diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a832c0a0aff..59b9a73ec9b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -101,7 +101,7 @@ jobs:
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1
-      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
         with:
           save-if: ${{ github.event_name != 'pull_request' }}
       - name: Format check
@@ -123,7 +123,7 @@ jobs:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1
       - uses: rui314/setup-mold@9c9c13bf4c3f1adef0cc596abc155580bcb04444 # v1
-      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
         with:
           save-if: ${{ github.event_name != 'pull_request' }}
       - name: Install cargo-nextest
@@ -147,7 +147,7 @@ jobs:
           fetch-depth: 2
       - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1
       - uses: rui314/setup-mold@9c9c13bf4c3f1adef0cc596abc155580bcb04444 # v1
-      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
         with:
           workspaces: desktop/src-tauri
           save-if: ${{ github.event_name != 'pull_request' }}
@@ -340,7 +340,7 @@ jobs:
           key: relay-artifacts-${{ runner.os }}-${{ hashFiles('crates/**', 'migrations/**', 'Dockerfile', 'Cargo.toml', 'Cargo.lock', 'rust-toolchain.toml', '.cargo/config.toml', '.github/workflows/ci.yml') }}
       - uses: rui314/setup-mold@9c9c13bf4c3f1adef0cc596abc155580bcb04444 # v1
         if: steps.relay-artifacts-cache.outputs.cache-hit != 'true'
-      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
         if: steps.relay-artifacts-cache.outputs.cache-hit != 'true'
         with:
           workspaces: |
@@ -763,7 +763,7 @@ jobs:
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1
-      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
         with:
           save-if: ${{ github.event_name != 'pull_request' }}
       # Reuse the relay + git-credential-nostr built by Desktop E2E Relay
@@ -952,7 +952,7 @@ jobs:
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1
-      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
         with:
           key: cross-${{ matrix.target }}
           save-if: ${{ github.event_name != 'pull_request' }}
@@ -993,7 +993,7 @@ jobs:
       # toolchain (1.95.0 + clippy via profile = default) comes from the
       # repo-root rust-toolchain.toml, which the runner's preinstalled rustup
       # honors on demand; the host triple already is x86_64-pc-windows-msvc.
-      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
         with:
           workspaces: |
             .
@@ -1070,7 +1070,7 @@ jobs:
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1
-      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
         with:
           workspaces: desktop/src-tauri
           save-if: ${{ github.event_name != 'pull_request' }}
diff --git a/.github/workflows/desktop-release-cache-proof.yml b/.github/workflows/desktop-release-cache-proof.yml
index cf9c8e78275..71436d00c36 100644
--- a/.github/workflows/desktop-release-cache-proof.yml
+++ b/.github/workflows/desktop-release-cache-proof.yml
@@ -67,7 +67,7 @@ jobs:
     name: Prove Linux cache visibility
     if: github.repository == 'block/buzz'
     runs-on: ubuntu-latest
-    container: ubuntu:24.04@sha256:4fbb8e6a8395de5a7550b33509421a2bafbc0aab6c06ba2cef9ebffbc7092d90
+    container: ubuntu:24.04@sha256:561618e2c15bf2397621dd04f96926663a3b5616c189cf7e38db7e82f5c538ea
     timeout-minutes: 15
     defaults:
       run:
diff --git a/.github/workflows/linux-canary.yml b/.github/workflows/linux-canary.yml
index d8b10032b2a..cdf8fe3bda7 100644
--- a/.github/workflows/linux-canary.yml
+++ b/.github/workflows/linux-canary.yml
@@ -21,7 +21,7 @@ jobs:
     name: Build Linux canary
     if: github.repository == 'block/buzz'
     runs-on: ubuntu-latest
-    container: ubuntu:24.04@sha256:4fbb8e6a8395de5a7550b33509421a2bafbc0aab6c06ba2cef9ebffbc7092d90
+    container: ubuntu:24.04@sha256:561618e2c15bf2397621dd04f96926663a3b5616c189cf7e38db7e82f5c538ea
     timeout-minutes: 60
     permissions:
       contents: read
diff --git a/.github/workflows/mesh-lifecycle.yml b/.github/workflows/mesh-lifecycle.yml
index 4780083ba49..b5f9660dfe3 100644
--- a/.github/workflows/mesh-lifecycle.yml
+++ b/.github/workflows/mesh-lifecycle.yml
@@ -55,7 +55,7 @@ jobs:
 
       - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1
 
-      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
         with:
           save-if: ${{ github.event_name != 'pull_request' }}
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2b0eb25c688..cc8147515a1 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -428,7 +428,7 @@ jobs:
     if: github.repository == 'block/buzz'
     runs-on: ubuntu-latest
     # Digest-pinned like the SHA-pinned actions below; Renovate keeps it fresh.
-    container: ubuntu:24.04@sha256:4fbb8e6a8395de5a7550b33509421a2bafbc0aab6c06ba2cef9ebffbc7092d90
+    container: ubuntu:24.04@sha256:561618e2c15bf2397621dd04f96926663a3b5616c189cf7e38db7e82f5c538ea
     needs: setup
     timeout-minutes: 60
     permissions:
@@ -511,7 +511,7 @@ jobs:
 
       - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1
 
-      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
         with:
           workspaces: desktop/src-tauri
           lookup-only: true
diff --git a/.release/desktop-candidate.json b/.release/desktop-candidate.json
index 3920dfeb44f..784725b2e6f 100644
--- a/.release/desktop-candidate.json
+++ b/.release/desktop-candidate.json
@@ -1,10 +1,10 @@
 {
   "schema": 2,
-  "version": "0.5.17",
-  "base_sha": "3fdf289b78c40f80abce86575c25b5ed6361d82c",
-  "previous_tag": "desktop-v0.5.16",
-  "previous_base_sha": "ee992ff0822f44d1c308822f116cb9d26f9a3386",
-  "previous_merge_sha": "978e585e8df893fe55aded854de07996b9412678",
-  "tag": "desktop-v0.5.17",
-  "commit_count": 5
+  "version": "0.5.18",
+  "base_sha": "aea0ef8df9fc24d9aa8bf5c761ab2910026a601b",
+  "previous_tag": "desktop-v0.5.17",
+  "previous_base_sha": "3fdf289b78c40f80abce86575c25b5ed6361d82c",
+  "previous_merge_sha": "8232299cbe6d90692fac3de46cde0ec123edd6c1",
+  "tag": "desktop-v0.5.18",
+  "commit_count": 66
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index bec9b9324e5..42fc482515e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,81 @@
 # Changelog
 
+## v0.5.18
+
+### Desktop and shared changes
+
+- fix(desktop): simplify duplicate agent provenance ([#6401](https://github.com/block/buzz/pull/6401)) ([`aea0ef8df9fc24d9aa8bf5c761ab2910026a601b`](https://github.com/block/buzz/commit/aea0ef8df9fc24d9aa8bf5c761ab2910026a601b))
+- fix(desktop): sender names in notifications + macOS click-through routing ([#6427](https://github.com/block/buzz/pull/6427)) ([`4e3c9e619c93dd26677b392ad1f8cf0d12c8f855`](https://github.com/block/buzz/commit/4e3c9e619c93dd26677b392ad1f8cf0d12c8f855))
+- polish(desktop): finish Projects navigation and context chrome ([#6429](https://github.com/block/buzz/pull/6429)) ([`9b32e055fed45864e1982f3d99c5402ba35cd8a6`](https://github.com/block/buzz/commit/9b32e055fed45864e1982f3d99c5402ba35cd8a6))
+- fix(desktop): clarify add agents channel action ([#6374](https://github.com/block/buzz/pull/6374)) ([`9891e64f6b8358d78aa85f2ba248310d58b51ec0`](https://github.com/block/buzz/commit/9891e64f6b8358d78aa85f2ba248310d58b51ec0))
+- feat(desktop-messages): show compact Buzz link metadata ([#6252](https://github.com/block/buzz/pull/6252)) ([`de8a2741c7598c27e0d27cd4562d76b947934e2f`](https://github.com/block/buzz/commit/de8a2741c7598c27e0d27cd4562d76b947934e2f))
+- feat(workflows): reply in-thread from send_message action ([#6178](https://github.com/block/buzz/pull/6178)) ([`c6e3fe7dfa751096d8c4083aaf15d6f6af296572`](https://github.com/block/buzz/commit/c6e3fe7dfa751096d8c4083aaf15d6f6af296572))
+- perf(desktop): split discover_acp_providers into cheap and forced paths ([#6330](https://github.com/block/buzz/pull/6330)) ([`c63ac746cd4622e043574c305ff54021b07b847b`](https://github.com/block/buzz/commit/c63ac746cd4622e043574c305ff54021b07b847b))
+- fix(desktop): restore recent channel sorting ([#6402](https://github.com/block/buzz/pull/6402)) ([`569308c23c9c2bf620dd3a9a5e4baecbcfa22e16`](https://github.com/block/buzz/commit/569308c23c9c2bf620dd3a9a5e4baecbcfa22e16))
+- fix(desktop): isolate main timeline stacking context from focus drawer ([#6398](https://github.com/block/buzz/pull/6398)) ([`b298a175c4b9da1638f84c1f287e42d16a690a61`](https://github.com/block/buzz/commit/b298a175c4b9da1638f84c1f287e42d16a690a61))
+- fix(desktop): make reconnect repair lossless ([#6415](https://github.com/block/buzz/pull/6415)) ([`06e8be9098f099ff9036cfbe637390d5ac982809`](https://github.com/block/buzz/commit/06e8be9098f099ff9036cfbe637390d5ac982809))
+- perf(desktop): resolve references without directory scans ([#6328](https://github.com/block/buzz/pull/6328)) ([`54bbe7305b9ec82a6ac03f84ff5887f77858c0b6`](https://github.com/block/buzz/commit/54bbe7305b9ec82a6ac03f84ff5887f77858c0b6))
+- feat(llm): stamp thinking effort on call-completed log line ([#6424](https://github.com/block/buzz/pull/6424)) ([`b728a2af3197db52e2d847b095f27209f99dc977`](https://github.com/block/buzz/commit/b728a2af3197db52e2d847b095f27209f99dc977))
+- Fix cross-owner relay agent mentions in owner-only builds ([#6338](https://github.com/block/buzz/pull/6338)) ([`ee0c7076af83fe9e2aafdc1baf4113ad988f53bd`](https://github.com/block/buzz/commit/ee0c7076af83fe9e2aafdc1baf4113ad988f53bd))
+- feat(workflows): add workflow editor ([#6248](https://github.com/block/buzz/pull/6248)) ([`1934e83bf5a5d8cd00f0cf28b558547b8d0dffb0`](https://github.com/block/buzz/commit/1934e83bf5a5d8cd00f0cf28b558547b8d0dffb0))
+- fix(desktop): preserve huddle speech boundaries ([#6397](https://github.com/block/buzz/pull/6397)) ([`7ebe3ea699a24b2f95573b88db8f8fe5f1187eb4`](https://github.com/block/buzz/commit/7ebe3ea699a24b2f95573b88db8f8fe5f1187eb4))
+- test(desktop): use a wordlist-safe separator in passphrase word-count test ([#6356](https://github.com/block/buzz/pull/6356)) ([`886cef7f723a539c4026d12e6a0605062bf2208b`](https://github.com/block/buzz/commit/886cef7f723a539c4026d12e6a0605062bf2208b))
+- fix(models): curate Databricks alias-aware labels for 5 missing endpoints ([#6360](https://github.com/block/buzz/pull/6360)) ([`2ce8df8533d8c8598ab3d7a2faa797f8b5ee2eea`](https://github.com/block/buzz/commit/2ce8df8533d8c8598ab3d7a2faa797f8b5ee2eea))
+- feat(desktop): refine context-aware Projects collaboration ([#6396](https://github.com/block/buzz/pull/6396)) ([`3c228b1082a93aca302c7b6a67ec274c51ed5eaf`](https://github.com/block/buzz/commit/3c228b1082a93aca302c7b6a67ec274c51ed5eaf))
+- fix(desktop): distinguish duplicate agent devices ([#6337](https://github.com/block/buzz/pull/6337)) ([`2e7583bf5ad5926ca32367af9954bc79d108e42d`](https://github.com/block/buzz/commit/2e7583bf5ad5926ca32367af9954bc79d108e42d))
+- feat(desktop): close Buzz window with Cmd+W ([#6314](https://github.com/block/buzz/pull/6314)) ([`e5d1dfef7bf24ad527c9c8c1785b613abad574f7`](https://github.com/block/buzz/commit/e5d1dfef7bf24ad527c9c8c1785b613abad574f7))
+- feat(desktop): make Projects workspaces selectable ([#6368](https://github.com/block/buzz/pull/6368)) ([`2b7be9340dd0785bd04795d55e004a6dfedd4998`](https://github.com/block/buzz/commit/2b7be9340dd0785bd04795d55e004a6dfedd4998))
+- feat(desktop): make the Projects overview follow the selected section ([#6335](https://github.com/block/buzz/pull/6335)) ([`f88cda9eb886500ec7d205e1d265ac6f654aa433`](https://github.com/block/buzz/commit/f88cda9eb886500ec7d205e1d265ac6f654aa433))
+- refactor(desktop): coordinate TTS playback ([#6341](https://github.com/block/buzz/pull/6341)) ([`09718fbb60c1acd5a4c1aff1bd91248008977129`](https://github.com/block/buzz/commit/09718fbb60c1acd5a4c1aff1bd91248008977129))
+- fix(desktop): show complete repository trees ([#5102](https://github.com/block/buzz/pull/5102)) ([`9c2f05346fdf3f058e4c579f6eea03dbe65fcca4`](https://github.com/block/buzz/commit/9c2f05346fdf3f058e4c579f6eea03dbe65fcca4))
+- Add appearance preference previews ([#6193](https://github.com/block/buzz/pull/6193)) ([`9a1e861ab8507ee28e5f03010b7f36d1b74ec919`](https://github.com/block/buzz/commit/9a1e861ab8507ee28e5f03010b7f36d1b74ec919))
+- fix(desktop): restore emoji recents ([#6263](https://github.com/block/buzz/pull/6263)) ([`f96f1883c5ad94825d43a856e5d25e307a0540cb`](https://github.com/block/buzz/commit/f96f1883c5ad94825d43a856e5d25e307a0540cb))
+- perf(desktop): move five hot renderer paths from JS into Rust ([#6024](https://github.com/block/buzz/pull/6024)) ([`bbd20fae75ecc3bd7a83cc12a65379fac22a2b79`](https://github.com/block/buzz/commit/bbd20fae75ecc3bd7a83cc12a65379fac22a2b79))
+- fix(media): accept portrait video resolutions ([#6058](https://github.com/block/buzz/pull/6058)) ([`196d62f97c21d053ddf8715d75ef57e92bd0051f`](https://github.com/block/buzz/commit/196d62f97c21d053ddf8715d75ef57e92bd0051f))
+- fix(desktop): hide archived channels from #/Tab autocomplete ([#6156](https://github.com/block/buzz/pull/6156)) ([`fe7c6808e7430d185498178e07e58e378d2e4c7d`](https://github.com/block/buzz/commit/fe7c6808e7430d185498178e07e58e378d2e4c7d))
+- fix(desktop): morph the drawer panel icon instead of sliding it ([#6306](https://github.com/block/buzz/pull/6306)) ([`e5a6e2022fb59c3928b054bc8d51874465fbe3df`](https://github.com/block/buzz/commit/e5a6e2022fb59c3928b054bc8d51874465fbe3df))
+- feat(desktop): refine repository-aware project workspaces ([#6003](https://github.com/block/buzz/pull/6003)) ([`87f8ff82ae5d3fdd99831c62a869b39138e65a57`](https://github.com/block/buzz/commit/87f8ff82ae5d3fdd99831c62a869b39138e65a57))
+- perf(desktop): parallelize relay agent directory rebuild ([#6258](https://github.com/block/buzz/pull/6258)) ([`a362fecc2389955f942c9581bdfeba379ab115b3`](https://github.com/block/buzz/commit/a362fecc2389955f942c9581bdfeba379ab115b3))
+- fix(desktop): exclude archived agents from nest, order regeneration ([#5905](https://github.com/block/buzz/pull/5905)) ([`121e4b3ce7acab6ac310257f444997f58a97cb2e`](https://github.com/block/buzz/commit/121e4b3ce7acab6ac310257f444997f58a97cb2e))
+- Add font size and conversation density preferences ([#5644](https://github.com/block/buzz/pull/5644)) ([`7e2651791d598a3938ef4560a41801223fb9b2c9`](https://github.com/block/buzz/commit/7e2651791d598a3938ef4560a41801223fb9b2c9))
+- fix(desktop): emit camelCase config-write payload fields ([#6062](https://github.com/block/buzz/pull/6062)) ([`6e8d078ffe1ab27b8dde6bb697551b7d2d1a85b5`](https://github.com/block/buzz/commit/6e8d078ffe1ab27b8dde6bb697551b7d2d1a85b5))
+- fix(desktop): downscale large avatars for agent-share PNG body ([#6260](https://github.com/block/buzz/pull/6260)) ([`e2ade93f02f6d1b4db23e0c442a2c65608e54d36`](https://github.com/block/buzz/commit/e2ade93f02f6d1b4db23e0c442a2c65608e54d36))
+- fix(desktop): preserve early relay auth challenges ([#3320](https://github.com/block/buzz/pull/3320)) ([`6ea7a2b2211438359b227a9991cf8ccad2927fe2`](https://github.com/block/buzz/commit/6ea7a2b2211438359b227a9991cf8ccad2927fe2))
+- feat(managed-agents): close five Claude Code agent-config gaps ([#4557](https://github.com/block/buzz/pull/4557)) ([`50a71137e6f1c56f66e2f7348a917b2d2a1798f0`](https://github.com/block/buzz/commit/50a71137e6f1c56f66e2f7348a917b2d2a1798f0))
+- fix(shared-ui): delay hover disclosures by default ([#5821](https://github.com/block/buzz/pull/5821)) ([`d7e8fdb10ca5e055b7af6d22f67d9a8f42cec8ed`](https://github.com/block/buzz/commit/d7e8fdb10ca5e055b7af6d22f67d9a8f42cec8ed))
+- fix(desktop-chrome): preserve balanced layout when sidebar collapses ([#6000](https://github.com/block/buzz/pull/6000)) ([`c442a90a176845e3989436f2bb24eb6d0ca79d47`](https://github.com/block/buzz/commit/c442a90a176845e3989436f2bb24eb6d0ca79d47))
+
+### Other repository changes
+
+- test(benchmarks): expand Buzz-native dataset ([#6448](https://github.com/block/buzz/pull/6448)) ([`b56a52ca11296b86ee41c41278a1169f92f245b6`](https://github.com/block/buzz/commit/b56a52ca11296b86ee41c41278a1169f92f245b6))
+- docs: clarify two-layer moderation ownership ([#6481](https://github.com/block/buzz/pull/6481)) ([`8740a1fa94dd14a3eb5cd2a570b0be2c4a68cbfe`](https://github.com/block/buzz/commit/8740a1fa94dd14a3eb5cd2a570b0be2c4a68cbfe))
+- Fix mobile thread tail and iOS channel header ([#6399](https://github.com/block/buzz/pull/6399)) ([`ffb12d3b05fe1ebd62006dbcd2f079be4e210b70`](https://github.com/block/buzz/commit/ffb12d3b05fe1ebd62006dbcd2f079be4e210b70))
+- chore(deps): pin earshot below 1.2.0 pending a VAD threshold re-pick ([#6392](https://github.com/block/buzz/pull/6392)) ([`2edacde4d4c01490834725774aa878dbc373c41d`](https://github.com/block/buzz/commit/2edacde4d4c01490834725774aa878dbc373c41d))
+- Repair stale large channel roster snapshots ([#6251](https://github.com/block/buzz/pull/6251)) ([`24ec6a468ec9d0d425ee58fbfc4d416412c446ad`](https://github.com/block/buzz/commit/24ec6a468ec9d0d425ee58fbfc4d416412c446ad))
+- fix(hooks): scope pre-push lanes to branch merge-base diff ([#6423](https://github.com/block/buzz/pull/6423)) ([`cd0d33f08507d07c8e8b8511bba92290c046ef03`](https://github.com/block/buzz/commit/cd0d33f08507d07c8e8b8511bba92290c046ef03))
+- Enforce a three-day dependency cooldown ([#6426](https://github.com/block/buzz/pull/6426)) ([`3ee465e12b815a191d902856440e2f3348bda506`](https://github.com/block/buzz/commit/3ee465e12b815a191d902856440e2f3348bda506))
+- feat(cli): accept Buzz message links for thread reads ([#6359](https://github.com/block/buzz/pull/6359)) ([`84c095f8bea14b55373e2d867100abe37aa6061e`](https://github.com/block/buzz/commit/84c095f8bea14b55373e2d867100abe37aa6061e))
+- fix(acp): guard against unrequested public relay skills ([#6394](https://github.com/block/buzz/pull/6394)) ([`d274a6e94928d64e27648f75320ab8af961396da`](https://github.com/block/buzz/commit/d274a6e94928d64e27648f75320ab8af961396da))
+- refactor(prompt): simplify Buzz agent guidance ([#6340](https://github.com/block/buzz/pull/6340)) ([`2a236e413723f207c2f6c1e8921fab4f071d0445`](https://github.com/block/buzz/commit/2a236e413723f207c2f6c1e8921fab4f071d0445))
+- Add Buzz-native collaboration benchmarks ([#6264](https://github.com/block/buzz/pull/6264)) ([`a9640c7cc4d55b0a0ac987aab4af02a204009d19`](https://github.com/block/buzz/commit/a9640c7cc4d55b0a0ac987aab4af02a204009d19))
+- Polish mobile timeline and emoji interactions ([#6297](https://github.com/block/buzz/pull/6297)) ([`da818eddc2f470c006a1073c8c5452f8a989f272`](https://github.com/block/buzz/commit/da818eddc2f470c006a1073c8c5452f8a989f272))
+- chore: serialize mobile pre-push checks ([#6322](https://github.com/block/buzz/pull/6322)) ([`81567b76a5d164b052c4e8526f453cf7a6ef43dc`](https://github.com/block/buzz/commit/81567b76a5d164b052c4e8526f453cf7a6ef43dc))
+- fix(buzz-acp): loosen workspace-scan guardrail to allow named paths ([#6261](https://github.com/block/buzz/pull/6261)) ([`934f3325c3fdaa3a6f23134b74518139aac8ca3f`](https://github.com/block/buzz/commit/934f3325c3fdaa3a6f23134b74518139aac8ca3f))
+- fix(buzz-dev-mcp): expand leading ~ in read_file/str_replace paths ([#6271](https://github.com/block/buzz/pull/6271)) ([`7f69b13b4586acedf6d898edf1be2a6babea3626`](https://github.com/block/buzz/commit/7f69b13b4586acedf6d898edf1be2a6babea3626))
+- Unify mobile channel details ([#6113](https://github.com/block/buzz/pull/6113)) ([`a567dfc2df870878dcf079550502a09a89cc8091`](https://github.com/block/buzz/commit/a567dfc2df870878dcf079550502a09a89cc8091))
+- Revert "fix(acp): gate relay-signed workflow messages on their attributed author" ([#6311](https://github.com/block/buzz/pull/6311)) ([`08eb46ef3c0894baa7e48d9229f45349751a4a57`](https://github.com/block/buzz/commit/08eb46ef3c0894baa7e48d9229f45349751a4a57))
+- Fix mobile Activity thread navigation ([#5850](https://github.com/block/buzz/pull/5850)) ([`93114c9c65138397de39729fde0a816eb9f314ab`](https://github.com/block/buzz/commit/93114c9c65138397de39729fde0a816eb9f314ab))
+- Refine the mobile emoji picker ([#5853](https://github.com/block/buzz/pull/5853)) ([`359fe646758d253ee94bf054a87904efd1dce7d1`](https://github.com/block/buzz/commit/359fe646758d253ee94bf054a87904efd1dce7d1))
+- Polish mobile message actions ([#5873](https://github.com/block/buzz/pull/5873)) ([`78267b0c3a75840d035ff0cc9ad1984def773886`](https://github.com/block/buzz/commit/78267b0c3a75840d035ff0cc9ad1984def773886))
+- Refine mobile pairing confirmation ([#6018](https://github.com/block/buzz/pull/6018)) ([`40f1dac6913d04c87d72610a69ed53bd12377b84`](https://github.com/block/buzz/commit/40f1dac6913d04c87d72610a69ed53bd12377b84))
+- chore(scripts): add buzz-adopt-prod-agents.sh ([#6250](https://github.com/block/buzz/pull/6250)) ([`4f9727a4b3d76389f862faa15241e16e2dd36108`](https://github.com/block/buzz/commit/4f9727a4b3d76389f862faa15241e16e2dd36108))
+- chore(hooks): keep mobile analysis out of pre-commit ([#6236](https://github.com/block/buzz/pull/6236)) ([`b74700daafa823e56c60b4e6470740ab28330888`](https://github.com/block/buzz/commit/b74700daafa823e56c60b4e6470740ab28330888))
+- Polish mobile timeline navigation ([#5874](https://github.com/block/buzz/pull/5874)) ([`417eea2230c1864e8c77f6440dbcfa109bfb63f6`](https://github.com/block/buzz/commit/417eea2230c1864e8c77f6440dbcfa109bfb63f6))
+- fix(prompt): simplify pickup follow-through ([#6186](https://github.com/block/buzz/pull/6186)) ([`d2cfd377e27dab8fdef0236dd8e92c89efbae829`](https://github.com/block/buzz/commit/d2cfd377e27dab8fdef0236dd8e92c89efbae829))
+- fix(mcp): scope todo usage ([#6216](https://github.com/block/buzz/pull/6216)) ([`5694e78def8b6ea674e101c1c988a5f17c9baf9d`](https://github.com/block/buzz/commit/5694e78def8b6ea674e101c1c988a5f17c9baf9d))
+
+[Compare desktop-v0.5.17...desktop-v0.5.18](https://github.com/block/buzz/compare/desktop-v0.5.17...desktop-v0.5.18)
+
 ## v0.5.17
 
 ### Desktop and shared changes
diff --git a/Cargo.lock b/Cargo.lock
index 16d86d0206f..18c53c18ca0 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -329,9 +329,9 @@ checksum = "8b75356056920673b02621b35afd0f7dda9306d03c79a30f5c56c44cf256e3de"
 
 [[package]]
 name = "async-trait"
-version = "0.1.91"
+version = "0.1.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ae36dc4177970ef04fde5178d3e2429882def40e57a451f919c098f72baa6cec"
+checksum = "82f6aeea286b8eb4dd3431a1be1b59d290ace00f5bfd8e2a159bc2a05e2c1667"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -3040,9 +3040,9 @@ checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c"
 
 [[package]]
 name = "futures"
-version = "0.3.32"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b147ee9d1f6d097cef9ce628cd2ee62288d963e16fb287bd9286455b241382d"
+checksum = "9a31d2a3fbaaeb2af2368bbdd904aa8e812d3c04a1ee10d3171f52d556e5d0a3"
 dependencies = [
  "futures-channel",
  "futures-core",
@@ -3068,9 +3068,9 @@ dependencies = [
 
 [[package]]
 name = "futures-channel"
-version = "0.3.32"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07bbe89c50d7a535e539b8c17bc0b49bdb77747034daa8087407d655f3f7cc1d"
+checksum = "b1f9e3d69d39e4862ffed03ed071a76f9a13ba1d9109d355b0f0aa6b15e393c4"
 dependencies = [
  "futures-core",
  "futures-sink",
@@ -3078,15 +3078,15 @@ dependencies = [
 
 [[package]]
 name = "futures-core"
-version = "0.3.32"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7e3450815272ef58cec6d564423f6e755e25379b217b0bc688e295ba24df6b1d"
+checksum = "92d699e522242e69e3003b94ecc1f960f3a5e015aa7c5d7486e65ad01dd94f5e"
 
 [[package]]
 name = "futures-executor"
-version = "0.3.32"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "baf29c38818342a3b26b5b923639e7b1f4a61fc5e76102d4b1981c6dc7a7579d"
+checksum = "031b47cf1a3c6cc8bc2fc76cd437f521619387907d469316e7c0bc278f1f5432"
 dependencies = [
  "futures-core",
  "futures-task",
@@ -3106,9 +3106,9 @@ dependencies = [
 
 [[package]]
 name = "futures-io"
-version = "0.3.32"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cecba35d7ad927e23624b22ad55235f2239cfa44fd10428eecbeba6d6a717718"
+checksum = "53c0fa8157de1303bfffdaa1cc2a673bfffb60102f76b0ef4441659124373fed"
 
 [[package]]
 name = "futures-lite"
@@ -3125,32 +3125,32 @@ dependencies = [
 
 [[package]]
 name = "futures-macro"
-version = "0.3.32"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e835b70203e41293343137df5c0664546da5745f82ec9b84d40be8336958447b"
+checksum = "9fb9654ba8355388abeb8dcb4fc62f511300867002afc858860463bdd9fe0c44"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 3.0.3",
 ]
 
 [[package]]
 name = "futures-sink"
-version = "0.3.32"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c39754e157331b013978ec91992bde1ac089843443c49cbc7f46150b0fad0893"
+checksum = "1944426bf7d03f1d14f708785e4b33efd750b36d48a157b836b3efc15ede8e1d"
 
 [[package]]
 name = "futures-task"
-version = "0.3.32"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "037711b3d59c33004d3856fbdc83b99d4ff37a24768fa1be9ce3538a1cde4393"
+checksum = "cd417de3d1d015fc3bfd2b1ea46dfc7bab72ef86f1cc7cc9c78e728b34a6d1fd"
 
 [[package]]
 name = "futures-util"
-version = "0.3.32"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "389ca41296e6190b48053de0321d02a77f32f8a5d2461dd38762c0593805c6d6"
+checksum = "0d50a92467f8ba5dd6e3ee5d4bd04d73ab2e4e1c44474a0674821dfce14b79bc"
 dependencies = [
  "futures-channel",
  "futures-core",
@@ -3617,9 +3617,9 @@ dependencies = [
 
 [[package]]
 name = "http"
-version = "1.4.0"
+version = "1.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3ba2a386d7f85a81f119ad7498ebe444d2e22c2af0b86b069416ace48b3311a"
+checksum = "6970f50e31d6fc17d3fa27329444bfa74e196cf62e95052a3f6fee181dba6425"
 dependencies = [
  "bytes",
  "itoa",
@@ -3637,9 +3637,9 @@ dependencies = [
 
 [[package]]
 name = "http-body-util"
-version = "0.1.3"
+version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b021d93e26becf5dc7e1b75b1bed1fd93124b374ceb73f43d4d4eafec896a64a"
+checksum = "23169fe34a5fbcdd3f3862e78fb9b6fccd5f02a6dc6f732547005d45631ce71c"
 dependencies = [
  "bytes",
  "futures-core",
diff --git a/VISION_MODERATION.md b/VISION_MODERATION.md
index 45d3ab86fd0..0b2e12cb597 100644
--- a/VISION_MODERATION.md
+++ b/VISION_MODERATION.md
@@ -14,7 +14,7 @@ Moderation splits the way it does on every serious platform:
 
 **Community moderation** — subjective, per-community rule enforcement. Your owners and admins decide what's spam in *your* community, what crosses *your* line, who gets a second chance. This layer belongs to the community and never reaches past it: an admin's authority ends at the community boundary, structurally, because every moderation decision is scoped to the tenant it was made in.
 
-**Platform safety** — the severe class: illegal content, network-level abuse, legal reporting obligations. That is never delegated to community admins. A community owner or admin can **escalate** a report upward, and the escalation is recorded durably for the platform operator's safety process. The community layer is the front line; the platform layer is the backstop.
+**Platform safety** — the severe class: illegal content, network-level abuse, legal reporting obligations. That is never delegated to community admins. A community owner or admin can **escalate** a report upward, and the escalation is recorded durably for the platform operator's safety process. The platform-safety layer belongs to whoever operates the relay. In a hosted multi-community deployment, that means the hosting platform's safety process; in a self-hosted deployment, it means the operator themselves, because the party hosting the content carries the legal accountability. The community layer is the front line; the platform layer is the backstop.
 
 This document is about the first layer. The second has its own lane.
 
@@ -54,7 +54,7 @@ This document is about the first layer. The second has its own lane.
 
 **Escalation is a hook today, not a pipeline.** Escalating writes a durable, queryable record for the platform operator — but the platform-side inbox that consumes it is a separate build. The substrate is there; the tooling above it comes next.
 
-**Two roles, not three.** Owners and admins moderate. There is no volunteer-moderator tier yet — deliberately. Authority is structured as capabilities, so adding a moderator tier later is a policy change, not a rewrite. We'd rather ship a loop that works and grow the org chart when communities ask for it.
+**Two roles, not three.** Owners and admins moderate. There is no volunteer-moderator tier yet — deliberately. Authority is structured as capabilities, so adding a moderator tier later is a policy change, not a rewrite. The relay/platform layer has its own operator-and-moderator roster, distinct from community owner and admin roles. We'd rather ship a loop that works and grow the org chart when communities ask for it.
 
 **Notices are best-effort.** The DMs that close the loop never block enforcement — a ban lands even if the notice fails. Enforcement is the promise; notification is the courtesy. A later platform-escalation pass should also make escalated reports say exactly that, instead of reusing the generic handled message.
 
diff --git a/benchmarks/buzz-dataset/README.md b/benchmarks/buzz-dataset/README.md
index 2909d0cd871..f5c8c8bb246 100644
--- a/benchmarks/buzz-dataset/README.md
+++ b/benchmarks/buzz-dataset/README.md
@@ -11,6 +11,11 @@ willing to read.
 | [`user-mention`](user-mention) | Hands the turn back with an event-level `p`-tag mention of the requesting human |
 | [`read-named-path-outside-workspace`](read-named-path-outside-workspace) | Reads a path the user named explicitly instead of refusing it as out of bounds |
 | [`create-channel-invite-users`](create-channel-invite-users) | Creates a channel with the exact shape, TTL, and membership asked for |
+| [`multiline-message`](multiline-message) | Preserves real newlines and blank-line structure through the CLI publish path |
+| [`narrative-agent-names`](narrative-agent-names) | Names agents in narrative without waking them through `p` tags |
+| [`interleaved-agent-reports`](interleaved-agent-reports) | Retains and synthesizes every report in a batch of agent messages |
+| [`cross-thread-requests`](cross-thread-requests) | Keeps simultaneous top-level requests isolated and replies to both exact threads |
+| [`ambiguous-user-mention`](ambiguous-user-mention) | Resolves duplicate display names and notifies only the intended pubkey |
 
 For `reply-to-thread` and `user-mention` the graded behavior is **deliberately
 absent from `instruction.md`** — it has to come from `buzz-acp`'s production
diff --git a/benchmarks/buzz-dataset/ambiguous-user-mention/README.md b/benchmarks/buzz-dataset/ambiguous-user-mention/README.md
new file mode 100644
index 00000000000..5f814cda987
--- /dev/null
+++ b/benchmarks/buzz-dataset/ambiguous-user-mention/README.md
@@ -0,0 +1,8 @@
+# ambiguous-user-mention
+
+The channel contains two real identities with the exact same three-word display
+name. Their profile `about` fields carry different routing codes. The agent must
+discover the intended pubkey, notify it exactly once, never notify the twin,
+and separately callback the requester. This guards the silent ambiguity family
+reported in [block/buzz#4303](https://github.com/block/buzz/issues/4303) and
+[block/buzz#6257](https://github.com/block/buzz/issues/6257).
diff --git a/benchmarks/buzz-dataset/ambiguous-user-mention/environment/Dockerfile b/benchmarks/buzz-dataset/ambiguous-user-mention/environment/Dockerfile
new file mode 100644
index 00000000000..29f16f3c412
--- /dev/null
+++ b/benchmarks/buzz-dataset/ambiguous-user-mention/environment/Dockerfile
@@ -0,0 +1,3 @@
+FROM python:3.12-slim-bookworm
+
+WORKDIR /app
diff --git a/benchmarks/buzz-dataset/ambiguous-user-mention/instruction.md b/benchmarks/buzz-dataset/ambiguous-user-mention/instruction.md
new file mode 100644
index 00000000000..761fd9caa57
--- /dev/null
+++ b/benchmarks/buzz-dataset/ambiguous-user-mention/instruction.md
@@ -0,0 +1,5 @@
+Two channel members are both displayed as `Taylor Morgan Lee`.
+
+Find the one whose profile says `Routing code ORCHID-72` and send that person
+the message `ORCHID-72 approved`. Do not notify the other Taylor Morgan Lee.
+Then tell me briefly that it was sent.
diff --git a/benchmarks/buzz-dataset/ambiguous-user-mention/task.toml b/benchmarks/buzz-dataset/ambiguous-user-mention/task.toml
new file mode 100644
index 00000000000..079507e0b4b
--- /dev/null
+++ b/benchmarks/buzz-dataset/ambiguous-user-mention/task.toml
@@ -0,0 +1,24 @@
+schema_version = "1.3"
+
+[task]
+name = "buzz-native/ambiguous-user-mention"
+description = "Resolve two identical display names by profile evidence and notify only the intended pubkey."
+authors = [{ name = "Buzz" }]
+keywords = ["buzz-native", "mentions", "identity", "ambiguity"]
+
+[metadata]
+difficulty = "hard"
+category = "collaboration"
+tags = ["mentions", "identity", "ambiguity", "cli"]
+
+[agent]
+timeout_sec = 300.0
+
+[verifier]
+timeout_sec = 30.0
+
+[environment]
+network_mode = "public"
+cpus = 1
+memory_mb = 1024
+storage_mb = 1024
diff --git a/benchmarks/buzz-dataset/ambiguous-user-mention/tests/test.sh b/benchmarks/buzz-dataset/ambiguous-user-mention/tests/test.sh
new file mode 100755
index 00000000000..79434035e3c
--- /dev/null
+++ b/benchmarks/buzz-dataset/ambiguous-user-mention/tests/test.sh
@@ -0,0 +1,5 @@
+#!/bin/sh
+set -eu
+
+mkdir -p /logs/verifier
+python3 /tests/verify.py --evidence /logs/artifacts/buzz-evidence.json --reward /logs/verifier/reward.json --details /logs/verifier/details.json
diff --git a/benchmarks/buzz-dataset/ambiguous-user-mention/tests/verify.py b/benchmarks/buzz-dataset/ambiguous-user-mention/tests/verify.py
new file mode 100755
index 00000000000..0efcb0dba62
--- /dev/null
+++ b/benchmarks/buzz-dataset/ambiguous-user-mention/tests/verify.py
@@ -0,0 +1,148 @@
+#!/usr/bin/env python3
+"""Deterministic verifier for a duplicate-display-name notification."""
+
+from __future__ import annotations
+
+import argparse
+import json
+from pathlib import Path
+from typing import Any
+
+TARGET_ID = "taylor-release-captain"
+OTHER_ID = "taylor-observer"
+
+
+def _zero() -> dict[str, float]:
+    return {
+        "reward": 0.0,
+        "target_notified_once": 0.0,
+        "other_not_notified": 0.0,
+        "message_correct": 0.0,
+        "user_callback": 0.0,
+        "reply_to_thread": 0.0,
+        "evidence_complete": 0.0,
+    }
+
+
+def score_evidence(evidence: object) -> tuple[dict[str, float], dict[str, Any]]:
+    if not isinstance(evidence, dict):
+        return _zero(), {"error": "evidence root is not an object"}
+    root = evidence.get("task_event_id")
+    directory = {
+        row.get("identity_id"): row
+        for row in evidence.get("directory", [])
+        if isinstance(row, dict)
+    }
+    target = directory.get(TARGET_ID, {})
+    other = directory.get(OTHER_ID, {})
+    identities = (
+        evidence.get("identities")
+        if isinstance(evidence.get("identities"), dict)
+        else {}
+    )
+    user = identities.get("Olivia Grace Park", {})
+    agents = [
+        row
+        for row in identities.values()
+        if isinstance(row, dict) and row.get("role") == "orchestrator"
+    ]
+    agent_pubkey = agents[0].get("pubkey") if len(agents) == 1 else None
+    messages = [row for row in evidence.get("messages", []) if isinstance(row, dict)]
+    authored = [
+        row for row in messages if agent_pubkey and row.get("pubkey") == agent_pubkey
+    ]
+    target_messages = [
+        row
+        for row in authored
+        if target.get("pubkey") in row.get("mentioned_pubkeys", [])
+    ]
+    other_messages = [
+        row
+        for row in authored
+        if other.get("pubkey") in row.get("mentioned_pubkeys", [])
+    ]
+    delivery = target_messages[0] if len(target_messages) == 1 else None
+    callbacks = [
+        row
+        for row in authored
+        if user.get("pubkey") in row.get("mentioned_pubkeys", [])
+        and row not in target_messages
+    ]
+    callback = callbacks[-1] if callbacks else None
+    target_notified_once = float(len(target_messages) == 1)
+    other_not_notified = float(len(other_messages) == 0)
+    message_correct = float(
+        delivery is not None
+        and "ORCHID-72 approved" in str(delivery.get("content", ""))
+    )
+    user_callback = float(
+        callback is not None
+        and any(
+            word in str(callback.get("content", "")).casefold()
+            for word in ("sent", "notified", "delivered")
+        )
+    )
+    reply_to_thread = float(
+        delivery is not None
+        and callback is not None
+        and delivery.get("reply_to_event_id") == root
+        and callback.get("reply_to_event_id") == root
+    )
+    evidence_complete = float(
+        evidence.get("schema_version") == 1
+        and evidence.get("task_name") == "ambiguous-user-mention"
+        and evidence.get("truncated") is False
+        and len(directory) == 2
+        and isinstance(target.get("pubkey"), str)
+        and isinstance(other.get("pubkey"), str)
+        and target.get("pubkey") != other.get("pubkey")
+        and len(agents) == 1
+    )
+    values = (
+        target_notified_once,
+        other_not_notified,
+        message_correct,
+        user_callback,
+        reply_to_thread,
+        evidence_complete,
+    )
+    metrics = {
+        "reward": float(all(value == 1.0 for value in values)),
+        "target_notified_once": target_notified_once,
+        "other_not_notified": other_not_notified,
+        "message_correct": message_correct,
+        "user_callback": user_callback,
+        "reply_to_thread": reply_to_thread,
+        "evidence_complete": evidence_complete,
+    }
+    return metrics, {
+        "target_pubkey": target.get("pubkey"),
+        "other_pubkey": other.get("pubkey"),
+        "delivery_message_id": delivery.get("id") if delivery else None,
+        "callback_message_id": callback.get("id") if callback else None,
+        "target_notification_count": len(target_messages),
+        "other_notification_count": len(other_messages),
+    }
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--evidence", type=Path, required=True)
+    parser.add_argument("--reward", type=Path, required=True)
+    parser.add_argument("--details", type=Path, required=True)
+    args = parser.parse_args()
+    try:
+        metrics, details = score_evidence(
+            json.loads(args.evidence.read_text(encoding="utf-8"))
+        )
+    except (OSError, json.JSONDecodeError) as error:
+        metrics, details = _zero(), {"error": str(error)}
+    args.reward.write_text(json.dumps(metrics, sort_keys=True) + "\n", encoding="utf-8")
+    args.details.write_text(
+        json.dumps(details, indent=2, sort_keys=True) + "\n", encoding="utf-8"
+    )
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/benchmarks/buzz-dataset/cross-thread-requests/README.md b/benchmarks/buzz-dataset/cross-thread-requests/README.md
new file mode 100644
index 00000000000..d7ed981c5f0
--- /dev/null
+++ b/benchmarks/buzz-dataset/cross-thread-requests/README.md
@@ -0,0 +1,9 @@
+# cross-thread-requests
+
+The harness posts ALPHA and BETA as separate top-level human mentions in the
+same channel before the queue flushes. Passing requires two different replies,
+each anchored to its own triggering event with only its own answer. This is a
+deliberately hard guard for the cross-thread contamination reported in
+[block/buzz#5839](https://github.com/block/buzz/issues/5839) and the exact
+reply-target contract in
+[block/buzz#4072](https://github.com/block/buzz/issues/4072).
diff --git a/benchmarks/buzz-dataset/cross-thread-requests/environment/Dockerfile b/benchmarks/buzz-dataset/cross-thread-requests/environment/Dockerfile
new file mode 100644
index 00000000000..29f16f3c412
--- /dev/null
+++ b/benchmarks/buzz-dataset/cross-thread-requests/environment/Dockerfile
@@ -0,0 +1,3 @@
+FROM python:3.12-slim-bookworm
+
+WORKDIR /app
diff --git a/benchmarks/buzz-dataset/cross-thread-requests/instruction.md b/benchmarks/buzz-dataset/cross-thread-requests/instruction.md
new file mode 100644
index 00000000000..160fad7d16d
--- /dev/null
+++ b/benchmarks/buzz-dataset/cross-thread-requests/instruction.md
@@ -0,0 +1,3 @@
+ALPHA request: calculate `(17 * 19) + 23`.
+
+Reply with the ALPHA result, labelled ALPHA.
diff --git a/benchmarks/buzz-dataset/cross-thread-requests/task.toml b/benchmarks/buzz-dataset/cross-thread-requests/task.toml
new file mode 100644
index 00000000000..14634fa2d5d
--- /dev/null
+++ b/benchmarks/buzz-dataset/cross-thread-requests/task.toml
@@ -0,0 +1,24 @@
+schema_version = "1.3"
+
+[task]
+name = "buzz-native/cross-thread-requests"
+description = "Keep two concurrent top-level requests in one channel isolated and reply to each exact thread."
+authors = [{ name = "Buzz" }]
+keywords = ["buzz-native", "threading", "batching", "concurrency"]
+
+[metadata]
+difficulty = "hard"
+category = "collaboration"
+tags = ["threading", "batching", "concurrency", "routing"]
+
+[agent]
+timeout_sec = 300.0
+
+[verifier]
+timeout_sec = 30.0
+
+[environment]
+network_mode = "public"
+cpus = 1
+memory_mb = 1024
+storage_mb = 1024
diff --git a/benchmarks/buzz-dataset/cross-thread-requests/tests/test.sh b/benchmarks/buzz-dataset/cross-thread-requests/tests/test.sh
new file mode 100755
index 00000000000..79434035e3c
--- /dev/null
+++ b/benchmarks/buzz-dataset/cross-thread-requests/tests/test.sh
@@ -0,0 +1,5 @@
+#!/bin/sh
+set -eu
+
+mkdir -p /logs/verifier
+python3 /tests/verify.py --evidence /logs/artifacts/buzz-evidence.json --reward /logs/verifier/reward.json --details /logs/verifier/details.json
diff --git a/benchmarks/buzz-dataset/cross-thread-requests/tests/verify.py b/benchmarks/buzz-dataset/cross-thread-requests/tests/verify.py
new file mode 100755
index 00000000000..7ba49e48f3f
--- /dev/null
+++ b/benchmarks/buzz-dataset/cross-thread-requests/tests/verify.py
@@ -0,0 +1,138 @@
+#!/usr/bin/env python3
+"""Deterministic verifier for isolation of two top-level requests."""
+
+from __future__ import annotations
+
+import argparse
+import json
+import re
+from pathlib import Path
+from typing import Any
+
+
+def _zero() -> dict[str, float]:
+    return {
+        "reward": 0.0,
+        "alpha_correct": 0.0,
+        "beta_correct": 0.0,
+        "thread_isolation": 0.0,
+        "user_mentioned_twice": 0.0,
+        "evidence_complete": 0.0,
+    }
+
+
+def _matches(message: dict[str, Any], label: str, value: int) -> bool:
+    content = str(message.get("content", ""))
+    return bool(re.search(rf"{label}\D+{value}(?:\D|$)", content, re.IGNORECASE))
+
+
+def score_evidence(evidence: object) -> tuple[dict[str, float], dict[str, Any]]:
+    if not isinstance(evidence, dict):
+        return _zero(), {"error": "evidence root is not an object"}
+    alpha_root = evidence.get("task_event_id")
+    scripts = [
+        row
+        for row in evidence.get("scripted_events", [])
+        if isinstance(row, dict) and row.get("label") == "beta-request"
+    ]
+    beta_root = scripts[0].get("event_id") if len(scripts) == 1 else None
+    identities = (
+        evidence.get("identities")
+        if isinstance(evidence.get("identities"), dict)
+        else {}
+    )
+    user = identities.get("Priya Simone Patel", {})
+    agents = [
+        row
+        for row in identities.values()
+        if isinstance(row, dict) and row.get("role") == "orchestrator"
+    ]
+    agent_pubkey = agents[0].get("pubkey") if len(agents) == 1 else None
+    messages = [row for row in evidence.get("messages", []) if isinstance(row, dict)]
+    candidates = [
+        row for row in messages if agent_pubkey and row.get("pubkey") == agent_pubkey
+    ]
+    alpha_replies = [
+        row
+        for row in candidates
+        if row.get("reply_to_event_id") == alpha_root and _matches(row, "ALPHA", 346)
+    ]
+    beta_replies = [
+        row
+        for row in candidates
+        if row.get("reply_to_event_id") == beta_root and _matches(row, "BETA", 41)
+    ]
+    alpha = alpha_replies[-1] if alpha_replies else None
+    beta = beta_replies[-1] if beta_replies else None
+    alpha_content = str(alpha.get("content", "")) if alpha else ""
+    beta_content = str(beta.get("content", "")) if beta else ""
+    alpha_correct = float(alpha is not None)
+    beta_correct = float(beta is not None)
+    thread_isolation = float(
+        alpha is not None
+        and beta is not None
+        and len(candidates) == 2
+        and alpha.get("id") != beta.get("id")
+        and "BETA" not in alpha_content.upper()
+        and "ALPHA" not in beta_content.upper()
+    )
+    user_mentioned_twice = float(
+        alpha is not None
+        and beta is not None
+        and user.get("pubkey") in alpha.get("mentioned_pubkeys", [])
+        and user.get("pubkey") in beta.get("mentioned_pubkeys", [])
+    )
+    evidence_complete = float(
+        evidence.get("schema_version") == 1
+        and evidence.get("task_name") == "cross-thread-requests"
+        and evidence.get("truncated") is False
+        and isinstance(alpha_root, str)
+        and isinstance(beta_root, str)
+        and len(agents) == 1
+    )
+    values = (
+        alpha_correct,
+        beta_correct,
+        thread_isolation,
+        user_mentioned_twice,
+        evidence_complete,
+    )
+    metrics = {
+        "reward": float(all(value == 1.0 for value in values)),
+        "alpha_correct": alpha_correct,
+        "beta_correct": beta_correct,
+        "thread_isolation": thread_isolation,
+        "user_mentioned_twice": user_mentioned_twice,
+        "evidence_complete": evidence_complete,
+    }
+    return metrics, {
+        "alpha_root": alpha_root,
+        "beta_root": beta_root,
+        "alpha_message_id": alpha.get("id") if alpha else None,
+        "beta_message_id": beta.get("id") if beta else None,
+        "alpha_content": alpha_content,
+        "beta_content": beta_content,
+    }
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--evidence", type=Path, required=True)
+    parser.add_argument("--reward", type=Path, required=True)
+    parser.add_argument("--details", type=Path, required=True)
+    args = parser.parse_args()
+    try:
+        metrics, details = score_evidence(
+            json.loads(args.evidence.read_text(encoding="utf-8"))
+        )
+    except (OSError, json.JSONDecodeError) as error:
+        metrics, details = _zero(), {"error": str(error)}
+    args.reward.write_text(json.dumps(metrics, sort_keys=True) + "\n", encoding="utf-8")
+    args.details.write_text(
+        json.dumps(details, indent=2, sort_keys=True) + "\n", encoding="utf-8"
+    )
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/benchmarks/buzz-dataset/interleaved-agent-reports/README.md b/benchmarks/buzz-dataset/interleaved-agent-reports/README.md
new file mode 100644
index 00000000000..a24a92fa0c4
--- /dev/null
+++ b/benchmarks/buzz-dataset/interleaved-agent-reports/README.md
@@ -0,0 +1,8 @@
+# interleaved-agent-reports
+
+Three signed bot identities publish independent reports immediately after the
+human request. The solo agent must retain every input, calculate 87, notify the
+human exactly once, and avoid waking the reporters again. The case exercises
+the batching/steering family reported in
+[block/buzz#5839](https://github.com/block/buzz/issues/5839) and
+[block/buzz#4942](https://github.com/block/buzz/issues/4942).
diff --git a/benchmarks/buzz-dataset/interleaved-agent-reports/environment/Dockerfile b/benchmarks/buzz-dataset/interleaved-agent-reports/environment/Dockerfile
new file mode 100644
index 00000000000..29f16f3c412
--- /dev/null
+++ b/benchmarks/buzz-dataset/interleaved-agent-reports/environment/Dockerfile
@@ -0,0 +1,3 @@
+FROM python:3.12-slim-bookworm
+
+WORKDIR /app
diff --git a/benchmarks/buzz-dataset/interleaved-agent-reports/instruction.md b/benchmarks/buzz-dataset/interleaved-agent-reports/instruction.md
new file mode 100644
index 00000000000..9221e0c2acf
--- /dev/null
+++ b/benchmarks/buzz-dataset/interleaved-agent-reports/instruction.md
@@ -0,0 +1,6 @@
+Three specialist agents will report separate inputs for a forecast. Wait until
+you have all three reports, then calculate:
+
+`(North + South - reserve) * multiplier`
+
+Send me one concise synthesis that labels all four inputs and the final value.
diff --git a/benchmarks/buzz-dataset/interleaved-agent-reports/task.toml b/benchmarks/buzz-dataset/interleaved-agent-reports/task.toml
new file mode 100644
index 00000000000..8bd320cb090
--- /dev/null
+++ b/benchmarks/buzz-dataset/interleaved-agent-reports/task.toml
@@ -0,0 +1,24 @@
+schema_version = "1.3"
+
+[task]
+name = "buzz-native/interleaved-agent-reports"
+description = "Aggregate multiple agent reports delivered together without losing an input or waking reporters again."
+authors = [{ name = "Buzz" }]
+keywords = ["buzz-native", "agents", "batching", "synthesis"]
+
+[metadata]
+difficulty = "hard"
+category = "collaboration"
+tags = ["agents", "batching", "synthesis", "mentions"]
+
+[agent]
+timeout_sec = 300.0
+
+[verifier]
+timeout_sec = 30.0
+
+[environment]
+network_mode = "public"
+cpus = 1
+memory_mb = 1024
+storage_mb = 1024
diff --git a/benchmarks/buzz-dataset/interleaved-agent-reports/tests/test.sh b/benchmarks/buzz-dataset/interleaved-agent-reports/tests/test.sh
new file mode 100755
index 00000000000..79434035e3c
--- /dev/null
+++ b/benchmarks/buzz-dataset/interleaved-agent-reports/tests/test.sh
@@ -0,0 +1,5 @@
+#!/bin/sh
+set -eu
+
+mkdir -p /logs/verifier
+python3 /tests/verify.py --evidence /logs/artifacts/buzz-evidence.json --reward /logs/verifier/reward.json --details /logs/verifier/details.json
diff --git a/benchmarks/buzz-dataset/interleaved-agent-reports/tests/verify.py b/benchmarks/buzz-dataset/interleaved-agent-reports/tests/verify.py
new file mode 100755
index 00000000000..b6b7dfc5244
--- /dev/null
+++ b/benchmarks/buzz-dataset/interleaved-agent-reports/tests/verify.py
@@ -0,0 +1,163 @@
+#!/usr/bin/env python3
+"""Deterministic verifier for aggregation of batched agent reports."""
+
+from __future__ import annotations
+
+import argparse
+import json
+import re
+from pathlib import Path
+from typing import Any
+
+REPORTERS = ("Ledger Scout", "Risk Sentinel", "Ops Forecaster")
+LABELS = {"ledger-report", "risk-report", "operations-report"}
+
+
+def _zero() -> dict[str, float]:
+    return {
+        "reward": 0.0,
+        "reports_delivered": 0.0,
+        "inputs_complete": 0.0,
+        "answer_correct": 0.0,
+        "single_human_callback": 0.0,
+        "reporters_not_rementioned": 0.0,
+        "reply_to_thread": 0.0,
+        "evidence_complete": 0.0,
+    }
+
+
+def score_evidence(evidence: object) -> tuple[dict[str, float], dict[str, Any]]:
+    if not isinstance(evidence, dict):
+        return _zero(), {"error": "evidence root is not an object"}
+    root = evidence.get("task_event_id")
+    identities = (
+        evidence.get("identities")
+        if isinstance(evidence.get("identities"), dict)
+        else {}
+    )
+    user = identities.get("Nora Isabel Grant", {})
+    agents = [
+        row
+        for row in identities.values()
+        if isinstance(row, dict) and row.get("role") == "orchestrator"
+    ]
+    agent_pubkey = agents[0].get("pubkey") if len(agents) == 1 else None
+    directory = {
+        row.get("name"): row
+        for row in evidence.get("directory", [])
+        if isinstance(row, dict)
+    }
+    reporter_pubkeys = {
+        directory[name].get("pubkey") for name in REPORTERS if name in directory
+    }
+    scripts = [
+        row for row in evidence.get("scripted_events", []) if isinstance(row, dict)
+    ]
+    script_ids = {row.get("event_id") for row in scripts if row.get("label") in LABELS}
+    messages = [row for row in evidence.get("messages", []) if isinstance(row, dict)]
+    delivered_ids = {row.get("id") for row in messages}
+    reports_delivered = float(
+        len(script_ids) == 3 and None not in script_ids and script_ids <= delivered_ids
+    )
+    candidates = [
+        row for row in messages if agent_pubkey and row.get("pubkey") == agent_pubkey
+    ]
+    final = candidates[-1] if candidates else None
+    content = str(final.get("content", "")) if final else ""
+    mentioned = set(final.get("mentioned_pubkeys", [])) if final else set()
+    inputs_complete = float(
+        all(
+            re.search(pattern, content, re.IGNORECASE)
+            for pattern in (
+                r"north\D+17",
+                r"south\D+23",
+                r"reserve\D+11",
+                r"multiplier\D+3",
+            )
+        )
+    )
+    answer_correct = float(
+        bool(
+            re.search(
+                r"(?:final|result|forecast|=)\D*87(?:\D|$)",
+                content,
+                re.IGNORECASE,
+            )
+        )
+    )
+    human_callbacks = [
+        row
+        for row in candidates
+        if user.get("pubkey") in row.get("mentioned_pubkeys", [])
+    ]
+    single_human_callback = float(
+        len(human_callbacks) == 1 and final in human_callbacks
+    )
+    reporters_not_rementioned = float(
+        len(reporter_pubkeys) == 3
+        and all(
+            set(row.get("mentioned_pubkeys", [])).isdisjoint(reporter_pubkeys)
+            and not any(f"@{name}" in str(row.get("content", "")) for name in REPORTERS)
+            for row in candidates
+        )
+    )
+    reply_to_thread = float(
+        final is not None and final.get("reply_to_event_id") == root
+    )
+    evidence_complete = float(
+        evidence.get("schema_version") == 1
+        and evidence.get("task_name") == "interleaved-agent-reports"
+        and evidence.get("truncated") is False
+        and len(agents) == 1
+        and len(directory) == 3
+        and final is not None
+        and len(candidates) == 1
+    )
+    values = (
+        reports_delivered,
+        inputs_complete,
+        answer_correct,
+        single_human_callback,
+        reporters_not_rementioned,
+        reply_to_thread,
+        evidence_complete,
+    )
+    metrics = {
+        "reward": float(all(value == 1.0 for value in values)),
+        "reports_delivered": reports_delivered,
+        "inputs_complete": inputs_complete,
+        "answer_correct": answer_correct,
+        "single_human_callback": single_human_callback,
+        "reporters_not_rementioned": reporters_not_rementioned,
+        "reply_to_thread": reply_to_thread,
+        "evidence_complete": evidence_complete,
+    }
+    return metrics, {
+        "scripted_event_ids": sorted(str(value) for value in script_ids),
+        "selected_message_id": final.get("id") if final else None,
+        "content": content,
+        "mentioned_pubkeys": sorted(mentioned),
+    }
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--evidence", type=Path, required=True)
+    parser.add_argument("--reward", type=Path, required=True)
+    parser.add_argument("--details", type=Path, required=True)
+    args = parser.parse_args()
+    try:
+        metrics, details = score_evidence(
+            json.loads(args.evidence.read_text(encoding="utf-8"))
+        )
+    except (OSError, json.JSONDecodeError) as error:
+        metrics, details = _zero(), {"error": str(error)}
+    args.reward.write_text(json.dumps(metrics, sort_keys=True) + "\n", encoding="utf-8")
+    args.details.write_text(
+        json.dumps(details, indent=2, sort_keys=True) + "\n", encoding="utf-8"
+    )
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/benchmarks/buzz-dataset/multiline-message/README.md b/benchmarks/buzz-dataset/multiline-message/README.md
new file mode 100644
index 00000000000..cb37089cfff
--- /dev/null
+++ b/benchmarks/buzz-dataset/multiline-message/README.md
@@ -0,0 +1,10 @@
+# multiline-message
+
+The agent sends a short release update whose blank lines and bullet boundaries
+must survive the `buzz messages send` shell call as real newline bytes. The
+verifier also checks the normal reply anchor and callback mention. This guards
+the first-newline truncation failure described in
+[block/buzz#5787](https://github.com/block/buzz/issues/5787).
+
+Run with the command in the parent [README](../README.md), replacing the task
+path with `benchmarks/buzz-dataset/multiline-message`.
diff --git a/benchmarks/buzz-dataset/multiline-message/environment/Dockerfile b/benchmarks/buzz-dataset/multiline-message/environment/Dockerfile
new file mode 100644
index 00000000000..29f16f3c412
--- /dev/null
+++ b/benchmarks/buzz-dataset/multiline-message/environment/Dockerfile
@@ -0,0 +1,3 @@
+FROM python:3.12-slim-bookworm
+
+WORKDIR /app
diff --git a/benchmarks/buzz-dataset/multiline-message/instruction.md b/benchmarks/buzz-dataset/multiline-message/instruction.md
new file mode 100644
index 00000000000..bf307c5fb52
--- /dev/null
+++ b/benchmarks/buzz-dataset/multiline-message/instruction.md
@@ -0,0 +1,11 @@
+Send me this release-readiness update, preserving the paragraph and list layout:
+
+Release readiness
+
+- API: ready
+- Database: ready
+- Rollback: tested
+
+Owner: Platform Operations
+
+Keep the response brief and do not add a table.
diff --git a/benchmarks/buzz-dataset/multiline-message/task.toml b/benchmarks/buzz-dataset/multiline-message/task.toml
new file mode 100644
index 00000000000..69f919f7c11
--- /dev/null
+++ b/benchmarks/buzz-dataset/multiline-message/task.toml
@@ -0,0 +1,24 @@
+schema_version = "1.3"
+
+[task]
+name = "buzz-native/multiline-message"
+description = "Deliver a multiline Buzz message without flattening or escaping its layout."
+authors = [{ name = "Buzz" }]
+keywords = ["buzz-native", "messaging", "multiline", "cli"]
+
+[metadata]
+difficulty = "medium"
+category = "collaboration"
+tags = ["messaging", "multiline", "cli"]
+
+[agent]
+timeout_sec = 300.0
+
+[verifier]
+timeout_sec = 30.0
+
+[environment]
+network_mode = "public"
+cpus = 1
+memory_mb = 1024
+storage_mb = 1024
diff --git a/benchmarks/buzz-dataset/multiline-message/tests/test.sh b/benchmarks/buzz-dataset/multiline-message/tests/test.sh
new file mode 100755
index 00000000000..3dd50814b6e
--- /dev/null
+++ b/benchmarks/buzz-dataset/multiline-message/tests/test.sh
@@ -0,0 +1,8 @@
+#!/bin/sh
+set -eu
+
+mkdir -p /logs/verifier
+python3 /tests/verify.py \
+  --evidence /logs/artifacts/buzz-evidence.json \
+  --reward /logs/verifier/reward.json \
+  --details /logs/verifier/details.json
diff --git a/benchmarks/buzz-dataset/multiline-message/tests/verify.py b/benchmarks/buzz-dataset/multiline-message/tests/verify.py
new file mode 100755
index 00000000000..afa34a6bd36
--- /dev/null
+++ b/benchmarks/buzz-dataset/multiline-message/tests/verify.py
@@ -0,0 +1,121 @@
+#!/usr/bin/env python3
+"""Deterministic verifier for multiline Buzz message delivery."""
+
+from __future__ import annotations
+
+import argparse
+import json
+from pathlib import Path
+from typing import Any
+
+EXPECTED = (
+    "Release readiness\n\n"
+    "- API: ready\n"
+    "- Database: ready\n"
+    "- Rollback: tested\n\n"
+    "Owner: Platform Operations"
+)
+
+
+def _zero() -> dict[str, float]:
+    return {
+        "reward": 0.0,
+        "layout_preserved": 0.0,
+        "real_newlines": 0.0,
+        "reply_to_thread": 0.0,
+        "user_mentioned": 0.0,
+        "evidence_complete": 0.0,
+    }
+
+
+def score_evidence(evidence: object) -> tuple[dict[str, float], dict[str, Any]]:
+    if not isinstance(evidence, dict):
+        return _zero(), {"error": "evidence root is not an object"}
+    root = evidence.get("task_event_id")
+    trial = evidence.get("trial") if isinstance(evidence.get("trial"), dict) else {}
+    identities = (
+        evidence.get("identities")
+        if isinstance(evidence.get("identities"), dict)
+        else {}
+    )
+    user = identities.get("Eleanor June Brooks", {})
+    agents = [
+        row
+        for row in identities.values()
+        if isinstance(row, dict) and row.get("role") == "orchestrator"
+    ]
+    agent_pubkey = agents[0].get("pubkey") if len(agents) == 1 else None
+    messages = [row for row in evidence.get("messages", []) if isinstance(row, dict)]
+    candidates = [
+        row for row in messages if agent_pubkey and row.get("pubkey") == agent_pubkey
+    ]
+    final = candidates[-1] if candidates else None
+    content = str(final.get("content", "")) if final else ""
+    tags = final.get("tags", []) if final else []
+    evidence_complete = float(
+        evidence.get("schema_version") == 1
+        and evidence.get("task_name") == "multiline-message"
+        and evidence.get("truncated") is False
+        and isinstance(root, str)
+        and isinstance(trial.get("channel_id"), str)
+        and len(agents) == 1
+        and isinstance(user.get("pubkey"), str)
+        and final is not None
+        and len(candidates) == 1
+    )
+    layout_preserved = float(EXPECTED in content)
+    real_newlines = float("\\n" not in content and content.count("\n") >= 6)
+    reply_to_thread = float(
+        final is not None and final.get("reply_to_event_id") == root
+    )
+    user_mentioned = float(
+        user.get("pubkey") in (final.get("mentioned_pubkeys", []) if final else [])
+    )
+    reward = float(
+        all(
+            value == 1.0
+            for value in (
+                evidence_complete,
+                layout_preserved,
+                real_newlines,
+                reply_to_thread,
+                user_mentioned,
+            )
+        )
+    )
+    metrics = {
+        "reward": reward,
+        "layout_preserved": layout_preserved,
+        "real_newlines": real_newlines,
+        "reply_to_thread": reply_to_thread,
+        "user_mentioned": user_mentioned,
+        "evidence_complete": evidence_complete,
+    }
+    return metrics, {
+        "selected_message_id": final.get("id") if final else None,
+        "content": content,
+        "tags": tags,
+    }
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--evidence", type=Path, required=True)
+    parser.add_argument("--reward", type=Path, required=True)
+    parser.add_argument("--details", type=Path, required=True)
+    args = parser.parse_args()
+    try:
+        metrics, details = score_evidence(
+            json.loads(args.evidence.read_text(encoding="utf-8"))
+        )
+    except (OSError, json.JSONDecodeError) as error:
+        metrics, details = _zero(), {"error": str(error)}
+    args.reward.write_text(json.dumps(metrics, sort_keys=True) + "\n", encoding="utf-8")
+    args.details.write_text(
+        json.dumps(details, indent=2, sort_keys=True) + "\n", encoding="utf-8"
+    )
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/benchmarks/buzz-dataset/narrative-agent-names/README.md b/benchmarks/buzz-dataset/narrative-agent-names/README.md
new file mode 100644
index 00000000000..f72a4ef3ccb
--- /dev/null
+++ b/benchmarks/buzz-dataset/narrative-agent-names/README.md
@@ -0,0 +1,7 @@
+# narrative-agent-names
+
+The agent reports status about two in-channel bots. Both names must remain
+plain narrative text: neither bot may receive a `p` tag or an `@Name` wake-up.
+The requesting human must still receive the callback mention. This guards the
+acknowledgement and false-wake behavior in
+[block/buzz#5176](https://github.com/block/buzz/issues/5176).
diff --git a/benchmarks/buzz-dataset/narrative-agent-names/environment/Dockerfile b/benchmarks/buzz-dataset/narrative-agent-names/environment/Dockerfile
new file mode 100644
index 00000000000..29f16f3c412
--- /dev/null
+++ b/benchmarks/buzz-dataset/narrative-agent-names/environment/Dockerfile
@@ -0,0 +1,3 @@
+FROM python:3.12-slim-bookworm
+
+WORKDIR /app
diff --git a/benchmarks/buzz-dataset/narrative-agent-names/instruction.md b/benchmarks/buzz-dataset/narrative-agent-names/instruction.md
new file mode 100644
index 00000000000..78c73109f3a
--- /dev/null
+++ b/benchmarks/buzz-dataset/narrative-agent-names/instruction.md
@@ -0,0 +1,6 @@
+Give me a two-line status update:
+
+- Aurora Audit Bot completed the audit.
+- Beacon Deploy Bot remains idle.
+
+This is only a status summary. Neither bot has any work to do.
diff --git a/benchmarks/buzz-dataset/narrative-agent-names/task.toml b/benchmarks/buzz-dataset/narrative-agent-names/task.toml
new file mode 100644
index 00000000000..09025e07231
--- /dev/null
+++ b/benchmarks/buzz-dataset/narrative-agent-names/task.toml
@@ -0,0 +1,24 @@
+schema_version = "1.3"
+
+[task]
+name = "buzz-native/narrative-agent-names"
+description = "Name agents in narrative without waking them through event mentions."
+authors = [{ name = "Buzz" }]
+keywords = ["buzz-native", "mentions", "agents", "notifications"]
+
+[metadata]
+difficulty = "medium"
+category = "collaboration"
+tags = ["mentions", "agents", "notifications"]
+
+[agent]
+timeout_sec = 300.0
+
+[verifier]
+timeout_sec = 30.0
+
+[environment]
+network_mode = "public"
+cpus = 1
+memory_mb = 1024
+storage_mb = 1024
diff --git a/benchmarks/buzz-dataset/narrative-agent-names/tests/test.sh b/benchmarks/buzz-dataset/narrative-agent-names/tests/test.sh
new file mode 100755
index 00000000000..79434035e3c
--- /dev/null
+++ b/benchmarks/buzz-dataset/narrative-agent-names/tests/test.sh
@@ -0,0 +1,5 @@
+#!/bin/sh
+set -eu
+
+mkdir -p /logs/verifier
+python3 /tests/verify.py --evidence /logs/artifacts/buzz-evidence.json --reward /logs/verifier/reward.json --details /logs/verifier/details.json
diff --git a/benchmarks/buzz-dataset/narrative-agent-names/tests/verify.py b/benchmarks/buzz-dataset/narrative-agent-names/tests/verify.py
new file mode 100755
index 00000000000..3759f13876f
--- /dev/null
+++ b/benchmarks/buzz-dataset/narrative-agent-names/tests/verify.py
@@ -0,0 +1,129 @@
+#!/usr/bin/env python3
+"""Deterministic verifier for non-notifying narrative agent names."""
+
+from __future__ import annotations
+
+import argparse
+import json
+import re
+from pathlib import Path
+from typing import Any
+
+BOT_NAMES = ("Aurora Audit Bot", "Beacon Deploy Bot")
+
+
+def _zero() -> dict[str, float]:
+    return {
+        "reward": 0.0,
+        "status_correct": 0.0,
+        "bots_not_mentioned": 0.0,
+        "user_mentioned": 0.0,
+        "reply_to_thread": 0.0,
+        "evidence_complete": 0.0,
+    }
+
+
+def score_evidence(evidence: object) -> tuple[dict[str, float], dict[str, Any]]:
+    if not isinstance(evidence, dict):
+        return _zero(), {"error": "evidence root is not an object"}
+    root = evidence.get("task_event_id")
+    identities = (
+        evidence.get("identities")
+        if isinstance(evidence.get("identities"), dict)
+        else {}
+    )
+    user = identities.get("Maya Elise Chen", {})
+    agents = [
+        row
+        for row in identities.values()
+        if isinstance(row, dict) and row.get("role") == "orchestrator"
+    ]
+    agent_pubkey = agents[0].get("pubkey") if len(agents) == 1 else None
+    directory = {
+        row.get("name"): row
+        for row in evidence.get("directory", [])
+        if isinstance(row, dict)
+    }
+    bot_pubkeys = {
+        directory[name].get("pubkey") for name in BOT_NAMES if name in directory
+    }
+    messages = [row for row in evidence.get("messages", []) if isinstance(row, dict)]
+    candidates = [
+        row for row in messages if agent_pubkey and row.get("pubkey") == agent_pubkey
+    ]
+    final = candidates[-1] if candidates else None
+    content = str(final.get("content", "")) if final else ""
+    mentioned = set(final.get("mentioned_pubkeys", [])) if final else set()
+    status_correct = float(
+        bool(re.search(r"Aurora Audit Bot[^.\n]*completed", content, re.IGNORECASE))
+        and bool(re.search(r"Beacon Deploy Bot[^.\n]*idle", content, re.IGNORECASE))
+    )
+    bots_not_mentioned = float(
+        len(bot_pubkeys) == 2
+        and all(
+            set(row.get("mentioned_pubkeys", [])).isdisjoint(bot_pubkeys)
+            and not any(f"@{name}" in str(row.get("content", "")) for name in BOT_NAMES)
+            for row in candidates
+        )
+    )
+    user_mentioned = float(user.get("pubkey") in mentioned)
+    reply_to_thread = float(
+        final is not None and final.get("reply_to_event_id") == root
+    )
+    evidence_complete = float(
+        evidence.get("schema_version") == 1
+        and evidence.get("task_name") == "narrative-agent-names"
+        and evidence.get("truncated") is False
+        and len(agents) == 1
+        and len(directory) == 2
+        and final is not None
+        and len(candidates) == 1
+    )
+    reward = float(
+        all(
+            value == 1.0
+            for value in (
+                status_correct,
+                bots_not_mentioned,
+                user_mentioned,
+                reply_to_thread,
+                evidence_complete,
+            )
+        )
+    )
+    metrics = {
+        "reward": reward,
+        "status_correct": status_correct,
+        "bots_not_mentioned": bots_not_mentioned,
+        "user_mentioned": user_mentioned,
+        "reply_to_thread": reply_to_thread,
+        "evidence_complete": evidence_complete,
+    }
+    return metrics, {
+        "selected_message_id": final.get("id") if final else None,
+        "content": content,
+        "mentioned_pubkeys": sorted(mentioned),
+    }
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--evidence", type=Path, required=True)
+    parser.add_argument("--reward", type=Path, required=True)
+    parser.add_argument("--details", type=Path, required=True)
+    args = parser.parse_args()
+    try:
+        metrics, details = score_evidence(
+            json.loads(args.evidence.read_text(encoding="utf-8"))
+        )
+    except (OSError, json.JSONDecodeError) as error:
+        metrics, details = _zero(), {"error": str(error)}
+    args.reward.write_text(json.dumps(metrics, sort_keys=True) + "\n", encoding="utf-8")
+    args.details.write_text(
+        json.dumps(details, indent=2, sort_keys=True) + "\n", encoding="utf-8"
+    )
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/benchmarks/harbor-buzz-orchestra/README.md b/benchmarks/harbor-buzz-orchestra/README.md
index b7df4a55579..bbc0b603805 100644
--- a/benchmarks/harbor-buzz-orchestra/README.md
+++ b/benchmarks/harbor-buzz-orchestra/README.md
@@ -66,10 +66,11 @@ artifacts) available for analysis.
 
 The local [`benchmarks/buzz-dataset`](../buzz-dataset) suite — a sibling
 directory of this harness, not a subdirectory of it — scores Buzz product
-behavior alongside task correctness. It currently covers direct thread replies, callback user
-mentions, targeted reads of user-named paths outside the workspace, and exact
-channel creation/membership. Run one task with the production base prompt from
-the checked-out source build:
+behavior alongside task correctness. It covers direct thread replies, callback
+user mentions, targeted reads of named paths, exact channel membership,
+multiline delivery, non-waking narrative names, batched reports, cross-thread
+isolation, and ambiguous identities. Run one task with the production base
+prompt from the checked-out source build:
 
 ```bash
 just benchmark \
@@ -108,6 +109,12 @@ or verifier. If the snapshot cannot be exported the trial **fails** rather than
 scoring 0 — a harness fault and a model fault stay distinguishable — and the
 cause is written to the trial's `buzz/buzz-evidence-error.txt`.
 
+Some tasks declare additional signed relay events. The provisioner creates
+their actors as normal channel identities and the runtime publishes the events
+through the production CLI immediately after the task message. Evidence exports
+only public actor metadata and event IDs; their signing credentials never enter
+the task container or verifier artifact.
+
 Each task ships its own `README.md` documenting its reward dimensions and, for
 the tasks whose graded Buzz behavior is deliberately absent from
 `instruction.md` (`reply-to-thread`, `user-mention`), why that omission is the
diff --git a/benchmarks/harbor-buzz-orchestra/src/harbor_buzz_orchestra/container_runtime.py b/benchmarks/harbor-buzz-orchestra/src/harbor_buzz_orchestra/container_runtime.py
index 756cbfa31f8..797e3a860c2 100644
--- a/benchmarks/harbor-buzz-orchestra/src/harbor_buzz_orchestra/container_runtime.py
+++ b/benchmarks/harbor-buzz-orchestra/src/harbor_buzz_orchestra/container_runtime.py
@@ -13,6 +13,7 @@
 import asyncio
 import json
 import os
+import re
 import shlex
 import traceback
 from dataclasses import dataclass, field
@@ -50,6 +51,9 @@
 # How many done-poll iterations between in-container liveness probes.
 LIVENESS_EVERY = 10
 TRANSCRIPT_LIMIT = 1000
+DELIVERY_RECEIPT_MARKER = "turn delivered Buzz events for channel"
+EVENT_ID_PATTERN = re.compile(r"(?<![0-9a-f])[0-9a-f]{64}(?![0-9a-f])")
+ANSI_ESCAPE_PATTERN = re.compile(r"\x1b\[[0-9;]*m")
 TURN_ENDED_MARKERS = (
     "turn complete for",
     "turn cancelled for",
@@ -138,6 +142,7 @@ async def run(
         agents: list[_Agent] = []
         infra: list[_Agent] = []
         task_event_id: str | None = None
+        scripted_events: list[dict[str, str | None]] = []
         final_message: dict[str, Any] | None = None
         evidence_exported = False
         try:
@@ -192,6 +197,11 @@ async def run(
                 task_event.get("event_id"), str
             ):
                 task_event_id = task_event["event_id"]
+            scripted_events = await self._send_scripted_messages(
+                trial=trial,
+                orchestrator=orchestrator,
+                task_event_id=task_event_id,
+            )
             final_message = await asyncio.wait_for(
                 self._wait_for_done(
                     environment,
@@ -199,6 +209,9 @@ async def run(
                     trial,
                     agents + infra,
                     solo=agents[0] if len(agents) == 1 else None,
+                    scripted_event_ids={
+                        str(event["event_id"]) for event in scripted_events
+                    },
                 ),
                 timeout=manifest.trial_budget.timeout_seconds,
             )
@@ -214,6 +227,7 @@ async def run(
                 completion_message_id=(
                     final_message.get("id") if final_message is not None else None
                 ),
+                scripted_events=scripted_events,
             )
 
         # A missing snapshot is a harness failure, not an agent failure: the
@@ -495,12 +509,13 @@ async def _wait_for_done(
         trial: TrialHandle,
         agents: list[_Agent],
         solo: _Agent | None = None,
+        scripted_event_ids: set[str] | frozenset[str] = frozenset(),
     ) -> dict[str, Any] | None:
-        """Observe until a team posts DONE or a solo agent finishes its one turn.
+        """Observe until a team posts DONE or a solo agent finishes its work.
 
         Observation only: the harness never speaks as any agent. If the team
         stalls, the trial times out and the stall is the measured result. A solo
-        agent cannot be woken by a teammate, so its logged turn end is final.
+        task without scripted events finishes at its first logged turn end.
         """
         polls = 0
         while True:
@@ -518,21 +533,71 @@ async def _wait_for_done(
                 "100",
             )
             for message in messages:
-                if message.get("pubkey") == orchestrator.nostr_pubkey and str(
-                    message.get("content", "")
-                ).startswith("DONE:"):
+                if (
+                    message.get("pubkey") == orchestrator.nostr_pubkey
+                    and str(message.get("content", "")).startswith("DONE:")
+                    and (solo is None or not scripted_event_ids)
+                ):
                     return message
-            if solo is not None and await self._turn_ended(environment, solo):
-                return None
+            if solo is not None:
+                starts, ends, delivered_event_ids = await self._turn_status(
+                    environment, solo
+                )
+                authored = [
+                    message
+                    for message in messages
+                    if message.get("pubkey") == orchestrator.nostr_pubkey
+                ]
+                if not scripted_event_ids and ends > 0:
+                    return authored[-1] if authored else None
+                if (
+                    starts > 0
+                    and starts == ends
+                    and scripted_event_ids <= delivered_event_ids
+                ):
+                    return authored[-1] if authored else None
             await asyncio.sleep(self.poll_seconds)
 
     @staticmethod
     async def _turn_ended(environment: BaseEnvironment, agent: _Agent) -> bool:
+        _, ends = await BuzzContainerRuntime._turn_counts(environment, agent)
+        return ends > 0
+
+    @staticmethod
+    async def _turn_counts(
+        environment: BaseEnvironment, agent: _Agent
+    ) -> tuple[int, int]:
+        starts, ends, _ = await BuzzContainerRuntime._turn_status(environment, agent)
+        return starts, ends
+
+    @staticmethod
+    async def _turn_status(
+        environment: BaseEnvironment, agent: _Agent
+    ) -> tuple[int, int, set[str]]:
         result = await environment.exec(
             f"cat {shlex.quote(agent.stdout_log)} "
             f"{shlex.quote(agent.stderr_log)} 2>/dev/null"
         )
-        return any(marker in (result.stdout or "") for marker in TURN_ENDED_MARKERS)
+        return BuzzContainerRuntime._parse_turn_status(result.stdout or "")
+
+    @staticmethod
+    def _parse_turn_status(output: str) -> tuple[int, int, set[str]]:
+        output = ANSI_ESCAPE_PATTERN.sub("", output)
+        delivered_event_ids: set[str] = set()
+        for line in output.splitlines():
+            if DELIVERY_RECEIPT_MARKER in line:
+                delivered_event_ids.update(EVENT_ID_PATTERN.findall(line))
+            elif (
+                "non-cancelling steer ack received" in line and "ack=Ok(Success" in line
+            ):
+                match = re.search(r"event_id=([0-9a-f]{64})", line)
+                if match is not None:
+                    delivered_event_ids.add(match.group(1))
+        return (
+            output.count("turn starting for"),
+            sum(output.count(marker) for marker in TURN_ENDED_MARKERS),
+            delivered_event_ids,
+        )
 
     async def _raise_for_dead_agents(
         self, environment: BaseEnvironment, agents: list[_Agent]
@@ -590,6 +655,7 @@ async def _collect_evidence(
         trial_dir: Path,
         task_event_id: str | None,
         completion_message_id: str | None,
+        scripted_events: list[dict[str, str | None]] | None = None,
     ) -> bool:
         """Snapshot public relay state for the verifier before trial teardown."""
         try:
@@ -611,6 +677,7 @@ async def _collect_evidence(
                 completion_message_id=completion_message_id,
                 transcript_limit=TRANSCRIPT_LIMIT,
                 observed_channels=observed_channels,
+                scripted_events=scripted_events,
             )
             evidence_path = trial_dir / "buzz-evidence.json"
             evidence_path.write_text(
@@ -726,6 +793,7 @@ async def _send(
         content: str,
         *,
         mention: str | None = None,
+        reply_to: str | None = None,
     ) -> Any:
         args = [
             "messages",
@@ -737,8 +805,69 @@ async def _send(
         ]
         if mention is not None:
             args += ["--mention", mention]
+        if reply_to is not None:
+            args += ["--reply-to", reply_to]
         return await self._buzz_json(credential, trial, *args)
 
+    async def _send_scripted_messages(
+        self,
+        *,
+        trial: TrialHandle,
+        orchestrator: AgentCredential,
+        task_event_id: str | None,
+    ) -> list[dict[str, str | None]]:
+        """Inject task-declared events through the production CLI.
+
+        Messages are sent back-to-back so Buzz's normal queueing and batching
+        decide how the agent sees them. The verifier receives only public event
+        metadata; fixture signing keys stay inside the runtime handle.
+        """
+        fixture = fixture_for(trial.task_name)
+        if not fixture.scripted_messages:
+            return []
+        actors = {actor.identity_id: actor.credential for actor in trial.fixture_actors}
+        recorded: list[dict[str, str | None]] = []
+        for message in fixture.scripted_messages:
+            try:
+                actor = trial.user if message.actor == "user" else actors[message.actor]
+            except KeyError as error:
+                raise RuntimeLaunchError(
+                    f"scripted actor {message.actor!r} has no fixture credential"
+                ) from error
+            content = message.content.replace(
+                "{orchestrator}", orchestrator.agent_id
+            ).replace("{user}", trial.user.agent_id)
+            response = await self._send(
+                actor,
+                trial,
+                content,
+                mention=(
+                    orchestrator.nostr_pubkey if message.mention_orchestrator else None
+                ),
+                reply_to=(task_event_id if message.reply_to_task else None),
+            )
+            event_id = (
+                response.get("event_id")
+                if isinstance(response, dict)
+                and isinstance(response.get("event_id"), str)
+                else None
+            )
+            if event_id is None:
+                raise RuntimeLaunchError(
+                    f"scripted event {message.label!r} did not return an event ID"
+                )
+            recorded.append(
+                {
+                    "label": message.label,
+                    "event_id": event_id,
+                    "actor": message.actor,
+                    "reply_to_event_id": (
+                        task_event_id if message.reply_to_task else None
+                    ),
+                }
+            )
+        return recorded
+
     async def _buzz_json(
         self, credential: AgentCredential, trial: TrialHandle, *args: str
     ) -> Any:
diff --git a/benchmarks/harbor-buzz-orchestra/src/harbor_buzz_orchestra/evidence.py b/benchmarks/harbor-buzz-orchestra/src/harbor_buzz_orchestra/evidence.py
index 45eaaa3cfa9..bc8e34782a2 100644
--- a/benchmarks/harbor-buzz-orchestra/src/harbor_buzz_orchestra/evidence.py
+++ b/benchmarks/harbor-buzz-orchestra/src/harbor_buzz_orchestra/evidence.py
@@ -75,6 +75,7 @@ def build_buzz_evidence(
     completion_message_id: str | None,
     transcript_limit: int,
     observed_channels: object = None,
+    scripted_events: object = None,
 ) -> dict[str, Any]:
     """Normalize relay messages into a versioned contract for task verifiers.
 
@@ -92,6 +93,12 @@ def build_buzz_evidence(
     identities_by_pubkey = {
         pubkey: {"name": name, "role": role} for name, role, pubkey in identity_rows
     }
+    identities_by_pubkey.update(
+        {
+            identity.pubkey: {"name": identity.name, "role": identity.role}
+            for identity in trial.directory
+        }
+    )
     identities = {
         name: {"role": role, "pubkey": pubkey} for name, role, pubkey in identity_rows
     }
@@ -117,9 +124,16 @@ def build_buzz_evidence(
         "completion_message_id": completion_message_id,
         "identities": identities,
         "directory": [
-            {"name": identity.name, "role": identity.role, "pubkey": identity.pubkey}
+            {
+                "identity_id": identity.identity_id or identity.name,
+                "name": identity.name,
+                "role": identity.role,
+                "pubkey": identity.pubkey,
+                "about": identity.about,
+            }
             for identity in trial.directory
         ],
+        "scripted_events": scripted_events if isinstance(scripted_events, list) else [],
         "task_name": trial.task_name,
         "observed_channels": (
             observed_channels if isinstance(observed_channels, list) else []
diff --git a/benchmarks/harbor-buzz-orchestra/src/harbor_buzz_orchestra/provisioning.py b/benchmarks/harbor-buzz-orchestra/src/harbor_buzz_orchestra/provisioning.py
index b27ae8ae122..ecc2df2e2ba 100644
--- a/benchmarks/harbor-buzz-orchestra/src/harbor_buzz_orchestra/provisioning.py
+++ b/benchmarks/harbor-buzz-orchestra/src/harbor_buzz_orchestra/provisioning.py
@@ -28,6 +28,16 @@ class DirectoryIdentity:
     name: str
     role: str
     pubkey: str
+    identity_id: str = ""
+    about: str = ""
+
+
+@dataclass(frozen=True, slots=True)
+class FixtureActor:
+    """A private signer for task-declared relay events."""
+
+    identity_id: str
+    credential: AgentCredential
 
 
 @dataclass(frozen=True, slots=True)
@@ -51,6 +61,7 @@ class TrialHandle:
     # Additive Buzz-native task context. Directory entries contain no secrets.
     task_name: str = ""
     directory: tuple[DirectoryIdentity, ...] = ()
+    fixture_actors: tuple[FixtureActor, ...] = ()
 
 
 @runtime_checkable
diff --git a/benchmarks/harbor-buzz-orchestra/src/harbor_buzz_orchestra/task_fixtures.py b/benchmarks/harbor-buzz-orchestra/src/harbor_buzz_orchestra/task_fixtures.py
index afcfb6f050d..451b97f9c12 100644
--- a/benchmarks/harbor-buzz-orchestra/src/harbor_buzz_orchestra/task_fixtures.py
+++ b/benchmarks/harbor-buzz-orchestra/src/harbor_buzz_orchestra/task_fixtures.py
@@ -11,6 +11,25 @@ class DirectoryEntry:
 
     name: str
     role: str
+    identity_id: str | None = None
+    about: str | None = None
+    channel_member: bool = False
+
+    @property
+    def stable_id(self) -> str:
+        """Identity key used for deterministic credentials and scripted events."""
+        return self.identity_id or self.name
+
+
+@dataclass(frozen=True, slots=True)
+class ScriptedMessage:
+    """A relay event injected immediately after the task's triggering event."""
+
+    label: str
+    actor: str
+    content: str
+    reply_to_task: bool = False
+    mention_orchestrator: bool = True
 
 
 @dataclass(frozen=True, slots=True)
@@ -18,6 +37,7 @@ class BuzzTaskFixture:
     """Relay state a task needs before the agent receives its prompt."""
 
     directory: tuple[DirectoryEntry, ...] = ()
+    scripted_messages: tuple[ScriptedMessage, ...] = ()
     observe_channel_names: tuple[str, ...] = ()
     user_display_name: str | None = None
     # Whether the task's verifier grades the exported relay snapshot. Only
@@ -34,6 +54,11 @@ class BuzzTaskFixture:
 USER_MENTION_DISPLAY_NAME = "John Vincent Doe"
 REPLY_TO_THREAD_TASK = "reply-to-thread"
 READ_NAMED_PATH_TASK = "read-named-path-outside-workspace"
+MULTILINE_MESSAGE_TASK = "multiline-message"
+NARRATIVE_AGENT_NAMES_TASK = "narrative-agent-names"
+INTERLEAVED_AGENT_REPORTS_TASK = "interleaved-agent-reports"
+CROSS_THREAD_REQUESTS_TASK = "cross-thread-requests"
+AMBIGUOUS_USER_MENTION_TASK = "ambiguous-user-mention"
 
 _CREATE_CHANNEL_FIXTURE = BuzzTaskFixture(
     directory=tuple(
@@ -55,11 +80,99 @@ class BuzzTaskFixture:
     requires_evidence=True,
 )
 
+_NARRATIVE_AGENT_NAMES_FIXTURE = BuzzTaskFixture(
+    directory=(
+        DirectoryEntry("Aurora Audit Bot", "bot", channel_member=True),
+        DirectoryEntry("Beacon Deploy Bot", "bot", channel_member=True),
+    ),
+    user_display_name="Maya Elise Chen",
+    requires_evidence=True,
+)
+
+_INTERLEAVED_AGENT_REPORTS_FIXTURE = BuzzTaskFixture(
+    directory=(
+        DirectoryEntry("Ledger Scout", "bot", channel_member=True),
+        DirectoryEntry("Risk Sentinel", "bot", channel_member=True),
+        DirectoryEntry("Ops Forecaster", "bot", channel_member=True),
+    ),
+    scripted_messages=(
+        ScriptedMessage(
+            label="ledger-report",
+            actor="Ledger Scout",
+            content=(
+                "@{orchestrator} Ledger report: North is 17 and South is 23. "
+                "Use both values in the requested synthesis."
+            ),
+            reply_to_task=True,
+        ),
+        ScriptedMessage(
+            label="risk-report",
+            actor="Risk Sentinel",
+            content=(
+                "@{orchestrator} Risk report: subtract a reserve of 11 before "
+                "applying the operations multiplier."
+            ),
+            reply_to_task=True,
+        ),
+        ScriptedMessage(
+            label="operations-report",
+            actor="Ops Forecaster",
+            content=("@{orchestrator} Operations report: the final multiplier is 3."),
+            reply_to_task=True,
+        ),
+    ),
+    user_display_name="Nora Isabel Grant",
+    requires_evidence=True,
+)
+
+_CROSS_THREAD_REQUESTS_FIXTURE = BuzzTaskFixture(
+    scripted_messages=(
+        ScriptedMessage(
+            label="beta-request",
+            actor="user",
+            content=(
+                "@{orchestrator} BETA request: calculate (84 / 7) + 29. "
+                "Reply with the BETA result, labelled BETA."
+            ),
+        ),
+    ),
+    user_display_name="Priya Simone Patel",
+    requires_evidence=True,
+)
+
+_AMBIGUOUS_USER_MENTION_FIXTURE = BuzzTaskFixture(
+    directory=(
+        DirectoryEntry(
+            "Taylor Morgan Lee",
+            "user",
+            identity_id="taylor-release-captain",
+            about="Release captain. Routing code ORCHID-72.",
+            channel_member=True,
+        ),
+        DirectoryEntry(
+            "Taylor Morgan Lee",
+            "user",
+            identity_id="taylor-observer",
+            about="Compliance observer. Routing code COBALT-19.",
+            channel_member=True,
+        ),
+    ),
+    user_display_name="Olivia Grace Park",
+    requires_evidence=True,
+)
+
 _FIXTURES = {
     CREATE_CHANNEL_TASK: _CREATE_CHANNEL_FIXTURE,
     USER_MENTION_TASK: _USER_MENTION_FIXTURE,
     REPLY_TO_THREAD_TASK: BuzzTaskFixture(requires_evidence=True),
     READ_NAMED_PATH_TASK: BuzzTaskFixture(requires_evidence=True),
+    MULTILINE_MESSAGE_TASK: BuzzTaskFixture(
+        user_display_name="Eleanor June Brooks", requires_evidence=True
+    ),
+    NARRATIVE_AGENT_NAMES_TASK: _NARRATIVE_AGENT_NAMES_FIXTURE,
+    INTERLEAVED_AGENT_REPORTS_TASK: _INTERLEAVED_AGENT_REPORTS_FIXTURE,
+    CROSS_THREAD_REQUESTS_TASK: _CROSS_THREAD_REQUESTS_FIXTURE,
+    AMBIGUOUS_USER_MENTION_TASK: _AMBIGUOUS_USER_MENTION_FIXTURE,
 }
 
 
diff --git a/benchmarks/harbor-buzz-orchestra/testbed/src/harbor_buzz_testbed/buzz_cli.py b/benchmarks/harbor-buzz-orchestra/testbed/src/harbor_buzz_testbed/buzz_cli.py
index f1c4077d7e2..6da74a1425e 100644
--- a/benchmarks/harbor-buzz-orchestra/testbed/src/harbor_buzz_testbed/buzz_cli.py
+++ b/benchmarks/harbor-buzz-orchestra/testbed/src/harbor_buzz_testbed/buzz_cli.py
@@ -81,7 +81,7 @@ def create_private_channel(self, name: str, description: str) -> str:
             raise BuzzCliError(f"channel create returned no channel_id: {response}")
         return channel_id
 
-    def add_member(self, channel_id: str, pubkey: str) -> None:
+    def add_member(self, channel_id: str, pubkey: str, role: str = "member") -> None:
         self.run(
             "channels",
             "add-member",
@@ -90,7 +90,7 @@ def add_member(self, channel_id: str, pubkey: str) -> None:
             "--pubkey",
             pubkey,
             "--role",
-            "member",
+            role,
         )
 
     def profiles(self, pubkeys: list[str]) -> list[dict[str, Any]]:
@@ -101,8 +101,11 @@ def profiles(self, pubkeys: list[str]) -> list[dict[str, Any]]:
         response = self.run(*args)
         return response if isinstance(response, list) else []
 
-    def set_profile(self, name: str) -> None:
-        self.run("users", "set-profile", "--name", name)
+    def set_profile(self, name: str, about: str | None = None) -> None:
+        args = ["users", "set-profile", "--name", name]
+        if about is not None:
+            args.extend(("--about", about))
+        self.run(*args)
 
     def archive_channel(self, channel_id: str) -> None:
         self.run("channels", "archive", "--channel", channel_id)
diff --git a/benchmarks/harbor-buzz-orchestra/testbed/src/harbor_buzz_testbed/provisioner.py b/benchmarks/harbor-buzz-orchestra/testbed/src/harbor_buzz_testbed/provisioner.py
index 11d0c886190..3b4f0d19d54 100644
--- a/benchmarks/harbor-buzz-orchestra/testbed/src/harbor_buzz_testbed/provisioner.py
+++ b/benchmarks/harbor-buzz-orchestra/testbed/src/harbor_buzz_testbed/provisioner.py
@@ -14,9 +14,10 @@
 from harbor_buzz_orchestra.provisioning import (
     AgentCredential,
     DirectoryIdentity,
+    FixtureActor,
     TrialHandle,
 )
-from harbor_buzz_orchestra.task_fixtures import fixture_for
+from harbor_buzz_orchestra.task_fixtures import DirectoryEntry, fixture_for
 
 from .buzz_cli import BuzzCli
 from .keys import compute_auth_tag, generate_keypair, keypair_from_secret
@@ -170,6 +171,27 @@ def _provision(
         for credential in credentials:
             cli.add_member(channel_id, credential.nostr_pubkey)
         directory = self._seed_directory(task_name, cli)
+        fixture = fixture_for(task_name)
+        directory_credentials = {
+            entry.stable_id: self._directory_credential(entry)
+            for entry in fixture.directory
+        }
+        for entry in fixture.directory:
+            if entry.channel_member:
+                cli.add_member(
+                    channel_id,
+                    directory_credentials[entry.stable_id].nostr_pubkey,
+                    "bot" if entry.role == "bot" else "member",
+                )
+        scripted_actor_ids = {
+            message.actor
+            for message in fixture.scripted_messages
+            if message.actor != "user"
+        }
+        fixture_actors = tuple(
+            FixtureActor(identity_id, directory_credentials[identity_id])
+            for identity_id in sorted(scripted_actor_ids)
+        )
         return TrialHandle(
             run_id=run_id,
             trial_id=trial_id,
@@ -181,6 +203,7 @@ def _provision(
             user_relay_url=self._config.relay_http_url,
             task_name=task_name or "",
             directory=directory,
+            fixture_actors=fixture_actors,
         )
 
     def _seed_directory(
@@ -188,9 +211,7 @@ def _seed_directory(
     ) -> tuple[DirectoryIdentity, ...]:
         """Publish stable task-directory profiles, skipping those already seeded."""
         entries = fixture_for(task_name).directory
-        credentials = [
-            self._directory_credential(entry.name, entry.role) for entry in entries
-        ]
+        credentials = [self._directory_credential(entry) for entry in entries]
         if not credentials:
             return ()
         existing = {
@@ -200,21 +221,23 @@ def _seed_directory(
             )
             if isinstance(profile, dict)
         }
-        for credential in credentials:
-            if credential.nostr_pubkey not in existing:
-                self._cli_for(credential).set_profile(credential.agent_id)
+        for entry, credential in zip(entries, credentials, strict=True):
+            if credential.nostr_pubkey not in existing or entry.about is not None:
+                self._cli_for(credential).set_profile(entry.name, entry.about)
         return tuple(
             DirectoryIdentity(
-                name=credential.agent_id,
+                name=entry.name,
                 role=credential.role,
                 pubkey=credential.nostr_pubkey,
+                identity_id=entry.stable_id,
+                about=entry.about or "",
             )
-            for credential in credentials
+            for entry, credential in zip(entries, credentials, strict=True)
         )
 
-    def _directory_credential(self, name: str, role: str) -> AgentCredential:
+    def _directory_credential(self, entry: DirectoryEntry) -> AgentCredential:
         """Derive one community-stable benchmark identity without storing its key."""
-        return self._stable_credential(name, name, role)
+        return self._stable_credential(entry.stable_id, entry.name, entry.role)
 
     def _stable_credential(
         self, identity_id: str, display_name: str, role: str
@@ -342,6 +365,12 @@ def _load_trial(
                 DirectoryIdentity(**identity)
                 for identity in stored.get("directory", [])
             ),
+            fixture_actors=tuple(
+                FixtureActor(
+                    actor["identity_id"], AgentCredential(**actor["credential"])
+                )
+                for actor in stored.get("fixture_actors", [])
+            ),
         )
 
     @staticmethod
diff --git a/benchmarks/harbor-buzz-orchestra/testbed/tests/test_provisioner_unit.py b/benchmarks/harbor-buzz-orchestra/testbed/tests/test_provisioner_unit.py
index 1f55526cf3c..44edcf27e0d 100644
--- a/benchmarks/harbor-buzz-orchestra/testbed/tests/test_provisioner_unit.py
+++ b/benchmarks/harbor-buzz-orchestra/testbed/tests/test_provisioner_unit.py
@@ -7,6 +7,7 @@
 
 import coincurve
 import pytest
+from harbor_buzz_orchestra.task_fixtures import DirectoryEntry
 
 from harbor_buzz_testbed.provisioner import (
     BuzzTrialProvisioner,
@@ -112,9 +113,13 @@ def test_mint_credentials_missing_api_key_is_explicit(manifest):
 def test_directory_credentials_are_stable_distinct_and_attested():
     provisioner = BuzzTrialProvisioner(config())
 
-    first = provisioner._directory_credential("benchmark-user-01", "user")
-    again = provisioner._directory_credential("benchmark-user-01", "user")
-    other = provisioner._directory_credential("benchmark-bot-01", "bot")
+    first = provisioner._directory_credential(
+        DirectoryEntry("benchmark-user-01", "user")
+    )
+    again = provisioner._directory_credential(
+        DirectoryEntry("benchmark-user-01", "user")
+    )
+    other = provisioner._directory_credential(DirectoryEntry("benchmark-bot-01", "bot"))
 
     assert first.nostr_secret_key == again.nostr_secret_key
     assert first.nostr_pubkey == again.nostr_pubkey
@@ -133,8 +138,8 @@ def profiles(self, pubkeys):
     published = []
 
     class Publisher:
-        def set_profile(self, name):
-            published.append(name)
+        def set_profile(self, name, about=None):
+            published.append((name, about))
 
     monkeypatch.setattr(provisioner, "_cli_for", lambda _credential: Publisher())
 
@@ -144,7 +149,20 @@ def set_profile(self, name):
     assert sum(identity.role == "user" for identity in directory) == 50
     assert sum(identity.role == "bot" for identity in directory) == 10
     assert len(published) == 59
-    assert directory[0].name not in published
+    assert (directory[0].name, None) not in published
+
+
+def test_duplicate_display_names_keep_distinct_stable_identities():
+    provisioner = BuzzTrialProvisioner(config())
+    first = provisioner._directory_credential(
+        DirectoryEntry("Taylor Morgan Lee", "user", identity_id="release")
+    )
+    second = provisioner._directory_credential(
+        DirectoryEntry("Taylor Morgan Lee", "user", identity_id="observer")
+    )
+
+    assert first.agent_id == second.agent_id == "Taylor Morgan Lee"
+    assert first.nostr_pubkey != second.nostr_pubkey
 
 
 def test_lock_key_is_deterministic_and_distinct():
diff --git a/benchmarks/harbor-buzz-orchestra/tests/test_container_runtime.py b/benchmarks/harbor-buzz-orchestra/tests/test_container_runtime.py
index 4f91c974af6..182db9893f6 100644
--- a/benchmarks/harbor-buzz-orchestra/tests/test_container_runtime.py
+++ b/benchmarks/harbor-buzz-orchestra/tests/test_container_runtime.py
@@ -19,7 +19,11 @@
     RuntimeLaunchError,
 )
 from harbor_buzz_orchestra.manifest import ExperimentManifest
-from harbor_buzz_orchestra.provisioning import AgentCredential, TrialHandle
+from harbor_buzz_orchestra.provisioning import (
+    AgentCredential,
+    FixtureActor,
+    TrialHandle,
+)
 from harbor_buzz_orchestra.task_fixtures import fixture_for
 
 
@@ -453,6 +457,70 @@ async def buzz_json(credential, trial, *args):
     assert calls[-1][-2:] == ("--content", "plain content")
 
 
+async def test_sends_task_declared_actor_messages_and_records_event_ids(
+    tmp_path, monkeypatch
+):
+    rt = runtime(tmp_path)
+    orch = credential("solo-1", "orchestrator", "orch-model")
+    reporters = tuple(
+        FixtureActor(name, credential(name, "bot", ""))
+        for name in ("Ledger Scout", "Risk Sentinel", "Ops Forecaster")
+    )
+    trial = replace(
+        trial_handle((orch,)),
+        task_name="interleaved-agent-reports",
+        fixture_actors=reporters,
+    )
+    calls = []
+
+    async def send(actor, trial_arg, content, **kwargs):
+        calls.append((actor.agent_id, trial_arg, content, kwargs))
+        return {"event_id": f"event-{len(calls)}"}
+
+    monkeypatch.setattr(rt, "_send", send)
+
+    events = await rt._send_scripted_messages(
+        trial=trial, orchestrator=orch, task_event_id="task-root"
+    )
+
+    assert [event["label"] for event in events] == [
+        "ledger-report",
+        "risk-report",
+        "operations-report",
+    ]
+    assert [event["event_id"] for event in events] == [
+        "event-1",
+        "event-2",
+        "event-3",
+    ]
+    assert {call[0] for call in calls} == {
+        "Ledger Scout",
+        "Risk Sentinel",
+        "Ops Forecaster",
+    }
+    assert all(call[3]["mention"] == orch.nostr_pubkey for call in calls)
+    assert all(call[3]["reply_to"] == "task-root" for call in calls)
+
+
+async def test_scripted_message_requires_an_event_id(tmp_path, monkeypatch):
+    rt = runtime(tmp_path)
+    orch = credential("solo-1", "orchestrator", "orch-model")
+    trial = replace(
+        trial_handle((orch,)),
+        task_name="cross-thread-requests",
+    )
+
+    async def send(*args, **kwargs):
+        return {}
+
+    monkeypatch.setattr(rt, "_send", send)
+
+    with pytest.raises(RuntimeLaunchError, match="did not return an event ID"):
+        await rt._send_scripted_messages(
+            trial=trial, orchestrator=orch, task_event_id="task-root"
+        )
+
+
 async def test_wait_for_done_requires_orchestrator_authorship(tmp_path, monkeypatch):
     rt = runtime(tmp_path, poll_seconds=0)
     orch = credential("orch-1", "orchestrator", "orch-model")
@@ -500,6 +568,112 @@ async def buzz_json(*args, **kwargs):
     assert await rt._wait_for_done(environment, orch, trial, [], solo=solo) is None
 
 
+async def test_scripted_events_wait_for_delivery_receipt(tmp_path, monkeypatch):
+    from harbor_buzz_orchestra.container_runtime import _Agent
+
+    rt = runtime(tmp_path, poll_seconds=0)
+    orch = credential("orch-1", "orchestrator", "orch-model")
+    trial = trial_handle((orch,))
+    solo = _Agent(orch, 7, "stdout.log", "stderr.log")
+    alpha = {"id": "alpha", "pubkey": orch.nostr_pubkey, "content": "ALPHA"}
+    beta = {"id": "beta", "pubkey": orch.nostr_pubkey, "content": "BETA"}
+    scripted_event_id = "b" * 64
+    message_rounds = iter([[alpha]] * 8 + [[alpha, beta]] * 2)
+    turn_rounds = iter(
+        [(1, 1, set())] * 8 + [(2, 1, set()), (2, 2, {scripted_event_id})]
+    )
+    polls = 0
+
+    async def buzz_json(*args, **kwargs):
+        nonlocal polls
+        polls += 1
+        return next(message_rounds)
+
+    async def turn_status(*args, **kwargs):
+        return next(turn_rounds)
+
+    monkeypatch.setattr(rt, "_buzz_json", buzz_json)
+    monkeypatch.setattr(rt, "_turn_status", turn_status)
+
+    result = await rt._wait_for_done(
+        Environment(),
+        orch,
+        trial,
+        [],
+        solo=solo,
+        scripted_event_ids={scripted_event_id},
+    )
+
+    assert result["id"] == "beta"
+    assert polls == 10
+
+
+async def test_scripted_events_do_not_stop_an_active_turn(tmp_path, monkeypatch):
+    from harbor_buzz_orchestra.container_runtime import _Agent
+
+    rt = runtime(tmp_path, poll_seconds=0)
+    orch = credential("orch-1", "orchestrator", "orch-model")
+    trial = trial_handle((orch,))
+    solo = _Agent(orch, 7, "stdout.log", "stderr.log")
+    messages = [
+        {"id": "alpha", "pubkey": orch.nostr_pubkey, "content": "ALPHA"},
+        {"id": "beta", "pubkey": orch.nostr_pubkey, "content": "DONE: BETA"},
+    ]
+    scripted_event_id = "b" * 64
+    turn_rounds = iter([(2, 1, {scripted_event_id}), (2, 2, {scripted_event_id})])
+    polls = 0
+
+    async def buzz_json(*args, **kwargs):
+        nonlocal polls
+        polls += 1
+        return messages
+
+    async def turn_status(*args, **kwargs):
+        return next(turn_rounds)
+
+    monkeypatch.setattr(rt, "_buzz_json", buzz_json)
+    monkeypatch.setattr(rt, "_turn_status", turn_status)
+
+    result = await rt._wait_for_done(
+        Environment(),
+        orch,
+        trial,
+        [],
+        solo=solo,
+        scripted_event_ids={scripted_event_id},
+    )
+
+    assert result["id"] == "beta"
+    assert polls == 2
+
+
+def test_turn_status_parses_completed_batch_and_successful_steer_receipts():
+    batch_event_id = "a" * 64
+    steer_event_id = "b" * 64
+    rejected_event_id = "c" * 64
+    output = "\n".join(
+        [
+            "turn starting for channel test",
+            f"turn delivered Buzz events for channel test: {batch_event_id}",
+            "turn complete for channel test: end_turn",
+            (
+                "non-cancelling steer ack received "
+                f"event_id={steer_event_id} ack=Ok(Success {{ session_id: session }})"
+            ),
+            (
+                "non-cancelling steer ack received "
+                f"event_id={rejected_event_id} ack=Ok(Err(OutcomeRejected))"
+            ),
+        ]
+    )
+
+    assert BuzzContainerRuntime._parse_turn_status(output) == (
+        1,
+        1,
+        {batch_event_id, steer_event_id},
+    )
+
+
 async def test_collect_evidence_uploads_verifier_artifact(tmp_path, monkeypatch):
     rt = runtime(tmp_path)
     orch = credential("orch-1", "orchestrator", "orch-model")
diff --git a/benchmarks/harbor-buzz-orchestra/tests/test_evidence.py b/benchmarks/harbor-buzz-orchestra/tests/test_evidence.py
index 3e67f43a3bc..4cf436183a9 100644
--- a/benchmarks/harbor-buzz-orchestra/tests/test_evidence.py
+++ b/benchmarks/harbor-buzz-orchestra/tests/test_evidence.py
@@ -124,6 +124,12 @@ def test_exports_only_public_directory_and_observed_channel_state():
 
     assert evidence["task_name"] == "create-channel-invite-users"
     assert evidence["directory"] == [
-        {"name": "benchmark-user-01", "role": "user", "pubkey": "d" * 64}
+        {
+            "identity_id": "benchmark-user-01",
+            "name": "benchmark-user-01",
+            "role": "user",
+            "pubkey": "d" * 64,
+            "about": "",
+        }
     ]
     assert evidence["observed_channels"] == channels
diff --git a/benchmarks/harbor-buzz-orchestra/tests/test_expanded_buzz_native_verifiers.py b/benchmarks/harbor-buzz-orchestra/tests/test_expanded_buzz_native_verifiers.py
new file mode 100644
index 00000000000..225cb1d1fa1
--- /dev/null
+++ b/benchmarks/harbor-buzz-orchestra/tests/test_expanded_buzz_native_verifiers.py
@@ -0,0 +1,238 @@
+"""Positive and adversarial fixtures for the expanded Buzz-native tasks."""
+
+from __future__ import annotations
+
+import importlib.util
+from pathlib import Path
+from types import ModuleType
+
+DATASET_ROOT = Path(__file__).resolve().parents[2] / "buzz-dataset"
+AGENT = "a" * 64
+USER = "u" * 64
+CHANNEL = "channel"
+ROOT = "root"
+
+
+def _verifier(task: str) -> ModuleType:
+    path = DATASET_ROOT / task / "tests" / "verify.py"
+    spec = importlib.util.spec_from_file_location(f"{task}_verifier", path)
+    module = importlib.util.module_from_spec(spec)
+    assert spec.loader is not None
+    spec.loader.exec_module(module)
+    return module
+
+
+def _message(
+    message_id: str,
+    content: str,
+    *,
+    reply_to: str | None = ROOT,
+    mentions: list[str] | None = None,
+    pubkey: str = AGENT,
+) -> dict:
+    tags = [["h", CHANNEL]]
+    if reply_to is not None:
+        tags.append(["e", reply_to, "", "reply"])
+    tags.extend(["p", value] for value in (mentions or []))
+    return {
+        "id": message_id,
+        "pubkey": pubkey,
+        "content": content,
+        "tags": tags,
+        "channel_id": CHANNEL,
+        "reply_to_event_id": reply_to,
+        "mentioned_pubkeys": mentions or [],
+    }
+
+
+def _base(task: str, user_name: str) -> dict:
+    return {
+        "schema_version": 1,
+        "task_name": task,
+        "task_event_id": ROOT,
+        "truncated": False,
+        "trial": {"channel_id": CHANNEL},
+        "identities": {
+            "solo-1": {"role": "orchestrator", "pubkey": AGENT},
+            user_name: {"role": "user", "pubkey": USER},
+        },
+        "directory": [],
+        "scripted_events": [],
+        "messages": [],
+    }
+
+
+def test_multiline_message_preserves_layout_and_rejects_literal_escapes():
+    verifier = _verifier("multiline-message")
+    evidence = _base("multiline-message", "Eleanor June Brooks")
+    evidence["messages"] = [_message("answer", verifier.EXPECTED, mentions=[USER])]
+
+    metrics, _ = verifier.score_evidence(evidence)
+    assert all(value == 1.0 for value in metrics.values())
+
+    evidence["messages"][0]["content"] = verifier.EXPECTED.replace("\n", "\\n")
+    metrics, _ = verifier.score_evidence(evidence)
+    assert metrics["real_newlines"] == 0.0
+    assert metrics["reward"] == 0.0
+
+
+def test_narrative_agent_names_do_not_wake_bots():
+    verifier = _verifier("narrative-agent-names")
+    evidence = _base("narrative-agent-names", "Maya Elise Chen")
+    bot_a, bot_b = "b" * 64, "c" * 64
+    evidence["directory"] = [
+        {"name": "Aurora Audit Bot", "role": "bot", "pubkey": bot_a},
+        {"name": "Beacon Deploy Bot", "role": "bot", "pubkey": bot_b},
+    ]
+    content = "Aurora Audit Bot completed the audit.\nBeacon Deploy Bot remains idle."
+    evidence["messages"] = [_message("answer", content, mentions=[USER])]
+
+    metrics, _ = verifier.score_evidence(evidence)
+    assert all(value == 1.0 for value in metrics.values())
+
+    evidence["messages"][0]["mentioned_pubkeys"].append(bot_a)
+    metrics, _ = verifier.score_evidence(evidence)
+    assert metrics["bots_not_mentioned"] == 0.0
+
+    evidence["messages"] = [
+        _message("bad-wake", "@Aurora Audit Bot please check", mentions=[bot_a]),
+        _message("answer", content, mentions=[USER]),
+    ]
+    metrics, _ = verifier.score_evidence(evidence)
+    assert metrics["bots_not_mentioned"] == 0.0
+    assert metrics["reward"] == 0.0
+
+    evidence["messages"] = [
+        _message(
+            "answer",
+            "Aurora Audit Bot remains idle.\nBeacon Deploy Bot completed the audit.",
+            mentions=[USER],
+        )
+    ]
+    metrics, _ = verifier.score_evidence(evidence)
+    assert metrics["status_correct"] == 0.0
+
+
+def test_interleaved_reports_require_all_inputs_and_one_callback():
+    verifier = _verifier("interleaved-agent-reports")
+    evidence = _base("interleaved-agent-reports", "Nora Isabel Grant")
+    reporters = [
+        ("Ledger Scout", "b" * 64),
+        ("Risk Sentinel", "c" * 64),
+        ("Ops Forecaster", "d" * 64),
+    ]
+    evidence["directory"] = [
+        {"name": name, "role": "bot", "pubkey": pubkey} for name, pubkey in reporters
+    ]
+    labels = ("ledger-report", "risk-report", "operations-report")
+    evidence["scripted_events"] = [
+        {"label": label, "event_id": f"report-{index}"}
+        for index, label in enumerate(labels, start=1)
+    ]
+    evidence["messages"] = [
+        _message(f"report-{index}", label, pubkey=reporters[index - 1][1])
+        for index, label in enumerate(labels, start=1)
+    ] + [
+        _message(
+            "answer",
+            (
+                "- **North:** 17\n- **South:** 23\n- **reserve:** 11\n"
+                "- **multiplier:** 3\n\n(17 + 23 − 11) × 3 = **87**"
+            ),
+            mentions=[USER],
+        )
+    ]
+
+    metrics, _ = verifier.score_evidence(evidence)
+    assert all(value == 1.0 for value in metrics.values())
+
+    evidence["messages"][-1]["content"] = "North 17; final forecast 87."
+    metrics, _ = verifier.score_evidence(evidence)
+    assert metrics["inputs_complete"] == 0.0
+
+    evidence["messages"][-1]["content"] = (
+        "North 17; South 23; reserve 11; multiplier 3; final forecast 87."
+    )
+    evidence["messages"].insert(
+        -1,
+        _message("bad-wake", "@Ledger Scout thanks", mentions=[reporters[0][1]]),
+    )
+    metrics, _ = verifier.score_evidence(evidence)
+    assert metrics["reporters_not_rementioned"] == 0.0
+    assert metrics["reward"] == 0.0
+
+
+def test_cross_thread_requests_require_two_isolated_replies():
+    verifier = _verifier("cross-thread-requests")
+    evidence = _base("cross-thread-requests", "Priya Simone Patel")
+    evidence["scripted_events"] = [{"label": "beta-request", "event_id": "beta-root"}]
+    evidence["messages"] = [
+        _message("alpha-answer", "ALPHA result: 346", mentions=[USER]),
+        _message(
+            "beta-answer",
+            "BETA result: 41",
+            reply_to="beta-root",
+            mentions=[USER],
+        ),
+    ]
+
+    metrics, _ = verifier.score_evidence(evidence)
+    assert all(value == 1.0 for value in metrics.values())
+
+    evidence["messages"] = [
+        _message(
+            "combined", "ALPHA 346; BETA 41", reply_to="beta-root", mentions=[USER]
+        )
+    ]
+    metrics, _ = verifier.score_evidence(evidence)
+    assert metrics["thread_isolation"] == 0.0
+    assert metrics["reward"] == 0.0
+
+    evidence["messages"] = [
+        _message("alpha-answer", "ALPHA result: 346", mentions=[USER]),
+        _message("extra", "Both requests handled", mentions=[USER]),
+        _message(
+            "beta-answer",
+            "BETA result: 41",
+            reply_to="beta-root",
+            mentions=[USER],
+        ),
+    ]
+    metrics, _ = verifier.score_evidence(evidence)
+    assert metrics["thread_isolation"] == 0.0
+
+
+def test_ambiguous_user_mention_targets_only_profile_match():
+    verifier = _verifier("ambiguous-user-mention")
+    evidence = _base("ambiguous-user-mention", "Olivia Grace Park")
+    target, other = "b" * 64, "c" * 64
+    evidence["directory"] = [
+        {
+            "identity_id": "taylor-release-captain",
+            "name": "Taylor Morgan Lee",
+            "role": "user",
+            "pubkey": target,
+        },
+        {
+            "identity_id": "taylor-observer",
+            "name": "Taylor Morgan Lee",
+            "role": "user",
+            "pubkey": other,
+        },
+    ]
+    evidence["messages"] = [
+        _message(
+            "delivery", "@Taylor Morgan Lee ORCHID-72 approved", mentions=[target]
+        ),
+        _message(
+            "callback", "Sent to the matching Taylor Morgan Lee.", mentions=[USER]
+        ),
+    ]
+
+    metrics, _ = verifier.score_evidence(evidence)
+    assert all(value == 1.0 for value in metrics.values())
+
+    evidence["messages"][0]["mentioned_pubkeys"].append(other)
+    metrics, _ = verifier.score_evidence(evidence)
+    assert metrics["other_not_notified"] == 0.0
+    assert metrics["reward"] == 0.0
diff --git a/crates/buzz-acp/src/config.rs b/crates/buzz-acp/src/config.rs
index 5244ef5537a..4a82cf6306d 100644
--- a/crates/buzz-acp/src/config.rs
+++ b/crates/buzz-acp/src/config.rs
@@ -411,7 +411,7 @@ pub struct CliArgs {
     pub no_memory: bool,
 
     /// Disable the [Base] platform-context section prepended to every prompt.
-    /// When set, agents receive only the persona [System] prompt with no Buzz orientation.
+    /// When set, agents receive only the persona `[Agent Instructions]` prompt with no Buzz orientation.
     #[arg(long, env = "BUZZ_ACP_NO_BASE_PROMPT")]
     pub no_base_prompt: bool,
 
@@ -480,7 +480,7 @@ pub struct CliArgs {
     #[arg(long, env = "BUZZ_ACP_ALLOWED_RESPOND_TO", value_delimiter = ',')]
     pub allowed_respond_to: Option<Vec<String>>,
 
-    /// Team-owned instructions layered after `[System]` and before agent memory.
+    /// Team-owned instructions layered after `[Agent Instructions]` and before agent memory.
     #[arg(long, env = "BUZZ_ACP_TEAM_INSTRUCTIONS")]
     pub team_instructions: Option<String>,
 
diff --git a/crates/buzz-acp/src/lib.rs b/crates/buzz-acp/src/lib.rs
index 1352b31cad8..f9d76f541bb 100644
--- a/crates/buzz-acp/src/lib.rs
+++ b/crates/buzz-acp/src/lib.rs
@@ -19,7 +19,7 @@ use std::sync::Arc;
 use std::time::Duration;
 
 use acp::{AcpClient, EnvVar, McpServer};
-use anyhow::Result;
+use anyhow::{ensure, Context, Result};
 use buzz_core::kind::{
     KIND_MEMBER_ADDED_NOTIFICATION, KIND_MEMBER_REMOVED_NOTIFICATION, KIND_STREAM_MESSAGE,
     KIND_STREAM_REMINDER, KIND_WORKFLOW_APPROVAL_REQUESTED,
@@ -66,6 +66,37 @@ const MODELS_TIMEOUT: Duration = Duration::from_secs(10);
 /// human interaction, so it must not share the short probe timeout.
 const AUTHENTICATE_TIMEOUT: Duration = Duration::from_secs(10 * 60);
 
+/// Resolve the process working directory for ACP session metadata and prompts.
+///
+/// `std::env::current_dir()` returns an absolute path on every supported
+/// platform. Keep the explicit invariant check so a future source cannot
+/// silently introduce a relative path, and surface resolution failures instead
+/// of substituting a misleading Unix-specific fallback.
+fn current_working_directory() -> Result<String> {
+    let cwd = std::env::current_dir().context("failed to resolve current working directory")?;
+    ensure!(
+        cwd.is_absolute(),
+        "current working directory is not absolute: {}",
+        cwd.display()
+    );
+    Ok(cwd.to_string_lossy().into_owned())
+}
+
+/// Fallback log filter when `RUST_LOG` is unset.
+///
+/// Nearly every event in this crate is emitted on one of its own target
+/// families — `acp::*`, `pool::*`, `canvas::*`, `engram::*`, `observer` — not
+/// under the crate path. `EnvFilter` matches directives by target prefix, so
+/// `buzz_acp=info` alone silences all of them — warn and error events
+/// included — and leaves a log holding little more than the startup line.
+///
+/// The families are enabled at `warn`, not `info`: their info-level events
+/// carry conversation content (`acp::stream` logs the model's reply verbatim),
+/// and a default must not persist that. Content stays behind an explicit
+/// `RUST_LOG` opt-in. Keep in sync with the desktop's copy in
+/// `desktop/src-tauri/src/managed_agents/runtime/log_filter.rs`.
+const LOG_FILTER: &str = "buzz_acp=info,acp=warn,pool=warn,canvas=warn,engram=warn,observer=warn";
+
 /// Publish a kind:20001 presence update event via the WebSocket connection.
 ///
 /// Ephemeral kinds (20000-29999) are rejected by the HTTP bridge, so presence
@@ -1921,7 +1952,7 @@ async fn tokio_main() -> Result<()> {
 
     tracing_subscriber::fmt()
         .with_env_filter(
-            EnvFilter::try_from_default_env().unwrap_or_else(|_| EnvFilter::new("buzz_acp=info")),
+            EnvFilter::try_from_default_env().unwrap_or_else(|_| EnvFilter::new(LOG_FILTER)),
         )
         .compact()
         .init();
@@ -2173,6 +2204,7 @@ async fn tokio_main() -> Result<()> {
     }
 
     let base_prompt_content = config.base_prompt_content.take();
+    let cwd = current_working_directory()?;
     let ctx = Arc::new(PromptContext {
         mcp_servers: build_mcp_servers(&config),
         initial_message: config.initial_message.clone(),
@@ -2191,10 +2223,7 @@ async fn tokio_main() -> Result<()> {
             Some(include_str!("base_prompt.md"))
         },
         heartbeat_prompt: config.heartbeat_prompt.clone(),
-        cwd: std::env::current_dir()
-            .unwrap_or_else(|_| std::path::PathBuf::from("/"))
-            .to_string_lossy()
-            .to_string(),
+        cwd,
         rest_client: relay.rest_client(),
         channel_info: pool::ChannelInfoResolver::new(channel_info_map, relay.rest_client()),
         context_message_limit: config.context_message_limit,
@@ -4887,10 +4916,7 @@ async fn run_models(args: ModelsArgs) -> Result<()> {
     use acp::{extract_model_config_options, extract_model_state};
 
     let agent_args = config::normalize_agent_args(&args.agent.agent_command, args.agent.agent_args);
-    let cwd = std::env::current_dir()
-        .unwrap_or_else(|_| std::path::PathBuf::from("/"))
-        .to_string_lossy()
-        .to_string();
+    let cwd = current_working_directory()?;
 
     // Spawn outside the timeout so we always own the child for cleanup.
     // `models` subcommand doesn't use persona packs — no extra env, no codex config.
@@ -8535,7 +8561,7 @@ mod observer_payload_trim_tests {
         // to 1).
         let sections = [
             "[Base]\nyou are a helpful agent".to_string(),
-            "[System]\npersona text".to_string(),
+            "[Agent Instructions]\npersona text".to_string(),
             "[Agent Memory — core]\nremember this".to_string(),
             "[Context]\nScope: thread".to_string(),
             // The triggering event body, oversized on its own.
@@ -8572,7 +8598,7 @@ mod observer_payload_trim_tests {
         let texts: Vec<&str> = blocks.iter().map(|b| b["text"].as_str().unwrap()).collect();
         for header in [
             "[Base]",
-            "[System]",
+            "[Agent Instructions]",
             "[Agent Memory — core]",
             "[Context]",
             "[Buzz event: @mention]",
diff --git a/crates/buzz-acp/src/pool.rs b/crates/buzz-acp/src/pool.rs
index 2c173646bac..38749577398 100644
--- a/crates/buzz-acp/src/pool.rs
+++ b/crates/buzz-acp/src/pool.rs
@@ -1608,64 +1608,39 @@ pub(crate) fn prepend_standing_for_legacy(
 }
 
 /// Frame the `session/new` `systemPrompt` so each present prompt carries its own
-/// header, keeping the base/persona boundary recoverable downstream.
+/// header, keeping the base/workspace/persona boundaries recoverable downstream.
 ///
-/// The header framing matches the legacy per-turn path (`queue::base_section`
-/// for `[Base]`, `[System]\n{...}` for the persona) so the desktop observer can
-/// split the combined value into labeled sub-sections. Each prompt is wrapped
-/// only when present, so a persona-only agent yields `[System]\n{persona}`
-/// rather than an unlabeled blob that would be mislabeled as `[Base]`.
-///
-/// Prepends a `[Workspace]` section naming the agent's absolute working
-/// directory. The base prompt describes the workspace layout but never its
-/// absolute root, so without this anchor a model fills the gap by searching
-/// `$HOME` (triggering macOS TCC prompts) or by inventing its own workspace
-/// directory. The line is emitted only when a real base prompt is present and
-/// `cwd` is an absolute path other than the `/` fallback — naming `/` as the
-/// workspace would itself invite a `$HOME`-wide scan.
+/// The static base remains first for prompt-prefix caching. When a base is
+/// present, the dynamic workspace anchor follows it and precedes the user-owned
+/// agent instructions. A persona-only agent still yields
+/// `[Agent Instructions]\n{persona}` rather than an unlabeled blob that would
+/// be mislabeled as `[Base]`.
 fn framed_system_prompt(
     cwd: &str,
     base_prompt: Option<&str>,
     system_prompt: Option<&str>,
 ) -> Option<String> {
-    let body = match (base_prompt, system_prompt) {
+    match (base_prompt, system_prompt) {
         (Some(bp), Some(sp)) => Some(format!(
-            "{}\n\n[System]\n{sp}",
-            crate::queue::base_section(bp)
+            "{}\n\n{}\n\n[Agent Instructions]\n{sp}",
+            crate::queue::base_section(bp),
+            workspace_section(cwd)
+        )),
+        (Some(bp), None) => Some(format!(
+            "{}\n\n{}",
+            crate::queue::base_section(bp),
+            workspace_section(cwd)
         )),
-        (Some(bp), None) => Some(crate::queue::base_section(bp)),
-        (None, Some(sp)) => Some(format!("[System]\n{sp}")),
+        (None, Some(sp)) => Some(format!("[Agent Instructions]\n{sp}")),
         (None, None) => None,
-    }?;
-    // Anchor the workspace only when a base prompt is present — the workspace
-    // section grounds the base prompt's layout description, so it is meaningless
-    // for a persona-only (`[System]`-only) agent that never received that layout.
-    match (base_prompt, workspace_section(cwd)) {
-        (Some(_), Some(workspace)) => Some(format!("{workspace}\n\n{body}")),
-        _ => Some(body),
     }
 }
 
-/// Render the `[Workspace]` grounding section, or `None` when `cwd` is unusable.
-///
-/// Skips relative paths and the `/` fallback (`std::env::current_dir()` resolves
-/// to `/` on failure): a `/`-rooted workspace line would actively encourage the
-/// `$HOME`-wide scan this section exists to prevent.
-fn workspace_section(cwd: &str) -> Option<String> {
-    if cwd != "/" && cwd.starts_with('/') {
-        Some(format!(
-            "[Workspace]\nYour absolute working directory is `{cwd}`. All workspace \
-             files — `AGENTS.md`, `RESEARCH/`, `PLANS/`, `GUIDES/`, `WORK_LOGS/`, \
-             `OUTBOX/` — and any repositories you clone (under `{cwd}/REPOS/`) live \
-             here. This is where you already are, so start here rather than scanning \
-             `$HOME`. Any specific path the user names is fine to read."
-        ))
-    } else {
-        None
-    }
+fn workspace_section(cwd: &str) -> String {
+    format!("[Workspace]\nCurrent working directory: {cwd}")
 }
 
-/// Append the team-owned instruction section after `[System]` and before core memory.
+/// Append the team-owned instruction section after `[Agent Instructions]` and before core memory.
 fn with_team(prompt: Option<String>, instructions: Option<&str>) -> Option<String> {
     let instructions = instructions
         .map(str::trim)
@@ -1856,7 +1831,7 @@ pub async fn run_prompt_task(
 
     //
     // Core memory is delivered inside the system prompt the harness already
-    // builds (system role for protocol >= 2, the `[System]` user-message
+    // builds (system role for protocol >= 2, the `[Agent Instructions]` user-message
     // section for legacy agents). To put it on the wire at `session/new` for
     // modern agents, the fetch must run *before* the session is created — so
     // we do it here and cache the rendered section in `state.core_sections`.
@@ -2619,12 +2594,14 @@ pub async fn run_prompt_task(
                                 "control signal arrived but turn already completed — treating as success"
                             );
                         }
+                        log_stop_reason(&source, &StopReason::EndTurn);
                         if let PromptSource::Channel(cid) = &source {
                             let standing_sent = !agent.has_system_prompt_support();
-                            agent.state.mark_channel_delivery_success(
+                            record_channel_delivery_success(
+                                &mut agent,
                                 *cid,
                                 standing_sent,
-                                pending_delivered_event_ids.iter().cloned(),
+                                &pending_delivered_event_ids,
                             );
                         }
                         apply_completed_before_control_signal(
@@ -2663,10 +2640,11 @@ pub async fn run_prompt_task(
 
             if let PromptSource::Channel(cid) = &source {
                 let standing_sent = !agent.has_system_prompt_support();
-                agent.state.mark_channel_delivery_success(
+                record_channel_delivery_success(
+                    &mut agent,
                     *cid,
                     standing_sent,
-                    pending_delivered_event_ids.iter().cloned(),
+                    &pending_delivered_event_ids,
                 );
             } else if !agent.has_system_prompt_support() {
                 agent.state.heartbeat_standing_context_sent = true;
@@ -4085,6 +4063,33 @@ fn log_stop_reason(source: &PromptSource, stop_reason: &StopReason) {
     }
 }
 
+fn delivery_receipt_line(channel_id: Uuid, event_ids: &HashSet<String>) -> String {
+    let mut event_ids: Vec<&str> = event_ids.iter().map(String::as_str).collect();
+    event_ids.sort_unstable();
+    format!(
+        "turn delivered Buzz events for channel {channel_id}: {}",
+        event_ids.join(",")
+    )
+}
+
+fn record_channel_delivery_success(
+    agent: &mut OwnedAgent,
+    channel_id: Uuid,
+    standing_context_sent: bool,
+    event_ids: &HashSet<String>,
+) {
+    tracing::info!(
+        target: "pool::prompt",
+        "{}",
+        delivery_receipt_line(channel_id, event_ids)
+    );
+    agent.state.mark_channel_delivery_success(
+        channel_id,
+        standing_context_sent,
+        event_ids.iter().cloned(),
+    );
+}
+
 //
 // Two-phase lifecycle visible to users:
 //   👀  "seen"    — event was queued and an agent will handle it
@@ -4709,6 +4714,17 @@ mod tests {
         }
     }
 
+    #[test]
+    fn delivery_receipt_line_sorts_event_ids() {
+        let channel_id = Uuid::nil();
+        let event_ids = HashSet::from(["beta".to_string(), "alpha".to_string()]);
+
+        assert_eq!(
+            delivery_receipt_line(channel_id, &event_ids),
+            format!("turn delivered Buzz events for channel {channel_id}: alpha,beta")
+        );
+    }
+
     // MINOR (#2884): the permission-mode RPC is gated on agent_supports_mode.
     // An advertised mode issues set_config_option; an absent one is skipped so
     // the harness falls back to per-tool auto-approval. Pin both edges directly.
@@ -4817,7 +4833,7 @@ mod tests {
     fn test_heartbeat_standing_block_is_base_only() {
         // A heartbeat has no channel, so core and canvas are absent by
         // construction — and it has never carried the persona. Pin that the
-        // shared helper does not start handing heartbeats [System].
+        // shared helper does not start handing heartbeats [Agent Instructions].
         let composed = prepend_standing_for_legacy(1, &base_only(Some("be helpful")), "tick");
         assert_eq!(composed, "[Base]\nbe helpful\n\ntick");
     }
@@ -4901,7 +4917,7 @@ mod tests {
         let composed = prepend_standing_for_legacy(1, &full_standing(), "do the thing");
         let positions: Vec<usize> = [
             "[Base]",
-            "[System]",
+            "[Agent Instructions]",
             "[Team Instructions]",
             "[Agent Memory — core]",
             "[Huddle Instructions]",
@@ -4957,86 +4973,64 @@ mod tests {
         // Also the regression guard against #2372: the session title travels
         // out of band in `_meta.sessionTitle`, so this exact-bytes assertion is
         // what pins the framing against a `[Session]` section reappearing here.
-        let framed = framed_system_prompt("/", Some("base text"), Some("persona text"))
+        let framed = framed_system_prompt("/workspace", Some("base text"), Some("persona text"))
             .expect("both present yields Some");
-        assert_eq!(framed, "[Base]\nbase text\n\n[System]\npersona text");
+        assert_eq!(
+            framed,
+            "[Base]\nbase text\n\n[Workspace]\nCurrent working directory: /workspace\n\n[Agent Instructions]\npersona text"
+        );
     }
 
     #[test]
     fn test_framed_system_prompt_base_only_labels_base() {
-        let framed = framed_system_prompt("/", Some("base text"), None).expect("base yields Some");
-        assert_eq!(framed, "[Base]\nbase text");
-    }
-
-    #[test]
-    fn test_framed_system_prompt_persona_only_labels_system() {
-        // A bare persona would be mislabeled "Base" downstream — it must carry
-        // its own [System] header even when no base prompt exists.
         let framed =
-            framed_system_prompt("/", None, Some("persona text")).expect("persona yields Some");
-        assert_eq!(framed, "[System]\npersona text");
-    }
-
-    #[test]
-    fn test_framed_system_prompt_neither_is_none() {
-        assert!(framed_system_prompt("/", None, None).is_none());
-    }
-
-    #[test]
-    fn test_framed_system_prompt_absolute_cwd_prepends_workspace_before_base() {
-        let framed = framed_system_prompt("/Users/me/.buzz", Some("base text"), None)
-            .expect("base yields Some");
-        assert!(
-            framed.starts_with("[Workspace]\n"),
-            "workspace section must lead: {framed}"
-        );
-        assert!(framed.contains("`/Users/me/.buzz`"));
-        assert!(
-            framed.contains("\n\n[Base]\nbase text"),
-            "base must follow the workspace section: {framed}"
+            framed_system_prompt("/workspace", Some("base text"), None).expect("base yields Some");
+        assert_eq!(
+            framed,
+            "[Base]\nbase text\n\n[Workspace]\nCurrent working directory: /workspace"
         );
     }
 
     #[test]
-    fn test_framed_system_prompt_persona_only_omits_workspace() {
-        // The workspace section grounds the base prompt's layout; a persona-only
-        // agent never received that layout, so no [Workspace] anchor is emitted.
-        let framed = framed_system_prompt("/Users/me/.buzz", None, Some("persona text"))
+    fn test_framed_system_prompt_persona_only_labels_agent_instructions() {
+        // A bare persona would be mislabeled "Base" downstream — it must carry
+        // its own [Agent Instructions] header even when no base prompt exists.
+        let framed = framed_system_prompt("/workspace", None, Some("persona text"))
             .expect("persona yields Some");
-        assert_eq!(framed, "[System]\npersona text");
+        assert_eq!(framed, "[Agent Instructions]\npersona text");
     }
 
     #[test]
-    fn test_framed_system_prompt_root_cwd_omits_workspace() {
-        // The "/" fallback must never be named — it would invite a $HOME scan.
-        let framed = framed_system_prompt("/", Some("base text"), None).expect("base yields Some");
-        assert_eq!(framed, "[Base]\nbase text");
+    fn test_framed_system_prompt_neither_is_none() {
+        assert!(framed_system_prompt("/workspace", None, None).is_none());
     }
 
     #[test]
-    fn test_workspace_section_relative_cwd_is_none() {
-        assert!(workspace_section("relative/path").is_none());
-        assert!(workspace_section("").is_none());
+    fn test_workspace_section_preserves_windows_cwd() {
+        assert_eq!(
+            workspace_section(r"C:\Users\me\buzz"),
+            "[Workspace]\nCurrent working directory: C:\\Users\\me\\buzz"
+        );
     }
 
     #[test]
     fn test_with_core_appends_below_framed() {
         let framed = with_core(
-            Some("[System]\npersona".to_string()),
+            Some("[Agent Instructions]\npersona".to_string()),
             Some("[Agent Memory — core]\nbe helpful"),
         )
         .expect("both present yields Some");
         assert_eq!(
             framed,
-            "[System]\npersona\n\n[Agent Memory — core]\nbe helpful"
+            "[Agent Instructions]\npersona\n\n[Agent Memory — core]\nbe helpful"
         );
     }
 
     #[test]
     fn test_with_core_framed_only_passes_through() {
-        let framed = with_core(Some("[System]\npersona".to_string()), None)
+        let framed = with_core(Some("[Agent Instructions]\npersona".to_string()), None)
             .expect("framed-only yields Some");
-        assert_eq!(framed, "[System]\npersona");
+        assert_eq!(framed, "[Agent Instructions]\npersona");
     }
 
     #[test]
diff --git a/crates/buzz-acp/src/queue.rs b/crates/buzz-acp/src/queue.rs
index b50f926d8b7..60866518bad 100644
--- a/crates/buzz-acp/src/queue.rs
+++ b/crates/buzz-acp/src/queue.rs
@@ -1441,13 +1441,13 @@ pub struct FormatPromptArgs<'a> {
     pub profile_lookup: Option<&'a PromptProfileLookup>,
     /// When true, base_prompt and system_prompt are delivered via the system
     /// role (session/new) and omitted from the user message. When false
-    /// (legacy agents), they are injected as `[Base]` and `[System]` sections.
+    /// (legacy agents), they are injected as `[Base]` and `[Agent Instructions]` sections.
     pub has_system_prompt_support: bool,
     /// Base prompt content for legacy agents (protocol_version < 2).
     pub base_prompt: Option<&'a str>,
     /// System prompt content for legacy agents (protocol_version < 2).
     pub system_prompt: Option<&'a str>,
-    /// Team instructions for legacy agents, rendered after `[System]`.
+    /// Team instructions for legacy agents, rendered after `[Agent Instructions]`.
     pub team_instructions: Option<&'a str>,
     /// Rendered `[Channel Canvas]` metadata section for legacy agents.
     ///
@@ -1493,7 +1493,7 @@ impl StandingContext<'_> {
             sections.push(base_section(bp));
         }
         if let Some(sp) = self.system_prompt {
-            sections.push(format!("[System]\n{sp}"));
+            sections.push(format!("[Agent Instructions]\n{sp}"));
         }
         if let Some(team) = self
             .team_instructions
@@ -1531,7 +1531,7 @@ pub(crate) fn base_section(base_prompt: &str) -> String {
 /// Format a [`FlushBatch`] into the per-section prompt blocks for the agent.
 ///
 /// Produces a stable prompt with these sections (in order):
-/// 0. [`StandingContext`] — `[Base]`, `[System]`, `[Team Instructions]`,
+/// 0. [`StandingContext`] — `[Base]`, `[Agent Instructions]`, `[Team Instructions]`,
 ///    `[Agent Memory — core]`, `[Channel Canvas]`. Legacy agents only, and only
 ///    on the session's first message (see `standing_context_sent`)
 /// 1. `[Context]` — scope, channel name, and contextual hints for the agent
@@ -2440,7 +2440,7 @@ mod tests {
         let prompt = format_prompt(&batch, &FormatPromptArgs::default()).join("\n\n");
         // system_prompt and base_prompt are delivered via session/new system role,
         // so they must NOT appear in the user message.
-        assert!(!prompt.contains("[System]"));
+        assert!(!prompt.contains("[Agent Instructions]"));
         assert!(!prompt.contains("[Base]"));
         assert!(prompt.starts_with("[Context]"));
     }
@@ -2553,12 +2553,12 @@ mod tests {
         // They are delivered via session/new system role instead.
         let prompt = format_prompt(&batch, &FormatPromptArgs::default()).join("\n\n");
         assert!(!prompt.contains("[Base]"));
-        assert!(!prompt.contains("[System]"));
+        assert!(!prompt.contains("[Agent Instructions]"));
         assert!(prompt.starts_with("[Context]"));
     }
 
     #[test]
-    fn test_format_prompt_legacy_agent_emits_base_and_system() {
+    fn test_format_prompt_legacy_agent_emits_base_and_agent_instructions() {
         let ch = Uuid::new_v4();
         let event = make_event("hello");
 
@@ -2592,20 +2592,23 @@ mod tests {
             "missing [Base] section"
         );
         assert!(
-            prompt.contains("[System]\ntest system prompt"),
-            "missing [System] section"
+            prompt.contains("[Agent Instructions]\ntest system prompt"),
+            "missing [Agent Instructions] section"
         );
 
-        // [Base] and [System] must appear BEFORE [Agent Memory] and [Context]
+        // [Base] and [Agent Instructions] must appear BEFORE [Agent Memory] and [Context]
         let base_pos = prompt.find("[Base]").unwrap();
-        let system_pos = prompt.find("[System]").unwrap();
+        let system_pos = prompt.find("[Agent Instructions]").unwrap();
         let core_pos = prompt.find("[Agent Memory").unwrap();
         let context_pos = prompt.find("[Context]").unwrap();
 
-        assert!(base_pos < system_pos, "[Base] should come before [System]");
+        assert!(
+            base_pos < system_pos,
+            "[Base] should come before [Agent Instructions]"
+        );
         assert!(
             system_pos < core_pos,
-            "[System] should come before [Agent Memory]"
+            "[Agent Instructions] should come before [Agent Memory]"
         );
         assert!(
             core_pos < context_pos,
@@ -2649,7 +2652,7 @@ mod tests {
 
         for section in [
             "[Base]",
-            "[System]",
+            "[Agent Instructions]",
             "[Team Instructions]",
             "[Agent Memory — core]",
             "[Channel Canvas]",
@@ -2669,7 +2672,7 @@ mod tests {
     }
 
     #[test]
-    fn test_format_prompt_modern_agent_suppresses_base_and_system() {
+    fn test_format_prompt_modern_agent_suppresses_base_and_agent_instructions() {
         let ch = Uuid::new_v4();
         let event = make_event("hello");
 
@@ -2701,8 +2704,8 @@ mod tests {
             "[Base] should be suppressed for modern agents"
         );
         assert!(
-            !prompt.contains("[System]"),
-            "[System] should be suppressed for modern agents"
+            !prompt.contains("[Agent Instructions]"),
+            "[Agent Instructions] should be suppressed for modern agents"
         );
         assert!(prompt.starts_with("[Context]"));
     }
@@ -2761,9 +2764,9 @@ mod tests {
             context_pos < thread_pos,
             "[Context] must come before [Thread Context]"
         );
-        // No [Base] or [System] in user message
+        // No [Base] or [Agent Instructions] in user message
         assert!(!prompt.contains("[Base]"));
-        assert!(!prompt.contains("[System]"));
+        assert!(!prompt.contains("[Agent Instructions]"));
     }
 
     #[test]
diff --git a/crates/buzz-deletion/src/lib.rs b/crates/buzz-deletion/src/lib.rs
index 4e27b85fe9f..ae3dbe4f396 100644
--- a/crates/buzz-deletion/src/lib.rs
+++ b/crates/buzz-deletion/src/lib.rs
@@ -547,23 +547,17 @@ fn nonempty_s3_region(region: String) -> Option<String> {
     (!region.is_empty()).then(|| region.to_string())
 }
 
-fn s3_region_from_env() -> String {
-    resolve_s3_region(
-        std::env::var("BUZZ_S3_REGION").ok(),
-        std::env::var("AWS_REGION").ok(),
-    )
-}
-
 async fn connect_services() -> Result<Services> {
     let store = connect_store().await?;
     connect_services_with_store(store).await
 }
 
 async fn connect_services_with_store(store: DeletionStore) -> Result<Services> {
+    let (s3_access_key, s3_secret_key) = s3_key_pair_from_env();
     let media_config = buzz_media::MediaConfig {
         s3_endpoint: required_env("BUZZ_S3_ENDPOINT")?,
-        s3_access_key: required_env("BUZZ_S3_ACCESS_KEY")?,
-        s3_secret_key: required_env("BUZZ_S3_SECRET_KEY")?,
+        s3_access_key,
+        s3_secret_key,
         s3_bucket: required_env("BUZZ_S3_BUCKET")?,
         s3_region: s3_region_from_env(),
         s3_addressing_style: std::env::var("BUZZ_S3_ADDRESSING_STYLE")
@@ -596,6 +590,24 @@ async fn connect_services_with_store(store: DeletionStore) -> Result<Services> {
     })
 }
 
+fn s3_region_from_env() -> String {
+    resolve_s3_region(
+        std::env::var("BUZZ_S3_REGION").ok(),
+        std::env::var("AWS_REGION").ok(),
+    )
+}
+
+fn s3_key_pair_from_env() -> (String, String) {
+    s3_key_pair_from(|name| std::env::var(name).ok())
+}
+
+fn s3_key_pair_from(get_env: impl Fn(&str) -> Option<String>) -> (String, String) {
+    (
+        optional_env_from(&get_env, "BUZZ_S3_ACCESS_KEY"),
+        optional_env_from(&get_env, "BUZZ_S3_SECRET_KEY"),
+    )
+}
+
 fn required_env(name: &str) -> Result<String> {
     std::env::var(name)
         .ok()
@@ -604,6 +616,12 @@ fn required_env(name: &str) -> Result<String> {
         .ok_or_else(|| anyhow::anyhow!("{name} is required for community deletion"))
 }
 
+fn optional_env_from(get_env: impl Fn(&str) -> Option<String>, name: &str) -> String {
+    get_env(name)
+        .map(|value| value.trim().to_owned())
+        .unwrap_or_default()
+}
+
 fn env_parse<T>(name: &str, default: T) -> T
 where
     T: std::str::FromStr,
@@ -1543,6 +1561,68 @@ mod tests {
         (db, services, claim)
     }
 
+    fn env_of<'a>(set: &'a [(&'a str, &'a str)]) -> impl Fn(&str) -> Option<String> + use<'a> {
+        move |name| {
+            set.iter()
+                .find(|(key, _)| *key == name)
+                .map(|(_, value)| (*value).to_string())
+        }
+    }
+
+    #[test]
+    fn deletion_s3_key_pair_normalizes_missing_and_blank_pairs_for_default_credentials() {
+        assert_eq!(
+            s3_key_pair_from(env_of(&[])),
+            (String::new(), String::new())
+        );
+
+        assert_eq!(
+            s3_key_pair_from(env_of(&[
+                ("BUZZ_S3_ACCESS_KEY", ""),
+                ("BUZZ_S3_SECRET_KEY", "   "),
+            ])),
+            (String::new(), String::new())
+        );
+    }
+
+    #[test]
+    fn deletion_s3_key_pair_trims_static_and_preserves_partial_pairs() {
+        assert_eq!(
+            s3_key_pair_from(env_of(&[
+                ("BUZZ_S3_ACCESS_KEY", " buzz_dev "),
+                ("BUZZ_S3_SECRET_KEY", " buzz_dev_secret "),
+            ])),
+            ("buzz_dev".to_string(), "buzz_dev_secret".to_string())
+        );
+
+        for (env, expected) in [
+            (
+                &[("BUZZ_S3_ACCESS_KEY", " buzz_dev ")][..],
+                ("buzz_dev".to_string(), String::new()),
+            ),
+            (
+                &[("BUZZ_S3_SECRET_KEY", " buzz_dev_secret ")][..],
+                (String::new(), "buzz_dev_secret".to_string()),
+            ),
+            (
+                &[
+                    ("BUZZ_S3_ACCESS_KEY", " buzz_dev "),
+                    ("BUZZ_S3_SECRET_KEY", "   "),
+                ][..],
+                ("buzz_dev".to_string(), String::new()),
+            ),
+            (
+                &[
+                    ("BUZZ_S3_ACCESS_KEY", "   "),
+                    ("BUZZ_S3_SECRET_KEY", " buzz_dev_secret "),
+                ][..],
+                (String::new(), "buzz_dev_secret".to_string()),
+            ),
+        ] {
+            assert_eq!(s3_key_pair_from(env_of(env)), expected);
+        }
+    }
+
     fn deletion_test_media_storage() -> Arc<MediaStorage> {
         let endpoint = std::env::var("BUZZ_TEST_S3_ENDPOINT")
             .or_else(|_| std::env::var("BUZZ_S3_ENDPOINT"))
diff --git a/crates/buzz-relay/src/audio/handler.rs b/crates/buzz-relay/src/audio/handler.rs
index 4c158eab0c4..de8f1e14591 100644
--- a/crates/buzz-relay/src/audio/handler.rs
+++ b/crates/buzz-relay/src/audio/handler.rs
@@ -121,7 +121,7 @@ fn limit_audio_websocket<F>(ws: WebSocketUpgrade<F>) -> WebSocketUpgrade<F> {
 /// Highest huddle audio protocol version this relay understands. Clients are
 /// allowed to negotiate any version in `1..=CURRENT_PROTOCOL_VERSION`; older
 /// versions stay supported indefinitely for staged rollouts.
-const CURRENT_PROTOCOL_VERSION: u8 = 2;
+const CURRENT_PROTOCOL_VERSION: u8 = 3;
 
 #[derive(Deserialize)]
 struct AuthMsg {
@@ -511,47 +511,75 @@ async fn handle_active_audio_connection(
 
     let admission = if let Some(session) = remote_session.as_ref() {
         room.add_peer_at_index(pubkey_hex.clone(), requested_version, session.peer_index())
-            .map(|(id, audio, ctrl)| (id, session.peer_index(), audio, ctrl))
+            .map(|(id, _mirror_epoch, audio, ctrl, revision)| {
+                // Report the owner-assigned epoch, not the local mirror's:
+                // the mirror never fans out via `broadcast_frame`, so its epoch
+                // is inert. The client's self-entry must match the owner roster.
+                (
+                    id,
+                    session.peer_index(),
+                    session.epoch(),
+                    audio,
+                    ctrl,
+                    revision,
+                )
+            })
     } else {
         room.add_peer(pubkey_hex.clone(), requested_version)
     };
-    let (peer_id, peer_index, audio_rx, peer_ctrl_rx) = match admission {
-        Ok(v) => v,
-        Err(crate::audio::room::AdmissionError::Full) => {
-            warn!(channel_id = %channel_id, "audio room full (255 peers exhausted)");
-            let _ = ws_send.send(WsMessage::Text(serde_json::json!({"type":"error","code":"room_full","message":"peer index space exhausted"}).to_string().into())).await;
-            if let (Some(session), Some(stream)) = (remote_session.as_ref(), remote_stream.as_mut())
-            {
-                crate::audio::join::send_clean_close(stream, session.fenced(), session.pubkey())
+    let (peer_id, peer_index, peer_epoch, audio_rx, peer_ctrl_rx, admission_revision) =
+        match admission {
+            Ok(v) => v,
+            Err(crate::audio::room::AdmissionError::Full) => {
+                warn!(channel_id = %channel_id, "audio room participant capacity reached");
+                let _ = ws_send.send(WsMessage::Text(serde_json::json!({"type":"error","code":"room_full","message":"room participant capacity reached"}).to_string().into())).await;
+                if let (Some(session), Some(stream)) =
+                    (remote_session.as_ref(), remote_stream.as_mut())
+                {
+                    crate::audio::join::send_clean_close(
+                        stream,
+                        session.fenced(),
+                        session.pubkey(),
+                    )
                     .await;
+                }
+                return;
             }
-            return;
-        }
-        Err(crate::audio::room::AdmissionError::Ended) => {
-            debug!(channel_id = %channel_id, "room ended before admission");
-            let _ = ws_send.send(WsMessage::Text(serde_json::json!({"type":"error","code":"room_ended","message":"huddle has ended"}).to_string().into())).await;
-            if let (Some(session), Some(stream)) = (remote_session.as_ref(), remote_stream.as_mut())
-            {
-                crate::audio::join::send_clean_close(stream, session.fenced(), session.pubkey())
+            Err(crate::audio::room::AdmissionError::Ended) => {
+                debug!(channel_id = %channel_id, "room ended before admission");
+                let _ = ws_send.send(WsMessage::Text(serde_json::json!({"type":"error","code":"room_ended","message":"huddle has ended"}).to_string().into())).await;
+                if let (Some(session), Some(stream)) =
+                    (remote_session.as_ref(), remote_stream.as_mut())
+                {
+                    crate::audio::join::send_clean_close(
+                        stream,
+                        session.fenced(),
+                        session.pubkey(),
+                    )
                     .await;
+                }
+                return;
             }
-            return;
-        }
-        Err(crate::audio::room::AdmissionError::VersionMismatch { pinned, requested }) => {
-            info!(channel_id = %channel_id, pubkey = %pubkey_hex, pinned, requested, "audio: protocol version mismatch — upgrade required");
-            let _ = ws_send.send(WsMessage::Text(serde_json::json!({
+            Err(crate::audio::room::AdmissionError::VersionMismatch { pinned, requested }) => {
+                info!(channel_id = %channel_id, pubkey = %pubkey_hex, pinned, requested, "audio: protocol version mismatch — upgrade required");
+                let _ = ws_send.send(WsMessage::Text(serde_json::json!({
                 "type": "error", "code": "upgrade_required",
                 "message": format!("this huddle is using audio protocol v{pinned}; your client requested v{requested}"),
                 "pinned_version": pinned, "requested_version": requested,
             }).to_string().into())).await;
-            if let (Some(session), Some(stream)) = (remote_session.as_ref(), remote_stream.as_mut())
-            {
-                crate::audio::join::send_clean_close(stream, session.fenced(), session.pubkey())
+                if let (Some(session), Some(stream)) =
+                    (remote_session.as_ref(), remote_stream.as_mut())
+                {
+                    crate::audio::join::send_clean_close(
+                        stream,
+                        session.fenced(),
+                        session.pubkey(),
+                    )
                     .await;
+                }
+                return;
             }
-            return;
-        }
-    };
+        };
 
     info!(
         channel_id = %channel_id,
@@ -608,24 +636,41 @@ async fn handle_active_audio_connection(
 
     // Remote registration and owner-assigned ingress admission completed above.
 
-    let peers_snapshot: Vec<serde_json::Value> = if let Some(session) = remote_session.as_ref() {
-        session
-            .roster()
-            .peers
-            .iter()
-            .map(|peer| serde_json::json!({"pubkey": peer.pubkey, "peer_index": peer.peer_index}))
-            .collect()
+    let (peers_snapshot, roster_revision): (Vec<serde_json::Value>, u64) = if let Some(session) =
+        remote_session.as_ref()
+    {
+        (
+                session
+                    .roster()
+                    .peers
+                    .iter()
+                    .map(|peer| {
+                        serde_json::json!({"pubkey": peer.pubkey, "peer_index": peer.peer_index, "epoch": peer.epoch})
+                    })
+                    .collect(),
+                session.roster().revision,
+            )
     } else {
-        room.peer_pubkeys()
-            .into_iter()
-            .map(|(pk, idx)| serde_json::json!({"pubkey": pk, "peer_index": idx}))
-            .collect()
+        let snapshot = room.roster_snapshot();
+        (
+                snapshot
+                    .peers
+                    .into_iter()
+                    .map(|peer| {
+                        serde_json::json!({"pubkey": peer.pubkey, "peer_index": peer.peer_index, "epoch": peer.epoch})
+                    })
+                    .collect(),
+                snapshot.revision,
+            )
     };
+    debug_assert!(roster_revision >= admission_revision);
 
     let joined_msg = serde_json::json!({
         "type": "joined",
+        "revision": roster_revision,
         "pubkey": pubkey_hex,
         "peer_index": peer_index,
+        "epoch": peer_epoch,
         "peers": peers_snapshot,
     })
     .to_string();
@@ -647,13 +692,22 @@ async fn handle_active_audio_connection(
     }
 
     // ── Step 6: emit kind:48101 (PARTICIPANT_JOINED) ──────────────────────────
+    let lifecycle_revision = if remote_session.is_some() {
+        roster_revision
+    } else {
+        admission_revision
+    };
     emit_participant_event(
         &state,
         &tenant,
-        Kind::Custom(48101),
         channel_id,
         parent_id_for_event,
-        &pubkey_hex,
+        ParticipantLifecycle {
+            kind: Kind::Custom(48101),
+            participant_pubkey: &pubkey_hex,
+            roster_revision: Some(lifecycle_revision),
+            admission_id: Some(peer_id),
+        },
     )
     .await;
 
@@ -684,6 +738,7 @@ async fn handle_active_audio_connection(
         data_tx,
         ctrl_tx.clone(),
         fwd_cancel,
+        cancel.clone(),
     ));
 
     // Non-owner path: own the owner's `HuddleControl` stream in a reader task.
@@ -811,32 +866,53 @@ async fn handle_active_audio_connection(
     // AdmissionGuard lock across index recycling AND the is_empty + ended=true
     // check. Ingress mirrors never archive authoritative huddle state; they
     // remove locally and let the owner decide room lifetime.
-    let should_auto_end = if remote_session.is_some() {
-        room.remove_peer(peer_id);
-        false
+    let removal = if remote_session.is_some() {
+        room.remove_peer(peer_id).map(|delta| (delta, false))
     } else {
         room.remove_peer_and_check_ended(peer_id)
-            .map(|(_, ended)| ended)
-            .unwrap_or(false)
     };
+    let removal_revision = if remote_session.is_none() {
+        removal.as_ref().map(|(delta, _)| delta.revision)
+    } else {
+        // The ingress mirror's local revision is not the owner's authoritative
+        // ordering. Omit it rather than publishing a plausible-but-wrong value.
+        None
+    };
+    let should_auto_end = removal.as_ref().map(|(_, ended)| *ended).unwrap_or(false);
 
-    let left_msg = serde_json::json!({
-        "type": "left",
-        "pubkey": pubkey_hex,
-        "peer_index": peer_index,
-    })
-    .to_string();
     if remote_session.is_none() {
-        room.broadcast_control(left_msg);
+        if let Some((delta, _)) = removal {
+            if let Some(left) = delta.left {
+                let left_msg = serde_json::json!({
+                    "type": "left",
+                    "revision": delta.revision,
+                    "pubkey": left.pubkey,
+                    "peer_index": left.peer_index,
+                    "epoch": left.epoch,
+                })
+                .to_string();
+                room.broadcast_control(left_msg);
+            } else {
+                warn!(
+                    channel_id = %channel_id,
+                    revision = delta.revision,
+                    "audio peer removal delta did not include the removed peer"
+                );
+            }
+        }
     }
 
     emit_participant_event(
         &state,
         &tenant,
-        Kind::Custom(48102),
         channel_id,
         parent_id_for_event,
-        &pubkey_hex,
+        ParticipantLifecycle {
+            kind: Kind::Custom(48102),
+            participant_pubkey: &pubkey_hex,
+            roster_revision: removal_revision,
+            admission_id: Some(peer_id),
+        },
     )
     .await;
 
@@ -862,10 +938,14 @@ async fn handle_active_audio_connection(
                 emit_participant_event(
                     &state,
                     &tenant,
-                    Kind::Custom(48103),
                     channel_id,
                     parent_id_for_event,
-                    &pubkey_hex,
+                    ParticipantLifecycle {
+                        kind: Kind::Custom(48103),
+                        participant_pubkey: &pubkey_hex,
+                        roster_revision: None,
+                        admission_id: None,
+                    },
                 )
                 .await;
             }
@@ -928,7 +1008,7 @@ fn remote_rejection_ws_error(reason: &crate::audio::join::RegisterRejection) ->
     match reason {
         RegisterRejection::RoomFull => serde_json::json!({
             "type": "error", "code": "room_full",
-            "message": "peer index space exhausted"
+            "message": "room participant capacity reached"
         }),
         RegisterRejection::RoomEnded => serde_json::json!({
             "type": "error", "code": "room_ended", "message": "huddle has ended"
@@ -1115,6 +1195,7 @@ async fn audio_forward_loop(
     data_tx: mpsc::Sender<WsMessage>,
     ctrl_tx: mpsc::Sender<WsMessage>,
     cancel: CancellationToken,
+    connection_cancel: CancellationToken,
 ) {
     loop {
         tokio::select! {
@@ -1124,9 +1205,18 @@ async fn audio_forward_loop(
             msg = peer_ctrl_rx.recv() => {
                 match msg {
                     Some(PeerCtrl::Json(json)) => {
-                        let _ = ctrl_tx.try_send(WsMessage::Text(json.into()));
+                        if ctrl_tx.try_send(WsMessage::Text(json.into())).is_err() {
+                            // State-bearing roster control may not be dropped.
+                            // Closing the connection forces admission to replay
+                            // a fresh authoritative snapshot.
+                            connection_cancel.cancel();
+                            break;
+                        }
+                    }
+                    Some(PeerCtrl::Close) | None => {
+                        connection_cancel.cancel();
+                        break;
                     }
-                    Some(PeerCtrl::Close) | None => break,
                 }
             }
             frame = audio_rx.recv() => {
@@ -1251,15 +1341,44 @@ async fn ensure_membership(
     Err("not a member".into())
 }
 
+#[derive(Clone, Copy)]
+struct ParticipantLifecycle<'a> {
+    kind: Kind,
+    participant_pubkey: &'a str,
+    roster_revision: Option<u64>,
+    admission_id: Option<Uuid>,
+}
+
 async fn emit_participant_event(
     state: &AppState,
     tenant: &TenantContext,
-    kind: Kind,
     channel_id: Uuid,
     parent_channel_id: Uuid,
-    participant_pubkey: &str,
+    lifecycle: ParticipantLifecycle<'_>,
 ) {
-    let content = serde_json::json!({"ephemeral_channel_id": channel_id.to_string()}).to_string();
+    let ParticipantLifecycle {
+        kind,
+        participant_pubkey,
+        roster_revision,
+        admission_id,
+    } = lifecycle;
+    let content = match (roster_revision, admission_id) {
+        (Some(revision), Some(admission_id)) => serde_json::json!({
+            "ephemeral_channel_id": channel_id.to_string(),
+            "roster_revision": revision,
+            "admission_id": admission_id.to_string(),
+        }),
+        (Some(revision), None) => serde_json::json!({
+            "ephemeral_channel_id": channel_id.to_string(),
+            "roster_revision": revision,
+        }),
+        (None, Some(admission_id)) => serde_json::json!({
+            "ephemeral_channel_id": channel_id.to_string(),
+            "admission_id": admission_id.to_string(),
+        }),
+        (None, None) => serde_json::json!({"ephemeral_channel_id": channel_id.to_string()}),
+    }
+    .to_string();
 
     let h_tag = match Tag::parse(["h", &parent_channel_id.to_string()]) {
         Ok(t) => t,
@@ -1433,6 +1552,66 @@ mod tests {
         received
     }
 
+    #[tokio::test]
+    async fn saturated_websocket_control_queue_cancels_the_audio_connection() {
+        let (_audio_tx, audio_rx) = mpsc::channel(1);
+        let (peer_ctrl_tx, peer_ctrl_rx) = mpsc::channel(2);
+        let (data_tx, _data_rx) = mpsc::channel(1);
+        let (ctrl_tx, _ctrl_rx) = mpsc::channel(1);
+        ctrl_tx
+            .try_send(WsMessage::Ping(Bytes::new()))
+            .expect("fill websocket control queue");
+        peer_ctrl_tx
+            .try_send(PeerCtrl::Json("{}".into()))
+            .expect("queue state-bearing control");
+        let task_cancel = CancellationToken::new();
+        let connection_cancel = CancellationToken::new();
+
+        audio_forward_loop(
+            audio_rx,
+            peer_ctrl_rx,
+            data_tx,
+            ctrl_tx,
+            task_cancel,
+            connection_cancel.clone(),
+        )
+        .await;
+
+        assert!(
+            connection_cancel.is_cancelled(),
+            "saturated websocket control must force a fresh roster admission"
+        );
+    }
+
+    #[tokio::test]
+    async fn closed_peer_control_queue_cancels_the_audio_connection() {
+        let (_audio_tx, audio_rx) = mpsc::channel(1);
+        let (peer_ctrl_tx, peer_ctrl_rx) = mpsc::channel(1);
+        let (data_tx, _data_rx) = mpsc::channel(1);
+        let (ctrl_tx, _ctrl_rx) = mpsc::channel(1);
+        let task_cancel = CancellationToken::new();
+        let connection_cancel = CancellationToken::new();
+
+        let forward = tokio::spawn(audio_forward_loop(
+            audio_rx,
+            peer_ctrl_rx,
+            data_tx,
+            ctrl_tx,
+            task_cancel,
+            connection_cancel.clone(),
+        ));
+        drop(peer_ctrl_tx);
+
+        tokio::time::timeout(Duration::from_secs(1), forward)
+            .await
+            .expect("forwarder exits when its state-bearing queue closes")
+            .expect("forwarder task completes cleanly");
+        assert!(
+            connection_cancel.is_cancelled(),
+            "lost control state must tear down the WebSocket for a fresh roster"
+        );
+    }
+
     #[tokio::test]
     async fn audio_send_loop_sends_policy_close_when_community_is_deleted() {
         use futures_util::Sink;
diff --git a/crates/buzz-relay/src/audio/join.rs b/crates/buzz-relay/src/audio/join.rs
index ddadb13f7ff..96cc66b4e07 100644
--- a/crates/buzz-relay/src/audio/join.rs
+++ b/crates/buzz-relay/src/audio/join.rs
@@ -47,7 +47,7 @@ use dashmap::DashMap;
 use serde::{Deserialize, Serialize};
 use tokio::task::JoinHandle;
 use tokio_util::sync::CancellationToken;
-use tracing::debug;
+use tracing::{debug, warn};
 use uuid::Uuid;
 
 use super::mesh::spawn_remote_peer_sink;
@@ -831,6 +831,11 @@ pub enum HuddleControlMsg {
         /// Owner-allocated 0..=254 index; the sole allocator is the owner, so
         /// indices never collide across pods.
         peer_index: u8,
+        /// Owner-assigned occupancy epoch for `peer_index`. The non-owner pod
+        /// stamps this on protocol v3 media datagrams so the frame carries the
+        /// same `[peer_index][epoch]` identity a same-pod speaker's frame would
+        /// (see [`RosterEntry::epoch`]).
+        epoch: u8,
         /// Complete authoritative roster after this admission. This is in the
         /// registration reply so no media/client identity can precede it.
         roster: RosterSnapshot,
@@ -880,6 +885,9 @@ pub struct RosterEntry {
     pub pubkey: String,
     /// Owner-assigned media routing index.
     pub peer_index: u8,
+    /// Occupancy epoch for `peer_index`, bumped each time the index is reused
+    /// by a new pubkey so stale in-flight media frames can be fenced.
+    pub epoch: u8,
 }
 
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
@@ -896,6 +904,7 @@ impl From<RosterPeer> for RosterEntry {
         Self {
             pubkey: peer.pubkey,
             peer_index: peer.peer_index,
+            epoch: peer.epoch,
         }
     }
 }
@@ -1292,17 +1301,8 @@ impl<D: HuddleDirectory + ?Sized> HuddleControlAcceptor<D> {
                             self.rooms
                                 .get(CommunityId::from_uuid(community_id), session_id)
                         }) {
-                            let peer_index = room.peers.get(&peer_id).map(|peer| peer.peer_index);
-                            room.remove_peer(peer_id);
-                            if let Some(peer_index) = peer_index {
-                                room.broadcast_control(
-                                    serde_json::json!({
-                                        "type": "left",
-                                        "pubkey": pubkey,
-                                        "peer_index": peer_index,
-                                    })
-                                    .to_string(),
-                                );
+                            if let Some(delta) = room.remove_peer(peer_id) {
+                                broadcast_peer_left(&room, delta, session_id);
                             }
                         }
                     }
@@ -1351,18 +1351,9 @@ impl<D: HuddleDirectory + ?Sized> HuddleControlAcceptor<D> {
             self.rooms
                 .get(CommunityId::from_uuid(community_id), session_id)
         }) {
-            for (pubkey, peer_id) in registered {
-                let peer_index = room.peers.get(&peer_id).map(|peer| peer.peer_index);
-                room.remove_peer(peer_id);
-                if let Some(peer_index) = peer_index {
-                    room.broadcast_control(
-                        serde_json::json!({
-                            "type": "left",
-                            "pubkey": pubkey,
-                            "peer_index": peer_index,
-                        })
-                        .to_string(),
-                    );
+            for (_pubkey, peer_id) in registered {
+                if let Some(delta) = room.remove_peer(peer_id) {
+                    broadcast_peer_left(&room, delta, session_id);
                 }
             }
         }
@@ -1381,7 +1372,7 @@ impl<D: HuddleDirectory + ?Sized> HuddleControlAcceptor<D> {
         registered: &mut std::collections::HashMap<String, Uuid>,
     ) -> HuddleControlMsg {
         match room.add_peer(pubkey.to_string(), protocol_version) {
-            Ok((peer_id, peer_index, audio_rx, _peer_ctrl_rx)) => {
+            Ok((peer_id, peer_index, epoch, audio_rx, _peer_ctrl_rx, roster_revision)) => {
                 registered.insert(pubkey.to_string(), peer_id);
                 // The owner's Room fans out to this remote peer's `audio_tx`;
                 // the sink drains `audio_rx` and ships each frame as a datagram
@@ -1389,15 +1380,18 @@ impl<D: HuddleDirectory + ?Sized> HuddleControlAcceptor<D> {
                 spawn_remote_peer_sink(Arc::clone(&self.transport), from, fenced, audio_rx);
                 let joined = serde_json::json!({
                     "type": "joined",
+                    "revision": roster_revision,
                     "pubkey": pubkey,
                     "peer_index": peer_index,
-                    "peers": [{"pubkey": pubkey, "peer_index": peer_index}],
+                    "epoch": epoch,
+                    "peers": [{"pubkey": pubkey, "peer_index": peer_index, "epoch": epoch}],
                 })
                 .to_string();
                 room.broadcast_control(joined);
                 HuddleControlMsg::PeerRegistered {
                     pubkey: pubkey.to_string(),
                     peer_index,
+                    epoch,
                     roster: roster_snapshot(&room),
                 }
             }
@@ -1409,6 +1403,34 @@ impl<D: HuddleDirectory + ?Sized> HuddleControlAcceptor<D> {
     }
 }
 
+fn broadcast_peer_left(room: &Room, delta: RoomRosterDelta, session_id: Uuid) {
+    let Some(left) = peer_left_control(delta, session_id) else {
+        return;
+    };
+    room.broadcast_control(left);
+}
+
+fn peer_left_control(delta: RoomRosterDelta, session_id: Uuid) -> Option<String> {
+    let Some(left) = delta.left else {
+        warn!(
+            %session_id,
+            revision = delta.revision,
+            "mesh audio peer removal delta did not include the removed peer"
+        );
+        return None;
+    };
+    Some(
+        serde_json::json!({
+            "type": "left",
+            "revision": delta.revision,
+            "pubkey": left.pubkey,
+            "peer_index": left.peer_index,
+            "epoch": left.epoch,
+        })
+        .to_string(),
+    )
+}
+
 fn roster_snapshot(room: &Room) -> RosterSnapshot {
     let snapshot = room.roster_snapshot();
     RosterSnapshot {
@@ -1471,6 +1493,13 @@ pub struct RemoteHuddleSession {
     /// The owner-allocated peer index this client occupies in the owner's room.
     /// Stamped on every media datagram so the owner attributes frames correctly.
     peer_index: u8,
+    /// The owner-assigned occupancy epoch for `peer_index`. Stamped alongside
+    /// `peer_index` on protocol v3 media datagrams so owner-side fan-out
+    /// produces the same `[peer_index][epoch]` prefix as a same-pod speaker.
+    epoch: u8,
+    /// The protocol version negotiated for this client. Cross-pod framing must
+    /// preserve the released v1/v2 one-byte prefix and add `epoch` only for v3.
+    protocol_version: u8,
     /// Latest complete authoritative owner roster.
     roster: RosterSnapshot,
     /// Fenced header for this session's owner epoch; every datagram carries it.
@@ -1544,7 +1573,7 @@ pub async fn read_owner_control(
                     let json = serde_json::json!({
                         "type": "roster", "revision": revision,
                         "peers": peers.into_iter().map(|p| serde_json::json!({
-                            "pubkey": p.pubkey, "peer_index": p.peer_index,
+                            "pubkey": p.pubkey, "peer_index": p.peer_index, "epoch": p.epoch,
                         })).collect::<Vec<_>>()
                     })
                     .to_string();
@@ -1565,13 +1594,13 @@ pub async fn read_owner_control(
                     let json = if let Some(peer) = joined {
                         serde_json::json!({
                             "type": "joined", "revision": revision,
-                            "pubkey": peer.pubkey, "peer_index": peer.peer_index,
-                            "peers": [{"pubkey": peer.pubkey, "peer_index": peer.peer_index}],
+                            "pubkey": peer.pubkey, "peer_index": peer.peer_index, "epoch": peer.epoch,
+                            "peers": [{"pubkey": peer.pubkey, "peer_index": peer.peer_index, "epoch": peer.epoch}],
                         })
                     } else if let Some(peer) = left {
                         serde_json::json!({
                             "type": "left", "revision": revision,
-                            "pubkey": peer.pubkey, "peer_index": peer.peer_index,
+                            "pubkey": peer.pubkey, "peer_index": peer.peer_index, "epoch": peer.epoch,
                         })
                     } else {
                         continue;
@@ -1696,10 +1725,15 @@ pub async fn dial_remote_owner(
     match stream.recv_frame().await? {
         Some(MeshStreamFrame::Data { payload, .. }) => match decode_control(&payload)? {
             HuddleControlMsg::PeerRegistered {
-                peer_index, roster, ..
+                peer_index,
+                epoch,
+                roster,
+                ..
             } => Ok((
                 RemoteHuddleSession {
                     peer_index,
+                    epoch,
+                    protocol_version,
                     roster,
                     fenced,
                     owner,
@@ -1733,6 +1767,14 @@ impl RemoteHuddleSession {
         self.peer_index
     }
 
+    /// The owner-assigned occupancy epoch for this client's index. Reported to
+    /// the client alongside `peer_index` so its self-entry matches the owner's
+    /// authoritative roster (the local ingress mirror's own epoch is inert —
+    /// the mirror never fans out via `broadcast_frame`).
+    pub fn epoch(&self) -> u8 {
+        self.epoch
+    }
+
     /// Complete authoritative roster returned atomically with registration.
     pub fn roster(&self) -> &RosterSnapshot {
         &self.roster
@@ -1753,7 +1795,14 @@ impl RemoteHuddleSession {
     /// with the owner-assigned index. Drop-on-error: realtime audio never blocks
     /// on a slow or gone link (the same discipline as local fan-out).
     pub fn forward_media(&mut self, client_frame: &[u8]) {
-        let dgram = media_datagram(self.peer_index, self.fenced, self.seq, client_frame);
+        let dgram = media_datagram(
+            self.peer_index,
+            self.epoch,
+            self.protocol_version,
+            self.fenced,
+            self.seq,
+            client_frame,
+        );
         self.seq = self.seq.wrapping_add(1);
         if let Err(e) = self.transport.send_datagram(self.owner, dgram) {
             debug!(owner = %self.owner, "huddle media datagram to owner failed: {e}");
@@ -1785,17 +1834,27 @@ pub async fn send_clean_close(stream: &mut MeshStream, fenced: FencedHeader, pub
 }
 
 /// Build the media datagram a non-owner ships to the owner for one client
-/// frame: `[owner_peer_index][client frame]`, stamped with the session fence
-/// and sequence. Pure so the framing is unit-testable without a live transport
-/// or stream.
+/// frame, stamped with the session fence and sequence. Protocol v1/v2 retain
+/// their released `[owner_peer_index][client frame]` framing; v3 adds the
+/// owner-assigned epoch: `[owner_peer_index][epoch][client frame]`. Both are
+/// byte-identical to [`super::room::Room::broadcast_frame`]. The owner-side
+/// [`super::mesh::MeshAudioRouter::on_media_datagram`] splits off `peer_index`
+/// and re-prefixes the opaque remainder. Pure so framing is unit-testable
+/// without a live transport or stream.
 fn media_datagram(
     peer_index: u8,
+    epoch: u8,
+    protocol_version: u8,
     fenced: FencedHeader,
     seq: u64,
     client_frame: &[u8],
 ) -> MeshDatagram {
-    let mut payload = Vec::with_capacity(1 + client_frame.len());
+    let prefix_len = if protocol_version >= 3 { 2 } else { 1 };
+    let mut payload = Vec::with_capacity(prefix_len + client_frame.len());
     payload.push(peer_index);
+    if protocol_version >= 3 {
+        payload.push(epoch);
+    }
     payload.extend_from_slice(client_frame);
     MeshDatagram {
         fenced,
@@ -1817,6 +1876,21 @@ mod tests {
         CommunityId::from_uuid(Uuid::from_u128(0xC0FFEE))
     }
 
+    #[test]
+    fn missing_peer_in_removal_delta_is_non_fatal() {
+        assert_eq!(
+            peer_left_control(
+                RoomRosterDelta {
+                    revision: 7,
+                    joined: None,
+                    left: None,
+                },
+                Uuid::from_u128(42),
+            ),
+            None,
+        );
+    }
+
     /// Scripted directory: `owner_of` returns a queued lookup, `acquire`
     /// returns a queued outcome, `validate` returns a queued result. Records
     /// call counts so ordering can be asserted.
@@ -2037,11 +2111,13 @@ mod tests {
             HuddleControlMsg::PeerRegistered {
                 pubkey: "abc123".into(),
                 peer_index: 42,
+                epoch: 0,
                 roster: RosterSnapshot {
                     revision: 1,
                     peers: vec![RosterEntry {
                         pubkey: "abc123".into(),
                         peer_index: 42,
+                        epoch: 0,
                     }],
                 },
             },
@@ -2051,6 +2127,7 @@ mod tests {
                 left: Some(RosterEntry {
                     pubkey: "abc123".into(),
                     peer_index: 42,
+                    epoch: 0,
                 }),
             },
             HuddleControlMsg::RosterResync,
@@ -2133,6 +2210,7 @@ mod tests {
                     joined: Some(RosterEntry {
                         pubkey: "bob".into(),
                         peer_index: 7,
+                        epoch: 0,
                     }),
                     left: None,
                 })
@@ -2162,6 +2240,7 @@ mod tests {
                     peers: vec![RosterEntry {
                         pubkey: "bob".into(),
                         peer_index: 7,
+                        epoch: 0,
                     }],
                 })
                 .unwrap(),
@@ -2277,7 +2356,7 @@ mod tests {
         let fenced = fenced_owned_by(owner_rt, session_id);
         let rooms = Arc::new(AudioRoomManager::new());
         let room = rooms.get_or_create(community(), session_id);
-        let (_local_id, _local_index, _audio_rx, mut local_ctrl_rx) =
+        let (_local_id, _local_index, _epoch, _audio_rx, mut local_ctrl_rx, _revision) =
             room.add_peer("owner-local".into(), 2).unwrap();
         // Discard the local peer's own roster delta; this assertion targets the
         // websocket-compatible control fanout below.
@@ -2913,21 +2992,29 @@ mod tests {
     }
 
     #[test]
-    fn media_datagram_tags_owner_index_and_stamps_fence() {
+    fn media_datagram_preserves_versioned_prefix_and_stamps_fence() {
         let fenced = FencedHeader {
             session_id: Uuid::new_v4(),
             generation: 9,
             owner_runtime_id: rt(2),
         };
-        // Owner-assigned index is the first payload byte; client bytes follow.
-        let d0 = media_datagram(42, fenced, 0, &[0xDE, 0xAD]);
-        assert_eq!(d0.payload, vec![42, 0xDE, 0xAD]);
-        assert_eq!(d0.fenced, fenced);
-        assert_eq!(d0.seq, 0);
-        // Empty client frame still carries the index byte (owner tolerates it).
-        let d1 = media_datagram(7, fenced, 3, &[]);
-        assert_eq!(d1.payload, vec![7]);
-        assert_eq!(d1.seq, 3);
+        let client_frame = [0xDE, 0xAD];
+
+        for protocol_version in [1, 2] {
+            let legacy = media_datagram(42, 3, protocol_version, fenced, 0, &client_frame);
+            assert_eq!(legacy.payload, vec![42, 0xDE, 0xAD]);
+            assert_eq!(legacy.fenced, fenced);
+            assert_eq!(legacy.seq, 0);
+        }
+
+        let v3 = media_datagram(42, 3, 3, fenced, 1, &client_frame);
+        assert_eq!(v3.payload, vec![42, 3, 0xDE, 0xAD]);
+        assert_eq!(v3.fenced, fenced);
+        assert_eq!(v3.seq, 1);
+
+        // Empty frames still carry exactly the negotiated prefix.
+        assert_eq!(media_datagram(7, 9, 2, fenced, 2, &[]).payload, vec![7]);
+        assert_eq!(media_datagram(7, 9, 3, fenced, 3, &[]).payload, vec![7, 9]);
     }
 
     // ── Non-owner teardown reader: wire signal → HuddleTeardownCause ──────────
diff --git a/crates/buzz-relay/src/audio/mesh.rs b/crates/buzz-relay/src/audio/mesh.rs
index 1eb62fdcfa3..4c06de37077 100644
--- a/crates/buzz-relay/src/audio/mesh.rs
+++ b/crates/buzz-relay/src/audio/mesh.rs
@@ -21,14 +21,16 @@
 //!
 //! ## The payload invariant (why this needs no wire change)
 //!
-//! The client sends `[8B v2 header][opaque Opus]`; the relay parses the header
-//! for telemetry only and forwards the frame opaquely, and `broadcast_frame`
-//! prepends a 1-byte `peer_index`. That `peer_index` is relay-added *routing*
-//! metadata — it never touches ciphertext — so the whole byte string
-//! `[peer_index][v2 header][Opus]` is exactly what [`MeshDatagram::payload`] is
-//! for: opaque to encryption, owned by the routing plane. **peer_index is
-//! always the first byte of a media datagram payload, both directions.** The
-//! client's WebSocket wire format is byte-identical to a single-pod huddle.
+//! Protocol v1/v2 clients send an opaque client frame and receive the released
+//! one-byte `[peer_index]` routing prefix. Protocol v3 adds a per-index `epoch`,
+//! so its relay-added prefix is `[peer_index][epoch]`. The relay parses v2/v3
+//! frame headers for telemetry only and otherwise forwards client bytes opaquely.
+//! Both prefix shapes are routing metadata — they never touch ciphertext — and
+//! map directly onto [`MeshDatagram::payload`]. **peer_index is always the first
+//! byte of a media datagram payload, both directions**; the remainder is the
+//! versioned opaque wire frame and rides unchanged through the split-and-reprefix
+//! below. The client's WebSocket wire format stays byte-identical to single-pod
+//! fan-out.
 //!
 //! ## Room stays pure
 //!
@@ -199,7 +201,8 @@ impl MeshAudioRouter {
 
     /// Deliver an inbound media datagram to the addressed local huddle.
     ///
-    /// The payload is `[peer_index][v2 header][Opus]` — already prefixed by the
+    /// The payload is `[peer_index][client frame]` for protocol v1/v2, or
+    /// `[peer_index][epoch][client frame]` for v3 — already prefixed by the
     /// sender (the owner, when fanning out to us; or a non-owner client's pod,
     /// when we are the owner). We fence, then push the payload into every
     /// *local* peer's audio sink **except** the peer whose index authored it,
@@ -235,10 +238,11 @@ impl MeshAudioRouter {
             warn!(%session_id, "empty media datagram payload — dropping");
             return verdict;
         };
-        // Reconstruct the exact on-wire frame the local fan-out uses:
-        // [peer_index][v2 header][Opus]. `rest` is [v2 header][Opus]; the
-        // prefix is the author's index. We hand peers the already-prefixed
-        // bytes and skip re-broadcasting to the author's own index.
+        // Reconstruct the exact versioned on-wire frame the local fan-out uses.
+        // `rest` is the opaque client frame for v1/v2, or `[epoch][client frame]`
+        // for v3; only `peer_index` (the author's routing index) is split off for
+        // the skip-self check. Hand peers the already-prefixed bytes without
+        // interpreting the negotiated payload shape.
         let mut prefixed = bytes::BytesMut::with_capacity(dgram.payload.len());
         prefixed.extend_from_slice(&[author_index]);
         prefixed.extend_from_slice(rest);
diff --git a/crates/buzz-relay/src/audio/room.rs b/crates/buzz-relay/src/audio/room.rs
index d5c42869883..d2849f3e0bd 100644
--- a/crates/buzz-relay/src/audio/room.rs
+++ b/crates/buzz-relay/src/audio/room.rs
@@ -2,15 +2,18 @@
 //!
 //! ```text
 //! Client A → WS binary frame → Room::broadcast_frame → Client B, C, ...
-//!                                                        (1-byte peer_index prefix)
+//!                                                        (versioned peer prefix)
 //! ```
 //!
-//! Frames are opaque Opus bytes — the relay never decodes audio.
-//! `try_send` is used throughout: real-time audio tolerates drops, never queues.
+//! Frames are opaque Opus bytes — the relay never decodes audio. Protocol v3
+//! adds the occupancy epoch after the peer index; v1/v2 keep their released
+//! one-byte peer prefix. `try_send` is used throughout: real-time audio
+//! tolerates drops, never queues.
 
 use buzz_core::CommunityId;
 use bytes::Bytes;
 use dashmap::DashMap;
+use std::collections::{HashMap, HashSet};
 use std::sync::Arc;
 use tokio::sync::{broadcast, mpsc};
 use uuid::Uuid;
@@ -26,6 +29,15 @@ pub struct AudioPeer {
     pub ctrl_tx: mpsc::Sender<PeerCtrl>,
     /// Stable 0-254 index assigned at join; prefixed onto relayed frames.
     pub peer_index: u8,
+    /// Per-index reuse generation. Incremented each time this `peer_index` is
+    /// (re)assigned to a new occupant, so a frame authored by a departed peer
+    /// can be told apart from one authored by the peer that later reused the
+    /// same index. Prefixed onto protocol-v3 relayed frames alongside
+    /// `peer_index`.
+    pub epoch: u8,
+    /// Pinned wire version used to shape outbound relay prefixes without
+    /// taking the admission mutex on the per-frame audio hot path.
+    pub protocol_version: u8,
 }
 
 /// Control message for a single peer (separate from audio frames).
@@ -45,7 +57,7 @@ const CTRL_CHANNEL_CAPACITY: usize = 32;
 
 /// Defense-in-depth cap on peers per room. A room with N peers generates
 /// N×(N−1) frame copies per 20ms tick — 25 peers = 600 copies/tick, which
-/// is reasonable. The 255 index space is the hard limit; this is the soft one.
+/// is reasonable. Routing identities rotate through a larger 255-value pool.
 const MAX_PEERS_PER_ROOM: usize = 25;
 
 /// One authoritative owner-roster entry.
@@ -55,6 +67,10 @@ pub struct RosterPeer {
     pub pubkey: String,
     /// Owner-assigned media routing index.
     pub peer_index: u8,
+    /// Per-index reuse generation for `peer_index` (see [`AudioPeer::epoch`]).
+    /// Carried in roster snapshots/deltas so receivers can fence media frames
+    /// authored by a prior occupant of the same index.
+    pub epoch: u8,
 }
 
 /// A complete owner-roster snapshot at one monotonic revision.
@@ -78,12 +94,36 @@ pub struct RosterDelta {
     pub left: Option<RosterPeer>,
 }
 
+/// Successful local admission: peer ID, routing index, per-index epoch,
+/// audio/control receivers, and the authoritative roster revision assigned to
+/// the join.
+pub type PeerAdmission = (
+    Uuid,
+    u8,
+    u8,
+    mpsc::Receiver<Bytes>,
+    mpsc::Receiver<PeerCtrl>,
+    u64,
+);
+
+/// Successful admission at an owner-assigned index: peer ID, per-index epoch,
+/// audio/control receivers, and the roster revision. The routing index is
+/// omitted because the caller supplied it.
+pub type IndexedPeerAdmission = (
+    Uuid,
+    u8,
+    mpsc::Receiver<Bytes>,
+    mpsc::Receiver<PeerCtrl>,
+    u64,
+);
+
 /// Reason a peer was refused entry to a room.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum AdmissionError {
     /// The room has been ended (or is shutting down) and no longer admits peers.
     Ended,
-    /// The room has hit the soft peer cap or exhausted the 255-index space.
+    /// The room has hit its participant cap or the requested routing identity
+    /// is already active.
     Full,
     /// The room is pinned to a different protocol version than the requested one.
     /// The caller should reply to the WS client with an `upgrade_required` error
@@ -104,8 +144,20 @@ pub enum AdmissionError {
 /// exclusive with peer admission. This closes the race between the last
 /// peer's cleanup path and a concurrent joiner.
 struct AdmissionGuard {
-    next_fresh: u8,
-    free: Vec<u8>,
+    /// Next routing identity to probe. Allocation rotates through the complete
+    /// 0..=254 space so a recently departed identity is not immediately reused,
+    /// while long-running rooms never consume a finite lifetime admission
+    /// budget.
+    next_candidate: u8,
+    /// Routing identities held by currently connected peers. Owner-assigned
+    /// mesh identities share this set with locally allocated identities.
+    active_indices: HashSet<u8>,
+    /// Per-index reuse generation. `next_epoch_for(idx)` returns the epoch to
+    /// stamp on the next occupant of `idx` and advances the counter, so every
+    /// (re)assignment of an index gets a distinct, monotonically increasing
+    /// (mod 256) epoch. A frame carrying a stale epoch for its index was
+    /// authored by a departed occupant and is fenced by receivers.
+    index_epochs: HashMap<u8, u8>,
     ended: bool,
     /// Pinned huddle audio protocol version for this room.
     ///
@@ -132,28 +184,35 @@ struct AdmissionGuard {
 impl AdmissionGuard {
     fn new() -> Self {
         Self {
-            next_fresh: 0,
-            free: Vec::new(),
+            next_candidate: 0,
+            active_indices: HashSet::new(),
+            index_epochs: HashMap::new(),
             ended: false,
             pinned_version: None,
             roster_revision: 0,
         }
     }
 
-    fn alloc(&mut self) -> Option<u8> {
-        if let Some(idx) = self.free.pop() {
-            return Some(idx);
-        }
-        if self.next_fresh == 255 {
-            return None;
+    fn alloc(&mut self) -> Option<(u8, u8)> {
+        for _ in 0..255 {
+            let idx = self.next_candidate;
+            self.next_candidate = if idx == 254 { 0 } else { idx + 1 };
+            if self.active_indices.insert(idx) {
+                return Some((idx, self.next_epoch_for(idx)));
+            }
         }
-        let idx = self.next_fresh;
-        self.next_fresh += 1;
-        Some(idx)
+        None
     }
 
-    fn release(&mut self, idx: u8) {
-        self.free.push(idx);
+    /// Epoch to stamp on the next occupant of `idx`, advancing the per-index
+    /// counter. The first occupant of an index gets epoch 0; each later reuse
+    /// increments (wrapping at 256, which is astronomically larger than the
+    /// number of in-flight frames a stale occupant could have queued).
+    fn next_epoch_for(&mut self, idx: u8) -> u8 {
+        let slot = self.index_epochs.entry(idx).or_insert(0);
+        let epoch = *slot;
+        *slot = slot.wrapping_add(1);
+        epoch
     }
 }
 
@@ -229,7 +288,7 @@ impl Room {
         &self,
         pubkey: String,
         requested_version: u8,
-    ) -> Result<(Uuid, u8, mpsc::Receiver<Bytes>, mpsc::Receiver<PeerCtrl>), AdmissionError> {
+    ) -> Result<PeerAdmission, AdmissionError> {
         let mut g = self.guard.lock().map_err(
             |_| AdmissionError::Ended, /* poisoned ≈ shutting down */
         )?;
@@ -247,7 +306,7 @@ impl Room {
                 });
             }
         }
-        let peer_index = g.alloc().ok_or(AdmissionError::Full)?;
+        let (peer_index, epoch) = g.alloc().ok_or(AdmissionError::Full)?;
         // Pin the room version on the first successful index allocation. We
         // pin *after* alloc so a Full error doesn't accidentally set the
         // version for a peer that didn't actually join.
@@ -262,17 +321,24 @@ impl Room {
                 audio_tx,
                 ctrl_tx,
                 peer_index,
+                epoch,
+                protocol_version: requested_version,
             },
         );
         g.roster_revision = g.roster_revision.wrapping_add(1);
+        let revision = g.roster_revision;
         let delta = RosterDelta {
-            revision: g.roster_revision,
-            joined: Some(RosterPeer { pubkey, peer_index }),
+            revision,
+            joined: Some(RosterPeer {
+                pubkey,
+                peer_index,
+                epoch,
+            }),
             left: None,
         };
         let _ = self.roster_tx.send(delta);
         drop(g); // Release lock after ordered roster publication.
-        Ok((peer_id, peer_index, audio_rx, ctrl_rx))
+        Ok((peer_id, peer_index, epoch, audio_rx, ctrl_rx, revision))
     }
 
     /// Add a non-owner ingress peer at the index already allocated by the
@@ -283,14 +349,12 @@ impl Room {
         pubkey: String,
         requested_version: u8,
         peer_index: u8,
-    ) -> Result<(Uuid, mpsc::Receiver<Bytes>, mpsc::Receiver<PeerCtrl>), AdmissionError> {
+    ) -> Result<IndexedPeerAdmission, AdmissionError> {
         let mut g = self.guard.lock().map_err(|_| AdmissionError::Ended)?;
         if g.ended {
             return Err(AdmissionError::Ended);
         }
-        if self.peers.len() >= MAX_PEERS_PER_ROOM
-            || self.peers.iter().any(|peer| peer.peer_index == peer_index)
-        {
+        if self.peers.len() >= MAX_PEERS_PER_ROOM || g.active_indices.contains(&peer_index) {
             return Err(AdmissionError::Full);
         }
         if let Some(pinned) = g.pinned_version {
@@ -302,13 +366,11 @@ impl Room {
             }
         }
         g.pinned_version.get_or_insert(requested_version);
-        // Keep a later local allocation from colliding if ownership changes
-        // while this room is still winding down. Skipped lower indices are a
-        // bounded handoff cost; a fresh room resets the allocator.
-        g.free.retain(|idx| *idx != peer_index);
-        if peer_index >= g.next_fresh {
-            g.next_fresh = peer_index.saturating_add(1);
-        }
+        g.active_indices.insert(peer_index);
+        let epoch = g.next_epoch_for(peer_index);
+        // Continue local allocation after the newest owner-assigned identity.
+        // The cursor wraps, so a high mesh index cannot burn the lower space.
+        g.next_candidate = if peer_index == 254 { 0 } else { peer_index + 1 };
 
         let peer_id = Uuid::new_v4();
         let (audio_tx, audio_rx) = mpsc::channel(AUDIO_CHANNEL_CAPACITY);
@@ -320,50 +382,59 @@ impl Room {
                 audio_tx,
                 ctrl_tx,
                 peer_index,
+                epoch,
+                protocol_version: requested_version,
             },
         );
         g.roster_revision = g.roster_revision.wrapping_add(1);
+        let revision = g.roster_revision;
         let delta = RosterDelta {
-            revision: g.roster_revision,
-            joined: Some(RosterPeer { pubkey, peer_index }),
+            revision,
+            joined: Some(RosterPeer {
+                pubkey,
+                peer_index,
+                epoch,
+            }),
             left: None,
         };
         let _ = self.roster_tx.send(delta);
         drop(g);
-        Ok((peer_id, audio_rx, ctrl_rx))
+        Ok((peer_id, epoch, audio_rx, ctrl_rx, revision))
     }
 
-    /// Remove a peer and recycle its index.
-    pub fn remove_peer(&self, peer_id: Uuid) {
+    /// Remove a peer and release its routing identity for a later allocator
+    /// rotation. Returns the ordered roster delta when the peer existed.
+    pub fn remove_peer(&self, peer_id: Uuid) -> Option<RosterDelta> {
         let Ok(mut g) = self.guard.lock() else {
-            return;
+            return None;
         };
-        if let Some((_, peer)) = self.peers.remove(&peer_id) {
-            g.release(peer.peer_index);
-            g.roster_revision = g.roster_revision.wrapping_add(1);
-            let delta = RosterDelta {
-                revision: g.roster_revision,
-                joined: None,
-                left: Some(RosterPeer {
-                    pubkey: peer.pubkey,
-                    peer_index: peer.peer_index,
-                }),
-            };
-            let _ = self.roster_tx.send(delta);
-            drop(g);
-        }
+        let (_, peer) = self.peers.remove(&peer_id)?;
+        g.active_indices.remove(&peer.peer_index);
+        g.roster_revision = g.roster_revision.wrapping_add(1);
+        let delta = RosterDelta {
+            revision: g.roster_revision,
+            joined: None,
+            left: Some(RosterPeer {
+                pubkey: peer.pubkey,
+                peer_index: peer.peer_index,
+                epoch: peer.epoch,
+            }),
+        };
+        let _ = self.roster_tx.send(delta.clone());
+        drop(g);
+        Some(delta)
     }
 
     /// Remove a peer AND atomically check if the room should end.
     /// If the room is now empty, sets `ended = true` under the same lock
-    /// acquisition that recycles the index — no window for a concurrent
+    /// acquisition that removes the peer — no window for a concurrent
     /// `add_peer` to sneak in between removal and the ended flag.
-    /// Returns `(peer_index, should_auto_end)`.
-    pub fn remove_peer_and_check_ended(&self, peer_id: Uuid) -> Option<(u8, bool)> {
+    /// Returns `(roster_delta, should_auto_end)`.
+    pub fn remove_peer_and_check_ended(&self, peer_id: Uuid) -> Option<(RosterDelta, bool)> {
         let mut g = self.guard.lock().ok()?;
         let (_, peer) = self.peers.remove(&peer_id)?;
         let peer_index = peer.peer_index;
-        g.release(peer_index);
+        g.active_indices.remove(&peer_index);
         g.roster_revision = g.roster_revision.wrapping_add(1);
         let delta = RosterDelta {
             revision: g.roster_revision,
@@ -371,6 +442,7 @@ impl Room {
             left: Some(RosterPeer {
                 pubkey: peer.pubkey,
                 peer_index,
+                epoch: peer.epoch,
             }),
         };
         // Only the first task to see empty + !ended wins the auto-end.
@@ -382,23 +454,27 @@ impl Room {
         } else {
             false
         };
-        let _ = self.roster_tx.send(delta);
+        let _ = self.roster_tx.send(delta.clone());
         drop(g);
-        Some((peer_index, should_end))
+        Some((delta, should_end))
     }
 
-    /// Fan-out a binary frame to all peers except the sender.
-    /// Prepends the sender's `peer_index` as a 1-byte prefix.
-    /// Drops on full buffer — real-time audio never queues.
+    /// Fan-out a binary frame to all peers except the sender. Protocol v3
+    /// prepends the sender's `peer_index` and per-index `epoch`; v1/v2 retain
+    /// their released one-byte `peer_index` prefix. Drops on full buffer —
+    /// real-time audio never queues.
     pub fn broadcast_frame(&self, sender_id: Uuid, frame: Bytes) {
-        let sender_index = match self.peers.get(&sender_id) {
-            Some(p) => p.peer_index,
+        let (sender_index, sender_epoch, protocol_version) = match self.peers.get(&sender_id) {
+            Some(p) => (p.peer_index, p.epoch, p.protocol_version),
             None => return,
         };
 
-        // Prepend peer_index as 1-byte header.
-        let mut prefixed = bytes::BytesMut::with_capacity(1 + frame.len());
+        let prefix_len = if protocol_version >= 3 { 2 } else { 1 };
+        let mut prefixed = bytes::BytesMut::with_capacity(prefix_len + frame.len());
         prefixed.extend_from_slice(&[sender_index]);
+        if protocol_version >= 3 {
+            prefixed.extend_from_slice(&[sender_epoch]);
+        }
         prefixed.extend_from_slice(&frame);
         let prefixed = prefixed.freeze();
 
@@ -431,19 +507,23 @@ impl Room {
     /// Send a JSON control message to all peers via the control channel.
     /// Separate from audio so control is never starved by audio backpressure.
     /// Control messages (joined/left) are state-bearing — the client's
-    /// peer_index→pubkey map depends on receiving every one. The channel is
-    /// sized generously (32 slots) so drops should never happen in practice;
-    /// if they do, we log a warning so the issue is visible.
+    /// peer_index→pubkey map depends on receiving every one. Saturation is
+    /// therefore terminal for that receiver: dropping its sender closes the
+    /// queue, forcing a reconnect with a fresh authoritative admission snapshot.
     pub fn broadcast_control(&self, json: String) {
-        for entry in self.peers.iter() {
+        for mut entry in self.peers.iter_mut() {
             if entry
                 .ctrl_tx
                 .try_send(PeerCtrl::Json(json.clone()))
                 .is_err()
             {
+                let (replacement_tx, replacement_rx) = mpsc::channel(1);
+                drop(replacement_rx);
+                let old_tx = std::mem::replace(&mut entry.ctrl_tx, replacement_tx);
+                drop(old_tx);
                 tracing::warn!(
                     peer_id = %entry.key(),
-                    "control channel full — dropped state-bearing message (peer map may desync)"
+                    "control channel full — closing receiver for authoritative roster resync"
                 );
             }
         }
@@ -466,6 +546,7 @@ impl Room {
             .map(|e| RosterPeer {
                 pubkey: e.pubkey.clone(),
                 peer_index: e.peer_index,
+                epoch: e.epoch,
             })
             .collect::<Vec<_>>();
         peers.sort_by_key(|peer| peer.peer_index);
@@ -568,7 +649,7 @@ mod tests {
         let (_local_id, local_index, ..) = room.add_peer("owner-local".into(), 2).unwrap();
         assert_eq!(local_index, 0);
 
-        let (remote_id, _audio, _ctrl) = room
+        let (remote_id, _epoch, _audio, _ctrl, _revision) = room
             .add_peer_at_index("remote".into(), 2, 7)
             .expect("owner-assigned index admits");
         assert_eq!(room.peers.get(&remote_id).unwrap().peer_index, 7);
@@ -580,6 +661,34 @@ mod tests {
         );
     }
 
+    #[test]
+    fn active_owner_assigned_index_cannot_be_readmitted() {
+        let room = fresh_room();
+        let (_remote_id, _epoch, _audio, _ctrl, _revision) = room
+            .add_peer_at_index("remote".into(), 2, 7)
+            .expect("owner-assigned index admits");
+
+        let result = room.add_peer_at_index("replacement".into(), 2, 7);
+        assert!(
+            matches!(result, Err(AdmissionError::Full)),
+            "an active owner-assigned index must not identify another socket"
+        );
+    }
+
+    #[test]
+    fn owner_assigned_high_index_does_not_exhaust_local_allocation() {
+        let room = fresh_room();
+        let (remote_id, _epoch, _audio, _ctrl, _revision) = room
+            .add_peer_at_index("remote".into(), 2, 254)
+            .expect("high owner-assigned index admits");
+        room.remove_peer(remote_id).expect("remote peer leaves");
+
+        let (_local_id, local_index, ..) = room
+            .add_peer("local".into(), 2)
+            .expect("a high owner index must not burn lower routing identities");
+        assert_eq!(local_index, 0);
+    }
+
     #[test]
     fn roster_revisions_are_ordered_and_snapshot_is_authoritative() {
         let room = fresh_room();
@@ -604,6 +713,7 @@ mod tests {
             vec![RosterPeer {
                 pubkey: "bob".into(),
                 peer_index: bob_index,
+                epoch: 0,
             }]
         );
     }
@@ -674,7 +784,7 @@ mod tests {
         let channel_id = Uuid::new_v4();
 
         let room1 = manager.get_or_create(community_id, channel_id);
-        let (peer_id, _, _, _) = room1
+        let (peer_id, _, _, _, _, _) = room1
             .add_peer("alice".to_string(), 2)
             .expect("first peer admits");
         // Last peer leaves and ends the room atomically.
@@ -729,27 +839,123 @@ mod tests {
         );
     }
 
-    /// Peer-index reuse: after a peer leaves, their index is released; a new
-    /// peer joining the same (still-pinned) room reuses the freed index.
-    /// Version pin must persist across this reuse — the room generation
-    /// hasn't ended.
+    /// Peer indices rotate instead of being immediately reused, which gives
+    /// queued media and cleanup work time to drain without imposing a lifetime
+    /// admission budget on the room.
     #[test]
-    fn version_pin_persists_across_peer_churn() {
+    fn peer_indices_are_not_reused_within_a_room_generation() {
         let room = fresh_room();
-        let (alice_id, alice_idx, _, _) =
+        let (alice_id, alice_idx, _, _, _, _) =
             room.add_peer("alice".to_string(), 2).expect("alice admits");
-        room.remove_peer(alice_id);
-        // Room is non-empty thanks to nothing yet — wait, alice left and
-        // nobody else is here. Add bob with the same version: should work.
-        // Then add carol with a different version: should fail with the
-        // *original* pin, even though alice already left.
-        let (_, bob_idx, _, _) = room
+        let (_keeper_id, keeper_idx, _, _, _, _) = room
+            .add_peer("keeper".to_string(), 2)
+            .expect("keeper admits");
+
+        room.remove_peer(alice_id).expect("alice leaves");
+        let (_, bob_idx, _, _, _, _) = room
             .add_peer("bob".to_string(), 2)
             .expect("bob admits at v=2");
+
+        assert_eq!(alice_idx, 0);
+        assert_eq!(keeper_idx, 1);
+        assert_eq!(
+            bob_idx, 2,
+            "a departed peer index must not be immediately reused",
+        );
+    }
+
+    /// A reused peer index carries a distinct epoch from its prior occupant,
+    /// so receivers can fence media authored before the reassignment. Rotation
+    /// still holds (the index is not immediately reused), but even after the
+    /// allocator wraps back, the epoch advances.
+    #[test]
+    fn reused_peer_index_gets_a_distinct_epoch() {
+        let room = fresh_room();
+        // First occupant of index 0 gets epoch 0.
+        let (alice_id, alice_index, alice_epoch, ..) =
+            room.add_peer("alice".into(), 2).expect("alice admits");
+        assert_eq!(alice_index, 0);
+        assert_eq!(alice_epoch, 0);
+        room.remove_peer(alice_id).expect("alice leaves");
+
+        // Force the allocator cursor back to 0 so the next admit reuses index 0.
+        // A single owner-assigned admit at 254 sets next_candidate to wrap to 0.
+        let (_high_id, high_epoch, ..) = room
+            .add_peer_at_index("high".into(), 2, 254)
+            .expect("high owner index admits");
+        assert_eq!(high_epoch, 0, "index 254 is a first occupant");
+
+        let (_bob_id, bob_index, bob_epoch, ..) =
+            room.add_peer("bob".into(), 2).expect("bob admits");
+        assert_eq!(bob_index, 0, "cursor wrapped to reuse index 0");
         assert_eq!(
-            bob_idx, alice_idx,
-            "freed peer index should be recycled by the next admit",
+            bob_epoch, 1,
+            "reused index 0 must advance its epoch past alice's"
         );
+    }
+
+    /// The epoch stamped on a fanned-out v3 frame matches the sender's current
+    /// per-index epoch. Released v2 retains its one-byte prefix so old v2
+    /// clients cannot share a room with v3 clients while decoding different
+    /// binary layouts under the same negotiated version.
+    #[test]
+    fn broadcast_frame_uses_the_prefix_for_the_pinned_version() {
+        let v2_room = fresh_room();
+        let (v2_sender_id, v2_sender_index, ..) = v2_room
+            .add_peer("v2-sender".into(), 2)
+            .expect("v2 sender admits");
+        let (_v2_listener_id, _, _, mut v2_listener_rx, _, _) = v2_room
+            .add_peer("v2-listener".into(), 2)
+            .expect("v2 listener admits");
+        v2_room.broadcast_frame(v2_sender_id, Bytes::from_static(&[0xAB, 0xCD]));
+        let v2_frame = v2_listener_rx
+            .try_recv()
+            .expect("v2 listener receives frame");
+        assert_eq!(&v2_frame[..1], &[v2_sender_index]);
+        assert_eq!(&v2_frame[1..], &[0xAB, 0xCD]);
+
+        let v3_room = fresh_room();
+        let (v3_sender_id, v3_sender_index, v3_sender_epoch, ..) = v3_room
+            .add_peer("v3-sender".into(), 3)
+            .expect("v3 sender admits");
+        let (_v3_listener_id, _, _, mut v3_listener_rx, _, _) = v3_room
+            .add_peer("v3-listener".into(), 3)
+            .expect("v3 listener admits");
+        v3_room.broadcast_frame(v3_sender_id, Bytes::from_static(&[0xAB, 0xCD]));
+        let v3_frame = v3_listener_rx
+            .try_recv()
+            .expect("v3 listener receives frame");
+        assert_eq!(&v3_frame[..2], &[v3_sender_index, v3_sender_epoch]);
+        assert_eq!(&v3_frame[2..], &[0xAB, 0xCD]);
+    }
+
+    #[test]
+    fn one_seated_peer_survives_more_than_index_space_reconnects() {
+        let room = fresh_room();
+        let (_keeper_id, keeper_index, ..) =
+            room.add_peer("keeper".into(), 2).expect("keeper admits");
+
+        for cycle in 0..300 {
+            let (peer_id, peer_index, ..) = room
+                .add_peer(format!("reconnect-{cycle}"), 2)
+                .unwrap_or_else(|error| panic!("cycle {cycle} must admit: {error:?}"));
+            assert_ne!(peer_index, keeper_index);
+            room.remove_peer(peer_id).expect("reconnecting peer leaves");
+        }
+    }
+
+    /// Protocol version pinning persists across peer churn even while routing
+    /// identities rotate for later reuse.
+    #[test]
+    fn version_pin_persists_across_peer_churn() {
+        let room = fresh_room();
+        let (alice_id, _, _, _, _, _) =
+            room.add_peer("alice".to_string(), 2).expect("alice admits");
+        let (_keeper_id, _, _, _, _, _) = room
+            .add_peer("keeper".to_string(), 2)
+            .expect("keeper admits");
+        room.remove_peer(alice_id);
+
         let err = room
             .add_peer("carol".to_string(), 1)
             .expect_err("v=1 must still be refused — room is pinned v=2");
diff --git a/crates/buzz-relay/src/handlers/ingest.rs b/crates/buzz-relay/src/handlers/ingest.rs
index 9629ffb0fd1..dd2fa6e93e0 100644
--- a/crates/buzz-relay/src/handlers/ingest.rs
+++ b/crates/buzz-relay/src/handlers/ingest.rs
@@ -50,6 +50,98 @@ use crate::conformance::{
     state_for_request, EmitGuard, TraceAction, Verdict,
 };
 
+fn huddle_backing_channel_id(event: &Event) -> Result<Uuid, IngestError> {
+    let content: serde_json::Value = serde_json::from_str(&event.content).map_err(|_| {
+        IngestError::Rejected("invalid: Huddle event content must be a JSON object".into())
+    })?;
+    let channel_id = content
+        .get("ephemeral_channel_id")
+        .and_then(serde_json::Value::as_str)
+        .ok_or_else(|| {
+            IngestError::Rejected("invalid: Huddle event must name an ephemeral_channel_id".into())
+        })?;
+    channel_id.parse::<Uuid>().map_err(|_| {
+        IngestError::Rejected("invalid: Huddle ephemeral_channel_id must be a UUID".into())
+    })
+}
+
+fn map_huddle_backing_channel_error(error: buzz_db::DbError) -> IngestError {
+    match error {
+        buzz_db::DbError::ChannelNotFound(_) => {
+            IngestError::Rejected("invalid: Huddle backing channel not found".into())
+        }
+        error => IngestError::Internal(format!("error: loading Huddle backing channel: {error}")),
+    }
+}
+
+fn expected_huddle_backing_ttl(ephemeral_ttl_override: Option<i32>) -> i32 {
+    ephemeral_ttl_override.unwrap_or(3600)
+}
+
+async fn validate_huddle_lifecycle_event(
+    tenant: &TenantContext,
+    state: &AppState,
+    event: &Event,
+    kind: u32,
+) -> Result<(), IngestError> {
+    if kind != KIND_HUDDLE_STARTED && kind != KIND_HUDDLE_ENDED {
+        return Ok(());
+    }
+
+    let backing_channel_id = huddle_backing_channel_id(event)?;
+    let backing = state
+        .db
+        .get_channel(tenant.community(), backing_channel_id)
+        .await
+        .map_err(map_huddle_backing_channel_error)?;
+    let signer = event.pubkey.to_bytes();
+    let relay = state.relay_keypair.public_key().to_bytes();
+    let signer_created_backing = backing.created_by.as_slice() == signer.as_slice();
+
+    if kind == KIND_HUDDLE_STARTED {
+        let expected_ttl = expected_huddle_backing_ttl(state.config.ephemeral_ttl_override);
+        if !signer_created_backing
+            || backing.channel_type != "stream"
+            || backing.visibility != "private"
+            || backing.ttl_seconds != Some(expected_ttl)
+            || backing.archived_at.is_some()
+        {
+            return Err(IngestError::Rejected(
+                "invalid: Huddle start must reference the signer's active private ephemeral stream"
+                    .into(),
+            ));
+        }
+    } else {
+        if !signer_created_backing && signer.as_slice() != relay.as_slice() {
+            return Err(IngestError::Rejected(
+                "invalid: only the Huddle creator or relay may end it".into(),
+            ));
+        }
+        let parent_channel_id = extract_channel_id(event).ok_or_else(|| {
+            IngestError::Rejected("invalid: Huddle end must name its parent channel".into())
+        })?;
+        let linked = state
+            .db
+            .huddle_started_link_exists(
+                tenant.community(),
+                parent_channel_id,
+                backing_channel_id,
+                &backing.created_by,
+            )
+            .await
+            .map_err(|error| {
+                IngestError::Internal(format!("error: checking Huddle start linkage: {error}"))
+            })?;
+        if !linked {
+            return Err(IngestError::Rejected(
+                "invalid: Huddle end does not match a creator-signed start in this channel".into(),
+            ));
+        }
+    }
+
+    Ok(())
+}
+
 fn validate_custom_emoji_tags(event: &Event) -> Result<(), IngestError> {
     for tag in event.tags.iter() {
         let parts = tag.as_slice();
@@ -2560,6 +2652,8 @@ async fn ingest_event_inner(
         });
     }
 
+    validate_huddle_lifecycle_event(tenant, state, &event, kind_u32).await?;
+
     if crate::handlers::side_effects::is_admin_kind(kind_u32) {
         crate::handlers::side_effects::validate_admin_event(tenant, kind_u32, &event, state)
             .await
@@ -3193,6 +3287,61 @@ mod tests {
     };
     use nostr::{EventBuilder, Kind};
 
+    #[test]
+    fn missing_huddle_backing_channel_is_a_client_rejection() {
+        let channel_id = Uuid::new_v4();
+        assert!(matches!(
+            map_huddle_backing_channel_error(buzz_db::DbError::ChannelNotFound(channel_id)),
+            IngestError::Rejected(message) if message.contains("backing channel not found")
+        ));
+    }
+
+    #[test]
+    fn huddle_backing_channel_lookup_outage_is_internal() {
+        let error = sqlx::Error::Io(std::io::Error::other("database unavailable"));
+        assert!(matches!(
+            map_huddle_backing_channel_error(buzz_db::DbError::Sqlx(error)),
+            IngestError::Internal(message) if message.contains("loading Huddle backing channel")
+        ));
+    }
+
+    #[test]
+    fn huddle_backing_ttl_honors_the_ephemeral_override() {
+        assert_eq!(expected_huddle_backing_ttl(None), 3600);
+        assert_eq!(expected_huddle_backing_ttl(Some(60)), 60);
+    }
+
+    #[test]
+    fn huddle_lifecycle_requires_a_uuid_backing_channel() {
+        let event = EventBuilder::new(
+            Kind::Custom(KIND_HUDDLE_STARTED as u16),
+            r#"{"ephemeral_channel_id":"not-a-uuid"}"#,
+        )
+        .sign_with_keys(&nostr::Keys::generate())
+        .expect("sign Huddle event");
+
+        assert!(matches!(
+            huddle_backing_channel_id(&event),
+            Err(IngestError::Rejected(message)) if message.contains("must be a UUID")
+        ));
+    }
+
+    #[test]
+    fn huddle_lifecycle_extracts_the_backing_channel() {
+        let channel_id = Uuid::new_v4();
+        let event = EventBuilder::new(
+            Kind::Custom(KIND_HUDDLE_ENDED as u16),
+            serde_json::json!({"ephemeral_channel_id": channel_id}).to_string(),
+        )
+        .sign_with_keys(&nostr::Keys::generate())
+        .expect("sign Huddle event");
+
+        assert_eq!(
+            huddle_backing_channel_id(&event).expect("channel id"),
+            channel_id
+        );
+    }
+
     #[test]
     fn reaction_validation_accepts_wrapped_max_shortcode() {
         let shortcode = "a".repeat(buzz_sdk::MAX_CUSTOM_EMOJI_SHORTCODE_LEN);
diff --git a/desktop/package.json b/desktop/package.json
index 683c1529d25..4a6bdcd7f56 100644
--- a/desktop/package.json
+++ b/desktop/package.json
@@ -1,7 +1,7 @@
 {
   "name": "buzz",
   "private": true,
-  "version": "0.5.17",
+  "version": "0.5.18",
   "type": "module",
   "scripts": {
     "dev": "vite",
diff --git a/desktop/src-tauri/Cargo.lock b/desktop/src-tauri/Cargo.lock
index 5bd19ef2b6d..fb60a351895 100644
--- a/desktop/src-tauri/Cargo.lock
+++ b/desktop/src-tauri/Cargo.lock
@@ -1081,7 +1081,7 @@ dependencies = [
 
 [[package]]
 name = "buzz-desktop"
-version = "0.5.17"
+version = "0.5.18"
 dependencies = [
  "anyhow",
  "arboard",
@@ -3080,9 +3080,9 @@ dependencies = [
 
 [[package]]
 name = "futures-channel"
-version = "0.3.32"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07bbe89c50d7a535e539b8c17bc0b49bdb77747034daa8087407d655f3f7cc1d"
+checksum = "b1f9e3d69d39e4862ffed03ed071a76f9a13ba1d9109d355b0f0aa6b15e393c4"
 dependencies = [
  "futures-core",
  "futures-sink",
@@ -3090,9 +3090,9 @@ dependencies = [
 
 [[package]]
 name = "futures-core"
-version = "0.3.32"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7e3450815272ef58cec6d564423f6e755e25379b217b0bc688e295ba24df6b1d"
+checksum = "92d699e522242e69e3003b94ecc1f960f3a5e015aa7c5d7486e65ad01dd94f5e"
 
 [[package]]
 name = "futures-executor"
@@ -3107,9 +3107,9 @@ dependencies = [
 
 [[package]]
 name = "futures-io"
-version = "0.3.32"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cecba35d7ad927e23624b22ad55235f2239cfa44fd10428eecbeba6d6a717718"
+checksum = "53c0fa8157de1303bfffdaa1cc2a673bfffb60102f76b0ef4441659124373fed"
 
 [[package]]
 name = "futures-lite"
@@ -3126,32 +3126,32 @@ dependencies = [
 
 [[package]]
 name = "futures-macro"
-version = "0.3.32"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e835b70203e41293343137df5c0664546da5745f82ec9b84d40be8336958447b"
+checksum = "9fb9654ba8355388abeb8dcb4fc62f511300867002afc858860463bdd9fe0c44"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.118",
+ "syn 3.0.3",
 ]
 
 [[package]]
 name = "futures-sink"
-version = "0.3.32"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c39754e157331b013978ec91992bde1ac089843443c49cbc7f46150b0fad0893"
+checksum = "1944426bf7d03f1d14f708785e4b33efd750b36d48a157b836b3efc15ede8e1d"
 
 [[package]]
 name = "futures-task"
-version = "0.3.32"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "037711b3d59c33004d3856fbdc83b99d4ff37a24768fa1be9ce3538a1cde4393"
+checksum = "cd417de3d1d015fc3bfd2b1ea46dfc7bab72ef86f1cc7cc9c78e728b34a6d1fd"
 
 [[package]]
 name = "futures-util"
-version = "0.3.32"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "389ca41296e6190b48053de0321d02a77f32f8a5d2461dd38762c0593805c6d6"
+checksum = "0d50a92467f8ba5dd6e3ee5d4bd04d73ab2e4e1c44474a0674821dfce14b79bc"
 dependencies = [
  "futures-channel",
  "futures-core",
@@ -10239,6 +10239,17 @@ dependencies = [
  "unicode-ident",
 ]
 
+[[package]]
+name = "syn"
+version = "3.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53e9bae58849f64dfa4f5d5ae372c8341f7305f82a3868709269343628b659a3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
 [[package]]
 name = "sync_wrapper"
 version = "1.0.2"
diff --git a/desktop/src-tauri/Cargo.toml b/desktop/src-tauri/Cargo.toml
index db089fc13fa..3f7189deea1 100644
--- a/desktop/src-tauri/Cargo.toml
+++ b/desktop/src-tauri/Cargo.toml
@@ -7,7 +7,7 @@ members = ["crates/buzz-terminal"]
 
 [package]
 name = "buzz-desktop"
-version = "0.5.17"
+version = "0.5.18"
 description = "Buzz desktop app"
 authors = ["you"]
 edition = "2021"
diff --git a/desktop/src-tauri/src/app_state.rs b/desktop/src-tauri/src/app_state.rs
index 5f5019cd20c..7c41f6bfe26 100644
--- a/desktop/src-tauri/src/app_state.rs
+++ b/desktop/src-tauri/src/app_state.rs
@@ -129,6 +129,7 @@ pub struct AppState {
     /// bounded and letting a later leave correctly flip the channel back to
     /// `is_member=false`.
     pub pending_owned_channels: Mutex<std::collections::HashSet<(String, String)>>,
+    pub archive_db: crate::archive::ArchiveDb,
 }
 
 /// Parse the `BUZZ_PRIVATE_KEY` env var into identity keys. `Some` means the
@@ -219,9 +220,7 @@ pub fn build_app_state() -> AppState {
         huddle_audio: Default::default(),
         app_handle: Mutex::new(None),
         media_proxy_port: AtomicU16::new(0),
-        prevent_sleep: Arc::new(Mutex::new(
-            crate::prevent_sleep::PreventSleepState::default(),
-        )),
+        prevent_sleep: Default::default(),
         keyring_locked: AtomicBool::new(false),
         identity_lost: AtomicBool::new(false),
         reset_failed: AtomicBool::new(false),
@@ -232,6 +231,7 @@ pub fn build_app_state() -> AppState {
         #[cfg(feature = "mesh-llm")]
         mesh_coordinator: AsyncMutex::new(None),
         pending_owned_channels: Mutex::new(std::collections::HashSet::new()),
+        archive_db: crate::archive::ArchiveDb::default(),
     }
 }
 
diff --git a/desktop/src-tauri/src/archive/archive_db.rs b/desktop/src-tauri/src/archive/archive_db.rs
new file mode 100644
index 00000000000..7c69591b0f6
--- /dev/null
+++ b/desktop/src-tauri/src/archive/archive_db.rs
@@ -0,0 +1,199 @@
+//! Process-wide gated adapter for the local archive SQLite database.
+//!
+//! Two coupled guarantees, both required by plan v3 (decisions 1–2):
+//!
+//! 1. **Init barrier.** Exactly one blocking task opens the DB the first time
+//!    and completes every schema migration (including M4, whose index build
+//!    over Will's 1.3M-row archive is not free). Every production open — every
+//!    Tauri archive command and all future startup/prune work — `await`s that
+//!    result before touching its own connection. The barrier is independent of
+//!    identity/relay resolution: the archive DB is a single per-nest file
+//!    (identity is a row column, not part of the path), and the path resolves
+//!    from `nest_dir()`, which is fixed early in `setup()` before the async
+//!    workspace relay override settles. This satisfies Thufir's binding
+//!    condition that the barrier cover workspace/identity timing and the
+//!    globally-mounted observer archive producer.
+//!
+//! 2. **Maintenance lock.** A shared `RwLock` whose read guard is held for the
+//!    full lifetime of every ordinary connection (acquired before the blocking
+//!    dispatch, released only after the closure returns and its connection is
+//!    dropped). The Phase-4 "reclaim space" conversion will take the *write*
+//!    guard for its sole-connection `VACUUM` sequence; nothing else may hold a
+//!    live connection while that runs. Phase 1 only ever takes the read guard,
+//!    but the lock lives here so the write path has a home.
+//!
+//! M4 additionally keeps its own `BEGIN IMMEDIATE` + in-lock recheck for crash
+//! and cross-process safety — the in-process barrier serializes this process's
+//! opens, but a second OS process (or a direct `open_archive_db` in tests) can
+//! still race the first open. The two mechanisms are complementary, not
+//! redundant: the barrier is startup orchestration, the immediate-lock is
+//! durability.
+
+use std::path::PathBuf;
+
+use rusqlite::Connection;
+use tokio::sync::{OnceCell, RwLock};
+
+use super::store;
+use crate::managed_agents::nest_dir;
+
+/// A hook run once on the blocking pool at the start of the single init task.
+/// Test-only: lets a test count initializations and hold the winner long
+/// enough to prove concurrent callers await it. Never set in production.
+#[cfg(test)]
+type InitHook = std::sync::Arc<dyn Fn() + Send + Sync>;
+
+/// Test-only overrides so the barrier and guard-lifetime contracts can be
+/// exercised without a real nest: a fixed DB path in place of `nest_dir()` and
+/// an optional init hook. `Default` leaves this `None`, so production always
+/// resolves the path from the nest and runs no hook.
+#[cfg(test)]
+struct TestSeam {
+    path: PathBuf,
+    on_init: Option<InitHook>,
+}
+
+/// Gated owner of every production archive DB connection. Lives in
+/// [`crate::app_state::AppState`]; commands call [`ArchiveDb::with_conn`].
+#[derive(Default)]
+pub struct ArchiveDb {
+    /// Set to `()` once the first open (which runs all migrations incl. M4)
+    /// succeeds. A failed init is NOT cached — the next caller retries — so a
+    /// transient error (e.g. a briefly unavailable external volume) does not
+    /// wedge the archive for the process lifetime.
+    init: OnceCell<()>,
+    /// Maintenance lock. Ordinary connections hold the read guard for their
+    /// whole lifetime; the Phase-4 conversion holds the write guard.
+    maintenance: RwLock<()>,
+    /// Test-only path/hook overrides; always `None` in production.
+    #[cfg(test)]
+    test_seam: Option<TestSeam>,
+}
+
+impl ArchiveDb {
+    /// Resolve the archive DB path. Production resolves from the nest
+    /// directory; a test seam (when present) supplies a fixed path so the
+    /// barrier can be exercised without a real nest. Errors only when the nest
+    /// cannot be resolved (fatal for archive access, same as the former
+    /// `open_db`).
+    fn db_path(&self) -> Result<PathBuf, String> {
+        #[cfg(test)]
+        if let Some(seam) = &self.test_seam {
+            return Ok(seam.path.clone());
+        }
+        let nest = nest_dir().ok_or("cannot resolve nest directory for archive")?;
+        Ok(nest.join("archive").join("archive.db"))
+    }
+
+    /// The init hook, if a test installed one; always `None` in production.
+    #[cfg(test)]
+    fn init_hook(&self) -> Option<InitHook> {
+        self.test_seam.as_ref().and_then(|s| s.on_init.clone())
+    }
+
+    /// Complete the one-time init: open the DB once on the blocking pool,
+    /// running `SCHEMA` + all migrations (incl. M4), then drop the connection.
+    /// Concurrent callers await the same single execution. Idempotent and
+    /// cheap after the first success (the cached `()` short-circuits).
+    async fn ensure_initialized(&self) -> Result<(), String> {
+        let path = self.db_path()?;
+        #[cfg(test)]
+        let hook = self.init_hook();
+        self.init
+            .get_or_try_init(|| async {
+                tokio::task::spawn_blocking(move || {
+                    // Test hook runs at the very start of the single init task,
+                    // before the migration opens the DB — this is where a test
+                    // holds the winner past the busy timeout to prove ordinary
+                    // callers await it. No-op in production.
+                    #[cfg(test)]
+                    if let Some(hook) = hook {
+                        hook();
+                    }
+                    // Opening runs every migration; the connection exists only
+                    // to complete them behind the barrier, so drop it here.
+                    let conn = store::open_archive_db(&path)?;
+                    drop(conn);
+                    Ok::<(), String>(())
+                })
+                .await
+                .map_err(|e| format!("archive init task failed: {e}"))?
+            })
+            .await
+            .map(|_| ())
+    }
+
+    /// Warm the init barrier without running a query. Called once from
+    /// `setup()` so the first-open migration cost (M4's index build over a
+    /// large archive) is paid at startup rather than blocking a user's first
+    /// archive command. A failure here is non-fatal — the first real
+    /// [`with_conn`](Self::with_conn) caller retries and surfaces the error.
+    pub async fn warm_init(&self) -> Result<(), String> {
+        self.ensure_initialized().await
+    }
+
+    /// Run `task` against a fresh archive connection on the blocking pool.
+    ///
+    /// Ordering: await the init barrier → acquire the maintenance read guard →
+    /// dispatch the blocking closure with its own connection. The read guard is
+    /// held across the `.await` on the blocking join, so it is released only
+    /// after `task` returns and the connection it borrowed has dropped — the
+    /// guard-lifetime contract the Phase-4 write path depends on.
+    pub async fn with_conn<T, F>(&self, task: F) -> Result<T, String>
+    where
+        T: Send + 'static,
+        F: FnOnce(&Connection) -> Result<T, String> + Send + 'static,
+    {
+        self.ensure_initialized().await?;
+        let path = self.db_path()?;
+        let _guard = self.maintenance.read().await;
+        tokio::task::spawn_blocking(move || {
+            let conn = store::open_archive_db(&path)?;
+            task(&conn)
+        })
+        .await
+        .map_err(|e| format!("archive db task failed: {e}"))?
+    }
+}
+
+#[cfg(test)]
+impl ArchiveDb {
+    /// Build an adapter bound to a fixed DB path (no nest required), so the
+    /// barrier and guard-lifetime contracts can be exercised in isolation.
+    fn with_test_path(path: PathBuf) -> Self {
+        Self {
+            init: OnceCell::new(),
+            maintenance: RwLock::new(()),
+            test_seam: Some(TestSeam {
+                path,
+                on_init: None,
+            }),
+        }
+    }
+
+    /// Build an adapter bound to a fixed path whose single initialization runs
+    /// `hook` first — used to count initializations and to hold the init task
+    /// open across the concurrent-caller window.
+    fn with_test_hook(path: PathBuf, hook: InitHook) -> Self {
+        Self {
+            init: OnceCell::new(),
+            maintenance: RwLock::new(()),
+            test_seam: Some(TestSeam {
+                path,
+                on_init: Some(hook),
+            }),
+        }
+    }
+
+    /// Whether the maintenance WRITE guard can be taken right now. A live
+    /// `with_conn` connection holds the read guard, so this returns `false`
+    /// while any ordinary connection is open and `true` once all have dropped —
+    /// exactly the signal the Phase-4 sole-connection VACUUM will gate on.
+    fn maintenance_write_available(&self) -> bool {
+        self.maintenance.try_write().is_ok()
+    }
+}
+
+#[cfg(test)]
+#[path = "archive_db_tests.rs"]
+mod archive_db_tests;
diff --git a/desktop/src-tauri/src/archive/archive_db_tests.rs b/desktop/src-tauri/src/archive/archive_db_tests.rs
new file mode 100644
index 00000000000..f8182f829ce
--- /dev/null
+++ b/desktop/src-tauri/src/archive/archive_db_tests.rs
@@ -0,0 +1,246 @@
+//! Behavior tests for the [`ArchiveDb`] init barrier and maintenance-lock
+//! guard lifetime — the two contracts Phase 1 introduced and Thufir's pass-1
+//! review required to be pinned directly (not via raw SQLite contention).
+//!
+//! These race PRODUCTION-shaped `with_conn` callers through the real
+//! `OnceCell`/`RwLock` orchestration, using the `#[cfg(test)]` path/hook seam
+//! on `ArchiveDb` to make timing deterministic instead of relying on a large
+//! on-disk fixture or wall-clock sleeps to approach the 5s busy timeout.
+
+use super::*;
+use std::sync::atomic::{AtomicUsize, Ordering};
+use std::sync::{Arc, Condvar, Mutex};
+use std::time::{Duration, Instant};
+use tempfile::TempDir;
+
+/// A one-shot latch that blocks a blocking-pool thread until the test releases
+/// it. Deterministic stand-in for "the M4 winner holds init open past the busy
+/// timeout": the init/closure thread parks here, the test observes the frozen
+/// state, then releases. `Mutex` + `Condvar` are `Sync`, so an `Arc<Latch>`
+/// captured by the `Send + Sync` init hook type-checks.
+struct Latch {
+    open: Mutex<bool>,
+    cv: Condvar,
+}
+
+impl Latch {
+    fn new() -> Arc<Self> {
+        Arc::new(Self {
+            open: Mutex::new(false),
+            cv: Condvar::new(),
+        })
+    }
+
+    /// Block until [`release`](Self::release) is called (returns immediately if
+    /// already released).
+    fn wait(&self) {
+        let mut open = self.open.lock().unwrap();
+        while !*open {
+            open = self.cv.wait(open).unwrap();
+        }
+    }
+
+    fn release(&self) {
+        *self.open.lock().unwrap() = true;
+        self.cv.notify_all();
+    }
+}
+
+/// Poll `cond` on the async runtime until it holds or `timeout` elapses.
+/// Panics on timeout so a broken barrier surfaces as a failure, never a hang.
+async fn await_until(what: &str, timeout: Duration, cond: impl Fn() -> bool) {
+    let deadline = Instant::now() + timeout;
+    while !cond() {
+        assert!(Instant::now() < deadline, "timed out waiting for {what}");
+        tokio::time::sleep(Duration::from_millis(5)).await;
+    }
+}
+
+/// An archive DB path inside a fresh temp dir. The dir is returned so the
+/// caller keeps it alive for the whole test (dropping it deletes the file).
+fn temp_db() -> (TempDir, std::path::PathBuf) {
+    let dir = tempfile::tempdir().unwrap();
+    let path = dir.path().join("archive").join("archive.db");
+    (dir, path)
+}
+
+/// The barrier serializes first-open: exactly one initialization runs while
+/// every concurrent `with_conn` caller awaits it, and no ordinary connection
+/// opens until that initialization has completed.
+///
+/// The init hook holds the single init task open on a latch. While it is held
+/// we prove no `with_conn` caller has opened its connection (`open_count == 0`)
+/// — impossible if callers bypassed the `OnceCell` and opened independently.
+/// Releasing the latch lets init finish; all callers then complete, exactly
+/// one initialization ran, and every open happened after init.
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn test_first_open_barrier_serializes_init_and_defers_opens() {
+    let (_dir, path) = temp_db();
+    let init_count = Arc::new(AtomicUsize::new(0));
+    let open_count = Arc::new(AtomicUsize::new(0));
+    let release = Latch::new();
+
+    let hook = {
+        let init_count = Arc::clone(&init_count);
+        let release = Arc::clone(&release);
+        Arc::new(move || {
+            // Runs once, at the head of the single init task. Record the
+            // initialization, then park so the test can inspect the frozen
+            // pre-open state.
+            init_count.fetch_add(1, Ordering::SeqCst);
+            release.wait();
+        }) as InitHook
+    };
+    let db = Arc::new(ArchiveDb::with_test_hook(path, hook));
+
+    // Trigger the single init and wait until it is provably in flight (hook
+    // ran) and parked on the latch.
+    let warm = {
+        let db = Arc::clone(&db);
+        tokio::spawn(async move { db.warm_init().await })
+    };
+    await_until("init to start", Duration::from_secs(10), || {
+        init_count.load(Ordering::SeqCst) == 1
+    })
+    .await;
+
+    // Fan out production-shaped callers while init is held. Each records that
+    // its task was scheduled (`entered`) and that its closure actually opened a
+    // connection (`open_count`).
+    let entered = Arc::new(AtomicUsize::new(0));
+    let callers: Vec<_> = (0..4)
+        .map(|_| {
+            let db = Arc::clone(&db);
+            let open_count = Arc::clone(&open_count);
+            let entered = Arc::clone(&entered);
+            tokio::spawn(async move {
+                entered.fetch_add(1, Ordering::SeqCst);
+                db.with_conn(move |conn| {
+                    open_count.fetch_add(1, Ordering::SeqCst);
+                    // Touch the migrated schema to prove a usable connection.
+                    conn.query_row("SELECT COUNT(*) FROM archive_meta", [], |r| {
+                        r.get::<_, i64>(0)
+                    })
+                    .map_err(|e| e.to_string())
+                })
+                .await
+            })
+        })
+        .collect();
+
+    // All four caller tasks are scheduled and running before we judge the
+    // barrier: they have entered `with_conn` and can only be parked on the
+    // init `OnceCell`. Without the barrier they would instead open independent
+    // connections here and bump `open_count` while init is still held.
+    await_until("callers to be scheduled", Duration::from_secs(10), || {
+        entered.load(Ordering::SeqCst) == 4
+    })
+    .await;
+    tokio::time::sleep(Duration::from_millis(100)).await;
+    assert_eq!(
+        open_count.load(Ordering::SeqCst),
+        0,
+        "no ordinary connection may open until initialization completes"
+    );
+
+    // Let init finish; every caller now completes against the migrated DB.
+    release.release();
+    assert!(warm.await.unwrap().is_ok(), "warm init must succeed");
+    for caller in callers {
+        assert!(
+            caller.await.unwrap().is_ok(),
+            "every with_conn must succeed"
+        );
+    }
+
+    assert_eq!(
+        init_count.load(Ordering::SeqCst),
+        1,
+        "exactly one initialization ran behind the barrier"
+    );
+    assert_eq!(
+        open_count.load(Ordering::SeqCst),
+        4,
+        "all callers opened, and only after init"
+    );
+}
+
+/// The maintenance read guard lives for the FULL lifetime of a `with_conn`
+/// connection: a write-lock contender cannot enter until the closure returns
+/// and its connection has dropped. This is the invariant the Phase-4
+/// sole-connection VACUUM depends on.
+///
+/// A `with_conn` closure parks on a latch while holding its connection; a
+/// separate task contends for the maintenance write guard. While the closure
+/// is parked the writer must be blocked. Releasing the closure — which returns
+/// and drops the connection — lets the writer finally acquire the guard.
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn test_with_conn_read_guard_blocks_writer_until_connection_drops() {
+    let (_dir, path) = temp_db();
+    let db = Arc::new(ArchiveDb::with_test_path(path));
+    db.warm_init().await.expect("init must succeed");
+
+    let in_closure = Arc::new(AtomicUsize::new(0));
+    let hold = Latch::new();
+
+    // A live connection: the closure parks holding it (and thus the read
+    // guard) until released.
+    let work = {
+        let db = Arc::clone(&db);
+        let in_closure = Arc::clone(&in_closure);
+        let hold = Arc::clone(&hold);
+        tokio::spawn(async move {
+            db.with_conn(move |_conn| {
+                in_closure.fetch_add(1, Ordering::SeqCst);
+                hold.wait();
+                Ok(())
+            })
+            .await
+        })
+    };
+    await_until(
+        "closure to hold the connection",
+        Duration::from_secs(10),
+        || in_closure.load(Ordering::SeqCst) == 1,
+    )
+    .await;
+
+    // A genuine write-lock contender.
+    let write_entered = Arc::new(AtomicUsize::new(0));
+    let writer = {
+        let db = Arc::clone(&db);
+        let write_entered = Arc::clone(&write_entered);
+        tokio::spawn(async move {
+            let _w = db.maintenance.write().await;
+            write_entered.fetch_add(1, Ordering::SeqCst);
+        })
+    };
+
+    // While the connection is held, the writer must not have entered, and the
+    // write guard must be unavailable.
+    tokio::time::sleep(Duration::from_millis(200)).await;
+    assert_eq!(
+        write_entered.load(Ordering::SeqCst),
+        0,
+        "writer must block while a with_conn connection is live"
+    );
+    assert!(
+        !db.maintenance_write_available(),
+        "write guard is unavailable while the read guard is held"
+    );
+
+    // Release the closure: it returns and its connection drops, releasing the
+    // read guard so the writer can proceed.
+    hold.release();
+    assert!(work.await.unwrap().is_ok(), "held with_conn must succeed");
+    writer.await.unwrap();
+    assert_eq!(
+        write_entered.load(Ordering::SeqCst),
+        1,
+        "writer enters once the connection has dropped"
+    );
+    assert!(
+        db.maintenance_write_available(),
+        "write guard is free again after the connection drops"
+    );
+}
diff --git a/desktop/src-tauri/src/archive/mod.rs b/desktop/src-tauri/src/archive/mod.rs
index 81bc2133528..1b246b3fa23 100644
--- a/desktop/src-tauri/src/archive/mod.rs
+++ b/desktop/src-tauri/src/archive/mod.rs
@@ -18,12 +18,16 @@
 //! == agent) is applied fail-closed.
 
 mod agent_usage;
+mod archive_db;
 mod metric_store;
 mod pipeline;
+pub mod retention;
 pub mod store;
 mod store_migrations;
 pub mod sync;
 
+pub use archive_db::ArchiveDb;
+
 use pipeline::{commit_archive, plan_archive, query_buckets};
 
 use nostr::Event;
@@ -32,7 +36,6 @@ use serde::{Deserialize, Serialize};
 use tauri::State;
 
 use crate::app_state::AppState;
-use crate::managed_agents::nest_dir;
 use crate::relay::{query_relay, relay_ws_url_with_override};
 
 // ── Constants ───────────────────────────────────────────────────────────────
@@ -43,10 +46,20 @@ const OBSERVER_FRAME_TELEMETRY: &str = "telemetry";
 
 // ── DB helpers ───────────────────────────────────────────────────────────────
 
-fn open_db() -> Result<Connection, String> {
-    let nest = nest_dir().ok_or("cannot resolve nest directory for archive")?;
-    let db_path = nest.join("archive").join("archive.db");
-    store::open_archive_db(&db_path)
+/// Warm the archive DB init barrier on a background task, now that the nest
+/// exists, so the first-open schema migration cost (M4's index build over a
+/// large archive) is paid at startup rather than blocking a user's first
+/// archive command. The globally-mounted observer archive producer also
+/// `await`s this barrier before its first write, so warming it early avoids a
+/// stall on the first observer frame. Non-fatal: the first real archive command
+/// retries and surfaces any error.
+pub fn spawn_warm_init(app: tauri::AppHandle) {
+    tauri::async_runtime::spawn(async move {
+        use tauri::Manager;
+        if let Err(error) = app.state::<AppState>().archive_db.warm_init().await {
+            eprintln!("buzz-desktop: archive DB init deferred: {error}");
+        }
+    });
 }
 
 fn identity_pubkey(state: &AppState) -> Result<String, String> {
@@ -61,19 +74,6 @@ fn now_secs() -> i64 {
         .as_secs() as i64
 }
 
-async fn run_archive_db_task<T, F>(task: F) -> Result<T, String>
-where
-    T: Send + 'static,
-    F: FnOnce(&Connection) -> Result<T, String> + Send + 'static,
-{
-    tokio::task::spawn_blocking(move || {
-        let conn = open_db()?;
-        task(&conn)
-    })
-    .await
-    .map_err(|e| format!("spawn_blocking failed: {e}"))?
-}
-
 // ── Scope type ───────────────────────────────────────────────────────────────
 
 /// The three supported archive scope discriminants.
@@ -170,10 +170,10 @@ pub(crate) async fn archive_candidates(
     // ── Phase 1: plan (blocking SQLite) ─────────────────────────────────────
     let plan_identity_pk = identity_pk.clone();
     let plan_relay_url = relay_url.clone();
-    let plan = run_archive_db_task(move |conn| {
-        plan_archive(candidates, &plan_identity_pk, &plan_relay_url, conn)
-    })
-    .await?;
+    let plan = state
+        .archive_db
+        .with_conn(move |conn| plan_archive(candidates, &plan_identity_pk, &plan_relay_url, conn))
+        .await?;
 
     // ── Phase 2: relay queries (async) ───────────────────────────────────────
     let bucket_results = query_buckets(plan.buckets, state).await;
@@ -186,19 +186,21 @@ pub(crate) async fn archive_candidates(
     };
     let commit_identity_pk = identity_pk.clone();
     let commit_relay_url = relay_url.clone();
-    run_archive_db_task(move |conn| {
-        commit_archive(
-            bucket_results,
-            plan.ephemeral,
-            plan.pre_dropped,
-            &commit_identity_pk,
-            &commit_relay_url,
-            &owner_keys,
-            now,
-            conn,
-        )
-    })
-    .await
+    state
+        .archive_db
+        .with_conn(move |conn| {
+            commit_archive(
+                bucket_results,
+                plan.ephemeral,
+                plan.pre_dropped,
+                &commit_identity_pk,
+                &commit_relay_url,
+                &owner_keys,
+                now,
+                conn,
+            )
+        })
+        .await
 }
 
 /// Validate an ephemeral observer frame (kind 24200) against ALL local rules.
@@ -337,16 +339,21 @@ pub async fn create_save_subscription(
     let kinds_json =
         serde_json::to_string(&kinds).map_err(|e| format!("failed to serialize kinds: {e}"))?;
 
-    let conn = open_db()?;
-    store::upsert_save_subscription(
-        &conn,
-        &identity_pk,
-        &relay_url,
-        scope_type.as_str(),
-        &scope_value,
-        &kinds_json,
-        now,
-    )?;
+    let scope_type_str = scope_type.as_str().to_string();
+    state
+        .archive_db
+        .with_conn(move |conn| {
+            store::upsert_save_subscription(
+                conn,
+                &identity_pk,
+                &relay_url,
+                &scope_type_str,
+                &scope_value,
+                &kinds_json,
+                now,
+            )
+        })
+        .await?;
     sync_state.notify_subscriptions_changed().await;
     Ok(())
 }
@@ -452,10 +459,12 @@ pub async fn merge_save_subscription_kinds(
     let relay_url = relay_ws_url_with_override(&state);
     let now = now_secs();
     let owner_pk = identity_pk.clone();
-    run_archive_db_task(move |conn| {
-        store::merge_owner_p_kinds(conn, &identity_pk, &relay_url, &owner_pk, kind, now)
-    })
-    .await?;
+    state
+        .archive_db
+        .with_conn(move |conn| {
+            store::merge_owner_p_kinds(conn, &identity_pk, &relay_url, &owner_pk, kind, now)
+        })
+        .await?;
     sync_state.notify_subscriptions_changed().await;
     Ok(())
 }
@@ -487,10 +496,12 @@ pub async fn remove_save_subscription_kind(
     let identity_pk = identity_pubkey(&state)?;
     let relay_url = relay_ws_url_with_override(&state);
     let owner_pk = identity_pk.clone();
-    run_archive_db_task(move |conn| {
-        store::remove_owner_p_kind(conn, &identity_pk, &relay_url, &owner_pk, kind)
-    })
-    .await?;
+    state
+        .archive_db
+        .with_conn(move |conn| {
+            store::remove_owner_p_kind(conn, &identity_pk, &relay_url, &owner_pk, kind)
+        })
+        .await?;
     sync_state.notify_subscriptions_changed().await;
     Ok(())
 }
@@ -504,7 +515,9 @@ pub async fn list_save_subscriptions(
 ) -> Result<Vec<store::SaveSubscription>, String> {
     let identity_pk = identity_pubkey(&state)?;
     let relay_url = relay_ws_url_with_override(&state);
-    run_archive_db_task(move |conn| store::list_save_subscriptions(conn, &identity_pk, &relay_url))
+    state
+        .archive_db
+        .with_conn(move |conn| store::list_save_subscriptions(conn, &identity_pk, &relay_url))
         .await
 }
 
@@ -523,16 +536,18 @@ pub async fn delete_save_subscription(
 ) -> Result<bool, String> {
     let identity_pk = identity_pubkey(&state)?;
     let relay_url = relay_ws_url_with_override(&state);
-    let removed = run_archive_db_task(move |conn| {
-        store::delete_save_subscription(
-            conn,
-            &identity_pk,
-            &relay_url,
-            scope_type.as_str(),
-            &scope_value,
-        )
-    })
-    .await?;
+    let removed = state
+        .archive_db
+        .with_conn(move |conn| {
+            store::delete_save_subscription(
+                conn,
+                &identity_pk,
+                &relay_url,
+                scope_type.as_str(),
+                &scope_value,
+            )
+        })
+        .await?;
     if removed {
         sync_state.notify_subscriptions_changed().await;
     }
@@ -564,18 +579,20 @@ pub async fn read_archived_observer_events_for_channel(
 ) -> Result<Vec<String>, String> {
     let identity_pk = identity_pubkey(&state)?;
     let relay_url = relay_ws_url_with_override(&state);
-    run_archive_db_task(move |conn| {
-        store::read_archived_observer_events_for_channel(
-            conn,
-            &identity_pk,
-            &relay_url,
-            &channel_id,
-            before_created_at,
-            before_id.as_deref(),
-            limit.unwrap_or(DEFAULT_READ_LIMIT),
-        )
-    })
-    .await
+    state
+        .archive_db
+        .with_conn(move |conn| {
+            store::read_archived_observer_events_for_channel(
+                conn,
+                &identity_pk,
+                &relay_url,
+                &channel_id,
+                before_created_at,
+                before_id.as_deref(),
+                limit.unwrap_or(DEFAULT_READ_LIMIT),
+            )
+        })
+        .await
 }
 
 // ── index_observer_channel_id ─────────────────────────────────────────────────
@@ -595,20 +612,22 @@ pub async fn index_observer_channel_id(
 ) -> Result<(), String> {
     let identity_pk = identity_pubkey(&state)?;
     let relay_url = relay_ws_url_with_override(&state);
-    run_archive_db_task(move |conn| {
-        for entry in &entries {
-            store::upsert_observer_channel_index(
-                conn,
-                &identity_pk,
-                &relay_url,
-                &entry.event_id,
-                entry.channel_id.as_deref(),
-                entry.created_at,
-            )?;
-        }
-        Ok(())
-    })
-    .await
+    state
+        .archive_db
+        .with_conn(move |conn| {
+            for entry in &entries {
+                store::upsert_observer_channel_index(
+                    conn,
+                    &identity_pk,
+                    &relay_url,
+                    &entry.event_id,
+                    entry.channel_id.as_deref(),
+                    entry.created_at,
+                )?;
+            }
+            Ok(())
+        })
+        .await
 }
 
 /// A single (event_id, channel_id?, created_at) record used by
@@ -639,18 +658,20 @@ pub async fn read_unindexed_observer_rows(
 ) -> Result<Vec<RawObserverRow>, String> {
     let identity_pk = identity_pubkey(&state)?;
     let relay_url = relay_ws_url_with_override(&state);
-    run_archive_db_task(move |conn| {
-        let rows = store::read_unindexed_observer_rows(conn, &identity_pk, &relay_url)?;
-        Ok(rows
-            .into_iter()
-            .map(|(id, raw_json, created_at)| RawObserverRow {
-                id,
-                raw_json,
-                created_at,
-            })
-            .collect())
-    })
-    .await
+    state
+        .archive_db
+        .with_conn(move |conn| {
+            let rows = store::read_unindexed_observer_rows(conn, &identity_pk, &relay_url)?;
+            Ok(rows
+                .into_iter()
+                .map(|(id, raw_json, created_at)| RawObserverRow {
+                    id,
+                    raw_json,
+                    created_at,
+                })
+                .collect())
+        })
+        .await
 }
 
 /// Wire type returned by `read_unindexed_observer_rows`.
@@ -695,20 +716,22 @@ pub async fn read_archived_events(
     let relay_url = relay_ws_url_with_override(&state);
     let scope_type_str = scope_type.as_str().to_string();
     let read_limit = limit.unwrap_or(DEFAULT_READ_LIMIT);
-    run_archive_db_task(move |conn| {
-        store::read_archived_events(
-            conn,
-            &identity_pk,
-            &relay_url,
-            &scope_type_str,
-            &scope_value,
-            kinds.as_deref(),
-            before_created_at,
-            before_id.as_deref(),
-            read_limit,
-        )
-    })
-    .await
+    state
+        .archive_db
+        .with_conn(move |conn| {
+            store::read_archived_events(
+                conn,
+                &identity_pk,
+                &relay_url,
+                &scope_type_str,
+                &scope_value,
+                kinds.as_deref(),
+                before_created_at,
+                before_id.as_deref(),
+                read_limit,
+            )
+        })
+        .await
 }
 
 // ── get_agent_usage_series ───────────────────────────────────────────────────
@@ -797,10 +820,48 @@ pub async fn get_agent_usage_series(
 ) -> Result<agent_usage::AgentUsageSeries, String> {
     let identity_pk = identity_pubkey(&state)?;
     let relay_url = relay_ws_url_with_override(&state);
-    run_archive_db_task(move |conn| agent_usage_series(conn, &identity_pk, &relay_url, &request))
+    state
+        .archive_db
+        .with_conn(move |conn| agent_usage_series(conn, &identity_pk, &relay_url, &request))
+        .await
+}
+
+// ── Retention configuration commands ──────────────────────────────────────────
+
+/// Read the global observer-frame (kind 24200) retention window, in days. Every
+/// other archived kind — NIP-AM metrics and any custom subscription — is kept
+/// indefinitely and has no setting.
+#[tauri::command]
+pub async fn get_observer_retention_days(state: State<'_, AppState>) -> Result<i64, String> {
+    state
+        .archive_db
+        .with_conn(retention::get_observer_retention_days)
+        .await
+}
+
+/// Set the global observer-frame retention window, in days. Fail-closed: the
+/// store layer rejects zero, negative, or out-of-range values (see
+/// [`retention::validate_days`]).
+#[tauri::command]
+pub async fn set_observer_retention_days(
+    state: State<'_, AppState>,
+    days: i64,
+) -> Result<(), String> {
+    state
+        .archive_db
+        .with_conn(move |conn| retention::set_observer_retention_days(conn, days))
         .await
 }
 
+/// Physical (file) and logical (page) size accounting for the archive DB, for
+/// the Settings size readout. PRAGMAs + file metadata only — no payload scans.
+#[tauri::command]
+pub async fn archive_size_stats(
+    state: State<'_, AppState>,
+) -> Result<retention::ArchiveSizeStats, String> {
+    state.archive_db.with_conn(retention::size_stats).await
+}
+
 // ── Tests ────────────────────────────────────────────────────────────────────
 
 #[cfg(test)]
diff --git a/desktop/src-tauri/src/archive/retention.rs b/desktop/src-tauri/src/archive/retention.rs
new file mode 100644
index 00000000000..5ee9acff200
--- /dev/null
+++ b/desktop/src-tauri/src/archive/retention.rs
@@ -0,0 +1,216 @@
+//! Local archive retention configuration + size accounting.
+//!
+//! v4 (Will's ruling, 2026-08-19): retention is a single global setting — how
+//! many days observer frames (kind 24200) are kept locally. NIP-AM metrics
+//! (44200) and every other archived kind are kept indefinitely with no
+//! retention machinery. The setting lives as one row in the `archive_meta` k/v
+//! table (`observer_retention_days`), seeded by migration M4.
+//!
+//! This module owns the `archive_meta` schema, the scope-age index used by the
+//! Phase-2 prune scan, the get/set accessors for the observer window, and the
+//! PRAGMA-based size readout. The prune worker itself lands in Phase 2.
+//!
+//! Kept in a sibling file (not `store.rs`) to respect the 1000-line gate, per
+//! the existing `metric_store.rs` / `pipeline.rs` / `store_migrations.rs`
+//! precedent.
+
+use rusqlite::{params, Connection, OptionalExtension};
+
+// ── Constants ────────────────────────────────────────────────────────────────
+
+/// `archive_meta` key holding the observer-frame retention window, in days,
+/// stored as its decimal text.
+pub const OBSERVER_RETENTION_DAYS_KEY: &str = "observer_retention_days";
+
+/// Default rolling window for observer frames (Will's ruling: "~14–30"; 30 is
+/// the shipped default, trivially changeable). Seeded into `archive_meta` by M4.
+pub const DEFAULT_OBSERVER_RETENTION_DAYS: i64 = 30;
+
+/// Upper bound on the retention window (~100 years). Guards against a day count
+/// large enough to overflow `archived_at` cutoff arithmetic while still
+/// admitting any realistic user choice.
+pub const MAX_RETENTION_DAYS: i64 = 36_500;
+
+// ── Schema (created by migration M4, not the base SCHEMA) ─────────────────────
+
+/// `archive_meta`. Created inside M4 under `BEGIN IMMEDIATE` (see
+/// `store_migrations::migrate_add_archive_meta`). Plain `CREATE TABLE`
+/// (no `IF NOT EXISTS`): M4 creates it once on a DB that provably lacks it (the
+/// fail-closed guard rejects a pre-existing one), so the clause would be dead
+/// weight. Holds the observer-retention window and the Phase-2 prune timestamp.
+pub(super) const ARCHIVE_META_SCHEMA: &str = "
+CREATE TABLE archive_meta (
+    key   TEXT PRIMARY KEY,
+    value TEXT NOT NULL
+);
+";
+
+/// Covering index for the Phase-2 retention prune candidate scan. V4 prunes
+/// one global observer window, so the scan filters `(identity_pubkey,
+/// relay_url, archived_at < cutoff)` and joins `archived_events` for
+/// `kind = 24200` — it does NOT constrain `scope_type`/`scope_value`. Age
+/// therefore has to lead the non-equality keys: putting `archived_at`
+/// immediately after the two identity/relay equality keys lets SQLite
+/// range-seek `archived_at < ?` directly (`SEARCH ... USING COVERING INDEX
+/// ... (identity_pubkey=? AND relay_url=? AND archived_at<?)`). The v3 order
+/// buried `archived_at` behind the two now-unconstrained scope keys, so the
+/// planner fell back to a bare identity/relay seek plus a temp b-tree.
+///
+/// The trailing `id, scope_type, scope_value` complete the scope-row primary
+/// key, so the index both covers the scan (no table lookup) and hands Phase 2
+/// the exact keys its bounded `DELETE` needs to materialize candidates.
+///
+/// Built in M4 so the one-time cost over the existing 1.3M-row archive is paid
+/// behind the init barrier rather than on the prune hot path. M4
+/// `DROP INDEX IF EXISTS`es under this name and recreates it unconditionally,
+/// so a fresh build is always correct — plain `CREATE INDEX`, no `IF NOT
+/// EXISTS`.
+pub(super) const SCOPE_AGE_INDEX_DDL: &str = "
+CREATE INDEX idx_archived_event_scopes_age
+    ON archived_event_scopes
+       (identity_pubkey, relay_url, archived_at, id, scope_type, scope_value);
+";
+
+/// Name of the scope-age index, shared by the DDL and M4's unconditional
+/// drop-and-rebuild.
+pub(super) const SCOPE_AGE_INDEX_NAME: &str = "idx_archived_event_scopes_age";
+
+// ── Types ─────────────────────────────────────────────────────────────────────
+
+/// Physical and logical size accounting for the archive DB file, returned by
+/// `archive_size_stats`. All figures come from cheap PRAGMAs and file metadata
+/// — no payload scans.
+#[derive(Debug, Clone, PartialEq, Eq, serde::Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct ArchiveSizeStats {
+    /// On-disk size of the main DB file, in bytes (from filesystem metadata).
+    pub main_file_bytes: i64,
+    /// On-disk size of the `-wal` sidecar file, in bytes; `0` when absent.
+    pub wal_file_bytes: i64,
+    /// SQLite page size, in bytes (`PRAGMA page_size`).
+    pub page_size: i64,
+    /// Total pages in the main DB (`PRAGMA page_count`).
+    pub page_count: i64,
+    /// Free (reclaimable) pages on the freelist (`PRAGMA freelist_count`).
+    pub freelist_count: i64,
+}
+
+// ── Validation ─────────────────────────────────────────────────────────────────
+
+/// Fail-closed validation for the observer retention window: a day count in
+/// `1..=MAX_RETENTION_DAYS`. Zero, negatives, and out-of-range values are
+/// rejected so the setting can never encode a non-expiring "0 days" or an
+/// overflowing cutoff.
+pub fn validate_days(days: i64) -> Result<(), String> {
+    if !(1..=MAX_RETENTION_DAYS).contains(&days) {
+        return Err(format!(
+            "retention days must be between 1 and {MAX_RETENTION_DAYS}; got {days}"
+        ));
+    }
+    Ok(())
+}
+
+// ── Observer retention window (archive_meta accessor) ───────────────────────────
+
+/// Read the observer-frame retention window (days). Returns the seeded default
+/// when the row is somehow absent (older DB opened before M4 seeded it, or an
+/// externally cleared row) so the setting always resolves to a bounded window
+/// rather than silently becoming Forever.
+pub fn get_observer_retention_days(conn: &Connection) -> Result<i64, String> {
+    let raw: Option<String> = conn
+        .query_row(
+            "SELECT value FROM archive_meta WHERE key = ?1",
+            params![OBSERVER_RETENTION_DAYS_KEY],
+            |row| row.get(0),
+        )
+        .optional()
+        .map_err(|e| format!("read observer retention days: {e}"))?;
+
+    match raw {
+        Some(s) => s
+            .parse::<i64>()
+            .map_err(|e| format!("observer retention days not an integer ({s:?}): {e}")),
+        None => Ok(DEFAULT_OBSERVER_RETENTION_DAYS),
+    }
+}
+
+/// Set the observer-frame retention window (days). Fail-closed: rejects an
+/// out-of-range value before writing (see [`validate_days`]). A single
+/// idempotent upsert, atomic under autocommit.
+pub fn set_observer_retention_days(conn: &Connection, days: i64) -> Result<(), String> {
+    validate_days(days)?;
+    conn.execute(
+        "INSERT INTO archive_meta (key, value) VALUES (?1, ?2)
+         ON CONFLICT (key) DO UPDATE SET value = excluded.value",
+        params![OBSERVER_RETENTION_DAYS_KEY, days.to_string()],
+    )
+    .map_err(|e| format!("set observer retention days: {e}"))?;
+    Ok(())
+}
+
+// ── Size accounting ─────────────────────────────────────────────────────────────
+
+/// Collect physical (file) and logical (page) size figures for the archive DB.
+/// PRAGMAs only — no row or payload scans. The main DB file path is read from
+/// the connection itself (`PRAGMA database_list`), and the `-wal` sidecar is
+/// measured by appending `-wal` to it.
+pub fn size_stats(conn: &Connection) -> Result<ArchiveSizeStats, String> {
+    let page_size: i64 = conn
+        .pragma_query_value(None, "page_size", |row| row.get(0))
+        .map_err(|e| format!("read page_size: {e}"))?;
+    let page_count: i64 = conn
+        .pragma_query_value(None, "page_count", |row| row.get(0))
+        .map_err(|e| format!("read page_count: {e}"))?;
+    let freelist_count: i64 = conn
+        .pragma_query_value(None, "freelist_count", |row| row.get(0))
+        .map_err(|e| format!("read freelist_count: {e}"))?;
+
+    // `PRAGMA database_list` yields (seq, name, file) rows; the `main` schema's
+    // `file` is the on-disk DB path (empty for a `:memory:` DB). File sizes are
+    // read from filesystem metadata rather than page arithmetic so WAL frames
+    // not yet checkpointed into the main file are accounted for separately.
+    let main_path: Option<String> = conn
+        .query_row(
+            "SELECT file FROM pragma_database_list WHERE name = 'main'",
+            [],
+            |row| row.get::<_, String>(0),
+        )
+        .optional()
+        .map_err(|e| format!("read database_list: {e}"))?
+        .filter(|p| !p.is_empty());
+
+    let (main_file_bytes, wal_file_bytes) = match main_path {
+        Some(p) => {
+            let main = std::path::PathBuf::from(&p);
+            (file_len(&main), file_len(&wal_path(&main)))
+        }
+        None => (0, 0),
+    };
+
+    Ok(ArchiveSizeStats {
+        main_file_bytes,
+        wal_file_bytes,
+        page_size,
+        page_count,
+        freelist_count,
+    })
+}
+
+/// Size of a file in bytes, or `0` when it does not exist / cannot be stat'd.
+/// A missing `-wal` (fully checkpointed DB) is the normal case, not an error.
+fn file_len(path: &std::path::Path) -> i64 {
+    std::fs::metadata(path).map(|m| m.len() as i64).unwrap_or(0)
+}
+
+/// The `-wal` sidecar path for a main DB file (`archive.db` → `archive.db-wal`).
+fn wal_path(db_path: &std::path::Path) -> std::path::PathBuf {
+    let mut name = db_path.as_os_str().to_os_string();
+    name.push("-wal");
+    std::path::PathBuf::from(name)
+}
+
+// ── Tests ───────────────────────────────────────────────────────────────────
+
+#[cfg(test)]
+#[path = "retention_tests.rs"]
+mod retention_tests;
diff --git a/desktop/src-tauri/src/archive/retention_tests.rs b/desktop/src-tauri/src/archive/retention_tests.rs
new file mode 100644
index 00000000000..26e6a25fdae
--- /dev/null
+++ b/desktop/src-tauri/src/archive/retention_tests.rs
@@ -0,0 +1,440 @@
+//! Behavior tests for the observer-retention setting, the size readout, and the
+//! M4 migration.
+//!
+//! Kept in a sibling file so `retention.rs` stays under the 1000-line gate;
+//! `#[path]`-included from there. `super::*` brings the retention API (and its
+//! `rusqlite::{params, Connection}` imports) into scope; `super::super::store`
+//! reaches the neighbouring subscription mutators and the base `SCHEMA`.
+
+use super::super::store;
+use super::*;
+use std::path::Path;
+use std::sync::{Arc, Barrier};
+use tempfile::NamedTempFile;
+
+const ID: &str = "idpk";
+const RELAY: &str = "wss://r";
+const OWNER: &str = "owner_p";
+
+/// Open a fresh archive DB (runs the full schema + every migration incl. M4).
+fn fresh(db: &NamedTempFile) -> Connection {
+    store::open_archive_db(db.path()).expect("open_archive_db must succeed")
+}
+
+/// Build a legacy DB that has the base schema and M1–M3 markers but NOT M4,
+/// so the next `open_archive_db` pends only the retention migration. This
+/// isolates the M4 first-open race from the separately-tested M1–M3 chain.
+fn build_pre_m4_db(path: &Path) {
+    let conn = Connection::open(path).unwrap();
+    conn.pragma_update(None, "busy_timeout", 5000).unwrap();
+    conn.pragma_update(None, "journal_mode", "WAL").unwrap();
+    conn.execute_batch(store::SCHEMA).unwrap();
+    for name in [
+        "add_harness_to_metric_index",
+        "add_cache_read_tokens",
+        "add_cache_write_and_pricing",
+    ] {
+        conn.execute(
+            "INSERT OR IGNORE INTO archive_migrations (name, applied_at) VALUES (?1, 0)",
+            params![name],
+        )
+        .unwrap();
+    }
+}
+
+fn m4_marker_count(conn: &Connection) -> i64 {
+    conn.query_row(
+        "SELECT COUNT(*) FROM archive_migrations WHERE name = 'add_archive_meta'",
+        [],
+        |r| r.get(0),
+    )
+    .unwrap()
+}
+
+// ── Validation (pure) ──────────────────────────────────────────────────────────
+
+#[test]
+fn test_validate_days_accepts_one_and_max() {
+    assert!(validate_days(1).is_ok());
+    assert!(validate_days(DEFAULT_OBSERVER_RETENTION_DAYS).is_ok());
+    assert!(validate_days(MAX_RETENTION_DAYS).is_ok());
+}
+
+#[test]
+fn test_validate_days_rejects_zero_negative_and_over_max() {
+    assert!(validate_days(0).is_err());
+    assert!(validate_days(-1).is_err());
+    assert!(validate_days(MAX_RETENTION_DAYS + 1).is_err());
+}
+
+// ── Observer retention get / set ────────────────────────────────────────────────
+
+#[test]
+fn test_get_observer_days_returns_seeded_default_on_fresh_db() {
+    let db = NamedTempFile::new().unwrap();
+    let conn = fresh(&db);
+    assert_eq!(
+        get_observer_retention_days(&conn).unwrap(),
+        DEFAULT_OBSERVER_RETENTION_DAYS
+    );
+}
+
+#[test]
+fn test_set_observer_days_upserts_and_overwrites() {
+    let db = NamedTempFile::new().unwrap();
+    let conn = fresh(&db);
+    set_observer_retention_days(&conn, 14).unwrap();
+    assert_eq!(get_observer_retention_days(&conn).unwrap(), 14);
+    set_observer_retention_days(&conn, 60).unwrap();
+    assert_eq!(get_observer_retention_days(&conn).unwrap(), 60);
+}
+
+#[test]
+fn test_set_observer_days_rejects_out_of_range_without_writing() {
+    let db = NamedTempFile::new().unwrap();
+    let conn = fresh(&db);
+    // Establish a known good value, then prove a rejected write leaves it.
+    set_observer_retention_days(&conn, 45).unwrap();
+    assert!(set_observer_retention_days(&conn, 0).is_err());
+    assert!(set_observer_retention_days(&conn, -5).is_err());
+    assert!(set_observer_retention_days(&conn, MAX_RETENTION_DAYS + 1).is_err());
+    assert_eq!(
+        get_observer_retention_days(&conn).unwrap(),
+        45,
+        "a rejected set must not overwrite the stored value"
+    );
+}
+
+#[test]
+fn test_observer_days_survive_reopen() {
+    let db = NamedTempFile::new().unwrap();
+    {
+        let first = fresh(&db);
+        set_observer_retention_days(&first, 7).unwrap();
+    }
+    let second = fresh(&db);
+    assert_eq!(
+        get_observer_retention_days(&second).unwrap(),
+        7,
+        "the setting persists across opens and M4 re-run does not reset it"
+    );
+}
+
+// ── Size accounting ─────────────────────────────────────────────────────────────
+
+#[test]
+fn test_size_stats_reports_pages_and_main_file_bytes() {
+    let db = NamedTempFile::new().unwrap();
+    let conn = fresh(&db);
+    // Write enough rows that the DB grows past a single page.
+    for i in 0..200 {
+        conn.execute(
+            "INSERT INTO archived_events
+                 (identity_pubkey, relay_url, id, kind, pubkey, created_at, raw_json, archived_at)
+             VALUES (?1, ?2, ?3, 24200, 'author', ?4, ?5, ?4)",
+            params![ID, RELAY, format!("e{i}"), 1000 + i, "x".repeat(256)],
+        )
+        .unwrap();
+    }
+    let stats = size_stats(&conn).unwrap();
+    assert!(stats.page_size > 0, "page_size is a positive PRAGMA value");
+    assert!(stats.page_count > 1, "multi-page DB after 200 inserts");
+    assert!(stats.freelist_count >= 0);
+    // In WAL mode the just-written pages live in the `-wal` sidecar until a
+    // checkpoint folds them into the main file, so the logical page total
+    // (page_size * page_count) is covered by the two files combined, not by
+    // the main file alone.
+    assert!(
+        stats.main_file_bytes + stats.wal_file_bytes >= stats.page_size * stats.page_count,
+        "main + wal bytes cover at least the counted pages ({} + {} >= {}*{})",
+        stats.main_file_bytes,
+        stats.wal_file_bytes,
+        stats.page_size,
+        stats.page_count
+    );
+    assert!(stats.main_file_bytes > 0, "the main DB file is on disk");
+    // WAL mode: the sidecar exists and carries the just-written frames.
+    assert!(
+        stats.wal_file_bytes > 0,
+        "the -wal sidecar is measured in WAL mode"
+    );
+}
+
+#[test]
+fn test_size_stats_freelist_grows_after_delete() {
+    let db = NamedTempFile::new().unwrap();
+    let conn = fresh(&db);
+    for i in 0..200 {
+        conn.execute(
+            "INSERT INTO archived_events
+                 (identity_pubkey, relay_url, id, kind, pubkey, created_at, raw_json, archived_at)
+             VALUES (?1, ?2, ?3, 24200, 'author', ?4, ?5, ?4)",
+            params![ID, RELAY, format!("e{i}"), 1000 + i, "x".repeat(256)],
+        )
+        .unwrap();
+    }
+    let before = size_stats(&conn).unwrap();
+    conn.execute("DELETE FROM archived_events", []).unwrap();
+    let after = size_stats(&conn).unwrap();
+    assert!(
+        after.freelist_count > before.freelist_count,
+        "deleted pages land on the freelist ({} > {})",
+        after.freelist_count,
+        before.freelist_count
+    );
+}
+
+// ── Migration M4 ──────────────────────────────────────────────────────────────
+
+#[test]
+fn test_m4_fresh_open_creates_schema_marker_and_seed() {
+    let db = NamedTempFile::new().unwrap();
+    let conn = fresh(&db);
+    let objects: i64 = conn
+        .query_row(
+            "SELECT COUNT(*) FROM sqlite_master
+             WHERE (type = 'table' AND name = 'archive_meta')
+                OR (type = 'index' AND name = 'idx_archived_event_scopes_age')",
+            [],
+            |r| r.get(0),
+        )
+        .unwrap();
+    assert_eq!(objects, 2, "one table + one index");
+    assert_eq!(m4_marker_count(&conn), 1, "M4 marker recorded");
+    assert_eq!(
+        get_observer_retention_days(&conn).unwrap(),
+        DEFAULT_OBSERVER_RETENTION_DAYS,
+        "the observer window is seeded to the default"
+    );
+}
+
+#[test]
+fn test_m4_reopen_is_idempotent_and_preserves_setting() {
+    let db = NamedTempFile::new().unwrap();
+    let first = fresh(&db);
+    set_observer_retention_days(&first, 90).unwrap();
+    drop(first);
+    let second = fresh(&db);
+    assert_eq!(
+        m4_marker_count(&second),
+        1,
+        "exactly one marker after reopen"
+    );
+    assert_eq!(
+        get_observer_retention_days(&second).unwrap(),
+        90,
+        "the re-run must not re-seed over an existing value"
+    );
+}
+
+#[test]
+fn test_m4_applies_over_a_populated_pre_m4_db() {
+    let db = NamedTempFile::new().unwrap();
+    build_pre_m4_db(db.path());
+    // Pre-M4 subscriptions and archived rows must survive the migration
+    // untouched — M4 no longer reads or seeds from subscriptions.
+    {
+        let conn = Connection::open(db.path()).unwrap();
+        store::upsert_save_subscription(&conn, ID, RELAY, OWNER, ID, "[24200,44200,1]", 100)
+            .unwrap();
+    }
+    let conn = fresh(&db);
+    assert_eq!(m4_marker_count(&conn), 1);
+    assert_eq!(
+        get_observer_retention_days(&conn).unwrap(),
+        DEFAULT_OBSERVER_RETENTION_DAYS
+    );
+    assert_eq!(
+        store::list_save_subscriptions(&conn, ID, RELAY)
+            .unwrap()
+            .len(),
+        1,
+        "the pre-existing subscription is untouched by M4"
+    );
+}
+
+#[test]
+fn test_m4_preexisting_archive_meta_without_marker_fails_closed() {
+    let db = NamedTempFile::new().unwrap();
+    build_pre_m4_db(db.path());
+    // An `archive_meta` table present without the M4 marker is unreachable via
+    // shipped code — M4 runs the whole body (create table, build index, seed,
+    // marker) in one transactional `BEGIN IMMEDIATE`, so a crash rolls back the
+    // table too. The only way to reach this state is an externally-created
+    // table. M4 refuses to certify it: it fails closed and rolls back with no
+    // marker rather than adopting a table it did not build. The table's shape
+    // is irrelevant — its mere presence without the marker is the trigger.
+    {
+        let conn = Connection::open(db.path()).unwrap();
+        conn.execute_batch("CREATE TABLE archive_meta (key TEXT PRIMARY KEY);")
+            .unwrap();
+    }
+    assert!(
+        store::open_archive_db(db.path()).is_err(),
+        "M4 must fail closed on a pre-existing archive_meta"
+    );
+    let verify = Connection::open(db.path()).unwrap();
+    assert_eq!(
+        m4_marker_count(&verify),
+        0,
+        "no marker may certify an externally-created table"
+    );
+}
+
+#[test]
+fn test_m4_preexisting_index_under_name_is_silently_rebuilt() {
+    let db = NamedTempFile::new().unwrap();
+    build_pre_m4_db(db.path());
+    // Unlike a table (which carries data and is fail-closed), an index carries
+    // no data, so M4 drops any index sharing the name and recreates it
+    // unconditionally — no shape inspection. A bogus pre-existing index under
+    // the name is silently replaced with the correct one and the marker lands.
+    {
+        let conn = Connection::open(db.path()).unwrap();
+        conn.execute_batch(&format!(
+            "CREATE INDEX {SCOPE_AGE_INDEX_NAME} ON archived_event_scopes (id);"
+        ))
+        .unwrap();
+    }
+    let conn = fresh(&db);
+    assert_eq!(m4_marker_count(&conn), 1, "M4 completes after the rebuild");
+    // The rebuilt index has the six expected key columns in the covering order.
+    let mut stmt = conn
+        .prepare(&format!(
+            "SELECT name FROM pragma_index_xinfo('{SCOPE_AGE_INDEX_NAME}') \
+             WHERE key = 1 ORDER BY seqno"
+        ))
+        .unwrap();
+    let keys: Vec<String> = stmt
+        .query_map([], |r| r.get::<_, String>(0))
+        .unwrap()
+        .collect::<Result<Vec<_>, _>>()
+        .unwrap();
+    assert_eq!(
+        keys,
+        [
+            "identity_pubkey",
+            "relay_url",
+            "archived_at",
+            "id",
+            "scope_type",
+            "scope_value"
+        ],
+        "the index was rebuilt with the age-first covering key order"
+    );
+}
+
+// ── Concurrency ───────────────────────────────────────────────────────────────
+
+#[test]
+fn test_m4_two_conn_first_open_race_neither_times_out_and_marks_once() {
+    use std::thread;
+    let db = NamedTempFile::new().unwrap();
+    let path = db.path().to_path_buf();
+    build_pre_m4_db(&path);
+    // A realistically-populated legacy DB: a multi-kind subscription plus
+    // archived scope rows so M4's index build touches real data.
+    {
+        let conn = Connection::open(&path).unwrap();
+        store::upsert_save_subscription(&conn, ID, RELAY, OWNER, ID, "[24200,44200,1]", 100)
+            .unwrap();
+        for i in 0..8 {
+            conn.execute(
+                "INSERT INTO archived_event_scopes
+                     (identity_pubkey, relay_url, id, scope_type, scope_value, archived_at)
+                 VALUES (?1, ?2, ?3, ?4, ?5, ?6)",
+                params![ID, RELAY, format!("e{i}"), OWNER, ID, 1000 + i],
+            )
+            .unwrap();
+        }
+    }
+
+    let barrier = Arc::new(Barrier::new(2));
+    let handles: Vec<_> = (0..2)
+        .map(|_| {
+            let p = path.clone();
+            let b = Arc::clone(&barrier);
+            thread::spawn(move || {
+                b.wait(); // maximise the first-open race window
+                store::open_archive_db(&p).map(|_| ())
+            })
+        })
+        .collect();
+    for h in handles {
+        assert!(
+            h.join().unwrap().is_ok(),
+            "both racing opens must complete within busy_timeout"
+        );
+    }
+
+    let verify = store::open_archive_db(&path).unwrap();
+    assert_eq!(m4_marker_count(&verify), 1, "M4 applied exactly once");
+    // The seed ran once inside the winner's transaction — one meta row, default.
+    let meta_rows: i64 = verify
+        .query_row(
+            "SELECT COUNT(*) FROM archive_meta WHERE key = ?1",
+            params![OBSERVER_RETENTION_DAYS_KEY],
+            |r| r.get(0),
+        )
+        .unwrap();
+    assert_eq!(meta_rows, 1, "the observer window was seeded exactly once");
+    assert_eq!(
+        get_observer_retention_days(&verify).unwrap(),
+        DEFAULT_OBSERVER_RETENTION_DAYS
+    );
+}
+
+// ── Prune-candidate access path (index shape) ──────────────────────────────────
+
+/// The Phase-2 prune-candidate scan (per `PLANS/ARCHIVE_RETENTION_PLAN.md`
+/// line 40): the single global observer window filters `identity + relay +
+/// archived_at < cutoff`, joins `archived_events` for `kind = 24200`, and
+/// selects the scope-row PK so the bounded `DELETE` can materialize candidates.
+/// The scope side constrains neither `scope_type` nor `scope_value`.
+const PRUNE_CANDIDATE_SQL: &str = "
+SELECT s.id, s.scope_type, s.scope_value
+FROM archived_event_scopes s
+JOIN archived_events e
+  ON e.identity_pubkey = s.identity_pubkey
+ AND e.relay_url = s.relay_url
+ AND e.id = s.id
+WHERE s.identity_pubkey = ?1
+  AND s.relay_url = ?2
+  AND s.archived_at < ?3
+  AND e.kind = 24200
+LIMIT 1000
+";
+
+/// The scope-age index must let the real Phase-2 prune query range-seek
+/// `archived_at` directly rather than fall back to a bare identity/relay seek
+/// plus a temp b-tree. The index is this PR's deliverable, so its access path
+/// is pinned here even though the prune worker lands in Phase 2.
+#[test]
+fn test_prune_candidate_scan_seeks_archived_at_through_the_index() {
+    let db = NamedTempFile::new().unwrap();
+    let conn = fresh(&db); // runs M4, creating the scope-age index
+
+    let plan: Vec<String> = conn
+        .prepare(&format!("EXPLAIN QUERY PLAN {PRUNE_CANDIDATE_SQL}"))
+        .unwrap()
+        .query_map(params![ID, RELAY, 0_i64], |r| r.get::<_, String>(3))
+        .unwrap()
+        .collect::<Result<Vec<_>, _>>()
+        .unwrap();
+
+    let scope_step = plan
+        .iter()
+        .find(|d| d.contains(SCOPE_AGE_INDEX_NAME))
+        .unwrap_or_else(|| panic!("prune scan must use {SCOPE_AGE_INDEX_NAME}; plan was {plan:?}"));
+    // The planner range-seeks archived_at through the index (equality on the
+    // two leading identity/relay keys, then the age bound) — not a bare
+    // identity/relay seek that would leave age to a scan / temp b-tree.
+    assert!(
+        scope_step.contains("archived_at<?"),
+        "scope step must range-seek archived_at, got: {scope_step}"
+    );
+    assert!(
+        !plan.iter().any(|d| d.contains("USE TEMP B-TREE")),
+        "age-first index must remove the ORDER-BY temp b-tree; plan was {plan:?}"
+    );
+}
diff --git a/desktop/src-tauri/src/archive/store_migrations.rs b/desktop/src-tauri/src/archive/store_migrations.rs
index 4e9391693ef..35a21e25d45 100644
--- a/desktop/src-tauri/src/archive/store_migrations.rs
+++ b/desktop/src-tauri/src/archive/store_migrations.rs
@@ -17,11 +17,13 @@ use rusqlite::{params, Connection};
 ///
 /// Ordering: M2 (column additions) runs before M1 (index rebuild) so that
 /// the M1 rebuild, which calls `insert_metric_index_row`, always operates
-/// against a schema that includes the cache-read columns.
+/// against a schema that includes the cache-read columns. M4 (`archive_meta`
+/// + scope-age index) runs last; it is independent of M1–M3.
 pub(super) fn apply_schema_migrations(conn: &Connection) -> Result<(), String> {
     migrate_add_cache_read_tokens(conn)?;
     migrate_add_cache_write_and_pricing(conn)?;
-    migrate_add_harness_to_metric_index(conn)
+    migrate_add_harness_to_metric_index(conn)?;
+    migrate_add_archive_meta(conn)
 }
 
 /// M1: add `harness TEXT` column to `agent_metric_index` and rebuild index
@@ -323,3 +325,135 @@ fn migrate_add_cache_write_and_pricing(conn: &Connection) -> Result<(), String>
 
     Ok(())
 }
+
+/// M4: create the retention config storage — `archive_meta` (k/v state holding
+/// the observer-frame retention window and the Phase-2 prune timestamp) and the
+/// `archived_at`-covering scope-age index — then seed the default observer
+/// retention window (`observer_retention_days = 30`).
+///
+/// Unlike M1–M3, M4 CANNOT use the "check marker → `BEGIN DEFERRED`" pattern.
+/// On a fresh DB two connections can open concurrently (the observer- and
+/// metric-archive seed hooks each `open_archive_db`), both read no marker, and
+/// a `DEFERRED` transaction lets both proceed on the same snapshot — the loser
+/// hits `SQLITE_BUSY_SNAPSHOT` or double-seeds. Instead M4 takes the write lock
+/// up front with `BEGIN IMMEDIATE` and **rechecks the marker inside the lock**:
+/// the race loser blocks on `busy_timeout`, then observes the winner's
+/// committed marker and no-ops. The cheap pre-lock guard keeps steady-state
+/// opens off the write lock entirely (M4 only takes it until the marker lands).
+///
+/// The table uses plain `CREATE TABLE` behind a fail-closed guard (a
+/// pre-existing `archive_meta` with no marker is an externally-created object
+/// M4 refuses to certify) and the index is dropped and recreated
+/// unconditionally; the seed is `ON CONFLICT DO NOTHING`. The marker is written
+/// last inside the same transaction, so a crash before COMMIT rolls back every
+/// object and the next open re-runs from scratch.
+fn migrate_add_archive_meta(conn: &Connection) -> Result<(), String> {
+    // Cheap pre-lock guard: steady-state opens (marker already present) never
+    // take the write lock. The marker is written last in M4's transaction, so
+    // its presence implies the full schema + seed committed.
+    if archive_meta_migration_applied(conn)? {
+        return Ok(());
+    }
+
+    conn.execute_batch("BEGIN IMMEDIATE")
+        .map_err(|e| format!("migration M4: begin immediate: {e}"))?;
+
+    let result = migrate_add_archive_meta_locked(conn);
+
+    if result.is_ok() {
+        conn.execute_batch("COMMIT")
+            .map_err(|e| format!("migration M4: commit: {e}"))?;
+    } else {
+        // Best-effort rollback; surface the original error to the caller.
+        let _ = conn.execute_batch("ROLLBACK");
+    }
+    result
+}
+
+/// M4 body, run under the `BEGIN IMMEDIATE` write lock held by
+/// `migrate_add_archive_meta`.
+fn migrate_add_archive_meta_locked(conn: &Connection) -> Result<(), String> {
+    // In-lock recheck: a concurrent first-opener may have committed the marker
+    // while we were blocked on the write lock. If so, this connection has
+    // nothing to do — the winner already created the schema and seeded.
+    if archive_meta_migration_applied(conn)? {
+        return Ok(());
+    }
+
+    // Fail closed on an externally-created table. M4's whole body runs inside
+    // one `BEGIN IMMEDIATE` transaction with the marker written last, and
+    // SQLite DDL is transactional — a crash anywhere rolls the whole thing
+    // back. So no shipped code path can leave the table present without the
+    // marker; the only way to reach here with it already existing is a
+    // hand-edited DB or a foreign tool. Rather than certify a table we did not
+    // create, refuse: roll back with no marker and let a corrected DB re-run.
+    let exists: bool = conn
+        .query_row(
+            "SELECT COUNT(*) FROM sqlite_master WHERE type = 'table' AND name = 'archive_meta'",
+            [],
+            |r| r.get::<_, i64>(0),
+        )
+        .map_err(|e| format!("migration M4: probe archive_meta: {e}"))?
+        > 0;
+    if exists {
+        return Err(
+            "migration M4: archive_meta already exists without the M4 marker — \
+             refusing to certify an externally-created table"
+                .to_string(),
+        );
+    }
+
+    conn.execute_batch(super::retention::ARCHIVE_META_SCHEMA)
+        .map_err(|e| format!("migration M4: create archive_meta: {e}"))?;
+
+    // Unconditionally rebuild the scope-age index. It carries no data, so a
+    // fresh `CREATE` is always correct; dropping any index that happens to
+    // share the name costs one rebuild and needs no shape inspection.
+    conn.execute_batch(&format!(
+        "DROP INDEX IF EXISTS {}",
+        super::retention::SCOPE_AGE_INDEX_NAME
+    ))
+    .map_err(|e| format!("migration M4: drop any pre-existing scope-age index: {e}"))?;
+    conn.execute_batch(super::retention::SCOPE_AGE_INDEX_DDL)
+        .map_err(|e| format!("migration M4: create scope-age index: {e}"))?;
+
+    let now = std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .unwrap_or_default()
+        .as_secs() as i64;
+
+    // Seed the default observer-frame retention window. `ON CONFLICT DO NOTHING`
+    // in the underlying insert makes this a no-op if a value is somehow already
+    // present — an existing choice always wins.
+    conn.execute(
+        "INSERT INTO archive_meta (key, value) VALUES (?1, ?2)
+         ON CONFLICT (key) DO NOTHING",
+        params![
+            super::retention::OBSERVER_RETENTION_DAYS_KEY,
+            super::retention::DEFAULT_OBSERVER_RETENTION_DAYS.to_string()
+        ],
+    )
+    .map_err(|e| format!("migration M4: seed observer retention days: {e}"))?;
+
+    conn.execute(
+        "INSERT OR IGNORE INTO archive_migrations (name, applied_at) \
+         VALUES ('add_archive_meta', ?1)",
+        params![now],
+    )
+    .map_err(|e| format!("migration M4: record marker: {e}"))?;
+
+    Ok(())
+}
+
+/// Whether the M4 marker is present. Its presence implies the retention schema
+/// and default seed committed (the marker is written last in M4's transaction).
+fn archive_meta_migration_applied(conn: &Connection) -> Result<bool, String> {
+    let count: i64 = conn
+        .query_row(
+            "SELECT COUNT(*) FROM archive_migrations WHERE name = 'add_archive_meta'",
+            [],
+            |r| r.get(0),
+        )
+        .map_err(|e| format!("migration M4: guard check: {e}"))?;
+    Ok(count > 0)
+}
diff --git a/desktop/src-tauri/src/archive/store_tests.rs b/desktop/src-tauri/src/archive/store_tests.rs
index bbd15391e75..c0f85430d4d 100644
--- a/desktop/src-tauri/src/archive/store_tests.rs
+++ b/desktop/src-tauri/src/archive/store_tests.rs
@@ -10,6 +10,9 @@ fn in_memory() -> Connection {
     conn.pragma_update(None, "journal_mode", "WAL").unwrap();
     conn.pragma_update(None, "busy_timeout", 5000).unwrap();
     conn.execute_batch(SCHEMA).unwrap();
+    // Match production `open_archive_db`: apply every schema migration (incl.
+    // M4) so tests run against the same shape production connections see.
+    apply_schema_migrations(&conn).unwrap();
     conn
 }
 
diff --git a/desktop/src-tauri/src/archive/sync.rs b/desktop/src-tauri/src/archive/sync.rs
index 4fe4452c818..3730774e952 100644
--- a/desktop/src-tauri/src/archive/sync.rs
+++ b/desktop/src-tauri/src/archive/sync.rs
@@ -280,10 +280,12 @@ impl ArchiveSyncIo for AppIo {
             let state: State<'_, AppState> = self.app.state();
             let identity_pk = super::identity_pubkey(&state)?;
             let relay_url = crate::relay::relay_ws_url_with_override(&state);
-            super::run_archive_db_task(move |conn| {
-                super::store::list_save_subscriptions(conn, &identity_pk, &relay_url)
-            })
-            .await
+            state
+                .archive_db
+                .with_conn(move |conn| {
+                    super::store::list_save_subscriptions(conn, &identity_pk, &relay_url)
+                })
+                .await
         })
     }
 
diff --git a/desktop/src-tauri/src/commands/channels.rs b/desktop/src-tauri/src/commands/channels.rs
index abf40c028fe..e0c6e3bc5ba 100644
--- a/desktop/src-tauri/src/commands/channels.rs
+++ b/desktop/src-tauri/src/commands/channels.rs
@@ -121,6 +121,24 @@ pub async fn get_channel_details(
         .ok_or_else(|| "channel not found".to_string())
 }
 
+/// Cap for the kind:0 profile join in `get_channel_members`. Enriching a
+/// huge roster required an `authors` filter carrying every member pubkey — a
+/// query whose size and relay cost grow linearly with membership and which
+/// dominated channel-open latency on large channels. Members past the cap
+/// keep `display_name: None` (the UI falls back to pubkey-derived labels and
+/// resolves visible names through its profile caches); `role == "bot"` agent
+/// flags are roster-derived and unaffected by the cap.
+const MEMBER_PROFILE_JOIN_LIMIT: usize = 500;
+
+/// The pubkeys eligible for the kind:0 profile join: roster order, capped.
+fn profile_join_pubkeys(members: &[crate::models::ChannelMemberInfo], limit: usize) -> Vec<String> {
+    members
+        .iter()
+        .take(limit)
+        .map(|member| member.pubkey.clone())
+        .collect()
+}
+
 #[tauri::command]
 pub async fn get_channel_members(
     channel_id: String,
@@ -142,8 +160,9 @@ pub async fn get_channel_members(
         .transpose()?
         .ok_or_else(|| "channel members not found".to_string())?;
 
-    // Batch-fetch kind:0 profiles to populate display names.
-    let pubkeys: Vec<String> = response.members.iter().map(|m| m.pubkey.clone()).collect();
+    // Batch-fetch kind:0 profiles to populate display names, capped so the
+    // query cost is bounded on large rosters (see MEMBER_PROFILE_JOIN_LIMIT).
+    let pubkeys = profile_join_pubkeys(&response.members, MEMBER_PROFILE_JOIN_LIMIT);
     if !pubkeys.is_empty() {
         let profile_events = query_relay(
             &state,
diff --git a/desktop/src-tauri/src/commands/channels_tests.rs b/desktop/src-tauri/src/commands/channels_tests.rs
index fb43bb7a70b..91e636d5f20 100644
--- a/desktop/src-tauri/src/commands/channels_tests.rs
+++ b/desktop/src-tauri/src/commands/channels_tests.rs
@@ -490,3 +490,26 @@ fn last_message_filters_stay_within_relay_channel_cap() {
     );
     assert_eq!(batches.concat(), filters);
 }
+
+fn member(pubkey: &str) -> crate::models::ChannelMemberInfo {
+    crate::models::ChannelMemberInfo {
+        pubkey: pubkey.to_string(),
+        role: "member".to_string(),
+        is_agent: false,
+        joined_at: None,
+        display_name: None,
+    }
+}
+
+#[test]
+fn profile_join_pubkeys_caps_in_roster_order() {
+    let members = vec![member(PK_A), member(PK_B), member(PK_C)];
+
+    assert_eq!(
+        profile_join_pubkeys(&members, 2),
+        vec![PK_A.to_string(), PK_B.to_string()]
+    );
+    assert_eq!(profile_join_pubkeys(&members, 3).len(), 3);
+    assert_eq!(profile_join_pubkeys(&members, 10).len(), 3);
+    assert!(profile_join_pubkeys(&[], 10).is_empty());
+}
diff --git a/desktop/src-tauri/src/events/message_tags.rs b/desktop/src-tauri/src/events/message_tags.rs
index c43a8874def..1d719beaa66 100644
--- a/desktop/src-tauri/src/events/message_tags.rs
+++ b/desktop/src-tauri/src/events/message_tags.rs
@@ -4,6 +4,7 @@ use super::check_pubkey;
 
 const MAX_THREAD_ROOT_EXCERPT_CHARS: usize = 64;
 const SENT_FROM_THREAD_TAG: &str = "buzz:sent-from-thread";
+const AGENT_ADDRESS_MENTION_MARKER: &str = "agent-address";
 
 pub(super) fn mention_reference_tags(
     mentions: &[Vec<String>],
@@ -19,10 +20,20 @@ pub(super) fn mention_reference_tags(
         let Some(pubkey) = mention.get(1) else {
             return Err("mention reference tag missing pubkey".into());
         };
+        if mention.len() > 3
+            || (mention.len() == 3
+                && mention.get(2).map(String::as_str) != Some(AGENT_ADDRESS_MENTION_MARKER))
+        {
+            return Err("mention reference tag has invalid display metadata".into());
+        }
         check_pubkey(pubkey)?;
+        let normalized_pubkey = pubkey.to_ascii_lowercase();
+        let mut parts = vec!["mention", normalized_pubkey.as_str()];
+        if mention.len() == 3 {
+            parts.push(AGENT_ADDRESS_MENTION_MARKER);
+        }
         tags.push(
-            Tag::parse(vec!["mention", &pubkey.to_ascii_lowercase()])
-                .map_err(|error| format!("invalid mention reference tag: {error}"))?,
+            Tag::parse(parts).map_err(|error| format!("invalid mention reference tag: {error}"))?,
         );
     }
     Ok(())
@@ -115,8 +126,39 @@ pub(super) fn append_client_tags(
 mod tests {
     use super::*;
 
+    const PUBKEY: &str = "79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798";
     const ROOT_HEX: &str = "d24da132115ca0a46233cf4c2ad8338fbf914250cbcaa9181a6dd59533cb5ac1";
 
+    #[test]
+    fn mention_reference_preserves_agent_address_display_metadata() {
+        let mut tags = Vec::new();
+        mention_reference_tags(
+            &[vec![
+                "mention".into(),
+                PUBKEY.to_ascii_uppercase(),
+                AGENT_ADDRESS_MENTION_MARKER.into(),
+            ]],
+            &mut tags,
+        )
+        .unwrap();
+
+        assert_eq!(
+            tags[0].as_slice(),
+            &["mention", PUBKEY, AGENT_ADDRESS_MENTION_MARKER]
+        );
+    }
+
+    #[test]
+    fn mention_reference_rejects_unknown_display_metadata() {
+        let mut tags = Vec::new();
+        let result = mention_reference_tags(
+            &[vec!["mention".into(), PUBKEY.into(), "unknown".into()]],
+            &mut tags,
+        );
+
+        assert!(result.is_err());
+    }
+
     #[test]
     fn message_accepts_only_valid_sent_from_thread_provenance() {
         let source_tag = vec![
diff --git a/desktop/src-tauri/src/huddle/agent_tts_publisher.rs b/desktop/src-tauri/src/huddle/agent_tts_publisher.rs
new file mode 100644
index 00000000000..a1d42692666
--- /dev/null
+++ b/desktop/src-tauri/src/huddle/agent_tts_publisher.rs
@@ -0,0 +1,75 @@
+//! Establishes agent-authenticated publishers for locally synthesized speech.
+
+use std::sync::Arc;
+
+use super::{relay_api, tts};
+use crate::app_state::AppState;
+
+pub(super) async fn ensure(
+    app: &tauri::AppHandle,
+    state: &AppState,
+    pipeline: &tts::TtsPipeline,
+    speaker_pubkey: &str,
+) -> Result<bool, String> {
+    if pipeline.has_audio_publisher(speaker_pubkey) {
+        return Ok(true);
+    }
+
+    let app_for_load = app.clone();
+    let speaker_for_load = speaker_pubkey.to_ascii_lowercase();
+    let record = tokio::task::spawn_blocking(move || {
+        crate::managed_agents::load_managed_agents(&app_for_load).map(|agents| {
+            agents.into_iter().find(|agent| {
+                agent.pubkey.eq_ignore_ascii_case(&speaker_for_load)
+                    && !agent.private_key_nsec.trim().is_empty()
+            })
+        })
+    })
+    .await
+    .map_err(|error| format!("managed-agent identity task failed: {error}"))??;
+    let Some(record) = record else {
+        return Ok(false);
+    };
+
+    let keys = nostr::Keys::parse(record.private_key_nsec.trim())
+        .map_err(|error| format!("managed-agent identity is unavailable: {error}"))?;
+    if !keys
+        .public_key()
+        .to_hex()
+        .eq_ignore_ascii_case(speaker_pubkey)
+    {
+        return Err("managed-agent identity does not match the Huddle speaker".to_string());
+    }
+    let (ephemeral_channel_id, parent_channel_id, local_tts_publishers) = {
+        let huddle = state.huddle()?;
+        (
+            huddle
+                .ephemeral_channel_id
+                .clone()
+                .ok_or("active Huddle has no backing channel")?,
+            huddle.parent_channel_id.clone(),
+            Arc::clone(&huddle.local_tts_publishers),
+        )
+    };
+    let has_bot_membership =
+        relay_api::fetch_channel_members_with_roles(&ephemeral_channel_id, state)
+            .await?
+            .into_iter()
+            .any(|(pubkey, role)| {
+                pubkey.eq_ignore_ascii_case(speaker_pubkey) && role.as_deref() == Some("bot")
+            });
+    if !has_bot_membership {
+        return Err("agent is not an active bot member of the Huddle".to_string());
+    }
+    let publisher = relay_api::connect_tts_audio_publisher(
+        &ephemeral_channel_id,
+        parent_channel_id.as_deref(),
+        state,
+        &keys,
+        record.auth_tag.as_deref(),
+        local_tts_publishers,
+    )
+    .await?;
+    pipeline.register_audio_publisher(speaker_pubkey, publisher);
+    Ok(true)
+}
diff --git a/desktop/src-tauri/src/huddle/agents.rs b/desktop/src-tauri/src/huddle/agents.rs
index 2b5b601de49..2bdf0544260 100644
--- a/desktop/src-tauri/src/huddle/agents.rs
+++ b/desktop/src-tauri/src/huddle/agents.rs
@@ -37,11 +37,11 @@ use super::{pipeline::start_auto_enabled_transcription, HuddlePhase};
 pub fn voice_mode_guidelines(parent_channel_id: &str) -> String {
     format!(
         "\
-You are in a live voice huddle attached to channel {parent_channel_id}.
-Only messages sent with `buzz messages send` to this huddle channel are spoken aloud, in the order sent; everything else you produce is silent.
-When a user addresses you, your FIRST tool call must send a brief spoken reply to this channel, before any file read, search, or other tool call. The usual rule against bare acknowledgments does not apply here; the pickup is the feedback that you heard them.
+You are in a live voice huddle. Its attached main channel is {parent_channel_id}; that is not the live huddle channel.
+The channel UUID in the current `[Context]` block is the live huddle channel. Only messages sent with `buzz messages send` to that current Context channel are spoken aloud, in the order sent; everything else you produce is silent.
+When a user addresses you, your FIRST tool call must send a brief spoken reply to the current Context channel, before any file read, search, or other tool call. The usual rule against bare acknowledgments does not apply here; the pickup is the feedback that you heard them.
 Then work, sending each useful sentence as its own message the moment it is ready—a few sentences per answer, not a monologue.
-Speak plainly without markdown; post code or long detail to the attached channel instead.
+Speak plainly without markdown; post code or long detail to the attached main channel instead.
 If you are not addressed, stay silent."
     )
 }
@@ -303,11 +303,13 @@ mod tests {
     fn voice_mode_guidelines_pin_spoken_reply_as_first_tool_call() {
         let guidelines = voice_mode_guidelines("parent-channel");
         assert_eq!(guidelines.lines().count(), 6);
-        assert!(guidelines.contains("Only messages sent with `buzz messages send`"));
+        assert!(guidelines.contains("Its attached main channel is parent-channel"));
+        assert!(guidelines.contains("that is not the live huddle channel"));
+        assert!(guidelines.contains("current `[Context]` block is the live huddle channel"));
+        assert!(guidelines.contains("buzz messages send` to that current Context channel"));
         assert!(guidelines.contains("your FIRST tool call must send a brief spoken reply"));
         assert!(guidelines.contains("before any file read, search, or other tool call"));
         assert!(guidelines.contains("rule against bare acknowledgments does not apply here"));
-        assert!(guidelines.contains("parent-channel"));
     }
 
     #[test]
diff --git a/desktop/src-tauri/src/huddle/audio_output.rs b/desktop/src-tauri/src/huddle/audio_output.rs
index 34dec53094b..383a7e8210a 100644
--- a/desktop/src-tauri/src/huddle/audio_output.rs
+++ b/desktop/src-tauri/src/huddle/audio_output.rs
@@ -97,3 +97,70 @@ pub(crate) fn open_output_sink_by_name(
 
     rodio::DeviceSinkBuilder::open_default_sink().map_err(|e| format!("audio output: {e}"))
 }
+
+fn device_type_is_isolated(device_type: rodio::cpal::DeviceType) -> bool {
+    use rodio::cpal::DeviceType;
+    matches!(
+        device_type,
+        DeviceType::Headphones
+            | DeviceType::Headset
+            | DeviceType::Earpiece
+            | DeviceType::HearingAid
+    )
+}
+
+/// Conservative route-isolation query using cpal's safe structured device
+/// description. This is intentionally re-evaluated at confirmed local onset,
+/// so a route change cannot leave a stale isolated capability behind.
+pub(crate) fn output_route_is_isolated(preferred: Option<&str>) -> bool {
+    use rodio::cpal::traits::HostTrait;
+    use rodio::DeviceTrait;
+
+    let host = rodio::cpal::default_host();
+    let device = match preferred.filter(|name| !name.is_empty()) {
+        Some(name) => {
+            let Ok(devices) = host.output_devices() else {
+                return false;
+            };
+            let mut matches = devices.filter(|device| {
+                device
+                    .description()
+                    .ok()
+                    .map(|description| description.name().to_owned())
+                    == Some(name.to_owned())
+            });
+            let Some(device) = matches.next() else {
+                return false;
+            };
+            if matches.next().is_some() {
+                return false;
+            }
+            device
+        }
+        None => match host.default_output_device() {
+            Some(device) => device,
+            None => return false,
+        },
+    };
+
+    device
+        .description()
+        .is_ok_and(|description| device_type_is_isolated(description.device_type()))
+}
+
+#[cfg(test)]
+mod route_isolation_tests {
+    use super::device_type_is_isolated;
+    use rodio::cpal::DeviceType;
+
+    #[test]
+    fn only_positive_isolated_terminal_types_are_accepted() {
+        assert!(device_type_is_isolated(DeviceType::Headphones));
+        assert!(device_type_is_isolated(DeviceType::Headset));
+        assert!(device_type_is_isolated(DeviceType::Earpiece));
+        assert!(device_type_is_isolated(DeviceType::HearingAid));
+        assert!(!device_type_is_isolated(DeviceType::Speaker));
+        assert!(!device_type_is_isolated(DeviceType::Virtual));
+        assert!(!device_type_is_isolated(DeviceType::Unknown));
+    }
+}
diff --git a/desktop/src-tauri/src/huddle/human_floor.rs b/desktop/src-tauri/src/huddle/human_floor.rs
new file mode 100644
index 00000000000..1643880c42c
--- /dev/null
+++ b/desktop/src-tauri/src/huddle/human_floor.rs
@@ -0,0 +1,73 @@
+//! Shared human-floor handle backed by the TTS playback coordinator.
+
+use std::sync::Arc;
+
+use super::tts_playback::{HumanFloorAuthorization, PlaybackCoordinator};
+
+#[derive(Clone)]
+pub(crate) struct HumanFloor {
+    playback: Arc<PlaybackCoordinator>,
+}
+
+impl std::fmt::Debug for HumanFloor {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter.debug_struct("HumanFloor").finish_non_exhaustive()
+    }
+}
+
+impl Default for HumanFloor {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl HumanFloor {
+    pub(crate) fn new() -> Self {
+        Self {
+            playback: Arc::new(PlaybackCoordinator::unbound()),
+        }
+    }
+
+    pub(super) fn playback(&self) -> Arc<PlaybackCoordinator> {
+        Arc::clone(&self.playback)
+    }
+
+    #[cfg(test)]
+    pub(crate) fn is_blocked(&self) -> bool {
+        self.playback.human_floor_blocked()
+    }
+
+    pub(crate) fn epoch(&self) -> u64 {
+        self.playback.human_floor_epoch()
+    }
+
+    pub(super) fn authorization(&self, epoch: u64) -> HumanFloorAuthorization {
+        self.playback.human_floor_authorization(epoch)
+    }
+
+    #[cfg(test)]
+    pub(crate) fn permits(&self, epoch: u64) -> bool {
+        self.authorization(epoch) == HumanFloorAuthorization::Permitted
+    }
+
+    pub(crate) fn enter_local(&self, route_isolated: bool, sustained_coupled_speech: bool) -> bool {
+        self.playback
+            .enter_local_human_floor(route_isolated, sustained_coupled_speech)
+    }
+
+    pub(crate) fn leave_local(&self) {
+        self.playback.leave_local_human_floor();
+    }
+
+    pub(crate) fn enter_remote(&self, peer: u8) {
+        self.playback.enter_remote_human_floor(peer);
+    }
+
+    pub(crate) fn leave_remote(&self, peer: u8) {
+        self.playback.leave_remote_human_floor(peer);
+    }
+
+    pub(crate) fn clear_remote(&self) {
+        self.playback.clear_remote_human_floor();
+    }
+}
diff --git a/desktop/src-tauri/src/huddle/latency_bench.rs b/desktop/src-tauri/src/huddle/latency_bench.rs
index 710854b5337..f928ddbce0f 100644
--- a/desktop/src-tauri/src/huddle/latency_bench.rs
+++ b/desktop/src-tauri/src/huddle/latency_bench.rs
@@ -141,6 +141,7 @@ fn baseline_stt_fake_llm_tts_first_audio() {
         tts_dir,
         Arc::clone(&tts_active),
         Arc::clone(&tts_cancel),
+        super::human_floor::HumanFloor::new(),
         "eve",
         None, // default output device
         None, // no Tauri app handle
@@ -152,7 +153,14 @@ fn baseline_stt_fake_llm_tts_first_audio() {
     );
 
     let t = Instant::now();
-    let (stt, mut text_rx) = SttPipeline::new(stt_dir, None, None).expect("stt pipeline");
+    let (stt, mut text_rx) = SttPipeline::new(
+        stt_dir,
+        None,
+        None,
+        super::human_floor::HumanFloor::new(),
+        None,
+    )
+    .expect("stt pipeline");
     // Recognizer loads inside the worker thread; give it time, then verify
     // liveness via a first throwaway feed below.
     std::thread::sleep(Duration::from_secs(2));
diff --git a/desktop/src-tauri/src/huddle/local_barge_in.rs b/desktop/src-tauri/src/huddle/local_barge_in.rs
new file mode 100644
index 00000000000..ac57c685ad6
--- /dev/null
+++ b/desktop/src-tauri/src/huddle/local_barge_in.rs
@@ -0,0 +1,151 @@
+//! Local VAD barge-in policy and coupled-output debounce.
+
+use super::human_floor::HumanFloor;
+
+/// Whether local audio should use VAD barge-in for this frame.
+///
+/// This currently matches STT's `vad_flush_allowed`, but the two decisions are
+/// kept separate deliberately: one assigns cancellation ownership and the
+/// other controls utterance endpointing.
+pub(super) fn enabled(ptt_mode: bool, manually_open: bool, ptt_held: bool) -> bool {
+    !ptt_mode || (manually_open && !ptt_held)
+}
+
+/// Consecutive 16 ms VAD-positive frames required to restore local barge-in
+/// on acoustically coupled output. The prior implementation shipped 20 frames
+/// after 5 frames caused speaker-bleed self-cancellation (`b29c8cdaa^`).
+const COUPLED_BARGE_IN_FRAMES: usize = 20;
+
+#[derive(Debug, Default)]
+pub(super) struct LocalBargeIn {
+    acquired_floor: bool,
+    coupled_positive_frames: usize,
+}
+
+impl LocalBargeIn {
+    pub(super) fn observe(
+        &mut self,
+        probability: f32,
+        confirmed_onset: bool,
+        human_floor: &HumanFloor,
+        output_device: Option<&str>,
+        onset_threshold: f32,
+    ) {
+        if self.acquired_floor {
+            return;
+        }
+        let sustained_coupled = self.track_sustained_coupled(probability, onset_threshold);
+        if !confirmed_onset && !sustained_coupled {
+            return;
+        }
+        let route_isolated = super::audio_output::output_route_is_isolated(output_device);
+        self.acquire(human_floor, route_isolated, sustained_coupled);
+    }
+
+    pub(super) fn acquire(
+        &mut self,
+        human_floor: &HumanFloor,
+        route_isolated: bool,
+        sustained_coupled: bool,
+    ) {
+        self.acquired_floor = human_floor.enter_local(route_isolated, sustained_coupled);
+    }
+
+    fn track_sustained_coupled(&mut self, probability: f32, onset_threshold: f32) -> bool {
+        if probability > onset_threshold {
+            self.coupled_positive_frames = self.coupled_positive_frames.saturating_add(1);
+        } else {
+            self.coupled_positive_frames = 0;
+        }
+        self.coupled_positive_frames >= COUPLED_BARGE_IN_FRAMES
+    }
+
+    pub(super) fn release(&mut self, human_floor: &HumanFloor) {
+        if self.acquired_floor {
+            human_floor.leave_local();
+        }
+        *self = Self::default();
+    }
+}
+
+#[derive(Debug)]
+pub(super) struct WorkerLocalBargeIn {
+    state: LocalBargeIn,
+    human_floor: HumanFloor,
+}
+
+impl WorkerLocalBargeIn {
+    pub(super) fn new(human_floor: HumanFloor) -> Self {
+        Self {
+            state: LocalBargeIn::default(),
+            human_floor,
+        }
+    }
+}
+
+impl std::ops::Deref for WorkerLocalBargeIn {
+    type Target = LocalBargeIn;
+
+    fn deref(&self) -> &Self::Target {
+        &self.state
+    }
+}
+
+impl std::ops::DerefMut for WorkerLocalBargeIn {
+    fn deref_mut(&mut self) -> &mut Self::Target {
+        &mut self.state
+    }
+}
+
+impl Drop for WorkerLocalBargeIn {
+    fn drop(&mut self) {
+        self.state.release(&self.human_floor);
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn manual_open_mic_enables_vad_barge_in_in_ptt_mode() {
+        assert!(enabled(true, true, false));
+        assert!(!enabled(true, false, false));
+        assert!(!enabled(true, true, true));
+        assert!(enabled(false, false, false));
+    }
+
+    #[test]
+    fn manual_open_ptt_sustained_speech_acquires_coupled_floor() {
+        assert!(enabled(true, true, false));
+        let human_floor = HumanFloor::new();
+        let mut barge_in = LocalBargeIn::default();
+        for _ in 0..COUPLED_BARGE_IN_FRAMES {
+            let sustained = barge_in.track_sustained_coupled(0.9, 0.5);
+            if sustained {
+                barge_in.acquire(&human_floor, false, true);
+            }
+        }
+        assert!(barge_in.acquired_floor);
+        assert!(human_floor.is_blocked());
+    }
+
+    #[test]
+    fn coupled_barge_in_requires_twenty_consecutive_positive_frames() {
+        let mut barge_in = LocalBargeIn::default();
+        for _ in 0..COUPLED_BARGE_IN_FRAMES - 1 {
+            assert!(!barge_in.track_sustained_coupled(0.9, 0.5));
+        }
+        assert!(barge_in.track_sustained_coupled(0.9, 0.5));
+    }
+
+    #[test]
+    fn coupled_barge_in_debounce_resets_on_a_non_speech_frame() {
+        let mut barge_in = LocalBargeIn::default();
+        for _ in 0..COUPLED_BARGE_IN_FRAMES - 1 {
+            assert!(!barge_in.track_sustained_coupled(0.9, 0.5));
+        }
+        assert!(!barge_in.track_sustained_coupled(0.1, 0.5));
+        assert!(!barge_in.track_sustained_coupled(0.9, 0.5));
+    }
+}
diff --git a/desktop/src-tauri/src/huddle/mod.rs b/desktop/src-tauri/src/huddle/mod.rs
index 1feb2073b09..e219b2f75fa 100644
--- a/desktop/src-tauri/src/huddle/mod.rs
+++ b/desktop/src-tauri/src/huddle/mod.rs
@@ -23,14 +23,17 @@
 //!    takes `stt_pipeline`/`tts_pipeline` out of the lock, then calls `shutdown()`
 //!    and drops them outside the lock (thread joins can block ~200ms).
 
+mod agent_tts_publisher;
 mod agent_tts_routing;
 pub mod agent_voice;
 pub mod agents;
 pub mod audio_output;
 mod commands;
+mod human_floor;
 pub mod jitter;
 #[cfg(test)]
 mod latency_bench;
+mod local_barge_in;
 pub mod models;
 pub mod pipeline;
 pub mod playout;
@@ -42,6 +45,8 @@ pub mod state;
 pub mod stt;
 pub mod transcription;
 pub mod tts;
+#[path = "tts_playback.rs"]
+mod tts_playback;
 pub mod tts_settings;
 mod tts_voice_import;
 mod tts_voice_registry;
@@ -81,7 +86,7 @@ pub use window::{close_huddle_companion, open_huddle_window};
 
 // ── Imports ───────────────────────────────────────────────────────────────────
 
-use std::sync::atomic::Ordering;
+use std::sync::{atomic::Ordering, Arc};
 use tauri::State;
 use uuid::Uuid;
 
@@ -489,7 +494,7 @@ fn teardown_huddle(state: &AppState) -> Result<(), String> {
         // Increment generation first — this immediately invalidates any
         // in-flight transcription task, even before pipelines shut down.
         hs.session_generation.fetch_add(1, Ordering::Release);
-        let stt = hs.stt_pipeline.take();
+        let stt = hs.take_stt_pipeline();
         let tts = hs.tts_pipeline.take();
         let cancel = hs.audio_ws_cancel.take();
         // Cancel the relay token BEFORE dropping the sender. If we drop
@@ -873,7 +878,7 @@ pub async fn speak_agent_message(
         })?;
     }
 
-    let sender = {
+    let pipeline = {
         let hs = state.huddle()?;
         let agent_is_present = hs
             .agent_pubkeys
@@ -887,20 +892,27 @@ pub async fn speak_agent_message(
             );
             return Ok(());
         }
-        hs.tts_pipeline
-            .as_ref()
-            .map(|pipeline| pipeline.text_sender())
-            .map(|sender| {
-                let speaker_generation = sender.speaker_generation(&speaker_pubkey);
-                (sender, speaker_generation)
-            })
+        hs.tts_pipeline.as_ref().map(Arc::clone)
     };
-    let Some((sender, speaker_generation)) = sender else {
+    let Some(pipeline) = pipeline else {
         eprintln!(
             "buzz-desktop: tts stage=invoke status=failed reason=unavailable route_id={route_id}"
         );
         return Err("Agent text to speech is enabled but its audio pipeline is unavailable".into());
     };
+    match agent_tts_publisher::ensure(&app, &state, &pipeline, &speaker_pubkey).await {
+        Ok(true) => eprintln!(
+            "buzz-desktop: tts broadcast status=ready route_id={route_id}"
+        ),
+        Ok(false) => eprintln!(
+            "buzz-desktop: tts broadcast status=unavailable reason=agent_identity_not_local route_id={route_id}"
+        ),
+        Err(error) => eprintln!(
+            "buzz-desktop: tts broadcast status=unavailable reason=publisher_setup_failed route_id={route_id} error={error}"
+        ),
+    }
+    let sender = pipeline.text_sender();
+    let speaker_generation = sender.speaker_generation(&speaker_pubkey);
     enqueue_agent_tts_text(route_id, text, move |route_id, text| {
         sender
             .send(
diff --git a/desktop/src-tauri/src/huddle/pipeline.rs b/desktop/src-tauri/src/huddle/pipeline.rs
index afa7aed8e05..47d4aeb43d1 100644
--- a/desktop/src-tauri/src/huddle/pipeline.rs
+++ b/desktop/src-tauri/src/huddle/pipeline.rs
@@ -55,7 +55,7 @@ pub async fn check_pipeline_hotstart(state: State<'_, AppState>) -> Result<(), S
         let mut hs = state.huddle()?;
         if let Some(ref p) = hs.stt_pipeline {
             if p.is_finished() {
-                hs.stt_pipeline = None;
+                hs.take_stt_pipeline();
             }
         }
         if let Some(ref p) = hs.tts_pipeline {
@@ -311,6 +311,8 @@ pub(crate) async fn maybe_start_stt_pipeline(
         stt_starting,
         ptt_active_for_stt,
         manual_mic_unmuted_for_stt,
+        human_floor,
+        output_device,
         old_stt,
     ) = {
         let mut hs = state.huddle()?;
@@ -325,7 +327,7 @@ pub(crate) async fn maybe_start_stt_pipeline(
         if hs.stt_pipeline.is_some() {
             hs.session_generation.fetch_add(1, Ordering::Release);
         }
-        let old = hs.stt_pipeline.take();
+        let old = hs.take_stt_pipeline();
         if let Some(ref p) = old {
             p.shutdown();
         }
@@ -346,6 +348,13 @@ pub(crate) async fn maybe_start_stt_pipeline(
             stt_starting,
             ptt,
             manual_mic_unmuted,
+            hs.human_floor.clone(),
+            state
+                .huddle_audio
+                .output_device
+                .lock()
+                .unwrap_or_else(|e| e.into_inner())
+                .clone(),
             old,
         )
     };
@@ -353,7 +362,13 @@ pub(crate) async fn maybe_start_stt_pipeline(
     drop(old_stt);
 
     let constructed = tokio::task::spawn_blocking(move || {
-        stt::SttPipeline::new(model_dir, ptt_active_for_stt, manual_mic_unmuted_for_stt)
+        stt::SttPipeline::new(
+            model_dir,
+            ptt_active_for_stt,
+            manual_mic_unmuted_for_stt,
+            human_floor,
+            output_device,
+        )
     })
     .await;
     let (pipeline, text_rx) = match constructed {
@@ -382,7 +397,7 @@ pub(crate) async fn maybe_start_stt_pipeline(
         {
             return Ok(false);
         }
-        hs.stt_pipeline = Some(Arc::clone(&pipeline));
+        hs.set_stt_pipeline(Arc::clone(&pipeline));
     }
 
     spawn_transcription_task(text_rx, channel_uuid, agent_pubkeys_arc, session_gen, state);
@@ -457,7 +472,7 @@ pub(crate) async fn maybe_start_tts_pipeline(state: &AppState) -> Result<bool, S
     // Atomically check preconditions and claim the construction slot.
     // The sentinel prevents a second caller from starting construction
     // while we're building outside the lock.
-    let (tts_active, tts_cancel, tts_starting) = {
+    let (tts_active, tts_cancel, human_floor, tts_starting) = {
         let hs = state.huddle()?;
         if hs.tts_pipeline.is_some() {
             return Ok(false);
@@ -471,6 +486,7 @@ pub(crate) async fn maybe_start_tts_pipeline(state: &AppState) -> Result<bool, S
         (
             Arc::clone(&hs.tts_active),
             Arc::clone(&hs.tts_cancel),
+            hs.human_floor.clone(),
             Arc::clone(&hs.tts_starting),
         )
     };
@@ -484,6 +500,7 @@ pub(crate) async fn maybe_start_tts_pipeline(state: &AppState) -> Result<bool, S
             model_dir,
             tts_active,
             tts_cancel,
+            human_floor,
             &initial_voice,
             output_device,
             app,
diff --git a/desktop/src-tauri/src/huddle/playout.rs b/desktop/src-tauri/src/huddle/playout.rs
index 346b425aec0..4371d8a1313 100644
--- a/desktop/src-tauri/src/huddle/playout.rs
+++ b/desktop/src-tauri/src/huddle/playout.rs
@@ -30,6 +30,7 @@ use futures_util::{SinkExt, StreamExt};
 use tokio_tungstenite::tungstenite::Message as WsMsg;
 use tokio_util::sync::CancellationToken;
 
+use super::human_floor::HumanFloor;
 use super::jitter::{PeerJitterBuffer, SAMPLE_RATE_HZ};
 use super::relay_api::{WsStream, REMOTE_SPEECH_THRESHOLD};
 use super::wire::{FrameHeader, FLAG_DTX, V2_HEADER_LEN};
@@ -42,6 +43,7 @@ const SPEAKER_TICK_MS: u64 = 500;
 const SPEAKER_LEVEL_TICK_MS: u64 = 50;
 /// Per-peer arrival window for the TTS interrupt frame counter.
 const FRAME_WINDOW: std::time::Duration = std::time::Duration::from_millis(500);
+const REMOTE_RELEASE_DEBOUNCE: std::time::Duration = std::time::Duration::from_millis(500);
 /// Playout clock: NetEq emits 10 ms frames, so we tick at 10 ms.
 const PLAYOUT_TICK_MS: u64 = 10;
 
@@ -84,6 +86,39 @@ fn normalized_speaker_level(level_dbov: i8) -> f32 {
     ((f32::from(level_dbov) + 60.0) / 48.0).clamp(0.0, 1.0)
 }
 
+fn update_remote_release_deadline(
+    peer: u8,
+    is_dtx: bool,
+    remote_floor_owners: &std::collections::HashSet<u8>,
+    deadlines: &mut std::collections::HashMap<u8, tokio::time::Instant>,
+    now: tokio::time::Instant,
+) {
+    if !is_dtx {
+        deadlines.remove(&peer);
+    } else if remote_floor_owners.contains(&peer) {
+        deadlines
+            .entry(peer)
+            .or_insert(now + REMOTE_RELEASE_DEBOUNCE);
+    }
+}
+
+fn release_expired_remote_floors(
+    now: tokio::time::Instant,
+    owners: &mut std::collections::HashSet<u8>,
+    deadlines: &mut std::collections::HashMap<u8, tokio::time::Instant>,
+    human_floor: &HumanFloor,
+) {
+    let released: Vec<u8> = deadlines
+        .iter()
+        .filter_map(|(peer, deadline)| (*deadline <= now).then_some(*peer))
+        .collect();
+    for peer in released {
+        deadlines.remove(&peer);
+        owners.remove(&peer);
+        human_floor.leave_remote(peer);
+    }
+}
+
 fn should_recover_playout(depth: usize, currently_recovering: bool) -> bool {
     if currently_recovering {
         depth > PLAYOUT_QUEUE_RECOVERY_END
@@ -92,11 +127,77 @@ fn should_recover_playout(depth: usize, currently_recovering: bool) -> bool {
     }
 }
 
+fn is_locally_synthesized_peer(
+    peer_idx: u8,
+    local_tts_publishers: &super::tts::LocalTtsPublishers,
+) -> bool {
+    local_tts_publishers
+        .lock()
+        .unwrap_or_else(|error| error.into_inner())
+        .contains_key(&peer_idx)
+}
+
+fn is_agent_peer(
+    peer_idx: u8,
+    index_to_pubkey: &std::collections::HashMap<u8, String>,
+    agent_pubkeys: &[String],
+) -> bool {
+    index_to_pubkey.get(&peer_idx).is_some_and(|pubkey| {
+        agent_pubkeys
+            .iter()
+            .any(|agent| agent.eq_ignore_ascii_case(pubkey))
+    })
+}
+
+/// Whether `peer_idx` is currently occupied at exactly `epoch`, per the
+/// authoritative roster. A frame is deliverable only when both match: an index
+/// absent from the roster is stale, and a slot reused by a later occupant has
+/// advanced its epoch, so a departed occupant's in-flight frame is fenced
+/// rather than mis-attributed to the new occupant. A legacy relay omits the
+/// epoch, which degrades to `0` on both sides, making the fence a no-op.
+fn is_current_occupant(
+    peer_idx: u8,
+    epoch: u8,
+    index_to_epoch: &std::collections::HashMap<u8, u8>,
+) -> bool {
+    index_to_epoch.get(&peer_idx) == Some(&epoch)
+}
+
+fn same_occupancy(
+    peer_idx: u8,
+    pubkey: &str,
+    epoch: u8,
+    index_to_pubkey: &std::collections::HashMap<u8, String>,
+    index_to_epoch: &std::collections::HashMap<u8, u8>,
+) -> bool {
+    index_to_pubkey
+        .get(&peer_idx)
+        .is_some_and(|current| current == pubkey)
+        && index_to_epoch.get(&peer_idx) == Some(&epoch)
+}
+
+fn mix_remote_stt_samples(mix: &mut Vec<f32>, samples: &[f32]) {
+    if mix.len() < samples.len() {
+        mix.resize(samples.len(), 0.0);
+    }
+    for (mixed, sample) in mix.iter_mut().zip(samples) {
+        *mixed = (*mixed + *sample).clamp(-1.0, 1.0);
+    }
+}
+
+fn f32_samples_to_le_bytes(samples: &[f32]) -> Vec<u8> {
+    let mut bytes = Vec::with_capacity(std::mem::size_of_val(samples));
+    for sample in samples {
+        bytes.extend_from_slice(&sample.to_le_bytes());
+    }
+    bytes
+}
+
 /// One remote peer's slot: jitter buffer + dedicated rodio Player.
 ///
 /// Per-frame seq/timestamp come from the v2 wire header (sender-authored).
-/// The relay forwards `peer_index | header | opus_bytes` opaquely; we parse
-/// the header here and pass the sender's own monotonic seq + 48 kHz media
+/// The relay forwards `peer_index | epoch | header | opus_bytes` opaquely; we
+/// parse the header here and pass the sender's own monotonic seq + 48 kHz media
 /// timestamp into NetEq.
 struct PeerSlot {
     jitter: PeerJitterBuffer,
@@ -168,9 +269,13 @@ pub(crate) async fn run_playout_recv_loop(
     sink_handle: rodio::MixerDeviceSink,
     cancel: CancellationToken,
     app_handle: Option<tauri::AppHandle>,
-    initial_peers: Vec<(u8, String)>,
+    initial_peers: Vec<(u8, String, u8)>,
     tts_active: Arc<AtomicBool>,
     tts_cancel: Arc<AtomicBool>,
+    local_tts_publishers: super::tts::LocalTtsPublishers,
+    remote_stt_pipeline: Arc<std::sync::Mutex<Option<std::sync::Weak<super::stt::SttPipeline>>>>,
+    agent_pubkeys: Arc<std::sync::Mutex<Vec<String>>>,
+    human_floor: HumanFloor,
 ) {
     use rodio::buffer::SamplesBuffer;
     use std::num::NonZero;
@@ -180,12 +285,23 @@ pub(crate) async fn run_playout_recv_loop(
     let rate = NonZero::new(SAMPLE_RATE_HZ).expect("48k is non-zero");
 
     let mut index_to_pubkey: std::collections::HashMap<u8, String> =
-        initial_peers.into_iter().collect();
+        std::collections::HashMap::new();
+    // Occupancy epoch per index, mirroring the authoritative roster. Advances
+    // each time a slot is reused by a new occupant, so a frame authored by a
+    // departed occupant that arrives after its index is reassigned carries the
+    // old epoch and is fenced rather than mis-attributed to the new occupant.
+    let mut index_to_epoch: std::collections::HashMap<u8, u8> = std::collections::HashMap::new();
+    for (idx, pubkey, epoch) in initial_peers {
+        index_to_pubkey.insert(idx, pubkey);
+        index_to_epoch.insert(idx, epoch);
+    }
     let mut active_indices: std::collections::HashSet<u8> = std::collections::HashSet::new();
     let mut speaker_levels: std::collections::HashMap<u8, f32> = std::collections::HashMap::new();
+    let mut remote_release_deadlines: std::collections::HashMap<u8, tokio::time::Instant> =
+        std::collections::HashMap::new();
+    let mut remote_floor_owners: std::collections::HashSet<u8> = std::collections::HashSet::new();
     let mut frame_counts: std::collections::HashMap<u8, u16> = std::collections::HashMap::new();
     let mut last_frame_reset = tokio::time::Instant::now();
-    let mut tts_was_active = false;
 
     let mut speaker_tick = tokio::time::interval(std::time::Duration::from_millis(SPEAKER_TICK_MS));
     speaker_tick.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Skip);
@@ -215,6 +331,7 @@ pub(crate) async fn run_playout_recv_loop(
                 // per idle peer into rodio forever. `is_active` is a 500 ms
                 // grace past the last received packet, far longer than typical
                 // DTX comfort-noise cadence.
+                let mut remote_stt_mix = Vec::new();
                 for (peer_idx, slot) in peers.iter_mut() {
                     if !slot.is_active() {
                         // Still drain the frame to keep NetEq's internal clock
@@ -236,6 +353,17 @@ pub(crate) async fn run_playout_recv_loop(
                                 );
                                 slot.player.skip_one();
                             }
+                            if !is_locally_synthesized_peer(*peer_idx, &local_tts_publishers) {
+                                let remote_agent = {
+                                    let agents = agent_pubkeys
+                                        .lock()
+                                        .unwrap_or_else(|error| error.into_inner());
+                                    is_agent_peer(*peer_idx, &index_to_pubkey, &agents)
+                                };
+                                if !remote_agent {
+                                    mix_remote_stt_samples(&mut remote_stt_mix, &samples);
+                                }
+                            }
                             slot.player.append(SamplesBuffer::new(channels, rate, samples));
                         }
                         Err(e) => {
@@ -245,8 +373,26 @@ pub(crate) async fn run_playout_recv_loop(
                         }
                     }
                 }
+                if !remote_stt_mix.is_empty() {
+                    let pipeline = remote_stt_pipeline
+                        .lock()
+                        .unwrap_or_else(|error| error.into_inner())
+                        .as_ref()
+                        .and_then(std::sync::Weak::upgrade);
+                    if let Some(pipeline) = pipeline {
+                        let _ = pipeline.push_remote_audio(f32_samples_to_le_bytes(
+                            &remote_stt_mix,
+                        ));
+                    }
+                }
             }
             _ = speaker_tick.tick() => {
+                release_expired_remote_floors(
+                    tokio::time::Instant::now(),
+                    &mut remote_floor_owners,
+                    &mut remote_release_deadlines,
+                    &human_floor,
+                );
                 if let Some(ref app) = app_handle {
                     use tauri::Emitter;
                     let pubkeys: Vec<String> = active_indices
@@ -276,13 +422,31 @@ pub(crate) async fn run_playout_recv_loop(
             msg = ws_rx.next() => {
                 match msg {
                     Some(Ok(WsMsg::Binary(data))) => {
-                        // Wire shape (v2): [peer_index: u8][header: 8 bytes][opus payload...]
-                        // The minimum size is 1 (peer_index) + 8 (header) + ≥1 Opus byte.
-                        if data.len() <= 1 + V2_HEADER_LEN {
+                        // Wire shape (v2): [peer_index: u8][epoch: u8][header: 8 bytes][opus payload...]
+                        // The minimum size is 2 (peer_index + epoch) + 8 (header) + ≥1 Opus byte.
+                        if data.len() <= 2 + V2_HEADER_LEN {
                             continue;
                         }
                         let peer_idx = data[0];
-                        let after_idx = &data[1..];
+                        let epoch = data[1];
+                        // Fence the peer-index reuse race: a frame authored by a
+                        // departed occupant that arrives after its index is
+                        // reassigned carries the old epoch. Drop it rather than
+                        // mis-attribute stale audio (and the new occupant's
+                        // human/agent STT policy) to whoever grabbed the index.
+                        // An index absent from the roster is also stale. A slot
+                        // with no known epoch (legacy relay) degrades to 0 on
+                        // both sides, so the fence is a no-op there.
+                        if !is_current_occupant(peer_idx, epoch, &index_to_epoch) {
+                            continue;
+                        }
+                        // Suppress only an agent stream synthesized and
+                        // published by this desktop. Other bot-role peers may
+                        // publish their own legitimate audio and must play.
+                        if is_locally_synthesized_peer(peer_idx, &local_tts_publishers) {
+                            continue;
+                        }
+                        let after_idx = &data[2..];
                         let Some((header, opus_bytes)) = FrameHeader::parse(after_idx)
                         else {
                             // Malformed v2 frame: header parse only fails when
@@ -303,6 +467,13 @@ pub(crate) async fn run_playout_recv_loop(
                         // by an idle peer to keep the codec alive — they
                         // don't mean the peer is speaking, and shouldn't
                         // make their tile flash for the 500 ms speaker tick.
+                        update_remote_release_deadline(
+                            peer_idx,
+                            is_dtx,
+                            &remote_floor_owners,
+                            &mut remote_release_deadlines,
+                            tokio::time::Instant::now(),
+                        );
                         if !is_dtx {
                             active_indices.insert(peer_idx);
                             let level = normalized_speaker_level(header.level_dbov);
@@ -312,14 +483,9 @@ pub(crate) async fn run_playout_recv_loop(
                                 .or_insert(level);
                         }
 
-                        // TTS interrupt frame counter — reset on TTS rising edge.
-                        let tts_now = tts_active.load(Ordering::Acquire);
-                        if tts_now && !tts_was_active {
-                            frame_counts.clear();
-                            last_frame_reset = tokio::time::Instant::now();
-                        }
-                        tts_was_active = tts_now;
-
+                        // Track remote speech independently of TTS liveness so a
+                        // human who starts while output is idle still owns the
+                        // floor and rejects delayed synthesis.
                         let slot = match peers.entry(peer_idx) {
                             std::collections::hash_map::Entry::Occupied(e) => e.into_mut(),
                             std::collections::hash_map::Entry::Vacant(e) => {
@@ -347,11 +513,16 @@ pub(crate) async fn run_playout_recv_loop(
                             slot.last_packet_at = tokio::time::Instant::now();
                         }
 
-                        // Count remote-speech frame arrivals for the TTS
-                        // interrupt. DTX/comfort frames don't count — they
-                        // mean the peer is silent, just keeping the codec
-                        // state alive.
-                        if tts_now && !is_dtx {
+                        let remote_human = {
+                            let agents = agent_pubkeys
+                                .lock()
+                                .unwrap_or_else(|error| error.into_inner());
+                            !is_agent_peer(peer_idx, &index_to_pubkey, &agents)
+                        };
+                        // Count only remote-human speech toward floor onset.
+                        // Agent audio still plays, but it must not acquire the
+                        // human floor or suppress another agent's response.
+                        if !is_dtx && remote_human {
                             if last_frame_reset.elapsed() >= FRAME_WINDOW {
                                 frame_counts.clear();
                                 last_frame_reset = tokio::time::Instant::now();
@@ -359,7 +530,11 @@ pub(crate) async fn run_playout_recv_loop(
                             let count = frame_counts.entry(peer_idx).or_insert(0);
                             *count = count.saturating_add(1);
                             if *count >= REMOTE_SPEECH_THRESHOLD {
-                                tts_cancel.store(true, Ordering::Release);
+                                human_floor.enter_remote(peer_idx);
+                                remote_floor_owners.insert(peer_idx);
+                                if tts_active.load(Ordering::Acquire) {
+                                    tts_cancel.store(true, Ordering::Release);
+                                }
                             }
                         }
                     }
@@ -374,20 +549,30 @@ pub(crate) async fn run_playout_recv_loop(
                                                 p["peer_index"].as_u64(),
                                             ) {
                                                 let key = idx as u8;
-                                                // peer_index reuse with a new pubkey:
+                                                // Absent `epoch` (legacy relay) degrades to
+                                                // 0 so the fence stays a no-op.
+                                                let epoch =
+                                                    p["epoch"].as_u64().unwrap_or(0) as u8;
+                                                // Any new occupancy (pubkey or epoch) must
                                                 // flush the old peer's NetEq + Player so
                                                 // the next frame starts clean.
-                                                if index_to_pubkey
-                                                    .get(&key)
-                                                    .map(|s| s.as_str())
-                                                    != Some(pk)
-                                                {
+                                                if !same_occupancy(
+                                                    key,
+                                                    pk,
+                                                    epoch,
+                                                    &index_to_pubkey,
+                                                    &index_to_epoch,
+                                                ) {
                                                     peers.remove(&key);
                                                     frame_counts.remove(&key);
+                                                    remote_release_deadlines.remove(&key);
+                                                    remote_floor_owners.remove(&key);
+                                                    human_floor.leave_remote(key);
                                                     active_indices.remove(&key);
                                                     speaker_levels.remove(&key);
                                                 }
                                                 index_to_pubkey.insert(key, pk.to_string());
+                                                index_to_epoch.insert(key, epoch);
                                             }
                                         }
                                     }
@@ -395,29 +580,60 @@ pub(crate) async fn run_playout_recv_loop(
                                 Some("roster") => {
                                     if let Some(peer_list) = v["peers"].as_array() {
                                         let mut replacement = std::collections::HashMap::new();
+                                        let mut replacement_epochs =
+                                            std::collections::HashMap::new();
                                         for p in peer_list {
                                             if let (Some(pk), Some(idx)) = (
                                                 p["pubkey"].as_str(),
                                                 p["peer_index"].as_u64(),
                                             ) {
-                                                replacement.insert(idx as u8, pk.to_string());
+                                                let key = idx as u8;
+                                                let epoch =
+                                                    p["epoch"].as_u64().unwrap_or(0) as u8;
+                                                replacement.insert(key, pk.to_string());
+                                                replacement_epochs.insert(key, epoch);
                                             }
                                         }
                                         let identity_unchanged = |idx: &u8| {
-                                            replacement.get(idx) == index_to_pubkey.get(idx)
+                                            replacement.get(idx).is_some_and(|pubkey| {
+                                                replacement_epochs.get(idx).is_some_and(|epoch| {
+                                                    same_occupancy(
+                                                        *idx,
+                                                        pubkey,
+                                                        *epoch,
+                                                        &index_to_pubkey,
+                                                        &index_to_epoch,
+                                                    )
+                                                })
+                                            })
                                         };
                                         peers.retain(|idx, _| identity_unchanged(idx));
+                                        for idx in index_to_pubkey
+                                            .keys()
+                                            .filter(|idx| !identity_unchanged(idx))
+                                            .copied()
+                                            .collect::<Vec<_>>()
+                                        {
+                                            human_floor.leave_remote(idx);
+                                            remote_release_deadlines.remove(&idx);
+                                            remote_floor_owners.remove(&idx);
+                                        }
                                         frame_counts.retain(|idx, _| identity_unchanged(idx));
                                         active_indices.retain(identity_unchanged);
                                         speaker_levels.retain(|idx, _| identity_unchanged(idx));
                                         index_to_pubkey = replacement;
+                                        index_to_epoch = replacement_epochs;
                                     }
                                 }
                                 Some("left") => {
                                     if let Some(idx) = v["peer_index"].as_u64() {
                                         let key = idx as u8;
                                         index_to_pubkey.remove(&key);
+                                        index_to_epoch.remove(&key);
                                         frame_counts.remove(&key);
+                                        remote_release_deadlines.remove(&key);
+                                        remote_floor_owners.remove(&key);
+                                        human_floor.leave_remote(key);
                                         active_indices.remove(&key);
                                         speaker_levels.remove(&key);
                                         // Dropping Player detaches its queue from the
@@ -441,6 +657,7 @@ pub(crate) async fn run_playout_recv_loop(
         }
     }
 
+    human_floor.clear_remote();
     if let Some(ref app) = app_handle {
         use tauri::Emitter;
         let _ = app.emit(
@@ -454,6 +671,50 @@ pub(crate) async fn run_playout_recv_loop(
 mod tests {
     use super::*;
 
+    #[test]
+    fn continuous_dtx_does_not_extend_remote_floor_deadline() {
+        let peer = 7;
+        let started = tokio::time::Instant::now();
+        let owners = std::collections::HashSet::from([peer]);
+        let mut deadlines = std::collections::HashMap::new();
+
+        update_remote_release_deadline(peer, true, &owners, &mut deadlines, started);
+        let armed = deadlines[&peer];
+        for elapsed_ms in [100, 200, 300, 400] {
+            update_remote_release_deadline(
+                peer,
+                true,
+                &owners,
+                &mut deadlines,
+                started + std::time::Duration::from_millis(elapsed_ms),
+            );
+        }
+
+        assert_eq!(deadlines[&peer], armed);
+        assert!(armed <= started + REMOTE_RELEASE_DEBOUNCE);
+
+        let human_floor = HumanFloor::new();
+        human_floor.enter_remote(peer);
+        let mut owners = owners;
+        release_expired_remote_floors(armed, &mut owners, &mut deadlines, &human_floor);
+        assert!(!human_floor.is_blocked());
+        assert!(owners.is_empty());
+        assert!(deadlines.is_empty());
+    }
+
+    #[test]
+    fn dtx_from_non_owner_does_not_arm_remote_floor_deadline() {
+        let mut deadlines = std::collections::HashMap::new();
+        update_remote_release_deadline(
+            7,
+            true,
+            &std::collections::HashSet::new(),
+            &mut deadlines,
+            tokio::time::Instant::now(),
+        );
+        assert!(deadlines.is_empty());
+    }
+
     #[test]
     fn speaker_level_maps_conversational_range() {
         assert_eq!(normalized_speaker_level(-127), 0.0);
@@ -470,4 +731,87 @@ mod tests {
         assert!(should_recover_playout(5, true));
         assert!(!should_recover_playout(4, true));
     }
+
+    #[test]
+    fn only_the_local_socket_is_suppressed_for_a_shared_agent_identity() {
+        let local_publishers = super::super::tts::LocalTtsPublishers::default();
+        local_publishers
+            .lock()
+            .expect("local publishers")
+            .insert(3, 1);
+
+        assert!(is_locally_synthesized_peer(3, &local_publishers));
+        assert!(
+            !is_locally_synthesized_peer(4, &local_publishers),
+            "a second socket for the same agent remains audible"
+        );
+        assert!(!is_locally_synthesized_peer(9, &local_publishers));
+    }
+
+    #[test]
+    fn remote_agent_identity_is_excluded_from_human_stt() {
+        let peers =
+            std::collections::HashMap::from([(3, "human".to_owned()), (4, "AGENT".to_owned())]);
+        let agents = vec!["agent".to_owned()];
+
+        assert!(!is_agent_peer(3, &peers, &agents));
+        assert!(is_agent_peer(4, &peers, &agents));
+        assert!(!is_agent_peer(9, &peers, &agents));
+    }
+
+    #[test]
+    fn occupancy_identity_includes_epoch_for_same_pubkey_rejoin() {
+        let pubkeys = std::collections::HashMap::from([(3_u8, "alice".to_owned())]);
+        let epochs = std::collections::HashMap::from([(3_u8, 4_u8)]);
+
+        assert!(same_occupancy(3, "alice", 4, &pubkeys, &epochs));
+        assert!(
+            !same_occupancy(3, "alice", 5, &pubkeys, &epochs),
+            "same pubkey with a new epoch must reset decoder and playout state"
+        );
+    }
+
+    /// Causal regression for the peer-index reuse race (Jude's blocking
+    /// finding): a frame authored by a departed occupant that arrives after
+    /// its slot is reassigned to a new occupant carries the stale epoch and
+    /// must be fenced, never mis-attributed to the new occupant.
+    #[test]
+    fn stale_epoch_frame_is_fenced_after_its_index_is_reused() {
+        let mut index_to_epoch = std::collections::HashMap::new();
+        // Slot 3 first occupied at epoch 0.
+        index_to_epoch.insert(3_u8, 0_u8);
+        assert!(
+            is_current_occupant(3, 0, &index_to_epoch),
+            "current occupant's frame is delivered"
+        );
+
+        // The occupant departs and a new peer reuses slot 3 at epoch 1.
+        index_to_epoch.insert(3, 1);
+        assert!(
+            !is_current_occupant(3, 0, &index_to_epoch),
+            "in-flight frame from the departed occupant (epoch 0) is fenced"
+        );
+        assert!(
+            is_current_occupant(3, 1, &index_to_epoch),
+            "the new occupant's frame (epoch 1) is delivered"
+        );
+
+        // A frame for an index absent from the roster is stale.
+        assert!(
+            !is_current_occupant(9, 0, &index_to_epoch),
+            "frame for an unoccupied index is dropped"
+        );
+    }
+
+    #[test]
+    fn remote_human_stt_mix_sums_and_clamps_concurrent_speakers() {
+        let mut mix = Vec::new();
+        mix_remote_stt_samples(&mut mix, &[0.4, -0.7, 0.2]);
+        mix_remote_stt_samples(&mut mix, &[0.8, -0.6, -0.1]);
+
+        assert_eq!(mix, vec![1.0, -1.0, 0.1]);
+        let bytes = f32_samples_to_le_bytes(&mix);
+        assert_eq!(bytes.len(), std::mem::size_of_val(mix.as_slice()));
+        assert_eq!(f32::from_le_bytes(bytes[0..4].try_into().unwrap()), 1.0);
+    }
 }
diff --git a/desktop/src-tauri/src/huddle/relay_api.rs b/desktop/src-tauri/src/huddle/relay_api.rs
index 3f2aa76a560..20a2be57652 100644
--- a/desktop/src-tauri/src/huddle/relay_api.rs
+++ b/desktop/src-tauri/src/huddle/relay_api.rs
@@ -41,30 +41,44 @@ pub(crate) fn parse_channel_uuid(channel_id: &str) -> Result<Uuid, String> {
 /// Handshake timeout — matches the server's AUTH_TIMEOUT (5 s).
 const HANDSHAKE_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(5);
 
-/// Connect to the relay's audio WebSocket and run the Opus encode/decode pipeline.
-///
-/// Returns `(cancel_token, pcm_sender)` — caller stores both in `HuddleState`.
-/// Dropping the sender or calling `cancel.cancel()` shuts down the relay task.
-pub(crate) async fn connect_audio_relay(
+fn build_audio_auth_event(
+    keys: &nostr::Keys,
+    relay_url: &str,
+    challenge: &str,
+    auth_tag_json: Option<&str>,
+) -> Result<nostr::Event, String> {
+    let mut tags = vec![
+        nostr::Tag::parse(["relay", relay_url]).map_err(|e| format!("tag relay: {e}"))?,
+        nostr::Tag::parse(["challenge", challenge]).map_err(|e| format!("tag challenge: {e}"))?,
+    ];
+    if let Some(auth_tag_json) = auth_tag_json {
+        let compat_pubkey = nostr::PublicKey::from_hex(&keys.public_key().to_hex())
+            .map_err(|e| format!("agent pubkey conversion failed: {e}"))?;
+        buzz_sdk_pkg::nip_oa::verify_auth_tag(auth_tag_json, &compat_pubkey)
+            .map_err(|e| format!("agent auth tag verification failed: {e}"))?;
+        let compat_tag = buzz_sdk_pkg::nip_oa::parse_auth_tag(auth_tag_json)
+            .map_err(|e| format!("agent auth tag parse failed: {e}"))?;
+        tags.push(
+            nostr::Tag::parse(compat_tag.as_slice())
+                .map_err(|e| format!("agent auth tag conversion failed: {e}"))?,
+        );
+    }
+    nostr::EventBuilder::new(nostr::Kind::Custom(22242), "")
+        .tags(tags)
+        .sign_with_keys(keys)
+        .map_err(|e| format!("sign: {e}"))
+}
+
+async fn connect_authenticated_audio_socket(
     channel_id: &str,
     parent_channel_id: Option<&str>,
-    state: &AppState,
-) -> Result<(CancellationToken, tokio::sync::mpsc::Sender<Vec<u8>>), String> {
+    relay_url: &str,
+    keys: &nostr::Keys,
+    auth_tag_json: Option<&str>,
+) -> Result<(WsSink, WsReceiver, u8, Vec<(u8, String, u8)>), String> {
     use nostr::JsonUtil;
 
-    let relay_url = crate::relay::relay_ws_url_with_override(state);
     let ws_url = format!("{relay_url}/huddle/{channel_id}/audio");
-
-    let keys = state.keys.lock().map_err(|e| e.to_string())?.clone();
-
-    // TTS interrupt flags — recv task cancels TTS when remote humans speak.
-    let (tts_cancel, tts_active) = {
-        let hs = state.huddle()?;
-        (Arc::clone(&hs.tts_cancel), Arc::clone(&hs.tts_active))
-    };
-
-    let app_handle = state.app_handle.lock().ok().and_then(|g| g.clone());
-
     let (ws_stream, _) = connect_async(&ws_url)
         .await
         .map_err(|e| format!("audio WS connect failed: {e}"))?;
@@ -74,13 +88,13 @@ pub(crate) async fn connect_audio_relay(
         loop {
             match ws_rx.next().await {
                 Some(Ok(WsMsg::Text(text))) => {
-                    let v: serde_json::Value = serde_json::from_str(&text)
+                    let value: serde_json::Value = serde_json::from_str(&text)
                         .map_err(|e| format!("bad challenge JSON: {e}"))?;
-                    if v["type"] == "challenge" {
-                        break v["challenge"]
+                    if value["type"] == "challenge" {
+                        break value["challenge"]
                             .as_str()
                             .ok_or_else(|| "missing challenge string".to_string())
-                            .map(|s| s.to_string());
+                            .map(str::to_string);
                     }
                 }
                 Some(Ok(WsMsg::Close(_))) | None => {
@@ -91,29 +105,15 @@ pub(crate) async fn connect_audio_relay(
         }
     })
     .await
-    .map_err(|_| "timeout waiting for challenge from relay".to_string())?
-    .map_err(|e: String| e)?;
-
-    let tags = vec![
-        nostr::Tag::parse(["relay", &relay_url]).map_err(|e| format!("tag relay: {e}"))?,
-        nostr::Tag::parse(["challenge", &challenge]).map_err(|e| format!("tag challenge: {e}"))?,
-    ];
-    let event = nostr::EventBuilder::new(nostr::Kind::Custom(22242), "")
-        .tags(tags)
-        .sign_with_keys(&keys)
-        .map_err(|e| format!("sign: {e}"))?;
+    .map_err(|_| "timeout waiting for challenge from relay".to_string())??;
 
+    let event = build_audio_auth_event(keys, relay_url, &challenge, auth_tag_json)?;
     let event_json: serde_json::Value = serde_json::from_str(&event.as_json())
         .map_err(|e| format!("failed to serialize auth event: {e}"))?;
     let auth_msg = serde_json::json!({
         "type": "auth",
         "event": event_json,
         "parent_channel_id": parent_channel_id,
-        // Negotiate huddle audio protocol v2 (8-byte sender-authored header
-        // per Opus frame: seq | ts_48k | level_dbov | flags). See
-        // huddle::wire for the layout. The relay pins the first joiner's
-        // version per-room and rejects mismatched joiners with
-        // `upgrade_required`.
         "protocol_version": super::wire::PROTOCOL_VERSION,
     });
     ws_tx
@@ -121,30 +121,39 @@ pub(crate) async fn connect_audio_relay(
         .await
         .map_err(|e| format!("send auth: {e}"))?;
 
-    let initial_peers: Vec<(u8, String)> = tokio::time::timeout(HANDSHAKE_TIMEOUT, async {
+    let (peer_index, initial_peers) = tokio::time::timeout(HANDSHAKE_TIMEOUT, async {
         loop {
             match ws_rx.next().await {
                 Some(Ok(WsMsg::Text(text))) => {
-                    let v: serde_json::Value = serde_json::from_str(&text).unwrap_or_default();
-                    match v["type"].as_str() {
+                    let value: serde_json::Value = serde_json::from_str(&text).unwrap_or_default();
+                    match value["type"].as_str() {
                         Some("joined") => {
-                            let peers = v["peers"]
+                            let peers = value["peers"]
                                 .as_array()
-                                .map(|arr| {
-                                    arr.iter()
-                                        .filter_map(|p| {
+                                .map(|peers| {
+                                    peers
+                                        .iter()
+                                        .filter_map(|peer| {
                                             Some((
-                                                p["peer_index"].as_u64()? as u8,
-                                                p["pubkey"].as_str()?.to_string(),
+                                                peer["peer_index"].as_u64()? as u8,
+                                                peer["pubkey"].as_str()?.to_string(),
+                                                // Absent `epoch` (legacy relay) degrades
+                                                // to 0 so the fence becomes a no-op rather
+                                                // than rejecting every frame.
+                                                peer["epoch"].as_u64().unwrap_or(0) as u8,
                                             ))
                                         })
-                                        .collect::<Vec<_>>()
+                                        .collect()
                                 })
                                 .unwrap_or_default();
-                            break Ok(peers);
+                            let peer_index = value["peer_index"]
+                                .as_u64()
+                                .and_then(|index| u8::try_from(index).ok())
+                                .ok_or_else(|| "joined message missing peer index".to_string())?;
+                            break Ok((peer_index, peers));
                         }
                         Some("error") => {
-                            break Err(format!("audio relay auth error: {}", v["message"]));
+                            break Err(format!("audio relay auth error: {}", value["message"]));
                         }
                         _ => continue,
                     }
@@ -157,8 +166,48 @@ pub(crate) async fn connect_audio_relay(
         }
     })
     .await
-    .map_err(|_| "timeout waiting for joined from relay".to_string())?
-    .map_err(|e: String| e)?;
+    .map_err(|_| "timeout waiting for joined from relay".to_string())??;
+
+    Ok((ws_tx, ws_rx, peer_index, initial_peers))
+}
+
+/// Connect to the relay's audio WebSocket and run the Opus encode/decode pipeline.
+///
+/// Returns `(cancel_token, pcm_sender)` — caller stores both in `HuddleState`.
+/// Dropping the sender or calling `cancel.cancel()` shuts down the relay task.
+pub(crate) async fn connect_audio_relay(
+    channel_id: &str,
+    parent_channel_id: Option<&str>,
+    state: &AppState,
+) -> Result<(CancellationToken, tokio::sync::mpsc::Sender<Vec<u8>>), String> {
+    let relay_url = crate::relay::relay_ws_url_with_override(state);
+    let keys = state.keys.lock().map_err(|e| e.to_string())?.clone();
+
+    // TTS interrupt flags — recv task cancels TTS when remote humans speak.
+    let (
+        tts_cancel,
+        tts_active,
+        local_tts_publishers,
+        remote_stt_pipeline,
+        agent_pubkeys,
+        human_floor,
+    ) = {
+        let hs = state.huddle()?;
+        (
+            Arc::clone(&hs.tts_cancel),
+            Arc::clone(&hs.tts_active),
+            Arc::clone(&hs.local_tts_publishers),
+            Arc::clone(&hs.remote_stt_pipeline),
+            Arc::clone(&hs.agent_pubkeys),
+            hs.human_floor.clone(),
+        )
+    };
+
+    let app_handle = state.app_handle.lock().ok().and_then(|g| g.clone());
+
+    let (ws_tx, ws_rx, _peer_index, initial_peers) =
+        connect_authenticated_audio_socket(channel_id, parent_channel_id, &relay_url, &keys, None)
+            .await?;
 
     let cancel = CancellationToken::new();
     let cancel_clone = cancel.clone();
@@ -180,6 +229,10 @@ pub(crate) async fn connect_audio_relay(
             initial_peers,
             tts_cancel,
             tts_active,
+            local_tts_publishers,
+            remote_stt_pipeline,
+            agent_pubkeys,
+            human_floor,
             output_device_name,
         })
         .await
@@ -204,6 +257,193 @@ pub(crate) async fn connect_audio_relay(
 /// Background Opus encode/decode pipeline spawned by `connect_audio_relay`.
 pub(crate) type WsStream =
     tokio_tungstenite::WebSocketStream<tokio_tungstenite::MaybeTlsStream<tokio::net::TcpStream>>;
+type WsSink = futures_util::stream::SplitSink<WsStream, WsMsg>;
+type WsReceiver = futures_util::stream::SplitStream<WsStream>;
+
+const TTS_BROADCAST_QUEUE_DEPTH: usize = 8;
+const TTS_BROADCAST_MAX_FRAMES: usize = 1_500; // 30 seconds at 20 ms/frame.
+
+struct QueuedTtsFrame {
+    epoch: u64,
+    speaker_generation: u64,
+    samples_48k: Vec<f32>,
+}
+
+fn upsample_tts_24k_to_48k(samples_24k: &[f32]) -> Vec<f32> {
+    let mut samples_48k = Vec::with_capacity(samples_24k.len().saturating_mul(2));
+    for (index, sample) in samples_24k.iter().copied().enumerate() {
+        let next = samples_24k.get(index + 1).copied().unwrap_or(sample);
+        samples_48k.push(sample);
+        samples_48k.push((sample + next) * 0.5);
+    }
+    samples_48k
+}
+
+fn queue_tts_broadcast_packet(
+    queue: &mut std::collections::VecDeque<QueuedTtsFrame>,
+    packet: super::tts::TtsBroadcastPacket,
+    current_epoch: u64,
+    current_speaker_generation: u64,
+) {
+    if packet.epoch != current_epoch
+        || packet.speaker_generation != current_speaker_generation
+        || packet.samples_24k.is_empty()
+    {
+        return;
+    }
+    let samples_48k = upsample_tts_24k_to_48k(&packet.samples_24k);
+    for chunk in samples_48k.chunks(960) {
+        if queue.len() >= TTS_BROADCAST_MAX_FRAMES {
+            eprintln!("buzz-desktop: tts broadcast status=dropped reason=queue_duration_limit");
+            break;
+        }
+        let mut frame = chunk.to_vec();
+        frame.resize(960, 0.0);
+        queue.push_back(QueuedTtsFrame {
+            epoch: packet.epoch,
+            speaker_generation: packet.speaker_generation,
+            samples_48k: frame,
+        });
+    }
+}
+
+/// Open a send-only v2 Huddle audio peer authenticated as a locally managed
+/// agent. The relay therefore assigns the synthesized stream to that agent's
+/// existing pubkey; no backend or wire-protocol extension is required.
+pub(crate) async fn connect_tts_audio_publisher(
+    channel_id: &str,
+    parent_channel_id: Option<&str>,
+    state: &AppState,
+    keys: &nostr::Keys,
+    auth_tag_json: Option<&str>,
+    local_tts_publishers: super::tts::LocalTtsPublishers,
+) -> Result<super::tts::TtsAudioPublisher, String> {
+    let relay_url = crate::relay::relay_ws_url_with_override(state);
+    let (ws_tx, ws_rx, peer_index, _) = connect_authenticated_audio_socket(
+        channel_id,
+        parent_channel_id,
+        &relay_url,
+        keys,
+        auth_tag_json,
+    )
+    .await?;
+
+    let cancel = CancellationToken::new();
+    let publisher_cancel = cancel.clone();
+    let (tx, rx) = tokio::sync::mpsc::channel(TTS_BROADCAST_QUEUE_DEPTH);
+    let publisher = super::tts::TtsAudioPublisher::new(tx, cancel);
+    let (epoch, speaker_generation) = publisher.version_state();
+    let local_publisher = super::tts::LocalTtsPublisherLease::new(peer_index, local_tts_publishers);
+    tokio::spawn(async move {
+        let _local_publisher = local_publisher;
+        if let Err(error) = run_tts_audio_publisher(
+            ws_tx,
+            ws_rx,
+            rx,
+            publisher_cancel.clone(),
+            epoch,
+            speaker_generation,
+        )
+        .await
+        {
+            eprintln!("buzz-desktop: tts broadcast status=disconnected error={error}");
+        }
+        publisher_cancel.cancel();
+    });
+    Ok(publisher)
+}
+
+async fn run_tts_audio_publisher(
+    mut ws_tx: WsSink,
+    mut ws_rx: WsReceiver,
+    mut audio_rx: tokio::sync::mpsc::Receiver<super::tts::TtsBroadcastPacket>,
+    cancel: CancellationToken,
+    epoch: Arc<std::sync::atomic::AtomicU64>,
+    speaker_generation: Arc<std::sync::atomic::AtomicU64>,
+) -> Result<(), String> {
+    use super::wire::{audio_level_dbov, FrameHeader, V2_HEADER_LEN};
+    use std::sync::atomic::Ordering;
+
+    let mut encoder = opus::Encoder::new(48_000, opus::Channels::Mono, opus::Application::Voip)
+        .map_err(|error| format!("tts opus encoder: {error}"))?;
+    encoder
+        .set_bitrate(opus::Bitrate::Bits(32_000))
+        .map_err(|error| format!("tts opus bitrate: {error}"))?;
+    encoder
+        .set_dtx(true)
+        .map_err(|error| format!("tts opus dtx: {error}"))?;
+
+    let mut sequence = 0_u16;
+    let mut timestamp_48k = 0_u32;
+    let mut encoded = vec![0_u8; 4_000];
+    let mut queue = std::collections::VecDeque::<QueuedTtsFrame>::new();
+    let mut send_tick = tokio::time::interval(std::time::Duration::from_millis(20));
+    send_tick.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Skip);
+
+    loop {
+        tokio::select! {
+            biased;
+            _ = cancel.cancelled() => break,
+            _ = send_tick.tick() => {
+                let current_epoch = epoch.load(Ordering::Acquire);
+                let current_generation = speaker_generation.load(Ordering::Acquire);
+                while queue.front().is_some_and(|frame| {
+                    frame.epoch != current_epoch
+                        || frame.speaker_generation != current_generation
+                }) {
+                    queue.pop_front();
+                }
+                let Some(frame) = queue.pop_front() else { continue };
+                let level = audio_level_dbov(&frame.samples_48k);
+                let encoded_len = encoder
+                    .encode_float(&frame.samples_48k, &mut encoded)
+                    .map_err(|error| format!("tts opus encode: {error}"))?;
+                if encoded_len == 0 {
+                    continue;
+                }
+                let flags = if encoded_len <= 2 { super::wire::FLAG_DTX } else { 0 };
+                let header = FrameHeader {
+                    seq: sequence,
+                    ts_48k: timestamp_48k,
+                    level_dbov: level,
+                    flags,
+                }
+                .encode();
+                let mut payload = Vec::with_capacity(V2_HEADER_LEN + encoded_len);
+                payload.extend_from_slice(&header);
+                payload.extend_from_slice(&encoded[..encoded_len]);
+                ws_tx
+                    .send(WsMsg::Binary(payload.into()))
+                    .await
+                    .map_err(|error| format!("tts audio send: {error}"))?;
+                sequence = sequence.wrapping_add(1);
+                timestamp_48k = timestamp_48k.wrapping_add(super::jitter::FRAME_TIMESTAMP_DELTA);
+            }
+            message = ws_rx.next() => {
+                match message {
+                    Some(Ok(WsMsg::Ping(data))) => {
+                        ws_tx.send(WsMsg::Pong(data)).await
+                            .map_err(|error| format!("tts audio pong: {error}"))?;
+                    }
+                    Some(Ok(WsMsg::Close(_))) | None => break,
+                    Some(Err(error)) => return Err(format!("tts audio receive: {error}")),
+                    Some(Ok(_)) => {}
+                }
+            }
+            packet = audio_rx.recv() => {
+                let Some(packet) = packet else { break };
+                queue_tts_broadcast_packet(
+                    &mut queue,
+                    packet,
+                    epoch.load(Ordering::Acquire),
+                    speaker_generation.load(Ordering::Acquire),
+                );
+            }
+        }
+    }
+    let _ = ws_tx.send(WsMsg::Close(None)).await;
+    Ok(())
+}
 
 struct AudioRelayPipelineArgs {
     ws_tx: futures_util::stream::SplitSink<WsStream, WsMsg>,
@@ -211,9 +451,13 @@ struct AudioRelayPipelineArgs {
     pcm_rx: tokio::sync::mpsc::Receiver<Vec<u8>>,
     cancel: CancellationToken,
     app_handle: Option<tauri::AppHandle>,
-    initial_peers: Vec<(u8, String)>,
+    initial_peers: Vec<(u8, String, u8)>,
     tts_cancel: Arc<AtomicBool>,
     tts_active: Arc<AtomicBool>,
+    local_tts_publishers: super::tts::LocalTtsPublishers,
+    remote_stt_pipeline: Arc<std::sync::Mutex<Option<std::sync::Weak<super::stt::SttPipeline>>>>,
+    agent_pubkeys: Arc<std::sync::Mutex<Vec<String>>>,
+    human_floor: super::human_floor::HumanFloor,
     output_device_name: Option<String>,
 }
 
@@ -227,6 +471,10 @@ async fn audio_relay_pipeline(args: AudioRelayPipelineArgs) -> Result<(), String
         initial_peers,
         tts_cancel,
         tts_active,
+        local_tts_publishers,
+        remote_stt_pipeline,
+        agent_pubkeys,
+        human_floor,
         output_device_name,
     } = args;
 
@@ -336,6 +584,10 @@ async fn audio_relay_pipeline(args: AudioRelayPipelineArgs) -> Result<(), String
         initial_peers,
         tts_active,
         tts_cancel,
+        local_tts_publishers,
+        remote_stt_pipeline,
+        agent_pubkeys,
+        human_floor,
     ));
 
     // Wait for either task to finish, then abort the survivor.
@@ -414,3 +666,45 @@ pub(crate) async fn count_human_members(
         .filter(|(_, role)| role.as_deref() != Some("bot"))
         .count())
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn tts_upsampling_doubles_rate_with_linear_midpoints() {
+        assert_eq!(
+            upsample_tts_24k_to_48k(&[0.0, 1.0, -1.0]),
+            vec![0.0, 0.5, 1.0, 0.0, -1.0, -1.0]
+        );
+    }
+
+    #[test]
+    fn tts_queue_rejects_cancelled_versions_and_pads_twenty_ms_frames() {
+        let mut queue = std::collections::VecDeque::new();
+        queue_tts_broadcast_packet(
+            &mut queue,
+            super::super::tts::TtsBroadcastPacket {
+                epoch: 1,
+                speaker_generation: 7,
+                samples_24k: vec![0.25; 480],
+            },
+            1,
+            7,
+        );
+        assert_eq!(queue.len(), 1);
+        assert_eq!(queue[0].samples_48k.len(), 960);
+
+        queue_tts_broadcast_packet(
+            &mut queue,
+            super::super::tts::TtsBroadcastPacket {
+                epoch: 1,
+                speaker_generation: 7,
+                samples_24k: vec![0.5; 480],
+            },
+            2,
+            7,
+        );
+        assert_eq!(queue.len(), 1, "cancelled epoch must not enqueue");
+    }
+}
diff --git a/desktop/src-tauri/src/huddle/state.rs b/desktop/src-tauri/src/huddle/state.rs
index c615ff19c2e..c7aff1bf7e2 100644
--- a/desktop/src-tauri/src/huddle/state.rs
+++ b/desktop/src-tauri/src/huddle/state.rs
@@ -7,10 +7,11 @@ use serde::{Deserialize, Serialize};
 use std::collections::BTreeMap;
 use std::sync::{
     atomic::{AtomicBool, AtomicU64, Ordering},
-    Arc, Mutex,
+    Arc, Mutex, Weak,
 };
 
 use super::agent_voice::AgentVoiceSettings;
+use super::human_floor::HumanFloor;
 use super::{stt, tts};
 
 /// Voice input mode: push-to-talk (PTT) or voice-activity detection (VAD).
@@ -78,9 +79,20 @@ pub struct HuddleState {
     /// Active STT pipeline — not serialized, not cloned.
     #[serde(skip)]
     pub stt_pipeline: Option<Arc<stt::SttPipeline>>,
+    /// Weak STT handle shared with the audio receive loop so remote human
+    /// speech can reach transcription even when the pipeline hot-starts after
+    /// the Huddle audio socket was connected. The state-owned strong handle
+    /// above remains the sole owner and teardown clears both atomically.
+    #[serde(skip)]
+    pub remote_stt_pipeline: Arc<Mutex<Option<Weak<stt::SttPipeline>>>>,
     /// Active TTS pipeline — not serialized, not cloned.
     #[serde(skip)]
     pub tts_pipeline: Option<Arc<tts::TtsPipeline>>,
+    /// Peer indices currently publishing locally synthesized TTS sockets. The
+    /// receive loop uses this live registry to suppress only this desktop's
+    /// echo, never another socket authenticated as the same bot.
+    #[serde(skip)]
+    pub local_tts_publishers: tts::LocalTtsPublishers,
     /// Whether this client created the huddle (vs. joined it).
     /// Used to enforce that only the creator can end/archive the huddle.
     pub is_creator: bool,
@@ -106,6 +118,10 @@ pub struct HuddleState {
     /// restarts — both STT and TTS reference the same flag for the entire huddle.
     #[serde(skip)]
     pub tts_cancel: Arc<AtomicBool>,
+    /// Shared human-floor state. Confirmed local or remote human speech hard
+    /// cancels TTS and blocks stale/new playback until every source releases.
+    #[serde(skip)]
+    pub human_floor: HumanFloor,
     /// Sentinel: true while a TTS pipeline is being constructed (outside the lock).
     /// Prevents TOCTOU races where two concurrent callers both pass the `is_some()`
     /// check and both spawn TTS worker threads — the loser's thread would leak.
@@ -182,13 +198,16 @@ impl Clone for HuddleState {
             agent_pubkeys: Arc::new(Mutex::new(agent_pubkeys_snapshot)),
             agent_voice_settings: self.agent_voice_settings.clone(),
             stt_pipeline: None, // Never clone the pipeline handle.
+            remote_stt_pipeline: Arc::new(Mutex::new(None)),
             tts_pipeline: None, // Never clone the pipeline handle.
+            local_tts_publishers: Arc::clone(&self.local_tts_publishers),
             is_creator: self.is_creator,
             tts_enabled: self.tts_enabled,
             transcription_enabled: self.transcription_enabled,
             transcription_user_controlled: self.transcription_user_controlled,
             tts_active: Arc::clone(&self.tts_active),
             tts_cancel: Arc::clone(&self.tts_cancel),
+            human_floor: self.human_floor.clone(),
             tts_starting: Arc::clone(&self.tts_starting),
             stt_starting: Arc::clone(&self.stt_starting),
             last_agent_refresh: self.last_agent_refresh,
@@ -203,6 +222,8 @@ impl Clone for HuddleState {
 
 impl Default for HuddleState {
     fn default() -> Self {
+        let tts_cancel = Arc::new(AtomicBool::new(false));
+        let human_floor = HumanFloor::new();
         Self {
             phase: HuddlePhase::Idle,
             parent_channel_id: None,
@@ -214,13 +235,16 @@ impl Default for HuddleState {
             agent_pubkeys: Arc::new(Mutex::new(Vec::new())),
             agent_voice_settings: BTreeMap::new(),
             stt_pipeline: None,
+            remote_stt_pipeline: Arc::new(Mutex::new(None)),
             tts_pipeline: None,
+            local_tts_publishers: tts::LocalTtsPublishers::default(),
             is_creator: false,
             tts_enabled: true,
             transcription_enabled: false,
             transcription_user_controlled: false,
             tts_active: Arc::new(AtomicBool::new(false)),
-            tts_cancel: Arc::new(AtomicBool::new(false)),
+            tts_cancel,
+            human_floor,
             tts_starting: Arc::new(AtomicBool::new(false)),
             stt_starting: Arc::new(AtomicBool::new(false)),
             last_agent_refresh: None,
@@ -234,6 +258,22 @@ impl Default for HuddleState {
 }
 
 impl HuddleState {
+    pub(crate) fn set_stt_pipeline(&mut self, pipeline: Arc<stt::SttPipeline>) {
+        *self
+            .remote_stt_pipeline
+            .lock()
+            .unwrap_or_else(|error| error.into_inner()) = Some(Arc::downgrade(&pipeline));
+        self.stt_pipeline = Some(pipeline);
+    }
+
+    pub(crate) fn take_stt_pipeline(&mut self) -> Option<Arc<stt::SttPipeline>> {
+        self.remote_stt_pipeline
+            .lock()
+            .unwrap_or_else(|error| error.into_inner())
+            .take();
+        self.stt_pipeline.take()
+    }
+
     /// Begin a new local huddle lifetime and return its identity.
     pub(crate) fn begin_huddle_lifetime(&mut self) -> u64 {
         self.huddle_generation = self.huddle_generation.wrapping_add(1);
diff --git a/desktop/src-tauri/src/huddle/stt.rs b/desktop/src-tauri/src/huddle/stt.rs
index 8185944834a..c27bf38b649 100644
--- a/desktop/src-tauri/src/huddle/stt.rs
+++ b/desktop/src-tauri/src/huddle/stt.rs
@@ -32,6 +32,8 @@ use std::{
 
 use tokio::sync::mpsc as tokio_mpsc;
 
+use super::{human_floor::HumanFloor, local_barge_in};
+
 // ── Public pipeline handle ────────────────────────────────────────────────────
 
 /// Bounded audio queue capacity.
@@ -52,21 +54,33 @@ const MAX_SPEECH_SAMPLES: usize = 16_000 * 30;
 #[derive(Debug)]
 pub struct SttPipeline {
     /// Send raw PCM bytes (f32 LE, 48 kHz mono) into the pipeline.
-    audio_tx: SyncSender<Vec<u8>>,
+    audio_tx: SyncSender<SttAudioInput>,
     /// Signals the worker thread to stop.
     shutdown: Arc<AtomicBool>,
     /// Worker thread handle — taken on drop to join cleanly.
     thread: Option<thread::JoinHandle<()>>,
 }
 
+#[derive(Debug)]
+struct SttAudioInput {
+    pcm_bytes: Vec<u8>,
+    origin: SttAudioOrigin,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+enum SttAudioOrigin {
+    Local,
+    RemoteHuman,
+}
+
 impl SttPipeline {
     /// Spawn the pipeline thread.
     ///
-    /// Mic input is transcribed even while agent TTS is playing: the huddle UI
-    /// already tells users to wear headphones, so speaker bleed is accepted in
-    /// exchange for never dropping human speech that overlaps agent audio.
-    /// Local mic frames still never cancel TTS — push-to-talk and remote
-    /// participant speech remain the explicit barge-in paths.
+    /// Mic input is transcribed even while agent TTS is playing. In open-mic
+    /// VAD mode, confirmed speech acquires the shared human floor: immediately
+    /// on an isolated output route, or after the restored 320 ms sustained-
+    /// speech debounce on an acoustically coupled route. Push-to-talk retains
+    /// its explicit shortcut cancellation path.
     ///
     /// `ptt_active` and `manual_mic_unmuted` are present when the PTT shortcut
     /// is enabled. The pipeline accepts speech while either input path is open;
@@ -85,8 +99,10 @@ impl SttPipeline {
         model_dir: PathBuf,
         ptt_active: Option<Arc<AtomicBool>>,
         manual_mic_unmuted: Option<Arc<AtomicBool>>,
+        human_floor: HumanFloor,
+        output_device: Option<String>,
     ) -> Result<(Self, tokio_mpsc::Receiver<String>), String> {
-        let (audio_tx, audio_rx) = mpsc::sync_channel::<Vec<u8>>(AUDIO_QUEUE_DEPTH);
+        let (audio_tx, audio_rx) = mpsc::sync_channel::<SttAudioInput>(AUDIO_QUEUE_DEPTH);
         let (text_tx, text_rx) = tokio_mpsc::channel::<String>(64);
         let shutdown = Arc::new(AtomicBool::new(false));
 
@@ -103,6 +119,8 @@ impl SttPipeline {
                     shutdown_worker,
                     ptt_active_worker,
                     manual_mic_unmuted_worker,
+                    human_floor,
+                    output_device,
                 )
             })
             .map_err(|e| format!("failed to spawn stt-worker thread: {e}"))?;
@@ -131,6 +149,18 @@ impl SttPipeline {
     /// Non-blocking. Drops audio silently if the pipeline can't keep up —
     /// better to lose frames than to stall the UI thread.
     pub fn push_audio(&self, pcm_bytes: Vec<u8>) -> Result<(), String> {
+        self.push_audio_from(pcm_bytes, SttAudioOrigin::Local)
+    }
+
+    /// Feed decoded remote-human PCM into transcription. Unlike the desktop
+    /// microphone path, this is not gated by the desktop PTT or mute state: the
+    /// remote participant already made their transmission choice on their own
+    /// device before the relay delivered these samples.
+    pub fn push_remote_audio(&self, pcm_bytes: Vec<u8>) -> Result<(), String> {
+        self.push_audio_from(pcm_bytes, SttAudioOrigin::RemoteHuman)
+    }
+
+    fn push_audio_from(&self, pcm_bytes: Vec<u8>, origin: SttAudioOrigin) -> Result<(), String> {
         // Reject non-4-byte-aligned input — would silently truncate in bytes_to_f32.
         if !pcm_bytes.len().is_multiple_of(4) {
             return Err(format!(
@@ -139,7 +169,7 @@ impl SttPipeline {
             ));
         }
         // Drop audio if the pipeline can't keep up — better than blocking the UI.
-        let _ = self.audio_tx.try_send(pcm_bytes);
+        let _ = self.audio_tx.try_send(SttAudioInput { pcm_bytes, origin });
         Ok(())
     }
 }
@@ -205,6 +235,7 @@ const MIN_VOICED_FRAMES: usize = 12;
 #[derive(Debug, PartialEq, Eq)]
 enum VadFrameAction {
     None,
+    ConfirmedOnset,
     Speech,
     FirstSilence,
     Flush,
@@ -268,7 +299,7 @@ impl VadEndpoint {
             for buffered in self.pre_roll.drain(..) {
                 self.speech_buf.extend_from_slice(&buffered);
             }
-            return VadFrameAction::Speech;
+            return VadFrameAction::ConfirmedOnset;
         }
 
         if probability > VAD_OFFSET_THRESHOLD {
@@ -342,31 +373,85 @@ fn stt_speculative_decode() -> bool {
     std::env::var("BUZZ_STT_SPECULATIVE").is_ok_and(|v| v == "1")
 }
 
+struct SttStreamState {
+    resampler: rubato::Fft<f32>,
+    chunk_in: usize,
+    input_buf_48k: Vec<f32>,
+    leftover_16k: Vec<f32>,
+    vad: earshot::Detector<earshot::DefaultPredictor>,
+    endpoint: VadEndpoint,
+    speculative: Option<(String, usize)>,
+}
+
+impl SttStreamState {
+    fn new() -> Result<Self, String> {
+        use rubato::{FixedSync, Resampler};
+
+        let resampler = rubato::Fft::<f32>::new(48_000, 16_000, 1024, 2, 1, FixedSync::Input)
+            .map_err(|error| format!("STT resampler init failed: {error}"))?;
+        let chunk_in = resampler.input_frames_next();
+        Ok(Self {
+            resampler,
+            chunk_in,
+            input_buf_48k: Vec::with_capacity(chunk_in * 2),
+            leftover_16k: Vec::new(),
+            vad: earshot::Detector::new(earshot::DefaultPredictor::new()),
+            endpoint: VadEndpoint::new(),
+            speculative: None,
+        })
+    }
+}
+
+#[derive(Debug)]
+enum SttLoopInput {
+    Tick,
+    Batch(Vec<SttAudioInput>),
+}
+
+fn run_stt_receive_loop(
+    audio_rx: Receiver<SttAudioInput>,
+    shutdown: &AtomicBool,
+    human_floor: HumanFloor,
+    mut process: impl FnMut(SttLoopInput, &mut local_barge_in::LocalBargeIn),
+) {
+    let mut local_barge_in_state = local_barge_in::WorkerLocalBargeIn::new(human_floor);
+
+    loop {
+        // Check shutdown flag before blocking.
+        if shutdown.load(Ordering::Acquire) {
+            break;
+        }
+
+        process(SttLoopInput::Tick, &mut local_barge_in_state);
+
+        // Use recv_timeout so we can periodically check the shutdown flag.
+        let input = match audio_rx.recv_timeout(RECV_TIMEOUT) {
+            Ok(input) => input,
+            Err(mpsc::RecvTimeoutError::Timeout) => continue,
+            Err(mpsc::RecvTimeoutError::Disconnected) => break, // Sender dropped.
+        };
+
+        // Drain any additional pending messages to batch-process.
+        let mut batch = vec![input];
+        while let Ok(input) = audio_rx.try_recv() {
+            batch.push(input);
+        }
+        process(SttLoopInput::Batch(batch), &mut local_barge_in_state);
+    }
+}
+
+#[allow(clippy::too_many_arguments)]
 fn stt_worker(
     model_dir: PathBuf,
-    audio_rx: Receiver<Vec<u8>>,
+    audio_rx: Receiver<SttAudioInput>,
     text_tx: tokio_mpsc::Sender<String>,
     shutdown: Arc<AtomicBool>,
     ptt_active: Option<Arc<AtomicBool>>,
     manual_mic_unmuted: Option<Arc<AtomicBool>>,
+    human_floor: HumanFloor,
+    output_device: Option<String>,
 ) {
-    // ── 1. Initialise rubato resampler (48 kHz → 16 kHz, mono) ───────────────
-    use rubato::{Fft, FixedSync, Resampler};
-
-    let mut resampler = match Fft::<f32>::new(48_000, 16_000, 1024, 2, 1, FixedSync::Input) {
-        Ok(r) => r,
-        Err(e) => {
-            eprintln!("buzz-desktop: STT resampler init failed: {e}");
-            return;
-        }
-    };
-    let chunk_in = resampler.input_frames_next();
-
-    // ── 2. Initialise earshot VAD ─────────────────────────────────────────────
-    use earshot::{DefaultPredictor, Detector};
-    let mut vad = Detector::new(DefaultPredictor::new());
-
-    // ── 3. Initialise sherpa-onnx recognizer ─────────────────────────────────
+    // ── 1. Initialise sherpa-onnx recognizer ─────────────────────────────────
     //
     // Parakeet TDT-CTC 110M ships as a single `model.int8.onnx` (CTC head) plus
     // `tokens.txt`. sherpa-onnx infers the model family from which inner config
@@ -403,100 +488,137 @@ fn stt_worker(
         }
     };
 
-    // ── 4. Processing state ───────────────────────────────────────────────────
-    // Leftover 48 kHz samples that didn't fill a full resampler chunk.
-    let mut input_buf_48k: Vec<f32> = Vec::with_capacity(chunk_in * 2);
-    // Leftover 16 kHz samples that didn't fill a full VAD frame.
-    let mut leftover_16k: Vec<f32> = Vec::new();
-    // Model-independent endpointing state around Earshot's frame probabilities.
-    let mut endpoint = VadEndpoint::new();
-    // Silence flush window (frames) — fixed at the production value.
-    let flush_frames = SILENCE_FLUSH_FRAMES;
-    // EXPERIMENTAL: speculative decode result + the voiced-frame count it was
-    // computed at. Valid only while no new voiced frame has arrived since.
+    // ── 2. Independent local and remote processing state ─────────────────────
+    // Separate resampler/VAD state prevents simultaneous desktop and remote
+    // speech from being serialized into one artificial utterance.
+    let mut local_stream = match SttStreamState::new() {
+        Ok(stream) => stream,
+        Err(error) => {
+            eprintln!("buzz-desktop: {error}");
+            return;
+        }
+    };
+    let mut remote_stream = match SttStreamState::new() {
+        Ok(stream) => stream,
+        Err(error) => {
+            eprintln!("buzz-desktop: {error}");
+            return;
+        }
+    };
     let speculative_enabled = stt_speculative_decode();
-    let mut speculative: Option<(String, usize)> = None;
-
-    // ── 5. Main loop ──────────────────────────────────────────────────────────
     let mut transmit_was_active = ptt_active
         .as_ref()
         .is_some_and(|ptt| ptt.load(Ordering::Acquire))
         || manual_mic_unmuted
             .as_ref()
             .is_some_and(|manual| manual.load(Ordering::Acquire));
-    loop {
-        // Check shutdown flag before blocking.
-        if shutdown.load(Ordering::Acquire) {
-            break;
-        }
 
-        // Track the combined manual/PTT transmission edge. When both paths
-        // close, the worklet stops sending frames, so flush here rather than
-        // waiting for silence that will never arrive.
-        if let Some(ref ptt) = ptt_active {
-            let transmit_now = ptt.load(Ordering::Acquire)
-                || manual_mic_unmuted
-                    .as_ref()
-                    .is_some_and(|manual| manual.load(Ordering::Acquire));
-            if transmit_was_active
-                && !transmit_now
-                && endpoint.in_speech
-                && !endpoint.speech_buf.is_empty()
-            {
-                flush_to_stt(
-                    &endpoint.speech_buf,
-                    endpoint.voiced_frames,
-                    &recognizer,
-                    &text_tx,
-                );
-                endpoint.reset_segment();
+    run_stt_receive_loop(
+        audio_rx,
+        &shutdown,
+        human_floor.clone(),
+        |input, local_barge_in_state| match input {
+            SttLoopInput::Tick => {
+                // The worklet stops sending frames when both local transmit
+                // paths close, so flush on that edge instead of waiting for
+                // silence that will never arrive.
+                if let Some(ref ptt) = ptt_active {
+                    let transmit_now = ptt.load(Ordering::Acquire)
+                        || manual_mic_unmuted
+                            .as_ref()
+                            .is_some_and(|manual| manual.load(Ordering::Acquire));
+                    if transmit_was_active
+                        && !transmit_now
+                        && local_stream.endpoint.in_speech
+                        && !local_stream.endpoint.speech_buf.is_empty()
+                    {
+                        flush_to_stt(
+                            &local_stream.endpoint.speech_buf,
+                            local_stream.endpoint.voiced_frames,
+                            &recognizer,
+                            &text_tx,
+                        );
+                        local_stream.endpoint.reset_segment();
+                        local_stream.speculative.take();
+                        local_barge_in_state.release(&human_floor);
+                    }
+                    transmit_was_active = transmit_now;
+                }
             }
-            transmit_was_active = transmit_now;
-        }
-
-        // Use recv_timeout so we can periodically check the shutdown flag.
-        let bytes = match audio_rx.recv_timeout(RECV_TIMEOUT) {
-            Ok(b) => b,
-            Err(mpsc::RecvTimeoutError::Timeout) => continue,
-            Err(mpsc::RecvTimeoutError::Disconnected) => break, // Sender dropped.
-        };
-
-        // Drain any additional pending messages to batch-process.
-        let mut batch = vec![bytes];
-        while let Ok(b) = audio_rx.try_recv() {
-            batch.push(b);
-        }
-
-        for bytes in batch {
-            // Convert raw bytes to f32 samples (little-endian).
-            let samples_48k = bytes_to_f32(&bytes);
-            input_buf_48k.extend_from_slice(&samples_48k);
-
-            // Resample in chunk_in-sized blocks.
-            while input_buf_48k.len() >= chunk_in {
-                let chunk: Vec<f32> = input_buf_48k.drain(..chunk_in).collect();
-                let resampled = resample_chunk(&mut resampler, &chunk);
-                process_16k_samples(
-                    &resampled,
-                    &mut leftover_16k,
-                    &mut vad,
-                    &mut endpoint,
-                    flush_frames,
-                    (speculative_enabled, &mut speculative),
-                    &recognizer,
-                    &text_tx,
-                    ptt_active.as_ref(),
-                    manual_mic_unmuted.as_ref(),
-                );
+            SttLoopInput::Batch(batch) => {
+                for input in batch {
+                    let (stream, ptt_gate, manual_gate, track_local_floor) = match input.origin {
+                        SttAudioOrigin::Local => (
+                            &mut local_stream,
+                            ptt_active.as_ref(),
+                            manual_mic_unmuted.as_ref(),
+                            true,
+                        ),
+                        SttAudioOrigin::RemoteHuman => (&mut remote_stream, None, None, false),
+                    };
+                    process_stt_input(
+                        stream,
+                        &input.pcm_bytes,
+                        speculative_enabled,
+                        &recognizer,
+                        &text_tx,
+                        ptt_gate,
+                        manual_gate,
+                        &human_floor,
+                        local_barge_in_state,
+                        output_device.as_deref(),
+                        track_local_floor,
+                    );
+                }
             }
-        }
-    }
+        },
+    );
 
     // No final flush — leave_huddle/end_huddle emit lifecycle events before
     // the STT worker exits, so a final flush would post a kind:9 message AFTER
     // the user has "left." Losing the last partial utterance is acceptable.
 }
 
+#[allow(clippy::too_many_arguments)]
+fn process_stt_input(
+    stream: &mut SttStreamState,
+    pcm_bytes: &[u8],
+    speculative_enabled: bool,
+    recognizer: &sherpa_onnx::OfflineRecognizer,
+    text_tx: &tokio_mpsc::Sender<String>,
+    ptt_active: Option<&Arc<AtomicBool>>,
+    manual_mic_unmuted: Option<&Arc<AtomicBool>>,
+    human_floor: &HumanFloor,
+    local_barge_in_state: &mut local_barge_in::LocalBargeIn,
+    output_device: Option<&str>,
+    track_local_floor: bool,
+) {
+    stream
+        .input_buf_48k
+        .extend_from_slice(&bytes_to_f32(pcm_bytes));
+
+    while stream.input_buf_48k.len() >= stream.chunk_in {
+        let chunk: Vec<f32> = stream.input_buf_48k.drain(..stream.chunk_in).collect();
+        let resampled = resample_chunk(&mut stream.resampler, &chunk);
+        process_16k_samples(
+            &resampled,
+            &mut stream.leftover_16k,
+            &mut stream.vad,
+            &mut stream.endpoint,
+            SILENCE_FLUSH_FRAMES,
+            (speculative_enabled, &mut stream.speculative),
+            recognizer,
+            text_tx,
+            ptt_active,
+            manual_mic_unmuted,
+            human_floor,
+            local_barge_in_state,
+            output_device,
+            track_local_floor,
+        );
+    }
+}
+
 /// Resample a mono 48 kHz chunk to 16 kHz using rubato.
 /// Returns the resampled samples (may be empty on error).
 fn resample_chunk(resampler: &mut rubato::Fft<f32>, chunk_48k: &[f32]) -> Vec<f32> {
@@ -546,6 +668,10 @@ fn process_16k_samples(
     text_tx: &tokio_mpsc::Sender<String>,
     ptt_active: Option<&Arc<AtomicBool>>,
     manual_mic_unmuted: Option<&Arc<AtomicBool>>,
+    human_floor: &HumanFloor,
+    local_barge_in_state: &mut local_barge_in::LocalBargeIn,
+    output_device: Option<&str>,
+    track_local_floor: bool,
 ) {
     let (speculative_enabled, speculative) = speculative;
     leftover.extend_from_slice(samples);
@@ -562,7 +688,30 @@ fn process_16k_samples(
         // VAD mode, or with a manually open mic once the shortcut is up.
         let flush_allowed = vad_flush_allowed(ptt_active.is_some(), manually_open, ptt_held);
 
-        match endpoint.process_frame(frame, prob, accepts_audio, flush_allowed, flush_frames) {
+        let action =
+            endpoint.process_frame(frame, prob, accepts_audio, flush_allowed, flush_frames);
+        // Open-mic VAD semantics also apply when a PTT-mode user manually
+        // opens the mic. A held shortcut keeps its explicit key-down cancel.
+        let local_barge_in = track_local_floor
+            && local_barge_in::enabled(ptt_active.is_some(), manually_open, ptt_held);
+        if track_local_floor {
+            if local_barge_in {
+                local_barge_in_state.observe(
+                    prob,
+                    action == VadFrameAction::ConfirmedOnset,
+                    human_floor,
+                    output_device,
+                    VAD_ONSET_THRESHOLD,
+                );
+            } else {
+                local_barge_in_state.release(human_floor);
+            }
+        }
+
+        match action {
+            VadFrameAction::ConfirmedOnset => {
+                speculative.take();
+            }
             VadFrameAction::Speech => {
                 // New voiced audio invalidates any speculative decode.
                 speculative.take();
@@ -594,6 +743,9 @@ fn process_16k_samples(
                     ),
                 }
                 endpoint.reset_segment();
+                if local_barge_in {
+                    local_barge_in_state.release(human_floor);
+                }
             }
             VadFrameAction::None => {}
         }
@@ -607,6 +759,9 @@ fn process_16k_samples(
                 text_tx,
             );
             endpoint.reset_segment();
+            if local_barge_in {
+                local_barge_in_state.release(human_floor);
+            }
             speculative.take();
         }
     }
@@ -686,200 +841,5 @@ fn bytes_to_f32(bytes: &[u8]) -> Vec<f32> {
 use super::drain_until_shutdown;
 
 #[cfg(test)]
-mod tests {
-    use super::{
-        has_enough_voiced_audio, vad_flush_allowed, VadEndpoint, VadFrameAction, MIN_VOICED_FRAMES,
-        SILENCE_FLUSH_FRAMES, VAD_FRAME_SAMPLES, VAD_ONSET_FRAMES, VAD_PRE_ROLL_FRAMES,
-    };
-
-    fn frame(value: f32) -> Vec<f32> {
-        vec![value; VAD_FRAME_SAMPLES]
-    }
-
-    #[test]
-    fn short_vad_blips_do_not_reach_the_recognizer() {
-        assert!(!has_enough_voiced_audio(1));
-        assert!(!has_enough_voiced_audio(MIN_VOICED_FRAMES - 1));
-        assert!(has_enough_voiced_audio(MIN_VOICED_FRAMES));
-    }
-
-    #[test]
-    fn confirmed_onset_prepends_pre_roll_once() {
-        let mut endpoint = VadEndpoint::new();
-        for value in 0..VAD_PRE_ROLL_FRAMES - VAD_ONSET_FRAMES {
-            assert_eq!(
-                endpoint.process_frame(frame(value as f32), 0.0, true, true, SILENCE_FLUSH_FRAMES),
-                VadFrameAction::None
-            );
-        }
-        for value in 0..VAD_ONSET_FRAMES {
-            let action = endpoint.process_frame(
-                frame(100.0 + value as f32),
-                0.9,
-                true,
-                true,
-                SILENCE_FLUSH_FRAMES,
-            );
-            if value + 1 == VAD_ONSET_FRAMES {
-                assert_eq!(action, VadFrameAction::Speech);
-            } else {
-                assert_eq!(action, VadFrameAction::None);
-            }
-        }
-
-        assert_eq!(
-            endpoint.speech_buf.len(),
-            VAD_PRE_ROLL_FRAMES * VAD_FRAME_SAMPLES
-        );
-        assert_eq!(endpoint.speech_buf[0], 0.0);
-        assert_eq!(endpoint.speech_buf[VAD_FRAME_SAMPLES], 1.0);
-        assert_eq!(endpoint.pre_roll.len(), 0);
-        endpoint.process_frame(frame(200.0), 0.9, true, true, SILENCE_FLUSH_FRAMES);
-        assert_eq!(
-            endpoint.speech_buf.len(),
-            (VAD_PRE_ROLL_FRAMES + 1) * VAD_FRAME_SAMPLES
-        );
-    }
-
-    #[test]
-    fn onset_requires_consecutive_high_frames() {
-        let mut endpoint = VadEndpoint::new();
-        for probability in [0.9, 0.9, 0.2, 0.9, 0.9] {
-            assert_eq!(
-                endpoint.process_frame(frame(1.0), probability, true, true, SILENCE_FLUSH_FRAMES),
-                VadFrameAction::None
-            );
-        }
-        assert_eq!(
-            endpoint.process_frame(frame(1.0), 0.9, true, true, SILENCE_FLUSH_FRAMES),
-            VadFrameAction::Speech
-        );
-    }
-
-    #[test]
-    fn offset_hysteresis_preserves_borderline_speech() {
-        let mut endpoint = VadEndpoint::new();
-        for _ in 0..VAD_ONSET_FRAMES {
-            endpoint.process_frame(frame(1.0), 0.9, true, true, SILENCE_FLUSH_FRAMES);
-        }
-        assert_eq!(
-            endpoint.process_frame(frame(2.0), 0.4, true, true, SILENCE_FLUSH_FRAMES),
-            VadFrameAction::Speech
-        );
-        assert_eq!(endpoint.silence_frames, 0);
-    }
-
-    #[test]
-    fn below_offset_threshold_starts_silence() {
-        let mut endpoint = VadEndpoint::new();
-        for _ in 0..VAD_ONSET_FRAMES {
-            endpoint.process_frame(frame(1.0), 0.9, true, true, SILENCE_FLUSH_FRAMES);
-        }
-        assert_eq!(
-            endpoint.process_frame(frame(0.0), 0.3, true, true, SILENCE_FLUSH_FRAMES),
-            VadFrameAction::FirstSilence
-        );
-        assert_eq!(endpoint.silence_frames, 1);
-    }
-
-    #[test]
-    fn short_segment_reaches_the_visible_drop_path() {
-        let mut endpoint = VadEndpoint::new();
-        for _ in 0..VAD_ONSET_FRAMES {
-            endpoint.process_frame(frame(1.0), 0.9, true, true, SILENCE_FLUSH_FRAMES);
-        }
-        let mut action = VadFrameAction::None;
-        for _ in 0..SILENCE_FLUSH_FRAMES {
-            action = endpoint.process_frame(frame(0.0), 0.0, true, true, SILENCE_FLUSH_FRAMES);
-        }
-        assert_eq!(action, VadFrameAction::Flush);
-        assert!(!has_enough_voiced_audio(endpoint.voiced_frames));
-        assert!(!endpoint.speech_buf.is_empty());
-    }
-
-    #[test]
-    fn silence_flush_retains_only_hangover_audio() {
-        let mut endpoint = VadEndpoint::new();
-        for _ in 0..VAD_ONSET_FRAMES {
-            endpoint.process_frame(frame(1.0), 0.9, true, true, SILENCE_FLUSH_FRAMES);
-        }
-        let speech_len = endpoint.speech_buf.len();
-        for index in 1..=SILENCE_FLUSH_FRAMES {
-            let action = endpoint.process_frame(frame(0.0), 0.0, true, true, SILENCE_FLUSH_FRAMES);
-            if index == SILENCE_FLUSH_FRAMES {
-                assert_eq!(action, VadFrameAction::Flush);
-            }
-        }
-        assert_eq!(
-            endpoint.speech_buf.len(),
-            speech_len + 6 * VAD_FRAME_SAMPLES
-        );
-    }
-
-    #[test]
-    fn flush_boundary_never_double_includes_audio() {
-        const SEGMENT_N_MARKER: f32 = 777.0;
-        let mut endpoint = VadEndpoint::new();
-        for _ in 0..VAD_ONSET_FRAMES {
-            endpoint.process_frame(
-                frame(SEGMENT_N_MARKER),
-                0.9,
-                true,
-                true,
-                SILENCE_FLUSH_FRAMES,
-            );
-        }
-        for _ in 0..SILENCE_FLUSH_FRAMES {
-            endpoint.process_frame(
-                frame(SEGMENT_N_MARKER),
-                0.0,
-                true,
-                true,
-                SILENCE_FLUSH_FRAMES,
-            );
-        }
-        endpoint.reset_segment();
-
-        for _ in 0..VAD_ONSET_FRAMES {
-            endpoint.process_frame(frame(2.0), 0.9, true, true, SILENCE_FLUSH_FRAMES);
-        }
-        let leaked = endpoint
-            .speech_buf
-            .iter()
-            .filter(|sample| **sample == SEGMENT_N_MARKER)
-            .count();
-        assert_eq!(leaked, 0, "segment N audio leaked into segment N+1");
-    }
-
-    #[test]
-    fn reset_prevents_pre_roll_from_leaking_between_segments() {
-        const SEGMENT_N_MARKER: f32 = 777.0;
-        let mut endpoint = VadEndpoint::new();
-        endpoint.pre_roll.push_back(frame(SEGMENT_N_MARKER));
-        endpoint.reset_segment();
-        for _ in 0..VAD_ONSET_FRAMES {
-            endpoint.process_frame(frame(2.0), 0.9, true, true, SILENCE_FLUSH_FRAMES);
-        }
-        let leaked = endpoint
-            .speech_buf
-            .iter()
-            .filter(|sample| **sample == SEGMENT_N_MARKER)
-            .count();
-        assert_eq!(leaked, 0, "segment N pre-roll leaked into segment N+1");
-    }
-
-    #[test]
-    fn held_push_to_talk_never_silence_flushes() {
-        // Pure VAD mode: silence always ends the utterance.
-        assert!(vad_flush_allowed(false, false, false));
-        // Shortcut configured, nothing transmitting: nothing to flush anyway,
-        // but the pause path stays closed.
-        assert!(!vad_flush_allowed(true, false, false));
-        // Shortcut held: "I am not done talking" — never flush on silence,
-        // regardless of the manual mic state.
-        assert!(!vad_flush_allowed(true, false, true));
-        assert!(!vad_flush_allowed(true, true, true));
-        // Manually open mic with the shortcut up: normal VAD behavior.
-        assert!(vad_flush_allowed(true, true, false));
-    }
-}
+#[path = "stt_tests.rs"]
+mod tests;
diff --git a/desktop/src-tauri/src/huddle/stt_tests.rs b/desktop/src-tauri/src/huddle/stt_tests.rs
new file mode 100644
index 00000000000..d7425970ced
--- /dev/null
+++ b/desktop/src-tauri/src/huddle/stt_tests.rs
@@ -0,0 +1,260 @@
+use std::sync::{atomic::AtomicBool, mpsc, Arc, Barrier};
+
+use super::{
+    has_enough_voiced_audio, run_stt_receive_loop, vad_flush_allowed, HumanFloor, SttAudioInput,
+    SttAudioOrigin, SttLoopInput, VadEndpoint, VadFrameAction, MIN_VOICED_FRAMES,
+    SILENCE_FLUSH_FRAMES, VAD_FRAME_SAMPLES, VAD_ONSET_FRAMES, VAD_PRE_ROLL_FRAMES,
+};
+
+#[derive(Clone, Copy)]
+enum WorkerExit {
+    Shutdown,
+    SenderDisconnect,
+}
+
+fn assert_worker_exit_releases_floor(exit: WorkerExit) {
+    let human_floor = HumanFloor::new();
+    let shutdown = Arc::new(AtomicBool::new(false));
+    let (audio_tx, audio_rx) = mpsc::channel();
+    let acquired = Arc::new(Barrier::new(2));
+    let worker_floor = human_floor.clone();
+    let worker_shutdown = Arc::clone(&shutdown);
+    let worker_acquired = Arc::clone(&acquired);
+    let worker = std::thread::spawn(move || {
+        run_stt_receive_loop(
+            audio_rx,
+            &worker_shutdown,
+            worker_floor.clone(),
+            |input, local_barge_in_state| {
+                if matches!(input, SttLoopInput::Batch(_)) && !worker_floor.is_blocked() {
+                    local_barge_in_state.acquire(&worker_floor, true, false);
+                    worker_acquired.wait();
+                }
+            },
+        );
+    });
+
+    audio_tx
+        .send(SttAudioInput {
+            pcm_bytes: Vec::new(),
+            origin: SttAudioOrigin::Local,
+        })
+        .expect("worker receiver is open");
+    acquired.wait();
+    assert!(human_floor.is_blocked());
+    match exit {
+        WorkerExit::Shutdown => {
+            shutdown.store(true, std::sync::atomic::Ordering::Release);
+        }
+        WorkerExit::SenderDisconnect => drop(audio_tx),
+    }
+    worker.join().expect("worker exits cleanly");
+
+    let replacement_epoch = human_floor.epoch();
+    assert!(
+        human_floor.permits(replacement_epoch),
+        "fresh TTS authorization must proceed after worker exit"
+    );
+    assert!(human_floor.enter_local(true, false));
+}
+
+#[test]
+fn worker_shutdown_releases_local_floor_for_replacement() {
+    assert_worker_exit_releases_floor(WorkerExit::Shutdown);
+}
+
+#[test]
+fn worker_channel_disconnect_releases_local_floor_for_replacement() {
+    assert_worker_exit_releases_floor(WorkerExit::SenderDisconnect);
+}
+
+fn frame(value: f32) -> Vec<f32> {
+    vec![value; VAD_FRAME_SAMPLES]
+}
+
+#[test]
+fn short_vad_blips_do_not_reach_the_recognizer() {
+    assert!(!has_enough_voiced_audio(1));
+    assert!(!has_enough_voiced_audio(MIN_VOICED_FRAMES - 1));
+    assert!(has_enough_voiced_audio(MIN_VOICED_FRAMES));
+}
+
+#[test]
+fn confirmed_onset_prepends_pre_roll_once() {
+    let mut endpoint = VadEndpoint::new();
+    for value in 0..VAD_PRE_ROLL_FRAMES - VAD_ONSET_FRAMES {
+        assert_eq!(
+            endpoint.process_frame(frame(value as f32), 0.0, true, true, SILENCE_FLUSH_FRAMES),
+            VadFrameAction::None
+        );
+    }
+    for value in 0..VAD_ONSET_FRAMES {
+        let action = endpoint.process_frame(
+            frame(100.0 + value as f32),
+            0.9,
+            true,
+            true,
+            SILENCE_FLUSH_FRAMES,
+        );
+        if value + 1 == VAD_ONSET_FRAMES {
+            assert_eq!(action, VadFrameAction::ConfirmedOnset);
+        } else {
+            assert_eq!(action, VadFrameAction::None);
+        }
+    }
+
+    assert_eq!(
+        endpoint.speech_buf.len(),
+        VAD_PRE_ROLL_FRAMES * VAD_FRAME_SAMPLES
+    );
+    assert_eq!(endpoint.speech_buf[0], 0.0);
+    assert_eq!(endpoint.speech_buf[VAD_FRAME_SAMPLES], 1.0);
+    assert_eq!(endpoint.pre_roll.len(), 0);
+    endpoint.process_frame(frame(200.0), 0.9, true, true, SILENCE_FLUSH_FRAMES);
+    assert_eq!(
+        endpoint.speech_buf.len(),
+        (VAD_PRE_ROLL_FRAMES + 1) * VAD_FRAME_SAMPLES
+    );
+}
+
+#[test]
+fn onset_requires_consecutive_high_frames() {
+    let mut endpoint = VadEndpoint::new();
+    for probability in [0.9, 0.9, 0.2, 0.9, 0.9] {
+        assert_eq!(
+            endpoint.process_frame(frame(1.0), probability, true, true, SILENCE_FLUSH_FRAMES),
+            VadFrameAction::None
+        );
+    }
+    assert_eq!(
+        endpoint.process_frame(frame(1.0), 0.9, true, true, SILENCE_FLUSH_FRAMES),
+        VadFrameAction::ConfirmedOnset
+    );
+}
+
+#[test]
+fn offset_hysteresis_preserves_borderline_speech() {
+    let mut endpoint = VadEndpoint::new();
+    for _ in 0..VAD_ONSET_FRAMES {
+        endpoint.process_frame(frame(1.0), 0.9, true, true, SILENCE_FLUSH_FRAMES);
+    }
+    assert_eq!(
+        endpoint.process_frame(frame(2.0), 0.4, true, true, SILENCE_FLUSH_FRAMES),
+        VadFrameAction::Speech
+    );
+    assert_eq!(endpoint.silence_frames, 0);
+}
+
+#[test]
+fn below_offset_threshold_starts_silence() {
+    let mut endpoint = VadEndpoint::new();
+    for _ in 0..VAD_ONSET_FRAMES {
+        endpoint.process_frame(frame(1.0), 0.9, true, true, SILENCE_FLUSH_FRAMES);
+    }
+    assert_eq!(
+        endpoint.process_frame(frame(0.0), 0.3, true, true, SILENCE_FLUSH_FRAMES),
+        VadFrameAction::FirstSilence
+    );
+    assert_eq!(endpoint.silence_frames, 1);
+}
+
+#[test]
+fn short_segment_reaches_the_visible_drop_path() {
+    let mut endpoint = VadEndpoint::new();
+    for _ in 0..VAD_ONSET_FRAMES {
+        endpoint.process_frame(frame(1.0), 0.9, true, true, SILENCE_FLUSH_FRAMES);
+    }
+    let mut action = VadFrameAction::None;
+    for _ in 0..SILENCE_FLUSH_FRAMES {
+        action = endpoint.process_frame(frame(0.0), 0.0, true, true, SILENCE_FLUSH_FRAMES);
+    }
+    assert_eq!(action, VadFrameAction::Flush);
+    assert!(!has_enough_voiced_audio(endpoint.voiced_frames));
+    assert!(!endpoint.speech_buf.is_empty());
+}
+
+#[test]
+fn silence_flush_retains_only_hangover_audio() {
+    let mut endpoint = VadEndpoint::new();
+    for _ in 0..VAD_ONSET_FRAMES {
+        endpoint.process_frame(frame(1.0), 0.9, true, true, SILENCE_FLUSH_FRAMES);
+    }
+    let speech_len = endpoint.speech_buf.len();
+    for index in 1..=SILENCE_FLUSH_FRAMES {
+        let action = endpoint.process_frame(frame(0.0), 0.0, true, true, SILENCE_FLUSH_FRAMES);
+        if index == SILENCE_FLUSH_FRAMES {
+            assert_eq!(action, VadFrameAction::Flush);
+        }
+    }
+    assert_eq!(
+        endpoint.speech_buf.len(),
+        speech_len + 6 * VAD_FRAME_SAMPLES
+    );
+}
+
+#[test]
+fn flush_boundary_never_double_includes_audio() {
+    const SEGMENT_N_MARKER: f32 = 777.0;
+    let mut endpoint = VadEndpoint::new();
+    for _ in 0..VAD_ONSET_FRAMES {
+        endpoint.process_frame(
+            frame(SEGMENT_N_MARKER),
+            0.9,
+            true,
+            true,
+            SILENCE_FLUSH_FRAMES,
+        );
+    }
+    for _ in 0..SILENCE_FLUSH_FRAMES {
+        endpoint.process_frame(
+            frame(SEGMENT_N_MARKER),
+            0.0,
+            true,
+            true,
+            SILENCE_FLUSH_FRAMES,
+        );
+    }
+    endpoint.reset_segment();
+
+    for _ in 0..VAD_ONSET_FRAMES {
+        endpoint.process_frame(frame(2.0), 0.9, true, true, SILENCE_FLUSH_FRAMES);
+    }
+    let leaked = endpoint
+        .speech_buf
+        .iter()
+        .filter(|sample| **sample == SEGMENT_N_MARKER)
+        .count();
+    assert_eq!(leaked, 0, "segment N audio leaked into segment N+1");
+}
+
+#[test]
+fn reset_prevents_pre_roll_from_leaking_between_segments() {
+    const SEGMENT_N_MARKER: f32 = 777.0;
+    let mut endpoint = VadEndpoint::new();
+    endpoint.pre_roll.push_back(frame(SEGMENT_N_MARKER));
+    endpoint.reset_segment();
+    for _ in 0..VAD_ONSET_FRAMES {
+        endpoint.process_frame(frame(2.0), 0.9, true, true, SILENCE_FLUSH_FRAMES);
+    }
+    let leaked = endpoint
+        .speech_buf
+        .iter()
+        .filter(|sample| **sample == SEGMENT_N_MARKER)
+        .count();
+    assert_eq!(leaked, 0, "segment N pre-roll leaked into segment N+1");
+}
+
+#[test]
+fn held_push_to_talk_never_silence_flushes() {
+    // Pure VAD mode: silence always ends the utterance.
+    assert!(vad_flush_allowed(false, false, false));
+    // Shortcut configured, nothing transmitting: nothing to flush anyway,
+    // but the pause path stays closed.
+    assert!(!vad_flush_allowed(true, false, false));
+    // Shortcut held: "I am not done talking" — never flush on silence,
+    // regardless of the manual mic state.
+    assert!(!vad_flush_allowed(true, false, true));
+    assert!(!vad_flush_allowed(true, true, true));
+    // Manually open mic with the shortcut up: normal VAD behavior.
+    assert!(vad_flush_allowed(true, true, false));
+}
diff --git a/desktop/src-tauri/src/huddle/transcription.rs b/desktop/src-tauri/src/huddle/transcription.rs
index 5962f57cf43..4825d4b8fbd 100644
--- a/desktop/src-tauri/src/huddle/transcription.rs
+++ b/desktop/src-tauri/src/huddle/transcription.rs
@@ -51,7 +51,7 @@ pub async fn set_huddle_transcription_enabled(
             (ephemeral_channel_id, None)
         } else {
             hs.invalidate_transcription_pipeline();
-            (ephemeral_channel_id, hs.stt_pipeline.take())
+            (ephemeral_channel_id, hs.take_stt_pipeline())
         }
     };
 
diff --git a/desktop/src-tauri/src/huddle/tts.rs b/desktop/src-tauri/src/huddle/tts.rs
index 5c6bbc4c777..3f12f883ba7 100644
--- a/desktop/src-tauri/src/huddle/tts.rs
+++ b/desktop/src-tauri/src/huddle/tts.rs
@@ -46,6 +46,7 @@ use std::{
     time::{Duration, Instant},
 };
 
+use super::human_floor::HumanFloor;
 use super::pocket::{
     load_text_to_speech, load_voice_style, DEFAULT_VOICE, SAMPLE_RATE, VOICE_FILE_EXT,
 };
@@ -53,10 +54,11 @@ use super::preprocessing::preprocess_for_tts;
 
 #[path = "tts_voice_transition.rs"]
 mod voice_transition;
+use super::tts_playback::*;
+#[path = "tts_append.rs"]
+mod append;
+use append::*;
 use voice_transition::*;
-#[path = "tts_playback.rs"]
-mod playback;
-use playback::*;
 #[path = "tts_startup.rs"]
 mod startup;
 use startup::await_worker_startup;
@@ -74,6 +76,12 @@ use speaker_cancellation::*;
 #[path = "tts_streaming.rs"]
 mod streaming;
 use streaming::*;
+#[path = "tts_broadcast.rs"]
+mod broadcast;
+use broadcast::TtsBroadcasters;
+pub(crate) use broadcast::{
+    LocalTtsPublisherLease, LocalTtsPublishers, TtsAudioPublisher, TtsBroadcastPacket,
+};
 
 // ── Constants ─────────────────────────────────────────────────────────────────
 
@@ -133,6 +141,7 @@ type WorkerControlState = (
     ActiveSpeaker,
     SpeakerCancellation,
     PlaybackProbe,
+    TtsBroadcasters,
 );
 
 // ── Public pipeline handle ────────────────────────────────────────────────────
@@ -153,6 +162,7 @@ pub struct TtsPipeline {
     /// Kept alive here so the Arc isn't dropped — the worker holds a clone.
     #[allow(dead_code)]
     cancel: Arc<AtomicBool>,
+    human_floor: HumanFloor,
     /// Internal cancellation used only for voice changes. Kept separate so a
     /// concurrent human barge-in always clears every queued message.
     voice_cancel: Arc<AtomicBool>,
@@ -172,6 +182,9 @@ pub struct TtsPipeline {
     playback_probe: PlaybackProbe,
     /// Completed after the worker drains pre-change text and installs the new style.
     voice_change_ack: VoiceChangeAck,
+    /// Agent-authenticated Huddle publishers used to carry synthesized speech
+    /// to remote clients without impersonating the hosting human.
+    broadcasters: TtsBroadcasters,
     /// Worker thread handle — taken on drop to join cleanly.
     thread: Option<thread::JoinHandle<()>>,
 }
@@ -185,6 +198,7 @@ impl TtsPipeline {
         model_dir: PathBuf,
         tts_active: Arc<AtomicBool>,
         cancel: Arc<AtomicBool>,
+        human_floor: HumanFloor,
         voice: &str,
         output_device: Option<String>,
         activity_app: Option<tauri::AppHandle>,
@@ -196,6 +210,7 @@ impl TtsPipeline {
 
         let shutdown_worker = Arc::clone(&shutdown);
         let cancel_worker = Arc::clone(&cancel);
+        let worker_human_floor = human_floor.clone();
         let voice_cancel = Arc::new(AtomicBool::new(false));
         let worker_voice_cancel = Arc::clone(&voice_cancel);
         let tts_active_worker = Arc::clone(&tts_active);
@@ -213,6 +228,8 @@ impl TtsPipeline {
         let worker_playback_probe = playback_probe.clone();
         let voice_change_ack = Arc::new(Mutex::new(None));
         let worker_voice_change_ack = Arc::clone(&voice_change_ack);
+        let broadcasters = TtsBroadcasters::default();
+        let worker_broadcasters = broadcasters.clone();
         let model_dir_worker = model_dir.clone();
         let (startup_tx, startup_rx) = mpsc::sync_channel(1);
 
@@ -227,6 +244,7 @@ impl TtsPipeline {
                         worker_voice_change_ack,
                     ),
                     text_rx,
+                    worker_human_floor,
                     (
                         tts_active_worker,
                         shutdown_worker,
@@ -235,6 +253,7 @@ impl TtsPipeline {
                         worker_active_speaker,
                         worker_speaker_cancel,
                         worker_playback_probe,
+                        worker_broadcasters,
                     ),
                     output_device,
                     activity_app,
@@ -249,6 +268,7 @@ impl TtsPipeline {
             tts_active,
             shutdown,
             cancel,
+            human_floor,
             voice_cancel,
             voice,
             voice_generation,
@@ -257,6 +277,7 @@ impl TtsPipeline {
             speaker_cancel,
             playback_probe,
             voice_change_ack,
+            broadcasters,
             thread: Some(handle),
         })
     }
@@ -265,6 +286,7 @@ impl TtsPipeline {
 impl Drop for TtsPipeline {
     fn drop(&mut self) {
         self.shutdown.store(true, Ordering::Release);
+        self.broadcasters.shutdown();
         // Dropping `text_tx` unblocks the worker's recv_timeout loop.
         // Join to ensure the audio thread exits cleanly.
         if let Some(thread) = self.thread.take() {
@@ -275,10 +297,33 @@ impl Drop for TtsPipeline {
 
 // ── Worker thread ─────────────────────────────────────────────────────────────
 
+fn authorize_or_defer_queued_text(
+    human_floor: &HumanFloor,
+    deferred_text: &mut VecDeque<QueuedText>,
+    queued_text: QueuedText,
+) -> Result<QueuedText, HumanFloorAuthorization> {
+    match human_floor.authorization(queued_text.floor_epoch) {
+        HumanFloorAuthorization::Blocked => {
+            deferred_text.push_front(queued_text);
+            Err(HumanFloorAuthorization::Blocked)
+        }
+        HumanFloorAuthorization::Stale => {
+            eprintln!(
+                "buzz-desktop: tts stage=queue status=dropped reason=barge_in route_id={}",
+                queued_text.route_id
+            );
+            Err(HumanFloorAuthorization::Stale)
+        }
+        HumanFloorAuthorization::Permitted => Ok(queued_text),
+    }
+}
+
+#[allow(clippy::too_many_arguments)]
 fn tts_worker(
     model_dir: PathBuf,
     voice_state: WorkerVoiceState,
     text_rx: mpsc::Receiver<QueuedText>,
+    human_floor: HumanFloor,
     control_state: WorkerControlState,
     output_device: Option<String>,
     activity_app: Option<tauri::AppHandle>,
@@ -293,6 +338,7 @@ fn tts_worker(
         active_speaker,
         speaker_cancel,
         playback_probe,
+        broadcasters,
     ) = control_state;
     let (cancel, voice_cancel) = cancel_signals;
     // ── 1. Initialise TTS engine ──────────────────────────────────────────────
@@ -377,10 +423,11 @@ fn tts_worker(
         }
     };
 
-    // One coordinator owns the current Player and every operation on it.
-    // Cancellation replaces its queue while the output stream and mixer stay
-    // alive, preserving cross-item pipelining without exposing Player handles.
-    let playback = Arc::new(PlaybackCoordinator::new(sink_handle.mixer()));
+    // One coordinator owns the current Player, floor state, and every operation.
+    // It was allocated with the huddle state so onset and playback share the
+    // same serialization boundary even before the TTS worker starts.
+    let playback = human_floor.playback();
+    playback.bind_mixer(sink_handle.mixer());
     playback_probe.install(Arc::clone(&playback));
 
     // Prime the audio output stream with a short silent buffer.
@@ -421,6 +468,7 @@ fn tts_worker(
         activity_frames: Arc::clone(&activity_frames),
         active_speaker: Arc::clone(&active_speaker),
         speaker_cancel: Arc::clone(&speaker_cancel),
+        broadcasters: broadcasters.clone(),
         activity_app,
     });
     if let Err(ref e) = monitor {
@@ -442,76 +490,40 @@ fn tts_worker(
     let tts_streaming = streaming_emit_frames();
     let mut last_route_id = 0;
     let mut deferred_text = VecDeque::new();
+    let append_context = TtsAppendContext {
+        playback: &playback,
+        #[cfg(test)]
+        human_floor: &human_floor,
+        cancel: &cancel,
+        voice_cancel: &voice_cancel,
+        shutdown: &shutdown,
+        tts_active: &tts_active,
+        speaker_generations: &speaker_generations,
+        active_speaker: &active_speaker,
+        activity_frames: &activity_frames,
+        broadcasters: &broadcasters,
+        channels,
+        rate,
+    };
     let append_audio = |prepared: PreparedModelAudio,
                         route_id: u64,
                         speaker_pubkey: Option<&str>,
-                        speaker_generation: u64| {
-        let sample_count = prepared.sample_count;
-        let chunk_index = prepared.chunk_index;
-        let activity = speaker_pubkey.map(|pubkey| {
-            build_tts_speaker_activity_frames(&prepared.buffer, pubkey, SAMPLE_RATE as usize)
-        });
-        let accepted = playback.append_if(
-            SamplesBuffer::new(channels, rate, prepared.buffer),
-            |player_empty| {
-                if cancel.load(Ordering::Acquire)
-                    || voice_cancel.load(Ordering::Acquire)
-                    || shutdown.load(Ordering::Acquire)
-                {
-                    let reason = if shutdown.load(Ordering::Acquire) {
-                        "shutdown"
-                    } else if cancel.load(Ordering::Acquire) {
-                        "barge_in"
-                    } else {
-                        "voice_switch"
-                    };
-                    eprintln!(
-                        "buzz-desktop: tts stage=synthesis status=cancelled reason={reason} route_id={route_id}"
-                    );
-                    return false;
+                        speaker_generation: u64,
+                        floor_epoch: u64| {
+        let broadcast_samples = speaker_pubkey.map(|_| prepared.buffer.clone());
+        append_worker_audio(
+            &append_context,
+            prepared,
+            route_id,
+            speaker_pubkey,
+            speaker_generation,
+            floor_epoch,
+            || {
+                if let (Some(pubkey), Some(samples)) = (speaker_pubkey, broadcast_samples) {
+                    broadcasters.publish(pubkey, speaker_generation, samples);
                 }
-                if speaker_pubkey.is_some_and(|pubkey| {
-                    current_speaker_generation(&speaker_generations, pubkey) != speaker_generation
-                }) {
-                    eprintln!(
-                        "buzz-desktop: tts stage=synthesis status=cancelled reason=speaker_removed route_id={route_id}"
-                    );
-                    return false;
-                }
-                if let Some(pubkey) = speaker_pubkey {
-                    let mut active = active_speaker
-                        .lock()
-                        .unwrap_or_else(|error| error.into_inner());
-                    if player_empty {
-                        active.take();
-                    }
-                    if active
-                        .as_deref()
-                        .is_some_and(|current| !current.eq_ignore_ascii_case(pubkey))
-                    {
-                        return false;
-                    }
-                    active.get_or_insert_with(|| pubkey.to_ascii_lowercase());
-                    activity_frames
-                        .lock()
-                        .unwrap_or_else(|error| error.into_inner())
-                        .extend(activity.unwrap_or_default());
-                }
-                true
             },
-            // Publish activity under the coordinator: an append and the mic
-            // gate it implies are one transition, so a cancellation that
-            // replaces this player cannot have its release overwritten by a
-            // `true` landing after the fact.
-            || tts_active.store(true, Ordering::Release),
-        );
-        if !accepted {
-            return false;
-        }
-        eprintln!(
-            "buzz-desktop: tts stage=player status=append_accepted route_id={route_id} chunk_index={chunk_index} sample_count={sample_count}"
-        );
-        true
+        )
     };
 
     loop {
@@ -526,6 +538,12 @@ fn tts_worker(
         ) {
             continue;
         }
+        if cancel.load(Ordering::Acquire)
+            || voice_cancel.load(Ordering::Acquire)
+            || shutdown.load(Ordering::Acquire)
+        {
+            broadcasters.cancel_all();
+        }
         if handle_cancel_or_shutdown(
             (&cancel, &voice_cancel),
             &shutdown,
@@ -585,6 +603,12 @@ fn tts_worker(
         // Check cancel again after unblocking — a cancel may have arrived
         // while we were waiting.
         let pending_route_id = queued_text.as_ref().map(|queued| queued.route_id);
+        if cancel.load(Ordering::Acquire)
+            || voice_cancel.load(Ordering::Acquire)
+            || shutdown.load(Ordering::Acquire)
+        {
+            broadcasters.cancel_all();
+        }
         if handle_cancel_or_shutdown(
             (&cancel, &voice_cancel),
             &shutdown,
@@ -632,7 +656,19 @@ fn tts_worker(
             thread::sleep(RECV_TIMEOUT);
             continue;
         }
-        let requested_voice = queued_text.voice_reference.unwrap_or_else(|| {
+        let mut queued_text =
+            match authorize_or_defer_queued_text(&human_floor, &mut deferred_text, queued_text) {
+                Ok(queued_text) => queued_text,
+                Err(HumanFloorAuthorization::Blocked) => {
+                    thread::sleep(RECV_TIMEOUT);
+                    continue;
+                }
+                Err(HumanFloorAuthorization::Stale) => continue,
+                Err(HumanFloorAuthorization::Permitted) => {
+                    unreachable!("permitted text is returned")
+                }
+            };
+        let requested_voice = queued_text.voice_reference.take().unwrap_or_else(|| {
             selected_voice
                 .lock()
                 .unwrap_or_else(|error| error.into_inner())
@@ -641,6 +677,7 @@ fn tts_worker(
         let raw_text = queued_text.text;
         let speaker_pubkey = queued_text.speaker_pubkey;
         let speaker_generation = queued_text.speaker_generation;
+        let floor_epoch = queued_text.floor_epoch;
         let route_id = queued_text.route_id;
         eprintln!("buzz-desktop: tts stage=synthesis status=started route_id={route_id}");
 
@@ -714,6 +751,12 @@ fn tts_worker(
         let mut model_unit_index = 0_usize;
         'playback_chunks: for chunk in &chunks {
             let mut no_current_text = None;
+            if cancel.load(Ordering::Acquire)
+                || voice_cancel.load(Ordering::Acquire)
+                || shutdown.load(Ordering::Acquire)
+            {
+                broadcasters.cancel_all();
+            }
             if handle_cancel_or_shutdown(
                 (&cancel, &voice_cancel),
                 &shutdown,
@@ -751,6 +794,7 @@ fn tts_worker(
                             route_id,
                             speaker_pubkey.as_deref(),
                             speaker_generation,
+                            floor_epoch,
                         ) {
                             return false;
                         }
@@ -787,6 +831,12 @@ fn tts_worker(
                 let chunk_index = model_unit_index;
                 model_unit_index += 1;
                 let mut no_current_text = None;
+                if cancel.load(Ordering::Acquire)
+                    || voice_cancel.load(Ordering::Acquire)
+                    || shutdown.load(Ordering::Acquire)
+                {
+                    broadcasters.cancel_all();
+                }
                 if handle_cancel_or_shutdown(
                     (&cancel, &voice_cancel),
                     &shutdown,
@@ -832,6 +882,7 @@ fn tts_worker(
                                 route_id,
                                 speaker_pubkey.as_deref(),
                                 speaker_generation,
+                                floor_epoch,
                             ) {
                                 synthesis_outcome = "cancelled";
                                 break 'playback_chunks;
@@ -860,6 +911,7 @@ fn tts_worker(
                     route_id,
                     speaker_pubkey.as_deref(),
                     speaker_generation,
+                    floor_epoch,
                 ) {
                     synthesis_outcome = "cancelled";
                     break 'playback_chunks;
diff --git a/desktop/src-tauri/src/huddle/tts_append.rs b/desktop/src-tauri/src/huddle/tts_append.rs
new file mode 100644
index 00000000000..274c806c95e
--- /dev/null
+++ b/desktop/src-tauri/src/huddle/tts_append.rs
@@ -0,0 +1,107 @@
+//! Commits synthesized audio to local playback and remote broadcast atomically.
+
+use super::*;
+
+pub(super) struct TtsAppendContext<'a> {
+    pub(super) playback: &'a PlaybackCoordinator,
+    #[cfg(test)]
+    pub(super) human_floor: &'a HumanFloor,
+    pub(super) cancel: &'a AtomicBool,
+    pub(super) voice_cancel: &'a AtomicBool,
+    pub(super) shutdown: &'a AtomicBool,
+    pub(super) tts_active: &'a AtomicBool,
+    pub(super) speaker_generations: &'a SpeakerGenerations,
+    pub(super) active_speaker: &'a ActiveSpeaker,
+    pub(super) activity_frames: &'a Mutex<VecDeque<TtsSpeakerActivityFrame>>,
+    pub(super) broadcasters: &'a TtsBroadcasters,
+    pub(super) channels: NonZero<u16>,
+    pub(super) rate: NonZero<u32>,
+}
+
+pub(super) fn append_worker_audio(
+    context: &TtsAppendContext<'_>,
+    prepared: PreparedModelAudio,
+    route_id: u64,
+    speaker_pubkey: Option<&str>,
+    speaker_generation: u64,
+    floor_epoch: u64,
+    publish_broadcast: impl FnOnce(),
+) -> bool {
+    // Keep the shared floor in this context so the regression can mutation-check
+    // that authorization never moves back inside the coordinator callback.
+    #[cfg(test)]
+    let _ = context.human_floor;
+    let sample_count = prepared.sample_count;
+    let chunk_index = prepared.chunk_index;
+    let activity = speaker_pubkey.map(|pubkey| {
+        build_tts_speaker_activity_frames(&prepared.buffer, pubkey, SAMPLE_RATE as usize)
+    });
+    let floor_authorization = context.playback.append_if_human_floor_permits(
+        rodio::buffer::SamplesBuffer::new(context.channels, context.rate, prepared.buffer),
+        floor_epoch,
+        |player_empty| {
+            if context.cancel.load(Ordering::Acquire)
+                || context.voice_cancel.load(Ordering::Acquire)
+                || context.shutdown.load(Ordering::Acquire)
+            {
+                context.broadcasters.cancel_all();
+                let reason = if context.shutdown.load(Ordering::Acquire) {
+                    "shutdown"
+                } else if context.cancel.load(Ordering::Acquire) {
+                    "barge_in"
+                } else {
+                    "voice_switch"
+                };
+                eprintln!(
+                    "buzz-desktop: tts stage=synthesis status=cancelled reason={reason} route_id={route_id}"
+                );
+                return false;
+            }
+            if speaker_pubkey.is_some_and(|pubkey| {
+                current_speaker_generation(context.speaker_generations, pubkey)
+                    != speaker_generation
+            }) {
+                eprintln!(
+                    "buzz-desktop: tts stage=synthesis status=cancelled reason=speaker_removed route_id={route_id}"
+                );
+                return false;
+            }
+            if let Some(pubkey) = speaker_pubkey {
+                let mut active = context
+                    .active_speaker
+                    .lock()
+                    .unwrap_or_else(|error| error.into_inner());
+                if player_empty {
+                    active.take();
+                }
+                if active
+                    .as_deref()
+                    .is_some_and(|current| !current.eq_ignore_ascii_case(pubkey))
+                {
+                    return false;
+                }
+                active.get_or_insert_with(|| pubkey.to_ascii_lowercase());
+                context
+                    .activity_frames
+                    .lock()
+                    .unwrap_or_else(|error| error.into_inner())
+                    .extend(activity.unwrap_or_default());
+            }
+            true
+        },
+        // Commit local and published activity under the same playback lock.
+        // A concurrent floor onset/cancel therefore cannot invalidate the
+        // player and then let this remote packet escape afterward.
+        || {
+            publish_broadcast();
+            context.tts_active.store(true, Ordering::Release);
+        },
+    );
+    if floor_authorization != HumanFloorAuthorization::Permitted {
+        return false;
+    }
+    eprintln!(
+        "buzz-desktop: tts stage=player status=append_accepted route_id={route_id} chunk_index={chunk_index} sample_count={sample_count}"
+    );
+    true
+}
diff --git a/desktop/src-tauri/src/huddle/tts_broadcast.rs b/desktop/src-tauri/src/huddle/tts_broadcast.rs
new file mode 100644
index 00000000000..ea8507d4b65
--- /dev/null
+++ b/desktop/src-tauri/src/huddle/tts_broadcast.rs
@@ -0,0 +1,270 @@
+//! Huddle-audio publishing handles for locally synthesized agent speech.
+//!
+//! The relay socket itself lives in `relay_api`; this module owns the small,
+//! synchronous seam the TTS worker needs. Each publisher is authenticated as
+//! the agent whose speech it carries, so the existing peer-index roster keeps
+//! remote playback attributed to the agent instead of the hosting human.
+
+use std::collections::HashMap;
+use std::sync::{
+    atomic::{AtomicU64, Ordering},
+    Arc, Mutex,
+};
+
+use tokio::sync::mpsc;
+use tokio_util::sync::CancellationToken;
+
+/// One prepared Pocket-TTS buffer, still at the model's native 24 kHz rate.
+#[derive(Debug)]
+pub(crate) struct TtsBroadcastPacket {
+    pub(crate) epoch: u64,
+    pub(crate) speaker_generation: u64,
+    pub(crate) samples_24k: Vec<f32>,
+}
+
+/// `peer_index -> active local publisher count` for sockets publishing Pocket
+/// TTS synthesized by this desktop.
+pub(crate) type LocalTtsPublishers = Arc<Mutex<HashMap<u8, usize>>>;
+
+/// A live registration for one locally synthesized publisher socket. The lease
+/// is owned by the socket task, so receive-side suppression ends immediately
+/// when that socket exits even if its command handle has not been replaced yet.
+pub(crate) struct LocalTtsPublisherLease {
+    peer_index: u8,
+    local_publishers: LocalTtsPublishers,
+}
+
+impl LocalTtsPublisherLease {
+    pub(crate) fn new(peer_index: u8, local_publishers: LocalTtsPublishers) -> Self {
+        *local_publishers
+            .lock()
+            .unwrap_or_else(|error| error.into_inner())
+            .entry(peer_index)
+            .or_default() += 1;
+        Self {
+            peer_index,
+            local_publishers,
+        }
+    }
+}
+
+impl Drop for LocalTtsPublisherLease {
+    fn drop(&mut self) {
+        let mut local_publishers = self
+            .local_publishers
+            .lock()
+            .unwrap_or_else(|error| error.into_inner());
+        let Some(count) = local_publishers.get_mut(&self.peer_index) else {
+            return;
+        };
+        *count -= 1;
+        if *count == 0 {
+            local_publishers.remove(&self.peer_index);
+        }
+    }
+}
+
+/// A live, agent-authenticated audio publisher.
+#[derive(Debug)]
+pub(crate) struct TtsAudioPublisher {
+    tx: mpsc::Sender<TtsBroadcastPacket>,
+    cancel: CancellationToken,
+    epoch: Arc<AtomicU64>,
+    speaker_generation: Arc<AtomicU64>,
+}
+
+impl TtsAudioPublisher {
+    pub(crate) fn new(tx: mpsc::Sender<TtsBroadcastPacket>, cancel: CancellationToken) -> Self {
+        Self {
+            tx,
+            cancel,
+            epoch: Arc::new(AtomicU64::new(0)),
+            speaker_generation: Arc::new(AtomicU64::new(0)),
+        }
+    }
+
+    pub(crate) fn version_state(&self) -> (Arc<AtomicU64>, Arc<AtomicU64>) {
+        (
+            Arc::clone(&self.epoch),
+            Arc::clone(&self.speaker_generation),
+        )
+    }
+
+    fn set_speaker_generation(&self, generation: u64) {
+        self.speaker_generation.store(generation, Ordering::Release);
+    }
+
+    fn is_closed(&self) -> bool {
+        self.cancel.is_cancelled() || self.tx.is_closed()
+    }
+
+    fn publish(&self, speaker_generation: u64, samples_24k: Vec<f32>) {
+        if speaker_generation != self.speaker_generation.load(Ordering::Acquire) {
+            return;
+        }
+        let packet = TtsBroadcastPacket {
+            epoch: self.epoch.load(Ordering::Acquire),
+            speaker_generation,
+            samples_24k,
+        };
+        if let Err(error) = self.tx.try_send(packet) {
+            eprintln!(
+                "buzz-desktop: tts broadcast status=dropped reason=publisher_backpressure error={error}"
+            );
+        }
+    }
+
+    fn cancel_pending(&self) {
+        self.epoch.fetch_add(1, Ordering::AcqRel);
+    }
+
+    fn shutdown(&self) {
+        self.cancel.cancel();
+    }
+}
+
+/// Thread-safe registry shared by the TTS worker, cancellation monitor, and
+/// async command path that establishes publishers before speech is queued.
+#[derive(Clone, Debug, Default)]
+pub(super) struct TtsBroadcasters {
+    publishers: Arc<Mutex<HashMap<String, TtsAudioPublisher>>>,
+}
+
+impl TtsBroadcasters {
+    pub(super) fn contains(&self, speaker_pubkey: &str) -> bool {
+        self.publishers
+            .lock()
+            .unwrap_or_else(|error| error.into_inner())
+            .get(&speaker_pubkey.to_ascii_lowercase())
+            .is_some_and(|publisher| !publisher.is_closed())
+    }
+
+    pub(super) fn register(
+        &self,
+        speaker_pubkey: &str,
+        publisher: TtsAudioPublisher,
+        speaker_generation: u64,
+    ) {
+        publisher.set_speaker_generation(speaker_generation);
+        let replaced = self
+            .publishers
+            .lock()
+            .unwrap_or_else(|error| error.into_inner())
+            .insert(speaker_pubkey.to_ascii_lowercase(), publisher);
+        if let Some(replaced) = replaced {
+            replaced.shutdown();
+        }
+    }
+
+    pub(super) fn publish(
+        &self,
+        speaker_pubkey: &str,
+        speaker_generation: u64,
+        samples_24k: Vec<f32>,
+    ) {
+        let publishers = self
+            .publishers
+            .lock()
+            .unwrap_or_else(|error| error.into_inner());
+        if let Some(publisher) = publishers.get(&speaker_pubkey.to_ascii_lowercase()) {
+            publisher.publish(speaker_generation, samples_24k);
+        }
+    }
+
+    pub(super) fn cancel_speaker(&self, speaker_pubkey: &str, speaker_generation: u64) {
+        let publishers = self
+            .publishers
+            .lock()
+            .unwrap_or_else(|error| error.into_inner());
+        if let Some(publisher) = publishers.get(&speaker_pubkey.to_ascii_lowercase()) {
+            publisher.set_speaker_generation(speaker_generation);
+            publisher.cancel_pending();
+        }
+    }
+
+    pub(super) fn remove_speaker(&self, speaker_pubkey: &str) {
+        let removed = self
+            .publishers
+            .lock()
+            .unwrap_or_else(|error| error.into_inner())
+            .remove(&speaker_pubkey.to_ascii_lowercase());
+        if let Some(removed) = removed {
+            removed.shutdown();
+        }
+    }
+
+    pub(super) fn cancel_all(&self) {
+        for publisher in self
+            .publishers
+            .lock()
+            .unwrap_or_else(|error| error.into_inner())
+            .values()
+        {
+            publisher.cancel_pending();
+        }
+    }
+
+    pub(super) fn shutdown(&self) {
+        let mut publishers = self
+            .publishers
+            .lock()
+            .unwrap_or_else(|error| error.into_inner());
+        for publisher in publishers.values() {
+            publisher.shutdown();
+        }
+        publishers.clear();
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn publisher_lifetime_tracks_local_synthesis_without_replacement_gaps() {
+        let local_publishers = LocalTtsPublishers::default();
+        let first = LocalTtsPublisherLease::new(3, Arc::clone(&local_publishers));
+        assert_eq!(
+            local_publishers.lock().expect("local publishers").get(&3),
+            Some(&1)
+        );
+
+        let replacement = LocalTtsPublisherLease::new(3, Arc::clone(&local_publishers));
+        drop(first);
+        assert_eq!(
+            local_publishers.lock().expect("local publishers").get(&3),
+            Some(&1),
+            "dropping a replaced socket must not expose its live replacement"
+        );
+
+        drop(replacement);
+        assert!(local_publishers
+            .lock()
+            .expect("local publishers")
+            .is_empty());
+    }
+
+    #[test]
+    fn cancellation_invalidates_queued_packet_versions() {
+        let (tx, mut rx) = mpsc::channel(2);
+        let publisher = TtsAudioPublisher::new(tx, CancellationToken::new());
+        let (epoch, generation) = publisher.version_state();
+        publisher.set_speaker_generation(4);
+
+        publisher.publish(4, vec![0.25]);
+        let queued = rx.try_recv().expect("queued audio");
+        assert_eq!(queued.epoch, 0);
+        assert_eq!(queued.speaker_generation, 4);
+
+        publisher.cancel_pending();
+        assert_ne!(queued.epoch, epoch.load(Ordering::Acquire));
+
+        publisher.set_speaker_generation(5);
+        publisher.publish(4, vec![0.5]);
+        assert!(
+            rx.try_recv().is_err(),
+            "stale speaker audio must be dropped"
+        );
+        assert_eq!(generation.load(Ordering::Acquire), 5);
+    }
+}
diff --git a/desktop/src-tauri/src/huddle/tts_pipeline_controls.rs b/desktop/src-tauri/src/huddle/tts_pipeline_controls.rs
index 0ee472f0fd1..2737de94959 100644
--- a/desktop/src-tauri/src/huddle/tts_pipeline_controls.rs
+++ b/desktop/src-tauri/src/huddle/tts_pipeline_controls.rs
@@ -1,14 +1,32 @@
 use super::*;
 
 impl TtsPipeline {
+    pub(crate) fn has_audio_publisher(&self, speaker_pubkey: &str) -> bool {
+        self.broadcasters.contains(speaker_pubkey)
+    }
+
+    pub(crate) fn register_audio_publisher(
+        &self,
+        speaker_pubkey: &str,
+        publisher: TtsAudioPublisher,
+    ) {
+        self.broadcasters.register(
+            speaker_pubkey,
+            publisher,
+            current_speaker_generation(&self.speaker_generations, speaker_pubkey),
+        );
+    }
+
     /// Queue `text` for TTS synthesis and playback.
     ///
     /// Non-blocking. Returns `Err` if the queue is full (bounded at
     /// `TEXT_QUEUE_DEPTH`) — caller may log and discard.
     pub fn speak(&self, text: String) -> Result<(), String> {
+        let floor_epoch = self.human_floor.epoch();
         self.text_tx
             .try_send(QueuedText {
                 generation: self.voice_generation.load(Ordering::Acquire),
+                floor_epoch,
                 route_id: 0,
                 speaker_pubkey: None,
                 speaker_generation: 0,
@@ -28,6 +46,7 @@ impl TtsPipeline {
         TtsTextSender {
             text_tx: self.text_tx.clone(),
             generation: self.voice_generation.load(Ordering::Acquire),
+            human_floor: self.human_floor.clone(),
             speaker_generations: Arc::clone(&self.speaker_generations),
         }
     }
@@ -41,6 +60,7 @@ impl TtsPipeline {
             &self.speaker_cancel,
             speaker_pubkey,
         );
+        self.broadcasters.remove_speaker(speaker_pubkey);
     }
 
     /// Cancel exactly the speaker utterance currently owning playback.
@@ -49,13 +69,20 @@ impl TtsPipeline {
     /// stale Stop click cannot cancel a later utterance that starts after the
     /// observed one drains.
     pub(crate) fn cancel_active_speaker(&self, expected_speaker_pubkey: &str) -> bool {
-        request_active_speaker_cancel(
+        let cancelled = request_active_speaker_cancel(
             &self.speaker_generations,
             &self.active_speaker,
             &self.speaker_cancel,
             &self.playback_probe,
             expected_speaker_pubkey,
-        )
+        );
+        if cancelled {
+            self.broadcasters.cancel_speaker(
+                expected_speaker_pubkey,
+                current_speaker_generation(&self.speaker_generations, expected_speaker_pubkey),
+            );
+        }
+        cancelled
     }
 
     /// Select a bundled Pocket voice for subsequent speech.
@@ -72,6 +99,7 @@ impl TtsPipeline {
             voice,
         );
         if acknowledged.is_some() {
+            self.broadcasters.cancel_all();
             eprintln!("buzz-desktop: tts stage=cancellation reason=voice_switch route_id=0");
         }
         acknowledged
@@ -89,6 +117,7 @@ impl TtsPipeline {
     /// Signal the worker thread to stop.
     pub fn shutdown(&self) {
         eprintln!("buzz-desktop: tts stage=cancellation reason=shutdown route_id=0");
+        self.broadcasters.shutdown();
         self.shutdown.store(true, Ordering::Release);
     }
 
diff --git a/desktop/src-tauri/src/huddle/tts_playback.rs b/desktop/src-tauri/src/huddle/tts_playback.rs
index 93a5b16b8c8..8a90c018994 100644
--- a/desktop/src-tauri/src/huddle/tts_playback.rs
+++ b/desktop/src-tauri/src/huddle/tts_playback.rs
@@ -1,7 +1,17 @@
-use std::sync::{Arc, Mutex, MutexGuard, PoisonError};
+use std::{
+    collections::HashSet,
+    sync::{Arc, Mutex, MutexGuard, PoisonError},
+    time::{Duration, Instant},
+};
 
 use rodio::{mixer::Mixer, Player, Source};
 
+/// Conservative guard after rodio reports drained. Max measured about 12 ms
+/// of cancellation tail on current-main CoreAudio and about 1 ms after player
+/// replacement; 100 ms safely bounds those observed paths while the phase-1
+/// route matrix determines whether this can be narrowed.
+const OUTPUT_TAIL_HANGOVER: Duration = Duration::from_millis(100);
+
 /// Serializes every operation on the TTS player and owns the utterance-boundary
 /// bookkeeping that must change atomically when playback is replaced.
 ///
@@ -10,18 +20,62 @@ use rodio::{mixer::Mixer, Player, Source};
 /// independently valid at either value, and no mutable reference to the state
 /// leaves the locked operation that created it.
 pub(super) struct PlaybackCoordinator {
-    mixer: Mixer,
+    mixer: Mutex<Option<Mixer>>,
     state: Mutex<PlaybackState>,
 }
 
 struct PlaybackState {
-    player: Player,
+    player: Option<Player>,
     /// `true` while no append has been committed since the last utterance
     /// boundary. Only `append_if` clears it, so it records appends that were
     /// actually queued — never one the authorization refused.
     first_append: bool,
     synthesis_in_flight: bool,
     synthesis_generation: u64,
+    output_lease: OutputLease,
+    human_floor: HumanFloorState,
+}
+
+#[derive(Default)]
+enum OutputLease {
+    #[default]
+    Inactive,
+    Active,
+    HangoverUntil(Instant),
+}
+
+impl OutputLease {
+    fn is_live_at(&mut self, now: Instant) -> bool {
+        match self {
+            Self::Inactive => false,
+            Self::Active => true,
+            Self::HangoverUntil(deadline) if now < *deadline => true,
+            Self::HangoverUntil(_) => {
+                *self = Self::Inactive;
+                false
+            }
+        }
+    }
+
+    fn begin_hangover(&mut self, now: Instant) {
+        if !matches!(self, Self::Inactive) {
+            *self = Self::HangoverUntil(now + OUTPUT_TAIL_HANGOVER);
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(super) enum HumanFloorAuthorization {
+    Permitted,
+    Blocked,
+    Stale,
+}
+
+#[derive(Default)]
+struct HumanFloorState {
+    epoch: u64,
+    local: bool,
+    remote: HashSet<u8>,
 }
 
 pub(super) struct SynthesisFlightGuard {
@@ -39,18 +93,35 @@ impl Drop for SynthesisFlightGuard {
 }
 
 impl PlaybackCoordinator {
+    #[cfg(test)]
     pub(super) fn new(mixer: &Mixer) -> Self {
+        let coordinator = Self::unbound();
+        coordinator.bind_mixer(mixer);
+        coordinator
+    }
+
+    pub(super) fn unbound() -> Self {
         Self {
-            mixer: mixer.clone(),
+            mixer: Mutex::new(None),
             state: Mutex::new(PlaybackState {
-                player: Player::connect_new(mixer),
+                player: None,
                 first_append: true,
                 synthesis_in_flight: false,
                 synthesis_generation: 0,
+                output_lease: OutputLease::Inactive,
+                human_floor: HumanFloorState::default(),
             }),
         }
     }
 
+    pub(super) fn bind_mixer(&self, mixer: &Mixer) {
+        *self.mixer.lock().unwrap_or_else(PoisonError::into_inner) = Some(mixer.clone());
+        let mut state = self.lock();
+        if state.player.is_none() {
+            state.player = Some(Player::connect_new(mixer));
+        }
+    }
+
     fn lock(&self) -> MutexGuard<'_, PlaybackState> {
         self.state.lock().unwrap_or_else(PoisonError::into_inner)
     }
@@ -61,6 +132,7 @@ impl PlaybackCoordinator {
     /// concurrent cancellation either replaces the queue before this append is
     /// authorized, or observes the committed state after it — never lands its
     /// own release between the two and gets overwritten.
+    #[cfg(test)]
     pub(super) fn append_if<S>(
         &self,
         source: S,
@@ -71,11 +143,15 @@ impl PlaybackCoordinator {
         S: Source<Item = f32> + Send + 'static,
     {
         let mut state = self.lock();
-        if !authorize(state.player.empty()) {
+        if !authorize(state.player.as_ref().is_none_or(Player::empty)) {
             return false;
         }
-        state.player.append(source);
+        let Some(player) = state.player.as_ref() else {
+            return false;
+        };
+        player.append(source);
         state.first_append = false;
+        state.output_lease = OutputLease::Active;
         commit();
         true
     }
@@ -84,28 +160,31 @@ impl PlaybackCoordinator {
     where
         S: Source<Item = f32> + Send + 'static,
     {
-        self.lock().player.append(source);
+        if let Some(player) = self.lock().player.as_ref() {
+            player.append(source);
+        }
     }
 
     pub(super) fn empty(&self) -> bool {
-        self.lock().player.empty()
+        self.lock().player.as_ref().is_none_or(Player::empty)
     }
 
     /// Observe playback emptiness under the coordinator so the onset decision
     /// for the audio being built is serialized with append and cancellation.
     pub(super) fn prepare_audio<R>(&self, prepare: impl FnOnce(bool) -> R) -> R {
         let state = self.lock();
-        let empty = state.player.empty();
+        let empty = state.player.as_ref().is_none_or(Player::empty);
         prepare(empty)
     }
 
     pub(super) fn release_if_drained(&self, release: impl FnOnce()) -> bool {
         let mut state = self.lock();
-        if !state.player.empty() || state.first_append {
+        if !state.player.as_ref().is_none_or(Player::empty) || state.first_append {
             return false;
         }
         release();
         state.first_append = true;
+        state.output_lease.begin_hangover(Instant::now());
         true
     }
 
@@ -124,7 +203,7 @@ impl PlaybackCoordinator {
 
     pub(super) fn with_playback_live<R>(&self, observe: impl FnOnce(bool) -> R) -> R {
         let state = self.lock();
-        observe(!state.player.empty() || state.synthesis_in_flight)
+        observe(!state.player.as_ref().is_none_or(Player::empty) || state.synthesis_in_flight)
     }
 
     /// Replace live playback with a fresh queue, publishing the replacement
@@ -142,21 +221,162 @@ impl PlaybackCoordinator {
         authorize: impl FnOnce() -> bool,
         commit: impl FnOnce(),
     ) -> bool {
+        let replacement = self
+            .mixer
+            .lock()
+            .unwrap_or_else(PoisonError::into_inner)
+            .as_ref()
+            .map(Player::connect_new);
         let old_player = {
             let mut state = self.lock();
-            if (state.player.empty() && !state.synthesis_in_flight) || !authorize() {
+            if (state.player.as_ref().is_none_or(Player::empty) && !state.synthesis_in_flight)
+                || !authorize()
+            {
                 return false;
             }
             state.first_append = true;
             state.synthesis_in_flight = false;
             state.synthesis_generation = state.synthesis_generation.wrapping_add(1);
-            let old_player = std::mem::replace(&mut state.player, Player::connect_new(&self.mixer));
+            state.output_lease.begin_hangover(Instant::now());
+            let old_player = std::mem::replace(&mut state.player, replacement);
             commit();
             old_player
         };
         drop(old_player);
         true
     }
+
+    #[cfg(test)]
+    pub(super) fn human_floor_blocked(&self) -> bool {
+        let state = self.lock();
+        state.human_floor.local || !state.human_floor.remote.is_empty()
+    }
+
+    pub(super) fn human_floor_epoch(&self) -> u64 {
+        self.lock().human_floor.epoch
+    }
+
+    pub(super) fn human_floor_authorization(&self, epoch: u64) -> HumanFloorAuthorization {
+        Self::human_floor_authorization_locked(&self.lock(), epoch)
+    }
+
+    fn human_floor_authorization_locked(
+        state: &PlaybackState,
+        epoch: u64,
+    ) -> HumanFloorAuthorization {
+        if state.human_floor.local || !state.human_floor.remote.is_empty() {
+            HumanFloorAuthorization::Blocked
+        } else if state.human_floor.epoch != epoch {
+            HumanFloorAuthorization::Stale
+        } else {
+            HumanFloorAuthorization::Permitted
+        }
+    }
+
+    #[cfg(test)]
+    pub(super) fn human_floor_permits(&self, epoch: u64) -> bool {
+        self.human_floor_authorization(epoch) == HumanFloorAuthorization::Permitted
+    }
+
+    pub(super) fn append_if_human_floor_permits<S>(
+        &self,
+        source: S,
+        epoch: u64,
+        authorize: impl FnOnce(bool) -> bool,
+        commit: impl FnOnce(),
+    ) -> HumanFloorAuthorization
+    where
+        S: Source<Item = f32> + Send + 'static,
+    {
+        let mut state = self.lock();
+        let floor_authorization = Self::human_floor_authorization_locked(&state, epoch);
+        if floor_authorization != HumanFloorAuthorization::Permitted {
+            return floor_authorization;
+        }
+        if !authorize(state.player.as_ref().is_none_or(Player::empty)) {
+            return HumanFloorAuthorization::Stale;
+        }
+        let Some(player) = state.player.as_ref() else {
+            return HumanFloorAuthorization::Stale;
+        };
+        player.append(source);
+        state.first_append = false;
+        state.output_lease = OutputLease::Active;
+        commit();
+        HumanFloorAuthorization::Permitted
+    }
+
+    pub(super) fn enter_local_human_floor(
+        &self,
+        route_isolated: bool,
+        sustained_coupled_speech: bool,
+    ) -> bool {
+        let replacement = self
+            .mixer
+            .lock()
+            .unwrap_or_else(PoisonError::into_inner)
+            .as_ref()
+            .map(Player::connect_new);
+        let old_player = {
+            let mut state = self.lock();
+            let output_live =
+                state.synthesis_in_flight || state.output_lease.is_live_at(Instant::now());
+            if state.human_floor.local
+                || (output_live && !route_isolated && !sustained_coupled_speech)
+            {
+                return false;
+            }
+            state.human_floor.local = true;
+            Self::commit_human_floor_onset(&mut state, replacement)
+        };
+        drop(old_player);
+        true
+    }
+
+    pub(super) fn leave_local_human_floor(&self) {
+        self.lock().human_floor.local = false;
+    }
+
+    pub(super) fn enter_remote_human_floor(&self, peer: u8) {
+        self.enter_human_floor(|floor| floor.remote.insert(peer));
+    }
+
+    pub(super) fn leave_remote_human_floor(&self, peer: u8) {
+        self.lock().human_floor.remote.remove(&peer);
+    }
+
+    pub(super) fn clear_remote_human_floor(&self) {
+        self.lock().human_floor.remote.clear();
+    }
+
+    fn enter_human_floor(&self, enter: impl FnOnce(&mut HumanFloorState) -> bool) {
+        let replacement = self
+            .mixer
+            .lock()
+            .unwrap_or_else(PoisonError::into_inner)
+            .as_ref()
+            .map(Player::connect_new);
+        let old_player = {
+            let mut state = self.lock();
+            if !enter(&mut state.human_floor) {
+                return;
+            }
+            Self::commit_human_floor_onset(&mut state, replacement)
+        };
+        drop(old_player);
+    }
+
+    fn commit_human_floor_onset(
+        state: &mut PlaybackState,
+        replacement: Option<Player>,
+    ) -> Option<Player> {
+        state.human_floor.epoch = state.human_floor.epoch.wrapping_add(1);
+        state.first_append = true;
+        state.synthesis_in_flight = false;
+        state.synthesis_generation = state.synthesis_generation.wrapping_add(1);
+        state.output_lease.begin_hangover(Instant::now());
+        std::mem::replace(&mut state.player, replacement)
+    }
 }
 
 #[cfg(test)]
@@ -194,6 +414,185 @@ mod tests {
         );
     }
 
+    fn one_second_source() -> SamplesBuffer {
+        SamplesBuffer::new(
+            NonZero::new(1).expect("nonzero channels"),
+            NonZero::new(24_000).expect("nonzero rate"),
+            vec![0.25; 24_000],
+        )
+    }
+
+    #[test]
+    fn floor_authorized_append_does_not_reenter_the_coordinator_lock() {
+        let (playback, _unpulled_source) = coordinator();
+        let epoch = playback.human_floor_epoch();
+        let (completed_tx, completed_rx) = std::sync::mpsc::sync_channel(1);
+        let worker = thread::spawn(move || {
+            let authorization =
+                playback.append_if_human_floor_permits(one_second_source(), epoch, |_| true, || {});
+            completed_tx
+                .send(authorization)
+                .expect("completion receiver");
+        });
+
+        assert_eq!(
+            completed_rx
+                .recv_timeout(Duration::from_secs(1))
+                .expect("floor-authorized append must not deadlock"),
+            HumanFloorAuthorization::Permitted
+        );
+        worker.join().expect("append worker");
+    }
+
+    #[test]
+    fn text_queued_during_a_held_floor_is_permitted_after_release() {
+        let (playback, _unpulled_source) = coordinator();
+        assert!(playback.enter_local_human_floor(true, false));
+        let queued_epoch = playback.human_floor_epoch();
+
+        assert_eq!(
+            playback.human_floor_authorization(queued_epoch),
+            HumanFloorAuthorization::Blocked
+        );
+        playback.leave_local_human_floor();
+        assert_eq!(
+            playback.human_floor_authorization(queued_epoch),
+            HumanFloorAuthorization::Permitted
+        );
+        assert_eq!(
+            playback.append_if_human_floor_permits(
+                one_second_source(),
+                queued_epoch,
+                |_| true,
+                || {},
+            ),
+            HumanFloorAuthorization::Permitted
+        );
+    }
+
+    #[test]
+    fn human_onset_replaces_playback_and_invalidates_late_append() {
+        let (playback, _unpulled_source) = coordinator();
+        append_second(&playback);
+        let stale_epoch = playback.human_floor_epoch();
+
+        assert!(playback.enter_local_human_floor(true, false));
+
+        assert!(playback.empty());
+        assert!(playback.human_floor_blocked());
+        assert!(!playback.human_floor_permits(stale_epoch));
+        playback.leave_local_human_floor();
+        assert!(!playback.human_floor_blocked());
+        assert!(!playback.human_floor_permits(stale_epoch));
+    }
+
+    #[test]
+    fn coupled_local_onset_while_idle_blocks_delayed_tts() {
+        let (playback, _unpulled_source) = coordinator();
+        let delayed_tts_epoch = playback.human_floor_epoch();
+
+        assert!(playback.enter_local_human_floor(false, false));
+
+        assert!(playback.human_floor_blocked());
+        assert!(!playback.human_floor_permits(delayed_tts_epoch));
+    }
+
+    #[test]
+    fn coupled_local_onset_during_output_is_rejected_as_ambiguous_echo() {
+        let (playback, _unpulled_source) = coordinator();
+        append_second(&playback);
+        let epoch = playback.human_floor_epoch();
+
+        assert!(!playback.enter_local_human_floor(false, false));
+
+        assert!(!playback.human_floor_blocked());
+        assert!(playback.human_floor_permits(epoch));
+        assert!(!playback.empty());
+    }
+
+    #[test]
+    fn sustained_coupled_speech_overrides_live_output_suppression() {
+        let (playback, _unpulled_source) = coordinator();
+        append_second(&playback);
+        let stale_epoch = playback.human_floor_epoch();
+
+        assert!(playback.enter_local_human_floor(false, true));
+
+        assert!(playback.empty());
+        assert!(playback.human_floor_blocked());
+        assert!(!playback.human_floor_permits(stale_epoch));
+    }
+
+    #[test]
+    fn coupled_local_onset_during_output_tail_hangover_is_rejected() {
+        let (playback, mut source) = coordinator();
+        append_second(&playback);
+        while !playback.empty() {
+            assert!(
+                source.next().is_some(),
+                "the mixer source outlives the queue"
+            );
+        }
+        assert!(playback.release_if_drained(|| {}));
+
+        assert!(!playback.enter_local_human_floor(false, false));
+        assert!(!playback.human_floor_blocked());
+    }
+
+    #[test]
+    fn coupled_local_onset_after_output_tail_hangover_is_accepted() {
+        let (playback, mut source) = coordinator();
+        append_second(&playback);
+        while !playback.empty() {
+            assert!(
+                source.next().is_some(),
+                "the mixer source outlives the queue"
+            );
+        }
+        assert!(playback.release_if_drained(|| {}));
+        playback.lock().output_lease =
+            OutputLease::HangoverUntil(Instant::now() - Duration::from_millis(1));
+
+        assert!(playback.enter_local_human_floor(false, false));
+        assert!(playback.human_floor_blocked());
+    }
+
+    #[test]
+    fn accepted_append_renews_an_expiring_output_lease() {
+        let (playback, _unpulled_source) = coordinator();
+        playback.lock().output_lease =
+            OutputLease::HangoverUntil(Instant::now() + Duration::from_millis(1));
+
+        append_second(&playback);
+
+        assert!(matches!(playback.lock().output_lease, OutputLease::Active));
+    }
+
+    #[test]
+    fn remote_onset_while_idle_blocks_delayed_tts() {
+        let (playback, _unpulled_source) = coordinator();
+        let delayed_tts_epoch = playback.human_floor_epoch();
+
+        playback.enter_remote_human_floor(7);
+
+        assert!(playback.human_floor_blocked());
+        assert!(!playback.human_floor_permits(delayed_tts_epoch));
+    }
+
+    #[test]
+    fn local_and_remote_sources_hold_the_same_floor_until_each_releases() {
+        let (playback, _unpulled_source) = coordinator();
+        assert!(playback.enter_local_human_floor(true, false));
+        let local_epoch = playback.human_floor_epoch();
+        playback.enter_remote_human_floor(7);
+        assert_ne!(playback.human_floor_epoch(), local_epoch);
+
+        playback.leave_local_human_floor();
+        assert!(playback.human_floor_blocked());
+        playback.leave_remote_human_floor(7);
+        assert!(!playback.human_floor_blocked());
+    }
+
     #[test]
     fn cancel_replaces_playback_without_waiting_for_the_mixer() {
         let (playback, _unpulled_source) = coordinator();
diff --git a/desktop/src-tauri/src/huddle/tts_settings.rs b/desktop/src-tauri/src/huddle/tts_settings.rs
index 64fd6d8a945..75cfef26e55 100644
--- a/desktop/src-tauri/src/huddle/tts_settings.rs
+++ b/desktop/src-tauri/src/huddle/tts_settings.rs
@@ -622,6 +622,7 @@ pub async fn preview_pocket_voice(
             model_dir,
             active.clone(),
             cancel,
+            super::human_floor::HumanFloor::new(),
             &voice_name,
             output_device,
             None,
diff --git a/desktop/src-tauri/src/huddle/tts_speaker_cancellation.rs b/desktop/src-tauri/src/huddle/tts_speaker_cancellation.rs
index 185ca56d08c..98bc66824c6 100644
--- a/desktop/src-tauri/src/huddle/tts_speaker_cancellation.rs
+++ b/desktop/src-tauri/src/huddle/tts_speaker_cancellation.rs
@@ -9,6 +9,7 @@ pub(super) struct TtsMonitorState {
     pub(super) activity_frames: Arc<Mutex<VecDeque<TtsSpeakerActivityFrame>>>,
     pub(super) active_speaker: ActiveSpeaker,
     pub(super) speaker_cancel: SpeakerCancellation,
+    pub(super) broadcasters: TtsBroadcasters,
     pub(super) activity_app: Option<tauri::AppHandle>,
 }
 
@@ -31,6 +32,7 @@ pub(super) fn spawn_tts_monitor(state: TtsMonitorState) -> std::io::Result<threa
                         // append winning the lock handoff cannot have its own
                         // activity publication overwritten by this `false`.
                         || {
+                            state.broadcasters.cancel_all();
                             state
                                 .active_speaker
                                 .lock()
diff --git a/desktop/src-tauri/src/huddle/tts_tests.rs b/desktop/src-tauri/src/huddle/tts_tests.rs
index 3358d526446..3e94aa43e1f 100644
--- a/desktop/src-tauri/src/huddle/tts_tests.rs
+++ b/desktop/src-tauri/src/huddle/tts_tests.rs
@@ -12,6 +12,117 @@ use std::sync::{Arc, Mutex};
 #[path = "tts_tests/token_split.rs"]
 mod token_split;
 
+// ── Human-floor queue authorization ───────────────────────────────────────
+
+fn queued_text(route_id: u64, floor_epoch: u64) -> QueuedText {
+    QueuedText {
+        generation: 1,
+        floor_epoch,
+        route_id,
+        speaker_pubkey: None,
+        speaker_generation: 0,
+        voice_reference: None,
+        text: "queued while a human is speaking".to_string(),
+    }
+}
+
+#[test]
+fn production_worker_append_authorization_completes() {
+    let (completed_tx, completed_rx) = mpsc::sync_channel(1);
+    let worker = std::thread::spawn(move || {
+        let human_floor = HumanFloor::new();
+        let playback = human_floor.playback();
+        let channels = NonZero::new(1).expect("nonzero channels");
+        let rate = NonZero::new(SAMPLE_RATE).expect("nonzero rate");
+        let (mixer, _unpulled_source) = rodio::mixer::mixer(channels, rate);
+        playback.bind_mixer(&mixer);
+        let floor_epoch = human_floor.epoch();
+        let cancel = AtomicBool::new(false);
+        let voice_cancel = AtomicBool::new(false);
+        let shutdown = AtomicBool::new(false);
+        let tts_active = AtomicBool::new(false);
+        let speaker_generations = Arc::new(Mutex::new(HashMap::new()));
+        let active_speaker = Arc::new(Mutex::new(None));
+        let activity_frames = Mutex::new(VecDeque::new());
+        let context = TtsAppendContext {
+            playback: &playback,
+            human_floor: &human_floor,
+            cancel: &cancel,
+            voice_cancel: &voice_cancel,
+            shutdown: &shutdown,
+            tts_active: &tts_active,
+            speaker_generations: &speaker_generations,
+            active_speaker: &active_speaker,
+            activity_frames: &activity_frames,
+            broadcasters: &TtsBroadcasters::default(),
+            channels,
+            rate,
+        };
+
+        let accepted = append_worker_audio(
+            &context,
+            PreparedModelAudio {
+                buffer: vec![0.25; SAMPLE_RATE as usize],
+                sample_count: SAMPLE_RATE as usize,
+                chunk_index: 0,
+            },
+            40,
+            None,
+            0,
+            floor_epoch,
+            || {},
+        );
+        completed_tx
+            .send((accepted, tts_active.load(Ordering::Acquire)))
+            .expect("completion receiver");
+    });
+
+    assert_eq!(
+        completed_rx
+            .recv_timeout(std::time::Duration::from_secs(1))
+            .expect("production worker append authorization must not deadlock"),
+        (true, true)
+    );
+    worker.join().expect("append worker");
+}
+
+#[test]
+fn worker_queue_defers_text_while_floor_is_held_then_releases_it() {
+    let human_floor = HumanFloor::new();
+    assert!(human_floor.enter_local(true, false));
+    let floor_epoch = human_floor.epoch();
+    let mut deferred = VecDeque::new();
+
+    assert!(matches!(
+        authorize_or_defer_queued_text(&human_floor, &mut deferred, queued_text(41, floor_epoch),),
+        Err(HumanFloorAuthorization::Blocked)
+    ));
+    assert_eq!(deferred.len(), 1, "held-floor text must stay queued");
+
+    human_floor.leave_local();
+    let queued = deferred.pop_front().expect("deferred text");
+    let released = authorize_or_defer_queued_text(&human_floor, &mut deferred, queued)
+        .expect("the same queue item is eligible after floor release");
+
+    assert_eq!(released.route_id, 41);
+    assert!(deferred.is_empty());
+}
+
+#[test]
+fn worker_queue_drops_text_from_before_human_onset() {
+    let human_floor = HumanFloor::new();
+    let stale_epoch = human_floor.epoch();
+    assert!(human_floor.enter_local(true, false));
+    human_floor.leave_local();
+    let mut deferred = VecDeque::new();
+
+    assert!(matches!(
+        authorize_or_defer_queued_text(&human_floor, &mut deferred, queued_text(42, stale_epoch),),
+        Err(HumanFloorAuthorization::Stale)
+    ));
+    assert!(deferred.is_empty(), "pre-barge-in text must not replay");
+}
+
 // ── Remote interrupt tracker ──────────────────────────────────────────────
 //
 // Models the per-peer frame counting logic in the recv task of
diff --git a/desktop/src-tauri/src/huddle/tts_voice_selection_tests.rs b/desktop/src-tauri/src/huddle/tts_voice_selection_tests.rs
index bff5ab4f76b..260239521e3 100644
--- a/desktop/src-tauri/src/huddle/tts_voice_selection_tests.rs
+++ b/desktop/src-tauri/src/huddle/tts_voice_selection_tests.rs
@@ -16,6 +16,7 @@ fn inert_pipeline(cancel: Arc<AtomicBool>) -> TtsPipeline {
         tts_active: Arc::new(AtomicBool::new(false)),
         shutdown,
         cancel,
+        human_floor: HumanFloor::new(),
         voice_cancel: Arc::new(AtomicBool::new(false)),
         voice: Arc::new(std::sync::Mutex::new("reference_sample".to_string())),
         voice_generation: Arc::new(AtomicU64::new(1)),
@@ -24,6 +25,7 @@ fn inert_pipeline(cancel: Arc<AtomicBool>) -> TtsPipeline {
         speaker_cancel: Arc::new(std::sync::Mutex::new(None)),
         playback_probe: PlaybackProbe::new(),
         voice_change_ack: Arc::new(std::sync::Mutex::new(None)),
+        broadcasters: TtsBroadcasters::default(),
         thread: Some(thread),
     }
 }
@@ -169,6 +171,7 @@ fn an_in_hand_post_change_message_survives_cancellation() {
     ));
     text_tx
         .send(QueuedText {
+            floor_epoch: 0,
             generation: voice_generation.load(Ordering::Acquire),
             route_id: 1,
             speaker_pubkey: None,
@@ -183,6 +186,7 @@ fn an_in_hand_post_change_message_survives_cancellation() {
     let active = AtomicBool::new(true);
     let mut deferred_text = VecDeque::from([
         QueuedText {
+            floor_epoch: 0,
             generation: 1,
             route_id: 2,
             speaker_pubkey: None,
@@ -191,6 +195,7 @@ fn an_in_hand_post_change_message_survives_cancellation() {
             text: "old message".to_string(),
         },
         QueuedText {
+            floor_epoch: 0,
             generation: voice_generation.load(Ordering::Acquire),
             route_id: 3,
             speaker_pubkey: None,
@@ -250,6 +255,7 @@ fn superseding_voice_change_removes_earlier_deferred_messages() {
     )
     .expect("first voice change");
     deferred_text.push_back(QueuedText {
+        floor_epoch: 0,
         generation: voice_generation.load(Ordering::Acquire),
         route_id: 4,
         speaker_pubkey: None,
@@ -299,6 +305,7 @@ fn barge_in_clears_deferred_voice_change_messages() {
     let voice_change_ack = Arc::new(std::sync::Mutex::new(None));
     let (_text_tx, text_rx) = std::sync::mpsc::channel();
     let mut deferred_text = VecDeque::from([QueuedText {
+        floor_epoch: 0,
         generation: 2,
         route_id: 5,
         speaker_pubkey: None,
@@ -343,6 +350,7 @@ fn barge_in_during_a_voice_change_clears_post_change_messages() {
     )
     .expect("voice change");
     deferred_text.push_back(QueuedText {
+        floor_epoch: 0,
         generation: voice_generation.load(Ordering::Acquire),
         route_id: 6,
         speaker_pubkey: None,
@@ -375,6 +383,7 @@ fn a_sender_captured_before_voice_change_is_stale_even_if_it_sends_after_drain()
     let old_sender = TtsTextSender {
         text_tx,
         generation: voice_generation.load(Ordering::Acquire),
+        human_floor: HumanFloor::new(),
         speaker_generations: Arc::new(std::sync::Mutex::new(HashMap::new())),
     };
     let shutdown = AtomicBool::new(false);
diff --git a/desktop/src-tauri/src/huddle/tts_voice_transition.rs b/desktop/src-tauri/src/huddle/tts_voice_transition.rs
index 78c9c3cc4d1..11f3acd2e4c 100644
--- a/desktop/src-tauri/src/huddle/tts_voice_transition.rs
+++ b/desktop/src-tauri/src/huddle/tts_voice_transition.rs
@@ -9,7 +9,7 @@ use std::{
     },
 };
 
-use super::{PlaybackCoordinator, SynthesisFlightGuard};
+use super::{HumanFloor, PlaybackCoordinator, SynthesisFlightGuard};
 
 use crate::huddle::pocket::{load_voice_style, VoiceStyle, DEFAULT_VOICE, VOICE_FILE_EXT};
 
@@ -74,6 +74,7 @@ impl fmt::Debug for PlaybackProbe {
 #[derive(Debug)]
 pub(super) struct QueuedText {
     pub(super) generation: u64,
+    pub(super) floor_epoch: u64,
     pub(super) route_id: u64,
     pub(super) speaker_pubkey: Option<String>,
     pub(super) speaker_generation: u64,
@@ -85,6 +86,7 @@ pub(super) struct QueuedText {
 pub(crate) struct TtsTextSender {
     pub(super) text_tx: SyncSender<QueuedText>,
     pub(super) generation: u64,
+    pub(super) human_floor: HumanFloor,
     pub(super) speaker_generations: SpeakerGenerations,
 }
 
@@ -97,9 +99,11 @@ impl TtsTextSender {
         voice_reference: String,
         text: String,
     ) -> Result<(), String> {
+        let floor_epoch = self.human_floor.epoch();
         self.text_tx
             .send(QueuedText {
                 generation: self.generation,
+                floor_epoch,
                 route_id,
                 speaker_pubkey: Some(speaker_pubkey),
                 speaker_generation,
@@ -544,6 +548,7 @@ mod speaker_generation_tests {
 
     fn queued_speech(speaker_pubkey: &str, speaker_generation: u64) -> QueuedText {
         QueuedText {
+            floor_epoch: 0,
             generation: 1,
             route_id: 1,
             speaker_pubkey: Some(speaker_pubkey.to_string()),
diff --git a/desktop/src-tauri/src/huddle/wire.rs b/desktop/src-tauri/src/huddle/wire.rs
index d315dd7f238..518377a60b0 100644
--- a/desktop/src-tauri/src/huddle/wire.rs
+++ b/desktop/src-tauri/src/huddle/wire.rs
@@ -7,13 +7,26 @@
 //!
 //! No per-frame metadata; receiver synthesizes sequence/timestamp on arrival.
 //! Kept for backward compatibility — relay still admits v1 clients into
-//! v1-pinned rooms — but new clients always speak v2.
+//! v1-pinned rooms — but new clients always speak v3.
 //!
-//! ## v2 (this commit)
+//! ## v2 (released)
 //!
 //! Client → relay: `<header: [u8; 8]><opus_bytes>`
 //! Relay   → client: `<peer_index: u8><header: [u8; 8]><opus_bytes>`
 //!
+//! ## v3 (this commit)
+//!
+//! Client → relay: `<header: [u8; 8]><opus_bytes>`
+//! Relay   → client: `<peer_index: u8><epoch: u8><header: [u8; 8]><opus_bytes>`
+//!
+//! The relay prefixes each forwarded frame with the sender's stable
+//! `peer_index` and the current occupancy `epoch` of that index. The epoch
+//! advances each time a slot is reused by a new occupant, so a client can
+//! fence a frame authored by a departed occupant that arrives after its index
+//! is reassigned — it carries the stale epoch and is dropped rather than
+//! mis-attributed. The client's own send path is unaffected: it emits only
+//! `<header><opus_bytes>` and the relay stamps the prefix.
+//!
 //! Header layout (8 bytes, network byte order, big-endian):
 //!
 //! ```text
@@ -31,13 +44,13 @@
 //! * `level_dbov` is client-authored telemetry. The relay parses it for
 //!   logging/active-speaker hints, clamps invalid values into range, and
 //!   **never** uses it for trust decisions (admission, moderation, etc.).
-//! * Negotiation lives in the WS auth message (`protocol_version: 2`), not
+//! * Negotiation lives in the WS auth message (`protocol_version: 3`), not
 //!   in any bit of `flags`. Mixed-version rooms are rejected at the relay
 //!   with `upgrade_required`.
 
 /// Wire protocol version this client speaks. Bumped only when the frame
 /// layout itself changes; the relay tracks pinned per-room.
-pub const PROTOCOL_VERSION: u8 = 2;
+pub const PROTOCOL_VERSION: u8 = 3;
 
 /// Length of the v2 per-frame header in bytes.
 pub const V2_HEADER_LEN: usize = 8;
diff --git a/desktop/src-tauri/src/lib.rs b/desktop/src-tauri/src/lib.rs
index c120ac12679..71a5eb3806e 100644
--- a/desktop/src-tauri/src/lib.rs
+++ b/desktop/src-tauri/src/lib.rs
@@ -314,16 +314,14 @@ pub fn run() {
             // agent spawns can resolve custom/preset runtime ids without
             // waiting for the frontend's discover_acp_providers call.  This is
             // a pure directory scan — no PATH probing, no async work.
-            {
-                let custom_dir = app_handle
-                    .path()
-                    .app_data_dir()
-                    .ok()
-                    .map(|d| d.join("custom_harnesses"));
-                managed_agents::custom_harnesses::warm_harness_registry_from_dir(
-                    custom_dir.as_deref(),
-                );
-            }
+            let custom_harness_dir = app_handle
+                .path()
+                .app_data_dir()
+                .ok()
+                .map(|d| d.join("custom_harnesses"));
+            managed_agents::custom_harnesses::warm_harness_registry_from_dir(
+                custom_harness_dir.as_deref(),
+            );
 
             // Store the AppHandle so huddle commands can emit `huddle-state-changed`
             // events via `huddle::emit_huddle_state` without threading the handle
@@ -353,10 +351,7 @@ pub fn run() {
                 // Route mesh-llm's download progress (model weights, runtime)
                 // onto Tauri events so the UI can render real progress.
                 crate::mesh_llm::install_progress_sink(&app_handle);
-                let mesh_app = app_handle.clone();
-                tauri::async_runtime::spawn(async move {
-                    crate::mesh_llm::start_coordinator(mesh_app).await;
-                });
+                tauri::async_runtime::spawn(crate::mesh_llm::start_coordinator(app_handle.clone()));
             }
 
             // Start the localhost media streaming proxy. Uses the shared HTTP
@@ -379,6 +374,7 @@ pub fn run() {
             if let Err(error) = ensure_nest() {
                 eprintln!("buzz-desktop: failed to create nest: {error}");
             }
+            archive::spawn_warm_init(app_handle.clone());
 
             // Resolve the REPOS symlink from the persisted repos_dir BEFORE
             // agents are restored below, and decide whether restore is safe.
@@ -842,6 +838,9 @@ pub fn run() {
             archive::index_observer_channel_id,
             archive::read_unindexed_observer_rows,
             archive::get_agent_usage_series,
+            archive::get_observer_retention_days,
+            archive::set_observer_retention_days,
+            archive::archive_size_stats,
             archive::sync::announce_archive_sync_epoch,
             archive::sync::start_archive_sync,
             archive::sync::stop_archive_sync,
@@ -914,7 +913,6 @@ pub fn run() {
         RunEvent::Exit => {
             shut_down_app(app_handle, &run_shutdown_done);
             app_handle.state::<ClipboardState>().release();
-
             #[cfg(all(feature = "mesh-llm", target_os = "macos"))]
             if restart_requested.load(Ordering::SeqCst) {
                 relaunch_after_mesh_shutdown(app_handle);
diff --git a/desktop/src-tauri/src/managed_agents/runtime.rs b/desktop/src-tauri/src/managed_agents/runtime.rs
index 0ce5ca7b219..ba880e50b1f 100644
--- a/desktop/src-tauri/src/managed_agents/runtime.rs
+++ b/desktop/src-tauri/src/managed_agents/runtime.rs
@@ -68,6 +68,8 @@ mod lifecycle;
 #[cfg(test)]
 use lifecycle::kill_stale_tracked_processes_with;
 pub use lifecycle::{kill_stale_tracked_processes, sync_managed_agent_processes};
+mod log_filter;
+
 mod spawn_key; // production spawn-key derivation + its regressions
 pub(crate) use spawn_key::bound_runtime_key;
 
@@ -529,7 +531,6 @@ pub fn spawn_agent_child(
     if let Some(ref path) = augmented_path {
         command.env("PATH", path);
     }
-    command.env("RUST_LOG", child_rust_log_filter());
     command.env("BUZZ_PRIVATE_KEY", &record.private_key_nsec);
     command.env("BUZZ_RELAY_URL", &effective_relay_url);
     command.env("BUZZ_ACP_LAZY_POOL", if lazy { "true" } else { "false" });
@@ -810,6 +811,12 @@ pub fn spawn_agent_child(
         command.env(key, value);
     }
 
+    // RUST_LOG is resolved after the loop above, for the same reason as effort
+    // below: that loop lets a user value win wholesale, and a saved
+    // `buzz_acp=debug` would drop the other harness families back into the
+    // silence this default exists to fix.
+    log_filter::apply(&mut command, &descriptor.env);
+
     // B5: carry persisted effort; harness resolves thought_level configId at first session.
     // Written AFTER descriptor.env so the canonical persisted value wins over any
     // user-supplied BUZZ_ACP_EFFORT_LEVEL entry, mirroring the A1 model-authority pattern
@@ -928,14 +935,6 @@ pub fn spawn_agent_child(
     })
 }
 
-fn child_rust_log_filter() -> String {
-    match std::env::var("RUST_LOG") {
-        Ok(existing) if existing.contains("buzz_acp") => existing,
-        Ok(existing) if !existing.trim().is_empty() => format!("{existing},buzz_acp=info"),
-        _ => "buzz_acp=info".to_string(),
-    }
-}
-
 /// Spawn (or adopt) the runtime pair for `record` on the caller's bound
 /// workspace relay. `workspace_relay` can only be produced by
 /// `bind_expected_relay_scope`, so this spawn consumes — by construction — the
diff --git a/desktop/src-tauri/src/managed_agents/runtime/log_filter.rs b/desktop/src-tauri/src/managed_agents/runtime/log_filter.rs
new file mode 100644
index 00000000000..533eebff2a7
--- /dev/null
+++ b/desktop/src-tauri/src/managed_agents/runtime/log_filter.rs
@@ -0,0 +1,139 @@
+//! Default `RUST_LOG` for the spawned harness, and the rule for merging a
+//! configured one into it.
+//!
+//! `buzz-acp` emits almost everything on its own target families — `acp::*`,
+//! `pool::*`, `canvas::*`, `engram::*`, `observer` — rather than under the
+//! crate path, and `EnvFilter` matches directives by target prefix. A bare
+//! `buzz_acp=info` therefore matches none of them, so an agent can log an
+//! error that its owner never sees.
+//!
+//! The families are enabled at `warn`, deliberately, and not at `info`: their
+//! info-level events carry conversation content (`acp::stream` logs the
+//! model's reply verbatim) and this log is a plaintext file on disk that a
+//! long-lived process appends to. Warn and error carry timeouts, ids and
+//! failures. Content stays behind an explicit opt-in.
+//!
+//! Keep in sync with the crate-side fallback in `crates/buzz-acp/src/lib.rs`.
+pub(super) const LOG_FILTER: &str =
+    "buzz_acp=info,acp=warn,pool=warn,canvas=warn,engram=warn,observer=warn";
+
+/// Whether a single directive is just a level, i.e. `EnvFilter`'s global
+/// default. Both spellings count: the names, and the numeric forms `0`..`5`
+/// the parser also accepts.
+///
+/// A target-specific directive outranks the global one, so merging our
+/// families into such a filter would *narrow* what the user asked for. `0`
+/// matters most: it means "log nothing", and widening that would be the
+/// opposite of the request.
+fn is_global_level(directive: &str) -> bool {
+    const NAMES: [&str; 6] = ["off", "error", "warn", "info", "debug", "trace"];
+    let directive = directive.trim();
+    NAMES
+        .iter()
+        .any(|name| directive.eq_ignore_ascii_case(name))
+        || matches!(directive, "0" | "1" | "2" | "3" | "4" | "5")
+}
+
+/// Merge a configured `RUST_LOG` with the harness defaults.
+///
+/// `configured` is the value that survives the desktop's own env layering, so
+/// this must be called after that layering rather than before it.
+pub(super) fn merge(configured: Option<&str>) -> String {
+    let Some(configured) = configured.map(str::trim).filter(|value| !value.is_empty()) else {
+        return LOG_FILTER.to_string();
+    };
+    if configured.split(',').any(is_global_level) {
+        return configured.to_string();
+    }
+    // Defaults first: a later directive for the same target overwrites an
+    // earlier one, so an explicit `acp=debug` still wins over ours while the
+    // families the user did not name keep their diagnostics.
+    format!("{LOG_FILTER},{configured}")
+}
+
+/// Write the harness `RUST_LOG` onto `command`.
+///
+/// Takes the already-layered agent env so the value the user actually saved is
+/// the one merged; calling this before that layering would let the layering
+/// overwrite the result.
+pub(super) fn apply(
+    command: &mut std::process::Command,
+    env: &std::collections::BTreeMap<String, String>,
+) {
+    let ambient = std::env::var("RUST_LOG").ok();
+    let configured = env
+        .get("RUST_LOG")
+        .map(String::as_str)
+        .or(ambient.as_deref());
+    command.env("RUST_LOG", merge(configured));
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{is_global_level, merge, LOG_FILTER};
+
+    #[test]
+    fn default_covers_every_harness_target_family() {
+        for family in ["buzz_acp", "acp", "pool", "canvas", "engram", "observer"] {
+            assert!(
+                LOG_FILTER.contains(&format!("{family}=")),
+                "default drops the `{family}` target family: {LOG_FILTER}"
+            );
+        }
+    }
+
+    #[test]
+    fn default_enables_no_content_bearing_target() {
+        // acp::stream logs assistant text verbatim at info, pool::prompt logs
+        // command arguments. Enabling a family at info would persist both to a
+        // plaintext file, so only warn and error may be on by default.
+        for family in ["acp", "pool", "canvas", "engram", "observer"] {
+            assert!(
+                LOG_FILTER.contains(&format!("{family}=warn")),
+                "`{family}` must default to warn, not info: {LOG_FILTER}"
+            );
+        }
+    }
+
+    #[test]
+    fn unset_or_blank_takes_the_default() {
+        assert_eq!(merge(None), LOG_FILTER);
+        assert_eq!(merge(Some("   ")), LOG_FILTER);
+    }
+
+    #[test]
+    fn explicit_target_directive_keeps_the_other_families() {
+        let filter = merge(Some("buzz_acp=debug"));
+        assert!(filter.starts_with(LOG_FILTER), "{filter}");
+        assert!(filter.ends_with(",buzz_acp=debug"), "{filter}");
+    }
+
+    #[test]
+    fn target_merely_containing_the_crate_name_does_not_bypass_defaults() {
+        assert!(merge(Some("my_buzz_acp=debug")).starts_with(LOG_FILTER));
+    }
+
+    #[test]
+    fn named_global_level_is_preserved_exactly() {
+        for value in ["debug", "TRACE", "off"] {
+            assert_eq!(merge(Some(value)), value, "global level must survive");
+        }
+    }
+
+    #[test]
+    fn numeric_global_levels_are_preserved_exactly() {
+        // EnvFilter accepts 0..5 as global levels. Treating them as targets
+        // would widen `0` (log nothing) and narrow `5` (trace).
+        for value in ["0", "1", "2", "3", "4", "5"] {
+            assert_eq!(merge(Some(value)), value, "numeric level must survive");
+            assert!(is_global_level(value));
+        }
+    }
+
+    #[test]
+    fn unrelated_directive_is_appended_not_replaced() {
+        let filter = merge(Some("hyper=warn"));
+        assert!(filter.starts_with(LOG_FILTER), "{filter}");
+        assert!(filter.ends_with(",hyper=warn"), "{filter}");
+    }
+}
diff --git a/desktop/src-tauri/tauri.conf.json b/desktop/src-tauri/tauri.conf.json
index b6cbaab514f..4a73c780641 100644
--- a/desktop/src-tauri/tauri.conf.json
+++ b/desktop/src-tauri/tauri.conf.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "Buzz",
-  "version": "0.5.17",
+  "version": "0.5.18",
   "identifier": "xyz.block.buzz.app",
   "build": {
     "beforeDevCommand": {
diff --git a/desktop/src/app/AppShell.helpers.test.mjs b/desktop/src/app/AppShell.helpers.test.mjs
index fa062329231..fc4a14f2cd7 100644
--- a/desktop/src/app/AppShell.helpers.test.mjs
+++ b/desktop/src/app/AppShell.helpers.test.mjs
@@ -3,6 +3,8 @@ import test from "node:test";
 
 import {
   markAllReadSources,
+  activateDesktopNotificationTarget,
+  createDesktopNotificationActivationQueue,
   shouldBounceForChannelNotification,
 } from "./AppShell.helpers.ts";
 
@@ -31,6 +33,177 @@ test("shouldBounceForChannelNotification_allowsBroadcastReplies", () => {
   );
 });
 
+test("notification activation queue preserves click order", async () => {
+  const calls = [];
+  const resolvers = new Map();
+  const queue = createDesktopNotificationActivationQueue((target) => {
+    calls.push(`start:${target.channelId}`);
+    return new Promise((resolve) => {
+      resolvers.set(target.channelId, () => {
+        calls.push(`finish:${target.channelId}`);
+        resolve();
+      });
+    });
+  });
+
+  queue.enqueue({ channelId: "first", eventId: null, kind: null });
+  queue.enqueue({ channelId: "second", eventId: null, kind: null });
+  await new Promise((resolve) => setImmediate(resolve));
+  assert.deepEqual(calls, ["start:first"]);
+
+  resolvers.get("first")();
+  await new Promise((resolve) => setImmediate(resolve));
+  assert.deepEqual(calls, ["start:first", "finish:first", "start:second"]);
+
+  resolvers.get("second")();
+});
+
+test("notification activation queue drops pending targets after cancellation", async () => {
+  const calls = [];
+  let resolveFirst;
+  const queue = createDesktopNotificationActivationQueue((target) => {
+    calls.push(target.channelId);
+    if (target.channelId === "first") {
+      return new Promise((resolve) => {
+        resolveFirst = resolve;
+      });
+    }
+    return Promise.resolve();
+  });
+
+  queue.enqueue({ channelId: "first", eventId: null, kind: null });
+  queue.enqueue({ channelId: "second", eventId: null, kind: null });
+  await new Promise((resolve) => setImmediate(resolve));
+  assert.deepEqual(calls, ["first"]);
+
+  queue.cancel();
+  resolveFirst();
+  await new Promise((resolve) => setImmediate(resolve));
+  assert.deepEqual(calls, ["first"]);
+});
+
+test("notification activation queue aborts an in-flight activation", async () => {
+  let observedSignal;
+  let resolveActivation;
+  const queue = createDesktopNotificationActivationQueue((_target, signal) => {
+    observedSignal = signal;
+    return new Promise((resolve) => {
+      resolveActivation = resolve;
+    });
+  });
+
+  queue.enqueue({ channelId: "first", eventId: null, kind: null });
+  await new Promise((resolve) => setImmediate(resolve));
+  assert.equal(observedSignal.aborted, false);
+
+  queue.cancel();
+  assert.equal(observedSignal.aborted, true);
+  resolveActivation();
+});
+
+test("notification activation queue reports failures and continues", async () => {
+  const calls = [];
+  const errors = [];
+  const queue = createDesktopNotificationActivationQueue(
+    async (target) => {
+      calls.push(target.channelId);
+      if (target.channelId === "first") {
+        throw new Error("navigation failed");
+      }
+    },
+    (error) => errors.push(error),
+  );
+
+  queue.enqueue({ channelId: "first", eventId: null, kind: null });
+  queue.enqueue({ channelId: "second", eventId: null, kind: null });
+  await new Promise((resolve) => setImmediate(resolve));
+
+  assert.deepEqual(calls, ["first", "second"]);
+  assert.equal(errors.length, 1);
+  assert.match(errors[0].message, /navigation failed/);
+});
+
+test("notification activation starts routing before a hung reveal", async () => {
+  const calls = [];
+  let resolveNavigation;
+  let navigationSettled = false;
+  const activation = activateDesktopNotificationTarget(
+    {
+      channelId: "channel",
+      eventId: "event",
+      kind: 9,
+    },
+    {
+      goChannel: async () => calls.push("channel"),
+      goHome: async () => calls.push("home"),
+      revealWindow: () => new Promise(() => {}),
+      openSearchHit: (_hit, behavior) => {
+        calls.push(`message:${String(behavior?.force)}`);
+        return new Promise((resolve) => {
+          resolveNavigation = () => {
+            navigationSettled = true;
+            resolve();
+          };
+        });
+      },
+    },
+  );
+
+  assert.deepEqual(calls, ["message:true"]);
+  resolveNavigation();
+  await activation;
+  assert.equal(navigationSettled, true);
+});
+
+test("notification activation falls back to forced channel navigation", async () => {
+  const calls = [];
+  await activateDesktopNotificationTarget(
+    { channelId: "channel", eventId: null, kind: null },
+    {
+      goChannel: async (channelId, behavior) =>
+        calls.push(`${channelId}:${String(behavior?.force)}`),
+      goHome: async () => calls.push("home"),
+      openSearchHit: async () => calls.push("message"),
+      revealWindow: async () => calls.push("reveal"),
+    },
+  );
+
+  assert.deepEqual(calls, ["channel:true", "reveal"]);
+});
+
+test("notification activation ignores reveal rejection after routing starts", async () => {
+  const calls = [];
+  await activateDesktopNotificationTarget(
+    { channelId: "channel", eventId: null, kind: null },
+    {
+      goChannel: async () => calls.push("channel"),
+      goHome: async () => calls.push("home"),
+      openSearchHit: async () => calls.push("message"),
+      revealWindow: async () => {
+        calls.push("reveal");
+        throw new Error("reveal failed");
+      },
+    },
+  );
+
+  assert.deepEqual(calls, ["channel", "reveal"]);
+});
+
+test("notification activation without a channel opens home", async () => {
+  const calls = [];
+  await activateDesktopNotificationTarget(
+    { channelId: null, eventId: "event", kind: 9 },
+    {
+      goChannel: async () => calls.push("channel"),
+      goHome: async () => calls.push("home"),
+      openSearchHit: async () => calls.push("message"),
+      revealWindow: async () => calls.push("reveal"),
+    },
+  );
+
+  assert.deepEqual(calls, ["home", "reveal"]);
+});
+
 test("markAllReadSources clears Inbox overrides and active thread activity", () => {
   const calls = [];
 
diff --git a/desktop/src/app/AppShell.helpers.ts b/desktop/src/app/AppShell.helpers.ts
index dd6b9195e82..9fc14736c7c 100644
--- a/desktop/src/app/AppShell.helpers.ts
+++ b/desktop/src/app/AppShell.helpers.ts
@@ -141,6 +141,79 @@ export function toSearchHit(
   };
 }
 
+export function createDesktopNotificationActivationQueue(
+  activate: (
+    target: DesktopNotificationTarget,
+    signal: AbortSignal,
+  ) => Promise<void>,
+  onError?: (error: unknown) => void,
+): {
+  cancel: () => void;
+  enqueue: (target: DesktopNotificationTarget) => void;
+} {
+  const controller = new AbortController();
+  let pending = Promise.resolve();
+
+  return {
+    cancel: () => {
+      controller.abort();
+    },
+    enqueue: (target) => {
+      // Preserve native click order when macOS drains multiple queued targets.
+      // Contain failures so one rejected navigation cannot poison later clicks.
+      pending = pending
+        .then(() => {
+          if (!controller.signal.aborted) {
+            return activate(target, controller.signal);
+          }
+        })
+        .catch((error) => {
+          try {
+            onError?.(error);
+          } catch {
+            // Reporting must not poison the activation queue either.
+          }
+        });
+    },
+  };
+}
+
+export async function activateDesktopNotificationTarget(
+  target: DesktopNotificationTarget,
+  actions: {
+    goChannel: (
+      channelId: string,
+      options?: { force?: boolean },
+    ) => Promise<unknown>;
+    goHome: () => Promise<unknown>;
+    openSearchHit: (
+      hit: SearchHit,
+      behavior?: { force?: boolean; signal?: AbortSignal },
+    ) => Promise<unknown>;
+    revealWindow: () => Promise<void>;
+  },
+  signal?: AbortSignal,
+): Promise<void> {
+  if (signal?.aborted) {
+    return;
+  }
+
+  let navigation: Promise<unknown>;
+  if (!target.channelId) {
+    navigation = actions.goHome();
+  } else {
+    const anchor = toSearchHit(target);
+    navigation = anchor
+      ? actions.openSearchHit(anchor, { force: true, signal })
+      : actions.goChannel(target.channelId, { force: true });
+  }
+
+  // Native activation already foregrounds the app on macOS. Other platforms
+  // still get a best-effort reveal, but it must never gate click-through.
+  void actions.revealWindow().catch(() => undefined);
+  await navigation;
+}
+
 export function deriveShellRoute(pathname: string): {
   selectedChannelId: string | null;
   selectedView: AppView;
diff --git a/desktop/src/app/navigation/searchHitNavigation.test.mjs b/desktop/src/app/navigation/searchHitNavigation.test.mjs
new file mode 100644
index 00000000000..74e5f108af6
--- /dev/null
+++ b/desktop/src/app/navigation/searchHitNavigation.test.mjs
@@ -0,0 +1,141 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import {
+  activateDesktopNotificationTarget,
+  createDesktopNotificationActivationQueue,
+} from "../AppShell.helpers.ts";
+
+const { clearSearchHitEventCache, getCachedSearchHitEvent } = await import(
+  "./searchHitEventCache.ts"
+);
+const { openSearchHitWithNavigation } = await import(
+  "./searchHitNavigation.ts"
+);
+
+const forumComment = {
+  eventId: "comment",
+  content: "reply",
+  kind: 45003,
+  pubkey: "author",
+  channelId: "old-community-channel",
+  channelName: "forum",
+  createdAt: 1,
+  score: 0,
+  threadRootId: null,
+};
+
+const plainMessage = {
+  ...forumComment,
+  eventId: "message",
+  kind: 9,
+  threadRootId: "thread-root",
+};
+
+test("search-hit navigation preserves forced message routing while active", async () => {
+  clearSearchHitEventCache();
+  const calls = [];
+  const result = await openSearchHitWithNavigation(plainMessage, {
+    force: true,
+    goChannel: async (channelId, options) => {
+      calls.push({ channelId, options });
+      return true;
+    },
+    goForumPost: async () => false,
+  });
+
+  assert.equal(result, true);
+  assert.deepEqual(calls, [
+    {
+      channelId: "old-community-channel",
+      options: {
+        force: true,
+        messageId: "message",
+        threadRootId: "thread-root",
+      },
+    },
+  ]);
+  assert.equal(getCachedSearchHitEvent("message")?.id, "message");
+});
+
+test("cancelled search-hit navigation cannot repopulate cache or route", async () => {
+  clearSearchHitEventCache();
+  let resolveLookup;
+  const destination = new Promise((resolve) => {
+    resolveLookup = resolve;
+  });
+  const calls = [];
+  const controller = new AbortController();
+  const navigation = openSearchHitWithNavigation(
+    forumComment,
+    {
+      goChannel: async () => calls.push("channel"),
+      goForumPost: async () => calls.push("forum"),
+      signal: controller.signal,
+    },
+    () => destination,
+  );
+
+  controller.abort();
+  clearSearchHitEventCache();
+  resolveLookup({
+    kind: "forum-post",
+    channelId: "old-community-channel",
+    postId: "old-community-post",
+    replyId: "comment",
+  });
+  await navigation;
+
+  assert.deepEqual(calls, []);
+  assert.equal(getCachedSearchHitEvent("comment"), null);
+});
+
+test("queue cancellation fences an in-flight forum-comment activation", async () => {
+  clearSearchHitEventCache();
+  let resolveLookup;
+  const destination = new Promise((resolve) => {
+    resolveLookup = resolve;
+  });
+  const calls = [];
+  const queue = createDesktopNotificationActivationQueue((target, signal) =>
+    activateDesktopNotificationTarget(
+      target,
+      {
+        goChannel: async () => calls.push("channel"),
+        goHome: async () => calls.push("home"),
+        openSearchHit: (hit, behavior) =>
+          openSearchHitWithNavigation(
+            hit,
+            {
+              force: behavior?.force,
+              goChannel: async () => calls.push("channel"),
+              goForumPost: async () => calls.push("forum"),
+              signal: behavior?.signal,
+            },
+            () => destination,
+          ),
+        revealWindow: async () => {},
+      },
+      signal,
+    ),
+  );
+
+  queue.enqueue({
+    channelId: "old-community-channel",
+    eventId: "comment",
+    kind: 45003,
+  });
+  await new Promise((resolve) => setImmediate(resolve));
+  queue.cancel();
+  clearSearchHitEventCache();
+  resolveLookup({
+    kind: "forum-post",
+    channelId: "old-community-channel",
+    postId: "old-community-post",
+    replyId: "comment",
+  });
+  await new Promise((resolve) => setImmediate(resolve));
+
+  assert.deepEqual(calls, []);
+  assert.equal(getCachedSearchHitEvent("comment"), null);
+});
diff --git a/desktop/src/app/navigation/searchHitNavigation.ts b/desktop/src/app/navigation/searchHitNavigation.ts
new file mode 100644
index 00000000000..8523340d481
--- /dev/null
+++ b/desktop/src/app/navigation/searchHitNavigation.ts
@@ -0,0 +1,60 @@
+import { resolveSearchHitDestination } from "@/app/navigation/resolveSearchHitDestination";
+import { cacheSearchHitEvent } from "@/app/navigation/searchHitEventCache";
+import type { SearchHit } from "@/shared/api/types";
+
+type SearchHitNavigationActions = {
+  force?: boolean;
+  goChannel: (
+    channelId: string,
+    options?: {
+      force?: boolean;
+      messageId?: string;
+      threadRootId?: string | null;
+    },
+  ) => Promise<unknown>;
+  goForumPost: (
+    channelId: string,
+    postId: string,
+    options?: { force?: boolean; replyId?: string },
+  ) => Promise<unknown>;
+  signal?: AbortSignal;
+};
+
+export async function openSearchHitWithNavigation(
+  hit: SearchHit,
+  actions: SearchHitNavigationActions,
+  resolveDestination = resolveSearchHitDestination,
+): Promise<unknown> {
+  if (actions.signal?.aborted) {
+    return false;
+  }
+
+  const isLifecycleBound = Boolean(actions.signal);
+  if (!isLifecycleBound) {
+    cacheSearchHitEvent(hit);
+  }
+
+  const destination = await resolveDestination(hit);
+  if (!destination || actions.signal?.aborted) {
+    return false;
+  }
+
+  if (isLifecycleBound) {
+    // Delay community-scoped writes for notification routing until async
+    // destination resolution completes and its owner is still current.
+    cacheSearchHitEvent(hit);
+  }
+
+  if (destination.kind === "forum-post") {
+    return actions.goForumPost(destination.channelId, destination.postId, {
+      force: actions.force,
+      replyId: destination.replyId,
+    });
+  }
+
+  return actions.goChannel(destination.channelId, {
+    force: actions.force,
+    messageId: destination.messageId,
+    threadRootId: destination.threadRootId,
+  });
+}
diff --git a/desktop/src/app/navigation/useAppNavigation.ts b/desktop/src/app/navigation/useAppNavigation.ts
index 53db19d3789..c4776564e34 100644
--- a/desktop/src/app/navigation/useAppNavigation.ts
+++ b/desktop/src/app/navigation/useAppNavigation.ts
@@ -6,8 +6,7 @@ import {
   useRouter,
 } from "@tanstack/react-router";
 
-import { cacheSearchHitEvent } from "@/app/navigation/searchHitEventCache";
-import { resolveSearchHitDestination } from "@/app/navigation/resolveSearchHitDestination";
+import { openSearchHitWithNavigation } from "@/app/navigation/searchHitNavigation";
 import type { SearchHit } from "@/shared/api/types";
 
 type NavigationBehavior = {
@@ -247,6 +246,10 @@ export function useAppNavigation() {
          * firing. Used by the Drafts panel "Send message" confirm flow.
          */
         autoSend?: string;
+        /** Navigate even when the destination matches the current href.
+         * Used by desktop-notification activation so a click is never
+         * silently swallowed (block/buzz#3509). */
+        force?: boolean;
         messageId?: string;
         replace?: boolean;
         /** Open this thread panel directly without waiting for a timeline row. */
@@ -275,6 +278,7 @@ export function useAppNavigation() {
           },
         },
         {
+          force: options?.force,
           replace: options?.replace,
           resetScroll: options?.messageId ? true : undefined,
         },
@@ -298,6 +302,8 @@ export function useAppNavigation() {
       channelId: string,
       postId: string,
       options?: {
+        /** Navigate even when the destination matches the current href. */
+        force?: boolean;
         replace?: boolean;
         replyId?: string;
       },
@@ -312,6 +318,7 @@ export function useAppNavigation() {
           search: options?.replyId ? { replyId: options.replyId } : {},
         },
         {
+          force: options?.force,
           replace: options?.replace,
           resetScroll: false,
         },
@@ -362,25 +369,23 @@ export function useAppNavigation() {
   );
 
   const openSearchHit = React.useCallback(
-    async (hit: SearchHit) => {
-      cacheSearchHitEvent(hit);
-
-      const destination = await resolveSearchHitDestination(hit);
-      if (!destination) {
-        return false;
-      }
-
-      if (destination.kind === "forum-post") {
-        return goForumPost(destination.channelId, destination.postId, {
-          replyId: destination.replyId,
-        });
-      }
-
-      return goChannel(destination.channelId, {
-        messageId: destination.messageId,
-        threadRootId: destination.threadRootId,
-      });
-    },
+    async (
+      hit: SearchHit,
+      behavior?: {
+        /** Navigate even when the destination matches the current href.
+         * Used by desktop-notification activation so a click is never
+         * silently swallowed (block/buzz#3509). */
+        force?: boolean;
+        /** Stop notification-driven routing when its owning lifecycle ends. */
+        signal?: AbortSignal;
+      },
+    ) =>
+      openSearchHitWithNavigation(hit, {
+        force: behavior?.force,
+        goChannel,
+        goForumPost,
+        signal: behavior?.signal,
+      }),
     [goChannel, goForumPost],
   );
 
diff --git a/desktop/src/app/useAppShellDesktopNotifications.ts b/desktop/src/app/useAppShellDesktopNotifications.ts
index 6792faf21a7..b86b95363cd 100644
--- a/desktop/src/app/useAppShellDesktopNotifications.ts
+++ b/desktop/src/app/useAppShellDesktopNotifications.ts
@@ -1,10 +1,10 @@
 import * as React from "react";
 
 import {
+  activateDesktopNotificationTarget,
+  createDesktopNotificationActivationQueue,
   shouldBounceForChannelNotification,
-  toSearchHit,
 } from "@/app/AppShell.helpers";
-import { getThreadReference } from "@/features/messages/lib/threading";
 import { useCommunityJoinAlerts } from "@/features/community-members/useCommunityJoinAlerts";
 import { hasMentionForEvent } from "@/features/notifications/lib/shouldNotify";
 import type { NotificationSettings } from "@/features/notifications/hooks";
@@ -14,15 +14,14 @@ import {
   revealDesktopAppWindow,
   sendDesktopNotification,
 } from "@/features/notifications/lib/desktop";
-import {
-  formatNotificationTitle,
-  truncateNotificationBody,
-} from "@/features/notifications/lib/notificationFormat";
+import { formatMessageNotification } from "@/features/notifications/lib/notificationFormat";
+import { buildEventNotificationTarget } from "@/features/notifications/lib/target";
 import {
   playNotificationSound,
   resolveSlotSound,
   shouldPlayNotificationSound,
 } from "@/features/notifications/lib/sound";
+import { useNotificationSenderName } from "@/features/notifications/useNotificationSenderName";
 import type { Channel, RelayEvent } from "@/shared/api/types";
 
 export function useAppShellDesktopNotifications({
@@ -37,11 +36,15 @@ export function useAppShellDesktopNotifications({
 }: {
   channels: Channel[];
   enabled: boolean;
-  goChannel: (channelId: string) => Promise<unknown>;
+  goChannel: (
+    channelId: string,
+    options?: { force?: boolean },
+  ) => Promise<unknown>;
   goHome: () => Promise<unknown>;
   notificationSettings: NotificationSettings;
   openSearchHit: (
     hit: import("@/shared/api/types").SearchHit,
+    behavior?: { force?: boolean },
   ) => Promise<unknown>;
   pubkey?: string;
   silentChannelIds?: ReadonlySet<string>;
@@ -53,6 +56,8 @@ export function useAppShellDesktopNotifications({
     enabled: enabled && notificationSettings.desktopEnabled,
   });
 
+  const resolveSenderName = useNotificationSenderName();
+
   const handleChannelNotification = React.useEffectEvent(
     (_channelId: string, event: RelayEvent) => {
       if (!enabled) return;
@@ -73,22 +78,20 @@ export function useAppShellDesktopNotifications({
       }
 
       const channelName = channel.name?.trim() || "Direct message";
-      const body = truncateNotificationBody(event.content, "New message");
-      const threadRootId = getThreadReference(event.tags).rootId ?? null;
+      const { title, body } = formatMessageNotification({
+        source: "dm",
+        senderName: resolveSenderName(event.pubkey),
+        channelName,
+        content: event.content,
+      });
 
       void sendDesktopNotification({
-        title: channelName,
+        title,
         body,
-        target: {
-          channelId: channel.id,
-          channelName,
-          content: event.content,
-          createdAt: event.created_at,
-          eventId: event.id,
-          kind: event.kind,
-          pubkey: event.pubkey,
-          threadRootId,
-        },
+        target: buildEventNotificationTarget(event, {
+          id: channel.id,
+          name: channelName,
+        }),
       }).then((didSend) => {
         if (!didSend) return;
         if (shouldPlayNotificationSound(channel.id, silentChannelIds)) {
@@ -118,25 +121,20 @@ export function useAppShellDesktopNotifications({
 
       const resolvedChannel = channels.find((c) => c.id === channelId);
       const channelName = resolvedChannel?.name?.trim() ?? null;
-      // channelLabel is "#name" for the toast title; channelName is the raw
-      // name stored in the navigation target for click-through routing.
-      const channelLabel = channelName ? `#${channelName}` : null;
-      const body = truncateNotificationBody(event.content, "New reply");
-      const threadRootId = getThreadReference(event.tags).rootId ?? null;
+      const { title, body } = formatMessageNotification({
+        source: "thread_reply",
+        senderName: resolveSenderName(event.pubkey),
+        channelName,
+        content: event.content,
+      });
 
       void sendDesktopNotification({
-        title: formatNotificationTitle({ prefix: "Reply", channelLabel }),
+        title,
         body,
-        target: {
-          channelId,
-          channelName,
-          content: event.content,
-          createdAt: event.created_at,
-          eventId: event.id,
-          kind: event.kind,
-          pubkey: event.pubkey,
-          threadRootId,
-        },
+        target: buildEventNotificationTarget(event, {
+          id: channelId,
+          name: channelName,
+        }),
       }).then((didSend) => {
         if (!didSend) return;
         if (shouldPlayNotificationSound(channelId, silentChannelIds)) {
@@ -152,21 +150,18 @@ export function useAppShellDesktopNotifications({
   const handleDesktopNotificationAction = React.useEffectEvent(
     async (
       target: import("@/features/notifications/lib/desktop").DesktopNotificationTarget,
+      signal: AbortSignal,
     ) => {
-      await revealDesktopAppWindow();
-
-      if (!target.channelId) {
-        void goHome();
-        return;
-      }
-
-      const anchor = toSearchHit(target);
-      if (!anchor) {
-        await goChannel(target.channelId);
-        return;
-      }
-
-      await openSearchHit(anchor);
+      await activateDesktopNotificationTarget(
+        target,
+        {
+          goChannel,
+          goHome,
+          openSearchHit,
+          revealWindow: revealDesktopAppWindow,
+        },
+        signal,
+      );
     },
   );
 
@@ -174,13 +169,19 @@ export function useAppShellDesktopNotifications({
     if (!enabled) return;
     let isCancelled = false;
     let cleanup = () => {};
+    const activationQueue = createDesktopNotificationActivationQueue(
+      (target, signal) => handleDesktopNotificationAction(target, signal),
+      (error) => {
+        console.error("Failed to activate desktop notification", error);
+      },
+    );
 
     void listenForDesktopNotificationActions((target) => {
       if (isCancelled) {
         return;
       }
 
-      void handleDesktopNotificationAction(target);
+      activationQueue.enqueue(target);
     }).then((dispose) => {
       if (isCancelled) {
         dispose();
@@ -192,6 +193,7 @@ export function useAppShellDesktopNotifications({
 
     return () => {
       isCancelled = true;
+      activationQueue.cancel();
       cleanup();
     };
   }, [enabled]);
diff --git a/desktop/src/app/useWebviewZoomShortcuts.ts b/desktop/src/app/useWebviewZoomShortcuts.ts
index e8b93207945..3d797b3bb72 100644
--- a/desktop/src/app/useWebviewZoomShortcuts.ts
+++ b/desktop/src/app/useWebviewZoomShortcuts.ts
@@ -1,9 +1,14 @@
 import * as React from "react";
 import { getCurrentWebview } from "@tauri-apps/api/webview";
 
-import { applyTextZoomFactor } from "@/shared/lib/fontSizePreference";
 import { hasPrimaryShortcutModifier } from "@/shared/lib/platform";
 
+/**
+ * Cmd +/- scales the real root font-size, so every rem in the app — text,
+ * spacing, widths, radii — zooms together. The Font size preference is a
+ * separate, text-only dial layered on top (see `styles/globals/typography.css`).
+ */
+const BASE_FONT_SIZE_PX = 16;
 const DEFAULT_ZOOM_FACTOR = 1;
 const MIN_ZOOM_FACTOR = 0.75;
 const MAX_ZOOM_FACTOR = 1.5;
@@ -75,8 +80,15 @@ function readStoredZoomFactor() {
   return Math.min(Math.max(parsed, MIN_ZOOM_FACTOR), MAX_ZOOM_FACTOR);
 }
 
+function applyRootZoom(zoomFactor: number) {
+  document.documentElement.style.fontSize =
+    zoomFactor === DEFAULT_ZOOM_FACTOR
+      ? ""
+      : `${BASE_FONT_SIZE_PX * zoomFactor}px`;
+}
+
 function applyTextScale(zoomFactor: number) {
-  applyTextZoomFactor(zoomFactor);
+  applyRootZoom(zoomFactor);
   if (zoomFactor === DEFAULT_ZOOM_FACTOR) {
     window.localStorage.removeItem(TEXT_SCALE_STORAGE_KEY);
     return;
@@ -95,7 +107,8 @@ export function useWebviewZoomShortcuts() {
     zoomFactorRef.current = storedZoomFactor;
     applyTextScale(storedZoomFactor);
 
-    // Keep the webview coordinate system stable; only text should scale.
+    // Pin the native webview zoom so the rem root is the only zoom dial and
+    // window/coordinate math stays stable.
     void webview.setZoom(DEFAULT_ZOOM_FACTOR).catch((error) => {
       console.error("Failed to reset webview zoom", error);
     });
@@ -126,7 +139,7 @@ export function useWebviewZoomShortcuts() {
 
       const storedZoomFactor = readStoredZoomFactor();
       zoomFactorRef.current = storedZoomFactor;
-      applyTextZoomFactor(storedZoomFactor);
+      applyRootZoom(storedZoomFactor);
     }
 
     window.addEventListener("keydown", handleKeyDown);
diff --git a/desktop/src/features/agents/knownAgentPubkeys.ts b/desktop/src/features/agents/knownAgentPubkeys.ts
index 70cbac68fdb..37e0b8d6afe 100644
--- a/desktop/src/features/agents/knownAgentPubkeys.ts
+++ b/desktop/src/features/agents/knownAgentPubkeys.ts
@@ -1,4 +1,5 @@
 import { normalizePubkey } from "@/shared/lib/pubkey";
+import { channelAgentMembers } from "@/shared/lib/rosterDerivations";
 
 /**
  * Pure merge behind `useKnownAgentPubkeys`: managed agents ∪ relay agents,
@@ -62,10 +63,11 @@ export function mergeChannelKnownAgentPubkeys(
   relayAgents: readonly { pubkey: string }[] | undefined,
 ): ReadonlySet<string> {
   const pubkeys = new Set(mergeKnownAgentPubkeys(managedAgents, relayAgents));
-  for (const member of channelMembers ?? []) {
-    if (member.role === "bot" || member.isAgent) {
-      pubkeys.add(normalizePubkey(member.pubkey));
-    }
+  // Identity-cached agent subset: avoids walking the full roster per call.
+  for (const member of channelMembers
+    ? channelAgentMembers(channelMembers)
+    : []) {
+    pubkeys.add(normalizePubkey(member.pubkey));
   }
   return pubkeys;
 }
diff --git a/desktop/src/features/agents/lib/otherSetupAgent.test.mjs b/desktop/src/features/agents/lib/otherSetupAgent.test.mjs
new file mode 100644
index 00000000000..f57c7f8154f
--- /dev/null
+++ b/desktop/src/features/agents/lib/otherSetupAgent.test.mjs
@@ -0,0 +1,35 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import { isOtherSetupAgent } from "./otherSetupAgent.ts";
+
+const OWNER = "a".repeat(64);
+const AGENT = "b".repeat(64);
+
+test("fails closed while the local managed directory is unresolved", () => {
+  assert.equal(
+    isOtherSetupAgent({
+      agentDirectoriesReady: false,
+      currentPubkey: OWNER,
+      managedAgents: [],
+      profileOwnerPubkey: OWNER,
+      pubkey: AGENT,
+      relayAgents: [],
+    }),
+    false,
+  );
+});
+
+test("labels a viewer-owned non-local identity as another setup", () => {
+  assert.equal(
+    isOtherSetupAgent({
+      agentDirectoriesReady: true,
+      currentPubkey: OWNER,
+      managedAgents: [],
+      profileOwnerPubkey: OWNER,
+      pubkey: AGENT,
+      relayAgents: [],
+    }),
+    true,
+  );
+});
diff --git a/desktop/src/features/agents/lib/otherSetupAgent.ts b/desktop/src/features/agents/lib/otherSetupAgent.ts
new file mode 100644
index 00000000000..63438a983fd
--- /dev/null
+++ b/desktop/src/features/agents/lib/otherSetupAgent.ts
@@ -0,0 +1,39 @@
+import type { ManagedAgent, RelayAgent } from "@/shared/api/types";
+import { normalizePubkey } from "@/shared/lib/pubkey";
+
+export function isOtherSetupAgent({
+  agentDirectoriesReady,
+  currentPubkey,
+  managedAgents,
+  profileOwnerPubkey,
+  pubkey,
+  relayAgents,
+}: {
+  agentDirectoriesReady: boolean;
+  currentPubkey?: string;
+  managedAgents: readonly ManagedAgent[];
+  profileOwnerPubkey?: string | null;
+  pubkey: string;
+  relayAgents: readonly RelayAgent[];
+}): boolean {
+  if (!agentDirectoriesReady || !currentPubkey) return false;
+
+  const normalizedPubkey = normalizePubkey(pubkey);
+  if (
+    managedAgents.some(
+      (agent) => normalizePubkey(agent.pubkey) === normalizedPubkey,
+    )
+  ) {
+    return false;
+  }
+
+  const relayOwnerPubkey = relayAgents.find(
+    (agent) => normalizePubkey(agent.pubkey) === normalizedPubkey,
+  )?.ownerPubkey;
+  const ownerPubkey = profileOwnerPubkey ?? relayOwnerPubkey;
+
+  return Boolean(
+    ownerPubkey &&
+      normalizePubkey(ownerPubkey) === normalizePubkey(currentPubkey),
+  );
+}
diff --git a/desktop/src/features/agents/ui/OtherSetupAgentMarker.tsx b/desktop/src/features/agents/ui/OtherSetupAgentMarker.tsx
new file mode 100644
index 00000000000..e6539434696
--- /dev/null
+++ b/desktop/src/features/agents/ui/OtherSetupAgentMarker.tsx
@@ -0,0 +1,30 @@
+import { Cloud } from "lucide-react";
+
+import { cn } from "@/shared/lib/cn";
+import { Badge } from "@/shared/ui/badge";
+
+const OTHER_SETUP_LABEL = "From another Buzz setup";
+
+export function OtherSetupAgentMarker({
+  className,
+  testId,
+}: {
+  className?: string;
+  testId?: string;
+}) {
+  return (
+    <Badge
+      aria-label={OTHER_SETUP_LABEL}
+      className={cn(
+        "gap-1 px-1.5 py-0.5 font-medium normal-case tracking-normal",
+        className,
+      )}
+      data-testid={testId}
+      title={OTHER_SETUP_LABEL}
+      variant="secondary"
+    >
+      <Cloud aria-hidden="true" className="h-3 w-3" />
+      Other setup
+    </Badge>
+  );
+}
diff --git a/desktop/src/features/agents/ui/PersonaCatalogDialog.tsx b/desktop/src/features/agents/ui/PersonaCatalogDialog.tsx
index f78f9d327ef..d2791b480a0 100644
--- a/desktop/src/features/agents/ui/PersonaCatalogDialog.tsx
+++ b/desktop/src/features/agents/ui/PersonaCatalogDialog.tsx
@@ -592,7 +592,7 @@ function PersonaCatalogDetail({ persona }: { persona: AgentPersona }) {
 
       <div className="min-w-0 max-w-full pt-3">
         <p className="text-base font-semibold text-foreground">
-          Agent instruction
+          Agent instructions
         </p>
         <AgentInstructionReview instructions={persona.systemPrompt} />
       </div>
diff --git a/desktop/src/features/agents/ui/agentSessionTranscript.ts b/desktop/src/features/agents/ui/agentSessionTranscript.ts
index e371bf5fc30..dfb8eb22fbd 100644
--- a/desktop/src/features/agents/ui/agentSessionTranscript.ts
+++ b/desktop/src/features/agents/ui/agentSessionTranscript.ts
@@ -871,7 +871,7 @@ export function processTranscriptEvent(
       }
     } else if (event.kind === "acp_write" && method === "session/new") {
       // The base + persona prompts ride session/new's systemPrompt, framed by
-      // the harness as [Base]/[System]/[Agent Memory — core]/[Channel Canvas].
+      // the harness as [Base]/[Agent Instructions]/[Agent Memory — core]/[Channel Canvas].
       // claude-agent-acp uses _meta.systemPrompt.append instead; both paths
       // produce the same standalone card (turnId: null, acpSource "session/new");
       // the bare field takes precedence when both are present.
diff --git a/desktop/src/features/agents/ui/agentSessionTranscriptHelpers.test.mjs b/desktop/src/features/agents/ui/agentSessionTranscriptHelpers.test.mjs
index f0f4cbf36da..23df1e5f2b2 100644
--- a/desktop/src/features/agents/ui/agentSessionTranscriptHelpers.test.mjs
+++ b/desktop/src/features/agents/ui/agentSessionTranscriptHelpers.test.mjs
@@ -201,6 +201,45 @@ test("parseSystemPromptSections splits both prompts into Base and System", () =>
   ]);
 });
 
+test("parseSystemPromptSections splits current Base and Agent Instructions framing", () => {
+  const framed =
+    "[Base]\nbase text\n\n[Workspace]\nCurrent working directory: /workspace\n\n[Agent Instructions]\npersona text";
+  const sections = parseSystemPromptSections(framed);
+  assert.deepEqual(sections, [
+    { title: "Base", body: "base text" },
+    { title: "Workspace", body: "Current working directory: /workspace" },
+    { title: "Agent Instructions", body: "persona text" },
+  ]);
+});
+
+test("parseSystemPromptSections preserves a Windows workspace path", () => {
+  const framed =
+    "[Base]\nbase text\n\n[Workspace]\nCurrent working directory: C:\\Users\\me\\buzz\n\n[Agent Instructions]\npersona text";
+  const sections = parseSystemPromptSections(framed);
+  assert.deepEqual(sections, [
+    { title: "Base", body: "base text" },
+    {
+      title: "Workspace",
+      body: "Current working directory: C:\\Users\\me\\buzz",
+    },
+    { title: "Agent Instructions", body: "persona text" },
+  ]);
+});
+
+test("parseSystemPromptSections preserves the former Workspace-before-Base framing", () => {
+  const framed =
+    "[Workspace]\nYour absolute working directory is `/workspace`.\n\n[Base]\nbase text\n\n[System]\npersona text";
+  const sections = parseSystemPromptSections(framed);
+  assert.deepEqual(sections, [
+    {
+      title: "Workspace",
+      body: "Your absolute working directory is `/workspace`.",
+    },
+    { title: "Base", body: "base text" },
+    { title: "System", body: "persona text" },
+  ]);
+});
+
 test("parseSystemPromptSections yields one Base section for a base-only frame", () => {
   const sections = parseSystemPromptSections("[Base]\nbase text");
   assert.deepEqual(sections, [{ title: "Base", body: "base text" }]);
@@ -211,6 +250,15 @@ test("parseSystemPromptSections yields one System section for a persona-only fra
   assert.deepEqual(sections, [{ title: "System", body: "persona text" }]);
 });
 
+test("parseSystemPromptSections yields Agent Instructions for a current persona-only frame", () => {
+  const sections = parseSystemPromptSections(
+    "[Agent Instructions]\npersona text",
+  );
+  assert.deepEqual(sections, [
+    { title: "Agent Instructions", body: "persona text" },
+  ]);
+});
+
 test("parseSystemPromptSections keeps embedded bracket lines literal in bodies", () => {
   // A persona that itself contains a [Context]-like line must NOT split into a
   // spurious sub-section — the body is read literally after the first boundary.
@@ -323,18 +371,15 @@ test("parseSystemPromptSections keeps exact core header literal when only a sing
   ]);
 });
 
-test("parseSystemPromptSections pins the realistic Workspace+Base+System+Core harness shape", () => {
-  // The real Buzz harness emits [Workspace] content before [Base]. The parser
-  // folds [Workspace] into the Base section (existing unchanged behavior);
-  // core is extracted as a distinct "Core Memory" section last.
+test("parseSystemPromptSections pins the current Base+Workspace+Agent Instructions+Core harness shape", () => {
   const framed = [
-    "[Workspace]",
-    "You are operating inside the Buzz platform.",
-    "",
     "[Base]",
     "You are an assistant.",
     "",
-    "[System]",
+    "[Workspace]",
+    "Current working directory: /workspace",
+    "",
+    "[Agent Instructions]",
     "Custom persona instructions.",
     "",
     "[Agent Memory — core]",
@@ -344,11 +389,9 @@ test("parseSystemPromptSections pins the realistic Workspace+Base+System+Core ha
   ].join("\n");
   const sections = parseSystemPromptSections(framed);
   assert.deepEqual(sections, [
-    {
-      title: "Base",
-      body: "[Workspace]\nYou are operating inside the Buzz platform.\n\n[Base]\nYou are an assistant.",
-    },
-    { title: "System", body: "Custom persona instructions." },
+    { title: "Base", body: "You are an assistant." },
+    { title: "Workspace", body: "Current working directory: /workspace" },
+    { title: "Agent Instructions", body: "Custom persona instructions." },
     {
       title: "Core Memory",
       body: "I am Duncan.\n## Lessons Learned\nAlways tag on handoff.",
diff --git a/desktop/src/features/agents/ui/agentSessionTranscriptHelpers.ts b/desktop/src/features/agents/ui/agentSessionTranscriptHelpers.ts
index 09a2bb31cf9..87cf8ec2dfa 100644
--- a/desktop/src/features/agents/ui/agentSessionTranscriptHelpers.ts
+++ b/desktop/src/features/agents/ui/agentSessionTranscriptHelpers.ts
@@ -56,12 +56,12 @@ export function parsePromptText(text: string): {
 }
 
 /**
- * Split the framed `session/new` `systemPrompt` into its `Base`/`System`/
+ * Split the framed `session/new` `systemPrompt` into its `Base`/`Agent Instructions`/
  * `Team Instructions`/`Core Memory`/`Channel Canvas` sub-sections
  * deterministically.
  *
  * The harness composes the value in order:
- *   `[Base]\n{base}\n\n[System]\n{persona}\n\n[Team Instructions]\n{team}\n\n[Agent Memory — core]\n{core}\n\n[Channel Canvas]\n{canvas}`
+ *   `[Base]\n{base}\n\n[Agent Instructions]\n{persona}\n\n[Team Instructions]\n{team}\n\n[Agent Memory — core]\n{core}\n\n[Channel Canvas]\n{canvas}`
  * with any section omitted when absent. Extraction runs in reverse producer
  * order so that each `lastIndexOf` search operates on the full input and each
  * extraction boundary is unambiguous.
@@ -80,18 +80,19 @@ export function parsePromptText(text: string): {
  * 3. **Team Instructions** (`[Team Instructions]`): appended before core by
  *    `with_team()` in `buzz-acp/src/pool.rs`. Same two cases (start-of-string
  *    or `\n\n[Team Instructions]\n` inline), same last-occurrence guard. Output
- *    position: after System, before Core Memory.
+ *    position: after Agent Instructions, before Core Memory.
  *
- * 4. **Base/System**: remainder after the three top-level section extractions.
- *    Split on the first `\n[System]\n` boundary; no embedded `[...]` line
- *    inside a body can start a new section.
+ * 4. **Base/Agent Instructions**: remainder after the three top-level section
+ *    extractions. Split on the first `\n[Agent Instructions]\n` boundary.
+ *    Archived frames using the former `[System]` header remain supported and
+ *    retain their historical observer label.
  *
- * 5. **Legacy Team Instructions** (backward compat): if the `System` body
+ * 5. **Legacy Team Instructions** (backward compat): if the agent-instructions body
  *    contains the exact canonical delimiter `\n\n---\n# Team Instructions\n`
  *    (produced by the now-removed `compose_prompt()` in buzz-persona), the body
  *    is split at the **last** occurrence of that boundary. The text before
- *    becomes the `System` body; the text after becomes a `Team Instructions`
- *    section inserted immediately after `System`. Non-canonical lookalikes
+ *    becomes the agent-instructions body; the text after becomes a `Team Instructions`
+ *    section inserted immediately after it. Non-canonical lookalikes
  *    (bare `---` without the heading, a `# Team Instructions` on a different
  *    line, or only a single preceding newline) are kept literal inside `System`.
  */
@@ -137,7 +138,7 @@ export function parseSystemPromptSections(
 
   // ── 3. Extract [Team Instructions] (modern runtime framing) ─────────────
   // with_team() in buzz-acp/src/pool.rs appends "\n\n[Team Instructions]\n{instructions}"
-  // after [System] and before core/canvas. Same two cases as canvas/core:
+  // after [Agent Instructions] and before core/canvas. Same two cases as canvas/core:
   // start-of-string (team-only input) or the inline double-newline marker
   // (last occurrence guards against embedded lookalikes preceded by a single \n).
   const TEAM_HEADER = "[Team Instructions]";
@@ -157,48 +158,110 @@ export function parseSystemPromptSections(
     }
   }
 
-  // ── 4. Parse Base/System from the remaining prefix ────────────────────────
+  // ── 4. Parse Base/Workspace/Agent Instructions from the remaining prefix ─
   // The canonical team-instructions delimiter produced by compose_prompt() in
   // buzz-persona/src/resolve.rs:
   //   format!("{persona_prompt}\n\n---\n# Team Instructions\n{instructions}")
   const TEAM_DELIMITER = "\n\n---\n# Team Instructions\n";
 
-  // splitSystemBody: split a raw [System] body string at the last occurrence
-  // of the canonical team delimiter, returning { systemBody, teamBody | null }.
+  // splitInstructionsBody: split a raw agent-instructions body string at the last occurrence
+  // of the canonical team delimiter, returning { instructionsBody, teamBody | null }.
   // Using lastIndexOf mirrors the canvas/core last-occurrence guard: a persona
   // author can embed an exact delimiter-like passage inside the persona body;
   // only the final occurrence is the producer boundary appended by compose_prompt().
-  function splitSystemBody(raw: string): {
-    systemBody: string;
+  function splitInstructionsBody(raw: string): {
+    instructionsBody: string;
     teamBody: string | null;
   } {
     const at = raw.lastIndexOf(TEAM_DELIMITER);
-    if (at === -1) return { systemBody: raw.trim(), teamBody: null };
+    if (at === -1) return { instructionsBody: raw.trim(), teamBody: null };
     return {
-      systemBody: raw.slice(0, at).trim(),
+      instructionsBody: raw.slice(0, at).trim(),
       teamBody: raw.slice(at + TEAM_DELIMITER.length).trim() || null,
     };
   }
 
-  const baseAndSystem = remainder;
-  if (baseAndSystem) {
-    if (baseAndSystem.startsWith("[System]\n")) {
-      const raw = baseAndSystem.slice("[System]\n".length);
-      const { systemBody, teamBody } = splitSystemBody(raw);
-      if (systemBody) sections.push({ title: "System", body: systemBody });
+  const instructionFrames = [
+    { header: "[Agent Instructions]", title: "Agent Instructions" },
+    { header: "[System]", title: "System" },
+  ] as const;
+
+  function appendBaseAndWorkspace(raw: string): void {
+    const BASE_HEADER = "[Base]";
+    const WORKSPACE_HEADER = "[Workspace]";
+    const workspaceMarker = `\n\n${WORKSPACE_HEADER}\n`;
+    const baseMarker = `\n\n${BASE_HEADER}\n`;
+
+    // Current framing keeps the static base first, followed by the dynamic cwd.
+    if (raw.startsWith(`${BASE_HEADER}\n`)) {
+      const workspaceAt = raw.lastIndexOf(workspaceMarker);
+      if (workspaceAt !== -1) {
+        const baseBody = raw
+          .slice(`${BASE_HEADER}\n`.length, workspaceAt)
+          .trim();
+        const workspaceBody = raw
+          .slice(workspaceAt + workspaceMarker.length)
+          .trim();
+        if (baseBody) sections.push({ title: "Base", body: baseBody });
+        if (workspaceBody)
+          sections.push({ title: "Workspace", body: workspaceBody });
+        return;
+      }
+    }
+
+    // Preserve readable transcripts for sessions captured with the former
+    // Workspace-before-Base framing.
+    if (raw.startsWith(`${WORKSPACE_HEADER}\n`)) {
+      const baseAt = raw.lastIndexOf(baseMarker);
+      if (baseAt !== -1) {
+        const workspaceBody = raw
+          .slice(`${WORKSPACE_HEADER}\n`.length, baseAt)
+          .trim();
+        const baseBody = raw.slice(baseAt + baseMarker.length).trim();
+        if (workspaceBody)
+          sections.push({ title: "Workspace", body: workspaceBody });
+        if (baseBody) sections.push({ title: "Base", body: baseBody });
+        return;
+      }
+    }
+
+    const baseBody = raw.replace(/^\[Base]\n/, "").trim();
+    if (baseBody) sections.push({ title: "Base", body: baseBody });
+  }
+
+  const baseAndInstructions = remainder;
+  if (baseAndInstructions) {
+    const leadingFrame = instructionFrames.find(({ header }) =>
+      baseAndInstructions.startsWith(`${header}\n`),
+    );
+    if (leadingFrame) {
+      const raw = baseAndInstructions.slice(`${leadingFrame.header}\n`.length);
+      const { instructionsBody, teamBody } = splitInstructionsBody(raw);
+      if (instructionsBody)
+        sections.push({ title: leadingFrame.title, body: instructionsBody });
       if (teamBody)
         sections.push({ title: "Team Instructions", body: teamBody });
     } else {
-      const marker = "\n[System]\n";
-      const at = baseAndSystem.indexOf(marker);
-      const head = at === -1 ? baseAndSystem : baseAndSystem.slice(0, at);
-      const baseBody = head.replace(/^\[Base]\n/, "").trim();
-      if (baseBody) sections.push({ title: "Base", body: baseBody });
-
-      if (at !== -1) {
-        const raw = baseAndSystem.slice(at + marker.length);
-        const { systemBody, teamBody } = splitSystemBody(raw);
-        if (systemBody) sections.push({ title: "System", body: systemBody });
+      const boundary = instructionFrames
+        .map((frame) => ({
+          ...frame,
+          marker: `\n${frame.header}\n`,
+          at: baseAndInstructions.indexOf(`\n${frame.header}\n`),
+        }))
+        .filter(({ at }) => at !== -1)
+        .sort((a, b) => a.at - b.at)[0];
+      const head = boundary
+        ? baseAndInstructions.slice(0, boundary.at)
+        : baseAndInstructions;
+      appendBaseAndWorkspace(head);
+
+      if (boundary) {
+        const raw = baseAndInstructions.slice(
+          boundary.at + boundary.marker.length,
+        );
+        const { instructionsBody, teamBody } = splitInstructionsBody(raw);
+        if (instructionsBody)
+          sections.push({ title: boundary.title, body: instructionsBody });
         if (teamBody)
           sections.push({ title: "Team Instructions", body: teamBody });
       }
diff --git a/desktop/src/features/agents/ui/useManagedAgentActions.ts b/desktop/src/features/agents/ui/useManagedAgentActions.ts
index 8270bea11f8..0627ad6ac36 100644
--- a/desktop/src/features/agents/ui/useManagedAgentActions.ts
+++ b/desktop/src/features/agents/ui/useManagedAgentActions.ts
@@ -1,4 +1,5 @@
 import * as React from "react";
+import { useQueryClient } from "@tanstack/react-query";
 import { toast } from "sonner";
 
 import {
@@ -15,6 +16,7 @@ import {
 } from "@/features/agents/hooks";
 import { useGlobalAgentConfig } from "@/features/agents/useGlobalAgentConfig";
 import { useChannelsQuery } from "@/features/channels/hooks";
+import { invalidateChannelMembersRosters } from "@/features/channels/rosterFreshness";
 import { usePresenceQuery } from "@/features/presence/hooks";
 import type { AgentPersona, Channel, ManagedAgent } from "@/shared/api/types";
 import { removeChannelMember } from "@/shared/api/tauri";
@@ -34,6 +36,7 @@ import {
 } from "../lib/instanceInputForDefinition";
 
 export function useManagedAgentActions() {
+  const queryClient = useQueryClient();
   const { globalConfig } = useGlobalAgentConfig();
   const relayAgentsQuery = useRelayAgentsQuery();
   const managedAgentsQuery = useManagedAgentsQuery();
@@ -296,6 +299,9 @@ export function useManagedAgentActions() {
     await Promise.allSettled(
       channelIds.map((channelId) => removeChannelMember(channelId, pubkey)),
     );
+    // Direct writes bypass the member mutations' invalidation; without this,
+    // the deleted agent stays in cached rosters for the freshness window.
+    await invalidateChannelMembersRosters(queryClient, channelIds);
   }
 
   async function handleDelete(pubkey: string) {
diff --git a/desktop/src/features/channels/hooks.test.mjs b/desktop/src/features/channels/hooks.test.mjs
index 8efeed8536c..7f4ee63656e 100644
--- a/desktop/src/features/channels/hooks.test.mjs
+++ b/desktop/src/features/channels/hooks.test.mjs
@@ -353,3 +353,22 @@ test("reconcileRefreshedCachedChannel_preservesRefreshedDmRecency", () => {
     ownerPubkey,
   ]);
 });
+
+test("invalidateChannelMembersRosters dedupes and targets member keys", async () => {
+  const { invalidateChannelMembersRosters } = await import(
+    "./rosterFreshness.ts"
+  );
+  const invalidated = [];
+  const queryClient = {
+    invalidateQueries: async ({ queryKey }) => {
+      invalidated.push(queryKey);
+    },
+  };
+
+  await invalidateChannelMembersRosters(queryClient, ["ch-a", "ch-b", "ch-a"]);
+
+  assert.deepEqual(invalidated, [
+    ["channels", "ch-a", "members"],
+    ["channels", "ch-b", "members"],
+  ]);
+});
diff --git a/desktop/src/features/channels/hooks.ts b/desktop/src/features/channels/hooks.ts
index 9f612031f3b..9069b052da4 100644
--- a/desktop/src/features/channels/hooks.ts
+++ b/desktop/src/features/channels/hooks.ts
@@ -44,12 +44,15 @@ import { mergeConcurrentChannelRecency } from "@/features/channels/lib/channelRe
 import { useIdentityQuery } from "@/shared/api/hooks";
 import { useFocusedRefetchInterval } from "@/shared/lib/useDocumentVisible";
 import { useCommunities } from "@/features/communities/useCommunities";
-import { canAddChannelMembers } from "@/features/channels/lib/channelMemberAdmission";
 import {
   inspectChannelSnapshot,
   type ChannelSnapshot,
   writeChannelSnapshot,
 } from "@/features/channels/channelSnapshot";
+import {
+  CHANNEL_MEMBERS_STALE_TIME_MS,
+  channelMembersQueryKey,
+} from "@/features/channels/rosterFreshness";
 
 export const channelsQueryKey = ["channels"] as const;
 /** Keeps focused polling at the established one-minute cadence. */
@@ -69,8 +72,6 @@ export const channelsFocusRefetchPolicy = {
 const channelsSnapshotPairKey = ["channels", "_snapshot-pair"] as const;
 const channelDetailQueryKey = (channelId: string) =>
   ["channels", channelId, "detail"] as const;
-const channelMembersQueryKey = (channelId: string) =>
-  ["channels", channelId, "members"] as const;
 const channelTypeOrder = {
   stream: 0,
   forum: 1,
@@ -628,7 +629,7 @@ export function useChannelMembersQuery(
 
       return getChannelMembers(channelId);
     },
-    staleTime: 30_000,
+    staleTime: CHANNEL_MEMBERS_STALE_TIME_MS,
   });
 }
 
@@ -795,32 +796,6 @@ export function useDeleteChannelMutation(channelId: string | null) {
   });
 }
 
-/**
- * Whether the signed-in identity may add *another* identity to this channel,
- * per {@link canAddChannelMembers}. Both queries are the ones the channel UI
- * already holds, so this shares their cache rather than fetching again.
- */
-export function useCanAddChannelMembers(channelId: string | null) {
-  const channelsQuery = useChannelsQuery();
-  const membersQuery = useChannelMembersQuery(channelId);
-  const identityQuery = useIdentityQuery();
-
-  const channel =
-    channelsQuery.data?.find((candidate) => candidate.id === channelId) ?? null;
-  const selfPubkey = identityQuery.data?.pubkey ?? null;
-  const selfRole = selfPubkey
-    ? (membersQuery.data?.find(
-        (member) => member.pubkey.toLowerCase() === selfPubkey.toLowerCase(),
-      )?.role ?? null)
-    : null;
-
-  return canAddChannelMembers({
-    channelType: channel?.channelType,
-    visibility: channel?.visibility,
-    selfRole,
-  });
-}
-
 export function useAddChannelMembersMutation(channelId: string | null) {
   const queryClient = useQueryClient();
 
diff --git a/desktop/src/features/channels/lib/huddleAvailability.test.mjs b/desktop/src/features/channels/lib/huddleAvailability.test.mjs
index 061d2cdc424..8351651a759 100644
--- a/desktop/src/features/channels/lib/huddleAvailability.test.mjs
+++ b/desktop/src/features/channels/lib/huddleAvailability.test.mjs
@@ -87,11 +87,9 @@ test("canStartHuddleInChannel blocks non-participant DMs", () => {
 });
 
 test("canStartHuddleInChannel keeps private channels member-gated", () => {
-  const privateChannel = channel({ visibility: "private" });
-
   assert.equal(
     canStartHuddleInChannel({
-      channel: privateChannel,
+      channel: channel({ visibility: "private", isMember: false }),
       currentPubkey: SELF,
       selfMember: null,
     }),
@@ -100,7 +98,7 @@ test("canStartHuddleInChannel keeps private channels member-gated", () => {
 
   assert.equal(
     canStartHuddleInChannel({
-      channel: privateChannel,
+      channel: channel({ visibility: "private", isMember: false }),
       currentPubkey: SELF,
       selfMember: member(),
     }),
@@ -108,6 +106,19 @@ test("canStartHuddleInChannel keeps private channels member-gated", () => {
   );
 });
 
+test("canStartHuddleInChannel accepts channel-level membership without a roster", () => {
+  // The roster is fetched lazily; `channel.isMember` derives from the same
+  // kind:39002 event, so it must satisfy the private-channel gate on its own.
+  assert.equal(
+    canStartHuddleInChannel({
+      channel: channel({ visibility: "private", isMember: true }),
+      currentPubkey: SELF,
+      selfMember: null,
+    }),
+    true,
+  );
+});
+
 test("canStartHuddleInChannel blocks archived channels and DMs", () => {
   assert.equal(
     canStartHuddleInChannel({
diff --git a/desktop/src/features/channels/lib/huddleAvailability.ts b/desktop/src/features/channels/lib/huddleAvailability.ts
index 828712d9dd8..15f5f57ab43 100644
--- a/desktop/src/features/channels/lib/huddleAvailability.ts
+++ b/desktop/src/features/channels/lib/huddleAvailability.ts
@@ -31,5 +31,10 @@ export function canStartHuddleInChannel({
     );
   }
 
-  return channel.visibility === "open" || selfMember !== null;
+  // `channel.isMember` and the roster's self entry derive from the same
+  // kind:39002 event; either satisfies the private-channel gate, so callers
+  // that no longer fetch the roster eagerly keep huddle access.
+  return (
+    channel.visibility === "open" || channel.isMember || selfMember !== null
+  );
 }
diff --git a/desktop/src/features/channels/rosterFreshness.ts b/desktop/src/features/channels/rosterFreshness.ts
new file mode 100644
index 00000000000..a0a3603165e
--- /dev/null
+++ b/desktop/src/features/channels/rosterFreshness.ts
@@ -0,0 +1,45 @@
+/**
+ * Member-roster freshness policy and the invalidation helper for write paths
+ * that bypass the member mutations. Split from hooks.ts to keep that file
+ * under the per-file line cap; behavior unchanged.
+ */
+
+import type { useQueryClient } from "@tanstack/react-query";
+
+/** Single source for the members cache key; hooks.ts imports it from here. */
+export const channelMembersQueryKey = (channelId: string) =>
+  ["channels", channelId, "members"] as const;
+
+/**
+ * Freshness window for the full member roster. Kept long because every
+ * membership change the client can observe invalidates this key explicitly:
+ * live join/leave/removed system messages for the active channel
+ * (useChannelSubscription), member-added/removed notifications targeting the
+ * current identity (useMembershipNotifications), and every membership
+ * mutation (add/remove/join/leave, template apply). The residual staleness is
+ * a third party joining a channel the viewer is not currently subscribed to,
+ * which corrects within this window. The previous 30s window put a full
+ * roster fetch (kind:39002 + a kind:0 batch over every member) on nearly
+ * every channel switch.
+ */
+export const CHANNEL_MEMBERS_STALE_TIME_MS = 5 * 60_000;
+
+/**
+ * Invalidates cached rosters for channels whose membership was written
+ * through direct `removeChannelMember` calls that bypass the member
+ * mutations (moderation kick, agent-deletion cleanup). The roster's long
+ * freshness window (CHANNEL_MEMBERS_STALE_TIME_MS) means any direct write
+ * path that skips this leaves the removed identity visible until the window
+ * lapses. Accepts a minimal client shape so node unit tests can stub it.
+ */
+export async function invalidateChannelMembersRosters(
+  queryClient: Pick<ReturnType<typeof useQueryClient>, "invalidateQueries">,
+  channelIds: Iterable<string>,
+) {
+  const uniqueChannelIds = [...new Set(channelIds)];
+  for (const channelId of uniqueChannelIds) {
+    await queryClient.invalidateQueries({
+      queryKey: channelMembersQueryKey(channelId),
+    });
+  }
+}
diff --git a/desktop/src/features/channels/ui/AddMemberSearchResultRow.tsx b/desktop/src/features/channels/ui/AddMemberSearchResultRow.tsx
new file mode 100644
index 00000000000..4990168b2f6
--- /dev/null
+++ b/desktop/src/features/channels/ui/AddMemberSearchResultRow.tsx
@@ -0,0 +1,92 @@
+import { Bot } from "lucide-react";
+import type { UserSearchResult } from "@/shared/api/types";
+import { Button } from "@/shared/ui/button";
+import { cn } from "@/shared/lib/cn";
+import { truncatePubkey } from "@/shared/lib/pubkey";
+import { UserAvatar } from "@/shared/ui/UserAvatar";
+
+const MEMBER_ROW_INSET_DIVIDER_CLASS =
+  "after:pointer-events-none after:absolute after:bottom-0 after:left-[3.75rem] after:right-0 after:h-px after:bg-border/60 after:content-[''] last:after:hidden";
+
+export function formatAddCandidateName(user: UserSearchResult) {
+  return (
+    user.displayName?.trim() ||
+    user.nip05Handle?.trim() ||
+    truncatePubkey(user.pubkey)
+  );
+}
+
+export function AddMemberSearchResultRow({
+  disabled,
+  onSelect,
+  ownerLabel,
+  user,
+}: {
+  disabled: boolean;
+  onSelect: (user: UserSearchResult) => void;
+  ownerLabel?: string | null;
+  user: UserSearchResult;
+}) {
+  return (
+    <div
+      className={cn(
+        "group/add-result relative isolate flex min-h-14 w-full items-center gap-3 px-4 py-3.5 text-left transition-colors duration-150 ease-out hover:bg-muted/40 focus-within:bg-muted/40",
+        MEMBER_ROW_INSET_DIVIDER_CLASS,
+      )}
+      data-testid={`channel-user-search-result-${user.pubkey}`}
+    >
+      <button
+        aria-label={`Select ${formatAddCandidateName(user)}`}
+        className="absolute inset-0 z-0 cursor-pointer focus-visible:outline-hidden focus-visible:ring-1 focus-visible:ring-ring"
+        disabled={disabled}
+        onClick={() => onSelect(user)}
+        type="button"
+      />
+      <UserAvatar
+        avatarUrl={user.avatarUrl}
+        className="pointer-events-none relative z-10 h-8 w-8 text-xs shadow-none"
+        displayName={formatAddCandidateName(user)}
+        size="sm"
+      />
+      <div className="pointer-events-none relative z-10 min-w-0 flex-1">
+        {user.isAgent ? (
+          <div className="min-w-0">
+            <div className="flex min-w-0 items-center gap-2">
+              <span className="truncate text-sm font-medium tracking-tight">
+                {formatAddCandidateName(user)}
+              </span>
+              <span className="inline-flex shrink-0 items-center gap-1 text-xs text-muted-foreground">
+                <Bot aria-hidden="true" className="h-4 w-4" />
+                agent
+              </span>
+            </div>
+            <span className="block truncate font-mono text-2xs text-muted-foreground">
+              {truncatePubkey(user.pubkey)}
+            </span>
+            {ownerLabel ? (
+              <span className="block truncate text-xs text-muted-foreground">
+                managed by {ownerLabel}
+              </span>
+            ) : null}
+          </div>
+        ) : (
+          <span className="block truncate text-sm font-medium tracking-tight">
+            {formatAddCandidateName(user)}
+          </span>
+        )}
+      </div>
+      <Button
+        className="relative z-20 shrink-0"
+        disabled={disabled}
+        onClick={(event) => {
+          event.stopPropagation();
+          onSelect(user);
+        }}
+        size="sm"
+        type="button"
+      >
+        Add
+      </Button>
+    </div>
+  );
+}
diff --git a/desktop/src/features/channels/ui/ChannelMembersBar.tsx b/desktop/src/features/channels/ui/ChannelMembersBar.tsx
index 2debd9e7a9b..a347cf41bbf 100644
--- a/desktop/src/features/channels/ui/ChannelMembersBar.tsx
+++ b/desktop/src/features/channels/ui/ChannelMembersBar.tsx
@@ -65,7 +65,14 @@ export function ChannelMembersBar({
   );
   const { startHuddle, isStarting: isStartingHuddle } = useHuddle();
   const queryClient = useQueryClient();
-  const membersQuery = useChannelMembersQuery(channel.id);
+  // The roster is only needed for DM huddle composition (agent detection and
+  // participant naming). Streams/forums render the count from the channel
+  // summary and gate huddle access on `channel.isMember`, so mounting this
+  // bar must not put a full-roster fetch on the channel-switch path.
+  const membersQuery = useChannelMembersQuery(
+    channel.id,
+    channel.channelType === "dm",
+  );
   const providersQuery = useAvailableAcpRuntimes();
   const managedAgentsQuery = useManagedAgentsQuery();
   const relayAgentsQuery = useRelayAgentsQuery();
diff --git a/desktop/src/features/channels/ui/ChannelPane.tsx b/desktop/src/features/channels/ui/ChannelPane.tsx
index 82da2e42142..bccc163ed40 100644
--- a/desktop/src/features/channels/ui/ChannelPane.tsx
+++ b/desktop/src/features/channels/ui/ChannelPane.tsx
@@ -692,6 +692,7 @@ export const ChannelPane = React.memo(function ChannelPane({
                   ) : null}
                   <ComposerDockBackdrop gutterClassName="inset-x-5" />
                   <MessageComposer
+                    audienceContext={{ type: "channel" }}
                     channelId={activeChannel?.id ?? null}
                     channelName={activeChannel?.name ?? "channel"}
                     channelType={activeChannel?.channelType ?? null}
diff --git a/desktop/src/features/channels/ui/MembersSidebar.tsx b/desktop/src/features/channels/ui/MembersSidebar.tsx
index 9ec3151bb09..70c7bf10a8a 100644
--- a/desktop/src/features/channels/ui/MembersSidebar.tsx
+++ b/desktop/src/features/channels/ui/MembersSidebar.tsx
@@ -1,6 +1,6 @@
 import * as React from "react";
 import { useMutation, useQueryClient } from "@tanstack/react-query";
-import { Bot, UserRoundPlus, X } from "lucide-react";
+import { UserRoundPlus, X } from "lucide-react";
 import {
   invalidateChannelState,
   useAddChannelMembersMutation,
@@ -14,6 +14,7 @@ import {
   getSharedChannelIds,
   isAgentIdentityInAllowedList,
 } from "@/features/agents/lib/agentAutocompleteEligibility";
+import { isOtherSetupAgent } from "@/features/agents/lib/otherSetupAgent";
 import { useIsArchivedPredicate } from "@/features/identity-archive/hooks";
 import { useClassifiedMembers } from "@/features/channels/lib/useClassifiedMembers";
 import { formatMemberName } from "@/features/channels/lib/memberUtils";
@@ -40,7 +41,6 @@ import type {
   ManagedAgent,
   UserSearchResult,
 } from "@/shared/api/types";
-import { Button } from "@/shared/ui/button";
 import {
   Dialog,
   DialogClose,
@@ -50,13 +50,15 @@ import {
 } from "@/shared/ui/dialog";
 import { useProfilePanel } from "@/shared/context/ProfilePanelContext";
 import { useFeedbackToasts } from "@/shared/hooks/useToastEffect";
-import { cn } from "@/shared/lib/cn";
 import { normalizePubkey, truncatePubkey } from "@/shared/lib/pubkey";
-import { UserAvatar } from "@/shared/ui/UserAvatar";
 import {
   MODAL_SEARCH_INPUT_CLASS,
   MODAL_SEARCH_SHELL_CLASS,
 } from "@/shared/ui/modalSearchStyles";
+import {
+  AddMemberSearchResultRow,
+  formatAddCandidateName,
+} from "./AddMemberSearchResultRow";
 import { MembersSidebarMemberCard } from "./MembersSidebarMemberCard";
 import { useManagedAgentRuntimesQuery } from "@/features/agents/managedAgentRuntimeHooks";
 import {
@@ -68,16 +70,6 @@ import { useMembersSidebarActions } from "./useMembersSidebarActions";
 import { useMembersSidebarModeration } from "./useMembersSidebarModeration";
 const MEMBER_ADD_RESULT_LIMIT = 50;
 const MEMBER_SEARCH_MIN_QUERY_LENGTH = 2;
-const MEMBER_ROW_INSET_DIVIDER_CLASS =
-  "after:pointer-events-none after:absolute after:bottom-0 after:left-[3.75rem] after:right-0 after:h-px after:bg-border/60 after:content-[''] last:after:hidden";
-
-function formatAddCandidateName(user: UserSearchResult) {
-  return (
-    user.displayName?.trim() ||
-    user.nip05Handle?.trim() ||
-    truncatePubkey(user.pubkey)
-  );
-}
 type AddMemberSearchCandidate = UserSearchResult & {
   isManagedAgent?: boolean;
   isMember?: boolean;
@@ -193,6 +185,13 @@ export function MembersSidebar({
     managedAgentsQuery,
     relayAgentsQuery,
   } = useClassifiedMembers(rawMembers, currentPubkey);
+  const agentDirectoriesReady =
+    managedAgentsQuery.data !== undefined &&
+    managedAgentsQuery.error === null &&
+    !managedAgentsQuery.isFetching &&
+    relayAgentsQuery.data !== undefined &&
+    relayAgentsQuery.error === null &&
+    !relayAgentsQuery.isFetching;
   const activeMembers = React.useMemo(
     () =>
       [...people, ...bots].sort((left, right) =>
@@ -611,6 +610,16 @@ export function MembersSidebar({
     const managedAgent = memberIsBot
       ? managedAgentByPubkey.get(normalizePubkey(member.pubkey))
       : undefined;
+    const showOtherSetupMarker =
+      memberIsBot &&
+      isOtherSetupAgent({
+        agentDirectoriesReady,
+        currentPubkey,
+        managedAgents: managedAgentsQuery.data ?? [],
+        profileOwnerPubkey: memberProfile?.ownerPubkey,
+        pubkey: member.pubkey,
+        relayAgents: relayAgentsQuery.data ?? [],
+      });
     const managedAgentRuntime =
       memberIsBot && relayUrl
         ? findManagedAgentRuntime(
@@ -675,6 +684,7 @@ export function MembersSidebar({
             memberPresenceQuery.data?.[member.pubkey.toLowerCase()] ?? null
           }
           profileAvatarUrl={memberProfile?.avatarUrl ?? null}
+          showOtherSetupMarker={showOtherSetupMarker}
           viewerIsOwner={viewerIsOwner}
         />
       </div>
@@ -913,78 +923,3 @@ function SearchResultSectionTitle({
     </div>
   );
 }
-
-function AddMemberSearchResultRow({
-  disabled,
-  onSelect,
-  ownerLabel,
-  user,
-}: {
-  disabled: boolean;
-  onSelect: (user: UserSearchResult) => void;
-  ownerLabel?: string | null;
-  user: UserSearchResult;
-}) {
-  return (
-    <div
-      className={cn(
-        "group/add-result relative isolate flex min-h-14 w-full items-center gap-3 px-4 py-3.5 text-left transition-colors duration-150 ease-out hover:bg-muted/40 focus-within:bg-muted/40",
-        MEMBER_ROW_INSET_DIVIDER_CLASS,
-      )}
-      data-testid={`channel-user-search-result-${user.pubkey}`}
-    >
-      <button
-        aria-label={`Select ${formatAddCandidateName(user)}`}
-        className="absolute inset-0 z-0 cursor-pointer focus-visible:outline-hidden focus-visible:ring-1 focus-visible:ring-ring"
-        disabled={disabled}
-        onClick={() => onSelect(user)}
-        type="button"
-      />
-      <UserAvatar
-        avatarUrl={user.avatarUrl}
-        className="pointer-events-none relative z-10 h-8 w-8 text-xs shadow-none"
-        displayName={formatAddCandidateName(user)}
-        size="sm"
-      />
-      <div className="pointer-events-none relative z-10 min-w-0 flex-1">
-        {user.isAgent ? (
-          <div className="min-w-0">
-            <div className="flex min-w-0 items-center gap-2">
-              <span className="truncate text-sm font-medium tracking-tight">
-                {formatAddCandidateName(user)}
-              </span>
-              <span className="inline-flex shrink-0 items-center gap-1 text-xs text-muted-foreground">
-                <Bot aria-hidden="true" className="h-4 w-4" />
-                agent
-              </span>
-            </div>
-            <span className="block truncate font-mono text-2xs text-muted-foreground">
-              {truncatePubkey(user.pubkey)}
-            </span>
-            {ownerLabel ? (
-              <span className="block truncate text-xs text-muted-foreground">
-                managed by {ownerLabel}
-              </span>
-            ) : null}
-          </div>
-        ) : (
-          <span className="block truncate text-sm font-medium tracking-tight">
-            {formatAddCandidateName(user)}
-          </span>
-        )}
-      </div>
-      <Button
-        className="relative z-20 shrink-0"
-        disabled={disabled}
-        onClick={(event) => {
-          event.stopPropagation();
-          onSelect(user);
-        }}
-        size="sm"
-        type="button"
-      >
-        Add
-      </Button>
-    </div>
-  );
-}
diff --git a/desktop/src/features/channels/ui/MembersSidebarMemberCard.tsx b/desktop/src/features/channels/ui/MembersSidebarMemberCard.tsx
index 0257e52ebf9..76750490cde 100644
--- a/desktop/src/features/channels/ui/MembersSidebarMemberCard.tsx
+++ b/desktop/src/features/channels/ui/MembersSidebarMemberCard.tsx
@@ -18,6 +18,7 @@ import {
   getManagedAgentPrimaryActionLabel,
   isManagedAgentActive,
 } from "@/features/agents/lib/managedAgentControlActions";
+import { OtherSetupAgentMarker } from "@/features/agents/ui/OtherSetupAgentMarker";
 import { ProfileAvatar } from "@/features/profile/ui/ProfileAvatar";
 import { PresenceDot } from "@/features/presence/ui/PresenceBadge";
 import {
@@ -73,6 +74,7 @@ type MembersSidebarMemberCardProps = {
   onViewActivity?: (pubkey: string) => void;
   presenceStatus?: PresenceStatus | null;
   profileAvatarUrl?: string | null;
+  showOtherSetupMarker?: boolean;
   viewerIsOwner: boolean;
 };
 
@@ -141,6 +143,7 @@ export function MembersSidebarMemberCard({
   onViewActivity,
   presenceStatus,
   profileAvatarUrl,
+  showOtherSetupMarker = false,
   viewerIsOwner,
 }: MembersSidebarMemberCardProps) {
   const roleLabel = formatRoleLabel(member, memberIsBot);
@@ -177,21 +180,28 @@ export function MembersSidebarMemberCard({
       </div>
       <div className="min-w-0 flex-1">
         {memberIsBot ? (
-          <div className="relative min-w-0">
-            <div className="flex min-w-0 items-center gap-2 transition-opacity duration-150 ease-out group-hover/member:opacity-0 group-focus-within/member:opacity-0">
-              <span className="truncate text-sm font-medium tracking-tight">
-                {memberLabel}
-              </span>
-              <span className="inline-flex shrink-0 items-center gap-1 text-xs text-muted-foreground">
-                <Bot aria-hidden="true" className="h-4 w-4" />
-                {roleLabel}
+          <div className="flex min-w-0 items-center gap-2">
+            <div className="relative min-w-0 flex-1">
+              <div className="flex min-w-0 items-center gap-2 transition-opacity duration-150 ease-out group-hover/member:opacity-0 group-focus-within/member:opacity-0">
+                <span className="truncate text-sm font-medium tracking-tight">
+                  {memberLabel}
+                </span>
+                <span className="inline-flex shrink-0 items-center gap-1 text-xs text-muted-foreground">
+                  <Bot aria-hidden="true" className="h-4 w-4" />
+                  {roleLabel}
+                </span>
+              </div>
+              <span className="absolute inset-0 flex items-center opacity-0 transition-opacity duration-150 ease-out group-hover/member:opacity-100 group-focus-within/member:opacity-100">
+                <span className="truncate font-mono text-sm text-muted-foreground">
+                  {truncatePubkey(member.pubkey)}
+                </span>
               </span>
             </div>
-            <span className="absolute inset-0 flex items-center opacity-0 transition-opacity duration-150 ease-out group-hover/member:opacity-100 group-focus-within/member:opacity-100">
-              <span className="truncate font-mono text-sm text-muted-foreground">
-                {truncatePubkey(member.pubkey)}
-              </span>
-            </span>
+            {showOtherSetupMarker ? (
+              <OtherSetupAgentMarker
+                testId={`sidebar-member-agent-provenance-${member.pubkey}`}
+              />
+            ) : null}
           </div>
         ) : (
           <div className="flex min-w-0 items-center gap-2">
diff --git a/desktop/src/features/channels/ui/useChannelActivityTyping.ts b/desktop/src/features/channels/ui/useChannelActivityTyping.ts
index 0f6807c0590..75a8974d00c 100644
--- a/desktop/src/features/channels/ui/useChannelActivityTyping.ts
+++ b/desktop/src/features/channels/ui/useChannelActivityTyping.ts
@@ -10,6 +10,7 @@ import type {
   RelayAgent,
 } from "@/shared/api/types";
 import { normalizePubkey } from "@/shared/lib/pubkey";
+import { channelAgentMembers } from "@/shared/lib/rosterDerivations";
 import {
   buildChannelAgentSessionCandidates,
   getChannelAgentSessionAgents,
@@ -178,9 +179,12 @@ export function mergeMemberAgentFlagsIntoProfiles(
     | readonly Pick<ChannelMember, "pubkey" | "role" | "isAgent">[]
     | undefined,
 ): UserProfileLookup {
-  const agentMembers = (channelMembers ?? []).filter(
-    (member) => member.role === "bot" || member.isAgent,
-  );
+  if (!channelMembers) {
+    return profiles;
+  }
+  // Identity-cached: this merge re-runs whenever the profile lookup re-keys,
+  // and the filter walked the full roster (10k+ members) each time.
+  const agentMembers = channelAgentMembers(channelMembers);
   if (agentMembers.length === 0) {
     return profiles;
   }
diff --git a/desktop/src/features/channels/ui/useChannelAgentSessions.ts b/desktop/src/features/channels/ui/useChannelAgentSessions.ts
index 8420c373279..20c561e7981 100644
--- a/desktop/src/features/channels/ui/useChannelAgentSessions.ts
+++ b/desktop/src/features/channels/ui/useChannelAgentSessions.ts
@@ -9,6 +9,10 @@ import type {
 } from "@/shared/api/types";
 import { usePanelReturnTarget } from "@/shared/hooks/usePanelReturnTarget";
 import { normalizePubkey, truncatePubkey } from "@/shared/lib/pubkey";
+import {
+  channelBotMemberPubkeySet,
+  channelMemberPubkeySet,
+} from "@/shared/lib/rosterDerivations";
 import {
   type AgentSessionReturnTarget,
   resolveAgentSessionReturnTarget,
@@ -121,15 +125,14 @@ export function getChannelAgentSessionAgents({
     return [];
   }
 
+  // Identity-cached: the memo recomputes whenever the active channel object
+  // churns (e.g. lastMessageAt updates), and these Sets walked the full
+  // roster each time.
   const memberPubkeys = channelMembers
-    ? new Set(channelMembers.map((member) => normalizePubkey(member.pubkey)))
+    ? channelMemberPubkeySet(channelMembers)
     : null;
   const botMemberPubkeys = channelMembers
-    ? new Set(
-        channelMembers
-          .filter((member) => member.role === "bot")
-          .map((member) => normalizePubkey(member.pubkey)),
-      )
+    ? channelBotMemberPubkeySet(channelMembers)
     : null;
 
   return agents.filter((agent) => {
diff --git a/desktop/src/features/channels/ui/useChannelIntro.tsx b/desktop/src/features/channels/ui/useChannelIntro.tsx
index c22bbff2c28..19f2da0edbc 100644
--- a/desktop/src/features/channels/ui/useChannelIntro.tsx
+++ b/desktop/src/features/channels/ui/useChannelIntro.tsx
@@ -91,9 +91,9 @@ export function useChannelIntro({
     if (!activeChannel.archivedAt && activeChannel.isMember) {
       if (onAddAgent) {
         actions.push({
-          description: "Add an agent here.",
+          description: "Bring them in.",
           icon: <Bot aria-hidden className="h-6 w-6" />,
-          label: "Create agent",
+          label: "Add agents",
           onClick: onAddAgent,
           testId: "channel-intro-action-create-agent",
         });
diff --git a/desktop/src/features/channels/useCanAddChannelMembers.ts b/desktop/src/features/channels/useCanAddChannelMembers.ts
new file mode 100644
index 00000000000..1b1a61d4c1d
--- /dev/null
+++ b/desktop/src/features/channels/useCanAddChannelMembers.ts
@@ -0,0 +1,44 @@
+import * as React from "react";
+
+import { canAddChannelMembers } from "@/features/channels/lib/channelMemberAdmission";
+import {
+  useChannelMembersQuery,
+  useChannelsQuery,
+} from "@/features/channels/hooks";
+import { useIdentityQuery } from "@/shared/api/hooks";
+
+// Split from hooks.ts to keep that file under the per-file line cap.
+
+/**
+ * Whether the signed-in identity may add *another* identity to this channel,
+ * per {@link canAddChannelMembers}. Both queries are the ones the channel UI
+ * already holds, so this shares their cache rather than fetching again.
+ */
+export function useCanAddChannelMembers(channelId: string | null) {
+  const channelsQuery = useChannelsQuery();
+  const membersQuery = useChannelMembersQuery(channelId);
+  const identityQuery = useIdentityQuery();
+
+  const channels = channelsQuery.data;
+  const members = membersQuery.data;
+  const selfPubkey = identityQuery.data?.pubkey ?? null;
+  // Memoized: this hook sits in the composer (useMentionSendFlow), which
+  // re-renders per keystroke, and these scans are O(channels) + O(members)
+  // — rosters can be 10k+. Structural sharing keeps the inputs' identities
+  // stable, so the scans run once per data change instead of per keystroke.
+  return React.useMemo(() => {
+    const channel =
+      channels?.find((candidate) => candidate.id === channelId) ?? null;
+    const selfRole = selfPubkey
+      ? (members?.find(
+          (member) => member.pubkey.toLowerCase() === selfPubkey.toLowerCase(),
+        )?.role ?? null)
+      : null;
+
+    return canAddChannelMembers({
+      channelType: channel?.channelType,
+      visibility: channel?.visibility,
+      selfRole,
+    });
+  }, [channelId, channels, members, selfPubkey]);
+}
diff --git a/desktop/src/features/communities/useCommunityInit.ts b/desktop/src/features/communities/useCommunityInit.ts
index e792358713f..5493a47b1e3 100644
--- a/desktop/src/features/communities/useCommunityInit.ts
+++ b/desktop/src/features/communities/useCommunityInit.ts
@@ -23,6 +23,7 @@ import {
 import { resetRenderScopedReactionHydration } from "@/features/messages/lib/renderScopedReactions";
 import { resetBackgroundMediaUploads } from "@/features/messages/lib/backgroundMediaUploadStore";
 import { resetLinkPreviewPreparations } from "@/features/messages/lib/linkPreviewPreparationStore";
+import { resetPersistentAgentAudienceStore } from "@/features/messages/lib/persistentAgentAudience";
 import {
   resetActiveAgentTurnsStore,
   saveActiveAgentTurnsForCommunity,
@@ -76,6 +77,7 @@ async function resetCommunityState({
   resetRenderScopedReactionHydration();
   resetBackgroundMediaUploads();
   resetLinkPreviewPreparations();
+  resetPersistentAgentAudienceStore();
   clearSearchHitEventCache();
   clearMarkdownNodeCache();
   resetMessageLinkMetadataCache();
diff --git a/desktop/src/features/forum/ui/ForumComposer.tsx b/desktop/src/features/forum/ui/ForumComposer.tsx
index 54e7d58c96c..d79cce9c35a 100644
--- a/desktop/src/features/forum/ui/ForumComposer.tsx
+++ b/desktop/src/features/forum/ui/ForumComposer.tsx
@@ -527,6 +527,7 @@ export function ForumComposer({
                 mentions.isMentionOpen ? mentions.suggestions : []
               }
               onChannelSelect={applyChannelInsert}
+              onMentionDismiss={mentions.cancelMentionAutocomplete}
               onMentionFetchMore={mentions.fetchMoreSuggestions}
               onMentionSelect={applyMentionInsert}
               position={autocompletePosition}
diff --git a/desktop/src/features/forum/ui/ForumComposerAutocompletes.tsx b/desktop/src/features/forum/ui/ForumComposerAutocompletes.tsx
index 5608a4e909d..149eec7b91c 100644
--- a/desktop/src/features/forum/ui/ForumComposerAutocompletes.tsx
+++ b/desktop/src/features/forum/ui/ForumComposerAutocompletes.tsx
@@ -12,6 +12,7 @@ type ForumComposerAutocompletesProps = {
   mentionSuggestions: MentionSuggestion[];
   onChannelSelect: (suggestion: ChannelSuggestion) => void;
   onMentionFetchMore?: () => void;
+  onMentionDismiss: () => void;
   onMentionSelect: (suggestion: MentionSuggestion) => void;
   position: "above" | "below";
 };
@@ -23,6 +24,7 @@ export function ForumComposerAutocompletes({
   mentionSuggestions,
   onChannelSelect,
   onMentionFetchMore,
+  onMentionDismiss,
   onMentionSelect,
   position,
 }: ForumComposerAutocompletesProps) {
@@ -35,6 +37,7 @@ export function ForumComposerAutocompletes({
         suggestions={channelSuggestions}
       />
       <MentionAutocomplete
+        onDismiss={onMentionDismiss}
         onFetchMore={onMentionFetchMore}
         onSelect={onMentionSelect}
         position={position}
diff --git a/desktop/src/features/home/ui/InboxDetailPane.tsx b/desktop/src/features/home/ui/InboxDetailPane.tsx
index 4b64ad10e06..9192c649521 100644
--- a/desktop/src/features/home/ui/InboxDetailPane.tsx
+++ b/desktop/src/features/home/ui/InboxDetailPane.tsx
@@ -34,7 +34,6 @@ import {
   isWithinGroupingWindow,
   startsNewMessageGroup,
 } from "@/features/messages/lib/messageGrouping";
-import { orderMentionPubkeysByText } from "@/features/messages/lib/orderMentionPubkeys";
 import { canManageMessageForCurrentUser } from "@/features/messages/lib/canManageMessage";
 import { buildEditMentionState } from "@/features/messages/lib/draftMentionRefs";
 import { imetaMediaFromTags } from "@/features/messages/lib/imetaMediaMarkdown";
@@ -43,13 +42,11 @@ import {
   hasRenderedVideoAttachment,
 } from "@/features/messages/lib/videoReviewContext";
 import { getThreadReference } from "@/features/messages/lib/threading";
-import { normalizePubkey } from "@/shared/lib/pubkey";
 import { MessageComposer } from "@/features/messages/ui/MessageComposer";
 import { useAnchoredScroll } from "@/features/messages/ui/useAnchoredScroll";
 import { useComposerHeightPadding } from "@/features/messages/ui/useComposerHeightPadding";
 import { UpdateIndicator } from "@/features/settings/UpdateIndicator";
 import type { Channel, UserProfileSummary } from "@/shared/api/types";
-import { resolveMentionProps } from "@/shared/lib/resolveMentionNames";
 import { TopChromeInsetHeader } from "@/shared/layout/TopChromeInsetHeader";
 import { cn } from "@/shared/lib/cn";
 import { Button } from "@/shared/ui/button";
@@ -214,40 +211,6 @@ function InboxMessageDetailPane({
   // Build the plain, non-virtualized timeline the shared hook anchors against.
   // Live arrivals rerun its layout compensation without changing the target.
 
-  // A latest reply can represent an Inbox conversation. Resolve the actual
-  // root from loaded context or the complete feed group; never treat an
-  // unresolved root/profile lookup as an authoritative empty audience.
-  const contextRoot = messages.find((message) => message.id === conversationId);
-  const feedRoot = item
-    ? [item.item, ...item.groupItems].find(
-        (groupItem) => groupItem.id === conversationId,
-      )
-    : undefined;
-  const rootMessage = contextRoot
-    ? {
-        authorPubkey: contextRoot.authorPubkey,
-        content: contextRoot.content,
-        mentionPubkeysByName: contextRoot.mentionPubkeysByName,
-      }
-    : feedRoot && profiles
-      ? {
-          authorPubkey: feedRoot.pubkey,
-          content: feedRoot.content,
-          mentionPubkeysByName: resolveMentionProps(feedRoot.tags, profiles)
-            .mentionPubkeysByName,
-        }
-      : null;
-  const initialAgentPubkeys = rootMessage
-    ? currentPubkey &&
-      normalizePubkey(rootMessage.authorPubkey) ===
-        normalizePubkey(currentPubkey)
-      ? orderMentionPubkeysByText(
-          rootMessage.content,
-          rootMessage.mentionPubkeysByName,
-          (pubkey) => agentPubkeys?.has(pubkey) === true,
-        )
-      : []
-    : undefined;
   const displayMessages = React.useMemo<InboxDisplayMessage[]>(() => {
     const selectedMessage = messages.find((message) => message.isSelected);
     const pendingReplyMessages: InboxDisplayMessage[] = replies.map(
@@ -793,15 +756,7 @@ function InboxMessageDetailPane({
           />
           <div className="pointer-events-auto">
             <MessageComposer
-              audienceContext={
-                isDirectMessage
-                  ? null
-                  : {
-                      type: "thread",
-                      threadRootId: item.conversationId,
-                      initialAgentPubkeys,
-                    }
-              }
+              audienceContext={isDirectMessage ? null : { type: "thread" }}
               channelId={item.item.channelId}
               channelName={item.channelLabel ?? "channel"}
               channelType={composerChannelType}
diff --git a/desktop/src/features/huddle/components/HuddleBar.tsx b/desktop/src/features/huddle/components/HuddleBar.tsx
index 16641f4cc34..d5a0423cf7c 100644
--- a/desktop/src/features/huddle/components/HuddleBar.tsx
+++ b/desktop/src/features/huddle/components/HuddleBar.tsx
@@ -28,6 +28,7 @@ import { useEmojiBurst } from "@/shared/ui/EmojiBurstProvider";
 import { Popover, PopoverContent, PopoverTrigger } from "@/shared/ui/popover";
 import { Tooltip, TooltipContent, TooltipTrigger } from "@/shared/ui/tooltip";
 import { useHuddle, useHuddleLevels } from "../HuddleContext";
+import { useHuddleParticipantRoster } from "../hooks/useHuddleParticipantRoster";
 import { AddAgentDialog, type AgentAddResult } from "./AddAgentDialog";
 import type { HuddleAgentVoiceSettings } from "./AgentVoiceMenu";
 import { MicControls, SpeakerControls } from "./MicControls";
@@ -376,6 +377,13 @@ export function HuddleBar({
   const barState = isHuddleVisible && state ? state : renderedState;
   const reactionChannelId = barState?.ephemeral_channel_id ?? null;
   const currentPubkey = identityQuery.data?.pubkey ?? null;
+  const lifecycleParticipants = useHuddleParticipantRoster({
+    parentChannelId: barState?.parent_channel_id ?? null,
+    ephemeralChannelId: barState?.ephemeral_channel_id ?? null,
+    fallbackParticipants: barState?.participants ?? [],
+    preservedParticipants: barState?.agent_pubkeys ?? [],
+    huddleThreadEventId: barState?.huddle_thread_event_id ?? null,
+  });
   const participantSpeakerLevels = React.useMemo(() => {
     const levels = { ...speakerLevels };
     if (currentPubkey) {
@@ -690,7 +698,7 @@ export function HuddleBar({
 
           {mode === "main" ? (
             <HuddleParticipantsControl
-              participants={barState.participants}
+              participants={lifecycleParticipants}
               activeSpeakers={activeSpeakers}
               speakerLevels={participantSpeakerLevels}
               agentPubkeys={barState.agent_pubkeys}
diff --git a/desktop/src/features/huddle/components/HuddleIndicator.tsx b/desktop/src/features/huddle/components/HuddleIndicator.tsx
index 298894c485c..6f11d84731f 100644
--- a/desktop/src/features/huddle/components/HuddleIndicator.tsx
+++ b/desktop/src/features/huddle/components/HuddleIndicator.tsx
@@ -25,6 +25,7 @@ const KIND_HUDDLE_ENDED = 48103;
 
 type ActiveHuddle = {
   ephemeralChannelId: string;
+  huddleThreadEventId: string | null;
   participants: Set<string>;
 };
 
@@ -105,6 +106,7 @@ export function HuddleIndicator({
             endedChannels.delete(ephId);
             huddle = {
               ephemeralChannelId: ephId,
+              huddleThreadEventId: ev.id,
               participants: new Set([ev.pubkey]),
             };
             break;
@@ -120,6 +122,7 @@ export function HuddleIndicator({
             if (!huddle || ephId !== huddle.ephemeralChannelId) {
               huddle = {
                 ephemeralChannelId: ephId,
+                huddleThreadEventId: null,
                 participants: new Set(),
               };
             }
@@ -135,6 +138,7 @@ export function HuddleIndicator({
             if (!huddle || ephId !== huddle.ephemeralChannelId) {
               huddle = {
                 ephemeralChannelId: ephId,
+                huddleThreadEventId: null,
                 participants: new Set(),
               };
             }
@@ -227,7 +231,11 @@ export function HuddleIndicator({
 
       if (activeHuddle) {
         setIsJoining(true);
-        void joinHuddle(channelId, activeHuddle.ephemeralChannelId)
+        void joinHuddle(
+          channelId,
+          activeHuddle.ephemeralChannelId,
+          activeHuddle.huddleThreadEventId ?? undefined,
+        )
           .then(() => {
             void queryClient.invalidateQueries({ queryKey: ["channels"] });
           })
@@ -309,7 +317,11 @@ export function HuddleIndicator({
     if (!activeHuddle || isJoining) return;
     setIsJoining(true);
     try {
-      await joinHuddle(channelId, activeHuddle.ephemeralChannelId);
+      await joinHuddle(
+        channelId,
+        activeHuddle.ephemeralChannelId,
+        activeHuddle.huddleThreadEventId ?? undefined,
+      );
       // Refetch channels so the ephemeral channel appears in the sidebar.
       void queryClient.invalidateQueries({ queryKey: ["channels"] });
     } catch (e) {
diff --git a/desktop/src/features/huddle/components/HuddleRoomHeader.tsx b/desktop/src/features/huddle/components/HuddleRoomHeader.tsx
index a356c6f2a93..0cf9c735da9 100644
--- a/desktop/src/features/huddle/components/HuddleRoomHeader.tsx
+++ b/desktop/src/features/huddle/components/HuddleRoomHeader.tsx
@@ -5,6 +5,7 @@ import * as React from "react";
 import { useProfileQuery, useSelfProfileCache } from "@/features/profile/hooks";
 import { useIdentityQuery } from "@/shared/api/hooks";
 import { useHuddle, useHuddleLevels } from "../HuddleContext";
+import { useHuddleParticipantRoster } from "../hooks/useHuddleParticipantRoster";
 import type { HuddleAgentVoiceSettings } from "./AgentVoiceMenu";
 import { HuddleParticipantsControl } from "./ParticipantList";
 
@@ -19,7 +20,9 @@ type HuddleRosterState = {
   participants: string[];
   agent_pubkeys: string[];
   agent_voice_settings: Record<string, HuddleAgentVoiceSettings>;
+  parent_channel_id: string | null;
   ephemeral_channel_id: string | null;
+  huddle_thread_event_id: string | null;
 };
 
 function isVisible(state: HuddleRosterState | null) {
@@ -35,6 +38,13 @@ export function HuddleRoomHeader() {
   const selfProfileCache = useSelfProfileCache();
   const [state, setState] = React.useState<HuddleRosterState | null>(null);
   const currentPubkey = identityQuery.data?.pubkey ?? null;
+  const lifecycleParticipants = useHuddleParticipantRoster({
+    parentChannelId: state?.parent_channel_id ?? null,
+    ephemeralChannelId: state?.ephemeral_channel_id ?? null,
+    fallbackParticipants: state?.participants ?? [],
+    preservedParticipants: state?.agent_pubkeys ?? [],
+    huddleThreadEventId: state?.huddle_thread_event_id ?? null,
+  });
   const participantSpeakerLevels = React.useMemo(() => {
     const levels = { ...speakerLevels };
     if (currentPubkey) {
@@ -106,7 +116,7 @@ export function HuddleRoomHeader() {
           void interruptAgentSpeech(agentPubkey)
         }
         onRemoveAgent={handleRemoveAgent}
-        participants={state.participants}
+        participants={lifecycleParticipants}
         selfProfile={{
           avatarUrl:
             profileQuery.data?.avatarUrl ??
diff --git a/desktop/src/features/huddle/hooks/useHuddleParticipantRoster.test.mjs b/desktop/src/features/huddle/hooks/useHuddleParticipantRoster.test.mjs
new file mode 100644
index 00000000000..bcf51fdbec1
--- /dev/null
+++ b/desktop/src/features/huddle/hooks/useHuddleParticipantRoster.test.mjs
@@ -0,0 +1,376 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import { reconstructHuddleParticipantRoster as reconstructRoster } from "./useHuddleParticipantRoster.ts";
+
+function reconstructHuddleParticipantRoster(options) {
+  const events = [...options.events];
+  return reconstructRoster({
+    ...options,
+    events,
+    relaySelfPubkey: "relay",
+    huddleThreadEventId:
+      options.huddleThreadEventId ??
+      events.find((candidate) => candidate.kind === 48100)?.id ??
+      null,
+  });
+}
+
+const room = "huddle-room";
+
+function event({
+  id,
+  kind,
+  participant,
+  pubkey = "relay",
+  createdAt = 1,
+  channel = room,
+  rosterRevision,
+  admissionId,
+}) {
+  return {
+    id,
+    kind,
+    pubkey,
+    created_at: createdAt,
+    content: JSON.stringify({
+      ephemeral_channel_id: channel,
+      ...(rosterRevision === undefined
+        ? {}
+        : { roster_revision: rosterRevision }),
+      ...(admissionId === undefined ? {} : { admission_id: admissionId }),
+    }),
+    tags: participant ? [["p", participant]] : [],
+    sig: "",
+  };
+}
+
+test("applies relay-signed joins and leaves over membership fallback", () => {
+  const events = [
+    event({ id: "left", kind: 48102, participant: "mobile", createdAt: 4 }),
+    event({ id: "joined", kind: 48101, participant: "mobile", createdAt: 3 }),
+    event({ id: "started", kind: 48100, pubkey: "desktop", createdAt: 1 }),
+  ];
+
+  assert.deepEqual(
+    reconstructHuddleParticipantRoster({
+      ephemeralChannelId: room,
+      events: events.slice(1),
+      fallbackParticipants: ["desktop"],
+    }),
+    ["desktop", "mobile"],
+  );
+  assert.deepEqual(
+    reconstructHuddleParticipantRoster({
+      ephemeralChannelId: room,
+      events,
+      fallbackParticipants: ["desktop", "mobile"],
+    }),
+    ["desktop"],
+  );
+});
+
+test("ignores other rooms and preserves local and agent participants", () => {
+  const events = [
+    event({
+      id: "other-join",
+      kind: 48101,
+      participant: "someone-else",
+      channel: "another-room",
+    }),
+  ];
+
+  assert.deepEqual(
+    reconstructHuddleParticipantRoster({
+      ephemeralChannelId: room,
+      events,
+      fallbackParticipants: ["DESKTOP"],
+      preservedParticipants: ["desktop", "AGENT"],
+    }),
+    ["desktop", "agent"],
+  );
+});
+
+test("orders same-second start before participant joins", () => {
+  const events = [
+    event({
+      id: "join-sorts-before-start-by-id",
+      kind: 48101,
+      participant: "mobile",
+      createdAt: 2,
+      rosterRevision: 2,
+    }),
+    event({
+      id: "start-sorts-after-join-by-id",
+      kind: 48100,
+      pubkey: "desktop",
+      createdAt: 2,
+    }),
+  ];
+
+  assert.deepEqual(
+    reconstructHuddleParticipantRoster({
+      ephemeralChannelId: room,
+      events,
+      fallbackParticipants: [],
+    }),
+    ["desktop", "mobile"],
+  );
+});
+
+test("orders same-second leave then rejoin by roster revision", () => {
+  const events = [
+    event({
+      id: "joined",
+      kind: 48101,
+      participant: "mobile",
+      createdAt: 2,
+      rosterRevision: 3,
+    }),
+    event({
+      id: "left",
+      kind: 48102,
+      participant: "mobile",
+      createdAt: 2,
+      rosterRevision: 2,
+    }),
+  ];
+
+  assert.deepEqual(
+    reconstructHuddleParticipantRoster({
+      ephemeralChannelId: room,
+      events,
+      fallbackParticipants: ["mobile"],
+    }),
+    ["mobile"],
+  );
+});
+
+test("orders same-second join then leave by admission identity", () => {
+  const events = [
+    event({
+      id: "joined",
+      kind: 48101,
+      participant: "mobile",
+      createdAt: 2,
+      rosterRevision: 3,
+      admissionId: "admission-a",
+    }),
+    event({
+      id: "left",
+      kind: 48102,
+      participant: "mobile",
+      createdAt: 2,
+      admissionId: "admission-a",
+    }),
+  ];
+
+  assert.deepEqual(
+    reconstructHuddleParticipantRoster({
+      ephemeralChannelId: room,
+      events,
+      fallbackParticipants: ["mobile"],
+    }),
+    [],
+  );
+});
+
+test("keeps a participant until their final admission leaves", () => {
+  const events = [
+    event({
+      id: "joined-desktop",
+      kind: 48101,
+      participant: "mobile",
+      createdAt: 2,
+      rosterRevision: 2,
+      admissionId: "desktop-admission",
+    }),
+    event({
+      id: "joined-phone",
+      kind: 48101,
+      participant: "mobile",
+      createdAt: 3,
+      rosterRevision: 3,
+      admissionId: "phone-admission",
+    }),
+    event({
+      id: "left-desktop",
+      kind: 48102,
+      participant: "mobile",
+      createdAt: 4,
+      rosterRevision: 4,
+      admissionId: "desktop-admission",
+    }),
+  ];
+
+  assert.deepEqual(
+    reconstructHuddleParticipantRoster({
+      ephemeralChannelId: room,
+      events,
+      fallbackParticipants: [],
+    }),
+    ["mobile"],
+  );
+
+  events.push(
+    event({
+      id: "left-phone",
+      kind: 48102,
+      participant: "mobile",
+      createdAt: 5,
+      rosterRevision: 5,
+      admissionId: "phone-admission",
+    }),
+  );
+  assert.deepEqual(
+    reconstructHuddleParticipantRoster({
+      ephemeralChannelId: room,
+      events,
+      fallbackParticipants: [],
+    }),
+    [],
+  );
+});
+
+test("orders same-second unrevisioned remote leave before revised rejoin", () => {
+  const events = [
+    event({
+      id: "joined",
+      kind: 48101,
+      participant: "mobile",
+      createdAt: 2,
+      rosterRevision: 3,
+    }),
+    event({
+      id: "left",
+      kind: 48102,
+      participant: "mobile",
+      createdAt: 2,
+    }),
+  ];
+
+  assert.deepEqual(
+    reconstructHuddleParticipantRoster({
+      ephemeralChannelId: room,
+      events,
+      fallbackParticipants: ["mobile"],
+    }),
+    ["mobile"],
+  );
+});
+
+test("rejects lifecycle events without relay or creator provenance", () => {
+  const started = event({
+    id: "started",
+    kind: 48100,
+    pubkey: "creator",
+    createdAt: 1,
+  });
+  const events = [
+    started,
+    event({
+      id: "forged-left",
+      kind: 48102,
+      participant: "mobile",
+      pubkey: "attacker",
+      createdAt: 2,
+    }),
+    event({
+      id: "forged-start",
+      kind: 48100,
+      pubkey: "attacker",
+      createdAt: 3,
+    }),
+    event({
+      id: "forged-end",
+      kind: 48103,
+      pubkey: "attacker",
+      createdAt: 4,
+    }),
+  ];
+
+  assert.deepEqual(
+    reconstructHuddleParticipantRoster({
+      ephemeralChannelId: room,
+      events,
+      fallbackParticipants: ["mobile"],
+      huddleThreadEventId: started.id,
+    }),
+    ["creator"],
+  );
+});
+
+test("an ended lifecycle does not retain stale membership", () => {
+  const events = [
+    event({ id: "started", kind: 48100, pubkey: "desktop", createdAt: 1 }),
+    event({ id: "joined", kind: 48101, participant: "mobile", createdAt: 2 }),
+    event({ id: "ended", kind: 48103, createdAt: 3 }),
+  ];
+
+  assert.deepEqual(
+    reconstructHuddleParticipantRoster({
+      ephemeralChannelId: room,
+      events,
+      fallbackParticipants: ["desktop", "mobile"],
+      preservedParticipants: ["desktop"],
+    }),
+    [],
+  );
+});
+
+test("preserves live fallback peers when the canonical start is outside history", () => {
+  const canonicalStart = event({
+    id: "canonical-start",
+    kind: 48100,
+    pubkey: "desktop",
+    createdAt: 1,
+  });
+  const events = [
+    event({
+      id: "recent-join",
+      kind: 48101,
+      participant: "newcomer",
+      createdAt: 2,
+    }),
+  ];
+
+  assert.deepEqual(
+    reconstructHuddleParticipantRoster({
+      ephemeralChannelId: room,
+      events,
+      fallbackParticipants: ["desktop", "long-lived"],
+      huddleThreadEventId: canonicalStart.id,
+      canonicalStartEvent: canonicalStart,
+    }),
+    ["desktop", "long-lived", "newcomer"],
+  );
+});
+
+test("authenticates an end with a canonical start outside the lifecycle window", () => {
+  const canonicalStart = event({
+    id: "canonical-start",
+    kind: 48100,
+    pubkey: "desktop",
+    createdAt: 1,
+  });
+  const events = [
+    event({ id: "joined", kind: 48101, participant: "mobile", createdAt: 2 }),
+    event({
+      id: "ended",
+      kind: 48103,
+      pubkey: "desktop",
+      createdAt: 3,
+    }),
+  ];
+
+  assert.deepEqual(
+    reconstructHuddleParticipantRoster({
+      ephemeralChannelId: room,
+      events,
+      fallbackParticipants: ["desktop", "mobile"],
+      huddleThreadEventId: canonicalStart.id,
+      canonicalStartEvent: canonicalStart,
+    }),
+    [],
+  );
+});
diff --git a/desktop/src/features/huddle/hooks/useHuddleParticipantRoster.ts b/desktop/src/features/huddle/hooks/useHuddleParticipantRoster.ts
new file mode 100644
index 00000000000..e2fdc022934
--- /dev/null
+++ b/desktop/src/features/huddle/hooks/useHuddleParticipantRoster.ts
@@ -0,0 +1,393 @@
+import * as React from "react";
+
+import { useRelaySelfQuery } from "@/features/moderation/hooks";
+import { relayClient } from "@/shared/api/relayClient";
+import type { RelayEvent } from "@/shared/api/types";
+import {
+  KIND_HUDDLE_ENDED,
+  KIND_HUDDLE_PARTICIPANT_JOINED,
+  KIND_HUDDLE_PARTICIPANT_LEFT,
+  KIND_HUDDLE_STARTED,
+} from "@/shared/constants/kinds";
+
+type ParticipantRosterOptions = {
+  ephemeralChannelId: string;
+  events: Iterable<RelayEvent>;
+  fallbackParticipants?: readonly string[];
+  preservedParticipants?: readonly (string | null | undefined)[];
+  relaySelfPubkey?: string | null;
+  huddleThreadEventId?: string | null;
+  canonicalStartEvent?: RelayEvent | null;
+};
+
+function normalizedPubkey(value: string | null | undefined): string | null {
+  const normalized = value?.trim().toLowerCase();
+  return normalized ? normalized : null;
+}
+
+function lifecycleContent(event: RelayEvent): {
+  ephemeralChannelId: string | null;
+  rosterRevision: number | null;
+  admissionId: string | null;
+} {
+  try {
+    const content = JSON.parse(event.content) as {
+      ephemeral_channel_id?: unknown;
+      roster_revision?: unknown;
+      admission_id?: unknown;
+    };
+    return {
+      ephemeralChannelId:
+        typeof content.ephemeral_channel_id === "string"
+          ? content.ephemeral_channel_id
+          : null,
+      rosterRevision:
+        typeof content.roster_revision === "number" &&
+        Number.isSafeInteger(content.roster_revision) &&
+        content.roster_revision >= 0
+          ? content.roster_revision
+          : null,
+      admissionId:
+        typeof content.admission_id === "string" && content.admission_id
+          ? content.admission_id
+          : null,
+    };
+  } catch {
+    return {
+      ephemeralChannelId: null,
+      rosterRevision: null,
+      admissionId: null,
+    };
+  }
+}
+
+function lifecycleChannelId(event: RelayEvent): string | null {
+  return lifecycleContent(event).ephemeralChannelId;
+}
+
+function lifecyclePhase(kind: number): number {
+  if (kind === KIND_HUDDLE_STARTED) return 0;
+  if (kind === KIND_HUDDLE_ENDED) return 2;
+  return 1;
+}
+
+function compareLifecycleEvents(left: RelayEvent, right: RelayEvent): number {
+  const timestampOrder = left.created_at - right.created_at;
+  if (timestampOrder !== 0) return timestampOrder;
+
+  const phaseOrder = lifecyclePhase(left.kind) - lifecyclePhase(right.kind);
+  if (phaseOrder !== 0) return phaseOrder;
+
+  const leftParticipant = lifecycleParticipant(left);
+  const rightParticipant = lifecycleParticipant(right);
+  const sameParticipant =
+    leftParticipant !== null && leftParticipant === rightParticipant;
+  const leftContent = lifecycleContent(left);
+  const rightContent = lifecycleContent(right);
+  if (
+    sameParticipant &&
+    leftContent.admissionId !== null &&
+    leftContent.admissionId === rightContent.admissionId &&
+    left.kind !== right.kind
+  ) {
+    return left.kind === KIND_HUDDLE_PARTICIPANT_JOINED ? -1 : 1;
+  }
+  const leftRevision = leftContent.rosterRevision;
+  const rightRevision = rightContent.rosterRevision;
+  if (sameParticipant && leftRevision !== rightRevision) {
+    if (leftRevision === null) {
+      return left.kind === KIND_HUDDLE_PARTICIPANT_LEFT ? -1 : 1;
+    }
+    if (rightRevision === null) {
+      return right.kind === KIND_HUDDLE_PARTICIPANT_LEFT ? 1 : -1;
+    }
+    return leftRevision - rightRevision;
+  }
+  if (
+    leftRevision !== null &&
+    rightRevision !== null &&
+    leftRevision !== rightRevision
+  ) {
+    return leftRevision - rightRevision;
+  }
+
+  return left.kind - right.kind || left.id.localeCompare(right.id);
+}
+
+function lifecycleParticipant(event: RelayEvent): string | null {
+  return normalizedPubkey(
+    event.tags.find((tag) => tag[0] === "p")?.[1] ?? event.pubkey,
+  );
+}
+
+function authenticatedLifecycleEvents({
+  events,
+  relaySelfPubkey,
+  huddleThreadEventId,
+  canonicalStartEvent,
+}: Pick<
+  ParticipantRosterOptions,
+  "events" | "relaySelfPubkey" | "huddleThreadEventId" | "canonicalStartEvent"
+>): RelayEvent[] {
+  const relaySelf = normalizedPubkey(relaySelfPubkey);
+  const lifecycle = [...events];
+  if (
+    canonicalStartEvent &&
+    !lifecycle.some((event) => event.id === canonicalStartEvent.id)
+  ) {
+    lifecycle.push(canonicalStartEvent);
+  }
+  const started = huddleThreadEventId
+    ? (lifecycle.find(
+        (event) =>
+          event.kind === KIND_HUDDLE_STARTED &&
+          event.id === huddleThreadEventId,
+      ) ?? null)
+    : null;
+  const creator = started ? normalizedPubkey(started.pubkey) : null;
+
+  return lifecycle.filter((event) => {
+    if (
+      event.kind === KIND_HUDDLE_PARTICIPANT_JOINED ||
+      event.kind === KIND_HUDDLE_PARTICIPANT_LEFT
+    ) {
+      return relaySelf !== null && normalizedPubkey(event.pubkey) === relaySelf;
+    }
+    if (event.kind === KIND_HUDDLE_STARTED) {
+      return started !== null && event.id === started.id;
+    }
+    if (event.kind === KIND_HUDDLE_ENDED) {
+      const signer = normalizedPubkey(event.pubkey);
+      return signer !== null && (signer === creator || signer === relaySelf);
+    }
+    return false;
+  });
+}
+
+/**
+ * Reconstruct the live media roster from relay-signed Huddle lifecycle events.
+ *
+ * Backing-channel membership remains the access-control fallback. Once the
+ * lifecycle stream is present, joins and disconnect-driven leaves are applied
+ * in causal order so clients do not have to wait for membership polling.
+ */
+export function reconstructHuddleParticipantRoster({
+  ephemeralChannelId,
+  events,
+  fallbackParticipants = [],
+  preservedParticipants = [],
+  relaySelfPubkey = null,
+  huddleThreadEventId = null,
+  canonicalStartEvent = null,
+}: ParticipantRosterOptions): string[] {
+  const lifecycleEvents = [...events];
+  const canonicalStartOutsideWindow =
+    canonicalStartEvent !== null &&
+    !lifecycleEvents.some((event) => event.id === canonicalStartEvent.id);
+  const participants = new Set(
+    fallbackParticipants
+      .map(normalizedPubkey)
+      .filter((pubkey): pubkey is string => pubkey !== null),
+  );
+  const sorted = authenticatedLifecycleEvents({
+    events: lifecycleEvents,
+    relaySelfPubkey,
+    huddleThreadEventId,
+    canonicalStartEvent,
+  })
+    .filter((event) => lifecycleChannelId(event) === ephemeralChannelId)
+    // Nostr timestamps have second precision and relay history arrives newest
+    // first. Session phases break start/end ties; owner roster revisions order
+    // same-second join/leave mutations without relying on delivery order.
+    .sort(compareLifecycleEvents);
+  let ended = false;
+  const admissionIdsByParticipant = new Map<string, Set<string>>();
+
+  for (const event of sorted) {
+    switch (event.kind) {
+      case KIND_HUDDLE_STARTED: {
+        ended = false;
+        // A canonical start fetched separately means the bounded lifecycle
+        // history no longer contains the whole session. Preserve the live
+        // membership fallback instead of erasing long-lived participants whose
+        // join fell outside that window.
+        if (!canonicalStartOutsideWindow) participants.clear();
+        admissionIdsByParticipant.clear();
+        const creator = normalizedPubkey(event.pubkey);
+        if (creator) participants.add(creator);
+        break;
+      }
+      case KIND_HUDDLE_PARTICIPANT_JOINED: {
+        if (ended) break;
+        const participant = lifecycleParticipant(event);
+        if (participant) {
+          const admissionId = lifecycleContent(event).admissionId;
+          if (admissionId) {
+            const admissionIds =
+              admissionIdsByParticipant.get(participant) ?? new Set<string>();
+            admissionIds.add(admissionId);
+            admissionIdsByParticipant.set(participant, admissionIds);
+          }
+          participants.add(participant);
+        }
+        break;
+      }
+      case KIND_HUDDLE_PARTICIPANT_LEFT: {
+        if (ended) break;
+        const participant = lifecycleParticipant(event);
+        if (participant) {
+          const admissionId = lifecycleContent(event).admissionId;
+          const admissionIds = admissionIdsByParticipant.get(participant);
+          if (admissionId && admissionIds) {
+            admissionIds.delete(admissionId);
+            if (admissionIds.size > 0) break;
+          }
+          admissionIdsByParticipant.delete(participant);
+          participants.delete(participant);
+        }
+        break;
+      }
+      case KIND_HUDDLE_ENDED:
+        ended = true;
+        participants.clear();
+        admissionIdsByParticipant.clear();
+        break;
+    }
+  }
+
+  if (!ended) {
+    for (const value of preservedParticipants) {
+      const participant = normalizedPubkey(value);
+      if (participant) participants.add(participant);
+    }
+  }
+
+  return [...participants];
+}
+
+type UseHuddleParticipantRosterOptions = {
+  parentChannelId: string | null;
+  ephemeralChannelId: string | null;
+  fallbackParticipants: readonly string[];
+  preservedParticipants?: readonly (string | null | undefined)[];
+  huddleThreadEventId?: string | null;
+};
+
+/** Subscribe the active desktop roster to the canonical signed lifecycle. */
+export function useHuddleParticipantRoster({
+  parentChannelId,
+  ephemeralChannelId,
+  fallbackParticipants,
+  preservedParticipants = [],
+  huddleThreadEventId = null,
+}: UseHuddleParticipantRosterOptions): string[] {
+  const relaySelfPubkey = useRelaySelfQuery(Boolean(parentChannelId)).data;
+  const sessionKey =
+    parentChannelId && ephemeralChannelId
+      ? `${parentChannelId}:${ephemeralChannelId}`
+      : null;
+  const [lifecycle, setLifecycle] = React.useState<{
+    sessionKey: string;
+    events: Map<string, RelayEvent>;
+    canonicalStartEvent: RelayEvent | null;
+  } | null>(null);
+
+  React.useEffect(() => {
+    if (!sessionKey || !parentChannelId) return;
+
+    let disposed = false;
+    let cleanup: (() => void) | null = null;
+    setLifecycle({
+      sessionKey,
+      events: new Map(),
+      canonicalStartEvent: null,
+    });
+
+    void relayClient
+      .subscribeToHuddleEvents(parentChannelId, (event) => {
+        if (disposed || lifecycleChannelId(event) !== ephemeralChannelId)
+          return;
+        setLifecycle((current) => {
+          const events =
+            current?.sessionKey === sessionKey
+              ? new Map(current.events)
+              : new Map<string, RelayEvent>();
+          if (events.has(event.id)) return current;
+          events.set(event.id, event);
+          return {
+            sessionKey,
+            events,
+            canonicalStartEvent:
+              current?.sessionKey === sessionKey
+                ? current.canonicalStartEvent
+                : null,
+          };
+        });
+      })
+      .then((dispose) => {
+        if (disposed) {
+          void dispose();
+          return;
+        }
+        cleanup = () => void dispose();
+      })
+      .catch((error) => {
+        console.error(
+          "[huddle] Participant lifecycle subscription failed:",
+          error,
+        );
+      });
+
+    if (huddleThreadEventId) {
+      void relayClient
+        .fetchEvents({
+          ids: [huddleThreadEventId],
+          kinds: [KIND_HUDDLE_STARTED],
+          limit: 1,
+        })
+        .then(([canonicalStart]) => {
+          if (!canonicalStart || disposed) return;
+          setLifecycle((current) => {
+            const events =
+              current?.sessionKey === sessionKey
+                ? new Map(current.events)
+                : new Map<string, RelayEvent>();
+            return { sessionKey, events, canonicalStartEvent: canonicalStart };
+          });
+        })
+        .catch((error) => {
+          console.error("[huddle] Canonical start lookup failed:", error);
+        });
+    }
+
+    return () => {
+      disposed = true;
+      cleanup?.();
+    };
+  }, [ephemeralChannelId, huddleThreadEventId, parentChannelId, sessionKey]);
+
+  const events =
+    lifecycle?.sessionKey === sessionKey ? lifecycle.events.values() : [];
+  if (!ephemeralChannelId) {
+    return reconstructHuddleParticipantRoster({
+      ephemeralChannelId: "",
+      events: [],
+      fallbackParticipants,
+      preservedParticipants,
+      relaySelfPubkey,
+      huddleThreadEventId,
+    });
+  }
+  return reconstructHuddleParticipantRoster({
+    ephemeralChannelId,
+    events,
+    fallbackParticipants,
+    preservedParticipants,
+    relaySelfPubkey,
+    huddleThreadEventId,
+    canonicalStartEvent:
+      lifecycle?.sessionKey === sessionKey
+        ? lifecycle.canonicalStartEvent
+        : null,
+  });
+}
diff --git a/desktop/src/features/messages/lib/agentAddressMention.d.mts b/desktop/src/features/messages/lib/agentAddressMention.d.mts
new file mode 100644
index 00000000000..5102f07d9f4
--- /dev/null
+++ b/desktop/src/features/messages/lib/agentAddressMention.d.mts
@@ -0,0 +1,12 @@
+export const AGENT_ADDRESS_MENTION_MARKER: "agent-address";
+
+export function buildAgentAddressMentionTags(
+  addressedPubkeys: Iterable<string>,
+  deliveredPubkeys: Iterable<string>,
+): string[][];
+
+export function getAgentAddressMentionPubkeys(
+  tags: readonly (readonly string[])[] | null | undefined,
+): string[];
+
+export function isAgentAddressMentionTag(tag: readonly string[]): boolean;
diff --git a/desktop/src/features/messages/lib/agentAddressMention.mjs b/desktop/src/features/messages/lib/agentAddressMention.mjs
new file mode 100644
index 00000000000..c1297e76125
--- /dev/null
+++ b/desktop/src/features/messages/lib/agentAddressMention.mjs
@@ -0,0 +1,39 @@
+import { normalizePubkey } from "../../../shared/lib/pubkey.ts";
+
+export const AGENT_ADDRESS_MENTION_MARKER = "agent-address";
+
+/**
+ * Persist the subset of delivered mentions that came from the composer's
+ * address tray. The ordinary `p` tag remains the notification mechanism;
+ * this annotated reference is display metadata for reconstructing the tray
+ * state when the message is rendered later.
+ */
+export function buildAgentAddressMentionTags(
+  addressedPubkeys,
+  deliveredPubkeys,
+) {
+  const delivered = new Set([...deliveredPubkeys].map(normalizePubkey));
+  return [...new Set([...addressedPubkeys].map(normalizePubkey))]
+    .filter((pubkey) => pubkey && delivered.has(pubkey))
+    .map((pubkey) => ["mention", pubkey, AGENT_ADDRESS_MENTION_MARKER]);
+}
+
+/** Return the ordered, deduplicated agent-address recipients on an event. */
+export function getAgentAddressMentionPubkeys(tags) {
+  return [
+    ...new Set(
+      (tags ?? [])
+        .filter(
+          (tag) =>
+            tag[0] === "mention" &&
+            tag[2] === AGENT_ADDRESS_MENTION_MARKER &&
+            Boolean(tag[1]),
+        )
+        .map((tag) => normalizePubkey(tag[1])),
+    ),
+  ];
+}
+
+export function isAgentAddressMentionTag(tag) {
+  return tag[0] === "mention" && tag[2] === AGENT_ADDRESS_MENTION_MARKER;
+}
diff --git a/desktop/src/features/messages/lib/agentAddressMention.test.mjs b/desktop/src/features/messages/lib/agentAddressMention.test.mjs
new file mode 100644
index 00000000000..cb239c3c2e3
--- /dev/null
+++ b/desktop/src/features/messages/lib/agentAddressMention.test.mjs
@@ -0,0 +1,30 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import {
+  AGENT_ADDRESS_MENTION_MARKER,
+  buildAgentAddressMentionTags,
+  getAgentAddressMentionPubkeys,
+} from "./agentAddressMention.mjs";
+
+const ALICE = "a".repeat(64);
+const BOB = "b".repeat(64);
+
+test("builds address metadata only for recipients that survived admission", () => {
+  assert.deepEqual(
+    buildAgentAddressMentionTags([ALICE.toUpperCase(), BOB], [ALICE]),
+    [["mention", ALICE, AGENT_ADDRESS_MENTION_MARKER]],
+  );
+});
+
+test("reads ordered address metadata without treating ordinary mentions as tray state", () => {
+  assert.deepEqual(
+    getAgentAddressMentionPubkeys([
+      ["p", BOB],
+      ["mention", BOB],
+      ["mention", ALICE.toUpperCase(), AGENT_ADDRESS_MENTION_MARKER],
+      ["mention", ALICE, AGENT_ADDRESS_MENTION_MARKER],
+    ]),
+    [ALICE],
+  );
+});
diff --git a/desktop/src/features/messages/lib/applyEditTagOverlay.mjs b/desktop/src/features/messages/lib/applyEditTagOverlay.mjs
index 809dcac3bd4..2abffa12b4f 100644
--- a/desktop/src/features/messages/lib/applyEditTagOverlay.mjs
+++ b/desktop/src/features/messages/lib/applyEditTagOverlay.mjs
@@ -9,6 +9,8 @@
  * TypeScript-facing callers get typed access via the sibling `.d.mts`.
  */
 
+import { isAgentAddressMentionTag } from "./agentAddressMention.mjs";
+
 /**
  * Merge the original event's tags with an edit's tags so that:
  *   - `imeta` tags come exclusively from the edit (full new attachment set);
@@ -17,7 +19,8 @@
  *     snapshot from the edited composer (marked by `buzz:mention-snapshot`)
  *     and therefore replace the original set; this preserves the edited body's
  *     stable recipient identities even before profiles load or after an alias
- *     changes;
+ *     changes. Agent-address mention metadata describes immutable send-time
+ *     state, so it survives that authored-mention snapshot;
  *   - `emoji` (NIP-30 custom-emoji) tags come from the edit *when the edit
  *     supplies any* — the edited body may add or remove custom emoji, so a
  *     supplied set rebuilds the shortcode→url map. But when the edit supplies
@@ -39,7 +42,9 @@ export function applyEditTagOverlay(originalTags, editTags) {
   const hasMentionSnapshot = editTags.some(
     (t) => t[0] === "buzz:mention-snapshot",
   );
-  const editMentions = editTags.filter((t) => t[0] === "mention");
+  const editMentions = editTags.filter(
+    (t) => t[0] === "mention" && !isAgentAddressMentionTag(t),
+  );
   // imeta is always fully replaced by the edit. emoji is replaced only when
   // the edit actually supplies emoji tags; otherwise the original's are kept.
   // An edit carrying the private snapshot marker is authoritative, including
@@ -48,7 +53,12 @@ export function applyEditTagOverlay(originalTags, editTags) {
   const droppedFromOriginal = (tag) => {
     if (tag[0] === "imeta") return false;
     if (editEmoji.length > 0 && tag[0] === "emoji") return false;
-    if (hasMentionSnapshot && tag[0] === "mention") return false;
+    if (
+      hasMentionSnapshot &&
+      tag[0] === "mention" &&
+      !isAgentAddressMentionTag(tag)
+    )
+      return false;
     return true;
   };
   const baseFromOriginal = originalTags.filter(droppedFromOriginal);
diff --git a/desktop/src/features/messages/lib/applyEditTagOverlay.test.mjs b/desktop/src/features/messages/lib/applyEditTagOverlay.test.mjs
index d77bf9d940a..40cca2f858d 100644
--- a/desktop/src/features/messages/lib/applyEditTagOverlay.test.mjs
+++ b/desktop/src/features/messages/lib/applyEditTagOverlay.test.mjs
@@ -153,6 +153,27 @@ test("edit mention snapshot replaces original references, including removals", (
   );
 });
 
+test("edit mention snapshots preserve the original agent-address state", () => {
+  const original = [
+    ["h", "uuid"],
+    ["mention", "addressed-agent", "agent-address"],
+    ["mention", "old-authored-mention"],
+  ];
+  const out = applyEditTagOverlay(original, [
+    ["buzz:mention-snapshot"],
+    ["mention", "addressed-agent", "agent-address"],
+    ["mention", "new-authored-mention"],
+  ]);
+
+  assert.deepEqual(
+    out.filter((tag) => tag[0] === "mention"),
+    [
+      ["mention", "addressed-agent", "agent-address"],
+      ["mention", "new-authored-mention"],
+    ],
+  );
+});
+
 test("legacy edits preserve original mention references", () => {
   const original = [
     ["h", "uuid"],
diff --git a/desktop/src/features/messages/lib/autoPinMentionedAgentsPreference.test.mjs b/desktop/src/features/messages/lib/autoPinMentionedAgentsPreference.test.mjs
new file mode 100644
index 00000000000..d7516fe6912
--- /dev/null
+++ b/desktop/src/features/messages/lib/autoPinMentionedAgentsPreference.test.mjs
@@ -0,0 +1,33 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+const values = new Map();
+globalThis.localStorage = {
+  getItem: (key) => values.get(key) ?? null,
+  setItem: (key, value) => values.set(key, String(value)),
+};
+
+const preference = await import("./autoPinMentionedAgentsPreference.ts");
+
+test("defaults missing and invalid values to keeping mentioned agents pinned", () => {
+  assert.equal(preference.parseKeepMentionedAgentsPinned(null), true);
+  assert.equal(preference.parseKeepMentionedAgentsPinned("invalid"), true);
+  assert.equal(preference.parseKeepMentionedAgentsPinned("true"), true);
+  assert.equal(preference.parseKeepMentionedAgentsPinned("false"), false);
+});
+
+test("persists changes to the post-mention pinning preference", () => {
+  preference.setKeepMentionedAgentsPinned(false);
+  assert.equal(preference.getKeepMentionedAgentsPinned(), false);
+  assert.equal(
+    values.get(preference.KEEP_MENTIONED_AGENTS_PINNED_STORAGE_KEY),
+    "false",
+  );
+
+  preference.setKeepMentionedAgentsPinned(true);
+  assert.equal(preference.getKeepMentionedAgentsPinned(), true);
+  assert.equal(
+    values.get(preference.KEEP_MENTIONED_AGENTS_PINNED_STORAGE_KEY),
+    "true",
+  );
+});
diff --git a/desktop/src/features/messages/lib/autoPinMentionedAgentsPreference.ts b/desktop/src/features/messages/lib/autoPinMentionedAgentsPreference.ts
new file mode 100644
index 00000000000..0a3821b4e37
--- /dev/null
+++ b/desktop/src/features/messages/lib/autoPinMentionedAgentsPreference.ts
@@ -0,0 +1,59 @@
+import * as React from "react";
+
+export const KEEP_MENTIONED_AGENTS_PINNED_STORAGE_KEY =
+  "buzz.messages.keepMentionedAgentsPinned";
+export const DEFAULT_KEEP_MENTIONED_AGENTS_PINNED = true;
+
+const listeners = new Set<() => void>();
+let keepMentionedAgentsPinned = readStoredPreference();
+
+export function parseKeepMentionedAgentsPinned(
+  value: string | null | undefined,
+): boolean {
+  if (value === "false") return false;
+  if (value === "true") return true;
+  return DEFAULT_KEEP_MENTIONED_AGENTS_PINNED;
+}
+
+function readStoredPreference(): boolean {
+  try {
+    return parseKeepMentionedAgentsPinned(
+      globalThis.localStorage?.getItem(
+        KEEP_MENTIONED_AGENTS_PINNED_STORAGE_KEY,
+      ),
+    );
+  } catch {
+    return DEFAULT_KEEP_MENTIONED_AGENTS_PINNED;
+  }
+}
+
+function subscribe(listener: () => void): () => void {
+  listeners.add(listener);
+  return () => listeners.delete(listener);
+}
+
+export function getKeepMentionedAgentsPinned(): boolean {
+  return keepMentionedAgentsPinned;
+}
+
+export function setKeepMentionedAgentsPinned(value: boolean): void {
+  if (value === keepMentionedAgentsPinned) return;
+  keepMentionedAgentsPinned = value;
+  try {
+    globalThis.localStorage?.setItem(
+      KEEP_MENTIONED_AGENTS_PINNED_STORAGE_KEY,
+      String(value),
+    );
+  } catch {
+    // Persistence is best-effort; the live preference still applies.
+  }
+  for (const listener of listeners) listener();
+}
+
+export function useKeepMentionedAgentsPinned(): boolean {
+  return React.useSyncExternalStore(
+    subscribe,
+    getKeepMentionedAgentsPinned,
+    () => DEFAULT_KEEP_MENTIONED_AGENTS_PINNED,
+  );
+}
diff --git a/desktop/src/features/messages/lib/extractMentionPersonas.ts b/desktop/src/features/messages/lib/extractMentionPersonas.ts
new file mode 100644
index 00000000000..a65f9123c49
--- /dev/null
+++ b/desktop/src/features/messages/lib/extractMentionPersonas.ts
@@ -0,0 +1,26 @@
+import type { AgentPersona } from "@/shared/api/types";
+import { hasMention } from "./hasMention";
+
+export type PersonaMentionTarget = {
+  displayName: string;
+  persona: AgentPersona;
+};
+
+export function extractMentionPersonasFromMaps(
+  text: string,
+  personaMentions: ReadonlyMap<string, string>,
+  activePersonaById: ReadonlyMap<string, AgentPersona>,
+): PersonaMentionTarget[] {
+  const targets: PersonaMentionTarget[] = [];
+  const seen = new Set<string>();
+
+  for (const [displayName, personaId] of personaMentions) {
+    if (seen.has(personaId) || !hasMention(text, displayName)) continue;
+    const persona = activePersonaById.get(personaId);
+    if (!persona) continue;
+    targets.push({ displayName, persona });
+    seen.add(personaId);
+  }
+
+  return targets;
+}
diff --git a/desktop/src/features/messages/lib/flushMentionDebounce.test.mjs b/desktop/src/features/messages/lib/flushMentionDebounce.test.mjs
index 4dfd9d99273..0e5ef81d057 100644
--- a/desktop/src/features/messages/lib/flushMentionDebounce.test.mjs
+++ b/desktop/src/features/messages/lib/flushMentionDebounce.test.mjs
@@ -31,6 +31,7 @@ test("flushMentionDebounce returns the fresh suggestion with its fresh start ind
       candidate({ displayName: "Beta", pubkey: "b".repeat(64) }),
     ],
     activePersonaIds: new Set(),
+    agentProvenanceReady: true,
     channelType: "group",
   });
 
@@ -48,6 +49,7 @@ test("flushMentionDebounce returns no-match for a fresh query with no matches",
     searchableNamesLowerRef: ref(["alpha", "beta"]),
     candidates: [candidate()],
     activePersonaIds: new Set(),
+    agentProvenanceReady: true,
     channelType: "group",
   });
 
@@ -62,6 +64,7 @@ test("flushMentionDebounce returns null for an empty fresh query", () => {
     searchableNamesLowerRef: ref(["alpha", "beta"]),
     candidates: [candidate()],
     activePersonaIds: new Set(),
+    agentProvenanceReady: true,
     channelType: "group",
   });
 
@@ -99,6 +102,7 @@ test("flushMentionDebounce preserves a team expansion selected with Enter", () =
       }),
     ],
     activePersonaIds: new Set(),
+    agentProvenanceReady: true,
     channelType: "group",
   });
 
diff --git a/desktop/src/features/messages/lib/flushMentionDebounce.ts b/desktop/src/features/messages/lib/flushMentionDebounce.ts
index fc343e4d8fe..c7f3bd520b1 100644
--- a/desktop/src/features/messages/lib/flushMentionDebounce.ts
+++ b/desktop/src/features/messages/lib/flushMentionDebounce.ts
@@ -37,6 +37,7 @@ export function flushMentionDebounce<T extends MentionCandidateWithUI>(opts: {
   searchableNamesLowerRef: React.RefObject<string[]>;
   candidates: readonly T[];
   activePersonaIds: ReadonlySet<string>;
+  agentProvenanceReady: boolean;
   channelType?: ChannelType | null;
   currentPubkey?: string | null;
   ownerProfiles?: UserProfileLookup;
@@ -72,6 +73,7 @@ export function flushMentionDebounce<T extends MentionCandidateWithUI>(opts: {
   return {
     type: "match",
     suggestion: mapMentionCandidateToSuggestion({
+      agentProvenanceReady: opts.agentProvenanceReady,
       candidate,
       label,
       channelType: opts.channelType,
diff --git a/desktop/src/features/messages/lib/formatTimelineMessages.ts b/desktop/src/features/messages/lib/formatTimelineMessages.ts
index ab35ecfcc41..a24da67f700 100644
--- a/desktop/src/features/messages/lib/formatTimelineMessages.ts
+++ b/desktop/src/features/messages/lib/formatTimelineMessages.ts
@@ -38,6 +38,9 @@ import {
 } from "@/shared/constants/kinds";
 import { resolveEventAuthorPubkey } from "@/shared/lib/authors";
 import { normalizePubkey } from "@/shared/lib/pubkey";
+import { channelRoleMap } from "@/shared/lib/rosterDerivations";
+
+const EMPTY_ROLE_MAP: ReadonlyMap<string, string> = new Map();
 import { formatTime } from "@/features/messages/lib/dateFormatters";
 // Pure overlay helper lives in a sibling .mjs so node:test (no TS loader)
 // can exercise the exact same source the renderer uses.
@@ -228,12 +231,9 @@ export function formatTimelineMessages(
   ownerProfiles?: UserProfileLookup,
 ): TimelineMessage[] {
   const currentPubkeyLower = currentPubkey?.toLowerCase();
-  const roleByPubkey = new Map<string, string>();
-  if (members) {
-    for (const member of members) {
-      roleByPubkey.set(member.pubkey.toLowerCase(), member.role);
-    }
-  }
+  // Identity-cached: rosters can be 10k+ members and this formatter re-runs
+  // on every live message; the map is computed once per distinct roster.
+  const roleByPubkey = members ? channelRoleMap(members) : EMPTY_ROLE_MAP;
   const deletedEventIds = new Set<string>();
   for (const event of events) {
     // Both kind:5 and kind:9005 are deletion markers; mirror the relay.
diff --git a/desktop/src/features/messages/lib/mentionHighlightExtension.test.mjs b/desktop/src/features/messages/lib/mentionHighlightExtension.test.mjs
index 164225fd80d..6c7055c20d8 100644
--- a/desktop/src/features/messages/lib/mentionHighlightExtension.test.mjs
+++ b/desktop/src/features/messages/lib/mentionHighlightExtension.test.mjs
@@ -1,9 +1,21 @@
 import assert from "node:assert/strict";
 import test from "node:test";
 
+import { getSchema } from "@tiptap/core";
+import { EditorState, TextSelection } from "@tiptap/pm/state";
+import StarterKit from "@tiptap/starter-kit";
+
 import {
+  assignMentionHighlightNames,
   buildHighlightPatterns,
+  createMentionCaretSettlement,
   findHighlightMatches,
+  insertPosForMentionTextInput,
+  MentionHighlightExtension,
+  mentionTextInputInsertPos,
+  positionAfterArrowLeftThroughMentionSpace,
+  selectionAfterMentionTrailingSpace,
+  shouldAdvanceMentionCaret,
 } from "./mentionHighlightExtension.ts";
 
 // ── buildHighlightPatterns ────────────────────────────────────────────
@@ -164,3 +176,205 @@ test("#general should NOT match inside #generally (trailing word boundary)", ()
   const matches = findHighlightMatches("#generally", patterns);
   assert.equal(matches.length, 0);
 });
+
+const schema = getSchema([
+  StarterKit.configure({
+    heading: false,
+    trailingNode: false,
+    link: false,
+  }),
+]);
+const paragraph = (...content) => schema.nodes.paragraph.create(null, content);
+const text = (value) => schema.text(value);
+const document = (...content) => schema.nodes.doc.create(null, content);
+
+test("selectionAfterMentionTrailingSpace steps past the space after @Name", () => {
+  const doc = document(paragraph(text("@quinn ")));
+  const spacePos = 1 + "@quinn".length;
+  assert.equal(selectionAfterMentionTrailingSpace(doc, spacePos), spacePos + 1);
+  assert.equal(
+    selectionAfterMentionTrailingSpace(doc, spacePos + 1),
+    spacePos + 1,
+  );
+});
+
+test("selectionAfterMentionTrailingSpace leaves a caret inside the mention name", () => {
+  const doc = document(paragraph(text("@quinn ")));
+  assert.equal(selectionAfterMentionTrailingSpace(doc, 4), 4);
+});
+
+test("selectionAfterMentionTrailingSpace does not move without a trailing space", () => {
+  const doc = document(paragraph(text("@quinn")));
+  const end = 1 + "@quinn".length;
+  assert.equal(selectionAfterMentionTrailingSpace(doc, end), end);
+});
+
+test("shouldAdvanceMentionCaret restores a remap while this editor is settling", () => {
+  assert.equal(
+    shouldAdvanceMentionCaret({
+      from: 7,
+      next: 8,
+      settling: true,
+    }),
+    true,
+  );
+});
+
+test("shouldAdvanceMentionCaret does not steal ArrowLeft after settlement is cancelled", () => {
+  assert.equal(
+    shouldAdvanceMentionCaret({
+      from: 7,
+      next: 8,
+      settling: false,
+    }),
+    false,
+  );
+});
+
+test("shouldAdvanceMentionCaret does not advance on an unsettled document change", () => {
+  // Regression: `docChanged` used to force an advance. That walked the caret
+  // across a mention's trailing space on every keystroke, so typing `@name`
+  // before existing text interleaved spaces into the draft.
+  assert.equal(
+    shouldAdvanceMentionCaret({ from: 7, next: 8, settling: false }),
+    false,
+  );
+});
+
+test("createMentionCaretSettlement keeps two editors independent", () => {
+  const composerA = createMentionCaretSettlement();
+  const composerB = createMentionCaretSettlement();
+  composerA.arm(8);
+  assert.equal(composerB.peek(), null);
+  composerB.arm(12);
+  composerA.cancel();
+  assert.equal(composerA.peek(), null);
+  assert.equal(composerB.peek(), 12);
+});
+
+test("insertPosForMentionTextInput redirects a caret at the chip edge", () => {
+  const doc = document(paragraph(text("@quinn ")));
+  const spacePos = 1 + "@quinn".length;
+  assert.equal(
+    insertPosForMentionTextInput(doc, spacePos, spacePos),
+    spacePos + 1,
+  );
+  assert.equal(
+    insertPosForMentionTextInput(doc, spacePos + 1, spacePos + 1),
+    null,
+  );
+});
+
+test("insertPosForMentionTextInput keeps a selected trailing space", () => {
+  const doc = document(paragraph(text("@quinn ")));
+  const spacePos = 1 + "@quinn".length;
+  assert.equal(
+    insertPosForMentionTextInput(doc, spacePos, spacePos + 1),
+    spacePos + 1,
+  );
+});
+
+test("mentionTextInputInsertPos honors a deliberate caret after settlement", () => {
+  const doc = document(paragraph(text("@bob ")));
+  const spacePos = 1 + "@bob".length;
+  assert.equal(mentionTextInputInsertPos(doc, spacePos, spacePos, false), null);
+  assert.equal(
+    mentionTextInputInsertPos(doc, spacePos, spacePos, true),
+    spacePos + 1,
+  );
+});
+
+test("positionAfterArrowLeftThroughMentionSpace steps onto the token end", () => {
+  const doc = document(paragraph(text("@bob ")));
+  const afterSpace = 1 + "@bob".length + 1;
+  assert.equal(
+    positionAfterArrowLeftThroughMentionSpace(doc, afterSpace),
+    afterSpace - 1,
+  );
+  assert.equal(
+    positionAfterArrowLeftThroughMentionSpace(doc, afterSpace - 1),
+    null,
+  );
+});
+
+test("assignMentionHighlightNames skips an unchanged list", () => {
+  const storage = { names: ["bob"], agentNames: [], channelNames: [] };
+  assert.equal(assignMentionHighlightNames(storage, ["bob"], [], []), false);
+});
+
+test("assignMentionHighlightNames updates when a new mention is added", () => {
+  const storage = { names: ["bob"], agentNames: [], channelNames: [] };
+  assert.equal(
+    assignMentionHighlightNames(storage, ["bob", "quinn"], [], []),
+    true,
+  );
+  assert.deepEqual(storage.names, ["bob", "quinn"]);
+});
+
+// ── caret regression: typing a mention before existing text ───────────
+//
+// Drives the real plugin through EditorState so `appendTransaction` runs.
+// Before the fix, every keystroke advanced the caret across a mention's
+// trailing space, interleaving spaces into the rest of the draft.
+
+function editorStateWithMentionHighlight(initialText, names) {
+  // The plugin factory only reads `this.storage`, so a minimal stand-in is
+  // enough to exercise it without constructing a full editor (needs a DOM).
+  const plugins = MentionHighlightExtension.config.addProseMirrorPlugins.call({
+    storage: { names, agentNames: [], channelNames: [] },
+  });
+  return EditorState.create({
+    doc: document(paragraph(text(initialText))),
+    schema,
+    plugins,
+  });
+}
+
+/** Insert `typed` one character at a time at `startPos`, as typing does. */
+function typeAt(state, startPos, typed) {
+  let next = state.apply(
+    state.tr.setSelection(TextSelection.create(state.doc, startPos)),
+  );
+  for (const char of typed) {
+    const { from, to } = next.selection;
+    const tr = next.tr.insertText(char, from, to);
+    tr.setSelection(TextSelection.create(tr.doc, tr.mapping.map(to, 1)));
+    next = next.apply(tr);
+  }
+  return next;
+}
+
+test("typing a mention before existing text does not interleave spaces", () => {
+  // Caret placed just after "hello" in "hello world", then " @qu" is typed.
+  const state = editorStateWithMentionHighlight("hello world", ["quinn"]);
+  const typed = typeAt(state, 1 + "hello".length, " @qu");
+  assert.equal(typed.doc.textContent, "hello @qu world");
+});
+
+test("typing a mention before existing text keeps the caret with the text", () => {
+  const state = editorStateWithMentionHighlight("hello world", ["quinn"]);
+  const typed = typeAt(state, 1 + "hello".length, " @qu");
+  assert.equal(typed.selection.from, 1 + "hello @qu".length);
+});
+
+test("an unknown @token before existing text is not rewritten either", () => {
+  // The trailing-space scan is purely textual, so it fired even for names
+  // that were never registered as mentions.
+  const state = editorStateWithMentionHighlight("hello world", []);
+  const typed = typeAt(state, 1 + "hello".length, " @zz");
+  assert.equal(typed.doc.textContent, "hello @zz world");
+});
+
+test("typing a mention at the end of a message still works", () => {
+  const state = editorStateWithMentionHighlight("hello world", ["quinn"]);
+  const typed = typeAt(state, 1 + "hello world".length, " @qu");
+  assert.equal(typed.doc.textContent, "hello world @qu");
+});
+
+test("typing after a completed mention keeps the separator intact", () => {
+  // "@quinn " already exists; typing at the very end must not consume or
+  // duplicate the trailing space.
+  const state = editorStateWithMentionHighlight("@quinn world", ["quinn"]);
+  const typed = typeAt(state, 1 + "@quinn world".length, "!");
+  assert.equal(typed.doc.textContent, "@quinn world!");
+});
diff --git a/desktop/src/features/messages/lib/mentionHighlightExtension.ts b/desktop/src/features/messages/lib/mentionHighlightExtension.ts
index a8d3ef8ff0a..82809eaabc0 100644
--- a/desktop/src/features/messages/lib/mentionHighlightExtension.ts
+++ b/desktop/src/features/messages/lib/mentionHighlightExtension.ts
@@ -1,5 +1,11 @@
 import { Extension } from "@tiptap/core";
-import { Plugin, PluginKey, type Transaction } from "@tiptap/pm/state";
+import type { Node as ProseMirrorNode } from "@tiptap/pm/model";
+import {
+  Plugin,
+  PluginKey,
+  TextSelection,
+  type Transaction,
+} from "@tiptap/pm/state";
 import { Decoration, DecorationSet } from "@tiptap/pm/view";
 
 import {
@@ -9,6 +15,241 @@ import {
 
 export const mentionHighlightKey = new PluginKey("mentionHighlight");
 
+export type MentionCaretSettlement = {
+  arm: (pos: number) => void;
+  peek: () => number | null;
+  cancel: () => void;
+};
+
+export function createMentionCaretSettlement(): MentionCaretSettlement {
+  let pos: number | null = null;
+  return {
+    arm(nextPos: number) {
+      pos = nextPos;
+    },
+    peek() {
+      return pos;
+    },
+    cancel() {
+      pos = null;
+    },
+  };
+}
+
+/**
+ * Whether to move an empty caret from `from` to `next` after a mention
+ * trailing space. Settlement is per editor: autocomplete arms it, and
+ * ArrowLeft/click cancel it so we do not steal an intentional caret.
+ *
+ * Only an armed settlement may advance the caret. Advancing on any
+ * document change instead walked the caret across the separator on every
+ * keystroke, so typing `@name` before existing text interleaved spaces
+ * into the draft (`hello @q uworld`).
+ */
+export function shouldAdvanceMentionCaret({
+  from,
+  next,
+  settling,
+}: {
+  from: number;
+  next: number;
+  settling: boolean;
+}): boolean {
+  return next !== from && settling;
+}
+
+/**
+ * Where to insert typed text when the caret (or a one-character selection)
+ * sits on the trailing space after an `@name` / `#channel` token.
+ * A selected trailing space would otherwise be replaced, producing
+ * `@bobhello`.
+ */
+export function insertPosForMentionTextInput(
+  doc: ProseMirrorNode,
+  from: number,
+  to: number,
+): number | null {
+  const next = selectionAfterMentionTrailingSpace(doc, from);
+  if (from === to) {
+    return next === from ? null : next;
+  }
+  if (to === next && next === from + 1) {
+    return next;
+  }
+  return null;
+}
+
+/**
+ * Redirect chip-edge typing only while autocomplete is settling. After a
+ * deliberate ArrowLeft or chip click, honor the caret so `x` lands in the
+ * token (`@bobx`) instead of after the space (`@bob x`).
+ */
+export function mentionTextInputInsertPos(
+  doc: ProseMirrorNode,
+  from: number,
+  to: number,
+  settling: boolean,
+): number | null {
+  if (!settling) return null;
+  return insertPosForMentionTextInput(doc, from, to);
+}
+
+/** Caret just after a mention trailing space: ArrowLeft lands on the token end. */
+export function positionAfterArrowLeftThroughMentionSpace(
+  doc: ProseMirrorNode,
+  from: number,
+): number | null {
+  if (from <= 0) return null;
+  const chipEnd = from - 1;
+  if (selectionAfterMentionTrailingSpace(doc, chipEnd) === from) {
+    return chipEnd;
+  }
+  return null;
+}
+
+export function setDomCaretAtPos(
+  view: {
+    domAtPos: (pos: number) => { node: Node; offset: number };
+    root: Document | ShadowRoot;
+  },
+  pos: number,
+): void {
+  if (typeof document === "undefined") return;
+  let mapped: { node: Node; offset: number };
+  try {
+    mapped = view.domAtPos(pos);
+  } catch {
+    return;
+  }
+  const range = document.createRange();
+  try {
+    range.setStart(mapped.node, mapped.offset);
+  } catch {
+    return;
+  }
+  range.collapse(true);
+  const root = view.root;
+  const selection =
+    "getSelection" in root && typeof root.getSelection === "function"
+      ? root.getSelection()
+      : window.getSelection();
+  if (!selection) return;
+  selection.removeAllRanges();
+  selection.addRange(range);
+}
+
+export function reassertMentionCaretAfterFocus(view: {
+  state: {
+    doc: ProseMirrorNode;
+    selection: { empty: boolean; from: number };
+    tr: Transaction;
+  };
+  dispatch: (tr: Transaction) => void;
+  domAtPos: (pos: number) => { node: Node; offset: number };
+  root: Document | ShadowRoot;
+}): void {
+  if (!view.state.selection.empty) return;
+  const from = view.state.selection.from;
+  const next = selectionAfterMentionTrailingSpace(view.state.doc, from);
+  if (next !== from) {
+    view.dispatch(
+      view.state.tr.setSelection(TextSelection.create(view.state.doc, next)),
+    );
+  }
+  setDomCaretAtPos(view, view.state.selection.from);
+}
+
+export type MentionHighlightStorage = {
+  names: string[];
+  agentNames: string[];
+  channelNames: string[];
+};
+
+function sameNameList(current: string[], next: string[]): boolean {
+  return (
+    current.length === next.length &&
+    current.every((name, index) => name === next[index])
+  );
+}
+
+export function assignMentionHighlightNames(
+  storage: MentionHighlightStorage,
+  names: string[],
+  agentNames: string[],
+  channelNames: string[],
+): boolean {
+  if (
+    sameNameList(storage.names, names) &&
+    sameNameList(storage.agentNames, agentNames) &&
+    sameNameList(storage.channelNames, channelNames)
+  ) {
+    return false;
+  }
+  storage.names = names;
+  storage.agentNames = agentNames;
+  storage.channelNames = channelNames;
+  return true;
+}
+
+export function mentionHighlightStorage(editor: {
+  storage: object;
+}): MentionHighlightStorage | undefined {
+  if (!("mentionHighlight" in editor.storage)) return undefined;
+  return editor.storage.mentionHighlight as MentionHighlightStorage;
+}
+
+export function settleAutocompleteMentionInsert(
+  editor: { storage: object },
+  tr: Transaction,
+  text: string,
+): void {
+  const storage = mentionHighlightStorage(editor);
+  const mentionInsert = /(?:^|[\s(])([@#])([^\s]+) $/.exec(text);
+  if (!mentionInsert) return;
+  const prefix = mentionInsert[1];
+  const label = mentionInsert[2];
+  if (storage) {
+    const known = [
+      ...storage.names,
+      ...storage.agentNames,
+      ...storage.channelNames,
+    ];
+    if (!known.some((name) => name.toLowerCase() === label.toLowerCase())) {
+      if (prefix === "#") {
+        storage.channelNames = [...storage.channelNames, label];
+      } else {
+        storage.names = [...storage.names, label];
+      }
+    }
+  }
+  tr.setMeta(mentionHighlightKey, true);
+}
+
+export function syncMentionHighlightFromProps(
+  editor: {
+    storage: object;
+    state: { tr: Transaction };
+    view: { dispatch: (tr: Transaction) => void };
+  },
+  names: string[] | undefined,
+  agentNames: string[] | undefined,
+  channelNames: string[] | undefined,
+): void {
+  const storage = mentionHighlightStorage(editor);
+  if (
+    !storage ||
+    !assignMentionHighlightNames(
+      storage,
+      names ?? [],
+      agentNames ?? [],
+      channelNames ?? [],
+    )
+  ) {
+    return;
+  }
+  editor.view.dispatch(editor.state.tr.setMeta(mentionHighlightKey, true));
+}
+
 /**
  * TipTap extension that applies inline `mention-chip` decorations
  * to `@Name` and `#channel-name` patterns in the document.
@@ -29,6 +270,7 @@ export const MentionHighlightExtension = Extension.create({
 
   addProseMirrorPlugins() {
     const extension = this;
+    const settlement = createMentionCaretSettlement();
 
     return [
       new Plugin({
@@ -43,6 +285,16 @@ export const MentionHighlightExtension = Extension.create({
             );
           },
           apply(tr, oldDecorations) {
+            if (
+              tr.getMeta(mentionHighlightKey) &&
+              tr.selection.empty &&
+              (tr.docChanged || settlement.peek() !== null)
+            ) {
+              settlement.arm(
+                selectionAfterMentionTrailingSpace(tr.doc, tr.selection.from),
+              );
+            }
+
             // Names/channels changed — full rebuild required.
             if (tr.getMeta(mentionHighlightKey)) {
               return buildDecorations(
@@ -85,10 +337,130 @@ export const MentionHighlightExtension = Extension.create({
             return oldDecorations.map(tr.mapping, tr.doc);
           },
         },
+        appendTransaction(_transactions, _oldState, newState) {
+          if (!newState.selection.empty) {
+            settlement.cancel();
+            return null;
+          }
+          const from = newState.selection.from;
+          const next = selectionAfterMentionTrailingSpace(newState.doc, from);
+          if (
+            !shouldAdvanceMentionCaret({
+              from,
+              next,
+              settling: settlement.peek() !== null,
+            })
+          ) {
+            return null;
+          }
+          return newState.tr.setSelection(
+            TextSelection.create(newState.doc, next),
+          );
+        },
+        view() {
+          let applying = false;
+          return {
+            update(view) {
+              if (applying || settlement.peek() === null) return;
+              if (!view.state.selection.empty) {
+                settlement.cancel();
+                return;
+              }
+              const from = view.state.selection.from;
+              const next = selectionAfterMentionTrailingSpace(
+                view.state.doc,
+                from,
+              );
+              if (next !== from) {
+                applying = true;
+                try {
+                  view.dispatch(
+                    view.state.tr.setSelection(
+                      TextSelection.create(view.state.doc, next),
+                    ),
+                  );
+                } finally {
+                  applying = false;
+                }
+              }
+              setDomCaretAtPos(view, view.state.selection.from);
+            },
+            destroy() {
+              settlement.cancel();
+            },
+          };
+        },
         props: {
           decorations(state) {
             return this.getState(state) ?? DecorationSet.empty;
           },
+          handleTextInput(view, from, to, text) {
+            const insertAt = mentionTextInputInsertPos(
+              view.state.doc,
+              from,
+              to,
+              settlement.peek() !== null,
+            );
+            if (insertAt == null) {
+              settlement.cancel();
+              return false;
+            }
+            const tr = view.state.tr.insertText(text, insertAt);
+            const caret = tr.mapping.map(insertAt, 1);
+            tr.setSelection(TextSelection.create(tr.doc, caret));
+            view.dispatch(tr);
+            settlement.cancel();
+            setDomCaretAtPos(view, caret);
+            return true;
+          },
+          handleKeyDown(view, event) {
+            if (
+              event.key === "ArrowRight" ||
+              event.key === "ArrowUp" ||
+              event.key === "ArrowDown" ||
+              event.key === "Home" ||
+              event.key === "End"
+            ) {
+              settlement.cancel();
+              return false;
+            }
+            if (event.key !== "ArrowLeft" || !view.state.selection.empty) {
+              return false;
+            }
+            settlement.cancel();
+            const chipEnd = positionAfterArrowLeftThroughMentionSpace(
+              view.state.doc,
+              view.state.selection.from,
+            );
+            if (chipEnd == null) return false;
+            view.dispatch(
+              view.state.tr.setSelection(
+                TextSelection.create(view.state.doc, chipEnd),
+              ),
+            );
+            setDomCaretAtPos(view, chipEnd);
+            return true;
+          },
+          handleClick(view, pos, event) {
+            const target = event.target;
+            const onChip =
+              target instanceof Element &&
+              Boolean(target.closest(".mention-chip"));
+            settlement.cancel();
+            if (!onChip) return false;
+            const chipEnd = positionAfterArrowLeftThroughMentionSpace(
+              view.state.doc,
+              pos,
+            );
+            if (chipEnd == null) return false;
+            view.dispatch(
+              view.state.tr.setSelection(
+                TextSelection.create(view.state.doc, chipEnd),
+              ),
+            );
+            setDomCaretAtPos(view, chipEnd);
+            return true;
+          },
         },
       }),
     ];
@@ -136,6 +508,28 @@ export function buildHighlightPatterns(
   return patterns;
 }
 
+/**
+ * If `pos` sits at the end of an `@name` / `#channel` token and the next
+ * character is a space, return the position after that space.
+ *
+ * Autocomplete inserts `@Name ` then chip decorations wrap the token. The
+ * browser can map the caret back to the chip edge, so the next keystroke
+ * lands before the space (`@quinnhello`). Callers use this to keep typing
+ * after the token.
+ */
+export function selectionAfterMentionTrailingSpace(
+  doc: ProseMirrorNode,
+  pos: number,
+): number {
+  if (pos < 0 || pos >= doc.content.size) return pos;
+  const nextChar = doc.textBetween(pos, pos + 1, "\n", "\0");
+  if (nextChar !== " ") return pos;
+  const lookbehind = Math.min(pos, 80);
+  const before = doc.textBetween(pos - lookbehind, pos, "\n", "\0");
+  if (!/(?:^|[\s(])[@#][^\s]+$/.test(before)) return pos;
+  return pos + 1;
+}
+
 /**
  * Find all highlight matches in a text string given a set of patterns.
  * Returns an array of { from, to } offsets relative to the text start.
@@ -310,25 +704,41 @@ function addMatchesForPatterns(
     while (match !== null) {
       const from = position + match.index;
       const to = from + match[0].length;
+      const outsideEnd = { inclusiveEnd: false };
       if (options?.hidePrefix && /^[@#]/.test(match[0])) {
         decorations.push(
-          Decoration.inline(from, from + 1, {
-            class: "mention-prefix-hidden",
-            spellcheck: "false",
-          }),
+          Decoration.inline(
+            from,
+            from + 1,
+            {
+              class: "mention-prefix-hidden",
+              spellcheck: "false",
+            },
+            outsideEnd,
+          ),
         );
         decorations.push(
-          Decoration.inline(from + 1, to, {
-            class: className,
-            spellcheck: "false",
-          }),
+          Decoration.inline(
+            from + 1,
+            to,
+            {
+              class: className,
+              spellcheck: "false",
+            },
+            outsideEnd,
+          ),
         );
       } else {
         decorations.push(
-          Decoration.inline(from, to, {
-            class: className,
-            spellcheck: "false",
-          }),
+          Decoration.inline(
+            from,
+            to,
+            {
+              class: className,
+              spellcheck: "false",
+            },
+            outsideEnd,
+          ),
         );
       }
       match = pattern.exec(text);
diff --git a/desktop/src/features/messages/lib/mentionSuggestionMapping.test.mjs b/desktop/src/features/messages/lib/mentionSuggestionMapping.test.mjs
index 624ae0c6226..599b59a8117 100644
--- a/desktop/src/features/messages/lib/mentionSuggestionMapping.test.mjs
+++ b/desktop/src/features/messages/lib/mentionSuggestionMapping.test.mjs
@@ -16,8 +16,9 @@ function candidate(overrides = {}) {
   };
 }
 
-function suggestion(overrides = {}) {
+function suggestion(overrides = {}, agentProvenanceReady = true) {
   return mapMentionCandidateToSuggestion({
+    agentProvenanceReady,
     candidate: candidate(overrides),
     currentPubkey: OWNER,
     label: "Carl",
@@ -35,6 +36,14 @@ test("labels same-owner relay agent identities as managed elsewhere", () => {
   assert.equal(suggestion().agentProvenance, "managed-elsewhere");
 });
 
+test("fails closed while the managed-agent directory is unresolved", () => {
+  assert.equal(
+    suggestion({ isManagedAgent: true }, false).agentProvenance,
+    undefined,
+  );
+  assert.equal(suggestion({}, false).agentProvenance, undefined);
+});
+
 test("does not attribute another owner's agent to a device", () => {
   assert.equal(
     suggestion({ ownerPubkey: "c".repeat(64) }).agentProvenance,
diff --git a/desktop/src/features/messages/lib/mentionSuggestionMapping.ts b/desktop/src/features/messages/lib/mentionSuggestionMapping.ts
index 08ee77ea23b..9be4f2c4a57 100644
--- a/desktop/src/features/messages/lib/mentionSuggestionMapping.ts
+++ b/desktop/src/features/messages/lib/mentionSuggestionMapping.ts
@@ -24,10 +24,12 @@ export function mapMentionCandidateToSuggestion(opts: {
   label: string;
   channelType?: ChannelType | null;
   currentPubkey?: string | null;
+  agentProvenanceReady: boolean;
   ownerProfiles?: UserProfileLookup;
   profiles?: UserProfileLookup;
 }): MentionSuggestion {
   const {
+    agentProvenanceReady,
     candidate,
     channelType,
     currentPubkey,
@@ -54,7 +56,7 @@ export function mapMentionCandidateToSuggestion(opts: {
       null,
     isAgent: candidate.isAgent,
     agentProvenance:
-      candidate.kind === "identity" && candidate.isAgent
+      agentProvenanceReady && candidate.kind === "identity" && candidate.isAgent
         ? candidate.isManagedAgent
           ? "managed-here"
           : candidate.ownerPubkey &&
diff --git a/desktop/src/features/messages/lib/persistentAgentAudience.test.mjs b/desktop/src/features/messages/lib/persistentAgentAudience.test.mjs
index ac3cc5b0d16..64d11cd6312 100644
--- a/desktop/src/features/messages/lib/persistentAgentAudience.test.mjs
+++ b/desktop/src/features/messages/lib/persistentAgentAudience.test.mjs
@@ -1,60 +1,39 @@
 import assert from "node:assert/strict";
 import test from "node:test";
 
-function createStorage(onSetItem = () => {}) {
-  const values = new Map();
-  return {
-    getItem: (key) => values.get(key) ?? null,
-    setItem: (key, value) => {
-      onSetItem(key, value);
-      values.set(key, String(value));
-    },
-  };
-}
-
 const agentA = "a".repeat(64);
 const agentB = "b".repeat(64);
 const agentC = "c".repeat(64);
 const ownerA = "1".repeat(64);
 const ownerB = "2".repeat(64);
-const storageKey = "buzz:persistent-agent-audiences:v2";
 
 let loadSequence = 0;
 
 async function loadStore(offset = 0) {
-  globalThis.window = { localStorage: createStorage() };
   loadSequence += 1;
   return import(
     `./persistentAgentAudience.ts?test=${Date.now()}-${offset}-${loadSequence}`
   );
 }
 
-function savedAudiences() {
-  return JSON.parse(window.localStorage.getItem(storageKey));
+function currentAudiences(store) {
+  return store.getPersistentAgentAudienceSnapshot().audiences;
 }
 
-test("conversation scopes isolate identities, channels, and threads", async () => {
+test("audience scopes isolate identities and channels", async () => {
   const store = await loadStore();
   const scopes = [
     store.getPersistentAgentAudienceScope({
       ownerPubkey: ownerA,
       channelId: "channel-a",
-      threadRootId: "root-1",
-    }),
-    store.getPersistentAgentAudienceScope({
-      ownerPubkey: ownerA,
-      channelId: "channel-a",
-      threadRootId: "root-2",
     }),
     store.getPersistentAgentAudienceScope({
       ownerPubkey: ownerA,
       channelId: "channel-b",
-      threadRootId: "root-1",
     }),
     store.getPersistentAgentAudienceScope({
       ownerPubkey: ownerB,
       channelId: "channel-a",
-      threadRootId: "root-1",
     }),
   ];
 
@@ -63,128 +42,51 @@ test("conversation scopes isolate identities, channels, and threads", async () =
     store.setPersistentAgentAudience(scope, [agentA]);
   }
 
-  assert.equal(new Set(Object.keys(savedAudiences())).size, 4);
+  assert.equal(new Set(Object.keys(currentAudiences(store))).size, 3);
 });
 
-test("successful fast send promotes without a persisted draft key", async () => {
+test("address locks can be added independently", async () => {
   const store = await loadStore(1);
   const scope = store.getPersistentAgentAudienceScope({
     ownerPubkey: ownerA,
     channelId: "channel-a",
-    threadRootId: "root",
   });
-  store.setPersistentAgentAudienceEnabled(true);
+  store.addPersistentAgentAudienceMember(scope, agentA);
+  store.addPersistentAgentAudienceMember(scope, agentB);
 
-  store.promotePersistentAgentAudience({
-    expectedGeneration: store.getPersistentAgentAudienceGeneration(),
-    scope,
-    expectedRevision: store.getPersistentAgentAudienceRevision(scope),
-    explicitAgentPubkeys: [agentA],
-  });
-
-  assert.deepEqual(savedAudiences(), { [scope]: [agentA] });
+  assert.deepEqual(currentAudiences(store), { [scope]: [agentA, agentB] });
 });
 
-test("explicit recipients merge and dedupe after successful send", async () => {
+test("adding an existing address lock preserves order and dedupes", async () => {
   const store = await loadStore(2);
-  const scope = `${ownerA}:channel-a:timeline`;
-  store.setPersistentAgentAudienceEnabled(true);
-  store.setPersistentAgentAudience(scope, [agentA]);
-  const revision = store.getPersistentAgentAudienceRevision(scope);
-
-  store.promotePersistentAgentAudience({
-    expectedGeneration: store.getPersistentAgentAudienceGeneration(),
-    scope,
-    expectedRevision: revision,
-    explicitAgentPubkeys: [agentA, agentB],
-  });
-
-  assert.deepEqual(savedAudiences(), { [scope]: [agentA, agentB] });
-});
-
-test("successful send makes authored mention order authoritative", async () => {
-  const store = await loadStore(100);
-  const scope = `${ownerA}:channel-a:timeline`;
-  store.setPersistentAgentAudienceEnabled(true);
+  const scope = `${ownerA}:channel-a:channel`;
   store.setPersistentAgentAudience(scope, [agentA, agentB]);
+  store.addPersistentAgentAudienceMember(scope, agentA);
 
-  store.promotePersistentAgentAudience({
-    expectedGeneration: store.getPersistentAgentAudienceGeneration(),
-    scope,
-    expectedRevision: store.getPersistentAgentAudienceRevision(scope),
-    explicitAgentPubkeys: [agentB, agentA, agentC],
-  });
-
-  assert.deepEqual(savedAudiences(), {
-    [scope]: [agentB, agentA, agentC],
-  });
-});
-
-test("successful send retains saved targets absent from the draft", async () => {
-  const store = await loadStore(101);
-  const scope = `${ownerA}:channel-a:timeline`;
-  store.setPersistentAgentAudienceEnabled(true);
-  store.setPersistentAgentAudience(scope, [agentA, agentC]);
-
-  store.promotePersistentAgentAudience({
-    expectedGeneration: store.getPersistentAgentAudienceGeneration(),
-    scope,
-    expectedRevision: store.getPersistentAgentAudienceRevision(scope),
-    explicitAgentPubkeys: [agentB, agentA],
-  });
-
-  assert.deepEqual(savedAudiences(), {
-    [scope]: [agentB, agentA, agentC],
-  });
+  assert.deepEqual(currentAudiences(store), { [scope]: [agentA, agentB] });
 });
 
-test("removal while send awaits wins over late success", async () => {
+test("address locks can be removed independently", async () => {
   const store = await loadStore(3);
-  const scope = `${ownerA}:channel-a:timeline`;
-  store.setPersistentAgentAudienceEnabled(true);
-  store.setPersistentAgentAudience(scope, [agentA]);
-  const revisionAtSubmit = store.getPersistentAgentAudienceRevision(scope);
+  const scope = `${ownerA}:channel-a:channel`;
+  store.setPersistentAgentAudience(scope, [agentA, agentB]);
 
   store.removePersistentAgentAudienceMember(scope, agentA);
-  store.promotePersistentAgentAudience({
-    expectedGeneration: store.getPersistentAgentAudienceGeneration(),
-    scope,
-    expectedRevision: revisionAtSubmit,
-    explicitAgentPubkeys: [agentA],
-  });
 
-  assert.deepEqual(savedAudiences(), { [scope]: [] });
+  assert.deepEqual(currentAudiences(store), { [scope]: [agentB] });
 });
 
 test("removing final chip preserves an explicit empty scope", async () => {
   const store = await loadStore(4);
-  const scope = `${ownerA}:channel-a:thread:root`;
+  const scope = `${ownerA}:channel-a:channel`;
   store.setPersistentAgentAudience(scope, [agentA]);
   store.removePersistentAgentAudienceMember(scope, agentA);
 
-  assert.deepEqual(savedAudiences(), { [scope]: [] });
-});
-
-test("completion after disabling cannot repopulate audiences", async () => {
-  const store = await loadStore(5);
-  const scope = `${ownerA}:channel-a:timeline`;
-  store.setPersistentAgentAudienceEnabled(true);
-  store.setPersistentAgentAudience(scope, [agentA]);
-  const revisionAtSubmit = store.getPersistentAgentAudienceRevision(scope);
-  store.setPersistentAgentAudienceEnabled(false);
-
-  store.promotePersistentAgentAudience({
-    expectedGeneration: store.getPersistentAgentAudienceGeneration(),
-    scope,
-    expectedRevision: revisionAtSubmit,
-    explicitAgentPubkeys: [agentB],
-  });
-
-  assert.deepEqual(savedAudiences(), {});
+  assert.deepEqual(currentAudiences(store), { [scope]: [] });
 });
 
 test("invalid, duplicate, and differently-cased pubkeys normalize", async () => {
-  const store = await loadStore(6);
+  const store = await loadStore(5);
   const scope = `${ownerA}:channel-a:timeline`;
   store.setPersistentAgentAudience(scope, [
     agentA.toUpperCase(),
@@ -192,152 +94,121 @@ test("invalid, duplicate, and differently-cased pubkeys normalize", async () =>
     "bad",
   ]);
 
-  assert.deepEqual(savedAudiences(), { [scope]: [agentA] });
+  assert.deepEqual(currentAudiences(store), { [scope]: [agentA] });
 });
 
-test("new recipients retain explicit mention order", async () => {
-  const store = await loadStore(9);
-  const scope = `${ownerA}:channel-a:timeline`;
-  store.setPersistentAgentAudienceEnabled(true);
-
-  store.promotePersistentAgentAudience({
-    expectedGeneration: store.getPersistentAgentAudienceGeneration(),
-    scope,
-    expectedRevision: store.getPersistentAgentAudienceRevision(scope),
-    explicitAgentPubkeys: [agentB, agentA],
-  });
-
-  assert.deepEqual(savedAudiences(), { [scope]: [agentB, agentA] });
-});
-
-test("persistent audiences retain only the 200 most recently touched scopes", async () => {
-  const store = await loadStore(11);
+test("in-memory audiences retain only the 200 most recently touched scopes", async () => {
+  const store = await loadStore(6);
   for (
     let index = 0;
-    index < store.MAX_PERSISTENT_AGENT_AUDIENCES + 2;
+    index < store.MAX_IN_MEMORY_AGENT_AUDIENCES + 2;
     index++
   ) {
     store.setPersistentAgentAudience(`scope-${index}`, [agentA]);
   }
 
-  const saved = savedAudiences();
-  assert.equal(Object.keys(saved).length, store.MAX_PERSISTENT_AGENT_AUDIENCES);
-  assert.equal(saved["scope-0"], undefined);
-  assert.equal(saved["scope-1"], undefined);
-  assert.deepEqual(saved["scope-201"], [agentA]);
+  const bounded = currentAudiences(store);
+  assert.equal(
+    Object.keys(bounded).length,
+    store.MAX_IN_MEMORY_AGENT_AUDIENCES,
+  );
+  assert.equal(bounded["scope-0"], undefined);
+  assert.equal(bounded["scope-1"], undefined);
+  assert.deepEqual(bounded["scope-201"], [agentA]);
 
   store.setPersistentAgentAudience("scope-2", [agentB]);
   store.setPersistentAgentAudience("scope-new", [agentC]);
-  const retouched = savedAudiences();
+  const retouched = currentAudiences(store);
   assert.equal(retouched["scope-3"], undefined);
   assert.deepEqual(retouched["scope-2"], [agentB]);
   assert.deepEqual(retouched["scope-new"], [agentC]);
 });
 
-test("an unchanged touch refreshes LRU without revision or emit", async () => {
-  const { JSDOM } = await import("jsdom");
-  const dom = new JSDOM(
-    "<!doctype html><html><body><div id='root'></div></body></html>",
-    {
-      url: "http://localhost",
-    },
-  );
-  const writes = [];
-  Object.defineProperty(dom.window, "localStorage", {
-    configurable: true,
-    value: createStorage((key, value) => writes.push([key, String(value)])),
+test("reset clears every audience for refresh and community boundaries", async () => {
+  const store = await loadStore(7);
+  const scope = `${ownerA}:channel-a:channel`;
+  store.setPersistentAgentAudience(scope, [agentA]);
+
+  store.resetPersistentAgentAudienceStore();
+
+  assert.deepEqual(currentAudiences(store), {});
+});
+
+test("channel and thread composers share the channel audience scope", async () => {
+  const store = await loadStore(8);
+  const channelScope = store.getPersistentAgentAudienceScope({
+    ownerPubkey: ownerA,
+    channelId: "channel-a",
   });
-  Object.assign(globalThis, {
-    document: dom.window.document,
-    HTMLElement: dom.window.HTMLElement,
-    IS_REACT_ACT_ENVIRONMENT: true,
-    window: dom.window,
+  const threadScope = store.getPersistentAgentAudienceScope({
+    ownerPubkey: ownerA,
+    channelId: "channel-a",
+    threadRootId: "root",
   });
-  loadSequence += 1;
-  const store = await import(
-    `./persistentAgentAudience.ts?test=${Date.now()}-touch-${loadSequence}`
-  );
-  const touchedScope = "scope-0";
-  store.setPersistentAgentAudience(touchedScope, [agentA]);
-  for (let index = 1; index < store.MAX_PERSISTENT_AGENT_AUDIENCES; index++) {
-    store.setPersistentAgentAudience(`scope-${index}`, [agentA]);
-  }
 
-  const React = await import("react");
-  const { createRoot } = await import("react-dom/client");
-  const root = createRoot(document.getElementById("root"));
-  let renderCount = 0;
-  function Probe() {
-    store.usePersistentAgentAudience(touchedScope);
-    renderCount += 1;
-    return null;
-  }
-  await React.act(async () => root.render(React.createElement(Probe)));
-  const revision = store.getPersistentAgentAudienceRevision(touchedScope);
-  const renderCountBeforeTouch = renderCount;
-  writes.length = 0;
+  assert.equal(channelScope, `${ownerA}:channel-a:channel`);
+  assert.equal(threadScope, channelScope);
+});
+
+test("delayed promotion cannot overwrite a newer audience choice", async () => {
+  const store = await loadStore(9);
+  const scope = `${ownerA}:channel-a:channel`;
+  store.setPersistentAgentAudience(scope, []);
+  const sendRevision = store.getPersistentAgentAudienceRevision(scope);
 
-  await React.act(async () => {
-    store.setPersistentAgentAudience(touchedScope, [agentA]);
+  store.addPersistentAgentAudienceMember(scope, agentA);
+  store.removePersistentAgentAudienceMember(scope, agentA);
+  const result = store.promotePersistentAgentAudienceIfUnchanged({
+    expectedRevision: sendRevision,
+    pubkeys: [agentA],
+    scope,
   });
 
-  assert.equal(writes.length, 1);
-  assert.equal(writes[0][0], storageKey);
-  assert.deepEqual(JSON.parse(writes[0][1])[touchedScope], [agentA]);
-  assert.equal(Object.keys(JSON.parse(writes[0][1])).at(-1), touchedScope);
-  assert.equal(
-    store.getPersistentAgentAudienceRevision(touchedScope),
-    revision,
-  );
-  assert.equal(renderCount, renderCountBeforeTouch);
+  assert.equal(result, null);
+  assert.deepEqual(currentAudiences(store), { [scope]: [] });
+});
 
-  writes.length = 0;
-  await React.act(async () => {
-    store.setPersistentAgentAudience(touchedScope, [agentA]);
+test("stale auto-pin Undo cannot remove a newer explicit choice", async () => {
+  const store = await loadStore(10);
+  const scope = `${ownerA}:channel-a:channel`;
+  store.setPersistentAgentAudience(scope, []);
+  const appliedRevision = store.promotePersistentAgentAudienceIfUnchanged({
+    expectedRevision: store.getPersistentAgentAudienceRevision(scope),
+    pubkeys: [agentA],
+    scope,
   });
-  assert.equal(writes.length, 0);
-  assert.equal(
-    store.getPersistentAgentAudienceRevision(touchedScope),
-    revision,
-  );
-  assert.equal(renderCount, renderCountBeforeTouch);
+  assert.notEqual(appliedRevision, null);
 
-  await React.act(async () => {
-    store.setPersistentAgentAudience("scope-new", [agentB]);
+  store.removePersistentAgentAudienceMember(scope, agentA);
+  store.addPersistentAgentAudienceMember(scope, agentA);
+  const removed = store.removePersistentAgentAudienceMembersIfUnchanged({
+    expectedRevision: appliedRevision.revision,
+    pubkeys: [agentA],
+    scope,
   });
-  const saved = savedAudiences();
-  assert.deepEqual(saved[touchedScope], [agentA]);
-  assert.equal(saved["scope-1"], undefined);
-  assert.deepEqual(saved["scope-new"], [agentB]);
-  assert.equal(
-    store.getPersistentAgentAudienceRevision(touchedScope),
-    revision,
-  );
 
-  await React.act(async () => root.unmount());
-  dom.window.close();
+  assert.equal(removed, false);
+  assert.deepEqual(currentAudiences(store), { [scope]: [agentA] });
 });
 
-test("timeline scope is intentionally unsupported", async () => {
-  const store = await loadStore(7);
+test("promotion reports only newly added agents for transactional Undo", async () => {
+  const store = await loadStore(11);
+  const scope = `${ownerA}:channel-a:channel`;
+  store.setPersistentAgentAudience(scope, [agentA]);
+  const promotion = store.promotePersistentAgentAudienceIfUnchanged({
+    expectedRevision: store.getPersistentAgentAudienceRevision(scope),
+    pubkeys: [agentA, agentB],
+    scope,
+  });
+
+  assert.deepEqual(promotion.promotedPubkeys, [agentB]);
   assert.equal(
-    store.getPersistentAgentAudienceScope({
-      ownerPubkey: ownerA,
-      channelId: "channel-a",
+    store.removePersistentAgentAudienceMembersIfUnchanged({
+      expectedRevision: promotion.revision,
+      pubkeys: promotion.promotedPubkeys,
+      scope,
     }),
-    null,
+    true,
   );
-});
-
-test("thread root audience initializes once and explicit clear wins on reopen", async () => {
-  const store = await loadStore(10);
-  const scope = `${ownerA}:channel-a:thread:root`;
-  store.setPersistentAgentAudienceEnabled(true);
-
-  store.initializePersistentAgentAudience(scope, [agentB, agentA]);
-  assert.deepEqual(savedAudiences(), { [scope]: [agentB, agentA] });
-
-  store.setPersistentAgentAudience(scope, []);
-  store.initializePersistentAgentAudience(scope, [agentA]);
-  assert.deepEqual(savedAudiences(), { [scope]: [] });
+  assert.deepEqual(currentAudiences(store), { [scope]: [agentA] });
 });
diff --git a/desktop/src/features/messages/lib/persistentAgentAudience.ts b/desktop/src/features/messages/lib/persistentAgentAudience.ts
index a16163ed1f3..018a7da489a 100644
--- a/desktop/src/features/messages/lib/persistentAgentAudience.ts
+++ b/desktop/src/features/messages/lib/persistentAgentAudience.ts
@@ -1,22 +1,16 @@
 import * as React from "react";
 
-const ENABLED_STORAGE_KEY = "buzz:keep-addressed-agents-active";
-const AUDIENCES_STORAGE_KEY = "buzz:persistent-agent-audiences:v2";
-export const MAX_PERSISTENT_AGENT_AUDIENCES = 200;
+export const MAX_IN_MEMORY_AGENT_AUDIENCES = 200;
 
 const listeners = new Set<() => void>();
 const revisions = new Map<string, number>();
 let revisionClock = 0;
 let defaultRevision = 0;
-let generation = 0;
-let enabled = readEnabled();
-let audiences = readAudiences();
+let audiences: Record<string, string[]> = {};
 let snapshot = buildSnapshot();
 
 export type PersistentAgentAudienceSnapshot = Readonly<{
-  enabled: boolean;
   audiences: Readonly<Record<string, readonly string[]>>;
-  generation: number;
 }>;
 
 type PersistentAgentAudienceScopeInput = {
@@ -31,49 +25,17 @@ function normalizePubkeys(pubkeys: Iterable<string>): string[] {
   ].filter((pubkey) => /^[0-9a-f]{64}$/.test(pubkey));
 }
 
-function readEnabled(): boolean {
-  if (typeof window === "undefined") return false;
-  try {
-    return window.localStorage.getItem(ENABLED_STORAGE_KEY) === "1";
-  } catch {
-    return false;
-  }
-}
-
 function boundAudiences(
   value: Record<string, string[]>,
 ): Record<string, string[]> {
   const entries = Object.entries(value);
-  return entries.length <= MAX_PERSISTENT_AGENT_AUDIENCES
+  return entries.length <= MAX_IN_MEMORY_AGENT_AUDIENCES
     ? value
-    : Object.fromEntries(entries.slice(-MAX_PERSISTENT_AGENT_AUDIENCES));
-}
-
-function readAudiences(): Record<string, string[]> {
-  if (typeof window === "undefined") return {};
-  try {
-    const parsed: unknown = JSON.parse(
-      window.localStorage.getItem(AUDIENCES_STORAGE_KEY) ?? "{}",
-    );
-    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
-      return {};
-
-    const result: Record<string, string[]> = {};
-    for (const [scope, value] of Object.entries(parsed)) {
-      if (scope && Array.isArray(value)) {
-        result[scope] = normalizePubkeys(
-          value.filter((entry): entry is string => typeof entry === "string"),
-        );
-      }
-    }
-    return boundAudiences(result);
-  } catch {
-    return {};
-  }
+    : Object.fromEntries(entries.slice(-MAX_IN_MEMORY_AGENT_AUDIENCES));
 }
 
 function buildSnapshot(): PersistentAgentAudienceSnapshot {
-  return { enabled, audiences, generation };
+  return { audiences };
 }
 
 function emit(): void {
@@ -81,69 +43,22 @@ function emit(): void {
   for (const listener of listeners) listener();
 }
 
-function persistAudiences(): void {
-  try {
-    window.localStorage.setItem(
-      AUDIENCES_STORAGE_KEY,
-      JSON.stringify(audiences),
-    );
-  } catch {
-    // Persistence is best-effort; the live session still uses in-memory state.
-  }
-}
-
-function advanceRevision(scope: string): void {
-  revisionClock += 1;
-  revisions.set(scope, revisionClock);
-}
-
-export function setPersistentAgentAudienceEnabled(nextEnabled: boolean): void {
-  if (enabled === nextEnabled) return;
-  enabled = nextEnabled;
-  if (!nextEnabled) {
-    generation += 1;
-    revisionClock += 1;
-    defaultRevision = revisionClock;
-    revisions.clear();
-    audiences = {};
-    persistAudiences();
-  }
-  try {
-    window.localStorage.setItem(ENABLED_STORAGE_KEY, nextEnabled ? "1" : "0");
-  } catch {
-    // Persistence is best-effort.
-  }
-  emit();
-}
-
 export function getPersistentAgentAudienceScope({
   ownerPubkey,
   channelId,
-  threadRootId = null,
 }: PersistentAgentAudienceScopeInput): string | null {
   const owner = ownerPubkey.trim().toLowerCase();
   if (!/^[0-9a-f]{64}$/.test(owner) || !channelId) return null;
-  if (!threadRootId) return null;
-  return `${owner}:${channelId}:thread:${threadRootId}`;
+  // Thread composers intentionally share their parent channel's audience.
+  return `${owner}:${channelId}:channel`;
 }
 
-export function getPersistentAgentAudienceGeneration(): number {
-  return generation;
-}
-
-export function getPersistentAgentAudienceRevision(scope: string): number {
-  return revisions.get(scope) ?? defaultRevision;
-}
-
-export function initializePersistentAgentAudience(
-  scope: string,
-  pubkeys: Iterable<string>,
-): void {
-  if (!enabled || !scope) return;
-  setPersistentAgentAudience(
-    scope,
-    Object.hasOwn(audiences, scope) ? audiences[scope] : pubkeys,
-  );
+export function resetPersistentAgentAudienceStore(): void {
+  revisionClock += 1;
+  defaultRevision = revisionClock;
+  revisions.clear();
+  audiences = {};
+  emit();
 }
 
 export function setPersistentAgentAudience(
@@ -162,7 +77,6 @@ export function setPersistentAgentAudience(
     const nextAudiences = { ...audiences };
     delete nextAudiences[scope];
     audiences = boundAudiences({ ...nextAudiences, [scope]: current });
-    persistAudiences();
     return;
   }
 
@@ -172,35 +86,64 @@ export function setPersistentAgentAudience(
   for (const revisedScope of revisions.keys()) {
     if (!Object.hasOwn(audiences, revisedScope)) revisions.delete(revisedScope);
   }
-  advanceRevision(scope);
-  persistAudiences();
+  revisionClock += 1;
+  revisions.set(scope, revisionClock);
   emit();
 }
 
-export function promotePersistentAgentAudience({
-  expectedGeneration,
+export function getPersistentAgentAudienceRevision(scope: string): number {
+  return revisions.get(scope) ?? defaultRevision;
+}
+
+export function promotePersistentAgentAudienceIfUnchanged({
   expectedRevision,
-  explicitAgentPubkeys,
+  pubkeys,
   scope,
 }: {
-  expectedGeneration: number;
-  expectedRevision: number | null;
-  explicitAgentPubkeys: string[];
-  scope: string | null;
-}): void {
-  if (
-    !enabled ||
-    expectedGeneration !== generation ||
-    !scope ||
-    (expectedRevision !== null &&
-      getPersistentAgentAudienceRevision(scope) !== expectedRevision)
-  ) {
-    return;
-  }
+  expectedRevision: number;
+  pubkeys: Iterable<string>;
+  scope: string;
+}): { promotedPubkeys: string[]; revision: number } | null {
+  if (getPersistentAgentAudienceRevision(scope) !== expectedRevision)
+    return null;
+  const promotedPubkeys = normalizePubkeys(pubkeys).filter(
+    (pubkey) => !(audiences[scope] ?? []).includes(pubkey),
+  );
+  if (promotedPubkeys.length === 0) return null;
   setPersistentAgentAudience(scope, [
-    ...explicitAgentPubkeys,
     ...(audiences[scope] ?? []),
+    ...promotedPubkeys,
   ]);
+  return {
+    promotedPubkeys,
+    revision: getPersistentAgentAudienceRevision(scope),
+  };
+}
+
+export function removePersistentAgentAudienceMembersIfUnchanged({
+  expectedRevision,
+  pubkeys,
+  scope,
+}: {
+  expectedRevision: number;
+  pubkeys: Iterable<string>;
+  scope: string;
+}): boolean {
+  if (getPersistentAgentAudienceRevision(scope) !== expectedRevision)
+    return false;
+  const removals = new Set(normalizePubkeys(pubkeys));
+  setPersistentAgentAudience(
+    scope,
+    (audiences[scope] ?? []).filter((pubkey) => !removals.has(pubkey)),
+  );
+  return true;
+}
+
+export function addPersistentAgentAudienceMember(
+  scope: string,
+  pubkey: string,
+): void {
+  setPersistentAgentAudience(scope, [...(audiences[scope] ?? []), pubkey]);
 }
 
 export function removePersistentAgentAudienceMember(
@@ -220,26 +163,23 @@ function subscribe(listener: () => void): () => void {
   return () => listeners.delete(listener);
 }
 
-function getSnapshot(): PersistentAgentAudienceSnapshot {
+export function getPersistentAgentAudienceSnapshot(): PersistentAgentAudienceSnapshot {
   return snapshot;
 }
 
+function getSnapshot(): PersistentAgentAudienceSnapshot {
+  return getPersistentAgentAudienceSnapshot();
+}
+
 const serverSnapshot: PersistentAgentAudienceSnapshot = {
-  enabled: false,
   audiences: {},
-  generation: 0,
 };
 
 export function usePersistentAgentAudience(scope: string | null): {
-  enabled: boolean;
   pubkeys: readonly string[];
-  generation: number;
-  revision: number;
-  setEnabled: (enabled: boolean) => void;
-  promotePubkeys: typeof promotePersistentAgentAudience;
+  addPubkey: (pubkey: string) => void;
   removePubkey: (pubkey: string) => void;
   clear: () => void;
-  initialize: (pubkeys: Iterable<string>) => void;
 } {
   const state = React.useSyncExternalStore(
     subscribe,
@@ -248,14 +188,11 @@ export function usePersistentAgentAudience(scope: string | null): {
   );
   const resolvedScope = scope ?? "";
   return {
-    enabled: state.enabled,
     pubkeys: resolvedScope ? (state.audiences[resolvedScope] ?? []) : [],
-    generation: state.generation,
-    revision: resolvedScope
-      ? getPersistentAgentAudienceRevision(resolvedScope)
-      : 0,
-    setEnabled: setPersistentAgentAudienceEnabled,
-    promotePubkeys: promotePersistentAgentAudience,
+    addPubkey: React.useCallback(
+      (pubkey) => addPersistentAgentAudienceMember(resolvedScope, pubkey),
+      [resolvedScope],
+    ),
     removePubkey: React.useCallback(
       (pubkey) => removePersistentAgentAudienceMember(resolvedScope, pubkey),
       [resolvedScope],
@@ -264,9 +201,5 @@ export function usePersistentAgentAudience(scope: string | null): {
       () => setPersistentAgentAudience(resolvedScope, []),
       [resolvedScope],
     ),
-    initialize: React.useCallback(
-      (pubkeys) => initializePersistentAgentAudience(resolvedScope, pubkeys),
-      [resolvedScope],
-    ),
   };
 }
diff --git a/desktop/src/features/messages/lib/useMentionSelection.ts b/desktop/src/features/messages/lib/useMentionSelection.ts
new file mode 100644
index 00000000000..fb0dee27a55
--- /dev/null
+++ b/desktop/src/features/messages/lib/useMentionSelection.ts
@@ -0,0 +1,40 @@
+import * as React from "react";
+
+import type { MentionSuggestion } from "@/features/messages/ui/MentionAutocomplete";
+
+export type MentionPickerMode = "first-agent" | "preserve" | null;
+
+export function useMentionSelection(suggestions: MentionSuggestion[]) {
+  const [mentionSelectedIndex, setMentionSelectedIndex] = React.useState(0);
+  const preferAgentSelectionRef = React.useRef(false);
+
+  React.useEffect(() => {
+    setMentionSelectedIndex((current) => {
+      if (suggestions.length === 0) return 0;
+      if (preferAgentSelectionRef.current) {
+        preferAgentSelectionRef.current = false;
+        const firstAgentIndex = suggestions.findIndex(
+          (suggestion) => suggestion.isAgent && suggestion.pubkey,
+        );
+        if (firstAgentIndex >= 0) return firstAgentIndex;
+      }
+      return Math.min(current, suggestions.length - 1);
+    });
+  }, [suggestions]);
+
+  const clearAgentSelectionPreference = React.useCallback(() => {
+    preferAgentSelectionRef.current = false;
+  }, []);
+  const prepareSelectionPreference = React.useCallback(
+    (preference: MentionPickerMode) => {
+      preferAgentSelectionRef.current = preference === "first-agent";
+    },
+    [],
+  );
+  return {
+    clearAgentSelectionPreference,
+    mentionSelectedIndex,
+    prepareSelectionPreference,
+    setMentionSelectedIndex,
+  };
+}
diff --git a/desktop/src/features/messages/lib/useMentions.ts b/desktop/src/features/messages/lib/useMentions.ts
index bf145713d50..30b7a1f48a5 100644
--- a/desktop/src/features/messages/lib/useMentions.ts
+++ b/desktop/src/features/messages/lib/useMentions.ts
@@ -31,20 +31,24 @@ import {
 } from "@/features/profile/hooks";
 import { useIdentityQuery } from "@/shared/api/hooks";
 import type { AutocompleteEdit } from "./useRichTextEditor";
-import type {
-  AgentPersona,
-  ChannelMember,
-  ChannelType,
-} from "@/shared/api/types";
+import type { ChannelMember, ChannelType } from "@/shared/api/types";
 import type { UserProfileLookup } from "@/features/profile/lib/identity";
 import { detectPrefixQuery } from "@/shared/lib/detectPrefixQuery";
 import { normalizePubkey } from "@/shared/lib/pubkey";
+import { channelMemberPubkeySet } from "@/shared/lib/rosterDerivations";
 import { trimMapToSize } from "@/shared/lib/trimMapToSize";
 import { flushMentionDebounce } from "./flushMentionDebounce";
 import { useAgentMentionRevalidation } from "./agentMentionRevalidation";
-import { hasMention } from "./hasMention";
 import { extractMentionPubkeys } from "./extractMentionPubkeys";
+import {
+  extractMentionPersonasFromMaps,
+  type PersonaMentionTarget,
+} from "./extractMentionPersonas";
 import { useDraftMentionRouting } from "./useDraftMentionRouting";
+import {
+  type MentionPickerMode,
+  useMentionSelection,
+} from "./useMentionSelection";
 import { rankMentionCandidates } from "./mentionRanking";
 import { mapMentionCandidateToSuggestion } from "./mentionSuggestionMapping";
 import {
@@ -59,13 +63,7 @@ import {
 } from "./mentionCandidates";
 const MENTION_DEBOUNCE_MS = 120;
 const MENTION_SUGGESTION_LIMIT = 50;
-export type PersonaMentionTarget = {
-  displayName: string;
-  persona: AgentPersona;
-};
-type UseMentionsOptions = {
-  channelType?: ChannelType | null;
-};
+type UseMentionsOptions = { channelType?: ChannelType | null };
 export function useMentions(
   channelId: string | null,
   externalMembers?: ChannelMember[],
@@ -74,7 +72,9 @@ export function useMentions(
 ) {
   const [mentionQuery, setMentionQuery] = React.useState<string | null>(null);
   const [mentionStartIndex, setMentionStartIndex] = React.useState(0);
-  const [mentionSelectedIndex, setMentionSelectedIndex] = React.useState(0);
+  const mentionPickerOriginRef = React.useRef<"inline" | "explicit" | null>(
+    null,
+  );
   const [selectedMentionNames, setSelectedMentionNames] = React.useState<
     string[]
   >([]);
@@ -225,9 +225,10 @@ export function useMentions(
     () => new Set(activePersonas.map((persona) => persona.id)),
     [activePersonas],
   );
+  // Identity-cached (shared with the timeline's roster derivations) — the
+  // Set is built once per distinct roster instead of per consumer.
   const memberPubkeys = React.useMemo(
-    () =>
-      new Set((members ?? []).map((member) => normalizePubkey(member.pubkey))),
+    () => (members ? channelMemberPubkeySet(members) : new Set<string>()),
     [members],
   );
   const agentIdentityPubkeys = React.useMemo(
@@ -456,11 +457,9 @@ export function useMentions(
     () => uniqueAutocompleteLabels(mentionCandidatesWithTeams),
     [mentionCandidatesWithTeams],
   );
-
   const highlightNames = React.useMemo<string[]>(() => {
     const names: string[] = [];
     const seen = new Set<string>();
-
     for (const name of selectedMentionNames) {
       const trimmed = name.trim();
       if (trimmed && !seen.has(trimmed.toLowerCase())) {
@@ -468,14 +467,11 @@ export function useMentions(
         seen.add(trimmed.toLowerCase());
       }
     }
-
     return names;
   }, [selectedMentionNames]);
-
   const agentHighlightNames = React.useMemo<string[]>(() => {
     const names: string[] = [];
     const seen = new Set<string>();
-
     for (const name of selectedAgentMentionNames) {
       const trimmed = name.trim();
       if (trimmed && !seen.has(trimmed.toLowerCase())) {
@@ -483,15 +479,12 @@ export function useMentions(
         seen.add(trimmed.toLowerCase());
       }
     }
-
     return names;
   }, [selectedAgentMentionNames]);
-
   const searchableNamesLower = React.useMemo<string[]>(
     () => searchableNames.map((n) => n.toLowerCase()),
     [searchableNames],
   );
-
   const debounceTimerRef = React.useRef<ReturnType<typeof setTimeout> | null>(
     null,
   );
@@ -499,11 +492,9 @@ export function useMentions(
   const latestCursorRef = React.useRef<number>(0);
   const flushedMentionStartIndexRef = React.useRef<number | null>(null);
   const searchableNamesLowerRef = React.useRef<string[]>(searchableNamesLower);
-
   React.useEffect(() => {
     searchableNamesLowerRef.current = searchableNamesLower;
   }, [searchableNamesLower]);
-
   React.useEffect(
     () => () => {
       if (debounceTimerRef.current !== null) {
@@ -512,12 +503,10 @@ export function useMentions(
     },
     [],
   );
-
   const matchingSuggestions = React.useMemo<MentionSuggestion[]>(() => {
     if (mentionQuery === null) {
       return [];
     }
-
     return rankMentionCandidates(
       mentionCandidatesWithTeams,
       mentionQuery,
@@ -526,6 +515,7 @@ export function useMentions(
       .slice(0, MENTION_SUGGESTION_LIMIT)
       .map(({ candidate, label }) =>
         mapMentionCandidateToSuggestion({
+          agentProvenanceReady: agentDirectoriesReady,
           candidate,
           label,
           channelType: options?.channelType,
@@ -536,6 +526,7 @@ export function useMentions(
       );
   }, [
     activePersonaIds,
+    agentDirectoriesReady,
     currentPubkey,
     mentionCandidatesWithTeams,
     mentionQuery,
@@ -543,29 +534,24 @@ export function useMentions(
     ownerProfilesQuery.data?.profiles,
     profiles,
   ]);
-
   const fetchMoreSuggestions = React.useCallback(() => {
     if (userSearchQuery.hasNextPage && !userSearchQuery.isFetchingNextPage) {
       void userSearchQuery.fetchNextPage();
     }
   }, [userSearchQuery]);
-
   const suggestions = React.useMemo<MentionSuggestion[]>(() => {
     if (mentionQuery === null) {
       return [];
     }
-
     if (matchingSuggestions.length > 0) {
       return matchingSuggestions;
     }
-
     if (userSearchQuery.isFetching) {
       return filterCachedAgentSuggestions(
         previousSuggestionsRef.current,
         mentionCandidatesWithTeams,
       );
     }
-
     return [];
   }, [
     matchingSuggestions,
@@ -573,42 +559,33 @@ export function useMentions(
     mentionQuery,
     userSearchQuery.isFetching,
   ]);
-
   React.useEffect(() => {
     if (mentionQuery === null) {
       previousSuggestionsRef.current = [];
       return;
     }
-
     if (matchingSuggestions.length > 0) {
       previousSuggestionsRef.current = matchingSuggestions;
     } else if (!userSearchQuery.isFetching) {
       previousSuggestionsRef.current = [];
     }
   }, [matchingSuggestions, mentionQuery, userSearchQuery.isFetching]);
-
-  React.useEffect(() => {
-    setMentionSelectedIndex((current) =>
-      suggestions.length === 0 ? 0 : Math.min(current, suggestions.length - 1),
-    );
-  }, [suggestions.length]);
-
+  const mentionSelection = useMentionSelection(suggestions);
+  const { mentionSelectedIndex, setMentionSelectedIndex: setSelected } =
+    mentionSelection;
   const isMentionOpen = mentionQuery !== null && suggestions.length > 0;
-
   const insertMention = React.useCallback(
     (suggestion: MentionSuggestion, selectionEnd: number): AutocompleteEdit => {
       if (debounceTimerRef.current !== null) {
         clearTimeout(debounceTimerRef.current);
         debounceTimerRef.current = null;
       }
-
       const displayName = suggestion.displayName;
       const teamMembers =
         suggestion.kind === "team" ? suggestion.teamMembers : null;
       const insertText = teamMembers
         ? formatTeamMention(displayName, teamMembers)
         : `@${displayName} `;
-
       const mentions = mentionMapRef.current;
       const personaMentions = personaMentionMapRef.current;
       const selectedMentions = teamMembers ?? [suggestion];
@@ -657,9 +634,9 @@ export function useMentions(
       }
       trimMapToSize(mentions, 200);
       trimMapToSize(personaMentions, 200);
+      mentionPickerOriginRef.current = null;
       setMentionQuery(null);
-      setMentionSelectedIndex(0);
-
+      setSelected(0);
       const startIndex =
         flushedMentionStartIndexRef.current ?? mentionStartIndex;
       flushedMentionStartIndexRef.current = null;
@@ -669,24 +646,20 @@ export function useMentions(
         insertText,
       };
     },
-    [knownAgentPubkeys, mentionStartIndex],
+    [knownAgentPubkeys, mentionStartIndex, setSelected],
   );
-
   const registerMentionPubkey = React.useCallback(
     (displayName: string, pubkey: string, options?: { isAgent?: boolean }) => {
       const trimmedName = displayName.trim();
       if (!trimmedName) {
         return;
       }
-
       mentionMapRef.current.set(trimmedName, pubkey);
       personaMentionMapRef.current.delete(trimmedName);
       trimMapToSize(mentionMapRef.current, 200);
-
       setSelectedMentionNames((current) =>
         appendUniqueName(current, trimmedName),
       );
-
       if (options?.isAgent) {
         setSelectedAgentMentionNames((current) => {
           const next = appendUniqueName(current, trimmedName);
@@ -697,7 +670,6 @@ export function useMentions(
     },
     [],
   );
-
   const insertResolvedMention = React.useCallback(
     ({
       displayName,
@@ -721,17 +693,14 @@ export function useMentions(
     },
     [registerMentionPubkey],
   );
-
   const getMentionDisplayName = React.useCallback(
     (pubkey: string): string | null => {
       const normalizedPubkey = normalizePubkey(pubkey);
-
       for (const [displayName, mentionPubkey] of mentionMapRef.current) {
         if (normalizePubkey(mentionPubkey) === normalizedPubkey) {
           return displayName;
         }
       }
-
       const candidate = mentionCandidates.find(
         (item) =>
           item.pubkey !== undefined &&
@@ -741,7 +710,6 @@ export function useMentions(
     },
     [mentionCandidates],
   );
-
   const isAgentPubkey = React.useCallback(
     (pubkey: string): boolean => knownAgentPubkeys.has(normalizePubkey(pubkey)),
     [knownAgentPubkeys],
@@ -751,21 +719,34 @@ export function useMentions(
       managedAgentPubkeys.has(normalizePubkey(pubkey)),
     [managedAgentPubkeys],
   );
+  const isInlineMentionSelection = React.useCallback(
+    () => mentionPickerOriginRef.current === "inline",
+    [],
+  );
   const autocompleteGenerationRef = React.useRef(0);
   const updateMentionQuery = React.useCallback(
     (value: string, cursorPosition: number) => {
+      mentionSelection.clearAgentSelectionPreference();
       const generation = ++autocompleteGenerationRef.current;
       latestValueRef.current = value;
       latestCursorRef.current = cursorPosition;
-
+      const activeInlineMention = detectPrefixQuery(
+        "@",
+        value,
+        cursorPosition,
+        searchableNamesLowerRef.current,
+      );
+      if (activeInlineMention) {
+        mentionPickerOriginRef.current = "inline";
+      } else if (mentionPickerOriginRef.current === "inline") {
+        mentionPickerOriginRef.current = null;
+      }
       if (debounceTimerRef.current !== null) {
         clearTimeout(debounceTimerRef.current);
       }
-
       debounceTimerRef.current = setTimeout(() => {
         debounceTimerRef.current = null;
         if (generation !== autocompleteGenerationRef.current) return;
-
         const mention = detectPrefixQuery(
           "@",
           latestValueRef.current,
@@ -773,17 +754,37 @@ export function useMentions(
           searchableNamesLowerRef.current,
         );
         if (mention) {
+          mentionPickerOriginRef.current = "inline";
           setMentionQuery(mention.query);
           setMentionStartIndex(mention.startIndex);
-          setMentionSelectedIndex(0);
+          setSelected(0);
         } else {
           setMentionQuery(null);
         }
       }, MENTION_DEBOUNCE_MS);
     },
-    [],
+    [mentionSelection.clearAgentSelectionPreference, setSelected],
+  );
+  const openMentionPicker = React.useCallback(
+    (cursorPosition: number, preference: MentionPickerMode = null) => {
+      autocompleteGenerationRef.current += 1;
+      if (debounceTimerRef.current !== null) {
+        clearTimeout(debounceTimerRef.current);
+        debounceTimerRef.current = null;
+      }
+      flushedMentionStartIndexRef.current = null;
+      mentionPickerOriginRef.current = "explicit";
+      if (preference === "preserve") {
+        setMentionStartIndex(cursorPosition);
+        return;
+      }
+      mentionSelection.prepareSelectionPreference(preference);
+      setMentionQuery("");
+      setMentionStartIndex(cursorPosition);
+      setSelected(0);
+    },
+    [mentionSelection.prepareSelectionPreference, setSelected],
   );
-
   const extractMentionPubkeysForCurrentMentions = React.useCallback(
     (text: string): string[] => {
       const extracted = extractMentionPubkeys({
@@ -816,31 +817,15 @@ export function useMentions(
     sharedChannelIds,
     refetchManagedAgents: managedAgentsQuery.refetch,
   });
-
   const extractMentionPersonas = React.useCallback(
-    (text: string): PersonaMentionTarget[] => {
-      const targets: PersonaMentionTarget[] = [];
-      const seen = new Set<string>();
-
-      for (const [displayName, personaId] of personaMentionMapRef.current) {
-        if (seen.has(personaId) || !hasMention(text, displayName)) {
-          continue;
-        }
-
-        const persona = activePersonaById.get(personaId);
-        if (!persona) {
-          continue;
-        }
-
-        targets.push({ displayName, persona });
-        seen.add(personaId);
-      }
-
-      return targets;
-    },
+    (text: string): PersonaMentionTarget[] =>
+      extractMentionPersonasFromMaps(
+        text,
+        personaMentionMapRef.current,
+        activePersonaById,
+      ),
     [activePersonaById],
   );
-
   const cancelMentionAutocomplete = React.useCallback(() => {
     autocompleteGenerationRef.current += 1;
     if (debounceTimerRef.current !== null) {
@@ -848,9 +833,11 @@ export function useMentions(
       debounceTimerRef.current = null;
     }
     flushedMentionStartIndexRef.current = null;
+    mentionPickerOriginRef.current = null;
+    mentionSelection.clearAgentSelectionPreference();
     setMentionQuery(null);
-    setMentionSelectedIndex(0);
-  }, []);
+    setSelected(0);
+  }, [mentionSelection.clearAgentSelectionPreference, setSelected]);
   const clearMentions = React.useCallback(() => {
     cancelMentionAutocomplete();
     mentionMapRef.current.clear();
@@ -860,7 +847,6 @@ export function useMentions(
     setSelectedMentionNames([]);
     setSelectedAgentMentionNames([]);
   }, [cancelMentionAutocomplete]);
-
   const { getDraftMentionRefs, restoreDraftMentionRefs } =
     useDraftMentionRouting({
       mentionMapRef,
@@ -870,7 +856,6 @@ export function useMentions(
       setSelectedNames: setSelectedMentionNames,
       setSelectedAgentNames: setSelectedAgentMentionNames,
     });
-
   const handleMentionKeyDown = React.useCallback(
     (
       event: React.KeyboardEvent,
@@ -878,23 +863,20 @@ export function useMentions(
       if (!isMentionOpen) {
         return { handled: false };
       }
-
       if (event.key === "ArrowDown") {
         event.preventDefault();
-        setMentionSelectedIndex((current) =>
+        setSelected((current) =>
           current < suggestions.length - 1 ? current + 1 : 0,
         );
         return { handled: true };
       }
-
       if (event.key === "ArrowUp") {
         event.preventDefault();
-        setMentionSelectedIndex((current) =>
+        setSelected((current) =>
           current > 0 ? current - 1 : suggestions.length - 1,
         );
         return { handled: true };
       }
-
       if (
         event.key === "Tab" ||
         (event.key === "Enter" &&
@@ -904,7 +886,6 @@ export function useMentions(
           !event.shiftKey)
       ) {
         event.preventDefault();
-
         if (debounceTimerRef.current !== null) {
           const flushed = flushMentionDebounce({
             debounceTimerRef,
@@ -913,6 +894,7 @@ export function useMentions(
             searchableNamesLowerRef,
             candidates: mentionCandidatesWithTeams,
             activePersonaIds,
+            agentProvenanceReady: agentDirectoriesReady,
             channelType: options?.channelType,
             currentPubkey,
             ownerProfiles: ownerProfilesQuery.data?.profiles,
@@ -920,6 +902,7 @@ export function useMentions(
           });
           if (flushed?.type === "match") {
             flushedMentionStartIndexRef.current = flushed.startIndex;
+            mentionPickerOriginRef.current = "inline";
             setMentionQuery(null); // reset so dropdown closes
             return { handled: true, suggestion: flushed.suggestion };
           }
@@ -928,20 +911,18 @@ export function useMentions(
             return { handled: true };
           }
         }
-
         return { handled: true, suggestion: suggestions[mentionSelectedIndex] };
       }
-
       if (event.key === "Escape") {
         event.preventDefault();
         cancelMentionAutocomplete(); // full cancel incl. pending debounce
         return { handled: true };
       }
-
       return { handled: false };
     },
     [
       activePersonaIds,
+      agentDirectoriesReady,
       cancelMentionAutocomplete,
       currentPubkey,
       isMentionOpen,
@@ -950,10 +931,10 @@ export function useMentions(
       options?.channelType,
       ownerProfilesQuery.data?.profiles,
       profiles,
+      setSelected,
       suggestions,
     ],
   );
-
   return {
     cancelMentionAutocomplete,
     clearMentions,
@@ -969,10 +950,13 @@ export function useMentions(
     agentKnownNames: agentHighlightNames,
     isAgentPubkey,
     isManagedAgentPubkey,
+    isInlineMentionSelection,
     isMentionOpen,
     knownNames: highlightNames,
     memberPubkeys,
     mentionSelectedIndex,
+    mentionStartIndex,
+    openMentionPicker,
     registerMentionPubkey,
     restoreDraftMentionRefs,
     suggestions,
@@ -982,5 +966,4 @@ export function useMentions(
     updateMentionQuery,
   };
 }
-
 export type UseMentionsResult = ReturnType<typeof useMentions>;
diff --git a/desktop/src/features/messages/lib/useRichTextEditor.ts b/desktop/src/features/messages/lib/useRichTextEditor.ts
index f812eb91156..36a75f32e5d 100644
--- a/desktop/src/features/messages/lib/useRichTextEditor.ts
+++ b/desktop/src/features/messages/lib/useRichTextEditor.ts
@@ -24,7 +24,9 @@ import { MESSAGE_MARKDOWN_CLASS } from "@/shared/ui/mentionChip";
 
 import {
   MentionHighlightExtension,
-  mentionHighlightKey,
+  reassertMentionCaretAfterFocus,
+  settleAutocompleteMentionInsert,
+  syncMentionHighlightFromProps,
 } from "./mentionHighlightExtension";
 import { CUSTOM_EMOJI_NODE_NAME } from "./customEmojiNode";
 import { useComposerCustomEmoji } from "./useComposerCustomEmoji";
@@ -688,24 +690,15 @@ export function useRichTextEditor({
   }, [editor, placeholder]);
 
   // Keep mention/channel-highlight decorations in sync with known names.
-  // NOTE: We use `editor.storage.mentionHighlight` (the mutable storage object
-  // shared with the ProseMirror plugin closure) rather than finding the
-  // extension instance via extensionManager — the instance's `.storage` getter
-  // returns a fresh spread-copy on every access, so mutations are silently lost.
+  // Mutate `editor.storage.mentionHighlight`; the extension getter copies storage.
   React.useEffect(() => {
     if (!editor) return;
-    // biome-ignore lint/suspicious/noExplicitAny: TipTap's Storage type doesn't include dynamic extension keys
-    const storage = (editor.storage as any).mentionHighlight as
-      | { names: string[]; agentNames: string[]; channelNames: string[] }
-      | undefined;
-    if (storage) {
-      storage.names = mentionNames ?? [];
-      storage.agentNames = agentMentionNames ?? [];
-      storage.channelNames = channelNames ?? [];
-      // Force the plugin to re-decorate by dispatching a metadata transaction.
-      const { tr } = editor.state;
-      editor.view.dispatch(tr.setMeta(mentionHighlightKey, true));
-    }
+    syncMentionHighlightFromProps(
+      editor,
+      mentionNames,
+      agentMentionNames,
+      channelNames,
+    );
   }, [editor, mentionNames, agentMentionNames, channelNames]);
 
   // Custom-emoji set changes: re-resolve the `src` attr on any existing
@@ -872,8 +865,10 @@ export function useRichTextEditor({
       // "Position N out of range".)
       const cursorPM = tr.mapping.map(toPM);
       tr.setSelection(TextSelection.create(tr.doc, cursorPM));
+      settleAutocompleteMentionInsert(editor, tr, text);
       editor.view.dispatch(tr);
       editor.view.focus();
+      reassertMentionCaretAfterFocus(editor.view);
     },
     [editor, customEmojiWiring.resolveUrl],
   );
diff --git a/desktop/src/features/messages/ui/ComposerAddressControls.test.mjs b/desktop/src/features/messages/ui/ComposerAddressControls.test.mjs
new file mode 100644
index 00000000000..78c14aeef9c
--- /dev/null
+++ b/desktop/src/features/messages/ui/ComposerAddressControls.test.mjs
@@ -0,0 +1,127 @@
+import assert from "node:assert/strict";
+import { after, afterEach, before, test } from "node:test";
+
+import { JSDOM } from "jsdom";
+
+const dom = new JSDOM("<!doctype html><html><body></body></html>", {
+  url: "http://localhost",
+});
+
+before(() => {
+  Object.assign(globalThis, {
+    document: dom.window.document,
+    Element: dom.window.Element,
+    HTMLElement: dom.window.HTMLElement,
+    IS_REACT_ACT_ENVIRONMENT: true,
+    Node: dom.window.Node,
+    window: dom.window,
+  });
+});
+
+afterEach(async () => {
+  const { cleanup } = await import("@testing-library/react");
+  cleanup();
+});
+
+after(() => dom.window.close());
+
+const agent = {
+  avatarUrl: null,
+  displayName: "Agent Ada",
+  pubkey: "agent-pubkey",
+};
+const secondAgent = {
+  avatarUrl: null,
+  displayName: "Agent Bea",
+  pubkey: "second-agent-pubkey",
+};
+const thirdAgent = {
+  avatarUrl: null,
+  displayName: "Agent Cia",
+  pubkey: "third-agent-pubkey",
+};
+
+test("mention control expands with automatically mentioned agents", async () => {
+  const React = await import("react");
+  const { fireEvent, render } = await import("@testing-library/react");
+  const { TooltipProvider } = await import("@/shared/ui/tooltip");
+  const { ComposerMentionButton } = await import(
+    "./ComposerAddressControls.tsx"
+  );
+  let opened = 0;
+  const removed = [];
+  const renderButton = (agents) =>
+    React.createElement(
+      TooltipProvider,
+      null,
+      React.createElement(ComposerMentionButton, {
+        agents,
+        disabled: false,
+        onCaptureSelection: () => {},
+        onOpen: () => {
+          opened += 1;
+        },
+        onRemove: (pubkey) => removed.push(pubkey),
+        showAgents: true,
+      }),
+    );
+  const view = render(renderButton([agent]));
+  view.rerender(renderButton([agent, secondAgent, thirdAgent]));
+
+  assert.ok(view.getByTestId("composer-address-locks"));
+  const avatar = view.getByTestId("composer-address-lock-agent-pubkey");
+  assert.ok(avatar);
+  const manage = view.getByRole("button", {
+    name: "Manage automatic agent mentions",
+  });
+  assert.match(manage.className, /(?:^|\s)-ml-2(?:\s|$)/);
+  assert.match(manage.className, /(?:^|\s)pl-2(?:\s|$)/);
+  assert.match(manage.parentElement?.className ?? "", /(?:^|\s)pl-2(?:\s|$)/);
+  assert.match(
+    view.getByRole("button", { name: "Manage automatic agent mentions" })
+      .parentElement?.className ?? "",
+    /(?:^|\s)pr-1(?:\s|$)/,
+  );
+  assert.match(
+    view.getByRole("button", { name: "Manage automatic agent mentions" })
+      .parentElement?.className ?? "",
+    /(?:^|\s)bg-primary\/15(?:\s|$)/,
+  );
+  assert.match(
+    view.getByRole("button", { name: "Manage automatic agent mentions" })
+      .parentElement?.className ?? "",
+    /(?:^|\s)text-primary(?:\s|$)/,
+  );
+  assert.doesNotMatch(
+    view.getByRole("button", { name: "Manage automatic agent mentions" })
+      .parentElement?.className ?? "",
+    /(?:^|\s)bg-accent\/70(?:\s|$)/,
+  );
+  assert.doesNotMatch(
+    avatar.querySelector("span")?.className ?? "",
+    /(?:^|\s)ring(?:-|\s)/,
+  );
+  for (const addedAgent of [secondAgent, thirdAgent]) {
+    const addedAvatar = view.getByTestId(
+      `composer-address-lock-${addedAgent.pubkey}`,
+    );
+    assert.equal(addedAvatar.parentElement?.style.opacity, "0");
+    assert.match(
+      addedAvatar.parentElement?.style.transform ?? "",
+      /scale\(0.8\)/,
+    );
+  }
+  const remove = view.getByRole("button", {
+    name: "Stop automatically mentioning Agent Ada",
+  });
+  assert.match(
+    remove.querySelector("span.absolute")?.className ?? "",
+    /group-hover\/address:opacity-100/,
+  );
+  fireEvent.click(remove);
+  assert.deepEqual(removed, ["agent-pubkey"]);
+  fireEvent.click(
+    view.getByRole("button", { name: "Manage automatic agent mentions" }),
+  );
+  assert.equal(opened, 1);
+});
diff --git a/desktop/src/features/messages/ui/ComposerAddressControls.tsx b/desktop/src/features/messages/ui/ComposerAddressControls.tsx
new file mode 100644
index 00000000000..2c8c28f5de3
--- /dev/null
+++ b/desktop/src/features/messages/ui/ComposerAddressControls.tsx
@@ -0,0 +1,262 @@
+import { ArrowUp, AtSign, X } from "lucide-react";
+import {
+  AnimatePresence,
+  motion,
+  useAnimationControls,
+  useReducedMotion,
+} from "motion/react";
+import * as React from "react";
+
+import { cn } from "@/shared/lib/cn";
+import { UserAvatar } from "@/shared/ui/UserAvatar";
+import { Tooltip, TooltipContent, TooltipTrigger } from "@/shared/ui/tooltip";
+
+export type ComposerAddressAgent = {
+  avatarUrl: string | null;
+  displayName: string;
+  pubkey: string;
+};
+
+type AddressAnimationProps = {
+  pulseVersion: number;
+  shakeVersion: number;
+};
+
+function AddressedAgentAvatar({
+  agent,
+  pulseVersion,
+  shakeVersion,
+}: AddressAnimationProps & { agent: ComposerAddressAgent }) {
+  const controls = useAnimationControls();
+  const shouldReduceMotion = useReducedMotion();
+  const previousPulseVersionRef = React.useRef(0);
+  const previousShakeVersionRef = React.useRef(0);
+
+  React.useEffect(() => {
+    if (pulseVersion <= previousPulseVersionRef.current) return;
+    previousPulseVersionRef.current = pulseVersion;
+    if (shouldReduceMotion) return;
+    void controls.start({
+      scale: [1, 1.3, 0.96, 1.08, 1],
+      y: [0, -4, 1, -1, 0],
+      transition: { duration: 0.48, ease: "easeOut" },
+    });
+  }, [controls, pulseVersion, shouldReduceMotion]);
+
+  React.useEffect(() => {
+    if (shakeVersion <= previousShakeVersionRef.current) return;
+    previousShakeVersionRef.current = shakeVersion;
+    if (shouldReduceMotion) return;
+    controls.stop();
+    controls.set({ scale: 1, x: 0, y: 0 });
+    void controls.start({
+      x: [0, -4, 4, -3, 3, -1.5, 1.5, 0],
+      transition: { duration: 0.42, ease: "easeOut" },
+    });
+  }, [controls, shakeVersion, shouldReduceMotion]);
+
+  return (
+    <motion.span
+      animate={controls}
+      className="relative block h-5 w-5 shrink-0"
+      data-pulse-version={pulseVersion}
+      data-shake-version={shakeVersion}
+      data-testid={`composer-address-lock-${agent.pubkey}`}
+      initial={false}
+    >
+      <UserAvatar
+        avatarUrl={agent.avatarUrl}
+        className="h-5 w-5"
+        displayName={agent.displayName}
+        size="xs"
+        testId="composer-address-lock-avatar"
+      />
+    </motion.span>
+  );
+}
+
+function RemainingAgentCount({ count }: { count: number }) {
+  return count > 0 ? (
+    <span
+      aria-label={`${count} more addressed ${count === 1 ? "agent" : "agents"}`}
+      className="flex h-5 min-w-5 items-center justify-center rounded-full bg-muted px-1 text-3xs font-semibold text-muted-foreground ring-1 ring-border/70"
+      role="img"
+    >
+      +{count}
+    </span>
+  ) : null;
+}
+
+const VISIBLE_AGENT_LIMIT = 3;
+
+function useNewlyAddedAgentPubkeys(
+  agents: readonly ComposerAddressAgent[],
+): ReadonlySet<string> {
+  const previousPubkeysRef = React.useRef<ReadonlySet<string> | null>(null);
+  const currentPubkeys = new Set(agents.map((agent) => agent.pubkey));
+  const newlyAddedPubkeys = new Set<string>();
+
+  if (previousPubkeysRef.current) {
+    for (const pubkey of currentPubkeys) {
+      if (!previousPubkeysRef.current.has(pubkey)) {
+        newlyAddedPubkeys.add(pubkey);
+      }
+    }
+  }
+
+  React.useEffect(() => {
+    previousPubkeysRef.current = new Set(agents.map((agent) => agent.pubkey));
+  }, [agents]);
+
+  return newlyAddedPubkeys;
+}
+
+const addressEntryTransition = {
+  type: "spring",
+  stiffness: 500,
+  damping: 30,
+} as const;
+
+type AddressAgentsProps = {
+  agents: readonly ComposerAddressAgent[];
+  pulseVersionByPubkey?: Readonly<Record<string, number>>;
+  shakeVersionByPubkey?: Readonly<Record<string, number>>;
+};
+
+export function ComposerMentionButton({
+  agents,
+  disabled,
+  onCaptureSelection,
+  onOpen,
+  onRemove,
+  pulseVersionByPubkey = {},
+  shakeVersionByPubkey = {},
+  showAgents,
+}: AddressAgentsProps & {
+  disabled: boolean;
+  onCaptureSelection: () => void;
+  onOpen: () => void;
+  onRemove: (pubkey: string) => void;
+  showAgents: boolean;
+}) {
+  const visibleAgents = showAgents ? agents.slice(0, VISIBLE_AGENT_LIMIT) : [];
+  const hiddenCount = showAgents ? agents.length - visibleAgents.length : 0;
+  const hasAgents = visibleAgents.length > 0;
+  const newlyAddedAgentPubkeys = useNewlyAddedAgentPubkeys(visibleAgents);
+
+  return (
+    <div
+      className={cn(
+        "flex h-8 min-w-8 items-center justify-center rounded-lg transition-colors",
+        hasAgents
+          ? "gap-1.5 bg-primary/15 pl-2 pr-1 text-primary hover:bg-primary/25 hover:text-primary/90"
+          : "text-foreground",
+      )}
+    >
+      <Tooltip disableHoverableContent>
+        <TooltipTrigger asChild>
+          <button
+            aria-label={
+              hasAgents ? "Manage automatic agent mentions" : "Mention someone"
+            }
+            className={cn(
+              "flex h-8 items-center justify-center rounded-lg focus-visible:outline-hidden focus-visible:ring-1 focus-visible:ring-ring disabled:pointer-events-none disabled:opacity-50",
+              hasAgents
+                ? "-ml-2 w-6 rounded-l-lg rounded-r-sm pl-2"
+                : "w-8 hover:bg-accent hover:text-accent-foreground",
+            )}
+            data-mention-picker-trigger=""
+            data-testid="message-insert-mention"
+            disabled={disabled}
+            onClick={onOpen}
+            onMouseDown={onCaptureSelection}
+            type="button"
+          >
+            <AtSign aria-hidden="true" className="h-4 w-4 shrink-0" />
+          </button>
+        </TooltipTrigger>
+        <TooltipContent>
+          {hasAgents ? "Manage automatic agent mentions" : "Mention someone"}
+        </TooltipContent>
+      </Tooltip>
+      {hasAgents ? (
+        <span
+          className="flex items-center gap-1"
+          data-testid="composer-address-locks"
+        >
+          <AnimatePresence mode="popLayout">
+            {visibleAgents.map((agent) => (
+              <Tooltip disableHoverableContent key={agent.pubkey}>
+                <TooltipTrigger asChild>
+                  <motion.button
+                    aria-label={`Stop automatically mentioning ${agent.displayName}`}
+                    animate={{ opacity: 1, scale: 1 }}
+                    className="group/address relative rounded-full focus-visible:outline-hidden focus-visible:ring-1 focus-visible:ring-ring"
+                    data-testid={`composer-address-lock-remove-${agent.pubkey}`}
+                    disabled={disabled}
+                    exit={{ opacity: 0, scale: 0.8 }}
+                    initial={
+                      newlyAddedAgentPubkeys.has(agent.pubkey)
+                        ? { opacity: 0, scale: 0.8 }
+                        : false
+                    }
+                    layout
+                    onClick={() => onRemove(agent.pubkey)}
+                    transition={addressEntryTransition}
+                    type="button"
+                  >
+                    <AddressedAgentAvatar
+                      agent={agent}
+                      pulseVersion={pulseVersionByPubkey[agent.pubkey] ?? 0}
+                      shakeVersion={shakeVersionByPubkey[agent.pubkey] ?? 0}
+                    />
+                    <span className="pointer-events-none absolute inset-0 flex items-center justify-center rounded-full bg-foreground/80 text-background opacity-0 transition-opacity group-hover/address:opacity-100 group-focus-visible/address:opacity-100">
+                      <X aria-hidden="true" className="h-3 w-3" />
+                    </span>
+                  </motion.button>
+                </TooltipTrigger>
+                <TooltipContent>
+                  Stop automatically mentioning {agent.displayName}
+                </TooltipContent>
+              </Tooltip>
+            ))}
+          </AnimatePresence>
+          <RemainingAgentCount count={hiddenCount} />
+        </span>
+      ) : null}
+    </div>
+  );
+}
+
+export function ComposerSendButton({
+  isSending,
+  sendDisabled,
+}: {
+  isSending: boolean;
+  sendDisabled: boolean;
+}) {
+  return (
+    <button
+      aria-label={isSending ? "Sending" : "Send message"}
+      className="inline-flex h-8 w-8 items-center justify-center rounded-full bg-primary text-primary-foreground shadow transition-colors hover:bg-primary/90 focus-visible:outline-hidden focus-visible:ring-1 focus-visible:ring-ring disabled:pointer-events-none disabled:opacity-50"
+      data-testid="send-message"
+      disabled={sendDisabled || isSending}
+      type="submit"
+    >
+      {isSending ? (
+        <SendSpinner />
+      ) : (
+        <ArrowUp aria-hidden className="h-4 w-4" />
+      )}
+    </button>
+  );
+}
+
+function SendSpinner() {
+  return (
+    <span
+      aria-hidden
+      className="h-4 w-4 animate-spin rounded-full border-2 border-primary-foreground border-t-transparent"
+    />
+  );
+}
diff --git a/desktop/src/features/messages/ui/MentionAutocomplete.test.mjs b/desktop/src/features/messages/ui/MentionAutocomplete.test.mjs
index 5f156b33240..012c962e0f0 100644
--- a/desktop/src/features/messages/ui/MentionAutocomplete.test.mjs
+++ b/desktop/src/features/messages/ui/MentionAutocomplete.test.mjs
@@ -1,8 +1,320 @@
 import assert from "node:assert/strict";
-import test from "node:test";
+import { after, afterEach, before, test } from "node:test";
 
-import { mentionAgentLabel } from "./MentionAutocomplete.tsx";
+import { JSDOM } from "jsdom";
+import { showMentionAgentProvenanceMarker } from "./MentionAutocomplete.tsx";
 
+const dom = new JSDOM("<!doctype html><html><body></body></html>", {
+  url: "http://localhost",
+});
+
+before(() => {
+  dom.window.HTMLElement.prototype.scrollIntoView = () => {};
+  Object.assign(globalThis, {
+    CustomEvent: dom.window.CustomEvent,
+    document: dom.window.document,
+    Element: dom.window.Element,
+    Event: dom.window.Event,
+    getComputedStyle: dom.window.getComputedStyle.bind(dom.window),
+    HTMLElement: dom.window.HTMLElement,
+    IS_REACT_ACT_ENVIRONMENT: true,
+    Node: dom.window.Node,
+    ResizeObserver: class {
+      disconnect() {}
+      observe() {}
+      unobserve() {}
+    },
+    window: dom.window,
+  });
+});
+
+afterEach(async () => {
+  const { cleanup } = await import("@testing-library/react");
+  cleanup();
+});
+
+after(() => dom.window.close());
+
+test("agent rows offer automatic mention controls", async () => {
+  const React = await import("react");
+  const { fireEvent, render } = await import("@testing-library/react");
+  const { MentionAutocomplete } = await import("./MentionAutocomplete.tsx");
+  const { TooltipProvider } = await import("@/shared/ui/tooltip");
+  const suggestion = {
+    pubkey: "agent-pubkey",
+    displayName: "Agent Ada",
+    isAgent: true,
+  };
+  const selected = [];
+  const toggled = [];
+  const props = {
+    suggestions: [suggestion],
+    selectedIndex: 0,
+    onSelect: (value) => selected.push(value),
+    onToggleAlwaysAddressAgent: (value) => toggled.push(value),
+    lockedAgentPubkeys: new Set(),
+  };
+  const renderAutocomplete = (autocompleteProps) =>
+    React.createElement(
+      TooltipProvider,
+      null,
+      React.createElement(MentionAutocomplete, autocompleteProps),
+    );
+  const view = render(renderAutocomplete(props));
+
+  assert.equal(
+    view.queryByText("Hover an agent avatar to keep it addressed"),
+    null,
+  );
+  const rowAction = view.getByRole("button", {
+    name: "Mention Agent Ada",
+  });
+  fireEvent.mouseDown(rowAction);
+  assert.deepEqual(selected, [suggestion]);
+
+  const action = view.getByRole("button", {
+    name: "Automatically mention Agent Ada",
+  });
+  assert.equal(action.getAttribute("aria-pressed"), "false");
+  assert.equal(action.getAttribute("data-state"), "off");
+  fireEvent.click(action);
+  assert.deepEqual(toggled, [suggestion]);
+  assert.deepEqual(selected, [suggestion]);
+
+  view.rerender(
+    renderAutocomplete({
+      ...props,
+      lockedAgentPubkeys: new Set(["agent-pubkey"]),
+    }),
+  );
+  const selectedAction = view.getByRole("button", {
+    name: "Stop automatically mentioning Agent Ada",
+  });
+  assert.equal(selectedAction.getAttribute("aria-pressed"), "true");
+  assert.equal(selectedAction.getAttribute("data-state"), "on");
+  fireEvent.click(selectedAction);
+  assert.deepEqual(toggled, [suggestion, suggestion]);
+});
+
+test("options expand in place without replacing the people list", async () => {
+  const React = await import("react");
+  const { fireEvent, render } = await import("@testing-library/react");
+  const { MentionAutocomplete } = await import("./MentionAutocomplete.tsx");
+  const changes = [];
+  const suggestion = {
+    pubkey: "agent-pubkey",
+    displayName: "Agent Ada",
+    isAgent: true,
+  };
+  const view = render(
+    React.createElement(MentionAutocomplete, {
+      suggestions: [suggestion],
+      selectedIndex: 0,
+      onSelect: () => {},
+      keepMentionedAgentsPinned: true,
+      onKeepMentionedAgentsPinnedChange: (value) => changes.push(value),
+    }),
+  );
+
+  const options = view.getByRole("button", { name: "Options" });
+  assert.equal(options.getAttribute("aria-expanded"), "false");
+  assert.match(options.parentElement?.className ?? "", /(?:^|\s)w-24(?:\s|$)/);
+  assert.ok(view.getByRole("button", { name: "Mention Agent Ada" }));
+  assert.equal(
+    view.queryByRole("switch", { name: "Automatically mention agents" }),
+    null,
+  );
+
+  fireEvent.click(options);
+  assert.equal(options.getAttribute("aria-expanded"), "true");
+  const toggle = view.getByRole("switch", {
+    name: "Automatically mention agents",
+  });
+  assert.equal(toggle.getAttribute("data-state"), "checked");
+  assert.ok(view.getByText("After you mention them once"));
+  assert.ok(view.getByRole("button", { name: "Mention Agent Ada" }));
+
+  fireEvent.click(toggle);
+  assert.deepEqual(changes, [false]);
+
+  view.rerender(
+    React.createElement(MentionAutocomplete, {
+      suggestions: [],
+      selectedIndex: 0,
+      onSelect: () => {},
+      keepMentionedAgentsPinned: false,
+      onKeepMentionedAgentsPinnedChange: (value) => changes.push(value),
+    }),
+  );
+  assert.equal(view.queryByRole("button", { name: "Options" }), null);
+
+  view.rerender(
+    React.createElement(MentionAutocomplete, {
+      suggestions: [suggestion],
+      selectedIndex: 0,
+      onSelect: () => {},
+      keepMentionedAgentsPinned: false,
+      onKeepMentionedAgentsPinnedChange: (value) => changes.push(value),
+    }),
+  );
+  assert.equal(
+    view.getByRole("button", { name: "Options" }).getAttribute("aria-expanded"),
+    "false",
+  );
+  assert.equal(
+    view.queryByRole("switch", { name: "Automatically mention agents" }),
+    null,
+  );
+  assert.ok(view.getByRole("button", { name: "Mention Agent Ada" }));
+});
+
+test("clicking outside dismisses the tray without intercepting its trigger", async () => {
+  const React = await import("react");
+  const { fireEvent, render } = await import("@testing-library/react");
+  const { MentionAutocomplete } = await import("./MentionAutocomplete.tsx");
+  const suggestion = {
+    pubkey: "agent-pubkey",
+    displayName: "Agent Ada",
+    isAgent: true,
+  };
+  let dismissCount = 0;
+  const view = render(
+    React.createElement(
+      React.Fragment,
+      null,
+      React.createElement(
+        "form",
+        null,
+        React.createElement(
+          "button",
+          { "data-mention-picker-trigger": "", type: "button" },
+          "@",
+        ),
+        React.createElement(MentionAutocomplete, {
+          suggestions: [suggestion],
+          selectedIndex: 0,
+          onDismiss: () => {
+            dismissCount += 1;
+          },
+          onSelect: () => {},
+        }),
+      ),
+      React.createElement("button", { type: "button" }, "Outside"),
+      React.createElement(
+        "form",
+        null,
+        React.createElement(
+          "button",
+          { "data-mention-picker-trigger": "", type: "button" },
+          "Other @",
+        ),
+      ),
+    ),
+  );
+
+  fireEvent.pointerDown(
+    view.getByRole("button", { name: "Mention Agent Ada" }),
+  );
+  assert.equal(dismissCount, 0);
+
+  fireEvent.pointerDown(view.getByRole("button", { name: "@" }));
+  assert.equal(dismissCount, 0);
+
+  fireEvent.pointerDown(view.getByTestId("mention-autocomplete-layer"));
+  assert.equal(dismissCount, 1);
+
+  fireEvent.pointerDown(view.getByRole("button", { name: "Outside" }));
+  assert.equal(dismissCount, 2);
+
+  fireEvent.pointerDown(view.getByRole("button", { name: "Other @" }));
+  assert.equal(dismissCount, 3);
+});
+
+test("collision npubs sit inline with agent metadata", async () => {
+  const React = await import("react");
+  const { render } = await import("@testing-library/react");
+  const { MentionAutocomplete } = await import("./MentionAutocomplete.tsx");
+  const suggestions = [
+    {
+      pubkey: "a".repeat(64),
+      displayName: "Same Name",
+      isAgent: true,
+      ownerLabel: "you",
+    },
+    {
+      pubkey: "b".repeat(64),
+      displayName: "Same Name",
+      isAgent: true,
+      ownerLabel: "you",
+    },
+  ];
+  const view = render(
+    React.createElement(MentionAutocomplete, {
+      suggestions,
+      selectedIndex: 0,
+      onSelect: () => {},
+    }),
+  );
+
+  const agentIcons = view.getAllByTestId("mention-agent-icon");
+  const collisionNpubs = view.getAllByTestId("mention-collision-npub");
+  assert.equal(collisionNpubs.length, 2);
+  for (const [index, npub] of collisionNpubs.entries()) {
+    const agentMetadata = agentIcons[index].closest("span")?.parentElement;
+    assert.equal(npub.parentElement, agentMetadata);
+    assert.match(agentMetadata?.textContent ?? "", /agentmanaged by younpub1/);
+    assert.match(npub.className, /(?:^|\s)-translate-y-0\.5(?:\s|$)/);
+    assert.match(npub.className, /(?:^|\s)leading-none(?:\s|$)/);
+    assert.match(agentMetadata?.className ?? "", /(?:^|\s)min-h-3\.5(?:\s|$)/);
+  }
+});
+
+test("does not intercept Tab from the editor", async () => {
+  const React = await import("react");
+  const { fireEvent, render } = await import("@testing-library/react");
+  const { MentionAutocomplete } = await import("./MentionAutocomplete.tsx");
+  const { TooltipProvider } = await import("@/shared/ui/tooltip");
+  const suggestions = [
+    {
+      pubkey: "agent-a",
+      displayName: "Agent Ada",
+      isAgent: true,
+    },
+    {
+      pubkey: "agent-b",
+      displayName: "Agent Bea",
+      isAgent: true,
+    },
+  ];
+  const view = render(
+    React.createElement(
+      TooltipProvider,
+      null,
+      React.createElement(
+        "form",
+        null,
+        React.createElement(
+          "div",
+          { "data-testid": "message-input-scroll" },
+          React.createElement("input", { "aria-label": "Message" }),
+        ),
+        React.createElement(MentionAutocomplete, {
+          suggestions,
+          selectedIndex: 1,
+          onSelect: () => {},
+          onToggleAlwaysAddressAgent: () => {},
+        }),
+      ),
+    ),
+  );
+
+  const input = view.getByRole("textbox", { name: "Message" });
+  input.focus();
+  const wasNotCancelled = fireEvent.keyDown(input, { key: "Tab" });
+
+  assert.equal(wasNotCancelled, true);
+  assert.equal(document.activeElement, input);
+});
 function suggestion(agentProvenance) {
   return {
     pubkey: "1".repeat(64),
@@ -12,21 +324,27 @@ function suggestion(agentProvenance) {
   };
 }
 
-test("duplicate owned agents show their management provenance", () => {
+test("duplicate owned agents mark only the other setup", () => {
   assert.equal(
-    mentionAgentLabel(suggestion("managed-here"), true),
-    "agent · managed here",
+    showMentionAgentProvenanceMarker(suggestion("managed-here"), true),
+    false,
   );
   assert.equal(
-    mentionAgentLabel(suggestion("managed-elsewhere"), true),
-    "agent · managed elsewhere",
+    showMentionAgentProvenanceMarker(suggestion("managed-elsewhere"), true),
+    true,
   );
 });
 
-test("unique agents keep the compact generic label", () => {
-  assert.equal(mentionAgentLabel(suggestion("managed-here"), false), "agent");
+test("unique agents omit management provenance", () => {
+  assert.equal(
+    showMentionAgentProvenanceMarker(suggestion("managed-here"), false),
+    false,
+  );
 });
 
-test("agents without trustworthy provenance keep the generic label", () => {
-  assert.equal(mentionAgentLabel(suggestion(undefined), true), "agent");
+test("agents without trustworthy provenance omit management provenance", () => {
+  assert.equal(
+    showMentionAgentProvenanceMarker(suggestion(undefined), true),
+    false,
+  );
 });
diff --git a/desktop/src/features/messages/ui/MentionAutocomplete.tsx b/desktop/src/features/messages/ui/MentionAutocomplete.tsx
index 8e715285259..9287c4f0e13 100644
--- a/desktop/src/features/messages/ui/MentionAutocomplete.tsx
+++ b/desktop/src/features/messages/ui/MentionAutocomplete.tsx
@@ -1,5 +1,7 @@
 import * as React from "react";
-import { Bot, Users } from "lucide-react";
+import { AtSign, Bot, ChevronRight, Users } from "lucide-react";
+import { OtherSetupAgentMarker } from "@/features/agents/ui/OtherSetupAgentMarker";
+import { motion } from "motion/react";
 import type { TeamMentionMember } from "@/features/messages/lib/mentionCandidates";
 
 import { Badge } from "@/shared/ui/badge";
@@ -10,8 +12,12 @@ import {
   POPOVER_SURFACE_CLASS,
 } from "@/shared/ui/popoverSurface";
 import { UserAvatar } from "@/shared/ui/UserAvatar";
+import { Switch } from "@/shared/ui/switch";
+import { Toggle } from "@/shared/ui/toggle";
+import { Tooltip, TooltipContent, TooltipTrigger } from "@/shared/ui/tooltip";
 import { safeNpub } from "@/shared/lib/nostrUtils";
 import { truncatePubkey } from "@/shared/lib/pubkey";
+import { getPlatformKeysById } from "@/shared/lib/keyboard-shortcuts";
 
 export type MentionSuggestion = {
   pubkey?: string;
@@ -33,17 +39,20 @@ type MentionAutocompleteProps = {
   selectedIndex: number;
   onFetchMore?: () => void;
   onSelect: (suggestion: MentionSuggestion) => void;
+  lockedAgentPubkeys?: ReadonlySet<string>;
+  onToggleAlwaysAddressAgent?: (suggestion: MentionSuggestion) => void;
+  keepMentionedAgentsPinned?: boolean;
+  onKeepMentionedAgentsPinnedChange?: (value: boolean) => void;
+  openOptionsRequest?: number;
+  onDismiss?: () => void;
   position?: "above" | "below";
 };
 
-export function mentionAgentLabel(
+export function showMentionAgentProvenanceMarker(
   suggestion: MentionSuggestion,
   hasNameCollision: boolean,
-) {
-  if (!hasNameCollision || !suggestion.agentProvenance) return "agent";
-  return suggestion.agentProvenance === "managed-here"
-    ? "agent · managed here"
-    : "agent · managed elsewhere";
+): boolean {
+  return hasNameCollision && suggestion.agentProvenance === "managed-elsewhere";
 }
 
 export const MentionAutocomplete = React.memo(function MentionAutocomplete({
@@ -51,17 +60,72 @@ export const MentionAutocomplete = React.memo(function MentionAutocomplete({
   selectedIndex,
   onFetchMore,
   onSelect,
+  lockedAgentPubkeys,
+  onToggleAlwaysAddressAgent,
+  keepMentionedAgentsPinned = true,
+  onKeepMentionedAgentsPinnedChange,
+  openOptionsRequest = 0,
+  onDismiss,
   position = "above",
 }: MentionAutocompleteProps) {
+  const rootRef = React.useRef<HTMLDivElement>(null);
+  const optionsSurfaceRef = React.useRef<HTMLDivElement>(null);
   const listRef = React.useRef<HTMLDivElement>(null);
+  const optionsId = React.useId();
+  const keepPinnedSwitchId = React.useId();
+  const [optionsOpen, setOptionsOpen] = React.useState(false);
+  const alwaysAddressShortcut = getPlatformKeysById("always-address-agent");
 
   React.useEffect(() => {
-    const activeItem = listRef.current?.children[selectedIndex] as
-      | HTMLElement
-      | undefined;
+    const activeItem = listRef.current?.querySelector<HTMLElement>(
+      `[data-mention-suggestion-index="${selectedIndex}"]`,
+    );
     activeItem?.scrollIntoView({ block: "nearest" });
   }, [selectedIndex]);
 
+  React.useEffect(() => {
+    if (suggestions.length === 0) {
+      setOptionsOpen(false);
+    }
+  }, [suggestions.length]);
+
+  React.useEffect(() => {
+    if (openOptionsRequest > 0) {
+      setOptionsOpen(true);
+    }
+  }, [openOptionsRequest]);
+
+  React.useEffect(() => {
+    if (!onDismiss) return;
+
+    const handlePointerDown = (event: PointerEvent) => {
+      const root = rootRef.current;
+      const target = event.target;
+      if (!root || !(target instanceof Node)) return;
+      if (
+        listRef.current?.contains(target) ||
+        optionsSurfaceRef.current?.contains(target)
+      ) {
+        return;
+      }
+
+      const composer = root.closest("form");
+      const mentionTrigger =
+        target instanceof Element
+          ? target.closest("[data-mention-picker-trigger]")
+          : null;
+      if (composer && mentionTrigger && composer.contains(mentionTrigger)) {
+        return;
+      }
+
+      onDismiss();
+    };
+
+    document.addEventListener("pointerdown", handlePointerDown, true);
+    return () =>
+      document.removeEventListener("pointerdown", handlePointerDown, true);
+  }, [onDismiss]);
+
   const handleScroll = React.useCallback(() => {
     const list = listRef.current;
     if (!list || !onFetchMore) return;
@@ -90,144 +154,288 @@ export const MentionAutocomplete = React.memo(function MentionAutocomplete({
         "absolute left-0 right-0 z-50 px-3 sm:px-4",
         position === "below" ? "top-full mt-1" : "bottom-full mb-1",
       )}
+      data-testid="mention-autocomplete-layer"
+      ref={rootRef}
     >
-      <div
-        className={cn(
-          "max-h-48 overflow-y-auto rounded-xl p-1",
-          POPOVER_CUSTOM_ENTER_MOTION_CLASS,
-          position === "below"
-            ? "origin-top slide-in-from-top-1"
-            : "origin-bottom slide-in-from-bottom-1",
-          POPOVER_SURFACE_CLASS,
-        )}
-        data-testid="mention-autocomplete"
-        onScroll={handleScroll}
-        ref={listRef}
-        style={POPOVER_SHADOW_STYLE}
-      >
-        {suggestions.map((suggestion, index) => {
-          const suggestionKey =
-            suggestion.pubkey ??
-            (suggestion.personaId ? `persona-${suggestion.personaId}` : null) ??
-            (suggestion.teamId ? `team-${suggestion.teamId}` : null) ??
-            suggestion.displayName;
-          const hasNameCollision =
-            (nameCounts.get(suggestion.displayName.toLowerCase()) ?? 0) > 1;
-          const agentLabel = mentionAgentLabel(suggestion, hasNameCollision);
-          const collisionNpub =
-            hasNameCollision && suggestion.pubkey
-              ? safeNpub(suggestion.pubkey)
-              : null;
-
-          return (
-            <button
+      <div className="w-full max-w-2xl">
+        {onKeepMentionedAgentsPinnedChange ? (
+          <div className="mb-2 flex justify-end">
+            <div
               className={cn(
-                "flex w-full cursor-pointer items-center gap-2 rounded-lg px-3 py-1.5 text-left text-sm",
-                index === selectedIndex
-                  ? "bg-accent text-accent-foreground"
-                  : "text-popover-foreground hover:bg-accent/50",
+                "max-w-full overflow-hidden rounded-xl text-popover-foreground ring-1 ring-border/50 transition-[width] duration-200 ease-out",
+                POPOVER_SURFACE_CLASS,
+                optionsOpen ? "w-72" : "w-24",
               )}
-              data-testid={`mention-suggestion-${suggestionKey}`}
-              key={suggestionKey}
-              onMouseDown={(event) => {
-                event.preventDefault();
-                onSelect(suggestion);
-              }}
-              tabIndex={-1}
-              type="button"
+              ref={optionsSurfaceRef}
+              style={POPOVER_SHADOW_STYLE}
             >
-              {suggestion.kind === "team" ? (
-                <span className="flex h-6 w-6 shrink-0 items-center justify-center rounded-full bg-primary/10 text-primary">
-                  <Users aria-hidden="true" className="h-4 w-4" />
-                </span>
-              ) : (
-                <UserAvatar
-                  avatarUrl={suggestion.avatarUrl ?? null}
-                  displayName={suggestion.displayName}
-                  size="xs"
-                  testId="mention-suggestion-avatar"
-                />
-              )}
-              <span className="flex min-w-0 flex-1 flex-col gap-0.5">
-                <span
-                  className="min-w-0 break-words font-medium leading-snug"
-                  title={suggestion.displayName}
+              {optionsOpen ? (
+                <motion.div
+                  animate={{ opacity: 1, y: 0 }}
+                  className="w-72"
+                  id={optionsId}
+                  initial={{ opacity: 0, y: 4 }}
+                  transition={{ duration: 0.16, ease: "easeOut" }}
                 >
-                  {suggestion.displayName}
-                </span>
-                {suggestion.kind === "team" ||
-                suggestion.isAgent ||
-                suggestion.role ||
-                suggestion.ownerLabel ||
-                suggestion.notInChannel ? (
-                  <span
-                    className={cn(
-                      "flex min-w-0 items-center gap-1.5 text-2xs leading-none",
-                      index === selectedIndex
-                        ? "text-accent-foreground/60"
-                        : "text-muted-foreground",
-                    )}
-                  >
-                    {suggestion.kind === "team" ? (
-                      <span className="inline-flex shrink-0 items-center gap-1">
-                        <Users aria-hidden="true" className="h-3.5 w-3.5" />
-                        team · {suggestion.teamMembers?.length ?? 0} agents
+                  <div className="flex min-h-12 items-center justify-between gap-3 px-3 py-2">
+                    <label
+                      className="flex min-w-0 flex-col"
+                      htmlFor={keepPinnedSwitchId}
+                    >
+                      <span className="text-sm font-medium">
+                        Automatically mention agents
                       </span>
-                    ) : suggestion.isAgent ? (
-                      <span className="inline-flex shrink-0 items-center gap-1">
-                        <Bot
-                          aria-hidden="true"
-                          className="h-3.5 w-3.5"
-                          data-testid="mention-agent-icon"
-                        />
-                        {agentLabel}
+                      <span className="text-2xs text-muted-foreground">
+                        After you mention them once
                       </span>
-                    ) : suggestion.role ? (
-                      <Badge
-                        className="max-w-24 shrink-0 truncate"
-                        variant="secondary"
-                      >
-                        {suggestion.role}
-                      </Badge>
-                    ) : null}
-                    {suggestion.ownerLabel || suggestion.notInChannel ? (
+                    </label>
+                    <Switch
+                      aria-label="Automatically mention agents"
+                      checked={keepMentionedAgentsPinned}
+                      className="shadow-none [&>span]:shadow-none"
+                      data-testid="mention-keep-agents-pinned-toggle"
+                      id={keepPinnedSwitchId}
+                      onCheckedChange={onKeepMentionedAgentsPinnedChange}
+                      onMouseDown={(event) => event.preventDefault()}
+                    />
+                  </div>
+                  <div className="mx-3 border-t border-border/50" />
+                </motion.div>
+              ) : null}
+              <button
+                aria-controls={optionsId}
+                aria-expanded={optionsOpen}
+                className="flex h-8 w-full items-center justify-between gap-1 px-2.5 text-sm font-medium text-muted-foreground transition-colors hover:bg-accent hover:text-popover-foreground"
+                data-testid="mention-options-trigger"
+                onClick={() => setOptionsOpen((open) => !open)}
+                onMouseDown={(event) => event.preventDefault()}
+                type="button"
+              >
+                <span>Options</span>
+                <motion.span
+                  animate={{ rotate: optionsOpen ? -90 : 0 }}
+                  className="inline-flex"
+                  transition={{ duration: 0.16, ease: "easeOut" }}
+                >
+                  <ChevronRight aria-hidden="true" className="h-3.5 w-3.5" />
+                </motion.span>
+              </button>
+            </div>
+          </div>
+        ) : null}
+        <div
+          className={cn(
+            "max-h-48 w-full overflow-y-auto rounded-xl p-1",
+            POPOVER_CUSTOM_ENTER_MOTION_CLASS,
+            position === "below"
+              ? "origin-top slide-in-from-top-1"
+              : "origin-bottom slide-in-from-bottom-1",
+            POPOVER_SURFACE_CLASS,
+          )}
+          data-testid="mention-autocomplete"
+          onScroll={handleScroll}
+          ref={listRef}
+          style={POPOVER_SHADOW_STYLE}
+        >
+          {suggestions.map((suggestion, index) => {
+            const suggestionKey =
+              suggestion.pubkey ??
+              (suggestion.personaId
+                ? `persona-${suggestion.personaId}`
+                : null) ??
+              (suggestion.teamId ? `team-${suggestion.teamId}` : null) ??
+              suggestion.displayName;
+            const hasNameCollision =
+              (nameCounts.get(suggestion.displayName.toLowerCase()) ?? 0) > 1;
+            const showAgentProvenanceMarker = showMentionAgentProvenanceMarker(
+              suggestion,
+              hasNameCollision,
+            );
+            const ownerLabel =
+              hasNameCollision && suggestion.agentProvenance
+                ? null
+                : suggestion.ownerLabel;
+            const collisionNpub =
+              hasNameCollision && suggestion.pubkey
+                ? safeNpub(suggestion.pubkey)
+                : null;
+            const hasMetadataBeforeNpub = Boolean(
+              suggestion.kind === "team" ||
+                suggestion.isAgent ||
+                suggestion.role ||
+                ownerLabel ||
+                suggestion.notInChannel,
+            );
+            const canAlwaysAddress = Boolean(
+              onToggleAlwaysAddressAgent &&
+                suggestion.isAgent &&
+                suggestion.pubkey,
+            );
+            const isAlwaysAddressed = Boolean(
+              suggestion.pubkey &&
+                lockedAgentPubkeys?.has(suggestion.pubkey.toLowerCase()),
+            );
+
+            return (
+              <div
+                className={cn(
+                  "relative flex w-full items-stretch rounded-lg text-left text-sm",
+                  index === selectedIndex
+                    ? "bg-accent text-accent-foreground"
+                    : "text-popover-foreground hover:bg-accent/50",
+                )}
+                data-testid={`mention-suggestion-${suggestionKey}`}
+                data-mention-suggestion-index={index}
+                key={suggestionKey}
+              >
+                <button
+                  aria-label={`Mention ${suggestion.displayName}`}
+                  className={cn(
+                    "flex min-w-0 flex-1 items-center gap-2 rounded-lg px-3 py-1.5 text-left",
+                    canAlwaysAddress && "pr-11",
+                  )}
+                  onMouseDown={(event) => {
+                    event.preventDefault();
+                    onSelect(suggestion);
+                  }}
+                  tabIndex={-1}
+                  type="button"
+                >
+                  {suggestion.kind === "team" ? (
+                    <span className="flex h-6 w-6 shrink-0 items-center justify-center rounded-full bg-primary/10 text-primary">
+                      <Users aria-hidden="true" className="h-4 w-4" />
+                    </span>
+                  ) : (
+                    <UserAvatar
+                      avatarUrl={suggestion.avatarUrl ?? null}
+                      displayName={suggestion.displayName}
+                      size="xs"
+                      testId="mention-suggestion-avatar"
+                    />
+                  )}
+                  <span className="flex min-w-0 flex-1 flex-col gap-0.5">
+                    <span
+                      className="min-w-0 break-words font-medium leading-snug"
+                      title={suggestion.displayName}
+                    >
+                      {suggestion.displayName}
+                    </span>
+                    {hasMetadataBeforeNpub || collisionNpub ? (
                       <span
-                        className="min-w-0 truncate"
-                        title={
-                          suggestion.ownerLabel && suggestion.notInChannel
-                            ? `managed by ${suggestion.ownerLabel} · not in channel`
-                            : suggestion.ownerLabel
-                              ? `managed by ${suggestion.ownerLabel}`
-                              : "not in channel"
-                        }
+                        className={cn(
+                          "flex min-h-3.5 min-w-0 items-center gap-1.5 text-2xs leading-none",
+                          index === selectedIndex
+                            ? "text-accent-foreground/60"
+                            : "text-muted-foreground",
+                        )}
                       >
-                        {suggestion.ownerLabel && suggestion.notInChannel
-                          ? `managed by ${suggestion.ownerLabel} · not in channel`
-                          : suggestion.ownerLabel
-                            ? `managed by ${suggestion.ownerLabel}`
-                            : "not in channel"}
+                        {suggestion.kind === "team" ? (
+                          <span className="inline-flex shrink-0 items-center gap-1">
+                            <Users aria-hidden="true" className="h-3.5 w-3.5" />
+                            team · {suggestion.teamMembers?.length ?? 0} agents
+                          </span>
+                        ) : suggestion.isAgent ? (
+                          <span className="inline-flex shrink-0 items-center gap-1">
+                            <Bot
+                              aria-hidden="true"
+                              className="h-3.5 w-3.5"
+                              data-testid="mention-agent-icon"
+                            />
+                            agent
+                            {showAgentProvenanceMarker ? (
+                              <OtherSetupAgentMarker testId="mention-agent-provenance" />
+                            ) : null}
+                          </span>
+                        ) : suggestion.role ? (
+                          <Badge
+                            className="max-w-24 shrink-0 truncate"
+                            variant="secondary"
+                          >
+                            {suggestion.role}
+                          </Badge>
+                        ) : null}
+                        {ownerLabel || suggestion.notInChannel ? (
+                          <span
+                            className="min-w-0 truncate"
+                            title={
+                              ownerLabel && suggestion.notInChannel
+                                ? `managed by ${ownerLabel} · not in channel`
+                                : ownerLabel
+                                  ? `managed by ${ownerLabel}`
+                                  : "not in channel"
+                            }
+                          >
+                            {ownerLabel && suggestion.notInChannel
+                              ? `managed by ${ownerLabel} · not in channel`
+                              : ownerLabel
+                                ? `managed by ${ownerLabel}`
+                                : "not in channel"}
+                          </span>
+                        ) : null}
+                        {collisionNpub ? (
+                          <span
+                            className="-translate-y-0.5 shrink-0 font-mono leading-none"
+                            data-testid="mention-collision-npub"
+                            title={collisionNpub}
+                          >
+                            {truncatePubkey(collisionNpub)}
+                          </span>
+                        ) : null}
                       </span>
                     ) : null}
                   </span>
+                </button>
+                {canAlwaysAddress ? (
+                  <Tooltip>
+                    <TooltipTrigger asChild>
+                      <span className="absolute right-3 top-1/2 inline-flex -translate-y-1/2">
+                        <Toggle
+                          aria-label={`${isAlwaysAddressed ? "Stop automatically mentioning" : "Automatically mention"} ${suggestion.displayName}`}
+                          className="h-6 w-6 p-0 data-[state=on]:bg-primary/15 data-[state=on]:text-primary"
+                          data-always-address-pubkey={suggestion.pubkey?.toLowerCase()}
+                          data-testid={`mention-always-address-${suggestion.pubkey}`}
+                          onPressedChange={() =>
+                            onToggleAlwaysAddressAgent?.(suggestion)
+                          }
+                          onClick={(event) => event.stopPropagation()}
+                          onMouseDown={(event) => {
+                            event.preventDefault();
+                            event.stopPropagation();
+                          }}
+                          pressed={isAlwaysAddressed}
+                          size="xs"
+                          type="button"
+                        >
+                          <AtSign aria-hidden="true" className="h-3.5 w-3.5" />
+                        </Toggle>
+                      </span>
+                    </TooltipTrigger>
+                    <TooltipContent
+                      className="flex items-center gap-2"
+                      side="top"
+                    >
+                      <span>
+                        {isAlwaysAddressed
+                          ? "Stop automatically mentioning"
+                          : "Automatically mention"}
+                      </span>
+                      {alwaysAddressShortcut ? (
+                        <kbd className="flex items-center gap-0.5 rounded border border-primary-foreground/20 bg-primary-foreground/10 px-1 py-0 font-mono text-sm text-primary-foreground/70">
+                          {(alwaysAddressShortcut.includes("+")
+                            ? alwaysAddressShortcut.split("+")
+                            : Array.from(alwaysAddressShortcut)
+                          ).map((key) => (
+                            <span key={key}>{key}</span>
+                          ))}
+                        </kbd>
+                      ) : null}
+                    </TooltipContent>
+                  </Tooltip>
                 ) : null}
-                {collisionNpub ? (
-                  <span
-                    className={cn(
-                      "min-w-0 truncate font-mono text-2xs leading-snug",
-                      index === selectedIndex
-                        ? "text-accent-foreground/60"
-                        : "text-muted-foreground",
-                    )}
-                    data-testid="mention-collision-npub"
-                    title={collisionNpub}
-                  >
-                    {truncatePubkey(collisionNpub)}
-                  </span>
-                ) : null}
-              </span>
-            </button>
-          );
-        })}
+              </div>
+            );
+          })}
+        </div>
       </div>
     </div>
   );
diff --git a/desktop/src/features/messages/ui/MessageAgentAddressPrefix.tsx b/desktop/src/features/messages/ui/MessageAgentAddressPrefix.tsx
new file mode 100644
index 00000000000..c43d6fa981e
--- /dev/null
+++ b/desktop/src/features/messages/ui/MessageAgentAddressPrefix.tsx
@@ -0,0 +1,47 @@
+import * as React from "react";
+
+import type { UserProfileLookup } from "@/features/profile/lib/identity";
+import { UserProfilePopover } from "@/features/profile/ui/UserProfilePopover";
+import { truncatePubkey } from "@/shared/lib/pubkey";
+import { InlineChip } from "@/shared/ui/InlineChip";
+
+/** Visible send-state prefix for recipients kept in the composer address tray. */
+export function MessageAgentAddressPrefix({
+  profiles,
+  pubkeys,
+}: {
+  profiles?: UserProfileLookup;
+  pubkeys: readonly string[];
+}) {
+  return (
+    <>
+      {pubkeys.map((pubkey) => {
+        const profile = profiles?.[pubkey];
+        const label =
+          profile?.displayName?.trim() ||
+          profile?.name?.trim() ||
+          truncatePubkey(pubkey);
+        return (
+          <React.Fragment key={pubkey}>
+            {/* biome-ignore lint/a11y/useValidAriaRole: UserProfilePopover uses role for agent classification, not as an ARIA attribute. */}
+            <UserProfilePopover
+              botIdenticonValue={label}
+              pubkey={pubkey}
+              role="bot"
+              triggerElement="span"
+            >
+              <InlineChip
+                className="agent-mention-highlight"
+                data-mention=""
+                icon="agent"
+                interactive
+              >
+                {label}
+              </InlineChip>
+            </UserProfilePopover>{" "}
+          </React.Fragment>
+        );
+      })}
+    </>
+  );
+}
diff --git a/desktop/src/features/messages/ui/MessageComposer.tsx b/desktop/src/features/messages/ui/MessageComposer.tsx
index 31a40c86b67..1adaefd8320 100644
--- a/desktop/src/features/messages/ui/MessageComposer.tsx
+++ b/desktop/src/features/messages/ui/MessageComposer.tsx
@@ -1,13 +1,17 @@
 import * as React from "react";
 import { EditorContent } from "@tiptap/react";
-import { useChannelLinks } from "@/features/messages/lib/useChannelLinks";
+import {
+  useChannelLinks,
+  type ChannelSuggestion,
+} from "@/features/messages/lib/useChannelLinks";
 import { handleAgentSnapshotPaste } from "@/features/messages/lib/agentSnapshotClipboard";
 import { useComposerAutofocus } from "@/features/messages/lib/useComposerAutofocus";
-import type { ChannelSuggestion } from "@/features/messages/lib/useChannelLinks";
 import { useDrafts } from "@/features/messages/lib/useDrafts";
 import { resolveSentDraftKey } from "@/features/messages/ui/draftSubmitKey";
-import { useEmojiAutocomplete } from "@/features/messages/lib/useEmojiAutocomplete";
-import type { EmojiSuggestion } from "@/features/messages/lib/useEmojiAutocomplete";
+import {
+  useEmojiAutocomplete,
+  type EmojiSuggestion,
+} from "@/features/messages/lib/useEmojiAutocomplete";
 import { useCustomEmoji } from "@/features/custom-emoji/hooks";
 import {
   findSpoileredImetaMediaUrls,
@@ -24,7 +28,15 @@ import {
   useBackgroundMediaUpload,
 } from "@/features/messages/lib/backgroundMediaUploadStore";
 import { useMentions } from "@/features/messages/lib/useMentions";
-import { getPersistentAgentAudienceScope } from "@/features/messages/lib/persistentAgentAudience";
+import {
+  getPersistentAgentAudienceRevision,
+  getPersistentAgentAudienceScope,
+  usePersistentAgentAudience,
+} from "@/features/messages/lib/persistentAgentAudience";
+import {
+  setKeepMentionedAgentsPinned,
+  useKeepMentionedAgentsPinned,
+} from "@/features/messages/lib/autoPinMentionedAgentsPreference";
 import { useIdentityQuery } from "@/shared/api/hooks";
 import {
   hasMentionClipboardHtml,
@@ -45,15 +57,16 @@ import { ChannelAutocomplete } from "./ChannelAutocomplete";
 import { ComposerReplyEditBanner } from "./ComposerReplyEditBanner";
 import { ComposerAttachments, DropZoneOverlay } from "./ComposerAttachments";
 import { EmojiAutocomplete } from "./EmojiAutocomplete";
-import {
-  MentionAutocomplete,
-  type MentionSuggestion,
-} from "./MentionAutocomplete";
+import { MentionAutocomplete } from "./MentionAutocomplete";
 import { ComposerDockToolbar } from "./ComposerDockToolbar";
 import { ComposerUploadProgressPill } from "./ComposerUploadProgressPill";
 import { NonMemberMentionDialog } from "./NonMemberMentionDialog";
 import { useMentionSendFlow } from "./useMentionSendFlow";
-import { usePersistentAgentMentionHydration } from "./usePersistentAgentMentionHydration";
+import { useAgentAddressLockPicker } from "./useAgentAddressLockPicker";
+import { useAddressMentionPulse } from "./useAddressMentionPulse";
+import { useAlwaysAddressShortcut } from "./useAlwaysAddressShortcut";
+import { useComposerMentionPicker } from "./useComposerMentionPicker";
+import { useAutoPinMentionedAgents } from "./useAutoPinMentionedAgents";
 import { useComposerContentState } from "./useComposerContentState";
 import { useDraftPersistLifecycle } from "./useDraftPersistSnapshot";
 import { submitMessageEdit } from "./submitMessageEdit";
@@ -109,6 +122,8 @@ function MessageComposerImpl({
   } = useComposerLinkPreviews(previewContent, editTarget == null);
   const [isEmojiPickerOpen, setIsEmojiPickerOpen] = React.useState(false);
   const [isFormattingOpen, setIsFormattingOpen] = React.useState(false);
+  const [mentionOptionsOpenRequest, setMentionOptionsOpenRequest] =
+    React.useState(0);
   const [spoileredAttachmentUrls, setSpoileredAttachmentUrls] = React.useState<
     Set<string>
   >(() => new Set());
@@ -122,13 +137,11 @@ function MessageComposerImpl({
   const identityQuery = useIdentityQuery();
   const effectiveDraftKey = draftKey ?? channelId;
   const ownerPubkey = identityQuery.data?.pubkey ?? null;
-  const audienceThreadRootId = audienceContext?.threadRootId ?? null;
   const audienceScope =
-    audienceThreadRootId && channelId && ownerPubkey
+    audienceContext && channelId && ownerPubkey
       ? getPersistentAgentAudienceScope({
           ownerPubkey,
           channelId,
-          threadRootId: audienceThreadRootId,
         })
       : null;
   const effectiveDraftKeyRef = React.useRef(effectiveDraftKey);
@@ -199,7 +212,6 @@ function MessageComposerImpl({
   const disabledRef = React.useRef(disabled);
   const isSendingRef = React.useRef(isSending);
   const isUploadingRef = React.useRef(media.isUploading);
-  // Sync lock: taken before any async send so rapid Enter can't double-submit.
   const isSubmitLockedRef = React.useRef(false);
   const onSendRef = React.useRef(onSend);
   const onEditSaveRef = React.useRef(onEditSave);
@@ -223,9 +235,6 @@ function MessageComposerImpl({
     emojiAutocomplete.isEmojiAutocompleteOpen;
   const submitMessageRef = React.useRef<() => void>(() => {});
   const composerScrollRef = React.useRef<HTMLDivElement>(null);
-  // Set after `useLinkEditor` exists below; the editor's link-click handler
-  // delegates through this ref to break the hook ordering cycle (the editor
-  // needs `onEditLink`, but the link editor needs the editor's `richText`).
   const onEditLinkRef = React.useRef<
     ((info: LinkSelectionInfo) => void) | null
   >(null);
@@ -256,8 +265,6 @@ function MessageComposerImpl({
     customEmoji,
     onSubmit: () => submitMessageRef.current(),
     onEditLastOwnMessage: () => {
-      // Never re-enter edit from an empty edit (e.g. image-only edit whose
-      // text body is empty) — `editTarget` means we're already editing.
       if (editTargetRef.current) return false;
       const handler = onEditLastOwnMessageRef.current;
       return handler ? handler() : false;
@@ -272,7 +279,6 @@ function MessageComposerImpl({
       mentions.updateMentionQuery(text, cursor);
       channelLinks.updateChannelQuery(text, cursor);
       emojiAutocomplete.updateEmojiQuery(text, cursor);
-      persistentMentionHydrationRef.current?.reconcile(text);
       if (text.trim().length > 0) {
         notifyTyping();
       }
@@ -288,19 +294,17 @@ function MessageComposerImpl({
   onLinkSelectionChangeRef.current = linkEditor.showFromCursor;
   onLinkShortcutRef.current = linkEditor.openFromShortcut;
   useComposerSpoilerParticles(richText.editor, composerScrollRef);
-  const persistentMentionHydration = usePersistentAgentMentionHydration({
+  const persistentAudience = usePersistentAgentAudience(audienceScope);
+  const keepMentionedAgentsPinned = useKeepMentionedAgentsPinned();
+  const addressPulse = useAddressMentionPulse();
+  const openMentionOptionsRef = React.useRef<() => void>(() => {});
+  const addInlineAgentMentionsToAudience = useAutoPinMentionedAgents({
     audienceScope,
-    hydrationKey: effectiveDraftKey,
-    initialAgentPubkeys: audienceContext?.initialAgentPubkeys,
-    isEditing: editTarget != null,
-    mentions,
-    richText,
+    enabled: keepMentionedAgentsPinned,
+    getDisplayName: mentions.getMentionDisplayName,
+    onOpenOptions: () => openMentionOptionsRef.current(),
+    onPulse: addressPulse.pulseOne,
   });
-  const persistentAudience = persistentMentionHydration.audience;
-  const persistentMentionHydrationRef = React.useRef(
-    persistentMentionHydration,
-  );
-  persistentMentionHydrationRef.current = persistentMentionHydration;
   const mentionSendFlow = useMentionSendFlow({
     channelId,
     channelLinks,
@@ -310,6 +314,9 @@ function MessageComposerImpl({
     drafts,
     emojiAutocomplete,
     mentions,
+    onAddressedAgentsSendStarted: addressPulse.pulseMany,
+    onAddressedAgentsSendFailed: addressPulse.shakeMany,
+    onInlineAgentMentionsSent: addInlineAgentMentionsToAudience,
     onPrepareSendChannel,
     onSendRef,
     richText,
@@ -322,18 +329,6 @@ function MessageComposerImpl({
     clearQueuedAttachments: media.clearQueuedAttachments,
     restoreQueuedAttachments: media.restoreQueuedAttachments,
     setSpoileredAttachmentUrls,
-    onSuccessfulExplicitAgentAudience:
-      persistentAudience.enabled && audienceContext && ownerPubkey
-        ? ({ channelId: successfulChannelId, ...promotion }) => {
-            const scope = getPersistentAgentAudienceScope({
-              ownerPubkey,
-              channelId: successfulChannelId,
-              threadRootId: audienceThreadRootId,
-            });
-            persistentAudience.promotePubkeys({ ...promotion, scope });
-          }
-        : undefined,
-    resolvePostSendContent: persistentMentionHydration.resolvePostSendContent,
   });
   React.useEffect(() => {
     onDeferredEditPendingChange?.(isDeferredEditPending);
@@ -349,9 +344,6 @@ function MessageComposerImpl({
         queuedAttachments: [...media.queuedAttachmentsRef.current],
         spoileredAttachmentUrls: new Set(spoileredAttachmentUrls),
       };
-      // Strip the trailing `![image|video](url)` lines that correspond to
-      // imeta attachments — the user manages those via the attachments row,
-      // not via raw markdown in the editor.
       const editableImeta = restoreImetaMediaDisplayLabels(
         editTarget.body,
         editTarget.imetaMedia ?? [],
@@ -359,19 +351,12 @@ function MessageComposerImpl({
       const editableBody = stripImetaMediaLines(editTarget.body, editableImeta);
       setComposerContent(editableBody);
       richText.setContent(editableBody);
-      // Seed pending imeta with removable originals before saving the edit.
-      // New attachments can then be added through the same row.
       mentions.restoreDraftMentionRefs(editTarget.mentionRefs ?? []);
       media.setPendingImeta(editableImeta);
       media.clearQueuedAttachments();
       setSpoileredAttachmentUrls(
         findSpoileredImetaMediaUrls(editTarget.body, editableImeta),
       );
-      // Defer focus to the next frame so it runs after any focus-
-      // restoration the trigger UI (e.g. the message-row context menu)
-      // fires on close. Without this, Radix-style focus-restoration races
-      // our call and leaves DOM focus on the message row — global keybinds
-      // like Delete then fire there instead of in the editor. `focusEnd`
       // also lands the caret at end of the loaded content.
       const rafId = requestAnimationFrame(() => richText.focusEnd());
       return () => cancelAnimationFrame(rafId);
@@ -399,9 +384,7 @@ function MessageComposerImpl({
     if (!replyTarget || composerDisabled) return;
     richText.focusPreserve();
   }, [composerDisabled, replyTarget, richText.focusPreserve]);
-  // ── Autofocus on mount / channel switch ─────────────────────────────
   useComposerAutofocus(richText.focus, effectiveDraftKey, composerDisabled);
-  // ── Mention / channel / emoji autocomplete insertion ────────────────
   // Hooks return a plain-text edit descriptor; `replacePlainTextRange`
   // applies it as a single ProseMirror transaction (no markdown round-trip).
   const applyAutocompleteEdit = React.useCallback(
@@ -415,17 +398,22 @@ function MessageComposerImpl({
     },
     [richText.replacePlainTextRange],
   );
-  const applyMentionInsert = React.useCallback(
-    (suggestion: MentionSuggestion) => {
-      const { cursor } = richText.getPlainTextAndCursor();
-      applyAutocompleteEdit(mentions.insertMention(suggestion, cursor));
-    },
-    [
-      applyAutocompleteEdit,
-      mentions.insertMention,
-      richText.getPlainTextAndCursor,
-    ],
-  );
+  const {
+    announcement: addressLockAnnouncement,
+    lockedAgents,
+    lockedAgentPubkeys,
+    removeAddressedAgent,
+    selectMentionSuggestion,
+    toggleAlwaysAddressAgent,
+  } = useAgentAddressLockPicker({
+    applyAutocompleteEdit,
+    audience: persistentAudience,
+    audienceScope,
+    mentions,
+    onPulseAddressLock: addressPulse.pulseOne,
+    profiles,
+    richText,
+  });
   const applyChannelInsert = React.useCallback(
     (suggestion: ChannelSuggestion) => {
       const { cursor } = richText.getPlainTextAndCursor();
@@ -484,32 +472,26 @@ function MessageComposerImpl({
     },
     [richText.editor, mentions.clearMentions, customEmoji],
   );
-  const openMentionPicker = React.useCallback(() => {
-    if (!richText.editor) return;
-    const { text, cursor } = richText.getPlainTextAndCursor();
-    // Check if there's already an @-query in progress
-    const beforeCursor = text.slice(0, cursor);
-    if (/(?:^|[\s])@[^\s]*$/.test(beforeCursor)) {
-      mentions.updateMentionQuery(text, cursor);
-      richText.focus();
-      return;
-    }
-    // Insert @ at cursor
-    const previousChar = text.slice(0, cursor).slice(-1);
-    const prefix =
-      cursor > 0 && previousChar && !/\s/.test(previousChar) ? " @" : "@";
-    richText.editor.chain().focus().insertContent(prefix).run();
-    setIsEmojiPickerOpen(false);
-    // Trigger mention detection after inserting @
-    const { text: updatedText, cursor: updatedCursor } =
-      richText.getPlainTextAndCursor();
-    mentions.updateMentionQuery(updatedText, updatedCursor);
-  }, [
-    richText.editor,
-    richText.getPlainTextAndCursor,
-    richText.focus,
-    mentions.updateMentionQuery,
-  ]);
+  const openMentionPicker = useComposerMentionPicker({
+    mentions,
+    richText,
+    setIsEmojiPickerOpen,
+  });
+  const openMentionSettings = React.useCallback(
+    () => openMentionPicker(false),
+    [openMentionPicker],
+  );
+  const openMentionOptions = React.useCallback(() => {
+    openMentionSettings();
+    setMentionOptionsOpenRequest((request) => request + 1);
+  }, [openMentionSettings]);
+  openMentionOptionsRef.current = openMentionOptions;
+  const handleAlwaysAddressShortcut = useAlwaysAddressShortcut({
+    enabled: Boolean(audienceScope && editTarget == null),
+    mentions,
+    onOpenPicker: openMentionPicker,
+    onToggle: toggleAlwaysAddressAgent,
+  });
   const submitMessage = React.useCallback(async () => {
     const trimmed = syncComposerContentFromEditor().trim();
     // Edit mode
@@ -580,7 +562,6 @@ function MessageComposerImpl({
     }
     isSubmitLockedRef.current = true;
     onPreparingMentionSendChange?.(true);
-    persistentMentionHydration.beginSubmit();
     try {
       const preparedLinkPreviews = getReadyLinkPreviewTags().some(
         (tag) => tag[1] === "none",
@@ -588,6 +569,10 @@ function MessageComposerImpl({
         ? null
         : prepareBackgroundLinkPreviews(getLiveLinkPreviewCandidates());
       await mentionSendFlow.sendMessageWithMentionFlow({
+        addressedAgentPubkeys: persistentAudience.pubkeys,
+        audienceRevision: audienceScope
+          ? getPersistentAgentAudienceRevision(audienceScope)
+          : 0,
         capturedChannelId: channelId,
         capturedThreadContext,
         pendingImeta: currentPendingImeta,
@@ -601,12 +586,9 @@ function MessageComposerImpl({
         recoveryDraftKey: effectiveDraftKey,
         spoileredAttachmentUrls,
         trimmed,
-        audienceGeneration: persistentAudience.generation,
-        audienceRevision: audienceScope ? persistentAudience.revision : null,
       });
     } finally {
       isSubmitLockedRef.current = false;
-      persistentMentionHydration.endSubmit();
       onPreparingMentionSendChange?.(false);
     }
   }, [
@@ -634,9 +616,7 @@ function MessageComposerImpl({
     onCaptureSendContext,
     onPreparingMentionSendChange,
     audienceScope,
-    persistentMentionHydration,
-    persistentAudience.generation,
-    persistentAudience.revision,
+    persistentAudience.pubkeys,
     isEditSubmissionLocked,
     effectiveDraftKey,
     mentions.getDraftMentionRefs,
@@ -677,6 +657,7 @@ function MessageComposerImpl({
   // handles autocomplete arrow/enter keys and Escape for edit mode.
   const handleEditorKeyDown = React.useCallback(
     (event: React.KeyboardEvent<HTMLDivElement>) => {
+      if (handleAlwaysAddressShortcut(event)) return;
       // Let autocomplete handle keys first
       const emojiResult = emojiAutocomplete.handleEmojiKeyDown(event);
       if (emojiResult.handled) {
@@ -695,7 +676,7 @@ function MessageComposerImpl({
       const { handled, suggestion } = mentions.handleMentionKeyDown(event);
       if (handled) {
         if (suggestion) {
-          applyMentionInsert(suggestion);
+          selectMentionSuggestion(suggestion);
         }
         return;
       }
@@ -719,12 +700,13 @@ function MessageComposerImpl({
       }
     },
     [
+      handleAlwaysAddressShortcut,
       emojiAutocomplete.handleEmojiKeyDown,
       applyEmojiInsert,
       channelLinks.handleChannelKeyDown,
       applyChannelInsert,
       mentions.handleMentionKeyDown,
-      applyMentionInsert,
+      selectMentionSuggestion,
       linkEditor.isCardOpen,
       linkEditor.focusCardFirstControl,
       isDeferredEditPending,
@@ -808,11 +790,9 @@ function MessageComposerImpl({
       media.pendingImeta.length === 0 &&
       media.queuedAttachments.length === 0);
   const handleCaptureSelection = React.useCallback(() => {}, []);
-
   const handlePaperclipClick = React.useCallback(() => {
     void media.handlePaperclip();
   }, [media.handlePaperclip]);
-
   const handleRemoveAttachment = React.useCallback(
     (url: string) => {
       setSpoileredAttachmentUrls((current) => {
@@ -825,14 +805,12 @@ function MessageComposerImpl({
     },
     [media.removeAttachment],
   );
-
   const { handleAttachmentEditSave, handleAttachmentRevert } =
     useAttachmentEditing({
       revertAttachment: media.revertAttachment,
       setSpoileredAttachmentUrls,
       uploadEditedAttachment: media.uploadEditedAttachment,
     });
-
   const handleToggleAttachmentSpoiler = React.useCallback((url: string) => {
     setSpoileredAttachmentUrls((current) => {
       const next = new Set(current);
@@ -844,7 +822,6 @@ function MessageComposerImpl({
       return next;
     });
   }, []);
-
   return (
     <>
       <footer
@@ -920,8 +897,22 @@ function MessageComposerImpl({
               }
             />
             <MentionAutocomplete
+              keepMentionedAgentsPinned={keepMentionedAgentsPinned}
+              lockedAgentPubkeys={lockedAgentPubkeys}
+              onKeepMentionedAgentsPinnedChange={
+                audienceScope && editTarget == null
+                  ? setKeepMentionedAgentsPinned
+                  : undefined
+              }
+              openOptionsRequest={mentionOptionsOpenRequest}
+              onToggleAlwaysAddressAgent={
+                audienceScope && editTarget == null
+                  ? toggleAlwaysAddressAgent
+                  : undefined
+              }
               onFetchMore={mentions.fetchMoreSuggestions}
-              onSelect={applyMentionInsert}
+              onDismiss={mentions.cancelMentionAutocomplete}
+              onSelect={selectMentionSuggestion}
               selectedIndex={mentions.mentionSelectedIndex}
               suggestions={mentions.isMentionOpen ? mentions.suggestions : []}
             />
@@ -937,31 +928,40 @@ function MessageComposerImpl({
                 </button>
               </div>
             ) : null}
-
             {composerLinkPreviews}
+            <output
+              aria-live="polite"
+              className="sr-only"
+              data-testid="composer-address-lock-status"
+            >
+              {addressLockAnnouncement}
+            </output>
             {(media.pendingImeta.length > 0 ||
               media.queuedAttachments.length > 0 ||
               media.isUploading) && (
-              <div className="mb-2 flex items-center gap-2">
-                <ComposerAttachments
-                  attachments={media.pendingImeta}
-                  isUploading={media.isUploading}
-                  onCancelUpload={media.cancelUpload}
-                  onRemoveQueued={media.removeQueuedAttachment}
-                  onToggleQueuedSpoiler={media.toggleQueuedAttachmentSpoiler}
-                  queuedPreviews={media.queuedPreviews}
-                  uploadingCount={media.uploadingCount}
-                  uploadingPreviews={media.uploadingPreviews}
-                  onEditSave={handleAttachmentEditSave}
-                  onRemove={handleRemoveAttachment}
-                  onRevert={handleAttachmentRevert}
-                  originalUrlByUrl={media.originalUrlByUrl}
-                  onToggleSpoiler={handleToggleAttachmentSpoiler}
-                  spoileredUrls={spoileredAttachmentUrls}
-                />
+              <div className="mb-2 flex flex-wrap items-center gap-2">
+                {media.pendingImeta.length > 0 ||
+                media.queuedAttachments.length > 0 ||
+                media.isUploading ? (
+                  <ComposerAttachments
+                    attachments={media.pendingImeta}
+                    isUploading={media.isUploading}
+                    onCancelUpload={media.cancelUpload}
+                    onRemoveQueued={media.removeQueuedAttachment}
+                    onToggleQueuedSpoiler={media.toggleQueuedAttachmentSpoiler}
+                    queuedPreviews={media.queuedPreviews}
+                    uploadingCount={media.uploadingCount}
+                    uploadingPreviews={media.uploadingPreviews}
+                    onEditSave={handleAttachmentEditSave}
+                    onRemove={handleRemoveAttachment}
+                    onRevert={handleAttachmentRevert}
+                    originalUrlByUrl={media.originalUrlByUrl}
+                    onToggleSpoiler={handleToggleAttachmentSpoiler}
+                    spoileredUrls={spoileredAttachmentUrls}
+                  />
+                ) : null}
               </div>
             )}
-
             {/* biome-ignore lint/a11y/noStaticElementInteractions: keydown handler bridges Tiptap editor to autocomplete and submit */}
             <div
               className="rich-text-composer relative max-h-32 overflow-y-auto"
@@ -971,8 +971,8 @@ function MessageComposerImpl({
             >
               <EditorContent editor={richText.editor} />
             </div>
-
             <ComposerDockToolbar
+              addressedAgents={editTarget == null ? lockedAgents : []}
               layoutMode={layoutMode}
               composerDisabled={composerDisabled}
               editor={richText.editor}
@@ -980,27 +980,27 @@ function MessageComposerImpl({
               formattingDisabled={composerDisabled}
               isEmojiPickerOpen={isEmojiPickerOpen}
               isFormattingOpen={isFormattingOpen}
-              isSending={isSending}
+              isSending={isSending || mentionSendFlow.isPreparingMentionSend}
               isUploading={media.isUploading}
               onCaptureSelection={handleCaptureSelection}
               onEmojiPickerOpenChange={setIsEmojiPickerOpen}
               onEmojiSelect={insertEmoji}
               onFormattingToggle={handleFormattingToggle}
               onLinkButton={linkEditor.openFromToolbar}
-              onOpenMentionPicker={openMentionPicker}
+              onOpenMentionPicker={openMentionSettings}
               onPaperclip={handlePaperclipClick}
+              onRemoveAddressedAgent={removeAddressedAgent}
+              pulseVersionByPubkey={addressPulse.pulseVersionByPubkey}
               sendDisabled={sendDisabled}
+              shakeVersionByPubkey={addressPulse.shakeVersionByPubkey}
             />
           </form>
         </div>
       </footer>
-
       <NonMemberMentionDialog {...mentionSendFlow.nonMemberPromptProps} />
-
       {linkEditor.card}
       {linkEditor.dialog}
     </>
   );
 }
-
 export const MessageComposer = React.memo(MessageComposerImpl);
diff --git a/desktop/src/features/messages/ui/MessageComposer.types.ts b/desktop/src/features/messages/ui/MessageComposer.types.ts
index a24be0aeab0..517b9afb00e 100644
--- a/desktop/src/features/messages/ui/MessageComposer.types.ts
+++ b/desktop/src/features/messages/ui/MessageComposer.types.ts
@@ -24,9 +24,7 @@ export type MessageComposerEditTarget = {
 
 export type MessageComposerProps = {
   audienceContext?: {
-    type: "thread";
-    threadRootId: string;
-    initialAgentPubkeys?: readonly string[];
+    type: "channel" | "thread";
   } | null;
   channelId?: string | null;
   channelName: string;
diff --git a/desktop/src/features/messages/ui/MessageComposerToolbar.tsx b/desktop/src/features/messages/ui/MessageComposerToolbar.tsx
index efb0d3b3b99..d4e2284b85f 100644
--- a/desktop/src/features/messages/ui/MessageComposerToolbar.tsx
+++ b/desktop/src/features/messages/ui/MessageComposerToolbar.tsx
@@ -1,10 +1,15 @@
 import * as React from "react";
 import type { Editor } from "@tiptap/react";
 import { AnimatePresence, motion } from "motion/react";
-import { ALargeSmall, ArrowUp, AtSign, Paperclip, X } from "lucide-react";
+import { ALargeSmall, Paperclip, X } from "lucide-react";
 
 import { Button } from "@/shared/ui/button";
 import { Tooltip, TooltipContent, TooltipTrigger } from "@/shared/ui/tooltip";
+import {
+  type ComposerAddressAgent,
+  ComposerMentionButton,
+  ComposerSendButton,
+} from "./ComposerAddressControls";
 import { ComposerEmojiPicker } from "./ComposerEmojiPicker";
 import { FormattingToolbar } from "./FormattingToolbar";
 import { SelectionFormattingTray } from "./SelectionFormattingTray";
@@ -15,9 +20,12 @@ const presenceSpring = {
   stiffness: 400,
   damping: 28,
 } as const;
+const NO_ADDRESSED_AGENTS: readonly ComposerAddressAgent[] = [];
+const ignoreAddressRemoval = () => {};
 
 export const MessageComposerToolbar = React.memo(
   function MessageComposerToolbar({
+    addressedAgents = NO_ADDRESSED_AGENTS,
     composerDisabled,
     editor,
     extraActions,
@@ -33,8 +41,12 @@ export const MessageComposerToolbar = React.memo(
     onLinkButton,
     onOpenMentionPicker,
     onPaperclip,
+    onRemoveAddressedAgent = ignoreAddressRemoval,
+    pulseVersionByPubkey,
     sendDisabled,
+    shakeVersionByPubkey,
   }: {
+    addressedAgents?: readonly ComposerAddressAgent[];
     composerDisabled: boolean;
     editor: Editor | null;
     extraActions?: React.ReactNode;
@@ -50,7 +62,10 @@ export const MessageComposerToolbar = React.memo(
     onLinkButton: () => void;
     onOpenMentionPicker: () => void;
     onPaperclip: () => void;
+    onRemoveAddressedAgent?: (pubkey: string) => void;
+    pulseVersionByPubkey?: Readonly<Record<string, number>>;
     sendDisabled: boolean;
+    shakeVersionByPubkey?: Readonly<Record<string, number>>;
   }) {
     return (
       <div className="mt-2 flex flex-wrap items-center justify-between gap-3">
@@ -158,24 +173,16 @@ export const MessageComposerToolbar = React.memo(
                 exit={{ opacity: 0, x: -12 }}
                 transition={presenceSpring}
               >
-                {/* disableHoverableContent keeps tooltips from lingering over the editor. */}
-                <Tooltip disableHoverableContent>
-                  <TooltipTrigger asChild>
-                    <Button
-                      aria-label="Mention someone"
-                      data-testid="message-insert-mention"
-                      disabled={composerDisabled}
-                      onClick={onOpenMentionPicker}
-                      onMouseDown={onCaptureSelection}
-                      size="icon"
-                      type="button"
-                      variant="ghost"
-                    >
-                      <AtSign />
-                    </Button>
-                  </TooltipTrigger>
-                  <TooltipContent>Mention someone</TooltipContent>
-                </Tooltip>
+                <ComposerMentionButton
+                  agents={addressedAgents}
+                  disabled={composerDisabled}
+                  onCaptureSelection={onCaptureSelection}
+                  onOpen={onOpenMentionPicker}
+                  onRemove={onRemoveAddressedAgent}
+                  pulseVersionByPubkey={pulseVersionByPubkey}
+                  shakeVersionByPubkey={shakeVersionByPubkey}
+                  showAgents
+                />
                 <Tooltip disableHoverableContent>
                   <TooltipTrigger asChild>
                     <Button
@@ -231,23 +238,10 @@ export const MessageComposerToolbar = React.memo(
 
         <div className="flex items-center gap-2">
           {extraActions}
-          <Button
-            aria-label={isSending ? "Sending" : "Send message"}
-            className="rounded-full"
-            data-testid="send-message"
-            disabled={sendDisabled || isSending}
-            size="icon"
-            type="submit"
-          >
-            {isSending ? (
-              <span
-                aria-hidden
-                className="h-4 w-4 animate-spin rounded-full border-2 border-primary-foreground border-t-transparent"
-              />
-            ) : (
-              <ArrowUp aria-hidden />
-            )}
-          </Button>
+          <ComposerSendButton
+            isSending={isSending}
+            sendDisabled={sendDisabled}
+          />
         </div>
       </div>
     );
diff --git a/desktop/src/features/messages/ui/MessageRow.tsx b/desktop/src/features/messages/ui/MessageRow.tsx
index fd5be7d9a86..536631b02d3 100644
--- a/desktop/src/features/messages/ui/MessageRow.tsx
+++ b/desktop/src/features/messages/ui/MessageRow.tsx
@@ -58,6 +58,8 @@ import { MessageTimestamp } from "./MessageTimestamp";
 import { SentFromThreadLine } from "./SentFromThreadLine";
 import { WaveMessageAttachment } from "./WaveMessageAttachment";
 import { Tooltip, TooltipContent, TooltipTrigger } from "@/shared/ui/tooltip";
+import { getAgentAddressMentionPubkeys } from "@/features/messages/lib/agentAddressMention.mjs";
+import { MessageAgentAddressPrefix } from "./MessageAgentAddressPrefix";
 
 const DiffMessage = React.lazy(() => import("./DiffMessage"));
 const DiffMessageExpanded = React.lazy(() => import("./DiffMessageExpanded"));
@@ -277,6 +279,18 @@ export const MessageRow = React.memo(
 
       return Object.keys(values).length > 0 ? values : undefined;
     }, [isKnownAgentPubkey, mentionPubkeysByName]);
+    const addressedAgentPubkeys = React.useMemo(() => {
+      return getAgentAddressMentionPubkeys(message.tags).filter(
+        isKnownAgentPubkey,
+      );
+    }, [isKnownAgentPubkey, message.tags]);
+    const agentAddressPrefix =
+      addressedAgentPubkeys.length > 0 ? (
+        <MessageAgentAddressPrefix
+          profiles={profiles}
+          pubkeys={addressedAgentPubkeys}
+        />
+      ) : undefined;
 
     const imetaByUrl = React.useMemo(
       () => (message.tags ? parseImetaTags(message.tags) : undefined),
@@ -427,6 +441,7 @@ export const MessageRow = React.memo(
               messageId={message.id}
               linkPreviewsSuppressed={linkPreviewsSuppressed}
               linkPreviewTags={message.tags}
+              leadingInlineContent={agentAddressPrefix}
               onRemoveLinkPreviewsForEveryone={removeLinkPreviewsForEveryone}
               customEmoji={customEmoji}
               imetaByUrl={imetaByUrl}
diff --git a/desktop/src/features/messages/ui/MessageThreadPanel.tsx b/desktop/src/features/messages/ui/MessageThreadPanel.tsx
index 517065cc03d..d2650c84ac4 100644
--- a/desktop/src/features/messages/ui/MessageThreadPanel.tsx
+++ b/desktop/src/features/messages/ui/MessageThreadPanel.tsx
@@ -1,11 +1,7 @@
 import * as React from "react";
 import { ArrowDown } from "lucide-react";
 
-import { useKnownAgentPubkeys } from "@/features/agents/useKnownAgentPubkeys";
 import { HuddleTranscriptIntro } from "@/features/huddle/components/HuddleTranscriptIntro";
-import { orderMentionPubkeysByText } from "@/features/messages/lib/orderMentionPubkeys";
-import { normalizePubkey } from "@/shared/lib/pubkey";
-import { resolveMentionProps } from "@/shared/lib/resolveMentionNames";
 import {
   buildThreadSummaryFromVisibleEntries,
   hasNestedThreadBranches,
@@ -534,29 +530,6 @@ export function MessageThreadPanel({
     "padding",
     settleAtBottomAfterLayout,
   );
-  const knownAgentPubkeys = useKnownAgentPubkeys();
-  const initialAgentPubkeys = React.useMemo(() => {
-    if (
-      !threadHead ||
-      !currentPubkey ||
-      normalizePubkey(threadHead.signerPubkey ?? threadHead.pubkey ?? "") !==
-        normalizePubkey(currentPubkey)
-    ) {
-      return [];
-    }
-    const { mentionPubkeysByName } = resolveMentionProps(
-      threadHead.tags,
-      profiles,
-    );
-    if (!mentionPubkeysByName) return [];
-
-    return orderMentionPubkeysByText(
-      threadHead.body,
-      mentionPubkeysByName,
-      (pubkey) =>
-        knownAgentPubkeys.has(pubkey) || profiles?.[pubkey]?.isAgent === true,
-    );
-  }, [currentPubkey, knownAgentPubkeys, profiles, threadHead]);
   const stableSendToChannel = useStableSendToChannel(
     channelId,
     threadHead,
@@ -893,11 +866,7 @@ export function MessageThreadPanel({
           >
             <ComposerDockBackdrop gutterClassName="inset-x-5" />
             <MessageComposer
-              audienceContext={{
-                type: "thread",
-                threadRootId: threadHead.id,
-                initialAgentPubkeys,
-              }}
+              audienceContext={{ type: "thread" }}
               channelId={channelId}
               channelName={channelName}
               channelType={channel?.channelType ?? null}
diff --git a/desktop/src/features/messages/ui/MessageThreadTranscript.tsx b/desktop/src/features/messages/ui/MessageThreadTranscript.tsx
index fceda286578..7460f9aad3c 100644
--- a/desktop/src/features/messages/ui/MessageThreadTranscript.tsx
+++ b/desktop/src/features/messages/ui/MessageThreadTranscript.tsx
@@ -21,6 +21,7 @@ type MessageThreadTranscriptProps = {
     remove: boolean,
   ) => Promise<void>;
   profiles?: UserProfileLookup;
+  renderAfterMessage?: (message: TimelineMessage) => React.ReactNode;
   testId?: string;
 };
 
@@ -36,6 +37,7 @@ export function MessageThreadTranscript({
   messages,
   onToggleReaction,
   profiles,
+  renderAfterMessage,
   testId = "message-thread-transcript",
 }: MessageThreadTranscriptProps) {
   const renderItems = React.useMemo(() => {
@@ -59,16 +61,18 @@ export function MessageThreadTranscript({
       data-testid={testId}
     >
       {renderItems.map(({ isContinuation, message }) => (
-        <MessageThreadRow
-          channelId={channelId}
-          currentPubkey={currentPubkey}
-          isContinuation={isContinuation}
-          key={message.renderKey ?? message.id}
-          message={message}
-          onToggleReaction={onToggleReaction}
-          profiles={profiles}
-          showDepthGuides={false}
-        />
+        <React.Fragment key={message.renderKey ?? message.id}>
+          <MessageThreadRow
+            channelId={channelId}
+            currentPubkey={currentPubkey}
+            isContinuation={isContinuation}
+            message={message}
+            onToggleReaction={onToggleReaction}
+            profiles={profiles}
+            showDepthGuides={false}
+          />
+          {renderAfterMessage?.(message)}
+        </React.Fragment>
       ))}
     </div>
   );
diff --git a/desktop/src/features/messages/ui/composerAgentKeyboard.test.mjs b/desktop/src/features/messages/ui/composerAgentKeyboard.test.mjs
new file mode 100644
index 00000000000..e98763a4a51
--- /dev/null
+++ b/desktop/src/features/messages/ui/composerAgentKeyboard.test.mjs
@@ -0,0 +1,94 @@
+import assert from "node:assert/strict";
+import { after, afterEach, before, test } from "node:test";
+
+import { JSDOM } from "jsdom";
+
+const dom = new JSDOM("<!doctype html><html><body></body></html>", {
+  url: "http://localhost",
+});
+
+before(() => {
+  Object.assign(globalThis, {
+    document: dom.window.document,
+    HTMLElement: dom.window.HTMLElement,
+    IS_REACT_ACT_ENVIRONMENT: true,
+    window: dom.window,
+  });
+});
+
+afterEach(async () => {
+  const { cleanup } = await import("@testing-library/react");
+  cleanup();
+});
+
+after(() => dom.window.close());
+
+test("agent picker preference skips people", async () => {
+  const { act, renderHook } = await import("@testing-library/react");
+  const { useMentionSelection } = await import(
+    "@/features/messages/lib/useMentionSelection"
+  );
+  const view = renderHook(
+    ({ suggestions }) => useMentionSelection(suggestions),
+    { initialProps: { suggestions: [] } },
+  );
+  const suggestions = [
+    { displayName: "Alice", pubkey: "person" },
+    { displayName: "Agent Ada", isAgent: true, pubkey: "agent-a" },
+    { displayName: "Bob", pubkey: "person-b" },
+    { displayName: "Agent Bea", isAgent: true, pubkey: "agent-b" },
+  ];
+
+  act(() => view.result.current.prepareSelectionPreference("first-agent"));
+  view.rerender({ suggestions });
+  assert.equal(view.result.current.mentionSelectedIndex, 1);
+});
+
+test("primary+Shift+Enter opens the picker or toggles in place", async () => {
+  const { act, renderHook } = await import("@testing-library/react");
+  const { useAlwaysAddressShortcut } = await import(
+    "./useAlwaysAddressShortcut.ts"
+  );
+  const { isMacPlatform } = await import("@/shared/lib/platform");
+  const opened = [];
+  const toggled = [];
+  const suggestion = {
+    displayName: "Agent Ada",
+    isAgent: true,
+    pubkey: "agent-a",
+  };
+  const createEvent = () => ({
+    altKey: false,
+    ctrlKey: !isMacPlatform(),
+    key: "Enter",
+    metaKey: isMacPlatform(),
+    preventDefault() {},
+    repeat: false,
+    shiftKey: true,
+  });
+  const view = renderHook(
+    ({ isMentionOpen }) =>
+      useAlwaysAddressShortcut({
+        enabled: true,
+        mentions: {
+          isMentionOpen,
+          mentionSelectedIndex: 0,
+          suggestions: [suggestion],
+        },
+        onOpenPicker: (insertTrigger) => opened.push(insertTrigger),
+        onToggle: (value) => toggled.push(value),
+      }),
+    { initialProps: { isMentionOpen: false } },
+  );
+
+  act(() => assert.equal(view.result.current(createEvent()), true));
+  assert.deepEqual(opened, [false]);
+  assert.deepEqual(toggled, []);
+
+  view.rerender({ isMentionOpen: true });
+  act(() => assert.equal(view.result.current(createEvent()), true));
+  assert.deepEqual(toggled, [suggestion]);
+
+  act(() => assert.equal(view.result.current(createEvent()), true));
+  assert.deepEqual(toggled, [suggestion, suggestion]);
+});
diff --git a/desktop/src/features/messages/ui/persistentAgentAudienceHosts.test.mjs b/desktop/src/features/messages/ui/persistentAgentAudienceHosts.test.mjs
index d6200f253e1..26f666491c8 100644
--- a/desktop/src/features/messages/ui/persistentAgentAudienceHosts.test.mjs
+++ b/desktop/src/features/messages/ui/persistentAgentAudienceHosts.test.mjs
@@ -16,16 +16,12 @@ test("supported conversation hosts opt into explicit audience contexts", async (
     ],
   );
 
-  assert.doesNotMatch(channelPane, /audienceContext=/);
+  assert.match(channelPane, /audienceContext=\{\{ type: "channel" \}\}/);
   assert.doesNotMatch(newMessage, /audienceContext=/);
-  assert.match(
-    threadPanel,
-    /type: "thread"[\s\S]*threadRootId: threadHead\.id/,
-  );
-  assert.match(
-    inboxDetail,
-    /type: "thread"[\s\S]*threadRootId: item\.conversationId/,
-  );
+  assert.match(threadPanel, /audienceContext=\{\{ type: "thread" \}\}/);
+  assert.match(inboxDetail, /type: "thread"/);
+  assert.doesNotMatch(threadPanel, /audienceContext=\{[\s\S]*threadRootId/);
+  assert.doesNotMatch(inboxDetail, /audienceContext=\{[\s\S]*threadRootId/);
 });
 
 test("video review remains explicitly outside persistent audience routing", async () => {
@@ -43,5 +39,5 @@ test("composer never derives audience context from draft keys", async () => {
   const composer = await source("./MessageComposer.tsx");
 
   assert.doesNotMatch(composer, /draftKey\?\.startsWith\("thread:"\)/);
-  assert.match(composer, /audienceContext\?\.threadRootId/);
+  assert.match(composer, /audienceContext && channelId && ownerPubkey/);
 });
diff --git a/desktop/src/features/messages/ui/useAddressMentionPulse.test.mjs b/desktop/src/features/messages/ui/useAddressMentionPulse.test.mjs
new file mode 100644
index 00000000000..e4eea41ef54
--- /dev/null
+++ b/desktop/src/features/messages/ui/useAddressMentionPulse.test.mjs
@@ -0,0 +1,50 @@
+import assert from "node:assert/strict";
+import { after, afterEach, before, test } from "node:test";
+
+import { JSDOM } from "jsdom";
+
+const dom = new JSDOM("<!doctype html><html><body></body></html>", {
+  url: "http://localhost",
+});
+
+before(() => {
+  Object.assign(globalThis, {
+    document: dom.window.document,
+    HTMLElement: dom.window.HTMLElement,
+    IS_REACT_ACT_ENVIRONMENT: true,
+    window: dom.window,
+  });
+});
+
+afterEach(async () => {
+  const { cleanup } = await import("@testing-library/react");
+  cleanup();
+});
+
+after(() => dom.window.close());
+
+test("pulse versions restart per addressed agent", async () => {
+  const { act, renderHook } = await import("@testing-library/react");
+  const { useAddressMentionPulse } = await import(
+    "./useAddressMentionPulse.ts"
+  );
+  const { result } = renderHook(() => useAddressMentionPulse());
+
+  act(() => result.current.pulseMany(["AGENT-A", "agent-a", "agent-b"]));
+  assert.deepEqual(result.current.pulseVersionByPubkey, {
+    "agent-a": 1,
+    "agent-b": 1,
+  });
+
+  act(() => result.current.pulseOne("agent-a"));
+  assert.deepEqual(result.current.pulseVersionByPubkey, {
+    "agent-a": 2,
+    "agent-b": 1,
+  });
+
+  act(() => result.current.shakeMany(["AGENT-A", "agent-a", "agent-b"]));
+  assert.deepEqual(result.current.shakeVersionByPubkey, {
+    "agent-a": 1,
+    "agent-b": 1,
+  });
+});
diff --git a/desktop/src/features/messages/ui/useAddressMentionPulse.ts b/desktop/src/features/messages/ui/useAddressMentionPulse.ts
new file mode 100644
index 00000000000..55c157b979b
--- /dev/null
+++ b/desktop/src/features/messages/ui/useAddressMentionPulse.ts
@@ -0,0 +1,44 @@
+import * as React from "react";
+
+export function useAddressMentionPulse() {
+  const [pulseVersionByPubkey, setPulseVersionByPubkey] = React.useState<
+    Record<string, number>
+  >({});
+  const [shakeVersionByPubkey, setShakeVersionByPubkey] = React.useState<
+    Record<string, number>
+  >({});
+  const pulseMany = React.useCallback((pubkeys: readonly string[]) => {
+    setPulseVersionByPubkey((current) => {
+      const next = { ...current };
+      for (const pubkey of new Set(
+        pubkeys.map((value) => value.toLowerCase()),
+      )) {
+        next[pubkey] = (next[pubkey] ?? 0) + 1;
+      }
+      return next;
+    });
+  }, []);
+  const pulseOne = React.useCallback(
+    (pubkey: string) => pulseMany([pubkey]),
+    [pulseMany],
+  );
+  const shakeMany = React.useCallback((pubkeys: readonly string[]) => {
+    setShakeVersionByPubkey((current) => {
+      const next = { ...current };
+      for (const pubkey of new Set(
+        pubkeys.map((value) => value.toLowerCase()),
+      )) {
+        next[pubkey] = (next[pubkey] ?? 0) + 1;
+      }
+      return next;
+    });
+  }, []);
+
+  return {
+    pulseMany,
+    pulseOne,
+    pulseVersionByPubkey,
+    shakeMany,
+    shakeVersionByPubkey,
+  };
+}
diff --git a/desktop/src/features/messages/ui/useAgentAddressLockPicker.test.mjs b/desktop/src/features/messages/ui/useAgentAddressLockPicker.test.mjs
new file mode 100644
index 00000000000..4acd89cf0a5
--- /dev/null
+++ b/desktop/src/features/messages/ui/useAgentAddressLockPicker.test.mjs
@@ -0,0 +1,406 @@
+import assert from "node:assert/strict";
+import { after, afterEach, before, test } from "node:test";
+
+import { JSDOM } from "jsdom";
+
+const dom = new JSDOM("<!doctype html><html><body></body></html>", {
+  url: "http://localhost",
+});
+
+before(() => {
+  Object.assign(globalThis, {
+    document: dom.window.document,
+    HTMLElement: dom.window.HTMLElement,
+    IS_REACT_ACT_ENVIRONMENT: true,
+    window: dom.window,
+  });
+});
+
+afterEach(async () => {
+  const { cleanup } = await import("@testing-library/react");
+  cleanup();
+});
+
+after(() => dom.window.close());
+
+test("always addressing an agent keeps autocomplete open, adds the lock, and pulses", async () => {
+  const { act, renderHook } = await import("@testing-library/react");
+  const { useAgentAddressLockPicker } = await import(
+    "./useAgentAddressLockPicker.ts"
+  );
+  const appliedEdits = [];
+  const addedPubkeys = [];
+  const pulsedPubkeys = [];
+  let cancelCount = 0;
+  const text = "Ask @Agent Ada later @";
+  const mentions = {
+    cancelMentionAutocomplete: () => {
+      cancelCount += 1;
+    },
+    getDraftMentionRefs: () => [
+      {
+        displayName: "Agent Ada",
+        pubkey: "agent-pubkey",
+        isAgent: true,
+      },
+    ],
+    getMentionDisplayName: () => "Agent Ada",
+    mentionStartIndex: text.lastIndexOf("@"),
+  };
+  const audience = {
+    pubkeys: [],
+    addPubkey: (pubkey) => addedPubkeys.push(pubkey),
+  };
+  const richText = {
+    getPlainTextAndCursor: () => ({ text, cursor: text.length }),
+  };
+  const { result } = renderHook(() =>
+    useAgentAddressLockPicker({
+      applyAutocompleteEdit: (edit) => appliedEdits.push(edit),
+      audience,
+      audienceScope: "channel-scope",
+      mentions,
+      onPulseAddressLock: (pubkey) => pulsedPubkeys.push(pubkey),
+      richText,
+    }),
+  );
+
+  act(() => {
+    result.current.toggleAlwaysAddressAgent({
+      pubkey: "agent-pubkey",
+      displayName: "Agent Ada",
+      isAgent: true,
+    });
+  });
+
+  assert.deepEqual(appliedEdits, []);
+  assert.equal(cancelCount, 0);
+  assert.deepEqual(addedPubkeys, ["agent-pubkey"]);
+  assert.deepEqual(pulsedPubkeys, ["agent-pubkey"]);
+  assert.equal(
+    result.current.announcement,
+    "Automatically mentioning Agent Ada",
+  );
+});
+
+test("toggling an addressed agent keeps autocomplete open and removes the lock", async () => {
+  const { act, renderHook } = await import("@testing-library/react");
+  const { useAgentAddressLockPicker } = await import(
+    "./useAgentAddressLockPicker.ts"
+  );
+  const appliedEdits = [];
+  const removedPubkeys = [];
+  const pulsedPubkeys = [];
+  let cancelCount = 0;
+  const text = "Ask @Agent Ada later @";
+  const mentions = {
+    cancelMentionAutocomplete: () => {
+      cancelCount += 1;
+    },
+    getDraftMentionRefs: () => [
+      {
+        displayName: "Agent Ada",
+        pubkey: "agent-pubkey",
+        isAgent: true,
+      },
+    ],
+    getMentionDisplayName: () => "Agent Ada",
+    mentionStartIndex: text.lastIndexOf("@"),
+  };
+  const audience = {
+    pubkeys: ["agent-pubkey"],
+    addPubkey: () => {
+      throw new Error("an addressed agent must not be added again");
+    },
+    removePubkey: (pubkey) => removedPubkeys.push(pubkey),
+  };
+  const richText = {
+    getPlainTextAndCursor: () => ({ text, cursor: text.length }),
+  };
+  const { result } = renderHook(() =>
+    useAgentAddressLockPicker({
+      applyAutocompleteEdit: (edit) => appliedEdits.push(edit),
+      audience,
+      audienceScope: "channel-scope",
+      mentions,
+      onPulseAddressLock: (pubkey) => pulsedPubkeys.push(pubkey),
+      richText,
+    }),
+  );
+
+  act(() => {
+    result.current.toggleAlwaysAddressAgent({
+      pubkey: "agent-pubkey",
+      displayName: "Agent Ada",
+      isAgent: true,
+    });
+  });
+
+  assert.deepEqual(appliedEdits, []);
+  assert.equal(cancelCount, 0);
+  assert.deepEqual(removedPubkeys, ["agent-pubkey"]);
+  assert.deepEqual(pulsedPubkeys, []);
+  assert.equal(
+    result.current.announcement,
+    "Stopped automatically mentioning Agent Ada",
+  );
+});
+
+test("selecting an already addressed agent from the explicit picker pulses its badge", async () => {
+  const { act, renderHook } = await import("@testing-library/react");
+  const { useAgentAddressLockPicker } = await import(
+    "./useAgentAddressLockPicker.ts"
+  );
+  const appliedEdits = [];
+  const addedPubkeys = [];
+  const pulsedPubkeys = [];
+  const mentions = {
+    cancelMentionAutocomplete: () => {},
+    getDraftMentionRefs: () => [],
+    getMentionDisplayName: () => "Agent Ada",
+    isInlineMentionSelection: () => false,
+    insertMention: () => {
+      throw new Error("an already addressed agent must not be inserted");
+    },
+    mentionStartIndex: 5,
+  };
+  const audience = {
+    pubkeys: ["agent-pubkey"],
+    addPubkey: (pubkey) => addedPubkeys.push(pubkey),
+  };
+  const richText = {
+    getPlainTextAndCursor: () => ({ text: "ping ", cursor: 5 }),
+  };
+  const { result } = renderHook(() =>
+    useAgentAddressLockPicker({
+      applyAutocompleteEdit: (edit) => appliedEdits.push(edit),
+      audience,
+      audienceScope: "channel-scope",
+      mentions,
+      onPulseAddressLock: (pubkey) => pulsedPubkeys.push(pubkey),
+      richText,
+    }),
+  );
+
+  act(() => {
+    result.current.selectMentionSuggestion({
+      pubkey: "AGENT-PUBKEY",
+      displayName: "Agent Ada",
+      isAgent: true,
+    });
+  });
+
+  assert.deepEqual(appliedEdits, []);
+  assert.deepEqual(addedPubkeys, []);
+  assert.deepEqual(pulsedPubkeys, ["agent-pubkey"]);
+});
+
+test("selecting an agent from a typed query leaves the inline mention for send", async () => {
+  const { act, renderHook } = await import("@testing-library/react");
+  const { useAgentAddressLockPicker } = await import(
+    "./useAgentAddressLockPicker.ts"
+  );
+  const appliedEdits = [];
+  const addedPubkeys = [];
+  const pulsedPubkeys = [];
+  const mentions = {
+    cancelMentionAutocomplete: () => {},
+    getDraftMentionRefs: () => [],
+    getMentionDisplayName: () => "Agent Ada",
+    isInlineMentionSelection: () => true,
+    insertMention: () => ({
+      replaceFromOffset: 5,
+      replaceToOffset: 6,
+      insertText: "@Agent Ada ",
+    }),
+    mentionStartIndex: 5,
+  };
+  const audience = {
+    pubkeys: [],
+    addPubkey: (pubkey) => addedPubkeys.push(pubkey),
+  };
+  const richText = {
+    // Selection intent comes from the mention picker, even if focus movement
+    // makes the editor text/cursor insufficient to re-detect the typed query.
+    getPlainTextAndCursor: () => ({ text: "ping ", cursor: 5 }),
+  };
+  const { result } = renderHook(() =>
+    useAgentAddressLockPicker({
+      applyAutocompleteEdit: (edit) => appliedEdits.push(edit),
+      audience,
+      audienceScope: "channel-scope",
+      mentions,
+      onPulseAddressLock: (pubkey) => pulsedPubkeys.push(pubkey),
+      richText,
+    }),
+  );
+
+  act(() => {
+    result.current.selectMentionSuggestion({
+      pubkey: "agent-pubkey",
+      displayName: "Agent Ada",
+      isAgent: true,
+    });
+  });
+
+  assert.deepEqual(appliedEdits, [
+    {
+      replaceFromOffset: 5,
+      replaceToOffset: 6,
+      insertText: "@Agent Ada ",
+    },
+  ]);
+  assert.deepEqual(addedPubkeys, []);
+  assert.deepEqual(pulsedPubkeys, []);
+  assert.equal(result.current.announcement, "");
+});
+
+test("selecting an agent from the explicit picker auto-addresses it", async () => {
+  const { act, renderHook } = await import("@testing-library/react");
+  const { useAgentAddressLockPicker } = await import(
+    "./useAgentAddressLockPicker.ts"
+  );
+  const appliedEdits = [];
+  const addedPubkeys = [];
+  const pulsedPubkeys = [];
+  const mentions = {
+    cancelMentionAutocomplete: () => {},
+    getDraftMentionRefs: () => [],
+    getMentionDisplayName: () => "Agent Ada",
+    isInlineMentionSelection: () => false,
+    insertMention: () => {
+      throw new Error("explicit picker selections must become addressing");
+    },
+    mentionStartIndex: 5,
+  };
+  const audience = {
+    pubkeys: [],
+    addPubkey: (pubkey) => addedPubkeys.push(pubkey),
+  };
+  const richText = {
+    getPlainTextAndCursor: () => ({ text: "ping ", cursor: 5 }),
+  };
+  const { result } = renderHook(() =>
+    useAgentAddressLockPicker({
+      applyAutocompleteEdit: (edit) => appliedEdits.push(edit),
+      audience,
+      audienceScope: "channel-scope",
+      mentions,
+      onPulseAddressLock: (pubkey) => pulsedPubkeys.push(pubkey),
+      richText,
+    }),
+  );
+
+  act(() => {
+    result.current.selectMentionSuggestion({
+      pubkey: "agent-pubkey",
+      displayName: "Agent Ada",
+      isAgent: true,
+    });
+  });
+
+  assert.deepEqual(appliedEdits, []);
+  assert.deepEqual(addedPubkeys, ["agent-pubkey"]);
+  assert.deepEqual(pulsedPubkeys, ["agent-pubkey"]);
+  assert.equal(
+    result.current.announcement,
+    "Automatically mentioning Agent Ada",
+  );
+});
+
+test("selecting an explicitly unpinned agent inserts a mention until send", async () => {
+  const { act, renderHook } = await import("@testing-library/react");
+  const { useAgentAddressLockPicker } = await import(
+    "./useAgentAddressLockPicker.ts"
+  );
+  const appliedEdits = [];
+  const addedPubkeys = [];
+  const removedPubkeys = [];
+  const pulsedPubkeys = [];
+  const mentions = {
+    cancelMentionAutocomplete: () => {},
+    getDraftMentionRefs: () => [],
+    getMentionDisplayName: () => "Agent Ada",
+    isInlineMentionSelection: () => false,
+    insertMention: () => ({
+      replaceFromOffset: 0,
+      replaceToOffset: 0,
+      insertText: "@Agent Ada ",
+    }),
+    mentionStartIndex: 0,
+  };
+  const richText = {
+    getPlainTextAndCursor: () => ({ text: "", cursor: 0 }),
+  };
+  const { result, rerender } = renderHook(
+    ({ pubkeys }) =>
+      useAgentAddressLockPicker({
+        applyAutocompleteEdit: (edit) => appliedEdits.push(edit),
+        audience: {
+          pubkeys,
+          addPubkey: (pubkey) => addedPubkeys.push(pubkey),
+          removePubkey: (pubkey) => removedPubkeys.push(pubkey),
+        },
+        audienceScope: "channel-scope",
+        mentions,
+        onPulseAddressLock: (pubkey) => pulsedPubkeys.push(pubkey),
+        richText,
+      }),
+    { initialProps: { pubkeys: ["agent-pubkey"] } },
+  );
+
+  act(() => result.current.removeAddressedAgent("AGENT-PUBKEY"));
+  rerender({ pubkeys: [] });
+  act(() => {
+    result.current.selectMentionSuggestion({
+      pubkey: "agent-pubkey",
+      displayName: "Agent Ada",
+      isAgent: true,
+    });
+  });
+
+  assert.deepEqual(removedPubkeys, ["agent-pubkey"]);
+  assert.deepEqual(appliedEdits, [
+    {
+      replaceFromOffset: 0,
+      replaceToOffset: 0,
+      insertText: "@Agent Ada ",
+    },
+  ]);
+  assert.deepEqual(addedPubkeys, []);
+  assert.deepEqual(pulsedPubkeys, []);
+});
+
+test("an addressed agent keeps its resolved name while mention state clears during send", async () => {
+  const { renderHook } = await import("@testing-library/react");
+  const { useAgentAddressLockPicker } = await import(
+    "./useAgentAddressLockPicker.ts"
+  );
+  let displayName = "Agent Ada";
+  const mentions = {
+    getMentionDisplayName: () => displayName,
+  };
+  const audience = {
+    pubkeys: ["agent-pubkey"],
+  };
+  const { result, rerender } = renderHook(
+    ({ profiles }) =>
+      useAgentAddressLockPicker({
+        applyAutocompleteEdit: () => {},
+        audience,
+        audienceScope: "channel-scope",
+        mentions,
+        onPulseAddressLock: () => {},
+        profiles,
+        richText: {},
+      }),
+    { initialProps: { profiles: {} } },
+  );
+
+  assert.equal(result.current.lockedAgents[0].displayName, "Agent Ada");
+
+  displayName = null;
+  rerender({ profiles: {} });
+
+  assert.equal(result.current.lockedAgents[0].displayName, "Agent Ada");
+});
diff --git a/desktop/src/features/messages/ui/useAgentAddressLockPicker.ts b/desktop/src/features/messages/ui/useAgentAddressLockPicker.ts
new file mode 100644
index 00000000000..8d5a87b9b8f
--- /dev/null
+++ b/desktop/src/features/messages/ui/useAgentAddressLockPicker.ts
@@ -0,0 +1,248 @@
+import * as React from "react";
+
+import { getMentionOffsets } from "@/features/messages/lib/hasMention";
+import type { usePersistentAgentAudience } from "@/features/messages/lib/persistentAgentAudience";
+import type { UseMentionsResult } from "@/features/messages/lib/useMentions";
+import type {
+  AutocompleteEdit,
+  UseRichTextEditorResult,
+} from "@/features/messages/lib/useRichTextEditor";
+import type { UserProfileLookup } from "@/features/profile/lib/identity";
+import { detectPrefixQuery } from "@/shared/lib/detectPrefixQuery";
+import { normalizePubkey, truncatePubkey } from "@/shared/lib/pubkey";
+import type { ComposerAddressAgent } from "./ComposerAddressControls";
+import type { MentionSuggestion } from "./MentionAutocomplete";
+
+function buildMentionRemovalEdits(
+  text: string,
+  displayNames: readonly string[],
+  queryStart: number,
+  cursor: number,
+): AutocompleteEdit[] {
+  const ranges = displayNames.flatMap((displayName) =>
+    getMentionOffsets(text, displayName).map((start) => {
+      let end = start + `@${displayName}`.length;
+      if (text[end] === " ") end += 1;
+      return { start, end };
+    }),
+  );
+  ranges.push({
+    start: Math.max(0, Math.min(queryStart, text.length)),
+    end: Math.max(0, Math.min(cursor, text.length)),
+  });
+
+  const merged = ranges
+    .filter(({ start, end }) => start < end)
+    .sort((left, right) => left.start - right.start)
+    .reduce<Array<{ start: number; end: number }>>((result, range) => {
+      const previous = result.at(-1);
+      if (previous && range.start <= previous.end) {
+        previous.end = Math.max(previous.end, range.end);
+      } else {
+        result.push({ ...range });
+      }
+      return result;
+    }, []);
+
+  return merged.reverse().map(({ start, end }) => ({
+    replaceFromOffset: start,
+    replaceToOffset: end,
+    insertText: "",
+  }));
+}
+
+export function useAgentAddressLockPicker({
+  applyAutocompleteEdit,
+  audience,
+  audienceScope,
+  mentions,
+  onPulseAddressLock,
+  profiles,
+  richText,
+}: {
+  applyAutocompleteEdit: (edit: AutocompleteEdit) => void;
+  audience: ReturnType<typeof usePersistentAgentAudience>;
+  audienceScope: string | null;
+  mentions: UseMentionsResult;
+  onPulseAddressLock: (pubkey: string) => void;
+  profiles?: UserProfileLookup;
+  richText: UseRichTextEditorResult;
+}) {
+  const lockedAgentPubkeys = React.useMemo(
+    () => new Set(audience.pubkeys),
+    [audience.pubkeys],
+  );
+  const unpinnedAgentPubkeysRef = React.useRef(new Set<string>());
+  const unpinnedAudienceScopeRef = React.useRef(audienceScope);
+  if (unpinnedAudienceScopeRef.current !== audienceScope) {
+    unpinnedAudienceScopeRef.current = audienceScope;
+    unpinnedAgentPubkeysRef.current.clear();
+  }
+  const lockedAgentNamesRef = React.useRef(new Map<string, string>());
+  const [announcement, setAnnouncement] = React.useState("");
+  const lockedAgents = React.useMemo<ComposerAddressAgent[]>(
+    () =>
+      audience.pubkeys.map((pubkey) => {
+        const normalized = normalizePubkey(pubkey);
+        const profile = profiles?.[normalized];
+        const resolvedDisplayName =
+          profile?.displayName?.trim() ||
+          profile?.name?.trim() ||
+          profile?.nip05Handle?.trim() ||
+          mentions.getMentionDisplayName(normalized)?.trim();
+        if (resolvedDisplayName) {
+          lockedAgentNamesRef.current.set(normalized, resolvedDisplayName);
+        }
+        return {
+          pubkey: normalized,
+          displayName:
+            resolvedDisplayName ??
+            lockedAgentNamesRef.current.get(normalized) ??
+            truncatePubkey(normalized),
+          avatarUrl: profile?.avatarUrl ?? null,
+        };
+      }),
+    [audience.pubkeys, mentions.getMentionDisplayName, profiles],
+  );
+  const consumeAddressSuggestion = React.useCallback(
+    (
+      suggestion: MentionSuggestion,
+      { removeInlineMentions }: { removeInlineMentions: boolean },
+    ): string | null => {
+      const pubkey = normalizePubkey(suggestion.pubkey ?? "");
+      if (!audienceScope || !pubkey || !suggestion.isAgent) return null;
+
+      const { text, cursor } = richText.getPlainTextAndCursor();
+      const matchingDisplayNames = removeInlineMentions
+        ? mentions
+            .getDraftMentionRefs(text)
+            .filter((ref) => normalizePubkey(ref.pubkey) === pubkey)
+            .map((ref) => ref.displayName)
+        : [];
+      mentions.cancelMentionAutocomplete();
+      for (const edit of buildMentionRemovalEdits(
+        text,
+        matchingDisplayNames,
+        mentions.mentionStartIndex,
+        cursor,
+      )) {
+        applyAutocompleteEdit(edit);
+      }
+      return pubkey;
+    },
+    [
+      applyAutocompleteEdit,
+      audienceScope,
+      mentions.cancelMentionAutocomplete,
+      mentions.getDraftMentionRefs,
+      mentions.mentionStartIndex,
+      richText.getPlainTextAndCursor,
+    ],
+  );
+  const removeAddressedAgent = React.useCallback(
+    (pubkey: string) => {
+      const normalized = normalizePubkey(pubkey);
+      if (!audienceScope || !normalized) return;
+      unpinnedAgentPubkeysRef.current.add(normalized);
+      audience.removePubkey(normalized);
+    },
+    [audience.removePubkey, audienceScope],
+  );
+  const toggleAlwaysAddressAgent = React.useCallback(
+    (suggestion: MentionSuggestion) => {
+      const pubkey = normalizePubkey(suggestion.pubkey ?? "");
+      if (!audienceScope || !pubkey || !suggestion.isAgent) return;
+
+      if (lockedAgentPubkeys.has(pubkey)) {
+        removeAddressedAgent(pubkey);
+        setAnnouncement(
+          `Stopped automatically mentioning ${suggestion.displayName}`,
+        );
+      } else {
+        unpinnedAgentPubkeysRef.current.delete(pubkey);
+        audience.addPubkey(pubkey);
+        onPulseAddressLock(pubkey);
+        setAnnouncement(`Automatically mentioning ${suggestion.displayName}`);
+      }
+
+      if (mentions.isMentionOpen) {
+        const { text, cursor } = richText.getPlainTextAndCursor();
+        const activeMention = detectPrefixQuery("@", text, cursor, [
+          suggestion.displayName.toLowerCase(),
+        ]);
+        const queryStart = Math.max(
+          0,
+          Math.min(
+            activeMention?.startIndex ?? mentions.mentionStartIndex,
+            text.length,
+          ),
+        );
+        applyAutocompleteEdit({
+          replaceFromOffset: queryStart,
+          replaceToOffset: Math.max(queryStart, Math.min(cursor, text.length)),
+          insertText: "",
+        });
+        mentions.openMentionPicker(queryStart, "preserve");
+      }
+    },
+    [
+      applyAutocompleteEdit,
+      audience.addPubkey,
+      audienceScope,
+      lockedAgentPubkeys,
+      mentions.isMentionOpen,
+      mentions.mentionStartIndex,
+      mentions.openMentionPicker,
+      onPulseAddressLock,
+      removeAddressedAgent,
+      richText.getPlainTextAndCursor,
+    ],
+  );
+
+  const selectMentionSuggestion = React.useCallback(
+    (suggestion: MentionSuggestion) => {
+      const pubkey = normalizePubkey(suggestion.pubkey ?? "");
+      if (suggestion.isAgent && pubkey && audienceScope) {
+        const { cursor } = richText.getPlainTextAndCursor();
+        const wasUnpinned =
+          !lockedAgentPubkeys.has(pubkey) &&
+          unpinnedAgentPubkeysRef.current.has(pubkey);
+        if (mentions.isInlineMentionSelection() || wasUnpinned) {
+          applyAutocompleteEdit(mentions.insertMention(suggestion, cursor));
+          return;
+        }
+
+        consumeAddressSuggestion(suggestion, { removeInlineMentions: false });
+        if (!lockedAgentPubkeys.has(pubkey)) {
+          audience.addPubkey(pubkey);
+          setAnnouncement(`Automatically mentioning ${suggestion.displayName}`);
+        }
+        onPulseAddressLock(pubkey);
+        return;
+      }
+
+      const { cursor } = richText.getPlainTextAndCursor();
+      applyAutocompleteEdit(mentions.insertMention(suggestion, cursor));
+    },
+    [
+      applyAutocompleteEdit,
+      audience.addPubkey,
+      audienceScope,
+      consumeAddressSuggestion,
+      lockedAgentPubkeys,
+      mentions.isInlineMentionSelection,
+      mentions.insertMention,
+      onPulseAddressLock,
+      richText.getPlainTextAndCursor,
+    ],
+  );
+
+  return {
+    announcement,
+    lockedAgents,
+    lockedAgentPubkeys,
+    removeAddressedAgent,
+    selectMentionSuggestion,
+    toggleAlwaysAddressAgent,
+  };
+}
diff --git a/desktop/src/features/messages/ui/useAlwaysAddressShortcut.ts b/desktop/src/features/messages/ui/useAlwaysAddressShortcut.ts
new file mode 100644
index 00000000000..8fd253df222
--- /dev/null
+++ b/desktop/src/features/messages/ui/useAlwaysAddressShortcut.ts
@@ -0,0 +1,52 @@
+import * as React from "react";
+
+import type { UseMentionsResult } from "@/features/messages/lib/useMentions";
+import { hasPrimaryShortcutModifier } from "@/shared/lib/platform";
+import type { MentionSuggestion } from "./MentionAutocomplete";
+
+export function useAlwaysAddressShortcut({
+  enabled,
+  mentions,
+  onOpenPicker,
+  onToggle,
+}: {
+  enabled: boolean;
+  mentions: UseMentionsResult;
+  onOpenPicker: (insertTrigger?: boolean) => void;
+  onToggle: (suggestion: MentionSuggestion) => void;
+}) {
+  const { isMentionOpen, mentionSelectedIndex, suggestions } = mentions;
+  return React.useCallback(
+    (event: React.KeyboardEvent): boolean => {
+      if (
+        !enabled ||
+        event.key !== "Enter" ||
+        !hasPrimaryShortcutModifier(event) ||
+        event.altKey ||
+        !event.shiftKey
+      ) {
+        return false;
+      }
+
+      event.preventDefault();
+      if (event.repeat) return true;
+      if (!isMentionOpen) {
+        onOpenPicker(false);
+        return true;
+      }
+
+      const suggestion = suggestions[mentionSelectedIndex];
+      if (!suggestion?.isAgent || !suggestion.pubkey) return true;
+      onToggle(suggestion);
+      return true;
+    },
+    [
+      enabled,
+      isMentionOpen,
+      mentionSelectedIndex,
+      onOpenPicker,
+      onToggle,
+      suggestions,
+    ],
+  );
+}
diff --git a/desktop/src/features/messages/ui/useAutoPinMentionedAgents.ts b/desktop/src/features/messages/ui/useAutoPinMentionedAgents.ts
new file mode 100644
index 00000000000..44b87c9f1d0
--- /dev/null
+++ b/desktop/src/features/messages/ui/useAutoPinMentionedAgents.ts
@@ -0,0 +1,74 @@
+import * as React from "react";
+import { toast } from "sonner";
+
+import {
+  promotePersistentAgentAudienceIfUnchanged,
+  removePersistentAgentAudienceMembersIfUnchanged,
+} from "@/features/messages/lib/persistentAgentAudience";
+import { normalizePubkey } from "@/shared/lib/pubkey";
+
+type Options = {
+  audienceScope: string | null;
+  enabled: boolean;
+  getDisplayName: (pubkey: string) => string | null | undefined;
+  onOpenOptions: () => void;
+  onPulse: (pubkey: string) => void;
+};
+
+export function useAutoPinMentionedAgents({
+  audienceScope,
+  enabled,
+  getDisplayName,
+  onOpenOptions,
+  onPulse,
+}: Options) {
+  return React.useCallback(
+    ({
+      expectedRevision,
+      pubkeys,
+    }: {
+      expectedRevision: number;
+      pubkeys: readonly string[];
+    }) => {
+      if (!audienceScope || !enabled) return;
+      const normalizedPubkeys = [
+        ...new Set(pubkeys.map(normalizePubkey)),
+      ].filter(Boolean);
+      const promotion = promotePersistentAgentAudienceIfUnchanged({
+        expectedRevision,
+        pubkeys: normalizedPubkeys,
+        scope: audienceScope,
+      });
+      if (promotion === null) return;
+      const { promotedPubkeys, revision } = promotion;
+      for (const pubkey of promotedPubkeys) onPulse(pubkey);
+
+      const displayName =
+        promotedPubkeys.length === 1
+          ? getDisplayName(promotedPubkeys[0])?.trim()
+          : null;
+      const title = displayName
+        ? `${displayName} will be mentioned automatically`
+        : promotedPubkeys.length === 1
+          ? "Agent will be mentioned automatically"
+          : `${promotedPubkeys.length} agents will be mentioned automatically`;
+      toast.success(title, {
+        action: {
+          label: "Undo",
+          onClick: () => {
+            if (
+              removePersistentAgentAudienceMembersIfUnchanged({
+                expectedRevision: revision,
+                pubkeys: promotedPubkeys,
+                scope: audienceScope,
+              })
+            ) {
+              onOpenOptions();
+            }
+          },
+        },
+      });
+    },
+    [audienceScope, enabled, getDisplayName, onOpenOptions, onPulse],
+  );
+}
diff --git a/desktop/src/features/messages/ui/useComposerLinkPreviews.test.mjs b/desktop/src/features/messages/ui/useComposerLinkPreviews.test.mjs
index 049c57f70c4..9236ee3a6fe 100644
--- a/desktop/src/features/messages/ui/useComposerLinkPreviews.test.mjs
+++ b/desktop/src/features/messages/ui/useComposerLinkPreviews.test.mjs
@@ -70,18 +70,18 @@ test("composer input versions retain only active hrefs while re-entry advances",
     nextHrefVersion: 0,
   };
 
-  input = updateComposerLinkPreviewInput(input, `see ${HREF}`);
+  input = updateComposerLinkPreviewInput(input, `see ${HREF}`, null);
   const firstVersion = input.hrefVersions.get(HREF);
   assert.equal(input.hrefVersions.size, 1);
 
-  input = updateComposerLinkPreviewInput(input, `see ${secondHref}`);
+  input = updateComposerLinkPreviewInput(input, `see ${secondHref}`, null);
   assert.deepEqual(
     [...input.hrefVersions.keys()],
     [secondHref],
     "departed href history is pruned instead of retained for the composer lifetime",
   );
 
-  input = updateComposerLinkPreviewInput(input, `see ${HREF}`);
+  input = updateComposerLinkPreviewInput(input, `see ${HREF}`, null);
   assert.deepEqual([...input.hrefVersions.keys()], [HREF]);
   assert.ok(
     input.hrefVersions.get(HREF) > firstVersion,
@@ -159,6 +159,7 @@ test("composer forces a refetch and drops the stale tag on a fast clear+re-paste
         nextHrefVersion: 0,
       },
       `see ${HREF}`,
+      null,
     );
     const { result, rerender, unmount } = renderHook(
       ({ content, hrefVersions }) =>
@@ -183,10 +184,11 @@ test("composer forces a refetch and drops the stale tag on a fast clear+re-paste
     // href set equals the previous commit, but the update-boundary version has
     // advanced because the URL left and re-entered between those updates.
     await act(async () => {
-      previewInput = updateComposerLinkPreviewInput(previewInput, "see ");
+      previewInput = updateComposerLinkPreviewInput(previewInput, "see ", null);
       previewInput = updateComposerLinkPreviewInput(
         previewInput,
         `see ${HREF}`,
+        null,
       );
       rerender(previewInput);
     });
@@ -318,6 +320,7 @@ test("a removed blocked re-entry can later use metadata that resolved while abse
         nextHrefVersion: 0,
       },
       `see ${HREF}`,
+      null,
     );
     const { result, rerender, unmount } = renderHook(
       ({ content, hrefVersions }) =>
@@ -330,10 +333,11 @@ test("a removed blocked re-entry can later use metadata that resolved while abse
 
     // Re-enter the cached negative and wait until its forced refetch is in flight.
     await act(async () => {
-      previewInput = updateComposerLinkPreviewInput(previewInput, "see ");
+      previewInput = updateComposerLinkPreviewInput(previewInput, "see ", null);
       previewInput = updateComposerLinkPreviewInput(
         previewInput,
         `see ${HREF}`,
+        null,
       );
       rerender(previewInput);
     });
@@ -345,7 +349,7 @@ test("a removed blocked re-entry can later use metadata that resolved while abse
     // Remove the blocked href, then let its refetch populate healthy metadata
     // while no candidate is active.
     await act(async () => {
-      previewInput = updateComposerLinkPreviewInput(previewInput, "see ");
+      previewInput = updateComposerLinkPreviewInput(previewInput, "see ", null);
       rerender(previewInput);
     });
     await settle();
@@ -359,6 +363,7 @@ test("a removed blocked re-entry can later use metadata that resolved while abse
       previewInput = updateComposerLinkPreviewInput(
         previewInput,
         `see ${HREF}`,
+        null,
       );
       rerender(previewInput);
     });
@@ -486,6 +491,7 @@ test("a stale in-flight upload cannot publish after the URL re-enters and a fres
         nextHrefVersion: 0,
       },
       `see ${HREF}`,
+      null,
     );
     const { result, rerender, unmount } = renderHook(
       ({ content, hrefVersions }) =>
@@ -510,10 +516,11 @@ test("a stale in-flight upload cannot publish after the URL re-enters and a fres
 
     // 2. Fast gesture: clear then re-paste the SAME URL inside the debounce.
     await act(async () => {
-      previewInput = updateComposerLinkPreviewInput(previewInput, "see ");
+      previewInput = updateComposerLinkPreviewInput(previewInput, "see ", null);
       previewInput = updateComposerLinkPreviewInput(
         previewInput,
         `see ${HREF}`,
+        null,
       );
       rerender(previewInput);
     });
@@ -750,3 +757,105 @@ test("an abandoned concurrent render cannot invalidate the committed snapshot ta
     ipcHandlers.clear();
   }
 });
+
+// ── Composer clone-URL classification ────────────────────────────────────────
+//
+// A same-relay `/git/<owner>/<repo>` clone URL is a Buzz repository entity: the
+// renderer normalizes it onto `buzz://repo` and shows it as an inline chip, not
+// a standalone card. The composer must reach the same verdict from the same
+// active relay origin — without it the URL is classified as an external
+// generic-link, enters snapshot fetching, and shows a card the sent message
+// then contradicts.
+
+const CLONE_OWNER = "a".repeat(64);
+const RELAY_ORIGIN = "https://relay.example.com";
+const CLONE_HREF = `${RELAY_ORIGIN}/git/${CLONE_OWNER}/relay-tools.git`;
+
+test("composer input classifies a same-relay clone URL as a Buzz entity", async () => {
+  const { updateComposerLinkPreviewInput } = await import(
+    "./useComposerLinkPreviews.tsx"
+  );
+  const empty = {
+    content: "",
+    hrefs: new Set(),
+    hrefVersions: new Map(),
+    nextHrefVersion: 0,
+  };
+
+  assert.deepEqual(
+    [
+      ...updateComposerLinkPreviewInput(
+        empty,
+        `clone ${CLONE_HREF}`,
+        RELAY_ORIGIN,
+      ).hrefs,
+    ],
+    [],
+    "a same-relay clone URL is a chip-only entity, never a preview candidate",
+  );
+  // A different origin sharing the path shape stays an ordinary external link.
+  assert.deepEqual(
+    [
+      ...updateComposerLinkPreviewInput(
+        empty,
+        `clone ${CLONE_HREF}`,
+        "https://evil.example.com",
+      ).hrefs,
+    ],
+    [CLONE_HREF],
+  );
+});
+
+test("composer never fetches a snapshot for a same-relay clone URL", async () => {
+  const { act, cleanup, renderHook } = await import("@testing-library/react");
+  const { getCachedRelayOrigin } = await import("@/shared/lib/mediaUrl.ts");
+  const { resetLinkPreviewMetadataCache } = await import(
+    "@/shared/lib/useResolvedLinkPreviews.ts"
+  );
+  const { useComposerLinkPreviews } = await import(
+    "./useComposerLinkPreviews.tsx"
+  );
+
+  resetLinkPreviewMetadataCache();
+  ipcHandlers.clear();
+  ipcHandlers.set("get_relay_http_url", () => Promise.resolve(RELAY_ORIGIN));
+  let fetchCalls = 0;
+  ipcHandlers.set("fetch_link_preview_metadata", () => {
+    fetchCalls += 1;
+    return Promise.resolve(metadata());
+  });
+
+  try {
+    // The origin resolves asynchronously; the classification under test only
+    // exists once it is known, so wait for the shared cache to publish it.
+    const deadline = Date.now() + 5000;
+    while (getCachedRelayOrigin() !== RELAY_ORIGIN && Date.now() < deadline) {
+      await new Promise((resolve) => setTimeout(resolve, 25));
+    }
+    assert.equal(getCachedRelayOrigin(), RELAY_ORIGIN);
+
+    const { result, unmount } = renderHook(() =>
+      useComposerLinkPreviews(`clone ${CLONE_HREF}`),
+    );
+    await act(async () => {
+      await new Promise((resolve) => setTimeout(resolve, DEBOUNCE_WAIT_MS));
+    });
+    await act(async () => {
+      await new Promise((resolve) => setTimeout(resolve, 50));
+    });
+
+    assert.equal(
+      fetchCalls,
+      0,
+      "a Buzz repository entity must not enter external snapshot fetching",
+    );
+    assert.equal(result.current.previewList, null);
+    assert.deepEqual(result.current.getReadyTags(), []);
+    assert.deepEqual(result.current.getLiveCandidates(), []);
+    assert.equal(result.current.hasPendingSnapshots, false);
+    unmount();
+  } finally {
+    cleanup();
+    ipcHandlers.clear();
+  }
+});
diff --git a/desktop/src/features/messages/ui/useComposerLinkPreviews.tsx b/desktop/src/features/messages/ui/useComposerLinkPreviews.tsx
index 3c845d057f7..9795401f78b 100644
--- a/desktop/src/features/messages/ui/useComposerLinkPreviews.tsx
+++ b/desktop/src/features/messages/ui/useComposerLinkPreviews.tsx
@@ -12,6 +12,7 @@ import {
   beginRelayOriginFetch,
   getCachedRelayOrigin,
 } from "@/shared/lib/mediaUrl";
+import { useRelayOrigin } from "@/shared/lib/useRelayOrigin";
 import {
   isBuzzEntityPreview,
   type ResolvedLinkPreview,
@@ -199,9 +200,10 @@ export interface ComposerLinkPreviewInput {
 export function updateComposerLinkPreviewInput(
   current: ComposerLinkPreviewInput,
   content: string,
+  relayOrigin: string | null,
 ): ComposerLinkPreviewInput {
   const nextHrefs = new Set(
-    extractSupportedLinkPreviews(content)
+    extractSupportedLinkPreviews(content, relayOrigin)
       .filter((preview) =>
         preview.href.startsWith("buzz://")
           ? true
@@ -235,11 +237,28 @@ export function useComposerLinkPreviewInput() {
     hrefVersions: new Map(),
     nextHrefVersion: 0,
   }));
+  // Read the origin through the store subscription so a paste that lands
+  // before the async lookup resolves is reclassified — an href set frozen at
+  // first-render time would keep a same-relay clone URL versioned as an
+  // external candidate for the life of the composer.
+  const relayOrigin = useRelayOrigin();
   const update = React.useCallback(
     (content: string) =>
-      setInput((current) => updateComposerLinkPreviewInput(current, content)),
-    [],
+      setInput((current) =>
+        updateComposerLinkPreviewInput(current, content, relayOrigin),
+      ),
+    [relayOrigin],
   );
+  // Re-classify already-entered content when the origin resolves or changes.
+  // An empty draft has nothing to reclassify; returning `current` lets React
+  // bail out of the mount-time pass instead of re-rendering the composer.
+  React.useEffect(() => {
+    setInput((current) =>
+      current.content
+        ? updateComposerLinkPreviewInput(current, current.content, relayOrigin)
+        : current,
+    );
+  }, [relayOrigin]);
   return [input, update] as const;
 }
 
@@ -273,16 +292,17 @@ export function useComposerLinkPreviews(
     );
     return () => window.clearTimeout(timer);
   }, [content]);
+  const relayOrigin = useRelayOrigin();
   const extractCandidates = React.useCallback(
     (source: string) =>
       enabled
-        ? extractSupportedLinkPreviews(source).filter((preview) =>
+        ? extractSupportedLinkPreviews(source, relayOrigin).filter((preview) =>
             preview.href.startsWith("buzz://")
               ? true
               : isValidLinkPreviewSnapshotCanonicalUrl(preview.href),
           )
         : [],
-    [enabled],
+    [enabled, relayOrigin],
   );
   const candidates = React.useMemo(
     () => extractCandidates(debounced),
diff --git a/desktop/src/features/messages/ui/useComposerMentionPicker.ts b/desktop/src/features/messages/ui/useComposerMentionPicker.ts
new file mode 100644
index 00000000000..1a13aa98586
--- /dev/null
+++ b/desktop/src/features/messages/ui/useComposerMentionPicker.ts
@@ -0,0 +1,63 @@
+import * as React from "react";
+
+import type { UseMentionsResult } from "@/features/messages/lib/useMentions";
+import type { UseRichTextEditorResult } from "@/features/messages/lib/useRichTextEditor";
+
+export function useComposerMentionPicker({
+  mentions,
+  richText,
+  setIsEmojiPickerOpen,
+}: {
+  mentions: UseMentionsResult;
+  richText: UseRichTextEditorResult;
+  setIsEmojiPickerOpen: (open: boolean) => void;
+}) {
+  const {
+    cancelMentionAutocomplete,
+    isMentionOpen,
+    openMentionPicker,
+    updateMentionQuery,
+  } = mentions;
+  const { editor, focus, getPlainTextAndCursor } = richText;
+  return React.useCallback(
+    (insertTrigger = true) => {
+      if (!editor) return;
+      const { text, cursor } = getPlainTextAndCursor();
+      if (!insertTrigger) {
+        if (isMentionOpen) {
+          cancelMentionAutocomplete();
+          setIsEmojiPickerOpen(false);
+          focus();
+          return;
+        }
+        openMentionPicker(cursor, "first-agent");
+        setIsEmojiPickerOpen(false);
+        focus();
+        return;
+      }
+      const beforeCursor = text.slice(0, cursor);
+      if (/(?:^|[\s])@[^\s]*$/.test(beforeCursor)) {
+        updateMentionQuery(text, cursor);
+        focus();
+        return;
+      }
+      const previousChar = text.slice(0, cursor).slice(-1);
+      const prefix =
+        cursor > 0 && previousChar && !/\s/.test(previousChar) ? " @" : "@";
+      editor.chain().focus().insertContent(prefix).run();
+      setIsEmojiPickerOpen(false);
+      const updated = getPlainTextAndCursor();
+      updateMentionQuery(updated.text, updated.cursor);
+    },
+    [
+      cancelMentionAutocomplete,
+      editor,
+      focus,
+      getPlainTextAndCursor,
+      isMentionOpen,
+      openMentionPicker,
+      setIsEmojiPickerOpen,
+      updateMentionQuery,
+    ],
+  );
+}
diff --git a/desktop/src/features/messages/ui/useMentionSendFlow.helpers.test.mjs b/desktop/src/features/messages/ui/useMentionSendFlow.helpers.test.mjs
new file mode 100644
index 00000000000..f45f63be27a
--- /dev/null
+++ b/desktop/src/features/messages/ui/useMentionSendFlow.helpers.test.mjs
@@ -0,0 +1,15 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import { mergeMentionRecipients } from "./useMentionSendFlow.helpers.ts";
+
+test("address-locked agents join explicit mentions without duplicating recipients", () => {
+  const explicit = ["A".repeat(64), "b".repeat(64)];
+  const locked = ["a".repeat(64), "C".repeat(64)];
+
+  assert.deepEqual(mergeMentionRecipients(explicit, locked), [
+    "a".repeat(64),
+    "b".repeat(64),
+    "c".repeat(64),
+  ]);
+});
diff --git a/desktop/src/features/messages/ui/useMentionSendFlow.helpers.ts b/desktop/src/features/messages/ui/useMentionSendFlow.helpers.ts
index 4bd87c15d64..8176bb13bbd 100644
--- a/desktop/src/features/messages/ui/useMentionSendFlow.helpers.ts
+++ b/desktop/src/features/messages/ui/useMentionSendFlow.helpers.ts
@@ -12,6 +12,9 @@ import { MENTION_REFERENCE_TAG } from "@/shared/lib/resolveMentionNames";
 export { MENTION_REFERENCE_TAG };
 
 export type PendingNonMemberMentionSend = {
+  addressedAgentPubkeys: string[];
+  audienceRevision: number;
+  inlineAgentMentionPubkeys: string[];
   capturedChannelId: string | null;
   capturedThreadContext: {
     parentEventId: string | null;
@@ -31,12 +34,11 @@ export type PendingNonMemberMentionSend = {
   sentDraftKey: string | null | undefined;
   recoveryDraftKey: string | null | undefined;
   savedMentionRefs: DraftMentionRef[];
-  audienceGeneration: number;
-  audienceRevision: number | null;
-  explicitAgentPubkeys: string[];
 };
 
 export type SendMessageWithMentionFlowInput = {
+  addressedAgentPubkeys?: readonly string[];
+  audienceRevision?: number;
   capturedChannelId: string | null;
   capturedThreadContext?: PendingNonMemberMentionSend["capturedThreadContext"];
   pendingImeta: ImetaMedia[];
@@ -47,8 +49,6 @@ export type SendMessageWithMentionFlowInput = {
   recoveryDraftKey: string | null | undefined;
   spoileredAttachmentUrls?: ReadonlySet<string>;
   trimmed: string;
-  audienceGeneration?: number;
-  audienceRevision?: number | null;
 };
 
 export async function resolvePreviewTags(
@@ -89,6 +89,16 @@ export function uniqueNormalizedPubkeys(pubkeys: Iterable<string>) {
   return [...new Set([...pubkeys].map(normalizePubkey))].filter(Boolean);
 }
 
+export function mergeMentionRecipients(
+  explicitMentionPubkeys: Iterable<string>,
+  addressedAgentPubkeys: Iterable<string>,
+) {
+  return uniqueNormalizedPubkeys([
+    ...explicitMentionPubkeys,
+    ...addressedAgentPubkeys,
+  ]);
+}
+
 export function isManagedAgentRunning(agent: ManagedAgent) {
   return agent.status === "running" || agent.status === "deployed";
 }
diff --git a/desktop/src/features/messages/ui/useMentionSendFlow.ts b/desktop/src/features/messages/ui/useMentionSendFlow.ts
index e322f91987d..601c3b41135 100644
--- a/desktop/src/features/messages/ui/useMentionSendFlow.ts
+++ b/desktop/src/features/messages/ui/useMentionSendFlow.ts
@@ -10,13 +10,10 @@ import {
   useStartManagedAgentMutation,
 } from "@/features/agents/hooks";
 import { resolvePersonaRuntime } from "@/features/agents/lib/resolvePersonaRuntime";
-import {
-  useAddChannelMembersMutation,
-  useCanAddChannelMembers,
-} from "@/features/channels/hooks";
+import { useAddChannelMembersMutation } from "@/features/channels/hooks";
+import { useCanAddChannelMembers } from "@/features/channels/useCanAddChannelMembers";
 import { PRIVATE_CHANNEL_ADD_DENIED_MESSAGE } from "@/features/channels/lib/channelMemberAdmission";
 import { dmThreadAgentMentionError } from "@/features/messages/lib/dmThreadAgentMentionError";
-import { filterEffectiveExplicitAgentPubkeys } from "@/features/messages/lib/effectiveExplicitAgentPubkeys";
 import {
   prepareBackgroundMediaUpload,
   saveQueuedAttachmentsForDraft,
@@ -41,6 +38,7 @@ import {
   getErrorMessage,
   isManagedAgentRunning,
   isProviderBackedAgent,
+  mergeMentionRecipients,
   MENTION_REFERENCE_TAG,
   mergeOutgoingTagsWithReferenceMentions,
   type PendingNonMemberMentionSend,
@@ -48,6 +46,7 @@ import {
   resolvePreviewTags,
   uniqueNormalizedPubkeys,
 } from "./useMentionSendFlow.helpers";
+import { buildAgentAddressMentionTags } from "@/features/messages/lib/agentAddressMention.mjs";
 type UseMentionSendFlowOptions = {
   channelId: string | null;
   channelLinks: Pick<UseChannelLinksResult, "clearChannels">;
@@ -58,6 +57,12 @@ type UseMentionSendFlowOptions = {
   emojiAutocomplete: Pick<UseEmojiAutocompleteResult, "clearEmojis">;
   mentions: UseMentionsResult;
   onPrepareSendChannel?: (pubkeys?: string[]) => Promise<string | null>;
+  onAddressedAgentsSendStarted?: (pubkeys: readonly string[]) => void;
+  onAddressedAgentsSendFailed?: (pubkeys: readonly string[]) => void;
+  onInlineAgentMentionsSent?: (promotion: {
+    expectedRevision: number;
+    pubkeys: readonly string[];
+  }) => void;
   onSendRef: React.MutableRefObject<
     (
       content: string,
@@ -71,10 +76,7 @@ type UseMentionSendFlowOptions = {
       forceRest?: boolean,
     ) => Promise<void>
   >;
-  richText: Pick<
-    UseRichTextEditorResult,
-    "clearContent" | "setContent" | "restorePlainTextAndFocusEnd"
-  >;
+  richText: Pick<UseRichTextEditorResult, "clearContent" | "setContent">;
   setContent: (content: string) => void;
   setIsEmojiPickerOpen: React.Dispatch<React.SetStateAction<boolean>>;
   setPendingImeta: (pendingImeta: ImetaMedia[]) => void;
@@ -84,13 +86,6 @@ type UseMentionSendFlowOptions = {
   setSpoileredAttachmentUrls?: React.Dispatch<
     React.SetStateAction<Set<string>>
   >;
-  onSuccessfulExplicitAgentAudience?: (audience: {
-    channelId: string;
-    expectedGeneration: number;
-    expectedRevision: number | null;
-    explicitAgentPubkeys: string[];
-  }) => void;
-  resolvePostSendContent?: (effectiveExplicitAgentPubkeys: string[]) => string;
 };
 export function useMentionSendFlow({
   channelId,
@@ -102,6 +97,9 @@ export function useMentionSendFlow({
   emojiAutocomplete,
   mentions,
   onPrepareSendChannel,
+  onAddressedAgentsSendStarted,
+  onAddressedAgentsSendFailed,
+  onInlineAgentMentionsSent,
   onSendRef,
   richText,
   setContent,
@@ -111,8 +109,6 @@ export function useMentionSendFlow({
   clearQueuedAttachments,
   restoreQueuedAttachments,
   setSpoileredAttachmentUrls,
-  onSuccessfulExplicitAgentAudience,
-  resolvePostSendContent,
 }: UseMentionSendFlowOptions) {
   const [pendingNonMemberSend, setPendingNonMemberSend] =
     React.useState<PendingNonMemberMentionSend | null>(null);
@@ -319,51 +315,39 @@ export function useMentionSendFlow({
       provisionPersonaAgentMutation,
     ],
   );
-
-  const clearComposer = React.useCallback(
-    (postSendContent = "") => {
-      setPendingNonMemberSend(null);
-      setNonMemberPromptError(null);
-      setContent(postSendContent);
-      contentRef.current = postSendContent;
-      if (postSendContent) {
-        richText.restorePlainTextAndFocusEnd(postSendContent);
-        mentions.cancelMentionAutocomplete();
-      } else richText.clearContent();
-      setPendingImeta([]);
-      clearQueuedAttachments();
-      setSpoileredAttachmentUrls?.(new Set());
-      if (!postSendContent) mentions.clearMentions();
-      channelLinks.clearChannels();
-      emojiAutocomplete.clearEmojis();
-      setIsEmojiPickerOpen(false);
-    },
-    [
-      channelLinks.clearChannels,
-      contentRef,
-      emojiAutocomplete.clearEmojis,
-      mentions.cancelMentionAutocomplete,
-      mentions.clearMentions,
-      richText.clearContent,
-      richText.restorePlainTextAndFocusEnd,
-      setContent,
-      setIsEmojiPickerOpen,
-      setPendingImeta,
-      clearQueuedAttachments,
-      setSpoileredAttachmentUrls,
-    ],
-  );
-
+  const clearComposer = React.useCallback(() => {
+    setPendingNonMemberSend(null);
+    setNonMemberPromptError(null);
+    setContent("");
+    contentRef.current = "";
+    richText.clearContent();
+    setPendingImeta([]);
+    clearQueuedAttachments();
+    setSpoileredAttachmentUrls?.(new Set());
+    mentions.clearMentions();
+    channelLinks.clearChannels();
+    emojiAutocomplete.clearEmojis();
+    setIsEmojiPickerOpen(false);
+  }, [
+    channelLinks.clearChannels,
+    contentRef,
+    emojiAutocomplete.clearEmojis,
+    mentions.clearMentions,
+    richText.clearContent,
+    setContent,
+    setIsEmojiPickerOpen,
+    setPendingImeta,
+    clearQueuedAttachments,
+    setSpoileredAttachmentUrls,
+  ]);
   React.useEffect(() => {
     if (previousChannelIdRef.current === channelId) {
       return;
     }
-
     previousChannelIdRef.current = channelId;
     setPendingNonMemberSend(null);
     setNonMemberPromptError(null);
   }, [channelId]);
-
   const completeSend = React.useCallback(
     async (
       draft: PendingNonMemberMentionSend,
@@ -373,11 +357,9 @@ export function useMentionSendFlow({
       if (isCompleteSendPendingRef.current) {
         return;
       }
-
       const sendSignal = draft.preparedLinkPreviews?.signal;
       const isSendCancelled = () => sendSignal?.aborted === true;
       if (isSendCancelled()) return draft.preparedLinkPreviews?.release();
-
       isCompleteSendPendingRef.current = true;
       setIsCompleteSendPending(true);
       const preparedUpload =
@@ -399,12 +381,84 @@ export function useMentionSendFlow({
           draft.queuedAttachments,
         );
       };
+      const persistCanceledDraft = () => {
+        if (isSendCancelled() || !draft.recoveryDraftKey) return;
+        const existing = drafts.loadDraft(draft.recoveryDraftKey);
+        if (
+          existing &&
+          (existing.content !== draft.savedContent ||
+            existing.channelId !==
+              (draft.capturedChannelId ?? draft.recoveryDraftKey) ||
+            JSON.stringify(existing.pendingImeta) !==
+              JSON.stringify(draft.savedImeta) ||
+            JSON.stringify(existing.spoileredAttachmentUrls) !==
+              JSON.stringify([...draft.savedSpoileredAttachmentUrls]))
+        ) {
+          return;
+        }
+        drafts.persistDraft(
+          draft.recoveryDraftKey,
+          draft.savedContent,
+          draft.capturedChannelId ?? draft.recoveryDraftKey,
+          draft.savedImeta,
+          [...draft.savedSpoileredAttachmentUrls],
+          draft.savedMentionRefs,
+        );
+      };
+      let composerCleared = false;
+      const restoreComposerAfterFailure = () => {
+        if (!composerCleared) return;
+        composerCleared = false;
+        persistCanceledDraft();
+        const canAnimateCurrentComposer =
+          isMountedRef.current &&
+          (draft.capturedChannelId === channelIdRef.current ||
+            channelIdRef.current === null);
+        if (
+          canAnimateCurrentComposer &&
+          draft.addressedAgentPubkeys.length > 0
+        ) {
+          onAddressedAgentsSendFailed?.(draft.addressedAgentPubkeys);
+        }
+        const canRestoreCurrentComposer =
+          canAnimateCurrentComposer &&
+          contentRef.current.trim().length === 0 &&
+          !hasUnsavedMedia();
+        if (!canRestoreCurrentComposer && draft.recoveryDraftKey) {
+          saveQueuedAttachmentsForDraft(
+            draft.recoveryDraftKey,
+            draft.queuedAttachments,
+          );
+        }
+        if (!canRestoreCurrentComposer) {
+          return;
+        }
+        setContent(draft.savedContent);
+        contentRef.current = draft.savedContent;
+        richText.setContent(draft.savedContent);
+        setPendingImeta(draft.savedImeta);
+        restoreQueuedAttachments(draft.queuedAttachments);
+        mentions.restoreDraftMentionRefs(draft.savedMentionRefs);
+        setSpoileredAttachmentUrls?.(
+          new Set(draft.savedSpoileredAttachmentUrls),
+        );
+      };
+      if (
+        draft.capturedChannelId === channelIdRef.current ||
+        channelIdRef.current === null
+      ) {
+        if (draft.addressedAgentPubkeys.length > 0) {
+          onAddressedAgentsSendStarted?.(draft.addressedAgentPubkeys);
+        }
+        clearComposer();
+        composerCleared = true;
+      }
       let uploadStarted = false;
       try {
         const admittedMentionPubkeys = uniqueNormalizedPubkeys(
           await mentions.revalidateMentionPubkeys(mentionPubkeys),
         );
-        if (isSendCancelled()) return;
+        if (isSendCancelled()) return restoreComposerAfterFailure();
         if (!isMountedRef.current) return persistPreflightDraft();
         const admittedMentionPubkeySet = new Set(admittedMentionPubkeys);
         const readyAgentPubkeys = new Set(
@@ -413,7 +467,7 @@ export function useMentionSendFlow({
           ),
         );
         const managedAgentsByPubkey = await getManagedAgentsByPubkey();
-        if (isSendCancelled()) return;
+        if (isSendCancelled()) return restoreComposerAfterFailure();
         if (!isMountedRef.current) {
           persistPreflightDraft();
           return;
@@ -436,16 +490,15 @@ export function useMentionSendFlow({
         let sendChannelId = draft.capturedChannelId;
         if (preparedAgentPubkeys.length > 0 && onPrepareSendChannel) {
           sendChannelId = await onPrepareSendChannel(preparedAgentPubkeys);
-          if (isSendCancelled()) return;
+          if (isSendCancelled()) return restoreComposerAfterFailure();
           if (!sendChannelId) {
-            return;
+            return restoreComposerAfterFailure();
           }
           if (!isMountedRef.current) {
             persistPreflightDraft();
             return;
           }
         }
-
         const agentReadiness = await ensureManagedAgentMentionsReady(
           managedMentionPubkeys.filter(
             (pubkey) => !readyAgentPubkeys.has(normalizePubkey(pubkey)),
@@ -454,7 +507,7 @@ export function useMentionSendFlow({
           onPrepareSendChannel ? preparedAgentPubkeys : [],
           [...managedAgentsByPubkey.values()],
         );
-        if (isSendCancelled()) return;
+        if (isSendCancelled()) return restoreComposerAfterFailure();
         if (!isMountedRef.current) {
           persistPreflightDraft();
           return;
@@ -468,7 +521,7 @@ export function useMentionSendFlow({
                 )}`;
           setNonMemberPromptError(message);
           toast.error(message);
-          return;
+          return restoreComposerAfterFailure();
         }
         if (preparedAgentPubkeys.length > 0 && sendChannelId) {
           try {
@@ -476,76 +529,19 @@ export function useMentionSendFlow({
               channelId: sendChannelId,
               agentPubkeys: preparedAgentPubkeys,
             });
-            if (isSendCancelled()) return;
+            if (isSendCancelled()) return restoreComposerAfterFailure();
           } catch (error) {
-            if (isSendCancelled()) return;
+            if (isSendCancelled()) return restoreComposerAfterFailure();
             const message = `Could not add mentioned agent to the Huddle: ${getErrorMessage(
               error,
               "Huddle enrollment failed.",
             )}`;
             setNonMemberPromptError(message);
             toast.error(message);
-            return;
+            return restoreComposerAfterFailure();
           }
         }
-        const effectiveExplicitAgentPubkeys =
-          filterEffectiveExplicitAgentPubkeys(
-            draft.explicitAgentPubkeys,
-            mentionPubkeys,
-          );
         const send = onSendRef.current;
-        const persistCanceledDraft = () => {
-          if (isSendCancelled() || !draft.recoveryDraftKey) return;
-          const existing = drafts.loadDraft(draft.recoveryDraftKey);
-          if (
-            existing &&
-            (existing.content !== draft.savedContent ||
-              existing.channelId !==
-                (draft.capturedChannelId ?? draft.recoveryDraftKey) ||
-              JSON.stringify(existing.pendingImeta) !==
-                JSON.stringify(draft.savedImeta) ||
-              JSON.stringify(existing.spoileredAttachmentUrls) !==
-                JSON.stringify([...draft.savedSpoileredAttachmentUrls]))
-          ) {
-            return;
-          }
-          drafts.persistDraft(
-            draft.recoveryDraftKey,
-            draft.savedContent,
-            draft.capturedChannelId ?? draft.recoveryDraftKey,
-            draft.savedImeta,
-            [...draft.savedSpoileredAttachmentUrls],
-            draft.savedMentionRefs,
-          );
-        };
-        const restoreComposerAfterFailure = () => {
-          if (isSendCancelled()) return;
-          persistCanceledDraft();
-          const canRestoreCurrentComposer =
-            isMountedRef.current &&
-            (draft.capturedChannelId === channelIdRef.current ||
-              channelIdRef.current === null) &&
-            contentRef.current.trim().length === 0 &&
-            !hasUnsavedMedia();
-          if (!canRestoreCurrentComposer && draft.recoveryDraftKey) {
-            saveQueuedAttachmentsForDraft(
-              draft.recoveryDraftKey,
-              draft.queuedAttachments,
-            );
-          }
-          if (!canRestoreCurrentComposer) {
-            return;
-          }
-          setContent(draft.savedContent);
-          contentRef.current = draft.savedContent;
-          richText.setContent(draft.savedContent);
-          setPendingImeta(draft.savedImeta);
-          restoreQueuedAttachments(draft.queuedAttachments);
-          mentions.restoreDraftMentionRefs(draft.savedMentionRefs);
-          setSpoileredAttachmentUrls?.(
-            new Set(draft.savedSpoileredAttachmentUrls),
-          );
-        };
         const finishSend = async (
           uploaded: ImetaMedia[],
           signal?: AbortSignal,
@@ -572,28 +568,31 @@ export function useMentionSendFlow({
           const revalidatedMentionPubkeys =
             await mentions.revalidateMentionPubkeys(mentionPubkeys);
           if (signal?.aborted || isSendCancelled()) return;
-          const revalidatedExplicitAgentPubkeys =
-            filterEffectiveExplicitAgentPubkeys(
-              draft.explicitAgentPubkeys,
+          const finalTagsWithAgentAddress = [
+            ...finalOutgoingTags,
+            ...buildAgentAddressMentionTags(
+              draft.addressedAgentPubkeys,
               revalidatedMentionPubkeys,
-            );
+            ),
+          ];
           await send(
             finalContent,
             revalidatedMentionPubkeys,
-            finalOutgoingTags,
+            finalTagsWithAgentAddress,
             sendChannelId,
             draft.capturedThreadContext,
             draft.preparedLinkPreviews != null,
           );
           if (signal?.aborted || isSendCancelled()) return;
-          if (revalidatedExplicitAgentPubkeys.length > 0) {
-            onSuccessfulExplicitAgentAudience?.({
-              channelId: sendChannelId ?? draft.capturedChannelId ?? "",
-              expectedGeneration: draft.audienceGeneration,
-              expectedRevision: draft.audienceRevision,
-              explicitAgentPubkeys: revalidatedExplicitAgentPubkeys,
-            });
-          }
+          const sentMentionPubkeys = new Set(
+            revalidatedMentionPubkeys.map(normalizePubkey),
+          );
+          onInlineAgentMentionsSent?.({
+            expectedRevision: draft.audienceRevision,
+            pubkeys: draft.inlineAgentMentionPubkeys.filter((pubkey) =>
+              sentMentionPubkeys.has(normalizePubkey(pubkey)),
+            ),
+          });
           if (draft.sentDraftKey) {
             drafts.markDraftSent(
               draft.sentDraftKey,
@@ -624,18 +623,9 @@ export function useMentionSendFlow({
             },
           });
           if (!uploadStarted) {
-            return;
+            return restoreComposerAfterFailure();
           }
         }
-        if (
-          draft.capturedChannelId === channelIdRef.current ||
-          channelIdRef.current === null
-        ) {
-          clearComposer(
-            resolvePostSendContent?.(effectiveExplicitAgentPubkeys),
-          );
-        }
-
         if (!preparedUpload) {
           try {
             await finishSend([]);
@@ -643,6 +633,9 @@ export function useMentionSendFlow({
             restoreComposerAfterFailure();
           }
         }
+      } catch (error) {
+        restoreComposerAfterFailure();
+        throw error;
       } finally {
         if (draft.preparedLinkPreviews) {
           activePreparedLinkPreviews.delete(draft.preparedLinkPreviews);
@@ -663,10 +656,11 @@ export function useMentionSendFlow({
       getManagedAgentsByPubkey,
       mentions.isAgentPubkey,
       mentions.revalidateMentionPubkeys,
+      onAddressedAgentsSendStarted,
+      onAddressedAgentsSendFailed,
+      onInlineAgentMentionsSent,
       onPrepareSendChannel,
       onSendRef,
-      onSuccessfulExplicitAgentAudience,
-      resolvePostSendContent,
       richText.setContent,
       setContent,
       setPendingImeta,
@@ -679,6 +673,8 @@ export function useMentionSendFlow({
   );
   const sendMessageWithMentionFlow = React.useCallback(
     async ({
+      addressedAgentPubkeys = [],
+      audienceRevision = 0,
       capturedChannelId,
       capturedThreadContext = null,
       pendingImeta,
@@ -689,13 +685,10 @@ export function useMentionSendFlow({
       recoveryDraftKey,
       spoileredAttachmentUrls = new Set(),
       trimmed,
-      audienceGeneration = 0,
-      audienceRevision = null,
     }: SendMessageWithMentionFlowInput) => {
       if (isMentionSendPendingRef.current) {
         return;
       }
-
       isMentionSendPendingRef.current = true;
       setIsMentionSendPending(true);
       const isSendCancelled = () =>
@@ -711,7 +704,11 @@ export function useMentionSendFlow({
           isThreadReply: capturedThreadContext != null,
           channelType,
           extractMentionPersonas: mentions.extractMentionPersonas,
-          extractMentionPubkeys: mentions.extractMentionPubkeys,
+          extractMentionPubkeys: (text) =>
+            mergeMentionRecipients(
+              mentions.extractMentionPubkeys(text),
+              addressedAgentPubkeys,
+            ),
           isAgentPubkey: mentions.isAgentPubkey,
           hasResolvedMembers: mentions.hasResolvedMembers,
           memberPubkeys: mentions.memberPubkeys,
@@ -721,7 +718,6 @@ export function useMentionSendFlow({
           toast.error(dmThreadAgentMentionErrorMessage);
           return;
         }
-
         let effectiveChannelId = capturedChannelId;
         if (!effectiveChannelId && onPrepareSendChannel) {
           effectiveChannelId = await onPrepareSendChannel();
@@ -730,7 +726,6 @@ export function useMentionSendFlow({
             return;
           }
         }
-
         const personaMentionResult = await createMentionedPersonaAgents(
           trimmed,
           effectiveChannelId ?? "",
@@ -747,7 +742,6 @@ export function useMentionSendFlow({
           toast.error(message);
           return;
         }
-
         const createdPersonaAgentPubkeys = personaMentionResult.pubkeys;
         const createdPersonaAgentPubkeySet = new Set(
           createdPersonaAgentPubkeys.map(normalizePubkey),
@@ -756,12 +750,10 @@ export function useMentionSendFlow({
           ...mentions.extractMentionPubkeys(trimmed),
           ...createdPersonaAgentPubkeys,
         ]);
-        const explicitAgentPubkeys = explicitMentionPubkeys.filter(
-          (pubkey) =>
-            mentions.isAgentPubkey(pubkey) ||
-            createdPersonaAgentPubkeySet.has(pubkey),
+        const pubkeys = mergeMentionRecipients(
+          explicitMentionPubkeys,
+          addressedAgentPubkeys,
         );
-        const pubkeys = explicitMentionPubkeys;
         const outgoingTags = [
           ...buildCustomEmojiTags(trimmed, customEmoji),
           ...linkPreviewTags,
@@ -779,7 +771,6 @@ export function useMentionSendFlow({
             !mentions.isManagedAgentPubkey(pubkey) &&
             !createdPersonaAgentPubkeySet.has(normalizePubkey(pubkey)),
         );
-
         if (promptNonMemberPubkeys.length > 0) {
           try {
             const managedAgentsByPubkey = await getManagedAgentsByPubkey();
@@ -789,8 +780,15 @@ export function useMentionSendFlow({
             );
           } catch {}
         }
-
+        const savedMentionRefs = mentions.getDraftMentionRefs(trimmed);
         const pendingDraft: PendingNonMemberMentionSend = {
+          addressedAgentPubkeys: uniqueNormalizedPubkeys(addressedAgentPubkeys),
+          audienceRevision,
+          inlineAgentMentionPubkeys: uniqueNormalizedPubkeys(
+            savedMentionRefs
+              .filter((ref) => ref.isAgent)
+              .map((ref) => ref.pubkey),
+          ),
           capturedChannelId: effectiveChannelId,
           capturedThreadContext,
           trimmed,
@@ -809,18 +807,13 @@ export function useMentionSendFlow({
           savedSpoileredAttachmentUrls: new Set(spoileredAttachmentUrls),
           sentDraftKey,
           recoveryDraftKey,
-          savedMentionRefs: mentions.getDraftMentionRefs(trimmed),
-          audienceGeneration,
-          audienceRevision,
-          explicitAgentPubkeys,
+          savedMentionRefs,
         };
-
         if (promptNonMemberPubkeys.length > 0) {
           setNonMemberPromptError(null);
           setPendingNonMemberSend(pendingDraft);
           return;
         }
-
         sendPromoted = true;
         await completeSend(pendingDraft, pubkeys);
       } finally {
@@ -853,16 +846,13 @@ export function useMentionSendFlow({
   );
   const pendingNonMemberNames = React.useMemo(() => {
     if (!pendingNonMemberSend) return [];
-
     return pendingNonMemberSend.nonMemberPubkeys.map(
       (pubkey) =>
         mentions.getMentionDisplayName(pubkey) ?? truncatePubkey(pubkey),
     );
   }, [mentions.getMentionDisplayName, pendingNonMemberSend]);
-
   const handleSendWithoutInviting = React.useCallback(() => {
     if (!pendingNonMemberSend) return;
-
     const nonMemberPubkeys = new Set(
       pendingNonMemberSend.nonMemberPubkeys.map((pubkey) =>
         normalizePubkey(pubkey),
@@ -911,14 +901,12 @@ export function useMentionSendFlow({
         if (managedAgentsByPubkey.has(pubkey)) {
           continue;
         }
-
         if (mentions.isAgentPubkey(pubkey)) {
           relayAgentPubkeys.push(pubkey);
         } else {
           peoplePubkeys.push(pubkey);
         }
       }
-
       const errors: string[] = [];
       if (peoplePubkeys.length > 0) {
         const result = await addMembersMutation.mutateAsync({
@@ -928,7 +916,6 @@ export function useMentionSendFlow({
         });
         errors.push(...result.errors.map((error) => error.error));
       }
-
       if (relayAgentPubkeys.length > 0) {
         const result = await addMembersMutation.mutateAsync({
           channelId: pendingNonMemberSend.capturedChannelId ?? undefined,
@@ -937,12 +924,10 @@ export function useMentionSendFlow({
         });
         errors.push(...result.errors.map((error) => error.error));
       }
-
       if (errors.length > 0) {
         setNonMemberPromptError(errors.join("; "));
         return;
       }
-
       await completeSend(
         {
           ...pendingNonMemberSend,
@@ -966,7 +951,6 @@ export function useMentionSendFlow({
     mentions.revalidateMentionPubkeys,
     pendingNonMemberSend,
   ]);
-
   const dismissNonMemberPrompt = React.useCallback(() => {
     setPendingNonMemberSend(null);
     setNonMemberPromptError(null);
diff --git a/desktop/src/features/messages/ui/usePersistentAgentMentionHydration.ts b/desktop/src/features/messages/ui/usePersistentAgentMentionHydration.ts
deleted file mode 100644
index d2e0d4390e1..00000000000
--- a/desktop/src/features/messages/ui/usePersistentAgentMentionHydration.ts
+++ /dev/null
@@ -1,175 +0,0 @@
-import * as React from "react";
-
-import { usePersistentAgentAudience } from "@/features/messages/lib/persistentAgentAudience";
-import type { UseMentionsResult } from "@/features/messages/lib/useMentions";
-import type { UseRichTextEditorResult } from "@/features/messages/lib/useRichTextEditor";
-
-export function usePersistentAgentMentionHydration({
-  audienceScope,
-  hydrationKey,
-  initialAgentPubkeys,
-  isEditing,
-  mentions,
-  richText,
-}: {
-  audienceScope: string | null;
-  hydrationKey: string | null | undefined;
-  initialAgentPubkeys?: readonly string[];
-  isEditing: boolean;
-  mentions: UseMentionsResult;
-  richText: UseRichTextEditorResult;
-}) {
-  const audience = usePersistentAgentAudience(audienceScope);
-  const audienceRef = React.useRef(audience);
-  audienceRef.current = audience;
-  const scopeRef = React.useRef(audienceScope);
-  scopeRef.current = audienceScope;
-  const isEditingRef = React.useRef(isEditing);
-  isEditingRef.current = isEditing;
-  React.useEffect(() => {
-    if (!audienceScope || !initialAgentPubkeys) return;
-    audience.initialize(initialAgentPubkeys);
-  }, [audience.initialize, audienceScope, initialAgentPubkeys]);
-  const isRestoringRef = React.useRef(false);
-  const isSubmittingRef = React.useRef(false);
-  const cancelHydrationAutocompleteRef = React.useRef(false);
-  const hydratedRef = React.useRef(false);
-
-  const hydrate = React.useCallback(() => {
-    const capturedScope = audienceScope;
-    if (
-      !audience.enabled ||
-      !capturedScope ||
-      isEditingRef.current ||
-      audience.pubkeys.length === 0
-    ) {
-      hydratedRef.current = true;
-      return;
-    }
-    isRestoringRef.current = true;
-    const current = richText.getPlainTextAndCursor().text;
-    const targets = audience.pubkeys
-      .map((pubkey) => ({
-        pubkey,
-        displayName: mentions.getMentionDisplayName(pubkey),
-      }))
-      .filter((target): target is { pubkey: string; displayName: string } =>
-        Boolean(target.displayName),
-      );
-    for (const target of targets)
-      mentions.registerMentionPubkey(target.displayName, target.pubkey, {
-        isAgent: true,
-      });
-    if (scopeRef.current !== capturedScope) {
-      isRestoringRef.current = false;
-      return;
-    }
-    const present = new Set(mentions.extractMentionPubkeys(current));
-    let prefixLength = 0;
-    for (const target of targets.filter(
-      (candidate) => !present.has(candidate.pubkey),
-    )) {
-      if (scopeRef.current !== capturedScope) break;
-      const edit = mentions.insertResolvedMention({
-        ...target,
-        isAgent: true,
-        replaceFromOffset: prefixLength,
-        replaceToOffset: prefixLength,
-      });
-      cancelHydrationAutocompleteRef.current = true;
-      richText.replacePlainTextRange(
-        edit.replaceFromOffset,
-        edit.replaceToOffset,
-        edit.insertText,
-      );
-      prefixLength += edit.insertText.length;
-    }
-    hydratedRef.current = scopeRef.current === capturedScope;
-    isRestoringRef.current = false;
-    if (cancelHydrationAutocompleteRef.current) {
-      cancelHydrationAutocompleteRef.current = false;
-      // Hydration is a programmatic transition, not an authored query. Cancel
-      // only when its editor updates actually scheduled autocomplete work.
-      mentions.cancelMentionAutocomplete();
-    }
-  }, [audience.enabled, audience.pubkeys, audienceScope, mentions, richText]);
-
-  const reconcile = React.useCallback(
-    (text: string) => {
-      if (
-        !hydratedRef.current ||
-        isRestoringRef.current ||
-        isSubmittingRef.current ||
-        isEditingRef.current
-      )
-        return;
-      const present = new Set(mentions.extractMentionPubkeys(text));
-      for (const pubkey of audienceRef.current.pubkeys) {
-        if (!present.has(pubkey)) audienceRef.current.removePubkey(pubkey);
-      }
-    },
-    [mentions.extractMentionPubkeys],
-  );
-
-  const hydrateRef = React.useRef(hydrate);
-  hydrateRef.current = hydrate;
-  const scheduleHydration = React.useCallback(
-    (cancelAutocomplete = false) =>
-      requestAnimationFrame(() => {
-        hydrateRef.current();
-        if (cancelAutocomplete) mentions.cancelMentionAutocomplete();
-      }),
-    [mentions.cancelMentionAutocomplete],
-  );
-  React.useEffect(() => {
-    void hydrationKey;
-    hydratedRef.current = false;
-    const frame = scheduleHydration();
-    return () => cancelAnimationFrame(frame);
-  }, [hydrationKey, scheduleHydration]);
-
-  const resolvePostSendContent = React.useCallback(
-    (explicitAgentPubkeys: string[]) => {
-      if (!audience.enabled || !audienceScope || isEditingRef.current)
-        return "";
-      const orderedPubkeys = [
-        ...new Set([...explicitAgentPubkeys, ...audience.pubkeys]),
-      ];
-      const targets = orderedPubkeys
-        .map((pubkey) => ({
-          pubkey,
-          displayName: mentions.getMentionDisplayName(pubkey),
-        }))
-        .filter((target): target is { pubkey: string; displayName: string } =>
-          Boolean(target.displayName),
-        );
-      mentions.clearMentions();
-      for (const target of targets) {
-        mentions.registerMentionPubkey(target.displayName, target.pubkey, {
-          isAgent: true,
-        });
-      }
-      isRestoringRef.current = true;
-      hydratedRef.current = true;
-      return (
-        targets.map((target) => `@${target.displayName}`).join(" ") +
-        (targets.length > 0 ? " " : "")
-      );
-    },
-    [audience.enabled, audience.pubkeys, audienceScope, mentions],
-  );
-
-  return {
-    audience,
-    beginSubmit: () => {
-      isSubmittingRef.current = true;
-    },
-    endSubmit: () => {
-      isSubmittingRef.current = false;
-      scheduleHydration(true);
-    },
-    reconcile,
-    resolvePostSendContent,
-    scheduleHydration,
-  };
-}
diff --git a/desktop/src/features/notifications/lib/desktop.ts b/desktop/src/features/notifications/lib/desktop.ts
index 45716de2d94..0844c24de51 100644
--- a/desktop/src/features/notifications/lib/desktop.ts
+++ b/desktop/src/features/notifications/lib/desktop.ts
@@ -210,6 +210,7 @@ export async function listenForDesktopNotificationActions(
 
   let pluginListener: { unregister: () => Promise<void> } | null = null;
   let nativeUnlisten: (() => void) | null = null;
+  let redrainUnlisten: (() => void) | null = null;
 
   if (isTauri()) {
     const usesMacActivationQueue = isMacPlatform();
@@ -279,6 +280,29 @@ export async function listenForDesktopNotificationActions(
         );
       }
     }
+
+    if (usesMacActivationQueue) {
+      // Belt and suspenders for block/buzz#3509: the Rust delegate queues the
+      // target before emitting, so a lost emit strands the activation with
+      // nothing re-draining it. macOS always foregrounds the app on a
+      // notification click, and WebKit delivers the resulting focus and
+      // visibility transitions independently of the Tauri event channel — use
+      // them to re-drain so a queued target is never stranded.
+      const redrain = () => {
+        void dispatchNativeActivations().catch((error) => {
+          console.error(
+            "Failed to drain macOS notification activations on focus",
+            error,
+          );
+        });
+      };
+      window.addEventListener("focus", redrain);
+      document.addEventListener("visibilitychange", redrain);
+      redrainUnlisten = () => {
+        window.removeEventListener("focus", redrain);
+        document.removeEventListener("visibilitychange", redrain);
+      };
+    }
   }
 
   return () => {
@@ -288,6 +312,7 @@ export async function listenForDesktopNotificationActions(
     );
     void pluginListener?.unregister();
     nativeUnlisten?.();
+    redrainUnlisten?.();
   };
 }
 
@@ -335,6 +360,33 @@ export async function requestDockBounce(): Promise<void> {
   }
 }
 
+/**
+ * How long the window-reveal invoke chain may run before callers proceed
+ * without it. macOS already foregrounds the app when a notification is
+ * clicked, so a reveal that never settles must not gate click-through
+ * routing (block/buzz#3509).
+ */
+const REVEAL_WINDOW_TIMEOUT_MS = 1_500;
+
+function resolveWithinTimeout(
+  operation: Promise<void>,
+  timeoutMs: number,
+): Promise<void> {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(resolve, timeoutMs);
+    operation.then(
+      () => {
+        clearTimeout(timer);
+        resolve();
+      },
+      (error) => {
+        clearTimeout(timer);
+        reject(error);
+      },
+    );
+  });
+}
+
 export async function revealDesktopAppWindow(): Promise<void> {
   if (!isTauri()) {
     if (typeof window !== "undefined") {
@@ -345,9 +397,19 @@ export async function revealDesktopAppWindow(): Promise<void> {
 
   try {
     const currentWindow = getCurrentWindow();
-    await currentWindow.unminimize();
-    await currentWindow.show();
-    await currentWindow.setFocus();
+    // The reveal crosses the IPC boundary three times, and the try/catch
+    // only covers rejections — an invoke that never settles (seen while
+    // macOS is simultaneously foregrounding the app from a notification
+    // click) would strand callers that await this helper before navigating.
+    // Resolve after a timeout so navigation always proceeds.
+    await resolveWithinTimeout(
+      (async () => {
+        await currentWindow.unminimize();
+        await currentWindow.show();
+        await currentWindow.setFocus();
+      })(),
+      REVEAL_WINDOW_TIMEOUT_MS,
+    );
   } catch {
     // Best effort only.
   }
diff --git a/desktop/src/features/notifications/lib/desktopActivations.test.mjs b/desktop/src/features/notifications/lib/desktopActivations.test.mjs
new file mode 100644
index 00000000000..880018c415d
--- /dev/null
+++ b/desktop/src/features/notifications/lib/desktopActivations.test.mjs
@@ -0,0 +1,141 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+// revealDesktopAppWindow and listenForDesktopNotificationActions cross the
+// Tauri IPC boundary through window.__TAURI_INTERNALS__ — stub it before the
+// module (and @tauri-apps/api) load. block/buzz#3509: a macOS notification
+// click must always route, even when a window invoke hangs or the Tauri
+// activation emit is lost.
+
+let pendingActivations = [];
+let hangWindowInvokes = false;
+
+const tauriInternals = {
+  invoke(command) {
+    if (command === "take_pending_activations") {
+      const drained = pendingActivations;
+      pendingActivations = [];
+      return Promise.resolve(drained);
+    }
+    if (hangWindowInvokes && command.startsWith("plugin:window|")) {
+      return new Promise(() => {});
+    }
+    if (command === "plugin:event|listen") {
+      return Promise.resolve(1);
+    }
+    return Promise.resolve(undefined);
+  },
+  transformCallback() {
+    return 0;
+  },
+  metadata: { currentWindow: { label: "main" } },
+};
+
+const testWindow = new EventTarget();
+testWindow.__TAURI_INTERNALS__ = tauriInternals;
+testWindow.__TAURI_EVENT_PLUGIN_INTERNALS__ = {
+  unregisterListener() {},
+};
+// The module under test only checks that a Notification API exists and reads
+// its static permission; a plain function stub keeps biome happy.
+function StubNotification() {}
+StubNotification.permission = "granted";
+testWindow.Notification = StubNotification;
+globalThis.window = testWindow;
+globalThis.document = new EventTarget();
+globalThis.isTauri = true;
+Object.defineProperty(globalThis, "navigator", {
+  configurable: true,
+  value: { platform: "MacIntel", userAgent: "buzz-test" },
+});
+
+const { listenForDesktopNotificationActions, revealDesktopAppWindow } =
+  await import("./desktop.ts");
+
+function flushPendingWork() {
+  return new Promise((resolve) => setImmediate(resolve));
+}
+
+test("reveal resolves via timeout when a window invoke hangs", async (t) => {
+  t.mock.timers.enable({ apis: ["setTimeout"] });
+  hangWindowInvokes = true;
+  t.after(() => {
+    hangWindowInvokes = false;
+  });
+
+  let settled = false;
+  const reveal = revealDesktopAppWindow().then(() => {
+    settled = true;
+  });
+
+  await Promise.resolve();
+  await Promise.resolve();
+  assert.equal(settled, false);
+
+  t.mock.timers.tick(1_500);
+  await reveal;
+  assert.equal(settled, true);
+});
+
+test("reveal resolves without the timer when the invoke chain settles", async (t) => {
+  // Mocked timers never fire on their own here, so this await only returns
+  // if the helper resolves through the settled invoke chain.
+  t.mock.timers.enable({ apis: ["setTimeout"] });
+
+  await revealDesktopAppWindow();
+});
+
+test("window focus re-drains activations stranded by a lost emit", async () => {
+  const received = [];
+  const dispose = await listenForDesktopNotificationActions((target) => {
+    received.push(target);
+  });
+
+  // The Tauri emit was lost, but the Rust queue still holds the clicked
+  // target. macOS foregrounds the app anyway; WebKit fires window focus.
+  pendingActivations = [
+    { channelId: "channel-1", eventId: "event-1", kind: 9 },
+  ];
+  window.dispatchEvent(new Event("focus"));
+  await flushPendingWork();
+
+  assert.deepEqual(received, [
+    {
+      channelId: "channel-1",
+      channelName: null,
+      content: undefined,
+      createdAt: null,
+      eventId: "event-1",
+      kind: 9,
+      pubkey: undefined,
+      threadRootId: null,
+    },
+  ]);
+
+  dispose();
+  pendingActivations = [
+    { channelId: "channel-2", eventId: "event-2", kind: 9 },
+  ];
+  window.dispatchEvent(new Event("focus"));
+  await flushPendingWork();
+  assert.equal(received.length, 1, "disposed listener must not re-drain");
+  // Leave the queue empty so the next test's mount-time drain starts clean.
+  pendingActivations = [];
+});
+
+test("visibilitychange re-drains activations stranded by a lost emit", async () => {
+  const received = [];
+  const dispose = await listenForDesktopNotificationActions((target) => {
+    received.push(target);
+  });
+
+  pendingActivations = [
+    { channelId: "channel-3", eventId: "event-3", kind: 9 },
+  ];
+  document.dispatchEvent(new Event("visibilitychange"));
+  await flushPendingWork();
+
+  assert.equal(received.length, 1);
+  assert.equal(received[0].channelId, "channel-3");
+  dispose();
+});
diff --git a/desktop/src/features/notifications/lib/feed.ts b/desktop/src/features/notifications/lib/feed.ts
index f8413c4313c..4c87cb99d4f 100644
--- a/desktop/src/features/notifications/lib/feed.ts
+++ b/desktop/src/features/notifications/lib/feed.ts
@@ -1,8 +1,5 @@
 import type { Channel, FeedItem, HomeFeedResponse } from "@/shared/api/types";
-import {
-  formatNotificationTitle,
-  truncateNotificationBody,
-} from "@/features/notifications/lib/notificationFormat";
+import { formatMessageNotification } from "@/features/notifications/lib/notificationFormat";
 
 export type NotificationChannel = Pick<Channel, "id" | "name" | "channelType">;
 
@@ -31,44 +28,28 @@ export function enrichFeedItemChannel(
   };
 }
 
-export function notificationTitle(item: FeedItem, senderName?: string) {
-  const channelLabel =
-    item.channelType !== "dm" && item.channelName.trim()
-      ? `#${item.channelName.trim()}`
-      : null;
-
-  if (item.channelType === "dm") {
-    return senderName || "Direct message";
-  }
-
-  if (item.category === "mention") {
-    return formatNotificationTitle({
-      prefix: senderName ? `${senderName} mentioned you` : "@Mention",
-      channelLabel,
-    });
-  }
-
-  if (item.kind === 46010) {
-    return formatNotificationTitle({
-      prefix: senderName
-        ? `${senderName} requested approval`
-        : "Approval Requested",
-      channelLabel,
-    });
-  }
+function feedNotificationSource(item: FeedItem) {
+  if (item.channelType === "dm") return "dm" as const;
+  if (item.category === "mention") return "mention" as const;
+  if (item.kind === 46010) return "approval" as const;
+  return "needs_action" as const;
+}
 
-  return formatNotificationTitle({
-    prefix: senderName ? senderName : "Needs Action",
-    channelLabel,
+export function formatFeedNotification(item: FeedItem, senderName?: string) {
+  return formatMessageNotification({
+    source: feedNotificationSource(item),
+    senderName,
+    channelName: item.channelType !== "dm" ? item.channelName : null,
+    content: item.content,
   });
 }
 
+export function notificationTitle(item: FeedItem, senderName?: string) {
+  return formatFeedNotification(item, senderName).title;
+}
+
 export function notificationBody(item: FeedItem) {
-  const fallback =
-    item.kind === 46010
-      ? "A workflow is waiting for your approval."
-      : "Something in Buzz needs your attention.";
-  return truncateNotificationBody(item.content, fallback);
+  return formatFeedNotification(item).body;
 }
 
 export function collectHomeAlertItems(feed: HomeFeedResponse) {
diff --git a/desktop/src/features/notifications/lib/notificationFormat.test.mjs b/desktop/src/features/notifications/lib/notificationFormat.test.mjs
new file mode 100644
index 00000000000..162cb6a439e
--- /dev/null
+++ b/desktop/src/features/notifications/lib/notificationFormat.test.mjs
@@ -0,0 +1,163 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import { formatMessageNotification } from "./notificationFormat.ts";
+import { senderNameFromSummary } from "./senderName.ts";
+
+test("DM title is the sender name when resolved", () => {
+  const { title, body } = formatMessageNotification({
+    source: "dm",
+    senderName: "Taylor",
+    channelName: "taylor-wes",
+    content: "hey there",
+  });
+
+  assert.equal(title, "Taylor");
+  assert.equal(body, "hey there");
+});
+
+test("DM title falls back to the channel name, then generic copy", () => {
+  assert.equal(
+    formatMessageNotification({
+      source: "dm",
+      senderName: null,
+      channelName: "taylor-wes",
+      content: "hi",
+    }).title,
+    "taylor-wes",
+  );
+  assert.equal(
+    formatMessageNotification({
+      source: "dm",
+      senderName: "  ",
+      channelName: "",
+      content: "hi",
+    }).title,
+    "Direct message",
+  );
+});
+
+test("DM body falls back when the message is blank", () => {
+  assert.equal(
+    formatMessageNotification({
+      source: "dm",
+      senderName: "Taylor",
+      channelName: null,
+      content: "   ",
+    }).body,
+    "New message",
+  );
+});
+
+test("thread reply leads with the sender when resolved", () => {
+  assert.equal(
+    formatMessageNotification({
+      source: "thread_reply",
+      senderName: "Taylor",
+      channelName: "ship-room",
+      content: "done!",
+    }).title,
+    "Taylor replied in #ship-room",
+  );
+});
+
+test("thread reply preserves legacy copy when the sender is unknown", () => {
+  assert.equal(
+    formatMessageNotification({
+      source: "thread_reply",
+      senderName: null,
+      channelName: "ship-room",
+      content: "done!",
+    }).title,
+    "Reply in #ship-room",
+  );
+  assert.deepEqual(
+    formatMessageNotification({
+      source: "thread_reply",
+      senderName: null,
+      channelName: null,
+      content: "",
+    }),
+    { title: "Reply", body: "New reply" },
+  );
+});
+
+test("mention titles match the home-feed conventions", () => {
+  assert.equal(
+    formatMessageNotification({
+      source: "mention",
+      senderName: "Taylor",
+      channelName: "ship-room",
+      content: "@wes look",
+    }).title,
+    "Taylor mentioned you in #ship-room",
+  );
+  assert.equal(
+    formatMessageNotification({
+      source: "mention",
+      senderName: null,
+      channelName: "ship-room",
+      content: "@wes look",
+    }).title,
+    "@Mention in #ship-room",
+  );
+});
+
+test("approval and needs-action titles match the home-feed conventions", () => {
+  assert.deepEqual(
+    formatMessageNotification({
+      source: "approval",
+      senderName: "Taylor",
+      channelName: "ops",
+      content: "",
+    }),
+    {
+      title: "Taylor requested approval in #ops",
+      body: "A workflow is waiting for your approval.",
+    },
+  );
+  assert.deepEqual(
+    formatMessageNotification({
+      source: "needs_action",
+      senderName: null,
+      channelName: null,
+      content: "",
+    }),
+    {
+      title: "Needs Action",
+      body: "Something in Buzz needs your attention.",
+    },
+  );
+});
+
+test("senderNameFromSummary prefers displayName, then NIP-05, never a pubkey", () => {
+  assert.equal(
+    senderNameFromSummary({
+      displayName: "Taylor",
+      avatarUrl: null,
+      nip05Handle: "taylor@buzz.example",
+      ownerPubkey: null,
+    }),
+    "Taylor",
+  );
+  assert.equal(
+    senderNameFromSummary({
+      displayName: "  ",
+      avatarUrl: null,
+      nip05Handle: "taylor@buzz.example",
+      ownerPubkey: null,
+    }),
+    "taylor@buzz.example",
+  );
+  assert.equal(
+    senderNameFromSummary({
+      displayName: null,
+      avatarUrl: null,
+      nip05Handle: null,
+      ownerPubkey: null,
+    }),
+    null,
+  );
+  assert.equal(senderNameFromSummary(null), null);
+  assert.equal(senderNameFromSummary(undefined), null);
+});
diff --git a/desktop/src/features/notifications/lib/notificationFormat.ts b/desktop/src/features/notifications/lib/notificationFormat.ts
index c25270123ae..04c951c33fc 100644
--- a/desktop/src/features/notifications/lib/notificationFormat.ts
+++ b/desktop/src/features/notifications/lib/notificationFormat.ts
@@ -47,3 +47,66 @@ export function formatNotificationTitle(opts: {
     ? `${opts.prefix} in ${opts.channelLabel}`
     : opts.prefix;
 }
+
+export type MessageNotificationSource =
+  | "mention"
+  | "approval"
+  | "needs_action"
+  | "dm"
+  | "thread_reply";
+
+const MESSAGE_BODY_FALLBACKS: Record<MessageNotificationSource, string> = {
+  mention: "Something in Buzz needs your attention.",
+  approval: "A workflow is waiting for your approval.",
+  needs_action: "Something in Buzz needs your attention.",
+  dm: "New message",
+  thread_reply: "New reply",
+};
+
+/**
+ * Canonical copy for every message-shaped desktop notification (home-feed
+ * mentions and needs-action items, live DMs, live thread replies). All paths
+ * format through here so sender attribution and fallbacks stay consistent:
+ * the sender leads the title whenever their profile has resolved, and each
+ * source degrades to neutral copy — never a raw pubkey — when it has not.
+ *
+ * `senderName` must already be a real human label (see
+ * `senderNameFromSummary`); `channelName` is the raw channel name without
+ * a `#` prefix.
+ */
+export function formatMessageNotification(opts: {
+  source: MessageNotificationSource;
+  senderName?: string | null;
+  channelName?: string | null;
+  content: string;
+}): { title: string; body: string } {
+  const { source, content } = opts;
+  const senderName = opts.senderName?.trim() || null;
+  const channelName = opts.channelName?.trim() || null;
+  const body = truncateNotificationBody(
+    content,
+    MESSAGE_BODY_FALLBACKS[source],
+  );
+
+  if (source === "dm") {
+    return { title: senderName ?? channelName ?? "Direct message", body };
+  }
+
+  const channelLabel = channelName ? `#${channelName}` : null;
+  const prefix =
+    source === "mention"
+      ? senderName
+        ? `${senderName} mentioned you`
+        : "@Mention"
+      : source === "approval"
+        ? senderName
+          ? `${senderName} requested approval`
+          : "Approval Requested"
+        : source === "thread_reply"
+          ? senderName
+            ? `${senderName} replied`
+            : "Reply"
+          : (senderName ?? "Needs Action");
+
+  return { title: formatNotificationTitle({ prefix, channelLabel }), body };
+}
diff --git a/desktop/src/features/notifications/lib/senderName.ts b/desktop/src/features/notifications/lib/senderName.ts
new file mode 100644
index 00000000000..1872cf540b6
--- /dev/null
+++ b/desktop/src/features/notifications/lib/senderName.ts
@@ -0,0 +1,24 @@
+import type { UserProfileSummary } from "@/shared/api/types";
+
+/**
+ * Resolve a sender's human display label from a profile summary, mirroring
+ * the sidebar's precedence (`resolveUserLabel`: displayName, then NIP-05
+ * handle) — but returning `null` instead of a truncated pubkey when no real
+ * name is known. Notification titles fall back to neutral copy ("Reply in
+ * #channel", "Direct message"), never a hex fragment.
+ */
+export function senderNameFromSummary(
+  summary: UserProfileSummary | null | undefined,
+): string | null {
+  const displayName = summary?.displayName?.trim();
+  if (displayName) {
+    return displayName;
+  }
+
+  const nip05Handle = summary?.nip05Handle?.trim();
+  if (nip05Handle) {
+    return nip05Handle;
+  }
+
+  return null;
+}
diff --git a/desktop/src/features/notifications/lib/target.test.mjs b/desktop/src/features/notifications/lib/target.test.mjs
new file mode 100644
index 00000000000..b9966381bdb
--- /dev/null
+++ b/desktop/src/features/notifications/lib/target.test.mjs
@@ -0,0 +1,81 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import {
+  buildEventNotificationTarget,
+  buildFeedItemNotificationTarget,
+} from "./target.ts";
+
+test("builds a complete click-through target from a live relay event", () => {
+  const target = buildEventNotificationTarget(
+    {
+      content: "hello",
+      created_at: 123,
+      id: "event-id",
+      kind: 9,
+      pubkey: "sender",
+      tags: [
+        ["h", "channel-id"],
+        ["e", "root-id", "", "root"],
+        ["e", "parent-id", "", "reply"],
+      ],
+    },
+    { id: "channel-id", name: "ship-room" },
+  );
+
+  assert.deepEqual(target, {
+    channelId: "channel-id",
+    channelName: "ship-room",
+    content: "hello",
+    createdAt: 123,
+    eventId: "event-id",
+    kind: 9,
+    pubkey: "sender",
+    threadRootId: "root-id",
+  });
+});
+
+test("null channel name and top-level events produce null fields", () => {
+  const target = buildEventNotificationTarget(
+    {
+      content: "hello",
+      created_at: 123,
+      id: "event-id",
+      kind: 9,
+      pubkey: "sender",
+      tags: [["h", "channel-id"]],
+    },
+    { id: "channel-id", name: "  " },
+  );
+
+  assert.equal(target.channelName, null);
+  assert.equal(target.threadRootId, null);
+});
+
+test("builds a complete click-through target from a feed item", () => {
+  const target = buildFeedItemNotificationTarget({
+    id: "feed-event",
+    kind: 9,
+    pubkey: "sender",
+    content: "ping",
+    createdAt: 456,
+    channelId: "channel-id",
+    channelName: "ship-room",
+    tags: [
+      ["e", "root-id", "", "root"],
+      ["e", "parent-id", "", "reply"],
+    ],
+    category: "mention",
+  });
+
+  assert.deepEqual(target, {
+    channelId: "channel-id",
+    channelName: "ship-room",
+    content: "ping",
+    createdAt: 456,
+    eventId: "feed-event",
+    kind: 9,
+    pubkey: "sender",
+    threadRootId: "root-id",
+  });
+});
diff --git a/desktop/src/features/notifications/lib/target.ts b/desktop/src/features/notifications/lib/target.ts
new file mode 100644
index 00000000000..be4459b9c18
--- /dev/null
+++ b/desktop/src/features/notifications/lib/target.ts
@@ -0,0 +1,44 @@
+import { getThreadReference } from "@/features/messages/lib/threading";
+import type { FeedItem, RelayEvent } from "@/shared/api/types";
+import type { DesktopNotificationTarget } from "./desktop";
+
+/**
+ * Build the click-through navigation target for a live relay event (DM or
+ * thread-reply). Every notification path constructs its target here so the
+ * payload the OS hands back on activation always carries the full routing
+ * anchor (eventId + threadRootId), not a hand-rolled subset.
+ */
+export function buildEventNotificationTarget(
+  event: Pick<
+    RelayEvent,
+    "content" | "created_at" | "id" | "kind" | "pubkey" | "tags"
+  >,
+  channel: { id: string; name?: string | null },
+): DesktopNotificationTarget {
+  return {
+    channelId: channel.id,
+    channelName: channel.name?.trim() || null,
+    content: event.content,
+    createdAt: event.created_at,
+    eventId: event.id,
+    kind: event.kind,
+    pubkey: event.pubkey,
+    threadRootId: getThreadReference(event.tags).rootId ?? null,
+  };
+}
+
+/** Build the click-through navigation target for a home-feed item. */
+export function buildFeedItemNotificationTarget(
+  item: FeedItem,
+): DesktopNotificationTarget {
+  return {
+    channelId: item.channelId,
+    channelName: item.channelName,
+    content: item.content,
+    createdAt: item.createdAt,
+    eventId: item.id,
+    kind: item.kind,
+    pubkey: item.pubkey,
+    threadRootId: getThreadReference(item.tags).rootId ?? null,
+  };
+}
diff --git a/desktop/src/features/notifications/use-feed-desktop-notifications.ts b/desktop/src/features/notifications/use-feed-desktop-notifications.ts
index b58e260ec2e..4a0865437ed 100644
--- a/desktop/src/features/notifications/use-feed-desktop-notifications.ts
+++ b/desktop/src/features/notifications/use-feed-desktop-notifications.ts
@@ -5,15 +5,14 @@ import {
   resolveUserLabel,
   type UserProfileLookup,
 } from "@/features/profile/lib/identity";
-import { getThreadReference } from "@/features/messages/lib/threading";
 import type { FeedItem, HomeFeedResponse } from "@/shared/api/types";
 import {
   collectHomeAlertItems,
   eligibleFeedNotificationItems,
+  formatFeedNotification,
   type NotificationChannel,
-  notificationBody,
-  notificationTitle,
 } from "./lib/feed";
+import { buildFeedItemNotificationTarget } from "./lib/target";
 import {
   getDesktopNotificationPermissionState,
   requestDesktopNotificationAccess,
@@ -112,20 +111,11 @@ export function useFeedDesktopNotifications(
 
   const deliverFeedNotification = React.useEffectEvent(
     async (item: FeedItem, senderName?: string) => {
-      const threadRootId = getThreadReference(item.tags).rootId ?? null;
+      const { title, body } = formatFeedNotification(item, senderName);
       const didSend = await sendDesktopNotification({
-        body: notificationBody(item),
-        target: {
-          channelId: item.channelId,
-          channelName: item.channelName,
-          content: item.content,
-          createdAt: item.createdAt,
-          eventId: item.id,
-          kind: item.kind,
-          pubkey: item.pubkey,
-          threadRootId,
-        },
-        title: notificationTitle(item, senderName),
+        body,
+        target: buildFeedItemNotificationTarget(item),
+        title,
       });
 
       if (
diff --git a/desktop/src/features/notifications/useNotificationSenderName.ts b/desktop/src/features/notifications/useNotificationSenderName.ts
new file mode 100644
index 00000000000..9f51e44b492
--- /dev/null
+++ b/desktop/src/features/notifications/useNotificationSenderName.ts
@@ -0,0 +1,76 @@
+import * as React from "react";
+import { useQueryClient } from "@tanstack/react-query";
+
+import { useCommunities } from "@/features/communities/useCommunities";
+import {
+  usersBatchEntryKey,
+  type UsersBatchEntry,
+} from "@/features/profile/hooks";
+import {
+  readCachedUserLabels,
+  writeCachedUserLabels,
+} from "@/features/profile/lib/userLabelStorage";
+import { getUsersBatch } from "@/shared/api/tauriProfiles";
+import { senderNameFromSummary } from "./lib/senderName";
+
+/**
+ * Synchronous sender-name lookup for live desktop notifications (DMs and
+ * thread replies). Toasts must never wait on the network, so resolution is
+ * cache-only: the per-pubkey `users-batch-entry` React Query cache first
+ * (kept warm by the sidebar and home feed), then the persisted label cache
+ * (survives restart). A cold miss returns `null` — the caller falls back to
+ * neutral copy — and kicks off a background fetch so the sender's next
+ * message resolves.
+ */
+export function useNotificationSenderName(): (
+  pubkey: string | undefined,
+) => string | null {
+  const queryClient = useQueryClient();
+  const { activeCommunity } = useCommunities();
+  const relayUrl = activeCommunity?.relayUrl ?? "";
+
+  return React.useCallback(
+    (pubkey) => {
+      const normalized = pubkey?.trim().toLowerCase() ?? "";
+      if (!normalized) {
+        return null;
+      }
+
+      const entry = queryClient.getQueryData<UsersBatchEntry>(
+        usersBatchEntryKey(normalized),
+      );
+      if (entry) {
+        // A stale name still beats no name for a toast; relay-confirmed
+        // misses (summary: null) correctly resolve to the fallback copy.
+        return senderNameFromSummary(entry.summary);
+      }
+
+      const cached = relayUrl
+        ? readCachedUserLabels(relayUrl, [normalized])
+        : undefined;
+      const cachedSummary = cached?.profiles[normalized];
+      if (cachedSummary) {
+        return senderNameFromSummary(cachedSummary);
+      }
+
+      void getUsersBatch([normalized])
+        .then((fresh) => {
+          queryClient.setQueryData<UsersBatchEntry>(
+            usersBatchEntryKey(normalized),
+            {
+              summary: fresh.profiles[normalized] ?? null,
+              fetchedAt: Date.now(),
+            },
+          );
+          if (relayUrl) {
+            writeCachedUserLabels(relayUrl, fresh.profiles, fresh.missing);
+          }
+        })
+        .catch(() => {
+          // Warm-up is best effort; the toast already shipped with fallback copy.
+        });
+      return null;
+    },
+    [queryClient, relayUrl],
+  );
+}
diff --git a/desktop/src/features/profile/hooks.ts b/desktop/src/features/profile/hooks.ts
index 7a456fb2591..f174d504080 100644
--- a/desktop/src/features/profile/hooks.ts
+++ b/desktop/src/features/profile/hooks.ts
@@ -286,12 +286,15 @@ export function useUserProfileQuery(pubkey?: string) {
 // `summary: null` records a relay-confirmed miss so unknown pubkeys aren't
 // re-requested every page. Entries older than the hook's 60s staleTime are
 // treated as unresolved and refetched.
-type UsersBatchEntry = {
+export type UsersBatchEntry = {
   summary: UserProfileSummary | null;
   fetchedAt: number;
 };
 
-const usersBatchEntryKey = (pubkey: string) => ["users-batch-entry", pubkey];
+export const usersBatchEntryKey = (pubkey: string) => [
+  "users-batch-entry",
+  pubkey,
+];
 
 /**
  * Drop the per-pubkey delta-fetch entries so the next `useUsersBatchQuery`
diff --git a/desktop/src/features/profile/ui/UserProfilePanelDeletion.ts b/desktop/src/features/profile/ui/UserProfilePanelDeletion.ts
index e52864727f6..c708bffe823 100644
--- a/desktop/src/features/profile/ui/UserProfilePanelDeletion.ts
+++ b/desktop/src/features/profile/ui/UserProfilePanelDeletion.ts
@@ -1,9 +1,11 @@
 import * as React from "react";
+import { useQueryClient } from "@tanstack/react-query";
 
 import {
   deleteManagedAgentWithRules,
   type ManagedAgentActionResult,
 } from "@/features/agents/lib/managedAgentControlActions";
+import { invalidateChannelMembersRosters } from "@/features/channels/rosterFreshness";
 import { removeChannelMember } from "@/shared/api/tauri";
 import type {
   AgentPersona,
@@ -46,6 +48,7 @@ export function useProfileAgentDeletion({
   presenceLookup,
   relayAgents,
 }: UseProfileAgentDeletionInput) {
+  const queryClient = useQueryClient();
   const removeAgentFromAllChannels = React.useCallback(
     async (agentPubkey: string) => {
       const normalizedPubkey = agentPubkey.toLowerCase();
@@ -67,8 +70,12 @@ export function useProfileAgentDeletion({
           removeChannelMember(channelId, agentPubkey),
         ),
       );
+      // Direct writes bypass the member mutations' invalidation; without
+      // this, the deleted agent stays in cached rosters for the freshness
+      // window.
+      await invalidateChannelMembersRosters(queryClient, channelIds);
     },
-    [channels, relayAgents],
+    [channels, queryClient, relayAgents],
   );
 
   const deleteManagedAgentRecord = React.useCallback(
diff --git a/desktop/src/features/profile/ui/UserProfilePopover.tsx b/desktop/src/features/profile/ui/UserProfilePopover.tsx
index 257256c5f63..f82bac1c336 100644
--- a/desktop/src/features/profile/ui/UserProfilePopover.tsx
+++ b/desktop/src/features/profile/ui/UserProfilePopover.tsx
@@ -134,24 +134,138 @@ export function UserProfilePopover({
   const hoverTimerRef = React.useRef<ReturnType<typeof setTimeout> | null>(
     null,
   );
-  const profileQuery = useUserProfileQuery(open ? pubkey : undefined);
-  const usersBatchQuery = useUsersBatchQuery(open ? [pubkey] : [], {
-    enabled: open,
-  });
-  const relayAgentsQuery = useRelayAgentsQuery({
-    enabled: open,
-  });
-  const managedAgentsQuery = useManagedAgentsQuery({
-    enabled: open,
-  });
-  const presenceQuery = usePresenceQuery(open ? [pubkey] : [], {
-    enabled: open,
-  });
-  const userStatusQuery = useUserStatusQuery(open ? [pubkey] : []);
-
-  const { canOpenAgentActivity, openAgentActivity } = useOpenAgentActivity();
   const { openProfilePanel } = useProfilePanel();
   const canOpenProfilePanel = enableProfilePanel && Boolean(openProfilePanel);
+
+  const clearHoverTimer = React.useCallback(() => {
+    if (hoverTimerRef.current !== null) {
+      clearTimeout(hoverTimerRef.current);
+      hoverTimerRef.current = null;
+    }
+  }, []);
+
+  const handleTriggerMouseEnter = React.useCallback(() => {
+    if (!enableHoverPopover) {
+      return;
+    }
+    clearHoverTimer();
+    hoverTimerRef.current = setTimeout(() => {
+      setOpen(true);
+    }, DEFAULT_POPOVER_HOVER_OPEN_DELAY_MS);
+  }, [clearHoverTimer, enableHoverPopover]);
+
+  const handleMouseLeave = React.useCallback(() => {
+    clearHoverTimer();
+    hoverTimerRef.current = setTimeout(() => {
+      setOpen(false);
+    }, HOVER_CLOSE_DELAY_MS);
+  }, [clearHoverTimer]);
+
+  const handleContentMouseEnter = React.useCallback(() => {
+    clearHoverTimer();
+  }, [clearHoverTimer]);
+
+  const handleTriggerClick = React.useCallback(
+    (event: React.MouseEvent) => {
+      clearHoverTimer();
+      if (canOpenProfilePanel && openProfilePanel) {
+        event.preventDefault();
+        event.stopPropagation();
+        setOpen(false);
+        openProfilePanel(pubkey);
+      }
+    },
+    [canOpenProfilePanel, clearHoverTimer, openProfilePanel, pubkey],
+  );
+
+  React.useEffect(() => {
+    return clearHoverTimer;
+  }, [clearHoverTimer]);
+
+  const TriggerElement = triggerElement;
+  return (
+    <Popover onOpenChange={setOpen} open={open}>
+      <PopoverAnchor asChild>
+        <TriggerElement
+          aria-label={triggerAriaLabel}
+          role={canOpenProfilePanel ? "button" : undefined}
+          tabIndex={canOpenProfilePanel ? 0 : undefined}
+          onClick={handleTriggerClick}
+          onKeyDown={(e) => {
+            if (
+              (e.key === "Enter" || e.key === " ") &&
+              canOpenProfilePanel &&
+              openProfilePanel
+            ) {
+              e.preventDefault();
+              e.stopPropagation();
+              clearHoverTimer();
+              setOpen(false);
+              openProfilePanel(pubkey);
+            }
+          }}
+          onMouseEnter={handleTriggerMouseEnter}
+          onMouseLeave={handleMouseLeave}
+          className={cn(
+            "inline-flex",
+            canOpenProfilePanel && "cursor-pointer [&_*]:cursor-pointer",
+          )}
+        >
+          {children}
+        </TriggerElement>
+      </PopoverAnchor>
+      {open ? (
+        <UserProfilePopoverBody
+          botIdenticonValue={botIdenticonValue}
+          canOpenProfilePanel={canOpenProfilePanel}
+          onBeforeAction={clearHoverTimer}
+          onContentMouseEnter={handleContentMouseEnter}
+          onMouseLeave={handleMouseLeave}
+          onTriggerClick={handleTriggerClick}
+          pubkey={pubkey}
+          role={role}
+          setOpen={setOpen}
+        />
+      ) : null}
+    </Popover>
+  );
+}
+
+/**
+ * Everything behind the popover surface: seven query subscriptions, agent
+ * classification, and the interaction actions. Mounted only while the
+ * popover is open — the trigger shell above stays cheap enough for grids
+ * that render hundreds of instances (~40ms per card when this was eager).
+ */
+function UserProfilePopoverBody({
+  botIdenticonValue,
+  canOpenProfilePanel,
+  onBeforeAction,
+  onContentMouseEnter,
+  onMouseLeave,
+  onTriggerClick,
+  pubkey,
+  role,
+  setOpen,
+}: {
+  botIdenticonValue?: string;
+  canOpenProfilePanel: boolean;
+  onBeforeAction: () => void;
+  onContentMouseEnter: () => void;
+  onMouseLeave: () => void;
+  onTriggerClick: (event: React.MouseEvent) => void;
+  pubkey: string;
+  role?: string;
+  setOpen: (open: boolean) => void;
+}) {
+  const profileQuery = useUserProfileQuery(pubkey);
+  const usersBatchQuery = useUsersBatchQuery([pubkey]);
+  const relayAgentsQuery = useRelayAgentsQuery();
+  const managedAgentsQuery = useManagedAgentsQuery();
+  const presenceQuery = usePresenceQuery([pubkey]);
+  const userStatusQuery = useUserStatusQuery([pubkey]);
+
+  const { canOpenAgentActivity, openAgentActivity } = useOpenAgentActivity();
   const relayAgent = relayAgentsQuery.data?.find((a) => a.pubkey === pubkey);
   const managedAgent = managedAgentsQuery.data?.find(
     (a) => a.pubkey === pubkey,
@@ -160,7 +274,7 @@ export function UserProfilePopover({
   const ownerPubkey = profile?.ownerPubkey ?? null;
   const ownerProfileQuery = useUsersBatchQuery(
     ownerPubkey ? [ownerPubkey] : [],
-    { enabled: open && Boolean(ownerPubkey) },
+    { enabled: Boolean(ownerPubkey) },
   );
   const normalizedPubkey = normalizePubkey(pubkey);
   const isAgentByOaOwner = Boolean(
@@ -173,7 +287,6 @@ export function UserProfilePopover({
     isAgentByProfileOwner ||
     isAgentByOaOwner;
   const isAgentClassificationPending =
-    open &&
     role !== "bot" &&
     (profileQuery.isPending ||
       relayAgentsQuery.isPending ||
@@ -234,48 +347,10 @@ export function UserProfilePopover({
     return map;
   }, [channelsQuery.data]);
 
-  const clearHoverTimer = React.useCallback(() => {
-    if (hoverTimerRef.current !== null) {
-      clearTimeout(hoverTimerRef.current);
-      hoverTimerRef.current = null;
-    }
-  }, []);
-
-  const handleTriggerMouseEnter = React.useCallback(() => {
-    if (!enableHoverPopover) {
-      return;
-    }
-    clearHoverTimer();
-    hoverTimerRef.current = setTimeout(() => {
-      setOpen(true);
-    }, DEFAULT_POPOVER_HOVER_OPEN_DELAY_MS);
-  }, [clearHoverTimer, enableHoverPopover]);
-
-  const handleMouseLeave = React.useCallback(() => {
-    clearHoverTimer();
-    hoverTimerRef.current = setTimeout(() => {
-      setOpen(false);
-    }, HOVER_CLOSE_DELAY_MS);
-  }, [clearHoverTimer]);
-
-  const handleContentMouseEnter = React.useCallback(() => {
-    clearHoverTimer();
-  }, [clearHoverTimer]);
-
-  const handleTriggerClick = React.useCallback(
-    (event: React.MouseEvent) => {
-      clearHoverTimer();
-      if (canOpenProfilePanel && openProfilePanel) {
-        event.preventDefault();
-        event.stopPropagation();
-        setOpen(false);
-        openProfilePanel(pubkey);
-      }
-    },
-    [canOpenProfilePanel, clearHoverTimer, openProfilePanel, pubkey],
+  const closeProfileActions = React.useCallback(
+    () => setOpen(false),
+    [setOpen],
   );
-
-  const closeProfileActions = React.useCallback(() => setOpen(false), []);
   const {
     handleHuddle,
     handleMessage,
@@ -290,19 +365,14 @@ export function UserProfilePopover({
       wave: showHumanProfileActions,
     },
     effectivePubkey: pubkey,
-    enabled: open,
+    enabled: true,
     isBot: isBotProfile,
     isSelf,
-    onBeforeAction: clearHoverTimer,
+    onBeforeAction: onBeforeAction,
     onClose: closeProfileActions,
     viewerIsOwner,
   });
 
-  React.useEffect(() => {
-    return clearHoverTimer;
-  }, [clearHoverTimer]);
-
-  const TriggerElement = triggerElement;
   const profileHeaderContent = (
     <>
       <ProfileAvatarWithStatus
@@ -349,220 +419,187 @@ export function UserProfilePopover({
   );
 
   return (
-    <Popover onOpenChange={setOpen} open={open}>
-      <PopoverAnchor asChild>
-        <TriggerElement
-          aria-label={triggerAriaLabel}
-          role={canOpenProfilePanel ? "button" : undefined}
-          tabIndex={canOpenProfilePanel ? 0 : undefined}
-          onClick={handleTriggerClick}
-          onKeyDown={(e) => {
-            if (
-              (e.key === "Enter" || e.key === " ") &&
-              canOpenProfilePanel &&
-              openProfilePanel
-            ) {
-              e.preventDefault();
-              e.stopPropagation();
-              clearHoverTimer();
-              setOpen(false);
-              openProfilePanel(pubkey);
-            }
-          }}
-          onMouseEnter={handleTriggerMouseEnter}
-          onMouseLeave={handleMouseLeave}
-          className={cn(
-            "inline-flex",
-            canOpenProfilePanel && "cursor-pointer [&_*]:cursor-pointer",
-          )}
-        >
-          {children}
-        </TriggerElement>
-      </PopoverAnchor>
-      <PopoverContent
-        align="start"
-        className="w-80"
-        data-testid="user-profile-popover"
-        onMouseEnter={handleContentMouseEnter}
-        onMouseLeave={handleMouseLeave}
-        // This is a hover card: moving focus into its first button on open
-        // makes the profile header look keyboard-selected before the user has
-        // interacted with it. Keep focus on the trigger; Tab still enters the
-        // card and shows its normal focus treatment when needed.
-        onOpenAutoFocus={(event) => event.preventDefault()}
-        side="top"
-        sideOffset={8}
-      >
-        <div className="flex flex-col gap-3">
-          {canOpenProfilePanel ? (
-            <button
-              className="flex w-full min-w-0 cursor-pointer items-center gap-3 rounded-lg text-left text-foreground focus-visible:outline-hidden focus-visible:ring-2 focus-visible:ring-ring [&_*]:cursor-pointer"
-              onClick={handleTriggerClick}
-              type="button"
-            >
-              {profileHeaderContent}
-            </button>
-          ) : (
-            <div className="flex w-full min-w-0 items-center gap-3 text-left text-foreground">
-              {profileHeaderContent}
-            </div>
-          )}
+    <PopoverContent
+      align="start"
+      className="w-80"
+      data-testid="user-profile-popover"
+      onMouseEnter={onContentMouseEnter}
+      onMouseLeave={onMouseLeave}
+      // This is a hover card: moving focus into its first button on open
+      // makes the profile header look keyboard-selected before the user has
+      // interacted with it. Keep focus on the trigger; Tab still enters the
+      // card and shows its normal focus treatment when needed.
+      onOpenAutoFocus={(event) => event.preventDefault()}
+      side="top"
+      sideOffset={8}
+    >
+      <div className="flex flex-col gap-3">
+        {canOpenProfilePanel ? (
+          <button
+            className="flex w-full min-w-0 cursor-pointer items-center gap-3 rounded-lg text-left text-foreground focus-visible:outline-hidden focus-visible:ring-2 focus-visible:ring-ring [&_*]:cursor-pointer"
+            onClick={onTriggerClick}
+            type="button"
+          >
+            {profileHeaderContent}
+          </button>
+        ) : (
+          <div className="flex w-full min-w-0 items-center gap-3 text-left text-foreground">
+            {profileHeaderContent}
+          </div>
+        )}
 
-          {isBotProfile && (managedAgent || relayAgent) ? (
-            <div className="flex flex-wrap gap-1.5">
-              {managedAgent?.agentCommand ? (
-                <InfoBadge>{runtimeLabel(managedAgent.agentCommand)}</InfoBadge>
-              ) : relayAgent?.agentType ? (
-                <InfoBadge>{runtimeLabel(relayAgent.agentType)}</InfoBadge>
-              ) : null}
-              {managedAgent?.model ? (
-                <InfoBadge>
-                  {resolveModelLabel(
-                    managedAgent.model,
-                    null,
-                    managedAgent.provider,
-                  )}
-                </InfoBadge>
-              ) : null}
-              {managedAgent?.acpCommand ? (
-                <InfoBadge>ACP: {managedAgent.acpCommand}</InfoBadge>
-              ) : null}
-            </div>
-          ) : null}
+        {isBotProfile && (managedAgent || relayAgent) ? (
+          <div className="flex flex-wrap gap-1.5">
+            {managedAgent?.agentCommand ? (
+              <InfoBadge>{runtimeLabel(managedAgent.agentCommand)}</InfoBadge>
+            ) : relayAgent?.agentType ? (
+              <InfoBadge>{runtimeLabel(relayAgent.agentType)}</InfoBadge>
+            ) : null}
+            {managedAgent?.model ? (
+              <InfoBadge>
+                {resolveModelLabel(
+                  managedAgent.model,
+                  null,
+                  managedAgent.provider,
+                )}
+              </InfoBadge>
+            ) : null}
+            {managedAgent?.acpCommand ? (
+              <InfoBadge>ACP: {managedAgent.acpCommand}</InfoBadge>
+            ) : null}
+          </div>
+        ) : null}
 
-          {activeTurns.length > 0 ? (
-            <div className="flex flex-wrap gap-1.5">
-              {activeTurns.map(({ channelId, anchorAt }) => (
-                <PopoverWorkingBadge
-                  key={channelId}
-                  name={channelIdToName[channelId] ?? channelId}
-                  anchorAt={anchorAt}
-                />
-              ))}
-            </div>
-          ) : null}
+        {activeTurns.length > 0 ? (
+          <div className="flex flex-wrap gap-1.5">
+            {activeTurns.map(({ channelId, anchorAt }) => (
+              <PopoverWorkingBadge
+                key={channelId}
+                name={channelIdToName[channelId] ?? channelId}
+                anchorAt={anchorAt}
+              />
+            ))}
+          </div>
+        ) : null}
 
-          {canViewActivity ? (
-            <button
-              className="flex w-full items-center gap-2 rounded-lg border border-border/60 px-3 py-2 text-left text-xs font-medium text-foreground transition-colors hover:bg-muted/50"
-              data-testid={`user-profile-view-activity-${pubkey}`}
-              onClick={() => {
-                setOpen(false);
-                openAgentActivity(pubkey);
-              }}
-              type="button"
-            >
-              <Activity className="h-4 w-4 text-muted-foreground" />
-              View activity log
-            </button>
-          ) : null}
+        {canViewActivity ? (
+          <button
+            className="flex w-full items-center gap-2 rounded-lg border border-border/60 px-3 py-2 text-left text-xs font-medium text-foreground transition-colors hover:bg-muted/50"
+            data-testid={`user-profile-view-activity-${pubkey}`}
+            onClick={() => {
+              setOpen(false);
+              openAgentActivity(pubkey);
+            }}
+            type="button"
+          >
+            <Activity className="h-4 w-4 text-muted-foreground" />
+            View activity log
+          </button>
+        ) : null}
 
-          {hasUserStatus || showAnyProfileActions ? (
-            <>
-              <div
-                aria-hidden="true"
-                className="my-1 border-t border-border/60"
-              />
-              {hasUserStatus ? (
-                <StatusLine>
-                  {userStatus?.emoji ? (
-                    <StatusEmoji
-                      className="h-3.5 w-3.5 shrink-0"
-                      value={userStatus.emoji}
-                    />
-                  ) : null}
-                  {userStatusText ? (
-                    <span className="truncate">{userStatusText}</span>
-                  ) : null}
-                </StatusLine>
-              ) : null}
-              {showAnyProfileActions ? (
-                <div className="flex gap-2">
-                  {showHumanProfileActions ? (
-                    <Button
-                      aria-label="Wave"
-                      className="buzz-wave-hover-trigger shrink-0 px-3 transition-transform duration-100 ease-out motion-reduce:transition-none motion-safe:active:scale-[0.97]"
-                      data-testid={`user-profile-popover-wave-${pubkey}`}
-                      disabled={pendingAction !== null || isOpeningDm}
-                      onClick={() => {
-                        void handleWave();
-                      }}
-                      size="sm"
-                      type="button"
-                      variant="outline"
-                    >
-                      {pendingAction === "wave" ? (
-                        <Spinner
-                          aria-hidden="true"
-                          className="h-3.5 w-3.5 border-2"
-                        />
-                      ) : (
-                        <span
-                          aria-hidden="true"
-                          className="buzz-wave-hand text-sm leading-none"
-                        >
-                          👋
-                        </span>
-                      )}
-                    </Button>
-                  ) : null}
-                  {showMessageAction ? (
-                    <Button
-                      className="min-w-0 flex-1"
-                      data-testid={`user-profile-popover-message-${pubkey}`}
-                      disabled={pendingAction !== null || isOpeningDm}
-                      onClick={() => {
-                        void handleMessage();
-                      }}
-                      size="sm"
-                      type="button"
-                      variant="outline"
-                    >
-                      {pendingAction === "message" ? (
-                        <Spinner
-                          aria-hidden="true"
-                          className="h-3.5 w-3.5 border-2"
-                        />
-                      ) : (
-                        <MessageSquare />
-                      )}
-                      Message
-                    </Button>
-                  ) : null}
-                  {showHuddleAction ? (
-                    <Button
-                      className="min-w-0 flex-1"
-                      data-testid={`user-profile-popover-huddle-${pubkey}`}
-                      disabled={
-                        pendingAction !== null ||
-                        isOpeningDm ||
-                        isStartingHuddle
-                      }
-                      onClick={() => {
-                        void handleHuddle();
-                      }}
-                      size="sm"
-                      type="button"
-                      variant="outline"
-                    >
-                      {pendingAction === "huddle" ? (
-                        <Spinner
-                          aria-hidden="true"
-                          className="h-3.5 w-3.5 border-2"
-                        />
-                      ) : (
-                        <Headphones />
-                      )}
-                      Huddle
-                    </Button>
-                  ) : null}
-                </div>
-              ) : null}
-            </>
-          ) : null}
-        </div>
-      </PopoverContent>
-    </Popover>
+        {hasUserStatus || showAnyProfileActions ? (
+          <>
+            <div
+              aria-hidden="true"
+              className="my-1 border-t border-border/60"
+            />
+            {hasUserStatus ? (
+              <StatusLine>
+                {userStatus?.emoji ? (
+                  <StatusEmoji
+                    className="h-3.5 w-3.5 shrink-0"
+                    value={userStatus.emoji}
+                  />
+                ) : null}
+                {userStatusText ? (
+                  <span className="truncate">{userStatusText}</span>
+                ) : null}
+              </StatusLine>
+            ) : null}
+            {showAnyProfileActions ? (
+              <div className="flex gap-2">
+                {showHumanProfileActions ? (
+                  <Button
+                    aria-label="Wave"
+                    className="buzz-wave-hover-trigger shrink-0 px-3 transition-transform duration-100 ease-out motion-reduce:transition-none motion-safe:active:scale-[0.97]"
+                    data-testid={`user-profile-popover-wave-${pubkey}`}
+                    disabled={pendingAction !== null || isOpeningDm}
+                    onClick={() => {
+                      void handleWave();
+                    }}
+                    size="sm"
+                    type="button"
+                    variant="outline"
+                  >
+                    {pendingAction === "wave" ? (
+                      <Spinner
+                        aria-hidden="true"
+                        className="h-3.5 w-3.5 border-2"
+                      />
+                    ) : (
+                      <span
+                        aria-hidden="true"
+                        className="buzz-wave-hand text-sm leading-none"
+                      >
+                        👋
+                      </span>
+                    )}
+                  </Button>
+                ) : null}
+                {showMessageAction ? (
+                  <Button
+                    className="min-w-0 flex-1"
+                    data-testid={`user-profile-popover-message-${pubkey}`}
+                    disabled={pendingAction !== null || isOpeningDm}
+                    onClick={() => {
+                      void handleMessage();
+                    }}
+                    size="sm"
+                    type="button"
+                    variant="outline"
+                  >
+                    {pendingAction === "message" ? (
+                      <Spinner
+                        aria-hidden="true"
+                        className="h-3.5 w-3.5 border-2"
+                      />
+                    ) : (
+                      <MessageSquare />
+                    )}
+                    Message
+                  </Button>
+                ) : null}
+                {showHuddleAction ? (
+                  <Button
+                    className="min-w-0 flex-1"
+                    data-testid={`user-profile-popover-huddle-${pubkey}`}
+                    disabled={
+                      pendingAction !== null || isOpeningDm || isStartingHuddle
+                    }
+                    onClick={() => {
+                      void handleHuddle();
+                    }}
+                    size="sm"
+                    type="button"
+                    variant="outline"
+                  >
+                    {pendingAction === "huddle" ? (
+                      <Spinner
+                        aria-hidden="true"
+                        className="h-3.5 w-3.5 border-2"
+                      />
+                    ) : (
+                      <Headphones />
+                    )}
+                    Huddle
+                  </Button>
+                ) : null}
+              </div>
+            ) : null}
+          </>
+        ) : null}
+      </div>
+    </PopoverContent>
   );
 }
 
diff --git a/desktop/src/features/projects/assignmentOperationFetch.test.mjs b/desktop/src/features/projects/assignmentOperationFetch.test.mjs
index 3882d1807e0..c669ee5a261 100644
--- a/desktop/src/features/projects/assignmentOperationFetch.test.mjs
+++ b/desktop/src/features/projects/assignmentOperationFetch.test.mjs
@@ -285,3 +285,38 @@ test("a failed assignment query surfaces as a failed section instead of silent l
 
   assert.ok(result.issues.failedSections.includes("assignments"));
 });
+
+test("fetchAssignmentOperationEvents stops paginating once its signal aborts", async () => {
+  // A permanently-full page would paginate forever without the cursor; abort
+  // after the first page and require the loop to stop with AbortError.
+  const controller = new AbortController();
+  let fetches = 0;
+  const fullPage = (until) =>
+    Array.from({ length: 500 }, (_, index) => ({
+      id: `${until ?? "head"}-${index}`.padEnd(64, "0"),
+      kind: 1,
+      pubkey: "a".repeat(64),
+      created_at: 1_000_000 - fetches * 1_000 - index,
+      content: JSON.stringify({ type: "assign" }),
+      tags: [],
+    }));
+  const fetchEvents = async (filter) => {
+    fetches += 1;
+    // Bound the fake: without the abort support the loop would paginate
+    // forever (each page has a fresh cursor) and OOM the test run.
+    if (fetches > 3) throw new Error("kept paginating after abort");
+    const page = fullPage(filter.until);
+    controller.abort();
+    return page;
+  };
+
+  await assert.rejects(
+    fetchAssignmentOperationEvents(
+      ["issue".padEnd(64, "1")],
+      fetchEvents,
+      controller.signal,
+    ),
+    (error) => error.name === "AbortError",
+  );
+  assert.equal(fetches, 1);
+});
diff --git a/desktop/src/features/projects/assignmentOperationFetch.ts b/desktop/src/features/projects/assignmentOperationFetch.ts
index fbdc90b2186..fa4e2585149 100644
--- a/desktop/src/features/projects/assignmentOperationFetch.ts
+++ b/desktop/src/features/projects/assignmentOperationFetch.ts
@@ -68,6 +68,7 @@ export async function fetchAssignmentOperationEvents(
   fetchEvents: (
     filter: FetchEventsInput,
   ) => Promise<RelayEvent[]> = relayClient.fetchEvents.bind(relayClient),
+  signal?: AbortSignal,
 ): Promise<RelayEvent[]> {
   if (issueIds.length === 0) return [];
   const chunks: string[][] = [];
@@ -75,7 +76,9 @@ export async function fetchAssignmentOperationEvents(
     chunks.push(issueIds.slice(i, i + ISSUE_ID_CHUNK_SIZE));
   }
   const pages = await Promise.all(
-    chunks.map((chunk) => fetchIssueCommentsExhaustively(chunk, fetchEvents)),
+    chunks.map((chunk) =>
+      fetchIssueCommentsExhaustively(chunk, fetchEvents, signal),
+    ),
   );
   const seen = new Map<string, RelayEvent>();
   for (const page of pages) {
@@ -91,11 +94,15 @@ export async function fetchAssignmentOperationEvents(
 async function fetchIssueCommentsExhaustively(
   issueIds: string[],
   fetchEvents: (filter: FetchEventsInput) => Promise<RelayEvent[]>,
+  signal?: AbortSignal,
 ): Promise<RelayEvent[]> {
   const seen = new Map<string, RelayEvent>();
   let limit = ASSIGNMENT_PAGE_LIMIT;
   let until: number | undefined;
   for (;;) {
+    // Leaving the Projects surface cancels its queries; stop queuing pages
+    // behind the next surface's fetches.
+    signal?.throwIfAborted();
     const page = await fetchEvents({
       kinds: [KIND_TEXT_NOTE],
       "#e": issueIds,
diff --git a/desktop/src/features/projects/hooks.ts b/desktop/src/features/projects/hooks.ts
index 17ab58d0621..ebfc15a083e 100644
--- a/desktop/src/features/projects/hooks.ts
+++ b/desktop/src/features/projects/hooks.ts
@@ -168,13 +168,18 @@ export function eventToProject(
 }
 
 export async function fetchProjects(
-  fetchExhaustively: FetchProjectEventsExhaustively = fetchProjectEventsExhaustively,
+  fetchExhaustively?: FetchProjectEventsExhaustively,
+  signal?: AbortSignal,
 ): Promise<Project[]> {
   // Delegates to `buildProjectsFromFetcher` in `projectEnumeration.ts`, which
   // is the pure, Tauri-free core of this operation. That helper's javadoc
   // explains the fail-closed tombstone contract and the NIP-OA owner-deletion
   // relay-side-suppression decision.
-  return buildProjectsFromFetcher(fetchExhaustively, {
+  const fetcher: FetchProjectEventsExhaustively =
+    fetchExhaustively ??
+    ((kinds, extraFilter) =>
+      fetchProjectEventsExhaustively(kinds, extraFilter, undefined, signal));
+  return buildProjectsFromFetcher(fetcher, {
     relayOrigin: getCachedRelayOrigin(),
     hiddenAddresses: new Set(readHiddenProjectCards()),
   });
@@ -637,22 +642,45 @@ async function deleteProject(project: Project): Promise<void> {
 
 export const projectsQueryKey = ["projects"] as const;
 
-export function useProjectsQuery() {
+/**
+ * Freshness windows for the Projects surface. Every local write path
+ * invalidates its keys explicitly (issue/PR mutations, project creation,
+ * repo sync), so short windows bought nothing for own-actions and charged a
+ * full relay fan-out — project enumeration is an exhaustive paginated scan,
+ * work items are five 2,000-event queries — on nearly every Projects
+ * re-entry. Remote actors' changes surface within the window. gcTime keeps
+ * the enumeration cached across visits so re-entering Projects paints from
+ * cache instead of blocking on the scan.
+ */
+export const PROJECTS_STALE_TIME_MS = 5 * 60_000;
+// Window-guarded like react-query's own server default (Infinity): an
+// explicit finite gcTime schedules a real, non-unref'd timeout per cache
+// entry, which keeps node test processes alive for the full 30 minutes.
+export const PROJECTS_GC_TIME_MS =
+  typeof window === "undefined" ? Number.POSITIVE_INFINITY : 30 * 60_000;
+export const PROJECT_WORK_ITEMS_STALE_TIME_MS = 2 * 60_000;
+export const PROJECT_ACTIVITY_STALE_TIME_MS = 2 * 60_000;
+export const PROJECT_LOCAL_REPOS_STALE_TIME_MS = 2 * 60_000;
+
+export function useProjectsQuery(enabled = true) {
   return useQuery({
     queryKey: projectsQueryKey,
-    queryFn: () => fetchProjects(),
-    staleTime: 60_000,
+    queryFn: ({ signal }) => fetchProjects(undefined, signal),
+    staleTime: PROJECTS_STALE_TIME_MS,
+    gcTime: PROJECTS_GC_TIME_MS,
+    enabled,
   });
 }
 
 export function useProjectQuery(projectId: string) {
   return useQuery({
     queryKey: projectsQueryKey,
-    queryFn: () => fetchProjects(),
+    queryFn: ({ signal }) => fetchProjects(undefined, signal),
     select: (projects) =>
       projects.find((project) => projectMatchesRouteId(project, projectId)) ??
       null,
-    staleTime: 60_000,
+    staleTime: PROJECTS_STALE_TIME_MS,
+    gcTime: PROJECTS_GC_TIME_MS,
   });
 }
 
@@ -793,7 +821,8 @@ export function useProjectLocalRepositoriesQuery(reposDir?: string | null) {
   return useQuery({
     queryKey: ["projects", "local-repositories", reposDir ?? "default"],
     queryFn: () => listProjectLocalRepositories({ reposDir }),
-    staleTime: 10_000,
+    // Filesystem scan; repo sync/clone flows invalidate this key on change.
+    staleTime: PROJECT_LOCAL_REPOS_STALE_TIME_MS,
     retry: 1,
   });
 }
@@ -828,9 +857,22 @@ export function useProjectPullRequestsQuery(
 export function useProjectsWorkItemsQuery(projects: Project[]) {
   return useQuery({
     enabled: projects.length > 0,
-    queryKey: ["projects", "work-items", projects.map((project) => project.id)],
-    queryFn: () => fetchProjectsWorkItems(projects),
-    staleTime: 30_000,
+    queryKey: [
+      "projects",
+      "work-items",
+      projects.map((project) => project.id),
+      // Repo attach/detach changes the fan-out inputs without changing
+      // project ids; keying on addresses too prevents a pre-attach result
+      // from serving as fresh for the whole staleTime window.
+      projects
+        .flatMap((project) =>
+          project.repositories.map((repository) => repository.repoAddress),
+        )
+        .sort(),
+    ],
+    queryFn: ({ signal }) =>
+      fetchProjectsWorkItems(projects, undefined, signal),
+    staleTime: PROJECT_WORK_ITEMS_STALE_TIME_MS,
   });
 }
 
@@ -935,7 +977,7 @@ export function useProjectActivitySummariesQuery(projects: Project[]) {
     enabled: repoAddresses.length > 0,
     queryKey: ["projects", "activity-summaries", repoAddresses],
     queryFn: () => fetchProjectActivitySummaries(projects),
-    staleTime: 30_000,
+    staleTime: PROJECT_ACTIVITY_STALE_TIME_MS,
   });
 }
 
diff --git a/desktop/src/features/projects/lib/projectDetailAgentContext.test.mjs b/desktop/src/features/projects/lib/projectDetailAgentContext.test.mjs
index 7febdf8b678..36066132c42 100644
--- a/desktop/src/features/projects/lib/projectDetailAgentContext.test.mjs
+++ b/desktop/src/features/projects/lib/projectDetailAgentContext.test.mjs
@@ -6,6 +6,7 @@ import {
   buildProjectSelectionAgentContext,
   buildProjectsOverviewAgentContext,
   projectDetailAgentContextBlock,
+  splitProjectDetailAgentContext,
   stripProjectDetailAgentContext,
   untrustedPromptValue,
   withProjectSelectionAgentContext,
@@ -215,8 +216,44 @@ test("selected project context enforces a final serialization budget", () => {
 });
 
 test("strips hidden page context from the displayed user message", () => {
-  const content = `Explain this file${projectDetailAgentContextBlock(
+  const payload = projectDetailAgentContextBlock(
     buildProjectDetailAgentContext(base),
-  )}`;
+  );
+  const content = `Explain this file${payload}`;
   assert.equal(stripProjectDetailAgentContext(content), "Explain this file");
+  assert.deepEqual(splitProjectDetailAgentContext(content), {
+    context: payload.trim(),
+    message: "Explain this file",
+  });
+});
+
+test("leaves ordinary messages unchanged without inventing context", () => {
+  assert.deepEqual(splitProjectDetailAgentContext("A normal message"), {
+    context: null,
+    message: "A normal message",
+  });
+});
+
+test("splits only the final appended context marker", () => {
+  const userMessage =
+    "Discuss this literal example:\n---\nCurrent Buzz project page:\nnot appended";
+  const payload = projectDetailAgentContextBlock(
+    buildProjectDetailAgentContext(base),
+  );
+  assert.deepEqual(splitProjectDetailAgentContext(`${userMessage}${payload}`), {
+    context: payload.trim(),
+    message: userMessage,
+  });
+});
+
+test("splits workspace repository context for the shared conversation view", () => {
+  const payload =
+    '\n---\nWorkspace repositories:\n- "Buzz" (address: "owner:buzz")';
+  assert.deepEqual(
+    splitProjectDetailAgentContext(`Compare the repos${payload}`),
+    {
+      context: payload.trim(),
+      message: "Compare the repos",
+    },
+  );
 });
diff --git a/desktop/src/features/projects/lib/projectDetailAgentContext.ts b/desktop/src/features/projects/lib/projectDetailAgentContext.ts
index 0194bad3e18..97142157007 100644
--- a/desktop/src/features/projects/lib/projectDetailAgentContext.ts
+++ b/desktop/src/features/projects/lib/projectDetailAgentContext.ts
@@ -5,6 +5,12 @@ import {
 } from "./projectSelection.ts";
 
 const PROJECT_PAGE_CONTEXT_MARKER = "Current Buzz project page:";
+/** Marker for the repository set appended by the full Projects agent page. */
+export const PROJECT_WORKSPACE_CONTEXT_MARKER = "Workspace repositories:";
+const PROJECT_AGENT_CONTEXT_MARKERS = [
+  PROJECT_PAGE_CONTEXT_MARKER,
+  PROJECT_WORKSPACE_CONTEXT_MARKER,
+];
 const MAX_OVERVIEW_CONTEXT_ITEMS = 200;
 const MAX_OVERVIEW_CONTEXT_FIELD_LENGTH = 180;
 const MAX_SELECTION_CONTEXT_ITEMS = 100;
@@ -323,8 +329,24 @@ function overviewContextField(value: string | null | undefined) {
   return normalizedPromptValue(value, MAX_OVERVIEW_CONTEXT_FIELD_LENGTH);
 }
 
+export function splitProjectDetailAgentContext(content: string): {
+  context: string | null;
+  message: string;
+} {
+  const markerIndex = Math.max(
+    ...PROJECT_AGENT_CONTEXT_MARKERS.map((marker) =>
+      content.lastIndexOf(`---\n${marker}`),
+    ),
+  );
+  if (markerIndex === -1) {
+    return { context: null, message: content };
+  }
+  return {
+    context: content.slice(markerIndex).trim(),
+    message: content.slice(0, markerIndex).replace(/\n+$/, ""),
+  };
+}
+
 export function stripProjectDetailAgentContext(content: string) {
-  const markerIndex = content.indexOf(`---\n${PROJECT_PAGE_CONTEXT_MARKER}`);
-  if (markerIndex === -1) return content;
-  return content.slice(0, markerIndex).replace(/\n+$/, "");
+  return splitProjectDetailAgentContext(content).message;
 }
diff --git a/desktop/src/features/projects/lib/projectReviewDisplay.test.mjs b/desktop/src/features/projects/lib/projectReviewDisplay.test.mjs
new file mode 100644
index 00000000000..2f89decab42
--- /dev/null
+++ b/desktop/src/features/projects/lib/projectReviewDisplay.test.mjs
@@ -0,0 +1,181 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import {
+  currentPullRequestForSelection,
+  projectReviewFilesChangedBody,
+  retainLatestByKey,
+  reviewDiffWorkspaceBranch,
+  shouldReplaceRetainedPullRequest,
+} from "./projectReviewDisplay.ts";
+
+test("retainLatestByKey keeps the previous value when shouldReplace is false", () => {
+  const cache = { current: { key: "pr-1", value: { files: [1] } } };
+
+  const retained = retainLatestByKey(
+    cache,
+    "pr-1",
+    { files: [] },
+    (next, previous) =>
+      next.files.length > 0 ? true : previous.files.length === 0,
+  );
+
+  assert.deepEqual(retained, { files: [1] });
+  assert.deepEqual(cache.current.value, { files: [1] });
+});
+
+test("retainLatestByKey takes a new key immediately", () => {
+  const cache = { current: { key: "pr-1", value: { files: [1] } } };
+
+  const retained = retainLatestByKey(
+    cache,
+    "pr-2",
+    { files: [] },
+    (next) => next.files.length > 0,
+  );
+
+  assert.deepEqual(retained, { files: [] });
+});
+
+test("an explicit selected review does not fall back to another identity", () => {
+  const selected = { id: "pr-a" };
+  const branchReview = { id: "pr-branch" };
+
+  assert.equal(
+    currentPullRequestForSelection({
+      fallback: branchReview,
+      pullRequests: [selected, branchReview],
+      selectedPullRequestId: "pr-a",
+    }),
+    selected,
+  );
+  assert.equal(
+    currentPullRequestForSelection({
+      fallback: branchReview,
+      pullRequests: [branchReview],
+      selectedPullRequestId: "pr-a",
+    }),
+    null,
+  );
+  assert.equal(
+    currentPullRequestForSelection({
+      fallback: branchReview,
+      pullRequests: [branchReview],
+      selectedPullRequestId: null,
+    }),
+    branchReview,
+  );
+});
+
+test("retained review identity stays aligned with the diff-query identity across fetch phases", () => {
+  const reviewA = { id: "pr-a" };
+  const renderedCache = { current: { key: "repo:pr-a", value: reviewA } };
+  const diffQueryCache = { current: { key: "repo:pr-a", value: reviewA } };
+
+  const renderedDuringFetch = retainLatestByKey(
+    renderedCache,
+    "repo:pr-a",
+    currentPullRequestForSelection({
+      fallback: { id: "pr-branch" },
+      pullRequests: [],
+      selectedPullRequestId: "pr-a",
+    }),
+    (next) => shouldReplaceRetainedPullRequest(next, true),
+  );
+  const diffDuringFetch = retainLatestByKey(
+    diffQueryCache,
+    "repo:pr-a",
+    currentPullRequestForSelection({
+      fallback: { id: "pr-branch" },
+      pullRequests: [],
+      selectedPullRequestId: "pr-a",
+    }),
+    (next) => shouldReplaceRetainedPullRequest(next, true),
+  );
+  assert.equal(renderedDuringFetch, reviewA);
+  assert.equal(diffDuringFetch, reviewA);
+  assert.equal(renderedDuringFetch.id, diffDuringFetch.id);
+
+  const renderedAfterComplete = retainLatestByKey(
+    renderedCache,
+    "repo:pr-a",
+    currentPullRequestForSelection({
+      fallback: { id: "pr-branch" },
+      pullRequests: [],
+      selectedPullRequestId: "pr-a",
+    }),
+    (next) => shouldReplaceRetainedPullRequest(next, false),
+  );
+  const diffAfterComplete = retainLatestByKey(
+    diffQueryCache,
+    "repo:pr-a",
+    currentPullRequestForSelection({
+      fallback: { id: "pr-branch" },
+      pullRequests: [],
+      selectedPullRequestId: "pr-a",
+    }),
+    (next) => shouldReplaceRetainedPullRequest(next, false),
+  );
+  assert.equal(renderedAfterComplete, null);
+  assert.equal(diffAfterComplete, null);
+});
+
+test("review files stay mounted when a populated diff races an unavailable snapshot", () => {
+  assert.equal(
+    projectReviewFilesChangedBody({
+      hasPopulatedDiff: true,
+      hasSelectedPullRequest: true,
+      repositoryUnavailable: true,
+    }),
+    "files",
+  );
+});
+
+test("review files can show unavailable before a diff exists", () => {
+  assert.equal(
+    projectReviewFilesChangedBody({
+      hasPopulatedDiff: false,
+      hasSelectedPullRequest: true,
+      repositoryUnavailable: true,
+    }),
+    "unavailable",
+  );
+});
+
+test("review files render the panel for a selected review when the repo is available", () => {
+  assert.equal(
+    projectReviewFilesChangedBody({
+      hasPopulatedDiff: false,
+      hasSelectedPullRequest: true,
+      repositoryUnavailable: false,
+    }),
+    "files",
+  );
+});
+
+test("review diffs stay on the target branch, not the head or picker branch", () => {
+  assert.equal(
+    reviewDiffWorkspaceBranch({
+      activeBranch: "variation/bees",
+      defaultBranch: "main",
+      pullRequest: { targetBranch: "main" },
+    }),
+    "main",
+  );
+  assert.equal(
+    reviewDiffWorkspaceBranch({
+      activeBranch: "variation/bees",
+      defaultBranch: "main",
+      pullRequest: { targetBranch: null },
+    }),
+    "main",
+  );
+  assert.equal(
+    reviewDiffWorkspaceBranch({
+      activeBranch: "variation/bees",
+      defaultBranch: "main",
+      pullRequest: null,
+    }),
+    "variation/bees",
+  );
+});
diff --git a/desktop/src/features/projects/lib/projectReviewDisplay.ts b/desktop/src/features/projects/lib/projectReviewDisplay.ts
new file mode 100644
index 00000000000..d7ba721238c
--- /dev/null
+++ b/desktop/src/features/projects/lib/projectReviewDisplay.ts
@@ -0,0 +1,101 @@
+type RetainLatestByKeyCache<T> = {
+  current: {
+    key: string;
+    value: T;
+  };
+};
+
+/**
+ * Keep the latest accepted value for a stable key across transient empties.
+ * A new key always takes `value` immediately (real navigation).
+ */
+export function retainLatestByKey<T>(
+  cache: RetainLatestByKeyCache<T>,
+  key: string,
+  value: T,
+  shouldReplace: (next: T, previous: T) => boolean,
+): T {
+  if (cache.current.key !== key) {
+    cache.current = { key, value };
+    return value;
+  }
+  if (shouldReplace(value, cache.current.value)) {
+    cache.current.value = value;
+  }
+  return cache.current.value;
+}
+
+/**
+ * Keep a selected review through transient empty refetches. Once the fetch
+ * is idle, accept the completed result — including null — so the rendered
+ * identity can match the diff-query identity.
+ */
+export function shouldReplaceRetainedPullRequest(
+  next: unknown,
+  isFetching: boolean,
+): boolean {
+  return Boolean(next) || !isFetching;
+}
+
+/**
+ * Resolve the current review for a selection. An explicit ID that is missing
+ * from the list is `null` so a completed refetch can clear it; pass
+ * `fallback` only when no ID is selected (branch auto-select).
+ */
+export function currentPullRequestForSelection<T extends { id: string }>({
+  fallback = null,
+  pullRequests,
+  selectedPullRequestId,
+}: {
+  fallback?: T | null;
+  pullRequests: readonly T[] | undefined;
+  selectedPullRequestId: string | null;
+}): T | null {
+  if (selectedPullRequestId) {
+    return (
+      pullRequests?.find((item) => item.id === selectedPullRequestId) ?? null
+    );
+  }
+  return fallback;
+}
+
+/**
+ * Which body to render under a review's Files changed section.
+ * A populated diff must keep the files panel mounted even when the repository
+ * snapshot briefly looks unavailable — swapping in the unavailable placeholder
+ * is the files-section flicker.
+ */
+export function projectReviewFilesChangedBody({
+  hasPopulatedDiff,
+  hasSelectedPullRequest,
+  repositoryUnavailable,
+}: {
+  hasPopulatedDiff: boolean;
+  hasSelectedPullRequest: boolean;
+  repositoryUnavailable: boolean;
+}): "files" | "unavailable" | null {
+  if (hasSelectedPullRequest && (hasPopulatedDiff || !repositoryUnavailable)) {
+    return "files";
+  }
+  if (repositoryUnavailable) return "unavailable";
+  return null;
+}
+
+/**
+ * Workspace branch used to fetch a review diff.
+ * A selected review is `target...head`; do not key that query on the head
+ * branch or the workspace picker, or Files changed will swap with the
+ * default-branch snapshot.
+ */
+export function reviewDiffWorkspaceBranch({
+  activeBranch,
+  defaultBranch,
+  pullRequest,
+}: {
+  activeBranch: string | null | undefined;
+  defaultBranch: string | null | undefined;
+  pullRequest: { targetBranch: string | null } | null | undefined;
+}): string | null | undefined {
+  if (!pullRequest) return activeBranch;
+  return pullRequest.targetBranch || defaultBranch || activeBranch;
+}
diff --git a/desktop/src/features/projects/projectEnumeration.test.mjs b/desktop/src/features/projects/projectEnumeration.test.mjs
index 240546b8a4b..49cec525162 100644
--- a/desktop/src/features/projects/projectEnumeration.test.mjs
+++ b/desktop/src/features/projects/projectEnumeration.test.mjs
@@ -245,3 +245,31 @@ test("buildProjectsFromFetcher still suppresses deleted heads via the scoped fet
   const projects = await buildProjectsFromFetcher(fetchExhaustively);
   assert.deepEqual(projects, [], "deleted repo must not surface as a project");
 });
+
+test("enumerateProjectEvents stops paginating once its signal aborts", async () => {
+  // 3 full pages of 2 → without an abort the enumeration would fetch all of
+  // them plus boundary drains. Abort after the first page: the loop must
+  // throw before requesting another page.
+  const events = [
+    relayEvent("a", 1_000),
+    relayEvent("b", 900),
+    relayEvent("c", 800),
+    relayEvent("d", 700),
+    relayEvent("e", 600),
+    relayEvent("f", 500),
+  ];
+  const controller = new AbortController();
+  let pageFetches = 0;
+  const fetchPage = async (filter) => {
+    pageFetches += 1;
+    const page = await fetcherFor(events)(filter);
+    controller.abort();
+    return page;
+  };
+
+  await assert.rejects(
+    enumerateProjectEvents(fetchPage, [30617], 2, undefined, controller.signal),
+    (error) => error.name === "AbortError",
+  );
+  assert.equal(pageFetches, 1);
+});
diff --git a/desktop/src/features/projects/projectEnumeration.ts b/desktop/src/features/projects/projectEnumeration.ts
index ab1502c7577..ac494321042 100644
--- a/desktop/src/features/projects/projectEnumeration.ts
+++ b/desktop/src/features/projects/projectEnumeration.ts
@@ -44,6 +44,7 @@ export async function enumerateProjectEvents(
   kinds: number[],
   pageSize: number,
   extraFilter?: ProjectEventExtraFilter,
+  signal?: AbortSignal,
 ): Promise<RelayEvent[]> {
   if (!Number.isSafeInteger(pageSize) || pageSize <= 0) {
     throw new Error(
@@ -55,6 +56,10 @@ export async function enumerateProjectEvents(
   let until: number | undefined;
 
   for (;;) {
+    // Each relay REQ is bounded, but this loop is not: leaving the Projects
+    // surface cancels its queries, and the abort must stop the enumeration
+    // from queuing further pages behind the next surface's fetches.
+    signal?.throwIfAborted();
     const page = await fetchPage({
       ...extraFilter,
       kinds,
@@ -65,6 +70,7 @@ export async function enumerateProjectEvents(
     if (page.length < pageSize) return [...eventsById.values()];
 
     const oldest = Math.min(...page.map((event) => event.created_at));
+    signal?.throwIfAborted();
     const boundary = await fetchPage({
       ...extraFilter,
       kinds,
@@ -94,12 +100,14 @@ export function fetchProjectEventsExhaustively(
   kinds: number[],
   extraFilter?: ProjectEventExtraFilter,
   pageSize = PROJECT_ENUMERATION_PAGE_SIZE,
+  signal?: AbortSignal,
 ): Promise<RelayEvent[]> {
   return enumerateProjectEvents(
     (filter) => relayClient.fetchEvents(filter),
     kinds,
     pageSize,
     extraFilter,
+    signal,
   );
 }
 
diff --git a/desktop/src/features/projects/projectWorkItems.ts b/desktop/src/features/projects/projectWorkItems.ts
index 80ab32c62a5..11acbc8b34b 100644
--- a/desktop/src/features/projects/projectWorkItems.ts
+++ b/desktop/src/features/projects/projectWorkItems.ts
@@ -82,6 +82,7 @@ export async function fetchProjectsWorkItems<TProject extends ProjectReference>(
   fetchEvents: (
     filter: FetchEventsInput,
   ) => Promise<RelayEvent[]> = relayClient.fetchEvents.bind(relayClient),
+  signal?: AbortSignal,
 ): Promise<ProjectsWorkItemsResult<TProject>> {
   const repoAddresses = [
     ...new Set(
@@ -129,10 +130,17 @@ export async function fetchProjectsWorkItems<TProject extends ProjectReference>(
             .filter((event) => event.kind === KIND_GIT_ISSUE)
             .map((event) => event.id),
           fetchEvents,
+          signal,
         ),
       ),
     ]);
 
+  // The five eager queries above are single bounded REQs the relay client
+  // cannot abort mid-flight; only the assignment pagination is abort-aware.
+  // What cancellation CAN save here is the reduce work below and caching a
+  // result for a surface the user already left.
+  signal?.throwIfAborted();
+
   if (rootResult.status === "rejected") {
     throw rootResult.reason instanceof Error
       ? rootResult.reason
diff --git a/desktop/src/features/projects/repositoryActivityHooks.ts b/desktop/src/features/projects/repositoryActivityHooks.ts
index 10733116a88..39a9cdb98a4 100644
--- a/desktop/src/features/projects/repositoryActivityHooks.ts
+++ b/desktop/src/features/projects/repositoryActivityHooks.ts
@@ -3,6 +3,7 @@ import * as React from "react";
 
 import {
   fetchRepositoryActivitySummaries,
+  PROJECT_ACTIVITY_STALE_TIME_MS,
   type Project,
 } from "@/features/projects/hooks";
 
@@ -27,6 +28,6 @@ export function useRepositoryActivitySummariesQuery(projects: Project[]) {
     enabled: repoAddresses.length > 0,
     queryKey: ["projects", "activity-summaries", "repositories", repoAddresses],
     queryFn: () => fetchRepositoryActivitySummaries(repositories),
-    staleTime: 30_000,
+    staleTime: PROJECT_ACTIVITY_STALE_TIME_MS,
   });
 }
diff --git a/desktop/src/features/projects/ui/AgentContextPayloadPreview.test.mjs b/desktop/src/features/projects/ui/AgentContextPayloadPreview.test.mjs
index 749d5eb5011..6229c775389 100644
--- a/desktop/src/features/projects/ui/AgentContextPayloadPreview.test.mjs
+++ b/desktop/src/features/projects/ui/AgentContextPayloadPreview.test.mjs
@@ -33,7 +33,7 @@ afterEach(async () => {
 
 after(() => dom.window.close());
 
-async function renderPreview(payload) {
+async function renderPreview(payload, options = {}) {
   const { createElement } = await import("react");
   const { render } = await import("@testing-library/react");
   const { AgentContextPayloadPreview } = await import(
@@ -41,8 +41,9 @@ async function renderPreview(payload) {
   );
   return render(
     createElement(AgentContextPayloadPreview, {
+      iconOnly: options.iconOnly,
       payload,
-      triggerLabel: "Context",
+      triggerLabel: options.triggerLabel ?? "Context",
     }),
   );
 }
@@ -83,6 +84,24 @@ test("discloses the exact appended payload before send, adversarial metadata inc
   assert.equal(screen.queryByTestId("agent-context-preview"), null);
 });
 
+test("supports a subtle icon-only disclosure without losing its accessible name", async () => {
+  const { fireEvent, screen } = await import("@testing-library/react");
+  await renderPreview("Exact context", {
+    iconOnly: true,
+    triggerLabel: "Preview message context",
+  });
+
+  const trigger = screen.getByRole("button", {
+    name: "Preview message context",
+  });
+  assert.equal(trigger.textContent?.trim(), "");
+  fireEvent.click(trigger);
+  assert.equal(
+    screen.getByTestId("agent-context-preview-payload").textContent,
+    "Exact context",
+  );
+});
+
 test("renders nothing when there is no payload to append", async () => {
   const { screen } = await import("@testing-library/react");
   await renderPreview("");
diff --git a/desktop/src/features/projects/ui/AgentContextPayloadPreview.tsx b/desktop/src/features/projects/ui/AgentContextPayloadPreview.tsx
index d6db47b8686..550cadd86aa 100644
--- a/desktop/src/features/projects/ui/AgentContextPayloadPreview.tsx
+++ b/desktop/src/features/projects/ui/AgentContextPayloadPreview.tsx
@@ -1,6 +1,7 @@
 import { Info } from "lucide-react";
 import * as React from "react";
 
+import { cn } from "@/shared/lib/cn";
 import { Button } from "@/shared/ui/button";
 
 /**
@@ -13,9 +14,11 @@ import { Button } from "@/shared/ui/button";
  * inspects here is byte-identical to what gets signed under their key.
  */
 export function AgentContextPayloadPreview({
+  iconOnly = false,
   payload,
   triggerLabel,
 }: {
+  iconOnly?: boolean;
   payload: string;
   triggerLabel: string;
 }) {
@@ -25,8 +28,14 @@ export function AgentContextPayloadPreview({
   return (
     <div className="relative shrink-0">
       <Button
+        aria-label={iconOnly ? triggerLabel : undefined}
         aria-expanded={open}
-        className="h-7 gap-1 rounded-full px-2 text-xs text-muted-foreground"
+        className={cn(
+          "h-7 rounded-full text-muted-foreground",
+          iconOnly
+            ? "w-7 p-0 text-muted-foreground/75 hover:text-muted-foreground focus-visible:text-muted-foreground"
+            : "gap-1 px-2 text-xs",
+        )}
         data-testid="agent-context-preview-trigger"
         onClick={() => setOpen((value) => !value)}
         size="sm"
@@ -34,8 +43,8 @@ export function AgentContextPayloadPreview({
         type="button"
         variant="ghost"
       >
-        <Info className="h-3.5 w-3.5" />
-        {triggerLabel}
+        <Info className={iconOnly ? "h-3 w-3" : "h-3.5 w-3.5"} />
+        {iconOnly ? null : triggerLabel}
       </Button>
       {open ? (
         <div
diff --git a/desktop/src/features/projects/ui/DiscussionChannels.tsx b/desktop/src/features/projects/ui/DiscussionChannels.tsx
index 9b78fbcf08f..665f77b6f2a 100644
--- a/desktop/src/features/projects/ui/DiscussionChannels.tsx
+++ b/desktop/src/features/projects/ui/DiscussionChannels.tsx
@@ -64,6 +64,53 @@ export function useDiscussionChannels(query: string): {
   };
 }
 
+/** Hits are sorted newest first, so the first hit per channel is the one a
+ * click should land on (and the one worth quoting). */
+function useLatestHitByChannel(hits: SearchHit[]) {
+  return React.useMemo(() => {
+    const byChannel = new Map<string, SearchHit>();
+    for (const hit of hits) {
+      if (hit.channelId && !byChannel.has(hit.channelId)) {
+        byChannel.set(hit.channelId, hit);
+      }
+    }
+    return byChannel;
+  }, [hits]);
+}
+
+/**
+ * Shared row-click behavior: land on the latest matching message — in the
+ * side conversation panel when one is mounted — instead of jumping straight
+ * to the channel. Forum content opens in place (the panel renders chat
+ * threads only), and channels with no quotable hit fall back to plain
+ * channel navigation.
+ */
+function openDiscussionHit({
+  channelId,
+  goChannel,
+  latestHit,
+  openSearchHit,
+  panel,
+}: {
+  channelId: string;
+  goChannel: (channelId: string) => unknown;
+  latestHit: SearchHit | undefined;
+  openSearchHit: (hit: SearchHit) => unknown;
+  panel: { openConversation: (hit: SearchHit) => void } | null;
+}) {
+  if (!latestHit) {
+    void goChannel(channelId);
+    return;
+  }
+  const opensForum =
+    latestHit.kind === KIND_FORUM_POST || latestHit.kind === KIND_FORUM_COMMENT;
+  if (!panel || opensForum) {
+    void openSearchHit(latestHit);
+    return;
+  }
+  panel.openConversation(latestHit);
+}
+
 /** Channel display name, preferring the hit's name, then bounded metadata,
  * then a short id so inaccessible/renamed channels still render something. */
 function useChannelNameLookup(channelIds: readonly string[]) {
@@ -141,19 +188,10 @@ export function DiscussedInChannels({
     { enabled: visible.length > 0 },
   );
   const profiles = profilesQuery.data?.profiles;
-  // Hits are sorted newest first, so the first hit per channel is the one a
-  // click should land on (and the one worth quoting). The origin channel has
-  // no such hit: the `h` tag proves only the channel, so its row navigates
-  // to the channel without claiming any particular message.
-  const latestHitByChannel = React.useMemo(() => {
-    const byChannel = new Map<string, SearchHit>();
-    for (const hit of hits) {
-      if (hit.channelId && !byChannel.has(hit.channelId)) {
-        byChannel.set(hit.channelId, hit);
-      }
-    }
-    return byChannel;
-  }, [hits]);
+  // The origin channel has no quotable hit: the `h` tag proves only the
+  // channel, so its row navigates to the channel without claiming any
+  // particular message.
+  const latestHitByChannel = useLatestHitByChannel(hits);
   if (channels.length === 0) return null;
 
   const hiddenCount = channels.length - visible.length;
@@ -173,21 +211,14 @@ export function DiscussedInChannels({
         {visible.map((channel) => {
           const latestHit = latestHitByChannel.get(channel.id);
           const name = channelName(channel.id, channel.name);
-          const opensForum =
-            latestHit != null &&
-            (latestHit.kind === KIND_FORUM_POST ||
-              latestHit.kind === KIND_FORUM_COMMENT);
-          const openConversation = () => {
-            if (!latestHit) {
-              void goChannel(channel.id);
-              return;
-            }
-            if (!projectConversationPanel || opensForum) {
-              void openSearchHit(latestHit);
-              return;
-            }
-            projectConversationPanel.openConversation(latestHit);
-          };
+          const openConversation = () =>
+            openDiscussionHit({
+              channelId: channel.id,
+              goChannel,
+              latestHit,
+              openSearchHit,
+              panel: projectConversationPanel,
+            });
           return (
             <div
               className="group relative flex w-full min-w-0 items-start gap-2.5 px-3 py-2 transition-colors hover:bg-muted/30"
@@ -277,7 +308,7 @@ const NAME_LIST_MAX = 3;
 function DiscussionMessagePreview({ content }: { content: string }) {
   return (
     <Markdown
-      className="inbox-preview-markdown mt-0.5 text-inherit leading-4"
+      className="inbox-preview-markdown mt-0.5 text-inherit leading-6"
       content={discussionSnippet(content)}
       interactive={false}
     />
@@ -336,7 +367,9 @@ function DiscussionNameList({
 /**
  * Full-width channel list for the workspace "Channels" tab: every channel
  * where the repository (or its PRs/issues) is linked in chat, with the
- * people who discussed it there.
+ * people who discussed it there. Clicking a row opens the latest matching
+ * conversation in the side panel (whose header still jumps to the channel)
+ * rather than leaving the project view.
  */
 export function DiscussionChannelsPanel({
   query,
@@ -345,13 +378,17 @@ export function DiscussionChannelsPanel({
   query: string;
   repositoryName: string;
 }) {
-  const { channels, isLoading, isTruncated } = useDiscussionChannels(query);
-  const { goChannel } = useAppNavigation();
+  const { channels, hits, isLoading, isTruncated } =
+    useDiscussionChannels(query);
+  const { goChannel, openSearchHit } = useAppNavigation();
+  const projectConversationPanel = useProjectConversationPanel();
+  const latestHitByChannel = useLatestHitByChannel(hits);
   const channelIds = React.useMemo(
     () => channels.map((channel) => channel.id),
     [channels],
   );
   const channelName = useChannelNameLookup(channelIds);
+
   const profilesQuery = useUsersBatchQuery(
     channels.flatMap((channel) => channel.participants),
     { enabled: channels.length > 0 },
@@ -363,7 +400,10 @@ export function DiscussionChannelsPanel({
   }
   if (channels.length === 0) {
     return (
-      <p className="px-4 py-6 text-sm text-muted-foreground">
+      <p
+        className="px-4 py-6 text-sm text-muted-foreground"
+        data-testid="project-discussion-channels-panel"
+      >
         No channels reference this repository yet. Paste its link (or a review
         or task link) in a channel and it will show up here.
       </p>
@@ -379,10 +419,11 @@ export function DiscussionChannelsPanel({
   );
 
   return (
-    <div>
+    <div className="px-4" data-testid="project-discussion-channels-panel">
       <ul data-testid="discussion-channels">
         {channels.map((channel) => {
           const name = channelName(channel.id, channel.name);
+          const latestHit = latestHitByChannel.get(channel.id);
           return (
             <li className="relative" key={channel.id}>
               <ProjectEntityListRow
@@ -397,7 +438,15 @@ export function DiscussionChannelsPanel({
                 dateSeconds={channel.lastActivityAt}
                 dateTestId="project-channel-row-date"
                 icon={<Hash className="h-3.5 w-3.5 text-muted-foreground/70" />}
-                onClick={() => void goChannel(channel.id)}
+                onClick={() =>
+                  openDiscussionHit({
+                    channelId: channel.id,
+                    goChannel,
+                    latestHit,
+                    openSearchHit,
+                    panel: projectConversationPanel,
+                  })
+                }
                 people={channel.participants}
                 peopleTestId="project-channel-participants"
                 profiles={profiles}
@@ -411,7 +460,11 @@ export function DiscussionChannelsPanel({
                 }}
                 testId="project-channel-row"
                 title={`#${name}`}
-                titleAttr={`Open #${name}`}
+                titleAttr={
+                  latestHit
+                    ? `Open the latest conversation in #${name}`
+                    : `Open #${name}`
+                }
               />
             </li>
           );
diff --git a/desktop/src/features/projects/ui/IssueAssigneesRow.tsx b/desktop/src/features/projects/ui/IssueAssigneesRow.tsx
index 4da5123814a..74130447270 100644
--- a/desktop/src/features/projects/ui/IssueAssigneesRow.tsx
+++ b/desktop/src/features/projects/ui/IssueAssigneesRow.tsx
@@ -267,7 +267,9 @@ export function IssueAssigneesRow({
       {canSelfAssign && viewer ? (
         <Button
           className={cn(
-            "h-5 px-1 text-xs text-muted-foreground hover:text-foreground",
+            contextActions
+              ? "h-5 px-1 text-xs text-muted-foreground hover:text-foreground"
+              : "h-5 px-0 text-xs text-primary hover:bg-transparent hover:text-primary hover:underline",
             contextActions && PROJECT_CONTEXT_ACTION_BUTTON_CLASS,
           )}
           data-testid={`${testIdPrefix}-self-assign`}
diff --git a/desktop/src/features/projects/ui/ProjectAgentChatPanel.tsx b/desktop/src/features/projects/ui/ProjectAgentChatPanel.tsx
index 7aef6d0212e..14013a6157a 100644
--- a/desktop/src/features/projects/ui/ProjectAgentChatPanel.tsx
+++ b/desktop/src/features/projects/ui/ProjectAgentChatPanel.tsx
@@ -295,8 +295,9 @@ export function ProjectAgentChatPanel({
             toolbarExtraActions={
               <>
                 <AgentContextPayloadPreview
+                  iconOnly
                   payload={contextPayload}
-                  triggerLabel="Context"
+                  triggerLabel="Preview message context"
                 />
                 {conversation ? (
                   <Button
diff --git a/desktop/src/features/projects/ui/ProjectAgentSubmittedContextPill.test.mjs b/desktop/src/features/projects/ui/ProjectAgentSubmittedContextPill.test.mjs
new file mode 100644
index 00000000000..82b49eb036d
--- /dev/null
+++ b/desktop/src/features/projects/ui/ProjectAgentSubmittedContextPill.test.mjs
@@ -0,0 +1,61 @@
+import assert from "node:assert/strict";
+import { after, afterEach, before, test } from "node:test";
+
+import { JSDOM } from "jsdom";
+
+const dom = new JSDOM("<!doctype html><html><body></body></html>", {
+  url: "http://localhost",
+});
+
+before(() => {
+  Object.assign(globalThis, {
+    document: dom.window.document,
+    HTMLElement: dom.window.HTMLElement,
+    IS_REACT_ACT_ENVIRONMENT: true,
+    window: dom.window,
+  });
+  dom.window.matchMedia = () => ({
+    matches: false,
+    addEventListener() {},
+    removeEventListener() {},
+  });
+});
+
+afterEach(async () => {
+  const { cleanup } = await import("@testing-library/react");
+  cleanup();
+});
+
+after(() => dom.window.close());
+
+test("keeps submitted context collapsed until explicitly expanded", async () => {
+  const { createElement } = await import("react");
+  const { fireEvent, render, screen } = await import("@testing-library/react");
+  const { ProjectAgentSubmittedContextPill } = await import(
+    "./ProjectAgentSubmittedContextPill.tsx"
+  );
+  const payload =
+    '---\nCurrent Buzz project page:\n- Project: "Projects"\n- View: Activity';
+
+  render(createElement(ProjectAgentSubmittedContextPill, { payload }));
+
+  const trigger = screen.getByRole("button", { name: "Show sent context" });
+  assert.equal(trigger.getAttribute("aria-expanded"), "false");
+  assert.equal(
+    screen.queryByTestId("project-agent-sent-context-payload"),
+    null,
+  );
+
+  fireEvent.click(trigger);
+  assert.equal(trigger.getAttribute("aria-expanded"), "true");
+  const disclosed = screen.getByTestId("project-agent-sent-context-payload");
+  assert.equal(disclosed.getAttribute("aria-label"), "Sent project context");
+  assert.equal(disclosed.getAttribute("tabindex"), "0");
+  assert.equal(disclosed.textContent, payload);
+
+  fireEvent.click(trigger);
+  assert.equal(
+    screen.queryByTestId("project-agent-sent-context-payload"),
+    null,
+  );
+});
diff --git a/desktop/src/features/projects/ui/ProjectAgentSubmittedContextPill.tsx b/desktop/src/features/projects/ui/ProjectAgentSubmittedContextPill.tsx
new file mode 100644
index 00000000000..c9c98244688
--- /dev/null
+++ b/desktop/src/features/projects/ui/ProjectAgentSubmittedContextPill.tsx
@@ -0,0 +1,39 @@
+import { ChevronDown, Info } from "lucide-react";
+import * as React from "react";
+
+import { cn } from "@/shared/lib/cn";
+
+export const ProjectAgentSubmittedContextPill = React.memo(
+  function ProjectAgentSubmittedContextPill({ payload }: { payload: string }) {
+    const [open, setOpen] = React.useState(false);
+
+    return (
+      <div className="pb-1 pl-11 pr-2" data-testid="project-agent-sent-context">
+        <button
+          aria-expanded={open}
+          aria-label={open ? "Hide sent context" : "Show sent context"}
+          className="inline-flex h-6 items-center gap-1 rounded-full border border-border/45 bg-muted/20 px-2 text-2xs text-muted-foreground transition-colors hover:border-border/70 hover:bg-muted/35 hover:text-foreground"
+          onClick={() => setOpen((current) => !current)}
+          type="button"
+        >
+          <Info className="h-3 w-3" />
+          <span>Sent context</span>
+          <ChevronDown
+            className={cn("h-3 w-3 transition-transform", open && "rotate-180")}
+          />
+        </button>
+        {open ? (
+          <section
+            aria-label="Sent project context"
+            className="mt-1 max-h-48 overflow-auto whitespace-pre-wrap break-words rounded-lg bg-muted/25 p-2 font-mono text-xs text-muted-foreground outline-hidden focus-visible:ring-1 focus-visible:ring-ring"
+            data-testid="project-agent-sent-context-payload"
+            // biome-ignore lint/a11y/noNoninteractiveTabindex: the scrollable disclosure must receive keyboard focus
+            tabIndex={0}
+          >
+            {payload}
+          </section>
+        ) : null}
+      </div>
+    );
+  },
+);
diff --git a/desktop/src/features/projects/ui/ProjectCards.tsx b/desktop/src/features/projects/ui/ProjectCards.tsx
index b8c3ffd273d..e9672d643bd 100644
--- a/desktop/src/features/projects/ui/ProjectCards.tsx
+++ b/desktop/src/features/projects/ui/ProjectCards.tsx
@@ -20,10 +20,8 @@ import type {
   ProjectActivitySummary,
 } from "@/features/projects/hooks";
 import {
-  formatExactTimestamp,
   getProjectUpdatedAt,
   listRowDescription,
-  relativeTime,
 } from "@/features/projects/lib/projectsViewHelpers";
 import type { ProjectRepoUnavailableReason } from "@/features/projects/lib/projectRepoAvailability";
 import { projectShareLink } from "@/features/projects/lib/projectShareLinks";
@@ -55,39 +53,6 @@ import { ProjectEntityListRow } from "./ProjectEntityListRow";
 import { PROJECT_GRID_CARD_BODY_CLASS } from "./projectGridCardStyles";
 import { ProjectListRowMenu } from "./ProjectListRowMenu";
 
-function ProjectUpdatedLabel({
-  profiles,
-  project,
-  summary,
-}: {
-  profiles?: UserProfileLookup;
-  project: Project;
-  summary: ProjectActivitySummary | undefined;
-}) {
-  const updatedAt = getProjectUpdatedAt(project, summary);
-  const latestCommit = summary?.latestCommit;
-  const authorLabel = latestCommit?.author
-    ? resolveUserLabel({ profiles, pubkey: latestCommit.author })
-    : null;
-
-  return (
-    <Tooltip>
-      <TooltipTrigger asChild>
-        <span className="whitespace-nowrap text-xs leading-4 text-muted-foreground/70">
-          {relativeTime(updatedAt)}
-        </span>
-      </TooltipTrigger>
-      <TooltipContent className="max-w-96 break-words">
-        {latestCommit
-          ? `${latestCommit.title || latestCommit.commit.slice(0, 7)}${
-              authorLabel ? ` · ${authorLabel}` : ""
-            } · ${formatExactTimestamp(latestCommit.createdAt)}`
-          : `Created ${formatExactTimestamp(project.createdAt)}`}
-      </TooltipContent>
-    </Tooltip>
-  );
-}
-
 export function ProjectPeopleStack({
   pubkeys,
   profiles,
@@ -489,7 +454,9 @@ type ProjectItemProps = {
   onOpenTerminal: (project: Project) => Promise<void> | void;
 };
 
-export function ProjectGridCard({
+// Memoized: these cards render in unbounded grids/lists; identity-stable
+// props from the caller keep re-renders scoped to genuinely changed cards.
+export const ProjectGridCard = React.memo(function ProjectGridCard({
   project,
   people,
   profiles,
@@ -504,7 +471,7 @@ export function ProjectGridCard({
 }: ProjectItemProps) {
   return (
     <Card
-      className="group relative flex min-h-40 flex-col overflow-hidden border-border/60 bg-transparent shadow-none transition-colors duration-150 hover:bg-muted/20"
+      className="group relative flex h-full min-h-40 flex-col overflow-hidden border-border/60 bg-transparent shadow-none transition-colors duration-150 hover:bg-muted/20"
       data-projects-grid-card
       data-testid={`project-card-${project.dtag}`}
     >
@@ -540,12 +507,7 @@ export function ProjectGridCard({
               </div>
             </div>
           </div>
-          <div className="pointer-events-auto relative z-10 flex shrink-0 items-center gap-1">
-            <ProjectUpdatedLabel
-              profiles={profiles}
-              project={project}
-              summary={summary}
-            />
+          <div className="pointer-events-auto relative z-10 shrink-0">
             <ProjectActionsMenu
               canDelete={canDelete}
               disabled={deleteDisabled}
@@ -581,9 +543,9 @@ export function ProjectGridCard({
       </div>
     </Card>
   );
-}
+});
 
-export function ProjectListRow({
+export const ProjectListRow = React.memo(function ProjectListRow({
   project,
   people,
   profiles,
@@ -613,6 +575,7 @@ export function ProjectListRow({
           <span>{repositoryCount}</span>
         </span>
       }
+      affiliationClassName="w-auto"
       affiliationTestId="projects-row-context"
       affiliationTitle={`${repositoryCount} ${
         repositoryCount === 1 ? "repository" : "repositories"
@@ -656,7 +619,7 @@ export function ProjectListRow({
       }
     />
   );
-}
+});
 
 /** Compact, borderless repository row for the overview side rail. */
 export function ProjectRailRow({
diff --git a/desktop/src/features/projects/ui/ProjectCommitCopyButton.tsx b/desktop/src/features/projects/ui/ProjectCommitCopyButton.tsx
index 0930146e2db..faadaf5d2c4 100644
--- a/desktop/src/features/projects/ui/ProjectCommitCopyButton.tsx
+++ b/desktop/src/features/projects/ui/ProjectCommitCopyButton.tsx
@@ -15,12 +15,16 @@ export function CopyTextButton({
   text: string;
 }) {
   const [copied, setCopied] = React.useState(false);
-  const handleCopy = React.useCallback(() => {
-    void writeTextToClipboard(text).then(() => {
-      setCopied(true);
-      setTimeout(() => setCopied(false), 2_000);
-    });
-  }, [text]);
+  const handleCopy = React.useCallback(
+    (event: React.MouseEvent<HTMLButtonElement>) => {
+      event.stopPropagation();
+      void writeTextToClipboard(text).then(() => {
+        setCopied(true);
+        setTimeout(() => setCopied(false), 2_000);
+      });
+    },
+    [text],
+  );
 
   return (
     <button
@@ -30,6 +34,7 @@ export function CopyTextButton({
         className,
       )}
       onClick={handleCopy}
+      onKeyDown={(event) => event.stopPropagation()}
       type="button"
     >
       {copied ? (
diff --git a/desktop/src/features/projects/ui/ProjectCommitDetailPanel.tsx b/desktop/src/features/projects/ui/ProjectCommitDetailPanel.tsx
index f36e332650f..96773a08205 100644
--- a/desktop/src/features/projects/ui/ProjectCommitDetailPanel.tsx
+++ b/desktop/src/features/projects/ui/ProjectCommitDetailPanel.tsx
@@ -1,4 +1,4 @@
-import { Calendar, GitCommitHorizontal, Hash } from "lucide-react";
+import { Calendar, GitCommitHorizontal, Hash, UserRound } from "lucide-react";
 
 import type { Repository } from "@/features/projects/hooks";
 import { commitDiscussionQuery } from "@/features/projects/lib/discussionChannels";
@@ -48,86 +48,108 @@ export function ProjectCommitDetailPanel({
   project: Repository;
 }) {
   const shortHash = commit?.shortHash ?? commitHash.slice(0, 7);
-  const fileCount = diff?.files.length;
 
   return (
     <div
-      className={PROJECT_DETAIL_READING_COLUMN_CLASS}
+      className="flex w-full flex-1 flex-col overflow-hidden"
       data-project-detail-panel
       data-testid="project-commit-detail"
     >
-      <header className="space-y-2 px-6 pb-3 pt-5">
-        <h3 className="line-clamp-2 text-lg font-semibold leading-6 text-foreground">
-          {commit?.subject ?? shortHash}{" "}
-          <ShareLinkButton
-            className="ml-1 inline-flex h-7 w-7 align-text-bottom"
-            label="Copy commit link"
-            link={commitShareLink(project, commit?.hash ?? commitHash)}
-            testId="project-commit-copy-link"
-          />
-        </h3>
-        <p className="flex flex-wrap items-center gap-x-1.5 gap-y-1 text-xs text-muted-foreground">
-          <span>Committed</span>
-          {commit ? (
-            <span
-              className="shrink-0 whitespace-nowrap"
-              title={commitDateLabel(commit.timestamp)}
-            >
-              {commitDateLabel(commit.timestamp)}
-            </span>
-          ) : null}
-          <ProjectOriginReference
-            agentName={originAgentName}
-            channelId={originChannelId}
-          />
-        </p>
-      </header>
-      <ProjectDetailMetaList>
-        <ProjectDetailMetaRow icon={Hash} label="Commit">
-          <span className="inline-flex min-w-0 items-center gap-1 font-mono text-xs">
-            {shortHash}
-            <CopyCommitHashButton
-              className="h-6 w-6"
-              hash={commit?.hash ?? commitHash}
+      <div className={PROJECT_DETAIL_READING_COLUMN_CLASS}>
+        <header className="space-y-1 px-6 pb-3 pt-5">
+          <h3 className="line-clamp-2 text-lg font-semibold leading-6 text-foreground">
+            {commit?.subject ?? shortHash}{" "}
+            <ShareLinkButton
+              className="ml-0.5 inline-flex h-auto w-auto align-middle hover:bg-transparent"
+              label="Copy commit link"
+              link={commitShareLink(project, commit?.hash ?? commitHash)}
+              testId="project-commit-copy-link"
             />
-          </span>
-        </ProjectDetailMetaRow>
-        {commit ? (
-          <ProjectDetailMetaRow icon={Calendar} label="Date">
-            <span className="text-muted-foreground">
-              {commitDateLabel(commit.timestamp)}
-            </span>
-          </ProjectDetailMetaRow>
-        ) : null}
-        {diff ? (
-          <ProjectDetailMetaRow icon={GitCommitHorizontal} label="Changes">
-            <span className="flex items-center gap-1.5">
-              <span className="text-green-500">+{diff.additions}</span>
-              <span className="text-destructive">-{diff.deletions}</span>
+          </h3>
+          <p className="flex flex-wrap items-center gap-x-1.5 gap-y-1 text-xs text-muted-foreground">
+            <span>Committed</span>
+            {commit ? (
+              <span
+                className="shrink-0 whitespace-nowrap"
+                title={commitDateLabel(commit.timestamp)}
+              >
+                {commitDateLabel(commit.timestamp)}
+              </span>
+            ) : null}
+            <ProjectOriginReference
+              agentName={originAgentName}
+              channelId={originChannelId}
+            />
+          </p>
+        </header>
+        <ProjectDetailMetaList>
+          <ProjectDetailMetaRow icon={Hash} label="Commit">
+            <span className="inline-flex min-w-0 items-center gap-1 font-mono text-xs">
+              {shortHash}
+              <CopyCommitHashButton
+                className="h-6 w-6"
+                hash={commit?.hash ?? commitHash}
+              />
             </span>
           </ProjectDetailMetaRow>
+          {commit?.authorName ? (
+            <ProjectDetailMetaRow icon={UserRound} label="Author">
+              <span
+                className="min-w-0 truncate text-muted-foreground"
+                title={commit.authorEmail}
+              >
+                {commit.authorName}
+              </span>
+            </ProjectDetailMetaRow>
+          ) : null}
+          {commit ? (
+            <ProjectDetailMetaRow icon={Calendar} label="Date">
+              <span className="text-muted-foreground">
+                {commitDateLabel(commit.timestamp)}
+              </span>
+            </ProjectDetailMetaRow>
+          ) : null}
+          {diff ? (
+            <ProjectDetailMetaRow icon={GitCommitHorizontal} label="Changes">
+              <span className="flex items-center gap-1.5">
+                <span className="text-green-500">+{diff.additions}</span>
+                <span className="text-destructive">-{diff.deletions}</span>
+              </span>
+            </ProjectDetailMetaRow>
+          ) : null}
+        </ProjectDetailMetaList>
+        {diff?.commitBody ? (
+          <ProjectDetailSection defaultOpen title="Description">
+            <ProjectRichContent
+              content={diff.commitBody}
+              hardLineBreaks={false}
+            />
+          </ProjectDetailSection>
         ) : null}
-      </ProjectDetailMetaList>
-      {diff?.commitBody ? (
-        <ProjectDetailSection defaultOpen title="Description">
-          <ProjectRichContent
-            content={diff.commitBody}
-            hardLineBreaks={false}
-          />
-        </ProjectDetailSection>
-      ) : null}
-      <DiscussedInChannels
-        className="mx-6 mb-4"
-        entityLabel="this commit"
-        query={commitDiscussionQuery({
-          hash: commit?.hash ?? commitHash,
-          shortHash: commit?.shortHash,
-        })}
-        testId="commit-discussed-in"
-      />
-      <ProjectDetailSection count={fileCount} defaultOpen title="Files changed">
-        <div className="-mx-6">
+        <DiscussedInChannels
+          className="mx-6 mb-4"
+          entityLabel="this commit"
+          query={commitDiscussionQuery({
+            hash: commit?.hash ?? commitHash,
+            shortHash: commit?.shortHash,
+          })}
+          testId="commit-discussed-in"
+        />
+      </div>
+      <ProjectDetailSection
+        className="flex min-h-0 flex-1 flex-col"
+        contentClassName="flex min-h-0 flex-1 flex-col"
+        defaultOpen
+        headerClassName="mx-auto max-w-3xl"
+        title="Files changed"
+      >
+        {/* Full-bleed: cancel the section's inner padding so the file
+            tree + diff grid spans the whole content column, and let it
+            grow to the bottom of the scrollport when the page is short. */}
+        <div className="-mx-6 -mb-6 flex min-h-0 flex-1 flex-col">
           <ProjectDiffFilesPanel
+            className="min-h-0 flex-1"
+            fileTreeClassName="max-h-none"
             diff={diff}
             embedded
             error={diffError}
diff --git a/desktop/src/features/projects/ui/ProjectDetailChrome.tsx b/desktop/src/features/projects/ui/ProjectDetailChrome.tsx
index 64810363f2d..f9740b8aa32 100644
--- a/desktop/src/features/projects/ui/ProjectDetailChrome.tsx
+++ b/desktop/src/features/projects/ui/ProjectDetailChrome.tsx
@@ -3,9 +3,6 @@ import type * as React from "react";
 
 import { AppTopChromePortal } from "@/app/AppTopChromePortal";
 import type { Project, Repository } from "@/features/projects/hooks";
-import { projectShareLink } from "@/features/projects/lib/projectShareLinks";
-import type { EntityLinkTab } from "@/shared/lib/entityLink";
-import { ShareLinkButton } from "./ShareLinkButton";
 
 export type ProjectDetailWorkItemCrumb = {
   category: string;
@@ -21,7 +18,6 @@ export function ProjectDetailChrome({
   onGoProjects,
   project,
   repository,
-  shareTab,
 }: {
   /** Repository-scoped controls, rendered left of the project-wide ones. */
   actions?: React.ReactNode;
@@ -31,7 +27,6 @@ export function ProjectDetailChrome({
   onGoProjects: () => void;
   project: Project;
   repository: Repository;
-  shareTab?: EntityLinkTab;
 }) {
   return (
     <AppTopChromePortal>
@@ -120,12 +115,6 @@ export function ProjectDetailChrome({
           )}
         </nav>
         <div className="ml-auto flex shrink-0 items-center gap-0.5">
-          <ShareLinkButton
-            className="text-sidebar-foreground/65 hover:bg-sidebar-accent hover:text-sidebar-accent-foreground"
-            label="Copy project link"
-            link={projectShareLink(project, shareTab)}
-            testId="project-detail-copy-link"
-          />
           {actions}
         </div>
       </div>
diff --git a/desktop/src/features/projects/ui/ProjectDetailFeedPanels.tsx b/desktop/src/features/projects/ui/ProjectDetailFeedPanels.tsx
index 793b1de02cf..36238689857 100644
--- a/desktop/src/features/projects/ui/ProjectDetailFeedPanels.tsx
+++ b/desktop/src/features/projects/ui/ProjectDetailFeedPanels.tsx
@@ -162,7 +162,10 @@ export function ContributorsPanel({
   }
 
   return (
-    <div className={PROJECT_DETAIL_PANEL_CLASS} data-project-detail-panel>
+    <div
+      className={`${PROJECT_DETAIL_PANEL_CLASS} mx-4`}
+      data-project-detail-panel
+    >
       {rows.map((row) => (
         <div
           className="flex min-h-9 min-w-0 items-center gap-2 px-4 py-1.5 transition-colors hover:bg-muted/35"
@@ -181,6 +184,7 @@ export function ContributorsPanel({
           />
           <span
             className="min-w-0 flex-1 truncate text-sm font-medium text-foreground"
+            data-projects-text-priority="primary"
             title={row.label}
           >
             {row.label}
diff --git a/desktop/src/features/projects/ui/ProjectDetailScreen.tsx b/desktop/src/features/projects/ui/ProjectDetailScreen.tsx
index 8d151167104..b7f39a8cf33 100644
--- a/desktop/src/features/projects/ui/ProjectDetailScreen.tsx
+++ b/desktop/src/features/projects/ui/ProjectDetailScreen.tsx
@@ -8,11 +8,7 @@ import {
   type Repository,
   useProjectQuery,
   useProjectIssuesQuery,
-  useProjectLocalRepoDiffQuery,
-  useProjectLocalRepoSnapshotQuery,
-  useProjectRepoDiffQuery,
   useProjectPullRequestsQuery,
-  useProjectRepoSnapshotQuery,
   useProjectsQuery,
   useRepoStateQuery,
 } from "@/features/projects/hooks";
@@ -32,18 +28,13 @@ import { ProfilePanelProvider } from "@/shared/context/ProfilePanelContext";
 import { useHistorySearchState } from "@/shared/hooks/useHistorySearchState";
 import { ViewLoadingFallback } from "@/shared/ui/ViewLoadingFallback";
 import { useCommunities } from "@/features/communities/useCommunities";
-import { useProjectCommitDiffQuery } from "@/features/projects/useProjectCommitDiff";
 import {
   projectBranchCreationReason,
   projectBranchManagementState,
   projectBranchOptionsFromSync,
   resolveProjectDefaultBranch,
 } from "@/features/projects/lib/projectBranches";
-import { normalizeRepositoryUrl } from "@/features/projects/lib/projectsViewHelpers";
-import {
-  shareTabForWorkspaceTab,
-  workspaceTabForShareTab,
-} from "@/features/projects/lib/projectShareLinks";
+import { workspaceTabForShareTab } from "@/features/projects/lib/projectShareLinks";
 import {
   buildProjectDetailAgentContext,
   type ProjectDetailAgentContext,
@@ -70,10 +61,7 @@ import { ProjectDetailChrome } from "./ProjectDetailChrome";
 import { ProjectConversationPanelController } from "./ProjectConversationPanelContext";
 import { ProjectDetailRightPanel } from "./ProjectDetailRightPanel";
 import { ProjectDetailUnavailableState } from "./ProjectDetailUnavailableState";
-import {
-  ProjectChatPanelControl,
-  ProjectRightPanelControls,
-} from "./ProjectRightPanelControls";
+import { ProjectRightPanelControls } from "./ProjectRightPanelControls";
 import { buildProjectDetailCrumbs } from "./useProjectDetailCrumbs";
 import { useProjectDetailPeople } from "./useProjectDetailPeople";
 import { useProjectProfilePanel } from "./useProjectProfilePanel";
@@ -81,6 +69,10 @@ import { useProjectRepositoryPanel } from "./useProjectRepositoryPanel";
 import { useRepositoryFileContentSource } from "./useRepositoryFileContentSource";
 import { useProjectPanelWidths } from "./useProjectPanelWidths";
 import { useProjectRepositoryOpenActions } from "./useProjectRepositoryOpenActions";
+import {
+  useProjectDetailGitViews,
+  useRetainedPullRequestSelection,
+} from "./useRetainedProjectGitViews";
 import {
   PROJECT_REPOSITORY_SEARCH_KEYS,
   type ProjectDetailScreenProps,
@@ -192,76 +184,55 @@ export function ProjectDetailScreen(props: ProjectDetailScreenProps) {
     [],
   );
   const issuesQuery = useProjectIssuesQuery(repository);
-  const selectedBranchPullRequest = React.useMemo(() => {
-    const projectRepositories = new Set(
-      (repository?.cloneUrls ?? []).map(normalizeRepositoryUrl),
-    );
-    const matches =
-      pullRequestsQuery.data?.filter(
-        (pullRequest) =>
-          pullRequest.branchName === activeBranch &&
-          pullRequest.cloneUrls.some((cloneUrl) =>
-            projectRepositories.has(normalizeRepositoryUrl(cloneUrl)),
-          ),
-      ) ?? [];
-    return matches.length === 1 ? matches[0] : null;
-  }, [activeBranch, pullRequestsQuery.data, repository?.cloneUrls]);
-  const openBranchPullRequest =
-    selectedBranchPullRequest?.status === "Open" ||
-    selectedBranchPullRequest?.status === "Draft"
-      ? selectedBranchPullRequest
-      : null;
-  const activeRepoPullRequest =
-    pullRequestsQuery.data?.find((item) => item.id === selectedPullRequestId) ??
-    selectedBranchPullRequest;
+  const {
+    activeRepoPullRequest,
+    openBranchPullRequest,
+    selectedBranchPullRequest,
+    selectedPullRequest,
+  } = useRetainedPullRequestSelection({
+    activeBranch,
+    isFetching: pullRequestsQuery.isFetching,
+    pullRequests: pullRequestsQuery.data,
+    repository,
+    selectedPullRequestId,
+  });
   const [repoSource, setRepoSource] = React.useState<"remote" | "local">(
     "remote",
   );
   const repositoryPanel = useProjectRepositoryPanel(
     `${repository?.id ?? ""}:${activeTab}:${selectedPullRequestId ?? ""}:${selectedIssueId ?? ""}:${selectedCommitHash ?? ""}`,
   );
-  const repoSnapshotQuery = useProjectRepoSnapshotQuery(
-    repository,
+  const {
+    commitDiffQuery,
+    displayedRepoDiff,
+    displayedRepoDiffError,
+    displayedRepoDiffLoading,
+    displayedRepoSnapshot,
+    localRepoSnapshotQuery,
+    repoSnapshotQuery,
+  } = useProjectDetailGitViews({
     activeBranch,
-    selectedTag ? null : selectedBranchPullRequest,
+    activeRepoPullRequest,
     activeTag,
-    repoRemote.host.kind === "buzz",
-  );
+    isBuzzHost: repoRemote.host.kind === "buzz",
+    repository,
+    reposDir: activeCommunity?.reposDir,
+    repoSource,
+    selectedBranchPullRequest,
+    selectedCommitHash,
+    selectedTag,
+  });
   const memberChannelIds = useMemberChannelIds();
   const remoteUnavailableReason =
     repoRemote.host.kind === "buzz" &&
     !repoSnapshotQuery.isLoading &&
-    (!repoSnapshotQuery.data || repoSnapshotQuery.error)
+    !displayedRepoSnapshot
       ? refineRepoUnavailableReason({
           reason: projectRepoUnavailableReason(repoSnapshotQuery.error),
           repositoryChannelId: repository?.channelId,
           memberChannelIds,
         })
       : undefined;
-  const repoDiffQuery = useProjectRepoDiffQuery(
-    repository,
-    activeBranch,
-    activeRepoPullRequest,
-    repoSource === "remote",
-  );
-  const localRepoDiffQuery = useProjectLocalRepoDiffQuery(
-    repository,
-    activeCommunity?.reposDir,
-    activeBranch,
-    activeRepoPullRequest,
-    repoSource === "local" && Boolean(activeRepoPullRequest),
-  );
-  const commitDiffQuery = useProjectCommitDiffQuery(
-    repository,
-    selectedCommitHash,
-    repoSource,
-    activeCommunity?.reposDir,
-  );
-  const localRepoSnapshotQuery = useProjectLocalRepoSnapshotQuery(
-    repository,
-    activeCommunity?.reposDir,
-    activeBranch,
-  );
   const repoSyncStatusQuery = useProjectRepoSyncStatusQuery(
     repository,
     activeCommunity?.reposDir,
@@ -290,15 +261,6 @@ export function ProjectDetailScreen(props: ProjectDetailScreenProps) {
   const hasLocalCheckout = Boolean(
     localRepoSnapshotQuery.data || repoSyncStatusQuery.data?.localPath,
   );
-  const hasRemoteSnapshot = snapshotHasContent(repoSnapshotQuery.data);
-  const displayedRepoDiff =
-    repoSource === "local" ? localRepoDiffQuery.data : repoDiffQuery.data;
-  const displayedRepoDiffError =
-    repoSource === "local" ? localRepoDiffQuery.error : repoDiffQuery.error;
-  const displayedRepoDiffLoading =
-    repoSource === "local"
-      ? localRepoDiffQuery.isLoading
-      : repoDiffQuery.isLoading;
   const branchOptionsWithLocal = projectBranchOptionsFromSync(
     branchOptions,
     repoSyncStatusQuery.data,
@@ -315,7 +277,7 @@ export function ProjectDetailScreen(props: ProjectDetailScreenProps) {
       ),
       remoteBranch: repoSyncStatusQuery.data?.remoteBranch,
       remoteHead: repoSyncStatusQuery.data?.remoteHead,
-      snapshotCommit: repoSnapshotQuery.data?.latestCommit?.hash,
+      snapshotCommit: displayedRepoSnapshot?.latestCommit?.hash,
     });
   const handleBranchChange = React.useCallback(
     (branch: string | null) => {
@@ -492,10 +454,21 @@ export function ProjectDetailScreen(props: ProjectDetailScreenProps) {
       setRepoSource("remote");
       return;
     }
-    if (repoSource === "remote" && !hasRemoteSnapshot && hasLocalCheckout) {
+    if (
+      !selectedPullRequestId &&
+      repoSource === "remote" &&
+      !snapshotHasContent(displayedRepoSnapshot) &&
+      hasLocalCheckout
+    ) {
       setRepoSource("local");
     }
-  }, [hasLocalCheckout, hasRemoteSnapshot, repoSource, selectedTag]);
+  }, [
+    displayedRepoSnapshot,
+    hasLocalCheckout,
+    repoSource,
+    selectedPullRequestId,
+    selectedTag,
+  ]);
   const {
     contributorActivityCounts,
     contributorPubkeys,
@@ -708,23 +681,20 @@ export function ProjectDetailScreen(props: ProjectDetailScreenProps) {
       />
     );
   }
-  const repoContributors = repoSnapshotQuery.data?.contributors ?? [];
+  const repoContributors = displayedRepoSnapshot?.contributors ?? [];
   const displayedRepositorySnapshot =
     repoSource === "local"
       ? (localRepoSnapshotQuery.data?.snapshot ?? null)
-      : repoSnapshotQuery.data;
+      : displayedRepoSnapshot;
   const displayedRepositoryContributors =
     displayedRepositorySnapshot?.contributors ?? repoContributors;
   const displayedRepositoryFiles = displayedRepositorySnapshot?.files ?? [];
-  const selectedPullRequest =
-    pullRequestsQuery.data?.find((item) => item.id === selectedPullRequestId) ??
-    null;
   const selectedIssue =
     issuesQuery.data?.find((item) => item.id === selectedIssueId) ?? null;
   const displayedSnapshotCommits =
     repoSource === "local"
       ? (localRepoSnapshotQuery.data?.snapshot.commits ?? [])
-      : (repoSnapshotQuery.data?.commits ?? []);
+      : (displayedRepoSnapshot?.commits ?? []);
   const selectedCommit = selectedCommitHash
     ? (displayedSnapshotCommits.find(
         (commit) => commit.hash === selectedCommitHash,
@@ -770,15 +740,6 @@ export function ProjectDetailScreen(props: ProjectDetailScreenProps) {
       terminalAvailable={projectTerminalContext !== null}
     />
   );
-  const chatPanelAction = (
-    <ProjectChatPanelControl
-      collapsed={repositoryPanel.collapsed}
-      mode={repositoryPanel.mode}
-      onCollapse={repositoryPanel.collapse}
-      onExpand={repositoryPanel.expand}
-      onModeChange={repositoryPanel.setMode}
-    />
-  );
   const detachedRepositoryPanel =
     !profilePanelPubkey && repositoryPanel.mode === "repository";
   const sharedHeaderBackdrop =
@@ -879,17 +840,15 @@ export function ProjectDetailScreen(props: ProjectDetailScreenProps) {
                 }}
                 project={project}
                 repository={repository}
-                shareTab={
-                  activeWorkItemCrumb
-                    ? undefined
-                    : shareTabForWorkspaceTab(activeTab)
-                }
               />
               <div
                 className="flex min-h-0 min-w-0 flex-1 flex-col overflow-x-hidden overflow-y-auto overscroll-y-none px-4 pb-4"
                 data-testid="project-detail-scroll"
               >
-                <div className="w-full space-y-3">
+                {/* min-h-full + flex chain lets the commit detail's diff pane
+                    grow to the bottom of the scrollport without forcing a
+                    taller page when content already overflows. */}
+                <div className="flex min-h-full w-full flex-col space-y-3">
                   <WorkspaceTabs
                     key={`${project.id}:${repository.id}:${tabsResetKey}`}
                     initialTab={
@@ -915,7 +874,6 @@ export function ProjectDetailScreen(props: ProjectDetailScreenProps) {
                       reposDir: activeCommunity?.reposDir,
                     }}
                     createPullRequestRequestKey={createPullRequestRequestKey}
-                    headerAction={chatPanelAction}
                     updatePullRequestAction={
                       openBranchPullRequest &&
                       repoSyncStatusQuery.data?.remoteHead &&
@@ -932,7 +890,6 @@ export function ProjectDetailScreen(props: ProjectDetailScreenProps) {
                     localSnapshot={localRepoSnapshotQuery.data}
                     localSnapshotError={localRepoSnapshotQuery.error}
                     localSnapshotLoading={localRepoSnapshotQuery.isLoading}
-                    onBranchChange={handleBranchChange}
                     onFilesContextChange={setFilesContext}
                     onOpenMergeRecoveryTerminal={
                       handleOpenMergeRecoveryTerminal
@@ -957,11 +914,14 @@ export function ProjectDetailScreen(props: ProjectDetailScreenProps) {
                     repoSource={repoSource}
                     selectedCommitHash={selectedCommitHash}
                     selectedIssueId={selectedIssueId}
+                    selectedPullRequest={selectedPullRequest}
                     selectedPullRequestId={selectedPullRequestId}
                     sharedHeaderBackdrop={sharedHeaderBackdrop}
-                    snapshot={repoSnapshotQuery.data}
+                    snapshot={displayedRepoSnapshot}
                     snapshotError={repoSnapshotQuery.error}
-                    snapshotLoading={repoSnapshotQuery.isLoading}
+                    snapshotLoading={
+                      repoSnapshotQuery.isLoading && !displayedRepoSnapshot
+                    }
                     sourceControls={filesSourceControls}
                     viewerGitIdentity={viewerGitIdentity}
                   />
diff --git a/desktop/src/features/projects/ui/ProjectDetailSection.tsx b/desktop/src/features/projects/ui/ProjectDetailSection.tsx
index 20271e035dc..56dc0aec347 100644
--- a/desktop/src/features/projects/ui/ProjectDetailSection.tsx
+++ b/desktop/src/features/projects/ui/ProjectDetailSection.tsx
@@ -10,16 +10,25 @@ import { cn } from "@/shared/lib/cn";
  */
 export function ProjectDetailSection({
   children,
+  className,
+  contentClassName,
   count,
   defaultOpen = true,
+  headerClassName,
   onOpenChange,
   open: openProp,
   testId,
   title,
 }: {
   children: React.ReactNode;
+  /** Extra classes for the outer section, e.g. flex growth in fill layouts. */
+  className?: string;
+  /** Extra classes for the expanded content wrapper. */
+  contentClassName?: string;
   count?: number;
   defaultOpen?: boolean;
+  /** Extra classes for the header row, e.g. to align it with a reading column while the content is full-bleed. */
+  headerClassName?: string;
   onOpenChange?: (open: boolean) => void;
   open?: boolean;
   testId?: string;
@@ -35,12 +44,16 @@ export function ProjectDetailSection({
 
   return (
     <section
+      className={className}
       data-open={open ? "true" : "false"}
       data-testid={testId ?? "project-detail-section"}
     >
       <button
         aria-expanded={open}
-        className="flex min-h-10 w-full min-w-0 items-center gap-2 px-6 py-2 text-left text-sm font-medium leading-5 text-foreground transition-colors hover:bg-muted/20"
+        className={cn(
+          "flex min-h-10 w-full min-w-0 items-center gap-2 px-6 py-2 text-left text-sm font-medium leading-5 text-foreground transition-colors hover:bg-muted/20",
+          headerClassName,
+        )}
         onClick={() => setOpen(!open)}
         type="button"
       >
@@ -59,7 +72,9 @@ export function ProjectDetailSection({
           ) : null}
         </span>
       </button>
-      {open ? <div className="px-6 pb-6 pt-1">{children}</div> : null}
+      {open ? (
+        <div className={cn("px-6 pb-6 pt-1", contentClassName)}>{children}</div>
+      ) : null}
     </section>
   );
 }
diff --git a/desktop/src/features/projects/ui/ProjectEntityListRow.tsx b/desktop/src/features/projects/ui/ProjectEntityListRow.tsx
index 10cd1f87a41..d0769e31e50 100644
--- a/desktop/src/features/projects/ui/ProjectEntityListRow.tsx
+++ b/desktop/src/features/projects/ui/ProjectEntityListRow.tsx
@@ -131,6 +131,7 @@ export function ProjectEntitySelectControl({
 
 export function ProjectEntityListRow({
   affiliation,
+  affiliationClassName,
   affiliationTestId,
   affiliationTitle,
   beforeDate,
@@ -158,6 +159,7 @@ export function ProjectEntityListRow({
   trailing,
 }: {
   affiliation?: React.ReactNode;
+  affiliationClassName?: string;
   affiliationTestId?: string;
   affiliationTitle?: string;
   beforeDate?: React.ReactNode;
@@ -292,7 +294,10 @@ export function ProjectEntityListRow({
       ) : null}
       {affiliation ? (
         <span
-          className="hidden w-36 shrink-0 truncate text-right text-xs text-muted-foreground/65 md:block"
+          className={cn(
+            "hidden w-36 shrink-0 truncate text-right text-xs text-muted-foreground/65 md:block",
+            affiliationClassName,
+          )}
           data-projects-text-priority="secondary"
           data-testid={affiliationTestId}
           title={
@@ -311,13 +316,13 @@ export function ProjectEntityListRow({
       </span>
       {count != null ? (
         <span
-          className="grid w-12 shrink-0 grid-cols-[0.875rem_1fr] items-center gap-1 text-xs text-muted-foreground/65"
+          className="flex w-12 shrink-0 items-center gap-1 text-xs text-muted-foreground/65"
           data-projects-text-priority="secondary"
           data-testid={countTestId}
           title={countTitle}
         >
           <MessageSquare className="h-3.5 w-3.5" />
-          <span className="text-right tabular-nums">
+          <span className="tabular-nums">
             {count}
             {countSuffix}
           </span>
diff --git a/desktop/src/features/projects/ui/ProjectPullRequestFilesChangedPanel.tsx b/desktop/src/features/projects/ui/ProjectPullRequestFilesChangedPanel.tsx
index 105d20f10ee..72884a33ed3 100644
--- a/desktop/src/features/projects/ui/ProjectPullRequestFilesChangedPanel.tsx
+++ b/desktop/src/features/projects/ui/ProjectPullRequestFilesChangedPanel.tsx
@@ -755,8 +755,10 @@ export function ProjectPullRequestFilesChangedPanel({
 }
 
 export function ProjectDiffFilesPanel({
+  className,
   error,
   diff,
+  fileTreeClassName,
   isLoading,
   embedded = false,
   focusedAnchor,
@@ -764,6 +766,10 @@ export function ProjectDiffFilesPanel({
   inlineComments,
   subjectLabel,
 }: {
+  /** Extra classes for the file-tree/diff grid container. */
+  className?: string;
+  /** Overrides the file tree's default `max-h-96` cap, e.g. for full-height layouts. */
+  fileTreeClassName?: string;
   error: unknown;
   diff: ProjectRepoDiff | null | undefined;
   isLoading: boolean;
@@ -814,11 +820,11 @@ export function ProjectDiffFilesPanel({
     }
   }, [filteredFiles, selectedPath]);
 
-  if (isLoading) {
+  if (isLoading && !diff) {
     return <BuzzLoadingState label="Loading changed files" />;
   }
 
-  if (error) {
+  if (error && !diff) {
     const message = errorMessage(error);
     return (
       <div
@@ -857,6 +863,7 @@ export function ProjectDiffFilesPanel({
       className={cn(
         "grid min-h-0 overflow-hidden lg:grid-cols-[17rem_minmax(0,1fr)]",
         outerBorderClass,
+        className,
       )}
       data-project-detail-panel={embedded ? undefined : true}
     >
@@ -876,7 +883,12 @@ export function ProjectDiffFilesPanel({
             />
           </label>
         </div>
-        <nav className="max-h-96 overflow-auto border-border/50 border-t py-1">
+        <nav
+          className={cn(
+            "max-h-96 overflow-auto border-border/50 border-t py-1",
+            fileTreeClassName,
+          )}
+        >
           <FileTreeItems
             node={fileTree}
             onSelect={setSelectedPath}
diff --git a/desktop/src/features/projects/ui/ProjectPullRequestsPanel.tsx b/desktop/src/features/projects/ui/ProjectPullRequestsPanel.tsx
index 9ea2310e788..b130bf552c5 100644
--- a/desktop/src/features/projects/ui/ProjectPullRequestsPanel.tsx
+++ b/desktop/src/features/projects/ui/ProjectPullRequestsPanel.tsx
@@ -34,7 +34,6 @@ import type { UserProfileLookup } from "@/features/profile/lib/identity";
 import { useIdentityQuery } from "@/shared/api/hooks";
 import type { ChannelMember } from "@/shared/api/types";
 import { normalizePubkey, truncatePubkey } from "@/shared/lib/pubkey";
-import { BuzzLoadingState } from "@/shared/ui/BuzzLoadingState";
 import {
   ProjectFeedRow,
   ProjectFeedRowCluster,
@@ -58,6 +57,7 @@ import {
 } from "./ProjectStatusProgressIcon";
 import { ProjectWorkItemGroup } from "./ProjectWorkItemGroup";
 import { ProjectWorkItemRow } from "./ProjectWorkItemRow";
+import { PullRequestsPanelSurface } from "./PullRequestsPanelSurface";
 
 export { PullRequestMetaHeader } from "./PullRequestMetaRail";
 
@@ -537,13 +537,14 @@ export function ProjectPullRequestDetail({
           ) : null}
           {pullRequest.updates.length > 0 ? (
             <div
-              className={pullRequest.content ? "mt-4 space-y-3" : "space-y-3"}
+              className={pullRequest.content ? "mt-4 space-y-4" : "space-y-4"}
             >
               <h4 className="text-sm font-semibold text-foreground">Updates</h4>
               {pullRequest.updates.map((update) => (
                 <article className="space-y-1" key={update.id}>
                   <div className="flex min-w-0 items-center justify-between gap-3">
                     <AuthorIdentity
+                      avatarSize="sm"
                       profiles={profiles}
                       pubkey={update.author}
                       role={
@@ -855,7 +856,7 @@ export function PullRequestsPanel({
   profiles,
   project,
   pullRequests,
-  selectedPullRequestId,
+  selectedPullRequest,
 }: {
   diffStats?: { additions: number; deletions: number } | null;
   error: unknown;
@@ -870,51 +871,8 @@ export function PullRequestsPanel({
   profiles?: UserProfileLookup;
   project: Project;
   pullRequests: ProjectPullRequest[];
-  selectedPullRequestId: string | null;
+  selectedPullRequest: ProjectPullRequest | null;
 }) {
-  const selectedPullRequest =
-    pullRequests.find((item) => item.id === selectedPullRequestId) ?? null;
-
-  React.useEffect(() => {
-    if (
-      selectedPullRequestId &&
-      !pullRequests.some((item) => item.id === selectedPullRequestId)
-    ) {
-      onSelectedPullRequestIdChange(null);
-    }
-  }, [onSelectedPullRequestIdChange, pullRequests, selectedPullRequestId]);
-
-  if (isLoading) {
-    return <BuzzLoadingState label="Loading reviews" />;
-  }
-
-  if (pullRequests.length === 0) {
-    return (
-      <p className="p-4 text-sm text-muted-foreground">
-        {error
-          ? "Could not load reviews for this repository."
-          : "No reviews yet."}
-      </p>
-    );
-  }
-
-  if (selectedPullRequest) {
-    return (
-      <ProjectPullRequestDetail
-        diffStats={diffStats}
-        filesChanged={filesChanged}
-        filesCount={filesCount}
-        forceOpenFiles={forceOpenFiles}
-        onOpenInlineComment={onOpenInlineComment}
-        onOpenCommit={onOpenCommit}
-        onOpenTerminal={onOpenTerminal}
-        profiles={profiles}
-        project={project}
-        pullRequest={selectedPullRequest}
-      />
-    );
-  }
-
   const groups = PULL_REQUEST_STATUS_ORDER.map((status) => ({
     items: pullRequests.filter((pullRequest) => pullRequest.status === status),
     status,
@@ -924,36 +882,60 @@ export function PullRequestsPanel({
   );
 
   return (
-    <div>
-      {groups.map(({ items, status }) => {
-        return (
-          <ProjectWorkItemGroup
-            count={items.length}
-            icon={
-              <ProjectStatusProgressIcon
-                className={`h-4 w-4 ${pullRequestStatusClassName(status)}`}
-                state={pullRequestProgressState(status)}
-              />
-            }
-            items={items.map((pullRequest) =>
-              reviewSelectionItem(project, pullRequest),
-            )}
-            key={status}
-            label={status}
-          >
-            {items.map((pullRequest) => (
-              <PullRequestRow
-                key={pullRequest.id}
-                onOpen={() => onSelectedPullRequestIdChange(pullRequest.id)}
-                profiles={profiles}
-                project={project}
-                pullRequest={pullRequest}
-                rangeItems={rangeItems}
-              />
-            ))}
-          </ProjectWorkItemGroup>
-        );
-      })}
-    </div>
+    <PullRequestsPanelSurface
+      detail={
+        selectedPullRequest ? (
+          <ProjectPullRequestDetail
+            diffStats={diffStats}
+            filesChanged={filesChanged}
+            filesCount={filesCount}
+            forceOpenFiles={forceOpenFiles}
+            onOpenInlineComment={onOpenInlineComment}
+            onOpenCommit={onOpenCommit}
+            onOpenTerminal={onOpenTerminal}
+            profiles={profiles}
+            project={project}
+            pullRequest={selectedPullRequest}
+          />
+        ) : null
+      }
+      error={error}
+      isLoading={isLoading}
+      list={
+        <div>
+          {groups.map(({ items, status }) => {
+            return (
+              <ProjectWorkItemGroup
+                count={items.length}
+                icon={
+                  <ProjectStatusProgressIcon
+                    className={`h-4 w-4 ${pullRequestStatusClassName(status)}`}
+                    state={pullRequestProgressState(status)}
+                  />
+                }
+                items={items.map((pullRequest) =>
+                  reviewSelectionItem(project, pullRequest),
+                )}
+                key={status}
+                label={status}
+              >
+                {items.map((pullRequest) => (
+                  <PullRequestRow
+                    key={pullRequest.id}
+                    onOpen={() => onSelectedPullRequestIdChange(pullRequest.id)}
+                    profiles={profiles}
+                    project={project}
+                    pullRequest={pullRequest}
+                    rangeItems={rangeItems}
+                  />
+                ))}
+              </ProjectWorkItemGroup>
+            );
+          })}
+        </div>
+      }
+      pullRequests={pullRequests}
+      selectedPullRequest={selectedPullRequest}
+    />
   );
 }
diff --git a/desktop/src/features/projects/ui/ProjectReadmePanel.tsx b/desktop/src/features/projects/ui/ProjectReadmePanel.tsx
index 68bf61a8d42..9bc89e52131 100644
--- a/desktop/src/features/projects/ui/ProjectReadmePanel.tsx
+++ b/desktop/src/features/projects/ui/ProjectReadmePanel.tsx
@@ -263,7 +263,7 @@ export function ReadmePanel({
     return (
       <section className="overflow-hidden">
         {header}
-        <div className="p-6 text-sm text-muted-foreground">
+        <div className="px-8 py-6 text-sm text-muted-foreground">
           {fileContent.error
             ? "Could not load this README. Try again after refreshing the repository."
             : gitDataState === "empty"
@@ -283,11 +283,13 @@ export function ReadmePanel({
   return (
     <section className="overflow-hidden">
       {header}
-      <div className="p-4">
+      <div className="min-w-0 px-8 py-6">
         {isMarkdown ? (
           <Markdown
+            blockCode
             className="text-sm"
             content={readmeContent}
+            hardLineBreaks={false}
             interactive={false}
           />
         ) : language ? (
diff --git a/desktop/src/features/projects/ui/ProjectRepositoryActionsPanel.tsx b/desktop/src/features/projects/ui/ProjectRepositoryActionsPanel.tsx
index 78c59de03e7..90d2e2011fc 100644
--- a/desktop/src/features/projects/ui/ProjectRepositoryActionsPanel.tsx
+++ b/desktop/src/features/projects/ui/ProjectRepositoryActionsPanel.tsx
@@ -35,10 +35,7 @@ import {
 import { useProjectSelection } from "@/features/projects/lib/useProjectSelection";
 import type { UserProfileLookup } from "@/features/profile/lib/identity";
 import { RightAuxiliaryPane } from "@/features/channels/ui/RightAuxiliaryPane";
-import { normalizePubkey } from "@/shared/lib/pubkey";
 import { Button } from "@/shared/ui/button";
-import { Tooltip, TooltipContent, TooltipTrigger } from "@/shared/ui/tooltip";
-import { UserAvatar } from "@/shared/ui/UserAvatar";
 import {
   RepoSourceDropdown,
   type RepoSourceHeaderControls,
@@ -90,14 +87,19 @@ type ProjectRepositoryActionsPanelProps = {
 function RepositoryPanelSection({
   children,
   divided = false,
+  testId,
   title,
 }: {
   children: React.ReactNode;
   divided?: boolean;
+  testId?: string;
   title?: string;
 }) {
   return (
-    <section className={divided ? "!mt-2 space-y-0.5 pt-2" : "space-y-0.5"}>
+    <section
+      className={divided ? "!mt-2 space-y-0.5 pt-2" : "space-y-0.5"}
+      data-testid={testId}
+    >
       {title ? (
         <h3 className="flex h-7 min-w-0 items-center truncate text-sm font-normal text-muted-foreground/70">
           {title}
@@ -108,49 +110,6 @@ function RepositoryPanelSection({
   );
 }
 
-function RepositoryPeople({
-  people,
-  profiles,
-}: {
-  people: string[];
-  profiles?: UserProfileLookup;
-}) {
-  return (
-    <div
-      className="flex -space-x-1.5 pb-1 pt-0"
-      data-testid="project-repository-people"
-    >
-      {people.slice(0, 18).map((person) => {
-        const profile = profiles?.[person];
-        const label =
-          profile?.displayName?.trim() ||
-          profile?.nip05Handle?.trim() ||
-          person;
-        return (
-          <Tooltip key={person}>
-            <TooltipTrigger asChild>
-              <span
-                className="relative inline-flex rounded-full ring-2 ring-background"
-                data-testid="project-repository-person"
-              >
-                <UserAvatar
-                  accent={profile?.isAgent === true}
-                  avatarUrl={profile?.avatarUrl ?? null}
-                  displayName={label}
-                  size="sm"
-                />
-              </span>
-            </TooltipTrigger>
-            <TooltipContent data-testid="project-repository-person-tooltip">
-              {label}
-            </TooltipContent>
-          </Tooltip>
-        );
-      })}
-    </div>
-  );
-}
-
 function RepositoryActionButton({
   children,
   disabled,
@@ -207,19 +166,6 @@ export function ProjectRepositoryActionsPanel({
   terminalTitle,
   widthPx,
 }: ProjectRepositoryActionsPanelProps) {
-  const contextPeople = selectedIssue
-    ? [selectedIssue.author, ...selectedIssue.assignees]
-    : selectedPullRequest
-      ? [
-          selectedPullRequest.author,
-          ...selectedPullRequest.reviewers,
-          ...selectedPullRequest.approvals.map(({ author }) => author),
-          ...selectedPullRequest.changeRequests.map(({ author }) => author),
-        ]
-      : [repository.owner, ...repository.contributors];
-  const people = [
-    ...new Set(contextPeople.filter(Boolean).map(normalizePubkey)),
-  ];
   const selection = useProjectSelection();
   const selectionPresentation = projectSelectionPresentation(
     selection?.items ?? [],
@@ -246,6 +192,16 @@ export function ProjectRepositoryActionsPanel({
     sourceControls.externalUrl,
     branchScoped ? (sourceControls.selectedTag ?? sourceControls.branch) : null,
   );
+  const showCreateTask = activeTab === "issues" && !selectionPresentation;
+  const showCreateReview =
+    activeTab === "prs" &&
+    !selectionPresentation &&
+    Boolean(onCreatePullRequest);
+  const showActions =
+    Boolean(selectedIssue || selectedPullRequest || contextItem) ||
+    branchScoped ||
+    showCreateTask ||
+    showCreateReview;
 
   return (
     <RightAuxiliaryPane
@@ -310,163 +266,183 @@ export function ProjectRepositoryActionsPanel({
               selectionPresentation ? "hidden" : ""
             }`}
           >
-            <ProjectWorkItemContextActions
-              issue={selectedIssue}
-              profiles={profiles}
-              pullRequest={selectedPullRequest}
-              repository={repository}
-            />
-            {contextItem ? (
-              <ProjectWorkItemCommunicationActions
-                item={contextItem}
-                onChatWithAgent={onChatWithAgent}
-              />
-            ) : null}
-            {branchScoped ? (
-              <RepositoryPanelSection>
-                <div className="grid gap-0.5 [&_button]:-mx-2 [&_button]:h-7 [&_button]:w-[calc(100%+1rem)] [&_button]:max-w-none [&_button]:justify-start [&_button]:gap-3 [&_button]:rounded-md [&_button]:border-0 [&_button]:bg-transparent [&_button]:px-2 [&_button]:text-left [&_button]:text-sm [&_button]:font-normal [&_button]:shadow-none [&_button]:hover:bg-muted/70 [&_button>svg:last-child]:ml-auto">
-                  <RepoSourceDropdown controls={sourceControls} />
-                  <RepositoryBranchDropdown
-                    branch={sourceControls.branch}
-                    branchOptions={sourceControls.branchOptions}
-                    createBranchDisabled={sourceControls.createBranchDisabled}
-                    createBranchTitle={sourceControls.createBranchTitle}
-                    deleteBranchDisabled={sourceControls.deleteBranchDisabled}
-                    deleteBranchTitle={sourceControls.deleteBranchTitle}
-                    onBranchChange={sourceControls.onBranchChange}
-                    onCreateBranch={sourceControls.onCreateBranch}
-                    onDeleteBranch={sourceControls.onDeleteBranch}
-                    onTagChange={sourceControls.onTagChange}
-                    selectedTag={sourceControls.selectedTag}
-                    tagOptions={sourceControls.tagOptions}
+            {showActions ? (
+              <RepositoryPanelSection testId="project-context-actions">
+                <ProjectWorkItemContextActions
+                  issue={selectedIssue}
+                  profiles={profiles}
+                  pullRequest={selectedPullRequest}
+                  repository={repository}
+                />
+                {contextItem ? (
+                  <ProjectWorkItemCommunicationActions
+                    item={contextItem}
+                    onChatWithAgent={onChatWithAgent}
                   />
-                </div>
-              </RepositoryPanelSection>
-            ) : activeTab === "issues" && !selectionPresentation ? (
-              <RepositoryPanelSection>
-                <RepositoryActionButton
-                  disabled={createIssuePending}
-                  onClick={onCreateTask}
-                >
-                  <Plus className="h-3.5 w-3.5" />
-                  Create task
-                </RepositoryActionButton>
-              </RepositoryPanelSection>
-            ) : null}
-
-            {branchScoped ? (
-              <RepositoryPanelSection>
-                <div className="grid gap-0.5">
-                  {cloneAction ? (
-                    <RepositoryActionButton
-                      disabled={sourceControls.clonePending}
-                      onClick={cloneAction}
-                    >
-                      {sourceControls.clonePending ? (
-                        <Loader2 className="h-3.5 w-3.5 animate-spin" />
-                      ) : (
-                        <DownloadCloud className="h-3.5 w-3.5" />
-                      )}
-                      {sourceControls.clonePending ? "Cloning…" : "Clone"}
-                    </RepositoryActionButton>
-                  ) : null}
-                  {sourceControls.remoteUnavailableReason === "access" &&
-                  sourceControls.onAskForAccess ? (
-                    <RepositoryActionButton
-                      onClick={sourceControls.onAskForAccess}
-                      title="Open project chat to ask for repository access"
-                    >
-                      <MessageCircle className="h-3.5 w-3.5" />
-                      Ask for access
-                    </RepositoryActionButton>
-                  ) : null}
-                  {fetchAction ? (
-                    <RepositoryActionButton
-                      disabled={sourceControls.fetchPending}
-                      onClick={fetchAction}
-                      title={sourceControls.fetchTitle}
-                    >
-                      {sourceControls.fetchPending ? (
-                        <Loader2 className="h-3.5 w-3.5 animate-spin" />
-                      ) : (
-                        <RefreshCw className="h-3.5 w-3.5" />
-                      )}
-                      Fetch
-                    </RepositoryActionButton>
-                  ) : null}
-                  {pullAction ? (
-                    <RepositoryActionButton
-                      disabled={sourceControls.pullDisabled}
-                      onClick={pullAction}
-                      title={sourceControls.pullTitle}
+                ) : null}
+                {branchScoped ? (
+                  <>
+                    <div
+                      className="grid gap-0.5 [&_button]:-mx-2 [&_button]:h-7 [&_button]:w-[calc(100%+1rem)] [&_button]:max-w-none [&_button]:justify-start [&_button]:gap-3 [&_button]:rounded-md [&_button]:border-0 [&_button]:bg-transparent [&_button]:px-2 [&_button]:text-left [&_button]:text-sm [&_button]:font-normal [&_button]:shadow-none [&_button]:hover:bg-muted/70 [&_button>svg:last-child]:ml-auto"
+                      data-testid="project-context-source-controls"
                     >
-                      {sourceControls.pullPending ? (
-                        <Loader2 className="h-3.5 w-3.5 animate-spin" />
-                      ) : (
-                        <DownloadCloud className="h-3.5 w-3.5" />
-                      )}
-                      Pull
-                      {sourceControls.behindCount
-                        ? ` ${sourceControls.behindCount}`
-                        : ""}
-                    </RepositoryActionButton>
-                  ) : null}
-                  {pushAction ? (
-                    <RepositoryActionButton
-                      disabled={sourceControls.pushDisabled}
-                      onClick={pushAction}
-                      title={sourceControls.pushTitle}
+                      <RepoSourceDropdown controls={sourceControls} />
+                      <RepositoryBranchDropdown
+                        branch={sourceControls.branch}
+                        branchOptions={sourceControls.branchOptions}
+                        createBranchDisabled={
+                          sourceControls.createBranchDisabled
+                        }
+                        createBranchTitle={sourceControls.createBranchTitle}
+                        deleteBranchDisabled={
+                          sourceControls.deleteBranchDisabled
+                        }
+                        deleteBranchTitle={sourceControls.deleteBranchTitle}
+                        onBranchChange={sourceControls.onBranchChange}
+                        onCreateBranch={sourceControls.onCreateBranch}
+                        onDeleteBranch={sourceControls.onDeleteBranch}
+                        onTagChange={sourceControls.onTagChange}
+                        selectedTag={sourceControls.selectedTag}
+                        tagOptions={sourceControls.tagOptions}
+                      />
+                    </div>
+                    <div
+                      className="grid gap-0.5"
+                      data-testid="project-context-repository-actions"
                     >
-                      {sourceControls.pushPending ? (
-                        <Loader2 className="h-3.5 w-3.5 animate-spin" />
-                      ) : (
-                        <UploadCloud className="h-3.5 w-3.5" />
-                      )}
-                      Push
-                      {sourceControls.aheadCount
-                        ? ` ${sourceControls.aheadCount}`
-                        : ""}
-                    </RepositoryActionButton>
-                  ) : null}
+                      {cloneAction ? (
+                        <RepositoryActionButton
+                          disabled={sourceControls.clonePending}
+                          onClick={cloneAction}
+                        >
+                          {sourceControls.clonePending ? (
+                            <Loader2 className="h-3.5 w-3.5 animate-spin" />
+                          ) : (
+                            <DownloadCloud className="h-3.5 w-3.5" />
+                          )}
+                          {sourceControls.clonePending ? "Cloning…" : "Clone"}
+                        </RepositoryActionButton>
+                      ) : null}
+                      {sourceControls.remoteUnavailableReason === "access" &&
+                      sourceControls.onAskForAccess ? (
+                        <RepositoryActionButton
+                          onClick={sourceControls.onAskForAccess}
+                          title="Open project chat to ask for repository access"
+                        >
+                          <MessageCircle className="h-3.5 w-3.5" />
+                          Ask for access
+                        </RepositoryActionButton>
+                      ) : null}
+                      {fetchAction ? (
+                        <RepositoryActionButton
+                          disabled={sourceControls.fetchPending}
+                          onClick={fetchAction}
+                          title={sourceControls.fetchTitle}
+                        >
+                          {sourceControls.fetchPending ? (
+                            <Loader2 className="h-3.5 w-3.5 animate-spin" />
+                          ) : (
+                            <RefreshCw className="h-3.5 w-3.5" />
+                          )}
+                          Fetch
+                        </RepositoryActionButton>
+                      ) : null}
+                      {pullAction ? (
+                        <RepositoryActionButton
+                          disabled={sourceControls.pullDisabled}
+                          onClick={pullAction}
+                          title={sourceControls.pullTitle}
+                        >
+                          {sourceControls.pullPending ? (
+                            <Loader2 className="h-3.5 w-3.5 animate-spin" />
+                          ) : (
+                            <DownloadCloud className="h-3.5 w-3.5" />
+                          )}
+                          Pull
+                          {sourceControls.behindCount
+                            ? ` ${sourceControls.behindCount}`
+                            : ""}
+                        </RepositoryActionButton>
+                      ) : null}
+                      {pushAction ? (
+                        <RepositoryActionButton
+                          disabled={sourceControls.pushDisabled}
+                          onClick={pushAction}
+                          title={sourceControls.pushTitle}
+                        >
+                          {sourceControls.pushPending ? (
+                            <Loader2 className="h-3.5 w-3.5 animate-spin" />
+                          ) : (
+                            <UploadCloud className="h-3.5 w-3.5" />
+                          )}
+                          Push
+                          {sourceControls.aheadCount
+                            ? ` ${sourceControls.aheadCount}`
+                            : ""}
+                        </RepositoryActionButton>
+                      ) : null}
+                      <RepositoryActionButton
+                        onClick={onOpenTerminal}
+                        title={terminalTitle ?? "Open terminal"}
+                      >
+                        <SquareTerminal className="h-3.5 w-3.5" />
+                        Terminal
+                      </RepositoryActionButton>
+                      {sourceControls.source === "local" ? (
+                        <RepositoryActionButton
+                          onClick={onOpenLocalRepository}
+                          title="Open local repository folder"
+                        >
+                          <FolderOpen className="h-3.5 w-3.5" />
+                          Open
+                        </RepositoryActionButton>
+                      ) : externalOpenUrl ? (
+                        <Button
+                          asChild
+                          className="-mx-2 h-7 w-[calc(100%+1rem)] justify-start gap-3 rounded-md px-2 text-left text-sm font-normal hover:bg-muted/70 [&_svg]:h-4 [&_svg]:w-4 [&_svg]:shrink-0 [&_svg]:text-muted-foreground"
+                          size="sm"
+                          variant="ghost"
+                        >
+                          <a
+                            href={externalOpenUrl}
+                            rel="noreferrer"
+                            target="_blank"
+                          >
+                            <ExternalLink className="h-3.5 w-3.5" />
+                            Open
+                          </a>
+                        </Button>
+                      ) : null}
+                    </div>
+                  </>
+                ) : null}
+                {showCreateTask ? (
                   <RepositoryActionButton
-                    onClick={onOpenTerminal}
-                    title={terminalTitle ?? "Open terminal"}
+                    disabled={createIssuePending}
+                    onClick={onCreateTask}
                   >
-                    <SquareTerminal className="h-3.5 w-3.5" />
-                    Terminal
+                    <Plus className="h-3.5 w-3.5" />
+                    Create task
                   </RepositoryActionButton>
-                  {sourceControls.source === "local" ? (
-                    <RepositoryActionButton
-                      onClick={onOpenLocalRepository}
-                      title="Open local repository folder"
-                    >
-                      <FolderOpen className="h-3.5 w-3.5" />
-                      Open
-                    </RepositoryActionButton>
-                  ) : externalOpenUrl ? (
-                    <Button
-                      asChild
-                      className="-mx-2 h-7 w-[calc(100%+1rem)] justify-start gap-3 rounded-md px-2 text-left text-sm font-normal hover:bg-muted/70 [&_svg]:h-4 [&_svg]:w-4 [&_svg]:shrink-0 [&_svg]:text-muted-foreground"
-                      size="sm"
-                      variant="ghost"
-                    >
-                      <a
-                        href={externalOpenUrl}
-                        rel="noreferrer"
-                        target="_blank"
-                      >
-                        <ExternalLink className="h-3.5 w-3.5" />
-                        Open
-                      </a>
-                    </Button>
-                  ) : null}
-                </div>
+                ) : null}
+                {showCreateReview && onCreatePullRequest ? (
+                  <RepositoryActionButton
+                    onClick={onCreatePullRequest}
+                    title="Create review — choose a repository and branches to compare"
+                  >
+                    <Plus className="h-3.5 w-3.5" />
+                    Create review
+                  </RepositoryActionButton>
+                ) : null}
               </RepositoryPanelSection>
             ) : null}
 
-            {branchScoped ? (
-              <RepositoryPanelSection divided title="Details">
-                <RepositoryPeople people={people} profiles={profiles} />
+            <RepositoryPanelSection
+              divided={showActions}
+              testId="project-context-details"
+              title="Details"
+            >
+              {branchScoped ? (
                 <dl className="text-sm [&>div]:h-7 [&_dd]:ml-auto [&_dd]:tabular-nums [&_dt]:gap-3 [&_dt]:text-foreground [&_dt_svg]:h-4 [&_dt_svg]:w-4 [&_dt_svg]:shrink-0 [&_dt_svg]:text-muted-foreground">
                   <div className="flex items-center justify-between gap-3">
                     <dt className="flex items-center gap-3 text-muted-foreground">
@@ -499,121 +475,94 @@ export function ProjectRepositoryActionsPanel({
                     </dd>
                   </div>
                 </dl>
-              </RepositoryPanelSection>
-            ) : (
-              <>
-                <RepositoryPanelSection
-                  divided={activeTab === "issues"}
-                  title={
-                    selectedIssue || selectedPullRequest
-                      ? "People"
-                      : activeTab === "issues"
-                        ? "Details"
-                        : undefined
-                  }
-                >
-                  <RepositoryPeople people={people} profiles={profiles} />
-                </RepositoryPanelSection>
-                <RepositoryPanelSection
-                  title={
-                    selectedIssue
-                      ? "Task details"
-                      : selectedPullRequest
-                        ? "Review details"
-                        : activeTab === "issues"
-                          ? undefined
-                          : activeTab === "prs"
-                            ? "Review activity"
-                            : "Repository activity"
-                  }
-                >
-                  <dl className="text-sm [&>div]:h-7 [&_dd]:ml-auto [&_dd]:tabular-nums [&_dt]:gap-3 [&_dt]:text-foreground [&_dt_svg]:h-4 [&_dt_svg]:w-4 [&_dt_svg]:shrink-0 [&_dt_svg]:text-muted-foreground">
-                    <ProjectWorkItemContextDetails
-                      issue={selectedIssue}
-                      pullRequest={selectedPullRequest}
-                    />
-                    {!selectedIssue &&
-                    !selectedPullRequest &&
-                    activeTab !== "prs" ? (
-                      <>
-                        <div className="flex items-center justify-between gap-3">
-                          <dt className="flex items-center gap-3 text-muted-foreground">
-                            <CircleDot className="h-3.5 w-3.5" />
-                            {activeTab === "issues" ? "Tasks" : "Active tasks"}
-                          </dt>
-                          <dd className="font-medium text-foreground">
-                            {activeTab === "issues"
-                              ? taskActivity.total
-                              : taskActivity.active}
-                          </dd>
-                        </div>
-                        {activeTab === "issues" ? (
-                          <>
-                            <div className="flex items-center justify-between gap-3">
-                              <dt className="flex items-center gap-3 text-muted-foreground">
-                                <CircleDot className="h-3.5 w-3.5" />
-                                Active
-                              </dt>
-                              <dd className="font-medium text-foreground">
-                                {taskActivity.active}
-                              </dd>
-                            </div>
-                            <div className="flex items-center justify-between gap-3">
-                              <dt className="flex items-center gap-3 text-muted-foreground">
-                                <CheckCircle2 className="h-3.5 w-3.5" />
-                                Completed
-                              </dt>
-                              <dd className="font-medium text-foreground">
-                                {taskActivity.completed}
-                              </dd>
-                            </div>
-                          </>
-                        ) : null}
-                      </>
-                    ) : null}
-                    {!selectedIssue &&
-                    !selectedPullRequest &&
-                    activeTab !== "issues" ? (
-                      <>
-                        <div className="flex items-center justify-between gap-3">
-                          <dt className="flex items-center gap-3 text-muted-foreground">
-                            <GitPullRequest className="h-3.5 w-3.5" />
-                            {activeTab === "prs" ? "Reviews" : "Open reviews"}
-                          </dt>
-                          <dd className="font-medium text-foreground">
-                            {activeTab === "prs"
-                              ? reviewActivity.total
-                              : reviewActivity.open}
-                          </dd>
-                        </div>
-                        {activeTab === "prs" ? (
-                          <>
-                            <div className="flex items-center justify-between gap-3">
-                              <dt className="flex items-center gap-3 text-muted-foreground">
-                                <GitPullRequest className="h-3.5 w-3.5" />
-                                Open
-                              </dt>
-                              <dd className="font-medium text-foreground">
-                                {reviewActivity.open}
-                              </dd>
-                            </div>
-                            <div className="flex items-center justify-between gap-3">
-                              <dt className="flex items-center gap-3 text-muted-foreground">
-                                <GitMerge className="h-3.5 w-3.5" />
-                                Merged
-                              </dt>
-                              <dd className="font-medium text-foreground">
-                                {reviewActivity.merged}
-                              </dd>
-                            </div>
-                          </>
-                        ) : null}
-                      </>
-                    ) : null}
-                  </dl>
-                </RepositoryPanelSection>
-              </>
-            )}
+              ) : (
+                <dl className="text-sm [&>div]:h-7 [&_dd]:ml-auto [&_dd]:tabular-nums [&_dt]:gap-3 [&_dt]:text-foreground [&_dt_svg]:h-4 [&_dt_svg]:w-4 [&_dt_svg]:shrink-0 [&_dt_svg]:text-muted-foreground">
+                  <ProjectWorkItemContextDetails
+                    issue={selectedIssue}
+                    pullRequest={selectedPullRequest}
+                    repository={repository}
+                  />
+                  {!selectedIssue &&
+                  !selectedPullRequest &&
+                  activeTab !== "prs" ? (
+                    <>
+                      <div className="flex items-center justify-between gap-3">
+                        <dt className="flex items-center gap-3 text-muted-foreground">
+                          <CircleDot className="h-3.5 w-3.5" />
+                          {activeTab === "issues" ? "Tasks" : "Active tasks"}
+                        </dt>
+                        <dd className="font-medium text-foreground">
+                          {activeTab === "issues"
+                            ? taskActivity.total
+                            : taskActivity.active}
+                        </dd>
+                      </div>
+                      {activeTab === "issues" ? (
+                        <>
+                          <div className="flex items-center justify-between gap-3">
+                            <dt className="flex items-center gap-3 text-muted-foreground">
+                              <CircleDot className="h-3.5 w-3.5" />
+                              Active
+                            </dt>
+                            <dd className="font-medium text-foreground">
+                              {taskActivity.active}
+                            </dd>
+                          </div>
+                          <div className="flex items-center justify-between gap-3">
+                            <dt className="flex items-center gap-3 text-muted-foreground">
+                              <CheckCircle2 className="h-3.5 w-3.5" />
+                              Completed
+                            </dt>
+                            <dd className="font-medium text-foreground">
+                              {taskActivity.completed}
+                            </dd>
+                          </div>
+                        </>
+                      ) : null}
+                    </>
+                  ) : null}
+                  {!selectedIssue &&
+                  !selectedPullRequest &&
+                  activeTab !== "issues" ? (
+                    <>
+                      <div className="flex items-center justify-between gap-3">
+                        <dt className="flex items-center gap-3 text-muted-foreground">
+                          <GitPullRequest className="h-3.5 w-3.5" />
+                          {activeTab === "prs" ? "Reviews" : "Open reviews"}
+                        </dt>
+                        <dd className="font-medium text-foreground">
+                          {activeTab === "prs"
+                            ? reviewActivity.total
+                            : reviewActivity.open}
+                        </dd>
+                      </div>
+                      {activeTab === "prs" ? (
+                        <>
+                          <div className="flex items-center justify-between gap-3">
+                            <dt className="flex items-center gap-3 text-muted-foreground">
+                              <GitPullRequest className="h-3.5 w-3.5" />
+                              Open
+                            </dt>
+                            <dd className="font-medium text-foreground">
+                              {reviewActivity.open}
+                            </dd>
+                          </div>
+                          <div className="flex items-center justify-between gap-3">
+                            <dt className="flex items-center gap-3 text-muted-foreground">
+                              <GitMerge className="h-3.5 w-3.5" />
+                              Merged
+                            </dt>
+                            <dd className="font-medium text-foreground">
+                              {reviewActivity.merged}
+                            </dd>
+                          </div>
+                        </>
+                      ) : null}
+                    </>
+                  ) : null}
+                </dl>
+              )}
+            </RepositoryPanelSection>
           </div>
         </div>
       </div>
diff --git a/desktop/src/features/projects/ui/ProjectRepositoryLatestCommitRow.tsx b/desktop/src/features/projects/ui/ProjectRepositoryLatestCommitRow.tsx
new file mode 100644
index 00000000000..36e379058ea
--- /dev/null
+++ b/desktop/src/features/projects/ui/ProjectRepositoryLatestCommitRow.tsx
@@ -0,0 +1,41 @@
+import type * as React from "react";
+
+import { cn } from "@/shared/lib/cn";
+
+/** Interactive table-header row that opens the repository's latest commit. */
+export function ProjectRepositoryLatestCommitRow({
+  children,
+  commitShortHash,
+  onOpen,
+}: {
+  children: React.ReactNode;
+  commitShortHash?: string;
+  onOpen?: () => void;
+}) {
+  return (
+    <tr
+      aria-label={
+        commitShortHash ? `Open commit ${commitShortHash}` : undefined
+      }
+      className={cn(
+        "bg-muted/20",
+        onOpen &&
+          "cursor-pointer transition-colors hover:bg-muted/35 focus-visible:outline-hidden focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-ring",
+      )}
+      data-testid="project-repository-latest-commit"
+      onClick={onOpen}
+      onKeyDown={
+        onOpen
+          ? (event) => {
+              if (event.key !== "Enter" && event.key !== " ") return;
+              event.preventDefault();
+              onOpen();
+            }
+          : undefined
+      }
+      tabIndex={onOpen ? 0 : undefined}
+    >
+      {children}
+    </tr>
+  );
+}
diff --git a/desktop/src/features/projects/ui/ProjectRepositoryPanel.tsx b/desktop/src/features/projects/ui/ProjectRepositoryPanel.tsx
index d784dc04cd8..09ac04dd7ab 100644
--- a/desktop/src/features/projects/ui/ProjectRepositoryPanel.tsx
+++ b/desktop/src/features/projects/ui/ProjectRepositoryPanel.tsx
@@ -46,6 +46,7 @@ import {
   PROJECT_DETAIL_PANEL_CLASS,
   PROJECT_DETAIL_PANEL_MESSAGE_CLASS,
 } from "./projectPanelStyles";
+import { ProjectRepositoryLatestCommitRow } from "./ProjectRepositoryLatestCommitRow";
 import {
   type RepoSourceHeaderControls,
   RepoSourceDropdown,
@@ -617,6 +618,7 @@ export function RepositoryFilesPanel({
   profiles,
   fallbackAuthorPubkey,
   onContextChange,
+  onOpenCommit,
   sourceControls,
   unavailableMessage,
 }: {
@@ -631,6 +633,7 @@ export function RepositoryFilesPanel({
     kind: "file" | "folder";
     path: string;
   }) => void;
+  onOpenCommit?: (commitHash: string) => void;
   /** Branch picker + remote/local toggle rendered in the panel header. */
   sourceControls?: RepoSourceHeaderControls;
   unavailableMessage?: string;
@@ -850,12 +853,22 @@ export function RepositoryFilesPanel({
       ) : null}
 
       <div className="overflow-x-auto px-2 pb-2">
-        <table className="w-full border-separate border-spacing-y-0.5 caption-bottom text-sm">
+        <table className="w-full border-collapse caption-bottom text-sm">
           <thead>
-            <tr className="border-border/50 border-b bg-muted/20">
+            <ProjectRepositoryLatestCommitRow
+              commitShortHash={latestCommit?.shortHash}
+              onOpen={
+                latestCommit && onOpenCommit
+                  ? () => onOpenCommit(latestCommit.hash)
+                  : undefined
+              }
+            >
               <th className="px-4 py-3 text-left font-normal" colSpan={3}>
                 {latestCommit ? (
-                  <div className="flex min-w-0 items-center justify-between gap-3 text-sm">
+                  <div
+                    className="flex min-w-0 items-center justify-between gap-3 text-xs"
+                    data-testid="project-repository-latest-commit-summary"
+                  >
                     <div className="flex min-w-0 items-center gap-2">
                       <UserAvatar
                         accent={latestCommitProfile?.isAgent === true}
@@ -901,12 +914,11 @@ export function RepositoryFilesPanel({
                   </p>
                 )}
               </th>
-            </tr>
+            </ProjectRepositoryLatestCommitRow>
           </thead>
           <tbody>
-            {visibleEntries.map((entry, index) => {
+            {visibleEntries.map((entry) => {
               const latestCommit = entry.latestCommit;
-              const rowIsLast = index === visibleEntries.length - 1;
               const openEntry = () =>
                 openRepositoryEntry(entry, openPath, setSelectedFile);
 
@@ -914,6 +926,7 @@ export function RepositoryFilesPanel({
                 <tr
                   aria-label={`Open ${entry.type} ${entry.name}`}
                   className="group/repository-entry cursor-pointer text-xs focus-visible:outline-hidden"
+                  data-testid="project-repository-entry-row"
                   key={`${entry.type}:${entry.path}`}
                   onClick={openEntry}
                   onKeyDown={(event) =>
@@ -921,12 +934,7 @@ export function RepositoryFilesPanel({
                   }
                   tabIndex={0}
                 >
-                  <td
-                    className={cn(
-                      "min-w-52 rounded-l-md px-3 py-2 align-middle transition-colors group-hover/repository-entry:bg-muted/35 group-focus-visible/repository-entry:bg-muted/35",
-                      !rowIsLast && "border-border/50 border-b",
-                    )}
-                  >
+                  <td className="min-w-52 px-3 py-2 align-middle transition-colors group-hover/repository-entry:rounded-l-md group-hover/repository-entry:bg-muted/35 group-focus-visible/repository-entry:rounded-l-md group-focus-visible/repository-entry:bg-muted/35">
                     <div className="flex min-w-0 items-center gap-2">
                       <RepositoryEntryIcon entry={entry} />
                       <span className="truncate font-medium text-foreground">
@@ -934,23 +942,13 @@ export function RepositoryFilesPanel({
                       </span>
                     </div>
                   </td>
-                  <td
-                    className={cn(
-                      "max-w-96 p-2 align-middle transition-colors group-hover/repository-entry:bg-muted/35 group-focus-visible/repository-entry:bg-muted/35",
-                      !rowIsLast && "border-border/50 border-b",
-                    )}
-                  >
+                  <td className="max-w-96 p-2 align-middle transition-colors group-hover/repository-entry:bg-muted/35 group-focus-visible/repository-entry:bg-muted/35">
                     <RepositoryCommitCell
                       commit={latestCommit}
                       profiles={profiles}
                     />
                   </td>
-                  <td
-                    className={cn(
-                      "w-36 whitespace-nowrap rounded-r-md p-2 text-right align-middle text-muted-foreground transition-colors group-hover/repository-entry:bg-muted/35 group-focus-visible/repository-entry:bg-muted/35",
-                      !rowIsLast && "border-border/50 border-b",
-                    )}
-                  >
+                  <td className="w-36 whitespace-nowrap p-2 text-right align-middle text-muted-foreground transition-colors group-hover/repository-entry:rounded-r-md group-hover/repository-entry:bg-muted/35 group-focus-visible/repository-entry:rounded-r-md group-focus-visible/repository-entry:bg-muted/35">
                     {latestCommit ? (
                       <time
                         dateTime={new Date(
diff --git a/desktop/src/features/projects/ui/ProjectRightPanelControls.tsx b/desktop/src/features/projects/ui/ProjectRightPanelControls.tsx
index 1f509794dc9..1e382326e2b 100644
--- a/desktop/src/features/projects/ui/ProjectRightPanelControls.tsx
+++ b/desktop/src/features/projects/ui/ProjectRightPanelControls.tsx
@@ -28,7 +28,7 @@ export function ProjectChatPanelControl({
     <Button
       aria-label={chatOpen ? "Hide project chat" : "Show project chat"}
       aria-pressed={chatOpen}
-      className="h-7 w-7 text-muted-foreground hover:bg-muted/70 hover:text-foreground"
+      className="h-7 w-7 text-sidebar-foreground hover:bg-sidebar-accent"
       data-testid="project-right-panel-chat-tab"
       onClick={() => {
         if (chatOpen) {
@@ -95,6 +95,13 @@ export function ProjectRightPanelControls({
           open={terminalOpen}
         />
       </Button>
+      <ProjectChatPanelControl
+        collapsed={collapsed}
+        mode={mode}
+        onCollapse={onCollapse}
+        onExpand={onExpand}
+        onModeChange={onModeChange}
+      />
       <Button
         aria-label={
           repositoryOpen ? "Hide project context" : "Show project context"
diff --git a/desktop/src/features/projects/ui/ProjectSectionHeader.tsx b/desktop/src/features/projects/ui/ProjectSectionHeader.tsx
index b79d7ae7db4..f949f1aa5b9 100644
--- a/desktop/src/features/projects/ui/ProjectSectionHeader.tsx
+++ b/desktop/src/features/projects/ui/ProjectSectionHeader.tsx
@@ -1,4 +1,5 @@
 import { type LucideIcon, Plus } from "lucide-react";
+import type { ReactNode } from "react";
 
 import { cn } from "@/shared/lib/cn";
 import { Button } from "@/shared/ui/button";
@@ -9,6 +10,7 @@ export function ProjectSectionHeader({
   icon: Icon,
   testId = "project-section-header",
   title,
+  trailing,
 }: {
   action?: {
     disabled?: boolean;
@@ -20,20 +22,24 @@ export function ProjectSectionHeader({
   icon: LucideIcon;
   testId?: string;
   title: string;
+  trailing?: ReactNode;
 }) {
   return (
     <header
-      className={cn("flex min-h-12 items-center gap-3 px-4 py-2", className)}
+      className={cn(
+        "flex min-h-12 flex-wrap items-center gap-2 px-4 py-2",
+        className,
+      )}
       data-testid={testId}
     >
       <div className="flex min-w-0 flex-1 items-center gap-3">
-        <h2 className="min-w-0 truncate text-sm font-semibold text-foreground">
-          {title}
-        </h2>
         <Icon
           className="h-4 w-4 shrink-0 text-muted-foreground"
           data-testid="project-section-header-icon"
         />
+        <h2 className="min-w-0 truncate text-sm font-semibold text-foreground">
+          {title}
+        </h2>
       </div>
       {action ? (
         <Button
@@ -48,6 +54,7 @@ export function ProjectSectionHeader({
           <Plus className="h-4 w-4" />
         </Button>
       ) : null}
+      {trailing}
     </header>
   );
 }
diff --git a/desktop/src/features/projects/ui/ProjectSelectableGroup.tsx b/desktop/src/features/projects/ui/ProjectSelectableGroup.tsx
index 3536ea20b0c..e49f80af620 100644
--- a/desktop/src/features/projects/ui/ProjectSelectableGroup.tsx
+++ b/desktop/src/features/projects/ui/ProjectSelectableGroup.tsx
@@ -10,6 +10,7 @@ export function ProjectSelectableGroup({
   contentClassName,
   count,
   groupKey,
+  headerClassName,
   headerTestId,
   icon,
   items,
@@ -21,6 +22,7 @@ export function ProjectSelectableGroup({
   contentClassName?: string;
   count: number;
   groupKey: string;
+  headerClassName?: string;
   headerTestId: string;
   icon: React.ReactNode;
   items: ProjectSelectionItem[];
@@ -36,6 +38,7 @@ export function ProjectSelectableGroup({
     ).length ?? 0;
   const allSelected = items.length > 0 && selectedCount === items.length;
   const partiallySelected = selectedCount > 0 && !allSelected;
+  const showSelectControl = allSelected || partiallySelected;
 
   return (
     <section
@@ -44,34 +47,50 @@ export function ProjectSelectableGroup({
       data-testid={testId}
     >
       <div
-        className="group/header mx-2 flex h-9 items-center gap-1.5 rounded-md bg-muted/40 px-2 text-xs text-muted-foreground"
+        className={cn(
+          "group/header mx-2 flex h-9 items-center gap-1.5 rounded-md bg-muted/40 px-2 text-xs text-muted-foreground",
+          headerClassName,
+        )}
         data-testid={headerTestId}
       >
-        {selection && items.length > 0 ? (
+        <span
+          className="relative flex h-4 w-4 shrink-0 items-center justify-center"
+          data-testid="project-group-leading-icon"
+        >
           <span
             className={cn(
-              "flex shrink-0 opacity-0 transition-opacity group-focus-within/header:opacity-100 group-hover/header:opacity-100",
-              (allSelected || partiallySelected) && "opacity-100",
+              "flex items-center justify-center transition-opacity",
+              selection &&
+                "group-focus-within/header:opacity-0 group-hover/header:opacity-0",
+              showSelectControl && "opacity-0",
             )}
+            data-testid="project-group-icon"
           >
-            <ProjectEntitySelectControl
-              checked={allSelected}
-              indeterminate={partiallySelected}
-              label={`${allSelected ? "Clear" : "Select"} all ${label}`}
-              onToggle={() => selection.toggleGroup(items)}
-              testId="projects-group-select"
-            />
+            {icon}
           </span>
-        ) : null}
+          {selection && items.length > 0 ? (
+            <span
+              className={cn(
+                "absolute inset-0 flex items-center justify-center opacity-0 transition-opacity group-focus-within/header:opacity-100 group-hover/header:opacity-100",
+                showSelectControl && "opacity-100",
+              )}
+            >
+              <ProjectEntitySelectControl
+                checked={allSelected}
+                indeterminate={partiallySelected}
+                label={`${allSelected ? "Clear" : "Select"} all ${label}`}
+                onToggle={() => selection.toggleGroup(items)}
+                testId="projects-group-select"
+              />
+            </span>
+          ) : null}
+        </span>
         <button
           aria-expanded={expanded}
           className="flex min-w-0 flex-1 cursor-pointer items-center gap-1.5 text-left"
           onClick={() => setExpanded((current) => !current)}
           type="button"
         >
-          <span className="flex h-4 w-4 shrink-0 items-center justify-center opacity-80">
-            {icon}
-          </span>
           <span
             className="min-w-0 truncate font-medium text-foreground/80"
             data-testid={labelTestId}
diff --git a/desktop/src/features/projects/ui/ProjectWorkItemCommunicationActions.tsx b/desktop/src/features/projects/ui/ProjectWorkItemCommunicationActions.tsx
index ab2c44b0255..b5d2d22bd36 100644
--- a/desktop/src/features/projects/ui/ProjectWorkItemCommunicationActions.tsx
+++ b/desktop/src/features/projects/ui/ProjectWorkItemCommunicationActions.tsx
@@ -18,13 +18,10 @@ export function ProjectWorkItemCommunicationActions({
   const discussInChannel = useProjectDiscussInChannel(items);
 
   return (
-    <section
-      className="space-y-0.5 pt-2"
+    <div
+      className="space-y-0.5"
       data-testid="project-context-communication-actions"
     >
-      <h3 className="text-xs font-normal text-muted-foreground/70">
-        Discussion
-      </h3>
       <Button
         className={PROJECT_CONTEXT_ACTION_BUTTON_CLASS}
         data-testid="project-context-chat-agent"
@@ -41,6 +38,6 @@ export function ProjectWorkItemCommunicationActions({
         onSelectChannel={discussInChannel}
         testIdPrefix="project-context"
       />
-    </section>
+    </div>
   );
 }
diff --git a/desktop/src/features/projects/ui/ProjectWorkItemContextActions.tsx b/desktop/src/features/projects/ui/ProjectWorkItemContextActions.tsx
index 523e9ce7a1b..9182754c629 100644
--- a/desktop/src/features/projects/ui/ProjectWorkItemContextActions.tsx
+++ b/desktop/src/features/projects/ui/ProjectWorkItemContextActions.tsx
@@ -33,13 +33,7 @@ export function ProjectWorkItemContextActions({
     const canAssignOthers =
       viewer !== null && (isAuthor || isOwner || isManagedAgentOwner);
     return (
-      <section
-        className="space-y-1 pt-2"
-        data-testid="project-context-task-assignment"
-      >
-        <h3 className="text-xs font-normal text-muted-foreground/70">
-          Assignment
-        </h3>
+      <div data-testid="project-context-task-assignment">
         <IssueAssigneesRow
           canAssignOthers={canAssignOthers}
           contextActions
@@ -52,7 +46,7 @@ export function ProjectWorkItemContextActions({
           testIdPrefix="project-context-issue"
           viewerPubkey={viewer}
         />
-      </section>
+      </div>
     );
   }
 
@@ -64,7 +58,7 @@ export function ProjectWorkItemContextActions({
       (isAuthor || isOwner || isManagedAgentOwner);
     if (!canRequestReview) return null;
     return (
-      <section className="pt-2" data-testid="project-context-reviewers">
+      <div data-testid="project-context-reviewers">
         <PullRequestReviewersRow
           actionLabel="Add Reviewer"
           canRequest={canRequestReview}
@@ -77,7 +71,7 @@ export function ProjectWorkItemContextActions({
           showSummary={false}
           summaryTestId="project-context-review-summary"
         />
-      </section>
+      </div>
     );
   }
 
diff --git a/desktop/src/features/projects/ui/ProjectWorkItemContextDetails.tsx b/desktop/src/features/projects/ui/ProjectWorkItemContextDetails.tsx
index cdaf3ebf8b9..fd390060602 100644
--- a/desktop/src/features/projects/ui/ProjectWorkItemContextDetails.tsx
+++ b/desktop/src/features/projects/ui/ProjectWorkItemContextDetails.tsx
@@ -1,6 +1,7 @@
 import {
   CheckCircle2,
   CircleDot,
+  GitBranch,
   GitPullRequest,
   type LucideIcon,
   MessageCircle,
@@ -11,6 +12,7 @@ import type * as React from "react";
 import type {
   ProjectIssue,
   ProjectPullRequest,
+  Repository,
 } from "@/features/projects/hooks";
 
 function ContextDetailRow({
@@ -36,9 +38,11 @@ function ContextDetailRow({
 export function ProjectWorkItemContextDetails({
   issue,
   pullRequest,
+  repository,
 }: {
   issue?: ProjectIssue | null;
   pullRequest?: ProjectPullRequest | null;
+  repository: Repository;
 }) {
   if (issue) {
     return (
@@ -63,8 +67,25 @@ export function ProjectWorkItemContextDetails({
   }
 
   if (pullRequest) {
+    const sourceBranch = pullRequest.branchName || "Unknown branch";
+    const targetBranch =
+      pullRequest.targetBranch || repository.defaultBranch || "Default branch";
+    const branchLabel = `${sourceBranch} → ${targetBranch}`;
     return (
       <>
+        <ContextDetailRow
+          icon={GitBranch}
+          label="Branch"
+          value={
+            <span
+              className="block max-w-40 truncate"
+              data-testid="project-context-branch"
+              title={branchLabel}
+            >
+              {branchLabel}
+            </span>
+          }
+        />
         <ContextDetailRow
           icon={GitPullRequest}
           label="Status"
diff --git a/desktop/src/features/projects/ui/ProjectWorkItemGroup.tsx b/desktop/src/features/projects/ui/ProjectWorkItemGroup.tsx
index 90bfc5f8136..e77e19ed003 100644
--- a/desktop/src/features/projects/ui/ProjectWorkItemGroup.tsx
+++ b/desktop/src/features/projects/ui/ProjectWorkItemGroup.tsx
@@ -19,13 +19,15 @@ export function ProjectWorkItemGroup({
 }) {
   return (
     <ProjectSelectableGroup
-      contentClassName="px-2"
+      contentClassName="px-4"
       count={count}
       groupKey={label}
+      headerClassName="mx-4 gap-3 px-4"
       headerTestId="project-work-item-group-header"
       icon={icon}
       items={items}
       label={label}
+      labelTestId="project-work-item-group-label"
       testId="project-work-item-group"
     >
       {children}
diff --git a/desktop/src/features/projects/ui/ProjectWorkItemRow.tsx b/desktop/src/features/projects/ui/ProjectWorkItemRow.tsx
index 7d2c5245e80..acf54121499 100644
--- a/desktop/src/features/projects/ui/ProjectWorkItemRow.tsx
+++ b/desktop/src/features/projects/ui/ProjectWorkItemRow.tsx
@@ -42,32 +42,66 @@ export function ProjectWorkItemRow({
   return (
     <article
       className={cn(
-        "group/work-item flex min-h-10 min-w-0 items-center gap-2 rounded-md px-2 py-2 transition-colors hover:bg-muted/30",
+        "group/work-item mx-2 flex min-h-10 min-w-0 items-center gap-3 rounded-md px-2 py-2 transition-colors hover:bg-muted/30",
         selected && "bg-muted/40",
       )}
       data-project-event-id={eventId}
       data-selected={selected ? "true" : undefined}
       data-testid={testId}
     >
-      {selection && projectSelection ? (
+      <span
+        className="relative flex h-4 w-4 shrink-0 items-center justify-center"
+        data-testid="project-work-item-leading-icon"
+      >
         <span
           className={cn(
-            "flex h-4 w-4 shrink-0 items-center justify-center opacity-0 group-hover/work-item:opacity-100 group-focus-within/work-item:opacity-100",
-            showSelectControl && "opacity-100",
+            "flex items-center justify-center opacity-80 transition-opacity",
+            selection &&
+              "group-hover/work-item:opacity-0 group-focus-within/work-item:opacity-0",
+            showSelectControl && "opacity-0",
           )}
+          data-testid="project-work-item-status-icon"
         >
-          <ProjectEntitySelectControl
-            checked={selected}
-            label={`Select ${selection.item.title}`}
-            onToggle={({ shiftKey }) =>
-              projectSelection.toggle(selection.item, {
-                rangeItems: selection.rangeItems,
-                shiftKey,
-              })
-            }
-          />
+          {statusIcon}
         </span>
-      ) : null}
+        {selection && projectSelection ? (
+          <span
+            className={cn(
+              "absolute inset-0 flex items-center justify-center opacity-0 transition-opacity group-hover/work-item:opacity-100 group-focus-within/work-item:opacity-100",
+              showSelectControl && "opacity-100",
+            )}
+          >
+            <ProjectEntitySelectControl
+              checked={selected}
+              label={`Select ${selection.item.title}`}
+              onToggle={({ shiftKey }) =>
+                projectSelection.toggle(selection.item, {
+                  rangeItems: selection.rangeItems,
+                  shiftKey,
+                })
+              }
+            />
+          </span>
+        ) : null}
+      </span>
+      {onOpen ? (
+        <button
+          className="min-w-0 flex-1 truncate rounded-sm text-left text-sm font-normal text-foreground transition-colors hover:text-primary focus-visible:outline-hidden focus-visible:ring-2 focus-visible:ring-ring"
+          data-projects-text-priority="primary"
+          onClick={onOpen}
+          title={title}
+          type="button"
+        >
+          {title}
+        </button>
+      ) : (
+        <span
+          className="min-w-0 flex-1 truncate text-sm font-normal text-foreground"
+          data-projects-text-priority="primary"
+        >
+          {title}
+        </span>
+      )}
       {onOpen ? (
         <button
           className={cn(
@@ -94,30 +128,6 @@ export function ProjectWorkItemRow({
           {identifier}
         </span>
       )}
-      <span
-        className="flex h-4 w-4 shrink-0 items-center justify-center opacity-80"
-        data-testid="project-work-item-status-icon"
-      >
-        {statusIcon}
-      </span>
-      {onOpen ? (
-        <button
-          className="min-w-0 truncate rounded-sm text-left text-sm font-normal text-foreground transition-colors hover:text-primary focus-visible:outline-hidden focus-visible:ring-2 focus-visible:ring-ring"
-          data-projects-text-priority="primary"
-          onClick={onOpen}
-          title={title}
-          type="button"
-        >
-          {title}
-        </button>
-      ) : (
-        <span
-          className="min-w-0 truncate text-sm font-normal text-foreground"
-          data-projects-text-priority="primary"
-        >
-          {title}
-        </span>
-      )}
       {metadata ? (
         <div
           className="hidden min-w-0 shrink items-center gap-1.5 overflow-hidden text-xs text-muted-foreground/60 lg:flex"
diff --git a/desktop/src/features/projects/ui/ProjectWorkspaceTabs.tsx b/desktop/src/features/projects/ui/ProjectWorkspaceTabs.tsx
index 4ef9ae39736..2c526900d38 100644
--- a/desktop/src/features/projects/ui/ProjectWorkspaceTabs.tsx
+++ b/desktop/src/features/projects/ui/ProjectWorkspaceTabs.tsx
@@ -1,5 +1,4 @@
 import {
-  BookOpen,
   CircleDot,
   Files as FilesIcon,
   GitCommitHorizontal,
@@ -27,6 +26,7 @@ import {
 } from "@/features/projects/lib/projectContributorMatching";
 import { repositoryDiscussionQuery } from "@/features/projects/lib/discussionChannels";
 import type { ProjectRepoHost } from "@/features/projects/lib/projectRepoHost";
+import { projectReviewFilesChangedBody } from "@/features/projects/lib/projectReviewDisplay";
 import { projectRepoUnavailableReason } from "@/features/projects/lib/projectRepoAvailability";
 import type { UserProfileLookup } from "@/features/profile/lib/identity";
 import { normalizePubkey } from "@/shared/lib/pubkey";
@@ -62,6 +62,8 @@ import {
   type CreateIssueDialogInput,
 } from "./CreateIssueDialog";
 
+const SECTION_HEADER_CLASS = "mx-4 mb-2 rounded-xl bg-muted/40";
+
 type CreatePullRequestAction = {
   projects: Project[];
   reposDir?: string | null;
@@ -92,7 +94,6 @@ export function WorkspaceTabs({
   createIssueRequestKey,
   createPullRequestAction,
   createPullRequestRequestKey,
-  headerAction,
   updatePullRequestAction,
   initialTab,
   initialTabRequestKey,
@@ -107,6 +108,7 @@ export function WorkspaceTabs({
   repoDiffLoading,
   selectedCommitHash,
   selectedIssueId,
+  selectedPullRequest,
   selectedPullRequestId,
   sharedHeaderBackdrop,
   pullRequests,
@@ -117,7 +119,6 @@ export function WorkspaceTabs({
   onSelectedIssueIdChange,
   onSelectedPullRequestIdChange,
   onSelectedTabChange,
-  onBranchChange,
   onOpenMergeRecoveryTerminal,
   snapshot,
   snapshotError,
@@ -138,7 +139,6 @@ export function WorkspaceTabs({
   createIssueRequestKey?: number;
   createPullRequestAction?: CreatePullRequestAction;
   createPullRequestRequestKey?: number;
-  headerAction?: React.ReactNode;
   updatePullRequestAction?: UpdatePullRequestAction;
   /** Tab to open on mount (workspace vocabulary), e.g. from a share link. */
   initialTab?: string;
@@ -155,6 +155,7 @@ export function WorkspaceTabs({
   repoDiffLoading: boolean;
   selectedCommitHash: string | null;
   selectedIssueId: string | null;
+  selectedPullRequest: ProjectPullRequest | null;
   selectedPullRequestId: string | null;
   sharedHeaderBackdrop?: boolean;
   pullRequests: ProjectPullRequest[];
@@ -169,7 +170,6 @@ export function WorkspaceTabs({
   onSelectedPullRequestIdChange: (id: string | null) => void;
   /** Reports the active tab so the screen breadcrumb can mirror it. */
   onSelectedTabChange?: (tab: string) => void;
-  onBranchChange: (branch: string | null) => void;
   onOpenMergeRecoveryTerminal?: OpenMergeRecoveryTerminal;
   snapshot: ProjectRepoSnapshot | null | undefined;
   snapshotError: unknown;
@@ -210,13 +210,13 @@ export function WorkspaceTabs({
     repoSource === "remote" && repoHost.kind === "external"
       ? repoHost.host
       : undefined;
-  const gitDataState: GitDataState = displayedSnapshotLoading
-    ? "checking"
-    : externalHost || displayedSnapshotError || !displayedSnapshot
-      ? "unavailable"
-      : files.length === 0
-        ? "empty"
-        : "available";
+  const gitDataState: GitDataState = displayedSnapshot
+    ? files.length === 0
+      ? "empty"
+      : "available"
+    : displayedSnapshotLoading
+      ? "checking"
+      : "unavailable";
   const unavailableReason =
     gitDataState === "unavailable" && !externalHost
       ? repoSource === "remote"
@@ -239,10 +239,11 @@ export function WorkspaceTabs({
         retryPending={sourceControls?.fetchPending}
       />
     ) : null;
-  const selectedPullRequest =
-    pullRequests.find(
-      (pullRequest) => pullRequest.id === selectedPullRequestId,
-    ) ?? null;
+  const filesChangedBody = projectReviewFilesChangedBody({
+    hasPopulatedDiff: (repoDiff?.files.length ?? 0) > 0,
+    hasSelectedPullRequest: Boolean(selectedPullRequest),
+    repositoryUnavailable: Boolean(repositoryUnavailableState),
+  });
   const selectedCommitPullRequest = React.useMemo(
     () =>
       pullRequests.find(
@@ -302,11 +303,8 @@ export function WorkspaceTabs({
   React.useEffect(() => {
     if (isPullRequestSelected) {
       setSelectedTab("prs");
-      if (selectedPullRequest?.branchName) {
-        onBranchChange(selectedPullRequest.branchName);
-      }
     }
-  }, [isPullRequestSelected, onBranchChange, selectedPullRequest?.branchName]);
+  }, [isPullRequestSelected]);
 
   React.useEffect(() => {
     if (selectedIssueId) {
@@ -350,12 +348,18 @@ export function WorkspaceTabs({
     [selectedPullRequestId],
   );
   const sectionHeader =
-    selectedTab === "overview" && readmeFile ? (
-      <ProjectSectionHeader icon={BookOpen} title="README" />
-    ) : selectedTab === "files" && files.length > 0 ? (
-      <ProjectSectionHeader icon={FilesIcon} title="Files" />
+    selectedTab === "files" && files.length > 0 ? (
+      <ProjectSectionHeader
+        className={SECTION_HEADER_CLASS}
+        icon={FilesIcon}
+        title="Files"
+      />
     ) : selectedTab === "activity" && !selectedCommitHash ? (
-      <ProjectSectionHeader icon={GitCommitHorizontal} title="Commits" />
+      <ProjectSectionHeader
+        className={SECTION_HEADER_CLASS}
+        icon={GitCommitHorizontal}
+        title="Commits"
+      />
     ) : selectedTab === "issues" && !selectedIssueId ? (
       <ProjectSectionHeader
         action={{
@@ -363,6 +367,7 @@ export function WorkspaceTabs({
           label: "Create task",
           onClick: () => setCreateIssueOpen(true),
         }}
+        className={SECTION_HEADER_CLASS}
         icon={CircleDot}
         title="Tasks"
       />
@@ -376,18 +381,27 @@ export function WorkspaceTabs({
           onClick: () => setCreatePullRequestOpen(true),
           title: "Create review — choose a repository and branches to compare",
         }}
+        className={SECTION_HEADER_CLASS}
         icon={GitPullRequest}
         title="Reviews"
       />
     ) : selectedTab === "channels" ? (
-      <ProjectSectionHeader icon={Hash} title="Channels" />
+      <ProjectSectionHeader
+        className={SECTION_HEADER_CLASS}
+        icon={Hash}
+        title="Channels"
+      />
     ) : selectedTab === "contributors" ? (
-      <ProjectSectionHeader icon={Users} title="Contributors" />
+      <ProjectSectionHeader
+        className={SECTION_HEADER_CLASS}
+        icon={Users}
+        title="Contributors"
+      />
     ) : null;
 
   return (
     <Tabs
-      className="min-w-0 space-y-3"
+      className="flex min-w-0 flex-1 flex-col space-y-3"
       onValueChange={handleTabChange}
       value={selectedTab}
     >
@@ -415,14 +429,13 @@ export function WorkspaceTabs({
                   : "Update review"}
               </Button>
             ) : null}
-            {headerAction}
           </div>
         </div>
       ) : null}
       {/* Project content follows the same borderless flow as work-item details.
           Inner panels retain standalone chrome, neutralized here. */}
       <div
-        className="-mx-4 [&_[data-project-detail-panel]]:rounded-none [&_[data-project-detail-panel]]:border-0"
+        className="-mx-4 flex flex-1 flex-col [&_[data-project-detail-panel]]:rounded-none [&_[data-project-detail-panel]]:border-0"
         data-testid="project-workspace-panel"
       >
         {sectionHeader}
@@ -444,7 +457,10 @@ export function WorkspaceTabs({
           />
         </TabsContent>
 
-        <TabsContent className="m-0" value="activity">
+        <TabsContent
+          className="m-0 min-h-0 flex-1 flex-col data-[state=active]:flex"
+          value="activity"
+        >
           {repositoryUnavailableState ??
             (selectedCommitHash ? (
               <ProjectCommitDetailPanel
@@ -498,8 +514,7 @@ export function WorkspaceTabs({
             }
             error={pullRequestsError}
             filesChanged={
-              repositoryUnavailableState ??
-              (selectedPullRequest ? (
+              filesChangedBody === "files" && selectedPullRequest ? (
                 <ProjectPullRequestFilesChangedPanel
                   diff={repoDiff}
                   error={repoDiffError}
@@ -514,7 +529,9 @@ export function WorkspaceTabs({
                   project={project}
                   pullRequest={selectedPullRequest}
                 />
-              ) : undefined)
+              ) : filesChangedBody === "unavailable" ? (
+                repositoryUnavailableState
+              ) : undefined
             }
             filesCount={repoDiff?.files.length}
             forceOpenFiles={
@@ -528,7 +545,7 @@ export function WorkspaceTabs({
             profiles={profiles}
             project={project}
             pullRequests={pullRequests}
-            selectedPullRequestId={selectedPullRequestId}
+            selectedPullRequest={selectedPullRequest}
           />
         </TabsContent>
 
@@ -566,6 +583,7 @@ export function WorkspaceTabs({
                 files={files}
                 isLoading={displayedSnapshotLoading}
                 onContextChange={onFilesContextChange}
+                onOpenCommit={onSelectedCommitHashChange}
                 profiles={profiles}
                 snapshot={displayedSnapshot}
                 unavailableMessage={
diff --git a/desktop/src/features/projects/ui/ProjectsActivityFeed.tsx b/desktop/src/features/projects/ui/ProjectsActivityFeed.tsx
index cae4fdfe079..a7befcb560a 100644
--- a/desktop/src/features/projects/ui/ProjectsActivityFeed.tsx
+++ b/desktop/src/features/projects/ui/ProjectsActivityFeed.tsx
@@ -1,3 +1,7 @@
+import * as React from "react";
+
+import { useNow } from "@/shared/lib/useNow";
+
 import {
   resolveUserLabel,
   type UserProfileLookup,
@@ -181,7 +185,7 @@ function buildActivityItems({
       actorName: null,
       action: "created the repository",
       title: project.name,
-      body: contentPreview(project.description),
+      body: project.description,
       detail: null,
       target: { type: "project", project },
     });
@@ -228,7 +232,7 @@ function buildActivityItems({
       actorName: null,
       action: "opened a review in",
       title: pullRequest.title,
-      body: contentPreview(pullRequest.content),
+      body: pullRequest.content,
       detail: pullRequest.status,
       target,
     });
@@ -241,7 +245,7 @@ function buildActivityItems({
         actorName: null,
         action: "updated a review in",
         title: pullRequest.title,
-        body: contentPreview(update.content),
+        body: update.content,
         detail: update.commit?.slice(0, 7) ?? null,
         target,
       });
@@ -275,7 +279,7 @@ function buildActivityItems({
                 ? "requested review in"
                 : "commented on a review in",
         title: pullRequest.title,
-        body: contentPreview(comment.content),
+        body: comment.content,
         detail:
           kind === "approval"
             ? "Approved"
@@ -297,7 +301,7 @@ function buildActivityItems({
       actorName: null,
       action: "created a task in",
       title: issue.title,
-      body: contentPreview(issue.content),
+      body: issue.content,
       detail: issue.status,
       target,
     });
@@ -310,16 +314,26 @@ function buildActivityItems({
         actorName: null,
         action: "commented on a task in",
         title: issue.title,
-        body: contentPreview(comment.content),
+        body: comment.content,
         detail: null,
         target,
       });
     }
   }
 
-  return items
-    .sort((left, right) => right.createdAt - left.createdAt)
-    .slice(0, ACTIVITY_LIMIT);
+  return (
+    items
+      .sort((left, right) => right.createdAt - left.createdAt)
+      .slice(0, ACTIVITY_LIMIT)
+      // Bodies are carried raw until here so the markdown flattening runs for
+      // the rendered window only — every issue/PR/comment in the community
+      // used to be flattened just to be sorted and discarded.
+      .map((item) =>
+        item.body === null
+          ? item
+          : { ...item, body: contentPreview(item.body) },
+      )
+  );
 }
 
 export function buildProjectsActivityAgentContextItems(
@@ -358,8 +372,8 @@ function startOfWeek(timestamp: number) {
   return Math.floor(date.getTime() / 1_000);
 }
 
-function groupActivityItems(items: ProjectActivityItem[]) {
-  const thisWeek = startOfWeek(Math.floor(Date.now() / 1_000));
+function groupActivityItems(items: ProjectActivityItem[], nowMs: number) {
+  const thisWeek = startOfWeek(Math.floor(nowMs / 1_000));
   const lastWeek = thisWeek - WEEK_SECONDS;
   const groups: ProjectActivityGroup[] = [
     { key: "this-week", label: "This week", items: [] },
@@ -596,8 +610,21 @@ function ActivityCard({
 
 /** Mixed GitHub-style workspace activity shown beneath the overview callouts. */
 export function ProjectsActivityFeed(props: ProjectsActivityFeedProps) {
-  const items = buildActivityItems(props);
-  const groups = groupActivityItems(items);
+  const { issues, projects, pullRequests, snapshots } = props;
+  // Memoized: this feed re-renders with every parent state change (profiles
+  // landing, selection, hover), and an unmemoized rebuild re-flattened and
+  // re-sorted the whole community's activity each time.
+  const items = React.useMemo(
+    () => buildActivityItems({ issues, projects, pullRequests, snapshots }),
+    [issues, projects, pullRequests, snapshots],
+  );
+  // Week buckets are clock-derived; ticked so the memo cannot freeze "This
+  // week" across a week boundary. Coarse cadence — the boundary moves weekly.
+  const now = useNow(600_000);
+  const groups = React.useMemo(
+    () => groupActivityItems(items, now),
+    [items, now],
+  );
   const rangeItems = groups.flatMap((group) =>
     group.items.flatMap((item) => {
       const selectionItem = activitySelectionItem(item);
diff --git a/desktop/src/features/projects/ui/ProjectsAgentPromptPage.tsx b/desktop/src/features/projects/ui/ProjectsAgentPromptPage.tsx
index 81c1459f97e..9a465d3da0e 100644
--- a/desktop/src/features/projects/ui/ProjectsAgentPromptPage.tsx
+++ b/desktop/src/features/projects/ui/ProjectsAgentPromptPage.tsx
@@ -43,6 +43,8 @@ import { useProfileQuery, useUsersBatchQuery } from "@/features/profile/hooks";
 import type { Project } from "@/features/projects/hooks";
 import { AgentContextPayloadPreview } from "./AgentContextPayloadPreview";
 import {
+  PROJECT_WORKSPACE_CONTEXT_MARKER,
+  splitProjectDetailAgentContext,
   UNTRUSTED_CONTEXT_NOTICE,
   untrustedPromptValue,
 } from "@/features/projects/lib/projectDetailAgentContext";
@@ -70,6 +72,7 @@ import {
 import { cn } from "@/shared/lib/cn";
 import { normalizePubkey } from "@/shared/lib/pubkey";
 import { Button } from "@/shared/ui/button";
+import { ProjectAgentSubmittedContextPill } from "./ProjectAgentSubmittedContextPill";
 import {
   DropdownMenu,
   DropdownMenuContent,
@@ -94,7 +97,6 @@ type ProjectAgentConversation = {
 };
 
 const MAX_CONTEXT_REPOS = 8;
-const REPO_CONTEXT_MARKER = "Workspace repositories:";
 
 /** Compact machine-readable footer so the agent can scope git queries
  * (repo announcements are addressable by these coordinates). Only sent
@@ -119,7 +121,7 @@ function repoContextBlock(projects: readonly Project[]) {
         `- ${untrustedPromptValue(repository.label)} (address: ${untrustedPromptValue(repository.repoAddress, 400)})`,
     );
   const remaining = repositories.length - listed.length;
-  return ["", "---", REPO_CONTEXT_MARKER, ...listed]
+  return ["", "---", PROJECT_WORKSPACE_CONTEXT_MARKER, ...listed]
     .concat(remaining > 0 ? [`…and ${remaining} more`] : [])
     .concat([UNTRUSTED_CONTEXT_NOTICE])
     .join("\n");
@@ -203,11 +205,9 @@ export function useAgentCandidates() {
 }
 
 /** Live message feed for the conversation's backing DM channel, reduced to
- * plain chat rows (kind 9 / 40002 only). The user's own messages render
- * verbatim — including any machine-appended context footer — so the exact
- * payload signed under the user's identity is always visible. Hiding it
- * while sending it would let relay-controlled metadata ride invisibly on
- * the user's signature. */
+ * plain chat rows (kind 9 / 40002 only). Machine-appended context stays
+ * inspectable beside the user's message, but defaults to a compact disclosure
+ * so the transcript foregrounds what the user actually typed. */
 export function ConversationThread({
   channel,
   agent,
@@ -276,26 +276,47 @@ export function ConversationThread({
       selfAvatarUrl,
     ],
   );
-  const messages = React.useMemo(() => {
+  const conversationMessages = React.useMemo(() => {
     const events = mergeProjectAgentConversationEvents(
       messagesQuery.data ?? [],
       threadReplies.events,
     );
-    return formatTimelineMessages(
+    const contexts = new Map<string, string>();
+    const messages = formatTimelineMessages(
       events,
       channel,
       currentPubkey ?? undefined,
       selfAvatarUrl,
       profiles,
-    ).filter(
-      (message) =>
-        (message.kind === KIND_STREAM_MESSAGE ||
-          message.kind === KIND_STREAM_MESSAGE_V2) &&
-        isAtOrAfterConversationOpener(
-          { created_at: message.createdAt, id: message.id, tags: message.tags },
-          opener,
-        ),
-    );
+    )
+      .filter(
+        (message) =>
+          (message.kind === KIND_STREAM_MESSAGE ||
+            message.kind === KIND_STREAM_MESSAGE_V2) &&
+          isAtOrAfterConversationOpener(
+            {
+              created_at: message.createdAt,
+              id: message.id,
+              tags: message.tags,
+            },
+            opener,
+          ),
+      )
+      .map((message) => {
+        const authorPubkey = message.signerPubkey ?? message.pubkey;
+        if (
+          !normalizedCurrent ||
+          !authorPubkey ||
+          normalizePubkey(authorPubkey) !== normalizedCurrent
+        ) {
+          return message;
+        }
+        const split = splitProjectDetailAgentContext(message.body);
+        if (!split.context) return message;
+        contexts.set(message.id, split.context);
+        return { ...message, body: split.message };
+      });
+    return { contexts, messages };
   }, [
     channel,
     currentPubkey,
@@ -304,7 +325,18 @@ export function ConversationThread({
     selfAvatarUrl,
     threadReplies.events,
     opener,
+    normalizedCurrent,
   ]);
+  const messages = conversationMessages.messages;
+  const renderSubmittedContext = React.useCallback(
+    (message: TimelineMessage) => {
+      const payload = conversationMessages.contexts.get(message.id);
+      return payload ? (
+        <ProjectAgentSubmittedContextPill payload={payload} />
+      ) : null;
+    },
+    [conversationMessages.contexts],
+  );
   const lastMessageId = messages[messages.length - 1]?.id ?? null;
   const handleToggleReaction = React.useCallback(
     async (message: TimelineMessage, emoji: string, remove: boolean) => {
@@ -329,6 +361,7 @@ export function ConversationThread({
         messages={messages}
         onToggleReaction={handleToggleReaction}
         profiles={profiles}
+        renderAfterMessage={renderSubmittedContext}
       />
       {agentWorking.working ? (
         <div className="flex items-center gap-2 pl-11 text-sm text-muted-foreground">
diff --git a/desktop/src/features/projects/ui/ProjectsChannelsList.tsx b/desktop/src/features/projects/ui/ProjectsChannelsList.tsx
index ce1c723dc1a..b2904afc4e4 100644
--- a/desktop/src/features/projects/ui/ProjectsChannelsList.tsx
+++ b/desktop/src/features/projects/ui/ProjectsChannelsList.tsx
@@ -124,6 +124,7 @@ export function ProjectsChannelsList({ projects }: { projects: Project[] }) {
         <ProjectSelectableGroup
           count={group.rows.length}
           groupKey={group.projectId}
+          headerClassName="mx-0 gap-3 px-4"
           headerTestId="projects-channel-project-group-header"
           icon={<FolderKanban className="h-4 w-4" />}
           items={group.rows.flatMap((row) => {
diff --git a/desktop/src/features/projects/ui/ProjectsContributionGraph.tsx b/desktop/src/features/projects/ui/ProjectsContributionGraph.tsx
deleted file mode 100644
index 64d3430fe61..00000000000
--- a/desktop/src/features/projects/ui/ProjectsContributionGraph.tsx
+++ /dev/null
@@ -1,170 +0,0 @@
-import { cn } from "@/shared/lib/cn";
-import { Tooltip, TooltipContent, TooltipTrigger } from "@/shared/ui/tooltip";
-
-const WEEK_COUNT = 26;
-const DAYS_PER_WEEK = 7;
-
-// Intensity ramp shared by the cells and the legend dots.
-// Tints of the theme's primary token: the most active cells are fully
-// saturated primary, quieter days fade toward the muted background.
-const LEVEL_CLASSES = [
-  "bg-muted/40 dark:bg-muted/30",
-  "bg-primary/25",
-  "bg-primary/50",
-  "bg-primary/75",
-  "bg-primary",
-];
-
-// Descriptors matching the thresholds in `levelFor`.
-const LEVEL_LABELS = [
-  "No activity",
-  "1–2 events",
-  "3–5 events",
-  "6–9 events",
-  "10+ events",
-];
-
-/** Activity intensity legend shared with the contribution graph header. */
-export function ProjectsContributionLegend() {
-  return (
-    <div className="flex items-center gap-1.5">
-      {LEVEL_CLASSES.map((levelClass, level) => (
-        <Tooltip key={levelClass}>
-          <TooltipTrigger asChild>
-            <span className={cn("h-2.5 w-2.5 rounded", levelClass)} />
-          </TooltipTrigger>
-          <TooltipContent>{LEVEL_LABELS[level]}</TooltipContent>
-        </Tooltip>
-      ))}
-    </div>
-  );
-}
-
-function dayKeyOf(date: Date) {
-  const month = `${date.getMonth() + 1}`.padStart(2, "0");
-  const day = `${date.getDate()}`.padStart(2, "0");
-  return `${date.getFullYear()}-${month}-${day}`;
-}
-
-function levelFor(count: number) {
-  if (count <= 0) return 0;
-  if (count <= 2) return 1;
-  if (count <= 5) return 2;
-  if (count <= 9) return 3;
-  return 4;
-}
-
-/** Week columns (each 7 days, Sunday first) ending with the current week. */
-function buildWeeks(today: Date, weekCount: number) {
-  const start = new Date(
-    today.getFullYear(),
-    today.getMonth(),
-    today.getDate() - today.getDay() - (weekCount - 1) * DAYS_PER_WEEK,
-  );
-
-  return Array.from({ length: weekCount }, (_, weekIndex) =>
-    Array.from({ length: DAYS_PER_WEEK }, (_, dayIndex) => {
-      const date = new Date(start);
-      date.setDate(start.getDate() + weekIndex * DAYS_PER_WEEK + dayIndex);
-      return date;
-    }),
-  );
-}
-
-// Minimum columns between labels so adjacent months never overlap.
-const MIN_LABEL_GAP = 3;
-
-function monthLabels(weeks: Date[][]) {
-  let lastLabeledIndex = -MIN_LABEL_GAP;
-  return weeks.map((week, index) => {
-    const isNewMonth =
-      index === 0 || week[0].getMonth() !== weeks[index - 1][0].getMonth();
-    if (!isNewMonth || index - lastLabeledIndex < MIN_LABEL_GAP) return "";
-    lastLabeledIndex = index;
-    return week[0].toLocaleDateString(undefined, { month: "short" });
-  });
-}
-
-/**
- * GitHub-style activity heatmap for the last 26 weeks, fed by per-day
- * activity counts (see `ProjectActivitySummary.activityByDay`).
- */
-export function ProjectsContributionGraph({
-  activityByDay,
-  className,
-  compact = false,
-}: {
-  activityByDay: Record<string, number>;
-  className?: string;
-  compact?: boolean;
-}) {
-  const today = new Date();
-  const weeks = buildWeeks(today, compact ? 18 : WEEK_COUNT);
-  const labels = monthLabels(weeks);
-  const gridTemplateColumns = `repeat(${weeks.length}, minmax(0, 1fr))`;
-  const todayKey = dayKeyOf(today);
-
-  return (
-    <div className={cn("space-y-2", className)}>
-      <div
-        className={cn("grid", compact ? "gap-1" : "gap-2")}
-        style={{ gridTemplateColumns }}
-      >
-        {labels.map((label, index) => (
-          <span
-            className="overflow-visible whitespace-nowrap text-2xs font-medium text-muted-foreground"
-            // Columns are positional; labels have no stable content key.
-            // biome-ignore lint/suspicious/noArrayIndexKey: fixed-size grid
-            key={index}
-          >
-            {label}
-          </span>
-        ))}
-      </div>
-      <div
-        className={cn(
-          "grid grid-flow-col grid-rows-7",
-          compact ? "gap-1" : "gap-2",
-        )}
-        style={{ gridTemplateColumns }}
-      >
-        {weeks.map((week) =>
-          week.map((day) => {
-            const key = dayKeyOf(day);
-            if (key > todayKey) {
-              return (
-                <span
-                  aria-hidden
-                  className="aspect-square rounded-[22%] border border-border/40 dark:border-border/30"
-                  key={key}
-                />
-              );
-            }
-            const count = activityByDay[key] ?? 0;
-            const dateLabel = day.toLocaleDateString(undefined, {
-              month: "short",
-              day: "numeric",
-            });
-            return (
-              <Tooltip key={key}>
-                <TooltipTrigger asChild>
-                  <span
-                    className={cn(
-                      "aspect-square w-full rounded-[22%]",
-                      LEVEL_CLASSES[levelFor(count)],
-                    )}
-                  />
-                </TooltipTrigger>
-                <TooltipContent>
-                  {count > 0
-                    ? `${count} ${count === 1 ? "event" : "events"} · ${dateLabel}`
-                    : `No activity · ${dateLabel}`}
-                </TooltipContent>
-              </Tooltip>
-            );
-          }),
-        )}
-      </div>
-    </div>
-  );
-}
diff --git a/desktop/src/features/projects/ui/ProjectsIssuesList.tsx b/desktop/src/features/projects/ui/ProjectsIssuesList.tsx
index 542678b415c..c7c55367be5 100644
--- a/desktop/src/features/projects/ui/ProjectsIssuesList.tsx
+++ b/desktop/src/features/projects/ui/ProjectsIssuesList.tsx
@@ -1,4 +1,5 @@
 import { Eye, FolderKanban } from "lucide-react";
+import * as React from "react";
 
 import type {
   Project,
@@ -13,6 +14,11 @@ import {
   resolveUserLabel,
   type UserProfileLookup,
 } from "@/features/profile/lib/identity";
+import {
+  countGroupedRows,
+  sliceGroupedRows,
+  useIncrementalMount,
+} from "@/shared/hooks/useIncrementalMount";
 import { cn } from "@/shared/lib/cn";
 import { BuzzLoadingState } from "@/shared/ui/BuzzLoadingState";
 import { Card } from "@/shared/ui/card";
@@ -53,14 +59,20 @@ function nextStepLabel(status: ProjectIssue["status"]) {
   return "Open task";
 }
 
-function IssueGridCard({
+const IssueGridCard = React.memo(function IssueGridCard({
   issue,
   onOpen,
   project,
+  repository,
 }: {
   issue: ProjectIssue;
-  onOpen: (project: Project, issue: ProjectIssue) => void;
+  onOpen: (
+    project: Project,
+    repository: Repository,
+    issue: ProjectIssue,
+  ) => void;
   project: Project;
+  repository: Repository;
 }) {
   return (
     <Card
@@ -69,7 +81,7 @@ function IssueGridCard({
     >
       <button
         className="absolute inset-0"
-        onClick={() => onOpen(project, issue)}
+        onClick={() => onOpen(project, repository, issue)}
         type="button"
       >
         <span className="sr-only">View task {issue.title}</span>
@@ -97,7 +109,7 @@ function IssueGridCard({
       </div>
     </Card>
   );
-}
+});
 
 function issueSelectionItem(
   project: Project,
@@ -113,7 +125,10 @@ function issueSelectionItem(
   });
 }
 
-function IssueListRow({
+// Memoized: these rows render in unbounded lists, and any Projects-view
+// state change used to re-render every row. Props are kept identity-stable
+// by the list (memoized groups/selection arrays, stable onOpen).
+const IssueListRow = React.memo(function IssueListRow({
   issue,
   onOpen,
   profiles,
@@ -122,7 +137,11 @@ function IssueListRow({
   repository,
 }: {
   issue: ProjectIssue;
-  onOpen: (project: Project, issue: ProjectIssue) => void;
+  onOpen: (
+    project: Project,
+    repository: Repository,
+    issue: ProjectIssue,
+  ) => void;
   profiles?: UserProfileLookup;
   project: Project;
   rangeItems: ReturnType<typeof issueSelectionItem>[];
@@ -137,7 +156,7 @@ function IssueListRow({
       dateSeconds={issue.updatedAt}
       dateTestId="projects-row-date"
       icon={null}
-      onClick={() => onOpen(project, issue)}
+      onClick={() => onOpen(project, repository, issue)}
       peopleSlot={
         <ProjectAuthorIdentity
           label={authorLabel}
@@ -157,7 +176,7 @@ function IssueListRow({
       titleIcon={<ProjectEventTypeIcon className="h-3.5 w-3.5" kind="issue" />}
       trailing={
         <ProjectListRowMenu label={`More options for ${issue.title}`}>
-          <DropdownMenuItem onSelect={() => onOpen(project, issue)}>
+          <DropdownMenuItem onSelect={() => onOpen(project, repository, issue)}>
             <Eye className="h-4 w-4" />
             {nextStepLabel(issue.status)}
           </DropdownMenuItem>
@@ -170,7 +189,7 @@ function IssueListRow({
       }
     />
   );
-}
+});
 
 export function ProjectsIssuesList({
   embedded,
@@ -185,6 +204,40 @@ export function ProjectsIssuesList({
   profiles,
   viewMode,
 }: ProjectsIssuesListProps) {
+  // Grouping and per-group selection arrays are identity-stable across
+  // re-renders so the memoized rows only re-render when their data changes.
+  const allGroups = React.useMemo(
+    () =>
+      groupProjectWorkItemsByProject(issues).map((group) => ({
+        ...group,
+        selectionItems: group.rows.map((row) =>
+          issueSelectionItem(row.project, row.repository, row.issue),
+        ),
+      })),
+    [issues],
+  );
+  // Mount rows progressively: a one-shot mount of hundreds of rows blocked
+  // the main thread for over a second on tab entry.
+  // Each layout's counter grows only while that layout is active: otherwise
+  // a layout switch would find the other counter already grown and mount the
+  // whole collection in one commit.
+  const mountedRowCount = useIncrementalMount(
+    countGroupedRows(allGroups),
+    30,
+    60,
+    viewMode !== "grid",
+  );
+  const mountedGridCount = useIncrementalMount(
+    issues.length,
+    30,
+    60,
+    viewMode === "grid",
+  );
+  const groups = React.useMemo(
+    () => sliceGroupedRows(allGroups, mountedRowCount),
+    [allGroups, mountedRowCount],
+  );
+
   if (isLoading) {
     return <BuzzLoadingState label="Loading tasks" />;
   }
@@ -224,35 +277,33 @@ export function ProjectsIssuesList({
       <div className="space-y-3">
         {loadNotice}
         <div className="grid gap-3 md:grid-cols-2 xl:grid-cols-3">
-          {issues.map(({ project, issue, repository }) => (
-            <IssueGridCard
-              issue={issue}
-              key={`${repository.id}:${issue.id}`}
-              onOpen={(selectedProject, selectedIssue) =>
-                onOpen(selectedProject, repository, selectedIssue)
-              }
-              project={project}
-            />
-          ))}
+          {issues
+            .slice(0, mountedGridCount)
+            .map(({ project, issue, repository }) => (
+              <IssueGridCard
+                issue={issue}
+                key={`${repository.id}:${issue.id}`}
+                onOpen={onOpen}
+                project={project}
+                repository={repository}
+              />
+            ))}
         </div>
       </div>
     );
   }
 
-  const groups = groupProjectWorkItemsByProject(issues);
-
   return (
     <div className="space-y-3">
       {loadNotice}
       <div data-testid="projects-list-container">
         {groups.map((group) => {
-          const groupSelectionItems = group.rows.map((row) =>
-            issueSelectionItem(row.project, row.repository, row.issue),
-          );
+          const groupSelectionItems = group.selectionItems;
           return (
             <ProjectSelectableGroup
               count={group.rows.length}
               groupKey={group.project.id}
+              headerClassName="mx-0 gap-3 px-4"
               headerTestId="projects-issue-project-group-header"
               icon={<FolderKanban className="h-4 w-4" />}
               items={groupSelectionItems}
@@ -263,12 +314,13 @@ export function ProjectsIssuesList({
             >
               <ul>
                 {group.rows.map(({ project, issue, repository }) => (
-                  <li key={`${repository.id}:${issue.id}`}>
+                  <li
+                    className="[contain-intrinsic-size:auto_3.5rem] [content-visibility:auto]"
+                    key={`${repository.id}:${issue.id}`}
+                  >
                     <IssueListRow
                       issue={issue}
-                      onOpen={(selectedProject, selectedIssue) =>
-                        onOpen(selectedProject, repository, selectedIssue)
-                      }
+                      onOpen={onOpen}
                       profiles={profiles}
                       project={project}
                       rangeItems={groupSelectionItems}
diff --git a/desktop/src/features/projects/ui/ProjectsListHeaderBar.tsx b/desktop/src/features/projects/ui/ProjectsListHeaderBar.tsx
index 92eb2c150ec..99587133974 100644
--- a/desktop/src/features/projects/ui/ProjectsListHeaderBar.tsx
+++ b/desktop/src/features/projects/ui/ProjectsListHeaderBar.tsx
@@ -7,7 +7,6 @@ import type {
 } from "@/features/projects/lib/projectsViewHelpers";
 import { ProjectsListScopeDropdown } from "@/features/projects/ui/ProjectsListScopeDropdown";
 import { ProjectsViewModeToggle } from "@/features/projects/ui/ProjectsToolbar";
-import { cn } from "@/shared/lib/cn";
 
 const PROJECT_SCOPE_OPTIONS: Array<{
   label: string;
@@ -56,18 +55,11 @@ type ProjectsListHeaderBarProps = {
   pullRequestScope: ProjectsWorkItemScope;
   repositoryScope: ProjectsRepositoryScope;
   sort: ProjectsSort;
-  /**
-   * "row" renders as the first row of the list table (no chrome of its own —
-   * the surrounding container provides border and rounding); "bar" renders as
-   * a standalone rounded bar with identical proportions for the card grid.
-   */
-  variant: "bar" | "row";
   viewMode: ProjectsViewMode;
 };
 
 /**
- * Header for the Projects lists: scope selector on the left, sort + view
- * toggle on the right.
+ * Compact controls rendered in the Projects section header.
  */
 export function ProjectsListHeaderBar({
   filter,
@@ -80,7 +72,6 @@ export function ProjectsListHeaderBar({
   pullRequestScope,
   repositoryScope,
   sort,
-  variant,
   viewMode,
 }: ProjectsListHeaderBarProps) {
   const scopeDropdown =
@@ -116,35 +107,26 @@ export function ProjectsListHeaderBar({
 
   return (
     <div
-      className={cn(
-        "flex flex-wrap items-center justify-between gap-2 bg-muted/20 px-3 py-1.5",
-        variant === "bar"
-          ? "rounded-xl border border-border/60"
-          : "border-b border-border/60",
-      )}
+      className="ml-auto flex flex-wrap items-center justify-end gap-2"
       data-testid="projects-list-header"
     >
-      <div className="flex flex-wrap items-center gap-2">{scopeDropdown}</div>
-      <div className="flex flex-wrap items-center gap-2">
-        <label className="flex items-center gap-2 text-xs text-muted-foreground">
-          <span className="sr-only">Sort projects</span>
-          <select
-            className="h-8 rounded-md bg-transparent px-2 text-xs text-foreground outline-hidden hover:bg-muted/50 focus:ring-1 focus:ring-ring"
-            onChange={(event) =>
-              onSortChange(event.target.value as ProjectsSort)
-            }
-            value={sort}
-          >
-            <option value="updated">Recent activity</option>
-            <option value="created">Created date</option>
-            <option value="name">Name</option>
-          </select>
-        </label>
-        <ProjectsViewModeToggle
-          onViewModeChange={onViewModeChange}
-          viewMode={viewMode}
-        />
-      </div>
+      {scopeDropdown}
+      <label className="flex items-center gap-2 text-xs text-muted-foreground">
+        <span className="sr-only">Sort projects</span>
+        <select
+          className="h-8 rounded-md bg-transparent px-2 text-xs text-foreground outline-hidden hover:bg-muted/50 focus:ring-1 focus:ring-ring"
+          onChange={(event) => onSortChange(event.target.value as ProjectsSort)}
+          value={sort}
+        >
+          <option value="updated">Recent activity</option>
+          <option value="created">Created date</option>
+          <option value="name">Name</option>
+        </select>
+      </label>
+      <ProjectsViewModeToggle
+        onViewModeChange={onViewModeChange}
+        viewMode={viewMode}
+      />
     </div>
   );
 }
diff --git a/desktop/src/features/projects/ui/ProjectsOverviewChromeActions.tsx b/desktop/src/features/projects/ui/ProjectsOverviewChromeActions.tsx
new file mode 100644
index 00000000000..ba7cce9a818
--- /dev/null
+++ b/desktop/src/features/projects/ui/ProjectsOverviewChromeActions.tsx
@@ -0,0 +1,62 @@
+import { Info, MessageCircle } from "lucide-react";
+
+import { cn } from "@/shared/lib/cn";
+import { Button } from "@/shared/ui/button";
+
+export function ProjectsOverviewChromeActions({
+  chatOpen,
+  contextOpen,
+  onToggleChat,
+  onToggleContext,
+  sectionTitle,
+}: {
+  chatOpen: boolean;
+  contextOpen: boolean;
+  onToggleChat: () => void;
+  onToggleContext: () => void;
+  sectionTitle: string;
+}) {
+  return (
+    <>
+      <Button
+        aria-label={`Chat with an agent about ${sectionTitle}`}
+        aria-pressed={chatOpen}
+        className="h-7 w-7 text-sidebar-foreground hover:bg-sidebar-accent"
+        data-testid="projects-overview-chat-toggle"
+        onClick={onToggleChat}
+        size="icon"
+        title={`Chat with an agent about ${sectionTitle}`}
+        type="button"
+        variant="ghost"
+      >
+        <MessageCircle
+          className={cn(
+            "h-4 w-4 transition-opacity duration-200 ease-linear",
+            chatOpen ? "opacity-100" : "opacity-60",
+          )}
+        />
+      </Button>
+      <Button
+        aria-label={
+          contextOpen ? "Hide project context" : "Show project context"
+        }
+        aria-pressed={contextOpen}
+        className="h-7 w-7 text-sidebar-foreground hover:bg-sidebar-accent"
+        data-testid="projects-overview-context-toggle"
+        onClick={onToggleContext}
+        size="icon"
+        title={contextOpen ? "Hide project context" : "Show project context"}
+        type="button"
+        variant="ghost"
+      >
+        <Info
+          className={cn(
+            "h-4 w-4 transition-opacity duration-200 ease-linear",
+            contextOpen ? "opacity-100" : "opacity-60",
+          )}
+          data-testid="projects-overview-context-icon"
+        />
+      </Button>
+    </>
+  );
+}
diff --git a/desktop/src/features/projects/ui/ProjectsOverviewItems.tsx b/desktop/src/features/projects/ui/ProjectsOverviewItems.tsx
index df1ceb25595..3c23c7452b0 100644
--- a/desktop/src/features/projects/ui/ProjectsOverviewItems.tsx
+++ b/desktop/src/features/projects/ui/ProjectsOverviewItems.tsx
@@ -1,3 +1,5 @@
+import * as React from "react";
+
 import type { UserProfileLookup } from "@/features/profile/lib/identity";
 import type {
   Project,
@@ -32,8 +34,12 @@ import {
   RepositoryGridCard,
   RepositoryListRow,
 } from "@/features/projects/ui/RepositoryCards";
+import { useIncrementalMount } from "@/shared/hooks/useIncrementalMount";
 import { cn } from "@/shared/lib/cn";
 
+// Stable fallback so a cache miss cannot hand a memoized card a fresh array.
+const EMPTY_PEOPLE: string[] = [];
+
 export function ProjectsOverviewProjectItems({
   currentPubkey,
   deleteDisabled,
@@ -63,6 +69,51 @@ export function ProjectsOverviewProjectItems({
   viewMode: ProjectsViewMode;
   visibleProjects: Project[];
 }) {
+  // One selection array shared by every row (was rebuilt per row per render —
+  // O(n²) object churn that also defeated row memoization).
+  const selectionRangeItems = React.useMemo(
+    () =>
+      visibleProjects.map((item) =>
+        selectionItemFromProject({
+          channelId: item.projectChannelId,
+          id: item.id,
+          owner: item.owner,
+          shareLink: projectShareLink(item),
+          title: item.name,
+        }),
+      ),
+    [visibleProjects],
+  );
+  // Identity-stable people arrays: an inline projectPeople() call would hand
+  // every memoized card a fresh array each render, defeating React.memo.
+  const peopleByProject = React.useMemo(
+    () =>
+      new Map(
+        visibleProjects.map((project) => [
+          project.id,
+          projectPeople(project, summaries?.[project.id]),
+        ]),
+      ),
+    [summaries, visibleProjects],
+  );
+  // Mount cards progressively; a one-shot mount of every card blocked the
+  // main thread on tab entry.
+  // Cards cost ~5ms each to mount (activity bar, people stack, menus); the
+  // viewport fits under a dozen, so a small first window keeps the tab-entry
+  // commit short and the rest streams in within a few frames.
+  // Grid cards are the expensive layout; while list view is active the
+  // counter stays dormant at its initial window so a later list→grid switch
+  // still mounts incrementally instead of in one full-collection commit.
+  const mountedCount = useIncrementalMount(
+    visibleProjects.length,
+    12,
+    36,
+    viewMode === "grid",
+  );
+  const mountedProjects = React.useMemo(
+    () => visibleProjects.slice(0, mountedCount),
+    [mountedCount, visibleProjects],
+  );
   if (visibleProjects.length === 0) {
     return <EmptyFilteredState />;
   }
@@ -74,61 +125,64 @@ export function ProjectsOverviewProjectItems({
           filter !== "all" && "xl:grid-cols-3",
         )}
       >
-        {visibleProjects.map((project) => {
+        {mountedProjects.map((project) => {
           const summary = summaries?.[project.id];
           return (
-            <ProjectGridCard
+            <div
+              className={
+                "[contain-intrinsic-size:auto_11rem] [content-visibility:auto]"
+              }
+              key={project.id}
+            >
+              <ProjectGridCard
+                canDelete={isProjectOwnedByCurrentUser(project, currentPubkey)}
+                deleteDisabled={deleteDisabled}
+                hasLocal={hasLocalCheckout(project, localRepoNames)}
+                onDelete={onDelete}
+                onOpen={onOpen}
+                onOpenTerminal={onOpenTerminal}
+                people={peopleByProject.get(project.id) ?? EMPTY_PEOPLE}
+                profiles={profiles}
+                project={project}
+                repositoryUnavailableReason={repositoryUnavailableReasonFor(
+                  project,
+                )}
+                summary={summary}
+              />
+            </div>
+          );
+        })}
+      </div>
+    );
+  }
+  return (
+    <div data-testid="projects-list-container">
+      {visibleProjects.map((project) => {
+        const summary = summaries?.[project.id];
+        return (
+          <div
+            className={
+              "[contain-intrinsic-size:auto_3.5rem] [content-visibility:auto]"
+            }
+            key={project.id}
+          >
+            <ProjectListRow
               canDelete={isProjectOwnedByCurrentUser(project, currentPubkey)}
               deleteDisabled={deleteDisabled}
               hasLocal={hasLocalCheckout(project, localRepoNames)}
-              key={project.id}
               onDelete={onDelete}
               onOpen={onOpen}
               onOpenTerminal={onOpenTerminal}
-              people={projectPeople(project, summary)}
+              people={peopleByProject.get(project.id) ?? EMPTY_PEOPLE}
               profiles={profiles}
               project={project}
               repositoryUnavailableReason={repositoryUnavailableReasonFor(
                 project,
               )}
+              selectionRangeItems={selectionRangeItems}
               summary={summary}
             />
-          );
-        })}
-      </div>
-    );
-  }
-  return (
-    <div data-testid="projects-list-container">
-      {visibleProjects.map((project) => {
-        const summary = summaries?.[project.id];
-        const selectionRangeItems = visibleProjects.map((item) =>
-          selectionItemFromProject({
-            channelId: item.projectChannelId,
-            id: item.id,
-            owner: item.owner,
-            shareLink: projectShareLink(item),
-            title: item.name,
-          }),
-        );
-        return (
-          <ProjectListRow
-            canDelete={isProjectOwnedByCurrentUser(project, currentPubkey)}
-            deleteDisabled={deleteDisabled}
-            hasLocal={hasLocalCheckout(project, localRepoNames)}
-            key={project.id}
-            onDelete={onDelete}
-            onOpen={onOpen}
-            onOpenTerminal={onOpenTerminal}
-            people={projectPeople(project, summary)}
-            profiles={profiles}
-            project={project}
-            repositoryUnavailableReason={repositoryUnavailableReasonFor(
-              project,
-            )}
-            selectionRangeItems={selectionRangeItems}
-            summary={summary}
-          />
+          </div>
         );
       })}
     </div>
@@ -152,23 +206,56 @@ export function ProjectsOverviewRepositoryItems({
   viewMode: ProjectsViewMode;
   visibleRepositories: Array<{ project: Project; repository: Repository }>;
 }) {
+  // Shared, identity-stable selection array (see ProjectsOverviewProjectItems).
+  const selectionRangeItems = React.useMemo(
+    () =>
+      visibleRepositories.map((row) =>
+        selectionItemFromRepository({
+          channelId: row.repository.channelId ?? row.project.projectChannelId,
+          id: row.repository.id,
+          owner: row.repository.owner,
+          shareLink: repositoryShareLink(row.repository),
+          title: row.repository.name,
+        }),
+      ),
+    [visibleRepositories],
+  );
+  // Mount cards progressively (see ProjectsOverviewProjectItems).
+  // Small first window: see ProjectsOverviewProjectItems.
+  // Dormant outside grid layout; see ProjectsOverviewProjectItems.
+  const mountedCount = useIncrementalMount(
+    visibleRepositories.length,
+    12,
+    36,
+    viewMode === "grid",
+  );
+  const mountedRepositories = React.useMemo(
+    () => visibleRepositories.slice(0, mountedCount),
+    [mountedCount, visibleRepositories],
+  );
   if (visibleRepositories.length === 0) {
     return <EmptyFilteredState />;
   }
   if (viewMode === "grid") {
     return (
       <div className="grid gap-3 md:grid-cols-2 xl:grid-cols-3">
-        {visibleRepositories.map(({ project, repository }) => (
-          <RepositoryGridCard
-            hasLocal={hasLocalRepositoryCheckout(repository, localRepoNames)}
+        {mountedRepositories.map(({ project, repository }) => (
+          <div
+            className={
+              "[contain-intrinsic-size:auto_11rem] [content-visibility:auto]"
+            }
             key={repository.repoAddress}
-            onOpen={onOpen}
-            onOpenTerminal={onOpenTerminal}
-            profiles={profiles}
-            project={project}
-            repository={repository}
-            summary={summaries?.[repository.repoAddress]}
-          />
+          >
+            <RepositoryGridCard
+              hasLocal={hasLocalRepositoryCheckout(repository, localRepoNames)}
+              onOpen={onOpen}
+              onOpenTerminal={onOpenTerminal}
+              profiles={profiles}
+              project={project}
+              repository={repository}
+              summary={summaries?.[repository.repoAddress]}
+            />
+          </div>
         ))}
       </div>
     );
@@ -176,26 +263,23 @@ export function ProjectsOverviewRepositoryItems({
   return (
     <div data-testid="projects-list-container">
       {visibleRepositories.map(({ project, repository }) => (
-        <RepositoryListRow
-          hasLocal={hasLocalRepositoryCheckout(repository, localRepoNames)}
+        <div
+          className={
+            "[contain-intrinsic-size:auto_3.5rem] [content-visibility:auto]"
+          }
           key={repository.repoAddress}
-          onOpen={onOpen}
-          onOpenTerminal={onOpenTerminal}
-          profiles={profiles}
-          project={project}
-          repository={repository}
-          selectionRangeItems={visibleRepositories.map((row) =>
-            selectionItemFromRepository({
-              channelId:
-                row.repository.channelId ?? row.project.projectChannelId,
-              id: row.repository.id,
-              owner: row.repository.owner,
-              shareLink: repositoryShareLink(row.repository),
-              title: row.repository.name,
-            }),
-          )}
-          summary={summaries?.[repository.repoAddress]}
-        />
+        >
+          <RepositoryListRow
+            hasLocal={hasLocalRepositoryCheckout(repository, localRepoNames)}
+            onOpen={onOpen}
+            onOpenTerminal={onOpenTerminal}
+            profiles={profiles}
+            project={project}
+            repository={repository}
+            selectionRangeItems={selectionRangeItems}
+            summary={summaries?.[repository.repoAddress]}
+          />
+        </div>
       ))}
     </div>
   );
diff --git a/desktop/src/features/projects/ui/ProjectsOverviewPanel.tsx b/desktop/src/features/projects/ui/ProjectsOverviewPanel.tsx
index 81d1e954a86..f774c192d51 100644
--- a/desktop/src/features/projects/ui/ProjectsOverviewPanel.tsx
+++ b/desktop/src/features/projects/ui/ProjectsOverviewPanel.tsx
@@ -8,7 +8,7 @@ import {
   Hash,
   Plus,
 } from "lucide-react";
-import type * as React from "react";
+import * as React from "react";
 
 import type {
   Project,
@@ -26,15 +26,14 @@ import type { UserProfileLookup } from "@/features/profile/lib/identity";
 import { Button } from "@/shared/ui/button";
 import { ProjectsCreateMenu } from "./ProjectsCreateMenu";
 import { ProjectsSelectionCountMenu } from "./ProjectsSelectionCountMenu";
+import { useCommunities } from "@/features/communities/useCommunities";
+import { useActiveCommunityIcon } from "@/features/communities/useCommunityIcons";
 import {
   type OverviewContextStatIcon,
   type ProjectsOverviewSection,
   projectsOverviewContext,
 } from "./projectsOverviewContext";
-import {
-  ProjectsOverviewActivityGraph,
-  ProjectsOverviewPeople,
-} from "./ProjectsOverviewRail";
+import { ProjectsOverviewPeople } from "./ProjectsOverviewRail";
 
 export type { ProjectsOverviewSection };
 
@@ -130,11 +129,34 @@ export function ProjectsOverviewPanel({
 }
 
 export function ProjectsActivityIntro() {
+  const { activeCommunity } = useCommunities();
+  const communityIconQuery = useActiveCommunityIcon(activeCommunity?.relayUrl);
+  const communityIcon = communityIconQuery.data ?? null;
+
   return (
     <section
-      className="pb-8 pt-5 text-center"
+      className="pb-8 pt-16 text-center"
       data-testid="projects-activity-intro"
     >
+      <div
+        aria-label={`${activeCommunity?.name ?? "Current"} relay`}
+        className="mx-auto mb-3 flex h-10 w-10 items-center justify-center overflow-hidden rounded-xl text-4xl"
+        data-testid="projects-activity-relay-icon"
+        role="img"
+      >
+        {communityIcon ? (
+          <img
+            alt=""
+            className="h-full w-full object-cover"
+            draggable={false}
+            src={communityIcon}
+          />
+        ) : (
+          <span aria-hidden="true" className="-translate-y-px leading-none">
+            🐝
+          </span>
+        )}
+      </div>
       <h2
         className="text-xl font-semibold tracking-tight text-foreground"
         data-testid="projects-page-header"
@@ -162,16 +184,24 @@ export function ProjectsOverviewContextPanel({
   summaries,
 }: ProjectsOverviewContextPanelProps) {
   const selection = useProjectSelection();
-  const selectionPresentation = projectSelectionPresentation(
-    selection?.items ?? [],
+  const selectionItems = selection?.items;
+  const selectionPresentation = React.useMemo(
+    () => projectSelectionPresentation(selectionItems ?? []),
+    [selectionItems],
+  );
+  // Memoized: the rail re-renders with every Projects-view state change, and
+  // the context stats walk every issue and pull request in the community.
+  const context = React.useMemo(
+    () =>
+      projectsOverviewContext({
+        filter,
+        issues,
+        projects,
+        pullRequests,
+        summaries,
+      }),
+    [filter, issues, projects, pullRequests, summaries],
   );
-  const context = projectsOverviewContext({
-    filter,
-    issues,
-    projects,
-    pullRequests,
-    summaries,
-  });
   const actionHandler =
     context.action?.kind === "issue"
       ? onCreateIssue
@@ -235,19 +265,12 @@ export function ProjectsOverviewContextPanel({
                 ))}
               </section>
             </div>
-            {context.people.length > 0 || context.activityByDay ? (
+            {context.people.length > 0 ? (
               <div className="mt-3 space-y-3 py-3">
                 <ProjectsOverviewPeople
                   people={context.people}
                   profiles={profiles}
                 />
-                {context.activityByDay ? (
-                  <div data-testid="projects-overview-activity">
-                    <ProjectsOverviewActivityGraph
-                      activityByDay={context.activityByDay}
-                    />
-                  </div>
-                ) : null}
               </div>
             ) : null}
           </>
diff --git a/desktop/src/features/projects/ui/ProjectsOverviewRail.tsx b/desktop/src/features/projects/ui/ProjectsOverviewRail.tsx
index c4380f684d3..edc7077c5bb 100644
--- a/desktop/src/features/projects/ui/ProjectsOverviewRail.tsx
+++ b/desktop/src/features/projects/ui/ProjectsOverviewRail.tsx
@@ -8,7 +8,6 @@ import { cn } from "@/shared/lib/cn";
 import { normalizePubkey } from "@/shared/lib/pubkey";
 import { Tooltip, TooltipContent, TooltipTrigger } from "@/shared/ui/tooltip";
 import { UserAvatar } from "@/shared/ui/UserAvatar";
-import { ProjectsContributionGraph } from "./ProjectsContributionGraph";
 
 /** Matches Tailwind `-space-x-1.5` so stacked rows stay zoom-safe. */
 const STACK_OVERLAP_REM = 0.375;
@@ -180,11 +179,3 @@ export function ProjectsOverviewPeople({
     </div>
   );
 }
-
-export function ProjectsOverviewActivityGraph({
-  activityByDay,
-}: {
-  activityByDay: Record<string, number>;
-}) {
-  return <ProjectsContributionGraph activityByDay={activityByDay} compact />;
-}
diff --git a/desktop/src/features/projects/ui/ProjectsPullRequestsList.tsx b/desktop/src/features/projects/ui/ProjectsPullRequestsList.tsx
index 04f6c41d651..f4315576f57 100644
--- a/desktop/src/features/projects/ui/ProjectsPullRequestsList.tsx
+++ b/desktop/src/features/projects/ui/ProjectsPullRequestsList.tsx
@@ -1,4 +1,5 @@
 import { FolderKanban, GitPullRequest } from "lucide-react";
+import * as React from "react";
 
 import type {
   Project,
@@ -9,6 +10,11 @@ import type {
 import { pullRequestShareLink } from "@/features/projects/lib/projectShareLinks";
 import { selectionItemFromReview } from "@/features/projects/lib/projectSelection";
 import type { ProjectWorkItemSection } from "@/features/projects/projectWorkItems";
+import {
+  countGroupedRows,
+  sliceGroupedRows,
+  useIncrementalMount,
+} from "@/shared/hooks/useIncrementalMount";
 import { cn } from "@/shared/lib/cn";
 import {
   resolveUserLabel,
@@ -52,14 +58,20 @@ function nextStepLabel(status: ProjectPullRequest["status"]) {
   return "Open review";
 }
 
-function PullRequestGridCard({
+const PullRequestGridCard = React.memo(function PullRequestGridCard({
   project,
   pullRequest,
   onOpen,
+  repository,
 }: {
   project: Project;
   pullRequest: ProjectPullRequest;
-  onOpen: (project: Project, pullRequest: ProjectPullRequest) => void;
+  onOpen: (
+    project: Project,
+    repository: Repository,
+    pullRequest: ProjectPullRequest,
+  ) => void;
+  repository: Repository;
 }) {
   return (
     <Card
@@ -68,7 +80,7 @@ function PullRequestGridCard({
     >
       <button
         className="absolute inset-0"
-        onClick={() => onOpen(project, pullRequest)}
+        onClick={() => onOpen(project, repository, pullRequest)}
         type="button"
       >
         <span className="sr-only">View review {pullRequest.title}</span>
@@ -96,7 +108,7 @@ function PullRequestGridCard({
       </div>
     </Card>
   );
-}
+});
 
 function reviewSelectionItem(
   project: Project,
@@ -112,7 +124,10 @@ function reviewSelectionItem(
   });
 }
 
-function PullRequestListRow({
+// Memoized: these rows render in unbounded lists, and any Projects-view
+// state change used to re-render every row. Props are kept identity-stable
+// by the list (memoized groups/selection arrays, stable onOpen).
+const PullRequestListRow = React.memo(function PullRequestListRow({
   project,
   profiles,
   pullRequest,
@@ -125,7 +140,11 @@ function PullRequestListRow({
   pullRequest: ProjectPullRequest;
   rangeItems: ReturnType<typeof reviewSelectionItem>[];
   repository: Repository;
-  onOpen: (project: Project, pullRequest: ProjectPullRequest) => void;
+  onOpen: (
+    project: Project,
+    repository: Repository,
+    pullRequest: ProjectPullRequest,
+  ) => void;
 }) {
   const authorLabel = resolveUserLabel({
     profiles,
@@ -139,7 +158,7 @@ function PullRequestListRow({
       dateSeconds={pullRequest.updatedAt}
       dateTestId="projects-row-date"
       icon={null}
-      onClick={() => onOpen(project, pullRequest)}
+      onClick={() => onOpen(project, repository, pullRequest)}
       peopleSlot={
         <ProjectAuthorIdentity
           label={authorLabel}
@@ -161,7 +180,9 @@ function PullRequestListRow({
       }
       trailing={
         <ProjectListRowMenu label={`More options for ${pullRequest.title}`}>
-          <DropdownMenuItem onSelect={() => onOpen(project, pullRequest)}>
+          <DropdownMenuItem
+            onSelect={() => onOpen(project, repository, pullRequest)}
+          >
             <GitPullRequest className="h-4 w-4" />
             {nextStepLabel(pullRequest.status)}
           </DropdownMenuItem>
@@ -174,7 +195,7 @@ function PullRequestListRow({
       }
     />
   );
-}
+});
 
 export function ProjectsPullRequestsList({
   embedded,
@@ -188,6 +209,40 @@ export function ProjectsPullRequestsList({
   pullRequests,
   viewMode,
 }: ProjectsPullRequestsListProps) {
+  // Grouping and per-group selection arrays are identity-stable across
+  // re-renders so the memoized rows only re-render when their data changes.
+  const allGroups = React.useMemo(
+    () =>
+      groupProjectWorkItemsByProject(pullRequests).map((group) => ({
+        ...group,
+        selectionItems: group.rows.map((row) =>
+          reviewSelectionItem(row.project, row.repository, row.pullRequest),
+        ),
+      })),
+    [pullRequests],
+  );
+  // Mount rows progressively: a one-shot mount of hundreds of rows blocked
+  // the main thread for over a second on tab entry.
+  // Each layout's counter grows only while that layout is active: otherwise
+  // a layout switch would find the other counter already grown and mount the
+  // whole collection in one commit.
+  const mountedRowCount = useIncrementalMount(
+    countGroupedRows(allGroups),
+    30,
+    60,
+    viewMode !== "grid",
+  );
+  const mountedGridCount = useIncrementalMount(
+    pullRequests.length,
+    30,
+    60,
+    viewMode === "grid",
+  );
+  const groups = React.useMemo(
+    () => sliceGroupedRows(allGroups, mountedRowCount),
+    [allGroups, mountedRowCount],
+  );
+
   if (isLoading) {
     return <BuzzLoadingState label="Loading reviews" />;
   }
@@ -227,35 +282,33 @@ export function ProjectsPullRequestsList({
       <div className="space-y-3">
         {loadNotice}
         <div className="grid gap-3 md:grid-cols-2 xl:grid-cols-3">
-          {pullRequests.map(({ project, pullRequest, repository }) => (
-            <PullRequestGridCard
-              key={`${repository.id}:${pullRequest.id}`}
-              onOpen={(selectedProject, selectedPullRequest) =>
-                onOpen(selectedProject, repository, selectedPullRequest)
-              }
-              project={project}
-              pullRequest={pullRequest}
-            />
-          ))}
+          {pullRequests
+            .slice(0, mountedGridCount)
+            .map(({ project, pullRequest, repository }) => (
+              <PullRequestGridCard
+                key={`${repository.id}:${pullRequest.id}`}
+                onOpen={onOpen}
+                project={project}
+                pullRequest={pullRequest}
+                repository={repository}
+              />
+            ))}
         </div>
       </div>
     );
   }
 
-  const groups = groupProjectWorkItemsByProject(pullRequests);
-
   return (
     <div className="space-y-3">
       {loadNotice}
       <div data-testid="projects-list-container">
         {groups.map((group) => {
-          const groupSelectionItems = group.rows.map((row) =>
-            reviewSelectionItem(row.project, row.repository, row.pullRequest),
-          );
+          const groupSelectionItems = group.selectionItems;
           return (
             <ProjectSelectableGroup
               count={group.rows.length}
               groupKey={group.project.id}
+              headerClassName="mx-0 gap-3 px-4"
               headerTestId="projects-review-project-group-header"
               icon={<FolderKanban className="h-4 w-4" />}
               items={groupSelectionItems}
@@ -266,11 +319,12 @@ export function ProjectsPullRequestsList({
             >
               <ul>
                 {group.rows.map(({ project, pullRequest, repository }) => (
-                  <li key={`${repository.id}:${pullRequest.id}`}>
+                  <li
+                    className="[contain-intrinsic-size:auto_3.5rem] [content-visibility:auto]"
+                    key={`${repository.id}:${pullRequest.id}`}
+                  >
                     <PullRequestListRow
-                      onOpen={(selectedProject, selectedPullRequest) =>
-                        onOpen(selectedProject, repository, selectedPullRequest)
-                      }
+                      onOpen={onOpen}
                       profiles={profiles}
                       project={project}
                       pullRequest={pullRequest}
diff --git a/desktop/src/features/projects/ui/ProjectsScreen.tsx b/desktop/src/features/projects/ui/ProjectsScreen.tsx
index 9d13c574d44..bb84804e8ea 100644
--- a/desktop/src/features/projects/ui/ProjectsScreen.tsx
+++ b/desktop/src/features/projects/ui/ProjectsScreen.tsx
@@ -1,6 +1,30 @@
+import { useQueryClient } from "@tanstack/react-query";
+import * as React from "react";
+
 import { ProjectsView } from "@/features/projects/ui/ProjectsView";
 
 export function ProjectsScreen() {
+  const queryClient = useQueryClient();
+  React.useEffect(() => {
+    return () => {
+      // Leaving the surface: stop the work-items fan. Its assignment-operation
+      // pagination is abort-aware and unbounded, so cancellation genuinely
+      // stops relay work that would otherwise compete with the next surface's
+      // channel fetches. Cached data stays; the next visit refetches per
+      // staleTime.
+      //
+      // Deliberately NOT cancelled:
+      // - projects enumeration: the always-mounted sidebar projects section
+      //   observes this key, so it must keep filling its 30-minute cache.
+      // - repo snapshots / local repositories: native clone/scan work cannot
+      //   be aborted mid-flight; cancellation would only discard the finished
+      //   result and force the same clones again on the next visit.
+      // - activity summaries: a single bounded request — it completes either
+      //   way, so cancelling just wastes the response.
+      void queryClient.cancelQueries({ queryKey: ["projects", "work-items"] });
+    };
+  }, [queryClient]);
+
   return (
     <div className="relative flex min-h-0 min-w-0 flex-1 flex-col overflow-hidden">
       <ProjectsView />
diff --git a/desktop/src/features/projects/ui/ProjectsView.tsx b/desktop/src/features/projects/ui/ProjectsView.tsx
index ac4a8dde234..be0d3da1f0c 100644
--- a/desktop/src/features/projects/ui/ProjectsView.tsx
+++ b/desktop/src/features/projects/ui/ProjectsView.tsx
@@ -17,7 +17,6 @@ import {
 } from "@/features/projects/hooks";
 import { useRepositoryActivitySummariesQuery } from "@/features/projects/repositoryActivityHooks";
 import { useCreateProjectMutation } from "@/features/projects/useCreateProject";
-import { selectProjectRepository } from "@/features/projects/projectModels";
 import { useProjectsRepoSnapshotsQuery } from "@/features/projects/useProjectsRepoSnapshots";
 import { buildProjectSelectionAgentContext } from "@/features/projects/lib/projectDetailAgentContext";
 import type { ProjectSelectionItem } from "@/features/projects/lib/projectSelection";
@@ -31,7 +30,6 @@ import {
 } from "@/features/projects/lib/projectRepoHost";
 import { ProjectsActivityFeed } from "@/features/projects/ui/ProjectsActivityFeed";
 import { ProjectsChannelsList } from "@/features/projects/ui/ProjectsChannelsList";
-import { ProjectsOverviewChatToggle } from "@/features/projects/ui/ProjectsOverviewChatToggle";
 import {
   ProjectsOverviewContextSheet,
   ProjectsOverviewNarrowContextToggle,
@@ -41,6 +39,7 @@ import {
   ProjectsOverviewContextPanel,
   ProjectsOverviewPanel,
 } from "@/features/projects/ui/ProjectsOverviewPanel";
+import { ProjectsOverviewChromeActions } from "@/features/projects/ui/ProjectsOverviewChromeActions";
 import { ProjectContextRail } from "@/features/projects/ui/ProjectContextRail";
 import {
   openAppSearch,
@@ -112,6 +111,12 @@ import { useRelayOrigin } from "@/shared/lib/useRelayOrigin";
 import { Button } from "@/shared/ui/button";
 import { useOptionalSidebar } from "@/shared/ui/sidebar";
 import { useProjectsOverviewAgentContext } from "./useProjectsOverviewAgentContext";
+import {
+  EMPTY_ITEMS,
+  useContextWorkItems,
+  useDeleteProjectHandler,
+  useOpenProjectTerminalHandler,
+} from "./projectsViewWorkItems";
 
 const MANY_PROJECTS_THRESHOLD = 12;
 const PROJECTS_CONTEXT_POD_MIN_VIEWPORT_PX = 1024;
@@ -136,8 +141,6 @@ export function ProjectsView() {
       : storedFilter;
   });
   const [overviewPanelOpen, setOverviewPanelOpen] = React.useState(true);
-  // Narrow layouts present the same context as a dismissible sheet instead of
-  // the docked rail; the sheet starts closed so resizing never pops a modal.
   const [narrowContextOpen, setNarrowContextOpen] = React.useState(false);
   const contextToggleRef = React.useRef<HTMLButtonElement | null>(null);
   const isNarrowProjectsLayout = useMediaBreakpoint(
@@ -483,16 +486,21 @@ export function ProjectsView() {
   });
   const handleFilterChange = React.useCallback(
     (nextFilter: ProjectsFilter) => {
-      if (
-        nextFilter === "projects" &&
-        (repositoryScope === "buzz" || repositoryScope === "linked")
-      ) {
-        setRepositoryScope("all");
-        writeStoredRepositoryScope("all");
-      }
-      setSelectionAgentContext(null);
-      setFilter(nextFilter);
       writeStoredFilter(nextFilter);
+      // Tab content swaps mount hundreds of rows/cards at once; a transition
+      // lets React keep the click responsive and paint the previous tab until
+      // the new tree is ready instead of blocking the main thread.
+      React.startTransition(() => {
+        if (
+          nextFilter === "projects" &&
+          (repositoryScope === "buzz" || repositoryScope === "linked")
+        ) {
+          setRepositoryScope("all");
+          writeStoredRepositoryScope("all");
+        }
+        setSelectionAgentContext(null);
+        setFilter(nextFilter);
+      });
     },
     [repositoryScope, setSelectionAgentContext],
   );
@@ -545,20 +553,9 @@ export function ProjectsView() {
   );
 
   const openTerminal = useOpenProjectTerminal(activeCommunity?.reposDir);
-  const handleOpenTerminal = React.useCallback(
-    (project: Project) => {
-      const repository = selectProjectRepository(project, null);
-      if (!repository) return Promise.resolve();
-      return openTerminal(repository, {
-        // Check the selected repository only — not all members — so the
-        // terminal affordance reflects the repository the button will open.
-        hasLocalCheckout: hasLocalRepositoryCheckout(
-          repository,
-          localRepoNames,
-        ),
-      });
-    },
-    [localRepoNames, openTerminal],
+  const handleOpenTerminal = useOpenProjectTerminalHandler(
+    openTerminal,
+    localRepoNames,
   );
   const handleOpenRepositoryTerminal = React.useCallback(
     (repository: Repository) =>
@@ -571,18 +568,12 @@ export function ProjectsView() {
     [localRepoNames, openTerminal],
   );
 
-  const handleDeleteProject = React.useCallback(
-    async (project: Project) => {
-      try {
-        await deleteProjectMutation.mutateAsync(project);
-        toast.success("Project deleted");
-      } catch (error) {
-        toast.error(
-          error instanceof Error ? error.message : "Failed to delete project",
-        );
-      }
-    },
-    [deleteProjectMutation],
+  const handleDeleteProject = useDeleteProjectHandler(
+    deleteProjectMutation.mutateAsync,
+  );
+
+  const { contextIssues, contextPullRequests } = useContextWorkItems(
+    projectsWorkItemsQuery.data,
   );
 
   if (projectsQuery.isLoading) {
@@ -640,7 +631,6 @@ export function ProjectsView() {
   const listHeaderBar = (
     <ProjectsListHeaderBar
       filter={filter}
-      variant="bar"
       issueScope={issueScope}
       onIssueScopeChange={handleIssueScopeChange}
       onPullRequestScopeChange={handlePullRequestScopeChange}
@@ -675,14 +665,16 @@ export function ProjectsView() {
         isLoading={
           repoSnapshotsQuery.isLoading || projectsWorkItemsQuery.isLoading
         }
-        issues={projectsWorkItemsQuery.data?.issues.items ?? []}
+        issues={projectsWorkItemsQuery.data?.issues.items ?? EMPTY_ITEMS}
         onOpenCommit={handleOpenCommit}
         onOpenIssue={handleOpenIssue}
         onOpenProject={handleOpenProject}
         onOpenPullRequest={handleOpenPullRequest}
         profiles={profiles}
         projects={projects}
-        pullRequests={projectsWorkItemsQuery.data?.pullRequests.items ?? []}
+        pullRequests={
+          projectsWorkItemsQuery.data?.pullRequests.items ?? EMPTY_ITEMS
+        }
         snapshots={repoSnapshotsQuery.data?.snapshots}
       />
     </>
@@ -690,8 +682,7 @@ export function ProjectsView() {
 
   const contextPanelProps = {
     filter,
-    issues:
-      projectsWorkItemsQuery.data?.issues.items.map(({ issue }) => issue) ?? [],
+    issues: contextIssues,
     onChatWithAgent: (items: ProjectSelectionItem[]) =>
       setSelectionAgentContext(buildProjectSelectionAgentContext(items)),
     onCreateIssue: () => setCreateIssueOpen(true),
@@ -699,28 +690,34 @@ export function ProjectsView() {
     onCreatePullRequest: () => setCreatePullRequestOpen(true),
     profiles,
     projects,
-    pullRequests:
-      projectsWorkItemsQuery.data?.pullRequests.items.map(
-        ({ pullRequest }) => pullRequest,
-      ) ?? [],
+    pullRequests: contextPullRequests,
     summaries: activitySummariesQuery.data,
   };
-  const overviewDetached = overviewPanelOpen && !isNarrowProjectsLayout;
   const contextOpen = isNarrowProjectsLayout
     ? narrowContextOpen
     : overviewPanelOpen;
-  const chromeActions = (
-    <>
-      <ProjectsOverviewNarrowContextToggle
-        onToggle={() =>
-          isNarrowProjectsLayout
-            ? setNarrowContextOpen((open) => !open)
-            : setOverviewPanelOpen((open) => !open)
-        }
-        open={contextOpen}
-        ref={contextToggleRef}
-      />
-    </>
+  const overviewChatOpen =
+    selectionAgentContext !== null && !isNarrowProjectsLayout;
+  const overviewContextOpen = overviewPanelOpen && !isNarrowProjectsLayout;
+  const overviewDetached = overviewContextOpen || overviewChatOpen;
+  const chromeActions = isNarrowProjectsLayout ? (
+    <ProjectsOverviewNarrowContextToggle
+      onToggle={() => setNarrowContextOpen((open) => !open)}
+      open={contextOpen}
+      ref={contextToggleRef}
+    />
+  ) : (
+    <ProjectsOverviewChromeActions
+      chatOpen={overviewChatOpen}
+      contextOpen={overviewPanelOpen}
+      onToggleChat={() =>
+        setSelectionAgentContext((context) =>
+          context ? null : overviewAgentContext,
+        )
+      }
+      onToggleContext={() => setOverviewPanelOpen((open) => !open)}
+      sectionTitle={projectsSectionTitle(filter)}
+    />
   );
 
   return (
@@ -842,19 +839,10 @@ export function ProjectsView() {
                           onFilterChange={handleFilterChange}
                         />
                       </div>
-                      <ProjectsOverviewChatToggle
-                        active={selectionAgentContext !== null}
-                        onToggle={() =>
-                          setSelectionAgentContext((context) =>
-                            context ? null : overviewAgentContext,
-                          )
-                        }
-                        sectionTitle={projectsSectionTitle(filter)}
-                      />
                     </div>
                     <div
                       className={
-                        filter === "all" ? "mx-auto w-full max-w-xl" : "w-full"
+                        filter === "all" ? "mx-auto w-full max-w-2xl" : "w-full"
                       }
                     >
                       {filter === "all" ? (
@@ -867,14 +855,16 @@ export function ProjectsView() {
                       ) : (
                         <>
                           <ProjectSectionHeader
-                            className="-mx-4"
+                            className="mb-2 rounded-xl bg-muted/40"
                             icon={projectsSectionIcon(filter)}
                             testId="projects-page-header"
                             title={projectsSectionTitle(filter)}
+                            trailing={
+                              filter === "channels" ? undefined : listHeaderBar
+                            }
                           />
                           <section>
                             <div className="space-y-3">
-                              {filter === "channels" ? null : listHeaderBar}
                               {filter === "prs" ? (
                                 <ProjectsPullRequestsList
                                   embedded={viewMode === "list"}
@@ -933,20 +923,29 @@ export function ProjectsView() {
                 </div>
               </div>
             </div>
-            {selectionAgentContext && !isNarrowProjectsLayout ? (
-              <ProjectAgentChatPanel
-                canResetWidth={overviewAgentPanelWidth.canReset}
-                context={selectionAgentContext}
-                onClose={() => setSelectionAgentContext(null)}
-                onResetWidth={overviewAgentPanelWidth.onResetWidth}
-                onResizeStart={overviewAgentPanelWidth.onResizeStart}
-                widthPx={overviewAgentPanelWidth.widthPx}
-              />
-            ) : null}
           </div>
         </div>
         <ProjectContextRail
-          open={overviewDetached}
+          open={overviewChatOpen}
+          panelWidthPx={overviewAgentPanelWidth.widthPx}
+          resizing={overviewAgentPanelWidth.isResizing}
+          testId="projects-overview-agent-rail"
+        >
+          {selectionAgentContext ? (
+            <ProjectAgentChatPanel
+              canResetWidth={overviewAgentPanelWidth.canReset}
+              constrainToAvailableSpace={false}
+              context={selectionAgentContext}
+              detached
+              onClose={() => setSelectionAgentContext(null)}
+              onResetWidth={overviewAgentPanelWidth.onResetWidth}
+              onResizeStart={overviewAgentPanelWidth.onResizeStart}
+              widthPx={overviewAgentPanelWidth.widthPx}
+            />
+          ) : null}
+        </ProjectContextRail>
+        <ProjectContextRail
+          open={overviewContextOpen}
           panelWidthPx={PROJECT_CONTEXT_PANEL_DEFAULT_WIDTH_PX}
           testId="projects-overview-context-rail"
         >
diff --git a/desktop/src/features/projects/ui/PullRequestMetaRail.tsx b/desktop/src/features/projects/ui/PullRequestMetaRail.tsx
index d0f37027721..449fe2ab39a 100644
--- a/desktop/src/features/projects/ui/PullRequestMetaRail.tsx
+++ b/desktop/src/features/projects/ui/PullRequestMetaRail.tsx
@@ -81,16 +81,22 @@ export function PullRequestMetaHeader({
             <span className="truncate text-foreground">{targetBranch}</span>
           </p>
           <div className="ml-auto flex shrink-0 items-center gap-1.5">
-            {displayedDiffStats ? (
-              <>
-                <span className="text-green-500">
-                  +{displayedDiffStats.additions}
+            <span className="inline-flex min-w-20 justify-end gap-1.5 tabular-nums">
+              {displayedDiffStats ? (
+                <>
+                  <span className="text-green-500">
+                    +{displayedDiffStats.additions}
+                  </span>
+                  <span className="text-destructive">
+                    -{displayedDiffStats.deletions}
+                  </span>
+                </>
+              ) : (
+                <span aria-hidden className="invisible">
+                  +0 -0
                 </span>
-                <span className="text-destructive">
-                  -{displayedDiffStats.deletions}
-                </span>
-              </>
-            ) : null}
+              )}
+            </span>
             {pullRequest.commit ? (
               <span className="inline-flex min-w-0 items-center gap-0.5 text-muted-foreground">
                 <code
diff --git a/desktop/src/features/projects/ui/PullRequestReviewersRow.tsx b/desktop/src/features/projects/ui/PullRequestReviewersRow.tsx
index 83e2b4c1f76..a79a705a5b3 100644
--- a/desktop/src/features/projects/ui/PullRequestReviewersRow.tsx
+++ b/desktop/src/features/projects/ui/PullRequestReviewersRow.tsx
@@ -289,63 +289,83 @@ export function PullRequestReviewersRow({
 
   return (
     <ProjectDetailMetaRow icon={Users} label="Reviewers">
-      <div className="grid min-w-0 gap-1">
-        <div className="flex min-w-0 flex-wrap items-center gap-x-2 gap-y-1">
-          {showSummary ? (
-            <span className="font-medium" data-testid={summaryTestId}>
+      <div
+        className="flex min-w-0 items-center gap-2"
+        data-testid="project-reviewers-content"
+      >
+        <div className="flex min-w-0 flex-1 items-center gap-2 overflow-hidden whitespace-nowrap">
+          {showSummary && displayedDecisionActors.length === 0 ? (
+            <span className="truncate font-medium" data-testid={summaryTestId}>
               {reviewSummary}
             </span>
           ) : null}
+          {displayedDecisionActors.map((pubkey, index) => {
+            const label = labelForPubkey(pubkey, profiles);
+            const hasApproved = approvedBy.has(pubkey);
+            const hasRequestedChanges = changesRequestedBy.has(pubkey);
+            const needsRereview = staleDecisionActors.has(pubkey);
+            const DecisionIcon = hasApproved
+              ? Check
+              : hasRequestedChanges
+                ? TriangleAlert
+                : needsRereview
+                  ? History
+                  : null;
+            const decisionLabel = hasApproved
+              ? `Approved by ${label}`
+              : hasRequestedChanges
+                ? `Changes requested by ${label}`
+                : needsRereview
+                  ? `Re-review needed from ${label}`
+                  : `Awaiting review from ${label}`;
+            return (
+              <React.Fragment key={pubkey}>
+                {index > 0 ? (
+                  <span
+                    aria-hidden="true"
+                    className="shrink-0 text-muted-foreground/50"
+                  >
+                    ·
+                  </span>
+                ) : null}
+                <span
+                  className={cn(
+                    "flex min-w-0 shrink items-center gap-1 text-sm",
+                    hasApproved && "text-green-600 dark:text-green-400",
+                    hasRequestedChanges && "text-amber-600 dark:text-amber-400",
+                    !hasApproved &&
+                      !hasRequestedChanges &&
+                      "text-muted-foreground",
+                  )}
+                  data-testid="project-reviewer-decision"
+                  title={decisionLabel}
+                >
+                  <span className="sr-only">{decisionLabel}</span>
+                  {DecisionIcon ? (
+                    <DecisionIcon
+                      aria-hidden="true"
+                      className="h-3.5 w-3.5 shrink-0"
+                    />
+                  ) : null}
+                  <span
+                    aria-hidden="true"
+                    className="truncate"
+                    data-testid="project-reviewer-name"
+                  >
+                    {label}
+                  </span>
+                </span>
+              </React.Fragment>
+            );
+          })}
           {hasHistoricalDecision ? (
-            <span className="flex items-center gap-1 text-xs text-amber-600 dark:text-amber-400">
+            <span className="flex min-w-0 items-center gap-1 truncate text-xs text-amber-600 dark:text-amber-400">
               <History className="h-3.5 w-3.5 shrink-0" />
               Earlier decision applies to another commit
             </span>
           ) : null}
-          {requestAction}
         </div>
-        {displayedDecisionActors.map((pubkey) => {
-          const label = labelForPubkey(pubkey, profiles);
-          const hasApproved = approvedBy.has(pubkey);
-          const hasRequestedChanges = changesRequestedBy.has(pubkey);
-          const needsRereview = staleDecisionActors.has(pubkey);
-          const DecisionIcon = hasApproved
-            ? Check
-            : hasRequestedChanges
-              ? TriangleAlert
-              : needsRereview
-                ? History
-                : null;
-          const decisionLabel = hasApproved
-            ? "Approved"
-            : hasRequestedChanges
-              ? "Changes requested"
-              : needsRereview
-                ? "Re-review needed"
-                : "Pending";
-          return (
-            <span
-              className="flex min-w-0 items-center gap-2"
-              data-testid="project-reviewer-decision"
-              key={pubkey}
-            >
-              <span className="truncate text-sm text-foreground">{label}</span>
-              <span
-                className={cn(
-                  "inline-flex shrink-0 items-center gap-0.5 text-sm",
-                  hasApproved && "text-green-600 dark:text-green-400",
-                  hasRequestedChanges && "text-amber-600 dark:text-amber-400",
-                  !hasApproved &&
-                    !hasRequestedChanges &&
-                    "text-muted-foreground",
-                )}
-              >
-                {DecisionIcon ? <DecisionIcon className="h-3.5 w-3.5" /> : null}
-                {decisionLabel}
-              </span>
-            </span>
-          );
-        })}
+        {requestAction}
       </div>
     </ProjectDetailMetaRow>
   );
diff --git a/desktop/src/features/projects/ui/PullRequestsPanelSurface.tsx b/desktop/src/features/projects/ui/PullRequestsPanelSurface.tsx
new file mode 100644
index 00000000000..de532858443
--- /dev/null
+++ b/desktop/src/features/projects/ui/PullRequestsPanelSurface.tsx
@@ -0,0 +1,62 @@
+import type * as React from "react";
+
+import { BuzzLoadingState } from "@/shared/ui/BuzzLoadingState";
+
+/** Which center pane `PullRequestsPanel` should show. A retained selected
+ * review wins over an empty list so refetching does not flash "No reviews yet." */
+export function pullRequestsPanelKind({
+  isLoading,
+  pullRequests,
+  selectedPullRequest,
+}: {
+  isLoading: boolean;
+  pullRequests: { length: number };
+  selectedPullRequest: unknown;
+}): "loading" | "detail" | "empty" | "list" {
+  if (isLoading && !selectedPullRequest) return "loading";
+  if (selectedPullRequest) return "detail";
+  if (pullRequests.length === 0) return "empty";
+  return "list";
+}
+
+/** Loading / empty / detail / list switch used by `PullRequestsPanel`. */
+export function PullRequestsPanelSurface({
+  detail,
+  error,
+  isLoading,
+  list,
+  pullRequests,
+  selectedPullRequest,
+}: {
+  detail: React.ReactNode;
+  error: unknown;
+  isLoading: boolean;
+  list: React.ReactNode;
+  pullRequests: { length: number };
+  selectedPullRequest: unknown;
+}) {
+  const kind = pullRequestsPanelKind({
+    isLoading,
+    pullRequests,
+    selectedPullRequest,
+  });
+  if (kind === "loading") {
+    return <BuzzLoadingState label="Loading reviews" />;
+  }
+  if (kind === "detail") {
+    return detail;
+  }
+  if (kind === "empty") {
+    return (
+      <p
+        className="p-4 text-sm text-muted-foreground"
+        data-testid="project-pull-requests-empty"
+      >
+        {error
+          ? "Could not load reviews for this repository."
+          : "No reviews yet."}
+      </p>
+    );
+  }
+  return list;
+}
diff --git a/desktop/src/features/projects/ui/RepositoryCards.tsx b/desktop/src/features/projects/ui/RepositoryCards.tsx
index 75d87843126..f33de916165 100644
--- a/desktop/src/features/projects/ui/RepositoryCards.tsx
+++ b/desktop/src/features/projects/ui/RepositoryCards.tsx
@@ -1,3 +1,5 @@
+import * as React from "react";
+
 import { FolderGit2, Globe, SquareTerminal } from "lucide-react";
 
 import type {
@@ -18,10 +20,6 @@ import {
   selectionItemFromRepository,
   type ProjectSelectionItem,
 } from "@/features/projects/lib/projectSelection";
-import {
-  formatExactTimestamp,
-  relativeTime,
-} from "@/features/projects/lib/projectsViewHelpers";
 import { cn } from "@/shared/lib/cn";
 import { normalizePubkey } from "@/shared/lib/pubkey";
 import { useRelayOrigin } from "@/shared/lib/useRelayOrigin";
@@ -155,27 +153,6 @@ function RepositoryIdentity({
   );
 }
 
-function RepositoryUpdatedLabel({
-  repository,
-  summary,
-}: Pick<RepositoryItemProps, "repository" | "summary">) {
-  const updatedAt = summary?.updatedAt || repository.createdAt;
-  return (
-    <Tooltip>
-      <TooltipTrigger asChild>
-        <span className="whitespace-nowrap text-xs leading-4 text-muted-foreground/70">
-          {relativeTime(updatedAt)}
-        </span>
-      </TooltipTrigger>
-      <TooltipContent>
-        {summary?.latestCommit
-          ? `${summary.latestCommit.title || summary.latestCommit.commit.slice(0, 7)} · ${formatExactTimestamp(summary.latestCommit.createdAt)}`
-          : `Created ${formatExactTimestamp(repository.createdAt)}`}
-      </TooltipContent>
-    </Tooltip>
-  );
-}
-
 function repositoryPeople(
   repository: Repository,
   summary: ProjectActivitySummary | undefined,
@@ -216,7 +193,11 @@ function RepositoryActionsMenu({
   );
 }
 
-export function RepositoryGridCard(props: RepositoryItemProps) {
+// Memoized: unbounded grids/lists; identity-stable caller props keep
+// re-renders scoped to changed cards.
+export const RepositoryGridCard = React.memo(function RepositoryGridCard(
+  props: RepositoryItemProps,
+) {
   const {
     hasLocal,
     onOpen,
@@ -228,7 +209,7 @@ export function RepositoryGridCard(props: RepositoryItemProps) {
   } = props;
   return (
     <Card
-      className="group relative flex min-h-40 flex-col overflow-hidden border-border/60 bg-transparent shadow-none transition-colors duration-150 hover:bg-muted/20"
+      className="group relative flex h-full min-h-40 flex-col overflow-hidden border-border/60 bg-transparent shadow-none transition-colors duration-150 hover:bg-muted/20"
       data-testid={`repository-card-${repository.dtag}`}
     >
       <RepositoryOpenButton
@@ -261,13 +242,12 @@ export function RepositoryGridCard(props: RepositoryItemProps) {
         >
           {repository.description || "A repository in this project."}
         </p>
-        <div className="pointer-events-auto mt-auto flex items-center justify-between gap-3">
+        <div className="pointer-events-auto mt-auto">
           <ProjectPeopleStack
             profiles={profiles}
             pubkeys={repositoryPeople(repository, summary)}
             workOwnerPubkey={repository.owner}
           />
-          <RepositoryUpdatedLabel repository={repository} summary={summary} />
         </div>
         <div className="mt-2">
           <ProjectStatsRow summary={summary} />
@@ -278,9 +258,11 @@ export function RepositoryGridCard(props: RepositoryItemProps) {
       </div>
     </Card>
   );
-}
+});
 
-export function RepositoryListRow(props: RepositoryItemProps) {
+export const RepositoryListRow = React.memo(function RepositoryListRow(
+  props: RepositoryItemProps,
+) {
   const {
     hasLocal,
     onOpen,
@@ -332,4 +314,4 @@ export function RepositoryListRow(props: RepositoryItemProps) {
       }
     />
   );
-}
+});
diff --git a/desktop/src/features/projects/ui/projectsOverviewContext.test.mjs b/desktop/src/features/projects/ui/projectsOverviewContext.test.mjs
index 975d3761524..c7332c03ffb 100644
--- a/desktop/src/features/projects/ui/projectsOverviewContext.test.mjs
+++ b/desktop/src/features/projects/ui/projectsOverviewContext.test.mjs
@@ -195,7 +195,6 @@ function peopleContext(filter, overrides = {}) {
     pullRequests: [makePullRequest("Open")],
     summaries: {
       "project-buzz": {
-        activityByDay: { "2026-08-01": 4 },
         latestCommit: { author: REVIEW_AUTHOR },
       },
     },
@@ -226,22 +225,10 @@ test("listed repository contributors without commits stay off the repositories p
   assert.deepEqual(context.people, []);
 });
 
-test("projects pod shows owners and keeps the activity graph; channels hides both", () => {
+test("projects pod shows owners; channels hides people", () => {
   const projects = peopleContext("projects");
   const channels = peopleContext("channels");
 
   assert.deepEqual(projects.people, [OWNER]);
-  assert.deepEqual(projects.activityByDay, { "2026-08-01": 4 });
   assert.deepEqual(channels.people, []);
-  assert.equal(channels.activityByDay, null);
-});
-
-test("activity, projects, and repositories pods show the contribution graph", () => {
-  const expected = { "2026-08-01": 4 };
-  assert.deepEqual(peopleContext("all").activityByDay, expected);
-  assert.deepEqual(peopleContext("projects").activityByDay, expected);
-  assert.deepEqual(peopleContext("repositories").activityByDay, expected);
-  assert.equal(peopleContext("issues").activityByDay, null);
-  assert.equal(peopleContext("prs").activityByDay, null);
-  assert.equal(peopleContext("channels").activityByDay, null);
 });
diff --git a/desktop/src/features/projects/ui/projectsOverviewContext.ts b/desktop/src/features/projects/ui/projectsOverviewContext.ts
index 8b2e6b897e4..7871c425dc4 100644
--- a/desktop/src/features/projects/ui/projectsOverviewContext.ts
+++ b/desktop/src/features/projects/ui/projectsOverviewContext.ts
@@ -46,7 +46,6 @@ export type OverviewContextStat = {
 
 export type OverviewContextPresentation = {
   action: OverviewContextAction;
-  activityByDay: Record<string, number> | null;
   detailsTitle: string;
   people: string[];
   stats: OverviewContextStat[];
@@ -129,21 +128,6 @@ function uniquePubkeys(pubkeys: Array<string | null | undefined>) {
   ];
 }
 
-function summaryActivityByDay(
-  projects: Project[],
-  summaries: Record<string, ProjectActivitySummary> | undefined,
-) {
-  const merged: Record<string, number> = {};
-  for (const project of projects) {
-    const byDay = summaries?.[project.id]?.activityByDay;
-    if (!byDay) continue;
-    for (const [day, count] of Object.entries(byDay)) {
-      merged[day] = (merged[day] ?? 0) + count;
-    }
-  }
-  return merged;
-}
-
 function latestCommitAuthors(
   summaries: Record<string, ProjectActivitySummary> | undefined,
 ) {
@@ -227,18 +211,7 @@ function overviewContextPeople({
   return projectOwners(projects);
 }
 
-function overviewContextActivityByDay({
-  filter,
-  projects,
-  summaries,
-}: OverviewContextInput): Record<string, number> | null {
-  if (filter === "all" || filter === "projects" || filter === "repositories") {
-    return summaryActivityByDay(projects, summaries);
-  }
-  return null;
-}
-
-/** Title, people, activity, and stats for the Projects overview context pod. */
+/** Title, people, and stats for the Projects overview context pod. */
 export function projectsOverviewContext(
   input: OverviewContextInput,
 ): OverviewContextPresentation {
@@ -249,12 +222,10 @@ export function projectsOverviewContext(
   const channelCount = uniqueProjectRelatedChannelCount(projects);
   const repositories = repositoryCount(projects);
   const people = overviewContextPeople(input);
-  const activityByDay = overviewContextActivityByDay(input);
 
   if (filter === "repositories") {
     return {
       action: null,
-      activityByDay,
       detailsTitle: "Repository activity",
       people,
       stats: [
@@ -284,7 +255,6 @@ export function projectsOverviewContext(
   if (filter === "channels") {
     return {
       action: null,
-      activityByDay,
       detailsTitle: "Details",
       people,
       stats: [
@@ -318,7 +288,6 @@ export function projectsOverviewContext(
         label: "Create task",
         testId: "projects-overview-create-issue",
       },
-      activityByDay,
       detailsTitle: "Details",
       people,
       stats: [
@@ -352,7 +321,6 @@ export function projectsOverviewContext(
         label: "Create review",
         testId: "projects-overview-create-pull-request",
       },
-      activityByDay,
       detailsTitle: "Review activity",
       people,
       stats: [
@@ -382,7 +350,6 @@ export function projectsOverviewContext(
   if (filter === "all") {
     return {
       action: createProjectAction(),
-      activityByDay,
       detailsTitle: "Details",
       people,
       stats: [
@@ -423,7 +390,6 @@ export function projectsOverviewContext(
 
   return {
     action: createProjectAction(),
-    activityByDay,
     detailsTitle: "Details",
     people,
     stats: [
diff --git a/desktop/src/features/projects/ui/projectsViewWorkItems.ts b/desktop/src/features/projects/ui/projectsViewWorkItems.ts
new file mode 100644
index 00000000000..90fc4ce910e
--- /dev/null
+++ b/desktop/src/features/projects/ui/projectsViewWorkItems.ts
@@ -0,0 +1,83 @@
+import * as React from "react";
+import { toast } from "sonner";
+
+import type { ProjectsWorkItemsResult } from "@/features/projects/projectWorkItems";
+import type { Project } from "@/features/projects/hooks";
+import { hasLocalRepositoryCheckout } from "@/features/projects/lib/projectLocalRepos";
+import { selectProjectRepository } from "@/features/projects/projectModels";
+import type { useOpenProjectTerminal } from "@/features/projects/ui/useOpenProjectTerminal";
+
+// Split from ProjectsView.tsx to keep that file under the per-file line cap.
+
+/**
+ * Stable empty fallback: a fresh `[]` per render would defeat the memoized
+ * activity feed while work items load.
+ */
+export const EMPTY_ITEMS: never[] = [];
+
+/**
+ * Memoized flat issue/PR arrays for the overview context panel. Fresh
+ * `.map()` arrays per render would change the panel's memo deps every
+ * render, re-walking every issue and pull request in the community on
+ * unrelated Projects-view state changes.
+ */
+export function useContextWorkItems(
+  workItemsData: ProjectsWorkItemsResult<Project> | undefined,
+) {
+  const contextIssues = React.useMemo(
+    () => workItemsData?.issues.items.map(({ issue }) => issue) ?? [],
+    [workItemsData],
+  );
+  const contextPullRequests = React.useMemo(
+    () =>
+      workItemsData?.pullRequests.items.map(({ pullRequest }) => pullRequest) ??
+      [],
+    [workItemsData],
+  );
+  return { contextIssues, contextPullRequests };
+}
+
+/**
+ * Delete-project handler with toast feedback. Depends on the stable
+ * mutateAsync, not the per-render mutation object, so memoized card/row
+ * trees keep their identity across renders.
+ */
+export function useDeleteProjectHandler(
+  mutateAsync: (project: Project) => Promise<unknown>,
+) {
+  return React.useCallback(
+    async (project: Project) => {
+      try {
+        await mutateAsync(project);
+        toast.success("Project deleted");
+      } catch (error) {
+        toast.error(
+          error instanceof Error ? error.message : "Failed to delete project",
+        );
+      }
+    },
+    [mutateAsync],
+  );
+}
+
+/** Opens the project's selected repository in a terminal (see ProjectsView). */
+export function useOpenProjectTerminalHandler(
+  openTerminal: ReturnType<typeof useOpenProjectTerminal>,
+  localRepoNames: Set<string>,
+) {
+  return React.useCallback(
+    (project: Project) => {
+      const repository = selectProjectRepository(project, null);
+      if (!repository) return Promise.resolve();
+      return openTerminal(repository, {
+        // Check the selected repository only — not all members — so the
+        // terminal affordance reflects the repository the button will open.
+        hasLocalCheckout: hasLocalRepositoryCheckout(
+          repository,
+          localRepoNames,
+        ),
+      });
+    },
+    [localRepoNames, openTerminal],
+  );
+}
diff --git a/desktop/src/features/projects/ui/useRetainedProjectGitViews.test.mjs b/desktop/src/features/projects/ui/useRetainedProjectGitViews.test.mjs
new file mode 100644
index 00000000000..72906a50eea
--- /dev/null
+++ b/desktop/src/features/projects/ui/useRetainedProjectGitViews.test.mjs
@@ -0,0 +1,492 @@
+import assert from "node:assert/strict";
+import { registerHooks } from "node:module";
+import { after, before, test } from "node:test";
+
+import { JSDOM } from "jsdom";
+
+import { buildProjectDetailAgentContext } from "../lib/projectDetailAgentContext.ts";
+import { projectDetailSelectionItem } from "../lib/projectDetailSelectionItem.ts";
+import { reviewDiffWorkspaceBranch } from "../lib/projectReviewDisplay.ts";
+import { pullRequestsPanelKind } from "./PullRequestsPanelSurface.tsx";
+import { buildProjectDetailCrumbs } from "./useProjectDetailCrumbs.ts";
+
+// The real composer mounts TipTap and never releases jsdom handles. Stub it so
+// the production panel can prove selectedPullRequest wiring without hanging
+// the node:test process.
+registerHooks({
+  resolve(specifier, context, nextResolve) {
+    if (specifier === "@/features/forum/ui/ForumComposer") {
+      return { shortCircuit: true, url: "buzz-pr-panel-stub:ForumComposer" };
+    }
+    return nextResolve(specifier, context);
+  },
+  load(url, context, nextLoad) {
+    if (url === "buzz-pr-panel-stub:ForumComposer") {
+      return {
+        format: "module",
+        shortCircuit: true,
+        source:
+          "globalThis.__FORUM_COMPOSER_STUBBED__ = true;\nexport function ForumComposer() { return null; }\n",
+      };
+    }
+    return nextLoad(url, context);
+  },
+});
+
+const OWNER = "a".repeat(64);
+const REVIEW_A_ID = "b".repeat(64);
+
+const repository = {
+  id: `${OWNER}:buzz`,
+  dtag: "buzz",
+  name: "buzz",
+  description: "",
+  cloneUrls: ["https://example.com/buzz.git"],
+  webUrl: null,
+  owner: OWNER,
+  contributors: [],
+  createdAt: 0,
+  status: "open",
+  defaultBranch: "main",
+  repoAddress: `30617:${OWNER}:buzz`,
+  channelId: "trusted-repository-channel",
+};
+
+const reviewA = {
+  id: REVIEW_A_ID,
+  title: "Ship the retained review",
+  content: "Keep this description visible while the list refetches.",
+  tags: [],
+  author: OWNER,
+  createdAt: 1_700_000_000,
+  repoAddress: repository.repoAddress,
+  channelId: null,
+  originAgentName: null,
+  labels: [],
+  recipients: [],
+  reviewers: [],
+  approvals: [],
+  changeRequests: [],
+  status: "Open",
+  statusEventId: null,
+  statusCreatedAt: null,
+  branchName: "feature-a",
+  targetBranch: "main",
+  initialCommit: null,
+  commit: null,
+  cloneUrls: repository.cloneUrls,
+  updateCount: 0,
+  updatedAt: 1_700_000_000,
+  updates: [],
+  comments: [],
+};
+
+const noop = () => {};
+
+function assertRetainedReviewDetail(screen) {
+  const detail = screen.getByTestId("project-pull-request-detail");
+  const title = detail.querySelector("h3");
+  assert.ok(title, "real PullRequestsPanel detail should render an h3 title");
+  assert.match(title.textContent, /Ship the retained review/);
+  assert.match(
+    detail.textContent,
+    /Keep this description visible while the list refetches/,
+  );
+  assert.equal(screen.queryByTestId("project-pull-requests-empty"), null);
+  assert.equal(screen.queryByText("No reviews yet."), null);
+}
+
+function productionConsumers({ activeRepoPullRequest, selectedPullRequest }) {
+  const crumbs = buildProjectDetailCrumbs({
+    activeTab: "prs",
+    commit: null,
+    issue: null,
+    pullRequest: selectedPullRequest,
+    setRequestedTab: noop,
+    setSelectedCommitHash: noop,
+    setSelectedIssueId: noop,
+    setSelectedPullRequestId: noop,
+    setTabsResetKey: noop,
+  });
+  const contextItem = projectDetailSelectionItem({
+    projectChannelId: "trusted-project-channel",
+    projectId: "project-id",
+    pullRequest: selectedPullRequest,
+    repository,
+  });
+  const agent = buildProjectDetailAgentContext({
+    activeTab: "prs",
+    branch: "feature-a",
+    project: { name: "buzz" },
+    repository: {
+      name: repository.name,
+      repoAddress: repository.repoAddress,
+    },
+    source: "remote",
+    workItems: [null, null, selectedPullRequest],
+  });
+  return {
+    agentReviewId: agent.workItem?.id ?? null,
+    crumbTitle: crumbs.activeWorkItemCrumb?.title ?? null,
+    contextId: contextItem?.id ?? null,
+    diffQueryId: activeRepoPullRequest?.id ?? null,
+    diffWorkspaceBranch: reviewDiffWorkspaceBranch({
+      activeBranch: "feature-a",
+      defaultBranch: repository.defaultBranch,
+      pullRequest: activeRepoPullRequest,
+    }),
+  };
+}
+
+function panelConsumers({ isLoading, pullRequests, selectedPullRequest }) {
+  return {
+    kind: pullRequestsPanelKind({
+      isLoading,
+      pullRequests,
+      selectedPullRequest,
+    }),
+    ...productionConsumers({
+      activeRepoPullRequest: selectedPullRequest,
+      selectedPullRequest,
+    }),
+  };
+}
+
+const dom = new JSDOM("<!doctype html><html><body></body></html>", {
+  url: "http://localhost",
+});
+
+class NoopObserver {
+  disconnect() {}
+  observe() {}
+  unobserve() {}
+}
+
+Object.assign(globalThis, {
+  HTMLElement: dom.window.HTMLElement,
+  IS_REACT_ACT_ENVIRONMENT: true,
+  IntersectionObserver: NoopObserver,
+  MutationObserver: dom.window.MutationObserver,
+  ResizeObserver: NoopObserver,
+  document: dom.window.document,
+  getComputedStyle: (...args) => dom.window.getComputedStyle(...args),
+  localStorage: dom.window.localStorage,
+  self: dom.window,
+  window: dom.window,
+});
+Object.defineProperty(globalThis, "navigator", {
+  configurable: true,
+  value: dom.window.navigator,
+  writable: true,
+});
+Object.defineProperty(dom.window.navigator, "mediaDevices", {
+  configurable: true,
+  value: {
+    addEventListener: () => {},
+    enumerateDevices: async () => [],
+    removeEventListener: () => {},
+  },
+});
+dom.window.matchMedia = () => ({
+  matches: false,
+  addEventListener() {},
+  removeEventListener() {},
+});
+dom.window.requestAnimationFrame = (callback) => setTimeout(callback, 0);
+dom.window.cancelAnimationFrame = (id) => clearTimeout(id);
+globalThis.requestAnimationFrame = dom.window.requestAnimationFrame;
+globalThis.cancelAnimationFrame = dom.window.cancelAnimationFrame;
+const tauriInternals = {
+  invoke: async (cmd) => {
+    if (cmd === "get_identity") return { pubkey: OWNER };
+    if (cmd === "search_messages") return { found: 0, hits: [] };
+    if (cmd === "get_open_channel_directory") return [];
+    if (cmd === "get_channel_details") return null;
+    if (cmd === "list_channels") return [];
+    if (cmd === "get_users_batch") return { missing: [], profiles: {} };
+    if (cmd.startsWith("plugin:event|")) return 0;
+    throw new Error(`unmocked Tauri command: ${cmd}`);
+  },
+  transformCallback: () => 1,
+};
+globalThis.__TAURI_INTERNALS__ = tauriInternals;
+dom.window.__TAURI_INTERNALS__ = tauriInternals;
+globalThis.__TAURI_EVENT_PLUGIN_INTERNALS__ = { unregisterListener: () => {} };
+dom.window.__TAURI_EVENT_PLUGIN_INTERNALS__ =
+  globalThis.__TAURI_EVENT_PLUGIN_INTERNALS__;
+
+after(() => dom.window.close());
+
+const workspaceTabsStub = {
+  commitDiff: null,
+  commitDiffError: null,
+  commitDiffLoading: false,
+  contributorActivityCounts: {},
+  contributorPubkeys: [],
+  createIssueAction: { onCreate: async () => {}, pending: false },
+  localSnapshot: null,
+  localSnapshotError: null,
+  localSnapshotLoading: false,
+  onSelectedCommitHashChange: noop,
+  onSelectedIssueIdChange: noop,
+  onSelectedPullRequestIdChange: noop,
+  projectId: "project-id",
+  repoContributors: [],
+  repoDiff: null,
+  repoDiffError: null,
+  repoDiffLoading: false,
+  repoHost: { kind: "unresolved" },
+  repoSource: "remote",
+  selectedCommitHash: null,
+  selectedIssueId: null,
+  snapshot: null,
+  snapshotError: null,
+  snapshotLoading: false,
+};
+
+let React;
+let act;
+let createRoot;
+let hookModule;
+let workspaceTabsModule;
+let QueryClient;
+let QueryClientProvider;
+let CommunitiesProvider;
+let HuddleProvider;
+let TooltipProvider;
+let createMemoryHistory;
+let createRootRoute;
+let createRoute;
+let createRouter;
+let RouterProvider;
+let channelsQueryKey;
+before(async () => {
+  ({ default: React, act } = await import("react"));
+  ({ createRoot } = await import("react-dom/client"));
+  hookModule = await import("./useRetainedProjectGitViews.ts");
+  workspaceTabsModule = await import("./ProjectWorkspaceTabs.tsx");
+  ({ QueryClient, QueryClientProvider } = await import(
+    "@tanstack/react-query"
+  ));
+  ({ CommunitiesProvider } = await import(
+    "@/features/communities/useCommunities.tsx"
+  ));
+  ({ HuddleProvider } = await import("@/features/huddle"));
+  ({ TooltipProvider } = await import("@/shared/ui/tooltip"));
+  ({
+    createMemoryHistory,
+    createRootRoute,
+    createRoute,
+    createRouter,
+    RouterProvider,
+  } = await import("@tanstack/react-router"));
+  ({ channelsQueryKey } = await import("@/features/channels/hooks.ts"));
+});
+
+async function renderSelection(initialProps) {
+  let props = initialProps;
+  const result = { current: null };
+  function Probe() {
+    result.current = hookModule.useRetainedPullRequestSelection(props);
+    return null;
+  }
+  const container = document.createElement("div");
+  document.body.appendChild(container);
+  const root = createRoot(container);
+  await act(async () => {
+    root.render(React.createElement(Probe));
+  });
+  return {
+    result,
+    async rerender(nextProps) {
+      props = nextProps;
+      await act(async () => {
+        root.render(React.createElement(Probe));
+      });
+    },
+    async unmount() {
+      await act(async () => {
+        root.unmount();
+      });
+      container.remove();
+    },
+  };
+}
+
+async function renderWorkspaceReviews(initialProps) {
+  let setPanelProps = noop;
+  const { WorkspaceTabs } = workspaceTabsModule;
+  const client = new QueryClient({
+    defaultOptions: { queries: { retry: false, gcTime: 0 } },
+  });
+  client.setQueryData(["identity"], { pubkey: OWNER });
+  client.setQueryData(channelsQueryKey, []);
+  function Panel() {
+    const [props, setProps] = React.useState(initialProps);
+    setPanelProps = setProps;
+    return React.createElement(WorkspaceTabs, {
+      ...workspaceTabsStub,
+      initialTab: "prs",
+      project: repository,
+      pullRequests: props.pullRequests,
+      pullRequestsError: null,
+      pullRequestsLoading: props.isLoading,
+      selectedPullRequest: props.selectedPullRequest,
+      selectedPullRequestId: props.selectedPullRequestId,
+    });
+  }
+  const rootRoute = createRootRoute({ component: Panel });
+  const channelRoute = createRoute({
+    getParentRoute: () => rootRoute,
+    path: "/channels/$channelId",
+    component: () => null,
+  });
+  const router = createRouter({
+    history: createMemoryHistory({ initialEntries: ["/"] }),
+    routeTree: rootRoute.addChildren([channelRoute]),
+  });
+  await router.load();
+  const container = document.createElement("div");
+  document.body.appendChild(container);
+  const root = createRoot(container);
+  const tree = () =>
+    React.createElement(
+      QueryClientProvider,
+      { client },
+      React.createElement(
+        TooltipProvider,
+        null,
+        React.createElement(
+          CommunitiesProvider,
+          null,
+          React.createElement(
+            HuddleProvider,
+            null,
+            React.createElement(RouterProvider, { router }),
+          ),
+        ),
+      ),
+    );
+  await act(async () => {
+    root.render(tree());
+  });
+  return {
+    async rerender(nextProps) {
+      await act(async () => {
+        setPanelProps(nextProps);
+      });
+    },
+    async unmount() {
+      await act(async () => {
+        root.unmount();
+      });
+      client.clear();
+      client.unmount();
+      container.remove();
+    },
+  };
+}
+
+test("selected review chrome and diff query stay aligned across fetch phases", async () => {
+  const { screen } = await import("@testing-library/react");
+  const populated = {
+    activeBranch: "feature-a",
+    isFetching: false,
+    pullRequests: [reviewA],
+    repository,
+    selectedPullRequestId: REVIEW_A_ID,
+  };
+  const {
+    rerender,
+    result,
+    unmount: unmountSelection,
+  } = await renderSelection(populated);
+
+  const populatedConsumers = panelConsumers({
+    isLoading: false,
+    pullRequests: populated.pullRequests,
+    selectedPullRequest: result.current.selectedPullRequest,
+  });
+  assert.equal(result.current.selectedPullRequest, reviewA);
+  assert.equal(result.current.activeRepoPullRequest, reviewA);
+  assert.deepEqual(populatedConsumers, {
+    agentReviewId: REVIEW_A_ID,
+    crumbTitle: "Ship the retained review",
+    contextId: `review:${REVIEW_A_ID}`,
+    diffQueryId: REVIEW_A_ID,
+    diffWorkspaceBranch: "main",
+    kind: "detail",
+  });
+  // Drive the production WorkspaceTabs → PullRequestsPanel handoff
+  // (ProjectWorkspaceTabs.tsx selectedPullRequest={selectedPullRequest}).
+  // Hardcoding that prop to null makes the fetching-empty assertions fail.
+  const panel = await renderWorkspaceReviews({
+    isLoading: false,
+    pullRequests: populated.pullRequests,
+    selectedPullRequest: result.current.selectedPullRequest,
+    selectedPullRequestId: REVIEW_A_ID,
+  });
+  try {
+    assert.equal(globalThis.__FORUM_COMPOSER_STUBBED__, true);
+    assertRetainedReviewDetail(screen);
+
+    await rerender({
+      ...populated,
+      isFetching: true,
+      pullRequests: [],
+    });
+    const fetchingConsumers = panelConsumers({
+      isLoading: false,
+      pullRequests: [],
+      selectedPullRequest: result.current.selectedPullRequest,
+    });
+    assert.equal(result.current.selectedPullRequest, reviewA);
+    assert.equal(
+      result.current.selectedPullRequest,
+      result.current.activeRepoPullRequest,
+    );
+    assert.deepEqual(fetchingConsumers, populatedConsumers);
+    await panel.rerender({
+      isLoading: false,
+      pullRequests: [],
+      selectedPullRequest: result.current.selectedPullRequest,
+      selectedPullRequestId: REVIEW_A_ID,
+    });
+    assertRetainedReviewDetail(screen);
+
+    await rerender({
+      ...populated,
+      isFetching: false,
+      pullRequests: [],
+    });
+    const completedConsumers = panelConsumers({
+      isLoading: false,
+      pullRequests: [],
+      selectedPullRequest: result.current.selectedPullRequest,
+    });
+    assert.equal(result.current.selectedPullRequest, null);
+    assert.equal(result.current.activeRepoPullRequest, null);
+    assert.deepEqual(completedConsumers, {
+      agentReviewId: null,
+      crumbTitle: null,
+      contextId: null,
+      diffQueryId: null,
+      diffWorkspaceBranch: "feature-a",
+      kind: "empty",
+    });
+    await panel.rerender({
+      isLoading: false,
+      pullRequests: [],
+      selectedPullRequest: result.current.selectedPullRequest,
+      selectedPullRequestId: REVIEW_A_ID,
+    });
+    assert.equal(
+      screen.getByTestId("project-pull-requests-empty").textContent,
+      "No reviews yet.",
+    );
+    assert.equal(screen.queryByTestId("project-pull-request-detail"), null);
+  } finally {
+    await panel.unmount();
+    await unmountSelection();
+  }
+});
diff --git a/desktop/src/features/projects/ui/useRetainedProjectGitViews.ts b/desktop/src/features/projects/ui/useRetainedProjectGitViews.ts
new file mode 100644
index 00000000000..d0583383c38
--- /dev/null
+++ b/desktop/src/features/projects/ui/useRetainedProjectGitViews.ts
@@ -0,0 +1,218 @@
+import * as React from "react";
+
+import {
+  type ProjectPullRequest,
+  type ProjectRepoDiff,
+  type ProjectRepoSnapshot,
+  type Repository,
+  useProjectLocalRepoDiffQuery,
+  useProjectLocalRepoSnapshotQuery,
+  useProjectRepoDiffQuery,
+  useProjectRepoSnapshotQuery,
+} from "@/features/projects/hooks";
+import {
+  currentPullRequestForSelection,
+  retainLatestByKey,
+  reviewDiffWorkspaceBranch,
+  shouldReplaceRetainedPullRequest,
+} from "@/features/projects/lib/projectReviewDisplay";
+import { normalizeRepositoryUrl } from "@/features/projects/lib/projectsViewHelpers";
+import { useProjectCommitDiffQuery } from "@/features/projects/useProjectCommitDiff";
+import { snapshotHasContent } from "./projectDetailHelpers";
+
+/** Keep the active review identity stable while the pull-request list refetches. */
+export function useRetainedPullRequestSelection({
+  activeBranch,
+  isFetching,
+  pullRequests,
+  repository,
+  selectedPullRequestId,
+}: {
+  activeBranch: string | null | undefined;
+  isFetching: boolean;
+  pullRequests: ProjectPullRequest[] | undefined;
+  repository: Repository | null | undefined;
+  selectedPullRequestId: string | null;
+}) {
+  const currentBranchPullRequest = React.useMemo(() => {
+    const projectRepositories = new Set(
+      (repository?.cloneUrls ?? []).map(normalizeRepositoryUrl),
+    );
+    const matches =
+      pullRequests?.filter(
+        (pullRequest) =>
+          pullRequest.branchName === activeBranch &&
+          pullRequest.cloneUrls.some((cloneUrl) =>
+            projectRepositories.has(normalizeRepositoryUrl(cloneUrl)),
+          ),
+      ) ?? [];
+    return matches.length === 1 ? matches[0] : null;
+  }, [activeBranch, pullRequests, repository?.cloneUrls]);
+  const selectedBranchPullRequestKey = `${repository?.id ?? "none"}:${activeBranch}`;
+  const selectedBranchPullRequestCache = React.useRef({
+    key: selectedBranchPullRequestKey,
+    value: currentBranchPullRequest,
+  });
+  const selectedBranchPullRequest = retainLatestByKey(
+    selectedBranchPullRequestCache,
+    selectedBranchPullRequestKey,
+    currentBranchPullRequest,
+    (next) => shouldReplaceRetainedPullRequest(next, isFetching),
+  );
+  const openBranchPullRequest =
+    selectedBranchPullRequest?.status === "Open" ||
+    selectedBranchPullRequest?.status === "Draft"
+      ? selectedBranchPullRequest
+      : null;
+  const currentSelectedPullRequest = currentPullRequestForSelection({
+    pullRequests,
+    selectedPullRequestId,
+  });
+  const selectedPullRequestKey = [
+    repository?.id ?? "none",
+    selectedPullRequestId ?? "none",
+  ].join(":");
+  const selectedPullRequestCache = React.useRef({
+    key: selectedPullRequestKey,
+    value: currentSelectedPullRequest,
+  });
+  const selectedPullRequest = retainLatestByKey(
+    selectedPullRequestCache,
+    selectedPullRequestKey,
+    currentSelectedPullRequest,
+    (next) => shouldReplaceRetainedPullRequest(next, isFetching),
+  );
+  const activeRepoPullRequest = selectedPullRequestId
+    ? selectedPullRequest
+    : selectedBranchPullRequest;
+  return {
+    activeRepoPullRequest,
+    openBranchPullRequest,
+    selectedBranchPullRequest,
+    selectedPullRequest,
+  };
+}
+
+/** Keep a populated repository snapshot on screen across transient refetches. */
+export function useRetainedRepoSnapshot(
+  cacheKey: string,
+  data: ProjectRepoSnapshot | null | undefined,
+  isFetching: boolean,
+) {
+  const cache = React.useRef({
+    key: cacheKey,
+    value: data,
+  });
+  return retainLatestByKey(
+    cache,
+    cacheKey,
+    data,
+    (next, previous) =>
+      snapshotHasContent(next) || !snapshotHasContent(previous) || !isFetching,
+  );
+}
+
+/** Keep a populated review diff on screen across empty refetch results. */
+export function useRetainedRepoDiff(
+  cacheKey: string,
+  data: ProjectRepoDiff | null | undefined,
+  isFetching: boolean,
+) {
+  const cache = React.useRef({
+    key: cacheKey,
+    value: data,
+  });
+  return retainLatestByKey(cache, cacheKey, data, (next, previous) => {
+    const nextFiles = next?.files.length ?? 0;
+    const previousFiles = previous?.files.length ?? 0;
+    if (previousFiles > 0 && nextFiles === 0) return !isFetching;
+    return next !== undefined || !isFetching;
+  });
+}
+
+/** Load and retain repository snapshot/diff queries for the project detail view. */
+export function useProjectDetailGitViews({
+  activeBranch,
+  activeRepoPullRequest,
+  activeTag,
+  isBuzzHost,
+  repository,
+  reposDir,
+  repoSource,
+  selectedBranchPullRequest,
+  selectedCommitHash,
+  selectedTag,
+}: {
+  activeBranch: string | null | undefined;
+  activeRepoPullRequest: ProjectPullRequest | null | undefined;
+  activeTag: { commit: string; name: string } | null;
+  isBuzzHost: boolean;
+  repository: Repository | null | undefined;
+  reposDir?: string | null;
+  repoSource: "local" | "remote";
+  selectedBranchPullRequest: ProjectPullRequest | null;
+  selectedCommitHash: string | null;
+  selectedTag: string | null;
+}) {
+  const repoSnapshotQuery = useProjectRepoSnapshotQuery(
+    repository,
+    activeBranch,
+    selectedTag ? null : selectedBranchPullRequest,
+    activeTag,
+    isBuzzHost,
+  );
+  const displayedRepoSnapshot = useRetainedRepoSnapshot(
+    `${repository?.id}:${activeBranch}:${selectedTag ? activeTag?.name : selectedBranchPullRequest?.id}:${selectedTag ? activeTag?.commit : selectedBranchPullRequest?.commit}`,
+    repoSnapshotQuery.data,
+    repoSnapshotQuery.isFetching,
+  );
+  const reviewDiffBranch = reviewDiffWorkspaceBranch({
+    activeBranch,
+    defaultBranch: repository?.defaultBranch,
+    pullRequest: activeRepoPullRequest,
+  });
+  const repoDiffQuery = useProjectRepoDiffQuery(
+    repository,
+    reviewDiffBranch,
+    activeRepoPullRequest,
+    repoSource === "remote",
+  );
+  const localRepoDiffQuery = useProjectLocalRepoDiffQuery(
+    repository,
+    reposDir,
+    reviewDiffBranch,
+    activeRepoPullRequest,
+    repoSource === "local" && Boolean(activeRepoPullRequest),
+  );
+  const commitDiffQuery = useProjectCommitDiffQuery(
+    repository,
+    selectedCommitHash,
+    repoSource,
+    reposDir,
+  );
+  const localRepoSnapshotQuery = useProjectLocalRepoSnapshotQuery(
+    repository,
+    reposDir,
+    activeBranch,
+  );
+  const displayedRepoDiff = useRetainedRepoDiff(
+    `${repository?.id ?? "none"}:${repoSource}:${reviewDiffBranch}:${activeRepoPullRequest?.id}:${activeRepoPullRequest?.commit}`,
+    repoSource === "local" ? localRepoDiffQuery.data : repoDiffQuery.data,
+    repoSource === "local"
+      ? localRepoDiffQuery.isFetching
+      : repoDiffQuery.isFetching,
+  );
+  return {
+    commitDiffQuery,
+    displayedRepoDiff,
+    displayedRepoDiffError:
+      repoSource === "local" ? localRepoDiffQuery.error : repoDiffQuery.error,
+    displayedRepoDiffLoading: (repoSource === "local"
+      ? localRepoDiffQuery
+      : repoDiffQuery
+    ).isLoading,
+    displayedRepoSnapshot,
+    localRepoSnapshotQuery,
+    repoSnapshotQuery,
+  };
+}
diff --git a/desktop/src/features/settings/ui/AgentsSettingsPanel.tsx b/desktop/src/features/settings/ui/AgentsSettingsPanel.tsx
index 7307ff5df05..50538868d05 100644
--- a/desktop/src/features/settings/ui/AgentsSettingsPanel.tsx
+++ b/desktop/src/features/settings/ui/AgentsSettingsPanel.tsx
@@ -1,10 +1,21 @@
 import { AgentDefaultsSettingsCard } from "./AgentDefaultsSettingsCard";
+import {
+  setKeepMentionedAgentsPinned,
+  useKeepMentionedAgentsPinned,
+} from "@/features/messages/lib/autoPinMentionedAgentsPreference";
+import { Switch } from "@/shared/ui/switch";
 import { HarnessesSettingsPanel } from "./HarnessesSettingsPanel";
 import { PreventSleepSettingsCard } from "./PreventSleepSettingsCard";
-import { SettingsOptionGroupList } from "./SettingsOptionGroup";
+import {
+  SettingsOptionGroup,
+  SettingsOptionGroupList,
+  SettingsOptionRow,
+} from "./SettingsOptionGroup";
 import { SettingsSectionHeader } from "./SettingsSectionHeader";
 
 export function AgentsSettingsPanel() {
+  const automaticallyMentionAgents = useKeepMentionedAgentsPinned();
+
   return (
     <section className="min-w-0" data-testid="settings-agents">
       <SettingsSectionHeader
@@ -13,6 +24,30 @@ export function AgentsSettingsPanel() {
       />
 
       <SettingsOptionGroupList>
+        <SettingsOptionGroup title="Conversations">
+          <SettingsOptionRow data-testid="settings-automatic-agent-mentions">
+            <div className="min-w-0">
+              <label
+                className="font-medium text-foreground"
+                htmlFor="settings-automatic-agent-mentions-switch"
+              >
+                Automatically mention agents
+              </label>
+              <p
+                className="mt-0.5 text-sm text-muted-foreground/70"
+                data-settings-subcopy
+              >
+                After you mention them once
+              </p>
+            </div>
+            <Switch
+              aria-label="Automatically mention agents"
+              checked={automaticallyMentionAgents}
+              id="settings-automatic-agent-mentions-switch"
+              onCheckedChange={setKeepMentionedAgentsPinned}
+            />
+          </SettingsOptionRow>
+        </SettingsOptionGroup>
         <PreventSleepSettingsCard />
         <HarnessesSettingsPanel />
         <AgentDefaultsSettingsCard />
diff --git a/desktop/src/features/settings/ui/ModerationQueueCard.tsx b/desktop/src/features/settings/ui/ModerationQueueCard.tsx
index de414bbf0d1..58dbe87ab79 100644
--- a/desktop/src/features/settings/ui/ModerationQueueCard.tsx
+++ b/desktop/src/features/settings/ui/ModerationQueueCard.tsx
@@ -1,7 +1,10 @@
+import { useQueryClient } from "@tanstack/react-query";
 import { AlertTriangle, ChevronDown, ShieldAlert } from "lucide-react";
 import { useMemo } from "react";
 import { toast } from "sonner";
 
+import { invalidateChannelMembersRosters } from "@/features/channels/rosterFreshness";
+
 import {
   useModerationAuditQuery,
   useModerationReportsQuery,
@@ -365,6 +368,7 @@ function QueueGroupCard({
 }
 
 function QueueTab() {
+  const queryClient = useQueryClient();
   const reportsQuery = useModerationReportsQuery({ status: "open" });
   const auditQuery = useModerationAuditQuery();
   const resolveMutation = useResolveReportMutation();
@@ -408,6 +412,12 @@ function QueueTab() {
       // report open (retryable, no orphan decision row). Only after the paired
       // 9040/9005/9001 lands do we resolve every open report about this target.
       await enforceResolution(group, action, banMutation.mutateAsync);
+      if (action === "kick" && group.channelId != null) {
+        // The kick writes the roster directly (no member mutation); without
+        // this, the kicked identity stays in the cached roster for the
+        // freshness window.
+        await invalidateChannelMembersRosters(queryClient, [group.channelId]);
+      }
       await Promise.all(
         openReports.map((report) =>
           resolveMutation.mutateAsync({
diff --git a/desktop/src/features/settings/ui/PreventSleepSettingsCard.tsx b/desktop/src/features/settings/ui/PreventSleepSettingsCard.tsx
index 9f46f0b5c85..7844d1f8f86 100644
--- a/desktop/src/features/settings/ui/PreventSleepSettingsCard.tsx
+++ b/desktop/src/features/settings/ui/PreventSleepSettingsCard.tsx
@@ -1,15 +1,10 @@
 import { usePreventSleepContext } from "@/features/agents/usePreventSleep";
 import { Switch } from "@/shared/ui/switch";
 import { SettingsOptionGroup, SettingsOptionRow } from "./SettingsOptionGroup";
-import {
-  setPersistentAgentAudienceEnabled,
-  usePersistentAgentAudience,
-} from "@/features/messages/lib/persistentAgentAudience";
 
 export function PreventSleepSettingsCard() {
   const { enabled, setEnabled, hasRunningAgents, expired, clearExpired } =
     usePreventSleepContext();
-  const persistentAudience = usePersistentAgentAudience(null);
 
   return (
     <div className="min-w-0 space-y-3">
@@ -17,30 +12,6 @@ export function PreventSleepSettingsCard() {
         data-testid="agents-preferences-card"
         title="Preferences"
       >
-        <SettingsOptionRow>
-          <div className="min-w-0">
-            <label
-              className="text-sm font-medium"
-              htmlFor="persistent-agent-audience-switch"
-            >
-              Keep addressed agents active
-            </label>
-            <p
-              className="text-sm font-normal text-muted-foreground/70"
-              data-settings-subcopy
-            >
-              Keep agents you address selected for future messages in the same
-              channel or thread. Remove them from the composer at any time.
-            </p>
-          </div>
-          <Switch
-            checked={persistentAudience.enabled}
-            data-testid="persistent-agent-audience-toggle"
-            id="persistent-agent-audience-switch"
-            onCheckedChange={setPersistentAgentAudienceEnabled}
-          />
-        </SettingsOptionRow>
-
         <SettingsOptionRow>
           <div className="min-w-0">
             <label
diff --git a/desktop/src/features/workflows/ui/WorkflowActionsMenu.tsx b/desktop/src/features/workflows/ui/WorkflowActionsMenu.tsx
index 69cd3103f30..1114e2b1afa 100644
--- a/desktop/src/features/workflows/ui/WorkflowActionsMenu.tsx
+++ b/desktop/src/features/workflows/ui/WorkflowActionsMenu.tsx
@@ -26,6 +26,7 @@ type WorkflowActionsMenuProps = {
   onEdit: () => void;
   onToggleEnabled: () => void;
   onTrigger: () => void;
+  showEnabledToggle?: boolean;
 };
 
 export function WorkflowActionsMenu({
@@ -36,6 +37,7 @@ export function WorkflowActionsMenu({
   onEdit,
   onToggleEnabled,
   onTrigger,
+  showEnabledToggle = true,
 }: WorkflowActionsMenuProps) {
   return (
     <DropdownMenu>
@@ -63,37 +65,39 @@ export function WorkflowActionsMenu({
           <Copy className="mr-2 h-4 w-4" />
           Duplicate
         </DropdownMenuItem>
-        <DropdownMenuCheckboxItem
-          checked={isEnabled}
-          className="gap-2 pl-2 [&>span:first-child]:hidden"
-          disabled={isTogglingEnabled}
-          onCheckedChange={(checked) => {
-            if (checked !== isEnabled) onToggleEnabled();
-          }}
-          onSelect={(event) => event.preventDefault()}
-        >
-          {isEnabled ? (
-            <Power className="mr-2 h-4 w-4 shrink-0" />
-          ) : (
-            <PowerOff className="mr-2 h-4 w-4 shrink-0" />
-          )}
-          <span>Enable</span>
-          <span
-            aria-hidden="true"
-            className={
-              "ml-auto inline-flex h-5 w-9 shrink-0 items-center rounded-full border-2 border-transparent transition-colors " +
-              (isEnabled ? "bg-primary" : "bg-input")
-            }
-            data-testid="workflow-enabled-switch-visual"
+        {showEnabledToggle ? (
+          <DropdownMenuCheckboxItem
+            checked={isEnabled}
+            className="gap-2 pl-2 [&>span:first-child]:hidden"
+            disabled={isTogglingEnabled}
+            onCheckedChange={(checked) => {
+              if (checked !== isEnabled) onToggleEnabled();
+            }}
+            onSelect={(event) => event.preventDefault()}
           >
+            {isEnabled ? (
+              <Power className="mr-2 h-4 w-4 shrink-0" />
+            ) : (
+              <PowerOff className="mr-2 h-4 w-4 shrink-0" />
+            )}
+            <span>Enable</span>
             <span
+              aria-hidden="true"
               className={
-                "block h-4 w-4 rounded-full bg-background transition-transform " +
-                (isEnabled ? "translate-x-4" : "translate-x-0")
+                "ml-auto inline-flex h-5 w-9 shrink-0 items-center rounded-full border-2 border-transparent transition-colors " +
+                (isEnabled ? "bg-primary" : "bg-input")
               }
-            />
-          </span>
-        </DropdownMenuCheckboxItem>
+              data-testid="workflow-enabled-switch-visual"
+            >
+              <span
+                className={
+                  "block h-4 w-4 rounded-full bg-background transition-transform " +
+                  (isEnabled ? "translate-x-4" : "translate-x-0")
+                }
+              />
+            </span>
+          </DropdownMenuCheckboxItem>
+        ) : null}
         <DropdownMenuSeparator />
         <DropdownMenuItem className="text-destructive" onClick={onDelete}>
           <Trash2 className="mr-2 h-4 w-4" />
diff --git a/desktop/src/features/workflows/ui/WorkflowCard.tsx b/desktop/src/features/workflows/ui/WorkflowCard.tsx
index 3d3044d63d8..48ce8d2db60 100644
--- a/desktop/src/features/workflows/ui/WorkflowCard.tsx
+++ b/desktop/src/features/workflows/ui/WorkflowCard.tsx
@@ -6,25 +6,27 @@ import {
   Hash,
   MessageCircle,
   MessageSquare,
-  Send,
   SmilePlus,
   Timer,
   Webhook,
   Zap,
 } from "lucide-react";
 import type { LucideIcon } from "lucide-react";
+import { motion, useReducedMotion } from "motion/react";
+import * as React from "react";
 
 import type { Workflow } from "@/shared/api/types";
 import { cn } from "@/shared/lib/cn";
+import { Switch } from "@/shared/ui/switch";
 import { WorkflowActionsMenu } from "./WorkflowActionsMenu";
 import {
-  getWorkflowDescription,
-  getWorkflowDisplayStatus,
   getWorkflowEnabled,
-  getWorkflowPrimaryAction,
-  getWorkflowTriggerSummary,
+  getWorkflowActionTiles,
+  getWorkflowCardLabel,
+  getWorkflowTriggerEmoji,
   getWorkflowTriggerType,
 } from "./workflowDefinition";
+import { StatusEmoji } from "@/features/user-status/ui/StatusEmoji";
 
 type WorkflowCardProps = {
   workflow: Workflow;
@@ -52,7 +54,7 @@ const ACTION_ICONS: Record<string, LucideIcon> = {
   delay: Timer,
   request_approval: CircleCheckBig,
   send_dm: MessageCircle,
-  send_message: Send,
+  send_message: MessageSquare,
   set_channel_topic: Hash,
 };
 
@@ -64,15 +66,123 @@ const TRIGGER_ACCENTS: Record<string, string> = {
   webhook: "border-orange-300/30 bg-orange-500 text-white",
 };
 
-function StatusBadge({ status }: { status: Workflow["status"] }) {
+const ACTION_ACCENTS: Record<string, string> = {
+  add_reaction: "border-pink-400/30 bg-pink-600 text-white",
+  call_webhook: "border-orange-300/30 bg-orange-500 text-white",
+  delay: "border-sky-300/30 bg-sky-500 text-white",
+  request_approval: "border-emerald-300/30 bg-emerald-600 text-white",
+  send_dm: "border-indigo-300/30 bg-indigo-600 text-white",
+  send_message: "border-blue-300/30 bg-blue-600 text-white",
+  set_channel_topic: "border-violet-300/30 bg-violet-600 text-white",
+};
+
+function StatusToggle({
+  disabled,
+  enabled,
+  onToggle,
+}: {
+  disabled: boolean;
+  enabled: boolean;
+  onToggle: () => void;
+}) {
+  return (
+    <Switch
+      aria-label={enabled ? "Disable workflow" : "Enable workflow"}
+      checked={enabled}
+      disabled={disabled}
+      onCheckedChange={(checked) => {
+        if (checked !== enabled) onToggle();
+      }}
+    />
+  );
+}
+
+function ActionTile({
+  action,
+  animationSequence,
+  className,
+  emoji,
+  index,
+}: {
+  action: string;
+  animationSequence: number;
+  className?: string;
+  emoji: string | null;
+  index: number;
+}) {
+  const ActionIcon = ACTION_ICONS[action];
+  const accent = ACTION_ACCENTS[action];
+  const reduceMotion = useReducedMotion();
+
+  return (
+    <span
+      aria-hidden="true"
+      className={cn(
+        "absolute inset-y-0 flex w-9 items-center justify-center rounded-xl border shadow-xs",
+        accent ?? "border-border/65 bg-background/80 text-muted-foreground",
+        className,
+      )}
+    >
+      <motion.span
+        animate={
+          animationSequence > 0 && !reduceMotion
+            ? { scale: [1, 1.18, 0.94, 1], y: [0, -5, 1, 0] }
+            : undefined
+        }
+        className="flex items-center justify-center"
+        transition={{
+          delay: index * 0.11,
+          duration: 0.48,
+          ease: "easeOut",
+        }}
+      >
+        {emoji ? (
+          <StatusEmoji className="h-6 w-6 text-xl" value={emoji} />
+        ) : ActionIcon ? (
+          <ActionIcon className="h-5 w-5" />
+        ) : (
+          <Zap className="h-5 w-5" />
+        )}
+      </motion.span>
+    </span>
+  );
+}
+
+function ActionTileStack({
+  actions,
+  animationSequence = 0,
+}: {
+  actions: Array<{ action: string; emoji: string | null; key: string }>;
+  animationSequence?: number;
+}) {
+  const visibleActions = actions.slice(0, 3);
+
   return (
     <span
       className={cn(
-        "rounded-full border border-border/65 bg-background/80 px-2 py-1 text-2xs font-semibold uppercase tracking-wider shadow-xs",
-        status === "active" ? "text-foreground" : "text-muted-foreground",
+        "relative h-9",
+        visibleActions.length === 1 && "w-9",
+        visibleActions.length === 2 && "w-[2.625rem]",
+        visibleActions.length > 2 && "w-12",
       )}
+      data-testid="workflow-card-action-stack"
     >
-      {status}
+      {visibleActions
+        .map((action, index) => (
+          <ActionTile
+            action={action.action}
+            animationSequence={animationSequence}
+            className={cn(
+              index === 0 && "left-0 z-10",
+              index === 1 && "left-1.5 z-[5] scale-90 opacity-60",
+              index === 2 && "left-3 scale-75 opacity-35",
+            )}
+            emoji={action.emoji}
+            index={index}
+            key={`${action.key}-${animationSequence}`}
+          />
+        ))
+        .reverse()}
     </span>
   );
 }
@@ -88,19 +198,20 @@ export function WorkflowCard({
   onDuplicate,
   onDelete,
 }: WorkflowCardProps) {
-  const displayStatus = getWorkflowDisplayStatus(workflow);
-  const triggerSummary = getWorkflowTriggerSummary(workflow.definition);
-  const description = getWorkflowDescription(workflow.definition);
+  const [triggerAnimationSequence, setTriggerAnimationSequence] =
+    React.useState(0);
+  const isEnabled = getWorkflowEnabled(workflow.definition);
+  const cardLabel = getWorkflowCardLabel(workflow.definition);
   const triggerType = getWorkflowTriggerType(workflow.definition);
-  const actionType = getWorkflowPrimaryAction(workflow.definition);
+  const actionTiles = getWorkflowActionTiles(workflow.definition);
+  const triggerEmoji = getWorkflowTriggerEmoji(workflow.definition);
   const TriggerIcon = triggerType ? TRIGGER_ICONS[triggerType] : undefined;
-  const ActionIcon = actionType ? ACTION_ICONS[actionType] : undefined;
   const triggerAccent = triggerType ? TRIGGER_ACCENTS[triggerType] : undefined;
 
   return (
     <div
       className={cn(
-        "group relative min-h-60 w-full overflow-hidden rounded-2xl bg-muted/50 p-5 text-left text-foreground shadow-xs transition-colors hover:bg-muted/65",
+        "group relative flex min-h-60 w-full flex-col overflow-hidden rounded-2xl bg-muted/50 p-5 text-left text-foreground shadow-xs transition-colors hover:bg-muted/65",
       )}
       data-testid={`workflow-card-${workflow.id}`}
     >
@@ -112,7 +223,7 @@ export function WorkflowCard({
         <span className="sr-only">View {workflow.name}</span>
       </button>
 
-      <div className="pointer-events-none relative z-10 flex h-full min-h-48 flex-col">
+      <div className="pointer-events-none relative z-10 flex min-h-48 flex-1 flex-col">
         <div className="flex items-start justify-between gap-3">
           <div className="flex items-center gap-2" aria-hidden="true">
             <span
@@ -121,54 +232,74 @@ export function WorkflowCard({
                 triggerAccent ?? "border-slate-400/30 bg-slate-600 text-white",
               )}
             >
-              {TriggerIcon ? (
+              {triggerEmoji ? (
+                <StatusEmoji className="h-6 w-6 text-xl" value={triggerEmoji} />
+              ) : TriggerIcon ? (
                 <TriggerIcon className="h-5 w-5" />
               ) : (
                 <Zap className="h-5 w-5" />
               )}
             </span>
-            {ActionIcon ? (
+            {actionTiles.length > 0 ? (
               <>
                 <ArrowRight className="h-4 w-4 text-muted-foreground/60" />
-                <span className="flex h-9 w-9 items-center justify-center rounded-xl border border-border/65 bg-background/80 text-muted-foreground shadow-xs">
-                  <ActionIcon className="h-5 w-5" />
-                </span>
+                <ActionTileStack
+                  actions={actionTiles}
+                  animationSequence={triggerAnimationSequence}
+                />
               </>
             ) : null}
           </div>
 
           <div className="pointer-events-auto flex items-center gap-1.5">
-            <StatusBadge status={displayStatus} />
+            <StatusToggle
+              disabled={isTogglingEnabled}
+              enabled={isEnabled}
+              onToggle={() => onToggleEnabled(workflow)}
+            />
             <WorkflowActionsMenu
-              isEnabled={getWorkflowEnabled(workflow.definition)}
+              isEnabled={isEnabled}
               isTogglingEnabled={isTogglingEnabled}
               onDelete={() => onDelete(workflow)}
               onDuplicate={() => onDuplicate(workflow)}
               onEdit={() => onEdit(workflow)}
               onToggleEnabled={() => onToggleEnabled(workflow)}
-              onTrigger={() => onTrigger(workflow.id)}
+              onTrigger={() => {
+                setTriggerAnimationSequence((sequence) => sequence + 1);
+                onTrigger(workflow.id);
+              }}
+              showEnabledToggle={false}
             />
           </div>
         </div>
 
-        {triggerSummary ? (
-          <p className="mt-4 line-clamp-1 text-xs font-semibold text-muted-foreground">
-            {triggerSummary}
-          </p>
-        ) : null}
-        <h3 className="mt-1 line-clamp-4 text-xl font-bold leading-tight tracking-tight">
-          {workflow.name}
+        <h3
+          className="mt-4 line-clamp-4 text-xl font-bold leading-tight tracking-tight"
+          data-testid="workflow-card-semantic-label"
+        >
+          {cardLabel}
         </h3>
-        {description ? (
-          <p className="mt-2 line-clamp-2 text-sm leading-relaxed text-muted-foreground">
-            {description}
-          </p>
-        ) : null}
 
         <div className="mt-auto flex min-w-0 items-end justify-between gap-3 pt-5 text-muted-foreground">
-          <p className="min-w-0 truncate text-2xs">
-            {channelName ? `#${channelName}` : "Channel workflow"}
-          </p>
+          <div className="min-w-0">
+            {channelName ? (
+              <p
+                className="truncate text-xs font-semibold text-foreground"
+                data-testid="workflow-card-channel"
+              >
+                #{channelName}
+              </p>
+            ) : null}
+            <p
+              className={cn(
+                "truncate text-2xs text-muted-foreground",
+                channelName && "mt-0.5",
+              )}
+              data-testid="workflow-card-name"
+            >
+              {workflow.name}
+            </p>
+          </div>
           <span className="shrink-0 text-2xs">
             {new Date(workflow.updatedAt * 1000).toLocaleDateString()}
           </span>
diff --git a/desktop/src/features/workflows/ui/WorkflowDialog.tsx b/desktop/src/features/workflows/ui/WorkflowDialog.tsx
index fc23515b55d..3f8655a3aa1 100644
--- a/desktop/src/features/workflows/ui/WorkflowDialog.tsx
+++ b/desktop/src/features/workflows/ui/WorkflowDialog.tsx
@@ -41,6 +41,7 @@ import {
   type WorkflowFormBuilderHandle,
 } from "./WorkflowFormBuilder";
 import { WorkflowWebhookSecretDialog } from "./WorkflowWebhookSecretDialog";
+import { getWorkflowActivationWarning } from "./workflowActivationWarning";
 import { getWorkflowEnabled } from "./workflowDefinition";
 import type { WorkflowEditorPane } from "./workflowEditorPane";
 import {
@@ -49,6 +50,7 @@ import {
   yamlToFormState,
 } from "./workflowFormTypes";
 import {
+  readWorkflowDocumentFields,
   readWorkflowHeaderState,
   yamlWithWorkflowEnabled,
   yamlWithWorkflowName,
@@ -117,7 +119,7 @@ function WorkflowNameEditor({
   generating: boolean;
   name: string;
   onCommit: (name: string) => boolean;
-  onEditingChange: (editing: boolean) => void;
+  onEditingChange?: (editing: boolean) => void;
 }) {
   const [editing, setEditing] = React.useState(false);
   const [draft, setDraft] = React.useState(name);
@@ -134,7 +136,7 @@ function WorkflowNameEditor({
   const changeEditing = React.useCallback(
     (nextEditing: boolean) => {
       setEditing(nextEditing);
-      onEditingChange(nextEditing);
+      onEditingChange?.(nextEditing);
     },
     [onEditingChange],
   );
@@ -247,13 +249,10 @@ export function WorkflowDialog({
   const [editorParseError, setEditorParseError] = React.useState<string | null>(
     null,
   );
-  const [workflowNameEditing, setWorkflowNameEditing] = React.useState(false);
   const [historyOpen, setHistoryOpen] = React.useState(false);
   const [channelAutoOpenPending, setChannelAutoOpenPending] = React.useState(
     mode === "create" && !channelId,
   );
-  const [nameLeadingElement, setNameLeadingElement] =
-    React.useState<HTMLDivElement | null>(null);
   const [savedWebhookInfo, setSavedWebhookInfo] = React.useState<{
     relayHttpUrl: string | null;
     relayUrlError: string | null;
@@ -262,6 +261,12 @@ export function WorkflowDialog({
   } | null>(null);
   const [discardConfirmationOpen, setDiscardConfirmationOpen] =
     React.useState(false);
+  const [activationConfirmationOpen, setActivationConfirmationOpen] =
+    React.useState(false);
+  const [pendingCreateYaml, setPendingCreateYaml] = React.useState<
+    string | null
+  >(null);
+  const [formValid, setFormValid] = React.useState(true);
   const [secretConfirmationOpen, setSecretConfirmationOpen] =
     React.useState(false);
   const [generatingName, setGeneratingName] = React.useState(false);
@@ -299,6 +304,9 @@ export function WorkflowDialog({
     let active = true;
     setSavedWebhookInfo(null);
     setDiscardConfirmationOpen(false);
+    setActivationConfirmationOpen(false);
+    setPendingCreateYaml(null);
+    setFormValid(true);
     resetCreate();
     resetUpdate();
 
@@ -338,6 +346,8 @@ export function WorkflowDialog({
     resetCreate();
     resetUpdate();
     setDiscardConfirmationOpen(false);
+    setActivationConfirmationOpen(false);
+    setPendingCreateYaml(null);
     onOpenChange(false);
   }, [onOpenChange, resetCreate, resetUpdate]);
 
@@ -402,14 +412,12 @@ export function WorkflowDialog({
     [closeDialog, isDirty, onOpenChange, savedWebhookInfo],
   );
 
-  async function handleSubmit() {
-    if (!selectedChannelId || !yamlDefinition.trim()) return;
-
+  async function saveWorkflow(yaml: string) {
     try {
-      const saved = await mutation.mutateAsync(yamlDefinition);
+      const saved = await mutation.mutateAsync(yaml);
       initialValuesRef.current = {
         channelId: selectedChannelId,
-        yaml: yamlDefinition,
+        yaml,
       };
       if (saved.webhookSecret) {
         allowNavigationRef.current = false;
@@ -441,6 +449,37 @@ export function WorkflowDialog({
     }
   }
 
+  function handleSubmit() {
+    if (!selectedChannelId || !yamlDefinition.trim() || !formValid) return;
+
+    const documentEnabled = readWorkflowDocumentFields(yamlDefinition).enabled;
+    const savedEnabled = workflowSnapshot
+      ? getWorkflowEnabled(workflowSnapshot.definition)
+      : null;
+    const enablesWorkflow =
+      documentEnabled !== false && (mode !== "edit" || savedEnabled === false);
+    if (enablesWorkflow && getWorkflowActivationWarning(yamlDefinition)) {
+      const disabledYaml = yamlWithWorkflowEnabled(yamlDefinition, false);
+      if (disabledYaml === null) return;
+      setPendingCreateYaml(disabledYaml);
+      setActivationConfirmationOpen(true);
+      return;
+    }
+
+    void saveWorkflow(yamlDefinition);
+  }
+
+  function handleCreateActivation(enabled: boolean) {
+    if (pendingCreateYaml === null) return;
+    const yaml = enabled
+      ? yamlWithWorkflowEnabled(pendingCreateYaml, true)
+      : pendingCreateYaml;
+    if (yaml === null) return;
+    setActivationConfirmationOpen(false);
+    setPendingCreateYaml(null);
+    void saveWorkflow(yaml);
+  }
+
   const handleEditorModeChange = React.useCallback(
     (nextMode: string) => {
       if (nextMode === editorMode) return;
@@ -504,6 +543,10 @@ export function WorkflowDialog({
     setYamlDefinition(nextYaml);
   }, [mutation.reset, workflowEnabled]);
   const showChannelSelector = mode !== "edit";
+  const activationWarning =
+    pendingCreateYaml === null
+      ? null
+      : getWorkflowActivationWarning(pendingCreateYaml);
 
   return (
     <>
@@ -539,17 +582,6 @@ export function WorkflowDialog({
                   generating={generatingName}
                   name={workflowName}
                   onCommit={handleWorkflowNameCommit}
-                  onEditingChange={setWorkflowNameEditing}
-                />
-                <div
-                  className={
-                    mode !== "edit" &&
-                    editorMode === "form" &&
-                    !workflowNameEditing
-                      ? "flex items-center"
-                      : "hidden"
-                  }
-                  ref={setNameLeadingElement}
                 />
               </div>
             </div>
@@ -634,13 +666,14 @@ export function WorkflowDialog({
               channels={channels}
               disabled={mutation.isPending}
               mode={editorMode}
-              nameLeadingContainer={mode === "edit" ? null : nameLeadingElement}
+              nameLeadingContainer={null}
               onChange={(yaml) => {
                 mutation.reset();
                 yamlDefinitionRef.current = yaml;
                 setYamlDefinition(yaml);
               }}
               onSelectedNodeChange={onEditorPaneChange}
+              onValidityChange={setFormValid}
               parseError={editorParseError}
               ref={formBuilderRef}
               scopeField={
@@ -744,6 +777,7 @@ export function WorkflowDialog({
                   disabled={
                     !selectedChannelId ||
                     !yamlDefinition.trim() ||
+                    !formValid ||
                     mutation.isPending
                   }
                   onClick={handleSubmit}
@@ -759,6 +793,48 @@ export function WorkflowDialog({
         </DialogContent>
       </Dialog>
 
+      <AlertDialog
+        onOpenChange={(nextOpen) => {
+          setActivationConfirmationOpen(nextOpen);
+          if (!nextOpen) setPendingCreateYaml(null);
+        }}
+        open={activationConfirmationOpen}
+      >
+        <AlertDialogContent data-testid="workflow-activation-confirmation">
+          <AlertDialogHeader>
+            <AlertDialogTitle>
+              {activationWarning?.title ?? "Turn on this workflow?"}
+            </AlertDialogTitle>
+            <AlertDialogDescription>
+              {activationWarning?.description ??
+                "Turn it on to let it run immediately, or keep it off until you’re ready."}
+            </AlertDialogDescription>
+          </AlertDialogHeader>
+          <AlertDialogFooter>
+            <AlertDialogCancel asChild>
+              <Button type="button" variant="ghost">
+                Back
+              </Button>
+            </AlertDialogCancel>
+            <Button
+              onClick={() => handleCreateActivation(false)}
+              type="button"
+              variant="outline"
+            >
+              Keep off
+            </Button>
+            <AlertDialogAction asChild>
+              <Button
+                onClick={() => handleCreateActivation(true)}
+                type="button"
+              >
+                Turn on
+              </Button>
+            </AlertDialogAction>
+          </AlertDialogFooter>
+        </AlertDialogContent>
+      </AlertDialog>
+
       <AlertDialog
         onOpenChange={(nextOpen) => {
           setDiscardConfirmationOpen(nextOpen);
diff --git a/desktop/src/features/workflows/ui/WorkflowFormBuilder.tsx b/desktop/src/features/workflows/ui/WorkflowFormBuilder.tsx
index 9a525591eb2..58e4b4a960b 100644
--- a/desktop/src/features/workflows/ui/WorkflowFormBuilder.tsx
+++ b/desktop/src/features/workflows/ui/WorkflowFormBuilder.tsx
@@ -1,11 +1,15 @@
 import {
   ArrowDown,
+  CalendarClock,
   Check,
   ChevronDown,
+  GitPullRequest,
+  MessageSquare,
   Plus,
+  SmilePlus,
   Trash2,
+  Webhook,
   X,
-  Zap,
 } from "lucide-react";
 import { FocusScope } from "@radix-ui/react-focus-scope";
 import { AnimatePresence, motion, useReducedMotion } from "motion/react";
@@ -13,6 +17,7 @@ import * as React from "react";
 import { createPortal } from "react-dom";
 
 import type { Channel } from "@/shared/api/types";
+import { StatusEmoji } from "@/features/user-status/ui/StatusEmoji";
 import { Button } from "@/shared/ui/button";
 import { cn } from "@/shared/lib/cn";
 import {
@@ -21,15 +26,20 @@ import {
   DropdownMenuItem,
   DropdownMenuTrigger,
 } from "@/shared/ui/dropdown-menu";
-import { Input } from "@/shared/ui/input";
 import { Switch } from "@/shared/ui/switch";
 import { Textarea } from "@/shared/ui/textarea";
-import { WorkflowEmojiField } from "./WorkflowEmojiField";
-import { WorkflowMessageTextCondition } from "./WorkflowMessageTextConditionEditor";
+import { reactionConditionValue } from "./workflowReactionCondition";
+import { WorkflowTriggerConditions } from "./WorkflowTriggerConditions";
+import { workflowStepDescription } from "./workflowStepDescription";
+import { workflowTriggerDescription } from "./workflowTriggerDescription";
 import { WorkflowScheduleFields } from "./WorkflowScheduleFields";
 import { WorkflowStepCard } from "./WorkflowStepCard";
+import {
+  parseConditionExpressions,
+  conditionValueError,
+  type ParsedConditionExpression,
+} from "./workflowConditionExpression";
 import type { WorkflowEditorPane } from "./workflowEditorPane";
-import { FieldLabel } from "./workflowFormPrimitives";
 import {
   DEFAULT_FORM_STATE,
   ACTION_LABELS,
@@ -52,62 +62,39 @@ import type {
 } from "./workflowFormTypes";
 
 function TriggerConfigFields({
+  conditionDrafts,
   disabled,
   trigger,
+  onConditionDraftsChange,
   onUpdate,
 }: {
+  conditionDrafts: ParsedConditionExpression[] | null;
   disabled?: boolean;
   trigger: TriggerConfig;
+  onConditionDraftsChange: (drafts: ParsedConditionExpression[] | null) => void;
   onUpdate: (trigger: TriggerConfig) => void;
 }) {
   switch (trigger.on) {
     case "message_posted":
-      return (
-        <WorkflowMessageTextCondition
-          disabled={disabled}
-          onChange={(filter) => onUpdate({ ...trigger, filter })}
-          value={trigger.filter ?? ""}
-        />
-      );
     case "diff_posted":
-      return (
-        <div className="space-y-1.5">
-          <FieldLabel htmlFor="wf-trigger-filter">
-            Condition (optional)
-          </FieldLabel>
-          <Input
-            autoCapitalize="off"
-            disabled={disabled}
-            id="wf-trigger-filter"
-            onChange={(event) =>
-              onUpdate({ ...trigger, filter: event.target.value })
-            }
-            placeholder='e.g. str_contains(trigger_text, "deploy")'
-            value={trigger.filter ?? ""}
-          />
-          <p className="text-xs text-muted-foreground">
-            Evalexpr. Empty matches all events.
-          </p>
-        </div>
-      );
     case "reaction_added":
       return (
-        <div className="space-y-1.5">
-          <FieldLabel htmlFor="wf-trigger-emoji">
-            Emoji filter (optional)
-          </FieldLabel>
-          <WorkflowEmojiField
-            ariaLabel="Choose trigger emoji"
-            clearAriaLabel="Clear trigger emoji"
-            disabled={disabled}
-            id="wf-trigger-emoji"
-            onChange={(emoji) => onUpdate({ ...trigger, emoji })}
-            value={trigger.emoji ?? ""}
-          />
-          <p className="text-xs text-muted-foreground">
-            Empty matches any reaction.
-          </p>
-        </div>
+        <WorkflowTriggerConditions
+          key={trigger.on}
+          conditionDrafts={conditionDrafts}
+          disabled={disabled}
+          onConditionDraftsChange={onConditionDraftsChange}
+          onChange={(filter) =>
+            onUpdate({
+              ...trigger,
+              emoji:
+                trigger.on === "reaction_added" ? undefined : trigger.emoji,
+              filter,
+            })
+          }
+          triggerType={trigger.on}
+          value={reactionConditionValue(trigger)}
+        />
       );
     case "webhook":
       return (
@@ -135,6 +122,7 @@ type WorkflowFormBuilderProps = {
   mode: WorkflowEditorMode;
   onChange: (yaml: string) => void;
   onSelectedNodeChange: (pane: WorkflowEditorPane) => void;
+  onValidityChange?: (valid: boolean) => void;
   parseError: string | null;
   scopeField?: React.ReactNode;
   selectedNode: WorkflowEditorPane;
@@ -275,6 +263,7 @@ function WorkflowNode({
               isNumbered && "text-sm font-semibold",
             )}
             data-selected={selected}
+            data-testid="workflow-node-icon"
           >
             {isNumbered ? number : icon}
           </span>
@@ -362,12 +351,13 @@ export const WorkflowFormBuilder = React.forwardRef<
   WorkflowFormBuilderProps
 >(function WorkflowFormBuilder(
   {
-    channels: _channels,
+    channels,
     disabled,
     nameLeadingContainer,
     mode,
     onChange,
     onSelectedNodeChange,
+    onValidityChange,
     parseError,
     scopeField,
     selectedNode: selectedRouteNode,
@@ -383,6 +373,18 @@ export const WorkflowFormBuilder = React.forwardRef<
       ? initialParseRef.current.state
       : DEFAULT_FORM_STATE,
   );
+  const [triggerConditionDrafts, setTriggerConditionDrafts] = React.useState<
+    ParsedConditionExpression[] | null
+  >(null);
+  const conditionDraftsValid =
+    triggerConditionDrafts === null ||
+    triggerConditionDrafts.every(
+      (condition) => !conditionValueError(condition.field, condition.value),
+    );
+
+  React.useEffect(() => {
+    onValidityChange?.(mode !== "form" || conditionDraftsValid);
+  }, [conditionDraftsValid, mode, onValidityChange]);
   const selectedNode =
     selectedRouteNode?.type === "trigger" ||
     (selectedRouteNode?.type === "step" &&
@@ -424,6 +426,7 @@ export const WorkflowFormBuilder = React.forwardRef<
     previousModeRef.current = mode;
 
     if (mode === "yaml") {
+      setTriggerConditionDrafts(null);
       onSelectedNodeChange(null);
       return;
     }
@@ -595,6 +598,33 @@ export const WorkflowFormBuilder = React.forwardRef<
   const selectedStepIndex = selectedStep
     ? formState.steps.findIndex((step) => step.id === selectedStep.id)
     : -1;
+  const triggerEmoji = React.useMemo(() => {
+    if (formState.trigger.on !== "reaction_added") return undefined;
+    const legacyEmoji = formState.trigger.emoji?.trim();
+    if (legacyEmoji) return legacyEmoji;
+    if (!formState.trigger.filter) return undefined;
+    const conditions = parseConditionExpressions(
+      formState.trigger.filter,
+      "reaction_added",
+    );
+    return conditions
+      ?.find(
+        ({ field, operator }) =>
+          field === "trigger_emoji" && operator === "equals",
+      )
+      ?.value.trim();
+  }, [formState.trigger]);
+  const triggerDescription = workflowTriggerDescription(formState.trigger);
+  const visibleTriggerDescription = triggerEmoji
+    ? "Reaction added"
+    : triggerDescription;
+  const TriggerIcon = {
+    diff_posted: GitPullRequest,
+    message_posted: MessageSquare,
+    reaction_added: SmilePlus,
+    schedule: CalendarClock,
+    webhook: Webhook,
+  }[formState.trigger.on];
 
   return (
     <>
@@ -637,10 +667,19 @@ export const WorkflowFormBuilder = React.forwardRef<
                   {scopeField ? <div className="mb-3">{scopeField}</div> : null}
                   <ol aria-label="Workflow sequence">
                     <WorkflowNode
-                      description={TRIGGER_LABELS[formState.trigger.on]}
+                      description={visibleTriggerDescription}
                       disabled={disabled}
-                      icon={<Zap className="h-4 w-4" />}
-                      label={`Trigger: ${TRIGGER_LABELS[formState.trigger.on]}`}
+                      icon={
+                        triggerEmoji ? (
+                          <StatusEmoji
+                            className="h-6 w-6 text-xl"
+                            value={triggerEmoji}
+                          />
+                        ) : (
+                          <TriggerIcon className="h-4 w-4" />
+                        )
+                      }
+                      label={`Trigger: ${triggerDescription}`}
                       onAddAfter={(action) => insertStep(0, action)}
                       onClick={() => selectNode({ type: "trigger" })}
                       selected={selectedNode?.type === "trigger"}
@@ -649,16 +688,39 @@ export const WorkflowFormBuilder = React.forwardRef<
                     />
 
                     {formState.steps.map((step, index) => {
-                      const stepName = step.name?.trim();
                       const actionLabel = ACTION_LABELS[step.action];
-                      const nodeTitle = stepName || actionLabel;
+                      const channelLabel = step.channel
+                        ? channels.find(
+                            (channel) => channel.id === step.channel,
+                          )?.name
+                        : undefined;
+                      const nodeDescription = workflowStepDescription(step, {
+                        channelLabel,
+                      });
+                      const stepEmoji =
+                        step.action === "add_reaction"
+                          ? step.emoji?.trim()
+                          : undefined;
+                      const visibleNodeDescription = stepEmoji
+                        ? actionLabel
+                        : nodeDescription;
+                      const showActionSubtitle =
+                        !stepEmoji && nodeDescription !== actionLabel;
                       return (
                         <WorkflowNode
-                          description={nodeTitle}
+                          description={visibleNodeDescription}
                           disabled={disabled}
+                          icon={
+                            stepEmoji ? (
+                              <StatusEmoji
+                                className="h-6 w-6 text-xl"
+                                value={stepEmoji}
+                              />
+                            ) : undefined
+                          }
                           key={step.id}
-                          label={`Step ${index + 1}: ${nodeTitle}`}
-                          number={index + 1}
+                          label={`Step ${index + 1}: ${nodeDescription}`}
+                          number={stepEmoji ? undefined : index + 1}
                           onAddAfter={(action) => insertStep(index + 1, action)}
                           onClick={() =>
                             selectNode({ type: "step", stepId: step.id })
@@ -669,7 +731,9 @@ export const WorkflowFormBuilder = React.forwardRef<
                             selectedNode.stepId === step.id
                           }
                           showTitle={false}
-                          subtitle={stepName ? actionLabel : undefined}
+                          subtitle={
+                            showActionSubtitle ? actionLabel : undefined
+                          }
                           terminal={index === formState.steps.length - 1}
                           title={`Step ${index + 1}`}
                         />
@@ -746,6 +810,7 @@ export const WorkflowFormBuilder = React.forwardRef<
                                 disabled={disabled}
                                 labels={TRIGGER_LABELS}
                                 onChange={(triggerType) => {
+                                  setTriggerConditionDrafts(null);
                                   const next = withTriggerType(
                                     formState,
                                     triggerType,
@@ -842,7 +907,11 @@ export const WorkflowFormBuilder = React.forwardRef<
                               {selectedNode.type === "trigger" ? (
                                 <div>
                                   <TriggerConfigFields
+                                    conditionDrafts={triggerConditionDrafts}
                                     disabled={disabled}
+                                    onConditionDraftsChange={
+                                      setTriggerConditionDrafts
+                                    }
                                     onUpdate={(trigger) =>
                                       updateFormState({ ...formState, trigger })
                                     }
@@ -858,6 +927,10 @@ export const WorkflowFormBuilder = React.forwardRef<
                                   onUpdate={(updated) =>
                                     updateStep(selectedStepIndex, updated)
                                   }
+                                  previousSteps={formState.steps.slice(
+                                    0,
+                                    selectedStepIndex,
+                                  )}
                                   showHeader={false}
                                   step={selectedStep}
                                   triggerType={formState.trigger.on}
diff --git a/desktop/src/features/workflows/ui/WorkflowStepCard.tsx b/desktop/src/features/workflows/ui/WorkflowStepCard.tsx
index 20c6d4dad33..539edf2ba93 100644
--- a/desktop/src/features/workflows/ui/WorkflowStepCard.tsx
+++ b/desktop/src/features/workflows/ui/WorkflowStepCard.tsx
@@ -6,6 +6,7 @@ import { Button } from "@/shared/ui/button";
 import { Checkbox } from "@/shared/ui/checkbox";
 import { Input } from "@/shared/ui/input";
 import { Textarea } from "@/shared/ui/textarea";
+import { WorkflowTemplateTextarea } from "./WorkflowTemplateTextarea";
 import { WorkflowDurationField } from "./WorkflowDurationField";
 import { WorkflowMessageTextCondition } from "./WorkflowMessageTextConditionEditor";
 import { FieldLabel, FormSelect } from "./workflowFormPrimitives";
@@ -109,6 +110,7 @@ function StepConfigFields({
   step,
   prefix,
   disabled,
+  previousSteps,
   triggerType,
   workflowChannelId,
   onUpdate,
@@ -116,6 +118,7 @@ function StepConfigFields({
   step: StepFormState;
   prefix: string;
   disabled?: boolean;
+  previousSteps: StepFormState[];
   triggerType: TriggerType;
   workflowChannelId?: string | null;
   onUpdate: (step: StepFormState) => void;
@@ -142,15 +145,15 @@ function StepConfigFields({
         <div className="space-y-2">
           <div className="space-y-1.5">
             <FieldLabel htmlFor={`${prefix}-text`}>Message text</FieldLabel>
-            <Textarea
+            <WorkflowTemplateTextarea
               autoCapitalize="off"
               className="min-h-[60px] resize-y text-xs"
               disabled={disabled}
               id={`${prefix}-text`}
-              onChange={(event) =>
-                onUpdate({ ...step, text: event.target.value })
-              }
+              onValueChange={(text) => onUpdate({ ...step, text })}
               placeholder="e.g. Deployment started by {{trigger.author}}"
+              previousSteps={previousSteps}
+              triggerType={triggerType}
               value={step.text ?? ""}
             />
           </div>
@@ -390,6 +393,7 @@ export function WorkflowStepCard({
   onRemove,
   onUpdate,
   step,
+  previousSteps = [],
   triggerType,
   workflowChannelId,
 }: {
@@ -400,6 +404,7 @@ export function WorkflowStepCard({
   onRemove: () => void;
   onUpdate: (step: StepFormState) => void;
   step: StepFormState;
+  previousSteps?: StepFormState[];
   triggerType: TriggerType;
   workflowChannelId?: string | null;
 }) {
@@ -443,6 +448,7 @@ export function WorkflowStepCard({
           disabled={disabled}
           onUpdate={onUpdate}
           prefix={prefix}
+          previousSteps={previousSteps}
           step={step}
           triggerType={triggerType}
           workflowChannelId={workflowChannelId}
diff --git a/desktop/src/features/workflows/ui/WorkflowTemplateTextarea.tsx b/desktop/src/features/workflows/ui/WorkflowTemplateTextarea.tsx
new file mode 100644
index 00000000000..7abf8e98e12
--- /dev/null
+++ b/desktop/src/features/workflows/ui/WorkflowTemplateTextarea.tsx
@@ -0,0 +1,188 @@
+import * as React from "react";
+
+import { cn } from "@/shared/lib/cn";
+import { Popover, PopoverAnchor, PopoverContent } from "@/shared/ui/popover";
+import { Textarea } from "@/shared/ui/textarea";
+import type { StepFormState, TriggerType } from "./workflowFormTypes";
+import {
+  activeTemplateToken,
+  insertTemplateVariable,
+  workflowTemplateVariables,
+} from "./workflowTemplateVariables";
+import type {
+  ActiveTemplateToken,
+  WorkflowTemplateVariable,
+} from "./workflowTemplateVariables";
+
+export function WorkflowTemplateTextarea({
+  className,
+  disabled,
+  onValueChange,
+  previousSteps,
+  triggerType,
+  value,
+  ...props
+}: Omit<React.ComponentProps<typeof Textarea>, "onChange" | "value"> & {
+  onValueChange: (value: string) => void;
+  previousSteps: StepFormState[];
+  triggerType: TriggerType;
+  value: string;
+}) {
+  const textareaRef = React.useRef<HTMLTextAreaElement>(null);
+  const generatedId = React.useId();
+  const textareaId = props.id ?? `workflow-template-${generatedId}`;
+  const listboxId = `${textareaId}-variables`;
+  const [token, setToken] = React.useState<ActiveTemplateToken | null>(null);
+  const [selectedIndex, setSelectedIndex] = React.useState(0);
+  const variables = React.useMemo(
+    () => workflowTemplateVariables(triggerType, previousSteps),
+    [previousSteps, triggerType],
+  );
+  const suggestions = React.useMemo(() => {
+    if (!token) return [];
+    const query = token.query.toLowerCase();
+    return variables.filter(
+      (variable) =>
+        variable.value.toLowerCase().includes(query) ||
+        variable.description.toLowerCase().includes(query),
+    );
+  }, [token, variables]);
+  const open = token !== null;
+  const selectedOptionId = suggestions[selectedIndex]
+    ? `${listboxId}-option-${selectedIndex}`
+    : undefined;
+
+  const updateToken = React.useCallback((nextValue: string, caret: number) => {
+    setToken(activeTemplateToken(nextValue, caret));
+    setSelectedIndex(0);
+  }, []);
+
+  const selectVariable = React.useCallback(
+    (variable: WorkflowTemplateVariable) => {
+      if (!token) return;
+      const next = insertTemplateVariable(value, token, variable.value);
+      onValueChange(next.value);
+      setToken(null);
+      requestAnimationFrame(() => {
+        const textarea = textareaRef.current;
+        textarea?.focus();
+        textarea?.setSelectionRange(next.caret, next.caret);
+      });
+    },
+    [onValueChange, token, value],
+  );
+
+  return (
+    <Popover
+      open={open}
+      onOpenChange={(nextOpen) => {
+        if (!nextOpen) setToken(null);
+      }}
+    >
+      <PopoverAnchor asChild>
+        <Textarea
+          {...props}
+          aria-activedescendant={open ? selectedOptionId : undefined}
+          aria-autocomplete="list"
+          aria-controls={open ? listboxId : undefined}
+          aria-expanded={open}
+          aria-haspopup="listbox"
+          className={className}
+          disabled={disabled}
+          id={textareaId}
+          onChange={(event) => {
+            const nextValue = event.target.value;
+            onValueChange(nextValue);
+            updateToken(nextValue, event.target.selectionStart);
+          }}
+          onClick={(event) =>
+            updateToken(
+              event.currentTarget.value,
+              event.currentTarget.selectionStart,
+            )
+          }
+          onKeyDown={(event) => {
+            if (!open) return;
+            if (event.key === "Escape") {
+              event.preventDefault();
+              setToken(null);
+              return;
+            }
+            if (suggestions.length === 0) return;
+            if (event.key === "ArrowDown" || event.key === "ArrowUp") {
+              event.preventDefault();
+              const direction = event.key === "ArrowDown" ? 1 : -1;
+              setSelectedIndex(
+                (current) =>
+                  (current + direction + suggestions.length) %
+                  suggestions.length,
+              );
+              return;
+            }
+            if (event.key === "Enter" || event.key === "Tab") {
+              event.preventDefault();
+              selectVariable(suggestions[selectedIndex] ?? suggestions[0]);
+            }
+          }}
+          ref={textareaRef}
+          value={value}
+        />
+      </PopoverAnchor>
+      <PopoverContent
+        align="start"
+        className="w-[var(--radix-popover-trigger-width)] min-w-72 p-1.5"
+        onOpenAutoFocus={(event) => event.preventDefault()}
+        side="bottom"
+        sideOffset={6}
+      >
+        <div className="max-h-72 overflow-y-auto" id={listboxId} role="listbox">
+          {suggestions.length > 0 ? (
+            suggestions.map((variable, index) => {
+              const previousGroup = suggestions[index - 1]?.group;
+              return (
+                <React.Fragment key={variable.value}>
+                  {variable.group !== previousGroup ? (
+                    <p className="px-2 pb-1 pt-1.5 text-2xs font-semibold uppercase tracking-wide text-muted-foreground">
+                      {variable.group}
+                    </p>
+                  ) : null}
+                  <button
+                    aria-selected={index === selectedIndex}
+                    className={cn(
+                      "flex w-full items-center justify-between gap-3 rounded-md px-2 py-1.5 text-left",
+                      index === selectedIndex
+                        ? "bg-muted text-foreground"
+                        : "text-foreground hover:bg-muted/60",
+                    )}
+                    id={`${listboxId}-option-${index}`}
+                    onMouseDown={(event) => event.preventDefault()}
+                    onMouseEnter={() => setSelectedIndex(index)}
+                    onClick={() => selectVariable(variable)}
+                    role="option"
+                    type="button"
+                  >
+                    <code className="min-w-0 truncate text-xs">
+                      {`{{${variable.value}}}`}
+                    </code>
+                    <span className="shrink-0 text-2xs text-muted-foreground">
+                      {variable.description}
+                    </span>
+                  </button>
+                </React.Fragment>
+              );
+            })
+          ) : (
+            <p className="px-2 py-2 text-xs text-muted-foreground">
+              No matching variables
+            </p>
+          )}
+        </div>
+        {triggerType === "webhook" ? (
+          <p className="border-t border-border/50 px-2 pb-1 pt-2 text-2xs text-muted-foreground">
+            JSON fields are available as {"{{trigger.field_name}}"}.
+          </p>
+        ) : null}
+      </PopoverContent>
+    </Popover>
+  );
+}
diff --git a/desktop/src/features/workflows/ui/WorkflowTriggerConditions.tsx b/desktop/src/features/workflows/ui/WorkflowTriggerConditions.tsx
new file mode 100644
index 00000000000..39caec253a5
--- /dev/null
+++ b/desktop/src/features/workflows/ui/WorkflowTriggerConditions.tsx
@@ -0,0 +1,327 @@
+import { ChevronRight } from "lucide-react";
+import * as React from "react";
+
+import { cn } from "@/shared/lib/cn";
+import { Input } from "@/shared/ui/input";
+import { Tabs, TabsList, TabsTrigger } from "@/shared/ui/tabs";
+import { WorkflowEmojiField } from "./WorkflowEmojiField";
+import { FieldLabel } from "./workflowFormPrimitives";
+import {
+  buildConditionExpressions,
+  conditionFieldsForTrigger,
+  conditionOperatorNeedsValue,
+  conditionOperatorsForField,
+  conditionValueError,
+  parseConditionExpressions,
+  type ConditionOperator,
+  type ParsedConditionExpression,
+} from "./workflowConditionExpression";
+import type { TriggerType } from "./workflowFormTypes";
+
+const OPERATOR_LABELS: Record<ConditionOperator, string> = {
+  contains: "contains",
+  not_contains: "does not contain",
+  starts_with: "starts with",
+  ends_with: "ends with",
+  equals: "is",
+  not_equals: "is not",
+  is_not_empty: "is not empty",
+  is_empty: "is empty",
+};
+
+function emptyCondition(field: string): ParsedConditionExpression {
+  return {
+    field,
+    operator: conditionOperatorsForField(field)[0],
+    value: "",
+    webhookField: "",
+  };
+}
+
+function compact(value: string): string {
+  const trimmed = value.trim();
+  return trimmed.length <= 20
+    ? trimmed
+    : `${trimmed.slice(0, 11)}…${trimmed.slice(-6)}`;
+}
+
+function fieldPlaceholder(field: string): string {
+  if (field === "trigger_author") return "64-character hex pubkey";
+  if (field === "trigger_message_id") return "64-character hex event ID";
+  return "e.g. deploy";
+}
+
+export function WorkflowTriggerConditions({
+  conditionDrafts,
+  disabled,
+  onChange,
+  onConditionDraftsChange,
+  triggerType,
+  value,
+}: {
+  conditionDrafts: ParsedConditionExpression[] | null;
+  disabled?: boolean;
+  onChange: (value: string) => void;
+  onConditionDraftsChange: (drafts: ParsedConditionExpression[] | null) => void;
+  triggerType: Extract<
+    TriggerType,
+    "message_posted" | "diff_posted" | "reaction_added"
+  >;
+  value: string;
+}) {
+  const parsedValue = React.useMemo(
+    () => parseConditionExpressions(value, triggerType),
+    [triggerType, value],
+  );
+  const [mode, setMode] = React.useState<"basic" | "advanced">(() =>
+    value && parsedValue === null ? "advanced" : "basic",
+  );
+  const [expandedField, setExpandedField] = React.useState<string | null>(
+    () => conditionFieldsForTrigger(triggerType)[0]?.value ?? null,
+  );
+  const conditions = conditionDrafts ?? parsedValue ?? [];
+  const localValue = React.useRef(value);
+
+  React.useEffect(() => {
+    if (value === localValue.current) return;
+    localValue.current = value;
+    const parsed = parseConditionExpressions(value, triggerType);
+    if (parsed) {
+      onConditionDraftsChange(null);
+      setMode("basic");
+    } else if (value) {
+      setMode("advanced");
+    }
+  }, [onConditionDraftsChange, triggerType, value]);
+
+  const updateConditions = (next: ParsedConditionExpression[]) => {
+    onConditionDraftsChange(next);
+    if (
+      next.some((condition) =>
+        conditionValueError(condition.field, condition.value),
+      )
+    ) {
+      return;
+    }
+    const expression = buildConditionExpressions(next);
+    localValue.current = expression;
+    onChange(expression);
+  };
+
+  const fields = conditionFieldsForTrigger(triggerType);
+
+  return (
+    <Tabs
+      className="space-y-3"
+      onValueChange={(next) => setMode(next as "basic" | "advanced")}
+      value={mode}
+    >
+      <TabsList
+        aria-label="Condition editor mode"
+        className="grid h-9 w-full grid-cols-2 p-0.5"
+      >
+        <TabsTrigger className="h-8" disabled={disabled} value="basic">
+          Basic
+        </TabsTrigger>
+        <TabsTrigger className="h-8" disabled={disabled} value="advanced">
+          Advanced
+        </TabsTrigger>
+      </TabsList>
+
+      {mode === "advanced" ? (
+        <div className="space-y-2">
+          <Input
+            aria-label="Advanced expression"
+            autoCapitalize="off"
+            autoCorrect="off"
+            disabled={disabled}
+            onChange={(event) => {
+              onConditionDraftsChange(null);
+              localValue.current = event.target.value;
+              onChange(event.target.value.trim());
+            }}
+            placeholder='e.g. trigger_author == "…"'
+            value={value}
+          />
+          <p className="text-xs text-muted-foreground">
+            Use an evalexpr expression. Existing custom expressions stay
+            unchanged.
+          </p>
+        </div>
+      ) : parsedValue === null && value.trim() ? (
+        <div className="space-y-3 rounded-md border border-border/70 p-3">
+          <p className="text-xs text-muted-foreground">
+            An advanced expression is active. Replacing it with basic filters
+            cannot be undone.
+          </p>
+          <button
+            className="text-sm font-medium text-destructive hover:underline"
+            disabled={disabled}
+            onClick={() => {
+              onConditionDraftsChange(null);
+              localValue.current = "";
+              onChange("");
+            }}
+            type="button"
+          >
+            Replace with basic filters
+          </button>
+        </div>
+      ) : (
+        <div className="divide-y divide-border/50">
+          {fields.map((field) => {
+            const existing = conditions.find(
+              (condition) => condition.field === field.value,
+            );
+            const condition = existing ?? emptyCondition(field.value);
+            const expanded = expandedField === field.value;
+            const error = conditionValueError(field.value, condition.value);
+            const summary = existing
+              ? `${OPERATOR_LABELS[condition.operator]}${condition.value ? ` ${compact(condition.value)}` : ""}`
+              : "Any";
+            return (
+              <div className={cn(expanded && "pb-4")} key={field.value}>
+                <button
+                  aria-expanded={expanded}
+                  className="flex min-h-12 w-full items-center gap-3 py-3 text-left transition-colors hover:text-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-ring disabled:opacity-50"
+                  disabled={disabled}
+                  onClick={() =>
+                    setExpandedField(expanded ? null : field.value)
+                  }
+                  type="button"
+                >
+                  <span className="min-w-0 flex-1 truncate text-base font-medium">
+                    {field.label}
+                  </span>
+                  <span className="max-w-44 truncate font-mono text-xs text-muted-foreground">
+                    {summary}
+                  </span>
+                  <ChevronRight
+                    className={cn(
+                      "h-4 w-4 shrink-0 text-muted-foreground/70 transition-transform duration-150 motion-reduce:transition-none",
+                      expanded && "rotate-90",
+                    )}
+                  />
+                </button>
+                {expanded ? (
+                  <div className="animate-in space-y-3 pt-1 fade-in slide-in-from-top-1 duration-150 motion-reduce:animate-none">
+                    <fieldset>
+                      <legend className="sr-only">Match</legend>
+                      <div className="grid grid-cols-2 gap-2.5">
+                        {conditionOperatorsForField(field.value).map(
+                          (operator) => {
+                            const selected = condition.operator === operator;
+                            return (
+                              <button
+                                aria-pressed={selected}
+                                className={cn(
+                                  "flex min-h-12 items-center justify-center rounded-lg border px-3 py-2 text-center text-sm font-medium",
+                                  "outline-2 outline-offset-2 outline-transparent transition-[background-color,border-color,color,outline-color] focus-visible:ring-2 focus-visible:ring-ring disabled:cursor-not-allowed disabled:opacity-50",
+                                  selected
+                                    ? "border-border/0 bg-transparent text-foreground outline-foreground/45"
+                                    : "border-border/70 bg-background/35 text-muted-foreground hover:border-border hover:bg-muted/55 hover:text-foreground hover:outline-muted-foreground/20",
+                                )}
+                                disabled={disabled}
+                                key={operator}
+                                onClick={() => {
+                                  const next = { ...condition, operator };
+                                  updateConditions([
+                                    ...conditions.filter(
+                                      (item) => item.field !== field.value,
+                                    ),
+                                    next,
+                                  ]);
+                                }}
+                                type="button"
+                              >
+                                {OPERATOR_LABELS[operator]}
+                              </button>
+                            );
+                          },
+                        )}
+                      </div>
+                    </fieldset>
+                    {conditionOperatorNeedsValue(condition.operator) ? (
+                      field.value === "trigger_emoji" ? (
+                        <WorkflowEmojiField
+                          ariaLabel="Choose trigger emoji"
+                          clearAriaLabel="Clear trigger emoji"
+                          disabled={disabled}
+                          id="wf-trigger-emoji"
+                          onChange={(emoji) =>
+                            updateConditions([
+                              ...conditions.filter(
+                                (item) => item.field !== field.value,
+                              ),
+                              { ...condition, value: emoji ?? "" },
+                            ])
+                          }
+                          value={condition.value}
+                        />
+                      ) : (
+                        <div className="space-y-1.5">
+                          <FieldLabel
+                            htmlFor={`wf-trigger-${field.value}-value`}
+                          >
+                            {field.label}
+                          </FieldLabel>
+                          <Input
+                            aria-describedby={
+                              error
+                                ? `wf-trigger-${field.value}-error`
+                                : undefined
+                            }
+                            aria-invalid={error ? true : undefined}
+                            autoCapitalize="off"
+                            autoCorrect="off"
+                            disabled={disabled}
+                            id={`wf-trigger-${field.value}-value`}
+                            onChange={(event) =>
+                              updateConditions([
+                                ...conditions.filter(
+                                  (item) => item.field !== field.value,
+                                ),
+                                { ...condition, value: event.target.value },
+                              ])
+                            }
+                            placeholder={fieldPlaceholder(field.value)}
+                            spellCheck={field.value === "trigger_text"}
+                            value={condition.value}
+                          />
+                          {error ? (
+                            <p
+                              className="text-xs text-destructive"
+                              id={`wf-trigger-${field.value}-error`}
+                            >
+                              {error}
+                            </p>
+                          ) : null}
+                        </div>
+                      )
+                    ) : null}
+                    {existing ? (
+                      <button
+                        className="text-xs font-medium text-muted-foreground hover:text-foreground"
+                        disabled={disabled}
+                        onClick={() =>
+                          updateConditions(
+                            conditions.filter(
+                              (item) => item.field !== field.value,
+                            ),
+                          )
+                        }
+                        type="button"
+                      >
+                        Clear filter
+                      </button>
+                    ) : null}
+                  </div>
+                ) : null}
+              </div>
+            );
+          })}
+        </div>
+      )}
+    </Tabs>
+  );
+}
diff --git a/desktop/src/features/workflows/ui/WorkflowsView.tsx b/desktop/src/features/workflows/ui/WorkflowsView.tsx
index f0dfb1b7dd0..ba4cdf0baec 100644
--- a/desktop/src/features/workflows/ui/WorkflowsView.tsx
+++ b/desktop/src/features/workflows/ui/WorkflowsView.tsx
@@ -9,6 +9,7 @@ import {
   workflowListFocusRefetchPolicy,
   workflowQueryKey,
 } from "@/features/workflows/hooks";
+import { getWorkflowActivationWarning } from "@/features/workflows/ui/workflowActivationWarning";
 import { WorkflowCard } from "@/features/workflows/ui/WorkflowCard";
 import { WorkflowDeleteDialog } from "@/features/workflows/ui/WorkflowDeleteDialog";
 import { WorkflowEditorHost } from "@/features/workflows/ui/WorkflowEditorHost";
@@ -25,6 +26,16 @@ import {
   triggerWorkflow,
   updateWorkflow,
 } from "@/shared/api/tauriWorkflows";
+import {
+  AlertDialog,
+  AlertDialogAction,
+  AlertDialogCancel,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogFooter,
+  AlertDialogHeader,
+  AlertDialogTitle,
+} from "@/shared/ui/alert-dialog";
 import { Button } from "@/shared/ui/button";
 import { PageHeader } from "@/shared/ui/PageHeader";
 import { Skeleton } from "@/shared/ui/skeleton";
@@ -99,6 +110,8 @@ export function WorkflowsView({
   onEditorPaneChange,
 }: WorkflowsViewProps) {
   const [deleteTarget, setDeleteTarget] = React.useState<Workflow | null>(null);
+  const [activationTarget, setActivationTarget] =
+    React.useState<Workflow | null>(null);
   const queryClient = useQueryClient();
 
   const editorWorkflowId =
@@ -175,6 +188,7 @@ export function WorkflowsView({
       });
     },
     onSuccess: (_data, workflow) => {
+      setActivationTarget(null);
       void queryClient.invalidateQueries({
         queryKey: workflowQueryKey(workflow.id),
       });
@@ -230,9 +244,21 @@ export function WorkflowsView({
 
   const toggleEnabled = toggleEnabledMutation.mutate;
   const handleToggleEnabled = React.useCallback(
-    (workflow: Workflow) => toggleEnabled(workflow),
+    (workflow: Workflow) => {
+      if (
+        !getWorkflowEnabled(workflow.definition) &&
+        getWorkflowActivationWarning(yamlStringify(workflow.definition))
+      ) {
+        setActivationTarget(workflow);
+        return;
+      }
+      toggleEnabled(workflow);
+    },
     [toggleEnabled],
   );
+  const activationWarning = activationTarget
+    ? getWorkflowActivationWarning(yamlStringify(activationTarget.definition))
+    : null;
 
   const editorWorkflowHint = allWorkflows.find(
     ({ workflow }) => workflow.id === editorWorkflowId,
@@ -316,6 +342,40 @@ export function WorkflowsView({
         workflowHint={editorWorkflowHint}
       />
 
+      <AlertDialog
+        onOpenChange={(open) => {
+          if (!open && !toggleEnabledMutation.isPending) {
+            setActivationTarget(null);
+          }
+        }}
+        open={activationTarget !== null}
+      >
+        <AlertDialogContent data-testid="workflow-activation-confirmation">
+          <AlertDialogHeader>
+            <AlertDialogTitle>
+              {activationWarning?.title ?? "Turn on this workflow?"}
+            </AlertDialogTitle>
+            <AlertDialogDescription>
+              {activationWarning?.description ??
+                "Turn it on to let it run immediately, or keep it off until you’re ready."}
+            </AlertDialogDescription>
+          </AlertDialogHeader>
+          <AlertDialogFooter>
+            <AlertDialogCancel>Keep off</AlertDialogCancel>
+            <AlertDialogAction
+              disabled={toggleEnabledMutation.isPending}
+              onClick={(event) => {
+                if (!activationTarget) return;
+                event.preventDefault();
+                toggleEnabled(activationTarget);
+              }}
+            >
+              Turn on
+            </AlertDialogAction>
+          </AlertDialogFooter>
+        </AlertDialogContent>
+      </AlertDialog>
+
       <WorkflowDeleteDialog
         error={
           deleteMutation.error instanceof Error
diff --git a/desktop/src/features/workflows/ui/workflowActivationWarning.test.mjs b/desktop/src/features/workflows/ui/workflowActivationWarning.test.mjs
new file mode 100644
index 00000000000..dcd6155c44b
--- /dev/null
+++ b/desktop/src/features/workflows/ui/workflowActivationWarning.test.mjs
@@ -0,0 +1,107 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import { getWorkflowActivationWarning } from "./workflowActivationWarning.ts";
+
+function workflowYaml(trigger) {
+  return `name: Test\ntrigger:\n${trigger}\nsteps:\n  - id: notify\n    action: send_message\n    text: Hi\n`;
+}
+
+test("warns when a message trigger matches every message", () => {
+  assert.deepEqual(
+    getWorkflowActivationWarning(workflowYaml("  on: message_posted")),
+    {
+      description:
+        "It will run for every new message in this channel. Review the trigger before turning it on.",
+      title: "This workflow may run often",
+    },
+  );
+});
+
+test("does not warn when a message trigger is narrowed", () => {
+  assert.equal(
+    getWorkflowActivationWarning(
+      workflowYaml('  on: message_posted\n  filter: text == "deploy"'),
+    ),
+    null,
+  );
+});
+
+test("warns for hourly-or-faster interval schedules with concrete copy", () => {
+  assert.equal(
+    getWorkflowActivationWarning(
+      workflowYaml("  on: schedule\n  interval: 15m"),
+    )?.description,
+    "It is scheduled to run every 15 minutes. Review the schedule before turning it on.",
+  );
+  assert.equal(
+    getWorkflowActivationWarning(
+      workflowYaml("  on: schedule\n  interval: 2h"),
+    ),
+    null,
+  );
+});
+
+test("warns for clear hourly-or-faster cron schedules", () => {
+  for (const cron of ["*/5 * * * *", "0 */5 * * * *", "0 */5 * * * * *"]) {
+    assert.equal(
+      getWorkflowActivationWarning(
+        workflowYaml(`  on: schedule\n  cron: "${cron}"`),
+      )?.description,
+      "It is scheduled to run every 5 minutes. Review the schedule before turning it on.",
+    );
+  }
+  assert.equal(
+    getWorkflowActivationWarning(
+      workflowYaml('  on: schedule\n  cron: "*/10 * * * * *"'),
+    )?.description,
+    "It is scheduled to run multiple times a minute. Review the schedule before turning it on.",
+  );
+  assert.equal(
+    getWorkflowActivationWarning(
+      workflowYaml('  on: schedule\n  cron: "0 9 * * *"'),
+    ),
+    null,
+  );
+});
+
+test("warns for stepped, ranged, and listed hourly cron schedules", () => {
+  for (const cron of [
+    "0 0 */1 * * *",
+    "0 0 * * * *",
+    "0 0 0-23 * * *",
+    "0 0 0-11,12-23 * * *",
+    "0 0 */1 * * * *",
+  ]) {
+    assert.equal(
+      getWorkflowActivationWarning(
+        workflowYaml(`  on: schedule\n  cron: "${cron}"`),
+      )?.description,
+      "It is scheduled to run every hour. Review the schedule before turning it on.",
+      cron,
+    );
+  }
+  assert.equal(
+    getWorkflowActivationWarning(
+      workflowYaml('  on: schedule\n  cron: "*/5 0-23 * * *"'),
+    )?.description,
+    "It is scheduled to run every 5 minutes. Review the schedule before turning it on.",
+  );
+  for (const cron of ["0 */3 * * *", "0 0 0,12 * * *", "0 0 8-17 * * *"]) {
+    assert.equal(
+      getWorkflowActivationWarning(
+        workflowYaml(`  on: schedule\n  cron: "${cron}"`),
+      ),
+      null,
+      cron,
+    );
+  }
+});
+
+test("returns no warning for malformed or unrelated definitions", () => {
+  assert.equal(getWorkflowActivationWarning("not: [valid"), null);
+  assert.equal(
+    getWorkflowActivationWarning(workflowYaml("  on: reaction_added")),
+    null,
+  );
+});
diff --git a/desktop/src/features/workflows/ui/workflowActivationWarning.ts b/desktop/src/features/workflows/ui/workflowActivationWarning.ts
new file mode 100644
index 00000000000..ff1cd971fbe
--- /dev/null
+++ b/desktop/src/features/workflows/ui/workflowActivationWarning.ts
@@ -0,0 +1,160 @@
+import { parse as yamlParse } from "yaml";
+
+import {
+  formatDurationSecondsVerbose,
+  parseDurationSeconds,
+} from "./workflowDuration";
+
+type WorkflowActivationWarning = {
+  description: string;
+  title: string;
+};
+
+const FREQUENT_SCHEDULE_THRESHOLD_SECONDS = 60 * 60;
+
+function asRecord(value: unknown): Record<string, unknown> | null {
+  return value !== null && typeof value === "object" && !Array.isArray(value)
+    ? (value as Record<string, unknown>)
+    : null;
+}
+
+function nonEmptyString(value: unknown): string | null {
+  return typeof value === "string" && value.trim() ? value.trim() : null;
+}
+
+function frequentIntervalDescription(interval: string): string | null {
+  const seconds = parseDurationSeconds(interval);
+  if (
+    seconds === null ||
+    seconds <= 0 ||
+    seconds > FREQUENT_SCHEDULE_THRESHOLD_SECONDS
+  ) {
+    return null;
+  }
+  return `It is scheduled to run every ${formatDurationSecondsVerbose(seconds)}. Review the schedule before turning it on.`;
+}
+
+function normalizedCronFields(cron: string): string[] | null {
+  const fields = cron.trim().split(/\s+/);
+  if (fields.length === 5) return ["0", ...fields, "*"];
+  if (fields.length === 6) return [...fields, "*"];
+  return fields.length === 7 ? fields : null;
+}
+
+function repeatedFieldCount(field: string, maximum: number): number | null {
+  if (field === "*") return maximum + 1;
+  const step = /^\*\/(\d+)$/.exec(field);
+  if (step) {
+    const size = Number(step[1]);
+    return size >= 1 && size <= maximum + 1
+      ? Math.ceil((maximum + 1) / size)
+      : null;
+  }
+  if (field.includes(",") || field.includes("-")) return 2;
+  return /^\d+$/.test(field) ? 1 : null;
+}
+
+/**
+ * Reports whether an hour field selects every hour of the day, so schedules
+ * written as `*`, `*\/1`, `0-23`, or an equivalent list still classify as
+ * hourly. Unrecognized fields are treated as not matching every hour.
+ */
+function matchesEveryHour(field: string): boolean {
+  const HOURS = 24;
+  const selected = new Set<number>();
+  for (const segment of field.split(",")) {
+    const [base, step] = segment.split("/");
+    if (step !== undefined && (!/^\d+$/.test(step) || Number(step) < 1)) {
+      return false;
+    }
+    const size = step === undefined ? 1 : Number(step);
+    let start: number, end: number;
+    if (base === "*") {
+      start = 0;
+      end = HOURS - 1;
+    } else {
+      const bounds = base.split("-");
+      if (bounds.length > 2 || bounds.some((part) => !/^\d+$/.test(part))) {
+        return false;
+      }
+      start = Number(bounds[0]);
+      end = bounds.length === 2 ? Number(bounds[1]) : start;
+      if (start > end || end >= HOURS) return false;
+      // A bare hour selects only itself; a stepped one runs to end of day.
+      if (bounds.length === 1) {
+        if (step === undefined) {
+          selected.add(start);
+          continue;
+        }
+        end = HOURS - 1;
+      }
+    }
+    for (let hour = start; hour <= end; hour += size) selected.add(hour);
+  }
+  return selected.size === HOURS;
+}
+
+function frequentCronDescription(cron: string): string | null {
+  const fields = normalizedCronFields(cron);
+  if (!fields) return null;
+  const [second, minute, hour] = fields;
+  const secondRuns = repeatedFieldCount(second, 59);
+  const minuteRuns = repeatedFieldCount(minute, 59);
+  if (secondRuns === null || minuteRuns === null) return null;
+  if (!matchesEveryHour(hour)) return null;
+
+  if (secondRuns > 1) {
+    return "It is scheduled to run multiple times a minute. Review the schedule before turning it on.";
+  }
+  if (minute === "*") {
+    return "It is scheduled to run every minute. Review the schedule before turning it on.";
+  }
+  const steppedMinute = /^\*\/(\d+)$/.exec(minute);
+  if (steppedMinute) {
+    const minutes = Number(steppedMinute[1]);
+    return `It is scheduled to run every ${minutes} minute${minutes === 1 ? "" : "s"}. Review the schedule before turning it on.`;
+  }
+  if (minuteRuns === 1) {
+    return "It is scheduled to run every hour. Review the schedule before turning it on.";
+  }
+  if (minuteRuns > 1) {
+    return "It is scheduled to run multiple times an hour. Review the schedule before turning it on.";
+  }
+  return null;
+}
+
+export function getWorkflowActivationWarning(
+  yaml: string,
+): WorkflowActivationWarning | null {
+  let definition: Record<string, unknown> | null;
+  try {
+    definition = asRecord(yamlParse(yaml));
+  } catch {
+    return null;
+  }
+  const trigger = asRecord(definition?.trigger);
+  const triggerType = nonEmptyString(trigger?.on);
+
+  if (triggerType === "message_posted" && !nonEmptyString(trigger?.filter)) {
+    return {
+      description:
+        "It will run for every new message in this channel. Review the trigger before turning it on.",
+      title: "This workflow may run often",
+    };
+  }
+
+  if (triggerType === "schedule") {
+    const interval = nonEmptyString(trigger?.interval);
+    const cron = nonEmptyString(trigger?.cron);
+    const description = interval
+      ? frequentIntervalDescription(interval)
+      : cron
+        ? frequentCronDescription(cron)
+        : null;
+    if (description) {
+      return { description, title: "This workflow may run often" };
+    }
+  }
+
+  return null;
+}
diff --git a/desktop/src/features/workflows/ui/workflowConditionExpression.test.mjs b/desktop/src/features/workflows/ui/workflowConditionExpression.test.mjs
new file mode 100644
index 00000000000..9f59e8bffed
--- /dev/null
+++ b/desktop/src/features/workflows/ui/workflowConditionExpression.test.mjs
@@ -0,0 +1,171 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+
+import {
+  buildConditionExpression,
+  buildConditionExpressions,
+  conditionFieldsForTrigger,
+  conditionOperatorsForField,
+  conditionValueError,
+  parseConditionExpression,
+  parseConditionExpressions,
+} from "./workflowConditionExpression.ts";
+
+const AUTHOR = "a".repeat(64);
+const MESSAGE_ID = "b".repeat(64);
+
+test("builds and escapes supported text conditions", () => {
+  assert.equal(
+    buildConditionExpression({
+      field: "trigger_text",
+      operator: "contains",
+      value: 'deploy "buzz"\\path',
+      webhookField: "",
+    }),
+    'str_contains(trigger_text, "deploy \\"buzz\\"\\\\path")',
+  );
+});
+
+test("limits opaque identifiers to equality and validates 64-char hex", () => {
+  for (const field of [
+    "trigger_author",
+    "trigger_emoji",
+    "trigger_message_id",
+    "future_id",
+  ]) {
+    assert.deepEqual(conditionOperatorsForField(field), [
+      "equals",
+      "not_equals",
+    ]);
+  }
+  assert.equal(
+    conditionValueError("trigger_author", "abc"),
+    "Enter a 64-character hex pubkey.",
+  );
+  assert.equal(conditionValueError("trigger_author", AUTHOR), null);
+  assert.equal(
+    conditionValueError("trigger_message_id", "z".repeat(64)),
+    "Enter a 64-character hex event ID.",
+  );
+  assert.equal(conditionValueError("trigger_message_id", MESSAGE_ID), null);
+});
+
+test("normalizes generated hex identifiers to lowercase", () => {
+  const uppercaseAuthor = "A".repeat(64);
+  const uppercaseMessageId = "B".repeat(64);
+  assert.equal(
+    buildConditionExpressions([
+      {
+        field: "trigger_author",
+        operator: "equals",
+        value: uppercaseAuthor,
+        webhookField: "",
+      },
+      {
+        field: "trigger_message_id",
+        operator: "not_equals",
+        value: uppercaseMessageId,
+        webhookField: "",
+      },
+    ]),
+    `trigger_author == "${AUTHOR}" && trigger_message_id != "${MESSAGE_ID}"`,
+  );
+});
+
+test("exposes only trigger-relevant local fields", () => {
+  assert.deepEqual(
+    conditionFieldsForTrigger("reaction_added").map(({ value }) => value),
+    ["trigger_emoji", "trigger_author", "trigger_message_id"],
+  );
+  assert.deepEqual(
+    conditionFieldsForTrigger("message_posted").map(({ value }) => value),
+    ["trigger_text", "trigger_author"],
+  );
+  for (const trigger of [
+    "message_posted",
+    "diff_posted",
+    "reaction_added",
+    "webhook",
+    "schedule",
+  ]) {
+    assert.equal(
+      conditionFieldsForTrigger(trigger).some(
+        ({ value }) => value === "trigger_channel_id",
+      ),
+      false,
+    );
+  }
+});
+
+test("round-trips reaction emoji, author, and message ID conjunctions", () => {
+  const conditions = [
+    {
+      field: "trigger_emoji",
+      operator: "equals",
+      value: "👾",
+      webhookField: "",
+    },
+    {
+      field: "trigger_author",
+      operator: "not_equals",
+      value: AUTHOR,
+      webhookField: "",
+    },
+    {
+      field: "trigger_message_id",
+      operator: "equals",
+      value: MESSAGE_ID,
+      webhookField: "",
+    },
+  ];
+  const expression = buildConditionExpressions(conditions);
+  assert.equal(
+    expression,
+    `trigger_emoji == "👾" && trigger_author != "${AUTHOR}" && trigger_message_id == "${MESSAGE_ID}"`,
+  );
+  assert.deepEqual(
+    parseConditionExpressions(expression, "reaction_added"),
+    conditions,
+  );
+});
+
+test("does not split conjunctions inside values and rejects duplicates", () => {
+  const expression = `str_contains(trigger_text, "one && two") && trigger_author == "${AUTHOR}"`;
+  assert.equal(
+    parseConditionExpressions(expression, "message_posted")?.length,
+    2,
+  );
+  assert.equal(
+    parseConditionExpressions(
+      `trigger_author == "${AUTHOR}" && trigger_author != "${MESSAGE_ID}"`,
+      "message_posted",
+    ),
+    null,
+  );
+});
+
+test("keeps unsupported expressions in advanced mode", () => {
+  assert.equal(
+    parseConditionExpression("trigger_timestamp > 0", "message_posted"),
+    null,
+  );
+  assert.equal(
+    parseConditionExpression('trigger_emoji == "👍"', "message_posted"),
+    null,
+  );
+  assert.equal(
+    parseConditionExpression('trigger_author == "abc"', "message_posted"),
+    null,
+  );
+  assert.equal(
+    parseConditionExpression("str_len(trigger_author) == 0", "message_posted"),
+    null,
+  );
+  assert.equal(
+    parseConditionExpression(
+      "str_len(trigger_message_id) > 0",
+      "reaction_added",
+    ),
+    null,
+  );
+});
diff --git a/desktop/src/features/workflows/ui/workflowConditionExpression.ts b/desktop/src/features/workflows/ui/workflowConditionExpression.ts
new file mode 100644
index 00000000000..e44d6a7a165
--- /dev/null
+++ b/desktop/src/features/workflows/ui/workflowConditionExpression.ts
@@ -0,0 +1,276 @@
+import type { TriggerType } from "./workflowFormTypes";
+
+export const CONDITION_OPERATORS = [
+  "contains",
+  "not_contains",
+  "starts_with",
+  "ends_with",
+  "equals",
+  "not_equals",
+  "is_not_empty",
+  "is_empty",
+] as const;
+export type ConditionOperator = (typeof CONDITION_OPERATORS)[number];
+
+const EXACT_MATCH_OPERATORS = [
+  "equals",
+  "not_equals",
+] as const satisfies readonly ConditionOperator[];
+const HEX_ID_PATTERN = /^[0-9a-fA-F]{64}$/;
+
+export type ConditionField = { label: string; value: string };
+export type ParsedConditionExpression = {
+  field: string;
+  operator: ConditionOperator;
+  value: string;
+  webhookField: string;
+};
+
+const AUTHOR_FIELD: ConditionField = {
+  label: "Author pubkey",
+  value: "trigger_author",
+};
+const FIELDS_BY_TRIGGER: Record<TriggerType, ConditionField[]> = {
+  message_posted: [
+    { label: "Message text", value: "trigger_text" },
+    AUTHOR_FIELD,
+  ],
+  diff_posted: [{ label: "Diff text", value: "trigger_text" }, AUTHOR_FIELD],
+  reaction_added: [
+    { label: "Reaction emoji", value: "trigger_emoji" },
+    AUTHOR_FIELD,
+    { label: "Message event ID", value: "trigger_message_id" },
+  ],
+  webhook: [],
+  schedule: [],
+};
+
+export function conditionFieldsForTrigger(
+  triggerType: TriggerType,
+): ConditionField[] {
+  return FIELDS_BY_TRIGGER[triggerType];
+}
+
+export function conditionOperatorsForField(
+  field: string,
+): readonly ConditionOperator[] {
+  return field === "trigger_author" ||
+    field === "trigger_emoji" ||
+    field.endsWith("_id")
+    ? EXACT_MATCH_OPERATORS
+    : CONDITION_OPERATORS;
+}
+
+export function defaultConditionOperatorForField(
+  field: string,
+): ConditionOperator {
+  return conditionOperatorsForField(field)[0];
+}
+
+export function conditionOperatorNeedsValue(
+  operator: ConditionOperator,
+): boolean {
+  return operator !== "is_not_empty" && operator !== "is_empty";
+}
+
+export function conditionValueError(
+  field: string,
+  value: string,
+): string | null {
+  const trimmed = value.trim();
+  if (!trimmed) return null;
+  if (field === "trigger_author" && !HEX_ID_PATTERN.test(trimmed)) {
+    return "Enter a 64-character hex pubkey.";
+  }
+  if (field.endsWith("_id") && !HEX_ID_PATTERN.test(trimmed)) {
+    return "Enter a 64-character hex event ID.";
+  }
+  return null;
+}
+
+function escapeEvalexprString(value: string): string {
+  return value.replaceAll("\\", "\\\\").replaceAll('"', '\\"');
+}
+
+export function buildConditionExpression(
+  condition: ParsedConditionExpression,
+): string | null {
+  const { field, operator } = condition;
+  if (operator === "is_not_empty") return `str_len(${field}) > 0`;
+  if (operator === "is_empty") return `str_len(${field}) == 0`;
+  const value = condition.value.trim();
+  if (!value || conditionValueError(field, value)) return null;
+  const normalizedValue =
+    field === "trigger_author" || field.endsWith("_id")
+      ? value.toLowerCase()
+      : value;
+  const quoted = `"${escapeEvalexprString(normalizedValue)}"`;
+  switch (operator) {
+    case "contains":
+      return `str_contains(${field}, ${quoted})`;
+    case "not_contains":
+      return `!str_contains(${field}, ${quoted})`;
+    case "starts_with":
+      return `str_starts_with(${field}, ${quoted})`;
+    case "ends_with":
+      return `str_ends_with(${field}, ${quoted})`;
+    case "equals":
+      return `${field} == ${quoted}`;
+    case "not_equals":
+      return `${field} != ${quoted}`;
+    default:
+      return null;
+  }
+}
+
+export function buildConditionExpressions(
+  conditions: ParsedConditionExpression[],
+): string {
+  return conditions
+    .map(buildConditionExpression)
+    .filter((value): value is string => value !== null)
+    .join(" && ");
+}
+
+function unescapeEvalexprString(value: string): string {
+  return value.replaceAll(/\\(["\\])/g, "$1");
+}
+
+function parseField(variable: string, triggerType: TriggerType): string | null {
+  return conditionFieldsForTrigger(triggerType).some(
+    (field) => field.value === variable,
+  )
+    ? variable
+    : null;
+}
+
+export function parseConditionExpression(
+  expression: string,
+  triggerType: TriggerType,
+): ParsedConditionExpression | null {
+  const trimmed = expression.trim();
+  const empty = /^str_len\(([A-Za-z_][A-Za-z0-9_]*)\) (>|==) 0$/.exec(trimmed);
+  if (empty && parseField(empty[1], triggerType)) {
+    const operator: ConditionOperator =
+      empty[2] === ">" ? "is_not_empty" : "is_empty";
+    if (!conditionOperatorsForField(empty[1]).includes(operator)) return null;
+    return {
+      field: empty[1],
+      operator,
+      value: "",
+      webhookField: "",
+    };
+  }
+  const literal = '"((?:\\\\["\\\\]|[^"\\\\])*)"';
+  const fn = new RegExp(
+    `^(!)?str_(contains|starts_with|ends_with)\\(([A-Za-z_][A-Za-z0-9_]*), ${literal}\\)$`,
+  ).exec(trimmed);
+  if (fn && parseField(fn[3], triggerType)) {
+    const operator: ConditionOperator = fn[1]
+      ? "not_contains"
+      : fn[2] === "starts_with"
+        ? "starts_with"
+        : fn[2] === "ends_with"
+          ? "ends_with"
+          : "contains";
+    const result = {
+      field: fn[3],
+      operator,
+      value: unescapeEvalexprString(fn[4]),
+      webhookField: "",
+    };
+    return conditionOperatorsForField(result.field).includes(result.operator)
+      ? result
+      : null;
+  }
+  const equality = new RegExp(
+    `^([A-Za-z_][A-Za-z0-9_]*) (!=|==) ${literal}$`,
+  ).exec(trimmed);
+  if (equality && parseField(equality[1], triggerType)) {
+    const result = {
+      field: equality[1],
+      operator:
+        equality[2] === "==" ? ("equals" as const) : ("not_equals" as const),
+      value: unescapeEvalexprString(equality[3]),
+      webhookField: "",
+    };
+    return conditionValueError(result.field, result.value) ? null : result;
+  }
+  return null;
+}
+
+function splitTopLevel(
+  expression: string,
+  operator: "&&" | "||",
+): string[] | null {
+  const parts: string[] = [];
+  let start = 0,
+    depth = 0,
+    inString = false,
+    escaped = false;
+  for (let index = 0; index < expression.length; index += 1) {
+    const character = expression[index];
+    if (inString) {
+      if (escaped) escaped = false;
+      else if (character === "\\") escaped = true;
+      else if (character === '"') inString = false;
+      continue;
+    }
+    if (character === '"') inString = true;
+    else if (character === "(") depth += 1;
+    else if (character === ")") {
+      depth -= 1;
+      if (depth < 0) return null;
+    } else if (
+      character === operator[0] &&
+      expression[index + 1] === operator[1] &&
+      depth === 0
+    ) {
+      const part = expression.slice(start, index).trim();
+      if (!part) return null;
+      parts.push(part);
+      index += 1;
+      start = index + 1;
+    }
+  }
+  if (inString || depth !== 0) return null;
+  const last = expression.slice(start).trim();
+  if (!last) return null;
+  parts.push(last);
+  return parts;
+}
+
+function splitTopLevelConjunctions(expression: string): string[] | null {
+  return splitTopLevel(expression, "&&");
+}
+
+/**
+ * Reports whether `expression` needs parentheses before it can be combined
+ * with `&&`. Conjunction binds tighter than disjunction in evalexpr, so a
+ * top-level `||` would otherwise absorb the added conjunct. Structurally
+ * unparseable expressions are grouped defensively.
+ */
+export function needsConjunctionGrouping(expression: string): boolean {
+  const parts = splitTopLevel(expression, "||");
+  return parts === null || parts.length > 1;
+}
+
+export function parseConditionExpressions(
+  expression: string,
+  triggerType: TriggerType,
+): ParsedConditionExpression[] | null {
+  if (!expression.trim()) return [];
+  const parts = splitTopLevelConjunctions(expression);
+  if (!parts) return null;
+  const parsed = parts.map((part) =>
+    parseConditionExpression(part, triggerType),
+  );
+  if (parsed.some((condition) => condition === null)) return null;
+  const conditions = parsed.filter(
+    (condition): condition is ParsedConditionExpression => condition !== null,
+  );
+  return new Set(conditions.map((condition) => condition.field)).size ===
+    conditions.length
+    ? conditions
+    : null;
+}
diff --git a/desktop/src/features/workflows/ui/workflowDefinition.test.mjs b/desktop/src/features/workflows/ui/workflowDefinition.test.mjs
index 57ced7d9c14..85b9a12d28a 100644
--- a/desktop/src/features/workflows/ui/workflowDefinition.test.mjs
+++ b/desktop/src/features/workflows/ui/workflowDefinition.test.mjs
@@ -2,8 +2,14 @@ import assert from "node:assert/strict";
 import test from "node:test";
 
 import {
+  getWorkflowActionTiles,
+  getWorkflowCardLabel,
   getWorkflowDisplayStatus,
   getWorkflowPrimaryAction,
+  getWorkflowPrimaryActionEmoji,
+  getWorkflowStepCount,
+  getWorkflowTriggerEmoji,
+  getWorkflowTriggerSummary,
   getWorkflowTriggerType,
   withWorkflowEnabled,
 } from "./workflowDefinition.ts";
@@ -23,19 +29,244 @@ test("reads only direct trigger and first-action types for card icons", () => {
   assert.equal(getWorkflowPrimaryAction({ steps: [null] }), null);
 });
 
-test("updates enabled state without mutating the workflow definition", () => {
+test("builds a plain-language workflow card label", () => {
+  assert.equal(
+    getWorkflowCardLabel({
+      trigger: { on: "message_posted" },
+      steps: [{ action: "send_message", text: "Deploying now" }],
+    }),
+    "When a message is posted, send “Deploying now”",
+  );
+
+  assert.equal(
+    getWorkflowCardLabel({
+      trigger: { on: "reaction_added", emoji: "🔥" },
+      steps: [
+        { action: "delay", duration: "5m" },
+        { action: "add_reaction", emoji: "✅" },
+      ],
+    }),
+    "When someone reacts with 🔥, wait 5 minutes, then 1 more step",
+  );
+
+  assert.equal(
+    getWorkflowCardLabel(
+      {
+        trigger: {
+          on: "reaction_added",
+          filter: 'trigger_emoji == "🫠"',
+        },
+        steps: [{ action: "add_reaction", emoji: "👍" }],
+      },
+      { triggerReaction: "🫠" },
+    ),
+    "When someone reacts with 🫠, add a 👍 reaction",
+  );
+
+  assert.equal(
+    getWorkflowCardLabel({
+      trigger: {
+        on: "reaction_added",
+        filter: 'trigger_emoji == "🫠"',
+      },
+      steps: [{ action: "add_reaction", emoji: "👍" }],
+    }),
+    "When someone reacts with 🫠, add a 👍 reaction",
+  );
+
+  assert.equal(
+    getWorkflowCardLabel(
+      {
+        trigger: { on: "message_posted" },
+        steps: [{ action: "send_message", text: "Deploying now" }],
+      },
+      { actionChannelLabel: "releases" },
+    ),
+    "When a message is posted, send “Deploying now” in #releases",
+  );
+
+  assert.equal(
+    getWorkflowCardLabel(
+      {
+        trigger: {
+          on: "message_posted",
+          filter: `trigger_author == "${"a".repeat(64)}"`,
+        },
+        steps: [{ action: "send_message", text: "Deploying now" }],
+      },
+      { triggerDescription: "Message posted by Carl" },
+    ),
+    "When a message is posted by Carl, send “Deploying now”",
+  );
+
+  assert.equal(
+    getWorkflowCardLabel(
+      {
+        trigger: {
+          on: "message_posted",
+          filter: 'str_contains(trigger_text, "deploy")',
+        },
+        steps: [{ action: "call_webhook" }],
+      },
+      { triggerDescription: "Message contains “deploy”" },
+    ),
+    "When a message contains “deploy”, call a webhook",
+  );
+
+  assert.equal(
+    getWorkflowCardLabel({
+      trigger: {
+        on: "message_posted",
+        filter: 'str_contains(trigger_text, "deploy")',
+      },
+      steps: [{ action: "call_webhook" }],
+    }),
+    "When a message contains “deploy”, call a webhook",
+  );
+
+  assert.equal(
+    getWorkflowCardLabel({
+      trigger: {
+        on: "reaction_added",
+        filter: `trigger_message_id == "${"b".repeat(64)}"`,
+      },
+      steps: [{ action: "add_reaction", emoji: "👍" }],
+    }),
+    "When a reaction is added, add a 👍 reaction",
+  );
+
+  assert.equal(
+    getWorkflowCardLabel(
+      {
+        trigger: {
+          on: "message_posted",
+          filter: `trigger_text == "FUCK" && trigger_author == "${"a".repeat(64)}"`,
+        },
+        steps: [{ action: "send_message", text: "{{trigger.text}} yourself" }],
+      },
+      {
+        triggerDescription: "Message “FUCK” is posted by Carl",
+      },
+    ),
+    "When “FUCK” is posted by Carl, send “{{trigger.text}} yourself”",
+  );
+});
+
+test("builds a concise semantic trigger label for workflow cards", () => {
+  assert.equal(
+    getWorkflowTriggerSummary({
+      trigger: {
+        on: "message_posted",
+        filter: 'str_contains(trigger_text, "deploy")',
+      },
+    }),
+    "Message contains “deploy”",
+  );
+  assert.equal(
+    getWorkflowTriggerSummary({
+      trigger: {
+        on: "reaction_added",
+        filter: `trigger_emoji == "🔥" && trigger_author == "${"a".repeat(64)}" && trigger_message_id == "${"b".repeat(64)}"`,
+      },
+    }),
+    "🔥 reaction added",
+  );
+  assert.equal(
+    getWorkflowTriggerSummary({
+      trigger: { on: "schedule", interval: "15m" },
+    }),
+    "Schedule",
+  );
+});
+
+test("counts configured steps for card stack presentation", () => {
+  assert.equal(getWorkflowStepCount({}), 0);
+  assert.equal(
+    getWorkflowStepCount({
+      steps: [{ action: "send_message" }, { action: "add_reaction" }],
+    }),
+    2,
+  );
+});
+
+test("returns configured reaction emoji for rich card rendering", () => {
+  assert.equal(
+    getWorkflowTriggerEmoji({
+      trigger: {
+        on: "reaction_added",
+        filter: 'trigger_emoji == "👀"',
+      },
+    }),
+    "👀",
+  );
+  assert.equal(
+    getWorkflowTriggerEmoji({
+      trigger: { on: "reaction_added", emoji: ":blob-wave:" },
+    }),
+    ":blob-wave:",
+  );
+  assert.equal(
+    getWorkflowTriggerEmoji({
+      trigger: {
+        on: "reaction_added",
+        filter: 'trigger_emoji != "👀"',
+      },
+    }),
+    null,
+  );
+  assert.equal(
+    getWorkflowTriggerEmoji({
+      trigger: {
+        on: "message_posted",
+        filter: 'trigger_emoji == "👀"',
+      },
+    }),
+    null,
+  );
+
+  assert.equal(
+    getWorkflowPrimaryActionEmoji({
+      steps: [{ action: "add_reaction", emoji: ":blob-wave:" }],
+    }),
+    ":blob-wave:",
+  );
+  assert.equal(
+    getWorkflowPrimaryActionEmoji({
+      steps: [{ action: "send_message", emoji: ":blob-wave:" }],
+    }),
+    null,
+  );
+  assert.deepEqual(
+    getWorkflowActionTiles({
+      steps: [
+        { action: "add_reaction", emoji: "🐥" },
+        { action: "send_message", text: "hello" },
+        { action: "delay", duration: "5m" },
+      ],
+    }),
+    [
+      { action: "add_reaction", emoji: "🐥", key: "step-0" },
+      { action: "send_message", emoji: null, key: "step-1" },
+      { action: "delay", emoji: null, key: "step-2" },
+    ],
+  );
+});
+
+test("toggles workflow enabled state without mutating its definition", () => {
   const definition = {
     name: "deploy",
+    enabled: false,
     trigger: { on: "message_posted" },
+    future_field: { keep: true },
   };
-  const disabled = withWorkflowEnabled(definition, false);
 
-  assert.deepEqual(disabled, { ...definition, enabled: false });
-  assert.deepEqual(definition, {
+  assert.deepEqual(withWorkflowEnabled(definition, true), {
     name: "deploy",
     trigger: { on: "message_posted" },
+    future_field: { keep: true },
   });
-  assert.deepEqual(withWorkflowEnabled(disabled, true), definition);
+  assert.deepEqual(withWorkflowEnabled(definition, false), definition);
+  assert.equal(definition.enabled, false);
 });
 
 test("shows a disabled definition as disabled while preserving other statuses", () => {
@@ -55,3 +286,38 @@ test("shows a disabled definition as disabled while preserving other statuses",
     "archived",
   );
 });
+
+test("summarizes common and custom schedules", () => {
+  assert.equal(
+    getWorkflowCardLabel({
+      trigger: { on: "schedule", interval: "15m" },
+      steps: [{ action: "call_webhook" }],
+    }),
+    "Every 15 minutes, call a webhook",
+  );
+  assert.equal(
+    getWorkflowCardLabel({
+      trigger: { on: "schedule", cron: "30 9 * * *" },
+      steps: [{ action: "request_approval" }],
+    }),
+    "Every day at 09:30 UTC, request approval",
+  );
+  assert.equal(
+    getWorkflowCardLabel({
+      trigger: { on: "schedule", cron: "*/5 8-17 * * 1-5" },
+      steps: [],
+    }),
+    "On a custom schedule",
+  );
+});
+
+test("gracefully labels definitions with future trigger and action types", () => {
+  assert.equal(
+    getWorkflowCardLabel({
+      trigger: { on: "issue_closed" },
+      steps: [{ action: "archive_issue" }],
+    }),
+    "When issue closed happens, archive issue",
+  );
+  assert.equal(getWorkflowCardLabel({}), "When this workflow starts");
+});
diff --git a/desktop/src/features/workflows/ui/workflowDefinition.ts b/desktop/src/features/workflows/ui/workflowDefinition.ts
index d70b40abd16..e6d70845966 100644
--- a/desktop/src/features/workflows/ui/workflowDefinition.ts
+++ b/desktop/src/features/workflows/ui/workflowDefinition.ts
@@ -1,6 +1,22 @@
 import type { Workflow } from "@/shared/api/types";
-import { TRIGGER_LABELS } from "./workflowFormTypes";
-import type { TriggerType } from "./workflowFormTypes";
+import {
+  scheduleFormFromTrigger,
+  SCHEDULE_FREQUENCY_LABELS,
+} from "./workflowSchedule";
+import {
+  ACTION_LABELS,
+  TRIGGER_LABELS,
+  TRIGGER_TYPES,
+} from "./workflowFormTypes";
+import type {
+  ActionType,
+  StepFormState,
+  TriggerConfig,
+  TriggerType,
+} from "./workflowFormTypes";
+import { workflowStepDescription } from "./workflowStepDescription";
+import { parseConditionExpressions } from "./workflowConditionExpression";
+import { workflowTriggerDescription } from "./workflowTriggerDescription";
 
 function asRecord(value: unknown): Record<string, unknown> | null {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
@@ -9,25 +25,389 @@ function asRecord(value: unknown): Record<string, unknown> | null {
   return value as Record<string, unknown>;
 }
 
+function nonEmptyString(value: unknown): string | null {
+  return typeof value === "string" && value.trim().length > 0
+    ? value.trim()
+    : null;
+}
+
+function humanizeIdentifier(value: string): string {
+  return value.replaceAll("_", " ").replace(/\s+/g, " ").trim();
+}
+
+function getWorkflowSteps(
+  definition: Record<string, unknown>,
+): Record<string, unknown>[] {
+  return Array.isArray(definition.steps)
+    ? definition.steps.map(asRecord).filter((step) => step !== null)
+    : [];
+}
+
 export function getWorkflowTriggerType(
   definition: Record<string, unknown>,
 ): string | null {
-  const trigger = asRecord(definition.trigger);
-  return typeof trigger?.on === "string" && trigger.on.trim().length > 0
-    ? trigger.on
-    : null;
+  return nonEmptyString(asRecord(definition.trigger)?.on);
 }
 
 export function getWorkflowPrimaryAction(
   definition: Record<string, unknown>,
 ): string | null {
-  const firstStep = Array.isArray(definition.steps)
-    ? asRecord(definition.steps[0])
+  return nonEmptyString(getWorkflowSteps(definition)[0]?.action);
+}
+
+export function getWorkflowPrimaryActionEmoji(
+  definition: Record<string, unknown>,
+): string | null {
+  return getWorkflowActionTiles(definition)[0]?.emoji ?? null;
+}
+
+export function getWorkflowActionTiles(
+  definition: Record<string, unknown>,
+): Array<{ action: string; emoji: string | null; key: string }> {
+  return getWorkflowSteps(definition).map((step, index) => ({
+    action: nonEmptyString(step.action) ?? "",
+    emoji: step.action === "add_reaction" ? nonEmptyString(step.emoji) : null,
+    key: nonEmptyString(step.id) ?? `step-${index}`,
+  }));
+}
+
+export function getWorkflowTriggerEmoji(
+  definition: Record<string, unknown>,
+): string | null {
+  const trigger = asRecord(definition.trigger);
+  if (trigger?.on !== "reaction_added") return null;
+
+  const legacyEmoji = nonEmptyString(trigger.emoji);
+  if (legacyEmoji) return legacyEmoji;
+
+  const filter = nonEmptyString(trigger.filter);
+  if (!filter) return null;
+  const conditions = parseConditionExpressions(filter, "reaction_added");
+  const emojiCondition = conditions?.find(
+    ({ field, operator }) => field === "trigger_emoji" && operator === "equals",
+  );
+  return nonEmptyString(emojiCondition?.value);
+}
+
+function getWorkflowTriggerConfig(
+  definition: Record<string, unknown>,
+): TriggerConfig | null {
+  const trigger = asRecord(definition.trigger);
+  const triggerType = nonEmptyString(trigger?.on);
+  if (
+    !trigger ||
+    !triggerType ||
+    !TRIGGER_TYPES.includes(triggerType as TriggerType)
+  ) {
+    return null;
+  }
+
+  return {
+    on: triggerType as TriggerType,
+    filter: nonEmptyString(trigger.filter) ?? undefined,
+    emoji: nonEmptyString(trigger.emoji) ?? undefined,
+    cron: nonEmptyString(trigger.cron) ?? undefined,
+    interval: nonEmptyString(trigger.interval) ?? undefined,
+  };
+}
+
+function getScheduleCardClause(trigger: Record<string, unknown>): string {
+  const schedule = scheduleFormFromTrigger({
+    on: "schedule",
+    cron: nonEmptyString(trigger.cron) ?? undefined,
+    interval: nonEmptyString(trigger.interval) ?? undefined,
+  });
+
+  switch (schedule.frequency) {
+    case "daily":
+      return `Every day at ${schedule.time} UTC`;
+    case "weekly":
+      return `Every week at ${schedule.time} UTC`;
+    case "monthly":
+      return `Every month at ${schedule.time} UTC`;
+    case "custom_interval":
+      return schedule.customInterval
+        ? `Every ${schedule.customInterval}`
+        : "On a schedule";
+    case "custom_cron":
+      return "On a custom schedule";
+    default:
+      return SCHEDULE_FREQUENCY_LABELS[schedule.frequency];
+  }
+}
+
+function getTriggerCardClause(
+  definition: Record<string, unknown>,
+  presentedReaction?: string,
+): string {
+  const trigger = asRecord(definition.trigger);
+  const triggerType = nonEmptyString(trigger?.on);
+  if (!trigger || !triggerType) return "When this workflow starts";
+
+  switch (triggerType) {
+    case "message_posted":
+      return nonEmptyString(trigger.filter)
+        ? "When a matching message is posted"
+        : "When a message is posted";
+    case "reaction_added": {
+      const emoji = nonEmptyString(presentedReaction ?? trigger.emoji);
+      return emoji
+        ? `When someone reacts with ${emoji}`
+        : "When someone adds a reaction";
+    }
+    case "diff_posted":
+      return nonEmptyString(trigger.filter)
+        ? "When a matching diff is posted"
+        : "When a diff is posted";
+    case "webhook":
+      return "When a webhook arrives";
+    case "schedule":
+      return getScheduleCardClause(trigger);
+    default:
+      return `When ${humanizeIdentifier(triggerType)} happens`;
+  }
+}
+
+function eventDescriptionCardClause(
+  description: string,
+  event: "message" | "diff",
+): string | null {
+  const subject = event === "message" ? "Message" : "Diff";
+  const eventPhrase = `${subject} posted`;
+  if (!description.startsWith(eventPhrase)) return null;
+
+  const detail = description.slice(eventPhrase.length);
+  if (!detail) return `When a ${event} is posted`;
+  if (detail.startsWith(" is ") || detail.startsWith(" is not ")) {
+    return `When a ${event}${detail}`;
+  }
+  if (
+    detail.startsWith(" containing ") ||
+    detail.startsWith(" without ") ||
+    detail.startsWith(" starting with ") ||
+    detail.startsWith(" ending with ") ||
+    detail === " with text"
+  ) {
+    return `When a ${event}${detail} is posted`;
+  }
+  return `When a ${event} is posted${detail}`;
+}
+
+function textDescriptionCardClause(
+  description: string,
+  event: "message" | "diff",
+): string | null {
+  const subject = event === "message" ? "Message" : "Diff";
+  if (!description.startsWith(`${subject} `)) return null;
+  return `When a ${event}${description.slice(subject.length)}`;
+}
+
+function postedValueCardClause(description: string): string | null {
+  const postedIndex = description.indexOf(" posted");
+  if (postedIndex < 1) return null;
+
+  const value = description.slice(0, postedIndex);
+  if (!value.startsWith("“") && !value.startsWith("Anything except ")) {
+    return null;
+  }
+  const normalizedValue = value.startsWith("Anything")
+    ? `anything${value.slice("Anything".length)}`
+    : value;
+  return `When ${normalizedValue} is posted${description.slice(postedIndex + " posted".length)}`;
+}
+
+function qualifiedPostedEventCardClause(
+  description: string,
+  event: "message" | "diff",
+): string | null {
+  const subject = event === "message" ? "Message" : "Diff";
+  const postedIndex = description.indexOf(" posted");
+  if (postedIndex < 1) return null;
+
+  const suffix = description.slice(postedIndex + " posted".length);
+  const otherTextPrefix = `${subject} with text other than `;
+  if (description.startsWith(otherTextPrefix)) {
+    const value = description.slice(otherTextPrefix.length, postedIndex);
+    return `When a ${event} with text other than ${value} is posted${suffix}`;
+  }
+
+  if (description.startsWith(`${subject} with text posted`)) {
+    return `When a ${event} with text is posted${suffix}`;
+  }
+  if (description.startsWith(`${subject} without text posted`)) {
+    return `When a ${event} without text is posted${suffix}`;
+  }
+  return null;
+}
+
+function exactValueEventCardClause(
+  description: string,
+  event: "message" | "diff",
+): string | null {
+  const subject = event === "message" ? "Message" : "Diff";
+  const prefix = `${subject} “`;
+  const postedMarker = " is posted";
+  if (!description.startsWith(prefix)) return null;
+
+  const postedIndex = description.indexOf(postedMarker);
+  if (postedIndex < prefix.length) return null;
+  const value = description.slice(subject.length + 1, postedIndex);
+  const suffix = description.slice(postedIndex + postedMarker.length);
+  return event === "message"
+    ? `When ${value} is posted${suffix}`
+    : `When a diff ${value} is posted${suffix}`;
+}
+
+function getPresentedTriggerCardClause(description?: string): string | null {
+  if (!description) return null;
+
+  const eventClause =
+    exactValueEventCardClause(description, "message") ??
+    exactValueEventCardClause(description, "diff") ??
+    qualifiedPostedEventCardClause(description, "message") ??
+    qualifiedPostedEventCardClause(description, "diff") ??
+    postedValueCardClause(description) ??
+    eventDescriptionCardClause(description, "message") ??
+    eventDescriptionCardClause(description, "diff") ??
+    textDescriptionCardClause(description, "message") ??
+    textDescriptionCardClause(description, "diff");
+  if (eventClause) return eventClause;
+
+  if (description.startsWith("Reaction added")) {
+    return `When a reaction is added${description.slice("Reaction added".length)}`;
+  }
+  if (description.endsWith(" reaction added")) {
+    return `When someone reacts with ${description.slice(0, -" reaction added".length)}`;
+  }
+  if (
+    description.startsWith("Any reaction ") &&
+    description.endsWith(" added")
+  ) {
+    return `When ${description.slice(0, -" added".length).toLocaleLowerCase()} is added`;
+  }
+  return null;
+}
+
+function getActionCardClause(
+  step: Record<string, unknown>,
+  channelLabel?: string,
+): string | null {
+  const action = nonEmptyString(step.action);
+  if (!action) return null;
+
+  const actionLabel = ACTION_LABELS[action as ActionType];
+  const parsedStep: StepFormState | null = actionLabel
+    ? {
+        action: action as ActionType,
+        id: nonEmptyString(step.id) ?? "step_1",
+        duration: nonEmptyString(step.duration) ?? undefined,
+        emoji: nonEmptyString(step.emoji) ?? undefined,
+        from: nonEmptyString(step.from) ?? undefined,
+        message: nonEmptyString(step.message) ?? undefined,
+        method: nonEmptyString(step.method) ?? undefined,
+        name: nonEmptyString(step.name) ?? undefined,
+        text: nonEmptyString(step.text) ?? undefined,
+        to: nonEmptyString(step.to) ?? undefined,
+        topic: nonEmptyString(step.topic) ?? undefined,
+        url: nonEmptyString(step.url) ?? undefined,
+      }
     : null;
-  return typeof firstStep?.action === "string" &&
-    firstStep.action.trim().length > 0
-    ? firstStep.action
+  const detail = parsedStep
+    ? workflowStepDescription(parsedStep, {
+        channelLabel,
+        includeName: false,
+      })
+    : null;
+  const configuredDetail =
+    detail &&
+    detail !== actionLabel &&
+    detail !==
+      (actionLabel
+        ? `${actionLabel[0]}${actionLabel.slice(1).toLocaleLowerCase()}`
+        : null)
+      ? detail
+      : null;
+
+  switch (action) {
+    case "delay": {
+      return configuredDetail
+        ? `wait ${configuredDetail}`
+        : "wait for a moment";
+    }
+    case "send_message":
+      if (!configuredDetail) return "send a channel message";
+      return nonEmptyString(step.text)
+        ? `send ${configuredDetail}`
+        : `send a message in ${configuredDetail}`;
+    case "call_webhook":
+      return configuredDetail ? `call ${configuredDetail}` : "call a webhook";
+    case "send_dm":
+      return configuredDetail
+        ? `send ${configuredDetail}`
+        : "send a direct message";
+    case "request_approval":
+      return configuredDetail
+        ? `request approval: ${configuredDetail}`
+        : "request approval";
+    case "add_reaction": {
+      return configuredDetail
+        ? `add a ${configuredDetail} reaction`
+        : "add a reaction";
+    }
+    case "set_channel_topic":
+      return configuredDetail
+        ? `set the channel topic to ${configuredDetail}`
+        : "update the channel topic";
+    default: {
+      return (actionLabel ?? humanizeIdentifier(action)).toLocaleLowerCase();
+    }
+  }
+}
+
+export function getWorkflowStepCount(
+  definition: Record<string, unknown>,
+): number {
+  return getWorkflowSteps(definition).length;
+}
+
+/** Build a short plain-language label from the workflow's trigger and steps. */
+export function getWorkflowCardLabel(
+  definition: Record<string, unknown>,
+  options: {
+    actionChannelLabel?: string;
+    triggerDescription?: string;
+    triggerReaction?: string;
+  } = {},
+): string {
+  const triggerConfig = getWorkflowTriggerConfig(definition);
+  const triggerClause =
+    getPresentedTriggerCardClause(options.triggerDescription) ??
+    getPresentedTriggerCardClause(
+      triggerConfig?.filter && !options.triggerReaction
+        ? workflowTriggerDescription(triggerConfig, {
+            omitUnresolvedReferences: true,
+          })
+        : undefined,
+    ) ??
+    getTriggerCardClause(definition, options.triggerReaction);
+  const steps = getWorkflowSteps(definition);
+  const firstAction = steps[0]
+    ? getActionCardClause(steps[0], options.actionChannelLabel)
     : null;
+  if (!firstAction) return triggerClause;
+
+  const remainingStepCount = steps.length - 1;
+  if (remainingStepCount === 0) return `${triggerClause}, ${firstAction}`;
+
+  return `${triggerClause}, ${firstAction}, then ${remainingStepCount} more ${
+    remainingStepCount === 1 ? "step" : "steps"
+  }`;
+}
+
+export function getWorkflowDescription(
+  definition: Record<string, unknown>,
+): string | null {
+  return nonEmptyString(definition.description);
 }
 
 export function getWorkflowEnabled(
@@ -59,49 +439,18 @@ export function getWorkflowDisplayStatus(
   return getWorkflowEnabled(workflow.definition) ? workflow.status : "disabled";
 }
 
-export function getWorkflowDescription(
-  definition: Record<string, unknown>,
-): string | null {
-  const description = definition.description;
-  return typeof description === "string" && description.trim().length > 0
-    ? description.trim()
-    : null;
-}
-
 export function getWorkflowTriggerSummary(
   definition: Record<string, unknown>,
 ): string | null {
-  const trigger = asRecord(definition.trigger);
-  if (!trigger) return null;
-
-  const on = trigger.on;
-  if (typeof on !== "string") return null;
+  const trigger = getWorkflowTriggerConfig(definition);
+  if (trigger)
+    return workflowTriggerDescription(trigger, {
+      omitUnresolvedReferences: true,
+    });
 
-  const label = TRIGGER_LABELS[on as TriggerType] ?? on;
-  switch (on) {
-    case "message_posted":
-    case "diff_posted":
-      return typeof trigger.filter === "string" &&
-        trigger.filter.trim().length > 0
-        ? `${label} · ${trigger.filter}`
-        : label;
-    case "reaction_added":
-      return typeof trigger.emoji === "string" &&
-        trigger.emoji.trim().length > 0
-        ? `${label} · ${trigger.emoji}`
-        : label;
-    case "schedule":
-      if (typeof trigger.cron === "string" && trigger.cron.trim().length > 0) {
-        return `${label} · ${trigger.cron}`;
-      }
-      if (
-        typeof trigger.interval === "string" &&
-        trigger.interval.trim().length > 0
-      ) {
-        return `${label} · ${trigger.interval}`;
-      }
-      return label;
-    default:
-      return label;
-  }
+  const rawTrigger = asRecord(definition.trigger);
+  const triggerType = nonEmptyString(rawTrigger?.on);
+  return triggerType
+    ? (TRIGGER_LABELS[triggerType as TriggerType] ?? triggerType)
+    : null;
 }
diff --git a/desktop/src/features/workflows/ui/workflowReactionCondition.test.mjs b/desktop/src/features/workflows/ui/workflowReactionCondition.test.mjs
new file mode 100644
index 00000000000..db13b94ef85
--- /dev/null
+++ b/desktop/src/features/workflows/ui/workflowReactionCondition.test.mjs
@@ -0,0 +1,49 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import { reactionConditionValue } from "./workflowReactionCondition.ts";
+
+test("merges a legacy reaction emoji with a separate structured filter", () => {
+  const author = "a".repeat(64);
+  assert.equal(
+    reactionConditionValue({
+      on: "reaction_added",
+      emoji: "🔥",
+      filter: `trigger_author == "${author}"`,
+    }),
+    `trigger_emoji == "🔥" && trigger_author == "${author}"`,
+  );
+});
+
+test("groups a legacy filter that has top-level alternatives", () => {
+  const a = "a".repeat(64);
+  const b = "b".repeat(64);
+  assert.equal(
+    reactionConditionValue({
+      on: "reaction_added",
+      emoji: "✅",
+      filter: `trigger_author == "${a}" || trigger_author == "${b}"`,
+    }),
+    `trigger_emoji == "✅" && (trigger_author == "${a}" || trigger_author == "${b}")`,
+  );
+});
+
+test("does not add redundant grouping to an already-parenthesized filter", () => {
+  const a = "a".repeat(64);
+  const b = "b".repeat(64);
+  assert.equal(
+    reactionConditionValue({
+      on: "reaction_added",
+      emoji: "✅",
+      filter: `(trigger_author == "${a}" || trigger_author == "${b}")`,
+    }),
+    `trigger_emoji == "✅" && (trigger_author == "${a}" || trigger_author == "${b}")`,
+  );
+});
+
+test("leaves non-reaction filters unchanged", () => {
+  assert.equal(
+    reactionConditionValue({ on: "message_posted", filter: "trigger_text" }),
+    "trigger_text",
+  );
+});
diff --git a/desktop/src/features/workflows/ui/workflowReactionCondition.ts b/desktop/src/features/workflows/ui/workflowReactionCondition.ts
new file mode 100644
index 00000000000..536f9166957
--- /dev/null
+++ b/desktop/src/features/workflows/ui/workflowReactionCondition.ts
@@ -0,0 +1,15 @@
+import { needsConjunctionGrouping } from "./workflowConditionExpression";
+import type { TriggerConfig } from "./workflowFormTypes";
+
+/** Presents legacy reaction emoji constraints alongside structured filters. */
+export function reactionConditionValue(trigger: TriggerConfig): string {
+  const filter = trigger.filter?.trim() ?? "";
+  const emoji = trigger.on === "reaction_added" ? trigger.emoji?.trim() : null;
+  if (!emoji) return filter;
+  const emojiCondition = `trigger_emoji == ${JSON.stringify(emoji)}`;
+  if (!filter) return emojiCondition;
+  // The emoji constraint and the filter are ANDed at runtime, so a filter with
+  // top-level alternatives must be grouped to preserve its original meaning.
+  const guarded = needsConjunctionGrouping(filter) ? `(${filter})` : filter;
+  return `${emojiCondition} && ${guarded}`;
+}
diff --git a/desktop/src/features/workflows/ui/workflowStepDescription.test.mjs b/desktop/src/features/workflows/ui/workflowStepDescription.test.mjs
new file mode 100644
index 00000000000..83286334d80
--- /dev/null
+++ b/desktop/src/features/workflows/ui/workflowStepDescription.test.mjs
@@ -0,0 +1,109 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import { workflowStepDescription } from "./workflowStepDescription.ts";
+
+test("describes configured workflow steps on the canvas", () => {
+  assert.equal(
+    workflowStepDescription({
+      id: "message",
+      action: "send_message",
+      name: "say hello",
+      text: "hey yourself",
+    }),
+    "say hello · “hey yourself”",
+  );
+  assert.equal(
+    workflowStepDescription(
+      {
+        id: "channel-message",
+        action: "send_message",
+        text: "deploying now",
+        channel: "channel-id",
+      },
+      { channelLabel: "deployments" },
+    ),
+    "“deploying now” in #deployments",
+  );
+  assert.equal(
+    workflowStepDescription({
+      id: "delay",
+      action: "delay",
+      duration: "5m",
+    }),
+    "5 minutes",
+  );
+  assert.equal(
+    workflowStepDescription({
+      id: "long-delay",
+      action: "delay",
+      duration: "4w",
+    }),
+    "4 weeks",
+  );
+  assert.equal(
+    workflowStepDescription({
+      id: "webhook",
+      action: "call_webhook",
+      method: "PATCH",
+      url: "https://example.com/deploy",
+    }),
+    "PATCH https://example.com/deploy",
+  );
+  assert.equal(
+    workflowStepDescription({
+      id: "dm",
+      action: "send_dm",
+      text: "Build finished",
+      to: "team-on-call",
+    }),
+    "“Build finished” to team-on-call",
+  );
+  assert.equal(
+    workflowStepDescription({
+      id: "approval",
+      action: "request_approval",
+      message: "Ship the release?",
+      from: "release-managers",
+    }),
+    "“Ship the release?” from release-managers",
+  );
+  assert.equal(
+    workflowStepDescription({
+      id: "reaction",
+      action: "add_reaction",
+      emoji: ":buzz:",
+    }),
+    ":buzz:",
+  );
+  assert.equal(
+    workflowStepDescription({
+      id: "topic",
+      action: "set_channel_topic",
+      topic: "Shipping this week",
+    }),
+    "“Shipping this week”",
+  );
+});
+
+test("falls back to the action label until a step is configured", () => {
+  assert.equal(
+    workflowStepDescription({ id: "message", action: "send_message" }),
+    "Send Message",
+  );
+});
+
+test("can omit a custom step name when composing an index label", () => {
+  assert.equal(
+    workflowStepDescription(
+      {
+        id: "message",
+        action: "send_message",
+        name: "say hello",
+        text: "hey yourself",
+      },
+      { includeName: false },
+    ),
+    "“hey yourself”",
+  );
+});
diff --git a/desktop/src/features/workflows/ui/workflowStepDescription.ts b/desktop/src/features/workflows/ui/workflowStepDescription.ts
new file mode 100644
index 00000000000..136ce026111
--- /dev/null
+++ b/desktop/src/features/workflows/ui/workflowStepDescription.ts
@@ -0,0 +1,83 @@
+import { truncatePubkey } from "@/shared/lib/pubkey";
+import {
+  formatDurationSecondsVerbose,
+  parseDurationSeconds,
+} from "./workflowDuration";
+import { ACTION_LABELS } from "./workflowFormTypes";
+import type { StepFormState } from "./workflowFormTypes";
+
+const MAX_DETAIL_LENGTH = 42;
+
+function compact(value: string): string {
+  const normalized = value.trim().replaceAll(/\s+/g, " ");
+  return normalized.length > MAX_DETAIL_LENGTH
+    ? `${normalized.slice(0, MAX_DETAIL_LENGTH - 3)}...`
+    : normalized;
+}
+
+function quoted(value: string | undefined): string | null {
+  const normalized = value ? compact(value) : "";
+  return normalized ? `“${normalized}”` : null;
+}
+
+function destination(value: string | undefined): string | null {
+  const normalized = value?.trim();
+  if (!normalized) return null;
+  return /^[0-9a-f]{64}$/i.test(normalized)
+    ? truncatePubkey(normalized)
+    : compact(normalized);
+}
+
+function configuredStepDetail(
+  step: StepFormState,
+  channelLabel?: string,
+): string | null {
+  switch (step.action) {
+    case "delay": {
+      const duration = step.duration?.trim();
+      if (!duration) return null;
+      const seconds = parseDurationSeconds(duration);
+      return compact(
+        seconds === null ? duration : formatDurationSecondsVerbose(seconds),
+      );
+    }
+    case "send_message": {
+      const text = quoted(step.text);
+      const channel = channelLabel ? `#${channelLabel}` : null;
+      if (text && channel) return `${text} in ${channel}`;
+      return text ?? channel;
+    }
+    case "send_dm": {
+      const text = quoted(step.text);
+      const recipient = destination(step.to);
+      if (text && recipient) return `${text} to ${recipient}`;
+      return text ?? recipient;
+    }
+    case "call_webhook": {
+      const url = step.url?.trim();
+      if (!url) return null;
+      return `${step.method?.trim() || "POST"} ${compact(url)}`;
+    }
+    case "request_approval": {
+      const message = quoted(step.message);
+      const approver = destination(step.from);
+      if (message && approver) return `${message} from ${approver}`;
+      return message ?? approver;
+    }
+    case "add_reaction":
+      return step.emoji?.trim() || null;
+    case "set_channel_topic":
+      return quoted(step.topic);
+  }
+}
+
+/** Build the concise action summary rendered on a workflow step node. */
+export function workflowStepDescription(
+  step: StepFormState,
+  options: { channelLabel?: string; includeName?: boolean } = {},
+): string {
+  const name = options.includeName === false ? undefined : step.name?.trim();
+  const detail = configuredStepDetail(step, options.channelLabel);
+  if (name && detail) return `${name} · ${detail}`;
+  return name || detail || ACTION_LABELS[step.action];
+}
diff --git a/desktop/src/features/workflows/ui/workflowTemplateVariables.test.mjs b/desktop/src/features/workflows/ui/workflowTemplateVariables.test.mjs
new file mode 100644
index 00000000000..ee174bdc91e
--- /dev/null
+++ b/desktop/src/features/workflows/ui/workflowTemplateVariables.test.mjs
@@ -0,0 +1,87 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+
+import {
+  activeTemplateToken,
+  insertTemplateVariable,
+  workflowTemplateVariables,
+} from "./workflowTemplateVariables.ts";
+
+test("finds the active template token at the caret", () => {
+  assert.deepEqual(activeTemplateToken("hello {{trig", 12), {
+    start: 6,
+    end: 12,
+    query: "trig",
+  });
+  assert.equal(activeTemplateToken("hello {{trigger.text}}", 22), null);
+  assert.equal(activeTemplateToken("hello {{trigger ", 16), null);
+});
+
+test("inserts a selected variable and preserves surrounding text", () => {
+  const token = activeTemplateToken("before {{tri after", 12);
+  assert.ok(token);
+  assert.deepEqual(
+    insertTemplateVariable("before {{tri after", token, "trigger.text"),
+    {
+      value: "before {{trigger.text}} after",
+      caret: 23,
+    },
+  );
+});
+
+test("replaces the whole template when editing inside an existing token", () => {
+  const token = activeTemplateToken("{{trigger.text}}", 9);
+  assert.ok(token);
+  assert.deepEqual(
+    insertTemplateVariable("{{trigger.text}}", token, "trigger.author"),
+    {
+      value: "{{trigger.author}}",
+      caret: 18,
+    },
+  );
+});
+
+test("offers trigger fields and known previous-step outputs", () => {
+  const variables = workflowTemplateVariables("message_posted", [
+    { id: "notify", action: "send_message" },
+    { id: "pause", action: "delay" },
+  ]).map(({ value }) => value);
+
+  assert.ok(variables.includes("trigger.text"));
+  assert.ok(variables.includes("trigger.author"));
+  assert.ok(variables.includes("steps.notify.output.event_id"));
+  assert.ok(variables.includes("steps.pause.output.slept_secs"));
+});
+
+test("offers only outputs available in every runtime shape", () => {
+  const variables = workflowTemplateVariables("reaction_added", [
+    { id: "react", action: "add_reaction" },
+  ]).map(({ value }) => value);
+
+  assert.ok(variables.includes("trigger.emoji"));
+  assert.ok(variables.includes("steps.react.output.added"));
+  assert.ok(!variables.includes("steps.react.output.status"));
+  assert.ok(!variables.includes("steps.react.output.response"));
+});
+
+test("keeps prior-step ordering and ignores unsafe step IDs", () => {
+  const variables = workflowTemplateVariables("webhook", [
+    { id: "first", action: "delay" },
+    { id: "unsafe-id", action: "send_message" },
+    { id: "second", action: "send_message" },
+  ]).map(({ value }) => value);
+
+  assert.deepEqual(variables, [
+    "trigger.channel_id",
+    "steps.first.output.slept_secs",
+    "steps.second.output.sent",
+    "steps.second.output.event_id",
+  ]);
+});
+
+test("only offers values populated by the selected trigger", () => {
+  const variables = workflowTemplateVariables("schedule", []).map(
+    ({ value }) => value,
+  );
+  assert.deepEqual(variables, ["trigger.channel_id", "trigger.timestamp"]);
+});
diff --git a/desktop/src/features/workflows/ui/workflowTemplateVariables.ts b/desktop/src/features/workflows/ui/workflowTemplateVariables.ts
new file mode 100644
index 00000000000..c4f038fef9e
--- /dev/null
+++ b/desktop/src/features/workflows/ui/workflowTemplateVariables.ts
@@ -0,0 +1,147 @@
+import type {
+  ActionType,
+  StepFormState,
+  TriggerType,
+} from "./workflowFormTypes";
+
+export type WorkflowTemplateVariable = {
+  description: string;
+  group: "Trigger" | "Previous steps";
+  value: string;
+};
+
+export type ActiveTemplateToken = {
+  end: number;
+  query: string;
+  start: number;
+};
+
+const COMMON_EVENT_VARIABLES: WorkflowTemplateVariable[] = [
+  {
+    value: "trigger.author",
+    description: "Author pubkey",
+    group: "Trigger",
+  },
+  {
+    value: "trigger.channel_id",
+    description: "Channel UUID",
+    group: "Trigger",
+  },
+  {
+    value: "trigger.timestamp",
+    description: "Unix timestamp",
+    group: "Trigger",
+  },
+  {
+    value: "trigger.message_id",
+    description: "Message event ID",
+    group: "Trigger",
+  },
+];
+
+const STEP_OUTPUTS: Partial<Record<ActionType, Record<string, string>>> = {
+  delay: { slept_secs: "Seconds elapsed" },
+  send_message: {
+    sent: "Whether the message was sent",
+    event_id: "Sent message ID",
+  },
+  call_webhook: { status: "HTTP response status", body: "HTTP response body" },
+  add_reaction: {
+    added: "Whether the reaction was added",
+  },
+};
+
+function triggerVariables(
+  triggerType: TriggerType,
+): WorkflowTemplateVariable[] {
+  switch (triggerType) {
+    case "message_posted":
+      return [
+        {
+          value: "trigger.text",
+          description: "Message text",
+          group: "Trigger",
+        },
+        ...COMMON_EVENT_VARIABLES,
+      ];
+    case "diff_posted":
+      return [
+        { value: "trigger.text", description: "Diff text", group: "Trigger" },
+        ...COMMON_EVENT_VARIABLES,
+      ];
+    case "reaction_added":
+      return [
+        {
+          value: "trigger.emoji",
+          description: "Reaction emoji",
+          group: "Trigger",
+        },
+        ...COMMON_EVENT_VARIABLES,
+      ];
+    case "schedule":
+      return COMMON_EVENT_VARIABLES.filter(
+        ({ value }) =>
+          value === "trigger.channel_id" || value === "trigger.timestamp",
+      );
+    case "webhook":
+      return [
+        {
+          value: "trigger.channel_id",
+          description: "Workflow channel UUID",
+          group: "Trigger",
+        },
+      ];
+  }
+}
+
+export function workflowTemplateVariables(
+  triggerType: TriggerType,
+  previousSteps: StepFormState[],
+): WorkflowTemplateVariable[] {
+  const priorOutputs = previousSteps.flatMap((step) => {
+    const outputs = STEP_OUTPUTS[step.action];
+    if (!outputs || !/^[A-Za-z0-9_]+$/.test(step.id)) return [];
+    return Object.entries(outputs).map(([field, description]) => ({
+      value: `steps.${step.id}.output.${field}`,
+      description,
+      group: "Previous steps" as const,
+    }));
+  });
+
+  return [...triggerVariables(triggerType), ...priorOutputs];
+}
+
+/** Find an unfinished `{{variable` token immediately before the caret. */
+export function activeTemplateToken(
+  value: string,
+  caret: number,
+): ActiveTemplateToken | null {
+  const beforeCaret = value.slice(0, caret);
+  const start = beforeCaret.lastIndexOf("{{");
+  if (start < 0) return null;
+
+  const query = beforeCaret.slice(start + 2);
+  if (query.includes("}}") || !/^[A-Za-z0-9._]*$/.test(query)) return null;
+
+  // If the caret is inside an existing template, replace the complete token
+  // instead of leaving its old suffix behind after a suggestion is chosen.
+  const closingBraces = value.indexOf("}}", caret);
+  const nestedOpening = value.indexOf("{{", start + 2);
+  const end =
+    closingBraces >= 0 && (nestedOpening < 0 || closingBraces < nestedOpening)
+      ? closingBraces + 2
+      : caret;
+  return { start, end, query };
+}
+
+export function insertTemplateVariable(
+  value: string,
+  token: ActiveTemplateToken,
+  variable: string,
+): { caret: number; value: string } {
+  const insertion = `{{${variable}}}`;
+  return {
+    value: `${value.slice(0, token.start)}${insertion}${value.slice(token.end)}`,
+    caret: token.start + insertion.length,
+  };
+}
diff --git a/desktop/src/features/workflows/ui/workflowTriggerDescription.test.mjs b/desktop/src/features/workflows/ui/workflowTriggerDescription.test.mjs
new file mode 100644
index 00000000000..94b04356cd2
--- /dev/null
+++ b/desktop/src/features/workflows/ui/workflowTriggerDescription.test.mjs
@@ -0,0 +1,158 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import { workflowTriggerDescription } from "./workflowTriggerDescription.ts";
+
+test("describes selected trigger conditions on the workflow canvas", () => {
+  assert.equal(
+    workflowTriggerDescription(
+      {
+        on: "message_posted",
+        filter: `trigger_author == "${"a".repeat(64)}"`,
+      },
+      { authorLabel: "Carl" },
+    ),
+    "Message posted by Carl",
+  );
+
+  assert.equal(
+    workflowTriggerDescription(
+      {
+        on: "message_posted",
+        filter: `trigger_author == "${"a".repeat(64)}"`,
+      },
+      { authorLoading: true },
+    ),
+    "Message posted by loading author",
+  );
+
+  assert.equal(
+    workflowTriggerDescription({
+      on: "message_posted",
+      filter: 'str_contains(trigger_text, "deploy")',
+    }),
+    "Message contains “deploy”",
+  );
+
+  assert.equal(
+    workflowTriggerDescription({
+      on: "message_posted",
+      filter: '!str_contains(trigger_text, "deploy")',
+    }),
+    "Message doesn’t contain “deploy”",
+  );
+
+  assert.equal(
+    workflowTriggerDescription({
+      on: "message_posted",
+      filter: 'str_starts_with(trigger_text, "deploy")',
+    }),
+    "Message starts with “deploy”",
+  );
+
+  assert.equal(
+    workflowTriggerDescription({
+      on: "message_posted",
+      filter: 'str_ends_with(trigger_text, "done")',
+    }),
+    "Message ends with “done”",
+  );
+
+  assert.equal(
+    workflowTriggerDescription({
+      on: "message_posted",
+      filter: 'trigger_text == "deploy"',
+    }),
+    "Message “deploy” is posted",
+  );
+
+  assert.equal(
+    workflowTriggerDescription({
+      on: "message_posted",
+      filter: 'trigger_text != "deploy"',
+    }),
+    "Message with text other than “deploy” posted",
+  );
+
+  assert.equal(
+    workflowTriggerDescription(
+      {
+        on: "message_posted",
+        filter: `trigger_text == "FUCK" && trigger_author == "${"a".repeat(64)}"`,
+      },
+      { authorLabel: "Carl" },
+    ),
+    "Message “FUCK” is posted by Carl",
+  );
+
+  assert.equal(
+    workflowTriggerDescription(
+      {
+        on: "message_posted",
+        filter: `str_contains(trigger_text, "deploy") && trigger_author == "${"a".repeat(64)}"`,
+      },
+      { authorLabel: "Carl" },
+    ),
+    "Message by Carl contains “deploy”",
+  );
+
+  assert.equal(
+    workflowTriggerDescription({
+      on: "message_posted",
+      filter: "str_len(trigger_text) == 0",
+    }),
+    "Message without text posted",
+  );
+
+  assert.equal(
+    workflowTriggerDescription({
+      on: "message_posted",
+      filter: "str_len(trigger_text) > 0",
+    }),
+    "Message with text posted",
+  );
+
+  assert.equal(
+    workflowTriggerDescription({
+      on: "reaction_added",
+      filter: 'trigger_emoji == "🔥"',
+    }),
+    "🔥 reaction added",
+  );
+
+  assert.equal(
+    workflowTriggerDescription(
+      {
+        on: "reaction_added",
+        filter: `trigger_message_id == "${"b".repeat(64)}"`,
+      },
+      { messageLoading: true },
+    ),
+    "Reaction added to loading message",
+  );
+
+  assert.equal(
+    workflowTriggerDescription(
+      {
+        on: "reaction_added",
+        filter: `trigger_emoji == "👾" && trigger_author == "${"a".repeat(64)}" && trigger_message_id == "${"b".repeat(64)}"`,
+      },
+      { authorLabel: "Carl", messageLabel: "hey yourself" },
+    ),
+    "👾 reaction added by Carl to “hey yourself”",
+  );
+});
+
+test("keeps the base label for unfiltered and custom triggers", () => {
+  assert.equal(
+    workflowTriggerDescription({ on: "message_posted" }),
+    "Message posted",
+  );
+  assert.equal(
+    workflowTriggerDescription({
+      on: "message_posted",
+      filter: "custom_variable == 1",
+    }),
+    "Message posted",
+  );
+});
diff --git a/desktop/src/features/workflows/ui/workflowTriggerDescription.ts b/desktop/src/features/workflows/ui/workflowTriggerDescription.ts
new file mode 100644
index 00000000000..49d3842f979
--- /dev/null
+++ b/desktop/src/features/workflows/ui/workflowTriggerDescription.ts
@@ -0,0 +1,209 @@
+import { truncatePubkey } from "@/shared/lib/pubkey";
+import { parseConditionExpressions } from "./workflowConditionExpression";
+import { TRIGGER_LABELS } from "./workflowFormTypes";
+import type { ParsedConditionExpression } from "./workflowConditionExpression";
+import type { TriggerConfig } from "./workflowFormTypes";
+
+const EVENT_PHRASES = {
+  diff_posted: "Diff posted",
+  message_posted: "Message posted",
+  reaction_added: "Reaction added",
+} as const;
+
+export const TRIGGER_MESSAGE_LOADING_LABEL = "loading message";
+export const TRIGGER_AUTHOR_LOADING_LABEL = "loading author";
+
+function authorReference(
+  condition: ParsedConditionExpression,
+  authorLabel?: string,
+  authorLoading?: boolean,
+): string {
+  if (authorLoading) return TRIGGER_AUTHOR_LOADING_LABEL;
+  return authorLabel ?? truncatePubkey(condition.value);
+}
+
+function quotedValue(value: string): string {
+  const normalized = value.trim().replaceAll(/\s+/g, " ");
+  const abbreviated =
+    normalized.length > 36 ? `${normalized.slice(0, 33)}...` : normalized;
+  return `“${abbreviated}”`;
+}
+
+function messageReference(
+  condition: ParsedConditionExpression,
+  messageLabel?: string,
+  messageLoading?: boolean,
+): string {
+  if (messageLoading) return TRIGGER_MESSAGE_LOADING_LABEL;
+  return messageLabel
+    ? quotedValue(messageLabel)
+    : truncatePubkey(condition.value);
+}
+
+function textConditionDescription(
+  eventPhrase: string,
+  condition: ParsedConditionExpression,
+): string {
+  const subject = eventPhrase.replace(/ posted$/, "");
+  const value = quotedValue(condition.value);
+  switch (condition.operator) {
+    case "contains":
+      return `${subject} contains ${value}`;
+    case "not_contains":
+      return `${subject} doesn’t contain ${value}`;
+    case "starts_with":
+      return `${subject} starts with ${value}`;
+    case "ends_with":
+      return `${subject} ends with ${value}`;
+    case "equals":
+      return `${subject} ${value} is posted`;
+    case "not_equals":
+      return `${subject} with text other than ${value} posted`;
+    case "is_not_empty":
+      return `${subject} with text posted`;
+    case "is_empty":
+      return `${subject} without text posted`;
+  }
+}
+
+/** Build the concise trigger summary rendered on the workflow canvas. */
+export function workflowTriggerDescription(
+  trigger: TriggerConfig,
+  options: {
+    authorLoading?: boolean;
+    authorLabel?: string;
+    messageLabel?: string;
+    messageLoading?: boolean;
+    omitUnresolvedReferences?: boolean;
+  } = {},
+): string {
+  const baseLabel =
+    EVENT_PHRASES[trigger.on as keyof typeof EVENT_PHRASES] ??
+    TRIGGER_LABELS[trigger.on];
+  const eventPhrase = EVENT_PHRASES[trigger.on as keyof typeof EVENT_PHRASES];
+  if (!eventPhrase) return baseLabel;
+
+  const conditions = trigger.filter
+    ? parseConditionExpressions(trigger.filter, trigger.on)
+    : [];
+  if (!conditions || conditions.length === 0) {
+    return trigger.on === "reaction_added" && trigger.emoji
+      ? eventPhrase
+      : baseLabel;
+  }
+
+  const condition = conditions[0];
+
+  if (conditions.length > 1) {
+    const authorCondition = conditions.find(
+      ({ field }) => field === "trigger_author",
+    );
+    const textCondition = conditions.find(
+      ({ field }) => field === "trigger_text",
+    );
+    const emojiCondition = conditions.find(
+      ({ field }) => field === "trigger_emoji",
+    );
+    const messageCondition = conditions.find(
+      ({ field }) => field === "trigger_message_id",
+    );
+    let description = textCondition
+      ? textConditionDescription(eventPhrase, textCondition)
+      : eventPhrase;
+
+    if (emojiCondition) {
+      description =
+        emojiCondition.operator === "not_equals"
+          ? `Any reaction except ${emojiCondition.value} added`
+          : `${emojiCondition.value} reaction added`;
+    }
+    if (
+      authorCondition &&
+      (!options.omitUnresolvedReferences ||
+        options.authorLabel ||
+        options.authorLoading)
+    ) {
+      const author = authorReference(
+        authorCondition,
+        options.authorLabel,
+        options.authorLoading,
+      );
+      const attribution =
+        authorCondition.operator === "not_equals"
+          ? ` by anyone except ${author}`
+          : ` by ${author}`;
+      const subject = eventPhrase.replace(/ posted$/, "");
+      description =
+        textCondition &&
+        description.startsWith(subject) &&
+        !/ (?:is )?posted$/.test(description)
+          ? `${subject}${attribution}${description.slice(subject.length)}`
+          : `${description}${attribution}`;
+    }
+    if (
+      messageCondition &&
+      (!options.omitUnresolvedReferences ||
+        options.messageLabel ||
+        options.messageLoading)
+    ) {
+      const message = messageReference(
+        messageCondition,
+        options.messageLabel,
+        options.messageLoading,
+      );
+      description +=
+        messageCondition.operator === "not_equals"
+          ? ` anywhere except ${message}`
+          : ` to ${message}`;
+    }
+    return description;
+  }
+
+  if (condition.field === "trigger_author") {
+    if (
+      options.omitUnresolvedReferences &&
+      !options.authorLabel &&
+      !options.authorLoading
+    ) {
+      return baseLabel;
+    }
+    const author = authorReference(
+      condition,
+      options.authorLabel,
+      options.authorLoading,
+    );
+    return condition.operator === "not_equals"
+      ? `${eventPhrase} by anyone except ${author}`
+      : `${eventPhrase} by ${author}`;
+  }
+
+  if (condition.field === "trigger_text") {
+    return textConditionDescription(eventPhrase, condition);
+  }
+
+  if (condition.field === "trigger_emoji") {
+    return condition.operator === "not_equals"
+      ? `Any reaction except ${condition.value} added`
+      : `${condition.value} reaction added`;
+  }
+
+  if (condition.field === "trigger_message_id") {
+    if (
+      options.omitUnresolvedReferences &&
+      !options.messageLabel &&
+      !options.messageLoading
+    ) {
+      return baseLabel;
+    }
+    const message = messageReference(
+      condition,
+      options.messageLabel,
+      options.messageLoading,
+    );
+    return condition.operator === "not_equals"
+      ? `Reaction added anywhere except ${message}`
+      : `Reaction added to ${message}`;
+  }
+
+  return baseLabel;
+}
diff --git a/desktop/src/shared/api/relayQueryInvalidation.test.mjs b/desktop/src/shared/api/relayQueryInvalidation.test.mjs
index 6130992a30d..059d2f4b7fb 100644
--- a/desktop/src/shared/api/relayQueryInvalidation.test.mjs
+++ b/desktop/src/shared/api/relayQueryInvalidation.test.mjs
@@ -63,6 +63,9 @@ test("relay invalidation separates relay project queries from local repo work",
     ["project", "project-1", "pull-requests"],
     ["projects", "issues", ["project-1"]],
     ["projects", "activity-summaries", ["addr-1"]],
+    // Work items fan out over the relay and are fresh for two minutes;
+    // reconnect auto-heal must be able to repair a partial result.
+    ["projects", "work-items", ["project-1"], ["addr-1"]],
   ]) {
     assert.equal(isRelayDependentQueryKey(queryKey), true, queryKey.join("/"));
   }
diff --git a/desktop/src/shared/api/relayQueryInvalidation.ts b/desktop/src/shared/api/relayQueryInvalidation.ts
index e07992184d9..6892c54a348 100644
--- a/desktop/src/shared/api/relayQueryInvalidation.ts
+++ b/desktop/src/shared/api/relayQueryInvalidation.ts
@@ -39,6 +39,10 @@ const RELAY_PROJECT_QUERY_PARTS = new Set<string>([
   "activity-summaries",
   "issues",
   "pull-requests",
+  // Fresh for two minutes (PROJECT_WORK_ITEMS_STALE_TIME_MS) and tolerant of
+  // partial fan-out failure — reconnect auto-heal is what repairs a partial
+  // result inside that window.
+  "work-items",
 ]);
 
 const LOCAL_PROJECT_QUERY_PARTS = new Set<string>([
diff --git a/desktop/src/shared/hooks/useIncrementalMount.test.mjs b/desktop/src/shared/hooks/useIncrementalMount.test.mjs
new file mode 100644
index 00000000000..57f7c225749
--- /dev/null
+++ b/desktop/src/shared/hooks/useIncrementalMount.test.mjs
@@ -0,0 +1,157 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import { countGroupedRows, sliceGroupedRows } from "./useIncrementalMount.ts";
+
+function group(id, rowCount) {
+  return { id, rows: Array.from({ length: rowCount }, (_, i) => `${id}-${i}`) };
+}
+
+test("sliceGroupedRows trims across group boundaries in order", () => {
+  const groups = [group("a", 3), group("b", 4), group("c", 2)];
+
+  assert.deepEqual(
+    sliceGroupedRows(groups, 5).map((g) => [g.id, g.rows.length]),
+    [
+      ["a", 3],
+      ["b", 2],
+    ],
+  );
+});
+
+test("sliceGroupedRows keeps whole groups untouched when under budget", () => {
+  const groups = [group("a", 3), group("b", 4)];
+  const sliced = sliceGroupedRows(groups, 10);
+  assert.equal(sliced.length, 2);
+  // Fully-included groups keep their identity (no needless clones).
+  assert.equal(sliced[0], groups[0]);
+  assert.equal(sliced[1], groups[1]);
+});
+
+test("sliceGroupedRows with zero budget is empty; counts add up", () => {
+  const groups = [group("a", 3), group("b", 4)];
+  assert.deepEqual(sliceGroupedRows(groups, 0), []);
+  assert.equal(countGroupedRows(groups), 7);
+});
+
+// --- Hook behavior: growth, layout gating, shrink reset -------------------
+
+async function withHookHarness(run) {
+  const { JSDOM } = await import("jsdom");
+  const dom = new JSDOM("<!doctype html><html><body></body></html>");
+  const originals = {
+    window: globalThis.window,
+    document: globalThis.document,
+    navigator: Object.getOwnPropertyDescriptor(globalThis, "navigator"),
+    act: globalThis.IS_REACT_ACT_ENVIRONMENT,
+  };
+  const frames = [];
+  dom.window.requestAnimationFrame = (cb) => frames.push(cb) && frames.length;
+  dom.window.cancelAnimationFrame = (id) => {
+    frames[id - 1] = null;
+  };
+  globalThis.window = dom.window;
+  globalThis.document = dom.window.document;
+  Object.defineProperty(globalThis, "navigator", {
+    configurable: true,
+    value: dom.window.navigator,
+  });
+  globalThis.IS_REACT_ACT_ENVIRONMENT = true;
+  try {
+    const React = (await import("react")).default;
+    const { act } = await import("react");
+    const { createRoot } = await import("react-dom/client");
+    const { useIncrementalMount } = await import("./useIncrementalMount.ts");
+
+    const seen = [];
+    function Probe({ total, enabled }) {
+      seen.push(useIncrementalMount(total, 2, 3, enabled));
+      return null;
+    }
+    const root = createRoot(
+      dom.window.document.body.appendChild(
+        dom.window.document.createElement("div"),
+      ),
+    );
+    const render = async (total, enabled = true) => {
+      await act(async () => {
+        root.render(React.createElement(Probe, { enabled, total }));
+      });
+    };
+    const flushFrames = async () => {
+      // Growth chains one rAF per step; run until quiescent.
+      for (let i = 0; i < 20 && frames.some(Boolean); i += 1) {
+        const pending = frames.splice(0, frames.length).filter(Boolean);
+        await act(async () => {
+          for (const cb of pending) cb();
+        });
+      }
+    };
+    await run({ render, flushFrames, seen, root, act });
+    await act(async () => root.unmount());
+  } finally {
+    globalThis.window = originals.window;
+    globalThis.document = originals.document;
+    if (originals.navigator) {
+      Object.defineProperty(globalThis, "navigator", originals.navigator);
+    }
+    globalThis.IS_REACT_ACT_ENVIRONMENT = originals.act;
+  }
+}
+
+test("hook grows stepwise to total and persists across data updates", async () => {
+  await withHookHarness(async ({ render, flushFrames, seen }) => {
+    await render(8);
+    assert.equal(seen.at(-1), 2); // initial window paints first
+    await flushFrames();
+    assert.equal(seen.at(-1), 8); // grown 2→5→8
+    await render(8); // in-place update: stays fully mounted
+    assert.equal(seen.at(-1), 8);
+  });
+});
+
+test("hook holds at initial while disabled and grows on activation", async () => {
+  await withHookHarness(async ({ render, flushFrames, seen }) => {
+    await render(9, false);
+    await flushFrames();
+    assert.equal(seen.at(-1), 2, "disabled layout must not grow");
+    await render(9, true);
+    await flushFrames();
+    assert.equal(seen.at(-1), 9);
+    // Deactivating resets to the initial window for the next activation.
+    await render(9, false);
+    await flushFrames();
+    assert.equal(seen.at(-1), 2);
+  });
+});
+
+test("hook snaps down on total shrink and re-grows stepwise on restore", async () => {
+  await withHookHarness(async ({ render, flushFrames, seen }) => {
+    await render(9);
+    await flushFrames();
+    assert.equal(seen.at(-1), 9);
+    await render(4); // scope narrowed
+    await flushFrames();
+    assert.equal(seen.at(-1), 4);
+    await render(9); // scope restored: no one-shot bulk mount
+    assert.equal(seen.at(-1), 4);
+    await flushFrames();
+    assert.equal(seen.at(-1), 9);
+  });
+});
+
+test("list dwell then grid switch: first enabled commit stays at the initial window", async () => {
+  await withHookHarness(async ({ render, flushFrames, seen }) => {
+    // Dwell in list layout (counter disabled) long enough that an ungated
+    // counter would have grown to the full collection.
+    await render(20, false);
+    await flushFrames();
+    assert.equal(seen.at(-1), 2, "dormant counter must hold at initial");
+    // Switch to grid: the FIRST grid commit must mount only the initial
+    // window — never the whole collection in one commit.
+    await render(20, true);
+    assert.equal(seen.at(-1), 2, "first grid commit stays at initial");
+    await flushFrames();
+    assert.equal(seen.at(-1), 20, "then grows stepwise to the total");
+  });
+});
diff --git a/desktop/src/shared/hooks/useIncrementalMount.ts b/desktop/src/shared/hooks/useIncrementalMount.ts
new file mode 100644
index 00000000000..7fcb440d251
--- /dev/null
+++ b/desktop/src/shared/hooks/useIncrementalMount.ts
@@ -0,0 +1,86 @@
+import * as React from "react";
+
+/**
+ * Mounts a long list progressively: the first `initial` items render in the
+ * first commit (fast click→paint), then the count grows by `step` in chained
+ * low-priority transitions until everything is mounted. This bounds the cost
+ * of any single React commit — a one-shot mount of hundreds of heavy rows
+ * blocked the main thread for 0.5–1.5s on the Projects tabs.
+ *
+ * The count persists across in-place data updates (a refetch re-rendering an
+ * already-grown list stays fully mounted) and resets naturally when the
+ * consuming component remounts (tab switches swap subtrees).
+ *
+ * Two guards keep the single-commit bound honest without a remount:
+ * - `enabled: false` (the inactive layout of a list/grid pair) holds the
+ *   count at `initial`, so switching layouts mounts the other collection
+ *   incrementally instead of all at once from its already-grown counter.
+ * - A `total` shrink (scope narrowed) snaps the count down — everything
+ *   visible stays mounted — so restoring the wider scope re-grows stepwise
+ *   instead of bulk-mounting the whole collection in one commit.
+ */
+export function useIncrementalMount(
+  total: number,
+  initial = 30,
+  step = 60,
+  enabled = true,
+): number {
+  const [count, setCount] = React.useState(initial);
+
+  React.useEffect(() => {
+    if (!enabled) {
+      if (count !== initial) setCount(initial);
+      return;
+    }
+    if (total < count) {
+      setCount(Math.max(initial, total));
+      return;
+    }
+    if (count >= total) return;
+    let cancelled = false;
+    // rAF so a frame paints between growth steps; the transition keeps each
+    // growth commit interruptible by user input.
+    const frame = window.requestAnimationFrame(() => {
+      if (cancelled) return;
+      React.startTransition(() => {
+        setCount((current) => Math.min(current + step, total));
+      });
+    });
+    return () => {
+      cancelled = true;
+      window.cancelAnimationFrame(frame);
+    };
+  }, [count, enabled, initial, step, total]);
+
+  return Math.min(count, total);
+}
+
+/**
+ * Trims grouped rows to a total row budget, preserving group order and
+ * dropping empty groups. Pure core for incrementally-mounted grouped lists.
+ */
+export function sliceGroupedRows<G extends { rows: readonly unknown[] }>(
+  groups: readonly G[],
+  limit: number,
+): G[] {
+  const result: G[] = [];
+  let remaining = limit;
+  for (const group of groups) {
+    if (remaining <= 0) break;
+    if (group.rows.length <= remaining) {
+      result.push(group);
+      remaining -= group.rows.length;
+    } else {
+      result.push({ ...group, rows: group.rows.slice(0, remaining) });
+      remaining = 0;
+    }
+  }
+  return result;
+}
+
+/** Total row count across groups. */
+export function countGroupedRows(
+  groups: readonly { rows: readonly unknown[] }[],
+): number {
+  return groups.reduce((sum, group) => sum + group.rows.length, 0);
+}
diff --git a/desktop/src/shared/lib/fontSizePreference.test.mjs b/desktop/src/shared/lib/fontSizePreference.test.mjs
index 217a3e5a00a..363a7604d1d 100644
--- a/desktop/src/shared/lib/fontSizePreference.test.mjs
+++ b/desktop/src/shared/lib/fontSizePreference.test.mjs
@@ -1,15 +1,18 @@
 import assert from "node:assert/strict";
 import test from "node:test";
 
+import { readFileSync } from "node:fs";
+
 import config from "../../../tailwind.config.js";
 
+const typographyCss = readFileSync(
+  new URL("../styles/globals/typography.css", import.meta.url),
+  "utf8",
+);
+
 const values = new Map();
 const attributes = new Map();
-const styleValues = new Map();
 const windowListeners = new Map();
-const style = {
-  setProperty: (name, value) => styleValues.set(name, value),
-};
 
 globalThis.window = {
   addEventListener: (type, listener) => windowListeners.set(type, listener),
@@ -21,7 +24,6 @@ globalThis.localStorage = {
 globalThis.document = {
   documentElement: {
     setAttribute: (name, value) => attributes.set(name, value),
-    style,
   },
 };
 
@@ -39,6 +41,28 @@ test("scales fixed line-height utilities with the typography rem", () => {
   });
 });
 
+test("derives the typography rem from the real root so zoom scales layout too", () => {
+  // Cmd +/- scales the root font-size; the type rem must stay rem-relative
+  // (never an absolute px) or text would zoom while containers froze.
+  assert.match(
+    typographyCss,
+    /--buzz-type-rem:\s*calc\(1rem \* var\(--buzz-type-scale\)\);/,
+  );
+  assert.doesNotMatch(typographyCss, /--buzz-type-rem:\s*[\d.]+px/);
+});
+
+test("maps the font size attribute to the 13 / 14 / 15px type contract", () => {
+  assert.match(typographyCss, /:root\s*\{[^}]*--buzz-type-scale:\s*1;/s);
+  assert.match(
+    typographyCss,
+    /:root\[data-font-size="smaller"\]\s*\{\s*--buzz-type-scale:\s*calc\(13 \/ 14\);/,
+  );
+  assert.match(
+    typographyCss,
+    /:root\[data-font-size="larger"\]\s*\{\s*--buzz-type-scale:\s*calc\(15 \/ 14\);/,
+  );
+});
+
 test("defaults invalid and missing font sizes to default", () => {
   assert.equal(preference.parseFontSize(null), "default");
   assert.equal(preference.parseFontSize("medium"), "default");
@@ -48,35 +72,28 @@ test("defaults invalid and missing font sizes to default", () => {
 });
 
 test("persists and applies the selected font size across the app", () => {
-  preference.applyTextZoomFactor(1);
   preference.setFontSize("smaller");
   assert.equal(preference.getFontSize(), "smaller");
   assert.equal(values.get(preference.FONT_SIZE_STORAGE_KEY), "smaller");
   assert.equal(attributes.get("data-font-size"), "smaller");
-  assert.equal(styleValues.get("--buzz-type-rem"), "14.857143px");
 });
 
 test("previews a font size without changing the saved preference", () => {
-  preference.applyTextZoomFactor(1.1);
   preference.setFontSize("smaller");
   preference.previewFontSize("larger");
   assert.equal(preference.getFontSize(), "smaller");
   assert.equal(values.get(preference.FONT_SIZE_STORAGE_KEY), "smaller");
   assert.equal(attributes.get("data-font-size"), "larger");
-  assert.equal(styleValues.get("--buzz-type-rem"), "18.857143px");
 
   preference.previewFontSize(null);
   assert.equal(attributes.get("data-font-size"), "smaller");
-  assert.equal(styleValues.get("--buzz-type-rem"), "16.342857px");
 });
 
 test("initializes from the stored font size", () => {
-  preference.applyTextZoomFactor(1);
   values.set(preference.FONT_SIZE_STORAGE_KEY, "larger");
   preference.initializeFontSizePreference();
   assert.equal(preference.getFontSize(), "larger");
   assert.equal(attributes.get("data-font-size"), "larger");
-  assert.equal(styleValues.get("--buzz-type-rem"), "17.142857px");
 });
 
 test("applies font size changes from another window", () => {
@@ -84,7 +101,6 @@ test("applies font size changes from another window", () => {
   windowListeners.get("storage")({ key: preference.FONT_SIZE_STORAGE_KEY });
   assert.equal(preference.getFontSize(), "smaller");
   assert.equal(attributes.get("data-font-size"), "smaller");
-  assert.equal(styleValues.get("--buzz-type-rem"), "14.857143px");
 });
 
 test("returns to the default when another window clears storage", () => {
@@ -93,5 +109,4 @@ test("returns to the default when another window clears storage", () => {
   windowListeners.get("storage")({ key: null });
   assert.equal(preference.getFontSize(), "default");
   assert.equal(attributes.get("data-font-size"), "default");
-  assert.equal(styleValues.get("--buzz-type-rem"), "16px");
 });
diff --git a/desktop/src/shared/lib/fontSizePreference.ts b/desktop/src/shared/lib/fontSizePreference.ts
index 9604a2c2cbc..0db303f00b3 100644
--- a/desktop/src/shared/lib/fontSizePreference.ts
+++ b/desktop/src/shared/lib/fontSizePreference.ts
@@ -7,20 +7,15 @@ export const FONT_SIZE_STORAGE_KEY = "buzz.appearance.fontSize";
 export const DEFAULT_FONT_SIZE: FontSize = "default";
 
 /**
- * Virtual rem sizes used by typography tokens. Keeping the real root at 16px
- * prevents a text preference from also resizing rem-based layout geometry.
+ * Root attribute that selects the type scale. The 13 / 14 / 15px contract and
+ * the virtual typography rem it drives live in `styles/globals/typography.css`;
+ * this module only records the user's choice. Cmd +/- zoom is a separate dial
+ * (`useWebviewZoomShortcuts`) that scales the real root font-size.
  */
-const TYPE_REM_SIZE_PX: Record<FontSize, number> = {
-  smaller: 13 / 0.875,
-  default: 14 / 0.875,
-  larger: 15 / 0.875,
-};
-
-const TYPE_REM_PROPERTY = "--buzz-type-rem";
+const FONT_SIZE_ATTRIBUTE = "data-font-size";
 
 const listeners = new Set<() => void>();
 let fontSize: FontSize = DEFAULT_FONT_SIZE;
-let textZoomFactor = 1;
 let listeningForStorageChanges = false;
 
 export function parseFontSize(value: string | null | undefined): FontSize {
@@ -39,16 +34,8 @@ function readStoredFontSize(): FontSize {
   }
 }
 
-function typeRemSizePx(size: FontSize): number {
-  return (
-    Math.round(TYPE_REM_SIZE_PX[size] * textZoomFactor * 1_000_000) / 1_000_000
-  );
-}
-
 function applyFontSize(size: FontSize): void {
-  const root = globalThis.document?.documentElement;
-  root?.setAttribute("data-font-size", size);
-  root?.style.setProperty(TYPE_REM_PROPERTY, `${typeRemSizePx(size)}px`);
+  globalThis.document?.documentElement?.setAttribute(FONT_SIZE_ATTRIBUTE, size);
 }
 
 function notifyListeners(): void {
@@ -80,13 +67,6 @@ export function initializeFontSizePreference(): void {
   listenForStorageChanges();
 }
 
-/** Combine Cmd +/- zoom with the selected app-wide type scale. */
-export function applyTextZoomFactor(zoomFactor: number): void {
-  if (!Number.isFinite(zoomFactor) || zoomFactor <= 0) return;
-  textZoomFactor = zoomFactor;
-  applyFontSize(fontSize);
-}
-
 function subscribe(listener: () => void): () => void {
   listeners.add(listener);
   return () => listeners.delete(listener);
diff --git a/desktop/src/shared/lib/keyboard-shortcuts.ts b/desktop/src/shared/lib/keyboard-shortcuts.ts
index fde3e06e6ca..e8b388d0dcb 100644
--- a/desktop/src/shared/lib/keyboard-shortcuts.ts
+++ b/desktop/src/shared/lib/keyboard-shortcuts.ts
@@ -163,6 +163,14 @@ export const KEYBOARD_SHORTCUTS: KeyboardShortcut[] = [
     keysWindows: "Shift+Enter",
     category: "Messages",
   },
+  {
+    id: "always-address-agent",
+    label: "Always address agent",
+    description: "Open the agent picker, or toggle the highlighted agent",
+    keys: "⇧⌘↵",
+    keysWindows: "Ctrl+Shift+Enter",
+    category: "Messages",
+  },
   {
     id: "publish-note",
     label: "Publish note",
diff --git a/desktop/src/shared/lib/linkPreview.test.mjs b/desktop/src/shared/lib/linkPreview.test.mjs
index f13014bf8e5..731ec9a9b99 100644
--- a/desktop/src/shared/lib/linkPreview.test.mjs
+++ b/desktop/src/shared/lib/linkPreview.test.mjs
@@ -236,30 +236,28 @@ test("parseSupportedLinkPreview rejects malformed buzz:// entity links", () => {
   }
 });
 
-test("extractSupportedLinkPreviews picks up buzz:// project links in prose", () => {
-  assert.deepEqual(
-    extractSupportedLinkPreviews(
-      `tracking here: buzz://project?owner=${BUZZ_OWNER}&d=buzz-world`,
-    ).map((preview) => [preview.kind, preview.typeLabel, preview.title]),
-    [["buzz-project", "project", "buzz-world"]],
-  );
-});
+test("extractSupportedLinkPreviews excludes Buzz entity links while keeping external links", () => {
+  const entityLinks = [
+    `buzz://project?owner=${BUZZ_OWNER}&d=buzz-world`,
+    `buzz://repo?owner=${BUZZ_OWNER}&d=buzz-world`,
+    `buzz://issue?id=${BUZZ_EVENT_ID}&owner=${BUZZ_OWNER}&d=buzz-world`,
+    `buzz://pr?id=${BUZZ_EVENT_ID}&owner=${BUZZ_OWNER}&d=buzz-world`,
+  ];
 
-test("extractSupportedLinkPreviews picks up buzz:// links in prose", () => {
   assert.deepEqual(
     extractSupportedLinkPreviews(
-      `PR is up: buzz://pr?id=${BUZZ_EVENT_ID}&owner=${BUZZ_OWNER}&d=buzz-world — review please.`,
-    ).map((preview) => [preview.kind, preview.title]),
-    [["buzz-pull-request", "buzz-world #c3b589fa"]],
+      `${entityLinks.join(" ")} https://example.com/story`,
+    ).map((preview) => preview.href),
+    ["https://example.com/story"],
   );
 });
 
-test("extractSupportedLinkPreviews uses markdown labels for buzz:// links", () => {
+test("extractSupportedLinkPreviews excludes markdown-labeled Buzz entity links", () => {
   assert.deepEqual(
     extractSupportedLinkPreviews(
-      `[Add header links](buzz://pr?id=${BUZZ_EVENT_ID}&owner=${BUZZ_OWNER}&d=buzz-world)`,
-    ).map((preview) => preview.title),
-    ["Add header links"],
+      `[Project](buzz://project?owner=${BUZZ_OWNER}&d=buzz-world)`,
+    ),
+    [],
   );
 });
 
@@ -324,21 +322,13 @@ test("extractSupportedLinkPreviews returns unique supported links in order", ()
   );
 });
 
-test("extractSupportedLinkPreviews picks up bare Buzz clone URLs in prose", () => {
+test("extractSupportedLinkPreviews excludes same-relay Buzz clone URLs", () => {
   assert.deepEqual(
     extractSupportedLinkPreviews(
       `master pushed; clone: https://buzz.block.builderlab.xyz/git/${BUZZ_OWNER}/buzz-world-galaxy and review please.`,
       "https://buzz.block.builderlab.xyz",
     ),
-    [
-      {
-        kind: "buzz-repository",
-        href: `buzz://repo?owner=${BUZZ_OWNER}&d=buzz-world-galaxy`,
-        provider: "Buzz",
-        title: "buzz-world-galaxy",
-        typeLabel: "repo",
-      },
-    ],
+    [],
   );
   // Without a relay origin the URL is treated as an ordinary external link.
   assert.deepEqual(
@@ -349,39 +339,13 @@ test("extractSupportedLinkPreviews picks up bare Buzz clone URLs in prose", () =
   );
 });
 
-test("extractSupportedLinkPreviews uses markdown labels for Buzz repo links", () => {
+test("extractSupportedLinkPreviews excludes markdown-labeled Buzz clone URLs", () => {
   assert.deepEqual(
     extractSupportedLinkPreviews(
       `[Buzz World](https://relay.example/git/${BUZZ_OWNER}/buzz-world-galaxy)`,
       "https://relay.example",
-    ).map((preview) => preview.title),
-    ["Buzz World"],
-  );
-});
-
-test("extractSupportedLinkPreviews dedupes clone URL variants of one repo", () => {
-  assert.deepEqual(
-    extractSupportedLinkPreviews(
-      [
-        `https://relay.example/git/${BUZZ_OWNER}/buzz-world-galaxy`,
-        `https://relay.example/git/${BUZZ_OWNER}/buzz-world-galaxy.git`,
-      ].join(" "),
-      "https://relay.example",
-    ).map((preview) => preview.href),
-    [`buzz://repo?owner=${BUZZ_OWNER}&d=buzz-world-galaxy`],
-  );
-});
-
-test("clone URLs and buzz://repo links for the same repo dedupe to one card", () => {
-  assert.deepEqual(
-    extractSupportedLinkPreviews(
-      [
-        `https://relay.example/git/${BUZZ_OWNER}/buzz-world-galaxy`,
-        `buzz://repo?owner=${BUZZ_OWNER}&d=buzz-world-galaxy`,
-      ].join(" "),
-      "https://relay.example",
-    ).map((preview) => preview.href),
-    [`buzz://repo?owner=${BUZZ_OWNER}&d=buzz-world-galaxy`],
+    ),
+    [],
   );
 });
 
diff --git a/desktop/src/shared/lib/linkPreview.ts b/desktop/src/shared/lib/linkPreview.ts
index c66e0b7c5fe..aa66784abf6 100644
--- a/desktop/src/shared/lib/linkPreview.ts
+++ b/desktop/src/shared/lib/linkPreview.ts
@@ -665,7 +665,17 @@ export function extractSupportedLinkPreviews(
   const relayOrigin = activeRelayOrigin ?? null;
   for (const candidate of candidates) {
     const preview = parseSupportedLinkPreview(candidate.href, relayOrigin);
-    if (!preview || seen.has(preview.href)) continue;
+    // Buzz-native links render as inline entity chips. Their relay-backed
+    // metadata is available from the chip on hover, so a second standalone
+    // preview would duplicate the same entity presentation. This also covers
+    // same-relay clone URLs, which parseSupportedLinkPreview normalizes to a
+    // buzz://repo href. External web links continue through the snapshot path.
+    if (
+      !preview ||
+      preview.href.startsWith("buzz://") ||
+      seen.has(preview.href)
+    )
+      continue;
 
     seen.add(preview.href);
     previews.push(
diff --git a/desktop/src/shared/lib/rosterDerivations.test.mjs b/desktop/src/shared/lib/rosterDerivations.test.mjs
new file mode 100644
index 00000000000..07837ab36f6
--- /dev/null
+++ b/desktop/src/shared/lib/rosterDerivations.test.mjs
@@ -0,0 +1,66 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import {
+  channelAgentMembers,
+  channelBotMemberPubkeySet,
+  channelMemberPubkeySet,
+  channelRoleMap,
+} from "./rosterDerivations.ts";
+
+const HUMAN = "A".repeat(64);
+const BOT_ROLE = "b".repeat(64);
+const FLAGGED_AGENT = "c".repeat(64);
+
+function roster() {
+  return [
+    { pubkey: HUMAN, role: "owner", isAgent: false },
+    { pubkey: BOT_ROLE, role: "bot", isAgent: false },
+    { pubkey: FLAGGED_AGENT, role: "member", isAgent: true },
+  ];
+}
+
+test("channelRoleMap lowercases pubkeys and maps roles", () => {
+  const map = channelRoleMap(roster());
+  assert.equal(map.get(HUMAN.toLowerCase()), "owner");
+  assert.equal(map.get(BOT_ROLE), "bot");
+  assert.equal(map.size, 3);
+});
+
+test("channelAgentMembers keeps bot-role and agent-flagged members", () => {
+  const agents = channelAgentMembers(roster());
+  assert.deepEqual(
+    agents.map((member) => member.pubkey),
+    [BOT_ROLE, FLAGGED_AGENT],
+  );
+});
+
+test("channelMemberPubkeySet normalizes; bot set is role-gated only", () => {
+  const members = roster();
+  assert.deepEqual(
+    [...channelMemberPubkeySet(members)],
+    [HUMAN.toLowerCase(), BOT_ROLE, FLAGGED_AGENT],
+  );
+  // role === "bot" only — an isAgent flag without the role stays out, matching
+  // the agent-session filter this set feeds.
+  assert.deepEqual([...channelBotMemberPubkeySet(members)], [BOT_ROLE]);
+});
+
+test("derivations are cached on roster identity", () => {
+  const members = roster();
+  assert.equal(channelRoleMap(members), channelRoleMap(members));
+  assert.equal(channelAgentMembers(members), channelAgentMembers(members));
+  assert.equal(
+    channelMemberPubkeySet(members),
+    channelMemberPubkeySet(members),
+  );
+  assert.equal(
+    channelBotMemberPubkeySet(members),
+    channelBotMemberPubkeySet(members),
+  );
+
+  // A new array — even with equal content — recomputes: the cache is keyed on
+  // identity, which React Query's structural sharing keeps stable for
+  // unchanged rosters.
+  assert.notEqual(channelRoleMap(members), channelRoleMap(roster()));
+});
diff --git a/desktop/src/shared/lib/rosterDerivations.ts b/desktop/src/shared/lib/rosterDerivations.ts
new file mode 100644
index 00000000000..c3bcb04959c
--- /dev/null
+++ b/desktop/src/shared/lib/rosterDerivations.ts
@@ -0,0 +1,96 @@
+/**
+ * Roster-derived lookups cached on the roster array's identity.
+ *
+ * Channel rosters can be 10k+ members, and several render-path consumers
+ * (timeline role badges, agent-flag merges, agent-session filters) each
+ * derived their own Map/Set from the full roster on every recompute — every
+ * live message re-ran the O(members) passes. React Query's structural sharing
+ * keeps the roster array's identity stable across refetches that return
+ * identical data, so a WeakMap keyed on that identity computes each
+ * derivation once per distinct roster.
+ */
+
+import { normalizePubkey } from "@/shared/lib/pubkey";
+
+type RosterMember = {
+  pubkey: string;
+  role: string;
+  isAgent: boolean;
+};
+
+const roleMaps = new WeakMap<
+  readonly RosterMember[],
+  ReadonlyMap<string, string>
+>();
+
+/** Lowercased pubkey → channel role for the given roster. */
+export function channelRoleMap<T extends RosterMember>(
+  members: readonly T[],
+): ReadonlyMap<string, string> {
+  const cached = roleMaps.get(members);
+  if (cached) return cached;
+  const map = new Map<string, string>();
+  for (const member of members) {
+    map.set(member.pubkey.toLowerCase(), member.role);
+  }
+  roleMaps.set(members, map);
+  return map;
+}
+
+const agentMemberLists = new WeakMap<
+  readonly RosterMember[],
+  readonly RosterMember[]
+>();
+
+/** Members that are agents: role `bot` or an explicit `isAgent` flag. */
+export function channelAgentMembers<T extends RosterMember>(
+  members: readonly T[],
+): readonly T[] {
+  const cached = agentMemberLists.get(members);
+  if (cached) return cached as readonly T[];
+  const agents = members.filter(
+    (member) => member.role === "bot" || member.isAgent,
+  );
+  agentMemberLists.set(members, agents);
+  return agents;
+}
+
+const memberPubkeySets = new WeakMap<
+  readonly RosterMember[],
+  ReadonlySet<string>
+>();
+
+/** Normalized pubkeys of every roster member. */
+export function channelMemberPubkeySet(
+  members: readonly RosterMember[],
+): ReadonlySet<string> {
+  const cached = memberPubkeySets.get(members);
+  if (cached) return cached;
+  const set = new Set(members.map((member) => normalizePubkey(member.pubkey)));
+  memberPubkeySets.set(members, set);
+  return set;
+}
+
+const botMemberPubkeySets = new WeakMap<
+  readonly RosterMember[],
+  ReadonlySet<string>
+>();
+
+/**
+ * Normalized pubkeys of role-`bot` members only. Deliberately narrower than
+ * {@link channelAgentMembers}: the agent-session filter treats the membership
+ * role as authoritative and ignores profile-derived agent flags.
+ */
+export function channelBotMemberPubkeySet(
+  members: readonly RosterMember[],
+): ReadonlySet<string> {
+  const cached = botMemberPubkeySets.get(members);
+  if (cached) return cached;
+  const set = new Set(
+    members
+      .filter((member) => member.role === "bot")
+      .map((member) => normalizePubkey(member.pubkey)),
+  );
+  botMemberPubkeySets.set(members, set);
+  return set;
+}
diff --git a/desktop/src/shared/styles/globals/composer.css b/desktop/src/shared/styles/globals/composer.css
index 2ee690e41de..fbbcdf026c9 100644
--- a/desktop/src/shared/styles/globals/composer.css
+++ b/desktop/src/shared/styles/globals/composer.css
@@ -254,4 +254,14 @@
 
 /* Inline chips — timeline markdown + composer share `.message-markdown` scope.
    Body copy is text-sm; inline code labels sit one step down (text-xs).
-   All chip variants share one box height so mono labels stay balanced. */
+   All chip variants share one box height so mono labels stay balanced.
+
+   Rendered-message chips use inline-flex. The same decoration in the
+   composer pulls the caret into the chip and swallows the trailing
+   space after an @mention, so typing "hello" after @quinn becomes
+   "@quinnhello". Keep composer chips inline; leave ::before icons in
+   place. */
+.rich-text-composer .tiptap .mention-chip {
+  display: inline;
+  min-height: 0;
+}
diff --git a/desktop/src/shared/styles/globals/composerCaret.test.mjs b/desktop/src/shared/styles/globals/composerCaret.test.mjs
new file mode 100644
index 00000000000..1ebb3b96eaa
--- /dev/null
+++ b/desktop/src/shared/styles/globals/composerCaret.test.mjs
@@ -0,0 +1,18 @@
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import test from "node:test";
+
+const composerCss = readFileSync(
+  new URL("./composer.css", import.meta.url),
+  "utf8",
+);
+
+const mentionChipRule = composerCss.match(
+  /\.rich-text-composer \.tiptap \.mention-chip\s*\{([\s\S]*?)\n\}/,
+)?.[1];
+
+test("composer mention chips stay inline so the caret can sit after the trailing space", () => {
+  assert.ok(mentionChipRule, "missing composer mention-chip override");
+  assert.match(mentionChipRule, /display:\s*inline;/);
+  assert.doesNotMatch(mentionChipRule, /display:\s*inline-flex/);
+});
diff --git a/desktop/src/shared/styles/globals/typography.css b/desktop/src/shared/styles/globals/typography.css
index fa59d372411..e25a84afc92 100644
--- a/desktop/src/shared/styles/globals/typography.css
+++ b/desktop/src/shared/styles/globals/typography.css
@@ -1,11 +1,20 @@
 @layer base {
   :root {
     /*
-     * A virtual typography rem. Font preferences and Cmd +/- change this
-     * token while the browser root remains 16px, so text scales without also
-     * resizing rem-based widths, gaps, radii, and controls.
+     * Two independent dials compose here:
+     *
+     * - Cmd +/- zoom scales the real root font-size (see
+     *   useWebviewZoomShortcuts), so every rem in the app — text, gaps,
+     *   widths, radii — grows and shrinks together. True zoom.
+     * - The Font size preference sets `data-font-size` on the root; it nudges
+     *   only the type scale below, so text changes without moving layout.
+     *
+     * Every text token derives from this virtual typography rem, which is
+     * rem-relative so it rides on top of zoom automatically. At the default
+     * preference and zoom it equals 16px, making `text-sm` 14px.
      */
-    --buzz-type-rem: 1rem;
+    --buzz-type-scale: 1;
+    --buzz-type-rem: calc(1rem * var(--buzz-type-scale));
     --text-xs: calc(var(--buzz-type-rem) * 0.75);
     --text-sm: calc(var(--buzz-type-rem) * 0.875);
     --text-base: var(--buzz-type-rem);
@@ -33,6 +42,15 @@
     --conversation-timestamp-line-height: var(--buzz-type-rem);
   }
 
+  /* Conversation text contract: 13 / 14 / 15px before keyboard zoom. */
+  :root[data-font-size="smaller"] {
+    --buzz-type-scale: calc(13 / 14);
+  }
+
+  :root[data-font-size="larger"] {
+    --buzz-type-scale: calc(15 / 14);
+  }
+
   :root[data-conversation-density="compact"] {
     --conversation-body-gap: 0rem;
     --conversation-row-padding-block: 0.25rem;
diff --git a/desktop/src/shared/ui/VideoReviewCommentMarkdown.tsx b/desktop/src/shared/ui/VideoReviewCommentMarkdown.tsx
index d1a08151239..309ceb1152e 100644
--- a/desktop/src/shared/ui/VideoReviewCommentMarkdown.tsx
+++ b/desktop/src/shared/ui/VideoReviewCommentMarkdown.tsx
@@ -9,10 +9,7 @@ import {
   VideoReviewTimecodeChip,
 } from "@/shared/ui/VideoReviewTimecodeButton";
 
-type VideoReviewCommentMarkdownProps = Omit<
-  MarkdownProps,
-  "leadingInlineContent"
-> & {
+type VideoReviewCommentMarkdownProps = MarkdownProps & {
   videoReviewCommentRootId?: string;
 };
 
@@ -20,6 +17,7 @@ type VideoReviewCommentMarkdownProps = Omit<
 export function VideoReviewCommentMarkdown({
   content,
   interactive = true,
+  leadingInlineContent: suppliedLeadingInlineContent,
   videoReviewCommentRootId,
   ...markdownProps
 }: VideoReviewCommentMarkdownProps) {
@@ -38,7 +36,7 @@ export function VideoReviewCommentMarkdown({
     [openVideoReviewAt, reviewTimecode, videoReviewCommentRootId],
   );
   const leadingInlineContent = React.useMemo(() => {
-    if (!reviewTimecode) return undefined;
+    if (!reviewTimecode) return suppliedLeadingInlineContent;
 
     const timecode =
       interactive && openVideoReviewAt ? (
@@ -53,23 +51,24 @@ export function VideoReviewCommentMarkdown({
           timecode={reviewTimecode.timecode}
         />
       );
-    return <>{timecode} </>;
-  }, [handleTimecodeClick, interactive, openVideoReviewAt, reviewTimecode]);
-
-  if (!reviewTimecode) {
     return (
-      <Markdown
-        {...markdownProps}
-        content={content}
-        interactive={interactive}
-      />
+      <>
+        {suppliedLeadingInlineContent}
+        {timecode}{" "}
+      </>
     );
-  }
+  }, [
+    handleTimecodeClick,
+    interactive,
+    openVideoReviewAt,
+    reviewTimecode,
+    suppliedLeadingInlineContent,
+  ]);
 
   return (
     <Markdown
       {...markdownProps}
-      content={reviewTimecode.text || "\u200B"}
+      content={reviewTimecode ? reviewTimecode.text || "\u200B" : content}
       interactive={interactive}
       leadingInlineContent={leadingInlineContent}
     />
diff --git a/desktop/src/shared/ui/markdown.test.mjs b/desktop/src/shared/ui/markdown.test.mjs
index f84babddd28..8136ff9f08e 100644
--- a/desktop/src/shared/ui/markdown.test.mjs
+++ b/desktop/src/shared/ui/markdown.test.mjs
@@ -1243,17 +1243,21 @@ test("authored Buzz permalink labels remain ordinary links", () => {
   });
   const html = renderToStaticMarkup(
     React.createElement(
-      MarkdownRuntimeContext.Provider,
-      {
-        value: {
-          channels: [{ id: channelId, name: "engineering" }],
-          onOpenChannel: () => {},
-          onOpenEntityLink: () => {},
-          onOpenMessageLink: () => {},
-          relayOrigin: null,
+      QueryClientProvider,
+      { client: new QueryClient() },
+      React.createElement(
+        MarkdownRuntimeContext.Provider,
+        {
+          value: {
+            channels: [{ id: channelId, name: "engineering" }],
+            onOpenChannel: () => {},
+            onOpenEntityLink: () => {},
+            onOpenMessageLink: () => {},
+            relayOrigin: null,
+          },
         },
-      },
-      markdown,
+        markdown,
+      ),
     ),
   );
 
diff --git a/desktop/src/shared/ui/markdown.tsx b/desktop/src/shared/ui/markdown.tsx
index 3810e2cc626..adb525ae74e 100644
--- a/desktop/src/shared/ui/markdown.tsx
+++ b/desktop/src/shared/ui/markdown.tsx
@@ -48,18 +48,14 @@ import {
   isImageOnlyParagraph,
   markdownPropsAreEqual,
 } from "./markdownUtils";
+import { ImageMosaic } from "./markdown/ImageMosaic";
 import {
   CODE_BLOCK_CLASS,
   extractLanguage,
   MarkdownCodeBlock,
   SyntaxHighlightedCode,
 } from "./markdown/CodeBlock";
-import {
-  EntityLinkAnchor,
-  renderEntityLinkAnchor,
-  useEntityCardOpenHandlers,
-  useOpenEntityLink,
-} from "./markdown/entityLinks";
+import { EntityLinkAnchor, useOpenEntityLink } from "./markdown/entityLinks";
 import { ExternalLinkAnchor } from "./markdown/ExternalLinkAnchor";
 import { FileCard } from "./markdown/FileCard";
 import {
@@ -1233,33 +1229,10 @@ function ImageBlock({ alt, dim, resolvedSrc, src, thumbSrc }: ImageBlockProps) {
   );
 }
 
-function ImageMosaic({ children }: { children: React.ReactNode[] }) {
-  const mosaicRef = React.useRef<HTMLDivElement | null>(null);
-  const isTriptych = children.length === 3;
-  const hasOddTail = children.length > 3 && children.length % 2 === 1;
-  useSmoothCorners(mosaicRef);
-
-  return (
-    <div
-      className={cn(
-        "mt-1 grid w-full min-w-0 max-w-lg grid-cols-2 gap-1.5 overflow-hidden rounded-2xl [&_br]:hidden [&_[data-block-media]]:min-h-0 [&_[data-block-media]]:max-w-none [&_[data-block-media]]:overflow-hidden [&_[data-block-media]>button]:m-0 [&_[data-block-media]>button]:h-full [&_[data-block-media]>button]:w-full [&_[data-block-media]>button]:max-w-none [&_[data-block-media]>button]:rounded-none [&_[data-block-media]_[data-progressive-image-frame]]:!h-full [&_[data-block-media]_[data-progressive-image-frame]]:!w-full [&_[data-block-media]_img]:!h-full [&_[data-block-media]_img]:!max-h-none [&_[data-block-media]_img]:!w-full [&_[data-block-media]_img]:!max-w-none [&_[data-block-media]_img]:rounded-none [&_[data-block-media]_img]:object-cover",
-        isTriptych
-          ? "h-80 grid-rows-2 [&_[data-block-media]]:h-auto [&_[data-block-media]:first-child]:row-span-2"
-          : "[&_[data-block-media]]:h-48",
-        hasOddTail && "[&_[data-block-media]:last-child]:col-span-2",
-      )}
-      data-image-mosaic=""
-      data-image-mosaic-count={children.length}
-      ref={mosaicRef}
-    >
-      {children}
-    </div>
-  );
-}
-
 export function createMarkdownComponents(
   interactive = true,
   mediaInset = false,
+  blockCode = false,
 ): Components {
   const listItemClassName = "[&_p]:inline";
   const listClassName = "space-y-1 pl-6 marker:text-muted-foreground/80";
@@ -1374,17 +1347,28 @@ export function createMarkdownComponents(
       // Malformed message deep links fall through to external handling.
     }
 
-    // `buzz://pr|issue|repo?…` entity links navigate in-app; malformed ones
-    // fall through to the default anchor.
-    const entityAnchor = renderEntityLinkAnchor({
-      children,
-      href,
-      onOpenEntityLink,
-      relayOrigin,
-      interactive,
-      asChip: label === href,
-    });
-    if (entityAnchor) return entityAnchor;
+    // `buzz://pr|issue|repo|project?…` entity links navigate in-app;
+    // malformed ones fall through to the default anchor. The provider-backed
+    // component keeps metadata tooltips available for both raw chips and
+    // authored Markdown labels.
+    if (href) {
+      const entityAnchor = React.createElement(
+        EntityLinkAnchor,
+        {
+          href,
+          onOpenEntityLink,
+          relayOrigin,
+          interactive,
+          asChip: label === href,
+        },
+        children,
+      );
+      if (
+        parseEntityLink(href).ok ||
+        parseSupportedLinkPreview(href, relayOrigin)?.href.startsWith("buzz://")
+      )
+        return entityAnchor;
+    }
 
     const supportedLinkPreview = href
       ? parseSupportedLinkPreview(href, relayOrigin)
@@ -1563,7 +1547,7 @@ export function createMarkdownComponents(
       return <p>{children}</p>;
     },
     pre: ({ children }) => {
-      if (!interactive) return <span>{children}</span>;
+      if (!interactive && !blockCode) return <span>{children}</span>;
       let language = "";
       React.Children.forEach(children, (child) => {
         if (
@@ -1699,9 +1683,9 @@ export function createMarkdownComponents(
 }
 
 /**
- * The component map only varies by the three boolean render flags, so at most
- * eight instances ever exist. Module-stable maps mean cached markdown element
- * trees (see ./markdown/nodeCache.ts) never embed per-mount closures.
+ * The component map only varies by the four boolean render flags, so at most
+ * sixteen instances ever exist. Module-stable maps mean cached markdown
+ * element trees (see ./markdown/nodeCache.ts) never embed per-mount closures.
  */
 const MARKDOWN_COMPONENT_SCHEMA_VERSION = "8";
 const markdownComponentsByVariant = new Map<string, MarkdownComponentSet>();
@@ -1719,12 +1703,13 @@ function getMarkdownComponents(
   interactive: boolean,
   leadingInlineContent: boolean,
   mediaInset: boolean,
+  blockCode: boolean,
 ): MarkdownComponentSet {
-  const variant = `${MARKDOWN_COMPONENT_SCHEMA_VERSION}:${interactive ? "i" : ""}${leadingInlineContent ? "l" : ""}${mediaInset ? "m" : ""}`;
+  const variant = `${MARKDOWN_COMPONENT_SCHEMA_VERSION}:${interactive ? "i" : ""}${leadingInlineContent ? "l" : ""}${mediaInset ? "m" : ""}${blockCode ? "c" : ""}`;
   let entry = markdownComponentsByVariant.get(variant);
   if (!entry) {
     entry = {
-      components: createMarkdownComponents(interactive, mediaInset),
+      components: createMarkdownComponents(interactive, mediaInset, blockCode),
       variant,
     };
     markdownComponentsByVariant.set(variant, entry);
@@ -1741,6 +1726,7 @@ function MarkdownInner({
   hardLineBreaks = true,
   imetaByUrl,
   interactive = true,
+  blockCode = false,
   agentMentionPubkeysByName,
   leadingInlineContent,
   mediaInset = false,
@@ -1844,11 +1830,6 @@ function MarkdownInner({
     processedContent = `${processedContent}\u200B`;
   }
 
-  const entityCardOpenHandlers = useEntityCardOpenHandlers(
-    resolvedLinkPreviews,
-    onOpenEntityLink,
-  );
-
   // When a config-nudge suppresses the prose (selectProseOrNudge returns
   // null), skip the parse entirely — it would be thrown away unrendered.
   const hasLeadingInlineContent = leadingInlineContent != null;
@@ -1856,6 +1837,7 @@ function MarkdownInner({
     interactive,
     hasLeadingInlineContent,
     mediaInset,
+    blockCode,
   );
   const markdownNode =
     configNudge === null
@@ -1908,7 +1890,6 @@ function MarkdownInner({
           <LinkPreviewList
             ImageLightbox={LinkPreviewImageLightbox}
             key={messageId}
-            onOpenByHref={entityCardOpenHandlers}
             onRemoveForEveryone={onRemoveLinkPreviewsForEveryone}
             previews={resolvedLinkPreviews}
           />
diff --git a/desktop/src/shared/ui/markdown/ChannelDeepLink.test.mjs b/desktop/src/shared/ui/markdown/ChannelDeepLink.test.mjs
index 75858a10fe8..5491c93d814 100644
--- a/desktop/src/shared/ui/markdown/ChannelDeepLink.test.mjs
+++ b/desktop/src/shared/ui/markdown/ChannelDeepLink.test.mjs
@@ -32,3 +32,14 @@ test("channelTooltipFooter adds archived status without changing existing metada
     "Private channel · Forum",
   );
 });
+
+test("channelTooltipFooter uses just now for activity within a minute", () => {
+  assert.equal(
+    channelTooltipFooter({
+      ...channel,
+      archivedAt: null,
+      lastMessageAt: new Date().toISOString(),
+    }),
+    "Private channel · Forum · Active just now",
+  );
+});
diff --git a/desktop/src/shared/ui/markdown/ImageMosaic.tsx b/desktop/src/shared/ui/markdown/ImageMosaic.tsx
new file mode 100644
index 00000000000..d45fdf97440
--- /dev/null
+++ b/desktop/src/shared/ui/markdown/ImageMosaic.tsx
@@ -0,0 +1,28 @@
+import React from "react";
+import { cn } from "@/shared/lib/cn";
+import { useSmoothCorners } from "@/shared/ui/smoothCorners";
+
+/** Grid layout for messages that contain multiple standalone images. */
+export function ImageMosaic({ children }: { children: React.ReactNode[] }) {
+  const mosaicRef = React.useRef<HTMLDivElement | null>(null);
+  const isTriptych = children.length === 3;
+  const hasOddTail = children.length > 3 && children.length % 2 === 1;
+  useSmoothCorners(mosaicRef);
+
+  return (
+    <div
+      className={cn(
+        "mt-1 grid w-full min-w-0 max-w-lg grid-cols-2 gap-1.5 overflow-hidden rounded-2xl [&_br]:hidden [&_[data-block-media]]:min-h-0 [&_[data-block-media]]:max-w-none [&_[data-block-media]]:overflow-hidden [&_[data-block-media]>button]:m-0 [&_[data-block-media]>button]:h-full [&_[data-block-media]>button]:w-full [&_[data-block-media]>button]:max-w-none [&_[data-block-media]>button]:rounded-none [&_[data-block-media]_[data-progressive-image-frame]]:!h-full [&_[data-block-media]_[data-progressive-image-frame]]:!w-full [&_[data-block-media]_img]:!h-full [&_[data-block-media]_img]:!max-h-none [&_[data-block-media]_img]:!w-full [&_[data-block-media]_img]:!max-w-none [&_[data-block-media]_img]:rounded-none [&_[data-block-media]_img]:object-cover",
+        isTriptych
+          ? "h-80 grid-rows-2 [&_[data-block-media]]:h-auto [&_[data-block-media]:first-child]:row-span-2"
+          : "[&_[data-block-media]]:h-48",
+        hasOddTail && "[&_[data-block-media]:last-child]:col-span-2",
+      )}
+      data-image-mosaic=""
+      data-image-mosaic-count={children.length}
+      ref={mosaicRef}
+    >
+      {children}
+    </div>
+  );
+}
diff --git a/desktop/src/shared/ui/markdown/entityLinks.tsx b/desktop/src/shared/ui/markdown/entityLinks.tsx
index 29f4ef69a33..4c86dbe5072 100644
--- a/desktop/src/shared/ui/markdown/entityLinks.tsx
+++ b/desktop/src/shared/ui/markdown/entityLinks.tsx
@@ -9,10 +9,7 @@ import {
   parseEntityLink,
   type ParsedEntityLink,
 } from "@/shared/lib/entityLink";
-import {
-  parseSupportedLinkPreview,
-  type SupportedLinkPreview,
-} from "@/shared/lib/linkPreview";
+import { parseSupportedLinkPreview } from "@/shared/lib/linkPreview";
 
 import {
   loadBuzzEntityMetadata,
@@ -193,27 +190,6 @@ export function useOpenEntityLink(): (link: ParsedEntityLink) => void {
   );
 }
 
-/**
- * In-app open handlers for `buzz://` entity preview cards, keyed by href.
- * External cards get no handler and keep their OS-opened anchor.
- */
-export function useEntityCardOpenHandlers(
-  previews: SupportedLinkPreview[],
-  onOpenEntityLink: (link: ParsedEntityLink) => void,
-): Map<string, () => void> {
-  return React.useMemo(() => {
-    const handlers = new Map<string, () => void>();
-    for (const preview of previews) {
-      if (!isEntityLink(preview.href)) continue;
-      const parsed = parseEntityLink(preview.href);
-      if (parsed.ok) {
-        handlers.set(preview.href, () => onOpenEntityLink(parsed.value));
-      }
-    }
-    return handlers;
-  }, [onOpenEntityLink, previews]);
-}
-
 /**
  * Resolve an anchor href to a canonical `buzz://` entity link, accepting
  * both the deep-link scheme directly and HTTPS relay clone URLs (which the
@@ -253,7 +229,7 @@ export function EntityLinkAnchor({
   interactive?: boolean;
   asChip?: boolean;
 }): React.ReactElement | null {
-  const { data: projects } = useProjectsQuery();
+  const { data: projects } = useProjectsQuery(interactive);
   return renderEntityLinkAnchor({
     children,
     href,
@@ -296,18 +272,38 @@ export function renderEntityLinkAnchor({
   if (!parsed.ok) return null;
   const presentation = entityLinkPresentation(parsed.value);
 
-  if (!asChip) {
+  const inlineLink = (metadata?: LinkPreviewMetadata | null) => {
+    const resolvedContext = metadata?.title.trim();
+    const ariaLabel = resolvedContext
+      ? `${presentation.ariaLabel}: ${resolvedContext}`
+      : presentation.ariaLabel;
     return (
       <BuzzInlineLink
         href={href}
         title={href}
-        aria-label={presentation.ariaLabel}
+        aria-label={ariaLabel}
         interactive={interactive}
         onOpenLink={() => onOpenEntityLink(parsed.value)}
       >
         {children}
       </BuzzInlineLink>
     );
+  };
+
+  if (!asChip) {
+    return interactive ? (
+      <EntityMetadataTooltip
+        fallback={presentation.label}
+        footer={presentation.tooltipFooter}
+        href={canonicalHref}
+        link={parsed.value}
+        projects={projects}
+      >
+        {inlineLink}
+      </EntityMetadataTooltip>
+    ) : (
+      inlineLink()
+    );
   }
 
   const chip = (metadata?: LinkPreviewMetadata | null) => {
diff --git a/desktop/src/shared/ui/markdown/types.ts b/desktop/src/shared/ui/markdown/types.ts
index 9a684de764a..3404c2ab170 100644
--- a/desktop/src/shared/ui/markdown/types.ts
+++ b/desktop/src/shared/ui/markdown/types.ts
@@ -82,6 +82,13 @@ export type MarkdownProps = {
   hardLineBreaks?: boolean;
   imetaByUrl?: ImetaLookup;
   interactive?: boolean;
+  /**
+   * Render fenced code as scrollable code blocks even when `interactive` is
+   * false. Non-interactive surfaces default to inlining code (compact
+   * previews); document surfaces like repository READMEs pass true so long
+   * lines scroll inside the block instead of stretching the layout.
+   */
+  blockCode?: boolean;
   agentMentionPubkeysByName?: Record<string, string>;
   mentionNames?: string[];
   mentionPubkeysByName?: Record<string, string>;
diff --git a/desktop/src/shared/ui/markdown/useMessageLinkPreviews.test.mjs b/desktop/src/shared/ui/markdown/useMessageLinkPreviews.test.mjs
index a4f5a528ec9..d6e58456060 100644
--- a/desktop/src/shared/ui/markdown/useMessageLinkPreviews.test.mjs
+++ b/desktop/src/shared/ui/markdown/useMessageLinkPreviews.test.mjs
@@ -27,7 +27,7 @@ function snapshotTag(href, title, siteName) {
   ];
 }
 
-test("relay-resolved Buzz entities beat conflicting sender snapshots in content order", () => {
+test("Buzz entity links do not create message preview cards", () => {
   const content = `${ENTITY_HREF} then ${EXTERNAL_HREF}`;
   const candidates = extractSupportedLinkPreviews(content, RELAY_ORIGIN);
   const snapshots = parseLinkPreviewSnapshots(
@@ -38,22 +38,12 @@ test("relay-resolved Buzz entities beat conflicting sender snapshots in content
     content,
     RELAY_ORIGIN,
   );
-  const entity = {
-    ...candidates[0],
-    title: "Relay-authenticated PR title",
-    imageState: "none",
-  };
 
   assert.deepEqual(
-    mergeMessageLinkPreviews(candidates, snapshots, [entity]).map(
+    mergeMessageLinkPreviews(candidates, snapshots).map(
       ({ href, title, provider }) => ({ href, title, provider }),
     ),
     [
-      {
-        href: ENTITY_HREF,
-        title: "Relay-authenticated PR title",
-        provider: "Buzz",
-      },
       {
         href: EXTERNAL_HREF,
         title: "External story",
diff --git a/desktop/src/shared/ui/markdown/useMessageLinkPreviews.ts b/desktop/src/shared/ui/markdown/useMessageLinkPreviews.ts
index 0f76412a0df..00b1e2f9621 100644
--- a/desktop/src/shared/ui/markdown/useMessageLinkPreviews.ts
+++ b/desktop/src/shared/ui/markdown/useMessageLinkPreviews.ts
@@ -5,12 +5,7 @@ import {
   type SupportedLinkPreview,
 } from "@/shared/lib/linkPreview";
 import { parseLinkPreviewSnapshots } from "@/shared/lib/linkPreviewSnapshot";
-import {
-  isBuzzEntityPreview,
-  type ResolvedLinkPreview,
-  useResolvedLinkPreviews,
-  withEntityFallbacks,
-} from "@/shared/lib/useResolvedLinkPreviews";
+import type { ResolvedLinkPreview } from "@/shared/lib/useResolvedLinkPreviews";
 
 /**
  * Resolve the link-preview cards for a rendered message.
@@ -18,33 +13,19 @@ import {
  * External URLs render exclusively from sender-authored
  * `["link-preview","snapshot",…]` tags (`parseLinkPreviewSnapshots`) — the
  * privacy model shipped in the rich-link-previews work: recipients never
- * contact external sites.
- *
- * `buzz://pr|issue|repo` entity links (and relay clone URLs, which normalize
- * onto `buzz://repo`) are the exception and are rendered recipient-side:
- * their metadata comes from the community relay itself via the entity metadata
- * loader, so the sender-snapshot privacy model does not apply — and senders
- * (CLI, agents, mobile) attach no snapshot tags for them. Recognized entity
- * cards win
- * over conflicting sender snapshots, and cards retain their first-seen order in
- * the message.
+ * contact external sites. Buzz-native entity links render as inline links or
+ * chips with relay-backed metadata tooltips, not as standalone cards.
  */
 export function mergeMessageLinkPreviews(
   candidates: SupportedLinkPreview[],
   snapshots: ResolvedLinkPreview[],
-  entities: ResolvedLinkPreview[],
 ): ResolvedLinkPreview[] {
   const snapshotsByHref = new Map(
     snapshots.map((preview) => [preview.href, preview]),
   );
-  const entitiesByHref = new Map(
-    entities.map((preview) => [preview.href, preview]),
-  );
 
   return candidates.flatMap((candidate) => {
-    const preview = isBuzzEntityPreview(candidate)
-      ? entitiesByHref.get(candidate.href)
-      : snapshotsByHref.get(candidate.href);
+    const preview = snapshotsByHref.get(candidate.href);
     return preview ? [preview] : [];
   });
 }
@@ -69,27 +50,12 @@ export function useMessageLinkPreviews({
         : [],
     [content, interactive, linkPreviewsSuppressed, relayOrigin],
   );
-  const entityLinkPreviews = React.useMemo(
-    () => linkPreviewCandidates.filter(isBuzzEntityPreview),
-    [linkPreviewCandidates],
-  );
-  const relayResolvedEntityLinkPreviews =
-    useResolvedLinkPreviews(entityLinkPreviews);
-  const resolvedEntityLinkPreviews = React.useMemo(
-    () =>
-      withEntityFallbacks(entityLinkPreviews, relayResolvedEntityLinkPreviews),
-    [entityLinkPreviews, relayResolvedEntityLinkPreviews],
-  );
   return React.useMemo(() => {
     const snapshots =
       interactive && !linkPreviewsSuppressed
         ? parseLinkPreviewSnapshots(linkPreviewTags, content, relayOrigin)
         : [];
-    return mergeMessageLinkPreviews(
-      linkPreviewCandidates,
-      snapshots,
-      resolvedEntityLinkPreviews,
-    );
+    return mergeMessageLinkPreviews(linkPreviewCandidates, snapshots);
   }, [
     content,
     interactive,
@@ -97,6 +63,5 @@ export function useMessageLinkPreviews({
     linkPreviewTags,
     linkPreviewsSuppressed,
     relayOrigin,
-    resolvedEntityLinkPreviews,
   ]);
 }
diff --git a/desktop/src/shared/ui/markdownUtils.ts b/desktop/src/shared/ui/markdownUtils.ts
index f0ce894c669..992341bacc5 100644
--- a/desktop/src/shared/ui/markdownUtils.ts
+++ b/desktop/src/shared/ui/markdownUtils.ts
@@ -111,6 +111,7 @@ export function markdownPropsAreEqual(
     prev.customEmoji === next.customEmoji &&
     prev.hardLineBreaks === next.hardLineBreaks &&
     prev.interactive === next.interactive &&
+    prev.blockCode === next.blockCode &&
     prev.mediaInset === next.mediaInset &&
     shallowRecordEqual(
       prev.agentMentionPubkeysByName,
diff --git a/desktop/tailwind.config.js b/desktop/tailwind.config.js
index 07d00b0db92..4816b3ddc35 100644
--- a/desktop/tailwind.config.js
+++ b/desktop/tailwind.config.js
@@ -3,9 +3,10 @@ export default {
   theme: {
     extend: {
       // Sub-`text-xs` ramp for meta text (timestamps, count badges, tracking
-      // labels) and tiny glyphs. These follow the virtual typography rem so
-      // preferences and Cmd +/- scale text without changing layout geometry.
-      // Do NOT reintroduce arbitrary `text-[…rem]` / `text-[…px]` literals;
+      // labels) and tiny glyphs. These follow the virtual typography rem
+      // (`--buzz-type-rem` in styles/globals/typography.css), which is
+      // rem-relative: Cmd +/- zooms it with the rest of the layout, and the
+      // Font size preference nudges it alone. Do NOT reintroduce arbitrary `text-[…rem]` / `text-[…px]` literals;
       // the px-text guard rejects them. Stock scale picks up from xs.
       fontSize: {
         "2xs": "calc(var(--buzz-type-rem) * 0.6875)", // 11px at 16px type rem
diff --git a/desktop/tests/e2e/buzz-theme-screenshots.spec.ts b/desktop/tests/e2e/buzz-theme-screenshots.spec.ts
index 408fa851d96..a075c7bd360 100644
--- a/desktop/tests/e2e/buzz-theme-screenshots.spec.ts
+++ b/desktop/tests/e2e/buzz-theme-screenshots.spec.ts
@@ -676,33 +676,43 @@ test("app font size and conversation density apply independently", async ({
   const fontSizeDescription = page
     .getByTestId("font-size-row")
     .locator("[data-settings-subcopy]");
+  // The conversation tokens are rem-relative `calc(...)` expressions (the
+  // type tokens ride on `--buzz-type-rem`, which itself derives from the
+  // root rem so Cmd +/- zooms everything together). Reading the raw custom
+  // property strings off <html> would just return unresolved calc text, so
+  // resolve each token to px through a probe element instead: assign the
+  // token to the probe's font-size and read the computed value back.
+  // font-size is used (rather than width) because its computed value keeps
+  // fractional precision instead of snapping to layout units.
   const readScale = () =>
     root.evaluate((element) => {
-      const style = window.getComputedStyle(element);
-      return {
-        authorLineHeight: Number.parseFloat(
-          style.getPropertyValue("--conversation-author-line-height"),
-        ),
-        bodyGap: Number.parseFloat(
-          style.getPropertyValue("--conversation-body-gap"),
-        ),
-        fontSize: style.getPropertyValue("--conversation-message-font-size"),
-        lineHeight: style.getPropertyValue(
-          "--conversation-message-line-height",
-        ),
-        paragraphGap: Number.parseFloat(
-          style.getPropertyValue("--conversation-paragraph-gap"),
-        ),
-        rowPadding: Number.parseFloat(
-          style.getPropertyValue("--conversation-row-padding-block"),
-        ),
-        timestampFontSize: style.getPropertyValue(
-          "--conversation-timestamp-font-size",
-        ),
-        timestampLineHeight: Number.parseFloat(
-          style.getPropertyValue("--conversation-timestamp-line-height"),
-        ),
+      const PROBE_ID = "buzz-e2e-conversation-scale-probe";
+      const tokens = {
+        authorLineHeight: "--conversation-author-line-height",
+        bodyGap: "--conversation-body-gap",
+        fontSize: "--conversation-message-font-size",
+        lineHeight: "--conversation-message-line-height",
+        paragraphGap: "--conversation-paragraph-gap",
+        rowPadding: "--conversation-row-padding-block",
+        timestampFontSize: "--conversation-timestamp-font-size",
+        timestampLineHeight: "--conversation-timestamp-line-height",
+      } as const;
+      let probe = element.ownerDocument.getElementById(PROBE_ID);
+      if (!probe) {
+        probe = element.ownerDocument.createElement("span");
+        probe.id = PROBE_ID;
+        probe.style.cssText =
+          "position:absolute;left:-9999px;top:0;visibility:hidden;pointer-events:none";
+        element.appendChild(probe);
+      }
+      const resolvePx = (token: string) => {
+        probe.style.fontSize = `var(${token})`;
+        const px = Number.parseFloat(window.getComputedStyle(probe).fontSize);
+        return Math.round(px * 100) / 100;
       };
+      return Object.fromEntries(
+        Object.entries(tokens).map(([key, token]) => [key, resolvePx(token)]),
+      ) as Record<keyof typeof tokens, number>;
     });
   const readSettingsScale = () =>
     page.getByTestId("conversation-density-row").evaluate((element) => {
@@ -753,14 +763,15 @@ test("app font size and conversation density apply independently", async ({
   await expect(fontSizeDescription).toHaveText(
     "Applies across conversations and interface text",
   );
+  // Comfy + Default: 14px conversation text on a 16px root rem.
   await expect.poll(readScale).toEqual({
     authorLineHeight: 16,
-    bodyGap: 0.125,
-    fontSize: "calc(16px * .875)",
-    lineHeight: "calc(16px * 1.25)",
-    paragraphGap: 0.5,
-    rowPadding: 0.25,
-    timestampFontSize: "calc(16px * .75)",
+    bodyGap: 2,
+    fontSize: 14,
+    lineHeight: 20,
+    paragraphGap: 8,
+    rowPadding: 4,
+    timestampFontSize: 12,
     timestampLineHeight: 16,
   });
   await expect
@@ -876,14 +887,15 @@ test("app font size and conversation density apply independently", async ({
       ),
     )
     .toBe("compact");
+  // Compact only tightens spacing; type is untouched.
   await expect.poll(readScale).toEqual({
     authorLineHeight: 16,
     bodyGap: 0,
-    fontSize: "calc(16px * .875)",
-    lineHeight: "calc(16px * 1.25)",
-    paragraphGap: 0.375,
-    rowPadding: 0.25,
-    timestampFontSize: "calc(16px * .75)",
+    fontSize: 14,
+    lineHeight: 20,
+    paragraphGap: 6,
+    rowPadding: 4,
+    timestampFontSize: 12,
     timestampLineHeight: 16,
   });
   await expect.poll(readSettingsScale).toEqual({
@@ -907,15 +919,16 @@ test("app font size and conversation density apply independently", async ({
       ),
     )
     .toBe("larger");
+  // Larger scales only the type tokens (15/14); compact spacing is unchanged.
   await expect.poll(readScale).toEqual({
-    authorLineHeight: 17.142857,
+    authorLineHeight: 17.14,
     bodyGap: 0,
-    fontSize: "calc(17.142857px * .875)",
-    lineHeight: "calc(17.142857px * 1.25)",
-    paragraphGap: 0.375,
-    rowPadding: 0.25,
-    timestampFontSize: "calc(17.142857px * .75)",
-    timestampLineHeight: 17.142857,
+    fontSize: 15,
+    lineHeight: 21.43,
+    paragraphGap: 6,
+    rowPadding: 4,
+    timestampFontSize: 12.86,
+    timestampLineHeight: 17.14,
   });
   await expect
     .poll(() =>
@@ -946,15 +959,16 @@ test("app font size and conversation density apply independently", async ({
   await expect(root).toHaveAttribute("data-conversation-density", "spacious");
   await expect(root).toHaveAttribute("data-font-size", "larger");
   await expect(spacious).toHaveAttribute("aria-pressed", "true");
+  // Spacious loosens spacing only; Larger type carries over.
   await expect.poll(readScale).toEqual({
-    authorLineHeight: 17.142857,
-    bodyGap: 0.25,
-    fontSize: "calc(17.142857px * .875)",
-    lineHeight: "calc(17.142857px * 1.25)",
-    paragraphGap: 0.625,
-    rowPadding: 0.5,
-    timestampFontSize: "calc(17.142857px * .75)",
-    timestampLineHeight: 17.142857,
+    authorLineHeight: 17.14,
+    bodyGap: 4,
+    fontSize: 15,
+    lineHeight: 21.43,
+    paragraphGap: 10,
+    rowPadding: 8,
+    timestampFontSize: 12.86,
+    timestampLineHeight: 17.14,
   });
   await expect.poll(readSettingsScale).toEqual({
     fontSize: "15px",
@@ -973,15 +987,16 @@ test("app font size and conversation density apply independently", async ({
   await expect(root).toHaveAttribute("data-conversation-density", "spacious");
   await expect(root).toHaveAttribute("data-font-size", "smaller");
   await expect(smaller).toHaveAttribute("aria-pressed", "true");
+  // Smaller scales only the type tokens (13/14); spacious spacing is unchanged.
   await expect.poll(readScale).toEqual({
-    authorLineHeight: 14.857143,
-    bodyGap: 0.25,
-    fontSize: "calc(14.857143px * .875)",
-    lineHeight: "calc(14.857143px * 1.25)",
-    paragraphGap: 0.625,
-    rowPadding: 0.5,
-    timestampFontSize: "calc(14.857143px * .75)",
-    timestampLineHeight: 14.857143,
+    authorLineHeight: 14.86,
+    bodyGap: 4,
+    fontSize: 13,
+    lineHeight: 18.57,
+    paragraphGap: 10,
+    rowPadding: 8,
+    timestampFontSize: 11.14,
+    timestampLineHeight: 14.86,
   });
   await expect
     .poll(() =>
@@ -1044,14 +1059,15 @@ test("app font size and conversation density apply independently", async ({
       ),
     )
     .toBe("comfortable");
+  // Back to Default type while the drag previews spacious spacing.
   await expect.poll(readScale).toEqual({
     authorLineHeight: 16,
-    bodyGap: 0.25,
-    fontSize: "calc(16px * .875)",
-    lineHeight: "calc(16px * 1.25)",
-    paragraphGap: 0.625,
-    rowPadding: 0.5,
-    timestampFontSize: "calc(16px * .75)",
+    bodyGap: 4,
+    fontSize: 14,
+    lineHeight: 20,
+    paragraphGap: 10,
+    rowPadding: 8,
+    timestampFontSize: 12,
     timestampLineHeight: 16,
   });
   await expect.poll(readSettingsScale).toEqual({
diff --git a/desktop/tests/e2e/channels.spec.ts b/desktop/tests/e2e/channels.spec.ts
index 8a32a436c32..52d91dea3ed 100644
--- a/desktop/tests/e2e/channels.spec.ts
+++ b/desktop/tests/e2e/channels.spec.ts
@@ -1746,8 +1746,15 @@ test("empty channel shows intro actions", async ({ page }) => {
   await expect(
     page.getByTestId("channel-intro-action-create-channel"),
   ).toHaveCount(0);
+  const addAgentsAction = page.getByTestId("channel-intro-action-create-agent");
+  await expect(addAgentsAction).toBeVisible();
   await expect(
-    page.getByTestId("channel-intro-action-create-agent"),
+    addAgentsAction.getByText("Add agents", { exact: true }),
+  ).toBeVisible();
+  await expect(
+    addAgentsAction.getByText("Bring them in.", {
+      exact: true,
+    }),
   ).toBeVisible();
   await expect(
     page.getByTestId("channel-intro-action-add-people"),
@@ -1767,7 +1774,7 @@ test("empty channel shows intro actions", async ({ page }) => {
   await page.keyboard.press("Escape");
   await expect(page.getByTestId("members-sidebar")).not.toBeVisible();
 
-  await page.getByTestId("channel-intro-action-create-agent").click();
+  await addAgentsAction.click();
   await expect(page.getByRole("heading", { name: "Add agents" })).toBeVisible();
 
   await page.keyboard.press("Escape");
diff --git a/desktop/tests/e2e/dm-double-notification.spec.ts b/desktop/tests/e2e/dm-double-notification.spec.ts
index 0678fff9131..3bab0fbd632 100644
--- a/desktop/tests/e2e/dm-double-notification.spec.ts
+++ b/desktop/tests/e2e/dm-double-notification.spec.ts
@@ -111,7 +111,7 @@ test("an incoming DM produces exactly one desktop notification", async ({
     `expected exactly one notification for a single DM, got: ${JSON.stringify(notifications)}`,
   ).toHaveLength(1);
 
-  // The survivor must be the live WebSocket DM toast (titled with the DM
-  // channel name), not the home-feed mention duplicate ("… mentioned you in …").
-  expect(notifications[0].title).toBe("alice-tyler");
+  // The survivor must be the live WebSocket DM toast (titled with the
+  // sender name), not the home-feed mention duplicate ("… mentioned you in …").
+  expect(notifications[0].title).toBe("alice");
 });
diff --git a/desktop/tests/e2e/empty-edit-delete.spec.ts b/desktop/tests/e2e/empty-edit-delete.spec.ts
index 2d8149966ff..3c4fec68044 100644
--- a/desktop/tests/e2e/empty-edit-delete.spec.ts
+++ b/desktop/tests/e2e/empty-edit-delete.spec.ts
@@ -6,7 +6,6 @@ import { installMockBridge } from "../helpers/bridge";
 // DEFAULT_MOCK_IDENTITY.pubkey in e2eBridge.ts). Editing/deleting one's own
 // message is exactly Sam's workflow: "delete a message by clearing its edit."
 const OWN_MESSAGE_ID = "mock-general-welcome";
-const ORIGINAL_CONTENT = "Welcome to #general";
 const RENDERED_ORIGINAL_CONTENT = "Welcome to general";
 
 // Open the more-actions menu for a message row and wait for the menu to mount.
diff --git a/desktop/tests/e2e/entity-link-recipient-cards.spec.ts b/desktop/tests/e2e/entity-link-recipient-cards.spec.ts
index 5f8eb5793dd..056b059b0e7 100644
--- a/desktop/tests/e2e/entity-link-recipient-cards.spec.ts
+++ b/desktop/tests/e2e/entity-link-recipient-cards.spec.ts
@@ -1,16 +1,17 @@
 import { expect, test } from "@playwright/test";
 
 import { waitForAnimations } from "../helpers/animations";
-import { installMockBridge, TEST_IDENTITIES } from "../helpers/bridge";
+import {
+  installBridge,
+  installMockBridge,
+  TEST_IDENTITIES,
+} from "../helpers/bridge";
 
 const SHOTS = "test-results/entity-link-recipient-cards";
 
-// Regression coverage for buzz:// entity links posted WITHOUT sender
-// snapshot tags (CLI / agent senders): #3818 moved external-link previews to
-// sender-authored snapshots, which silently killed the recipient-side
-// buzz://pr|issue|repo cards from #4695. These cards resolve their titles
-// from the active relay itself, so they must render for recipients even when
-// the message carries no link-preview tags.
+// Regression coverage for Buzz-native entity links after standalone cards were
+// removed. Raw and authored entity links keep their inline navigation and
+// relay-backed metadata tooltips, while external sender snapshots still render.
 
 const ALICE_PUBKEY = TEST_IDENTITIES.alice.pubkey;
 const DEFAULT_MOCK_PUBKEY = "deadbeef".repeat(8);
@@ -20,8 +21,11 @@ const PR_SUBJECT = "Restore recipient-side entity cards";
 const ISSUE_ID = `f0${"1a2b".repeat(15)}ee`; // 64-hex event id
 const ISSUE_SUBJECT =
   "Smoke test: issue tracking on relay-tools with a deliberately long title";
+const EXTERNAL_HREF = "https://example.com/entity-chip-control";
+const RELAY_ORIGIN = "http://localhost:3000";
+const CLONE_HREF = `${RELAY_ORIGIN}/git/${ALICE_PUBKEY}/relay-tools.git`;
 
-test("agent-style message with angle-bracket buzz:// links renders entity cards without snapshot tags", async ({
+test("agent-style Buzz links stay chip-only with metadata tooltips", async ({
   page,
 }) => {
   await page.addInitScript(
@@ -75,7 +79,7 @@ test("agent-style message with angle-bracket buzz:// links renders entity cards
   // Simulate an agent/CLI sender: plain kind-9 message with angle-bracket
   // buzz:// URLs in a Markdown list and NO link-preview snapshot tags.
   await page.evaluate(
-    ({ prId, issueId, alicePubkey }) => {
+    ({ prId, issueId, alicePubkey, externalHref, cloneHref }) => {
       window.__BUZZ_E2E_EMIT_MOCK_MESSAGE__?.({
         channelName: "general",
         pubkey: alicePubkey,
@@ -85,11 +89,35 @@ test("agent-style message with angle-bracket buzz:// links renders entity cards
           `- Pull request with enough leading context to wrap: <buzz://pr?id=${prId}&owner=${alicePubkey}&d=relay-tools>`,
           `- Issue: <buzz://issue?id=${issueId}&owner=${alicePubkey}&d=relay-tools>`,
           `- Repository: <buzz://repo?owner=${alicePubkey}&d=relay-tools>`,
+          `- Labeled issue: [triage this issue](buzz://issue?id=${issueId}&owner=${alicePubkey}&d=relay-tools)`,
+          `- Labeled clone: [clone relay-tools](${cloneHref})`,
           `- Missing repo: <buzz://repo?owner=${alicePubkey}&d=missing-repo>`,
+          `- External control: <${externalHref}>`,
         ].join("\n"),
+        extraTags: [
+          [
+            "link-preview",
+            "snapshot",
+            "1",
+            externalHref,
+            "External preview survives",
+            "Example",
+            "Sender-authored external metadata",
+            "",
+            "",
+            "",
+            "",
+          ],
+        ],
       });
     },
-    { prId: PR_ID, issueId: ISSUE_ID, alicePubkey: ALICE_PUBKEY },
+    {
+      prId: PR_ID,
+      issueId: ISSUE_ID,
+      alicePubkey: ALICE_PUBKEY,
+      externalHref: EXTERNAL_HREF,
+      cloneHref: CLONE_HREF,
+    },
   );
 
   const row = page
@@ -98,22 +126,10 @@ test("agent-style message with angle-bracket buzz:// links renders entity cards
     .last();
   await expect(row).toBeVisible();
 
-  // The PR card resolves builder metadata from the signed root and repository.
-  const prCard = row.locator('[data-link-preview="buzz-pull-request"]');
-  await expect(prCard).toBeVisible();
-  await expect(prCard).toContainText("relay-tools");
-  await expect(prCard).toContainText(PR_SUBJECT);
-  await expect(prCard).not.toContainText(
-    "Open · fix/entity-cards → main · abc1230",
-  );
-  await expect(prCard).toHaveAttribute("data-image-state", "none");
-  await expect(prCard.locator("[data-link-preview-thumbnail]")).toHaveCount(0);
-  await expect(
-    prCard.locator("[data-link-preview-hostname-buzz-mark]"),
-  ).toBeVisible();
-  await expect(
-    prCard.locator("[data-link-preview-hostname-favicon]"),
-  ).toHaveCount(0);
+  await expect(row.locator('[data-link-preview^="buzz-"]')).toHaveCount(0);
+  const externalCard = row.locator('[data-link-preview="generic-link"]');
+  await expect(externalCard).toBeVisible();
+  await expect(externalCard).toContainText("External preview survives");
   const prChip = row.getByRole("button", {
     name: /Open pull request .* in repository relay-tools/,
   });
@@ -158,9 +174,7 @@ test("agent-style message with angle-bracket buzz:// links renders entity cards
   expect(tooltipSemanticColors.actual).toEqual(tooltipSemanticColors.expected);
   await expect(prChip).toHaveText("relay-tools");
 
-  const issueChip = row.getByRole("button", {
-    name: /Open issue .* in repository relay-tools/,
-  });
+  const issueChip = row.locator('[data-buzz-link-kind="issue"]');
   // The issue chip is the repository name alone — resolved metadata never
   // reaches the inline label, so it neither absorbs the title nor falls back
   // to the event hash.
@@ -193,29 +207,21 @@ test("agent-style message with angle-bracket buzz:// links renders entity cards
     issueTooltip.locator('[data-buzz-tooltip-metadata-type=""]'),
   ).toHaveText("Issue · relay-tools");
 
-  // The repository card uses its signed announcement metadata and remains
-  // image-less.
-  const repoCard = row
-    .locator('[data-link-preview="buzz-repository"]')
-    .filter({ hasText: "relay-tools" });
-  await expect(repoCard).toBeVisible();
-  await expect(repoCard).toContainText("relay-tools");
-  await expect(repoCard).toContainText(
-    "Operator tooling and admin CLI for relay deployments.",
-  );
-  await expect(repoCard).toContainText("active · default: main");
-  await expect(repoCard).toHaveAttribute("data-image-state", "none");
-  await expect(repoCard.locator("[data-link-preview-thumbnail]")).toHaveCount(
-    0,
-  );
+  const labeledIssue = row
+    .getByRole("button", { name: /Open issue .* in repository relay-tools:/ })
+    .filter({ hasText: "triage this issue" });
+  await expect(labeledIssue).toBeVisible();
+  await labeledIssue.hover();
   await expect(
-    repoCard.locator("[data-link-preview-hostname-buzz-mark]"),
-  ).toBeVisible();
-  await expect(
-    repoCard.locator("[data-link-preview-hostname-favicon]"),
-  ).toHaveCount(0);
+    page
+      .getByRole("tooltip")
+      .locator('[data-buzz-tooltip-metadata-content=""]'),
+  ).toHaveText(ISSUE_SUBJECT);
+
+  // Repository metadata remains available from its inline chip.
   const repoChip = row.getByRole("button", {
     name: "Open repository relay-tools",
+    exact: true,
   });
   await repoChip.hover();
   const repoTooltip = page.getByRole("tooltip");
@@ -225,6 +231,23 @@ test("agent-style message with angle-bracket buzz:// links renders entity cards
   await expect(
     repoTooltip.locator('[data-buzz-tooltip-metadata-type=""]'),
   ).toHaveText("Repository");
+
+  const labeledClone = row
+    .getByRole("button", { name: "Open repository relay-tools" })
+    .filter({ hasText: "clone relay-tools" });
+  await expect(labeledClone).toBeVisible();
+  await expect(labeledClone).toHaveClass(/underline/);
+  await expect(labeledClone).not.toHaveClass(/wrapping-inline-chip/);
+  await expect(labeledClone).toHaveAttribute("title", CLONE_HREF);
+  await labeledClone.hover();
+  const cloneTooltip = page.getByRole("tooltip");
+  await expect(
+    cloneTooltip.locator('[data-buzz-tooltip-metadata-content=""]'),
+  ).toContainText("Operator tooling and admin CLI for relay deployments.");
+  await labeledClone.click();
+  await expect(page.locator("[data-project-detail-screen]")).toBeVisible();
+  await page.getByTestId("channel-general").click();
+
   const missingRepoChip = row.getByRole("button", {
     name: "Open repository missing-repo",
   });
@@ -257,16 +280,11 @@ test("agent-style message with angle-bracket buzz:// links renders entity cards
   await expect(missingRepoFooter).toHaveText("Repository");
   await expect(missingRepoFooter).toHaveClass(/text-secondary-foreground\/80/);
   await expect(missingRepoFooter).not.toHaveClass(/text-primary-foreground/);
-  // Default typography is 14px; keep the image-less card compact while
-  // allowing fractional line-height rounding across rendering platforms.
-  expect(
-    await repoCard.evaluate((card) => card.getBoundingClientRect().height),
-  ).toBeLessThan(90);
 
   await waitForAnimations(page);
   await page.screenshot({
     animations: "disabled",
-    path: `${SHOTS}/01-recipient-entity-cards.png`,
+    path: `${SHOTS}/01-recipient-entity-chips.png`,
   });
 });
 
@@ -384,7 +402,7 @@ test("entity tooltip uses project context while relay metadata is delayed", asyn
   ).toHaveText("buzz · The complete Buzz community platform.");
 });
 
-test("desktop composer shows entity card and send is not blocked by missing snapshot", async ({
+test("desktop composer and sent message keep Buzz entities chip-only", async ({
   page,
 }) => {
   await installMockBridge(page);
@@ -395,35 +413,96 @@ test("desktop composer shows entity card and send is not blocked by missing snap
   const repoLink = `buzz://repo?owner=${ALICE_PUBKEY}&d=relay-tools`;
   await page.getByTestId("message-input").fill(`Check out ${repoLink}`);
 
-  // buzz:// links never produce snapshot tags, so the composer card must
-  // show as done (not stuck "processing") with zero ready snapshots.
-  const composerCard = page
-    .locator("[data-composer-link-previews]")
-    .locator('[data-link-preview="buzz-repository"]');
-  await expect(composerCard).toBeVisible();
-  await expect(page.locator("[data-composer-link-previews]")).toHaveAttribute(
-    "data-ready-snapshot-count",
-    "0",
-  );
+  // Buzz-native links do not enter the standalone composer-preview surface.
+  await expect(page.locator("[data-composer-link-previews]")).toHaveCount(0);
 
   await waitForAnimations(page);
   await page.screenshot({
     animations: "disabled",
-    path: `${SHOTS}/02-composer-entity-card.png`,
+    path: `${SHOTS}/02-composer-entity-chip-only.png`,
   });
 
   await page.getByTestId("send-message").click();
 
   const row = page.getByTestId("message-row").last();
-  const repoCard = row.locator('[data-link-preview="buzz-repository"]');
-  await expect(repoCard).toBeVisible();
-  await expect(repoCard).toContainText("relay-tools");
+  await expect(row.locator('[data-link-preview^="buzz-"]')).toHaveCount(0);
+  const repoChip = row.getByRole("button", {
+    name: "Open repository relay-tools",
+  });
+  await expect(repoChip).toBeVisible();
+  await repoChip.hover();
+  await expect(
+    page
+      .getByRole("tooltip")
+      .locator('[data-buzz-tooltip-metadata-content=""]'),
+  ).toContainText("Operator tooling and admin CLI for relay deployments.");
 
   await waitForAnimations(page);
   await page.screenshot({
     animations: "disabled",
-    path: `${SHOTS}/03-sent-entity-card.png`,
+    path: `${SHOTS}/03-sent-entity-chip-tooltip.png`,
+  });
+});
+
+// The composer and the renderer must classify a same-relay clone URL
+// identically. Both read the active relay origin: without it the composer
+// treats the URL as an external link, shows a loading standalone card, and
+// enters sender-snapshot fetching — a preview the sent message then
+// contradicts by rendering the same URL as a repository chip.
+test("composer classifies a same-relay clone URL as a repository chip, not a card", async ({
+  page,
+}) => {
+  // The default mock relay is http://localhost:3000, and generic external
+  // previews are HTTPS-only — an http clone URL is unclassifiable either way,
+  // so the mismatch cannot appear. Point the bridge at an https relay so the
+  // composer's classification is the only variable.
+  const relayHttpUrl = "https://relay.e2e.example";
+  const cloneHref = `${relayHttpUrl}/git/${DEFAULT_MOCK_PUBKEY}/buzz.git`;
+  await installBridge(page, {
+    mode: "mock",
+    relayHttpUrl,
+    relayWsUrl: relayHttpUrl.replace(/^https/, "wss"),
+    // Serve external metadata so a misclassified clone URL produces a
+    // persistent standalone card rather than a card that loads and then
+    // disappears on a null result — the assertions below would otherwise pass
+    // by racing the loading window instead of by correct classification.
+    mock: {
+      linkPreviewMetadata: {
+        title: "Misclassified as external",
+        siteName: "relay.e2e.example",
+        description: "Sender-snapshot metadata for an external link",
+        imageDataUrl: null,
+        imageDomain: null,
+      },
+    },
   });
+  await page.goto("/", { waitUntil: "domcontentloaded" });
+  await page.getByTestId("channel-general").click();
+
+  await page.getByTestId("message-input").fill(`Clone it: ${cloneHref}`);
+  // Past the composer's 350ms resolution debounce: a same-relay clone URL must
+  // never reach the standalone preview surface, loading card included.
+  await expect(page.locator("[data-composer-link-previews]")).toHaveCount(0);
+  await page.waitForTimeout(600);
+  await expect(page.locator("[data-composer-link-previews]")).toHaveCount(0);
+
+  await page.getByTestId("send-message").click();
+
+  const row = page.getByTestId("message-row").last();
+  await expect(row.locator("[data-link-preview]")).toHaveCount(0);
+  const repoChip = row.getByRole("button", { name: "Open repository buzz" });
+  await expect(repoChip).toBeVisible();
+  await repoChip.hover();
+  await expect(
+    page
+      .getByRole("tooltip")
+      .locator('[data-buzz-tooltip-metadata-content=""]'),
+  ).toContainText("Relay, desktop, and mobile clients");
+
+  // The chip navigates in-app, proving the clone URL resolved onto the
+  // canonical buzz://repo target rather than being handed to the OS.
+  await repoChip.click();
+  await expect(page.locator("[data-project-detail-screen]")).toBeVisible();
 });
 
 test("reopening the same entity link reapplies its workspace state", async ({
diff --git a/desktop/tests/e2e/inbox-refactor-screenshots.spec.ts b/desktop/tests/e2e/inbox-refactor-screenshots.spec.ts
index 8f1f074e277..cc1a8f1e672 100644
--- a/desktop/tests/e2e/inbox-refactor-screenshots.spec.ts
+++ b/desktop/tests/e2e/inbox-refactor-screenshots.spec.ts
@@ -449,9 +449,14 @@ test.describe("inbox refactor screenshots", () => {
           if (!header || !body) {
             throw new Error("Inbox message spacing geometry is missing");
           }
+          // Round to 0.1px: under Cmd +/- zoom the rem gap is fractional and
+          // layout snaps it to 1/64px.
           return (
-            body.getBoundingClientRect().top -
-            header.getBoundingClientRect().bottom
+            Math.round(
+              (body.getBoundingClientRect().top -
+                header.getBoundingClientRect().bottom) *
+                10,
+            ) / 10
           );
         }),
         selectedAuthor.evaluate((element) => {
@@ -558,21 +563,22 @@ test.describe("inbox refactor screenshots", () => {
       );
     });
 
+    // Cmd +/- is a true zoom: the root rem scales, so conversation text AND
+    // the rem-based row padding / body gap grow together (4px → 4.4px,
+    // 2px → 2.2px). Text-only zoom with frozen spacing is the regression
+    // this guards against.
     await expect
       .poll(async () => [
-        await page.evaluate(() =>
-          window
-            .getComputedStyle(document.documentElement)
-            .getPropertyValue("--buzz-type-rem")
-            .trim(),
+        await page.evaluate(
+          () => window.getComputedStyle(document.documentElement).fontSize,
         ),
         ...(await readConversationMetrics()),
       ])
       .toEqual([
         "17.6px",
         { fontSize: "15.4px", lineHeight: "22px" },
-        { paddingBottom: "4px", paddingTop: "4px" },
-        2,
+        { paddingBottom: "4.4px", paddingTop: "4.4px" },
+        2.2,
         { fontSize: "15.4px", lineHeight: "17.6px" },
         { fontSize: "15.4px", lineHeight: "22px" },
         { fontSize: "13.2px", lineHeight: "17.6px" },
diff --git a/desktop/tests/e2e/mentions.spec.ts b/desktop/tests/e2e/mentions.spec.ts
index 820b1f2ab14..25d73b28ca7 100644
--- a/desktop/tests/e2e/mentions.spec.ts
+++ b/desktop/tests/e2e/mentions.spec.ts
@@ -374,8 +374,31 @@ test("duplicate owned agents preserve provenance and exact pubkey selection", as
     `mention-suggestion-${managedPubkey}`,
   );
   const relayRow = dropdown.getByTestId(`mention-suggestion-${relayPubkey}`);
-  await expect(managedRow).toContainText("agent · managed here");
-  await expect(relayRow).toContainText("agent · managed elsewhere");
+  await expect(managedRow).toContainText("agent");
+  await expect(managedRow.getByTestId("mention-agent-provenance")).toHaveCount(
+    0,
+  );
+  await expect(relayRow).toContainText("agent");
+  await expect(
+    relayRow.getByTestId("mention-agent-provenance"),
+  ).toHaveAttribute("aria-label", "From another Buzz setup");
+  await expect(
+    relayRow.getByText("Other setup", { exact: true }),
+  ).toBeVisible();
+  await expect(managedRow).not.toContainText("managed by you");
+  await expect(relayRow).not.toContainText("managed by you");
+
+  await page.setViewportSize({ width: 760, height: 640 });
+  await expect(
+    relayRow.getByText("Other setup", { exact: true }),
+  ).toBeVisible();
+  const rowBox = await relayRow.boundingBox();
+  const dropdownBox = await dropdown.boundingBox();
+  expect(rowBox).not.toBeNull();
+  expect(dropdownBox).not.toBeNull();
+  expect((rowBox?.x ?? 0) + (rowBox?.width ?? 0)).toBeLessThanOrEqual(
+    (dropdownBox?.x ?? 0) + (dropdownBox?.width ?? 0) + 1,
+  );
 
   const collisionKeys = dropdown.getByTestId("mention-collision-npub");
   await expect(collisionKeys).toHaveCount(2);
@@ -385,34 +408,39 @@ test("duplicate owned agents preserve provenance and exact pubkey selection", as
   expect(fullNpubs).toHaveLength(2);
   expect(new Set(fullNpubs).size).toBe(2);
 
-  const initialRows = dropdown.locator("button");
-  const managedIndex = await initialRows.evaluateAll(
-    (buttons, pubkey) =>
-      buttons.findIndex(
-        (button) =>
-          button.getAttribute("data-testid") === `mention-suggestion-${pubkey}`,
-      ),
-    managedPubkey,
-  );
-  expect(managedIndex).toBeGreaterThanOrEqual(0);
-  for (let index = 0; index < managedIndex; index += 1) {
-    await input.press("ArrowDown");
-  }
-  await input.press("Enter");
-  await page.keyboard.type("local");
+  await managedRow
+    .getByRole("button", { name: "Automatically mention carl", exact: true })
+    .click();
+  await expect(
+    page.getByTestId(`composer-address-lock-${managedPubkey}`),
+  ).toBeVisible();
+  await expect(
+    page.getByTestId(`composer-address-lock-${relayPubkey}`),
+  ).toHaveCount(0);
+  await input.fill("local");
   await page.getByTestId("send-message").click();
   await expect
-    .poll(() => readOutgoingMentionPubkeys(page, "@carl local"))
+    .poll(() => readOutgoingMentionPubkeys(page, "local"))
     .toEqual([managedPubkey]);
   await expect(input).toBeEmpty();
 
+  await page.getByTestId(`composer-address-lock-${managedPubkey}`).click();
   await input.fill("@carl");
   const reopenedDropdown = autocomplete(page);
   await expect(reopenedDropdown).toBeVisible();
-  await reopenedDropdown
-    .getByTestId(`mention-suggestion-${relayPubkey}`)
+  const reopenedRelayRow = reopenedDropdown.getByTestId(
+    `mention-suggestion-${relayPubkey}`,
+  );
+  await reopenedRelayRow
+    .getByRole("button", { name: "Automatically mention carl", exact: true })
     .click();
-  await page.keyboard.type("remote");
+  await expect(
+    page.getByTestId(`composer-address-lock-${relayPubkey}`),
+  ).toBeVisible();
+  await expect(
+    page.getByTestId(`composer-address-lock-${managedPubkey}`),
+  ).toHaveCount(0);
+  await input.fill("remote");
   await page.getByTestId("send-message").click();
   const sendWithoutInviting = page.getByRole("button", { name: "Do nothing" });
   try {
@@ -422,8 +450,57 @@ test("duplicate owned agents preserve provenance and exact pubkey selection", as
     // In-channel selections send immediately without opening the prompt.
   }
   await expect
-    .poll(() => readOutgoingMentionPubkeys(page, "@carl remote"))
+    .poll(() => readOutgoingMentionPubkeys(page, "remote"))
     .toEqual([relayPubkey]);
+
+  await page.getByTestId("channel-members-trigger").click();
+  const remoteSidebarMarker = page.getByTestId(
+    `sidebar-member-agent-provenance-${relayPubkey}`,
+  );
+  await expect(
+    page.getByTestId(`sidebar-member-agent-provenance-${managedPubkey}`),
+  ).toHaveCount(0);
+  await expect(remoteSidebarMarker).toHaveAttribute(
+    "aria-label",
+    "From another Buzz setup",
+  );
+  await expect(remoteSidebarMarker).toHaveText("Other setup");
+  const remoteSidebarRow = page.getByTestId(`sidebar-member-${relayPubkey}`);
+  const localSidebarMarker = page.getByTestId(
+    `sidebar-member-agent-provenance-${managedPubkey}`,
+  );
+  const markerRemainsVisible = () =>
+    remoteSidebarMarker.evaluate((marker) => {
+      let element: Element | null = marker;
+      while (element) {
+        const style = window.getComputedStyle(element);
+        if (style.display === "none" || style.visibility === "hidden") {
+          return false;
+        }
+        if (Number(style.opacity) === 0) return false;
+        element = element.parentElement;
+      }
+      return true;
+    });
+  await expect.poll(markerRemainsVisible).toBe(true);
+  await expect(localSidebarMarker).toHaveCount(0);
+  const sidebarMarkerBox = await remoteSidebarMarker.boundingBox();
+  const sidebarBox = await page.getByTestId("members-sidebar").boundingBox();
+  expect(sidebarMarkerBox).not.toBeNull();
+  expect(sidebarBox).not.toBeNull();
+  expect(
+    (sidebarMarkerBox?.x ?? 0) + (sidebarMarkerBox?.width ?? 0),
+  ).toBeLessThanOrEqual((sidebarBox?.x ?? 0) + (sidebarBox?.width ?? 0) + 1);
+
+  await remoteSidebarRow.hover();
+  await page.waitForTimeout(200);
+  await expect.poll(markerRemainsVisible).toBe(true);
+  await expect(localSidebarMarker).toHaveCount(0);
+
+  await page.getByTestId(`sidebar-member-open-profile-${relayPubkey}`).focus();
+  await page.waitForTimeout(200);
+  await expect.poll(markerRemainsVisible).toBe(true);
+  await expect(localSidebarMarker).toHaveCount(0);
 });
 
 test("relay-only shared agents emit an outbound mention tag when selected", async ({
@@ -734,19 +811,20 @@ test("selecting a person mention inserts @Name into input", async ({
   await expect(page.getByTestId("chat-title")).toHaveText("general");
 
   const input = page.getByTestId("message-input");
-  await input.fill("Hey @bo");
-
   const dropdown = autocomplete(page);
-  await dropdown.getByText("bob").click();
-
-  await expect(input).toHaveText("Hey @bob ");
+  for (let attempt = 0; attempt < 5; attempt++) {
+    await input.fill("Hey @bo");
+    await dropdown.getByText("bob").click();
+    await page.keyboard.type("hello");
+    await expect(input).toHaveText("Hey @bob hello");
+  }
   const mentionChip = input.locator(".human-mention-highlight", {
     hasText: "bob",
   });
   await expect(mentionChip).toBeVisible();
   await expect(mentionChip).toHaveText("bob");
   await expect(mentionChip).not.toHaveClass(/agent-mention-highlight/);
-  await expect(mentionChip).toHaveCSS("display", "inline-flex");
+  await expect(mentionChip).toHaveCSS("display", "inline");
   await expect(
     input.locator(".mention-prefix-hidden", { hasText: "@" }),
   ).toHaveCount(1);
@@ -758,6 +836,96 @@ test("selecting a person mention inserts @Name into input", async ({
   expect(iconMask).toContain("data:image/svg+xml");
 });
 
+test("immediate ArrowLeft after a person mention is not bounced past the trailing space", async ({
+  page,
+}) => {
+  await page.goto("/");
+  await page.getByTestId("channel-general").click();
+  await expect(page.getByTestId("chat-title")).toHaveText("general");
+
+  const input = page.getByTestId("message-input");
+  await input.fill("Hey @bo");
+  await autocomplete(page).getByText("bob").click();
+  await page.keyboard.press("ArrowLeft");
+  await page.keyboard.type("x");
+  const text = (await input.innerText()).replace(/\s+$/, "");
+  expect(text).toBe("Hey @bobx");
+  expect(text).not.toMatch(/@bob x/);
+});
+
+test("clicking a person mention chip edge is not treated as after the trailing space", async ({
+  page,
+}) => {
+  await page.goto("/");
+  await page.getByTestId("channel-general").click();
+  await expect(page.getByTestId("chat-title")).toHaveText("general");
+
+  const input = page.getByTestId("message-input");
+  await input.fill("Hey @bo");
+  await autocomplete(page).getByText("bob").click();
+  const chip = input.locator(".human-mention-highlight", { hasText: "bob" });
+  await expect(chip).toBeVisible();
+  const box = await chip.boundingBox();
+  expect(box).toBeTruthy();
+  await chip.click({
+    position: {
+      x: Math.max((box?.width ?? 1) - 2, 0),
+      y: (box?.height ?? 2) / 2,
+    },
+  });
+  await page.keyboard.type("x");
+  const text = (await input.innerText()).replace(/\s+$/, "");
+  expect(text).toBe("Hey @bobx");
+  expect(text).not.toMatch(/@bob x/);
+});
+
+test("typing a mention before existing text does not interleave spaces", async ({
+  page,
+}) => {
+  // Regression (the reported repro): with a draft already written, place the
+  // caret earlier in the message, type a partial mention, pick a suggestion,
+  // then keep typing. Caret correction used to fire on every document change
+  // and walk the caret across the mention's trailing space, so each keystroke
+  // pushed a space further into the rest of the draft.
+  await page.goto("/");
+  await page.getByTestId("channel-general").click();
+  await expect(page.getByTestId("chat-title")).toHaveText("general");
+
+  const input = page.getByTestId("message-input");
+  await input.fill("hello world");
+
+  // Click between "hello" and " world", then open autocomplete there.
+  await input.focus();
+  for (let i = 0; i < " world".length; i++) {
+    await page.keyboard.press("ArrowLeft");
+  }
+  await page.keyboard.type(" @bo");
+  await autocomplete(page).getByText("bob").click();
+  await page.keyboard.type("abc");
+
+  await expect(input).toHaveText("hello @bob abc world");
+});
+
+test("typing an unregistered @token before existing text is left alone", async ({
+  page,
+}) => {
+  // The trailing-space scan is purely textual, so it also fired for tokens
+  // that were never registered as mentions.
+  await page.goto("/");
+  await page.getByTestId("channel-general").click();
+  await expect(page.getByTestId("chat-title")).toHaveText("general");
+
+  const input = page.getByTestId("message-input");
+  await input.fill("hello world");
+  await input.focus();
+  for (let i = 0; i < " world".length; i++) {
+    await page.keyboard.press("ArrowLeft");
+  }
+  await page.keyboard.type(" @zzq");
+
+  await expect(input).toHaveText("hello @zzq world");
+});
+
 test("channel references keep caret movement through the channel name", async ({
   page,
 }) => {
@@ -809,18 +977,19 @@ test("selecting a managed agent mention inserts @Name into input", async ({
   await expect(page.getByTestId("chat-title")).toHaveText("general");
 
   const input = page.getByTestId("message-input");
-  await input.fill("Hey @ali");
-
   const dropdown = autocomplete(page);
-  await dropdown.getByText("alice").click();
-
-  await expect(input).toHaveText("Hey @alice ");
+  for (let attempt = 0; attempt < 5; attempt++) {
+    await input.fill("Hey @ali");
+    await dropdown.getByText("alice").click();
+    await page.keyboard.type("hello");
+    await expect(input).toHaveText("Hey @alice hello");
+  }
   const agentMentionChip = input.locator(".agent-mention-highlight", {
     hasText: "alice",
   });
   await expect(agentMentionChip).toBeVisible();
   await expect(agentMentionChip).toHaveText("alice");
-  await expect(agentMentionChip).toHaveCSS("display", "inline-flex");
+  await expect(agentMentionChip).toHaveCSS("display", "inline");
   await expect(agentMentionChip).toHaveCSS("border-top-width", "0px");
 });
 
@@ -971,7 +1140,7 @@ test("selecting a persona mention reuses an existing persona agent", async ({
   await expect(mentionChip).toHaveText("Fizz");
 });
 
-test("managed relay-profile agents with member roles use the agent composer style", async ({
+test("managed relay-profile agents with member roles use the agent address tray", async ({
   page,
 }) => {
   await installMockBridge(page, {
@@ -1001,11 +1170,15 @@ test("managed relay-profile agents with member roles use the agent composer styl
   await expect(dropdown.getByText("agent")).toBeVisible();
   await input.press("Enter");
 
-  const agentMentionChip = input.locator(".agent-mention-highlight", {
-    hasText: "charlie",
-  });
-  await expect(agentMentionChip).toBeVisible();
-  await expect(agentMentionChip).toHaveText("charlie");
+  await expect(input).toBeEmpty();
+  await expect(
+    page.getByTestId(`composer-address-lock-${TEST_IDENTITIES.charlie.pubkey}`),
+  ).toBeVisible();
+  await expect(
+    page.getByRole("status").filter({
+      hasText: "Automatically mentioning charlie",
+    }),
+  ).toBeVisible();
 });
 
 test("other-owned agents without a shared channel are hidden from mentions", async ({
@@ -1324,12 +1497,14 @@ test("relay-only allowlisted agents emit a p tag when sent", async ({
   );
 
   const input = page.getByTestId("message-input");
-  await input.fill("@quinn");
-  const quinnRow = autocomplete(page).locator("button", { hasText: "quinn" });
-  await expect(quinnRow).toBeVisible();
-  await quinnRow.click();
-  await page.keyboard.type("hello");
-  await expect(input).toHaveText("@quinn hello");
+  for (let attempt = 0; attempt < 5; attempt++) {
+    await input.fill("@quinn");
+    const quinnRow = autocomplete(page).locator("button", { hasText: "quinn" });
+    await expect(quinnRow).toBeVisible();
+    await quinnRow.click();
+    await page.keyboard.type("hello");
+    await expect(input).toHaveText("@quinn hello");
+  }
   const baselineCommands = await readCommandLog(page);
   await page.getByTestId("send-message").click();
 
@@ -2322,7 +2497,7 @@ test("system member-joined rows render the joined person as a plain profile name
   await expect(joinedPersonName).not.toHaveAttribute("data-mention");
 });
 
-test("selecting a managed non-member agent from a DM inserts @Name into input", async ({
+test("selecting a managed non-member agent from a DM addresses it", async ({
   page,
 }) => {
   await installMockBridge(page, {
@@ -2347,8 +2522,11 @@ test("selecting a managed non-member agent from a DM inserts @Name into input",
   await expect(input.locator(".mention-chip")).toHaveCount(0);
   await input.press("Enter");
 
-  await expect(input).toHaveText("@charlie ");
-  await expect(input.locator(".mention-chip")).toBeVisible();
+  await expect(input).toBeEmpty();
+  await expect(input.locator(".mention-chip")).toHaveCount(0);
+  await expect(
+    page.getByTestId(`composer-address-lock-${TEST_IDENTITIES.charlie.pubkey}`),
+  ).toBeVisible();
 });
 
 test("global non-member people can be selected from channel mentions", async ({
diff --git a/desktop/tests/e2e/navigation.spec.ts b/desktop/tests/e2e/navigation.spec.ts
index ed5a261a98c..189db09e0f6 100644
--- a/desktop/tests/e2e/navigation.spec.ts
+++ b/desktop/tests/e2e/navigation.spec.ts
@@ -62,6 +62,18 @@ async function createWorkflow(
   await page.getByRole("menuitem", { name: "Send Message" }).click();
   await dialog.getByLabel("Message text").fill("Workflow notification");
   await dialog.getByRole("button", { name: "Create" }).click();
+  const activationConfirmation = page.getByRole("alertdialog", {
+    name: "This workflow may run often",
+  });
+  await Promise.race([
+    activationConfirmation.waitFor({ state: "visible" }),
+    dialog.waitFor({ state: "hidden" }),
+  ]);
+  if (await activationConfirmation.isVisible()) {
+    await activationConfirmation
+      .getByRole("button", { name: "Turn on" })
+      .click();
+  }
   await expect(dialog).not.toBeVisible();
 }
 
diff --git a/desktop/tests/e2e/persistent-agent-audience.spec.ts b/desktop/tests/e2e/persistent-agent-audience.spec.ts
index 9636f2c7505..be1dbc86c3f 100644
--- a/desktop/tests/e2e/persistent-agent-audience.spec.ts
+++ b/desktop/tests/e2e/persistent-agent-audience.spec.ts
@@ -4,27 +4,33 @@ import { waitForAnimations } from "../helpers/animations";
 import { installMockBridge } from "../helpers/bridge";
 
 const SHOTS = "test-results/persistent-agent-audience";
-const OWNER = "deadbeef".repeat(8);
 const CHANNEL_ID = "9a1657ac-f7aa-5db0-b632-d8bbeb6dfb50";
 const AGENT_A = "a".repeat(64);
 const AGENT_B = "b".repeat(64);
 const THREAD_ROOT_ID = "mock-general-welcome";
-const SCOPE = `${OWNER}:${CHANNEL_ID}:thread:${THREAD_ROOT_ID}`;
 
-async function seedAudience(page: Page, pubkeys: string[], theme = "buzz") {
+async function seedTheme(page: Page, theme: string, accent = "#c0a2f1") {
   await page.addInitScript(
-    ({ audience, scope, selectedTheme }) => {
-      window.localStorage.setItem("buzz:keep-addressed-agents-active", "1");
-      window.localStorage.setItem(
-        "buzz:persistent-agent-audiences:v2",
-        JSON.stringify({ [scope]: audience }),
-      );
+    ({ selectedTheme, selectedAccent }) => {
       window.localStorage.setItem("buzz-theme", selectedTheme);
+      window.localStorage.setItem("buzz-accent-color", selectedAccent);
     },
-    { audience: pubkeys, scope: SCOPE, selectedTheme: theme },
+    { selectedTheme: theme, selectedAccent: accent },
   );
 }
 
+async function automaticallyMention(
+  composer: ReturnType<typeof channelComposer>,
+  displayName: string,
+) {
+  await composer.locator("[data-mention-picker-trigger]").click();
+  await composer
+    .getByTestId("mention-autocomplete")
+    .getByRole("button", { name: `Automatically mention ${displayName}` })
+    .click();
+  await composer.locator("[data-mention-picker-trigger]").click();
+}
+
 async function openGeneral(page: Page) {
   await page.goto(`/#/channels/${CHANNEL_ID}`, {
     waitUntil: "domcontentloaded",
@@ -40,32 +46,6 @@ async function openThread(page: Page, threadRootId = THREAD_ROOT_ID) {
   await expect(page.getByTestId("message-thread-panel")).toBeVisible();
 }
 
-async function emitRootMessage(
-  page: Page,
-  content: string,
-  mentionPubkeys: string[],
-) {
-  const event = await page.evaluate(
-    ({ message, pubkeys }) =>
-      (
-        window as Window & {
-          __BUZZ_E2E_EMIT_MOCK_MESSAGE__?: (input: {
-            channelName: string;
-            content: string;
-            mentionPubkeys: string[];
-          }) => { id: string };
-        }
-      ).__BUZZ_E2E_EMIT_MOCK_MESSAGE__?.({
-        channelName: "general",
-        content: message,
-        mentionPubkeys: pubkeys,
-      }),
-    { message: content, pubkeys: mentionPubkeys },
-  );
-  if (!event) throw new Error("Mock message emitter is not installed");
-  return event;
-}
-
 function channelComposer(page: Page) {
   return page.getByTestId("channel-composer-overlay");
 }
@@ -74,9 +54,65 @@ function threadComposer(page: Page) {
   return page.getByTestId("thread-composer-overlay");
 }
 
+async function pressPrimaryShift(page: Page, key: "Enter" | "M") {
+  const isMac = await page.evaluate(() =>
+    /mac|iphone|ipad|ipod/i.test(navigator.platform),
+  );
+  await page.keyboard.press(`${isMac ? "Meta" : "Control"}+Shift+${key}`);
+}
+
+async function readOutgoingMentionPubkeys(page: Page, content: string) {
+  return page.evaluate((expectedContent) => {
+    const signedEvent = window.__BUZZ_E2E_SIGNED_EVENTS__?.find(
+      (event) => event.content === expectedContent,
+    );
+    if (signedEvent) {
+      return (signedEvent.tags ?? [])
+        .filter((tag) => tag[0] === "p" && tag[1])
+        .map((tag) => tag[1]);
+    }
+
+    for (const entry of window.__BUZZ_E2E_COMMAND_LOG__ ?? []) {
+      if (entry.command === "send_channel_message") {
+        const payload = entry.payload as
+          | { content?: string; mentionPubkeys?: string[] }
+          | undefined;
+        if (payload?.content === expectedContent) {
+          return payload.mentionPubkeys ?? [];
+        }
+      }
+
+      if (entry.command !== "plugin:websocket|send") continue;
+      const data = (
+        entry.payload as { message?: { data?: string } } | undefined
+      )?.message?.data;
+      if (!data) continue;
+
+      try {
+        const frame = JSON.parse(data) as [
+          string,
+          { content?: string; tags?: string[][] },
+        ];
+        if (frame[0] !== "EVENT" || frame[1]?.content !== expectedContent) {
+          continue;
+        }
+        return (frame[1].tags ?? [])
+          .filter((tag) => tag[0] === "p" && tag[1])
+          .map((tag) => tag[1]);
+      } catch {}
+    }
+
+    return null;
+  }, content);
+}
+
 async function installAudienceFixtures(
   page: Page,
-  options: { sendMessageDelayMs?: number } = {},
+  options: {
+    sendMessageDelayMs?: number;
+    sendMessageErrors?: string[];
+    usersBatchDelayMs?: number;
+  } = {},
 ) {
   await installMockBridge(page, {
     ...options,
@@ -97,124 +133,253 @@ async function installAudienceFixtures(
   });
 }
 
-test("first thread open inherits explicitly addressed agents in authored order", async ({
+test("automatically mentions multiple agents from the mention picker", async ({
   page,
 }) => {
-  await page.addInitScript(() => {
-    window.localStorage.setItem("buzz:keep-addressed-agents-active", "1");
-  });
   await installAudienceFixtures(page);
   await openGeneral(page);
-  const root = await emitRootMessage(
-    page,
-    "@Vogue please pair with @Morgarita",
-    // Event tag order deliberately opposes authored mention order.
-    [AGENT_A, AGENT_B],
+
+  const composer = channelComposer(page);
+  await automaticallyMention(composer, "Morgarita");
+  await automaticallyMention(composer, "Vogue");
+
+  await expect(
+    composer.getByTestId(`composer-address-lock-${AGENT_A}`),
+  ).toBeVisible();
+  await expect(
+    composer.getByTestId(`composer-address-lock-${AGENT_B}`),
+  ).toBeVisible();
+  await expect(
+    composer.getByRole("button", { name: "Manage automatic agent mentions" }),
+  ).toBeVisible();
+});
+
+test("Tab keeps a manually selected agent as an inline mention", async ({
+  page,
+}) => {
+  await installAudienceFixtures(page);
+  await openGeneral(page);
+
+  const composer = channelComposer(page);
+  const input = composer.getByTestId("message-input");
+  await input.fill("@Mor");
+  await expect(composer.getByTestId("mention-autocomplete")).toBeVisible();
+
+  await input.press("Tab");
+
+  await expect(input).toHaveText("@Morgarita ");
+  await expect(composer.getByTestId("mention-autocomplete")).toHaveCount(0);
+  await expect(
+    composer.getByTestId(`composer-address-lock-${AGENT_A}`),
+  ).toHaveCount(0);
+});
+
+test("primary+Shift+Enter opens the picker, then pins the highlighted agent", async ({
+  page,
+}) => {
+  await installAudienceFixtures(page);
+  await openGeneral(page);
+
+  const composer = channelComposer(page);
+  const input = composer.getByTestId("message-input");
+  await input.fill("draft text");
+  await pressPrimaryShift(page, "Enter");
+
+  const menu = composer.getByTestId("mention-autocomplete");
+  await expect(menu).toBeVisible();
+  await expect(input).toHaveText("draft text");
+
+  await input.fill("@Mor");
+  await expect(menu.getByTestId(`mention-suggestion-${AGENT_A}`)).toHaveClass(
+    /(?:^|\s)bg-accent(?:\s|$)/,
+  );
+  await pressPrimaryShift(page, "Enter");
+
+  await expect(menu).toBeVisible();
+  await expect(input).toHaveText("");
+  await expect(
+    composer.getByTestId(`composer-address-lock-${AGENT_A}`),
+  ).toBeVisible();
+});
+
+test("the mention button opens settings and can undo an address", async ({
+  page,
+}) => {
+  await installAudienceFixtures(page);
+  await openGeneral(page);
+
+  const composer = channelComposer(page);
+  await automaticallyMention(composer, "Morgarita");
+  const input = composer.getByTestId("message-input");
+  const ingress = composer.getByRole("button", {
+    name: "Manage automatic agent mentions",
+  });
+
+  await input.fill("draft text");
+  await ingress.click();
+  const menu = composer.getByTestId("mention-autocomplete");
+  await expect(menu).toBeVisible();
+  await expect(input).toHaveText("draft text");
+  await page.getByTestId("mention-options-trigger").click();
+  await expect(
+    page.getByTestId("mention-keep-agents-pinned-toggle"),
+  ).toBeVisible();
+  const layerBox = await composer
+    .getByTestId("mention-autocomplete-layer")
+    .boundingBox();
+  const optionsBox = await page
+    .getByTestId("mention-options-trigger")
+    .boundingBox();
+  expect(layerBox).not.toBeNull();
+  expect(optionsBox).not.toBeNull();
+  if (!layerBox || !optionsBox) throw new Error("Mention tray is not laid out");
+  await page.mouse.click(layerBox.x + 4, optionsBox.y + optionsBox.height / 2);
+  await expect(menu).toHaveCount(0);
+  await expect(input).toHaveText("draft text");
+  await ingress.click();
+  await expect(menu).toBeVisible();
+  await expect(page.getByTestId("mention-options-trigger")).toHaveAttribute(
+    "aria-expanded",
+    "false",
   );
+  await expect(
+    page.getByTestId("mention-keep-agents-pinned-toggle"),
+  ).toHaveCount(0);
+  await ingress.click();
+  await expect(menu).toHaveCount(0);
+  await input.fill("");
+  await ingress.click();
+  await expect(menu).toBeVisible();
+  await expect(page.getByTestId("user-profile-panel")).toHaveCount(0);
+  await expect(
+    menu.getByRole("button", {
+      name: "Stop automatically mentioning Morgarita",
+    }),
+  ).toHaveAttribute("aria-pressed", "true");
 
-  await openThread(page, root.id);
+  await menu
+    .getByRole("button", { name: "Stop automatically mentioning Morgarita" })
+    .click();
+  await expect(input).toHaveText("");
+  await expect(
+    composer.getByRole("button", { name: "Mention someone" }),
+  ).toBeVisible();
+
+  await menu
+    .getByRole("button", { name: "Mention Morgarita", exact: true })
+    .click();
+  await expect(input).toHaveText("@Morgarita ");
+  await expect(
+    composer.getByTestId(`composer-address-lock-${AGENT_A}`),
+  ).toHaveCount(0);
 
-  const input = threadComposer(page).getByTestId("message-input");
-  await expect(input).toHaveText("@Vogue @Morgarita ");
-  await expect(input.locator(".agent-mention-highlight")).toHaveCount(2);
+  await input.type("later");
+  await input.press("Enter");
+  await expect(input).toHaveText("");
   await expect
-    .poll(() =>
-      page.evaluate(
-        ({ owner, channelId, rootId }) => {
-          const stored = JSON.parse(
-            localStorage.getItem("buzz:persistent-agent-audiences:v2") ?? "{}",
-          );
-          return stored[`${owner}:${channelId}:thread:${rootId}`] ?? null;
-        },
-        { owner: OWNER, channelId: CHANNEL_ID, rootId: root.id },
-      ),
-    )
-    .toEqual([AGENT_B, AGENT_A]);
+    .poll(() => readOutgoingMentionPubkeys(page, "@Morgarita later"))
+    .toContain(AGENT_A);
+  await expect(
+    composer.getByTestId(`composer-address-lock-${AGENT_A}`),
+  ).toHaveCount(1);
 });
 
-test("persistent agents transition atomically before Enter-send resolves", async ({
+test("always-mentioned agents remain in the mention button while Enter-send resolves", async ({
   page,
 }) => {
-  await seedAudience(page, [AGENT_A]);
-  await installAudienceFixtures(page, { sendMessageDelayMs: 1_500 });
+  await installAudienceFixtures(page, {
+    sendMessageDelayMs: 1_500,
+    usersBatchDelayMs: 1_500,
+  });
   await openThread(page);
 
   const composer = threadComposer(page);
+  await automaticallyMention(composer, "Morgarita");
   const input = composer.getByTestId("message-input");
   const send = composer.getByTestId("send-message");
-  await input.fill("@Morgarita hello");
+  const avatar = composer.getByTestId(`composer-address-lock-${AGENT_A}`);
+  const initialPulseVersion = Number(
+    await avatar.getAttribute("data-pulse-version"),
+  );
+  await input.fill("hello");
   await input.press("Enter");
 
-  // The network send is still pending, so this is the first observable
-  // post-submit editor state rather than the later success hydration pass.
-  await expect(input).toHaveText("@Morgarita ", { timeout: 500 });
-  await expect(input.locator(".agent-mention-highlight")).toHaveCount(1, {
-    timeout: 500,
-  });
+  await expect(input).toHaveText("", { timeout: 500 });
+  await expect(avatar).toHaveAttribute(
+    "data-pulse-version",
+    String(initialPulseVersion + 1),
+    { timeout: 500 },
+  );
+  await expect(
+    composer.getByRole("button", { name: "Manage automatic agent mentions" }),
+  ).toBeVisible();
   await expect(input).toBeFocused();
-  await page.waitForTimeout(200);
   await expect(composer.getByTestId("mention-autocomplete")).toHaveCount(0);
 
-  await expect(send).toBeEnabled();
+  await expect(send).toBeDisabled();
   await expect
-    .poll(() =>
-      input.evaluate((element) => {
-        const selection = window.getSelection();
-        const viewDesc = (
-          element as HTMLElement & {
-            pmViewDesc?: {
-              posFromDOM: (node: Node, offset: number, bias: number) => number;
-              size: number;
-            };
-          }
-        ).pmViewDesc;
-        if (!selection?.anchorNode || !viewDesc) return null;
-        const position = viewDesc.posFromDOM(
-          selection.anchorNode,
-          selection.anchorOffset,
-          1,
-        );
-        // The root view desc includes the document's two boundary tokens,
-        // while posFromDOM is relative to the editable root. Converting both
-        // to ProseMirror coordinates proves selection.from/to === doc.content.size.
-        return {
-          empty: selection.isCollapsed,
-          text: element.textContent,
-          endsWithSpace: element.textContent?.endsWith(" ") ?? false,
-          atDocumentEnd: position + 1 === viewDesc.size - 2,
-        };
-      }),
-    )
-    .toEqual({
-      empty: true,
-      text: "@Morgarita ",
-      endsWithSpace: true,
-      atDocumentEnd: true,
-    });
-
-  // Exercise the reported contract, not just its selection prerequisites:
-  // immediate typing after restoration must remain outside the mention chip.
-  await input.pressSequentially("testing");
-  await expect(input).toHaveText("@Morgarita testing");
-  await expect(input.locator(".agent-mention-highlight")).toHaveCount(1);
+    .poll(() => readOutgoingMentionPubkeys(page, "hello"))
+    .toContain(AGENT_A);
+
+  const sentRow = page
+    .getByTestId("message-row")
+    .filter({ hasText: "hello" })
+    .last();
+  const addressPrefix = sentRow.locator(
+    "[data-mention].agent-mention-highlight",
+    { hasText: "Morgarita" },
+  );
+  await expect(addressPrefix).toBeVisible();
+  await expect(addressPrefix).toHaveText("Morgarita");
 });
 
-test("timeline agent send remains one-shot and returns to the placeholder", async ({
+test("a failed always-mentioned send shakes the composer avatar", async ({
+  page,
+}) => {
+  await installAudienceFixtures(page, {
+    sendMessageDelayMs: 500,
+    sendMessageErrors: ["simulated send failure"],
+  });
+  await openThread(page);
+
+  const composer = threadComposer(page);
+  await automaticallyMention(composer, "Morgarita");
+  const input = composer.getByTestId("message-input");
+  const avatar = composer.getByTestId(`composer-address-lock-${AGENT_A}`);
+  const initialPulseVersion = Number(
+    await avatar.getAttribute("data-pulse-version"),
+  );
+  await expect(avatar).toHaveAttribute("data-shake-version", "0");
+
+  await input.fill("please retry");
+  await input.press("Enter");
+
+  await expect(avatar).toHaveAttribute(
+    "data-pulse-version",
+    String(initialPulseVersion + 1),
+    { timeout: 500 },
+  );
+  await expect(input).toHaveText("please retry");
+  await expect(avatar).toHaveAttribute("data-shake-version", "1");
+});
+
+test("a manually mentioned agent becomes selected after the message sends", async ({
   page,
 }) => {
-  await seedAudience(page, [AGENT_A]);
   await installAudienceFixtures(page, { sendMessageDelayMs: 1_500 });
   await openGeneral(page);
 
   const composer = channelComposer(page);
   const input = composer.getByTestId("message-input");
   await input.fill("@Mor");
-  await composer
-    .getByTestId("mention-autocomplete")
-    .getByText("Morgarita", { exact: true })
-    .click();
-  await input.pressSequentially("hello");
-  await expect(input).toHaveText("@Morgarita hello");
+  await expect(composer.getByTestId("mention-autocomplete")).toBeVisible();
+  await input.press("Tab");
+  await expect(input).toHaveText("@Morgarita ");
+  await expect(
+    composer.getByTestId(`composer-address-lock-${AGENT_A}`),
+  ).toHaveCount(0);
+
+  await input.type("hello");
   await input.press("Enter");
 
   await expect(input).toHaveText("", { timeout: 500 });
@@ -224,80 +389,133 @@ test("timeline agent send remains one-shot and returns to the placeholder", asyn
     { timeout: 500 },
   );
   await expect(input).toBeFocused();
+  await expect(
+    composer.getByTestId(`composer-address-lock-${AGENT_A}`),
+  ).toBeVisible({ timeout: 2_500 });
+  const autoPinToast = page
+    .locator("[data-sonner-toast][data-removed='false']")
+    .filter({ hasText: "Morgarita will be mentioned automatically" });
+  await expect(autoPinToast).not.toContainText(
+    "Future messages in this channel will include this agent.",
+  );
+  const undoAction = autoPinToast.locator("[data-action]");
+  await expect(undoAction).toHaveRole("button");
+  await expect(undoAction).toHaveText("Undo");
   await expect
-    .poll(() =>
-      input.evaluate((element) => {
-        const selection = window.getSelection();
-        return {
-          collapsed: selection?.isCollapsed ?? false,
-          inside: Boolean(
-            selection?.anchorNode && element.contains(selection.anchorNode),
-          ),
-        };
-      }),
-    )
-    .toEqual({ collapsed: true, inside: true });
+    .poll(() => readOutgoingMentionPubkeys(page, "@Morgarita hello"))
+    .toContain(AGENT_A);
+
+  await input.fill("follow up");
+  await input.press("Enter");
+  await expect
+    .poll(() => readOutgoingMentionPubkeys(page, "follow up"))
+    .toContain(AGENT_A);
 });
 
-test("persistent agents restore through the native inline mention UI", async ({
+test("the auto-pin toast can undo and the picker can restore the agent", async ({
   page,
 }) => {
-  await seedAudience(page, [AGENT_B, AGENT_A]);
   await installAudienceFixtures(page);
-  await openThread(page);
+  await openGeneral(page);
 
-  const composer = threadComposer(page);
+  const composer = channelComposer(page);
   const input = composer.getByTestId("message-input");
-  await expect(input).toHaveText("@Vogue @Morgarita ");
-  await expect(page.getByText("Talking to", { exact: true })).toHaveCount(0);
-  await expect(input.locator(".agent-mention-highlight")).toHaveCount(2);
+  await input.fill("@Mor");
+  await expect(composer.getByTestId("mention-autocomplete")).toBeVisible();
+  await input.press("Tab");
+  await expect(input).toHaveText("@Morgarita ");
+  await input.press("Space");
+  await input.type("undo me");
+  await input.press("Enter");
 
-  await input.fill("@Morgarita hello");
-  await expect
-    .poll(() =>
-      page.evaluate(
-        ({ scope }) => {
-          const stored = JSON.parse(
-            localStorage.getItem("buzz:persistent-agent-audiences:v2") ?? "{}",
-          );
-          return stored[scope] ?? [];
-        },
-        { scope: SCOPE },
-      ),
-    )
-    .toEqual([AGENT_A]);
-
-  await composer.getByTestId("send-message").click();
-  await expect(input).toContainText("@Morgarita");
-  await expect(input).not.toContainText("@Vogue");
-  await expect(input.locator(".agent-mention-highlight")).toHaveCount(1);
+  await expect(
+    composer.getByTestId(`composer-address-lock-${AGENT_A}`),
+  ).toBeVisible();
+  const autoPinToast = page
+    .locator("[data-sonner-toast][data-removed='false']")
+    .filter({ hasText: "Morgarita will be mentioned automatically" });
+  await autoPinToast.locator("[data-action]").click();
+
+  await expect(
+    composer.getByTestId(`composer-address-lock-${AGENT_A}`),
+  ).toHaveCount(0);
+  await expect(composer.getByTestId("mention-autocomplete")).toBeVisible();
+  await expect(composer.getByTestId("mention-options-trigger")).toHaveAttribute(
+    "aria-expanded",
+    "true",
+  );
+  await expect(
+    composer.getByTestId("mention-keep-agents-pinned-toggle"),
+  ).toBeVisible();
+
+  await input.press("Escape");
+  await expect(composer.getByTestId("mention-autocomplete")).toHaveCount(0);
+  await composer.locator("[data-mention-picker-trigger]").click();
+  await composer
+    .getByTestId("mention-autocomplete")
+    .getByRole("button", { name: "Mention Morgarita", exact: true })
+    .click();
+  await expect(input).toHaveText("");
+  await expect(
+    composer.getByTestId(`composer-address-lock-${AGENT_A}`),
+  ).toBeVisible();
+});
+
+test("channel automatic mentions carry into threads and stay synchronized", async ({
+  page,
+}) => {
+  await installAudienceFixtures(page);
+  await openGeneral(page);
+  await automaticallyMention(channelComposer(page), "Morgarita");
+
+  await openThread(page);
+  const channelAutomaticMention = channelComposer(page).getByTestId(
+    `composer-address-lock-${AGENT_A}`,
+  );
+  const threadAutomaticMention = threadComposer(page).getByTestId(
+    `composer-address-lock-${AGENT_A}`,
+  );
+  await expect(channelAutomaticMention).toBeVisible();
+  await expect(threadAutomaticMention).toBeVisible();
+
+  await threadComposer(page)
+    .getByRole("button", { name: "Stop automatically mentioning Morgarita" })
+    .click();
+  await expect(threadAutomaticMention).toHaveCount(0);
+  await expect(channelAutomaticMention).toHaveCount(0);
 });
 
 for (const theme of ["buzz", "buzz-dark"]) {
-  test(`captures native persistent mentions in ${theme}`, async ({ page }) => {
-    await seedAudience(page, [AGENT_A, AGENT_B], theme);
+  test(`captures the mention-button placement in ${theme}`, async ({
+    page,
+  }) => {
+    await seedTheme(page, theme);
     await installAudienceFixtures(page);
     await openThread(page);
     const overlay = threadComposer(page);
     const composer = overlay.getByTestId("message-composer");
+    await automaticallyMention(overlay, "Morgarita");
+    await automaticallyMention(overlay, "Vogue");
     await overlay.getByTestId("message-input").focus();
     await waitForAnimations(page);
-    await composer.screenshot({
-      path: `${SHOTS}/${theme}-native-mentions.png`,
-    });
+    await composer.screenshot({ path: `${SHOTS}/${theme}-mention-button.png` });
   });
 }
 
-test("native persistent mentions fit the narrow composer", async ({ page }) => {
+test("the mention-button placement fits the narrow composer", async ({
+  page,
+}) => {
   await page.setViewportSize({ width: 700, height: 760 });
-  await seedAudience(page, [AGENT_A, AGENT_B]);
   await installAudienceFixtures(page);
   await openThread(page);
   const overlay = threadComposer(page);
   const composer = overlay.getByTestId("message-composer");
-  await expect(overlay.getByTestId("message-input")).toContainText(
-    "@Morgarita",
-  );
+  await automaticallyMention(overlay, "Morgarita");
+  await automaticallyMention(overlay, "Vogue");
+  await expect(overlay.getByTestId("composer-address-locks")).toBeVisible();
+  await expect(
+    overlay.getByRole("button", { name: "Manage automatic agent mentions" }),
+  ).toBeVisible();
   await waitForAnimations(page);
-  await composer.screenshot({ path: `${SHOTS}/narrow-native-mentions.png` });
+  await composer.screenshot({ path: `${SHOTS}/narrow-mention-button.png` });
 });
diff --git a/desktop/tests/e2e/profile.spec.ts b/desktop/tests/e2e/profile.spec.ts
index 04411720acb..3870718e4e9 100644
--- a/desktop/tests/e2e/profile.spec.ts
+++ b/desktop/tests/e2e/profile.spec.ts
@@ -2490,9 +2490,6 @@ test("supports webview zoom keyboard shortcuts", async ({ page }) => {
   const getTextScaleState = () =>
     page.evaluate(() => ({
       rootFontSize: getComputedStyle(document.documentElement).fontSize,
-      textRemSize: getComputedStyle(document.documentElement)
-        .getPropertyValue("--buzz-type-rem")
-        .trim(),
       storedScale: localStorage.getItem("buzz:text-scale"),
       webviewZoom: (window as Window & { __BUZZ_E2E_WEBVIEW_ZOOM__?: number })
         .__BUZZ_E2E_WEBVIEW_ZOOM__,
@@ -2523,8 +2520,7 @@ test("supports webview zoom keyboard shortcuts", async ({ page }) => {
   await dispatchPrimaryShortcut("+", "Equal", true);
 
   await expect.poll(getTextScaleState).toEqual({
-    rootFontSize: "16px",
-    textRemSize: "17.6px",
+    rootFontSize: "17.6px",
     storedScale: "1.1",
     webviewZoom: 1,
   });
@@ -2533,7 +2529,6 @@ test("supports webview zoom keyboard shortcuts", async ({ page }) => {
 
   await expect.poll(getTextScaleState).toEqual({
     rootFontSize: "16px",
-    textRemSize: "16px",
     storedScale: null,
     webviewZoom: 1,
   });
@@ -2542,8 +2537,7 @@ test("supports webview zoom keyboard shortcuts", async ({ page }) => {
   await dispatchPrimaryShortcut("+", "Equal", true);
 
   await expect.poll(getTextScaleState).toEqual({
-    rootFontSize: "16px",
-    textRemSize: "19.2px",
+    rootFontSize: "19.2px",
     storedScale: "1.2",
     webviewZoom: 1,
   });
@@ -2552,7 +2546,6 @@ test("supports webview zoom keyboard shortcuts", async ({ page }) => {
 
   await expect.poll(getTextScaleState).toEqual({
     rootFontSize: "16px",
-    textRemSize: "16px",
     storedScale: null,
     webviewZoom: 1,
   });
@@ -2586,56 +2579,54 @@ test("storage clear resets composed font size and keyboard zoom across windows",
     await dispatchZoomIn();
   }
 
-  await expect
-    .poll(() =>
-      page.evaluate(() => ({
+  // Zoom scales the real root; the Font size preference layers a text-only
+  // multiplier on top. Resolve the composed type rem through a rendered probe
+  // so the CSS calc is actually evaluated (root px × 15/14 for "larger").
+  const readTypographyState = () =>
+    page.evaluate(() => {
+      const probe = document.createElement("span");
+      probe.style.fontSize = "var(--buzz-type-rem)";
+      document.documentElement.appendChild(probe);
+      const typeRemPx =
+        Math.round(Number.parseFloat(getComputedStyle(probe).fontSize) * 100) /
+        100;
+      probe.remove();
+      return {
         fontSize: document.documentElement.dataset.fontSize,
-        textRemSize: getComputedStyle(document.documentElement)
-          .getPropertyValue("--buzz-type-rem")
-          .trim(),
+        rootFontSize: getComputedStyle(document.documentElement).fontSize,
+        typeRemPx,
         textScale: localStorage.getItem("buzz:text-scale"),
-      })),
-    )
-    .toEqual({
-      fontSize: "larger",
-      textRemSize: "25.714286px",
-      textScale: "1.5",
+      };
     });
 
+  await expect.poll(readTypographyState).toEqual({
+    fontSize: "larger",
+    rootFontSize: "24px",
+    typeRemPx: 25.71,
+    textScale: "1.5",
+  });
+
   const peerPage = await context.newPage();
   await installMockBridge(peerPage);
   await peerPage.goto("/");
   await peerPage.evaluate(() => localStorage.clear());
 
-  await expect
-    .poll(() =>
-      page.evaluate(() => ({
-        fontSize: document.documentElement.dataset.fontSize,
-        textRemSize: getComputedStyle(document.documentElement)
-          .getPropertyValue("--buzz-type-rem")
-          .trim(),
-        textScale: localStorage.getItem("buzz:text-scale"),
-      })),
-    )
-    .toEqual({
-      fontSize: "default",
-      textRemSize: "16px",
-      textScale: null,
-    });
+  await expect.poll(readTypographyState).toEqual({
+    fontSize: "default",
+    rootFontSize: "16px",
+    typeRemPx: 16,
+    textScale: null,
+  });
 
   await page.keyboard.press(
     process.platform === "darwin" ? "Meta+-" : "Control+-",
   );
-  await expect
-    .poll(() =>
-      page.evaluate(() => ({
-        textRemSize: getComputedStyle(document.documentElement)
-          .getPropertyValue("--buzz-type-rem")
-          .trim(),
-        textScale: localStorage.getItem("buzz:text-scale"),
-      })),
-    )
-    .toEqual({ textRemSize: "14.4px", textScale: "0.9" });
+  await expect.poll(readTypographyState).toEqual({
+    fontSize: "default",
+    rootFontSize: "14.4px",
+    typeRemPx: 14.4,
+    textScale: "0.9",
+  });
 
   await peerPage.close();
 });
@@ -2681,9 +2672,8 @@ test("shows agent runtimes in agent settings", async ({ page }) => {
   await expect(runtimeRow).toHaveCSS("border-top-width", "0px");
 
   const agentsSecondaryColor = await agentsPage
-    .getByText(
-      "Keep agents you address selected for future messages in the same channel or thread. Remove them from the composer at any time.",
-    )
+    .getByTestId("settings-automatic-agent-mentions")
+    .locator("[data-settings-subcopy]")
     .evaluate((element) => getComputedStyle(element).color);
   await page.getByTestId("settings-nav-appearance").click();
   const appearanceSecondaryColor = await page
diff --git a/desktop/tests/e2e/project-commit-detail.spec.ts b/desktop/tests/e2e/project-commit-detail.spec.ts
index 0a663653ab1..53804bf85ae 100644
--- a/desktop/tests/e2e/project-commit-detail.spec.ts
+++ b/desktop/tests/e2e/project-commit-detail.spec.ts
@@ -585,6 +585,50 @@ test("multi-repository projects switch the active repository", async ({
     .toBe(true);
 });
 
+test("latest files commit opens its detail without a divider", async ({
+  page,
+}) => {
+  await enableProjectsFeature(page);
+  await installMockBridge(page);
+  await page.goto("/", { waitUntil: "domcontentloaded" });
+  await page.getByTestId("open-projects-view").click();
+  await page.getByTestId("projects-section-projects").click();
+  const projectEntry = page
+    .locator(
+      '[data-testid="project-card-buzz"], [data-testid="project-row-buzz"]',
+    )
+    .first();
+  await expect(projectEntry).toBeVisible({ timeout: 10_000 });
+  await projectEntry.click();
+  await page.getByRole("tab", { name: "Files" }).click();
+
+  const latestCommit = page.getByTestId("project-repository-latest-commit");
+  await expect(latestCommit).toBeVisible();
+  await expect(latestCommit).toHaveCSS("border-bottom-width", "0px");
+  await expect(
+    page.getByTestId("project-repository-latest-commit-summary"),
+  ).toHaveCSS("font-size", "12px");
+  await expect(
+    page.getByTestId("project-repository-entry-row").first(),
+  ).toHaveCSS("font-size", "12px");
+  const repositoryEntryRow = page
+    .getByTestId("project-repository-entry-row")
+    .first();
+  const repositoryEntryCells = repositoryEntryRow.locator("td");
+  await expect(repositoryEntryCells.first()).toHaveCSS("border-radius", "0px");
+  await repositoryEntryRow.hover();
+  await expect(repositoryEntryCells.first()).toHaveCSS(
+    "border-top-left-radius",
+    "8px",
+  );
+  await expect(repositoryEntryCells.last()).toHaveCSS(
+    "border-top-right-radius",
+    "8px",
+  );
+  await latestCommit.click();
+  await expect(page.getByTestId("project-commit-detail")).toBeVisible();
+});
+
 test("commit detail opens from the commits feed with a diff", async ({
   page,
 }) => {
@@ -649,7 +693,10 @@ test("commit detail opens from the commits feed with a diff", async ({
   await expect(commitHeader).toContainText("Committed");
   await expect(commitHeader).not.toContainText("Brain");
   await expect(commitHeader.locator("img")).toHaveCount(0);
-  await expect(commitDetail).toHaveCSS("max-width", "768px");
+  await expect(commitDetail.locator(":scope > div").first()).toHaveCSS(
+    "max-width",
+    "768px",
+  );
   await expect(
     commitDetail.getByRole("heading", {
       name: "Add Trello board workflow details",
@@ -823,7 +870,7 @@ test("pull request and issue feeds use compact work item rows", async ({
     page.getByTestId("project-work-item-group-header").first(),
   ).toBeVisible();
   await expect(
-    prRows.first().locator("button").filter({ hasText: /.+/ }).nth(1),
+    prRows.first().locator("[data-projects-text-priority='primary']"),
   ).toHaveCSS("font-weight", "400");
   await waitForAnimations(page);
   await page.screenshot({ fullPage: false, path: `${SHOTS}/03-prs-feed.png` });
diff --git a/desktop/tests/e2e/project-issue-comments.spec.ts b/desktop/tests/e2e/project-issue-comments.spec.ts
index 4cf0f0940c4..6cfd6f0271d 100644
--- a/desktop/tests/e2e/project-issue-comments.spec.ts
+++ b/desktop/tests/e2e/project-issue-comments.spec.ts
@@ -38,6 +38,22 @@ test("issue detail can open agent chat or seed a channel question", async ({
     "project-context-communication-actions",
   );
   await expect(communication).toBeVisible();
+  const contextPanel = page.getByTestId("project-repository-actions-panel");
+  await expect(
+    contextPanel.getByRole("heading", { name: "Actions", exact: true }),
+  ).toHaveCount(0);
+  await expect(
+    contextPanel.getByRole("heading", { name: "Details", exact: true }),
+  ).toBeVisible();
+  await expect(
+    contextPanel.getByRole("heading", { name: "Assignment", exact: true }),
+  ).toHaveCount(0);
+  await expect(
+    contextPanel.getByRole("heading", { name: "Discussion", exact: true }),
+  ).toHaveCount(0);
+  await expect(
+    contextPanel.getByTestId("project-repository-people"),
+  ).toHaveCount(0);
   await page.getByTestId("project-context-chat-agent").click();
   await expect(page.getByTestId("project-agent-chat-panel")).toBeVisible();
   await expect(page.getByTestId("projects-agent-selection-item")).toHaveCount(
diff --git a/desktop/tests/e2e/project-pr-review.spec.ts b/desktop/tests/e2e/project-pr-review.spec.ts
index fc9448cebae..47a49709e25 100644
--- a/desktop/tests/e2e/project-pr-review.spec.ts
+++ b/desktop/tests/e2e/project-pr-review.spec.ts
@@ -33,6 +33,23 @@ async function enableProjectsFeature(page: import("@playwright/test").Page) {
   });
 }
 
+async function waitForMockLiveSubscription(
+  page: import("@playwright/test").Page,
+  channelName: string,
+) {
+  await expect
+    .poll(() =>
+      page.evaluate(
+        (name) =>
+          window.__BUZZ_E2E_HAS_MOCK_LIVE_SUBSCRIPTION__?.({
+            channelName: name,
+          }) ?? false,
+        channelName,
+      ),
+    )
+    .toBe(true);
+}
+
 async function openBuzzProject(page: import("@playwright/test").Page) {
   await page.goto("/", { waitUntil: "domcontentloaded" });
   await page.getByTestId("open-projects-view").click();
@@ -199,11 +216,28 @@ test("PR creator/owner can toggle draft, request reviews, and approve", async ({
   const contextReviewers = page.getByTestId("project-context-reviewers");
   await expect(contextReviewers).toBeVisible();
   await expect(contextReviewers.locator("img")).toHaveCount(0);
+  const contextPanel = page.getByTestId("project-repository-actions-panel");
+  await expect(
+    contextPanel.getByRole("heading", { name: "Actions", exact: true }),
+  ).toHaveCount(0);
+  await expect(
+    contextPanel.getByRole("heading", { name: "Details", exact: true }),
+  ).toBeVisible();
+  await expect(
+    contextPanel.getByRole("heading", { name: "Discussion", exact: true }),
+  ).toHaveCount(0);
+  await expect(
+    contextPanel.getByRole("heading", { name: "People", exact: true }),
+  ).toHaveCount(0);
+  await expect(
+    contextPanel.getByRole("heading", { name: "Review details", exact: true }),
+  ).toHaveCount(0);
   await expect(
     page.getByTestId("project-context-communication-actions"),
   ).toBeVisible();
   await expect(page.getByTestId("project-context-chat-agent")).toBeVisible();
   await expect(page.getByTestId("project-context-discuss")).toBeVisible();
+  await expect(page.getByTestId("project-context-branch")).toContainText("→");
   await expect(page.getByTestId("project-context-review-summary")).toHaveCount(
     0,
   );
@@ -264,6 +298,21 @@ test("PR creator/owner can toggle draft, request reviews, and approve", async ({
   await expect(page.getByText("Requested a review from bob")).toBeVisible({
     timeout: 10_000,
   });
+  await expect(page.getByTestId("project-review-summary")).toHaveCount(0);
+  const reviewerDecision = page
+    .getByTestId("project-reviewer-decision")
+    .filter({ hasText: "bob" });
+  await expect(
+    reviewerDecision.getByTestId("project-reviewer-name"),
+  ).toHaveText("bob");
+  await expect(reviewerDecision).toHaveAttribute(
+    "title",
+    "Awaiting review from bob",
+  );
+  await expect(page.getByTestId("project-reviewers-content")).toHaveCSS(
+    "flex-wrap",
+    "nowrap",
+  );
 
   await waitForAnimations(page);
   await page.screenshot({
@@ -287,9 +336,12 @@ test("PR creator/owner can toggle draft, request reviews, and approve", async ({
       .getByTestId("project-pull-request-timeline-row")
       .filter({ hasText: "requested changes" }),
   ).toBeVisible({ timeout: 10_000 });
-  await expect(page.getByTestId("project-review-summary")).toHaveText(
-    "Changes requested",
-  );
+  await expect(page.getByTestId("project-review-summary")).toHaveCount(0);
+  await expect(
+    page.locator(
+      '[data-testid="project-reviewer-decision"][title^="Changes requested by "]',
+    ),
+  ).toHaveCount(1);
   const changeRequestEvent = await page.evaluate(() =>
     window.__BUZZ_E2E_SIGNED_EVENTS__
       ?.filter(
@@ -368,10 +420,12 @@ test("PR creator/owner can toggle draft, request reviews, and approve", async ({
   await expect(
     page.getByRole("button", { name: "Approve", exact: true }),
   ).toHaveCount(0);
-  await expect(page.getByTestId("project-review-summary")).toHaveText(
-    "Awaiting review",
-  );
-  await expect(page.getByText("Approved", { exact: true })).toBeVisible();
+  await expect(page.getByTestId("project-review-summary")).toHaveCount(0);
+  await expect(
+    page.locator(
+      '[data-testid="project-reviewer-decision"][title^="Approved by "]',
+    ),
+  ).toHaveCount(1);
   const approvalEvent = await page.evaluate(() =>
     window.__BUZZ_E2E_SIGNED_EVENTS__
       ?.filter(
@@ -1096,6 +1150,14 @@ test("sidebar distinguishes the Projects overview from an open project", async (
   await projectsOverview.click();
   await expect(projectsOverview).toHaveAttribute("data-active", "true");
   await expect(sidebarProject).toHaveAttribute("data-active", "false");
+  await expect(sidebarProject.locator("svg").first()).toHaveCSS(
+    "opacity",
+    "0.8",
+  );
+  await expect(sidebarProject.locator('[data-sidebar="menu-label"]')).toHaveCSS(
+    "opacity",
+    "0.8",
+  );
 
   await sidebarProject.click();
   await expect(projectsOverview).toHaveAttribute("data-active", "true");
@@ -1295,8 +1357,8 @@ test("overview tasks and reviews are grouped and selectable by project", async (
   }
 });
 
-test("project section icons follow their titles", async ({ page }) => {
-  const expectIconAfterTitle = async (headerTestId: string) => {
+test("project section icons lead their titles", async ({ page }) => {
+  const expectIconBeforeTitle = async (headerTestId: string) => {
     const header = page.getByTestId(headerTestId);
     const [titleBox, iconBox] = await Promise.all([
       header.getByRole("heading").boundingBox(),
@@ -1304,8 +1366,8 @@ test("project section icons follow their titles", async ({ page }) => {
     ]);
     expect(titleBox).not.toBeNull();
     expect(iconBox).not.toBeNull();
-    expect(iconBox?.x ?? 0).toBeGreaterThan(
-      (titleBox?.x ?? 0) + (titleBox?.width ?? 0),
+    expect((iconBox?.x ?? 0) + (iconBox?.width ?? 0)).toBeLessThan(
+      titleBox?.x ?? 0,
     );
   };
 
@@ -1314,11 +1376,282 @@ test("project section icons follow their titles", async ({ page }) => {
   await page.goto("/", { waitUntil: "domcontentloaded" });
   await page.getByTestId("open-projects-view").click();
   await page.getByTestId("projects-section-issues").click();
-  await expectIconAfterTitle("projects-page-header");
+  await expectIconBeforeTitle("projects-page-header");
 
   await openBuzzProject(page);
   await page.getByRole("tab", { name: "Tasks", exact: true }).click();
-  await expectIconAfterTitle("project-section-header");
+  await expectIconBeforeTitle("project-section-header");
+});
+
+test("project detail lists follow overview header geometry", async ({
+  page,
+}) => {
+  await enableProjectsFeature(page);
+  await installMockBridge(page);
+  await openBuzzProject(page);
+
+  for (const [tab, title] of [
+    ["Tasks", "Tasks"],
+    ["Review", "Reviews"],
+  ] as const) {
+    await page.getByRole("tab", { name: tab, exact: true }).click();
+    const header = page.getByTestId("project-section-header");
+    const group = page.getByTestId("project-work-item-group-header").first();
+    const firstRow = page
+      .getByTestId(
+        tab === "Tasks" ? "project-issue-row" : "project-pull-request-row",
+      )
+      .first();
+    const [headerBox, titleBox, groupBox, groupLabelBox, rowTitleBox] =
+      await Promise.all([
+        header.boundingBox(),
+        header.getByRole("heading", { name: title, exact: true }).boundingBox(),
+        group.boundingBox(),
+        group.getByTestId("project-work-item-group-label").boundingBox(),
+        firstRow
+          .locator('[data-projects-text-priority="primary"]')
+          .boundingBox(),
+      ]);
+    expect(headerBox).not.toBeNull();
+    expect(titleBox).not.toBeNull();
+    expect(groupBox).not.toBeNull();
+    expect(groupLabelBox).not.toBeNull();
+    expect(rowTitleBox).not.toBeNull();
+    expect(
+      Math.abs((headerBox?.x ?? 0) - (groupBox?.x ?? 0)),
+    ).toBeLessThanOrEqual(1);
+    const headerRight = (headerBox?.x ?? 0) + (headerBox?.width ?? 0);
+    const groupRight = (groupBox?.x ?? 0) + (groupBox?.width ?? 0);
+    expect(Math.abs(headerRight - groupRight)).toBeLessThanOrEqual(2);
+    expect(
+      Math.abs((titleBox?.x ?? 0) - (groupLabelBox?.x ?? 0)),
+    ).toBeLessThanOrEqual(2);
+    expect(
+      Math.abs((groupLabelBox?.x ?? 0) - (rowTitleBox?.x ?? 0)),
+    ).toBeLessThanOrEqual(2);
+    expect(
+      (groupBox?.y ?? 0) - ((headerBox?.y ?? 0) + (headerBox?.height ?? 0)),
+    ).toBeGreaterThanOrEqual(8);
+  }
+
+  for (const [tab, title, rowTestId, rowInset] of [
+    ["Contributors", "Contributors", "project-contributor-row", 0],
+  ] as const) {
+    await page.getByRole("tab", { name: tab, exact: true }).click();
+    const header = page.getByTestId("project-section-header");
+    const row = page.getByTestId(rowTestId).first();
+    const [headerBox, titleBox, rowBox, rowTitleBox] = await Promise.all([
+      header.boundingBox(),
+      header.getByRole("heading", { name: title, exact: true }).boundingBox(),
+      row.boundingBox(),
+      row.locator('[data-projects-text-priority="primary"]').boundingBox(),
+    ]);
+    expect(headerBox).not.toBeNull();
+    expect(titleBox).not.toBeNull();
+    expect(rowBox).not.toBeNull();
+    expect(rowTitleBox).not.toBeNull();
+    expect(
+      Math.abs((rowBox?.x ?? 0) - (headerBox?.x ?? 0) - rowInset),
+    ).toBeLessThanOrEqual(2);
+    const headerRight = (headerBox?.x ?? 0) + (headerBox?.width ?? 0);
+    const rowRight = (rowBox?.x ?? 0) + (rowBox?.width ?? 0);
+    expect(Math.abs(headerRight - rowRight - rowInset)).toBeLessThanOrEqual(2);
+    expect(
+      Math.abs((titleBox?.x ?? 0) - (rowTitleBox?.x ?? 0)),
+    ).toBeLessThanOrEqual(2);
+  }
+
+  await page.getByRole("tab", { name: "Channels", exact: true }).click();
+  await expect(page.getByTestId("project-discussion-channels-panel")).toHaveCSS(
+    "padding-left",
+    "16px",
+  );
+  await expect(page.getByTestId("project-discussion-channels-panel")).toHaveCSS(
+    "padding-right",
+    "16px",
+  );
+});
+
+test("channels tab opens the latest matching conversation without leaving the project", async ({
+  page,
+}) => {
+  await enableProjectsFeature(page);
+  await installMockBridge(page);
+  await page.goto("/", { waitUntil: "domcontentloaded" });
+  await page.getByTestId("channel-general").click();
+  await waitForMockLiveSubscription(page, "general");
+
+  const olderContent = "Older matching conversation for channels tab";
+  const latestContent = "Latest matching conversation for channels tab";
+  await page.evaluate(
+    ({ author, latestContent, olderContent, repoToken }) => {
+      const now = Math.floor(Date.now() / 1_000);
+      window.__BUZZ_E2E_EMIT_MOCK_MESSAGE__?.({
+        channelName: "general",
+        content: `${olderContent} ${repoToken}`,
+        createdAt: now - 1,
+        kind: 9,
+        pubkey: author,
+      });
+      window.__BUZZ_E2E_EMIT_MOCK_MESSAGE__?.({
+        channelName: "general",
+        content: `${latestContent} ${repoToken}`,
+        createdAt: now,
+        kind: 9,
+        pubkey: author,
+      });
+    },
+    {
+      author: TEST_IDENTITIES.alice.pubkey,
+      latestContent,
+      olderContent,
+      repoToken: `${DEFAULT_MOCK_PUBKEY} buzz`,
+    },
+  );
+
+  await page.getByTestId("open-projects-view").click();
+  await page.getByTestId("projects-section-projects").click();
+  const projectEntry = page
+    .locator(
+      '[data-testid="project-card-buzz"], [data-testid="project-row-buzz"]',
+    )
+    .first();
+  await expect(projectEntry).toBeVisible({ timeout: 10_000 });
+  await projectEntry.click();
+  await page.getByRole("tab", { name: "Channels", exact: true }).click();
+  const channelRow = page.getByTestId("project-channel-row").first();
+  await expect(channelRow).toBeVisible({ timeout: 10_000 });
+  await channelRow.click();
+
+  const panel = page.getByTestId("project-conversation-panel");
+  await expect(panel).toBeVisible();
+  await expect(panel).toContainText(latestContent);
+  await expect(panel).not.toContainText(olderContent);
+  await expect(page.getByTestId("project-detail-scroll")).toBeVisible();
+  await expect(
+    page.getByRole("tab", { name: "Channels", exact: true }),
+  ).toHaveAttribute("aria-selected", "true");
+});
+
+test("overview list titles share a row with controls and task groups align", async ({
+  page,
+}) => {
+  await enableProjectsFeature(page);
+  await installMockBridge(page);
+  await page.goto("/", { waitUntil: "domcontentloaded" });
+  await page.getByTestId("open-projects-view").click();
+
+  const rowSelectors = {
+    issues: '[data-testid^="projects-issue-row-"]',
+    projects: '[data-testid^="project-row-"]',
+    prs: '[data-testid^="projects-pr-row-"]',
+    repositories: '[data-testid^="repository-row-"]',
+  };
+  for (const section of [
+    "projects",
+    "repositories",
+    "issues",
+    "prs",
+  ] as const) {
+    await page.getByTestId(`projects-section-${section}`).click();
+    const header = page.getByTestId("projects-page-header");
+    const [headingBox, controlsBox] = await Promise.all([
+      header.getByRole("heading").boundingBox(),
+      header.getByTestId("projects-list-header").boundingBox(),
+    ]);
+    expect(headingBox).not.toBeNull();
+    expect(controlsBox).not.toBeNull();
+    const headingCenter = (headingBox?.y ?? 0) + (headingBox?.height ?? 0) / 2;
+    const controlsCenter =
+      (controlsBox?.y ?? 0) + (controlsBox?.height ?? 0) / 2;
+    expect(Math.abs(headingCenter - controlsCenter)).toBeLessThanOrEqual(2);
+
+    await header.getByRole("button", { name: "List layout" }).click();
+    const row = page.locator(rowSelectors[section]).first();
+    await expect(row).toBeVisible();
+    const [layoutButtonBox, rowMenuBox] = await Promise.all([
+      header.getByRole("button", { name: "List layout" }).boundingBox(),
+      row.getByRole("button", { name: /More options for/ }).boundingBox(),
+    ]);
+    expect(layoutButtonBox).not.toBeNull();
+    expect(rowMenuBox).not.toBeNull();
+    const layoutRight =
+      (layoutButtonBox?.x ?? 0) + (layoutButtonBox?.width ?? 0);
+    const rowMenuRight = (rowMenuBox?.x ?? 0) + (rowMenuBox?.width ?? 0);
+    expect(Math.abs(layoutRight - rowMenuRight)).toBeLessThanOrEqual(2);
+  }
+
+  for (const [section, groupTestId, groupLabelTestId, hasListLayout] of [
+    [
+      "issues",
+      "projects-issue-project-group-header",
+      "project-issue-project",
+      true,
+    ],
+    [
+      "prs",
+      "projects-review-project-group-header",
+      "project-review-project",
+      true,
+    ],
+    [
+      "channels",
+      "projects-channel-project-group-header",
+      "project-channel-project",
+      false,
+    ],
+  ] as const) {
+    await page.getByTestId(`projects-section-${section}`).click();
+    if (hasListLayout) {
+      await page.getByRole("button", { name: "List layout" }).click();
+    }
+    const [headerBox, headerTitleBox, groupBox, groupLabelBox] =
+      await Promise.all([
+        page.getByTestId("projects-page-header").boundingBox(),
+        page
+          .getByTestId("projects-page-header")
+          .getByRole("heading")
+          .boundingBox(),
+        page.getByTestId(groupTestId).first().boundingBox(),
+        page.getByTestId(groupLabelTestId).first().boundingBox(),
+      ]);
+    expect(headerBox).not.toBeNull();
+    expect(headerTitleBox).not.toBeNull();
+    expect(groupBox).not.toBeNull();
+    expect(groupLabelBox).not.toBeNull();
+    expect(
+      Math.abs((headerBox?.x ?? 0) - (groupBox?.x ?? 0)),
+    ).toBeLessThanOrEqual(1);
+    const headerRight = (headerBox?.x ?? 0) + (headerBox?.width ?? 0);
+    const groupRight = (groupBox?.x ?? 0) + (groupBox?.width ?? 0);
+    expect(Math.abs(headerRight - groupRight)).toBeLessThanOrEqual(2);
+    expect(
+      Math.abs((headerTitleBox?.x ?? 0) - (groupLabelBox?.x ?? 0)),
+    ).toBeLessThanOrEqual(2);
+
+    if (section === "issues") {
+      const groupHeader = page.getByTestId(groupTestId).first();
+      const groupIcon = groupHeader.getByTestId("project-group-icon");
+      const groupCheckbox = groupHeader.getByTestId("projects-group-select");
+      await expect(groupIcon).toHaveCSS("opacity", "1");
+      await groupHeader.hover();
+      await expect(groupIcon).toHaveCSS("opacity", "0");
+      await expect(groupCheckbox.locator("..").locator("..")).toHaveCSS(
+        "opacity",
+        "1",
+      );
+      const [iconSlotBox, checkboxBox] = await Promise.all([
+        groupHeader.getByTestId("project-group-leading-icon").boundingBox(),
+        groupCheckbox.boundingBox(),
+      ]);
+      expect(iconSlotBox).not.toBeNull();
+      expect(checkboxBox).not.toBeNull();
+      const iconCenter = (iconSlotBox?.x ?? 0) + (iconSlotBox?.width ?? 0) / 2;
+      const checkboxCenter =
+        (checkboxBox?.x ?? 0) + (checkboxBox?.width ?? 0) / 2;
+      expect(Math.abs(iconCenter - checkboxCenter)).toBeLessThanOrEqual(1);
+    }
+  }
 });
 
 test("project overview presents collapsible context beside grouped activity", async ({
@@ -1413,7 +1746,7 @@ test("project overview presents collapsible context beside grouped activity", as
     page
       .getByTestId("projects-overview-context-panel")
       .getByTestId("projects-overview-activity"),
-  ).toBeVisible();
+  ).toHaveCount(0);
   await expect(
     page.getByTestId("projects-activity-group").first(),
   ).toContainText(/This week|Last week|Earlier/);
@@ -1442,7 +1775,8 @@ test("project overview presents collapsible context beside grouped activity", as
   expect(Math.abs((searchBox?.y ?? 0) - (firstTabBox?.y ?? 0))).toBeLessThan(8);
   expect(tabMenuBox?.y ?? 0).toBeLessThan(introBox?.y ?? 0);
   expect(introBox?.y ?? 0).toBeLessThan(feedBox?.y ?? 0);
-  expect(feedBox?.width ?? 0).toBeLessThan((contentPodBox?.width ?? 0) - 48);
+  expect(feedBox?.width ?? 0).toBeGreaterThan(600);
+  expect(feedBox?.width ?? 0).toBeLessThan((contentPodBox?.width ?? 0) - 32);
   const feedCenter = (feedBox?.x ?? 0) + (feedBox?.width ?? 0) / 2;
   const contentCenter =
     (contentPodBox?.x ?? 0) + (contentPodBox?.width ?? 0) / 2;
@@ -1531,7 +1865,7 @@ test("project overview presents collapsible context beside grouped activity", as
     page.getByTestId("projects-overview-create-project"),
   ).toBeVisible();
   await expect(page.getByTestId("projects-overview-people")).toBeVisible();
-  await expect(page.getByTestId("projects-overview-activity")).toBeVisible();
+  await expect(page.getByTestId("projects-overview-activity")).toHaveCount(0);
   await page.getByTestId("projects-section-repositories").click();
   await expect(page.getByTestId("projects-overview-context-title")).toHaveText(
     "Repositories",
@@ -1540,7 +1874,7 @@ test("project overview presents collapsible context beside grouped activity", as
     page.getByTestId("projects-overview-create-project"),
   ).toHaveCount(0);
   await expect(stats.nth(1)).toContainText("Active tasks");
-  await expect(page.getByTestId("projects-overview-activity")).toBeVisible();
+  await expect(page.getByTestId("projects-overview-activity")).toHaveCount(0);
   await page.getByTestId("projects-section-issues").click();
   await expect(page.getByTestId("projects-overview-context-title")).toHaveText(
     "Tasks",
@@ -1565,7 +1899,7 @@ test("project overview presents collapsible context beside grouped activity", as
   await expect(page.getByTestId("projects-overview-context-title")).toHaveText(
     "Projects",
   );
-  await expect(page.getByTestId("projects-overview-activity")).toBeVisible();
+  await expect(page.getByTestId("projects-overview-activity")).toHaveCount(0);
 
   await page.getByTestId("projects-overview-create-project").click();
   await expect(page.getByTestId("create-project-dialog")).toBeVisible();
@@ -1593,7 +1927,9 @@ test("project overview presents collapsible context beside grouped activity", as
   ).toHaveCount(0);
 });
 
-test("project overview content header toggles agent chat", async ({ page }) => {
+test("project overview chrome toggles a detached resizable agent chat", async ({
+  page,
+}) => {
   await enableProjectsFeature(page);
   await installMockBridge(page);
   await page.goto("/", { waitUntil: "domcontentloaded" });
@@ -1610,25 +1946,36 @@ test("project overview content header toggles agent chat", async ({ page }) => {
     "Chat with an agent about Reviews",
   );
   await expect(overviewChat).toHaveAttribute("aria-pressed", "false");
-  const [contentBox, chatBox] = await Promise.all([
-    page.getByTestId("projects-overview-content-pod").boundingBox(),
+  const overviewInfo = page.getByTestId("projects-overview-context-toggle");
+  const [chatBox, infoBox] = await Promise.all([
     overviewChat.boundingBox(),
+    overviewInfo.boundingBox(),
   ]);
-  expect(contentBox).not.toBeNull();
   expect(chatBox).not.toBeNull();
+  expect(infoBox).not.toBeNull();
   expect(
-    (contentBox?.x ?? 0) +
-      (contentBox?.width ?? 0) -
-      ((chatBox?.x ?? 0) + (chatBox?.width ?? 0)),
-  ).toBeLessThanOrEqual(20);
+    (infoBox?.x ?? 0) - ((chatBox?.x ?? 0) + (chatBox?.width ?? 0)),
+  ).toBeLessThanOrEqual(4);
+  const contextRail = page.getByTestId("projects-overview-context-rail");
+  await expect(overviewInfo).toHaveAttribute("aria-pressed", "true");
+  await overviewInfo.click();
+  await expect(overviewInfo).toHaveAttribute("aria-pressed", "false");
+  await expect(contextRail).toHaveCSS("width", "0px");
   await overviewChat.click();
   await expect(overviewChat).toHaveAttribute("aria-pressed", "true");
+  await expect(overviewInfo).toHaveAttribute("aria-pressed", "false");
+  await expect(contextRail).toHaveCSS("width", "0px");
   await expect(overviewChat).toBeVisible();
+  const chatRail = page.getByTestId("projects-overview-agent-rail");
+  await expect(chatRail.getByTestId("project-agent-chat-panel")).toBeVisible();
   await expect(
     page
       .getByTestId("projects-overview-content-pod")
       .getByTestId("project-agent-chat-panel"),
-  ).toBeVisible();
+  ).toHaveCount(0);
+  await expect(
+    chatRail.getByTestId("projects-overview-agent-rail-panel"),
+  ).toHaveCSS("border-radius", "16px");
   const agentHeader = page.getByTestId("project-agent-context");
   await expect
     .poll(() =>
@@ -1637,11 +1984,46 @@ test("project overview content header toggles agent chat", async ({ page }) => {
       ),
     )
     .not.toBe("none");
-  await expect(page.getByTestId("projects-overview-agent-rail")).toHaveCount(0);
+  await expect(contextRail).toHaveAttribute("aria-hidden", "true");
+  await overviewInfo.click();
+  await expect(overviewInfo).toHaveAttribute("aria-pressed", "true");
+  await expect(contextRail).toHaveAttribute("aria-hidden", "false");
   await expect(
     page.getByTestId("projects-overview-context-panel"),
   ).toBeVisible();
   const chatPanel = page.getByTestId("project-agent-chat-panel");
+  const resizeHandle = chatPanel.getByTestId(
+    "right-auxiliary-pane-resize-handle",
+  );
+  const [initialPanelBox, resizeHandleBox] = await Promise.all([
+    chatPanel.boundingBox(),
+    resizeHandle.boundingBox(),
+  ]);
+  expect(initialPanelBox).not.toBeNull();
+  expect(resizeHandleBox).not.toBeNull();
+  const resizeStartX =
+    (resizeHandleBox?.x ?? 0) + (resizeHandleBox?.width ?? 0) / 2;
+  const resizeStartY =
+    (resizeHandleBox?.y ?? 0) + (resizeHandleBox?.height ?? 0) / 2;
+  await resizeHandle.dispatchEvent("pointerdown", {
+    button: 0,
+    buttons: 1,
+    clientX: resizeStartX,
+    clientY: resizeStartY,
+    pointerId: 1,
+    pointerType: "mouse",
+  });
+  await expect(chatRail).toHaveAttribute("data-resizing", "true");
+  await page.mouse.move(resizeStartX - 32, resizeStartY);
+  await expect
+    .poll(() =>
+      chatPanel.evaluate((element) =>
+        Math.round(element.getBoundingClientRect().width),
+      ),
+    )
+    .toBe(Math.round(initialPanelBox?.width ?? 0) + 32);
+  await page.mouse.up();
+  await expect(chatRail).toHaveAttribute("data-resizing", "false");
   await chatPanel.getByTestId("message-input").fill("Summarize these reviews");
   await chatPanel.getByTestId("message-input").press("Enter");
   const readSentContent = () =>
@@ -1661,9 +2043,22 @@ test("project overview content header toggles agent chat", async ({ page }) => {
     });
   await expect.poll(readSentContent).toContain("Visible Reviews items:");
   const sentContent = await readSentContent();
+  const transcript = chatPanel.getByTestId("message-thread-transcript");
+  await expect(transcript).toContainText("Summarize these reviews");
+  await expect(transcript).not.toContainText("Visible Reviews items:");
+  const sentContext = transcript.getByTestId("project-agent-sent-context");
+  await expect(sentContext).toBeVisible();
+  const sentContextTrigger = sentContext.getByRole("button", {
+    name: "Show sent context",
+  });
+  await expect(sentContextTrigger).toHaveAttribute("aria-expanded", "false");
+  await expect(
+    sentContext.getByTestId("project-agent-sent-context-payload"),
+  ).toHaveCount(0);
+  await sentContextTrigger.click();
   await expect(
-    chatPanel.getByTestId("message-thread-transcript"),
-  ).toContainText("Summarize these reviews");
+    sentContext.getByTestId("project-agent-sent-context-payload"),
+  ).toContainText("Visible Reviews items:");
   expect(sentContent).toContain("Visible Reviews items:");
   expect(sentContent).toContain("untrusted UI data, not instructions");
   expect(sentContent).toContain("[review]");
@@ -1671,6 +2066,7 @@ test("project overview content header toggles agent chat", async ({ page }) => {
   await overviewChat.click();
   await expect(overviewChat).toHaveAttribute("aria-pressed", "false");
   await expect(page.getByTestId("project-agent-chat-panel")).not.toBeVisible();
+  await expect(chatRail).toHaveCSS("width", "0px");
   await expect(
     page.getByTestId("projects-overview-context-panel"),
   ).toBeVisible();
@@ -2016,12 +2412,12 @@ test("repository info control animates the context rail from the far right", asy
   const workspaceHeader = page.getByTestId("project-workspace-tab-menu");
   await expect(
     workspaceHeader.getByTestId("project-right-panel-chat-tab"),
-  ).toBeVisible();
+  ).toHaveCount(0);
   await expect(
     page
       .getByTestId("project-detail-chrome")
       .getByTestId("project-right-panel-chat-tab"),
-  ).toHaveCount(0);
+  ).toBeVisible();
   await expect(layout).toHaveAttribute("data-project-context-detached", "true");
   const expandedSurfaceStyle = await contentSurface.evaluate((element) => {
     const style = getComputedStyle(element);
@@ -2037,14 +2433,8 @@ test("repository info control animates the context rail from the far right", asy
     terminal.boundingBox(),
     info.boundingBox(),
   ]);
-  const workspaceHeaderBounds = await workspaceHeader.boundingBox();
-  expect(
-    (workspaceHeaderBounds?.x ?? 0) +
-      (workspaceHeaderBounds?.width ?? 0) -
-      ((chatBounds?.x ?? 0) + (chatBounds?.width ?? 0)),
-  ).toBeLessThanOrEqual(16);
-  expect(chatBounds?.x).toBeLessThan(terminalBounds?.x ?? 0);
-  expect(terminalBounds?.x).toBeLessThan(infoBounds?.x ?? 0);
+  expect(terminalBounds?.x).toBeLessThan(chatBounds?.x ?? 0);
+  expect(chatBounds?.x).toBeLessThan(infoBounds?.x ?? 0);
   await expect(info).toHaveCSS("background-color", "rgba(0, 0, 0, 0)");
   await expect(infoIcon).toHaveCSS("opacity", "1");
   await expect(rail).toHaveCSS("width", "288px");
@@ -2180,13 +2570,22 @@ test("selecting repository workspace rows switches the context pod to the cluste
       title: left('[data-projects-text-priority="primary"]'),
     };
   });
-  expect(reviewRowOrder.checkbox).toBeLessThan(reviewRowOrder.identifier);
-  expect(reviewRowOrder.identifier).toBeLessThan(reviewRowOrder.status);
+  expect(
+    Math.abs(reviewRowOrder.checkbox - reviewRowOrder.status),
+  ).toBeLessThanOrEqual(1);
   expect(reviewRowOrder.status).toBeLessThan(reviewRowOrder.title);
+  expect(reviewRowOrder.title).toBeLessThan(reviewRowOrder.identifier);
   await reviewRows.first().getByTestId("projects-row-select").click();
   await expect(
     reviewRows.first().getByTestId("project-work-item-status-icon"),
-  ).toBeVisible();
+  ).toHaveCSS("opacity", "0");
+  await expect(
+    reviewRows
+      .first()
+      .getByTestId("projects-row-select")
+      .locator("..")
+      .locator(".."),
+  ).toHaveCSS("opacity", "1");
   await expect(page.getByTestId("projects-overview-context-title")).toHaveText(
     "1 review",
   );
@@ -2819,7 +3218,10 @@ test("pushed local branch can open a pull request", async ({ page }) => {
     .getByRole("menuitemradio", { name: "feature/projects-workflow" })
     .click();
   await page.getByRole("tab", { name: "Review", exact: true }).click();
-  await page.getByRole("button", { name: "Create review" }).click();
+  await page
+    .getByTestId("project-section-header")
+    .getByRole("button", { name: "Create review" })
+    .click();
   await expect(page.getByTestId("create-pull-request-repository")).toHaveValue(
     /:buzz$/,
   );
diff --git a/desktop/tests/e2e/projects-v3-screenshots.spec.ts b/desktop/tests/e2e/projects-v3-screenshots.spec.ts
index 93578ef552a..7548769e53c 100644
--- a/desktop/tests/e2e/projects-v3-screenshots.spec.ts
+++ b/desktop/tests/e2e/projects-v3-screenshots.spec.ts
@@ -19,6 +19,37 @@ async function expectSinglePrimaryTextColumn(row: Locator) {
   expect(secondaryColors.every((color) => color !== primaryColor)).toBe(true);
 }
 
+async function expectProjectContextGroups(
+  panel: Locator,
+  { hasActions }: { hasActions: boolean },
+) {
+  const detailsHeading = panel.getByRole("heading", {
+    name: "Details",
+    exact: true,
+  });
+  await expect(detailsHeading).toBeVisible();
+  if (hasActions) {
+    await expect(panel.getByTestId("project-context-actions")).toBeVisible();
+  } else {
+    await expect(panel.getByTestId("project-context-actions")).toHaveCount(0);
+  }
+  for (const name of [
+    "Actions",
+    "Assignment",
+    "Discussion",
+    "People",
+    "Task details",
+    "Review details",
+    "Review activity",
+    "Repository activity",
+  ]) {
+    await expect(panel.getByRole("heading", { name, exact: true })).toHaveCount(
+      0,
+    );
+  }
+  await expect(panel.getByTestId("project-repository-people")).toHaveCount(0);
+}
+
 async function openBuzzProject(page: import("@playwright/test").Page) {
   await page.goto("/", { waitUntil: "domcontentloaded" });
   await page.getByTestId("open-projects-view").click();
@@ -40,7 +71,19 @@ test("projects activity overview screenshot", async ({ page }) => {
   await page.goto("/", { waitUntil: "domcontentloaded" });
   await page.getByTestId("open-projects-view").click();
   await expect(page.getByTestId("projects-page-tabs")).toBeVisible();
-  await expect(page.getByTestId("projects-page-header")).toBeVisible();
+  const activityHeader = page.getByTestId("projects-page-header");
+  const relayIcon = page.getByTestId("projects-activity-relay-icon");
+  await expect(activityHeader).toBeVisible();
+  await expect(relayIcon).toBeVisible();
+  const [activityHeaderBox, relayIconBox] = await Promise.all([
+    activityHeader.boundingBox(),
+    relayIcon.boundingBox(),
+  ]);
+  expect(activityHeaderBox).not.toBeNull();
+  expect(relayIconBox).not.toBeNull();
+  expect((relayIconBox?.y ?? 0) + (relayIconBox?.height ?? 0)).toBeLessThan(
+    activityHeaderBox?.y ?? 0,
+  );
   await expect(page.getByTestId("projects-activity-search")).toBeVisible();
   await expect(page.getByTestId("projects-activity-intro")).toContainText(
     "Projects Activity",
@@ -58,6 +101,40 @@ test("projects activity overview screenshot", async ({ page }) => {
   await page.screenshot({ path: `${SHOTS}/00-projects-pulse.png` });
 });
 
+test("submitted project context stays compact and expandable", async ({
+  page,
+}) => {
+  await installMockBridge(page);
+  await page.goto("/", { waitUntil: "domcontentloaded" });
+  await page.getByTestId("open-projects-view").click();
+  await page.getByTestId("projects-section-prs").click();
+  await page.getByRole("button", { name: "List layout" }).click();
+  await page.getByTestId("projects-overview-chat-toggle").click();
+
+  const panel = page.getByTestId("project-agent-chat-panel");
+  await panel.getByTestId("message-input").fill("Summarize these reviews");
+  await panel.getByTestId("message-input").press("Enter");
+  const context = panel.getByTestId("project-agent-sent-context");
+  await expect(context).toBeVisible();
+  await expect(
+    panel.getByRole("button", { name: "Preview message context" }),
+  ).toBeVisible();
+
+  await waitForAnimations(page);
+  await panel.screenshot({
+    path: `${SHOTS}/08-agent-context-collapsed.png`,
+  });
+
+  await context.getByRole("button", { name: "Show sent context" }).click();
+  await expect(
+    context.getByTestId("project-agent-sent-context-payload"),
+  ).toBeVisible();
+  await waitForAnimations(page);
+  await panel.screenshot({
+    path: `${SHOTS}/09-agent-context-expanded.png`,
+  });
+});
+
 test("sidebar project add flow browses before creating", async ({ page }) => {
   await installMockBridge(page);
   await page.goto("/", { waitUntil: "domcontentloaded" });
@@ -205,7 +282,7 @@ test("projects v3 workspace screenshot states", async ({ page }) => {
   const repositoryActionsPanel = page.getByTestId(
     "project-repository-actions-panel",
   );
-  const expectFullWidthSection = async () => {
+  const expectInsetSection = async () => {
     const sectionHeader = workspacePanel.getByTestId("project-section-header");
     const [workspaceBox, headerBox, menuBox] = await Promise.all([
       workspacePanel.boundingBox(),
@@ -215,8 +292,14 @@ test("projects v3 workspace screenshot states", async ({ page }) => {
     expect(workspaceBox).not.toBeNull();
     expect(headerBox).not.toBeNull();
     expect(menuBox).not.toBeNull();
-    expect(headerBox?.x).toBe(workspaceBox?.x);
-    expect(headerBox?.width).toBe(workspaceBox?.width);
+    expect(Math.round((headerBox?.x ?? 0) - (workspaceBox?.x ?? 0))).toBe(16);
+    expect(
+      Math.round(
+        (workspaceBox?.x ?? 0) +
+          (workspaceBox?.width ?? 0) -
+          ((headerBox?.x ?? 0) + (headerBox?.width ?? 0)),
+      ),
+    ).toBe(16);
     expect(workspaceBox?.x).toBe(menuBox?.x);
     expect((workspaceBox?.x ?? 0) + (workspaceBox?.width ?? 0)).toBe(
       (menuBox?.x ?? 0) + (menuBox?.width ?? 0),
@@ -249,37 +332,23 @@ test("projects v3 workspace screenshot states", async ({ page }) => {
   });
   await expect(repositoryHeading).toBeVisible();
   await expect(repositoryHeading).toHaveCSS("font-size", "14px");
-  await expect(
-    repositoryActionsPanel.getByRole("heading", {
-      name: "Actions",
-      exact: true,
-    }),
-  ).toHaveCount(0);
+  await expectProjectContextGroups(repositoryActionsPanel, {
+    hasActions: true,
+  });
   await expect(
     repositoryActionsPanel.getByRole("heading", {
       name: "Languages",
       exact: true,
     }),
   ).toHaveCount(0);
-  await expect(
-    repositoryActionsPanel.getByRole("heading", {
-      name: "People",
-      exact: true,
-    }),
-  ).toHaveCount(0);
   const detailsHeading = repositoryActionsPanel.getByRole("heading", {
     name: "Details",
     exact: true,
   });
-  const peopleContent = repositoryActionsPanel.getByTestId(
-    "project-repository-people",
-  );
-  const peopleSection = peopleContent.locator("..");
   const fetchButton = repositoryActionsPanel.getByRole("button", {
     name: "Fetch",
     exact: true,
   });
-  await expect(peopleSection).toHaveCSS("border-top-width", "0px");
   await expect(detailsHeading.locator("..")).toHaveCSS(
     "border-top-width",
     "0px",
@@ -291,37 +360,25 @@ test("projects v3 workspace screenshot states", async ({ page }) => {
   ).toBe(
     await detailsHeading.evaluate((element) => getComputedStyle(element).color),
   );
-  const actionsSection = repositoryActionsPanel
-    .getByRole("button", { name: "Terminal", exact: true })
-    .locator("..")
-    .locator("..");
-  const [actionsSectionBounds, peopleSectionBounds, detailsHeadingBounds] =
+  const actionsSection = repositoryActionsPanel.getByTestId(
+    "project-context-actions",
+  );
+  const detailsSection = repositoryActionsPanel.getByTestId(
+    "project-context-details",
+  );
+  const [actionsSectionBounds, detailsSectionBounds, detailsHeadingBounds] =
     await Promise.all([
       actionsSection.boundingBox(),
-      peopleSection.boundingBox(),
+      detailsSection.boundingBox(),
       detailsHeading.boundingBox(),
     ]);
   expect(
-    (peopleSectionBounds?.y ?? 0) -
+    (detailsSectionBounds?.y ?? 0) -
       ((actionsSectionBounds?.y ?? 0) + (actionsSectionBounds?.height ?? 0)),
   ).toBe(8);
-  expect((detailsHeadingBounds?.y ?? 0) - (peopleSectionBounds?.y ?? 0)).toBe(
+  expect((detailsHeadingBounds?.y ?? 0) - (detailsSectionBounds?.y ?? 0)).toBe(
     8,
   );
-  const people = repositoryActionsPanel.getByTestId(
-    "project-repository-person",
-  );
-  const [firstPersonBounds, secondPersonBounds] = await Promise.all([
-    people.nth(0).boundingBox(),
-    people.nth(1).boundingBox(),
-  ]);
-  expect(secondPersonBounds?.x ?? 0).toBeLessThan(
-    (firstPersonBounds?.x ?? 0) + (firstPersonBounds?.width ?? 0),
-  );
-  await people.first().hover();
-  await expect(
-    page.getByTestId("project-repository-person-tooltip").first(),
-  ).toBeVisible();
   await expect(fetchButton).toHaveCSS("text-align", "left");
   const sourceButton = repositoryActionsPanel.getByRole("button", {
     name: "Remote",
@@ -334,6 +391,7 @@ test("projects v3 workspace screenshot states", async ({ page }) => {
     alignedDetailsHeadingBounds,
     sourceButtonBounds,
     sourceSectionBounds,
+    repositoryActionListBounds,
     sourceTrailingIconBounds,
     fetchButtonBounds,
     fetchIconBounds,
@@ -344,7 +402,12 @@ test("projects v3 workspace screenshot states", async ({ page }) => {
   ] = await Promise.all([
     detailsHeading.boundingBox(),
     sourceButton.boundingBox(),
-    sourceButton.locator("..").locator("..").boundingBox(),
+    repositoryActionsPanel
+      .getByTestId("project-context-source-controls")
+      .boundingBox(),
+    repositoryActionsPanel
+      .getByTestId("project-context-repository-actions")
+      .boundingBox(),
     sourceButton.locator("svg").last().boundingBox(),
     fetchButton.boundingBox(),
     fetchButton.locator("svg").first().boundingBox(),
@@ -364,7 +427,7 @@ test("projects v3 workspace screenshot states", async ({ page }) => {
   expect(fetchButtonBounds?.height).toBe(28);
   expect(latestDetailRowBounds?.height).toBe(28);
   expect(
-    (actionsSectionBounds?.y ?? 0) -
+    (repositoryActionListBounds?.y ?? 0) -
       ((sourceSectionBounds?.y ?? 0) + (sourceSectionBounds?.height ?? 0)),
   ).toBe(2);
   expect(fetchButtonBounds?.x ?? 0).toBeLessThan(
@@ -559,8 +622,8 @@ test("projects v3 workspace screenshot states", async ({ page }) => {
       terminalButton.boundingBox(),
     ]);
   expect(repositoryTabBounds?.width).toBe(chatTabBounds?.width);
-  expect(chatTabBounds?.x).toBeLessThan(terminalTabBounds?.x ?? 0);
-  expect(terminalTabBounds?.x).toBeLessThan(repositoryTabBounds?.x ?? 0);
+  expect(terminalTabBounds?.x).toBeLessThan(chatTabBounds?.x ?? 0);
+  expect(chatTabBounds?.x).toBeLessThan(repositoryTabBounds?.x ?? 0);
   await chatPanelTab.click();
   const agentChatPanel = page.getByTestId("project-agent-chat-panel");
   await expect(agentChatPanel).toBeVisible();
@@ -718,10 +781,7 @@ test("projects v3 workspace screenshot states", async ({ page }) => {
     "aria-label",
     "Hide project context",
   );
-  await expect(page.getByTestId("project-detail-copy-link")).toBeVisible();
-  await expect(
-    repositoryActionsPanel.getByTestId("project-detail-copy-link"),
-  ).toHaveCount(0);
+  await expect(page.getByTestId("project-detail-copy-link")).toHaveCount(0);
   await expect(
     workspacePanel.getByTestId("project-workspace-tab-menu"),
   ).toHaveCount(0);
@@ -785,6 +845,13 @@ test("projects v3 workspace screenshot states", async ({ page }) => {
   await expect(
     workspacePanel.getByTestId("project-repository-entry-icon").first(),
   ).toHaveCSS("border-radius", "8px");
+  const repositoryEntryCell = workspacePanel
+    .getByTestId("project-repository-entry-row")
+    .first()
+    .locator("td")
+    .first();
+  await expect(repositoryEntryCell).toHaveCSS("border-radius", "0px");
+  await expect(repositoryEntryCell).toHaveCSS("border-bottom-width", "0px");
   await chatPanelTab.click();
   await expect(agentContext).toContainText("Files");
   await expect(
@@ -792,13 +859,13 @@ test("projects v3 workspace screenshot states", async ({ page }) => {
   ).toBeVisible();
   await repositoryPanelTab.click();
   await expect(repositoryActionsPanel).toBeVisible();
-  await expectFullWidthSection();
+  await expectInsetSection();
   await page.getByRole("tab", { name: "Commits" }).click();
   await expect(repositoryActionsPanel).toBeVisible();
   await expect(
     workspacePanel.getByRole("heading", { name: "Commits", exact: true }),
   ).toBeVisible();
-  await expectFullWidthSection();
+  await expectInsetSection();
   const commitRow = page.getByTestId("project-activity-feed-item").first();
   const commitDate = commitRow.getByTestId("project-commit-row-date");
   const commitHash = commitRow.getByTitle(/^View commit /);
@@ -809,7 +876,7 @@ test("projects v3 workspace screenshot states", async ({ page }) => {
   expect(commitHashBounds).not.toBeNull();
   expect(commitDateBounds?.x).toBeGreaterThan(commitHashBounds?.x ?? 0);
   await contributorsTab.click();
-  await expectFullWidthSection();
+  await expectInsetSection();
   const contributorRow = page.getByTestId("project-contributor-row").first();
   await expect(
     contributorRow.getByTestId("project-contributor-commit-count"),
@@ -855,12 +922,9 @@ test("projects v3 workspace screenshot states", async ({ page }) => {
   await expect(
     repositoryActionsPanel.getByText("Working copy", { exact: true }),
   ).toHaveCount(0);
-  await expect(
-    repositoryActionsPanel.getByRole("heading", {
-      name: "Actions",
-      exact: true,
-    }),
-  ).toHaveCount(0);
+  await expectProjectContextGroups(repositoryActionsPanel, {
+    hasActions: false,
+  });
   for (const action of ["Clone", "Fetch", "Terminal"]) {
     await expect(
       repositoryActionsPanel.getByRole("button", {
@@ -869,35 +933,34 @@ test("projects v3 workspace screenshot states", async ({ page }) => {
       }),
     ).toHaveCount(0);
   }
-  await expectFullWidthSection();
+  await expectInsetSection();
 
   // Issues tab: the create action lives in the section header.
   await page.getByRole("tab", { name: "Tasks", exact: true }).click();
   await expect(repositoryActionsPanel).toBeVisible();
-  await expect(
-    repositoryActionsPanel
-      .getByTestId("project-repository-people")
-      .locator(".."),
-  ).toHaveCSS("border-top-width", "0px");
+  await expectProjectContextGroups(repositoryActionsPanel, {
+    hasActions: true,
+  });
   await expect(
     repositoryActionsPanel.getByRole("heading", {
       name: "Task activity",
       exact: true,
     }),
   ).toHaveCount(0);
-  const taskDetailsHeading = repositoryActionsPanel.getByRole("heading", {
-    name: "Details",
-    exact: true,
-  });
-  await expect(taskDetailsHeading).toBeVisible();
-  const [taskDetailsBounds, taskPeopleBounds] = await Promise.all([
-    taskDetailsHeading.boundingBox(),
-    repositoryActionsPanel
-      .getByTestId("project-repository-people")
-      .boundingBox(),
+  const taskActionsSection = repositoryActionsPanel.getByTestId(
+    "project-context-actions",
+  );
+  const taskDetailsSection = repositoryActionsPanel.getByTestId(
+    "project-context-details",
+  );
+  const [taskActionsBounds, taskDetailsBounds] = await Promise.all([
+    taskActionsSection.boundingBox(),
+    taskDetailsSection.boundingBox(),
   ]);
-  expect(taskDetailsBounds?.y ?? 0).toBeLessThan(taskPeopleBounds?.y ?? 0);
-  await expectFullWidthSection();
+  expect(taskDetailsBounds?.y ?? 0).toBeGreaterThan(
+    (taskActionsBounds?.y ?? 0) + (taskActionsBounds?.height ?? 0),
+  );
+  await expectInsetSection();
   const newIssueButton = workspacePanel.getByRole("button", {
     name: "Create task",
   });
@@ -935,8 +998,14 @@ test("projects v3 workspace screenshot states", async ({ page }) => {
     (firstIssueBounds?.y ?? 0) -
       ((issueHeaderBounds?.y ?? 0) + (issueHeaderBounds?.height ?? 0)),
   ).toBe(4);
-  expect(firstIssueBounds?.x).toBe(issueHeaderBounds?.x);
-  expect(firstIssueBounds?.width).toBe(issueHeaderBounds?.width);
+  expect(
+    Math.round((firstIssueBounds?.x ?? 0) - (issueHeaderBounds?.x ?? 0)),
+  ).toBe(8);
+  expect(
+    Math.round(
+      (issueHeaderBounds?.width ?? 0) - (firstIssueBounds?.width ?? 0),
+    ),
+  ).toBe(16);
   expect(
     (secondIssueBounds?.y ?? 0) -
       ((firstIssueBounds?.y ?? 0) + (firstIssueBounds?.height ?? 0)),
@@ -972,6 +1041,9 @@ test("projects v3 workspace screenshot states", async ({ page }) => {
     });
   }
   await expect(page.getByTestId("project-issue-copy-link")).toBeVisible();
+  await expectProjectContextGroups(repositoryActionsPanel, {
+    hasActions: true,
+  });
   const issueDetail = page.getByTestId("project-issue-detail");
   await expect(issueDetail).toHaveCSS("max-width", "768px");
   await expect(
@@ -997,7 +1069,7 @@ test("projects v3 workspace screenshot states", async ({ page }) => {
   await waitForAnimations(page);
   await page.screenshot({ path: `${SHOTS}/03-issue-detail.png` });
 
-  // PR list: section header owns creation; detail keeps its entity header.
+  // PR list: the create action lives in both the section header and context.
   await page
     .getByRole("navigation", { name: "Project breadcrumb" })
     .getByRole("button", { name: "Tasks", exact: true })
@@ -1007,12 +1079,9 @@ test("projects v3 workspace screenshot states", async ({ page }) => {
   await expect(
     repositoryActionsPanel.getByTestId("project-right-panel-scope"),
   ).toHaveCount(0);
-  await expect(
-    repositoryActionsPanel.getByRole("heading", {
-      name: "Review activity",
-      exact: true,
-    }),
-  ).toBeVisible();
+  await expectProjectContextGroups(repositoryActionsPanel, {
+    hasActions: true,
+  });
   await expect(
     workspacePanel.getByRole("heading", {
       name: "Reviews",
@@ -1022,7 +1091,15 @@ test("projects v3 workspace screenshot states", async ({ page }) => {
   await expect(
     workspacePanel.getByRole("button", { name: "Create review" }),
   ).toBeVisible();
-  await expectFullWidthSection();
+  const contextCreateReviewButton = repositoryActionsPanel.getByRole("button", {
+    name: "Create review",
+    exact: true,
+  });
+  await expect(contextCreateReviewButton).toBeVisible();
+  await contextCreateReviewButton.click();
+  await expect(page.getByTestId("create-pull-request-dialog")).toBeVisible();
+  await page.keyboard.press("Escape");
+  await expectInsetSection();
   await expect(
     tabMenu.getByRole("button", { name: "Create review" }),
   ).toHaveCount(0);
@@ -1038,8 +1115,14 @@ test("projects v3 workspace screenshot states", async ({ page }) => {
     (firstReviewBounds?.y ?? 0) -
       ((reviewHeaderBounds?.y ?? 0) + (reviewHeaderBounds?.height ?? 0)),
   ).toBe(4);
-  expect(firstReviewBounds?.x).toBe(reviewHeaderBounds?.x);
-  expect(firstReviewBounds?.width).toBe(reviewHeaderBounds?.width);
+  expect(
+    Math.round((firstReviewBounds?.x ?? 0) - (reviewHeaderBounds?.x ?? 0)),
+  ).toBe(8);
+  expect(
+    Math.round(
+      (reviewHeaderBounds?.width ?? 0) - (firstReviewBounds?.width ?? 0),
+    ),
+  ).toBe(16);
   expect(
     (secondReviewBounds?.y ?? 0) -
       ((firstReviewBounds?.y ?? 0) + (firstReviewBounds?.height ?? 0)),
@@ -1056,6 +1139,9 @@ test("projects v3 workspace screenshot states", async ({ page }) => {
   await expect(
     page.getByTestId("project-pull-request-copy-link"),
   ).toBeVisible();
+  await expectProjectContextGroups(repositoryActionsPanel, {
+    hasActions: true,
+  });
   const pullRequestDetail = page.getByTestId("project-pull-request-detail");
   await expect(pullRequestDetail).toHaveCSS("max-width", "768px");
   await expect(
@@ -1103,9 +1189,24 @@ test("projects v3 work-item list metadata", async ({ page }) => {
   );
 
   await page.getByTestId("projects-section-projects").click();
-  await expectSinglePrimaryTextColumn(
-    page.getByTestId(/^project-row-/).first(),
+  await expect(page.getByTestId("projects-list-header")).toHaveCSS(
+    "border-left-width",
+    "0px",
   );
+  const projectRow = page.getByTestId(/^project-row-/).first();
+  await expectSinglePrimaryTextColumn(projectRow);
+  const [projectTitleBox, repositoryCountBox] = await Promise.all([
+    projectRow.locator('[data-projects-text-priority="primary"]').boundingBox(),
+    projectRow.getByTestId("projects-row-context").boundingBox(),
+  ]);
+  expect(projectTitleBox).not.toBeNull();
+  expect(repositoryCountBox).not.toBeNull();
+  expect(
+    Math.round(
+      (repositoryCountBox?.x ?? 0) -
+        ((projectTitleBox?.x ?? 0) + (projectTitleBox?.width ?? 0)),
+    ),
+  ).toBe(12);
 
   await page.getByTestId("projects-section-repositories").click();
   await expectSinglePrimaryTextColumn(
diff --git a/desktop/tests/e2e/send-channel-binding.spec.ts b/desktop/tests/e2e/send-channel-binding.spec.ts
index c1b51819230..b0edbf66302 100644
--- a/desktop/tests/e2e/send-channel-binding.spec.ts
+++ b/desktop/tests/e2e/send-channel-binding.spec.ts
@@ -84,11 +84,11 @@ test("message with agent mention lands in compose-time channel despite mid-send
   await input.press("Enter");
   await page.keyboard.type(` ${MESSAGE_TEXT}`);
 
-  // Verify the mention chip is present before submitting
-  const composerChip = input.locator(".agent-mention-highlight", {
-    hasText: "BotA",
-  });
-  await expect(composerChip).toBeVisible();
+  // Verify the agent is addressed before submitting.
+  await expect(input).toHaveText(` ${MESSAGE_TEXT}`);
+  await expect(
+    page.getByTestId(`composer-address-lock-${OUT_OF_CHANNEL_BOT_PUBKEY}`),
+  ).toBeVisible();
 
   // Snapshot the baseline command count before sending
   const baselineCommands = await readCommandLog(page);
diff --git a/desktop/tests/e2e/sidebar.spec.ts b/desktop/tests/e2e/sidebar.spec.ts
index 01d9d64d67b..f2b31058128 100644
--- a/desktop/tests/e2e/sidebar.spec.ts
+++ b/desktop/tests/e2e/sidebar.spec.ts
@@ -531,6 +531,47 @@ test("aligns the sidebar search with the channel title outside the Buzz theme",
   expect(Math.abs(searchCenter - channelTitleCenter)).toBeLessThanOrEqual(2);
 });
 
+test("keeps only search pinned while primary navigation scrolls", async ({
+  page,
+}) => {
+  await loadTheme(page, "github-light");
+
+  const search = page.getByTestId("open-search");
+  const primaryMenu = page.getByTestId("sidebar-primary-menu");
+  const sidebarScroller = page.locator(".buzz-sidebar-scrollbar");
+  const [initialSearchBox, initialMenuBox] = await Promise.all([
+    search.boundingBox(),
+    primaryMenu.boundingBox(),
+  ]);
+  expect(initialSearchBox).not.toBeNull();
+  expect(initialMenuBox).not.toBeNull();
+
+  const scrollTop = await sidebarScroller.evaluate((element) => {
+    element.scrollTop = Math.min(
+      120,
+      Math.max(0, element.scrollHeight - element.clientHeight),
+    );
+    return element.scrollTop;
+  });
+  expect(scrollTop).toBeGreaterThan(0);
+  await expect
+    .poll(() =>
+      sidebarScroller.evaluate((element) => Math.round(element.scrollTop)),
+    )
+    .toBe(Math.round(scrollTop));
+
+  const [scrolledSearchBox, scrolledMenuBox] = await Promise.all([
+    search.boundingBox(),
+    primaryMenu.boundingBox(),
+  ]);
+  expect(scrolledSearchBox).not.toBeNull();
+  expect(scrolledMenuBox).not.toBeNull();
+  expect(
+    Math.abs((scrolledSearchBox?.y ?? 0) - (initialSearchBox?.y ?? 0)),
+  ).toBeLessThanOrEqual(1);
+  expect(scrolledMenuBox?.y ?? 0).toBeLessThan(initialMenuBox?.y ?? 0);
+});
+
 test("scales the sidebar backward while its chrome closes", async ({
   page,
 }) => {
diff --git a/desktop/tests/e2e/tooltip-semantics.spec.ts b/desktop/tests/e2e/tooltip-semantics.spec.ts
index 73306f025cf..90ccd061bfc 100644
--- a/desktop/tests/e2e/tooltip-semantics.spec.ts
+++ b/desktop/tests/e2e/tooltip-semantics.spec.ts
@@ -142,7 +142,7 @@ for (const theme of THEMES) {
     await expect(row).toBeVisible();
     await expectMutedSupportingText(
       row.getByRole("button", { name: "Open channel general" }),
-      /Public channel · Active \d+[mhdw] ago/,
+      /Public channel · Active (just now|\d+[mhdw] ago)/,
     );
     await page.mouse.move(0, 0);
     await expectMutedSupportingText(
diff --git a/desktop/tests/e2e/top-chrome-zoom-clearance.spec.ts b/desktop/tests/e2e/top-chrome-zoom-clearance.spec.ts
index d26001ba6ef..d1615dbcc64 100644
--- a/desktop/tests/e2e/top-chrome-zoom-clearance.spec.ts
+++ b/desktop/tests/e2e/top-chrome-zoom-clearance.spec.ts
@@ -90,24 +90,18 @@ async function seedTextScale(
   }, scale);
 }
 
-async function expectTextRemSize(
+// Cmd +/- scales the real root font-size so every rem in the app zooms. The
+// top chrome below must stay fixed *despite* that, which is what these tests
+// guard.
+async function expectRootFontSize(
   page: import("@playwright/test").Page,
   fontSize: string,
 ) {
-  await expect
-    .poll(() =>
-      page.evaluate(() =>
-        getComputedStyle(document.documentElement)
-          .getPropertyValue("--buzz-type-rem")
-          .trim(),
-      ),
-    )
-    .toBe(fontSize);
   await expect
     .poll(() =>
       page.evaluate(() => getComputedStyle(document.documentElement).fontSize),
     )
-    .toBe("16px");
+    .toBe(fontSize);
 }
 
 test.describe("top chrome macOS traffic-light clearance under text zoom", () => {
@@ -152,8 +146,8 @@ test.describe("top chrome macOS traffic-light clearance under text zoom", () =>
     await installMockBridge(page);
     await page.goto("/");
 
-    // Confirm the zoomed-out text scale applied without changing the root.
-    await expectTextRemSize(page, "12px");
+    // Confirm the zoomed-out scale reached the root.
+    await expectRootFontSize(page, "12px");
 
     expect(await firstNavButtonX(page)).toBeGreaterThanOrEqual(
       TRAFFIC_LIGHT_RIGHT_EDGE,
@@ -170,7 +164,7 @@ test.describe("top chrome macOS traffic-light clearance under text zoom", () =>
     await installMockBridge(page);
     await page.goto("/");
 
-    await expectTextRemSize(page, "24px");
+    await expectRootFontSize(page, "24px");
 
     expect(await firstNavButtonX(page)).toBeGreaterThanOrEqual(
       TRAFFIC_LIGHT_RIGHT_EDGE,
diff --git a/desktop/tests/e2e/workflow-local-controls.spec.ts b/desktop/tests/e2e/workflow-local-controls.spec.ts
index f153afc69c3..2cdd1b28d71 100644
--- a/desktop/tests/e2e/workflow-local-controls.spec.ts
+++ b/desktop/tests/e2e/workflow-local-controls.spec.ts
@@ -1,6 +1,7 @@
 import { expect, test } from "@playwright/test";
-import { parse as parseYaml } from "yaml";
+import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
 
+import { waitForAnimations } from "../helpers/animations";
 import { installMockBridge } from "../helpers/bridge";
 
 test.beforeEach(async ({ page }) => {
@@ -39,11 +40,10 @@ async function selectTrigger(
 
 async function openTriggerInspector(
   dialog: import("@playwright/test").Locator,
-  trigger: string,
 ) {
   const menu = dialog.getByRole("button", { name: "Trigger event" });
   if (!(await menu.isVisible())) {
-    await dialog.getByRole("button", { name: `Trigger: ${trigger}` }).click();
+    await dialog.getByRole("button", { name: /^Trigger:/ }).click();
   }
   await expect(menu).toBeVisible();
 }
@@ -57,6 +57,19 @@ async function addMessageStep(
   await dialog.getByLabel("Message text").fill("Workflow notification");
 }
 
+async function createEnabled(
+  page: import("@playwright/test").Page,
+  dialog: import("@playwright/test").Locator,
+) {
+  await dialog.getByRole("button", { name: "Create" }).click();
+  const confirmation = page.getByRole("alertdialog", {
+    name: "This workflow may run often",
+  });
+  if (await confirmation.isVisible()) {
+    await confirmation.getByRole("button", { name: "Turn on" }).click();
+  }
+}
+
 async function reopenWorkflow(
   page: import("@playwright/test").Page,
   name: string,
@@ -69,6 +82,111 @@ async function reopenWorkflow(
   return page.getByRole("dialog", { name: "Edit workflow" });
 }
 
+test("confirms activation after create and preserves a safe disabled path", async ({
+  page,
+}) => {
+  const name = `activation_confirmation_${Date.now()}`;
+  const dialog = await openCreateWorkflow(page, name);
+  await addMessageStep(page, dialog);
+
+  await expect(
+    dialog.getByRole("switch", { name: "Enable workflow" }),
+  ).toHaveCount(0);
+  await dialog.getByRole("button", { name: "Create" }).click();
+  const confirmation = page.getByRole("alertdialog", {
+    name: "This workflow may run often",
+  });
+  await expect(confirmation).toBeVisible();
+  await expect(
+    confirmation.getByRole("button", { name: "Back" }),
+  ).toBeFocused();
+
+  await confirmation.getByRole("button", { name: "Back" }).click();
+  await expect(confirmation).toBeHidden();
+  await expect(dialog).toBeVisible();
+  await expect
+    .poll(() =>
+      page.evaluate(
+        () =>
+          (window.__BUZZ_E2E_COMMAND_PAYLOADS__ ?? []).filter(
+            (call) => call.command === "create_workflow",
+          ).length,
+      ),
+    )
+    .toBe(0);
+
+  await dialog.getByRole("button", { name: "Create" }).click();
+  await confirmation.getByRole("button", { name: "Keep off" }).click();
+  await expect(dialog).toBeHidden();
+
+  const yaml = await page.evaluate(() => {
+    const call = [...(window.__BUZZ_E2E_COMMAND_PAYLOADS__ ?? [])]
+      .reverse()
+      .find((candidate) => candidate.command === "create_workflow");
+    return (call?.payload as { yamlDefinition?: string } | undefined)
+      ?.yamlDefinition;
+  });
+  expect(parseYaml(yaml ?? "").enabled).toBe(false);
+  const card = page
+    .locator('[data-testid^="workflow-card-"]')
+    .filter({ hasText: name })
+    .first();
+  await expect(
+    card.getByRole("switch", { name: "Enable workflow" }),
+  ).not.toBeChecked();
+});
+
+test("inserts template variables with keyboard control and restores the caret", async ({
+  page,
+}) => {
+  const dialog = await openCreateWorkflow(page, "template_variables_keyboard");
+  await dialog.getByRole("button", { name: "Add step", exact: true }).click();
+  await page.getByRole("menuitem", { name: "Send Message" }).click();
+
+  const textarea = dialog.getByLabel("Message text");
+  const listbox = page.getByRole("listbox");
+  await textarea.fill("Hello {{trig");
+  await expect(listbox).toBeVisible();
+  await expect(listbox.getByRole("option")).toHaveCount(5);
+  await waitForAnimations(page);
+  expect(await page.locator("body").screenshot()).toMatchSnapshot(
+    "workflow-template-variable-autocomplete.png",
+  );
+
+  await textarea.press("ArrowUp");
+  await expect(textarea).toHaveAttribute(
+    "aria-activedescendant",
+    /-variables-option-4$/,
+  );
+  await textarea.press("ArrowDown");
+  await expect(textarea).toHaveAttribute(
+    "aria-activedescendant",
+    /-variables-option-0$/,
+  );
+  await textarea.press("Enter");
+  await expect(textarea).toHaveValue("Hello {{trigger.text}}");
+  await expect(textarea).toBeFocused();
+  await expect
+    .poll(() =>
+      textarea.evaluate((element) =>
+        element instanceof HTMLTextAreaElement ? element.selectionStart : -1,
+      ),
+    )
+    .toBe("Hello {{trigger.text}}".length);
+
+  await textarea.fill("Keep {{auth");
+  await expect(listbox).toBeVisible();
+  await textarea.press("Escape");
+  await expect(listbox).toBeHidden();
+  await expect(textarea).toBeFocused();
+  await expect(textarea).toHaveValue("Keep {{auth");
+
+  await textarea.fill("By {{auth");
+  await textarea.press("Tab");
+  await expect(textarea).toHaveValue("By {{trigger.author}}");
+  await expect(textarea).toBeFocused();
+});
+
 test("round-trips schedule presets and saves a custom UTC cron", async ({
   page,
 }) => {
@@ -86,7 +204,7 @@ test("round-trips schedule presets and saves a custom UTC cron", async ({
   expect(definition.trigger).toEqual({ on: "schedule", interval: "15m" });
 
   await dialog.getByRole("tab", { name: "Form" }).click();
-  await openTriggerInspector(dialog, "Schedule");
+  await openTriggerInspector(dialog);
   await expect(
     dialog.getByRole("radio", { name: "Every 15 minutes" }),
   ).toBeChecked();
@@ -114,7 +232,7 @@ test("round-trips schedule presets and saves a custom UTC cron", async ({
     cron: "5 */2 * * 2-4",
   });
   await dialog.getByRole("tab", { name: "Form" }).click();
-  await openTriggerInspector(dialog, "Schedule");
+  await openTriggerInspector(dialog);
   await expect(
     dialog.getByRole("radio", { name: "Custom cron" }),
   ).toBeChecked();
@@ -123,9 +241,9 @@ test("round-trips schedule presets and saves a custom UTC cron", async ({
   ).toHaveValue("2-4");
 
   await addMessageStep(page, dialog);
-  await dialog.getByRole("button", { name: "Create" }).click();
+  await createEnabled(page, dialog);
   const reopened = await reopenWorkflow(page, name);
-  await openTriggerInspector(reopened, "Schedule");
+  await openTriggerInspector(reopened);
   await expect(
     reopened.getByRole("radio", { name: "Custom cron" }),
   ).toBeChecked();
@@ -145,17 +263,41 @@ test("round-trips and reopens structured message-text conditions", async ({
   const expression = 'str_ends_with(trigger_text, "deploy \\"buzz\\"\\\\path")';
   const dialog = await openCreateWorkflow(page, name);
 
-  await dialog.getByText("ends with", { exact: true }).click();
-  await dialog.getByLabel("Text to match").fill(text);
+  await dialog
+    .getByRole("group", { name: "Match" })
+    .getByRole("button", {
+      name: "ends with",
+    })
+    .click();
+  await dialog.getByLabel("Message text").fill(text);
   await dialog.getByRole("tab", { name: "YAML" }).click();
   const yamlEditor = dialog.getByRole("textbox", { name: "Workflow YAML" });
   const definition = parseYaml(await yamlEditor.inputValue());
   expect(definition.trigger.filter).toBe(expression);
 
   await dialog.getByRole("tab", { name: "Form" }).click();
-  await openTriggerInspector(dialog, "Message Posted");
-  await expect(dialog.getByText("ends with", { exact: true })).toBeVisible();
-  await expect(dialog.getByLabel("Text to match")).toHaveValue(text);
+  await openTriggerInspector(dialog);
+  const matchControls = dialog.getByRole("group", { name: "Match" });
+  const operatorButtons = matchControls.getByRole("button");
+  const firstOperatorBox = await operatorButtons.nth(0).boundingBox();
+  const secondOperatorBox = await operatorButtons.nth(1).boundingBox();
+  const thirdOperatorBox = await operatorButtons.nth(2).boundingBox();
+  expect(firstOperatorBox).not.toBeNull();
+  expect(secondOperatorBox).not.toBeNull();
+  expect(thirdOperatorBox).not.toBeNull();
+  expect(secondOperatorBox?.x).toBeGreaterThan(firstOperatorBox?.x ?? 0);
+  expect(
+    Math.abs((secondOperatorBox?.y ?? 0) - (firstOperatorBox?.y ?? 0)),
+  ).toBeLessThan(1);
+  expect(thirdOperatorBox?.y).toBeGreaterThan(firstOperatorBox?.y ?? 0);
+  await waitForAnimations(page);
+  await matchControls.screenshot({
+    path: "test-results/workflow-message-condition-operators.png",
+  });
+  await expect(
+    matchControls.getByRole("button", { name: "ends with" }),
+  ).toHaveAttribute("aria-pressed", "true");
+  await expect(dialog.getByLabel("Message text")).toHaveValue(text);
   await dialog.getByRole("tab", { name: "Advanced" }).click();
   await expect(dialog.getByLabel("Advanced expression")).toHaveValue(
     expression,
@@ -163,11 +305,196 @@ test("round-trips and reopens structured message-text conditions", async ({
   await dialog.getByRole("tab", { name: "Basic" }).click();
 
   await addMessageStep(page, dialog);
-  await dialog.getByRole("button", { name: "Create" }).click();
+  await createEnabled(page, dialog);
   const reopened = await reopenWorkflow(page, name);
-  await openTriggerInspector(reopened, "Message Posted");
-  await expect(reopened.getByText("ends with", { exact: true })).toBeVisible();
-  await expect(reopened.getByLabel("Text to match")).toHaveValue(text);
+  await openTriggerInspector(reopened);
+  await expect(
+    reopened
+      .getByRole("group", { name: "Match" })
+      .getByRole("button", { name: "ends with" }),
+  ).toHaveAttribute("aria-pressed", "true");
+  await expect(reopened.getByLabel("Message text")).toHaveValue(text);
+});
+
+test("renders deterministic trigger, step, and workflow-card summaries", async ({
+  page,
+}) => {
+  const name = `semantic_summaries_${Date.now()}`;
+  await page.addInitScript((workflowName) => {
+    const positions: number[] = [];
+    Object.defineProperty(window, "__WORKFLOW_METADATA_POSITIONS__", {
+      configurable: true,
+      value: positions,
+    });
+
+    const findTarget = () => {
+      const target = Array.from(
+        document.querySelectorAll<HTMLElement>(
+          '[data-testid="workflow-card-name"]',
+        ),
+      ).find((element) => element.textContent === workflowName);
+      if (!target) {
+        requestAnimationFrame(findTarget);
+        return;
+      }
+
+      let remainingFrames = 12;
+      const sample = () => {
+        positions.push(target.getBoundingClientRect().y);
+        remainingFrames -= 1;
+        if (remainingFrames > 0) requestAnimationFrame(sample);
+      };
+      sample();
+    };
+    requestAnimationFrame(findTarget);
+  }, name);
+  const dialog = await openCreateWorkflow(page, name);
+
+  await dialog.getByLabel("Message text").fill("deploy");
+  const triggerNode = dialog.getByRole("button", {
+    name: "Trigger: Message contains “deploy”",
+  });
+  await expect(triggerNode).toContainText("Trigger");
+  await expect(triggerNode).toContainText("Message contains “deploy”");
+
+  await addMessageStep(page, dialog);
+  await dialog.getByRole("tab", { name: "YAML" }).click();
+  const yamlEditor = dialog.getByRole("textbox", { name: "Workflow YAML" });
+  const definition = parseYaml(await yamlEditor.inputValue());
+  definition.steps[0].channel = "94a444a4-c0a3-5966-ab05-530c6ddc2301";
+  await yamlEditor.fill(stringifyYaml(definition));
+  await dialog.getByRole("tab", { name: "Form" }).click();
+  const stepNode = dialog.getByRole("button", {
+    name: "Step 1: “Workflow notification” in #agents",
+  });
+  await expect(stepNode).toContainText("Send Message");
+  await expect(stepNode).toContainText("“Workflow notification” in #agents");
+  await createEnabled(page, dialog);
+
+  const card = page
+    .locator('[data-testid^="workflow-card-"]')
+    .filter({ hasText: name })
+    .first();
+  const semanticLabel = card.getByTestId("workflow-card-semantic-label");
+  const workflowName = card.getByTestId("workflow-card-name");
+  const channelName = card.getByTestId("workflow-card-channel");
+  await expect(card.getByTestId("workflow-card-trigger-summary")).toHaveCount(
+    0,
+  );
+  await expect(semanticLabel).toHaveText(
+    "When a message contains “deploy”, send “Workflow notification”",
+  );
+  await expect(workflowName).toHaveText(name);
+  await expect(channelName).toHaveText("#agents");
+  const semanticBox = await semanticLabel.boundingBox();
+  const nameBox = await workflowName.boundingBox();
+  const channelBox = await channelName.boundingBox();
+  expect(semanticBox).not.toBeNull();
+  expect(nameBox).not.toBeNull();
+  expect(channelBox).not.toBeNull();
+  expect(semanticBox?.y).toBeLessThan(nameBox?.y ?? 0);
+  expect(channelBox?.y).toBeLessThan(nameBox?.y ?? 0);
+  await expect
+    .poll(() =>
+      page.evaluate(
+        () =>
+          (
+            window as typeof window & {
+              __WORKFLOW_METADATA_POSITIONS__?: number[];
+            }
+          ).__WORKFLOW_METADATA_POSITIONS__?.length ?? 0,
+      ),
+    )
+    .toBe(12);
+  const metadataPositions = await page.evaluate(
+    () =>
+      (
+        window as typeof window & {
+          __WORKFLOW_METADATA_POSITIONS__?: number[];
+        }
+      ).__WORKFLOW_METADATA_POSITIONS__ ?? [],
+  );
+  expect(
+    Math.max(...metadataPositions) - Math.min(...metadataPositions),
+  ).toBeLessThan(0.5);
+});
+
+test("round-trips manual author and reaction message IDs through save and reopen", async ({
+  page,
+}) => {
+  const name = `manual_trigger_ids_${Date.now()}`;
+  const author = "a".repeat(64);
+  const messageId = "b".repeat(64);
+  const dialog = await openCreateWorkflow(page, name);
+  await selectTrigger(page, dialog, "Reaction Added");
+  await addMessageStep(page, dialog);
+  await dialog.getByRole("button", { name: /^Trigger:/ }).click();
+  await openTriggerInspector(dialog);
+
+  await dialog.getByRole("button", { name: "Author pubkey" }).click();
+  await dialog.getByLabel("Author pubkey").fill("not-hex");
+  await expect(
+    dialog.getByText("Enter a 64-character hex pubkey."),
+  ).toBeVisible();
+  await expect(dialog.getByRole("button", { name: "Create" })).toBeDisabled();
+  await expect
+    .poll(() =>
+      page.evaluate(
+        () =>
+          (window.__BUZZ_E2E_COMMAND_PAYLOADS__ ?? []).filter(
+            (call) => call.command === "create_workflow",
+          ).length,
+      ),
+    )
+    .toBe(0);
+  await dialog.getByLabel("Author pubkey").fill(author);
+  await expect(dialog.getByRole("button", { name: "Create" })).toBeEnabled();
+  await dialog.getByLabel("Author pubkey").fill("still-not-hex");
+  await expect(dialog.getByRole("button", { name: "Create" })).toBeDisabled();
+  await dialog.getByRole("tab", { name: "YAML" }).click();
+  const correctionEditor = dialog.getByRole("textbox", {
+    name: "Workflow YAML",
+  });
+  const correctedDefinition = parseYaml(await correctionEditor.inputValue());
+  delete correctedDefinition.trigger.filter;
+  await correctionEditor.fill(stringifyYaml(correctedDefinition));
+  await expect(dialog.getByRole("button", { name: "Create" })).toBeEnabled();
+  await dialog.getByRole("tab", { name: "Form" }).click();
+  await openTriggerInspector(dialog);
+  await dialog.getByRole("button", { name: "Author pubkey" }).click();
+  await expect(dialog.getByLabel("Author pubkey")).toHaveValue("");
+  await dialog.getByLabel("Author pubkey").fill(author);
+  await dialog
+    .getByRole("group", { name: "Match" })
+    .getByRole("button", { name: "is not", exact: true })
+    .click();
+
+  await dialog.getByRole("button", { name: "Message event ID" }).click();
+  await dialog.getByLabel("Message event ID").fill(messageId);
+
+  await dialog.getByRole("tab", { name: "YAML" }).click();
+  const yamlEditor = dialog.getByRole("textbox", { name: "Workflow YAML" });
+  let definition = parseYaml(await yamlEditor.inputValue());
+  expect(definition.trigger).toEqual({
+    on: "reaction_added",
+    filter: `trigger_author != "${author}" && trigger_message_id == "${messageId}"`,
+  });
+
+  await dialog.getByRole("tab", { name: "Form" }).click();
+  await openTriggerInspector(dialog);
+  await createEnabled(page, dialog);
+
+  const reopened = await reopenWorkflow(page, name);
+  await openTriggerInspector(reopened);
+  await reopened.getByRole("button", { name: "Author pubkey" }).click();
+  await expect(reopened.getByLabel("Author pubkey")).toHaveValue(author);
+  await reopened.getByRole("button", { name: "Message event ID" }).click();
+  await expect(reopened.getByLabel("Message event ID")).toHaveValue(messageId);
+  await reopened.getByRole("tab", { name: "YAML" }).click();
+  definition = parseYaml(
+    await reopened.getByRole("textbox", { name: "Workflow YAML" }).inputValue(),
+  );
+  expect(definition.trigger.filter).toContain(messageId);
 });
 
 test("hides and clears message-text step conditions for schedule triggers", async ({
@@ -181,9 +508,9 @@ test("hides and clears message-text step conditions for schedule triggers", asyn
   await dialog.getByRole("button", { name: "Run controls" }).click();
   await dialog.getByLabel("Text to match").fill("deploy");
 
-  await dialog.getByRole("button", { name: "Trigger: Message Posted" }).click();
+  await dialog.getByRole("button", { name: /^Trigger:/ }).click();
   await selectTrigger(page, dialog, "Schedule");
-  await dialog.getByRole("button", { name: "Step 1: Send Message" }).click();
+  await dialog.getByRole("button", { name: /^Step 1:/ }).click();
   await dialog.getByRole("button", { name: "Run controls" }).click();
 
   await expect(dialog.getByLabel("Text to match")).toHaveCount(0);
@@ -212,7 +539,7 @@ test("keeps advanced and malformed definitions lossless", async ({ page }) => {
     ),
   );
   await dialog.getByRole("tab", { name: "Form" }).click();
-  await openTriggerInspector(dialog, "Message Posted");
+  await openTriggerInspector(dialog);
   await expect(dialog.getByRole("tab", { name: "Advanced" })).toHaveAttribute(
     "data-state",
     "active",
@@ -223,7 +550,9 @@ test("keeps advanced and malformed definitions lossless", async ({ page }) => {
     dialog.getByText(/advanced expression is active/i),
   ).toBeVisible();
 
-  await dialog.getByRole("switch", { name: "Enable workflow" }).click();
+  await expect(
+    dialog.getByRole("switch", { name: "Enable workflow" }),
+  ).toHaveCount(0);
   await dialog.getByRole("tab", { name: "YAML" }).click();
   expect(parseYaml(await yamlEditor.inputValue()).trigger.filter).toBe(
     advanced,
diff --git a/desktop/tests/e2e/workflow-local-controls.spec.ts-snapshots/workflow-template-variable-autocomplete-smoke-darwin.png b/desktop/tests/e2e/workflow-local-controls.spec.ts-snapshots/workflow-template-variable-autocomplete-smoke-darwin.png
new file mode 100644
index 00000000000..54cc63d5b2a
Binary files /dev/null and b/desktop/tests/e2e/workflow-local-controls.spec.ts-snapshots/workflow-template-variable-autocomplete-smoke-darwin.png differ
diff --git a/desktop/tests/e2e/workflow-local-controls.spec.ts-snapshots/workflow-template-variable-autocomplete-smoke-linux.png b/desktop/tests/e2e/workflow-local-controls.spec.ts-snapshots/workflow-template-variable-autocomplete-smoke-linux.png
new file mode 100644
index 00000000000..492b815d76d
Binary files /dev/null and b/desktop/tests/e2e/workflow-local-controls.spec.ts-snapshots/workflow-template-variable-autocomplete-smoke-linux.png differ
diff --git a/desktop/tests/e2e/workflow-reaction-picker.spec.ts b/desktop/tests/e2e/workflow-reaction-picker.spec.ts
index 457b23a4d51..2d39e145ebd 100644
--- a/desktop/tests/e2e/workflow-reaction-picker.spec.ts
+++ b/desktop/tests/e2e/workflow-reaction-picker.spec.ts
@@ -73,15 +73,60 @@ test("reaction trigger uses the emoji picker instead of a free-text field", asyn
   await expect(
     dialog.getByRole("button", { name: "Clear trigger emoji" }),
   ).toHaveCount(0);
+  await expect(
+    dialog
+      .getByRole("button", { name: "Trigger: Reaction Added" })
+      .getByTestId("workflow-node-icon")
+      .locator("svg"),
+  ).toHaveCount(1);
 
   await pickEmoji(page, dialog, "rocket", EMOJI);
 
+  const triggerNode = dialog.getByRole("button", {
+    name: "Trigger: 🚀 reaction added",
+  });
+  await expect(triggerNode.getByTestId("workflow-node-icon")).toHaveText(EMOJI);
+  await expect(triggerNode).toContainText("Reaction added");
+  await expect(triggerNode).not.toContainText(`${EMOJI} reaction added`);
+  await expect(
+    triggerNode.getByTestId("workflow-node-icon").locator("svg"),
+  ).toHaveCount(0);
+  await waitForAnimations(page);
+  await triggerNode.screenshot({
+    path: "test-results/workflow-reaction-trigger-node.png",
+  });
+
   // Selecting closes the popover and shows the chosen reaction by name.
   await expect(page.locator("em-emoji-picker")).toHaveCount(0);
   await expect(pickerButton).toContainText(EMOJI_SHORTCODE);
   await expect(pickerButton).not.toContainText("Choose a reaction");
 });
 
+test("add-reaction step replaces its sequence number with the configured emoji", async ({
+  page,
+}) => {
+  const dialog = await openReactionTrigger(page);
+  await dialog.getByRole("tab", { name: "YAML" }).click();
+  const yamlEditor = dialog.getByRole("textbox", { name: "Workflow YAML" });
+  await yamlEditor.fill(
+    (await yamlEditor.inputValue()).replace(
+      "steps: []",
+      "steps:\n  - id: step_1\n    action: add_reaction\n    emoji: ✅",
+    ),
+  );
+
+  await dialog.getByRole("tab", { name: "Form" }).click();
+  const stepNode = dialog.getByRole("button", { name: "Step 1: ✅" });
+  await expect(stepNode.getByTestId("workflow-node-icon")).toHaveText("✅");
+  await expect(stepNode).toContainText("Add Reaction");
+  await expect(stepNode).not.toContainText("✅✅");
+  await expect(stepNode.getByTestId("workflow-node-icon")).not.toHaveText("1");
+  await waitForAnimations(page);
+  await stepNode.screenshot({
+    path: "test-results/workflow-add-reaction-step-node.png",
+  });
+});
+
 test("picked reaction persists into canonical YAML and clears back out", async ({
   page,
 }) => {
@@ -92,15 +137,17 @@ test("picked reaction persists into canonical YAML and clears back out", async (
   const yamlEditor = dialog.getByRole("textbox", { name: "Workflow YAML" });
   const yaml = await yamlEditor.inputValue();
   expect(yaml).toContain("on: reaction_added");
-  // Stored verbatim as the reaction content the executor compares against.
-  expect(yaml).toContain(`emoji: ${EMOJI}`);
+  // Stored verbatim in the local filter expression the executor compares.
+  expect(yaml).toContain(`trigger_emoji == "${EMOJI}"`);
 
   // Clearing the optional filter removes the key entirely rather than
   // writing an empty string, so the trigger matches any reaction again.
   await dialog.getByRole("tab", { name: "Form" }).click();
   // Switching editor modes drops the inspector selection, so re-open the
   // trigger node before reaching for its fields.
-  await dialog.getByRole("button", { name: "Trigger: Reaction Added" }).click();
+  await dialog
+    .getByRole("button", { name: `Trigger: ${EMOJI} reaction added` })
+    .click();
   await dialog.getByRole("button", { name: "Clear trigger emoji" }).click();
   await expect(
     dialog.getByRole("button", { name: "Choose trigger emoji" }),
@@ -109,7 +156,7 @@ test("picked reaction persists into canonical YAML and clears back out", async (
   await dialog.getByRole("tab", { name: "YAML" }).click();
   const clearedYaml = await yamlEditor.inputValue();
   expect(clearedYaml).toContain("on: reaction_added");
-  expect(clearedYaml).not.toContain("emoji:");
+  expect(clearedYaml).not.toContain("trigger_emoji");
 });
 
 test("legacy free-text emoji values survive a trip through the picker", async ({
@@ -164,7 +211,7 @@ test("saved reaction filter round-trips back into the picker", async ({
   const editDialog = page.getByRole("dialog", { name: "Edit workflow" });
   await expect(editDialog).toBeVisible();
   await editDialog
-    .getByRole("button", { name: "Trigger: Reaction Added" })
+    .getByRole("button", { name: `Trigger: ${EMOJI} reaction added` })
     .click();
 
   // Reopening rehydrates the stored glyph into the picker, not an empty field.
diff --git a/desktop/tests/e2e/workflow-title-stability.spec.ts b/desktop/tests/e2e/workflow-title-stability.spec.ts
index b9c52de7c00..3fc5fbbf545 100644
--- a/desktop/tests/e2e/workflow-title-stability.spec.ts
+++ b/desktop/tests/e2e/workflow-title-stability.spec.ts
@@ -62,6 +62,20 @@ async function addStepAfterTrigger(page: Page, dialog: Locator) {
   await page.getByRole("menuitem", { name: "Send Message" }).click();
 }
 
+async function finishRiskyActivationIfShown(page: Page, dialog: Locator) {
+  const confirmation = page.getByRole("alertdialog", {
+    name: "This workflow may run often",
+  });
+  await Promise.race([
+    confirmation.waitFor({ state: "visible" }),
+    dialog.waitFor({ state: "hidden" }),
+  ]);
+  if (await confirmation.isVisible()) {
+    await confirmation.getByRole("button", { name: "Turn on" }).click();
+  }
+  await expect(dialog).toBeHidden();
+}
+
 async function createNamedWorkflow(page: Page, name: string) {
   await page.getByRole("button", { name: "Create Workflow" }).click();
   const dialog = page.getByRole("dialog", { name: "Create workflow" });
@@ -73,8 +87,17 @@ async function createNamedWorkflow(page: Page, name: string) {
   await dialog.getByRole("button", { name: "Save workflow name" }).click();
 
   await dialog.getByRole("button", { name: "Add first step" }).click();
-  await dialog.getByLabel("Message text").fill("Workflow notification");
+  await dialog.getByRole("tab", { name: "YAML" }).click();
+  const yamlEditor = dialog.getByRole("textbox", { name: "Workflow YAML" });
+  const yaml = await yamlEditor.inputValue();
+  await yamlEditor.fill(
+    yaml.replace(
+      "    action: send_message",
+      '    action: send_message\n    text: "Workflow notification"',
+    ),
+  );
   await dialog.getByRole("button", { name: "Create workflow" }).click();
+  await finishRiskyActivationIfShown(page, dialog);
 
   await expect(page.getByTestId("workflows-view")).toContainText(name);
 }
@@ -154,10 +177,14 @@ test("renames stay visible across pane navigation before the step is filled in",
   // Completing the step re-serializes the definition from the builder's form
   // state, which must have picked the rename up rather than writing back the
   // generated name it was holding when the rename happened.
-  await dialog.getByLabel("Message text").fill("Workflow notification");
+  await dialog
+    .getByTestId("workflow-node-inspector")
+    .getByLabel("Message text")
+    .fill("Workflow notification");
   expect(await readWorkflowName(dialog)).toBe(name);
 
   await dialog.getByRole("button", { name: "Create workflow" }).click();
+  await finishRiskyActivationIfShown(page, dialog);
   await expect(page.getByTestId("workflows-view")).toContainText(name);
 });
 
@@ -174,6 +201,7 @@ test("keeps a header disable across a later form edit", async ({ page }) => {
 
   const dialog = page.getByRole("dialog", { name: "Edit workflow" });
   await expect(dialog).toBeVisible();
+  await dialog.getByRole("tab", { name: "Form" }).click();
 
   const enableItem = page.getByRole("menuitemcheckbox", { name: "Enable" });
   // The open menu aria-hides the dialog behind it, so it has to be dismissed
@@ -223,6 +251,7 @@ test("keeps the saved name while editing an existing workflow", async ({
 
   const dialog = page.getByRole("dialog", { name: "Edit workflow" });
   await expect(dialog).toBeVisible();
+  await dialog.getByRole("tab", { name: "Form" }).click();
   expect(await readWorkflowName(dialog)).toBe(name);
 
   await openTriggerPane(dialog);
@@ -259,6 +288,7 @@ test("keeps the copy name while duplicating an existing workflow", async ({
 
   const dialog = page.getByRole("dialog", { name: "Duplicate workflow" });
   await expect(dialog).toBeVisible();
+  await dialog.getByRole("tab", { name: "Form" }).click();
   expect(await readWorkflowName(dialog)).toBe(`${name} (copy)`);
 
   await openStepPane(dialog, 1);
diff --git a/desktop/tests/e2e/workflows.spec.ts b/desktop/tests/e2e/workflows.spec.ts
index 2e26f57382e..16844a2f3e2 100644
--- a/desktop/tests/e2e/workflows.spec.ts
+++ b/desktop/tests/e2e/workflows.spec.ts
@@ -1,4 +1,5 @@
 import { expect, test } from "@playwright/test";
+import { parse as parseYaml } from "yaml";
 
 import { installMockBridge } from "../helpers/bridge";
 import { waitForAnimations } from "../helpers/animations";
@@ -74,9 +75,6 @@ async function createWorkflow(
     );
     await dialog.getByRole("tab", { name: "Form" }).click();
   }
-  if (options?.enabled === false) {
-    await dialog.getByRole("switch", { name: "Enable" }).click();
-  }
   if (options?.trigger) {
     await dialog
       .getByRole("button", { name: "Trigger: Message Posted" })
@@ -116,6 +114,16 @@ async function createWorkflow(
   }
 
   await dialog.getByRole("button", { name: "Create" }).click();
+  if (!options?.trigger || options.trigger === "message_posted") {
+    const activationConfirmation = page.getByRole("alertdialog", {
+      name: "This workflow may run often",
+    });
+    await activationConfirmation
+      .getByRole("button", {
+        name: options?.enabled === false ? "Keep off" : "Turn on",
+      })
+      .click();
+  }
 
   await expect(
     page.getByRole("heading", { name: "Create Workflow" }),
@@ -131,6 +139,27 @@ test("navigates to workflows view and shows the empty create tile", async ({
   await expect(page.locator('[data-testid^="workflow-card-"]')).toHaveCount(0);
 });
 
+test("creates a narrowly triggered workflow without an activation warning", async ({
+  page,
+}) => {
+  await navigateToWorkflows(page);
+  await createWorkflow(page, `safe_webhook_${Date.now()}`, {
+    trigger: "webhook",
+  });
+
+  await expect(
+    page.getByTestId("workflow-activation-confirmation"),
+  ).toHaveCount(0);
+  const yaml = await page.evaluate(() => {
+    const call = [...(window.__BUZZ_E2E_COMMAND_PAYLOADS__ ?? [])]
+      .reverse()
+      .find((candidate) => candidate.command === "create_workflow");
+    return (call?.payload as { yamlDefinition?: string } | undefined)
+      ?.yamlDefinition;
+  });
+  expect(parseYaml(yaml ?? "").enabled).not.toBe(false);
+});
+
 test("creation reveals the trigger pane only after a one-shot channel pick", async ({
   page,
 }) => {
@@ -211,6 +240,10 @@ test("accepts the generated name through the first form mutation", async ({
 
   await dialog.getByRole("button", { name: "Add first step" }).click();
   await dialog.getByRole("button", { name: "Create workflow" }).click();
+  const activationConfirmation = page.getByRole("alertdialog", {
+    name: "This workflow may run often",
+  });
+  await activationConfirmation.getByRole("button", { name: "Turn on" }).click();
 
   await expect(page.getByTestId("workflows-view")).toContainText(generatedName);
 });
@@ -249,9 +282,9 @@ test("shows executable guidance for diff trigger conditions", async ({
     .getByRole("menuitem", { name: "Diff Posted", exact: true })
     .click();
 
-  await expect(dialog.getByLabel("Condition (optional)")).toHaveAttribute(
+  await expect(dialog.getByLabel("Diff text")).toHaveAttribute(
     "placeholder",
-    'e.g. str_contains(trigger_text, "deploy")',
+    "e.g. deploy",
   );
 });
 
@@ -300,11 +333,9 @@ test("captures workflow library across responsive viewports", async ({
 
 test("captures disabled diff workflows in the list UI", async ({ page }) => {
   const workflowName = `diff_workflow_${Date.now()}`;
-  const description = "Watches diff events for src/ changes";
 
   await navigateToWorkflows(page);
   await createWorkflow(page, workflowName, {
-    description,
     enabled: false,
     trigger: "diff_posted",
     stepName: "Notify reviewers",
@@ -316,13 +347,18 @@ test("captures disabled diff workflows in the list UI", async ({ page }) => {
     .locator('[data-testid^="workflow-card-"]')
     .filter({ hasText: workflowName })
     .first();
-  await expect(card.getByText("Diff Posted", { exact: true })).toBeVisible();
-  await expect(card.locator("h3")).toHaveText(workflowName);
-  await expect(card.getByText(description, { exact: true })).toBeVisible();
-  await expect(card).toContainText("disabled");
+  await expect(card.locator("h3")).toHaveText(
+    "When a diff is posted, send “Workflow notification”",
+  );
+  await expect(card).toContainText(workflowName);
+  await expect(
+    card.getByRole("switch", { name: "Disable workflow" }),
+  ).toBeChecked();
 });
 
-test("enables and disables a workflow from its card menu", async ({ page }) => {
+test("enables and disables a workflow from its card status toggle", async ({
+  page,
+}) => {
   const workflowName = `toggle_workflow_${Date.now()}`;
 
   await navigateToWorkflows(page);
@@ -333,26 +369,32 @@ test("enables and disables a workflow from its card menu", async ({ page }) => {
       .locator('[data-testid^="workflow-card-"]')
       .filter({ hasText: workflowName })
       .first();
-  const workflowActions = () =>
-    workflowCard().getByRole("button", { name: "Workflow actions" });
 
-  const enableItem = page.getByRole("menuitemcheckbox", { name: "Enable" });
-
-  await workflowActions().click();
-  await expect(enableItem).toHaveAttribute("aria-checked", "true");
-  await expect(enableItem.locator("button")).toHaveCount(0);
-  await expect(
-    enableItem.getByTestId("workflow-enabled-switch-visual"),
-  ).toHaveAttribute("aria-hidden", "true");
-  await enableItem.click();
+  const disable = workflowCard().getByRole("switch", {
+    name: "Disable workflow",
+  });
+  await expect(disable).toBeChecked();
+  await disable.click();
+  const enable = workflowCard().getByRole("switch", {
+    name: "Enable workflow",
+  });
+  await expect(enable).not.toBeChecked();
+  await enable.click();
+  const activationConfirmation = page.getByRole("alertdialog", {
+    name: "This workflow may run often",
+  });
+  await expect(activationConfirmation).toBeVisible();
+  await activationConfirmation.getByRole("button", { name: "Turn on" }).click();
   await expect(
-    workflowCard().getByText("disabled", { exact: true }),
-  ).toBeVisible();
+    workflowCard().getByRole("switch", { name: "Disable workflow" }),
+  ).toBeChecked();
 
-  await enableItem.click();
+  await workflowCard()
+    .getByRole("button", { name: "Workflow actions" })
+    .click();
   await expect(
-    workflowCard().getByText("active", { exact: true }),
-  ).toBeVisible();
+    page.getByRole("menuitemcheckbox", { name: "Enable" }),
+  ).toHaveCount(0);
 });
 
 test("rejects a stale card toggle without overwriting a newer edit", async ({
@@ -395,8 +437,7 @@ test("rejects a stale card toggle without overwriting a newer edit", async ({
     });
   }, workflowName);
 
-  await workflowCard.getByRole("button", { name: "Workflow actions" }).click();
-  await page.getByRole("menuitemcheckbox", { name: "Enable" }).click();
+  await workflowCard.getByRole("switch", { name: "Disable workflow" }).click();
 
   await expect(
     page
@@ -436,14 +477,15 @@ test("reports a rejected workflow status change", async ({ page }) => {
     .locator('[data-testid^="workflow-card-"]')
     .filter({ hasText: workflowName })
     .first();
-  await workflowCard.getByRole("button", { name: "Workflow actions" }).click();
-  await page.getByRole("menuitemcheckbox", { name: "Enable" }).click();
+  await workflowCard.getByRole("switch", { name: "Disable workflow" }).click();
 
   const errorToast = page
     .locator("[data-sonner-toast][data-removed='false']")
     .filter({ hasText: "Couldn’t change workflow status" });
   await expect(errorToast).toContainText("relay refused the update");
-  await expect(workflowCard.getByText("active", { exact: true })).toBeVisible();
+  await expect(
+    workflowCard.getByRole("switch", { name: "Disable workflow" }),
+  ).toBeChecked();
 });
 
 test("shows the webhook secret dialog after saving a webhook workflow", async ({
@@ -528,8 +570,37 @@ test("duplicates a workflow", async ({ page }) => {
   const dialog = page.getByRole("dialog", { name: "Duplicate workflow" });
   await selectWorkflowChannel(page, dialog);
   await dialog.getByRole("button", { name: "Create copy" }).click();
+  const activationConfirmation = page.getByRole("alertdialog", {
+    name: "This workflow may run often",
+  });
+  await expect(activationConfirmation).toBeVisible();
+  await activationConfirmation.getByRole("button", { name: "Back" }).click();
+  await expect(dialog).toBeVisible();
+  await expect
+    .poll(() =>
+      page.evaluate(
+        () =>
+          (window.__BUZZ_E2E_COMMAND_PAYLOADS__ ?? []).filter(
+            (call) => call.command === "create_workflow",
+          ).length,
+      ),
+    )
+    .toBe(1);
+  await dialog.getByRole("button", { name: "Create copy" }).click();
+  await activationConfirmation
+    .getByRole("button", { name: "Keep off" })
+    .click();
   await expect(page.getByRole("dialog")).not.toBeVisible();
 
+  const copiedYaml = await page.evaluate(() => {
+    const calls = (window.__BUZZ_E2E_COMMAND_PAYLOADS__ ?? []).filter(
+      (call) => call.command === "create_workflow",
+    );
+    return (calls.at(-1)?.payload as { yamlDefinition?: string } | undefined)
+      ?.yamlDefinition;
+  });
+  expect(parseYaml(copiedYaml ?? "").enabled).toBe(false);
+
   // Both the original and copy should exist
   await expect(page.getByTestId("workflows-view")).toContainText(originalName);
 });
@@ -742,7 +813,7 @@ test("pane routes use stable IDs and Form/YAML changes stay synchronized", async
   await dialog.getByLabel("Duration").fill("5m");
   await expect(page).toHaveURL(/pane=step%3Astep_2/);
 
-  await dialog.getByRole("button", { name: "Step 1: Send Message" }).click();
+  await dialog.getByRole("button", { name: /^Step 1:/ }).click();
   await expect(page).toHaveURL(/pane=step%3Astep_1/);
   await dialog
     .getByTestId("workflow-node-inspector")
@@ -757,7 +828,7 @@ test("pane routes use stable IDs and Form/YAML changes stay synchronized", async
   const yaml = await yamlEditor.inputValue();
   await yamlEditor.fill(yaml.replace("duration: 5m", "duration: 10m"));
   await dialog.getByRole("tab", { name: "Form" }).click();
-  await dialog.getByRole("button", { name: "Step 1: Delay" }).click();
+  await dialog.getByRole("button", { name: /^Step 1:/ }).click();
   await expect(dialog.getByLabel("Duration")).toHaveValue("10m");
 });
 
diff --git a/docs/nips/NIP-FI-CONF.md b/docs/nips/NIP-FI-CONF.md
new file mode 100644
index 00000000000..c6ba387977f
--- /dev/null
+++ b/docs/nips/NIP-FI-CONF.md
@@ -0,0 +1,375 @@
+NIP-FI-CONF
+===========
+
+Conformance evidence profile
+----------------------------
+
+`draft` `optional`
+
+**Dependencies**: NIP-FI core. Applies additionally to any claimed
+NIP-FI-EDGE, NIP-FI-LIFECYCLE, and NIP-FI-DELEG profile.
+
+The key words "MUST", "MUST NOT", "REQUIRED", "SHOULD", "SHOULD NOT", and
+"MAY" in this document are to be interpreted as described in BCP 14 (RFC 2119
+and RFC 8174) when, and only when, they appear in all capitals.
+
+## Abstract
+
+NIP-FI core and its profiles state required behavior. This profile states what
+counts as evidence that an implementation has it: the claim unit, the evidence
+rules, the complete denial-fixture enumeration, mutation adequacy, and the
+interoperability exit test.
+
+This profile is separately claimable and is never advertised in discovery:
+conformance is a property of a reviewed revision, not a wire feature. It
+defines no wire behavior, denial mapping, invariant, or admission rule; where
+it names one, NIP-FI core or the owning profile is normative.
+
+## Claim unit
+
+A conformance claim names exactly one immutable tuple:
+
+```text
+(implementation revision,
+ adapter revision,
+ build artifact digest,
+ deployment revision,
+ governing document revision,
+ exit fixture digest,
+ claimed profiles,
+ assertion_policy_id,
+ transport_contract_id,
+ enrollment mode)
+```
+
+Changing any element creates a new claim. Results from one tuple MUST NOT be
+carried into another. A report contains every applicable oracle from core and
+every claimed profile exactly once, with status `pass` or `not-applicable`
+only, except that `FI-CONF-INTEROP-EXIT` alone may instead carry `deferred`
+under the condition in **Interoperability exit test**. Blank, skipped,
+expected-failure, and not-run results cannot support a claim
+(`FI-CONF-CLAIM-COMPLETE`).
+
+Enrollment mode is part of the claim unit and is private: it is recorded in
+the access-controlled report, never in discovery or any public artifact.
+
+## Evidence rules
+
+Each passing oracle records the claim tuple, a stable test identifier and
+adapter entry point, the command with start time, end time, exit status, and
+any random seed, the synthetic input or a privacy-safe digest of it, the
+before-and-after authoritative state relevant to the oracle, the expected and
+observed outcomes, and artifact locations with SHA-256 digests. Stateful
+oracles use an isolated database or namespace and inspect committed state
+rather than inferring it from a response. Concurrency oracles record every
+contender and the single serialized outcome. Time-boundary oracles use a
+controlled clock.
+
+Adapters MUST drive public or production-equivalent entry points. A storage
+helper MAY inspect state or inject a dependency outage; it MUST NOT replace the
+operation under test. Calling an internal authorization function without
+traversing the protected ingress does not satisfy ingress coverage.
+
+None of the following satisfies any oracle: searching source, documentation,
+schemas, or binaries for a token; asserting that a route calls a named
+function; recording a test name without its execution result; using a mock to
+prove a deployed network boundary; citing a check from another revision; or
+marking an oracle passed because the feature is configured.
+
+`FI-TRACE-TOFU-THEFT` takes an access-controlled **configuration** witness
+only; under the private-posture rule no discovery witness for enrollment mode
+can exist. Discovery invariance is proved separately by
+`FI-TRACE-DISCOVERY-PRIVATE`.
+
+Requirements marked `[deployment artifact: ...]` in core or a profile are
+evidenced by the named access-controlled review record at the claimed
+deployment revision, not by a behavioral oracle. A claim listing an artifact
+without the record is incomplete.
+
+Reports and artifacts hold private deployment detail and MUST remain access
+controlled. They MUST NOT enter public reports, examples, discovery, or
+protocol output, and MUST NOT contain raw assertions, secrets, or unredacted
+`iss`, `sub`, or claim values. The shared exit fixture is exempt: its values
+are synthetic by construction and name no real principal, issuer, or key.
+
+## Denial fixtures
+
+`FI-TRACE-DENIAL-ORACLE` requires one fixture per **private condition**, not
+one per public class; a per-class suite compares a class against itself. The
+enumeration below is the required fixture set (`FI-CONF-DENIAL-FIXTURES`). The
+public-class column restates NIP-FI core, which owns the mapping and the bytes.
+
+| # | Private condition | Public class | Defined by |
+|---|---|---|---|
+| 1 | assertion, proof, or delegation evidence absent | `missing_evidence` | core |
+| 2 | edge provenance absent or incomplete on an edge-required route (assertion may be present) | `missing_evidence` | NIP-FI-EDGE |
+| 3 | evidence present but rejected: signature, key selection, issuer, audience, time, size, ambiguity, token class, body binding, or edge provenance (present but rejected) | `evidence_rejected` | core, NIP-FI-EDGE |
+| 4 | replayed evidence — committed replay identity already claimed | `authorization_denied` | core, NIP-FI-EDGE |
+| 5 | `key_mismatch` — asserted key is not the proven actor | `authorization_denied` | core |
+| 6 | `attestation_required` — attested-key enrollment without a matching key claim | `authorization_denied` | core |
+| 7 | `binding_conflict` — either side of the active relation is taken | `authorization_denied` | core |
+| 8 | `pair_retired` | `authorization_denied` | core |
+| 9 | `key_revoked` | `authorization_denied` | core |
+| 10 | `policy_denied` — local operation policy | `authorization_denied` | core |
+| 11 | `binding_required` — enrollment policy creates no binding at this request: provisioned mode with no binding, or any unrecognized policy value | `authorization_denied` | core |
+| 12 | `identity_disabled` | `authorization_denied` | NIP-FI-LIFECYCLE |
+| 13 | `explicit_replacement_required` — pending lineage | `authorization_denied` | NIP-FI-LIFECYCLE |
+| 14 | `binding_expired` — administrative expiry | `authorization_denied` | NIP-FI-LIFECYCLE |
+| 15 | `delegation_not_current` — owner or relationship no longer current | `authorization_denied` | NIP-FI-DELEG |
+| 16 | `dependency_unreadable` | `authorization_unavailable` | core |
+
+Private-condition names are fixture identifiers, not wire values; a deployment
+MAY use other internal reason codes if every enumerated condition has a
+fixture. Rows for an unclaimed profile are `not-applicable` with absence
+evidence. A profile that introduces a private condition MUST add its row; an
+unenumerated condition escapes this oracle entirely.
+
+**Enumeration agreement.** `policy_denied` and `dependency_unreadable` are the
+*prose-only allowlist*: core conditions that core states in prose and does not
+name symbolically. The suite MUST check mechanically at the claimed head, by
+symbol and never by row number, and every check MUST be green on the unmutated
+documents before any mutant is scored:
+
+1. every symbol core denies by name has a row here attributed to core with the
+   same public class;
+2. the set of symbols in core-attributed rows equals core's symbolic denial set
+   together with the allowlist, exactly, and the allowlist is disjoint from
+   that set; and
+3. for each claimed profile that owns a private-denial-condition table, the
+   set of `(identifier, public class)` pairs in that table equals the set of
+   pairs attributed to that profile here, exactly; a row with multiple owners
+   contributes its pair to each.
+
+If a later core names an allowlisted symbol, check 2's disjointness fails
+until the allowlist entry is deleted, and check 1 validates the promoted
+symbol's class.
+
+**Anonymity comparison.** Every `authorization_denied` row is in the
+private-state anonymity set. Between two private conditions on one
+implementation, every response byte as transmitted MUST agree — transfer
+framing included — except values a server cannot hold constant across two
+instants, such as `Date`. This is wider than the interoperability object
+below: within one implementation, any byte that varies by private condition is
+a disclosure, whatever field it sits in.
+
+**Interoperability compared object.** Between two implementations, comparison
+is over what core pins and nothing more. Over Nostr: the complete relay message
+excluding only the event or subscription identifier echoed from the request,
+as compact JSON with no insignificant whitespace per NIP-01. Over HTTP: the
+status code; the content per RFC 9110 Section 6.4, after transfer decoding with
+chunk framing and trailers excluded; and the exact values of only the header
+fields core's denial table names, field names matched case-insensitively per
+RFC 9110 Section 5.1. `Content-Length` is not pinned. Header order and unnamed
+fields are outside the object, and their values MUST NOT depend on the private
+condition. A field core names that an implementation cannot hold constant MUST
+be reported with the reason, and its value MUST be independent of the private
+condition. If core later pins another field, it joins with no edit here.
+
+**Run discipline.** The oracle runs a fixed positive iteration count on a
+pinned isolated runner at the exact claimed head. Before the run the operator
+records the environment, public-response corpus, bounds, sampling method,
+statistical rule, noise treatment, and acceptance threshold. A breach fails the
+gate, MUST NOT trigger an automatic retry, and is retained and investigated
+before a separately authorized rerun.
+
+`authorization_unavailable` is observably distinct from `authorization_denied`.
+This is accepted residual: it discloses no per-principal state, and collapsing
+it would make fail-closed behavior undiagnosable.
+
+**Negative control.** The suite MUST include an implementation deliberately
+patched to vary its denial response by private condition, and it MUST fail
+this oracle.
+
+## Mutation adequacy
+
+An oracle that cannot fail is untested text that reads as tested. The
+denominator is the **listed oracle**: every table row whose first cell names
+exactly one complete literal oracle identifier, in NIP-FI core, in each claimed
+normative profile, and in this document when CONF is claimed — selected by
+that cell, not by section title. It is not the set of normative sentences, RFC
+2119 keywords, or invariant labels, none of which two readers enumerate alike.
+
+For each listed oracle the suite MUST retain at least one **mutant**: an
+implementation variant that violates a requirement that oracle governs,
+together with that oracle's failing output (`FI-CONF-MUTATION`). Evidence is
+the exact patch identity, the oracle identifier, and the retained failure
+output at the claimed head. For this document's own oracles the implementation
+under test includes the conformance suite and its report; a mutant is a single
+variant of the suite or report that the entry's own oracle rejects.
+
+While `FI-CONF-INTEROP-EXIT` is validly deferred it remains in claim
+completeness but is excluded from this section's mutation and global-control
+obligations, since its failing output cannot exist without the run. Both
+obligations attach with the run and MUST be discharged before either
+implementation's interoperable conformance claim is accepted. No other
+oracle's obligation under this section is deferrable.
+
+Normative prose outside the oracle tables remains binding but is not a second
+denominator. Prose that no listed oracle can detect is untestable text: add the
+oracle that detects it, or delete it.
+
+1. **One at a time.** Mutants are applied singly against an otherwise
+   unmodified implementation, so layered defenses cannot mask each other.
+2. **Attribution.** The kill MUST come from the entry's own oracle. A mutant
+   killed only by another oracle establishes coverage for neither.
+3. **One entry per mutant.** A mutant satisfies only the entry it was selected
+   for, even when it also kills other oracles.
+4. **Reachability.** The suite MUST witness that a fixture reaches the mutated
+   decision, not merely the enclosing operation.
+5. **Survivors are recorded.** A mutant its named oracle fails to kill is a
+   defect in the specification or the suite. It is recorded with that
+   disposition and MUST NOT be waived or replaced by an easier mutant.
+
+Two global controls bound the suite. A deny-everything implementation MUST
+fail every positive oracle; an allow-everything implementation MUST fail every
+negative oracle. Neither substitutes for per-entry mutants.
+
+## Interoperability exit test
+
+A claim of core conformance requires evidence that the documents alone are
+sufficient to build against (`FI-CONF-INTEROP-EXIT`). Two implementations that
+have not shared code and have not consulted a common reference implementation
+each produce, from NIP-FI core and any claimed profile documents alone:
+
+- one valid `client-attached` request, over WebSocket upgrade and over HTTP,
+  compared over its signing inputs as defined below; and
+- one byte-exact public denial response for each of the four public classes,
+  on each transport where the class can be decided, compared over the
+  interoperability compared object under **Denial fixtures**.
+
+Independence is a claim about code, not inputs: two implementations given
+different issuers, keys, or clocks cannot produce equal bytes. The run is
+therefore parameterized by a **shared exit fixture** that both sides load and
+neither side authors:
+
+- one issuer identity and one JWK set, including the private key needed to
+  mint assertions and the `kid` selecting it;
+- one assertion per denial class and one for the valid request, each as
+  complete pre-signature protected-header and claim-set JSON values —
+  including `alg`, `typ`, `kid`, every member the policy allows, and fixed
+  `iss`, `sub`, `aud`, `nostr_pubkey`, `client_id`, `iat`, `exp`, and token
+  class;
+- one Nostr secret key for the proof, with the complete unsigned event fields
+  for each transport — the NIP-98 event over HTTP and the NIP-42 event with
+  its challenge and relay values over the WebSocket upgrade — including
+  `created_at`;
+- one frozen evaluation instant, and the skew and lifetime bounds in force;
+  and
+- the domain, target resource, operation, and enrollment policy for each case.
+
+The canonical fixture is authored by this document's editors, not by any
+claiming implementation, and MUST be published as a single file at
+`docs/nips/fixtures/nip-fi-conf-exit.json` in the same repository as these
+documents, with its SHA-256 digest, before any `FI-CONF-INTEROP-EXIT` run.
+Both sides MUST load that file, MUST verify the digest before the run, and
+MUST record the digest with the evidence; a run against any other fixture
+instance is not `FI-CONF-INTEROP-EXIT` evidence. While the canonical fixture
+is unpublished, the claim tuple's exit fixture digest records the reserved
+value `pending-canonical-fixture`, valid only in a claim whose
+`FI-CONF-INTEROP-EXIT` result is `deferred`. Publication changes the element
+and therefore creates a new claim.
+
+**Request compared object.** Signature octets are excluded, because conforming
+implementations need not agree on them (randomized `ES256` and fresh-aux
+BIP-340 do not) and no document here pins JWS or JSON member order. The
+compared object is the **signing inputs**: for each transport's Nostr proof,
+the NIP-01 serialization the event id is taken over, compared against its own
+transport's serialization; for the assertion, the decoded protected header and
+claim set compared as JSON values with member order excluded. Every value the
+compared object depends on MUST be pinned in the fixture.
+
+The exchanged artifact per case is the complete request and response frame on
+each transport — for HTTP the request line, headers, and body and the response
+status, headers, and body; for Nostr the complete client and relay messages —
+so that a mismatch can be explained from fields outside the compared object.
+
+The test passes when outputs compare equal over their compared objects and
+each implementation accepts the other's valid request and reproduces the
+other's denials. Exit evidence includes the exchanged artifacts and each
+implementation's statement of independence. A divergence traced to an
+underspecified value is a defect in the specification, not in either
+implementation, and is fixed there.
+
+**Negative control.** One implementation is patched to emit a denial that
+differs from the other only outside the compared object — a header core does
+not name, or reordered fields — and the run MUST still pass. A run that fails
+this control is comparing more than core pins; the exit test is then the
+defect. The control is retained with the evidence.
+
+`FI-CONF-INTEROP-EXIT` is REQUIRED only once a second implementation meeting
+the independence conditions exists. Until then a conformance claim MUST record
+it as deferred with the machine-readable reason
+`no-independent-implementation`. A deferred exit test MUST be run and passed
+before the second implementation's conformance claim is accepted, and the
+first implementation's claim MUST be re-evidenced against that run.
+
+## Applicability
+
+`not-applicable` requires a machine-readable reason and behavioral proof that
+the surface is absent:
+
+- edge oracles only when no trusted-edge profile is accepted, none is
+  advertised, and executable cases reject every trusted-edge evidence shape;
+- snapshot-rotation oracles only when no local key or status snapshot source
+  is configured and executable evidence proves the absence;
+- `FI-TRACE-TOFU-THEFT` only when TOFU is neither configurable nor configured
+  and executable first-use cases deny;
+- `FI-TRACE-CURRENT-STATUS-STALE` and `FI-TRACE-CURRENT-STATUS-REVOKED` only
+  when every configured assertion policy declares freshness class
+  `offline-jwt` and executable cases prove a presented witness is never
+  consulted;
+- `FI-TRACE-CAPABILITY-REVOCATION` only when no external capability
+  projection requiring a declared revocation bound is configured, and
+  executable evidence proves no assertion capability or local-policy value
+  claims such a bound;
+- lifecycle and delegation oracles only when the profile is unclaimed,
+  disabled, and denied on every ingress; and
+- every other oracle is required for an enforcing deployment.
+
+An implementation that supports an optional surface runs its oracles even when
+one deployed domain does not activate it.
+
+## Release gate
+
+Before NIP-FI enforcement or discovery is enabled, reviewers verify, at one
+reviewed revision, that:
+
+- one immutable claim tuple passes every applicable oracle other than a
+  validly deferred `FI-CONF-INTEROP-EXIT`;
+- if the canonical fixture was published before the review, the tuple's exit
+  fixture digest is not `pending-canonical-fixture`;
+- the protected-ingress inventory has no uncovered or competing authority;
+- every listed oracle, other than a validly deferred `FI-CONF-INTEROP-EXIT`,
+  has a killed, attributed, reachable mutant and every survivor is recorded;
+- the denial-fixture enumeration is complete for the claimed profiles and its
+  negative control fails as required;
+- the interoperability exit test has passed against an independent
+  implementation, or is recorded as deferred because none exists;
+- every named deployment artifact exists at the claimed deployment revision;
+  and
+- public and operational sinks pass privacy-canary inspection.
+
+Documentation review, source review, and static scans are review inputs. They
+close no item in this gate.
+
+## Behavioral oracles
+
+| ID | Required outcome |
+|---|---|
+| `FI-CONF-CLAIM-COMPLETE` | A report missing an applicable oracle, duplicating one, carrying a result from another claim tuple, claiming a status other than `pass`/`not-applicable` — or `deferred` on any oracle other than `FI-CONF-INTEROP-EXIT` — or omitting mutant evidence for any oracle other than a deferred `FI-CONF-INTEROP-EXIT`, or recording the exit fixture digest `pending-canonical-fixture` with any `FI-CONF-INTEROP-EXIT` result other than `deferred`, is rejected. |
+| `FI-CONF-DENIAL-FIXTURES` | Every enumerated private condition has a fixture; core and each claimed profile pass exact identifier/class/owner enumeration agreement; anonymity-set responses compare byte-identical; the distinguishing negative control fails. |
+| `FI-CONF-MUTATION` | Every listed oracle — except `FI-CONF-INTEROP-EXIT` while validly deferred, per **Mutation adequacy** — has a singly-applied, attributed, reachability-witnessed mutant killed by that entry's own oracle; the deny-everything and allow-everything global controls fail every oracle **Mutation adequacy** requires of them, with retained evidence; survivors are recorded, not waived. |
+| `FI-CONF-INTEROP-EXIT` | Two independent implementations produce, from the documents alone, valid requests equal over the request compared object and per-class denials equal over the denial compared object, and accept each other's output. |
+
+## Security considerations
+
+Conformance evidence is a privileged artifact: it enumerates private denial
+conditions, enrollment posture, and deployment topology that the protocol
+deliberately keeps off the wire. Publishing a report, a fixture corpus, or a
+mutant catalogue would disclose exactly what `FI-INV-13` and
+`FI-TRACE-DISCOVERY-PRIVATE` protect.
+
+A passing suite bounds the behaviors it exercises and nothing else. Mutation
+adequacy raises the cost of a masked defect; it does not prove absence of
+defects, and a claim that cites this profile as proof of security rather than
+of tested behavior is misusing it.
diff --git a/docs/nips/NIP-FI-DELEG.md b/docs/nips/NIP-FI-DELEG.md
new file mode 100644
index 00000000000..9b9134c2b3d
--- /dev/null
+++ b/docs/nips/NIP-FI-DELEG.md
@@ -0,0 +1,186 @@
+NIP-FI-DELEG
+============
+
+Delegated agent authorization profile
+--------------------------------------
+
+`draft` `optional` `relay`
+
+**Protocol dependency**: NIP-FI core.
+
+The key words "MUST", "MUST NOT", "REQUIRED", "SHOULD", "SHOULD NOT", and
+"MAY" in this document are to be interpreted as described in BCP 14 (RFC 2119
+and RFC 8174) when, and only when, they appear in all capitals.
+
+## Scope
+
+This profile authorizes a delegate key from separately validated delegation
+evidence rooted in a currently eligible NIP-FI owner binding. The delegate
+proves its own key. It does not present a federated assertion and never receives
+or inherits the owner's binding. Because a trusted edge inserts assertion and
+provenance fields on every request it forwards, and `FI-DELEG-PATH-SEPARATION`
+denies any such field on a delegated request, delegated requests cannot traverse
+a route that requires edge provenance; they use ingress on which NIP-FI-EDGE is
+not required.
+
+This profile defines the normalized delegation result and its additional
+preparation, final-admission, and lease witnesses. It does not define a wire
+format for creating delegation relationships; NIP-OA or another protocol may
+supply the evidence if it satisfies this contract.
+
+## Delegation evidence
+
+A validator returns this closed result:
+
+```text
+DelegationEvidence = (
+  domain,
+  owner_key,
+  delegate_key,
+  relationship_id,
+  relationship_revision,
+  audience,
+  operations,
+  conditions,
+  resource_or_target,
+  not_before?,
+  mandatory_expiry
+)
+```
+
+`relationship_id` and `relationship_revision` are deployment-local dependency
+identifiers. All other fields are interoperability-critical in meaning even
+when their concrete encoding belongs to the supplying delegation protocol.
+
+The evidence authenticates every field, has one unambiguous owner and delegate,
+matches the server-owned domain and exact request or target, and has a finite
+expiry satisfying `now < mandatory_expiry`; equality at an expiry is expired.
+Optional `not_before` satisfies `not_before <= now + skew`, using the
+configured delegated `skew`; arithmetic is overflow-safe. A missing
+configured `skew` denies. The proven actor equals `delegate_key`.
+[FI-DELEG-EVIDENCE-CLOSED]
+
+A delegated request carries fresh request-appropriate Nostr proof and no
+`Nostr-Federated-Identity` or profile provenance field. Mixed direct and
+delegated evidence denies rather than selecting a path. [FI-DELEG-PATH-SEPARATION]
+
+## Private denial conditions
+
+This profile defines exactly this private condition identifier and owning public
+class for NIP-FI-CONF enumeration agreement:
+
+| Private condition identifier | Public class |
+|---|---|
+| `delegation_not_current` | `authorization_denied` |
+
+The identifier is a fixture name, not a wire value. Adding, removing, renaming,
+or reclassifying it requires the same change in NIP-FI-CONF's denial-fixture
+table.
+
+## Preparation
+
+Preparation resolves the exact server-owned domain, target context, operation,
+resource, and proven delegate actor before validating delegation evidence. It
+then atomically reads:
+
+- the active owner binding and exact binding version;
+- every owner tombstone, key-revocation, administrative, and profile lifecycle
+  gate applicable to that binding;
+- the exact relationship identifier and revision;
+- current local policy and resource versions; and
+- every invalidation dependency and deadline.
+
+The owner binding is current and authorization-eligible at preparation. A
+cached owner lease is not authority. The requested capability is the
+intersection of the delegation's operation, audience, conditions, and target
+with current local policy; an unsupported operation or empty intersection
+denies. [FI-DELEG-OWNER-CURRENT]
+
+Preparation remains read-only under `FI-INV-08`. It cannot create or change an
+owner or delegate binding, identity, provenance, lifecycle fact, relationship,
+last-seen value, replay claim, receipt, lease, or application effect.
+[FI-DELEG-NO-BINDING]
+
+## Final admission
+
+Core final admission additionally requires:
+
+1. the exact delegation evidence and delegate proof remain live;
+2. domain, actor, target, audience, operation, resource, and relationship match
+   the prepared value;
+3. the exact current owner binding and binding version remain eligible;
+4. relationship identity and revision remain current;
+5. current capability intersection equals the prepared intersection; and
+6. changed dependencies are reread and the complete delegated decision is
+   recomputed before atomic commit.
+
+Any mismatch, expiry, owner retirement, owner key revocation, owner binding
+version change, relationship change, unreadable dependency, or unsupported
+capability denies. Rotation makes the former owner key non-current; its
+relationships do not transfer to the new key. [FI-DELEG-OWNER-CURRENT]
+
+The delegated path creates no owner or delegate binding and cannot consume an
+enrollment opportunity. Its receipt identifies the delegate actor and exact
+owner-binding and relationship dependencies without publishing identity
+material. [FI-DELEG-NO-BINDING]
+
+## Delegated leases
+
+A deployment configures a positive finite delegated maximum and a non-negative
+finite delegated `skew`. The lease deadline is no later than the minimum of:
+
+- delegation expiry;
+- delegate proof or connection bound;
+- owner binding administrative bound, when applicable;
+- current relationship bound;
+- local policy bound;
+- the lease issue instant plus the configured delegated maximum; and
+- any stronger owner-assertion bound the deployment requires.
+
+Missing finite configuration denies. Equality is expired and arithmetic is
+overflow-safe. [FI-DELEG-LEASE-BOUND]
+
+Before each protected use, the service checks the delegate actor, owner binding
+and version, relationship and revision, capability intersection, target,
+resource, local policy, deadline, and invalidation state. It closes or rejects
+the lease within the deployment's tested revocation-detection bound after any
+owner or relationship dependency becomes ineligible. The claimed bound is no
+smaller than measured worst-case detection plus enforcement delay.
+[FI-DELEG-INVALIDATION-BOUND]
+
+Owner retirement, revocation, rotation, disablement under NIP-FI-LIFECYCLE, or
+binding replacement invalidates dependent delegates on the same effective
+schedule as owner authority. A delegate lease never authorizes another delegate
+or owner key on the same connection. [FI-DELEG-OWNER-CURRENT]
+
+## Discovery
+
+A relay claiming this profile MAY add `"delegation": true` to the NIP-11
+`federated_identity` object only when owner-current resolution, the positive
+finite maximum, uniform final admission, and all profile oracles are active. It
+does not advertise relationship IDs, owner keys, private delegation protocol
+names, or policy detail. [FI-DELEG-DISCOVERY]
+
+## Behavioral oracles
+
+| ID | Required outcome |
+|---|---|
+| `FI-DELEG-EVIDENCE-CLOSED` | Valid closed evidence passes; unauthenticated, ambiguous, wrong-domain/actor/target/audience, not-yet-valid, and expiry-equality variants deny. |
+| `FI-DELEG-PATH-SEPARATION` | Delegation plus any direct assertion/provenance field denies; neither path falls back to the other. |
+| `FI-DELEG-OWNER-CURRENT` | Exact current owner succeeds; retirement, revocation, rotation, replacement, stale owner version, stale relationship, and unreadable owner state deny without inheritance. |
+| `FI-DELEG-NO-BINDING` | Successful, denied, and concurrent delegated requests create or change no owner/delegate binding or lifecycle state. |
+| `FI-DELEG-LEASE-BOUND` | Every authority bound and equality boundary closes the lease; absent finite maximum denies. |
+| `FI-DELEG-INVALIDATION-BOUND` | Measured owner/relationship revocation closes prepared evidence and live leases within the claimed detection bound. |
+| `FI-DELEG-DISCOVERY` | Discovery is false/absent until the complete active profile passes; public output contains no relationship or owner detail. |
+
+NIP-FI-CONF defines evidence packaging and mutation adequacy. Each uppercase
+requirement above names the oracle that detects its violation.
+
+## Security considerations
+
+Delegation expands authority only by intersection and never by copying owner
+capabilities. A stolen delegation still requires the delegate key. A stolen
+delegate key is bounded by the relationship and finite lease. Owner rotation
+cannot silently transfer delegation because the exact owner key and binding
+version are dependencies. Implementations should invalidate by dependency index
+rather than wait for incidental delegate traffic.
diff --git a/docs/nips/NIP-FI-EDGE.md b/docs/nips/NIP-FI-EDGE.md
new file mode 100644
index 00000000000..1f54d36e37d
--- /dev/null
+++ b/docs/nips/NIP-FI-EDGE.md
@@ -0,0 +1,417 @@
+# NIP-FI-EDGE: Trusted Edge Profile
+
+`draft` `optional`
+
+## Scope
+
+This profile lets a trusted enterprise edge deliver federated assertion evidence to
+a NIP-FI verifier. It defines two constructions:
+
+- `trusted-proxy-hmac-v2`, a portable request-bound HMAC envelope; and
+- a private authenticated-edge assertion adapter, for platforms that provide an
+  equivalent closed trust boundary without the stock envelope.
+
+NIP-FI-EDGE is optional. A deployment can implement NIP-FI core using only
+`client-attached`. Claiming this profile does not weaken core assertion validation,
+independent Nostr proof, binding, lifecycle, policy, final-admission, or lease rules.
+The key words **MUST**, **MUST NOT**, **REQUIRED**, **SHALL**, **SHALL NOT**,
+**SHOULD**, **SHOULD NOT**, **RECOMMENDED**, **NOT RECOMMENDED**, **MAY**, and
+**OPTIONAL** are to be interpreted as described in BCP 14 when, and only when,
+they appear in all capitals.
+
+Every identifier this document serializes on the wire — header names, the
+profile identifier, provenance envelope fields, and proof transport codes — is
+interoperability-critical. `transport_contract_id` remains deployment-local as
+core classifies it: its value is opaque outside a deployment, while the
+canonical contract semantics this profile contributes to it are normative and
+fixed here. Local adapter revision identifiers and key identifiers are
+deployment-local and MUST NOT appear in public discovery.
+
+## Common trusted-edge requirements
+
+Server-owned listener, route, and authorization-domain configuration selects exactly
+one edge profile before protected traffic is accepted. Request evidence cannot
+select, negotiate, or downgrade that profile. Missing, repeated, comma-combined,
+malformed, oversized, mixed-profile, or profile-inconsistent evidence denies without
+fallback to `client-attached` or another edge profile.
+
+Every trusted edge MUST:
+
+1. strip every inbound copy of each `Nostr-Federated-Identity`,
+   `Nostr-Federated-Identity-Provenance`, and `Nostr-Federated-Identity-Client-Peer`
+   field, and of every other edge profile's assertion, identity, capability,
+   provenance, and client-peer field, before inserting its own fields. A trusted
+   edge MUST NOT remove or modify the `Authorization` field, which remains reserved
+   for the independent NIP-98 proof and MUST reach final admission unmodified;
+2. cryptographically authenticate the immediate edge to the accepting origin and
+   isolate the origin from direct or alternate ingress;
+3. integrity-protect every request component used by authorization other than
+   an independent Nostr proof, which is protected by its own signature;
+4. apply a positive finite provenance deadline that is included in final admission
+   and every resulting lease;
+5. validate a closed upstream identity and authorization claim set and produce the
+   same normalized assertion result required by core;
+6. preserve the server-resolved domain, operation, resource, method, authority,
+   path/query, body semantics, proof transport, and Nostr actor key through final
+   admission; and
+7. keep assertions, credentials, signatures, MACs, raw client addresses, and private
+   claims out of URLs, public protocol output, logs, metrics, and traces.
+
+Header presence, source address, private-network location, hostname, or reachability
+alone is not provenance. Accepting unsigned identity or capability headers, or
+accepting signed headers without authenticating and isolating the immediate caller,
+is nonconformant. A trusted edge that strips, rewrites, or reorders the
+`Authorization` field, or that admits a proof-transport-`0x02` request whose
+`Authorization` field did not arrive at the verifier byte-identical to the
+client-sent value, is nonconformant.
+
+An adapter's reviewed contract MUST identify its accepting origins, direct-origin
+controls, field-stripping point, immediate-caller authentication, protected request
+components, upstream assertion and policy validation, freshness bounds, independent
+Nostr-proof path, compromise impact, and conformance evidence. It MUST deny when any
+part of this boundary is absent or unreadable.
+
+### Authenticated-edge assertion adapters
+
+A deployment MAY install a private authenticated-edge adapter instead of HMAC-v2.
+The adapter MUST satisfy all common requirements and demonstrate together:
+origin isolation, cryptographically authenticated immediate caller, inbound-field
+stripping, integrity of the complete authorization-relevant request, bounded
+assertion and policy freshness, no direct-origin fallback, and the core final-
+admission path with independent Nostr proof.
+
+The adapter maps only its closed, validated claim set into the normalized result.
+An opaque edge token is acceptable only inside this complete contract; opacity does
+not make an unchecked header authoritative. Vendor names, issuer details, caller
+identities, private field names, capability semantics, and adapter identifiers MUST
+NOT appear in NIP-11 or portable examples.
+
+## `trusted-proxy-hmac-v2`
+
+The stock profile identifier is `trusted-proxy-hmac-v2`. Core computes the
+`transport_contract_id` from a canonical contract that includes this profile's exact
+wire format, protected components, replay rules, deadline rules, configured code
+meanings, and adapter semantics. Changing any of those inputs produces a different
+contract identity; the profile identifier itself remains stable. The proxy strips
+all inbound assertion, provenance, and client-peer fields and inserts exactly one of
+each:
+
+```text
+Nostr-Federated-Identity: Bearer <compact-JWS>
+Nostr-Federated-Identity-Provenance: v2.<timestamp>.<nonce>.<mac>
+Nostr-Federated-Identity-Client-Peer: <client-peer>
+```
+
+The assertion field follows core's compact-JWS and size rules. `timestamp` is
+canonical unsigned decimal without leading zeroes, except zero is `0`. `nonce` and
+`mac` are canonical unpadded base64url. Padding, the standard base64 alphabet,
+ignored whitespace, or another encoding denies. The proxy generates a fresh nonce
+containing at least 128 bits from a cryptographically secure random source. The
+decoded MAC is exactly 32 octets. Finite field and decoded-nonce maxima are applied
+before decoding, replay lookup, hashing, or allocation.
+
+`client-peer` is at most 64 ASCII octets. IPv4 uses dotted decimal with no leading
+zeroes. IPv6 uses lowercase RFC 5952 text. The edge converts an observed IPv4-mapped
+IPv6 address to canonical IPv4 before constructing the field; a textual mapped IPv6
+field is noncanonical. Empty, repeated, comma-combined, whitespace-padded, non-IP,
+or noncanonical values deny. After verification, the verifier MAY retain only a
+domain-separated keyed digest of this value in bounded private state.
+
+The profile uses HMAC-SHA-256 with a deployment secret containing at least 256 bits.
+Let `LP(x) = uint64be(len(x)) || x`, where length is in octets. The literal prefix is
+14 ASCII octets and is not length-prefixed. The pre-MAC input is exactly:
+
+```text
+"NIP-FI-PROXY-2" ||
+LP(timestamp_u64be) || LP(nonce_bytes) || LP(SHA256(jwt_ascii)) ||
+LP(authorization_domain_id) ||
+LP(method_ascii) || LP(authority_ascii) || LP(path_and_query_ascii) ||
+LP(SHA256(payload_octets)) || LP(proof_transport_octet) || LP(client_peer_ascii)
+```
+
+`mac = HMAC-SHA-256(secret, pre_mac_input)`. The transmitted `mac` is canonical
+unpadded base64url of the raw 32-octet result. The verifier compares it in constant
+time.
+
+### Canonical components
+
+- **Timestamp:** Parse canonical decimal into an unsigned 64-bit integer, rejecting
+  overflow, then serialize it as exactly eight-byte big-endian. Freshness checks are
+  separate from serialization.
+- **Nonce:** Decode the exact canonical base64url field before serialization.
+- **Assertion:** Hash the exact ASCII compact-JWS octets after the one space in
+  `Bearer `. No whitespace, Unicode, JSON, or base64 normalization is allowed.
+- **Authorization domain:** Configuration contains a canonical lowercase,
+  hyphenated RFC 9562 UUID named `authorization_domain_uuid`. Parse its 32 displayed
+  hexadecimal digits into the exact 16 UUID octets in display/network order. For
+  example, `00112233-4455-6677-8899-aabbccddeeff` becomes
+  `00112233445566778899aabbccddeeff`. UTF-8 UUID text, hashing, truncation,
+  namespace derivation, mixed-endian GUID encoding, uppercase, and unhyphenated
+  configuration are forbidden. The UUID is generated once, is immutable for the
+  domain's lifetime, and is shared through authenticated proxy/verifier
+  configuration. Duplicate UUIDs among active domains MUST fail startup.
+- **Method:** Use the exact uppercase ASCII method token after trusted route
+  resolution. Lowercase or noncanonical input denies; the verifier does not repair it.
+- **Authority:** Use server-configured lowercase ASCII host plus explicit effective
+  decimal port. IPv6 uses brackets and RFC 5952. Userinfo, a trailing dot, an omitted
+  port, percent encoding, or an authority derived solely from `Host`, `Forwarded`, or
+  `X-Forwarded-Host` denies.
+- **Path and query:** Use the exact post-rewrite ASCII origin-form. Empty path becomes
+  `/`; a present query includes `?`. Percent octets and hex case, an empty query,
+  repeated names, and parameter order are preserved. No decoding, sorting,
+  dot-segment removal, or re-encoding may occur after the edge snapshot. An
+  unaccounted rewrite denies.
+- **Payload:** Hash the complete HTTP payload octets after transfer-coding removal and
+  before content-coding decompression. These are exactly the octets forwarded by the
+  edge and exposed to verification. HTTP framing, chunk delimiters, and trailers are
+  excluded; `Content-Encoding` is not decoded. A WebSocket upgrade uses the empty
+  payload. Substitution of the protected octets after the snapshot denies.
+- **Proof transport:** Serialize exactly one assigned octet from the registry below.
+- **Client peer:** Serialize the exact canonical ASCII field value.
+
+No authorization decision, target, resource, capability, or effect selector
+derives from any request or connection component outside the protected pre-MAC
+components, except an independent Nostr proof validated on its own signature,
+such as the NIP-98 event in `Authorization` or the NIP-42 event after connect,
+which the MAC does not protect; body interpretation follows the server-resolved
+body semantics, never unprotected transport metadata such as `Content-Type` or
+`Content-Encoding`.
+
+### Freshness, replay, and key rotation
+
+The deployment configures a positive finite `maximum_provenance_age` and a
+non-negative finite `future_skew`. Evidence is live exactly when, using overflow-safe
+comparisons:
+
+```text
+timestamp <= now + future_skew
+now < timestamp + maximum_provenance_age
+```
+
+Equality at the age bound is expired. A direct lease deadline is no later than
+`timestamp + maximum_provenance_age` and every core assertion, proof, policy, and
+state deadline.
+
+Absent, malformed, stale, future-dated, wrong-key, or mismatched provenance denies.
+On a route that requires edge provenance, absent or incomplete provenance —
+including provenance that omits the proxy-authenticated end-client peer — maps
+to the `missing_evidence` public class, regardless of whether an assertion is
+present. Provenance that is present and complete but fails verification maps to
+`evidence_rejected`.
+A v1 envelope denies. A verifier MAY try only a configured finite set of active
+secrets. Rotation does not change nonce identity: replay uniqueness is scoped to
+`(authorization_domain_id, trusted-proxy-hmac-v2, nonce)` and is independent of the
+secret that verifies the MAC. A committed nonce is retained through at least
+`timestamp + maximum_provenance_age`.
+
+Preparation consumes neither nonce nor Nostr-proof replay identity. Final admission
+atomically consumes both with any enrollment, receipt, and authorization decision.
+A failed or rolled-back admission consumes neither. Two concurrent admissions with
+the same nonce commit at most one authorization. The proxy-to-verifier hop still
+requires confidentiality and integrity.
+
+## Proof-transport code registry
+
+| Code | Meaning and allocation policy |
+|---|---|
+| `0x00` | Invalid; MUST deny. |
+| `0x01` | NIP-42 connection proof. |
+| `0x02` | NIP-98 HTTP proof. |
+| `0x03` | Git smart-HTTP session proof: the proxy verifies a session-scoped Nostr authorization for a Git smart-HTTP request before forwarding. Reserved; allocation completes on publication of its transport contract (see below). |
+| `0x04` | Blossom media proof: the proxy verifies a Blossom media-HTTP authorization event for the request before forwarding. Reserved; allocation completes on publication of its transport contract (see below). |
+| `0x05`–`0x7f` | Unassigned; allocation requires a published stable specification. |
+| `0x80`–`0xfe` | Private use under an explicit shared proxy/verifier contract only. |
+| `0xff` | Reserved for a future extended encoding; invalid in HMAC-v2. |
+
+An allocation MUST define exact proof validation, request binding, freshness, replay
+identity and window, and conformance vectors. Assigned semantics never change; an
+incompatible meaning receives a new code. Unknown, unconfigured, or private-use
+codes without the same configured contract at proxy and verifier deny. Private-use
+codes MUST NOT be advertised as portable NIP-FI-EDGE interoperability.
+
+Codes `0x03` and `0x04` are reserved to fix their meanings and prevent
+reassignment; their transport contracts are not yet published, so their
+allocations are not complete. Until the contract for such a code is published,
+the code is valid only under an explicit shared proxy/verifier contract,
+exactly as for private use, and MUST NOT be presented as portable NIP-FI-EDGE
+interoperability.
+
+## Bounded payload acquisition
+
+Every protected `(authorization_domain_id, route, proof_transport_code)` tuple MUST
+configure a finite `maximum_payload_octets` and finite per-request
+`maximum_spool_octets >= maximum_payload_octets`. Zero is allowed only for a route
+that requires an empty payload. Proxy and verifier configuration MUST agree and is
+part of the transport contract.
+
+If trusted `Content-Length` exceeds the route limit, the edge denies before reading,
+hashing, JWT verification, replay lookup, or authoritative mutation. For absent,
+unknown, or streamed length, acquisition uses a bounded counter and spool and stops
+on octet `limit + 1`. Incremental SHA-256 is allowed, but no digest or prefix can
+authorize until EOF proves completeness.
+
+Spooling uses memory or access-controlled temporary storage with finite per-request
+and aggregate quotas, cleanup on every outcome, no public or log output, and no reuse
+across requests. Quota exhaustion fails closed and creates no nonce claim, proof
+claim, receipt, lease, or application mutation. At or below the limit, the exact
+captured payload is replayed unchanged. HMAC verification and core final admission
+complete before application effects. Forwarding to a rollback-safe private spool is
+not an application effect; forwarding to a parser, decoder, handler, or origin that
+can act is.
+
+A content decoder, multipart parser, Git/Blossom handler, framework, or intermediary
+that cannot expose and replay the exact stage defined above before effects cannot
+claim HMAC-v2 for that route. It MUST use core `client-attached` or another specified
+edge profile, never a partial-body MAC.
+
+## Normative HMAC-v2 vectors
+
+All vector integers and lengths are big-endian. Common values are:
+
+```text
+secret_hex = 000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f
+nonce_hex = 000102030405060708090a0b0c0d0e0f
+nonce_base64url = AAECAwQFBgcICQoLDA0ODw
+authorization_domain_uuid = 00112233-4455-6677-8899-aabbccddeeff
+authorization_domain_id_hex = 00112233445566778899aabbccddeeff
+jwt_ascii = eyJhbGciOiJFUzI1NiIsInR5cCI6Im5pcC1maStqd3QifQ.eyJpc3MiOiJodHRwczovL2lkLmV4YW1wbGUiLCJzdWIiOiIxMjMifQ.c2ln
+assertion_digest_hex = 6103b52a52730bc065d65673247603a63c9810488c90d0ada3d8d227eee5285f
+```
+
+The fixture JWT represents a separately minted `nip-fi+jwt` assertion and is opaque
+test input; its deliberately synthetic signature is not an assertion-validation
+vector. Implementations MUST reproduce each field, complete pre-MAC input,
+diagnostic input digest, raw MAC, and wire MAC exactly
+(`FI-TRACE-EDGE-VECTORS`).
+
+### Vector 1: HTTP / NIP-98 / non-empty payload
+
+```text
+timestamp_decimal = 1700000000
+timestamp_u64be_hex = 000000006553f100
+method_ascii = POST
+authority_ascii = api.example:443
+path_and_query_ascii = /upload?part=1&part=2&x=%2F
+payload_hex = 68656c6c6f0a
+body_digest_hex = 5891b5b522d5df086d0ff0b110fbd9d21bb4fc7163af34d08286a2e846f6be03
+proof_transport_hex = 02
+client_peer_ascii = 203.0.113.9
+pre_mac_input_hex = 4e49502d46492d50524f58592d320000000000000008000000006553f1000000000000000010000102030405060708090a0b0c0d0e0f00000000000000206103b52a52730bc065d65673247603a63c9810488c90d0ada3d8d227eee5285f000000000000001000112233445566778899aabbccddeeff0000000000000004504f5354000000000000000f6170692e6578616d706c653a343433000000000000001b2f75706c6f61643f706172743d3126706172743d3226783d25324600000000000000205891b5b522d5df086d0ff0b110fbd9d21bb4fc7163af34d08286a2e846f6be03000000000000000102000000000000000b3230332e302e3131332e39
+pre_mac_input_sha256 = df2870230d2170595dccd17d9e61a82282d8cd8b978ac18bff07419ed59091d5
+mac_hex = 761d3ecbf609f0f558b4a02a1a18a25070f3dbe89fce9cac59a80bce4436ade5
+mac_base64url = dh0-y_YJ8PVYtKAqGhiiUHDz2-ifzpysWagLzkQ2reU
+provenance = v2.1700000000.AAECAwQFBgcICQoLDA0ODw.dh0-y_YJ8PVYtKAqGhiiUHDz2-ifzpysWagLzkQ2reU
+```
+
+### Vector 2: WebSocket / NIP-42 / empty payload / mapped peer
+
+The edge observed `::ffff:192.0.2.128` and emitted canonical `192.0.2.128`.
+
+```text
+timestamp_decimal = 1
+timestamp_u64be_hex = 0000000000000001
+method_ascii = GET
+authority_ascii = relay.example:443
+path_and_query_ascii = /
+payload_hex =
+body_digest_hex = e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
+proof_transport_hex = 01
+client_peer_ascii = 192.0.2.128
+pre_mac_input_hex = 4e49502d46492d50524f58592d32000000000000000800000000000000010000000000000010000102030405060708090a0b0c0d0e0f00000000000000206103b52a52730bc065d65673247603a63c9810488c90d0ada3d8d227eee5285f000000000000001000112233445566778899aabbccddeeff0000000000000003474554000000000000001172656c61792e6578616d706c653a34343300000000000000012f0000000000000020e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855000000000000000101000000000000000b3139322e302e322e313238
+pre_mac_input_sha256 = 67564d241499491b3ea53b31d6111fbc9efac37a294f6ce591519e4bf21b53e9
+mac_hex = f71a179a018637a0582cf3de39ccb7b976216c18ada312127d4c983c14af4b20
+mac_base64url = 9xoXmgGGN6BYLPPeOcy3uXYhbBitoxISfUyYPBSvSyA
+```
+
+### Vector 3: IPv6 authority and path/query byte preservation
+
+```text
+timestamp_decimal = 1700000000
+timestamp_u64be_hex = 000000006553f100
+method_ascii = GET
+authority_ascii = [2001:db8::1]:443
+path_and_query_ascii = /a%2Fb?b=2&a=1&a=0
+payload_hex =
+body_digest_hex = e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
+proof_transport_hex = 02
+client_peer_ascii = 2001:db8::2
+pre_mac_input_hex = 4e49502d46492d50524f58592d320000000000000008000000006553f1000000000000000010000102030405060708090a0b0c0d0e0f00000000000000206103b52a52730bc065d65673247603a63c9810488c90d0ada3d8d227eee5285f000000000000001000112233445566778899aabbccddeeff000000000000000347455400000000000000115b323030313a6462383a3a315d3a34343300000000000000122f61253246623f623d3226613d3126613d300000000000000020e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855000000000000000102000000000000000b323030313a6462383a3a32
+pre_mac_input_sha256 = 8a93a29c4ac30b0f2551d346d0636040b639bb1f109d287e93ce44ddaed73e33
+mac_hex = df2936f81d752f3d6bac2a36d3381c38db2c9abc3570236cb121274ad34a6161
+mac_base64url = 3yk2-B11Lz1rrCo20zgcONssmrw1cCNssSEnStNKYWE
+```
+
+### Serialization and negative matrix
+
+The following timestamp values MUST serialize as shown before freshness evaluation:
+
+| Decimal | `uint64be` hex |
+|---:|---|
+| `0` | `0000000000000000` |
+| `1` | `0000000000000001` |
+| `255` | `00000000000000ff` |
+| `256` | `0000000000000100` |
+| `18446744073709551615` | `ffffffffffffffff` |
+
+`00`, `01`, `+1`, surrounding whitespace, negative values, and
+`18446744073709551616` deny before MAC comparison. The maximum value above is an
+encoding vector; ordinary freshness policy will reject it.
+
+Every implementation MUST run these normative negative cases:
+
+| Class | Required cases and result |
+|---|---|
+| Envelope | Absent/repeated/comma-combined fields, `v1`, missing/extra component, padding, alternate alphabet, nonce below 16 octets or above configured max, and MAC lengths 31 or 33 all deny. |
+| Domain | Uppercase/nonhyphenated UUID config fails configuration; mixed-endian UUID bytes or any one-bit domain transplant fails the baseline MAC; duplicate active UUID fails startup. |
+| Request | Mutating assertion, method, authority, path/query, body, proof code, or peer while retaining Vector 1's MAC denies. |
+| Metadata | Mutating `Content-Type` or `Content-Encoding` in flight changes no authorization decision, target, capability, or effect selector; a request whose server-resolved body semantics no longer hold denies. |
+| Path | `%2F`→`%2f`, decoding to `/`, reordering repeated query values, or adding/removing an empty `?` fails the baseline MAC. |
+| Authority | Unbracketed or non-RFC-5952 IPv6, uppercase host, trailing dot, or missing port denies before MAC comparison. |
+| Peer | Textual `::ffff:192.0.2.128`, padded IPv4, uppercase/noncanonical IPv6, or whitespace denies before MAC comparison. |
+| Proof | `0x00`, `0xff`, unknown stock code, or private code without a shared configured contract denies. |
+| Body | Known and unknown lengths `0`, `limit-1`, and `limit` may proceed only after EOF; `limit+1`, disconnect before EOF, aggregate-quota exhaustion, or any post-snapshot substitution of the protected octets denies with no replay or authoritative mutation. |
+| Replay | Concurrent final admissions of one valid envelope commit at most one; preparation and failed final admission consume none; secret rotation does not create a new nonce namespace. |
+| Fallback | Direct ingress, mixed evidence, and failed HMAC never retry as `client-attached` or another adapter. |
+
+## Discovery and conformance
+
+A relay that completely implements the stock profile MAY add exactly
+`"edge_transports": ["trusted-proxy-hmac-v2"]` inside the top-level NIP-11
+`federated_identity` object. `edge_transports` is an array of unique ASCII string
+profile identifiers in ascending bytewise order; this document assigns only the
+single value shown. A relay that does not completely implement the stock profile
+MUST omit the member. It MUST NOT advertise private adapters, keys, domains, field
+names, or code contracts. No request may select behavior from this discovery
+member; server-owned configuration selects the edge profile. Claiming FI-EDGE
+requires every configured edge profile to pass the applicable core conformance suite
+and these profile traces:
+
+| Trace | Required oracle |
+|---|---|
+| `FI-TRACE-EDGE-VECTORS` | Reproduce all three normative vectors field-for-field, including each complete pre-MAC input, diagnostic input digest, raw MAC, and wire MAC; reproduce all five timestamp serialization rows; every listed serialization and negative-matrix case produces its required denial or configuration failure. |
+| `FI-TRACE-PROXY-SPOOF` | Direct ingress, unsigned/header-only identity, unauthenticated caller, or invalid provenance denies without fallback. |
+| `FI-TRACE-PROXY-REPLAY` | Two HMAC-v2 final admissions using one nonce commit at most one; preparation consumes neither. A private adapter proves its declared replay semantics. |
+| `FI-TRACE-PROXY-CROSS-REQUEST` | Each protected component mutation denies. HMAC-v2 covers assertion, domain, method, authority, path/query, complete body, proof transport, and peer. On a `0x02` route the `Authorization` bytes at final admission equal the client-sent bytes, witnessed at both points; an edge that substitutes a valid proof from the same actor fails the witness. |
+| `FI-TRACE-EDGE-BODY-BOUNDS` | Known and streamed boundary cases prove bounded work/storage, EOF completeness, cleanup, and no pre-authorization effect. |
+| `FI-TRACE-EDGE-KEY-ROTATION` | A finite active-key set accepts an intended overlap without allowing nonce reuse or an unknown key. |
+
+The conformance record binds the exact implementation, adapter, deployment,
+assertion policy, transport contract, configured code meanings, and vector revision.
+Two HMAC-v2 implementations interoperate only when they reproduce all valid vector
+bytes exactly, reject every negative, agree on UUID and code configuration, and
+preserve atomic replay and bounded complete-body behavior.
+
+## Security considerations
+
+HMAC-v2 limits header spoofing, replay, and cross-request transplantation only when
+its secret remains confidential, the edge snapshots the final routed request, the
+origin authenticates that edge, and final admission atomically consumes replay state.
+It does not replace TLS or independent Nostr proof. A compromised edge or shared
+secret can forge federated evidence within its configured domains; use distinct
+secrets and UUIDs to limit blast radius.
+
+Authenticated-edge adapters intentionally shift more proof to deployment controls.
+A hostname, private network, or opaque token is not an equivalent construction unless
+the complete boundary obligations above are demonstrated. Body buffering and replay
+state are attacker-controlled resource surfaces, so all field, payload, spool,
+aggregate, key-set, and retention bounds fail closed.
diff --git a/docs/nips/NIP-FI-LIFECYCLE.md b/docs/nips/NIP-FI-LIFECYCLE.md
new file mode 100644
index 00000000000..fdd08d4dfb3
--- /dev/null
+++ b/docs/nips/NIP-FI-LIFECYCLE.md
@@ -0,0 +1,269 @@
+# NIP-FI-LIFECYCLE: Binding Lifecycle Profile
+
+`draft` `optional`
+
+## Abstract
+
+This profile extends NIP-FI with provisioned enrollment, identity disablement,
+re-enablement, and an administrative binding-expiry gate. It is for deployments
+whose binding changes require separately authorized operator or enterprise
+workflows. It does not change NIP-FI assertion validation, Nostr proof, final
+admission, or public denial semantics.
+
+The key words **MUST**, **MUST NOT**, **REQUIRED**, **SHALL**, **SHALL NOT**,
+**SHOULD**, **SHOULD NOT**, **RECOMMENDED**, **MAY**, and **OPTIONAL** in this
+document are to be interpreted as described in BCP 14 when, and only when, they
+appear in all capitals as shown here.
+
+## Dependencies and claim
+
+An implementation of this profile implements NIP-FI Core and advertises only
+the boolean `"lifecycle": true` inside its NIP-11 `federated_identity` object.
+This boolean claims support for this profile; it deliberately reveals neither an
+enrollment mode nor lifecycle state. For a fixed set of claimed profiles, the
+complete discovery output MUST be byte-identical whether enrollment is
+attested-key, TOFU, or provisioned and whether lifecycle facts exist. A server
+MUST NOT advertise the claim until every protected ingress in the advertised
+authorization domain applies this profile through the same final-admission
+authority (`FI-LC-CLAIM`).
+
+This profile contributes lifecycle dependencies and deadlines to the core
+prepared decision and lease. They compose with core dependencies by set union;
+the earliest applicable deadline wins. This profile cannot weaken, replace, or
+bypass a core check.
+
+## Additional state
+
+For authorization domain `D`, this profile adds:
+
+```text
+X_D : set of disabled identities
+Q_D : identity -> pending lineage
+
+PendingLineage = (
+  identity,
+  old_key,
+  old_binding_version
+)
+```
+
+It also permits a core binding to carry `binding_not_after`, an optional
+administrative deadline. The pending lineage names one exact retired pair and
+binding version. There is at most one pending lineage per identity.
+
+`binding_not_after` bounds the grant represented by **one binding**; it is not a
+bound on the identity. Rotation continues the same grant: the replacement binding
+preserves the carried bound, and only expiry authority changes it. Retirement,
+revocation, and disablement end the existing grant. Re-enablement, provisioning,
+and ordinary enrollment establish a *new* grant that carries no prior bound — so
+retirement of a bound pair followed by ordinary enrollment under `attested-key`
+or `tofu` policy yields an unbounded binding, and that is conformant. A deadline that must survive the end
+of a grant — an identity-scoped access bound — belongs in the capability
+projection of authoritative local-policy state, which core already requires for
+any projection whose removal must close authority within a declared bound and
+which is reread at preparation, final admission, and every protected lease use.
+`binding_not_after` is not that mechanism and cannot substitute for it: it does
+not survive the end of the grant that carries it, so a deployment relying on it
+for identity-scoped expiry cannot claim a revocation bound for that expiry
+(`FI-LC-ADMIN-EXPIRY`).
+
+A binding carrying a reached bound is **active** for every core relation and
+eligibility test in this profile and in core, including the core partial
+bijection and `TargetEligible` below. It is ineligible for authorization, not
+absent from the binding relation.
+
+`X_D`, `Q_D`, and `binding_not_after` are deployment-local state. Their versions
+are revalidation dependencies, not contract identities. A change invalidates a
+prepared decision and every dependent lease unless complete final-admission
+recomputation produces the required current result.
+
+Ordinary authorization MUST deny when its identity is disabled, when pending
+lineage exists for that identity, or when `now >= binding_not_after`; it MUST
+NOT clear, consume, or alter any of those facts (`FI-LC-ORDINARY-GATES`). An
+absent `binding_not_after` has no administrative expiry. Assertion `exp`,
+`iat`, refresh, or maximum age never creates, renews, extends, or clears it.
+Time passage alone creates no tombstone, lineage, or history.
+
+## Private denial conditions
+
+This profile defines exactly these private condition identifiers and owning
+public classes for NIP-FI-CONF enumeration agreement:
+
+| Private condition identifier | Public class |
+|---|---|
+| `identity_disabled` | `authorization_denied` |
+| `explicit_replacement_required` | `authorization_denied` |
+| `binding_expired` | `authorization_denied` |
+
+The identifiers are fixture names, not wire values. Adding, removing, renaming,
+or reclassifying one requires the same change in NIP-FI-CONF's denial-fixture
+table.
+
+## Common transition contract
+
+Each transition below requires privileged authority distinct from an ordinary
+federated assertion and Nostr proof. That authority MUST be bound to the exact
+`D`, transition name, identity, request, old binding version when present, and
+target key when present (`FI-LC-AUTHORITY`). The deployment defines how that
+authority is obtained; role names, approval count, and operator APIs are out of
+scope.
+
+A transition MUST, in one atomic commit:
+
+1. validate that privileged authority and fresh target-key evidence;
+2. read and recheck the applicable core binding relation, retired pairs,
+   revoked keys, `X_D`, `Q_D`, policy, and dependency versions;
+3. apply exactly the state changes specified below;
+4. append immutable lifecycle history identifying the transition and versions;
+   and
+5. advance lifecycle state so dependent prepared decisions and leases cannot
+   authorize after commit.
+
+A stale precondition, denied transition, unreadable dependency, or failed commit
+MUST leave all authoritative state unchanged (`FI-LC-ATOMIC`). Lease
+invalidation MAY be delivered asynchronously, but authorization use after the
+commit MUST recheck the advanced dependency before allowing an operation.
+
+Every transition that creates a binding MUST state whether it **continues** an
+existing grant, and therefore preserves that grant's administrative bound, or
+**establishes** a new grant carrying no prior bound. The two cases partition the
+binding-creating transitions with no remainder: core rotation continues, and
+provisioning, re-enablement, and ordinary enrollment establish. A profile that
+adds a binding-creating transition without this declaration cannot claim
+conformance (`FI-LC-CLAIM`).
+
+`TargetEligible(i, k, allow_disabled)` means that `k` is not revoked, `(i, k)`
+is not retired, neither `i` nor `k` has an active binding, and `i` is not
+disabled unless `allow_disabled` is true. Every new target key requires fresh,
+request-bound Nostr proof by that key. If domain policy requires issuer key
+attestation, the transition also requires a current assertion for `i` whose key
+claim equals `k`. Supplied stale, absent, wrong-identity, or mismatched required
+attestation denies; it is never ignored as optional evidence
+(`FI-LC-TARGET-PROOF`).
+
+A replacement binding records `attested-key` provenance only when current
+matching issuer attestation was validated; otherwise it records `provisioned`.
+TOFU provenance can arise only from the core ordinary first-use extension and
+is never inherited by a replacement.
+
+## Privileged transitions
+
+### Provision binding
+
+```text
+ProvisionBinding(i, k):
+  require domain enrollment policy = provisioned
+  require TargetEligible(i, k, false)
+  require Q_D(i) is absent
+  require fresh target-key evidence
+  create Binding(i, k, new_version, provisioned)
+```
+
+The transition creates no authorization lease. Later use requires a current
+assertion, fresh Nostr proof, and ordinary final admission. Ordinary
+request-time authorization under `provisioned` policy MUST NOT create a binding
+(`FI-LC-PROVISION`).
+
+### Disable identity
+
+```text
+DisableIdentity(i):
+  add i to X_D
+  if Binding(i, k, old_version) exists:
+    remove Binding(i, k, old_version)
+    add (i, k) to the core retired-pair set
+    set Q_D(i) = (i, k, old_version)
+```
+
+Applying an authorized disablement repeatedly is idempotent. It MUST NOT erase
+or replace existing lineage. If `i` has no active binding, disablement creates
+no lineage (`FI-LC-DISABLE`).
+
+### Re-enable identity
+
+```text
+ReenableIdentity(i, expected_lineage?, k_new):
+  require i is in X_D
+  require Q_D(i) is absent when expected_lineage is absent,
+          otherwise require Q_D(i) = expected_lineage
+  require TargetEligible(i, k_new, true)
+  require fresh target-key evidence
+  remove i from X_D
+  consume expected_lineage when present
+  create Binding(i, k_new, new_version, ReplacementProvenance(evidence))
+```
+
+Clearing disabled state and creating the target binding are inseparable. There
+is no clear-only transition: it would permit a later ordinary enrollment to
+capture the identity. An operator that intends to provision later leaves the
+identity disabled until the target and fresh proof are available
+(`FI-LC-REENABLE`).
+
+### Set administrative expiry
+
+```text
+SetAdministrativeExpiry(i, k, old_version, binding_not_after?):
+  require exact current Binding(i, k, old_version)
+  require separate privileged expiry authority
+  replace it with Binding(i, k, new_version,
+                          same_provenance, binding_not_after?)
+```
+
+This transition changes neither side of the pair nor its provenance. Setting,
+replacing, or clearing the bound advances the binding version. At equality the
+binding is ineligible but remains durable and occupies both sides of the core
+partial bijection. This transition is the only expiry authority: no other
+transition in this profile or in core sets, replaces, or clears the bound, and
+core rotation carries it onto the replacement binding unchanged. Only this or
+another applicable privileged transition can restore access; ordinary
+authorization cannot renew the bound (`FI-LC-ADMIN-EXPIRY`).
+
+## One-shot lineage and concurrency
+
+Consumption of `Q_D` and creation of its replacement binding MUST be one
+compare-and-commit operation over the exact pending lineage. Of two concurrent
+re-enablings presenting the same lineage, at most one can commit. The loser
+observes changed state and denies without creating a binding, consuming another
+lineage, or changing history (`FI-LC-QD-ONCE`).
+
+A lifecycle transition racing ordinary final admission is ordered by the same
+authoritative state transaction or dependency check. If the lifecycle commit
+wins, the ordinary operation denies; if final admission wins first, the
+lifecycle transition still invalidates subsequent lease use. No ordering
+permits authority from a disabled identity, consumed lineage, or expired
+binding after the corresponding state change is observed.
+
+## Behavioral oracles
+
+Each oracle is normative. A conforming implementation produces the stated
+result at final admission and retains no partial authoritative mutation from a
+denied case.
+
+| ID | Setup and required result |
+|---|---|
+| `FI-LC-CLAIM` | For a fixed profile set, compare complete discovery bytes across attested-key, TOFU, and provisioned configurations and across lifecycle states: they are identical. If one protected ingress omits lifecycle gates or uses a different lifecycle lineage, the domain cannot advertise the profile and the uncovered ingress fails closed. If any claimed profile defines a binding-creating transition that declares neither grant continuation nor grant establishment, the domain cannot advertise that profile. |
+| `FI-LC-ORDINARY-GATES` | Fresh assertion and proof for a disabled identity, an identity with pending lineage, and a binding at administrative-expiry equality each deny without changing lifecycle state. |
+| `FI-LC-AUTHORITY` | An ordinary assertion plus valid Nostr proof, but no transition-specific authority, cannot perform any transition; mutation of any authority-bound field denies. |
+| `FI-LC-ATOMIC` | Inject failure at each transition write boundary; no binding, tombstone, disabled fact, lineage, history entry, or dependency version is partially committed. |
+| `FI-LC-TARGET-PROOF` | Missing, stale, wrong-key, wrong-request, or mismatched required attestation for a new target denies without mutation. |
+| `FI-LC-PROVISION` | Ordinary first use in provisioned mode denies; authorized provisioning creates one binding and no lease; later current ordinary admission may use it. |
+| `FI-LC-DISABLE` | Disabling an active identity atomically disables it, retires its exact pair, records exact lineage, and closes subsequent lease use; replay is idempotent and preserves lineage. |
+| `FI-LC-REENABLE` | Re-enablement creates an eligible proven binding in the same commit that clears disabled state; absent or wrong expected lineage and a clear-only attempt deny. |
+| `FI-LC-ADMIN-EXPIRY` | Before the bound the binding may authorize; at equality it denies while still occupying the relation, so a target eligibility test for either side of that pair fails. Rotating the expired binding to a new key carries the bound: the replacement denies at the same instant. No non-expiry transition clears it. Only an authorized version-checked update by the expiry authority changes the bound. Conversely, retirement, revocation, or re-enablement of the bound pair followed by an authorized or ordinary new grant produces an unbounded binding, which is the required result and not an escape. |
+| `FI-LC-QD-ONCE` | Two concurrent re-enablings consume the same `Q_D` lineage; exactly one commits and the loser leaves every authoritative store unchanged. |
+| `FI-LC-RACE` | Race each transition against prepared ordinary admission and lease use; no operation authorizes after observing the advanced lifecycle or binding dependency. |
+
+## Security considerations
+
+Privileged authority compromise can provision or replace enterprise bindings;
+deployments should apply controls proportionate to that authority. This profile
+makes the authority request-bound and transitions atomic, but does not define
+approval UX or key custody.
+
+Disabled identities, retired pairs, revoked keys, and pending lineage serve
+different purposes. Re-enablement removes only the exact disabled fact and
+optional exact lineage named by its transition. No transition in this profile
+removes a core revoked-key or retired-pair fact.
+
+Administrative expiry is local policy, not upstream revocation freshness. It
+cannot extend an assertion, status witness, Nostr proof, or lease deadline.
diff --git a/docs/nips/NIP-FI-MODEL.md b/docs/nips/NIP-FI-MODEL.md
new file mode 100644
index 00000000000..821477755cc
--- /dev/null
+++ b/docs/nips/NIP-FI-MODEL.md
@@ -0,0 +1,96 @@
+NIP-FI-MODEL
+============
+
+Composed authorization model (non-normative)
+--------------------------------------------
+
+This companion is explanatory. It defines no requirement, invariant, wire
+value, denial mapping, or conformance claim. Normative requirements live in
+[NIP-FI](NIP-FI.md) and the claimed profile documents. In particular,
+`FI-INV-01` through `FI-INV-16` are defined only by NIP-FI core.
+
+## State sketch
+
+One useful implementation model keeps these authoritative relations per domain:
+
+```text
+B_D : active identity-to-key relation
+T_D : retired identity/key pairs
+Y_D : revoked keys
+H_D : immutable lifecycle history
+V_D : binding and lifecycle versions
+```
+
+NIP-FI-LIFECYCLE adds disabled identities and pending replacement lineage.
+NIP-FI-DELEG adds relationship state but no delegate binding. NIP-FI-EDGE adds
+transport-provenance and replay witnesses. Implementations may use different
+storage as long as their observable behavior satisfies the owning normative
+documents.
+
+## Composed direct decision
+
+The core decision can be read as this equation:
+
+```text
+validated issuer-qualified identity
++ fresh request/connection-bound Nostr proof
++ current durable partial-bijection state
++ current local policy
++ atomic final admission
+= authority for exactly the proven key and operation
+```
+
+Preparation gathers immutable evidence and snapshots every dependency without
+mutation. Final admission compares exact context and stable contract identities,
+checks all deadlines, revalidates changed snapshots, recomputes from current
+binding and policy state, then commits replay claims, optional enrollment, and a
+receipt atomically. The special concurrent-enrollment normalization is narrow:
+an `enroll(i,k)` proposal may become the same eligible `existing(i,k)` result;
+a different winner is not equivalent.
+
+## Profile composition
+
+Profiles contribute witnesses, never alternate final authority:
+
+```text
+core witnesses
+∪ EDGE provenance/replay witnesses
+∪ LIFECYCLE eligibility/lineage witnesses
+∪ DELEG owner/relationship witnesses
+```
+
+The lease deadline is the minimum of every bound in the resulting set. A missing
+or unreadable required witness denies. A profile cannot remove a core witness,
+extend a core deadline, replace the proven actor, or create a second admission
+lineage.
+
+For direct authorization, the path dependency is the normalized assertion and
+its current snapshot/status witnesses. For delegated authorization, it is the
+exact eligible owner binding plus relationship evidence; direct assertion fields
+are absent. Both paths share context resolution, Nostr-proof validation, local
+policy, read-only preparation, and atomic final admission.
+
+## Lifecycle intuition
+
+Bindings are durable; leases are ephemeral. Retirement makes one exact pair
+permanently ineligible for ordinary recreation. Revocation makes a key
+ineligible throughout the domain. Rotation retires the old pair and creates a
+new binding version but does not globally revoke the old key. Extended lifecycle
+operations may add disabled identity and one-shot pending-lineage state, as
+specified by NIP-FI-LIFECYCLE.
+
+## Privacy intuition
+
+Private reasons collapse to fixed public bytes. In particular, binding
+conflicts, tombstones, lifecycle gates, key mismatch, enrollment requirements,
+and local-policy decisions are indistinguishable. Operational diagnostics may
+retain bounded private reason codes, but such records are not protocol objects
+and never become authorization witnesses.
+
+## Reading order
+
+1. NIP-FI for core state, wire behavior, invariants, and direct admission.
+2. NIP-FI-EDGE for a trusted-enterprise edge.
+3. NIP-FI-LIFECYCLE for provisioning, disablement, and re-enablement.
+4. NIP-FI-DELEG for delegated agents.
+5. NIP-FI-CONF for claim and evidence rules.
diff --git a/docs/nips/NIP-FI.md b/docs/nips/NIP-FI.md
new file mode 100644
index 00000000000..663210659be
--- /dev/null
+++ b/docs/nips/NIP-FI.md
@@ -0,0 +1,632 @@
+NIP-FI
+======
+
+Federated identity authorization — core
+----------------------------------------
+
+`draft` `optional` `relay`
+
+**Protocol dependencies**: NIP-01 and either NIP-42 or NIP-98. Optional
+profiles are defined by NIP-FI-EDGE, NIP-FI-LIFECYCLE, NIP-FI-DELEG, and
+NIP-FI-CONF.
+
+The key words "MUST", "MUST NOT", "REQUIRED", "SHOULD", "SHOULD NOT", and
+"MAY" in this document are to be interpreted as described in BCP 14 (RFC 2119
+and RFC 8174) when, and only when, they appear in all capitals.
+
+## Abstract
+
+NIP-FI authorizes a Nostr key only when four independent facts agree: a valid
+issuer-qualified identity assertion, fresh proof of that Nostr key, current
+identity-to-key binding state, and current local policy for the exact operation.
+The identity provider never signs Nostr events, and an assertion never replaces
+Nostr proof.
+
+Bindings outlive individual assertions. Assertions and authorization leases do
+not outlive their evidence. This core defines the portable client-attached
+assertion transport, direct enrollment, atomic final admission, bounded
+sessions, privacy-preserving denial responses, and the smallest useful binding
+lifecycle. Companion profiles add trusted edges, extended lifecycle operations,
+and delegation without changing the core admission rule.
+
+This NIP does not define an identity provider, database schema, operator API,
+public identity projection, application membership policy, or user interface.
+
+## Terms and identifier classes
+
+- **domain** (`D`): an authorization boundary selected only by authenticated
+  server routing and configuration.
+- **identity** (`i`): the exact tuple `(iss, sub)` returned by assertion
+  validation. Email, display name, employee number, and a bare `sub` are not
+  identities.
+- **target context** (`R_t`): the server-resolved method, authority, path and
+  query, body semantics, transport, operation, and resource.
+- **actor** (`k`): the 32-byte public key returned by Nostr-proof validation.
+- **request context** (`R`): `R_t` sealed with `k`.
+- **binding**: a durable, versioned association `(D, i, k)` with immutable
+  provenance `attested-key`, `tofu`, or `provisioned`.
+- **retired pair**: a durable denial fact for an exact `(D, i, k)`.
+- **revoked key**: a durable denial fact for `(D, k)`.
+- **prepared authorization**: immutable, read-only evidence and witnesses for a
+  possible admission.
+- **committed authorization**: authority returned only after final revalidation
+  and atomic commit.
+- **lease**: a cached committed decision for one actor and bounded operation
+  set. A lease is not a binding.
+
+Identity and authorization-state comparisons preserve every tuple component.
+Equal `sub` values under different `iss` values are distinct identities; equal
+`(i, k)` pairs under different domains are distinct bindings, retired pairs,
+and authorization state. [FI-TRACE-CROSS-DOMAIN-COLLISION]
+
+Every identifier is either **interoperability-critical** or
+**deployment-local**. Header names, public response bytes, token type values,
+and trace identifiers are interoperability-critical and fixed here.
+`assertion_policy_id`, `transport_contract_id`, domain IDs, snapshot versions,
+binding versions, policy versions, and correlation IDs are deployment-local;
+their values are opaque outside a deployment, while their stability and
+invalidation behavior are normative.
+
+## Core security invariants
+
+These labels are the normative home of the NIP-FI invariants. Companion
+profiles may add witnesses and bounds but cannot weaken them.
+
+1. **`FI-INV-01 — partial bijection.`** Active bindings are one-to-one within a
+   domain: one identity has at most one active key and one key has at most one
+   active identity. [FI-TRACE-BINDING-CONFLICT]
+2. **`FI-INV-02 — durable binding.`** Assertion expiry removes neither a
+   binding nor its provenance. Fresh eligible evidence may authorize the same
+   binding later. [FI-TRACE-ASSERTION-REFRESH]
+3. **`FI-INV-03 — tombstone monotonicity.`** Ordinary authorization never
+   removes a retired-pair or revoked-key fact and never recreates a retired
+   pair. [FI-TRACE-TOMBSTONE-REPLAY]
+4. **`FI-INV-04 — server-owned context.`** Every admitted operation uses one
+   server-resolved domain, target, resource, operation, and proven actor.
+   Unauthenticated input cannot replace them. [FI-TRACE-DOMAIN-SPOOF]
+5. **`FI-INV-05 — independent evidence.`** Direct authorization requires a
+   current assertion and fresh Nostr proof. If the assertion names a key, it
+   equals the proven actor. [FI-TRACE-ASSERTION-KEY-MISMATCH]
+6. **`FI-INV-06 — stable assertion policy.`** Assertion-policy identity changes
+   when accepted assertion semantics change, but not when only authenticated
+   key or status snapshot contents rotate. [FI-TRACE-VERIFIER-PARITY]
+7. **`FI-INV-07 — current-snapshot verification.`** Evidence cannot survive
+   removal of the key or policy snapshot that authenticated it; a changed
+   snapshot requires revalidation. [FI-TRACE-JWKS-REMOVE]
+8. **`FI-INV-08 — read-only preparation.`** Preparation creates no binding,
+   tombstone, replay claim, receipt, lease, publication, last-seen value, audit
+   authority, or application mutation. [FI-TRACE-FINAL-DENIAL-NO-MUTATION]
+9. **`FI-INV-09 — atomic final admission.`** Enrollment, replay claims,
+   receipts, and required authorization evidence commit only after complete
+   final revalidation, all or none. [FI-TRACE-PREPARED-STALE]
+10. **`FI-INV-10 — explicit lifecycle authority.`** Retirement, revocation,
+    rotation, and profile-defined lifecycle changes occur only through their
+    separately authorized transition. [FI-TRACE-LIFECYCLE-AUTHORITY]
+11. **`FI-INV-11 — evidence-bounded leases.`** A lease ends no later than every
+    evidence, snapshot, proof, binding, local-policy, and implementation bound
+    on which it depends. [FI-TRACE-LEASE-BOUND]
+12. **`FI-INV-12 — current-owner delegation.`** When NIP-FI-DELEG is claimed,
+    delegation requires the exact current eligible owner binding, fresh
+    delegate proof, capability intersection, and a positive finite deadline.
+    [FI-DELEG-OWNER-CURRENT]
+13. **`FI-INV-13 — privacy-safe denial.`** Public rejection is many-to-one and
+    reveals no identity, key, claim, binding, tombstone, enrollment mode, key
+    identifier, or private policy fact. [FI-TRACE-DENIAL-ORACLE]
+14. **`FI-INV-14 — fail closed.`** Unreadable, ambiguous, stale beyond policy,
+    or inconsistent evidence or authoritative state cannot produce authority.
+    [FI-TRACE-DEPENDENCY-FAIL-CLOSED]
+15. **`FI-INV-15 — uniform authority.`** Every protected ingress in a domain
+    uses the same current domain policy and final-admission authority. An
+    uncovered or competing path is unavailable. [FI-TRACE-AUTHORITY-UNIFORM]
+16. **`FI-INV-16 — canonical verifier.`** Assertion transports feed one closed,
+    provider-neutral normalized-result contract and cannot fork final
+    admission. [FI-TRACE-VERIFIER-PARITY]
+
+## Client-attached transport
+
+Server configuration selects `client-attached` before protected traffic is
+accepted. Request fields cannot select, negotiate, or downgrade transport.
+Failure never falls back to another transport. [FI-TRACE-TRANSPORT-CLOSED]
+
+The client sends exactly one field on the request or WebSocket upgrade:
+
+```text
+Nostr-Federated-Identity: Bearer <compact-JWS>
+```
+
+`Authorization` remains reserved for NIP-98. Assertion and provenance fields
+from any other profile are absent. Missing, repeated, comma-combined, empty,
+malformed, non-Bearer, or mixed-profile fields deny. Assertions never appear in
+URLs, query parameters, Nostr events, tags, filters, application history, or
+public identity projections. [FI-TRACE-TRANSPORT-CLOSED]
+
+The core transport contract has deployment-local identity
+`transport_contract_id`. It deterministically identifies the exact field,
+parsing, request-attachment, no-fallback, and context-preservation semantics.
+Changing any of those semantics changes the ID; changing request data does not.
+[FI-TRACE-CONTRACT-IDENTITIES]
+
+## Assertion validation
+
+A configured assertion policy accepts exactly one bounded compact JWS and
+returns this closed result:
+
+```text
+VerifiedAssertion = (
+  identity = (iss, sub),
+  asserted_key?,
+  claims_or_capabilities,
+  authority_deadlines,          // non-empty
+  assertion_policy_id,
+  transport_contract_id,
+  revalidation_dependencies
+)
+```
+
+The verifier rejects ambiguous protected-header or claim members, unknown
+critical headers, `alg=none`, symmetric algorithms, algorithm/key mismatch,
+incompatible JWK usage, ambiguous key selection, and signatures not valid
+under exactly one accepted asymmetric key. It bounds the assertion, headers,
+claims, subject, key identifiers, and authenticated key set before lookup or
+logging. [FI-TRACE-ASSERTION-VALIDATION]
+
+The exact `iss` selects an authenticated policy and key source; `iss` and at
+least one `aud` value exactly match configured values. `sub` is a non-empty
+bounded string. Each policy configures a non-negative finite `skew`, a positive
+finite `maximum_assertion_age`, and, for `current-status`, a positive finite
+`maximum_status_age`; a missing value denies. `exp` and `iat` are finite
+NumericDate values satisfying `now < exp`, `iat <= now + skew`, and
+`now < iat + maximum_assertion_age`. Optional `nbf` satisfies
+`nbf <= now + skew`. Arithmetic is overflow-safe and equality at an expiry is
+expired. [FI-TRACE-ASSERTION-VALIDATION]
+
+The Nostr-key claim is named `nostr_pubkey`. When present it MUST be a
+lowercase hexadecimal encoding of exactly one 32-byte Nostr public key; other
+encodings and aliases deny. In `attested-key` enrollment policy and wherever
+current matching issuer attestation is required, this exact claim MUST be
+present and equal the proven actor; authorization claims or capabilities use a
+closed bounded input set and deterministic canonical encoding. Unchecked claims
+never enter the result. [FI-TRACE-VERIFIER-PARITY]
+
+### Token class
+
+Policy selects exactly one token class before parsing claims:
+
+- **`at+jwt` access token**: a Buzz-resource access token whose protected
+  `typ` is exactly `at+jwt` and whose `aud` contains the configured Buzz
+  resource audience. This class selects tokens carrying the RFC 9068 `at+jwt`
+  type but validates them under this document's claim contract; it does not
+  implement the full RFC 9068 validation profile, and the long-form media type
+  `application/at+jwt` is not accepted;
+- **dedicated Buzz assertion**: a separately minted assertion whose protected
+  `typ` is exactly `nip-fi+jwt`;
+- **named compatibility access token**: absent or generic protected `typ=JWT`
+  only under an explicit issuer policy whose required and forbidden claims,
+  audience, issuer, key source, and validation rules are mutually exclusive
+  with every accepted ID-token and other JWT class.
+
+OIDC ID Tokens always deny, even when `iss`, `aud`, and `sub` match. A generic
+or absent type has no stock fallback. Failure under one class never triggers
+validation under another. An `at+jwt` access token MUST contain one non-empty
+bounded `client_id`. Issuer policy MUST distinguish a resource-owner token from a token
+whose subject represents the OAuth client, including a client-credentials token,
+using authenticated claim semantics and mutually exclusive validation rules. A
+token that admits both interpretations denies. If client-subject tokens are
+accepted, the issuer MUST guarantee that their `(iss, sub)` coordinates cannot
+collide with resource-owner coordinates; otherwise that token class is
+ineligible. Token class and every class-specific validation rule are inputs to
+`assertion_policy_id`. [FI-TRACE-TOKEN-CLASS]
+
+### Policy identity and snapshots
+
+Core has exactly two semantic contract identities:
+
+```text
+assertion_policy_id  = H(canonical assertion-policy contract)
+transport_contract_id = H(canonical transport contract)
+```
+
+Each uses one implementation-defined but deterministic, versioned encoding and
+collision-resistant hash within a deployment. `assertion_policy_id` covers the
+canonical issuer, audience, token class, allowed algorithms, authenticated
+key/status-source contracts, identity/key/claim mapping, time and size rules,
+normalization, freshness class, and compiled verifier behavior. The verifier
+fingerprint is an input, not a third identity. `transport_contract_id` covers
+the client-attached field, parsing, attachment, context preservation, and
+no-fallback semantics; a companion transport may define its own canonical
+contract under that same identity slot. A semantic change changes exactly its
+owning ID. [FI-TRACE-CONTRACT-IDENTITIES]
+
+Mutable contents and deployment state are not contract identities. They remain
+in `revalidation_dependencies`: authenticated assertion-snapshot version,
+verification-key identity, key-snapshot hard deadline, optional status
+source/version/deadline, binding/lifecycle/local-policy/resource versions,
+proof and replay witnesses, and a confidential handle to the exact compact JWS.
+Adding, removing, or replacing an accepted key changes the snapshot version,
+not `assertion_policy_id`. Changed dependencies require revalidation under
+current state; a retained key may continue, while an absent key denies.
+Unknown-key refresh is bounded and coalesced and has no attacker-triggered
+stale-key fallback. [FI-TRACE-JWKS-ADD] [FI-TRACE-JWKS-REMOVE]
+
+The base contract compares the current authenticated snapshot and makes no
+anti-rollback promise. A deployment claiming rollback prevention records a
+separately authenticated monotonic floor and tests it. [deployment artifact:
+assertion-policy review]
+
+### Freshness class
+
+Each policy declares exactly one server-owned freshness class, included in
+`assertion_policy_id`:
+
+- **`offline-jwt`** validates the JWT and authenticated key snapshot only.
+  `upstream_authority_deadline` is the minimum of `exp`,
+  `iat + maximum_assertion_age`, and the key-snapshot hard deadline. Token age
+  bounds assertions minted before revocation; it cannot bound an issuer that
+  continues minting accepted assertions afterward. Enabling this class therefore
+  requires deployment evidence that revocation stops new accepted issuance, and
+  discovery reports the unconditional residual bound as unknown (`null`). It
+  MUST NOT advertise a finite unconditional residual bound. [deployment
+  artifact: issuer revocation review]
+- **`current-status`** additionally requires an authenticated witness
+  `(iss, sub, token_or_session_id?, active=true, observed_at, valid_until,
+  status_version, authenticated_source_id)`. Issuer, subject, and optional
+  session identifier exactly match the assertion. Ambiguous, unauthenticated,
+  inactive, or expired status denies. `valid_until` is finite and no later than
+  `observed_at + maximum_status_age`. The upstream deadline is the minimum of
+  the offline assertion deadlines and `valid_until`. Source outage cannot mint
+  or extend a witness; an already verified witness remains usable only until
+  its existing `valid_until`. [FI-TRACE-CURRENT-STATUS-STALE]
+
+A current-status deployment advertises a tested positive
+`maximum_residual_upstream_revocation_seconds`. Prepared evidence and leases
+close within that value after upstream revocation, including a revocation racing
+final admission. Poll/cache age, event-delivery and processing delay, and
+enforcement delay all fit within the advertised value. A push implementation
+may close authority sooner but cannot claim a value below its tested worst case.
+[FI-TRACE-CURRENT-STATUS-REVOKED]
+
+An external capability projection whose removal is required to close authority
+within a declared revocation bound MUST enter authoritative local-policy state,
+not `claims_or_capabilities` from the assertion. That state is reread during
+preparation, final admission, and protected lease use. A deployment that carries
+such a projection only in assertions cannot claim a revocation bound for its
+changes. [FI-TRACE-CAPABILITY-REVOCATION]
+
+Before enabling an issuer, the operator records authoritative evidence that
+`sub` is stable for the account lifetime, never reassigned, and not intentionally
+derived from mutable profile data. An issuer that cannot provide this property
+is ineligible. [deployment artifact: issuer subject-stability review]
+
+## Nostr proof and body semantics
+
+The actor is always returned by fresh Nostr-proof validation, never by an
+assertion or unsigned field. NIP-42 binds its AUTH event to the current
+challenge, relay URL, connection, and freshness window. NIP-98 binds its event
+to the exact server-resolved URL, method, and freshness window. All evidence
+agrees with the same `D` and `R_t`. [FI-TRACE-DOMAIN-SPOOF]
+
+Each protected HTTP operation declares in server policy whether its body is
+authorization-relevant; clients cannot select the declaration.
+
+For a relevant body, the NIP-98 event contains exactly one `payload` tag equal
+to lowercase hexadecimal SHA-256 of the **body bytes**: the complete content
+after transfer decoding and before any content decoding. Absence, duplication,
+mismatch, validation of only a prefix, or substitution of the body bytes after
+validation denies. For an irrelevant body, no
+authorization decision, target, capability, or effect selector derives from a
+body field not bound by NIP-98. A `payload` tag present on an operation whose
+body is declared authorization-irrelevant is validated identically against the
+body bytes; duplication or mismatch denies. [FI-TRACE-BODY-BINDING]
+
+Every operation has finite body and spool bounds. A known oversized body is
+rejected before hashing; a stream is rejected at octet `limit + 1`; admission
+waits for EOF. Before EOF there is no application effect, replay mutation,
+receipt, or partial digest authority. Quota failure cleans up staged bytes and
+denies. [FI-TRACE-BODY-BOUNDS]
+
+## Direct preparation
+
+The following is normative pseudocode; every read is from authoritative state.
+
+```text
+PrepareDirect(request, assertion, proof):
+  (D, R_t, operation, resource) := ResolveTargetContext(request) or DENY
+  e := ValidateClientAttached(assertion, D, R_t) or DENY
+  k := ValidateNostrProof(proof, D, R_t) or DENY
+  R := SealActor(R_t, k)
+  i := e.identity
+
+  if e.asserted_key exists and e.asserted_key != k: DENY(key_mismatch)
+  atomically read B_D(i), B_D(k), T_D(i,k), Y_D(k), enrollment policy,
+                      local policy, resource, and all dependency versions
+  if k in Y_D: DENY(key_revoked)
+  if (i,k) in T_D: DENY(pair_retired)
+
+  if B_D(i) = B_D(k) = binding(i,k):
+      proposal := existing(binding.version, binding.provenance)
+  else if B_D(i) exists or B_D(k) exists:
+      DENY(binding_conflict)
+  else if enrollment policy = attested-key:
+      if e.asserted_key != k: DENY(attestation_required)
+      proposal := enroll(i, k, attested-key)
+  else if enrollment policy = tofu:
+      proposal := enroll(i, k, e.asserted_key = k ? attested-key : tofu)
+  else:
+      DENY(binding_required)
+
+  EvaluateLocalPolicy(D, R, operation, resource, k,
+                      e.claims_or_capabilities) or DENY
+  return PreparedAuthorization(evidence, proposal, witnesses, deadlines)
+```
+
+TOFU is optional private deployment posture and is not self-advertised. It
+accepts that a stolen assertion for a never-enrolled identity can bind an
+attacker's proven key; deployments enabling it retain a passing
+FI-TRACE-TOFU-THEFT artifact. Binding provenance is immutable. A policy change
+affects only future creation. [deployment artifact: TOFU risk review]
+
+Preparation, including first-use enrollment, is read-only and produces no
+authoritative mutation. [FI-TRACE-FINAL-DENIAL-NO-MUTATION]
+
+## Final admission
+
+A prepared value is consumed at most once. Final admission first requires an
+exact domain, context, operation, resource, actor, and transport match; both
+contract IDs unchanged; and every bound live. A changed dependency is reread
+and re-evaluated from authoritative evidence. [FI-TRACE-PREPARED-STALE]
+
+Two verified assertion results are **equivalent** when:
+
+1. identity-class fields are byte-equal: `iss`, `sub`, asserted-key presence and
+   value, canonical claims/capabilities, `assertion_policy_id`, and
+   `transport_contract_id`;
+2. each bounds-class deadline — every `authority_deadlines` member, the
+   key-snapshot hard deadline, and any status deadline — is live now and is no
+   later than its prepared value; and
+3. provenance-class fields — snapshot version, verification-key identity,
+   status source and version, binding, lifecycle, local-policy, and resource
+   versions, proof and replay witnesses, the confidential JWS handle, cache
+   metadata, ordering, and retrieval time — are ignored after successful
+   current revalidation.
+
+Every `revalidation_dependencies` member is bounds-class if it is a deadline
+and provenance-class otherwise. Any new or unclassified assertion-content field
+belongs to the identity class. A fresher assertion cannot silently extend a
+prepared decision. [FI-TRACE-PREPARED-STALE]
+
+Final admission atomically rereads binding, tombstone, revocation, enrollment,
+policy, resource, status, replay, receipt, and invalidation witnesses;
+recomputes the complete decision; claims applicable proof replay identities;
+creates an eligible proposed binding; and appends its request-bound receipt and
+required authorization evidence. All commit or none. A concurrent identical
+enrollment may recompute as the same `existing` binding; conflicting enrollment
+commits at most one winner. [FI-TRACE-CONCURRENT-ENROLLMENT]
+
+A failed admission rolls back all authority mutation. The application operation
+runs only after committed authorization. If it cannot share the transaction, a
+request-bound idempotent receipt prevents the same proof from creating a second
+effect. [FI-TRACE-FINAL-DENIAL-NO-MUTATION]
+
+## Base lifecycle
+
+Retirement, revocation, and rotation require separate privileged authority
+bound to the exact domain, transition, identity, old binding version when
+present, target key when present, and request. Each atomically rechecks current
+state, appends immutable lifecycle history, and invalidates dependent leases
+after commit. Every new target key supplies fresh target-bound Nostr proof and
+any policy-required current matching issuer attestation. [FI-TRACE-LIFECYCLE-AUTHORITY]
+
+- **RetirePair** removes one exact active binding and durably retires its pair.
+- **RevokeKey** records the key as revoked even if inactive; if active, it also
+  removes the binding and retires that pair. Repeating the same authorized
+  revocation is idempotent.
+- **Rotate** replaces one exact active binding with one unused, unrevoked,
+  non-retired target key, retires the old pair, and creates a fresh binding
+  version. The replacement provenance is `attested-key` when current matching
+  issuer attestation was validated and `provisioned` otherwise. Rotation does
+  not globally revoke the old key. Rotation continues one grant onto a new key
+  rather than establishing a new one: the replacement preserves every
+  profile-defined administrative bound carried by the binding it replaces, as an
+  opaque field core neither interprets nor clears. Only the authority that set
+  such a bound can change it. [FI-TRACE-LIFECYCLE-AUTHORITY]
+
+Failure or stale state causes no partial mutation. Ordinary authorization cannot
+perform or undo these transitions. Extended disablement, re-enablement,
+provisioning, and administrative expiry are defined only by NIP-FI-LIFECYCLE.
+
+## Request and session bounds
+
+HTTP authority covers one exact request and is never reusable.
+
+A WebSocket lease is scoped to one actor, domain, operation set, binding
+version, normalized result, policy/resource versions, and invalidation
+witnesses. Its deadline is the earliest assertion, upstream-authority,
+key-snapshot, proof/connection, local-policy, and implementation deadline.
+Arithmetic is overflow-safe and equality is expired. [FI-TRACE-LEASE-BOUND]
+
+Before each protected use, the service checks actor, domain, operation,
+resource, deadline, binding version, contract IDs, snapshot/status versions,
+policy versions, and invalidation state. Changed dependencies require current
+revalidation to an equivalent result; unreadable or ineligible state denies.
+A lease for one key never authorizes another key on the same connection.
+[FI-TRACE-MULTI-KEY-SESSION]
+
+Expiry ends the lease, not the binding. Renewal requires a new connection with
+a fresh assertion attached to its WebSocket upgrade, fresh Nostr proof,
+preparation, and final admission; there is no in-band renewal path. Confidential
+assertion revalidation material is destroyed on expiry, close, or invalidation.
+
+## Rejection and privacy
+
+Public class is a function only of evidence the requester supplied, never of
+private per-principal server state; `authorization_unavailable` is the sole
+exception and reveals only that a required authoritative dependency is
+unreadable, never any per-principal fact. Replay status is a function of
+committed per-principal server state, not of the supplied evidence alone;
+replayed evidence is therefore classed `authorization_denied`, indistinguishable
+from any other private-state denial, so that resubmitting captured evidence
+reveals nothing about whether the original request committed. Under the
+private-posture rule, even `key_mismatch` joins the private-state anonymity set.
+
+| Private condition | Public class | Nostr prefix and exact text | HTTP response |
+|---|---|---|---|
+| assertion/proof absent | `missing_evidence` | `auth-required: authentication required` | `401`; `WWW-Authenticate: Nostr`; `Content-Type: text/plain; charset=utf-8`; `authentication required\n` |
+| malformed, invalid, or expired evidence | `evidence_rejected` | `restricted: evidence rejected` | `403`; `Content-Type: text/plain; charset=utf-8`; `evidence rejected\n` |
+| replayed evidence; key mismatch; attestation required; binding conflict; retired pair; revoked key; lifecycle gate; binding required/expired; local policy denial | `authorization_denied` | `restricted: authorization denied` | `403`; `Content-Type: text/plain; charset=utf-8`; `authorization denied\n` |
+| required current dependency unreadable | `authorization_unavailable` | `restricted: authorization unavailable` | `503`; `Content-Type: text/plain; charset=utf-8`; `authorization unavailable\n` |
+
+Nostr text is the exact UTF-8 text after an applicable NIP-42/NIP-01 prefix.
+A denial decided on a WebSocket upgrade request, before any NIP-42 proof
+exists, is the HTTP response in the table, sent instead of `101`; a denial
+decided after the connection is established is the Nostr text. For HTTP, the
+compared denial contract is closed over the
+status, complete body,
+and exact values of only the header fields named in the table; header order and
+other fields are outside that contract and their values cannot depend on the
+private condition. The body is the shown UTF-8 bytes with one LF and no other
+bytes. The `Nostr` challenge satisfies RFC 9110 Section 15.5.2.
+Responses contain no free text, reason code, request ID, issuer, subject, key,
+claim, binding state, enrollment posture, token material, or timing hint. All
+private conditions in `authorization_denied` produce byte-identical responses.
+[FI-TRACE-DENIAL-ORACLE]
+
+NIP-FI defines no public identity projection. Public events, tags, filters,
+discovery, responses, logs, metrics, and traces contain no raw assertions or
+unredacted `iss`, `sub`, email, display name, or private claim. Access-controlled
+authoritative stores retain only what enforcement and investigation require.
+A separate presentation protocol cannot confer NIP-FI authority.
+[FI-TRACE-PRIVACY-NONPUBLIC]
+
+## Discovery
+
+A relay SHOULD advertise core support in NIP-11 as:
+
+```json
+{
+  "limitation": { "federated_identity": true },
+  "federated_identity": {
+    "core": "client-attached",
+    "assertion_freshness": {
+      "class": "offline-jwt",
+      "maximum_residual_upstream_revocation_seconds": null
+    }
+  }
+}
+```
+
+NIP-FI-EDGE owns the optional `edge_transports` member and its exact type,
+placement, and value semantics. For `current-status`, the final value is a tested
+positive integer. Discovery never states enrollment mode or TOFU posture and
+never exposes issuer URLs, audiences, claim names, tenant IDs, or
+deployment-local identifiers. For a fixed
+set of claimed profiles, the complete public discovery output is byte-identical
+for every enrollment policy, including `attested-key`, private `tofu`, and any
+companion profile mode: no field, flag, value, omission, ordering, or object shape
+may distinguish the configured mode. Profile documents own only non-enrollment
+public claims.
+[FI-TRACE-DISCOVERY-PRIVATE]
+
+## Worked example (non-normative)
+
+A protected HTTP POST under `client-attached` with NIP-98 proof and an
+authorization-relevant body. Credentials are elided; the NIP-FI-CONF exit
+fixture pins the complete request compared objects.
+
+```text
+POST /media HTTP/1.1
+Host: relay.example
+Nostr-Federated-Identity: Bearer eyJhbGciOiJFUzI1NiIsInR5cCI6ImF0K2p3dCIs...
+Authorization: Nostr eyJpZCI6IjE1ZTI3ZDc0Li4uIiwicHVia2V5IjoiOTljNzQ4Li4u...
+Content-Type: application/octet-stream
+Content-Length: 4
+
+abcd
+```
+
+The bearer JWS validates under the configured assertion policy: exact `iss`
+and `aud`, token class `at+jwt`, live time claims, and `nostr_pubkey` equal to
+the NIP-98 event's `pubkey`. The NIP-98 event binds the server-resolved method
+and URL, and its single `payload` tag equals the SHA-256 of the four body
+bytes. Admission then follows Direct preparation and Final admission; success
+returns the application response, and every failure class returns exactly the
+bytes fixed in the Rejection table. On a WebSocket upgrade the same header
+attaches to the upgrade request and NIP-42 supplies the proof after connect.
+
+## Core behavioral oracles
+
+A core claim covers every applicable oracle below at one implementation and
+policy revision. NIP-FI-CONF defines evidence and mutation-adequacy rules.
+
+| ID | Required outcome |
+|---|---|
+| `FI-TRACE-TRANSPORT-CLOSED` | Exact one-header input succeeds; missing, repeated, combined, malformed, mixed, URL, and fallback variants deny. |
+| `FI-TRACE-ASSERTION-VALIDATION` | Valid boundary input passes; each signature, key-selection, issuer, audience, time, size, ambiguity, and missing-configuration negative denies. |
+| `FI-TRACE-TOKEN-CLASS` | An `at+jwt` access token and a dedicated `nip-fi+jwt` assertion pass only their selected class. ID tokens, wrong/generic types outside a named compatibility policy, client-only audiences, absent or ambiguous `client_id`, resource-owner/client-subject ambiguity, and every attempted cross-class fallback deny. |
+| `FI-TRACE-CONTRACT-IDENTITIES` | Mutate each assertion semantic, transport semantic, and mutable dependency independently: semantic mutations change only their owning contract ID; snapshot/binding/lifecycle/policy/resource/status mutations change neither ID but force current revalidation. |
+| `FI-TRACE-VERIFIER-PARITY` | Equal authoritative input and policy produce the same canonical normalized result. |
+| `FI-TRACE-JWKS-ADD` | Retained-key rotation revalidates successfully under the changed snapshot version. |
+| `FI-TRACE-JWKS-REMOVE` | Evidence and leases under a removed key deny after snapshot change. |
+| `FI-TRACE-CURRENT-STATUS-REVOKED` | Revocation, including one racing final admission, closes authority within the advertised tested bound. |
+| `FI-TRACE-CURRENT-STATUS-STALE` | Inactive/ambiguous status denies; an issuer, subject, or session-identifier mismatch denies; expiry equality, outage, delayed events, and changed status versions cannot mint or extend a witness. |
+| `FI-TRACE-CAPABILITY-REVOCATION` | Removal of a revocation-bounded external capability projection from authoritative local policy closes prepared evidence and lease use within the declared bound; assertion-only projection cannot satisfy this oracle. |
+| `FI-TRACE-BODY-BINDING` | Exact complete relevant body passes; absent/duplicate/mutated/partial/substituted payload variants deny without effects; a payload tag on an irrelevant-body operation validates identically and denies on duplication or mismatch. |
+| `FI-TRACE-BODY-BOUNDS` | Oversized, over-quota, and pre-EOF variants deny with bounded work, cleanup, and no effects. |
+| `FI-TRACE-DOMAIN-SPOOF` | Client routing and forwarded authority cannot replace server-owned context. |
+| `FI-TRACE-ASSERTION-KEY-MISMATCH` | Mismatch denies with no mutation and the private-state response. |
+| `FI-TRACE-BINDING-CONFLICT` | A binding conflict denies without replacing either existing binding. |
+| `FI-TRACE-TOMBSTONE-REPLAY` | Fresh eligible evidence for a retired pair or revoked key denies without recreation. |
+| `FI-TRACE-ASSERTION-REFRESH` | Fresh evidence reuses the same eligible durable binding after prior assertion expiry. |
+| `FI-TRACE-PREPARED-STALE` | Changed identity-class witnesses or extended bounds deny; provenance-only rotation revalidates. |
+| `FI-TRACE-CONCURRENT-ENROLLMENT` | Identical first use converges; conflicting first use commits at most one winner. |
+| `FI-TRACE-FINAL-DENIAL-NO-MUTATION` | Every failed phase leaves all authoritative stores and effects unchanged. |
+| `FI-TRACE-LIFECYCLE-AUTHORITY` | Unprivileged/stale transitions deny; authorized retirement/revocation/rotation is atomic. |
+| `FI-TRACE-LEASE-BOUND` | A lease ends at its earliest bound; equality at any bound is expired. |
+| `FI-TRACE-MULTI-KEY-SESSION` | One actor's lease never authorizes another key on the same connection. |
+| `FI-TRACE-DENIAL-ORACLE` | Each private row produces its exact fixed bytes on every surface where its condition can be decided — HTTP, a WebSocket upgrade, or after connect; all private-state rows compare byte-identical. |
+| `FI-TRACE-DEPENDENCY-FAIL-CLOSED` | Each unreadable authoritative dependency denies. |
+| `FI-TRACE-AUTHORITY-UNIFORM` | Every protected ingress reaches one current final-admission authority. |
+| `FI-TRACE-CROSS-DOMAIN-COLLISION` | Equal subjects across issuers and equal pairs across domains remain distinct. |
+| `FI-TRACE-PRIVACY-NONPUBLIC` | Private identity does not enter public surfaces. |
+| `FI-TRACE-DISCOVERY-PRIVATE` | Complete discovery bytes remain identical across attested-key, TOFU, and companion enrollment modes. |
+| `FI-TRACE-TOFU-THEFT` | Stolen-assertion first use denies unless private TOFU is enabled and the attacker also proves its chosen key. |
+
+## Relationship to other work (non-normative)
+
+NIP-FI binds an access token to a key the resource server itself verifies, the
+goal DPoP (RFC 9449) and mTLS-bound tokens (RFC 8705) reach through a `cnf`
+claim. Here the proof is the NIP-42 or NIP-98 event the relay already
+validates, so no second proof is defined and the issuer need not attest the
+key; `nostr_pubkey` is the optional `cnf` analogue. Unlike those profiles the
+binding is durable server state rather than a per-token claim: a stolen
+assertion cannot reach an enrolled identity without its key, and revocation is
+a local fact rather than a token-lifetime race. One identity, one key per
+domain is stricter than WebAuthn's many-credentials-per-account model because
+the Nostr key is itself the public identity; additional devices do not create
+additional active bindings. Two contract identities plus explicit dependency
+versions exist because folding a mutable key snapshot into policy identity would make benign
+rotation change policy lineage, while omitting it would let evidence under a
+removed key survive. Denial responses deliberately collapse the conditions that
+RFC 6750 error codes distinguish. `trusted-proxy-hmac-v2` in NIP-FI-EDGE is a
+fixed-component request MAC in the family of HTTP Message Signatures (RFC 9421)
+and AWS SigV4, without negotiation and with length-prefixed canonicalization.
+
+## Security considerations
+
+Issuer compromise can impersonate a principal but cannot prove an uncompromised
+bound Nostr key. Assertion theft cannot use an existing binding without that
+key; private TOFU intentionally retains first-use theft risk. Snapshot
+revalidation limits removed-key reuse but the base policy accepts authenticated
+key-source rollback as residual issuer risk. Two-phase admission closes the
+binding and policy TOCTOU window only when every authoritative witness is reread
+atomically. Availability failures deny rather than degrade to Nostr-only access.
+
+## Sources
+
+- NIP-42 authentication: <https://github.com/nostr-protocol/nips/blob/6d2979b3f503a8539c983efbcdcf901bbcf9ed23/42.md>
+- NIP-98 HTTP authentication: <https://github.com/nostr-protocol/nips/blob/6d2979b3f503a8539c983efbcdcf901bbcf9ed23/98.md>
+- JWT BCP: <https://www.rfc-editor.org/rfc/rfc8725>
+- JWT access-token profile: <https://www.rfc-editor.org/rfc/rfc9068>
+- DPoP: <https://www.rfc-editor.org/rfc/rfc9449>
+- OAuth 2.0 mTLS client certificate-bound tokens: <https://www.rfc-editor.org/rfc/rfc8705>
+- HTTP Message Signatures: <https://www.rfc-editor.org/rfc/rfc9421>
+- Non-normative composed model: [NIP-FI-MODEL.md](NIP-FI-MODEL.md)
diff --git a/mobile/HUDDLES.md b/mobile/HUDDLES.md
new file mode 100644
index 00000000000..0a49a71148c
--- /dev/null
+++ b/mobile/HUDDLES.md
@@ -0,0 +1,117 @@
+# Mobile Huddles MVP
+
+This foreground-only product slice preserves the existing Desktop/relay
+contract. Android and iOS clients can start a human Huddle, open a recent
+Desktop-started Huddle card, join with the microphone on, hear multiple remote
+participants, send microphone audio, mute, and leave.
+
+The parent channel carries creator-signed kind `48100` start and `48103` end
+events. The private `stream` backing channel uses kind `9007`, `ttl=3600`, and
+is hidden from the ordinary channel list only after a matching start event
+links it from an accessible parent. The top-right hang-up follows Desktop's
+rule: it fetches the current kind `39002` backing-channel snapshot and counts
+non-`bot` members before disconnecting, submits kind `9022` when another human
+remains, and otherwise publishes kind `48103` and archives with kind `9002`.
+A failed count safely assumes another human is present so a transient relay
+error cannot end the Huddle. Creator-only explicit
+end support remains in the controller, but the current mobile UI does not
+foreground a separate “End for everyone” control. On relaunch, parent event
+history reconstructs the visible card without silently reopening a microphone.
+
+## Control plane
+
+1. Connect to `WS /huddle/{ephemeral_channel_id}/audio`.
+2. Receive `{"type":"challenge","challenge":"..."}`.
+3. Sign NIP-42 kind `22242` with `relay=<base relay WebSocket URL>` and the
+   challenge. The `relay` tag is **not** the Huddle endpoint URL.
+4. Send an object envelope containing `type=auth`, the signed event,
+   `parent_channel_id`, and `protocol_version=3`. Protocol v2 remains available
+   for released clients with its one-byte relay peer prefix; v3 adds an
+   occupancy epoch and cannot share a pinned room with v2 clients.
+5. Treat the connection as usable only after a `joined` response. `error`,
+   unexpected close, handshake timeout, and protocol failures are explicit
+   states. An established session retries only its media socket with bounded
+   backoff (`0, 100, 250, 500, 1000, 2000, 2000 ms`) and keeps native media
+   alive while reconnecting.
+
+The main Nostr socket is intentionally not shared: it accepts Nostr JSON arrays
+and drops binary frames, while Huddle control messages are JSON objects.
+
+Emoji reactions remain on the shared Nostr control plane. Mobile publishes the
+same ephemeral kind `24810` event as Desktop, scoped to the backing channel with
+`h`, `reaction`, and `sender_name` tags (plus the optional NIP-30 `emoji` tag for
+custom emoji). While a Huddle session is active, Mobile also subscribes to that
+same backing-channel event stream and bursts reactions from other identities;
+the sender's relay echo is ignored because its burst already plays locally.
+When the sender's full-screen participant avatar is visible, that avatar is the
+burst origin so authorship is spatially clear; minimized calls fall back to the
+available Huddle surface. Reaction events never enter the ordinary channel
+timeline.
+
+## Media plane: protocol v3
+
+Audio is 48 kHz, mono Opus in 20 ms (960-sample) frames.
+
+Client to relay:
+
+```text
+8-byte header | Opus payload
+```
+
+Relay to client:
+
+```text
+peer_index u8 | epoch u8 | 8-byte header | Opus payload
+```
+
+The header is network byte order: sequence `u16`, 48 kHz timestamp `u32`,
+level dBov `i8` in `-127...0`, and flags `u8` where bit 0 marks DTX. The
+occupancy epoch advances whenever a peer index is assigned again, allowing
+clients to fence delayed media from the previous occupant. Unknown flag bits
+are ignored. Frames are capped at 4096 bytes before the relay peer prefix.
+
+The dBov header also drives the participant speaking treatment. Values above
+the existing `-55 dBov` activity threshold are normalized for a 50 ms visual
+update cadence and continuously scale a 7%-opacity primary-color halo from
+just beyond the avatar to 2.55 times its base diameter. Level increases use a
+responsive eased attack while decreases and silence use a softer eased release;
+silence begins that release after the existing 600 ms hold.
+
+## Native boundary
+
+`buzz/huddle_media` owns microphone permission and the foreground voice audio
+session. Each platform probes its native Opus encoder and decoder before
+advertising support. On Android, `AudioRecord` captures 48 kHz mono PCM,
+`MediaCodec` encodes and decodes Opus, and one `AudioTrack` per remote
+participant lets the Android communication mixer combine decoded PCM. On iOS,
+`AVAudioEngine` owns voice-processed capture and per-peer mixed playout while
+`AVAudioConverter` performs native Opus encoding and decoding. Both paths use a
+three-packet startup jitter buffer with a ten-packet per-peer bound.
+
+Acoustic echo cancellation is enabled through Android's voice communication
+effects and iOS Voice Processing I/O. Audio focus/session interruptions surface
+explicitly; media resumes only when the platform permits it. The Flutter
+speaker control directly switches between the built-in speaker and the normal
+communication route. Built-in output starts on the earpiece/receiver, while an
+already-selected external Bluetooth or wired communication route remains under
+the operating system's routing policy until the user explicitly enables the
+built-in speaker.
+
+Only compressed `localOpusFrame` and `playRemoteOpusFrame` messages cross the
+Flutter bridge; PCM remains inside the native realtime path. Capture starts
+unmuted. Debuggable builds also emit aggregate pre-encode RMS/peak dBov
+histograms plus the active recording route and exposed voice-processing state.
+They never retain or persist PCM, Opus packets, or speech content. Native
+capture and compressed ingress queues are bounded so a foreground session
+cannot accumulate unbounded latency.
+
+This is deliberately not Desktop parity. The app must remain in the foreground;
+pausing/detaching leaves the room. Mobile agent controls, mobile-originated
+STT/TTS, recordings, background ringing/calling, and advanced device controls
+remain outside this slice. Agent-authenticated Opus published by a Desktop
+Huddle uses the same remote playback path as any other participant.
+
+Physical iOS acceptance must separately verify permission, receiver/speaker and
+connected-headset routing, interruption recovery, and two-way audio with a
+Desktop participant. Static codec and Flutter tests do not prove those device
+behaviors.
diff --git a/mobile/README.md b/mobile/README.md
index 1849e1b097d..bef08e52098 100644
--- a/mobile/README.md
+++ b/mobile/README.md
@@ -4,11 +4,20 @@ Flutter mobile client for Buzz.
 
 ## Setup
 
+Use the Flutter SDK pinned by the repository. Activate Hermit from the repo
+root before resolving packages or running any Flutter command:
+
 ```bash
-cd mobile
-flutter pub get
+cd /path/to/buzz
+. ./bin/activate-hermit
+./bin/just mobile-install
 ```
 
+`mobile-build-android` intentionally builds with `--no-pub`. If an IDE or an
+external Flutter SDK has touched `mobile/.dart_tool`, rerun `mobile-install`
+with the pinned SDK before building so `flutter_test`, `sky_engine`, and the
+engine all come from the same Flutter version.
+
 ## Run
 
 ```bash
@@ -62,6 +71,22 @@ the persisted files are then picked up by any subsequent build. In the main
 checkout the script is a no-op that removes stale override files, restoring
 the plain `Buzz` identity.
 
+For an Android debug build that must remain installed alongside other Buzz
+worktree builds, set an explicit launcher name and package suffix when invoking
+the generator or a recipe that invokes it:
+
+```bash
+BUZZ_ANDROID_DEBUG_APP_NAME="Buzz Huddles" \
+BUZZ_ANDROID_DEBUG_ID_SUFFIX=".huddles_829c" \
+./bin/just mobile-build-android
+```
+
+This example produces the debug-only package
+`xyz.block.buzz.mobile.huddles_829c` with the launcher label `Buzz Huddles`.
+The suffix must start with a dot followed by a lowercase letter and may contain
+only lowercase letters, digits, and underscores. Release and profile builds
+ignore these overrides and retain the production package and name.
+
 To remove leftover worktree-suffixed installs from booted iOS simulators and
 connected Android emulators, run `just mobile-clean` (add `--dry-run` via
 `./scripts/mobile-worktree-clean.sh --dry-run` to preview). Production
diff --git a/mobile/analysis_options.yaml b/mobile/analysis_options.yaml
index db163d00139..37b3985d799 100644
--- a/mobile/analysis_options.yaml
+++ b/mobile/analysis_options.yaml
@@ -5,6 +5,14 @@ analyzer:
     - custom_lint
   errors:
     invalid_use_of_visible_for_overriding_member: ignore
+  exclude:
+    - build/**
+    - android/**
+    - ios/**
+    - web/**
+    - windows/**
+    - macos/**
+    - linux/**
 
 linter:
   rules:
diff --git a/mobile/android/app/build.gradle.kts b/mobile/android/app/build.gradle.kts
index 091ae65262b..d0ae877e9dd 100644
--- a/mobile/android/app/build.gradle.kts
+++ b/mobile/android/app/build.gradle.kts
@@ -46,6 +46,13 @@ if (worktreeLabel != null && !worktreeLabel.matches(Regex("""[A-Za-z0-9._-]+""")
             "resources), got: " + worktreeLabel,
     )
 }
+val worktreeAppName = worktreeProps.getProperty("appName")?.takeIf { it.isNotBlank() }
+if (worktreeAppName != null && !worktreeAppName.matches(Regex("""[A-Za-z0-9._() \-]+"""))) {
+    throw GradleException(
+        "worktree.properties appName must contain only letters, numbers, spaces, ., _, -, or " +
+            "parentheses, got: " + worktreeAppName,
+    )
+}
 val worktreeIdSuffix =
     worktreeProps.getProperty("applicationIdSuffix")?.takeIf { it.isNotBlank() }
 val debugIdSuffix =
@@ -133,10 +140,12 @@ android {
             if (debugIdSuffix != null) {
                 applicationIdSuffix = debugIdSuffix
             }
-            if (debugAppName != null) {
-                resValue("string", "app_name", debugAppName)
-            } else if (worktreeLabel != null) {
-                resValue("string", "app_name", "Buzz ($worktreeLabel)")
+            val resolvedAppName =
+                debugAppName
+                    ?: worktreeAppName
+                    ?: worktreeLabel?.let { "Buzz ($it)" }
+            if (resolvedAppName != null) {
+                resValue("string", "app_name", resolvedAppName)
             }
         }
         release {
diff --git a/mobile/android/app/src/main/AndroidManifest.xml b/mobile/android/app/src/main/AndroidManifest.xml
index 5e607ad2ea7..9121acbc151 100644
--- a/mobile/android/app/src/main/AndroidManifest.xml
+++ b/mobile/android/app/src/main/AndroidManifest.xml
@@ -2,6 +2,8 @@
     xmlns:android="http://schemas.android.com/apk/res/android"
     xmlns:tools="http://schemas.android.com/tools">
     <uses-permission android:name="android.permission.INTERNET" />
+    <uses-permission android:name="android.permission.RECORD_AUDIO" />
+    <uses-permission android:name="android.permission.MODIFY_AUDIO_SETTINGS" />
     <uses-permission android:name="android.permission.CAMERA" />
     <uses-permission
         android:name="android.permission.READ_EXTERNAL_STORAGE"
diff --git a/mobile/android/app/src/main/kotlin/xyz/block/buzz/mobile/HuddleAudioEngine.kt b/mobile/android/app/src/main/kotlin/xyz/block/buzz/mobile/HuddleAudioEngine.kt
new file mode 100644
index 00000000000..037f964699f
--- /dev/null
+++ b/mobile/android/app/src/main/kotlin/xyz/block/buzz/mobile/HuddleAudioEngine.kt
@@ -0,0 +1,925 @@
+package xyz.block.buzz.mobile
+
+import android.media.AudioAttributes
+import android.media.AudioFormat
+import android.media.AudioRecord
+import android.media.AudioTrack
+import android.media.MediaCodec
+import android.media.MediaCodecList
+import android.media.MediaFormat
+import android.media.MediaRecorder
+import android.media.audiofx.AcousticEchoCanceler
+import android.media.audiofx.AutomaticGainControl
+import android.media.audiofx.NoiseSuppressor
+import android.os.Build
+import android.os.Process
+import java.nio.ByteBuffer
+import java.nio.ByteOrder
+import java.util.ArrayDeque
+import java.util.concurrent.ArrayBlockingQueue
+import java.util.concurrent.TimeUnit
+import java.util.concurrent.atomic.AtomicBoolean
+import java.util.concurrent.atomic.AtomicInteger
+import kotlin.concurrent.thread
+import kotlin.math.log10
+import kotlin.math.max
+import kotlin.math.roundToInt
+
+/** One compressed microphone packet emitted to Flutter's Huddle transport. */
+internal data class HuddleLocalOpusPacket(
+    val sequence: Int,
+    val timestamp48k: Long,
+    val levelDbov: Int,
+    val flags: Int,
+    val opus: ByteArray,
+)
+
+/** One relay-authored packet queued for realtime native playout. */
+internal data class HuddleRemoteOpusPacket(
+    val peerIndex: Int,
+    val sequence: Int,
+    val timestamp48k: Long,
+    val levelDbov: Int,
+    val opus: ByteArray,
+)
+
+internal data class HuddleTalkerSelection(
+    val accepted: Boolean,
+    val evictedPeerIndex: Int?,
+) {
+    inline fun <T> allocateIfAccepted(allocate: () -> T): T? =
+        if (accepted) allocate() else null
+}
+
+/// Fixed-capacity active-talker selector. Roster membership stays in Dart;
+/// native decoder/track resources exist only for peers that actually send.
+internal class HuddleActiveTalkerSelector(
+    private val capacity: Int,
+    private val nowMs: () -> Long = { System.nanoTime() / 1_000_000 },
+    private val inactivityTimeoutMs: Long = 1_000,
+) {
+    internal data class Activity(
+        val peerIndex: Int,
+        val lastPacketOrdinal: Long,
+        val lastPacketAtMs: Long,
+        val levelDbov: Int,
+    )
+
+    private val active = mutableMapOf<Int, Activity>()
+    private var ordinal = 0L
+
+    fun activate(peerIndex: Int, levelDbov: Int): HuddleTalkerSelection {
+        ordinal += 1
+        val now = nowMs()
+        if (active.containsKey(peerIndex)) {
+            active[peerIndex] = Activity(peerIndex, ordinal, now, levelDbov)
+            return HuddleTalkerSelection(accepted = true, evictedPeerIndex = null)
+        }
+        val weakest = if (active.size >= capacity) {
+            active.values.minWithOrNull(
+                compareBy<Activity> { it.levelDbov }
+                    .thenBy { it.lastPacketOrdinal }
+                    .thenBy { it.peerIndex },
+            )
+        } else {
+            null
+        }
+        val expired = active.values
+            .filter { now - it.lastPacketAtMs >= inactivityTimeoutMs }
+            .minWithOrNull(compareBy<Activity> { it.lastPacketAtMs }.thenBy { it.peerIndex })
+        // Equal-level packets (especially continuous -127 dBov silence) must
+        // not churn decoder/jitter state. A new peer earns a slot when any
+        // selected slot is inactive or the new packet is actually louder.
+        if (weakest != null && expired == null && levelDbov <= weakest.levelDbov) {
+            return HuddleTalkerSelection(accepted = false, evictedPeerIndex = null)
+        }
+        val evicted = expired?.peerIndex ?: weakest?.peerIndex
+        evicted?.let(active::remove)
+        active[peerIndex] = Activity(peerIndex, ordinal, now, levelDbov)
+        return HuddleTalkerSelection(accepted = true, evictedPeerIndex = evicted)
+    }
+
+    fun remove(peerIndex: Int) {
+        active.remove(peerIndex)
+    }
+
+    fun indices(): Set<Int> = active.keys.toSet()
+}
+
+internal sealed interface HuddlePlaybackCommand {
+    data class Packet(val packet: HuddleRemoteOpusPacket) : HuddlePlaybackCommand
+    data class RemovePeer(val peerIndex: Int) : HuddlePlaybackCommand
+}
+
+internal class HuddlePacketJitterQueue(
+    private val capacity: Int,
+    private val startPackets: Int,
+) {
+    private val packets = mutableListOf<HuddleRemoteOpusPacket>()
+    private var lastDrainedSequence: Int? = null
+    private var started = false
+
+    fun enqueue(packet: HuddleRemoteOpusPacket) {
+        val lastDrained = lastDrainedSequence
+        if (lastDrained != null && !sequenceAfter(packet.sequence, lastDrained)) return
+        if (packets.any { it.sequence == packet.sequence }) return
+        val insertionIndex = packets.indexOfFirst { sequenceBefore(packet.sequence, it.sequence) }
+        if (insertionIndex < 0) packets.add(packet) else packets.add(insertionIndex, packet)
+        if (packets.size > capacity) packets.removeAt(0)
+        if (packets.size >= startPackets) started = true
+    }
+
+    fun drainOne(): HuddleRemoteOpusPacket? {
+        if (!started || packets.isEmpty()) return null
+        return packets.removeAt(0).also { lastDrainedSequence = it.sequence }
+    }
+
+    fun sequences(): List<Int> = packets.map { it.sequence }
+
+    private fun sequenceAfter(sequence: Int, reference: Int): Boolean {
+        val distance = (sequence - reference) and 0xffff
+        return distance in 1..0x7fff
+    }
+
+    private fun sequenceBefore(left: Int, right: Int): Boolean = sequenceAfter(right, left)
+}
+
+/** Aggregate, debug-only microphone telemetry. No PCM or encoded audio is retained. */
+internal data class HuddleCaptureDiagnostics(
+    val frameCount: Long,
+    val rmsDbovHistogram: Map<String, Long>,
+    val peakDbovHistogram: Map<String, Long>,
+    val maxPeakDbov: Int,
+    val audioSource: Int,
+    val audioSourceLabel: String,
+    val deviceId: Int?,
+    val deviceType: Int?,
+    val deviceLabel: String?,
+    val acousticEchoCancelerAvailable: Boolean,
+    val acousticEchoCancelerEnabled: Boolean?,
+    val noiseSuppressorAvailable: Boolean,
+    val noiseSuppressorEnabled: Boolean?,
+    val automaticGainControlAvailable: Boolean,
+    val automaticGainControlEnabled: Boolean?,
+)
+
+/**
+ * Foreground-only Android Huddle audio engine.
+ *
+ * PCM never crosses Flutter. AudioRecord feeds Android's Opus MediaCodec and
+ * compressed packets are delivered to Flutter; inbound compressed packets are
+ * decoded with MediaCodec and written to per-peer AudioTracks, which Android's
+ * communication mixer combines. Each peer gets a small bounded jitter queue.
+ */
+internal class HuddleAudioEngine(
+    private val onLocalPacket: (HuddleLocalOpusPacket) -> Unit,
+    private val onFailure: (code: String, message: String) -> Unit,
+    private val onDiagnostics: (HuddleCaptureDiagnostics) -> Unit,
+    private val diagnosticsEnabled: Boolean,
+) {
+    private val running = AtomicBoolean(false)
+    private val failureReported = AtomicBoolean(false)
+    private val playbackQueue = ArrayBlockingQueue<HuddlePlaybackCommand>(PLAYBACK_QUEUE_CAPACITY)
+    private val interrupted = AtomicBoolean(false)
+    private val interruptionEpoch = AtomicInteger(0)
+    private val interruptionLock = Object()
+
+    @Volatile
+    private var muted = false
+
+    @Volatile
+    private var audioRecord: AudioRecord? = null
+
+    @Volatile
+    private var captureThread: Thread? = null
+
+    @Volatile
+    private var playbackThread: Thread? = null
+
+    fun start() {
+        check(!running.get()) { "Huddle audio is already running." }
+        check(isSupported()) { "This device does not expose Android Opus encode/decode codecs." }
+
+        val record = createAudioRecord()
+        val encoder = try {
+            createEncoder()
+        } catch (error: Throwable) {
+            runCatching { record.release() }
+            throw error
+        }
+        try {
+            encoder.start()
+            record.startRecording()
+            check(record.recordingState == AudioRecord.RECORDSTATE_RECORDING) {
+                "Microphone recording did not start."
+            }
+        } catch (error: Throwable) {
+            runCatching { encoder.release() }
+            runCatching { record.release() }
+            throw error
+        }
+
+        audioRecord = record
+        muted = false
+        failureReported.set(false)
+        running.set(true)
+        captureThread = thread(name = "buzz-huddle-capture", isDaemon = true) {
+            runCapture(record, encoder)
+        }
+        playbackThread = thread(name = "buzz-huddle-playback", isDaemon = true) {
+            runPlayback()
+        }
+    }
+
+    fun setMuted(value: Boolean) {
+        check(running.get()) { "Huddle audio is not running." }
+        muted = value
+    }
+
+    fun setInterrupted(value: Boolean) {
+        val record = audioRecord
+        if (value) {
+            interrupted.set(true)
+            interruptionEpoch.incrementAndGet()
+            // A focus loss must stop native capture, not merely discard frames
+            // after AudioRecord has already read them from the microphone.
+            if (record != null) runCatching { record.stop() }
+            return
+        }
+        if (!running.get() || record == null) {
+            interrupted.set(false)
+            synchronized(interruptionLock) { interruptionLock.notifyAll() }
+            return
+        }
+        try {
+            record.startRecording()
+            check(record.recordingState == AudioRecord.RECORDSTATE_RECORDING) {
+                "Microphone recording did not resume."
+            }
+            interrupted.set(false)
+            synchronized(interruptionLock) { interruptionLock.notifyAll() }
+        } catch (error: Throwable) {
+            reportFailure("audio_resume_failed", error)
+        }
+    }
+
+    fun enqueueRemote(packet: HuddleRemoteOpusPacket) {
+        check(running.get()) { "Huddle audio is not running." }
+        offerPlayback(HuddlePlaybackCommand.Packet(packet))
+    }
+
+    fun removeRemotePeer(peerIndex: Int) {
+        check(running.get()) { "Huddle audio is not running." }
+        playbackQueue.removeIf { command ->
+            command is HuddlePlaybackCommand.Packet && command.packet.peerIndex == peerIndex
+        }
+        offerPlayback(HuddlePlaybackCommand.RemovePeer(peerIndex))
+    }
+
+    private fun offerPlayback(command: HuddlePlaybackCommand) {
+        if (playbackQueue.offer(command)) return
+
+        // Packets are expendable realtime data; peer-removal commands are not.
+        // Make room by evicting the oldest packet only, so an audio flood can
+        // never resurrect stale decoder/track state after index reuse.
+        val oldestPacket = playbackQueue.firstOrNull {
+            it is HuddlePlaybackCommand.Packet
+        }
+        if (oldestPacket != null) playbackQueue.remove(oldestPacket)
+        playbackQueue.offer(command)
+    }
+
+    fun stop() {
+        running.set(false)
+        synchronized(interruptionLock) { interruptionLock.notifyAll() }
+        runCatching { audioRecord?.stop() }
+        playbackThread?.interrupt()
+        runCatching { captureThread?.join(STOP_JOIN_TIMEOUT_MS) }
+        runCatching { playbackThread?.join(STOP_JOIN_TIMEOUT_MS) }
+        captureThread = null
+        playbackThread = null
+        audioRecord = null
+        playbackQueue.clear()
+    }
+
+    private fun runCapture(record: AudioRecord, encoder: MediaCodec) {
+        Process.setThreadPriority(Process.THREAD_PRIORITY_AUDIO)
+        val echoCanceler = if (AcousticEchoCanceler.isAvailable()) {
+            AcousticEchoCanceler.create(record.audioSessionId)?.apply { enabled = true }
+        } else {
+            null
+        }
+        val noiseSuppressor = if (NoiseSuppressor.isAvailable()) {
+            NoiseSuppressor.create(record.audioSessionId)?.apply { enabled = true }
+        } else {
+            null
+        }
+        // VOICE_COMMUNICATION may install AGC by default. Creating the control
+        // lets debug diagnostics report the platform's actual state without
+        // enabling or otherwise changing it.
+        val automaticGainControl = if (AutomaticGainControl.isAvailable()) {
+            AutomaticGainControl.create(record.audioSessionId)
+        } else {
+            null
+        }
+
+        val readBuffer = ShortArray(FRAME_SAMPLES)
+        val frame = ShortArray(FRAME_SAMPLES)
+        var filled = 0
+        var frameIndex = 0L
+        var sequence = 0
+        val levelsByPresentationTime = ArrayDeque<Pair<Long, Int>>()
+        var diagnosticFrameCount = 0L
+        var diagnosticMaxPeakDbov = SILENT_LEVEL_DBOV
+        val rmsDbovHistogram = mutableMapOf<Int, Long>()
+        val peakDbovHistogram = mutableMapOf<Int, Long>()
+
+        if (diagnosticsEnabled) {
+            onDiagnostics(
+                captureDiagnostics(
+                    record = record,
+                    echoCanceler = echoCanceler,
+                    noiseSuppressor = noiseSuppressor,
+                    automaticGainControl = automaticGainControl,
+                    frameCount = diagnosticFrameCount,
+                    rmsDbovHistogram = rmsDbovHistogram,
+                    peakDbovHistogram = peakDbovHistogram,
+                    maxPeakDbov = diagnosticMaxPeakDbov,
+                ),
+            )
+        }
+
+        try {
+            while (running.get()) {
+                // Snapshot before checking [interrupted]. If focus loss starts
+                // after that check, its epoch still marks the stopped read as
+                // expected; if it starts first, the loop waits below.
+                val readEpoch = interruptionEpoch.get()
+                if (interrupted.get()) {
+                    synchronized(interruptionLock) {
+                        while (running.get() && interrupted.get()) {
+                            interruptionLock.wait(INTERRUPTION_WAIT_MS)
+                        }
+                    }
+                    continue
+                }
+                val read = record.read(
+                    readBuffer,
+                    0,
+                    readBuffer.size,
+                    AudioRecord.READ_BLOCKING,
+                )
+                if (read < 0) {
+                    // AudioRecord.stop() unblocks a pending read with an error.
+                    // A focus interruption that began during this read owns that
+                    // result even if focus was regained before we inspected it.
+                    if (interruptionEpoch.get() != readEpoch) continue
+                    throw IllegalStateException("AudioRecord read failed with code $read.")
+                }
+                var sourceOffset = 0
+                while (sourceOffset < read && running.get()) {
+                    val copied = minOf(FRAME_SAMPLES - filled, read - sourceOffset)
+                    readBuffer.copyInto(
+                        frame,
+                        destinationOffset = filled,
+                        startIndex = sourceOffset,
+                        endIndex = sourceOffset + copied,
+                    )
+                    sourceOffset += copied
+                    filled += copied
+                    if (filled != FRAME_SAMPLES) continue
+
+                    sequence = drainEncoder(
+                        encoder = encoder,
+                        levelsByPresentationTime = levelsByPresentationTime,
+                        nextSequence = sequence,
+                    )
+                    if (!muted && !interrupted.get()) {
+                        val presentationTimeUs = frameIndex * FRAME_DURATION_US
+                        val level = audioLevelDbov(frame)
+                        if (diagnosticsEnabled) {
+                            val peak = audioPeakDbov(frame)
+                            diagnosticFrameCount += 1
+                            diagnosticMaxPeakDbov = max(diagnosticMaxPeakDbov, peak)
+                            rmsDbovHistogram[level] = (rmsDbovHistogram[level] ?: 0L) + 1L
+                            peakDbovHistogram[peak] = (peakDbovHistogram[peak] ?: 0L) + 1L
+                            if (diagnosticFrameCount % DIAGNOSTIC_EMIT_FRAME_INTERVAL == 0L) {
+                                onDiagnostics(
+                                    captureDiagnostics(
+                                        record = record,
+                                        echoCanceler = echoCanceler,
+                                        noiseSuppressor = noiseSuppressor,
+                                        automaticGainControl = automaticGainControl,
+                                        frameCount = diagnosticFrameCount,
+                                        rmsDbovHistogram = rmsDbovHistogram,
+                                        peakDbovHistogram = peakDbovHistogram,
+                                        maxPeakDbov = diagnosticMaxPeakDbov,
+                                    ),
+                                )
+                            }
+                        }
+                        queueEncoderInput(encoder, frame, presentationTimeUs)
+                        levelsByPresentationTime.addLast(presentationTimeUs to level)
+                        frameIndex += 1
+                    }
+                    filled = 0
+                    sequence = drainEncoder(
+                        encoder = encoder,
+                        levelsByPresentationTime = levelsByPresentationTime,
+                        nextSequence = sequence,
+                    )
+                }
+            }
+        } catch (error: Throwable) {
+            if (running.get()) reportFailure("capture_failed", error)
+        } finally {
+            running.set(false)
+            runCatching { record.stop() }
+            runCatching { record.release() }
+            runCatching { encoder.stop() }
+            runCatching { encoder.release() }
+            runCatching { echoCanceler?.release() }
+            runCatching { noiseSuppressor?.release() }
+            runCatching { automaticGainControl?.release() }
+        }
+    }
+
+    private fun queueEncoderInput(
+        encoder: MediaCodec,
+        samples: ShortArray,
+        presentationTimeUs: Long,
+    ) {
+        val inputIndex = encoder.dequeueInputBuffer(CODEC_DEQUEUE_TIMEOUT_US)
+        check(inputIndex >= 0) { "Opus encoder did not provide an input buffer." }
+        val input = checkNotNull(encoder.getInputBuffer(inputIndex)) {
+            "Opus encoder input buffer was unavailable."
+        }
+        input.clear()
+        input.order(ByteOrder.LITTLE_ENDIAN)
+        for (sample in samples) input.putShort(sample)
+        encoder.queueInputBuffer(
+            inputIndex,
+            0,
+            FRAME_BYTES,
+            presentationTimeUs,
+            0,
+        )
+    }
+
+    private fun drainEncoder(
+        encoder: MediaCodec,
+        levelsByPresentationTime: ArrayDeque<Pair<Long, Int>>,
+        nextSequence: Int,
+    ): Int {
+        val info = MediaCodec.BufferInfo()
+        var sequence = nextSequence
+        while (true) {
+            val outputIndex = encoder.dequeueOutputBuffer(info, 0)
+            when {
+                outputIndex == MediaCodec.INFO_TRY_AGAIN_LATER -> return sequence
+                outputIndex == MediaCodec.INFO_OUTPUT_FORMAT_CHANGED -> continue
+                outputIndex >= 0 -> {
+                    try {
+                        if (info.size > 0 && info.flags and MediaCodec.BUFFER_FLAG_CODEC_CONFIG == 0) {
+                            val output = checkNotNull(encoder.getOutputBuffer(outputIndex))
+                            output.position(info.offset)
+                            output.limit(info.offset + info.size)
+                            val opus = ByteArray(info.size)
+                            output.get(opus)
+                            val level = removeLevel(
+                                levelsByPresentationTime,
+                                info.presentationTimeUs,
+                            )
+                            onLocalPacket(
+                                HuddleLocalOpusPacket(
+                                    sequence = sequence,
+                                    timestamp48k = presentationTimeTo48k(info.presentationTimeUs),
+                                    levelDbov = level,
+                                    flags = 0,
+                                    opus = opus,
+                                ),
+                            )
+                            sequence = (sequence + 1) and 0xffff
+                        }
+                    } finally {
+                        encoder.releaseOutputBuffer(outputIndex, false)
+                    }
+                }
+            }
+        }
+    }
+
+    private fun removeLevel(
+        levels: ArrayDeque<Pair<Long, Int>>,
+        presentationTimeUs: Long,
+    ): Int {
+        while (levels.isNotEmpty()) {
+            val entry = levels.removeFirst()
+            if (entry.first == presentationTimeUs) return entry.second
+        }
+        return SILENT_LEVEL_DBOV
+    }
+
+    private fun runPlayback() {
+        Process.setThreadPriority(Process.THREAD_PRIORITY_AUDIO)
+        val playbacks = mutableMapOf<Int, PeerPlayback>()
+        val activeTalkers = HuddleActiveTalkerSelector(MAX_REMOTE_PEERS)
+        try {
+            while (running.get()) {
+                val command = try {
+                    playbackQueue.poll(FRAME_DURATION_US, TimeUnit.MICROSECONDS)
+                } catch (_: InterruptedException) {
+                    break
+                }
+                when (command) {
+                    is HuddlePlaybackCommand.Packet -> {
+                        val packet = command.packet
+                        val selection = activeTalkers.activate(
+                            packet.peerIndex,
+                            packet.levelDbov,
+                        )
+                        selection.evictedPeerIndex?.let {
+                            playbacks.remove(it)?.release()
+                        }
+                        val playback = playbacks[packet.peerIndex]
+                            ?: selection.allocateIfAccepted {
+                                PeerPlayback(packet.peerIndex).also {
+                                    playbacks[packet.peerIndex] = it
+                                }
+                            }
+                        playback?.enqueue(packet)
+                    }
+                    is HuddlePlaybackCommand.RemovePeer -> {
+                        activeTalkers.remove(command.peerIndex)
+                        playbacks.remove(command.peerIndex)?.release()
+                    }
+                    null -> Unit
+                }
+                if (!interrupted.get()) {
+                    for (playback in playbacks.values) playback.drainOne()
+                }
+            }
+        } catch (error: Throwable) {
+            if (running.get()) reportFailure("playback_failed", error)
+        } finally {
+            for (playback in playbacks.values) runCatching { playback.release() }
+        }
+    }
+
+    private fun reportFailure(code: String, error: Throwable) {
+        if (!failureReported.compareAndSet(false, true)) return
+        running.set(false)
+        onFailure(code, error.message ?: "Native Huddle audio failed.")
+    }
+
+    private class PeerPlayback private constructor(
+        val peerIndex: Int,
+        private val decoder: MediaCodec,
+        private val track: AudioTrack,
+    ) {
+        private val jitterQueue = HuddlePacketJitterQueue(
+            capacity = PER_PEER_JITTER_CAPACITY,
+            startPackets = JITTER_START_PACKETS,
+        )
+
+        companion object {
+            operator fun invoke(peerIndex: Int): PeerPlayback {
+                val decoder = createDecoder()
+                val track = try {
+                    createAudioTrack()
+                } catch (error: Throwable) {
+                    runCatching { decoder.release() }
+                    throw error
+                }
+                return PeerPlayback(peerIndex, decoder, track)
+            }
+        }
+
+        init {
+            try {
+                decoder.start()
+                track.play()
+            } catch (error: Throwable) {
+                runCatching { track.release() }
+                runCatching { decoder.stop() }
+                runCatching { decoder.release() }
+                throw error
+            }
+        }
+
+        fun enqueue(packet: HuddleRemoteOpusPacket) {
+            jitterQueue.enqueue(packet)
+        }
+
+        fun drainOne() {
+            jitterQueue.drainOne()?.let(::decode)
+        }
+
+        private fun decode(packet: HuddleRemoteOpusPacket) {
+            val inputIndex = decoder.dequeueInputBuffer(CODEC_DEQUEUE_TIMEOUT_US)
+            check(inputIndex >= 0) { "Opus decoder did not provide an input buffer." }
+            val input = checkNotNull(decoder.getInputBuffer(inputIndex)) {
+                "Opus decoder input buffer was unavailable."
+            }
+            input.clear()
+            input.put(packet.opus)
+            decoder.queueInputBuffer(
+                inputIndex,
+                0,
+                packet.opus.size,
+                timestamp48kToPresentationTime(packet.timestamp48k),
+                0,
+            )
+            drainOutput()
+        }
+
+        private fun drainOutput() {
+            val info = MediaCodec.BufferInfo()
+            while (true) {
+                val outputIndex = decoder.dequeueOutputBuffer(info, CODEC_DEQUEUE_TIMEOUT_US)
+                when {
+                    outputIndex == MediaCodec.INFO_TRY_AGAIN_LATER -> return
+                    outputIndex == MediaCodec.INFO_OUTPUT_FORMAT_CHANGED -> continue
+                    outputIndex >= 0 -> {
+                        try {
+                            if (info.size <= 0) continue
+                            val output = checkNotNull(decoder.getOutputBuffer(outputIndex))
+                            output.position(info.offset)
+                            output.limit(info.offset + info.size)
+                            val pcm = ByteArray(info.size)
+                            output.get(pcm)
+                            var offset = 0
+                            while (offset < pcm.size) {
+                                val written = track.write(
+                                    pcm,
+                                    offset,
+                                    pcm.size - offset,
+                                    AudioTrack.WRITE_BLOCKING,
+                                )
+                                check(written > 0) { "AudioTrack write failed with code $written." }
+                                offset += written
+                            }
+                        } finally {
+                            decoder.releaseOutputBuffer(outputIndex, false)
+                        }
+                    }
+                }
+            }
+        }
+
+        fun release() {
+            runCatching { track.pause() }
+            runCatching { track.flush() }
+            runCatching { track.release() }
+            runCatching { decoder.stop() }
+            runCatching { decoder.release() }
+        }
+    }
+
+    internal companion object {
+        private const val SAMPLE_RATE_HZ = 48_000
+        private const val CHANNELS = 1
+        private const val FRAME_SAMPLES = 960
+        private const val BYTES_PER_SAMPLE = 2
+        private const val FRAME_BYTES = FRAME_SAMPLES * BYTES_PER_SAMPLE
+        private const val FRAME_DURATION_US = 20_000L
+        private const val BIT_RATE = 32_000
+        private const val CODEC_DEQUEUE_TIMEOUT_US = 10_000L
+        private const val PLAYBACK_QUEUE_CAPACITY = 50
+        private const val PER_PEER_JITTER_CAPACITY = 10
+        private const val JITTER_START_PACKETS = 3
+        private const val MAX_REMOTE_PEERS = 15
+        private const val STOP_JOIN_TIMEOUT_MS = 750L
+        private const val INTERRUPTION_WAIT_MS = 250L
+        private const val SILENT_LEVEL_DBOV = -127
+        private const val OPUS_SEEK_PREROLL_NS = 80_000_000L
+        private const val DIAGNOSTIC_EMIT_FRAME_INTERVAL = 50L
+
+        fun isSupported(): Boolean {
+            val codecs = runCatching {
+                MediaCodecList(MediaCodecList.REGULAR_CODECS).codecInfos.toList()
+            }.getOrElse { return false }
+            val hasEncoder = codecs.any { codec ->
+                codec.isEncoder && codec.supportedTypes.any(MediaFormat.MIMETYPE_AUDIO_OPUS::equals)
+            }
+            val hasDecoder = codecs.any { codec ->
+                !codec.isEncoder && codec.supportedTypes.any(MediaFormat.MIMETYPE_AUDIO_OPUS::equals)
+            }
+            return hasEncoder && hasDecoder
+        }
+
+        private fun createAudioRecord(): AudioRecord {
+            val minimum = AudioRecord.getMinBufferSize(
+                SAMPLE_RATE_HZ,
+                AudioFormat.CHANNEL_IN_MONO,
+                AudioFormat.ENCODING_PCM_16BIT,
+            )
+            check(minimum > 0) { "Android does not support 48 kHz mono microphone capture." }
+            val record = AudioRecord.Builder()
+                .setAudioSource(MediaRecorder.AudioSource.VOICE_COMMUNICATION)
+                .setAudioFormat(
+                    AudioFormat.Builder()
+                        .setSampleRate(SAMPLE_RATE_HZ)
+                        .setChannelMask(AudioFormat.CHANNEL_IN_MONO)
+                        .setEncoding(AudioFormat.ENCODING_PCM_16BIT)
+                        .build(),
+                )
+                .setBufferSizeInBytes(max(minimum, FRAME_BYTES * 8))
+                .build()
+            if (record.state != AudioRecord.STATE_INITIALIZED) {
+                record.release()
+                error("Android microphone capture could not be initialized.")
+            }
+            return record
+        }
+
+        private fun createEncoder(): MediaCodec {
+            val format = MediaFormat.createAudioFormat(
+                MediaFormat.MIMETYPE_AUDIO_OPUS,
+                SAMPLE_RATE_HZ,
+                CHANNELS,
+            ).apply {
+                setInteger(MediaFormat.KEY_BIT_RATE, BIT_RATE)
+                setInteger(MediaFormat.KEY_MAX_INPUT_SIZE, FRAME_BYTES)
+                setInteger(MediaFormat.KEY_PCM_ENCODING, AudioFormat.ENCODING_PCM_16BIT)
+            }
+            val encoder = MediaCodec.createEncoderByType(MediaFormat.MIMETYPE_AUDIO_OPUS)
+            try {
+                encoder.configure(format, null, null, MediaCodec.CONFIGURE_FLAG_ENCODE)
+                return encoder
+            } catch (error: Throwable) {
+                runCatching { encoder.release() }
+                throw error
+            }
+        }
+
+        private fun createDecoder(): MediaCodec {
+            val format = MediaFormat.createAudioFormat(
+                MediaFormat.MIMETYPE_AUDIO_OPUS,
+                SAMPLE_RATE_HZ,
+                CHANNELS,
+            ).apply {
+                setInteger(MediaFormat.KEY_MAX_INPUT_SIZE, 4096)
+                setInteger(MediaFormat.KEY_PCM_ENCODING, AudioFormat.ENCODING_PCM_16BIT)
+                setByteBuffer("csd-0", ByteBuffer.wrap(opusIdentificationHeader()))
+                setByteBuffer("csd-1", nativeLongBuffer(0))
+                setByteBuffer("csd-2", nativeLongBuffer(OPUS_SEEK_PREROLL_NS))
+            }
+            val decoder = MediaCodec.createDecoderByType(MediaFormat.MIMETYPE_AUDIO_OPUS)
+            try {
+                decoder.configure(format, null, null, 0)
+                return decoder
+            } catch (error: Throwable) {
+                runCatching { decoder.release() }
+                throw error
+            }
+        }
+
+        private fun createAudioTrack(): AudioTrack {
+            val minimum = AudioTrack.getMinBufferSize(
+                SAMPLE_RATE_HZ,
+                AudioFormat.CHANNEL_OUT_MONO,
+                AudioFormat.ENCODING_PCM_16BIT,
+            )
+            check(minimum > 0) { "Android does not support 48 kHz mono audio output." }
+            val track = AudioTrack.Builder()
+                .setAudioAttributes(
+                    AudioAttributes.Builder()
+                        .setUsage(AudioAttributes.USAGE_VOICE_COMMUNICATION)
+                        .setContentType(AudioAttributes.CONTENT_TYPE_SPEECH)
+                        .build(),
+                )
+                .setAudioFormat(
+                    AudioFormat.Builder()
+                        .setSampleRate(SAMPLE_RATE_HZ)
+                        .setChannelMask(AudioFormat.CHANNEL_OUT_MONO)
+                        .setEncoding(AudioFormat.ENCODING_PCM_16BIT)
+                        .build(),
+                )
+                .setTransferMode(AudioTrack.MODE_STREAM)
+                .setBufferSizeInBytes(max(minimum, FRAME_BYTES * 8))
+                .build()
+            if (track.state != AudioTrack.STATE_INITIALIZED) {
+                track.release()
+                error("Android Huddle audio output could not be initialized.")
+            }
+            return track
+        }
+
+        private fun opusIdentificationHeader(): ByteArray = byteArrayOf(
+            'O'.code.toByte(),
+            'p'.code.toByte(),
+            'u'.code.toByte(),
+            's'.code.toByte(),
+            'H'.code.toByte(),
+            'e'.code.toByte(),
+            'a'.code.toByte(),
+            'd'.code.toByte(),
+            1,
+            CHANNELS.toByte(),
+            0,
+            0,
+            0x80.toByte(),
+            0xbb.toByte(),
+            0,
+            0,
+            0,
+            0,
+            0,
+        )
+
+        private fun nativeLongBuffer(value: Long): ByteBuffer =
+            ByteBuffer.allocate(java.lang.Long.BYTES)
+                .order(ByteOrder.nativeOrder())
+                .putLong(value)
+                .apply { flip() }
+
+        private fun audioLevelDbov(samples: ShortArray): Int {
+            var squareSum = 0.0
+            for (sample in samples) {
+                val normalized = sample.toDouble() / Short.MAX_VALUE.toDouble()
+                squareSum += normalized * normalized
+            }
+            val meanSquare = squareSum / samples.size
+            if (meanSquare <= 0.0) return SILENT_LEVEL_DBOV
+            val dbov = 10.0 * log10(meanSquare)
+            return dbov.roundToInt().coerceIn(SILENT_LEVEL_DBOV, 0)
+        }
+
+        private fun audioPeakDbov(samples: ShortArray): Int {
+            var peak = 0
+            for (sample in samples) {
+                peak = max(peak, kotlin.math.abs(sample.toInt()))
+            }
+            if (peak == 0) return SILENT_LEVEL_DBOV
+            val normalized = peak.toDouble() / Short.MAX_VALUE.toDouble()
+            return (20.0 * log10(normalized))
+                .roundToInt()
+                .coerceIn(SILENT_LEVEL_DBOV, 0)
+        }
+
+        private fun captureDiagnostics(
+            record: AudioRecord,
+            echoCanceler: AcousticEchoCanceler?,
+            noiseSuppressor: NoiseSuppressor?,
+            automaticGainControl: AutomaticGainControl?,
+            frameCount: Long,
+            rmsDbovHistogram: Map<Int, Long>,
+            peakDbovHistogram: Map<Int, Long>,
+            maxPeakDbov: Int,
+        ): HuddleCaptureDiagnostics {
+            val activeConfiguration = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) {
+                runCatching { record.activeRecordingConfiguration }.getOrNull()
+            } else {
+                null
+            }
+            val device = activeConfiguration?.audioDevice
+                ?: runCatching { record.routedDevice }.getOrNull()
+            val source = activeConfiguration?.audioSource
+                ?: MediaRecorder.AudioSource.VOICE_COMMUNICATION
+            return HuddleCaptureDiagnostics(
+                frameCount = frameCount,
+                rmsDbovHistogram = numericHistogram(rmsDbovHistogram),
+                peakDbovHistogram = numericHistogram(peakDbovHistogram),
+                maxPeakDbov = maxPeakDbov,
+                audioSource = source,
+                audioSourceLabel = audioSourceLabel(source),
+                deviceId = device?.id,
+                deviceType = device?.type,
+                deviceLabel = device?.productName?.toString()?.trim()?.takeIf { it.isNotEmpty() },
+                acousticEchoCancelerAvailable = AcousticEchoCanceler.isAvailable(),
+                acousticEchoCancelerEnabled = echoCanceler?.let {
+                    runCatching { it.enabled }.getOrNull()
+                },
+                noiseSuppressorAvailable = NoiseSuppressor.isAvailable(),
+                noiseSuppressorEnabled = noiseSuppressor?.let {
+                    runCatching { it.enabled }.getOrNull()
+                },
+                automaticGainControlAvailable = AutomaticGainControl.isAvailable(),
+                automaticGainControlEnabled = automaticGainControl?.let {
+                    runCatching { it.enabled }.getOrNull()
+                },
+            )
+        }
+
+        private fun numericHistogram(values: Map<Int, Long>): Map<String, Long> =
+            values.entries
+                .sortedBy { it.key }
+                .associate { (level, count) -> level.toString() to count }
+
+        private fun audioSourceLabel(source: Int): String = when (source) {
+            MediaRecorder.AudioSource.VOICE_COMMUNICATION -> "voice_communication"
+            MediaRecorder.AudioSource.MIC -> "microphone"
+            MediaRecorder.AudioSource.VOICE_RECOGNITION -> "voice_recognition"
+            MediaRecorder.AudioSource.UNPROCESSED -> "unprocessed"
+            MediaRecorder.AudioSource.VOICE_PERFORMANCE -> "voice_performance"
+            else -> "source_$source"
+        }
+
+        private fun presentationTimeTo48k(presentationTimeUs: Long): Long =
+            ((presentationTimeUs * SAMPLE_RATE_HZ) / 1_000_000L) and 0xffff_ffffL
+
+        private fun timestamp48kToPresentationTime(timestamp48k: Long): Long =
+            (timestamp48k * 1_000_000L) / SAMPLE_RATE_HZ
+    }
+}
diff --git a/mobile/android/app/src/main/kotlin/xyz/block/buzz/mobile/HuddleMediaPlugin.kt b/mobile/android/app/src/main/kotlin/xyz/block/buzz/mobile/HuddleMediaPlugin.kt
new file mode 100644
index 00000000000..76dfa18290a
--- /dev/null
+++ b/mobile/android/app/src/main/kotlin/xyz/block/buzz/mobile/HuddleMediaPlugin.kt
@@ -0,0 +1,507 @@
+package xyz.block.buzz.mobile
+
+import android.Manifest
+import android.app.Activity
+import android.content.ActivityNotFoundException
+import android.content.Context
+import android.content.Intent
+import android.content.pm.ApplicationInfo
+import android.content.pm.PackageManager
+import android.media.AudioDeviceInfo
+import android.media.AudioManager
+import android.net.Uri
+import android.os.Build
+import android.os.Handler
+import android.os.Looper
+import android.provider.Settings
+import io.flutter.plugin.common.BinaryMessenger
+import io.flutter.plugin.common.MethodCall
+import io.flutter.plugin.common.MethodChannel
+
+/**
+ * Foreground-only native seam for mobile Huddle media.
+ *
+ * Owns microphone permission, foreground communication routing, and the native
+ * realtime Opus engine. PCM remains native; Flutter only handles compressed
+ * Huddle v3 packets.
+ */
+internal class HuddleMediaPlugin(
+    private val activity: Activity,
+    messenger: BinaryMessenger,
+) {
+    private val channel = MethodChannel(messenger, CHANNEL_NAME)
+    private val audioManager = activity.getSystemService(Context.AUDIO_SERVICE) as AudioManager
+    private val mainHandler = Handler(Looper.getMainLooper())
+    private var previousAudioMode: Int? = null
+    private var previousCommunicationDevice: AudioDeviceInfo? = null
+    private var selectedCommunicationDevice = false
+    private var previousSpeakerphoneOn: Boolean? = null
+    private var pendingPermissionResult: MethodChannel.Result? = null
+    private var audioEngine: HuddleAudioEngine? = null
+    private var hasAudioFocus = false
+    private val audioFocusListener = AudioManager.OnAudioFocusChangeListener { change ->
+        val isInterrupted = change != AudioManager.AUDIOFOCUS_GAIN
+        audioEngine?.setInterrupted(isInterrupted)
+        mainHandler.post {
+            if (audioEngine != null) {
+                channel.invokeMethod(
+                    "interruptionChanged",
+                    mapOf("interrupted" to isInterrupted),
+                )
+            }
+        }
+    }
+
+    init {
+        channel.setMethodCallHandler(::handleMethodCall)
+    }
+
+    private fun handleMethodCall(
+        call: MethodCall,
+        result: MethodChannel.Result,
+    ) {
+        when (call.method) {
+            "getCapabilities" -> result.success(capabilities())
+            "requestMicrophonePermission" -> requestMicrophonePermission(result)
+            "openSystemSettings" -> openSystemSettings(result)
+            "prepare" -> prepare(call.arguments, result)
+            "start" -> start(result)
+            "setMuted" -> setMuted(call.arguments, result)
+            "setSpeakerEnabled" -> setSpeakerEnabled(call.arguments, result)
+            "playRemoteOpusFrame" -> playRemoteOpusFrame(call.arguments, result)
+            "removeRemotePeer" -> removeRemotePeer(call.arguments, result)
+            "stop" -> stop(result)
+            else -> result.notImplemented()
+        }
+    }
+
+    private fun capabilities(): Map<String, Any> {
+        val supportsOpus = HuddleAudioEngine.isSupported()
+        return mapOf(
+            "platform" to "android",
+            "audioSession" to true,
+            "microphonePermission" to true,
+            "capture" to supportsOpus,
+            "playback" to supportsOpus,
+            "opusEncoding" to supportsOpus,
+            "opusDecoding" to supportsOpus,
+        )
+    }
+
+    private fun requestMicrophonePermission(result: MethodChannel.Result) {
+        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.M || hasMicrophonePermission()) {
+            result.success("granted")
+            return
+        }
+        if (pendingPermissionResult != null) {
+            result.error(
+                "permission_request_in_progress",
+                "A microphone permission request is already active.",
+                null,
+            )
+            return
+        }
+        pendingPermissionResult = result
+        activity.requestPermissions(
+            arrayOf(Manifest.permission.RECORD_AUDIO),
+            MICROPHONE_PERMISSION_REQUEST,
+        )
+    }
+
+    fun onRequestPermissionsResult(
+        requestCode: Int,
+        permissions: Array<out String>,
+        grantResults: IntArray,
+    ): Boolean {
+        if (requestCode != MICROPHONE_PERMISSION_REQUEST) return false
+        val result = pendingPermissionResult ?: return true
+        pendingPermissionResult = null
+        val microphoneIndex = permissions.indexOf(Manifest.permission.RECORD_AUDIO)
+        val granted = microphoneIndex >= 0 &&
+            grantResults.getOrNull(microphoneIndex) == PackageManager.PERMISSION_GRANTED
+        result.success(if (granted) "granted" else "denied")
+        return true
+    }
+
+    /**
+     * Open this app's Android settings screen so the user can grant a
+     * previously denied microphone permission. Mirrors the iOS recovery path.
+     */
+    private fun openSystemSettings(result: MethodChannel.Result) {
+        val intent = Intent(
+            Settings.ACTION_APPLICATION_DETAILS_SETTINGS,
+            Uri.fromParts("package", activity.packageName, null),
+        ).apply { addFlags(Intent.FLAG_ACTIVITY_NEW_TASK) }
+        try {
+            activity.startActivity(intent)
+            result.success(true)
+        } catch (error: ActivityNotFoundException) {
+            result.success(false)
+        }
+    }
+
+    private fun prepare(arguments: Any?, result: MethodChannel.Result) {
+        val values = arguments as? Map<*, *>
+        if (values?.get("protocolVersion") != 3 ||
+            values["sampleRateHz"] != 48_000 ||
+            values["channels"] != 1 ||
+            values["frameSamples"] != 960
+        ) {
+            result.error(
+                "invalid_configuration",
+                "Expected the fixed Huddle Opus v3 media configuration.",
+                null,
+            )
+            return
+        }
+        if (!hasMicrophonePermission()) {
+            result.error(
+                "microphone_permission_denied",
+                "Microphone permission is required for a Huddle.",
+                null,
+            )
+            return
+        }
+        if (!HuddleAudioEngine.isSupported()) {
+            result.error(
+                "unsupported",
+                "This Android device does not expose Opus encode/decode codecs.",
+                null,
+            )
+            return
+        }
+
+        try {
+            if (previousAudioMode == null) previousAudioMode = audioManager.mode
+            audioManager.mode = AudioManager.MODE_IN_COMMUNICATION
+            @Suppress("DEPRECATION")
+            val focusResult = audioManager.requestAudioFocus(
+                audioFocusListener,
+                AudioManager.STREAM_VOICE_CALL,
+                AudioManager.AUDIOFOCUS_GAIN_TRANSIENT,
+            )
+            check(focusResult == AudioManager.AUDIOFOCUS_REQUEST_GRANTED) {
+                "Android did not grant communication audio focus."
+            }
+            hasAudioFocus = true
+            selectForegroundOutput()
+            result.success(
+                mapOf(
+                    "audioSessionPrepared" to true,
+                    "sampleRateHz" to 48_000,
+                    "channels" to 1,
+                    "frameSamples" to 960,
+                ),
+            )
+        } catch (error: RuntimeException) {
+            restoreAudioSession()
+            result.error(
+                "audio_session_failed",
+                "Unable to prepare the Android Huddle audio session.",
+                error.message,
+            )
+        }
+    }
+
+    private fun start(result: MethodChannel.Result) {
+        if (previousAudioMode == null) {
+            result.error(
+                "invalid_state",
+                "Prepare Huddle audio before starting it.",
+                null,
+            )
+            return
+        }
+        if (audioEngine != null) {
+            result.error("invalid_state", "Huddle audio is already running.", null)
+            return
+        }
+
+        try {
+            val engine = HuddleAudioEngine(
+                onLocalPacket = ::emitLocalPacket,
+                onFailure = ::emitNativeFailure,
+                onDiagnostics = ::emitCaptureDiagnostics,
+                diagnosticsEnabled =
+                    (activity.applicationInfo.flags and ApplicationInfo.FLAG_DEBUGGABLE) != 0,
+            )
+            engine.start()
+            audioEngine = engine
+            result.success(null)
+        } catch (error: Throwable) {
+            result.error(
+                "media_start_failed",
+                "Unable to start Android Huddle audio.",
+                error.message,
+            )
+        }
+    }
+
+    private fun setMuted(arguments: Any?, result: MethodChannel.Result) {
+        val muted = (arguments as? Map<*, *>)?.get("muted") as? Boolean
+        if (muted == null) {
+            result.error("invalid_arguments", "Missing Huddle mute state.", null)
+            return
+        }
+        try {
+            val engine = audioEngine ?: error("Huddle audio is not running.")
+            engine.setMuted(muted)
+            result.success(null)
+        } catch (error: Throwable) {
+            result.error("invalid_state", error.message, null)
+        }
+    }
+
+    private fun setSpeakerEnabled(arguments: Any?, result: MethodChannel.Result) {
+        val enabled = (arguments as? Map<*, *>)?.get("enabled") as? Boolean
+        if (enabled == null) {
+            result.error("invalid_arguments", "Missing Huddle speaker state.", null)
+            return
+        }
+        if (previousAudioMode == null || audioEngine == null) {
+            result.error("invalid_state", "Huddle audio is not running.", null)
+            return
+        }
+
+        try {
+            routeToBuiltInOutput(enabled)
+            result.success(null)
+        } catch (error: RuntimeException) {
+            result.error("audio_route_failed", "Unable to change Huddle audio output.", error.message)
+        }
+    }
+
+    private fun playRemoteOpusFrame(arguments: Any?, result: MethodChannel.Result) {
+        val values = arguments as? Map<*, *>
+        val peerIndex = (values?.get("peerIndex") as? Number)?.toInt()
+        val sequence = (values?.get("sequence") as? Number)?.toInt()
+        val timestamp48k = (values?.get("timestamp48k") as? Number)?.toLong()
+        val levelDbov = (values?.get("levelDbov") as? Number)?.toInt()
+        val opus = values?.get("opus") as? ByteArray
+        if (peerIndex == null || peerIndex !in 0..255 ||
+            sequence == null || sequence !in 0..0xffff ||
+            timestamp48k == null || timestamp48k !in 0..0xffff_ffffL ||
+            levelDbov == null || levelDbov !in -127..0 ||
+            opus == null || opus.isEmpty() || opus.size > MAX_OPUS_PACKET_BYTES
+        ) {
+            result.error("invalid_arguments", "Malformed remote Huddle Opus packet.", null)
+            return
+        }
+
+        try {
+            val engine = audioEngine ?: error("Huddle audio is not running.")
+            engine.enqueueRemote(
+                HuddleRemoteOpusPacket(
+                    peerIndex = peerIndex,
+                    sequence = sequence,
+                    timestamp48k = timestamp48k,
+                    levelDbov = levelDbov,
+                    opus = opus.copyOf(),
+                ),
+            )
+            result.success(null)
+        } catch (error: Throwable) {
+            result.error("playback_failed", error.message, null)
+        }
+    }
+
+    private fun removeRemotePeer(arguments: Any?, result: MethodChannel.Result) {
+        val peerIndex = ((arguments as? Map<*, *>)?.get("peerIndex") as? Number)?.toInt()
+        if (peerIndex == null || peerIndex !in 0..255) {
+            result.error("invalid_arguments", "Missing Huddle peer index.", null)
+            return
+        }
+        try {
+            val engine = audioEngine ?: error("Huddle audio is not running.")
+            engine.removeRemotePeer(peerIndex)
+            result.success(null)
+        } catch (error: Throwable) {
+            result.error("playback_failed", error.message, null)
+        }
+    }
+
+    private fun stop(result: MethodChannel.Result) {
+        try {
+            audioEngine?.stop()
+            audioEngine = null
+            restoreAudioSession()
+            result.success(null)
+        } catch (error: RuntimeException) {
+            result.error(
+                "audio_session_stop_failed",
+                "Unable to stop the Android Huddle audio session.",
+                error.message,
+            )
+        }
+    }
+
+    fun dispose() {
+        runCatching { audioEngine?.stop() }
+        audioEngine = null
+        restoreAudioSession()
+        pendingPermissionResult?.error(
+            "disposed",
+            "Huddle media was disposed during microphone permission.",
+            null,
+        )
+        pendingPermissionResult = null
+        channel.setMethodCallHandler(null)
+    }
+
+    private fun emitLocalPacket(packet: HuddleLocalOpusPacket) {
+        mainHandler.post {
+            if (audioEngine == null) return@post
+            channel.invokeMethod(
+                "localOpusFrame",
+                mapOf(
+                    "sequence" to packet.sequence,
+                    "timestamp48k" to packet.timestamp48k,
+                    "levelDbov" to packet.levelDbov,
+                    "flags" to packet.flags,
+                    "opus" to packet.opus,
+                ),
+            )
+        }
+    }
+
+    private fun emitNativeFailure(code: String, message: String) {
+        mainHandler.post {
+            if (audioEngine == null) return@post
+            channel.invokeMethod(
+                "nativeError",
+                mapOf("code" to code, "message" to message),
+            )
+        }
+    }
+
+    private fun emitCaptureDiagnostics(diagnostics: HuddleCaptureDiagnostics) {
+        mainHandler.post {
+            if (audioEngine == null) return@post
+            channel.invokeMethod(
+                "captureDiagnostics",
+                mapOf(
+                    "frameCount" to diagnostics.frameCount,
+                    "rmsDbovHistogram" to diagnostics.rmsDbovHistogram,
+                    "peakDbovHistogram" to diagnostics.peakDbovHistogram,
+                    "maxPeakDbov" to diagnostics.maxPeakDbov,
+                    "audioSource" to diagnostics.audioSource,
+                    "audioSourceLabel" to diagnostics.audioSourceLabel,
+                    "deviceId" to diagnostics.deviceId,
+                    "deviceType" to diagnostics.deviceType,
+                    "deviceLabel" to diagnostics.deviceLabel,
+                    "acousticEchoCancelerAvailable" to
+                        diagnostics.acousticEchoCancelerAvailable,
+                    "acousticEchoCancelerEnabled" to
+                        diagnostics.acousticEchoCancelerEnabled,
+                    "noiseSuppressorAvailable" to diagnostics.noiseSuppressorAvailable,
+                    "noiseSuppressorEnabled" to diagnostics.noiseSuppressorEnabled,
+                    "automaticGainControlAvailable" to
+                        diagnostics.automaticGainControlAvailable,
+                    "automaticGainControlEnabled" to
+                        diagnostics.automaticGainControlEnabled,
+                ),
+            )
+        }
+    }
+
+    @Suppress("DEPRECATION")
+    private fun selectForegroundOutput() {
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.S) {
+            if (selectedCommunicationDevice) return
+            previousCommunicationDevice = audioManager.communicationDevice
+            val currentType = previousCommunicationDevice?.type
+            if (currentType in externalCommunicationDeviceTypes) return
+            val earpiece = audioManager.availableCommunicationDevices.firstOrNull {
+                it.type == AudioDeviceInfo.TYPE_BUILTIN_EARPIECE
+            } ?: return
+            selectedCommunicationDevice = audioManager.setCommunicationDevice(earpiece)
+            return
+        }
+        if (previousSpeakerphoneOn == null) {
+            previousSpeakerphoneOn = audioManager.isSpeakerphoneOn
+            audioManager.isSpeakerphoneOn = false
+        }
+    }
+
+    @Suppress("DEPRECATION")
+    private fun routeToBuiltInOutput(useSpeaker: Boolean) {
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.S) {
+            if (previousCommunicationDevice == null) {
+                previousCommunicationDevice = audioManager.communicationDevice
+            }
+            val targetType = if (useSpeaker) {
+                AudioDeviceInfo.TYPE_BUILTIN_SPEAKER
+            } else {
+                AudioDeviceInfo.TYPE_BUILTIN_EARPIECE
+            }
+            val target = audioManager.availableCommunicationDevices.firstOrNull {
+                it.type == targetType
+            } ?: error("The requested built-in Huddle output is unavailable.")
+            check(audioManager.setCommunicationDevice(target)) {
+                "Android rejected the requested Huddle output."
+            }
+            selectedCommunicationDevice = true
+            return
+        }
+
+        if (previousSpeakerphoneOn == null) {
+            previousSpeakerphoneOn = audioManager.isSpeakerphoneOn
+        }
+        audioManager.isSpeakerphoneOn = useSpeaker
+    }
+
+    @Suppress("DEPRECATION")
+    private fun restoreForegroundOutput() {
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.S) {
+            if (selectedCommunicationDevice) {
+                val previous = previousCommunicationDevice
+                if (previous != null &&
+                    audioManager.availableCommunicationDevices.any { it.id == previous.id }
+                ) {
+                    audioManager.setCommunicationDevice(previous)
+                } else {
+                    audioManager.clearCommunicationDevice()
+                }
+            }
+            previousCommunicationDevice = null
+            selectedCommunicationDevice = false
+            return
+        }
+        previousSpeakerphoneOn?.let { audioManager.isSpeakerphoneOn = it }
+        previousSpeakerphoneOn = null
+    }
+
+    private fun restoreAudioSession() {
+        if (hasAudioFocus) {
+            @Suppress("DEPRECATION")
+            audioManager.abandonAudioFocus(audioFocusListener)
+            hasAudioFocus = false
+        }
+        runCatching { restoreForegroundOutput() }
+        runCatching {
+            previousAudioMode?.let { audioManager.mode = it }
+        }
+        previousAudioMode = null
+    }
+
+    private fun hasMicrophonePermission(): Boolean =
+        Build.VERSION.SDK_INT < Build.VERSION_CODES.M ||
+            activity.checkSelfPermission(Manifest.permission.RECORD_AUDIO) ==
+            PackageManager.PERMISSION_GRANTED
+
+    private companion object {
+        const val CHANNEL_NAME = "buzz/huddle_media"
+        const val MICROPHONE_PERMISSION_REQUEST = 7342
+        const val MAX_OPUS_PACKET_BYTES = 4088
+
+        val externalCommunicationDeviceTypes = setOf(
+            AudioDeviceInfo.TYPE_BLUETOOTH_A2DP,
+            AudioDeviceInfo.TYPE_BLUETOOTH_SCO,
+            AudioDeviceInfo.TYPE_BLE_HEADSET,
+            AudioDeviceInfo.TYPE_WIRED_HEADPHONES,
+            AudioDeviceInfo.TYPE_WIRED_HEADSET,
+            AudioDeviceInfo.TYPE_USB_DEVICE,
+            AudioDeviceInfo.TYPE_USB_HEADSET,
+        )
+    }
+}
diff --git a/mobile/android/app/src/main/kotlin/xyz/block/buzz/mobile/MainActivity.kt b/mobile/android/app/src/main/kotlin/xyz/block/buzz/mobile/MainActivity.kt
index f199f798233..e5719da0b7c 100644
--- a/mobile/android/app/src/main/kotlin/xyz/block/buzz/mobile/MainActivity.kt
+++ b/mobile/android/app/src/main/kotlin/xyz/block/buzz/mobile/MainActivity.kt
@@ -79,10 +79,16 @@ internal object AndroidImageProcessor {
 
 class MainActivity : FlutterFragmentActivity() {
     private var mediaUploadChannel: MethodChannel? = null
+    private var huddleMediaPlugin: HuddleMediaPlugin? = null
 
     override fun configureFlutterEngine(flutterEngine: FlutterEngine) {
         super.configureFlutterEngine(flutterEngine)
 
+        huddleMediaPlugin = HuddleMediaPlugin(
+            this,
+            flutterEngine.dartExecutor.binaryMessenger,
+        )
+
         mediaUploadChannel = MethodChannel(
             flutterEngine.dartExecutor.binaryMessenger,
             MEDIA_UPLOAD_CHANNEL,
@@ -110,6 +116,21 @@ class MainActivity : FlutterFragmentActivity() {
         }
     }
 
+    override fun onRequestPermissionsResult(
+        requestCode: Int,
+        permissions: Array<out String>,
+        grantResults: IntArray,
+    ) {
+        super.onRequestPermissionsResult(requestCode, permissions, grantResults)
+        huddleMediaPlugin?.onRequestPermissionsResult(requestCode, permissions, grantResults)
+    }
+
+    override fun onDestroy() {
+        huddleMediaPlugin?.dispose()
+        huddleMediaPlugin = null
+        super.onDestroy()
+    }
+
     private fun handleSanitizeImageForUpload(
         arguments: Any?,
         result: MethodChannel.Result,
diff --git a/mobile/android/app/src/test/kotlin/xyz/block/buzz/mobile/HuddleActiveTalkerSelectorTest.kt b/mobile/android/app/src/test/kotlin/xyz/block/buzz/mobile/HuddleActiveTalkerSelectorTest.kt
new file mode 100644
index 00000000000..b3287061f4c
--- /dev/null
+++ b/mobile/android/app/src/test/kotlin/xyz/block/buzz/mobile/HuddleActiveTalkerSelectorTest.kt
@@ -0,0 +1,141 @@
+package xyz.block.buzz.mobile
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNull
+import org.junit.Test
+
+class HuddleActiveTalkerSelectorTest {
+    @Test
+    fun `sixteen senders retain exactly the active talker capacity`() {
+        val selector = HuddleActiveTalkerSelector(capacity = 15)
+
+        repeat(15) { peer ->
+            assertEquals(
+                HuddleTalkerSelection(accepted = true, evictedPeerIndex = null),
+                selector.activate(peer, -20),
+            )
+        }
+        val rejected = selector.activate(15, -20)
+        assertEquals(
+            HuddleTalkerSelection(accepted = false, evictedPeerIndex = null),
+            rejected,
+        )
+        assertNull(rejected.allocateIfAccepted { Any() })
+        assertEquals((0..14).toSet(), selector.indices())
+    }
+
+    @Test
+    fun `recent activity wins and an evicted peer can reactivate`() {
+        val selector = HuddleActiveTalkerSelector(capacity = 2)
+
+        selector.activate(4, -40)
+        selector.activate(2, -20)
+        selector.activate(4, -10)
+        assertEquals(
+            HuddleTalkerSelection(accepted = true, evictedPeerIndex = 2),
+            selector.activate(9, -5),
+        )
+        assertEquals(setOf(4, 9), selector.indices())
+
+        assertEquals(
+            HuddleTalkerSelection(accepted = true, evictedPeerIndex = 4),
+            selector.activate(2, -1),
+        )
+        assertEquals(setOf(2, 9), selector.indices())
+    }
+
+    @Test
+    fun `equal level does not replace selected peer`() {
+        val selector = HuddleActiveTalkerSelector(capacity = 1)
+
+        selector.activate(7, -30)
+        assertEquals(
+            HuddleTalkerSelection(accepted = false, evictedPeerIndex = null),
+            selector.activate(3, -30),
+        )
+        assertEquals(setOf(7), selector.indices())
+    }
+
+    @Test
+    fun `equal level packets do not churn selected peers`() {
+        val selector = HuddleActiveTalkerSelector(capacity = 2)
+
+        selector.activate(4, -127)
+        selector.activate(2, -127)
+        assertEquals(
+            HuddleTalkerSelection(accepted = false, evictedPeerIndex = null),
+            selector.activate(9, -127),
+        )
+        assertFalse(9 in selector.indices())
+        assertEquals(setOf(2, 4), selector.indices())
+    }
+
+    @Test
+    fun `louder peer replaces the quietest selected peer`() {
+        val selector = HuddleActiveTalkerSelector(capacity = 2)
+
+        selector.activate(4, -40)
+        selector.activate(2, -20)
+        assertEquals(
+            HuddleTalkerSelection(accepted = true, evictedPeerIndex = 4),
+            selector.activate(9, -30),
+        )
+        assertEquals(setOf(2, 9), selector.indices())
+    }
+
+    @Test
+    fun `inactive selected peer yields its slot to a quieter speaker`() {
+        var nowMs = 0L
+        val selector = HuddleActiveTalkerSelector(
+            capacity = 2,
+            nowMs = { nowMs },
+            inactivityTimeoutMs = 1_000,
+        )
+
+        selector.activate(4, -10)
+        nowMs = 999
+        selector.activate(2, -5)
+        nowMs = 1_000
+
+        assertEquals(
+            HuddleTalkerSelection(accepted = true, evictedPeerIndex = 4),
+            selector.activate(9, -30),
+        )
+        assertEquals(setOf(2, 9), selector.indices())
+    }
+
+    @Test
+    fun `jitter queue reorders packets and rejects stale duplicates`() {
+        val queue = HuddlePacketJitterQueue(capacity = 3, startPackets = 2)
+        queue.enqueue(packet(11))
+        queue.enqueue(packet(10))
+        assertEquals(listOf(10, 11), queue.sequences())
+        assertEquals(10, queue.drainOne()?.sequence)
+        queue.enqueue(packet(10))
+        queue.enqueue(packet(12))
+        assertEquals(listOf(11, 12), queue.sequences())
+    }
+
+    private fun packet(sequence: Int) = HuddleRemoteOpusPacket(
+        peerIndex = 1,
+        sequence = sequence,
+        timestamp48k = sequence.toLong() * 960,
+        levelDbov = -20,
+        opus = byteArrayOf(1),
+    )
+
+    @Test
+    fun `remove clears the slot without allocating roster-only peers`() {
+        val selector = HuddleActiveTalkerSelector(capacity = 2)
+
+        assertEquals(emptySet<Int>(), selector.indices())
+        selector.activate(7, -20)
+        selector.remove(7)
+        assertEquals(emptySet<Int>(), selector.indices())
+        assertEquals(
+            HuddleTalkerSelection(accepted = true, evictedPeerIndex = null),
+            selector.activate(7, -20),
+        )
+    }
+}
diff --git a/mobile/android/gradle.properties b/mobile/android/gradle.properties
index fbee1d8cdaf..d5da7278a40 100644
--- a/mobile/android/gradle.properties
+++ b/mobile/android/gradle.properties
@@ -1,2 +1,6 @@
 org.gradle.jvmargs=-Xmx8G -XX:MaxMetaspaceSize=4G -XX:ReservedCodeCacheSize=512m -XX:+HeapDumpOnOutOfMemoryError
 android.useAndroidX=true
+# This builtInKotlin flag was added automatically by Flutter migrator
+android.builtInKotlin=false
+# This newDsl flag was added automatically by Flutter migrator
+android.newDsl=false
diff --git a/mobile/ios/Runner.xcodeproj/project.pbxproj b/mobile/ios/Runner.xcodeproj/project.pbxproj
index f6f66ee2dc2..0bbdeaa9802 100644
--- a/mobile/ios/Runner.xcodeproj/project.pbxproj
+++ b/mobile/ios/Runner.xcodeproj/project.pbxproj
@@ -20,6 +20,8 @@
 		4A71C00F2F40800100A17E01 /* NativeEmojiPickerModel.swift in Sources */ = {isa = PBXBuildFile; fileRef = 4A71C0102F40800100A17E01 /* NativeEmojiPickerModel.swift */; };
 		4A71C0112F40900100A17E01 /* NativeEmojiPickerView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 4A71C0122F40900100A17E01 /* NativeEmojiPickerView.swift */; };
 		4A71C0132F40A00100A17E01 /* NativeMessageActionSurface.swift in Sources */ = {isa = PBXBuildFile; fileRef = 4A71C0142F40A00100A17E01 /* NativeMessageActionSurface.swift */; };
+		4A71C0152F40B00100A17E01 /* HuddleMediaPlugin.swift in Sources */ = {isa = PBXBuildFile; fileRef = 4A71C0162F40B00100A17E01 /* HuddleMediaPlugin.swift */; };
+		4A71C0172F40C00100A17E01 /* HuddleAudioEngine.swift in Sources */ = {isa = PBXBuildFile; fileRef = 4A71C0182F40C00100A17E01 /* HuddleAudioEngine.swift */; };
 		331C809D294A63AB00263BE5 /* UIKitEncoded.png in Resources */ = {isa = PBXBuildFile; fileRef = 331C809C294A618700263BE5 /* UIKitEncoded.png */; };
 		331C809F294A63AB00263BE5 /* UIKitEncoded.jpg in Resources */ = {isa = PBXBuildFile; fileRef = 331C809E294A618700263BE5 /* UIKitEncoded.jpg */; };
 		33ADD70AB275E0EC81295559 /* Pods_Runner.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 8906419FB4E98B4B12B7A56F /* Pods_Runner.framework */; };
@@ -71,6 +73,8 @@
 		4A71C0102F40800100A17E01 /* NativeEmojiPickerModel.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = NativeEmojiPickerModel.swift; sourceTree = "<group>"; };
 		4A71C0122F40900100A17E01 /* NativeEmojiPickerView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = NativeEmojiPickerView.swift; sourceTree = "<group>"; };
 		4A71C0142F40A00100A17E01 /* NativeMessageActionSurface.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = NativeMessageActionSurface.swift; sourceTree = "<group>"; };
+		4A71C0162F40B00100A17E01 /* HuddleMediaPlugin.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = HuddleMediaPlugin.swift; sourceTree = "<group>"; };
+		4A71C0182F40C00100A17E01 /* HuddleAudioEngine.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = HuddleAudioEngine.swift; sourceTree = "<group>"; };
 		331C809C294A618700263BE5 /* UIKitEncoded.png */ = {isa = PBXFileReference; lastKnownFileType = image.png; path = UIKitEncoded.png; sourceTree = "<group>"; };
 		331C809E294A618700263BE5 /* UIKitEncoded.jpg */ = {isa = PBXFileReference; lastKnownFileType = image.jpeg; path = UIKitEncoded.jpg; sourceTree = "<group>"; };
 		331C8081294A63A400263BE5 /* RunnerTests.xctest */ = {isa = PBXFileReference; explicitFileType = wrapper.cfbundle; includeInIndex = 0; path = RunnerTests.xctest; sourceTree = BUILT_PRODUCTS_DIR; };
@@ -200,6 +204,8 @@
 				4A71C0102F40800100A17E01 /* NativeEmojiPickerModel.swift */,
 				4A71C0122F40900100A17E01 /* NativeEmojiPickerView.swift */,
 				4A71C0142F40A00100A17E01 /* NativeMessageActionSurface.swift */,
+				4A71C0162F40B00100A17E01 /* HuddleMediaPlugin.swift */,
+				4A71C0182F40C00100A17E01 /* HuddleAudioEngine.swift */,
 				7884E8672EC3CC0400C636F2 /* SceneDelegate.swift */,
 				74858FAD1ED2DC5600515810 /* Runner-Bridging-Header.h */,
 			);
@@ -441,6 +447,8 @@
 				4A71C00F2F40800100A17E01 /* NativeEmojiPickerModel.swift in Sources */,
 				4A71C0112F40900100A17E01 /* NativeEmojiPickerView.swift in Sources */,
 				4A71C0132F40A00100A17E01 /* NativeMessageActionSurface.swift in Sources */,
+				4A71C0152F40B00100A17E01 /* HuddleMediaPlugin.swift in Sources */,
+				4A71C0172F40C00100A17E01 /* HuddleAudioEngine.swift in Sources */,
 				1498D2341E8E89220040F4C2 /* GeneratedPluginRegistrant.m in Sources */,
 				7884E8682EC3CC0700C636F2 /* SceneDelegate.swift in Sources */,
 			);
diff --git a/mobile/ios/Runner/AppDelegate.swift b/mobile/ios/Runner/AppDelegate.swift
index e4ee6dbd916..65878e64d8e 100644
--- a/mobile/ios/Runner/AppDelegate.swift
+++ b/mobile/ios/Runner/AppDelegate.swift
@@ -12,6 +12,7 @@ import UserNotifications
   private var nativeAttachmentPopoverCoordinator: NativeAttachmentPopoverCoordinator?
   private var nativeEmojiPickerCoordinator: NativeEmojiPickerCoordinator?
   private var nativeMessageActionSurfaceSupportChannel: FlutterMethodChannel?
+  private var huddleMediaPlugin: HuddleMediaPlugin?
 
   override func application(
     _ application: UIApplication,
@@ -24,6 +25,7 @@ import UserNotifications
   func didInitializeImplicitFlutterEngine(_ engineBridge: FlutterImplicitEngineBridge) {
     GeneratedPluginRegistrant.register(with: engineBridge.pluginRegistry)
     let messenger = engineBridge.applicationRegistrar.messenger()
+    huddleMediaPlugin = HuddleMediaPlugin(messenger: messenger)
     mediaUploadChannel = FlutterMethodChannel(
       name: "buzz/media_upload",
       binaryMessenger: messenger
@@ -70,7 +72,7 @@ import UserNotifications
       forPlugin: "BuzzConcentricSheetSurface"
     ) {
       concentricSheetRegistrar.register(
-        ConcentricSheetSurfaceFactory(),
+        ConcentricSheetSurfaceFactory(messenger: messenger),
         withId: "buzz/concentric_sheet_surface"
       )
       concentricSheetSurfaceChannel = FlutterMethodChannel(
@@ -99,6 +101,15 @@ import UserNotifications
       )
     }
 
+    if let navigationGlassRegistrar = engineBridge.pluginRegistry.registrar(
+      forPlugin: "BuzzNavigationGlassButton"
+    ) {
+      navigationGlassRegistrar.register(
+        NavigationGlassButtonFactory(messenger: messenger),
+        withId: "buzz/navigation_glass"
+      )
+    }
+
     if let stickyDateGlassRegistrar = engineBridge.pluginRegistry.registrar(
       forPlugin: "BuzzStickyDateGlassHeader"
     ) {
diff --git a/mobile/ios/Runner/ConcentricSheetSurface.swift b/mobile/ios/Runner/ConcentricSheetSurface.swift
index d4d481d0981..a1da7650a5f 100644
--- a/mobile/ios/Runner/ConcentricSheetSurface.swift
+++ b/mobile/ios/Runner/ConcentricSheetSurface.swift
@@ -2,6 +2,13 @@ import Flutter
 import UIKit
 
 final class ConcentricSheetSurfaceFactory: NSObject, FlutterPlatformViewFactory {
+  private let messenger: FlutterBinaryMessenger
+
+  init(messenger: FlutterBinaryMessenger) {
+    self.messenger = messenger
+    super.init()
+  }
+
   func createArgsCodec() -> FlutterMessageCodec & NSObjectProtocol {
     FlutterStandardMessageCodec.sharedInstance()
   }
@@ -11,37 +18,110 @@ final class ConcentricSheetSurfaceFactory: NSObject, FlutterPlatformViewFactory
     viewIdentifier viewId: Int64,
     arguments args: Any?
   ) -> FlutterPlatformView {
-    ConcentricSheetSurfacePlatformView(frame: frame, arguments: args)
+    ConcentricSheetSurfacePlatformView(
+      frame: frame,
+      viewIdentifier: viewId,
+      messenger: messenger,
+      arguments: args
+    )
   }
 }
 
 final class ConcentricSheetSurfacePlatformView: NSObject, FlutterPlatformView {
+  private let rootView: UIView
   private let surfaceView: UIView
+  private let channel: FlutterMethodChannel
 
-  init(frame: CGRect, arguments args: Any?) {
+  init(
+    frame: CGRect,
+    viewIdentifier viewId: Int64,
+    messenger: FlutterBinaryMessenger,
+    arguments args: Any?
+  ) {
     let arguments = args as? [String: Any]
-    let colorValue = (arguments?["color"] as? NSNumber)?.uint32Value ?? 0xFFFFFFFF
+    let colorValue = (arguments?["color"] as? NSNumber)?.uint32Value ?? 0xFFFF_FFFF
+    let backdropColorValue = (arguments?["backdropColor"] as? NSNumber)?.uint32Value
     let minimumRadius = (arguments?["minimumRadius"] as? NSNumber)?.doubleValue ?? 24
+    let corners = arguments?["corners"] as? String ?? "all"
+
+    rootView = UIView(frame: frame)
+    rootView.isOpaque = backdropColorValue != nil
+    rootView.backgroundColor = backdropColorValue.map { Self.color(from: $0) } ?? .clear
 
-    surfaceView = UIView(frame: frame)
+    surfaceView = UIView(frame: rootView.bounds)
     surfaceView.isOpaque = true
     surfaceView.backgroundColor = Self.color(from: colorValue)
     surfaceView.clipsToBounds = true
     surfaceView.layer.cornerCurve = .continuous
+    surfaceView.autoresizingMask = [.flexibleWidth, .flexibleHeight]
+    rootView.addSubview(surfaceView)
+
+    channel = FlutterMethodChannel(
+      name: "buzz/concentric_sheet_surface/\(viewId)",
+      binaryMessenger: messenger
+    )
 
     if #available(iOS 26.0, *) {
-      surfaceView.cornerConfiguration = .uniformCorners(
-        radius: .containerConcentric(minimum: minimumRadius)
-      )
+      let radius = UICornerRadius.containerConcentric(minimum: minimumRadius)
+      surfaceView.cornerConfiguration =
+        corners == "bottom"
+        ? .uniformBottomRadius(
+          radius,
+          topLeftRadius: nil,
+          topRightRadius: nil
+        )
+        : .uniformCorners(radius: radius)
     } else {
       surfaceView.layer.cornerRadius = minimumRadius
+      if corners == "bottom" {
+        surfaceView.layer.maskedCorners = [
+          .layerMinXMaxYCorner,
+          .layerMaxXMaxYCorner,
+        ]
+      }
     }
 
     super.init()
+
+    channel.setMethodCallHandler { [weak self] call, result in
+      guard call.method == "updateColors" else {
+        result(FlutterMethodNotImplemented)
+        return
+      }
+      guard
+        let arguments = call.arguments as? [String: Any],
+        let colorValue = arguments["color"] as? NSNumber
+      else {
+        result(
+          FlutterError(
+            code: "invalid_arguments",
+            message: "Expected a surface color.",
+            details: nil
+          )
+        )
+        return
+      }
+
+      self?.updateColors(
+        colorValue: colorValue.uint32Value,
+        backdropColorValue: (arguments["backdropColor"] as? NSNumber)?.uint32Value
+      )
+      result(nil)
+    }
+  }
+
+  deinit {
+    channel.setMethodCallHandler(nil)
   }
 
   func view() -> UIView {
-    surfaceView
+    rootView
+  }
+
+  private func updateColors(colorValue: UInt32, backdropColorValue: UInt32?) {
+    surfaceView.backgroundColor = Self.color(from: colorValue)
+    rootView.isOpaque = backdropColorValue != nil
+    rootView.backgroundColor = backdropColorValue.map { Self.color(from: $0) } ?? .clear
   }
 
   private static func color(from value: UInt32) -> UIColor {
diff --git a/mobile/ios/Runner/HuddleAudioEngine.swift b/mobile/ios/Runner/HuddleAudioEngine.swift
new file mode 100644
index 00000000000..9f481b1dbdc
--- /dev/null
+++ b/mobile/ios/Runner/HuddleAudioEngine.swift
@@ -0,0 +1,1013 @@
+import AVFoundation
+import Foundation
+
+struct HuddleLocalOpusPacket {
+  let sequence: Int
+  let timestamp48k: Int
+  let levelDbov: Int
+  let flags: Int
+  let opus: Data
+}
+
+struct HuddleRemoteOpusPacket {
+  let peerIndex: Int
+  let sequence: Int
+  let timestamp48k: Int64
+  let levelDbov: Int
+  let opus: Data
+}
+
+struct HuddlePacketJitterQueue {
+  private(set) var packets: [HuddleRemoteOpusPacket] = []
+  private var lastDrainedSequence: Int?
+  private var started = false
+  let capacity: Int
+  let startPackets: Int
+
+  init(capacity: Int, startPackets: Int) {
+    self.capacity = capacity
+    self.startPackets = startPackets
+  }
+
+  mutating func enqueue(_ packet: HuddleRemoteOpusPacket) {
+    if let last = lastDrainedSequence, !sequenceAfter(packet.sequence, last) {
+      return
+    }
+    guard !packets.contains(where: { $0.sequence == packet.sequence }) else {
+      return
+    }
+    let index = packets.firstIndex {
+      sequenceBefore(packet.sequence, $0.sequence)
+    } ?? packets.endIndex
+    packets.insert(packet, at: index)
+    if packets.count > capacity { packets.removeFirst() }
+    if packets.count >= startPackets { started = true }
+  }
+
+  mutating func drainOne() -> HuddleRemoteOpusPacket? {
+    guard started, !packets.isEmpty else { return nil }
+    let packet = packets.removeFirst()
+    lastDrainedSequence = packet.sequence
+    return packet
+  }
+
+  private func sequenceAfter(_ sequence: Int, _ reference: Int) -> Bool {
+    let distance = (sequence - reference) & 0xffff
+    return distance > 0 && distance <= 0x7fff
+  }
+
+  private func sequenceBefore(_ left: Int, _ right: Int) -> Bool {
+    sequenceAfter(right, left)
+  }
+}
+
+struct HuddleCaptureDiagnostics {
+  let frameCount: Int64
+  let rmsDbovHistogram: [String: Int64]
+  let peakDbovHistogram: [String: Int64]
+  let maxPeakDbov: Int
+  let deviceLabel: String?
+  let voiceProcessingEnabled: Bool
+}
+
+enum HuddleNativeMediaError: LocalizedError {
+  case invalidState(String)
+  case unsupported(String)
+  case conversion(String)
+  case malformedPacket(String)
+
+  var errorDescription: String? {
+    switch self {
+    case .invalidState(let message),
+      .unsupported(let message),
+      .conversion(let message),
+      .malformedPacket(let message):
+      message
+    }
+  }
+}
+
+enum HuddleAudioFormats {
+  static let sampleRate = 48_000.0
+  static let channels: AVAudioChannelCount = 1
+  static let frameSamples = 960
+  static let maximumOpusPacketBytes = 4_088
+
+  static func makePCM() throws -> AVAudioFormat {
+    guard
+      let format = AVAudioFormat(
+        commonFormat: .pcmFormatFloat32,
+        sampleRate: sampleRate,
+        channels: channels,
+        interleaved: false
+      )
+    else {
+      throw HuddleNativeMediaError.unsupported(
+        "iOS does not expose 48 kHz mono PCM audio."
+      )
+    }
+    return format
+  }
+
+  static func makeOpus() throws -> AVAudioFormat {
+    var description = AudioStreamBasicDescription(
+      mSampleRate: sampleRate,
+      mFormatID: kAudioFormatOpus,
+      mFormatFlags: 0,
+      mBytesPerPacket: 0,
+      mFramesPerPacket: UInt32(frameSamples),
+      mBytesPerFrame: 0,
+      mChannelsPerFrame: channels,
+      mBitsPerChannel: 0,
+      mReserved: 0
+    )
+    guard let format = AVAudioFormat(streamDescription: &description) else {
+      throw HuddleNativeMediaError.unsupported(
+        "iOS does not expose the native Opus audio format."
+      )
+    }
+    return format
+  }
+}
+
+final class HuddleOpusEncoder {
+  private let pcmFormat: AVAudioFormat
+  private let opusFormat: AVAudioFormat
+  private let converter: AVAudioConverter
+  private let maximumPacketSize: Int
+
+  init() throws {
+    let pcmFormat = try HuddleAudioFormats.makePCM()
+    let opusFormat = try HuddleAudioFormats.makeOpus()
+    guard let converter = AVAudioConverter(from: pcmFormat, to: opusFormat) else {
+      throw HuddleNativeMediaError.unsupported(
+        "This iOS device does not expose an Opus encoder."
+      )
+    }
+    converter.bitRate = 32_000
+    converter.primeMethod = .none
+    self.pcmFormat = pcmFormat
+    self.opusFormat = opusFormat
+    self.converter = converter
+    maximumPacketSize = max(1_275, converter.maximumOutputPacketSize)
+  }
+
+  func encode(_ samples: [Float]) throws -> Data {
+    guard samples.count == HuddleAudioFormats.frameSamples else {
+      throw HuddleNativeMediaError.conversion(
+        "Opus input must contain exactly 960 samples."
+      )
+    }
+    guard
+      let pcm = AVAudioPCMBuffer(
+        pcmFormat: pcmFormat,
+        frameCapacity: AVAudioFrameCount(HuddleAudioFormats.frameSamples)
+      ),
+      let channel = pcm.floatChannelData?.pointee
+    else {
+      throw HuddleNativeMediaError.conversion(
+        "Unable to allocate the iOS Opus input buffer."
+      )
+    }
+    pcm.frameLength = AVAudioFrameCount(HuddleAudioFormats.frameSamples)
+    for index in samples.indices {
+      channel[index] = samples[index]
+    }
+
+    let compressed = AVAudioCompressedBuffer(
+      format: opusFormat,
+      packetCapacity: 1,
+      maximumPacketSize: maximumPacketSize
+    )
+    var suppliedInput = false
+    var conversionError: NSError?
+    let status = converter.convert(
+      to: compressed,
+      error: &conversionError
+    ) { _, inputStatus in
+      guard !suppliedInput else {
+        inputStatus.pointee = .noDataNow
+        return nil
+      }
+      suppliedInput = true
+      inputStatus.pointee = .haveData
+      return pcm
+    }
+    if status == .error || conversionError != nil {
+      throw HuddleNativeMediaError.conversion(
+        conversionError?.localizedDescription ?? "iOS Opus encoding failed."
+      )
+    }
+    let byteCount = Int(compressed.byteLength)
+    guard
+      compressed.packetCount == 1,
+      byteCount > 0,
+      byteCount <= HuddleAudioFormats.maximumOpusPacketBytes
+    else {
+      throw HuddleNativeMediaError.conversion(
+        "iOS produced an invalid Opus packet."
+      )
+    }
+    return Data(bytes: compressed.data, count: byteCount)
+  }
+}
+
+final class HuddleOpusDecoder {
+  private let pcmFormat: AVAudioFormat
+  private let opusFormat: AVAudioFormat
+  private let converter: AVAudioConverter
+
+  init() throws {
+    let pcmFormat = try HuddleAudioFormats.makePCM()
+    let opusFormat = try HuddleAudioFormats.makeOpus()
+    guard let converter = AVAudioConverter(from: opusFormat, to: pcmFormat) else {
+      throw HuddleNativeMediaError.unsupported(
+        "This iOS device does not expose an Opus decoder."
+      )
+    }
+    converter.primeMethod = .none
+    self.pcmFormat = pcmFormat
+    self.opusFormat = opusFormat
+    self.converter = converter
+  }
+
+  func decode(_ packet: Data) throws -> AVAudioPCMBuffer {
+    guard
+      !packet.isEmpty,
+      packet.count <= HuddleAudioFormats.maximumOpusPacketBytes
+    else {
+      throw HuddleNativeMediaError.malformedPacket(
+        "Remote Huddle Opus packet has an invalid length."
+      )
+    }
+    let compressed = AVAudioCompressedBuffer(
+      format: opusFormat,
+      packetCapacity: 1,
+      maximumPacketSize: HuddleAudioFormats.maximumOpusPacketBytes
+    )
+    packet.withUnsafeBytes { bytes in
+      guard let baseAddress = bytes.baseAddress else { return }
+      compressed.data.copyMemory(from: baseAddress, byteCount: packet.count)
+    }
+    compressed.byteLength = UInt32(packet.count)
+    compressed.packetCount = 1
+    if let descriptions = compressed.packetDescriptions {
+      descriptions.pointee = AudioStreamPacketDescription(
+        mStartOffset: 0,
+        mVariableFramesInPacket: UInt32(HuddleAudioFormats.frameSamples),
+        mDataByteSize: UInt32(packet.count)
+      )
+    }
+
+    guard
+      let pcm = AVAudioPCMBuffer(
+        pcmFormat: pcmFormat,
+        frameCapacity: AVAudioFrameCount(HuddleAudioFormats.frameSamples)
+      )
+    else {
+      throw HuddleNativeMediaError.conversion(
+        "Unable to allocate the iOS Opus output buffer."
+      )
+    }
+    var suppliedInput = false
+    var conversionError: NSError?
+    let status = converter.convert(
+      to: pcm,
+      error: &conversionError
+    ) { _, inputStatus in
+      guard !suppliedInput else {
+        inputStatus.pointee = .noDataNow
+        return nil
+      }
+      suppliedInput = true
+      inputStatus.pointee = .haveData
+      return compressed
+    }
+    if status == .error || conversionError != nil || pcm.frameLength == 0 {
+      throw HuddleNativeMediaError.conversion(
+        conversionError?.localizedDescription ?? "iOS Opus decoding failed."
+      )
+    }
+    return pcm
+  }
+}
+
+enum HuddleAudioLevels {
+  static func rmsDbov(_ samples: [Float]) -> Int {
+    guard !samples.isEmpty else { return -127 }
+    let squareSum = samples.reduce(0.0) { partial, sample in
+      partial + Double(sample * sample)
+    }
+    let meanSquare = squareSum / Double(samples.count)
+    guard meanSquare > 0 else { return -127 }
+    return min(0, max(-127, Int((10 * log10(meanSquare)).rounded())))
+  }
+
+  static func peakDbov(_ samples: [Float]) -> Int {
+    let peak = samples.reduce(Float.zero) { max($0, abs($1)) }
+    guard peak > 0 else { return -127 }
+    return min(0, max(-127, Int((20 * log10(Double(peak))).rounded())))
+  }
+}
+
+struct HuddleTalkerSelection: Equatable {
+  let accepted: Bool
+  let evictedPeerIndex: Int?
+
+  func allocateIfAccepted<T>(_ allocate: () throws -> T) rethrows -> T? {
+    guard accepted else { return nil }
+    return try allocate()
+  }
+}
+
+/// Fixed-capacity active-talker selector. The UI roster is independent; native
+/// decoder/player resources exist only for peers that actually send packets.
+struct HuddleActiveTalkerSelector {
+  struct Activity {
+    let peerIndex: Int
+    let lastPacketOrdinal: UInt64
+    let lastPacketAt: TimeInterval
+    let levelDbov: Int
+  }
+
+  let capacity: Int
+  let now: () -> TimeInterval
+  let inactivityTimeout: TimeInterval
+  private(set) var active: [Int: Activity] = [:]
+  private var ordinal: UInt64 = 0
+
+  init(
+    capacity: Int,
+    now: @escaping () -> TimeInterval = { ProcessInfo.processInfo.systemUptime },
+    inactivityTimeout: TimeInterval = 1
+  ) {
+    self.capacity = capacity
+    self.now = now
+    self.inactivityTimeout = inactivityTimeout
+  }
+
+  mutating func activate(peerIndex: Int, levelDbov: Int) -> HuddleTalkerSelection {
+    ordinal &+= 1
+    let packetAt = now()
+    if active[peerIndex] != nil {
+      active[peerIndex] = Activity(
+        peerIndex: peerIndex,
+        lastPacketOrdinal: ordinal,
+        lastPacketAt: packetAt,
+        levelDbov: levelDbov
+      )
+      return HuddleTalkerSelection(accepted: true, evictedPeerIndex: nil)
+    }
+    let weakest = active.count >= capacity
+      ? active.values.min { left, right in
+        if left.levelDbov != right.levelDbov {
+          return left.levelDbov < right.levelDbov
+        }
+        if left.lastPacketOrdinal != right.lastPacketOrdinal {
+          return left.lastPacketOrdinal < right.lastPacketOrdinal
+        }
+        return left.peerIndex < right.peerIndex
+      }
+      : nil
+    let expired = active.values
+      .filter { packetAt - $0.lastPacketAt >= inactivityTimeout }
+      .min { left, right in
+        if left.lastPacketAt != right.lastPacketAt {
+          return left.lastPacketAt < right.lastPacketAt
+        }
+        return left.peerIndex < right.peerIndex
+      }
+    // Equal-level packets (especially continuous -127 dBov silence) must not
+    // churn decoder/jitter state. Admit a new peer when any selected slot is
+    // inactive or the new packet is louder than the quietest selected peer.
+    if let weakest, expired == nil, levelDbov <= weakest.levelDbov {
+      return HuddleTalkerSelection(accepted: false, evictedPeerIndex: nil)
+    }
+    let evicted = expired?.peerIndex ?? weakest?.peerIndex
+    if let evicted { active.removeValue(forKey: evicted) }
+    active[peerIndex] = Activity(
+      peerIndex: peerIndex,
+      lastPacketOrdinal: ordinal,
+      lastPacketAt: packetAt,
+      levelDbov: levelDbov
+    )
+    return HuddleTalkerSelection(accepted: true, evictedPeerIndex: evicted)
+  }
+
+  mutating func remove(_ peerIndex: Int) {
+    active.removeValue(forKey: peerIndex)
+  }
+
+  mutating func removeAll() {
+    active.removeAll()
+    ordinal = 0
+  }
+}
+
+/// Foreground-only iOS realtime media engine for the fixed Huddle Opus v2 path.
+///
+/// AVAudioEngine owns voice-processed capture and per-peer mixed playout.
+/// AVAudioConverter keeps PCM native and moves only Opus packets across Flutter.
+final class HuddleAudioEngine {
+  private let onLocalPacket: (HuddleLocalOpusPacket) -> Void
+  private let onFailure: (String, String) -> Void
+  private let onDiagnostics: (HuddleCaptureDiagnostics) -> Void
+  private let diagnosticsEnabled: Bool
+  private let audioEngine = AVAudioEngine()
+  private let processingQueue = DispatchQueue(
+    label: "xyz.block.buzz.huddle.ios-media",
+    qos: .userInteractive
+  )
+  private let stateLock = NSLock()
+  private let pcmFormat: AVAudioFormat
+  private let encoder: HuddleOpusEncoder
+
+  private var running = false
+  private var muted = false
+  private var interrupted = false
+  private var failureReported = false
+  private var pendingCaptureBuffers = 0
+  private var pendingRemotePackets = 0
+  private var captureConverter: AVAudioConverter?
+  private var captureSourceFormat: AVAudioFormat?
+  private var captureTapInstalled = false
+  private var captureSamples: [Float] = []
+  private var captureSampleOffset = 0
+  private var sequence = 0
+  private var frameIndex: Int64 = 0
+  private var diagnosticFrameCount: Int64 = 0
+  private var diagnosticMaxPeakDbov = -127
+  private var rmsDbovHistogram: [Int: Int64] = [:]
+  private var peakDbovHistogram: [Int: Int64] = [:]
+  private var peerPlaybacks: [Int: HuddlePeerPlayback] = [:]
+  private var activeTalkers = HuddleActiveTalkerSelector(capacity: 15)
+  private var playbackTimer: DispatchSourceTimer?
+  private var configurationObserver: NSObjectProtocol?
+
+  init(
+    onLocalPacket: @escaping (HuddleLocalOpusPacket) -> Void,
+    onFailure: @escaping (String, String) -> Void,
+    onDiagnostics: @escaping (HuddleCaptureDiagnostics) -> Void,
+    diagnosticsEnabled: Bool
+  ) throws {
+    pcmFormat = try HuddleAudioFormats.makePCM()
+    encoder = try HuddleOpusEncoder()
+    self.onLocalPacket = onLocalPacket
+    self.onFailure = onFailure
+    self.onDiagnostics = onDiagnostics
+    self.diagnosticsEnabled = diagnosticsEnabled
+    configurationObserver = NotificationCenter.default.addObserver(
+      forName: .AVAudioEngineConfigurationChange,
+      object: audioEngine,
+      queue: nil
+    ) { [weak self] _ in
+      self?.processingQueue.async {
+        self?.restartAfterConfigurationChange()
+      }
+    }
+  }
+
+  deinit {
+    stop()
+    if let configurationObserver {
+      NotificationCenter.default.removeObserver(configurationObserver)
+    }
+  }
+
+  static func isSupported() -> Bool {
+    do {
+      _ = try HuddleOpusEncoder()
+      _ = try HuddleOpusDecoder()
+      return true
+    } catch {
+      return false
+    }
+  }
+
+  func start() throws {
+    var startError: Error?
+    processingQueue.sync {
+      do {
+        try startOnQueue()
+      } catch {
+        startError = error
+      }
+    }
+    if let startError { throw startError }
+  }
+
+  func setMuted(_ value: Bool) throws {
+    stateLock.lock()
+    defer { stateLock.unlock() }
+    guard running else {
+      throw HuddleNativeMediaError.invalidState(
+        "Huddle audio is not running."
+      )
+    }
+    muted = value
+  }
+
+  func setInterrupted(_ value: Bool) {
+    stateLock.lock()
+    let shouldUpdate = running
+    interrupted = value
+    stateLock.unlock()
+    guard shouldUpdate else { return }
+    processingQueue.async { [weak self] in
+      guard let self else { return }
+      if value {
+        for playback in peerPlaybacks.values {
+          playback.pause()
+        }
+        return
+      }
+      do {
+        if !audioEngine.isRunning {
+          try audioEngine.start()
+        }
+        for playback in peerPlaybacks.values {
+          playback.resume()
+        }
+      } catch {
+        reportFailure(code: "audio_resume_failed", error: error)
+      }
+    }
+  }
+
+  func enqueueRemote(_ packet: HuddleRemoteOpusPacket) throws {
+    stateLock.lock()
+    guard running else {
+      stateLock.unlock()
+      throw HuddleNativeMediaError.invalidState(
+        "Huddle audio is not running."
+      )
+    }
+    guard pendingRemotePackets < 50 else {
+      stateLock.unlock()
+      return
+    }
+    pendingRemotePackets += 1
+    stateLock.unlock()
+    processingQueue.async { [weak self] in
+      guard let self else { return }
+      defer { completeRemotePacket() }
+      do {
+        let selection = activeTalkers.activate(
+          peerIndex: packet.peerIndex,
+          levelDbov: packet.levelDbov
+        )
+        if let evictedIndex = selection.evictedPeerIndex,
+          let evicted = peerPlaybacks.removeValue(forKey: evictedIndex)
+        {
+          evicted.release(from: audioEngine)
+        }
+        let playback: HuddlePeerPlayback
+        if let existing = peerPlaybacks[packet.peerIndex] {
+          playback = existing
+        } else if let allocated = try selection.allocateIfAccepted({
+          try HuddlePeerPlayback(
+            engine: self.audioEngine,
+            pcmFormat: self.pcmFormat
+          )
+        }) {
+          playback = allocated
+          peerPlaybacks[packet.peerIndex] = allocated
+        } else {
+          return
+        }
+        playback.enqueue(packet)
+      } catch {
+        reportFailure(code: "playback_failed", error: error)
+      }
+    }
+  }
+
+  private func completeRemotePacket() {
+    stateLock.lock()
+    pendingRemotePackets = max(0, pendingRemotePackets - 1)
+    stateLock.unlock()
+  }
+
+  func removeRemotePeer(_ peerIndex: Int) {
+    processingQueue.async { [weak self] in
+      guard let self else { return }
+      activeTalkers.remove(peerIndex)
+      guard let playback = peerPlaybacks.removeValue(forKey: peerIndex)
+      else { return }
+      playback.release(from: audioEngine)
+    }
+  }
+
+  func stop() {
+    processingQueue.sync {
+      stopOnQueue()
+    }
+  }
+
+  private func startOnQueue() throws {
+    stateLock.lock()
+    let wasRunning = running
+    if !wasRunning {
+      running = true
+      muted = false
+      interrupted = false
+      failureReported = false
+    }
+    stateLock.unlock()
+    guard !wasRunning else {
+      throw HuddleNativeMediaError.invalidState(
+        "Huddle audio is already running."
+      )
+    }
+
+    do {
+      let input = audioEngine.inputNode
+      try input.setVoiceProcessingEnabled(true)
+      let inputFormat = input.outputFormat(forBus: 0)
+      guard inputFormat.sampleRate > 0, inputFormat.channelCount > 0 else {
+        throw HuddleNativeMediaError.unsupported(
+          "The iOS microphone does not expose an input format."
+        )
+      }
+      input.installTap(
+        onBus: 0,
+        bufferSize: AVAudioFrameCount(HuddleAudioFormats.frameSamples),
+        format: inputFormat
+      ) { [weak self] buffer, _ in
+        self?.acceptCapturedBuffer(buffer)
+      }
+      captureTapInstalled = true
+      audioEngine.prepare()
+      try audioEngine.start()
+      startPlaybackTimer()
+      if diagnosticsEnabled {
+        onDiagnostics(makeDiagnostics())
+      }
+    } catch {
+      stopOnQueue()
+      throw error
+    }
+  }
+
+  private func stopOnQueue() {
+    stateLock.lock()
+    running = false
+    muted = false
+    interrupted = false
+    pendingCaptureBuffers = 0
+    pendingRemotePackets = 0
+    stateLock.unlock()
+
+    playbackTimer?.cancel()
+    playbackTimer = nil
+    if captureTapInstalled {
+      audioEngine.inputNode.removeTap(onBus: 0)
+      captureTapInstalled = false
+    }
+    for playback in peerPlaybacks.values {
+      playback.release(from: audioEngine)
+    }
+    peerPlaybacks.removeAll()
+    activeTalkers.removeAll()
+    audioEngine.stop()
+    audioEngine.reset()
+    try? audioEngine.inputNode.setVoiceProcessingEnabled(false)
+    captureConverter = nil
+    captureSourceFormat = nil
+    captureSamples.removeAll(keepingCapacity: false)
+    captureSampleOffset = 0
+    sequence = 0
+    frameIndex = 0
+    diagnosticFrameCount = 0
+    diagnosticMaxPeakDbov = -127
+    rmsDbovHistogram.removeAll()
+    peakDbovHistogram.removeAll()
+  }
+
+  private func acceptCapturedBuffer(_ buffer: AVAudioPCMBuffer) {
+    stateLock.lock()
+    guard running, pendingCaptureBuffers < 8 else {
+      stateLock.unlock()
+      return
+    }
+    pendingCaptureBuffers += 1
+    stateLock.unlock()
+
+    guard let copied = copyPCMBuffer(buffer) else {
+      completeCaptureBuffer()
+      return
+    }
+    processingQueue.async { [weak self] in
+      guard let self else { return }
+      defer { completeCaptureBuffer() }
+      do {
+        try processCapturedBuffer(copied)
+      } catch {
+        reportFailure(code: "capture_failed", error: error)
+      }
+    }
+  }
+
+  private func completeCaptureBuffer() {
+    stateLock.lock()
+    pendingCaptureBuffers = max(0, pendingCaptureBuffers - 1)
+    stateLock.unlock()
+  }
+
+  private func processCapturedBuffer(_ input: AVAudioPCMBuffer) throws {
+    stateLock.lock()
+    let isRunning = running
+    stateLock.unlock()
+    guard isRunning else { return }
+
+    let normalized = try normalizeCapturedBuffer(input)
+    guard let channel = normalized.floatChannelData?.pointee else {
+      throw HuddleNativeMediaError.conversion(
+        "iOS microphone PCM data is unavailable."
+      )
+    }
+    captureSamples.append(
+      contentsOf: UnsafeBufferPointer(
+        start: channel,
+        count: Int(normalized.frameLength)
+      )
+    )
+
+    while captureSamples.count - captureSampleOffset >= HuddleAudioFormats.frameSamples {
+      let end = captureSampleOffset + HuddleAudioFormats.frameSamples
+      let frame = Array(captureSamples[captureSampleOffset..<end])
+      captureSampleOffset = end
+      try processCaptureFrame(frame)
+    }
+    if captureSampleOffset >= HuddleAudioFormats.frameSamples * 4 {
+      captureSamples.removeFirst(captureSampleOffset)
+      captureSampleOffset = 0
+    }
+  }
+
+  private func normalizeCapturedBuffer(
+    _ input: AVAudioPCMBuffer
+  ) throws -> AVAudioPCMBuffer {
+    if matchesTargetPCM(input.format) {
+      return input
+    }
+    if captureSourceFormat?.isEqual(input.format) != true {
+      guard let converter = AVAudioConverter(from: input.format, to: pcmFormat) else {
+        throw HuddleNativeMediaError.unsupported(
+          "iOS cannot convert the active microphone route to Huddle audio."
+        )
+      }
+      converter.primeMethod = .none
+      captureConverter = converter
+      captureSourceFormat = input.format
+    }
+    guard let converter = captureConverter else {
+      throw HuddleNativeMediaError.conversion(
+        "The iOS microphone converter is unavailable."
+      )
+    }
+    let ratio = HuddleAudioFormats.sampleRate / input.format.sampleRate
+    let capacity = max(
+      HuddleAudioFormats.frameSamples,
+      Int(ceil(Double(input.frameLength) * ratio)) + 64
+    )
+    guard
+      let output = AVAudioPCMBuffer(
+        pcmFormat: pcmFormat,
+        frameCapacity: AVAudioFrameCount(capacity)
+      )
+    else {
+      throw HuddleNativeMediaError.conversion(
+        "Unable to allocate converted iOS microphone audio."
+      )
+    }
+    var suppliedInput = false
+    var conversionError: NSError?
+    let status = converter.convert(
+      to: output,
+      error: &conversionError
+    ) { _, inputStatus in
+      guard !suppliedInput else {
+        inputStatus.pointee = .noDataNow
+        return nil
+      }
+      suppliedInput = true
+      inputStatus.pointee = .haveData
+      return input
+    }
+    if status == .error || conversionError != nil {
+      throw HuddleNativeMediaError.conversion(
+        conversionError?.localizedDescription
+          ?? "iOS microphone conversion failed."
+      )
+    }
+    return output
+  }
+
+  private func processCaptureFrame(_ frame: [Float]) throws {
+    stateLock.lock()
+    let shouldSend = running && !muted && !interrupted
+    stateLock.unlock()
+    guard shouldSend else { return }
+
+    let level = HuddleAudioLevels.rmsDbov(frame)
+    if diagnosticsEnabled {
+      let peak = HuddleAudioLevels.peakDbov(frame)
+      diagnosticFrameCount += 1
+      diagnosticMaxPeakDbov = max(diagnosticMaxPeakDbov, peak)
+      rmsDbovHistogram[level, default: 0] += 1
+      peakDbovHistogram[peak, default: 0] += 1
+      if diagnosticFrameCount % 50 == 0 {
+        onDiagnostics(makeDiagnostics())
+      }
+    }
+
+    let opus = try encoder.encode(frame)
+    let packet = HuddleLocalOpusPacket(
+      sequence: sequence,
+      timestamp48k: Int(
+        UInt32(truncatingIfNeeded: frameIndex * Int64(HuddleAudioFormats.frameSamples))
+      ),
+      levelDbov: level,
+      flags: 0,
+      opus: opus
+    )
+    sequence = (sequence + 1) & 0xffff
+    frameIndex += 1
+    onLocalPacket(packet)
+  }
+
+  private func startPlaybackTimer() {
+    let timer = DispatchSource.makeTimerSource(queue: processingQueue)
+    timer.schedule(
+      deadline: .now() + .milliseconds(20),
+      repeating: .milliseconds(20),
+      leeway: .milliseconds(2)
+    )
+    timer.setEventHandler { [weak self] in
+      self?.drainPlaybackTick()
+    }
+    playbackTimer = timer
+    timer.resume()
+  }
+
+  private func drainPlaybackTick() {
+    stateLock.lock()
+    let shouldPlay = running && !interrupted
+    stateLock.unlock()
+    guard shouldPlay else { return }
+    do {
+      for playback in peerPlaybacks.values {
+        try playback.drainOne()
+      }
+    } catch {
+      reportFailure(code: "playback_failed", error: error)
+    }
+  }
+
+  private func restartAfterConfigurationChange() {
+    stateLock.lock()
+    let shouldRestart = running && !interrupted
+    stateLock.unlock()
+    guard shouldRestart else { return }
+    do {
+      if !audioEngine.isRunning {
+        try audioEngine.start()
+      }
+      for playback in peerPlaybacks.values {
+        playback.resume()
+      }
+    } catch {
+      reportFailure(code: "audio_route_failed", error: error)
+    }
+  }
+
+  private func makeDiagnostics() -> HuddleCaptureDiagnostics {
+    let route = AVAudioSession.sharedInstance().currentRoute
+    return HuddleCaptureDiagnostics(
+      frameCount: diagnosticFrameCount,
+      rmsDbovHistogram: numericHistogram(rmsDbovHistogram),
+      peakDbovHistogram: numericHistogram(peakDbovHistogram),
+      maxPeakDbov: diagnosticMaxPeakDbov,
+      deviceLabel: route.inputs.first?.portName,
+      voiceProcessingEnabled: audioEngine.inputNode.isVoiceProcessingEnabled
+    )
+  }
+
+  private func reportFailure(code: String, error: Error) {
+    stateLock.lock()
+    guard running, !failureReported else {
+      stateLock.unlock()
+      return
+    }
+    let message =
+      (error as? LocalizedError)?.errorDescription
+      ?? error.localizedDescription
+    failureReported = true
+    stateLock.unlock()
+    // Fail closed on the native queue. Flutter will perform the durable session
+    // teardown too, but microphone and playout lifetime must not depend on a
+    // platform-channel callback making a successful round trip.
+    stopOnQueue()
+    onFailure(code, message)
+  }
+
+  private func matchesTargetPCM(_ format: AVAudioFormat) -> Bool {
+    format.commonFormat == .pcmFormatFloat32
+      && format.sampleRate == HuddleAudioFormats.sampleRate
+      && format.channelCount == HuddleAudioFormats.channels
+      && !format.isInterleaved
+  }
+
+  private func numericHistogram(_ values: [Int: Int64]) -> [String: Int64] {
+    Dictionary(uniqueKeysWithValues: values.map { (String($0.key), $0.value) })
+  }
+
+  private func copyPCMBuffer(_ source: AVAudioPCMBuffer) -> AVAudioPCMBuffer? {
+    guard
+      let copy = AVAudioPCMBuffer(
+        pcmFormat: source.format,
+        frameCapacity: source.frameLength
+      )
+    else { return nil }
+    copy.frameLength = source.frameLength
+    let sourceBuffers = UnsafeMutableAudioBufferListPointer(
+      source.mutableAudioBufferList
+    )
+    let destinationBuffers = UnsafeMutableAudioBufferListPointer(
+      copy.mutableAudioBufferList
+    )
+    guard sourceBuffers.count == destinationBuffers.count else { return nil }
+    for index in sourceBuffers.indices {
+      let sourceBuffer = sourceBuffers[index]
+      let destinationBuffer = destinationBuffers[index]
+      guard
+        let sourceData = sourceBuffer.mData,
+        let destinationData = destinationBuffer.mData
+      else { return nil }
+      let byteCount = Int(sourceBuffer.mDataByteSize)
+      memcpy(destinationData, sourceData, byteCount)
+    }
+    return copy
+  }
+}
+
+private final class HuddlePeerPlayback {
+  private let player: AVAudioPlayerNode
+  private let decoder: HuddleOpusDecoder
+  private var jitterQueue = HuddlePacketJitterQueue(
+    capacity: 10,
+    startPackets: 3
+  )
+
+  init(
+    engine: AVAudioEngine,
+    pcmFormat: AVAudioFormat
+  ) throws {
+    decoder = try HuddleOpusDecoder()
+    let player = AVAudioPlayerNode()
+    self.player = player
+    engine.attach(player)
+    do {
+      engine.connect(player, to: engine.mainMixerNode, format: pcmFormat)
+      player.play()
+    } catch {
+      player.stop()
+      engine.disconnectNodeOutput(player)
+      engine.detach(player)
+      throw error
+    }
+  }
+
+  func enqueue(_ packet: HuddleRemoteOpusPacket) {
+    jitterQueue.enqueue(packet)
+  }
+
+  func drainOne() throws {
+    guard let packet = jitterQueue.drainOne() else { return }
+    let decoded = try decoder.decode(packet.opus)
+    player.scheduleBuffer(decoded)
+    if !player.isPlaying {
+      player.play()
+    }
+  }
+
+  func pause() {
+    if player.isPlaying {
+      player.pause()
+    }
+  }
+
+  func resume() {
+    if !player.isPlaying {
+      player.play()
+    }
+  }
+
+  func release(from engine: AVAudioEngine) {
+    player.stop()
+    engine.disconnectNodeOutput(player)
+    engine.detach(player)
+    jitterQueue = HuddlePacketJitterQueue(capacity: 10, startPackets: 3)
+  }
+}
diff --git a/mobile/ios/Runner/HuddleMediaPlugin.swift b/mobile/ios/Runner/HuddleMediaPlugin.swift
new file mode 100644
index 00000000000..6f15bae720d
--- /dev/null
+++ b/mobile/ios/Runner/HuddleMediaPlugin.swift
@@ -0,0 +1,564 @@
+import AVFoundation
+import Flutter
+import UIKit
+
+/// Foreground-only native seam for iOS Huddle media.
+///
+/// Owns microphone permission, the voice-processing audio session, native
+/// Opus capture/playout, interruptions, and the built-in output toggle.
+final class HuddleMediaPlugin {
+  private let channel: FlutterMethodChannel
+  private let audioSession = AVAudioSession.sharedInstance()
+  private var audioSessionPrepared = false
+  private var speakerEnabled = false
+  private var audioEngine: HuddleAudioEngine?
+  private var interruptionObserver: NSObjectProtocol?
+  private var mediaServicesResetObserver: NSObjectProtocol?
+
+  init(messenger: FlutterBinaryMessenger) {
+    channel = FlutterMethodChannel(
+      name: "buzz/huddle_media",
+      binaryMessenger: messenger
+    )
+    channel.setMethodCallHandler { [weak self] call, result in
+      self?.handle(call, result: result)
+    }
+    interruptionObserver = NotificationCenter.default.addObserver(
+      forName: AVAudioSession.interruptionNotification,
+      object: audioSession,
+      queue: .main
+    ) { [weak self] notification in
+      self?.handleInterruption(notification)
+    }
+    mediaServicesResetObserver = NotificationCenter.default.addObserver(
+      forName: AVAudioSession.mediaServicesWereResetNotification,
+      object: audioSession,
+      queue: .main
+    ) { [weak self] _ in
+      self?.handleMediaServicesReset()
+    }
+  }
+
+  deinit {
+    channel.setMethodCallHandler(nil)
+    audioEngine?.stop()
+    audioEngine = nil
+    if let interruptionObserver {
+      NotificationCenter.default.removeObserver(interruptionObserver)
+    }
+    if let mediaServicesResetObserver {
+      NotificationCenter.default.removeObserver(mediaServicesResetObserver)
+    }
+    if audioSessionPrepared {
+      try? audioSession.overrideOutputAudioPort(.none)
+      try? audioSession.setActive(
+        false,
+        options: [.notifyOthersOnDeactivation]
+      )
+    }
+  }
+
+  private func handle(
+    _ call: FlutterMethodCall,
+    result: @escaping FlutterResult
+  ) {
+    switch call.method {
+    case "getCapabilities":
+      result(capabilities)
+    case "requestMicrophonePermission":
+      requestMicrophonePermission(result: result)
+    case "openSystemSettings":
+      openSystemSettings(result: result)
+    case "prepare":
+      prepare(arguments: call.arguments, result: result)
+    case "start":
+      start(result: result)
+    case "setMuted":
+      setMuted(arguments: call.arguments, result: result)
+    case "setSpeakerEnabled":
+      setSpeakerEnabled(arguments: call.arguments, result: result)
+    case "playRemoteOpusFrame":
+      playRemoteOpusFrame(arguments: call.arguments, result: result)
+    case "removeRemotePeer":
+      removeRemotePeer(arguments: call.arguments, result: result)
+    case "stop":
+      stop(result: result)
+    default:
+      result(FlutterMethodNotImplemented)
+    }
+  }
+
+  private var capabilities: [String: Any] {
+    let supportsOpus = HuddleAudioEngine.isSupported()
+    return [
+      "platform": "ios",
+      "audioSession": true,
+      "microphonePermission": true,
+      "capture": supportsOpus,
+      "playback": supportsOpus,
+      "opusEncoding": supportsOpus,
+      "opusDecoding": supportsOpus,
+    ]
+  }
+
+  private func requestMicrophonePermission(result: @escaping FlutterResult) {
+    switch audioSession.recordPermission {
+    case .granted:
+      result("granted")
+    case .denied:
+      result("denied")
+    case .undetermined:
+      audioSession.requestRecordPermission { granted in
+        DispatchQueue.main.async {
+          result(granted ? "granted" : "denied")
+        }
+      }
+    @unknown default:
+      result("restricted")
+    }
+  }
+
+  /// Open the iOS Settings app on this app's page so the user can grant a
+  /// previously denied microphone permission. iOS never re-prompts once denied,
+  /// so this is the only in-app recovery path.
+  private func openSystemSettings(result: @escaping FlutterResult) {
+    guard let url = URL(string: UIApplication.openSettingsURLString) else {
+      result(false)
+      return
+    }
+    DispatchQueue.main.async {
+      guard UIApplication.shared.canOpenURL(url) else {
+        result(false)
+        return
+      }
+      UIApplication.shared.open(url, options: [:]) { opened in
+        result(opened)
+      }
+    }
+  }
+
+  private func prepare(arguments: Any?, result: @escaping FlutterResult) {
+    guard let values = arguments as? [String: Any],
+      (values["protocolVersion"] as? NSNumber)?.intValue == 3,
+      (values["sampleRateHz"] as? NSNumber)?.intValue == 48_000,
+      (values["channels"] as? NSNumber)?.intValue == 1,
+      (values["frameSamples"] as? NSNumber)?.intValue == 960
+    else {
+      result(
+        FlutterError(
+          code: "invalid_configuration",
+          message: "Expected the fixed Huddle Opus v3 media configuration.",
+          details: nil
+        )
+      )
+      return
+    }
+    guard HuddleAudioEngine.isSupported() else {
+      result(
+        FlutterError(
+          code: "unsupported",
+          message: "This iOS device does not expose native Opus encode/decode.",
+          details: nil
+        )
+      )
+      return
+    }
+    guard audioSession.recordPermission == .granted else {
+      result(
+        FlutterError(
+          code: "microphone_permission_denied",
+          message: "Microphone permission is required for a Huddle.",
+          details: nil
+        )
+      )
+      return
+    }
+
+    do {
+      try audioSession.setCategory(
+        .playAndRecord,
+        mode: .voiceChat,
+        options: [.allowBluetoothHFP]
+      )
+      try audioSession.setPreferredSampleRate(48_000)
+      try audioSession.setPreferredIOBufferDuration(0.02)
+      try audioSession.setActive(true)
+      try audioSession.overrideOutputAudioPort(.none)
+      audioSessionPrepared = true
+      speakerEnabled = false
+      result([
+        "audioSessionPrepared": true,
+        "sampleRateHz": Int(audioSession.sampleRate),
+        "channels": 1,
+        "frameSamples": 960,
+      ])
+    } catch {
+      audioSessionPrepared = false
+      try? audioSession.overrideOutputAudioPort(.none)
+      try? audioSession.setActive(
+        false,
+        options: [.notifyOthersOnDeactivation]
+      )
+      result(
+        FlutterError(
+          code: "audio_session_failed",
+          message: "Unable to prepare the iOS Huddle audio session.",
+          details: error.localizedDescription
+        )
+      )
+    }
+  }
+
+  private func start(result: @escaping FlutterResult) {
+    guard audioSessionPrepared else {
+      result(
+        FlutterError(
+          code: "invalid_state",
+          message: "Prepare Huddle audio before starting it.",
+          details: nil
+        )
+      )
+      return
+    }
+    guard audioEngine == nil else {
+      result(
+        FlutterError(
+          code: "invalid_state",
+          message: "Huddle audio is already running.",
+          details: nil
+        )
+      )
+      return
+    }
+
+    do {
+      let engine = try HuddleAudioEngine(
+        onLocalPacket: { [weak self] packet in
+          self?.emitLocalPacket(packet)
+        },
+        onFailure: { [weak self] code, message in
+          self?.emitNativeFailure(code: code, message: message)
+        },
+        onDiagnostics: { [weak self] diagnostics in
+          self?.emitCaptureDiagnostics(diagnostics)
+        },
+        diagnosticsEnabled: Self.diagnosticsEnabled
+      )
+      try engine.start()
+      audioEngine = engine
+      result(nil)
+    } catch {
+      result(
+        FlutterError(
+          code: "media_start_failed",
+          message: "Unable to start iOS Huddle audio.",
+          details: error.localizedDescription
+        )
+      )
+    }
+  }
+
+  private func setMuted(arguments: Any?, result: @escaping FlutterResult) {
+    guard let values = arguments as? [String: Any],
+      let muted = values["muted"] as? Bool
+    else {
+      result(
+        FlutterError(
+          code: "invalid_arguments",
+          message: "Missing Huddle mute state.",
+          details: nil
+        )
+      )
+      return
+    }
+    do {
+      guard let audioEngine else {
+        throw HuddleNativeMediaError.invalidState(
+          "Huddle audio is not running."
+        )
+      }
+      try audioEngine.setMuted(muted)
+      result(nil)
+    } catch {
+      result(
+        FlutterError(
+          code: "invalid_state",
+          message: error.localizedDescription,
+          details: nil
+        )
+      )
+    }
+  }
+
+  private func setSpeakerEnabled(
+    arguments: Any?,
+    result: @escaping FlutterResult
+  ) {
+    guard audioSessionPrepared, audioEngine != nil else {
+      result(
+        FlutterError(
+          code: "invalid_state",
+          message: "Huddle audio is not running.",
+          details: nil
+        )
+      )
+      return
+    }
+    guard let values = arguments as? [String: Any],
+      let enabled = values["enabled"] as? Bool
+    else {
+      result(
+        FlutterError(
+          code: "invalid_arguments",
+          message: "Missing Huddle speaker state.",
+          details: nil
+        )
+      )
+      return
+    }
+
+    do {
+      try audioSession.overrideOutputAudioPort(enabled ? .speaker : .none)
+      speakerEnabled = enabled
+      result(nil)
+    } catch {
+      result(
+        FlutterError(
+          code: "audio_route_failed",
+          message: "Unable to change Huddle audio output.",
+          details: error.localizedDescription
+        )
+      )
+    }
+  }
+
+  private func playRemoteOpusFrame(
+    arguments: Any?,
+    result: @escaping FlutterResult
+  ) {
+    guard let values = arguments as? [String: Any],
+      let peerIndex = (values["peerIndex"] as? NSNumber)?.intValue,
+      (0...255).contains(peerIndex),
+      let sequence = (values["sequence"] as? NSNumber)?.intValue,
+      (0...0xffff).contains(sequence),
+      let timestamp = (values["timestamp48k"] as? NSNumber)?.int64Value,
+      (0...Int64(UInt32.max)).contains(timestamp),
+      let levelDbov = (values["levelDbov"] as? NSNumber)?.intValue,
+      (-127...0).contains(levelDbov),
+      let typedData = values["opus"] as? FlutterStandardTypedData,
+      !typedData.data.isEmpty,
+      typedData.data.count <= HuddleAudioFormats.maximumOpusPacketBytes
+    else {
+      result(
+        FlutterError(
+          code: "invalid_arguments",
+          message: "Malformed remote Huddle Opus packet.",
+          details: nil
+        )
+      )
+      return
+    }
+
+    do {
+      guard let audioEngine else {
+        throw HuddleNativeMediaError.invalidState(
+          "Huddle audio is not running."
+        )
+      }
+      try audioEngine.enqueueRemote(
+        HuddleRemoteOpusPacket(
+          peerIndex: peerIndex,
+          sequence: sequence,
+          timestamp48k: timestamp,
+          levelDbov: levelDbov,
+          opus: typedData.data
+        )
+      )
+      result(nil)
+    } catch {
+      result(
+        FlutterError(
+          code: "playback_failed",
+          message: error.localizedDescription,
+          details: nil
+        )
+      )
+    }
+  }
+
+  private func removeRemotePeer(
+    arguments: Any?,
+    result: @escaping FlutterResult
+  ) {
+    guard let values = arguments as? [String: Any],
+      let peerIndex = (values["peerIndex"] as? NSNumber)?.intValue,
+      (0...255).contains(peerIndex)
+    else {
+      result(
+        FlutterError(
+          code: "invalid_arguments",
+          message: "Missing Huddle peer index.",
+          details: nil
+        )
+      )
+      return
+    }
+    guard let audioEngine else {
+      result(
+        FlutterError(
+          code: "invalid_state",
+          message: "Huddle audio is not running.",
+          details: nil
+        )
+      )
+      return
+    }
+    audioEngine.removeRemotePeer(peerIndex)
+    result(nil)
+  }
+
+  private func handleInterruption(_ notification: Notification) {
+    guard audioSessionPrepared,
+      let rawType = notification.userInfo?[AVAudioSessionInterruptionTypeKey]
+        as? NSNumber,
+      let type = AVAudioSession.InterruptionType(rawValue: rawType.uintValue)
+    else { return }
+
+    if type == .began {
+      audioEngine?.setInterrupted(true)
+      emitInterruptionChanged(true)
+      return
+    }
+    let rawOptions =
+      notification.userInfo?[AVAudioSessionInterruptionOptionKey]
+      as? NSNumber
+    let options = AVAudioSession.InterruptionOptions(
+      rawValue: rawOptions?.uintValue ?? 0
+    )
+    guard options.contains(.shouldResume) else { return }
+    do {
+      try audioSession.setActive(true)
+      if speakerEnabled {
+        try audioSession.overrideOutputAudioPort(.speaker)
+      }
+      audioEngine?.setInterrupted(false)
+      emitInterruptionChanged(false)
+    } catch {
+      emitNativeFailure(
+        code: "audio_resume_failed",
+        message: "Unable to resume iOS Huddle audio after interruption."
+      )
+    }
+  }
+
+  private func handleMediaServicesReset() {
+    guard audioSessionPrepared || audioEngine != nil else { return }
+    audioEngine?.stop()
+    audioEngine = nil
+    audioSessionPrepared = false
+    speakerEnabled = false
+    emitNativeFailure(
+      code: "media_services_reset",
+      message: "iOS audio services restarted. Rejoin the Huddle to continue."
+    )
+  }
+
+  private func stop(result: @escaping FlutterResult) {
+    audioEngine?.stop()
+    audioEngine = nil
+    guard audioSessionPrepared else {
+      speakerEnabled = false
+      result(nil)
+      return
+    }
+    do {
+      try audioSession.overrideOutputAudioPort(.none)
+      try audioSession.setActive(
+        false,
+        options: [.notifyOthersOnDeactivation]
+      )
+      audioSessionPrepared = false
+      speakerEnabled = false
+      result(nil)
+    } catch {
+      result(
+        FlutterError(
+          code: "audio_session_stop_failed",
+          message: "Unable to stop the iOS Huddle audio session.",
+          details: error.localizedDescription
+        )
+      )
+    }
+  }
+
+  private func emitLocalPacket(_ packet: HuddleLocalOpusPacket) {
+    DispatchQueue.main.async { [weak self] in
+      guard self?.audioEngine != nil else { return }
+      self?.channel.invokeMethod(
+        "localOpusFrame",
+        arguments: [
+          "sequence": packet.sequence,
+          "timestamp48k": packet.timestamp48k,
+          "levelDbov": packet.levelDbov,
+          "flags": packet.flags,
+          "opus": FlutterStandardTypedData(bytes: packet.opus),
+        ]
+      )
+    }
+  }
+
+  private func emitNativeFailure(code: String, message: String) {
+    DispatchQueue.main.async { [weak self] in
+      guard self?.audioEngine != nil || code == "media_services_reset" else {
+        return
+      }
+      self?.channel.invokeMethod(
+        "nativeError",
+        arguments: ["code": code, "message": message]
+      )
+    }
+  }
+
+  private func emitCaptureDiagnostics(
+    _ diagnostics: HuddleCaptureDiagnostics
+  ) {
+    DispatchQueue.main.async { [weak self] in
+      guard self?.audioEngine != nil else { return }
+      self?.channel.invokeMethod(
+        "captureDiagnostics",
+        arguments: [
+          "frameCount": diagnostics.frameCount,
+          "rmsDbovHistogram": diagnostics.rmsDbovHistogram,
+          "peakDbovHistogram": diagnostics.peakDbovHistogram,
+          "maxPeakDbov": diagnostics.maxPeakDbov,
+          "audioSource": 0,
+          "audioSourceLabel": "voice_processing_io",
+          "deviceId": nil,
+          "deviceType": nil,
+          "deviceLabel": diagnostics.deviceLabel,
+          "acousticEchoCancelerAvailable": true,
+          "acousticEchoCancelerEnabled": diagnostics.voiceProcessingEnabled,
+          "noiseSuppressorAvailable": false,
+          "noiseSuppressorEnabled": nil,
+          "automaticGainControlAvailable": false,
+          "automaticGainControlEnabled": nil,
+        ]
+      )
+    }
+  }
+
+  private func emitInterruptionChanged(_ interrupted: Bool) {
+    channel.invokeMethod(
+      "interruptionChanged",
+      arguments: ["interrupted": interrupted]
+    )
+  }
+
+  private static var diagnosticsEnabled: Bool {
+    #if DEBUG
+      true
+    #else
+      false
+    #endif
+  }
+}
diff --git a/mobile/ios/Runner/Info.plist b/mobile/ios/Runner/Info.plist
index 80292ff8bb7..af42ebd34b6 100644
--- a/mobile/ios/Runner/Info.plist
+++ b/mobile/ios/Runner/Info.plist
@@ -47,6 +47,8 @@
 	<string>Buzz uses Face ID to confirm sensitive identity transfers.</string>
 	<key>NSCameraUsageDescription</key>
 	<string>Buzz needs camera access so you can take photos to attach to messages and scan QR codes for device pairing.</string>
+	<key>NSMicrophoneUsageDescription</key>
+	<string>Buzz needs microphone access so you can speak in Huddles.</string>
 	<key>NSPhotoLibraryUsageDescription</key>
 	<string>Buzz needs photo library access so you can attach images to messages.</string>
 	<key>NSPhotoLibraryAddUsageDescription</key>
diff --git a/mobile/ios/Runner/JumpToLatestGlassButton.swift b/mobile/ios/Runner/JumpToLatestGlassButton.swift
index 0e96a78ec0c..f613dea7119 100644
--- a/mobile/ios/Runner/JumpToLatestGlassButton.swift
+++ b/mobile/ios/Runner/JumpToLatestGlassButton.swift
@@ -40,6 +40,24 @@ private final class JumpToLatestGlassButton: UIButton {
   }
 }
 
+final class NavigationGlassButton: UIButton {
+  var hitTargetInsets = UIEdgeInsets.zero
+
+  override func point(inside point: CGPoint, with event: UIEvent?) -> Bool {
+    guard isEnabled, isUserInteractionEnabled, !isHidden, alpha > 0.01 else {
+      return false
+    }
+    return bounds
+      .inset(by: UIEdgeInsets(
+        top: -hitTargetInsets.top,
+        left: -hitTargetInsets.left,
+        bottom: -hitTargetInsets.bottom,
+        right: -hitTargetInsets.right
+      ))
+      .contains(point)
+  }
+}
+
 final class JumpToLatestGlassButtonPlatformView: NSObject, FlutterPlatformView {
   private let containerView: UIView
   private let channel: FlutterMethodChannel
@@ -123,3 +141,201 @@ final class JumpToLatestGlassButtonPlatformView: NSObject, FlutterPlatformView {
     channel.setMethodCallHandler(nil)
   }
 }
+
+final class NavigationGlassButtonFactory: NSObject, FlutterPlatformViewFactory {
+  private let messenger: FlutterBinaryMessenger
+
+  init(messenger: FlutterBinaryMessenger) {
+    self.messenger = messenger
+    super.init()
+  }
+
+  func createArgsCodec() -> FlutterMessageCodec & NSObjectProtocol {
+    FlutterStandardMessageCodec.sharedInstance()
+  }
+
+  func create(
+    withFrame frame: CGRect,
+    viewIdentifier viewId: Int64,
+    arguments args: Any?
+  ) -> FlutterPlatformView {
+    NavigationGlassButtonPlatformView(
+      frame: frame,
+      viewIdentifier: viewId,
+      arguments: args,
+      messenger: messenger
+    )
+  }
+}
+
+final class NavigationGlassButtonPlatformView: NSObject, FlutterPlatformView {
+  private let containerView: UIView
+  private let channel: FlutterMethodChannel
+  private let button = NavigationGlassButton(type: .system)
+
+  init(
+    frame: CGRect,
+    viewIdentifier viewId: Int64,
+    arguments args: Any?,
+    messenger: FlutterBinaryMessenger
+  ) {
+    containerView = UIView(frame: frame)
+    channel = FlutterMethodChannel(
+      name: "buzz/navigation_glass/\(viewId)",
+      binaryMessenger: messenger
+    )
+    super.init()
+
+    containerView.backgroundColor = .clear
+    containerView.isOpaque = false
+    let arguments = args as? [String: Any]
+    let buttonCenterX =
+      (arguments?["buttonCenterX"] as? NSNumber)?.doubleValue ?? 24
+    let hitTargetWidth =
+      (arguments?["hitTargetWidth"] as? NSNumber)?.doubleValue ?? 48
+    let hitTargetHeight =
+      (arguments?["hitTargetHeight"] as? NSNumber)?.doubleValue ?? 48
+    let icon = arguments?["icon"] as? String
+    let symbolName = icon == "close" ? "xmark" : "chevron.backward"
+
+    var configuration: UIButton.Configuration
+    if #available(iOS 26.0, *) {
+      configuration = .glass()
+    } else {
+      configuration = .gray()
+      configuration.baseBackgroundColor = UIColor.secondarySystemBackground
+    }
+    configuration.cornerStyle = .capsule
+    configuration.image = UIImage(
+      systemName: symbolName,
+      withConfiguration: UIImage.SymbolConfiguration(
+        pointSize: 17,
+        weight: .semibold
+      )
+    )
+    button.configuration = configuration
+    button.hitTargetInsets = UIEdgeInsets(
+      top: max(0, (hitTargetHeight - 40) / 2),
+      left: max(0, buttonCenterX - 20),
+      bottom: max(0, (hitTargetHeight - 40) / 2),
+      right: max(0, hitTargetWidth - buttonCenterX - 20)
+    )
+    button.accessibilityLabel = arguments?["accessibilityLabel"] as? String ?? "Back"
+    button.translatesAutoresizingMaskIntoConstraints = false
+    button.addAction(
+      UIAction { [weak self] _ in
+        self?.channel.invokeMethod("pressed", arguments: nil)
+      },
+      for: .touchUpInside
+    )
+
+    applyAppearance(from: args)
+    channel.setMethodCallHandler { [weak self] call, result in
+      guard call.method == "setAppearance" else {
+        result(FlutterMethodNotImplemented)
+        return
+      }
+      self?.applyAppearance(from: call.arguments)
+      result(nil)
+    }
+
+    containerView.addSubview(button)
+    NSLayoutConstraint.activate([
+      button.centerXAnchor.constraint(
+        equalTo: containerView.leadingAnchor,
+        constant: buttonCenterX
+      ),
+      button.centerYAnchor.constraint(equalTo: containerView.centerYAnchor),
+      button.widthAnchor.constraint(equalToConstant: 40),
+      button.heightAnchor.constraint(equalToConstant: 40),
+    ])
+  }
+
+  func view() -> UIView {
+    containerView
+  }
+
+  /// Returns the pre-iOS-26 surface that maximizes contrast with the requested
+  /// foreground while preserving the system surface when it already passes.
+  static func fallbackBackgroundColor(
+    foregroundColor: UIColor?,
+    interfaceStyle: UIUserInterfaceStyle
+  ) -> UIColor {
+    let traits = UITraitCollection(userInterfaceStyle: interfaceStyle)
+    let backgroundColor = UIColor.secondarySystemBackground.resolvedColor(with: traits)
+    guard interfaceStyle != .dark, let foregroundColor else { return backgroundColor }
+    let resolvedForeground = foregroundColor.resolvedColor(with: traits)
+    if contrastRatio(foregroundColor: resolvedForeground, backgroundColor: backgroundColor) >= 3 {
+      return backgroundColor
+    }
+    return .black
+  }
+
+  static func contrastRatio(
+    foregroundColor: UIColor,
+    backgroundColor: UIColor
+  ) -> CGFloat {
+    guard
+      let foregroundLuminance = relativeLuminance(of: foregroundColor),
+      let backgroundLuminance = relativeLuminance(of: backgroundColor)
+    else { return 1 }
+    let lighter = max(foregroundLuminance, backgroundLuminance)
+    let darker = min(foregroundLuminance, backgroundLuminance)
+    return (lighter + 0.05) / (darker + 0.05)
+  }
+
+  private static func relativeLuminance(of color: UIColor) -> CGFloat? {
+    var red: CGFloat = 0
+    var green: CGFloat = 0
+    var blue: CGFloat = 0
+    var alpha: CGFloat = 0
+    guard color.getRed(&red, green: &green, blue: &blue, alpha: &alpha) else {
+      return nil
+    }
+
+    func linearize(_ component: CGFloat) -> CGFloat {
+      component <= 0.04045
+        ? component / 12.92
+        : pow((component + 0.055) / 1.055, 2.4)
+    }
+
+    return 0.2126 * linearize(red) +
+      0.7152 * linearize(green) +
+      0.0722 * linearize(blue)
+  }
+
+  private func applyAppearance(from value: Any?) {
+    let arguments = value as? [String: Any]
+    let brightness = arguments?["brightness"] as? String
+    let interfaceStyle: UIUserInterfaceStyle = brightness == "dark" ? .dark : .light
+    let colorValue = (arguments?["foregroundColor"] as? NSNumber)?.uint32Value
+    let foregroundColor = colorValue.map(Self.color(from:))
+    let enabled = arguments?["enabled"] as? Bool ?? true
+
+    containerView.overrideUserInterfaceStyle = interfaceStyle
+    button.overrideUserInterfaceStyle = interfaceStyle
+    button.isEnabled = enabled
+    if let foregroundColor {
+      button.configuration?.baseForegroundColor = foregroundColor
+    }
+    if #unavailable(iOS 26.0) {
+      button.configuration?.baseBackgroundColor = Self.fallbackBackgroundColor(
+        foregroundColor: foregroundColor,
+        interfaceStyle: interfaceStyle
+      )
+    }
+    button.setNeedsUpdateConfiguration()
+  }
+
+  private static func color(from value: UInt32) -> UIColor {
+    let alpha = CGFloat((value >> 24) & 0xFF) / 255
+    let red = CGFloat((value >> 16) & 0xFF) / 255
+    let green = CGFloat((value >> 8) & 0xFF) / 255
+    let blue = CGFloat(value & 0xFF) / 255
+    return UIColor(red: red, green: green, blue: blue, alpha: alpha)
+  }
+
+  deinit {
+    channel.setMethodCallHandler(nil)
+  }
+}
diff --git a/mobile/ios/RunnerTests/RunnerTests.swift b/mobile/ios/RunnerTests/RunnerTests.swift
index 01f4c89b2cc..65087046711 100644
--- a/mobile/ios/RunnerTests/RunnerTests.swift
+++ b/mobile/ios/RunnerTests/RunnerTests.swift
@@ -7,6 +7,150 @@ import XCTest
 
 class RunnerTests: XCTestCase {
 
+  func testHuddleActiveTalkerSelectorBoundsAndReactivates() {
+    var selector = HuddleActiveTalkerSelector(capacity: 15)
+
+    for peer in 0..<15 {
+      XCTAssertEqual(
+        selector.activate(peerIndex: peer, levelDbov: -20),
+        HuddleTalkerSelection(accepted: true, evictedPeerIndex: nil)
+      )
+    }
+    let rejected = selector.activate(peerIndex: 15, levelDbov: -20)
+    XCTAssertEqual(
+      rejected,
+      HuddleTalkerSelection(accepted: false, evictedPeerIndex: nil)
+    )
+    var allocationCount = 0
+    XCTAssertNil(rejected.allocateIfAccepted {
+      allocationCount += 1
+      return NSObject()
+    })
+    XCTAssertEqual(allocationCount, 0)
+    XCTAssertEqual(Set(selector.active.keys), Set(0..<15))
+
+    selector.remove(7)
+    XCTAssertFalse(selector.active.keys.contains(7))
+    XCTAssertEqual(
+      selector.activate(peerIndex: 7, levelDbov: -10),
+      HuddleTalkerSelection(accepted: true, evictedPeerIndex: nil)
+    )
+    XCTAssertTrue(selector.active.keys.contains(7))
+  }
+
+  func testHuddleActiveTalkerSelectorUsesRecentActivity() {
+    var selector = HuddleActiveTalkerSelector(capacity: 2)
+
+    XCTAssertEqual(
+      selector.activate(peerIndex: 4, levelDbov: -10),
+      HuddleTalkerSelection(accepted: true, evictedPeerIndex: nil)
+    )
+    XCTAssertEqual(
+      selector.activate(peerIndex: 2, levelDbov: -20),
+      HuddleTalkerSelection(accepted: true, evictedPeerIndex: nil)
+    )
+    XCTAssertEqual(
+      selector.activate(peerIndex: 4, levelDbov: -10),
+      HuddleTalkerSelection(accepted: true, evictedPeerIndex: nil)
+    )
+    XCTAssertEqual(
+      selector.activate(peerIndex: 9, levelDbov: -5),
+      HuddleTalkerSelection(accepted: true, evictedPeerIndex: 2)
+    )
+    XCTAssertEqual(Set(selector.active.keys), Set([4, 9]))
+  }
+
+  func testHuddleActiveTalkerSelectorDoesNotChurnAtEqualLevels() {
+    var selector = HuddleActiveTalkerSelector(capacity: 2)
+
+    XCTAssertEqual(
+      selector.activate(peerIndex: 4, levelDbov: -127),
+      HuddleTalkerSelection(accepted: true, evictedPeerIndex: nil)
+    )
+    XCTAssertEqual(
+      selector.activate(peerIndex: 2, levelDbov: -127),
+      HuddleTalkerSelection(accepted: true, evictedPeerIndex: nil)
+    )
+    let rejected = selector.activate(peerIndex: 9, levelDbov: -127)
+    XCTAssertEqual(
+      rejected,
+      HuddleTalkerSelection(accepted: false, evictedPeerIndex: nil)
+    )
+    XCTAssertNil(rejected.allocateIfAccepted { NSObject() })
+    XCTAssertNil(selector.active[9])
+    XCTAssertEqual(Set(selector.active.keys), Set([2, 4]))
+  }
+
+  func testHuddleActiveTalkerSelectorExpiresInactiveSlots() {
+    var now: TimeInterval = 0
+    var selector = HuddleActiveTalkerSelector(
+      capacity: 2,
+      now: { now },
+      inactivityTimeout: 1
+    )
+
+    _ = selector.activate(peerIndex: 4, levelDbov: -10)
+    now = 0.999
+    _ = selector.activate(peerIndex: 2, levelDbov: -5)
+    now = 1
+
+    XCTAssertEqual(
+      selector.activate(peerIndex: 9, levelDbov: -30),
+      HuddleTalkerSelection(accepted: true, evictedPeerIndex: 4)
+    )
+    XCTAssertEqual(Set(selector.active.keys), Set([2, 9]))
+  }
+
+  func testHuddlePacketJitterQueueReordersAndRejectsStaleDuplicates() {
+    var queue = HuddlePacketJitterQueue(capacity: 3, startPackets: 2)
+    queue.enqueue(remotePacket(sequence: 11))
+    queue.enqueue(remotePacket(sequence: 10))
+    XCTAssertEqual(queue.packets.map(\.sequence), [10, 11])
+    XCTAssertEqual(queue.drainOne()?.sequence, 10)
+    queue.enqueue(remotePacket(sequence: 10))
+    queue.enqueue(remotePacket(sequence: 12))
+    XCTAssertEqual(queue.packets.map(\.sequence), [11, 12])
+  }
+
+  private func remotePacket(sequence: Int) -> HuddleRemoteOpusPacket {
+    HuddleRemoteOpusPacket(
+      peerIndex: 1,
+      sequence: sequence,
+      timestamp48k: Int64(sequence * 960),
+      levelDbov: -20,
+      opus: Data([1])
+    )
+  }
+
+  func testHuddleOpusCodecRoundTripsFixedV2Frame() throws {
+    let encoder = try HuddleOpusEncoder()
+    let decoder = try HuddleOpusDecoder()
+    let samples = (0..<HuddleAudioFormats.frameSamples).map { index in
+      Float(sin(2 * .pi * 440 * Double(index) / HuddleAudioFormats.sampleRate))
+    }
+
+    let packet = try encoder.encode(samples)
+    let decoded = try decoder.decode(packet)
+
+    XCTAssertFalse(packet.isEmpty)
+    XCTAssertLessThanOrEqual(packet.count, HuddleAudioFormats.maximumOpusPacketBytes)
+    XCTAssertGreaterThan(decoded.frameLength, 0)
+    XCTAssertLessThanOrEqual(
+      decoded.frameLength,
+      AVAudioFrameCount(HuddleAudioFormats.frameSamples)
+    )
+  }
+
+  func testHuddleAudioLevelsReportDbovWithoutPersistingAudio() {
+    let silence = Array(repeating: Float.zero, count: HuddleAudioFormats.frameSamples)
+    let halfScale = Array(repeating: Float(0.5), count: HuddleAudioFormats.frameSamples)
+
+    XCTAssertEqual(HuddleAudioLevels.rmsDbov(silence), -127)
+    XCTAssertEqual(HuddleAudioLevels.peakDbov(silence), -127)
+    XCTAssertEqual(HuddleAudioLevels.rmsDbov(halfScale), -6)
+    XCTAssertEqual(HuddleAudioLevels.peakDbov(halfScale), -6)
+  }
+
   func testRelativeTrackInsertionTimesPreserveAudioDelay() {
     let times = AppDelegate.relativeTrackInsertionTimes(
       videoStart: CMTime(seconds: 1, preferredTimescale: 600),
diff --git a/mobile/lib/app.dart b/mobile/lib/app.dart
index f2726b9f13a..e020bd50bff 100644
--- a/mobile/lib/app.dart
+++ b/mobile/lib/app.dart
@@ -12,6 +12,7 @@ import 'features/home/home_page.dart';
 import 'features/invites/invite_create_page.dart';
 import 'features/pairing/pairing_page.dart';
 import 'features/channels/agent_activity/observer_subscription.dart';
+import 'features/channels/channel_detail_page.dart';
 import 'features/channels/deep_link_dispatcher.dart';
 import 'features/profile/user_status_cache_provider.dart';
 import 'features/profile/settings_profile_header.dart';
@@ -46,6 +47,8 @@ final _unreadInboxItemCountProvider = Provider<int>((ref) {
       .length;
 });
 
+final _mobileRootNavigatorKey = GlobalKey<NavigatorState>();
+
 class App extends HookConsumerWidget {
   const App({super.key});
 
@@ -113,6 +116,7 @@ class App extends HookConsumerWidget {
     });
 
     return MaterialApp(
+      navigatorKey: _mobileRootNavigatorKey,
       title: 'Buzz',
       theme: AppTheme.light(
         colorScheme: lightScheme,
@@ -126,8 +130,10 @@ class App extends HookConsumerWidget {
       // Above the navigator, so a burst keeps playing over a pushed thread page
       // or a modal sheet — the same reason desktop pins its canvas to the
       // viewport rather than to the message row.
-      builder: (context, child) =>
-          EmojiBurstOverlay(child: child ?? const SizedBox.shrink()),
+      builder: (context, child) => MobileHuddleShell(
+        navigatorKey: _mobileRootNavigatorKey,
+        child: EmojiBurstOverlay(child: child ?? const SizedBox.shrink()),
+      ),
       home: authState.when(
         loading: () => const _SplashScreen(),
         error: (_, _) => const PairingPage(),
diff --git a/mobile/lib/features/channels/channel_actions_sheet.dart b/mobile/lib/features/channels/channel_actions_sheet.dart
index 14ef456de23..0df6a03863a 100644
--- a/mobile/lib/features/channels/channel_actions_sheet.dart
+++ b/mobile/lib/features/channels/channel_actions_sheet.dart
@@ -16,6 +16,8 @@ import '../../shared/widgets/buzz_action_tile.dart';
 import '../../shared/widgets/buzz_loading_indicator.dart';
 import '../../shared/widgets/frosted_app_bar.dart';
 import '../../shared/widgets/frosted_scaffold.dart';
+import '../../shared/widgets/ios_glass_navigation_button.dart';
+import '../../shared/widgets/lucide_star_icon.dart';
 import '../../shared/widgets/modal_presentation.dart';
 import '../../shared/widgets/sheet_divider.dart';
 import 'channel.dart';
diff --git a/mobile/lib/features/channels/channel_detail_page.dart b/mobile/lib/features/channels/channel_detail_page.dart
index 224094df145..354ee4471e6 100644
--- a/mobile/lib/features/channels/channel_detail_page.dart
+++ b/mobile/lib/features/channels/channel_detail_page.dart
@@ -1,6 +1,7 @@
 import 'dart:async';
-import 'dart:math' show max, min;
+import 'dart:math' show cos, max, min, pi;
 
+import 'package:flutter/foundation.dart';
 import 'package:flutter/material.dart';
 import 'package:flutter/rendering.dart' show ScrollDirection;
 import 'package:flutter_hooks/flutter_hooks.dart';
@@ -9,14 +10,19 @@ import 'package:lucide_icons_flutter/lucide_icons.dart';
 import 'package:scrollable_positioned_list/scrollable_positioned_list.dart';
 
 import '../../shared/animated_avatar.dart';
+import '../../shared/emoji/emoji_burst.dart';
+import '../../shared/huddle/huddle.dart';
 import '../../shared/mentions/agent_identity_provider.dart';
 import '../../shared/relay/relay.dart';
 import '../../shared/theme/theme.dart';
 import '../../shared/widgets/avatar_image.dart';
 import '../../shared/widgets/buzz_loading_indicator.dart';
+import '../../shared/widgets/concentric_sheet_surface.dart';
 import '../../shared/widgets/frosted_app_bar.dart';
 import '../../shared/widgets/frosted_scaffold.dart';
+import '../../shared/widgets/flapping_bee.dart';
 import '../../shared/widgets/keyboard_dismiss_on_drag.dart';
+import '../../shared/widgets/ios_glass_navigation_button.dart';
 import '../../shared/widgets/masked_avatar_badge.dart';
 import '../../shared/widgets/message_author_meta.dart';
 import '../../shared/widgets/modal_presentation.dart';
@@ -44,11 +50,16 @@ import 'date_formatters.dart';
 import 'day_divider.dart';
 import 'dm_channel_labels.dart';
 import 'ephemeral_channel_display.dart';
+import 'emoji_picker.dart';
 import 'ime_metrics_settle_observer.dart';
 import 'jump_to_latest_button.dart';
 import 'jump_to_latest_switcher.dart';
+import 'local_message_send_animation_provider.dart';
+import 'local_message_send_transition.dart';
+import 'mobile_huddle_controller.dart';
 import 'members_sheet.dart';
 import 'message_actions.dart';
+import 'message_action_backdrop_state.dart';
 import 'message_long_press_region.dart';
 import 'message_content.dart';
 import '../../shared/read_state/deferred_read_state_update.dart';
@@ -56,6 +67,7 @@ import '../../shared/read_state/read_state_format.dart';
 import '../../shared/read_state/read_state_provider.dart';
 import '../../shared/read_state/read_state_time.dart';
 import 'reaction_row.dart';
+import 'recent_emoji_provider.dart';
 import 'send_message_provider.dart';
 import '../profile/user_profile_sheet.dart';
 import 'small_avatar.dart';
@@ -65,6 +77,12 @@ import 'timeline_message.dart';
 
 part 'channel_detail_page/message_list.dart';
 part 'channel_detail_page/system_rows.dart';
+part 'channel_detail_page/huddle_sheet.dart';
+part 'channel_detail_page/huddle_call_avatar.dart';
+part 'channel_detail_page/huddle_call_participants.dart';
+part 'channel_detail_page/huddle_call_controls.dart';
+part 'channel_detail_page/huddle_drawer.dart';
+part 'channel_detail_page/huddle_reactions.dart';
 part 'channel_detail_page/message_bubble.dart';
 part 'channel_detail_page/banners.dart';
 part 'channel_detail_page/app_bar.dart';
@@ -158,6 +176,8 @@ class ChannelDetailPage extends HookConsumerWidget {
     final detailsAsync = ref.watch(channelDetailsProvider(channel.id));
     final channelsAsync = ref.watch(channelsProvider);
     final messagesState = ref.watch(channelMessagesProvider(channel.id));
+    final huddleLifecycle =
+        ref.watch(huddleLifecycleProvider(channel.id)).value ?? const [];
     final sessionStatus = ref.watch(relaySessionProvider).status;
     final readState = ref.watch(readStateProvider);
     final channelsNotifier = ref.read(channelsProvider.notifier);
@@ -264,6 +284,9 @@ class ChannelDetailPage extends HookConsumerWidget {
       context,
       isDm: resolvedChannel.isDm,
     );
+    final usesNativeIosGlassBackButton =
+        Navigator.canPop(context) &&
+        Theme.of(context).platform == TargetPlatform.iOS;
     final readTimestamp = _channelReadTimestamp(
       channel: resolvedChannel,
       messagesState: messagesState,
@@ -321,34 +344,60 @@ class ChannelDetailPage extends HookConsumerWidget {
       resizeToAvoidBottomInset:
           !usesFixedAndroidImeViewport || resolvedChannel.isForum,
       appBar: FrostedAppBar(
+        leading: usesNativeIosGlassBackButton
+            ? IosGlassNavigationButton(
+                key: const ValueKey('channel-ios-glass-back'),
+                icon: IosGlassNavigationIcon.back,
+                semanticLabel: 'Back',
+                onPressed: () => Navigator.of(context).maybePop(),
+                width: iosGlassChannelHeaderLeadingWidth,
+                buttonCenterX: iosGlassChannelHeaderButtonCenterX,
+                nativeViewSuppressed: messageActionBackdropActive,
+              )
+            : null,
         iconColor: context.colors.primary,
         titleContentHeight: appBarTitleContentHeight,
         titleStyle: channelTitleTextStyle,
-        title: resolvedChannel.isDm
-            ? _DmAppBarTitle(
-                channel: resolvedChannel,
-                currentPubkey: currentPubkey,
-              )
-            : _ChannelAppBarTitle(
-                channel: resolvedChannel,
-                onTap: () async {
-                  final shouldClose = await showChannelDetailsPage(
-                    context: context,
-                    channel: resolvedChannel,
-                    currentPubkey: currentPubkey,
-                    onMemberTap: showUserProfileSheet,
-                    sectionId: ref
-                        .read(channelSectionsProvider)
-                        .store
-                        .assignments[resolvedChannel.id],
-                  );
-                  if (shouldClose == true && context.mounted) {
-                    Navigator.of(context).pop();
-                  }
-                },
-              ),
+        title: Padding(
+          padding: EdgeInsets.only(
+            left: usesNativeIosGlassBackButton
+                ? iosGlassChannelHeaderTitleSpacing
+                : 0,
+          ),
+          child: resolvedChannel.isDm
+              ? _DmAppBarTitle(
+                  channel: resolvedChannel,
+                  currentPubkey: currentPubkey,
+                )
+              : _ChannelAppBarTitle(
+                  channel: resolvedChannel,
+                  onTap: () async {
+                    final shouldClose = await showChannelDetailsPage(
+                      context: context,
+                      channel: resolvedChannel,
+                      currentPubkey: currentPubkey,
+                      onMemberTap: showUserProfileSheet,
+                      sectionId: ref
+                          .read(channelSectionsProvider)
+                          .store
+                          .assignments[resolvedChannel.id],
+                    );
+                    if (shouldClose == true && context.mounted) {
+                      Navigator.of(context).pop();
+                    }
+                  },
+                ),
+        ),
         actions: resolvedChannel.isDm
             ? [
+                if (showsComposer)
+                  _HuddleButton(
+                    channel: resolvedChannel,
+                    events: [
+                      ...messagesState.value ?? const [],
+                      ...huddleLifecycle,
+                    ],
+                  ),
                 if (_showsMembersAction(resolvedChannel))
                   _MembersButton(
                     channelId: resolvedChannel.id,
@@ -375,7 +424,16 @@ class ChannelDetailPage extends HookConsumerWidget {
                   icon: const Icon(LucideIcons.ellipsisVertical, size: 22),
                 ),
               ]
-            : const [],
+            : [
+                if (showsComposer)
+                  _HuddleButton(
+                    channel: resolvedChannel,
+                    events: [
+                      ...messagesState.value ?? const [],
+                      ...huddleLifecycle,
+                    ],
+                  ),
+              ],
       ),
       body: Stack(
         fit: StackFit.expand,
diff --git a/mobile/lib/features/channels/channel_detail_page/app_bar.dart b/mobile/lib/features/channels/channel_detail_page/app_bar.dart
index bccf8679a7c..4bfea3f2795 100644
--- a/mobile/lib/features/channels/channel_detail_page/app_bar.dart
+++ b/mobile/lib/features/channels/channel_detail_page/app_bar.dart
@@ -23,9 +23,7 @@ double _twoLineAppBarTitleContentHeight(
   BuildContext context, {
   required bool isDm,
 }) {
-  final titleStyle = isDm
-      ? context.textTheme.titleSmall
-      : context.textTheme.titleMedium;
+  final titleStyle = context.textTheme.titleSmall;
   final subtitleStyle = isDm
       ? context.textTheme.bodyMedium
       : context.textTheme.bodySmall;
@@ -68,49 +66,68 @@ class _ChannelAppBarTitle extends ConsumerWidget {
                 width: _channelHeaderAvatarSize,
                 height: _channelHeaderAvatarSize,
                 decoration: BoxDecoration(
-                  color: context.colors.primaryContainer,
+                  color: context.colors.surface,
                   shape: BoxShape.circle,
+                  border: Border.fromBorderSide(
+                    BorderSide(
+                      color: context.colors.inverseSurface.withValues(
+                        alpha: 0.07,
+                      ),
+                      strokeAlign: BorderSide.strokeAlignOutside,
+                    ),
+                  ),
                 ),
                 child: Icon(
                   channelIcon(channel),
                   size: 20,
-                  color: context.colors.onPrimaryContainer,
+                  color: context.colors.primary,
                 ),
               ),
-              const SizedBox(width: Grid.xxs),
+              const SizedBox(width: Grid.twelve),
               Expanded(
-                child: Column(
-                  crossAxisAlignment: CrossAxisAlignment.start,
-                  mainAxisSize: MainAxisSize.min,
-                  children: [
-                    Row(
-                      mainAxisSize: MainAxisSize.min,
-                      children: [
-                        Flexible(
-                          child: Text(
-                            channel.name,
-                            key: const ValueKey('channel-header-name'),
-                            maxLines: 1,
-                            overflow: TextOverflow.ellipsis,
-                            style: context.textTheme.titleMedium,
+                child: ConstrainedBox(
+                  key: const ValueKey('channel-header-text-stack'),
+                  constraints: const BoxConstraints(
+                    minHeight: _channelHeaderAvatarSize,
+                  ),
+                  child: Column(
+                    mainAxisSize: MainAxisSize.min,
+                    crossAxisAlignment: CrossAxisAlignment.start,
+                    mainAxisAlignment: MainAxisAlignment.center,
+                    children: [
+                      Row(
+                        mainAxisSize: MainAxisSize.min,
+                        children: [
+                          Flexible(
+                            child: Text(
+                              channel.name,
+                              key: const ValueKey('channel-header-name'),
+                              maxLines: 1,
+                              overflow: TextOverflow.ellipsis,
+                              style: context.textTheme.titleSmall?.copyWith(
+                                fontWeight: FontWeight.w600,
+                              ),
+                            ),
                           ),
-                        ),
-                        if (channel.isEphemeral) ...[
-                          const SizedBox(width: Grid.quarter),
-                          _HeaderEphemeralBadge(channel: channel),
+                          if (channel.isEphemeral) ...[
+                            const SizedBox(width: Grid.quarter),
+                            _HeaderEphemeralBadge(channel: channel),
+                          ],
                         ],
-                      ],
-                    ),
-                    Text(
-                      memberLabel,
-                      key: const ValueKey('channel-header-member-count'),
-                      maxLines: 1,
-                      overflow: TextOverflow.ellipsis,
-                      style: context.textTheme.bodySmall?.copyWith(
-                        color: context.colors.onSurfaceVariant,
                       ),
-                    ),
-                  ],
+                      Text(
+                        memberLabel,
+                        key: const ValueKey('channel-header-member-count'),
+                        maxLines: 1,
+                        overflow: TextOverflow.ellipsis,
+                        style: context.textTheme.bodySmall?.copyWith(
+                          color: context.colors.onSurface.withValues(
+                            alpha: 0.65,
+                          ),
+                        ),
+                      ),
+                    ],
+                  ),
                 ),
               ),
             ],
diff --git a/mobile/lib/features/channels/channel_detail_page/huddle_call_avatar.dart b/mobile/lib/features/channels/channel_detail_page/huddle_call_avatar.dart
new file mode 100644
index 00000000000..c52d968fa9c
--- /dev/null
+++ b/mobile/lib/features/channels/channel_detail_page/huddle_call_avatar.dart
@@ -0,0 +1,189 @@
+part of '../channel_detail_page.dart';
+
+class _HuddleCallAvatar extends HookConsumerWidget {
+  const _HuddleCallAvatar({
+    required this.pubkey,
+    required this.profile,
+    required this.fallbackLabel,
+    required this.active,
+    required this.speakerLevel,
+    this.isSelf = false,
+    this.frameSize = _huddleAvatarFrameSize,
+  });
+
+  final String pubkey;
+  final UserProfile? profile;
+  final String? fallbackLabel;
+  final bool active;
+  final double speakerLevel;
+  final bool isSelf;
+  final double frameSize;
+
+  @override
+  Widget build(BuildContext context, WidgetRef ref) {
+    final reducedMotion = MediaQuery.disableAnimationsOf(context);
+    final scale = frameSize / _huddleAvatarFrameSize;
+    final avatarRadius = _huddleAvatarRadius * scale;
+    final speakingRingSize = _huddleSpeakingRingSize * scale;
+    final fallbackIconSize = 44 * scale;
+    final normalizedSpeakerLevel = speakerLevel.clamp(0.0, 1.0).toDouble();
+    final haloLevel = active ? 0.08 + normalizedSpeakerLevel * 0.92 : 0.0;
+    final haloController = useAnimationController(
+      initialValue: reducedMotion ? haloLevel : 0,
+    );
+    final animatedHaloLevel = useAnimation(haloController);
+    useEffect(() {
+      haloController.stop();
+      if (reducedMotion) {
+        haloController.value = haloLevel;
+        return null;
+      }
+
+      final isRising = haloLevel > haloController.value;
+      haloController.animateTo(
+        haloLevel,
+        duration: Duration(milliseconds: isRising ? 140 : 220),
+        curve: isRising ? Curves.easeOutCubic : Curves.easeInOutCubic,
+      );
+      return null;
+    }, [haloController, haloLevel, reducedMotion]);
+    final originKey = useMemoized(
+      () => GlobalKey(debugLabel: 'huddle-reaction-origin-$pubkey'),
+      [pubkey],
+    );
+    final originRegistry = ref.read(_huddleAvatarOriginRegistryProvider);
+    useEffect(() {
+      originRegistry.register(pubkey, originKey);
+      return () => originRegistry.unregister(pubkey, originKey);
+    }, [originRegistry, pubkey, originKey]);
+    final showsLabel = useState(false);
+    final profileName = profile?.displayName?.trim();
+    final directoryName = fallbackLabel?.trim();
+    final label = isSelf
+        ? 'You'
+        : (profileName?.isNotEmpty == true ? profileName : null) ??
+              (directoryName?.isNotEmpty == true ? directoryName : null) ??
+              (pubkey.isEmpty ? 'Participant' : shortPubkey(pubkey));
+    void toggleLabel() => showsLabel.value = !showsLabel.value;
+
+    return SizedBox(
+      width: frameSize,
+      child: Semantics(
+        label: active ? '$label, speaking' : label,
+        hint: showsLabel.value
+            ? 'Tap to hide participant name'
+            : 'Tap to show participant name',
+        button: true,
+        onTap: toggleLabel,
+        excludeSemantics: true,
+        child: GestureDetector(
+          key: ValueKey('huddle-participant-avatar-$pubkey'),
+          behavior: HitTestBehavior.opaque,
+          excludeFromSemantics: true,
+          onTap: toggleLabel,
+          child: Column(
+            mainAxisSize: MainAxisSize.min,
+            crossAxisAlignment: CrossAxisAlignment.center,
+            children: [
+              SizedBox.square(
+                key: ValueKey('huddle-speaking-ring-$pubkey'),
+                dimension: frameSize,
+                child: SizedBox.square(
+                  key: originKey,
+                  dimension: frameSize,
+                  child: Stack(
+                    alignment: Alignment.center,
+                    clipBehavior: Clip.none,
+                    children: [
+                      AnimatedOpacity(
+                        key: ValueKey('huddle-speaking-halo-opacity-$pubkey'),
+                        duration: reducedMotion
+                            ? Duration.zero
+                            : Duration(milliseconds: active ? 140 : 220),
+                        curve: active
+                            ? Curves.easeOutCubic
+                            : Curves.easeInOutCubic,
+                        opacity: active ? 1 : 0,
+                        child: Transform.scale(
+                          key: ValueKey('huddle-speaking-halo-scale-$pubkey'),
+                          scale: reducedMotion
+                              ? (active ? 1.15 : 1)
+                              : 1 + animatedHaloLevel * 1.55,
+                          child: Container(
+                            key: ValueKey('huddle-speaking-halo-$pubkey'),
+                            width: speakingRingSize,
+                            height: speakingRingSize,
+                            decoration: BoxDecoration(
+                              shape: BoxShape.circle,
+                              color: context.colors.primary.withValues(
+                                alpha: 0.07,
+                              ),
+                            ),
+                          ),
+                        ),
+                      ),
+                      AvatarImage(
+                        imageUrl: profile?.avatarUrl,
+                        radius: avatarRadius,
+                        backgroundColor: context.colors.primaryContainer,
+                        fallback: Icon(
+                          LucideIcons.userRound,
+                          size: fallbackIconSize,
+                          color: context.colors.onPrimaryContainer,
+                        ),
+                      ),
+                    ],
+                  ),
+                ),
+              ),
+              AnimatedSwitcher(
+                key: ValueKey('huddle-participant-label-reveal-$pubkey'),
+                duration: reducedMotion
+                    ? Duration.zero
+                    : const Duration(milliseconds: 180),
+                reverseDuration: reducedMotion
+                    ? Duration.zero
+                    : const Duration(milliseconds: 140),
+                switchInCurve: Curves.easeOutCubic,
+                switchOutCurve: Curves.easeInCubic,
+                layoutBuilder: (currentChild, previousChildren) => Stack(
+                  alignment: Alignment.topCenter,
+                  children: [...previousChildren, ?currentChild],
+                ),
+                transitionBuilder: (child, animation) => FadeTransition(
+                  opacity: animation,
+                  child: SizeTransition(
+                    sizeFactor: animation,
+                    axisAlignment: -1,
+                    child: child,
+                  ),
+                ),
+                child: showsLabel.value
+                    ? Padding(
+                        key: ValueKey('huddle-participant-label-$pubkey'),
+                        padding: const EdgeInsets.only(top: Grid.half),
+                        child: SizedBox(
+                          width: frameSize,
+                          child: Text(
+                            label,
+                            maxLines: 1,
+                            overflow: TextOverflow.ellipsis,
+                            textAlign: TextAlign.center,
+                            style: context.textTheme.labelLarge?.copyWith(
+                              color: context.colors.onSurface,
+                              fontWeight: active ? FontWeight.w600 : null,
+                            ),
+                          ),
+                        ),
+                      )
+                    : SizedBox(
+                        key: ValueKey('huddle-participant-label-empty-$pubkey'),
+                      ),
+              ),
+            ],
+          ),
+        ),
+      ),
+    );
+  }
+}
diff --git a/mobile/lib/features/channels/channel_detail_page/huddle_call_controls.dart b/mobile/lib/features/channels/channel_detail_page/huddle_call_controls.dart
new file mode 100644
index 00000000000..5a9b83878e8
--- /dev/null
+++ b/mobile/lib/features/channels/channel_detail_page/huddle_call_controls.dart
@@ -0,0 +1,119 @@
+part of '../channel_detail_page.dart';
+
+class _HuddleCallControls extends StatelessWidget {
+  const _HuddleCallControls({
+    required this.isMuted,
+    required this.isSpeakerEnabled,
+    required this.onToggleMute,
+    required this.onToggleSpeaker,
+    required this.onReact,
+  });
+
+  final bool isMuted;
+  final bool isSpeakerEnabled;
+  final VoidCallback onToggleMute;
+  final VoidCallback onToggleSpeaker;
+  final VoidCallback onReact;
+
+  @override
+  Widget build(BuildContext context) {
+    return Padding(
+      key: const ValueKey('huddle-call-controls'),
+      padding: const EdgeInsets.only(top: Grid.xxs),
+      child: Row(
+        mainAxisAlignment: MainAxisAlignment.center,
+        children: [
+          _HuddleRoundControl(
+            key: const ValueKey('huddle-speaker-toggle'),
+            tooltip: isSpeakerEnabled ? 'Use earpiece' : 'Use speaker',
+            icon: LucideIcons.volume2,
+            foregroundColor: isSpeakerEnabled
+                ? context.colors.onPrimary
+                : context.colors.onSurface,
+            backgroundColor: isSpeakerEnabled
+                ? context.colors.primary
+                : context.colors.surfaceContainerHighest,
+            dimension: 80,
+            toggled: isSpeakerEnabled,
+            onPressed: onToggleSpeaker,
+          ),
+          const SizedBox(width: Grid.sm),
+          _HuddleRoundControl(
+            key: const ValueKey('huddle-mute-toggle'),
+            tooltip: isMuted ? 'Unmute' : 'Mute',
+            icon: isMuted ? LucideIcons.micOff : LucideIcons.mic,
+            foregroundColor: isMuted
+                ? context.colors.onSurface
+                : context.colors.onPrimary,
+            backgroundColor: isMuted
+                ? context.colors.surfaceContainerHighest
+                : context.colors.primary,
+            dimension: 80,
+            toggled: isMuted,
+            onPressed: onToggleMute,
+          ),
+          const SizedBox(width: Grid.sm),
+          _HuddleRoundControl(
+            key: const ValueKey('huddle-emoji-reactions'),
+            tooltip: 'Emoji reactions',
+            icon: LucideIcons.smilePlus,
+            foregroundColor: context.colors.onSurface,
+            backgroundColor: context.colors.surfaceContainerHighest,
+            dimension: 80,
+            onPressed: onReact,
+          ),
+        ],
+      ),
+    );
+  }
+}
+
+class _HuddleRoundControl extends StatelessWidget {
+  const _HuddleRoundControl({
+    super.key,
+    required this.tooltip,
+    required this.icon,
+    required this.foregroundColor,
+    required this.backgroundColor,
+    required this.onPressed,
+    this.dimension = 64,
+    this.showTooltip = true,
+    this.toggled,
+  });
+
+  final String tooltip;
+  final IconData icon;
+  final Color foregroundColor;
+  final Color backgroundColor;
+  final VoidCallback? onPressed;
+  final double dimension;
+  final bool showTooltip;
+  final bool? toggled;
+
+  @override
+  Widget build(BuildContext context) {
+    return Semantics(
+      label: tooltip,
+      button: true,
+      enabled: onPressed != null,
+      toggled: toggled,
+      onTap: onPressed,
+      child: ExcludeSemantics(
+        child: SizedBox.square(
+          dimension: dimension,
+          child: IconButton(
+            tooltip: showTooltip ? tooltip : null,
+            onPressed: onPressed,
+            style: IconButton.styleFrom(
+              foregroundColor: foregroundColor,
+              backgroundColor: backgroundColor,
+              disabledForegroundColor: foregroundColor.withValues(alpha: 0.5),
+              disabledBackgroundColor: backgroundColor.withValues(alpha: 0.5),
+            ),
+            icon: Icon(icon, size: 28),
+          ),
+        ),
+      ),
+    );
+  }
+}
diff --git a/mobile/lib/features/channels/channel_detail_page/huddle_call_participants.dart b/mobile/lib/features/channels/channel_detail_page/huddle_call_participants.dart
new file mode 100644
index 00000000000..c7ef3dda57b
--- /dev/null
+++ b/mobile/lib/features/channels/channel_detail_page/huddle_call_participants.dart
@@ -0,0 +1,284 @@
+part of '../channel_detail_page.dart';
+
+class _HuddleCallParticipants extends StatelessWidget {
+  const _HuddleCallParticipants({
+    required this.connected,
+    required this.error,
+    required this.profiles,
+    required this.fallbackLabels,
+    required this.remotePubkeys,
+    required this.localPubkey,
+    required this.activeSpeakerPubkeys,
+    required this.speakerLevels,
+    required this.retryTooltip,
+    required this.retryIcon,
+    required this.onRetry,
+  });
+
+  final bool connected;
+  final String? error;
+  final Map<String, UserProfile> profiles;
+  final Map<String, String> fallbackLabels;
+  final List<String> remotePubkeys;
+  final String? localPubkey;
+  final Set<String> activeSpeakerPubkeys;
+  final Map<String, double> speakerLevels;
+  final String retryTooltip;
+  final IconData retryIcon;
+  final VoidCallback onRetry;
+
+  @override
+  Widget build(BuildContext context) {
+    if (error case final message?) {
+      return Center(
+        child: ConstrainedBox(
+          constraints: const BoxConstraints(maxWidth: 300),
+          child: Column(
+            mainAxisSize: MainAxisSize.min,
+            children: [
+              Icon(
+                LucideIcons.triangleAlert,
+                size: 32,
+                color: context.colors.error,
+              ),
+              const SizedBox(height: Grid.xxs),
+              Text(
+                message,
+                textAlign: TextAlign.center,
+                style: context.textTheme.bodyMedium?.copyWith(
+                  color: context.colors.error,
+                ),
+              ),
+              const SizedBox(height: Grid.xs),
+              IconButton.filledTonal(
+                key: const ValueKey('huddle-retry'),
+                tooltip: retryTooltip,
+                onPressed: onRetry,
+                icon: Icon(retryIcon),
+              ),
+            ],
+          ),
+        ),
+      );
+    }
+
+    if (!connected) {
+      return const Center(child: _HuddleLoadingBee());
+    }
+
+    final reducedMotion = MediaQuery.disableAnimationsOf(context);
+    final hasRemoteParticipants = remotePubkeys.isNotEmpty;
+    final hasDenseRemoteRoster =
+        remotePubkeys.length > _huddleDenseParticipantThreshold;
+    final remoteHeightFactor = hasDenseRemoteRoster ? 0.58 : 0.5;
+    final localHeightFactor = hasDenseRemoteRoster ? 0.42 : 0.5;
+    final movementDuration = reducedMotion
+        ? Duration.zero
+        : const Duration(milliseconds: 260);
+    final entryDuration = reducedMotion
+        ? Duration.zero
+        : const Duration(milliseconds: 180);
+
+    return Stack(
+      key: const ValueKey('huddle-participant-stage'),
+      fit: StackFit.expand,
+      children: [
+        Positioned.fill(
+          child: TweenAnimationBuilder<double>(
+            key: const ValueKey('huddle-local-participant-motion'),
+            duration: movementDuration,
+            curve: Curves.easeInOutCubic,
+            tween: Tween(
+              begin: hasRemoteParticipants ? 1 : 0,
+              end: hasRemoteParticipants ? 1 : 0,
+            ),
+            builder: (context, value, child) => FractionallySizedBox(
+              heightFactor: localHeightFactor,
+              alignment: Alignment.lerp(
+                Alignment.center,
+                Alignment.bottomCenter,
+                value,
+              )!,
+              child: Align(
+                key: const ValueKey('huddle-local-participant'),
+                alignment: Alignment.lerp(
+                  Alignment.center,
+                  const Alignment(0, -0.35),
+                  value,
+                )!,
+                child: child,
+              ),
+            ),
+            child: _HuddleCallAvatar(
+              pubkey: localPubkey ?? '',
+              profile: localPubkey == null ? null : profiles[localPubkey],
+              fallbackLabel: null,
+              active:
+                  localPubkey != null &&
+                  activeSpeakerPubkeys.contains(localPubkey),
+              speakerLevel: localPubkey == null
+                  ? 0
+                  : speakerLevels[localPubkey] ?? 0,
+              isSelf: true,
+            ),
+          ),
+        ),
+        Positioned.fill(
+          child: FractionallySizedBox(
+            key: const ValueKey('huddle-remote-participant-region'),
+            heightFactor: remoteHeightFactor,
+            alignment: Alignment.topCenter,
+            child: Align(
+              key: const ValueKey('huddle-remote-participant-group'),
+              alignment: const Alignment(0, 0.35),
+              child: LayoutBuilder(
+                builder: (context, constraints) {
+                  final layout = _HuddleParticipantLayout.fit(
+                    availableSize: constraints.biggest,
+                    participantCount: remotePubkeys.length,
+                    dense: hasDenseRemoteRoster,
+                  );
+                  return TweenAnimationBuilder<double>(
+                    key: const ValueKey('huddle-remote-participants'),
+                    duration: movementDuration,
+                    curve: Curves.easeInOutCubic,
+                    tween: Tween(end: layout.frameSize),
+                    builder: (context, frameSize, _) => Wrap(
+                      alignment: WrapAlignment.center,
+                      runAlignment: WrapAlignment.center,
+                      spacing: layout.spacing,
+                      runSpacing: layout.runSpacing,
+                      children: [
+                        for (final pubkey in remotePubkeys)
+                          SizedBox(
+                            key: ValueKey('huddle-participant-entry-$pubkey'),
+                            width: frameSize,
+                            height: frameSize + _huddleParticipantLabelSpace,
+                            child: TweenAnimationBuilder<double>(
+                              duration: entryDuration,
+                              curve: Curves.easeOutCubic,
+                              tween: Tween(begin: 0, end: 1),
+                              builder: (context, value, child) => Opacity(
+                                opacity: value,
+                                child: Transform.scale(
+                                  scale: 0.95 + value * 0.05,
+                                  child: child,
+                                ),
+                              ),
+                              child: _HuddleCallAvatar(
+                                pubkey: pubkey,
+                                profile: profiles[pubkey],
+                                fallbackLabel: fallbackLabels[pubkey],
+                                active: activeSpeakerPubkeys.contains(pubkey),
+                                speakerLevel: speakerLevels[pubkey] ?? 0,
+                                frameSize: frameSize,
+                              ),
+                            ),
+                          ),
+                      ],
+                    ),
+                  );
+                },
+              ),
+            ),
+          ),
+        ),
+      ],
+    );
+  }
+}
+
+class _HuddleLoadingBee extends HookWidget {
+  const _HuddleLoadingBee();
+
+  @override
+  Widget build(BuildContext context) {
+    final reducedMotion = MediaQuery.disableAnimationsOf(context);
+    final flapController = useAnimationController(
+      duration: const Duration(milliseconds: 480),
+    );
+    final flapProgress = useAnimation(flapController);
+    useEffect(() {
+      if (reducedMotion) {
+        flapController
+          ..stop()
+          ..reset();
+      } else {
+        flapController.repeat();
+      }
+      return null;
+    }, [flapController, reducedMotion]);
+    final flapAmount = reducedMotion
+        ? 0.0
+        : 0.5 - (0.5 * cos(flapProgress * 4 * pi));
+
+    return Semantics(
+      label: 'Joining Huddle',
+      liveRegion: true,
+      child: ExcludeSemantics(
+        child: FlappingBee(
+          key: const ValueKey('huddle-loading-bee'),
+          width: 60,
+          color: context.colors.primary,
+          flapAmount: flapAmount,
+        ),
+      ),
+    );
+  }
+}
+
+class _HuddleParticipantLayout {
+  const _HuddleParticipantLayout({
+    required this.frameSize,
+    required this.spacing,
+    required this.runSpacing,
+  });
+
+  final double frameSize;
+  final double spacing;
+  final double runSpacing;
+
+  static _HuddleParticipantLayout fit({
+    required Size availableSize,
+    required int participantCount,
+    required bool dense,
+  }) {
+    const spacing = Grid.xs;
+    const runSpacing = Grid.xxs;
+    final maximumFrameSize = dense
+        ? _huddleDenseAvatarFrameSize
+        : _huddleAvatarFrameSize;
+    if (participantCount <= 0 || availableSize.isEmpty) {
+      return _HuddleParticipantLayout(
+        frameSize: maximumFrameSize,
+        spacing: spacing,
+        runSpacing: runSpacing,
+      );
+    }
+
+    var bestFrameSize = _huddleMinimumAvatarFrameSize;
+    for (var columns = 1; columns <= participantCount; columns++) {
+      final rows = (participantCount + columns - 1) ~/ columns;
+      final widthForAvatars = availableSize.width - spacing * (columns - 1);
+      final heightForAvatars =
+          availableSize.height -
+          runSpacing * (rows - 1) -
+          _huddleParticipantLabelSpace * rows;
+      if (widthForAvatars <= 0 || heightForAvatars <= 0) continue;
+
+      final widthBound = widthForAvatars / columns;
+      final heightBound = heightForAvatars / rows;
+      final candidate = min(maximumFrameSize, min(widthBound, heightBound));
+      if (candidate > bestFrameSize) bestFrameSize = candidate;
+    }
+
+    return _HuddleParticipantLayout(
+      frameSize: bestFrameSize.clamp(
+        _huddleMinimumAvatarFrameSize,
+        maximumFrameSize,
+      ),
+      spacing: spacing,
+      runSpacing: runSpacing,
+    );
+  }
+}
diff --git a/mobile/lib/features/channels/channel_detail_page/huddle_drawer.dart b/mobile/lib/features/channels/channel_detail_page/huddle_drawer.dart
new file mode 100644
index 00000000000..3c0bbf339cf
--- /dev/null
+++ b/mobile/lib/features/channels/channel_detail_page/huddle_drawer.dart
@@ -0,0 +1,292 @@
+part of '../channel_detail_page.dart';
+
+const _mobileHuddleDrawerBaseHeight = 80.0;
+const _mobileHuddleDrawerRadius = 24.0;
+const _mobileHuddleDrawerMotion = Duration(milliseconds: 260);
+const _mobileHuddleDrawerCurve = Cubic(0.32, 0.72, 0, 1);
+
+/// Lifts the mobile app above a persistent Huddle control drawer when the
+/// full-screen call has been minimized.
+class MobileHuddleShell extends HookConsumerWidget {
+  const MobileHuddleShell({
+    super.key,
+    required this.navigatorKey,
+    required this.child,
+  });
+
+  final GlobalKey<NavigatorState> navigatorKey;
+  final Widget child;
+
+  @override
+  Widget build(BuildContext context, WidgetRef ref) {
+    ref.read(mobileHuddleControllerProvider.notifier);
+    final presentation = ref.watch(mobileHuddlePresentationProvider);
+    final session = ref.watch(huddleSessionProvider);
+    final relayStatus = ref.watch(relaySessionProvider).status;
+    _useIncomingHuddleReactions(
+      context: context,
+      ref: ref,
+      inSession: session.isInSession,
+      channelId: session.ephemeralChannelId,
+      currentPubkey: session.currentPubkey,
+      relayStatus: relayStatus,
+    );
+    final drawerOpen =
+        presentation == MobileHuddlePresentation.drawer && session.isInSession;
+    final reducedMotion = MediaQuery.disableAnimationsOf(context);
+    final duration = reducedMotion ? Duration.zero : _mobileHuddleDrawerMotion;
+    final drawerHeight =
+        _mobileHuddleDrawerBaseHeight + MediaQuery.paddingOf(context).bottom;
+    final surface = _huddleDrawerSurface(context);
+    final usesNativeConcentricSurface =
+        defaultTargetPlatform == TargetPlatform.iOS;
+
+    return ColoredBox(
+      color: drawerOpen ? surface : context.colors.surface,
+      child: Stack(
+        key: const ValueKey('mobile-huddle-shell'),
+        fit: StackFit.expand,
+        children: [
+          AnimatedPositioned(
+            key: const ValueKey('mobile-huddle-app-surface-position'),
+            duration: duration,
+            curve: _mobileHuddleDrawerCurve,
+            top: 0,
+            left: 0,
+            right: 0,
+            bottom: drawerOpen ? drawerHeight : 0,
+            child: AnimatedContainer(
+              key: const ValueKey('mobile-huddle-app-surface'),
+              duration: duration,
+              curve: _mobileHuddleDrawerCurve,
+              clipBehavior: usesNativeConcentricSurface
+                  ? Clip.none
+                  : Clip.antiAlias,
+              decoration: BoxDecoration(
+                borderRadius: BorderRadius.vertical(
+                  bottom: Radius.circular(
+                    drawerOpen ? _mobileHuddleDrawerRadius : 0,
+                  ),
+                ),
+                boxShadow: drawerOpen
+                    ? [
+                        BoxShadow(
+                          color: context.colors.shadow.withValues(alpha: 0.44),
+                          blurRadius: 24,
+                          spreadRadius: -12,
+                          offset: Offset(0, 10),
+                        ),
+                      ]
+                    : const [],
+              ),
+              child: usesNativeConcentricSurface
+                  ? ConcentricSheetSurface(
+                      key: const ValueKey(
+                        'mobile-huddle-app-concentric-surface',
+                      ),
+                      enabled: drawerOpen,
+                      color: context.colors.surface,
+                      backdropColor: surface,
+                      corners: ConcentricSurfaceCorners.bottom,
+                      padding: EdgeInsets.zero,
+                      providesSheetSurface: false,
+                      child: child,
+                    )
+                  : child,
+            ),
+          ),
+          AnimatedPositioned(
+            key: const ValueKey('mobile-huddle-drawer-position'),
+            duration: duration,
+            curve: _mobileHuddleDrawerCurve,
+            left: 0,
+            right: 0,
+            bottom: drawerOpen ? 0 : -drawerHeight,
+            height: drawerHeight,
+            child:
+                presentation != MobileHuddlePresentation.hidden ||
+                    session.isInSession
+                ? _MobileHuddleDrawer(
+                    navigatorKey: navigatorKey,
+                    session: session,
+                  )
+                : const SizedBox.shrink(),
+          ),
+        ],
+      ),
+    );
+  }
+}
+
+class _MobileHuddleDrawer extends ConsumerWidget {
+  const _MobileHuddleDrawer({
+    required this.navigatorKey,
+    required this.session,
+  });
+
+  final GlobalKey<NavigatorState> navigatorKey;
+  final HuddleSessionState session;
+
+  @override
+  Widget build(BuildContext context, WidgetRef ref) {
+    final foreground = _huddleDrawerForeground(context);
+    final controlSurface = _huddleDrawerControlSurface(context);
+    final drawerSurface = _huddleDrawerSurface(context);
+    final sessionController = ref.read(huddleSessionProvider.notifier);
+    final lifecycleController = ref.read(
+      mobileHuddleControllerProvider.notifier,
+    );
+
+    void restoreFullScreen() {
+      if (ref.read(mobileHuddlePresentationProvider) !=
+          MobileHuddlePresentation.drawer) {
+        return;
+      }
+      final parentChannelId = session.parentChannelId;
+      final ephemeralChannelId = session.ephemeralChannelId;
+      final navigator = navigatorKey.currentState;
+      final reducedMotion = MediaQuery.disableAnimationsOf(context);
+      if (parentChannelId == null ||
+          ephemeralChannelId == null ||
+          navigator == null) {
+        return;
+      }
+      ref.read(mobileHuddlePresentationProvider.notifier).showFullScreen();
+      unawaited(
+        Future<void>(() async {
+          if (!reducedMotion) {
+            await Future<void>.delayed(_mobileHuddleDrawerMotion);
+          }
+          if (!navigator.mounted ||
+              !ref.read(huddleSessionProvider).isInSession ||
+              ref.read(mobileHuddlePresentationProvider) !=
+                  MobileHuddlePresentation.fullScreen) {
+            return;
+          }
+          await navigator.push<void>(
+            _mobileHuddleCallRoute(
+              context: navigator.context,
+              invite: _HuddleInvite(
+                parentChannelId: parentChannelId,
+                ephemeralChannelId: ephemeralChannelId,
+                startedBy: session.isCreator ? session.currentPubkey ?? '' : '',
+                startedEventId: session.startedEventId ?? '',
+              ),
+            ),
+          );
+        }),
+      );
+    }
+
+    void leave() {
+      ref.read(mobileHuddlePresentationProvider.notifier).hide();
+      unawaited(
+        lifecycleController.leave().catchError((Object error) {
+          debugPrint('[MobileHuddle] drawer leave failed: $error');
+        }),
+      );
+    }
+
+    return Material(
+      key: const ValueKey('mobile-huddle-drawer'),
+      color: drawerSurface,
+      child: InkWell(
+        onTap: restoreFullScreen,
+        child: Semantics(
+          container: true,
+          label: 'Huddle controls',
+          hint: 'Tap outside a control to open the Huddle',
+          child: Center(
+            child: Padding(
+              padding: const EdgeInsets.symmetric(horizontal: Grid.gutter),
+              child: Transform.translate(
+                key: const ValueKey('huddle-drawer-control-offset'),
+                offset: const Offset(0, -8),
+                child: Row(
+                  key: const ValueKey('huddle-drawer-controls'),
+                  mainAxisAlignment: MainAxisAlignment.spaceBetween,
+                  crossAxisAlignment: CrossAxisAlignment.center,
+                  children: [
+                    Row(
+                      key: const ValueKey('huddle-drawer-primary-controls'),
+                      mainAxisSize: MainAxisSize.min,
+                      children: [
+                        _HuddleRoundControl(
+                          key: const ValueKey('huddle-drawer-expand'),
+                          tooltip: 'Open Huddle',
+                          showTooltip: false,
+                          icon: LucideIcons.chevronUp,
+                          foregroundColor: foreground,
+                          backgroundColor: controlSurface,
+                          onPressed: restoreFullScreen,
+                        ),
+                        const SizedBox(width: Grid.twelve),
+                        _HuddleRoundControl(
+                          key: const ValueKey('huddle-drawer-speaker-toggle'),
+                          tooltip: session.isSpeakerEnabled
+                              ? 'Use earpiece'
+                              : 'Use speaker',
+                          showTooltip: false,
+                          icon: LucideIcons.volume2,
+                          foregroundColor: session.isSpeakerEnabled
+                              ? drawerSurface
+                              : foreground,
+                          backgroundColor: session.isSpeakerEnabled
+                              ? foreground
+                              : controlSurface,
+                          toggled: session.isSpeakerEnabled,
+                          onPressed: () => unawaited(
+                            sessionController.setSpeakerEnabled(
+                              !session.isSpeakerEnabled,
+                            ),
+                          ),
+                        ),
+                        const SizedBox(width: Grid.twelve),
+                        _HuddleRoundControl(
+                          key: const ValueKey('huddle-drawer-mute-toggle'),
+                          tooltip: session.isMuted ? 'Unmute' : 'Mute',
+                          showTooltip: false,
+                          icon: session.isMuted
+                              ? LucideIcons.micOff
+                              : LucideIcons.mic,
+                          foregroundColor: session.isMuted
+                              ? foreground
+                              : drawerSurface,
+                          backgroundColor: session.isMuted
+                              ? controlSurface
+                              : foreground,
+                          toggled: session.isMuted,
+                          onPressed: () => unawaited(
+                            sessionController.setMuted(!session.isMuted),
+                          ),
+                        ),
+                      ],
+                    ),
+                    _HuddleRoundControl(
+                      key: const ValueKey('huddle-drawer-leave'),
+                      tooltip: 'Leave Huddle',
+                      showTooltip: false,
+                      icon: LucideIcons.phoneOff,
+                      foregroundColor: context.colors.error,
+                      backgroundColor: controlSurface,
+                      onPressed: leave,
+                    ),
+                  ],
+                ),
+              ),
+            ),
+          ),
+        ),
+      ),
+    );
+  }
+}
+
+Color _huddleDrawerSurface(BuildContext context) =>
+    context.appColors.huddleDrawerSurface;
+
+Color _huddleDrawerControlSurface(BuildContext context) =>
+    context.appColors.huddleControlSurface;
+
+Color _huddleDrawerForeground(BuildContext context) =>
+    context.appColors.onHuddleDrawer;
diff --git a/mobile/lib/features/channels/channel_detail_page/huddle_reactions.dart b/mobile/lib/features/channels/channel_detail_page/huddle_reactions.dart
new file mode 100644
index 00000000000..e00f96a81c2
--- /dev/null
+++ b/mobile/lib/features/channels/channel_detail_page/huddle_reactions.dart
@@ -0,0 +1,117 @@
+part of '../channel_detail_page.dart';
+
+final _huddleAvatarOriginRegistryProvider = Provider(
+  (_) => _HuddleAvatarOriginRegistry(),
+);
+
+class _HuddleAvatarOriginRegistry {
+  final Map<String, GlobalKey> _keys = {};
+
+  void register(String pubkey, GlobalKey key) {
+    _keys[pubkey.toLowerCase()] = key;
+  }
+
+  void unregister(String pubkey, GlobalKey key) {
+    final normalized = pubkey.toLowerCase();
+    if (identical(_keys[normalized], key)) _keys.remove(normalized);
+  }
+
+  Offset? originFor(String? pubkey) {
+    if (pubkey == null) return null;
+    final context = _keys[pubkey.toLowerCase()]?.currentContext;
+    final box = context?.findRenderObject();
+    if (box is! RenderBox || !box.hasSize) return null;
+    return box.localToGlobal(box.size.center(Offset.zero));
+  }
+}
+
+void _burstHuddleReaction({
+  required WidgetRef ref,
+  required BuildContext fallbackContext,
+  required String emoji,
+  required String? senderPubkey,
+}) {
+  if (MediaQuery.maybeDisableAnimationsOf(fallbackContext) ?? false) return;
+  final origin = ref
+      .read(_huddleAvatarOriginRegistryProvider)
+      .originFor(senderPubkey);
+  if (origin == null) {
+    burstEmojiFromContext(ref, fallbackContext, emoji, requirePositive: false);
+    return;
+  }
+  ref.read(emojiBurstControllerProvider).burst(emoji, origin);
+}
+
+void _useIncomingHuddleReactions({
+  required BuildContext context,
+  required WidgetRef ref,
+  required bool inSession,
+  required String? channelId,
+  required String? currentPubkey,
+  required SessionStatus relayStatus,
+}) {
+  useEffect(() {
+    if (!inSession ||
+        channelId == null ||
+        relayStatus != SessionStatus.connected) {
+      return null;
+    }
+
+    final relaySession = ref.read(relaySessionProvider.notifier);
+    final seenEventIds = <String>{};
+    var disposed = false;
+    VoidCallback? unsubscribe;
+    Future.microtask(() async {
+      try {
+        final cleanup = await relaySession.subscribe(
+          NostrFilter(
+            kinds: const [EventKind.huddleReaction],
+            tags: {
+              '#h': [channelId],
+            },
+            limit: 1000,
+          ).copyWithSince(DateTime.now().millisecondsSinceEpoch ~/ 1000),
+          (event) {
+            if (disposed || !seenEventIds.add(event.id)) return;
+            if (event.pubkey.toLowerCase() == currentPubkey?.toLowerCase()) {
+              return;
+            }
+            final emoji = _huddleReactionEmoji(event);
+            if (emoji == null || !context.mounted) return;
+            _burstHuddleReaction(
+              ref: ref,
+              fallbackContext: context,
+              emoji: emoji,
+              senderPubkey: event.pubkey,
+            );
+          },
+        );
+        if (disposed) {
+          cleanup();
+        } else {
+          unsubscribe = cleanup;
+        }
+      } catch (error) {
+        if (!disposed) {
+          debugPrint('[MobileHuddle] reaction subscription failed: $error');
+        }
+      }
+    });
+
+    return () {
+      disposed = true;
+      unsubscribe?.call();
+    };
+  }, [inSession, channelId, currentPubkey, relayStatus]);
+}
+
+String? _huddleReactionEmoji(NostrEvent event) {
+  if (event.kind != EventKind.huddleReaction) return null;
+  for (final tag in event.tags) {
+    if (tag.length < 2 || tag.first != 'reaction') continue;
+    final emoji = tag[1].trim();
+    if (emoji.isNotEmpty) return emoji;
+  }
+  final emoji = event.content.trim();
+  return emoji.isEmpty ? null : emoji;
+}
diff --git a/mobile/lib/features/channels/channel_detail_page/huddle_sheet.dart b/mobile/lib/features/channels/channel_detail_page/huddle_sheet.dart
new file mode 100644
index 00000000000..bb26eb4263a
--- /dev/null
+++ b/mobile/lib/features/channels/channel_detail_page/huddle_sheet.dart
@@ -0,0 +1,802 @@
+part of '../channel_detail_page.dart';
+
+const _huddleLifetime = Duration(hours: 1);
+const _huddleAvatarRadius = 52.0;
+const _huddleAvatarFrameSize = 128.0;
+const _huddleSpeakingRingSize = 112.0;
+const _huddleDenseAvatarFrameSize = 104.0;
+const _huddleMinimumAvatarFrameSize = 48.0;
+const _huddleParticipantLabelSpace = 28.0;
+const _huddleDenseParticipantThreshold = 6;
+
+final _huddleParticipantProfileUpdatesProvider = NotifierProvider.autoDispose
+    .family<_HuddleParticipantProfileUpdates, int, String>(
+      _HuddleParticipantProfileUpdates.new,
+    );
+
+class _HuddleParticipantProfileUpdates extends Notifier<int> {
+  _HuddleParticipantProfileUpdates(this.channelId);
+
+  final String channelId;
+  void Function()? _unsubscribe;
+  int _subscriptionVersion = 0;
+
+  @override
+  int build() {
+    final session = ref.watch(
+      huddleSessionProvider.select(
+        (state) => (
+          ephemeralChannelId: state.ephemeralChannelId,
+          currentPubkey: state.currentPubkey,
+          participantPubkeys: state.participantPubkeys,
+          wasAdmitted: state.wasAdmitted,
+        ),
+      ),
+    );
+    final members = session.wasAdmitted
+        ? const <ChannelMember>[]
+        : ref.watch(channelMembersProvider(channelId)).value ??
+              const <ChannelMember>[];
+    final relayState = ref.watch(relaySessionProvider);
+    final participantPubkeys = _huddleParticipantPubkeys(
+      sessionParticipantPubkeys: session.ephemeralChannelId == channelId
+          ? session.participantPubkeys
+          : const [],
+      currentPubkey: session.currentPubkey,
+      members: members,
+    );
+    final subscriptionVersion = ++_subscriptionVersion;
+    _clearSubscription();
+    ref.onDispose(() {
+      _subscriptionVersion++;
+      _clearSubscription();
+    });
+
+    if (participantPubkeys.isEmpty) return 0;
+    ref.read(userCacheProvider.notifier).preload(participantPubkeys);
+    if (relayState.status == SessionStatus.connected) {
+      Future.microtask(
+        () => _subscribe(participantPubkeys, subscriptionVersion),
+      );
+    }
+    return 0;
+  }
+
+  Future<void> _subscribe(
+    List<String> participantPubkeys,
+    int subscriptionVersion,
+  ) async {
+    try {
+      final unsubscribe = await ref
+          .read(relaySessionProvider.notifier)
+          .subscribe(
+            NostrFilter(
+              kinds: const [0],
+              authors: participantPubkeys,
+              limit: 0,
+            ).copyWithSince(DateTime.now().millisecondsSinceEpoch ~/ 1000 - 5),
+            (event) {
+              if (!_isCurrent(subscriptionVersion)) return;
+              ref.read(userCacheProvider.notifier).cacheProfileEvent(event);
+              state++;
+            },
+          );
+      if (!_isCurrent(subscriptionVersion)) {
+        unsubscribe();
+        return;
+      }
+      _unsubscribe = unsubscribe;
+    } catch (error) {
+      if (_isCurrent(subscriptionVersion)) {
+        debugPrint('[HuddleProfiles] live profile subscription failed: $error');
+      }
+    }
+  }
+
+  bool _isCurrent(int subscriptionVersion) =>
+      subscriptionVersion == _subscriptionVersion;
+
+  void _clearSubscription() {
+    _unsubscribe?.call();
+    _unsubscribe = null;
+  }
+}
+
+List<String> _huddleParticipantPubkeys({
+  required Iterable<String> sessionParticipantPubkeys,
+  required String? currentPubkey,
+  required Iterable<ChannelMember> members,
+}) {
+  final localPubkey = currentPubkey?.toLowerCase();
+  final pubkeys = <String>{};
+  for (final pubkey in sessionParticipantPubkeys) {
+    final normalized = pubkey.trim().toLowerCase();
+    if (normalized.isNotEmpty && normalized != localPubkey) {
+      pubkeys.add(normalized);
+    }
+  }
+  for (final member in members) {
+    final normalized = member.pubkey.trim().toLowerCase();
+    if (normalized.isNotEmpty && normalized != localPubkey) {
+      pubkeys.add(normalized);
+    }
+  }
+  if (localPubkey != null && localPubkey.isNotEmpty) {
+    pubkeys.add(localPubkey);
+  }
+  return List.unmodifiable(pubkeys);
+}
+
+class _HuddleInvite {
+  final String parentChannelId;
+  final String ephemeralChannelId;
+  final String startedBy;
+  final String startedEventId;
+
+  const _HuddleInvite({
+    required this.parentChannelId,
+    required this.ephemeralChannelId,
+    required this.startedBy,
+    required this.startedEventId,
+  });
+}
+
+class _HuddleButton extends ConsumerWidget {
+  const _HuddleButton({required this.channel, required this.events});
+
+  final Channel channel;
+  final List<NostrEvent> events;
+
+  @override
+  Widget build(BuildContext context, WidgetRef ref) {
+    final session = ref.watch(huddleSessionProvider);
+    final latestStart = _activeHuddleStart(events);
+    final unavailableFailure =
+        session.phase == HuddleSessionPhase.failed &&
+        _isUnavailableHuddleError(session.error);
+    final activeStart =
+        unavailableFailure &&
+            session.startedEventId == latestStart?.startedEventId
+        ? null
+        : latestStart;
+    final isCurrentParent =
+        session.parentChannelId == channel.id &&
+        session.ephemeralChannelId != null &&
+        session.phase != HuddleSessionPhase.idle &&
+        !unavailableFailure;
+    final disabledByOtherHuddle =
+        session.isInSession && session.parentChannelId != channel.id;
+
+    return IconButton(
+      key: const ValueKey('channel-huddle-button'),
+      color: context.colors.primary,
+      onPressed: disabledByOtherHuddle
+          ? null
+          : () async {
+              if (isCurrentParent) {
+                _showMobileHuddleCall(
+                  context: context,
+                  ref: ref,
+                  invite: _HuddleInvite(
+                    parentChannelId: channel.id,
+                    ephemeralChannelId: session.ephemeralChannelId!,
+                    startedBy: session.isCreator
+                        ? session.currentPubkey ?? ''
+                        : '',
+                    startedEventId: session.startedEventId ?? '',
+                  ),
+                );
+                return;
+              }
+              if (activeStart != null) {
+                _openMobileHuddle(
+                  context: context,
+                  ref: ref,
+                  invite: activeStart,
+                );
+                return;
+              }
+              try {
+                await ref
+                    .read(mobileHuddleControllerProvider.notifier)
+                    .start(parentChannelId: channel.id);
+                if (!context.mounted) return;
+                final started = ref.read(huddleSessionProvider);
+                final ephemeralChannelId = started.ephemeralChannelId;
+                if (ephemeralChannelId == null) return;
+                _showMobileHuddleCall(
+                  context: context,
+                  ref: ref,
+                  invite: _HuddleInvite(
+                    parentChannelId: channel.id,
+                    ephemeralChannelId: ephemeralChannelId,
+                    startedBy: started.currentPubkey ?? '',
+                    startedEventId: started.startedEventId ?? '',
+                  ),
+                );
+              } catch (error) {
+                if (!context.mounted) return;
+                ScaffoldMessenger.of(context).showSnackBar(
+                  SnackBar(content: Text(_huddleActionError(error))),
+                );
+              }
+            },
+      tooltip: disabledByOtherHuddle
+          ? 'Leave your current Huddle first'
+          : activeStart != null || isCurrentParent
+          ? 'Open Huddle'
+          : 'Start Huddle',
+      icon: const Icon(LucideIcons.headphones, size: 22),
+    );
+  }
+}
+
+class _HuddleJoinSurface extends ConsumerWidget {
+  const _HuddleJoinSurface({
+    required this.message,
+    required this.allMessages,
+    required this.parentChannelId,
+    required this.isMember,
+    required this.isArchived,
+  });
+
+  final TimelineMessage message;
+  final List<TimelineMessage> allMessages;
+  final String parentChannelId;
+  final bool isMember;
+  final bool isArchived;
+
+  @override
+  Widget build(BuildContext context, WidgetRef ref) {
+    final ephemeralChannelId = message.systemEvent?.ephemeralChannelId;
+    if (ephemeralChannelId == null) return const SizedBox.shrink();
+    final session = ref.watch(huddleSessionProvider);
+    final isThisSession =
+        session.ephemeralChannelId == ephemeralChannelId &&
+        session.phase != HuddleSessionPhase.idle;
+    final unavailable =
+        isThisSession &&
+        session.phase == HuddleSessionPhase.failed &&
+        _isUnavailableHuddleError(session.error);
+    final ended = _huddleEnded(
+      start: message,
+      allMessages: allMessages,
+      ephemeralChannelId: ephemeralChannelId,
+    );
+    final stale =
+        DateTime.now().difference(
+          DateTime.fromMillisecondsSinceEpoch(message.createdAt * 1000),
+        ) >
+        _huddleLifetime;
+    final blockedByOtherHuddle = session.isInSession && !isThisSession;
+    final canJoin =
+        isMember && !isArchived && !ended && !stale && !blockedByOtherHuddle;
+
+    final label = unavailable
+        ? 'Start new'
+        : switch ((isThisSession, session.phase, ended || stale)) {
+            (true, HuddleSessionPhase.connected, _) => 'Open',
+            (true, HuddleSessionPhase.interrupted, _) => 'Open',
+            (true, HuddleSessionPhase.reconnecting, _) => 'Reconnecting',
+            (true, HuddleSessionPhase.failed, _) => 'Retry',
+            (true, _, _) => 'Joining',
+            (_, _, true) => 'Ended',
+            _ => 'Join',
+          };
+
+    return Padding(
+      padding: const EdgeInsets.only(
+        left: messageAvatarSize + messageAvatarContentGap,
+        top: Grid.xxs,
+      ),
+      child: Container(
+        padding: const EdgeInsets.all(Grid.twelve),
+        decoration: BoxDecoration(
+          color: context.colors.primary.withValues(alpha: 0.08),
+          borderRadius: BorderRadius.circular(Radii.md),
+          border: Border.all(
+            color: context.colors.primary.withValues(alpha: 0.18),
+          ),
+        ),
+        child: Row(
+          children: [
+            Icon(
+              LucideIcons.headphones,
+              size: 20,
+              color: context.colors.primary,
+            ),
+            const SizedBox(width: Grid.xxs),
+            Expanded(
+              child: Column(
+                crossAxisAlignment: CrossAxisAlignment.start,
+                children: [
+                  Text(
+                    ended || stale || unavailable
+                        ? 'Huddle ended'
+                        : 'Huddle in progress',
+                    style: context.textTheme.labelLarge?.copyWith(
+                      color: context.colors.onSurface,
+                      fontWeight: FontWeight.w600,
+                    ),
+                  ),
+                  Text(
+                    isThisSession && session.isConnected
+                        ? '${session.participantCount} connected'
+                        : 'Foreground voice Huddle',
+                    style: context.textTheme.bodySmall?.copyWith(
+                      color: context.colors.onSurfaceVariant,
+                    ),
+                  ),
+                ],
+              ),
+            ),
+            const SizedBox(width: Grid.xxs),
+            FilledButton.tonal(
+              key: ValueKey('huddle-$label-$ephemeralChannelId'),
+              onPressed:
+                  (canJoin || isThisSession) &&
+                      session.phase != HuddleSessionPhase.leaving
+                  ? () => unavailable
+                        ? unawaited(
+                            _startMobileHuddleFromChannel(
+                              context: context,
+                              ref: ref,
+                              parentChannelId: parentChannelId,
+                            ),
+                          )
+                        : _openMobileHuddle(
+                            context: context,
+                            ref: ref,
+                            invite: _HuddleInvite(
+                              parentChannelId: parentChannelId,
+                              ephemeralChannelId: ephemeralChannelId,
+                              startedBy: message.pubkey,
+                              startedEventId: message.id,
+                            ),
+                          )
+                  : null,
+              child: Text(label),
+            ),
+          ],
+        ),
+      ),
+    );
+  }
+}
+
+bool _huddleEnded({
+  required TimelineMessage start,
+  required List<TimelineMessage> allMessages,
+  required String ephemeralChannelId,
+}) => allMessages.any((candidate) {
+  final event = candidate.systemEvent;
+  return candidate.createdAt >= start.createdAt &&
+      event?.type == SystemEventType.huddleEnded &&
+      event?.ephemeralChannelId == ephemeralChannelId;
+});
+
+Future<void> _startMobileHuddleFromChannel({
+  required BuildContext context,
+  required WidgetRef ref,
+  required String parentChannelId,
+}) async {
+  try {
+    await ref
+        .read(mobileHuddleControllerProvider.notifier)
+        .start(parentChannelId: parentChannelId);
+    if (!context.mounted) return;
+    final session = ref.read(huddleSessionProvider);
+    final ephemeralChannelId = session.ephemeralChannelId;
+    if (ephemeralChannelId == null ||
+        session.phase == HuddleSessionPhase.failed) {
+      throw StateError(session.error ?? 'Unable to start a new Huddle.');
+    }
+    _showMobileHuddleCall(
+      context: context,
+      ref: ref,
+      invite: _HuddleInvite(
+        parentChannelId: parentChannelId,
+        ephemeralChannelId: ephemeralChannelId,
+        startedBy: session.currentPubkey ?? '',
+        startedEventId: session.startedEventId ?? '',
+      ),
+    );
+  } catch (error) {
+    if (!context.mounted) return;
+    ScaffoldMessenger.of(
+      context,
+    ).showSnackBar(SnackBar(content: Text(_huddleActionError(error))));
+  }
+}
+
+void _openMobileHuddle({
+  required BuildContext context,
+  required WidgetRef ref,
+  required _HuddleInvite invite,
+}) {
+  final config = ref.read(relayConfigProvider);
+  final nsec = config.nsec;
+  if (nsec == null || nsec.isEmpty) {
+    ScaffoldMessenger.of(context).showSnackBar(
+      const SnackBar(content: Text('A paired identity is required.')),
+    );
+    return;
+  }
+
+  final session = ref.read(huddleSessionProvider);
+  _showMobileHuddleCall(context: context, ref: ref, invite: invite);
+  if (session.ephemeralChannelId != invite.ephemeralChannelId ||
+      session.phase == HuddleSessionPhase.idle ||
+      session.phase == HuddleSessionPhase.failed) {
+    unawaited(
+      ref
+          .read(mobileHuddleControllerProvider.notifier)
+          .join(
+            parentChannelId: invite.parentChannelId,
+            ephemeralChannelId: invite.ephemeralChannelId,
+            startedBy: invite.startedBy,
+            startedEventId: invite.startedEventId,
+          ),
+    );
+  }
+}
+
+void _showMobileHuddleCall({
+  required BuildContext context,
+  required WidgetRef ref,
+  required _HuddleInvite invite,
+}) {
+  ref.read(mobileHuddlePresentationProvider.notifier).showFullScreen();
+  unawaited(
+    Navigator.of(
+      context,
+      rootNavigator: true,
+    ).push<void>(_mobileHuddleCallRoute(context: context, invite: invite)),
+  );
+}
+
+PageRouteBuilder<void> _mobileHuddleCallRoute({
+  required BuildContext context,
+  required _HuddleInvite invite,
+}) {
+  final reduceMotion = MediaQuery.disableAnimationsOf(context);
+  return PageRouteBuilder<void>(
+    opaque: true,
+    transitionDuration: reduceMotion
+        ? Duration.zero
+        : const Duration(milliseconds: 280),
+    reverseTransitionDuration: reduceMotion
+        ? Duration.zero
+        : const Duration(milliseconds: 220),
+    pageBuilder: (_, _, _) => _MobileHuddleCallPage(invite: invite),
+    transitionsBuilder: (_, animation, _, child) {
+      if (reduceMotion) return child;
+      return SlideTransition(
+        position: Tween<Offset>(begin: const Offset(0, 1), end: Offset.zero)
+            .animate(
+              CurvedAnimation(
+                parent: animation,
+                curve: Curves.easeOutCubic,
+                reverseCurve: Curves.easeInCubic,
+              ),
+            ),
+        child: child,
+      );
+    },
+  );
+}
+
+Future<void> _startReplacementHuddle({
+  required BuildContext context,
+  required WidgetRef ref,
+  required String parentChannelId,
+}) async {
+  try {
+    await ref
+        .read(mobileHuddleControllerProvider.notifier)
+        .start(parentChannelId: parentChannelId);
+    if (!context.mounted) return;
+    final session = ref.read(huddleSessionProvider);
+    final ephemeralChannelId = session.ephemeralChannelId;
+    if (ephemeralChannelId == null ||
+        session.phase == HuddleSessionPhase.failed) {
+      throw StateError(session.error ?? 'Unable to start a new Huddle.');
+    }
+    ref.read(mobileHuddlePresentationProvider.notifier).showFullScreen();
+    Navigator.of(context, rootNavigator: true).pushReplacement<void, void>(
+      _mobileHuddleCallRoute(
+        context: context,
+        invite: _HuddleInvite(
+          parentChannelId: parentChannelId,
+          ephemeralChannelId: ephemeralChannelId,
+          startedBy: session.currentPubkey ?? '',
+          startedEventId: session.startedEventId ?? '',
+        ),
+      ),
+    );
+  } catch (error) {
+    if (!context.mounted) return;
+    ScaffoldMessenger.of(
+      context,
+    ).showSnackBar(SnackBar(content: Text(_huddleActionError(error))));
+  }
+}
+
+class _MobileHuddleCallPage extends ConsumerWidget {
+  const _MobileHuddleCallPage({required this.invite});
+
+  final _HuddleInvite invite;
+
+  @override
+  Widget build(BuildContext context, WidgetRef ref) {
+    final session = ref.watch(huddleSessionProvider);
+    final sessionController = ref.read(huddleSessionProvider.notifier);
+    final lifecycleController = ref.read(
+      mobileHuddleControllerProvider.notifier,
+    );
+    final presentationController = ref.read(
+      mobileHuddlePresentationProvider.notifier,
+    );
+
+    final connected =
+        session.phase == HuddleSessionPhase.connected ||
+        session.phase == HuddleSessionPhase.interrupted;
+    final unavailable =
+        session.phase == HuddleSessionPhase.failed &&
+        _isUnavailableHuddleError(session.error);
+    final needsMicrophoneSettings =
+        session.phase == HuddleSessionPhase.failed &&
+        !unavailable &&
+        session.microphonePermissionRequired;
+    final localPubkey = session.currentPubkey?.toLowerCase();
+    final backingMembers =
+        ref.watch(channelMembersProvider(invite.ephemeralChannelId)).value ??
+        const <ChannelMember>[];
+    final participantPubkeys = _huddleParticipantPubkeys(
+      sessionParticipantPubkeys: session.participantPubkeys,
+      currentPubkey: localPubkey,
+      members: session.wasAdmitted ? const [] : backingMembers,
+    );
+    final remotePubkeys = participantPubkeys
+        .where((pubkey) => pubkey != localPubkey)
+        .toList(growable: false);
+    ref.read(userCacheProvider.notifier).preload(participantPubkeys);
+    ref.watch(
+      _huddleParticipantProfileUpdatesProvider(invite.ephemeralChannelId),
+    );
+    final profiles = ref.watch(userCacheProvider);
+    final directoryDisplayNames = ref.watch(agentDirectoryDisplayNamesProvider);
+    final reactionSenderName = _huddleReactionSenderName(
+      localPubkey: localPubkey,
+      profile: localPubkey == null ? null : profiles[localPubkey],
+    );
+
+    final (retryTooltip, retryIcon, onRetry) = switch (true) {
+      _ when unavailable => (
+        'Start a new Huddle',
+        LucideIcons.headphones,
+        () => unawaited(
+          _startReplacementHuddle(
+            context: context,
+            ref: ref,
+            parentChannelId: invite.parentChannelId,
+          ),
+        ),
+      ),
+      _ when needsMicrophoneSettings => (
+        'Open Settings',
+        LucideIcons.settings,
+        () => unawaited(sessionController.openMicrophoneSettings()),
+      ),
+      _ => (
+        'Try again',
+        LucideIcons.refreshCw,
+        () => unawaited(
+          lifecycleController.join(
+            parentChannelId: invite.parentChannelId,
+            ephemeralChannelId: invite.ephemeralChannelId,
+            startedBy: invite.startedBy,
+            startedEventId: invite.startedEventId,
+          ),
+        ),
+      ),
+    };
+
+    return PopScope<void>(
+      onPopInvokedWithResult: (didPop, _) {
+        if (didPop &&
+            ref.read(mobileHuddlePresentationProvider) ==
+                MobileHuddlePresentation.fullScreen) {
+          presentationController.minimize();
+        }
+      },
+      child: Scaffold(
+        backgroundColor: context.colors.surface,
+        body: SafeArea(
+          child: Padding(
+            padding: const EdgeInsets.fromLTRB(
+              Grid.gutter,
+              Grid.xxs,
+              Grid.gutter,
+              Grid.gutter,
+            ),
+            child: Column(
+              children: [
+                _HuddleCallHeader(
+                  isLeaving: session.phase == HuddleSessionPhase.leaving,
+                  onMinimize: () {
+                    presentationController.minimize();
+                    Navigator.of(context).pop();
+                  },
+                  onLeave: () {
+                    presentationController.hide();
+                    final leaving = lifecycleController.leave();
+                    Navigator.of(context).pop();
+                    unawaited(
+                      leaving.catchError((Object error) {
+                        debugPrint('[MobileHuddle] leave failed: $error');
+                      }),
+                    );
+                  },
+                ),
+                Expanded(
+                  child: _HuddleCallParticipants(
+                    connected: connected,
+                    error: session.phase == HuddleSessionPhase.failed
+                        ? unavailable
+                              ? 'This Huddle is no longer available.'
+                              : session.error ?? 'Huddle audio failed.'
+                        : null,
+                    profiles: profiles,
+                    fallbackLabels: directoryDisplayNames,
+                    remotePubkeys: remotePubkeys,
+                    localPubkey: localPubkey,
+                    activeSpeakerPubkeys: session.activeSpeakerPubkeys,
+                    speakerLevels: session.speakerLevels,
+                    retryTooltip: retryTooltip,
+                    retryIcon: retryIcon,
+                    onRetry: onRetry,
+                  ),
+                ),
+                if (connected)
+                  _HuddleCallControls(
+                    isMuted: session.isMuted,
+                    isSpeakerEnabled: session.isSpeakerEnabled,
+                    onToggleMute: () =>
+                        unawaited(sessionController.setMuted(!session.isMuted)),
+                    onToggleSpeaker: () => unawaited(
+                      sessionController.setSpeakerEnabled(
+                        !session.isSpeakerEnabled,
+                      ),
+                    ),
+                    onReact: () => showEmojiPicker(
+                      context: context,
+                      onSelect: (emoji) {
+                        ref.read(recentEmojiProvider.notifier).record(emoji);
+                        _burstHuddleReaction(
+                          ref: ref,
+                          fallbackContext: context,
+                          emoji: emoji,
+                          senderPubkey: localPubkey,
+                        );
+                        unawaited(
+                          ref
+                              .read(channelActionsProvider)
+                              .sendHuddleReaction(
+                                channelId: invite.ephemeralChannelId,
+                                emoji: emoji,
+                                senderName: reactionSenderName,
+                              )
+                              .catchError((Object error) {
+                                if (!context.mounted) return;
+                                ScaffoldMessenger.of(context).showSnackBar(
+                                  const SnackBar(
+                                    content: Text('Reaction failed'),
+                                  ),
+                                );
+                              }),
+                        );
+                      },
+                    ),
+                  )
+                else
+                  const SizedBox(height: Grid.xxl),
+              ],
+            ),
+          ),
+        ),
+      ),
+    );
+  }
+}
+
+String _huddleReactionSenderName({
+  required String? localPubkey,
+  required UserProfile? profile,
+}) {
+  final displayName = profile?.displayName?.trim();
+  if (displayName?.isNotEmpty == true) return displayName!;
+  if (localPubkey?.isNotEmpty == true) {
+    return 'Participant ${shortPubkey(localPubkey!)}';
+  }
+  return 'Someone';
+}
+
+class _HuddleCallHeader extends StatelessWidget {
+  const _HuddleCallHeader({
+    required this.isLeaving,
+    required this.onMinimize,
+    required this.onLeave,
+  });
+
+  final bool isLeaving;
+  final VoidCallback onMinimize;
+  final VoidCallback onLeave;
+
+  @override
+  Widget build(BuildContext context) {
+    return SizedBox(
+      height: 72,
+      child: Row(
+        children: [
+          IconButton(
+            key: const ValueKey('huddle-minimize'),
+            tooltip: 'Minimize',
+            onPressed: onMinimize,
+            icon: const Icon(LucideIcons.chevronDown, size: 32),
+          ),
+          const Spacer(),
+          _HuddleRoundControl(
+            key: const ValueKey('huddle-leave'),
+            tooltip: 'Leave Huddle',
+            icon: LucideIcons.phoneOff,
+            foregroundColor: context.colors.error,
+            backgroundColor: context.colors.surfaceContainerHighest,
+            onPressed: isLeaving ? null : onLeave,
+          ),
+        ],
+      ),
+    );
+  }
+}
+
+_HuddleInvite? _activeHuddleStart(List<NostrEvent> events) {
+  final endedAt = <String, int>{};
+  for (final event in events) {
+    if (event.kind != EventKind.huddleEnded) continue;
+    final parsed = SystemEvent.fromHuddleEvent(event);
+    final id = parsed?.ephemeralChannelId;
+    if (id != null && event.createdAt > (endedAt[id] ?? 0)) {
+      endedAt[id] = event.createdAt;
+    }
+  }
+  final starts =
+      events.where((event) => event.kind == EventKind.huddleStarted).toList()
+        ..sort((left, right) => right.createdAt.compareTo(left.createdAt));
+  final now = DateTime.now().millisecondsSinceEpoch ~/ 1000;
+  for (final event in starts) {
+    if (now - event.createdAt > _huddleLifetime.inSeconds) continue;
+    final parsed = SystemEvent.fromHuddleEvent(event);
+    final ephemeralChannelId = parsed?.ephemeralChannelId;
+    final parentChannelId = event.channelId;
+    if (ephemeralChannelId == null || parentChannelId == null) continue;
+    if ((endedAt[ephemeralChannelId] ?? 0) >= event.createdAt) continue;
+    return _HuddleInvite(
+      parentChannelId: parentChannelId,
+      ephemeralChannelId: ephemeralChannelId,
+      startedBy: event.pubkey,
+      startedEventId: event.id,
+    );
+  }
+  return null;
+}
+
+String _huddleActionError(Object error) {
+  final message = error.toString();
+  return message
+      .replaceFirst('Bad state: ', '')
+      .replaceFirst('Invalid argument(s): ', '');
+}
+
+bool _isUnavailableHuddleError(String? error) =>
+    error?.trim().toLowerCase() == 'not a member';
diff --git a/mobile/lib/features/channels/channel_detail_page/message_list.dart b/mobile/lib/features/channels/channel_detail_page/message_list.dart
index 781b96c33ac..807111ef369 100644
--- a/mobile/lib/features/channels/channel_detail_page/message_list.dart
+++ b/mobile/lib/features/channels/channel_detail_page/message_list.dart
@@ -42,6 +42,9 @@ class _MessageList extends HookConsumerWidget {
   @override
   Widget build(BuildContext context, WidgetRef ref) {
     final appView = View.of(context);
+    final localSendAnimations = ref.watch(
+      localMessageSendAnimationProvider(channelId),
+    );
     final displayEntries = groupMembershipTimelineEntries(entries);
     final itemScrollController = useMemoized(ItemScrollController.new);
     final itemPositionsListener = useMemoized(ItemPositionsListener.create);
@@ -66,9 +69,11 @@ class _MessageList extends HookConsumerWidget {
     );
     final isAutoScrolling = useRef(false);
     final latestNavigationRequest = useState(0);
+    final latestNavigationTargetId = useRef<String?>(null);
     final latestRealignmentQueued = useRef(false);
     final latestEntryId = entries.isEmpty ? null : entries.last.message.id;
     final previousLatestEntryId = useRef<String?>(null);
+    final observedLocalSendIds = useRef(localSendAnimations.keys.toSet());
     final didOpenInitialThread = useRef(false);
     final didJumpToInitialMessage = useRef(false);
     final isUnreadNavigationDismissed = useState(false);
@@ -338,14 +343,16 @@ class _MessageList extends HookConsumerWidget {
         return;
       }
       try {
+        final targetIndex =
+            reversedIndexOf(latestNavigationTargetId.value) ?? 0;
         await itemScrollController.scrollTo(
-          index: 0,
+          index: targetIndex,
           alignment: latestAlignment(),
           duration: jumpToLatestScrollDuration,
           curve: jumpToLatestScrollCurve,
         );
         if (context.mounted && !hasUserScrolled.value) {
-          isAtLatest.value = true;
+          isAtLatest.value = targetIndex == 0;
           isJumpToLatestVisible.value = false;
         }
       } finally {
@@ -353,12 +360,13 @@ class _MessageList extends HookConsumerWidget {
       }
     }
 
-    void scrollToLatest() {
+    void scrollToLatest({String? targetMessageId}) {
       if (!itemScrollController.isAttached || isAutoScrolling.value) return;
       isAutoScrolling.value = true;
       followsLatest.value = true;
       hasUserScrolled.value = false;
       hasUnseenLatestEntry.value = false;
+      latestNavigationTargetId.value = targetMessageId;
       latestNavigationRequest.value += 1;
     }
 
@@ -617,18 +625,36 @@ class _MessageList extends HookConsumerWidget {
     useEffect(() {
       final previous = previousLatestEntryId.value;
       previousLatestEntryId.value = latestEntryId;
-      if (previous == null ||
-          latestEntryId == null ||
-          previous == latestEntryId) {
+      final entryIds = entries.map((entry) => entry.message.id).toSet();
+      final newlyInsertedLocalSendIds = localSendAnimations.keys
+          .where(
+            (eventId) =>
+                !observedLocalSendIds.value.contains(eventId) &&
+                entryIds.contains(eventId),
+          )
+          .toList();
+      observedLocalSendIds.value
+        ..removeWhere((eventId) => !localSendAnimations.containsKey(eventId))
+        ..addAll(newlyInsertedLocalSendIds);
+      final localSendId = newlyInsertedLocalSendIds.firstOrNull;
+      final latestEntryChanged =
+          previous != null &&
+          latestEntryId != null &&
+          previous != latestEntryId;
+      if (!latestEntryChanged && localSendId == null) {
         return null;
       }
+      if (localSendId != null) {
+        followsLatest.value = true;
+        hasUserScrolled.value = false;
+      }
       if (!followsLatest.value || hasUserScrolled.value) {
         hasUnseenLatestEntry.value = true;
       }
       WidgetsBinding.instance.addPostFrameCallback((_) {
         if (!context.mounted) return;
         if (followsLatest.value && !hasUserScrolled.value) {
-          scrollToLatest();
+          scrollToLatest(targetMessageId: localSendId);
           return;
         }
         final positions = itemPositionsListener.itemPositions.value;
@@ -640,7 +666,7 @@ class _MessageList extends HookConsumerWidget {
         }
       });
       return null;
-    }, [latestEntryId]);
+    }, [latestEntryId, localSendAnimations]);
 
     if (entries.isEmpty) {
       return Center(
@@ -781,57 +807,67 @@ class _MessageList extends HookConsumerWidget {
                             message.pubkey.toLowerCase() ||
                         (message.createdAt - prevMessage.createdAt) > 300);
 
-                return Padding(
-                  key: ValueKey('channel-message-group-${message.id}'),
-                  padding: EdgeInsets.only(bottom: index == 0 ? Grid.xs : 0),
-                  child: Column(
-                    crossAxisAlignment: CrossAxisAlignment.start,
-                    children: [
-                      if (showDayDivider)
-                        DayDivider(
-                          label: formatDayHeading(message.createdAt),
-                          dayTimestamp: message.createdAt,
-                          stickyDayTimestamp: stickyDayTimestamp,
-                        ),
-                      if (message.isSystem)
-                        _SystemMessageRow(
-                          message: message,
-                          groupedMessages: entryGroup.length > 1
-                              ? entryGroup
-                                    .map((entry) => entry.message)
-                                    .toList()
-                              : null,
-                          channelId: channelId,
-                          currentPubkey: currentPubkey,
-                          allMessages: null,
-                          isMember: isMember,
-                          isArchived: isArchived,
-                        )
-                      else ...[
-                        _MessageBubble(
-                          message: message,
-                          showAuthor: showAuthor,
-                          channelNames: channelNamesMap,
-                          currentChannelId: channelId,
-                          currentPubkey: currentPubkey,
-                          allMessages: allMessages,
-                          isMember: isMember,
-                          isArchived: isArchived,
-                          composerFocusNode: composerFocusNode,
-                          restoreComposerFocus: restoreComposerFocus,
-                        ),
-                        if (entry.summary != null)
-                          _ThreadSummaryRow(
-                            summary: entry.summary!,
+                return LocalMessageSendTransition(
+                  key: ValueKey('channel-message-send-${message.id}'),
+                  animate: isRecentLocalMessageSendAnimation(
+                    localSendAnimations,
+                    message.id,
+                  ),
+                  startOffsetFactor: showAuthor
+                      ? localMessageSendTransitionAvatarStartOffset
+                      : localMessageSendTransitionStartOffset,
+                  child: Padding(
+                    key: ValueKey('channel-message-group-${message.id}'),
+                    padding: EdgeInsets.only(bottom: index == 0 ? Grid.xs : 0),
+                    child: Column(
+                      crossAxisAlignment: CrossAxisAlignment.start,
+                      children: [
+                        if (showDayDivider)
+                          DayDivider(
+                            label: formatDayHeading(message.createdAt),
+                            dayTimestamp: message.createdAt,
+                            stickyDayTimestamp: stickyDayTimestamp,
+                          ),
+                        if (message.isSystem)
+                          _SystemMessageRow(
                             message: message,
-                            allMessages: allMessages,
+                            groupedMessages: entryGroup.length > 1
+                                ? entryGroup
+                                      .map((entry) => entry.message)
+                                      .toList()
+                                : null,
                             channelId: channelId,
                             currentPubkey: currentPubkey,
+                            allMessages: allMessages,
+                            isMember: isMember,
+                            isArchived: isArchived,
+                          )
+                        else ...[
+                          _MessageBubble(
+                            message: message,
+                            showAuthor: showAuthor,
+                            channelNames: channelNamesMap,
+                            currentChannelId: channelId,
+                            currentPubkey: currentPubkey,
+                            allMessages: allMessages,
                             isMember: isMember,
                             isArchived: isArchived,
+                            composerFocusNode: composerFocusNode,
+                            restoreComposerFocus: restoreComposerFocus,
                           ),
+                          if (entry.summary != null)
+                            _ThreadSummaryRow(
+                              summary: entry.summary!,
+                              message: message,
+                              allMessages: allMessages,
+                              channelId: channelId,
+                              currentPubkey: currentPubkey,
+                              isMember: isMember,
+                              isArchived: isArchived,
+                            ),
+                        ],
                       ],
-                    ],
+                    ),
                   ),
                 );
               },
diff --git a/mobile/lib/features/channels/channel_detail_page/system_rows.dart b/mobile/lib/features/channels/channel_detail_page/system_rows.dart
index 96f5655f411..5aaca11f4a6 100644
--- a/mobile/lib/features/channels/channel_detail_page/system_rows.dart
+++ b/mobile/lib/features/channels/channel_detail_page/system_rows.dart
@@ -164,6 +164,15 @@ class _SystemMessageRow extends HookConsumerWidget {
                         ],
                       ),
               ),
+              if (systemEvent.type == SystemEventType.huddleStarted &&
+                  systemEvent.ephemeralChannelId != null)
+                _HuddleJoinSurface(
+                  message: message,
+                  allMessages: allMessages ?? const [],
+                  parentChannelId: channelId,
+                  isMember: isMember,
+                  isArchived: isArchived,
+                ),
               if (reactions.isNotEmpty)
                 Padding(
                   padding: EdgeInsets.only(
diff --git a/mobile/lib/features/channels/channel_details_page.dart b/mobile/lib/features/channels/channel_details_page.dart
index cbe9be7a931..0fc68f7f3a8 100644
--- a/mobile/lib/features/channels/channel_details_page.dart
+++ b/mobile/lib/features/channels/channel_details_page.dart
@@ -249,11 +249,31 @@ class ChannelDetailsPage extends HookConsumerWidget {
     }
 
     final reducedMotion = MediaQuery.disableAnimationsOf(context);
+    final usesNativeIosGlassBackButton =
+        Navigator.canPop(context) &&
+        Theme.of(context).platform == TargetPlatform.iOS;
     return FrostedScaffold(
       backgroundColor: context.colors.surface,
       appBar: FrostedAppBar(
+        leading: usesNativeIosGlassBackButton
+            ? IosGlassNavigationButton(
+                key: const ValueKey('channel-details-ios-glass-back'),
+                icon: IosGlassNavigationIcon.back,
+                semanticLabel: 'Back',
+                onPressed: () => Navigator.of(context).maybePop(),
+                width: iosGlassChannelHeaderLeadingWidth,
+                buttonCenterX: iosGlassChannelHeaderButtonCenterX,
+              )
+            : null,
         iconColor: context.colors.primary,
-        actions: const [SizedBox.square(dimension: 48)],
+        actions: [
+          SizedBox(
+            width: usesNativeIosGlassBackButton
+                ? iosGlassChannelHeaderLeadingWidth
+                : 48,
+            height: 48,
+          ),
+        ],
         frosted: headerFrostProgress.value > 0,
         frostedSurfaceOpacity: 0.5 * headerFrostProgress.value,
         frostedBlurSigma:
@@ -302,8 +322,14 @@ class ChannelDetailsPage extends HookConsumerWidget {
                   Expanded(
                     child: BuzzActionTile(
                       key: const ValueKey('channel-details-star-action'),
-                      icon: isStarred ? LucideIcons.starOff : LucideIcons.star,
-                      label: isStarred ? 'Unstar' : 'Star channel',
+                      icon: null,
+                      iconWidget: LucideStarIcon(
+                        filled: isStarred,
+                        color: isStarred
+                            ? context.colors.primary
+                            : context.colors.onSurface,
+                      ),
+                      label: isStarred ? 'Unstar' : 'Star',
                       onTap: toggleStar,
                     ),
                   ),
@@ -312,7 +338,8 @@ class ChannelDetailsPage extends HookConsumerWidget {
                     child: BuzzActionTile(
                       key: const ValueKey('channel-details-mute-action'),
                       icon: isMuted ? LucideIcons.bell : LucideIcons.bellOff,
-                      label: isMuted ? 'Unmute' : 'Mute channel',
+                      iconColor: isMuted ? context.colors.primary : null,
+                      label: isMuted ? 'Unmute' : 'Mute',
                       onTap: toggleMute,
                     ),
                   ),
diff --git a/mobile/lib/features/channels/channel_huddle_actions.dart b/mobile/lib/features/channels/channel_huddle_actions.dart
new file mode 100644
index 00000000000..537bf443940
--- /dev/null
+++ b/mobile/lib/features/channels/channel_huddle_actions.dart
@@ -0,0 +1,91 @@
+part of 'channel_management_provider.dart';
+
+const _huddleReactionNameMax = 48;
+
+String _clampHuddleReactionName(String name) {
+  final trimmed = name.trim();
+  if (trimmed.length <= _huddleReactionNameMax) return trimmed;
+  return '${trimmed.substring(0, _huddleReactionNameMax - 1).trimRight()}…';
+}
+
+/// Canonical Huddle lifecycle operations built on the shared channel actions.
+extension HuddleChannelActions on ChannelActions {
+  /// Creates the private, one-hour stream used only by Huddle media.
+  Future<String> createHuddleBackingChannel() async {
+    final channelId = _newUuidV4();
+    await _signedEventRelay.submit(
+      kind: 9007,
+      content: '',
+      tags: buildCreateChannelTags(
+        channelId: channelId,
+        name: 'huddle-${channelId.substring(0, 8)}',
+        channelType: 'stream',
+        visibility: 'private',
+        ttlSeconds: 3600,
+      ),
+    );
+    // The accepted kind:9007 write has already committed creator membership
+    // on the relay. Avoid refreshing the global channel list here: the backing
+    // channel is intentionally hidden, and racing its membership fan-out can
+    // temporarily make the parent channel appear read-only.
+    return channelId;
+  }
+
+  /// Publishes the canonical creator-signed Huddle start event in its parent.
+  Future<NostrEvent> announceHuddleStarted({
+    required String parentChannelId,
+    required String ephemeralChannelId,
+  }) async {
+    NostrEvent? signed;
+    await _signedEventRelay.submit(
+      kind: EventKind.huddleStarted,
+      content: jsonEncode({'ephemeral_channel_id': ephemeralChannelId}),
+      tags: [
+        ['h', parentChannelId],
+      ],
+      onSigned: (event) => signed = event,
+    );
+    return signed ??
+        (throw StateError('Huddle start event was not signed locally'));
+  }
+
+  /// Publishes the canonical creator-signed Huddle end event in its parent.
+  Future<void> announceHuddleEnded({
+    required String parentChannelId,
+    required String ephemeralChannelId,
+  }) async {
+    await _signedEventRelay.submit(
+      kind: EventKind.huddleEnded,
+      content: jsonEncode({'ephemeral_channel_id': ephemeralChannelId}),
+      tags: [
+        ['h', parentChannelId],
+      ],
+    );
+  }
+
+  /// Sends an ephemeral emoji burst to the active Huddle backing channel.
+  Future<void> sendHuddleReaction({
+    required String channelId,
+    required String emoji,
+    required String senderName,
+  }) async {
+    final normalizedEmoji = emoji.trim();
+    if (normalizedEmoji.isEmpty) return;
+    final shortcode = normalizeShortcode(normalizedEmoji);
+    final emojiUrl = reactionEmojiUrl(
+      normalizedEmoji,
+      _ref.read(customEmojiListProvider),
+    );
+    await _signedEventRelay.submit(
+      kind: EventKind.huddleReaction,
+      content: normalizedEmoji,
+      tags: [
+        ['h', channelId],
+        ['reaction', normalizedEmoji],
+        ['sender_name', _clampHuddleReactionName(senderName)],
+        if (shortcode != null && emojiUrl != null)
+          ['emoji', shortcode, emojiUrl],
+      ],
+    );
+  }
+}
diff --git a/mobile/lib/features/channels/channel_management_provider.dart b/mobile/lib/features/channels/channel_management_provider.dart
index 68d5250bc2c..9e021ab5178 100644
--- a/mobile/lib/features/channels/channel_management_provider.dart
+++ b/mobile/lib/features/channels/channel_management_provider.dart
@@ -16,6 +16,7 @@ import 'channels_provider.dart';
 
 export 'channel_metadata_updates.dart';
 
+part 'channel_huddle_actions.dart';
 part 'channel_management_actions.dart';
 
 String _relayErrorMessage(Object error) =>
diff --git a/mobile/lib/features/channels/channel_mutes/channel_mutes_manager.dart b/mobile/lib/features/channels/channel_mutes/channel_mutes_manager.dart
index eb768dd8fae..32c163a1bbd 100644
--- a/mobile/lib/features/channels/channel_mutes/channel_mutes_manager.dart
+++ b/mobile/lib/features/channels/channel_mutes/channel_mutes_manager.dart
@@ -100,6 +100,7 @@ class ChannelMutesManager {
     );
     _store = ChannelMuteStore(channels: {..._store.channels, channelId: entry});
     _persist();
+    _onChanged();
     markDirty();
   }
 
@@ -111,6 +112,7 @@ class ChannelMutesManager {
     );
     _store = ChannelMuteStore(channels: {..._store.channels, channelId: entry});
     _persist();
+    _onChanged();
     markDirty();
   }
 
diff --git a/mobile/lib/features/channels/channel_stars/channel_stars_manager.dart b/mobile/lib/features/channels/channel_stars/channel_stars_manager.dart
index c4f4da862ff..94fba0acb9d 100644
--- a/mobile/lib/features/channels/channel_stars/channel_stars_manager.dart
+++ b/mobile/lib/features/channels/channel_stars/channel_stars_manager.dart
@@ -100,6 +100,7 @@ class ChannelStarsManager {
     );
     _store = ChannelStarStore(channels: {..._store.channels, channelId: entry});
     _persist();
+    _onChanged();
     markDirty();
   }
 
@@ -111,6 +112,7 @@ class ChannelStarsManager {
     );
     _store = ChannelStarStore(channels: {..._store.channels, channelId: entry});
     _persist();
+    _onChanged();
     markDirty();
   }
 
diff --git a/mobile/lib/features/channels/channels_provider.dart b/mobile/lib/features/channels/channels_provider.dart
index 2f8dddf2d92..deb6869cb2e 100644
--- a/mobile/lib/features/channels/channels_provider.dart
+++ b/mobile/lib/features/channels/channels_provider.dart
@@ -12,6 +12,7 @@ import 'channel.dart';
 import 'channel_management_provider.dart'
     show ChannelMember, channelDetailsProvider;
 import 'channel_mutes/channel_mutes_provider.dart';
+import 'huddle_channel_filter.dart';
 import '../../shared/read_state/read_state_provider.dart';
 import 'thread_follows/thread_follows_provider.dart';
 import 'unread_badge/is_high_priority_event.dart';
@@ -229,6 +230,21 @@ class ChannelsNotifier extends AsyncNotifier<List<Channel>> {
     }
 
     final hiddenDmIds = await _fetchHiddenDmIds(session, myPk);
+    // Fetch the authoritative membership snapshots before filtering Huddle
+    // backing channels. The relay-signed kind:39000 metadata identifies the
+    // relay, not the channel creator; the owner role in kind:39002 is the
+    // canonical creator identity used to reject forged Huddle links.
+    final memberEvents = await session.fetchHistory(
+      NostrFilter(
+        kinds: const [39002],
+        tags: {'#d': channelIds},
+        limit: channelIds.length,
+      ),
+    );
+    final huddleBackingIds = huddleBackingChannelIds(
+      await _fetchHuddleStarts(session, channelIds),
+      memberEvents,
+    );
 
     final channels = <Channel>[];
     for (final event in dedupedMetas) {
@@ -238,6 +254,11 @@ class ChannelsNotifier extends AsyncNotifier<List<Channel>> {
         displayNames: displayNames,
       );
       if (channel.isDm && hiddenDmIds.contains(channel.id)) continue;
+      if (huddleBackingIds.contains(channel.id) &&
+          channel.isStream &&
+          channel.isPrivate) {
+        continue;
+      }
       // Ephemeral (TTL) channels are surfaced in the list with an
       // `_EphemeralBadge` rendered in `channels_page.dart` — they shouldn't be
       // hidden. Desktop shows them too. Previously dropped here unconditionally,
@@ -245,14 +266,8 @@ class ChannelsNotifier extends AsyncNotifier<List<Channel>> {
       channels.add(channel);
     }
 
-    // Batch-fetch member counts via kind:39002 membership events.
-    final memberEvents = await session.fetchHistory(
-      NostrFilter(
-        kinds: const [39002],
-        tags: {'#d': channelIds},
-        limit: channelIds.length,
-      ),
-    );
+    // Use the membership snapshots already fetched above for both Huddle
+    // linkage validation and member-count hydration.
     if (memberEvents.isNotEmpty) _cacheMemberSnapshots(memberEvents);
     final memberCounts = <String, int>{};
     for (final event in memberEvents) {
@@ -477,6 +492,29 @@ class ChannelsNotifier extends AsyncNotifier<List<Channel>> {
     }
   }
 
+  Future<List<NostrEvent>> _fetchHuddleStarts(
+    RelaySessionNotifier session,
+    List<String> parentChannelIds,
+  ) async {
+    if (parentChannelIds.isEmpty) return const [];
+    try {
+      final now = DateTime.now().millisecondsSinceEpoch ~/ 1000;
+      return await session.fetchHistory(
+        NostrFilter(
+          kinds: const [EventKind.huddleStarted],
+          tags: {'#h': parentChannelIds},
+          since: now - const Duration(hours: 2).inSeconds,
+          limit: 500,
+        ),
+      );
+    } catch (error) {
+      debugPrint(
+        '[ChannelsNotifier] Huddle backing-channel query failed: $error',
+      );
+      return const [];
+    }
+  }
+
   /// Build a [Channel] from a kind:39000 metadata event.
   ///
   /// [displayNames] maps lowercase participant pubkey → resolved label and is
diff --git a/mobile/lib/features/channels/compose_bar.dart b/mobile/lib/features/channels/compose_bar.dart
index ee2ba7a7aa9..b36c2d3f1c8 100644
--- a/mobile/lib/features/channels/compose_bar.dart
+++ b/mobile/lib/features/channels/compose_bar.dart
@@ -24,6 +24,7 @@ import '../../shared/widgets/avatar_image.dart';
 import '../../shared/widgets/anchored_popover_menu.dart';
 import '../../shared/widgets/buzz_loading_indicator.dart';
 import '../../shared/widgets/keyboard_dismiss_on_drag.dart';
+import '../../shared/widgets/ios_glass_navigation_button.dart';
 import '../../shared/widgets/mobile_tab_footer_backdrop.dart';
 import '../../shared/widgets/modal_presentation.dart';
 import '../../shared/profile/user_cache_provider.dart';
diff --git a/mobile/lib/features/channels/compose_bar/camera_preview.dart b/mobile/lib/features/channels/compose_bar/camera_preview.dart
index 1a06534d6e3..32cc992a562 100644
--- a/mobile/lib/features/channels/compose_bar/camera_preview.dart
+++ b/mobile/lib/features/channels/compose_bar/camera_preview.dart
@@ -287,6 +287,16 @@ class _CameraCloseButton extends StatelessWidget {
 
   @override
   Widget build(BuildContext context) {
+    if (Theme.of(context).platform == TargetPlatform.iOS) {
+      return IosGlassNavigationButton(
+        icon: IosGlassNavigationIcon.back,
+        semanticLabel: 'Back to attachment options',
+        onPressed: () => _runComposerAction(onTap),
+        width: emphasized ? _cameraBackSize : 40,
+        height: emphasized ? _cameraBackSize : 40,
+        foregroundColor: Colors.white,
+      );
+    }
     return SizedBox.square(
       dimension: emphasized ? _cameraBackSize : 36,
       child: IconButton(
diff --git a/mobile/lib/features/channels/compose_bar/compose_bar_widget.dart b/mobile/lib/features/channels/compose_bar/compose_bar_widget.dart
index 344972f10e0..b63731662cc 100644
--- a/mobile/lib/features/channels/compose_bar/compose_bar_widget.dart
+++ b/mobile/lib/features/channels/compose_bar/compose_bar_widget.dart
@@ -456,6 +456,7 @@ class ComposeBar extends HookConsumerWidget {
           uploadingCount.value > 0) {
         return;
       }
+      final submittedDraftRevision = draftRevision.value;
       // Resolved before any await: see
       // `_reportSendCancelledByCommunitySwitch`.
       final messenger = ScaffoldMessenger.maybeOf(context);
@@ -501,29 +502,25 @@ class ComposeBar extends HookConsumerWidget {
       isSending.value = true;
       try {
         if (queuedAttachments.isEmpty) {
-          try {
-            await addMentionedNonMembers();
-            final payload = _ComposeDraftPayload.fromDraft(
+          if (!context.mounted) return;
+          await _sendTextOnlyDraft(
+            context: context,
+            controller: controller,
+            mentionMap: mentionMap,
+            draftRevision: draftRevision,
+            submittedDraftRevision: submittedDraftRevision,
+            focusNode: focusNode,
+            clearComposer: clearComposer,
+            addMentionedNonMembers: addMentionedNonMembers,
+            payload: _ComposeDraftPayload.fromDraft(
               text: text,
               attachments: const [],
               customEmoji: customEmoji,
-            );
-            await onSend(
-              payload.content,
-              outgoing.pubkeys,
-              mediaTags: [...payload.mediaTags, ...outgoing.referenceTags],
-            );
-            if (context.mounted) clearComposer();
-          } on StateError {
-            _reportSendCancelledByCommunitySwitch(messenger);
-          } catch (error) {
-            // send() runs unawaited, so a relay rejection or publish timeout
-            // would otherwise vanish with the composer looking idle. The draft
-            // is kept (clearComposer never ran) so the user can retry.
-            messenger?.showSnackBar(
-              SnackBar(content: Text(_composeSendErrorMessage(error))),
-            );
-          }
+            ),
+            outgoing: outgoing,
+            onSend: onSend,
+            messenger: messenger,
+          );
           return;
         }
 
diff --git a/mobile/lib/features/channels/compose_bar/draft_lifecycle.dart b/mobile/lib/features/channels/compose_bar/draft_lifecycle.dart
index dd58be9da4a..288fad4bf1d 100644
--- a/mobile/lib/features/channels/compose_bar/draft_lifecycle.dart
+++ b/mobile/lib/features/channels/compose_bar/draft_lifecycle.dart
@@ -1,5 +1,67 @@
 part of '../compose_bar.dart';
 
+Future<void> _sendTextOnlyDraft({
+  required BuildContext context,
+  required _MarkdownEditingController controller,
+  required ObjectRef<Map<String, MentionCandidate>> mentionMap,
+  required ObjectRef<int> draftRevision,
+  required int submittedDraftRevision,
+  required FocusNode focusNode,
+  required VoidCallback clearComposer,
+  required Future<void> Function() addMentionedNonMembers,
+  required _ComposeDraftPayload payload,
+  required _OutgoingMentions outgoing,
+  required ComposeBarOnSend onSend,
+  required ScaffoldMessengerState? messenger,
+}) async {
+  TextEditingValue? clearedDraftText;
+  Map<String, MentionCandidate>? clearedDraftMentions;
+  int? clearedDraftRevision;
+
+  void restoreClearedDraft() {
+    if (!context.mounted ||
+        clearedDraftText == null ||
+        clearedDraftMentions == null ||
+        clearedDraftRevision == null ||
+        draftRevision.value != clearedDraftRevision) {
+      return;
+    }
+    controller.value = clearedDraftText;
+    mentionMap.value
+      ..clear()
+      ..addAll(clearedDraftMentions);
+    focusNode.requestFocus();
+  }
+
+  try {
+    await addMentionedNonMembers();
+    // Clear before optimistic insertion so the outgoing row and draft never
+    // appear simultaneously during the send transition. If the user edited
+    // while membership changes were pending, preserve that newer draft.
+    if (context.mounted && draftRevision.value == submittedDraftRevision) {
+      clearedDraftText = controller.value;
+      clearedDraftMentions = Map<String, MentionCandidate>.of(mentionMap.value);
+      clearComposer();
+      clearedDraftRevision = draftRevision.value;
+    }
+    await onSend(
+      payload.content,
+      outgoing.pubkeys,
+      mediaTags: [...payload.mediaTags, ...outgoing.referenceTags],
+    );
+  } on StateError {
+    restoreClearedDraft();
+    _reportSendCancelledByCommunitySwitch(messenger);
+  } catch (error) {
+    // The caller runs unawaited, so surface publish failures and restore the
+    // sent draft unless the user has already started a new one.
+    restoreClearedDraft();
+    messenger?.showSnackBar(
+      SnackBar(content: Text(_composeSendErrorMessage(error))),
+    );
+  }
+}
+
 void _useComposeDraftLifecycle({
   required WidgetRef ref,
   required _MarkdownEditingController controller,
diff --git a/mobile/lib/features/channels/compose_bar/ios_photo_picker.dart b/mobile/lib/features/channels/compose_bar/ios_photo_picker.dart
index 0548d73fd20..0b94aad550a 100644
--- a/mobile/lib/features/channels/compose_bar/ios_photo_picker.dart
+++ b/mobile/lib/features/channels/compose_bar/ios_photo_picker.dart
@@ -138,25 +138,14 @@ class _IOSInlinePhotoPicker extends HookWidget {
             bottom: Grid.twelve,
             child: SafeArea(
               top: false,
-              child: DecoratedBox(
-                decoration: BoxDecoration(
-                  color: Colors.black.withValues(alpha: 0.62),
-                  shape: BoxShape.circle,
-                  border: Border.all(
-                    color: Colors.white.withValues(alpha: 0.28),
-                  ),
-                ),
-                child: IconButton(
-                  key: const ValueKey('ios-inline-photo-picker-back'),
-                  onPressed: isProcessing.value
-                      ? null
-                      : () => _runComposerAction(onBack),
-                  tooltip: 'Back to attachment options',
-                  icon: const Icon(
-                    LucideIcons.chevronLeft,
-                    color: Colors.white,
-                  ),
-                ),
+              child: IosGlassNavigationButton(
+                key: const ValueKey('ios-inline-photo-picker-back'),
+                icon: IosGlassNavigationIcon.back,
+                semanticLabel: 'Back to attachment options',
+                onPressed: isProcessing.value
+                    ? null
+                    : () => _runComposerAction(onBack),
+                foregroundColor: Colors.white,
               ),
             ),
           ),
diff --git a/mobile/lib/features/channels/compose_bar/photo_gallery_picker.dart b/mobile/lib/features/channels/compose_bar/photo_gallery_picker.dart
index d40fd93a227..349aa3237aa 100644
--- a/mobile/lib/features/channels/compose_bar/photo_gallery_picker.dart
+++ b/mobile/lib/features/channels/compose_bar/photo_gallery_picker.dart
@@ -160,15 +160,27 @@ class _RecentPhotoGalleryPicker extends HookConsumerWidget {
             height: 40,
             child: Row(
               children: [
-                IconButton(
-                  key: const ValueKey('photo-gallery-back'),
-                  onPressed: isResolving.value
-                      ? null
-                      : () => _runComposerAction(onBack),
-                  tooltip: 'Back to attachment options',
-                  visualDensity: VisualDensity.compact,
-                  icon: const Icon(LucideIcons.arrowLeft, size: 20),
-                ),
+                if (Theme.of(context).platform == TargetPlatform.iOS)
+                  IosGlassNavigationButton(
+                    key: const ValueKey('photo-gallery-back'),
+                    icon: IosGlassNavigationIcon.back,
+                    semanticLabel: 'Back to attachment options',
+                    onPressed: isResolving.value
+                        ? null
+                        : () => _runComposerAction(onBack),
+                    width: 40,
+                    height: 40,
+                  )
+                else
+                  IconButton(
+                    key: const ValueKey('photo-gallery-back'),
+                    onPressed: isResolving.value
+                        ? null
+                        : () => _runComposerAction(onBack),
+                    tooltip: 'Back to attachment options',
+                    visualDensity: VisualDensity.compact,
+                    icon: const Icon(LucideIcons.arrowLeft, size: 20),
+                  ),
                 const SizedBox(width: Grid.quarter),
                 Expanded(
                   child: Text(
diff --git a/mobile/lib/features/channels/huddle_channel_filter.dart b/mobile/lib/features/channels/huddle_channel_filter.dart
new file mode 100644
index 00000000000..4f0f7779cac
--- /dev/null
+++ b/mobile/lib/features/channels/huddle_channel_filter.dart
@@ -0,0 +1,45 @@
+import 'dart:convert';
+
+import '../../shared/relay/relay.dart';
+
+/// Returns backing-channel IDs whose Huddle starts are signed by the
+/// authoritative channel owner.
+Set<String> huddleBackingChannelIds(
+  Iterable<NostrEvent> starts,
+  Iterable<NostrEvent> membershipSnapshots,
+) {
+  final ownersByChannelId = <String, Set<String>>{};
+  for (final snapshot in membershipSnapshots) {
+    if (snapshot.kind != 39002) continue;
+    final channelId = snapshot.getTagValue('d');
+    if (channelId == null) continue;
+    ownersByChannelId[channelId] = {
+      for (final member in membersFromEvent(snapshot))
+        if (member.role == 'owner') member.pubkey.toLowerCase(),
+    };
+  }
+
+  final backingIds = <String>{};
+  for (final start in starts) {
+    final backingChannelId = _huddleBackingChannelId(start.content);
+    if (backingChannelId != null &&
+        (ownersByChannelId[backingChannelId] ?? const {}).contains(
+          start.pubkey.toLowerCase(),
+        )) {
+      backingIds.add(backingChannelId);
+    }
+  }
+  return backingIds;
+}
+
+String? _huddleBackingChannelId(String content) {
+  try {
+    final decoded = jsonDecode(content);
+    if (decoded is! Map) return null;
+    final value = decoded['ephemeral_channel_id'];
+    if (value is! String || value.isEmpty) return null;
+    return value;
+  } catch (_) {
+    return null;
+  }
+}
diff --git a/mobile/lib/features/channels/local_message_send_animation_provider.dart b/mobile/lib/features/channels/local_message_send_animation_provider.dart
new file mode 100644
index 00000000000..1b3fa0f0368
--- /dev/null
+++ b/mobile/lib/features/channels/local_message_send_animation_provider.dart
@@ -0,0 +1,51 @@
+import 'package:hooks_riverpod/hooks_riverpod.dart';
+
+const _localMessageSendAnimationClaimWindow = Duration(seconds: 1);
+
+/// Recently signed local messages that may play the send entrance animation.
+///
+/// The short claim window prevents a message first rendered much later (for
+/// example after opening its channel) from looking newly sent.
+class LocalMessageSendAnimationNotifier
+    extends Notifier<Map<String, DateTime>> {
+  /// The channel whose outgoing messages are tracked by this notifier.
+  final String channelId;
+
+  /// Creates animation state scoped to [channelId].
+  LocalMessageSendAnimationNotifier(this.channelId);
+
+  @override
+  Map<String, DateTime> build() => const {};
+
+  /// Marks [eventId] as a newly signed local message eligible for animation.
+  void mark(String eventId) {
+    final now = DateTime.now();
+    state = {
+      for (final entry in state.entries)
+        if (now.difference(entry.value) <=
+            _localMessageSendAnimationClaimWindow)
+          entry.key: entry.value,
+      eventId: now,
+    };
+  }
+}
+
+/// Whether [eventId] was marked recently enough to animate as a local send.
+bool isRecentLocalMessageSendAnimation(
+  Map<String, DateTime> animations,
+  String eventId, {
+  DateTime? now,
+}) {
+  final markedAt = animations[eventId];
+  if (markedAt == null) return false;
+  return (now ?? DateTime.now()).difference(markedAt) <=
+      _localMessageSendAnimationClaimWindow;
+}
+
+/// Recent local-send animation claims keyed by channel and event ID.
+final localMessageSendAnimationProvider =
+    NotifierProvider.family<
+      LocalMessageSendAnimationNotifier,
+      Map<String, DateTime>,
+      String
+    >(LocalMessageSendAnimationNotifier.new);
diff --git a/mobile/lib/features/channels/local_message_send_transition.dart b/mobile/lib/features/channels/local_message_send_transition.dart
new file mode 100644
index 00000000000..dcf8df4f9a7
--- /dev/null
+++ b/mobile/lib/features/channels/local_message_send_transition.dart
@@ -0,0 +1,72 @@
+import 'dart:async';
+
+import 'package:flutter/material.dart';
+import 'package:flutter_hooks/flutter_hooks.dart';
+
+/// Duration of a local message's entrance transition.
+const localMessageSendTransitionDuration = Duration(milliseconds: 300);
+
+/// Default vertical offset, in child heights, for a message entrance.
+const localMessageSendTransitionStartOffset = 1.5;
+
+/// Vertical offset, in child heights, used for an avatar entrance.
+const localMessageSendTransitionAvatarStartOffset = 2.5;
+
+/// Slides a newly sent local message upward from beneath the composer.
+class LocalMessageSendTransition extends HookWidget {
+  /// Creates a local send transition around [child].
+  const LocalMessageSendTransition({
+    super.key,
+    required this.animate,
+    this.startOffsetFactor = localMessageSendTransitionStartOffset,
+    required this.child,
+  });
+
+  /// Whether to play the entrance transition.
+  final bool animate;
+
+  /// Initial vertical offset expressed as a multiple of the child's height.
+  final double startOffsetFactor;
+
+  /// Message content translated by the transition.
+  final Widget child;
+
+  @override
+  Widget build(BuildContext context) {
+    final reduceMotion = MediaQuery.disableAnimationsOf(context);
+    final controller = useAnimationController(
+      duration: localMessageSendTransitionDuration,
+      initialValue: animate && !reduceMotion ? 0 : 1,
+    );
+    final easedAnimation = useMemoized(
+      () => CurvedAnimation(parent: controller, curve: Curves.easeOutCubic),
+      [controller],
+    );
+    useEffect(() => easedAnimation.dispose, [easedAnimation]);
+
+    useEffect(() {
+      if (animate && !reduceMotion) {
+        unawaited(
+          controller.animateTo(
+            1,
+            duration: localMessageSendTransitionDuration,
+            curve: Curves.linear,
+          ),
+        );
+      } else {
+        controller.value = 1;
+      }
+      return null;
+    }, [animate, controller, reduceMotion]);
+
+    return AnimatedBuilder(
+      animation: easedAnimation,
+      child: child,
+      builder: (context, child) => FractionalTranslation(
+        translation: Offset(0, startOffsetFactor * (1 - easedAnimation.value)),
+        transformHitTests: false,
+        child: child,
+      ),
+    );
+  }
+}
diff --git a/mobile/lib/features/channels/media_viewer_page.dart b/mobile/lib/features/channels/media_viewer_page.dart
index b5eb308c634..1c3b50c44b3 100644
--- a/mobile/lib/features/channels/media_viewer_page.dart
+++ b/mobile/lib/features/channels/media_viewer_page.dart
@@ -14,6 +14,7 @@ import 'package:video_player/video_player.dart';
 import '../../shared/relay/relay.dart';
 import '../../shared/theme/theme.dart';
 import '../../shared/widgets/buzz_loading_indicator.dart';
+import '../../shared/widgets/ios_glass_navigation_button.dart';
 import 'media_viewer_hero.dart';
 
 export 'media_viewer_hero.dart';
@@ -648,9 +649,8 @@ class MediaImageViewerPage extends HookConsumerWidget {
               child: Opacity(
                 opacity: chromeOpacity,
                 child: SafeArea(
-                  child: _MediaViewerCircleButton(
+                  child: _MediaViewerCloseButton(
                     key: const ValueKey('message-media-image-viewer-close'),
-                    icon: LucideIcons.x,
                     tooltip: 'Close image viewer',
                     onPressed: () => unawaited(dismiss()),
                   ),
diff --git a/mobile/lib/features/channels/media_viewer_page/image_controls.dart b/mobile/lib/features/channels/media_viewer_page/image_controls.dart
index 77361676116..e3c623704e4 100644
--- a/mobile/lib/features/channels/media_viewer_page/image_controls.dart
+++ b/mobile/lib/features/channels/media_viewer_page/image_controls.dart
@@ -259,6 +259,34 @@ class _MediaViewerCircleButton extends StatelessWidget {
   }
 }
 
+class _MediaViewerCloseButton extends StatelessWidget {
+  const _MediaViewerCloseButton({
+    super.key,
+    required this.tooltip,
+    required this.onPressed,
+  });
+
+  final String tooltip;
+  final VoidCallback onPressed;
+
+  @override
+  Widget build(BuildContext context) {
+    if (Theme.of(context).platform == TargetPlatform.iOS) {
+      return IosGlassNavigationButton(
+        icon: IosGlassNavigationIcon.close,
+        semanticLabel: tooltip,
+        onPressed: onPressed,
+        foregroundColor: Colors.white,
+      );
+    }
+    return _MediaViewerCircleButton(
+      icon: LucideIcons.x,
+      tooltip: tooltip,
+      onPressed: onPressed,
+    );
+  }
+}
+
 Size _imageViewerSize(Size viewport, double? aspectRatio) {
   if (aspectRatio == null || aspectRatio <= 0) {
     return viewport;
diff --git a/mobile/lib/features/channels/media_viewer_page/video_viewer.dart b/mobile/lib/features/channels/media_viewer_page/video_viewer.dart
index dc4a82b5064..7267795734a 100644
--- a/mobile/lib/features/channels/media_viewer_page/video_viewer.dart
+++ b/mobile/lib/features/channels/media_viewer_page/video_viewer.dart
@@ -294,9 +294,8 @@ class MediaVideoViewerPage extends HookConsumerWidget {
             child: Opacity(
               opacity: chromeOpacity,
               child: SafeArea(
-                child: _MediaViewerCircleButton(
+                child: _MediaViewerCloseButton(
                   key: const ValueKey('message-media-video-viewer-close'),
-                  icon: LucideIcons.x,
                   tooltip: 'Close video viewer',
                   onPressed: () => Navigator.of(context).maybePop(),
                 ),
diff --git a/mobile/lib/features/channels/mobile_huddle_controller.dart b/mobile/lib/features/channels/mobile_huddle_controller.dart
new file mode 100644
index 00000000000..4cb856f3811
--- /dev/null
+++ b/mobile/lib/features/channels/mobile_huddle_controller.dart
@@ -0,0 +1,514 @@
+import 'dart:async';
+
+import 'package:flutter/widgets.dart';
+import 'package:hooks_riverpod/hooks_riverpod.dart';
+
+import '../../shared/community/community_provider.dart';
+import '../../shared/huddle/huddle.dart';
+import '../../shared/relay/relay.dart';
+import 'channel_management_provider.dart';
+
+typedef HuddleHumanCountLoader = Future<int> Function(String channelId);
+
+enum MobileHuddlePresentation { hidden, fullScreen, drawer }
+
+/// Tracks whether the foreground Huddle owns the screen or lives in the
+/// persistent app-level drawer. Audio lifecycle remains owned separately by
+/// [huddleSessionProvider].
+final class MobileHuddlePresentationNotifier
+    extends Notifier<MobileHuddlePresentation> {
+  @override
+  MobileHuddlePresentation build() {
+    ref.listen(huddleSessionProvider, (_, next) {
+      if (!next.isInSession && state != MobileHuddlePresentation.hidden) {
+        state = MobileHuddlePresentation.hidden;
+      }
+    });
+    return MobileHuddlePresentation.hidden;
+  }
+
+  void showFullScreen() => state = MobileHuddlePresentation.fullScreen;
+
+  void minimize() {
+    if (ref.read(huddleSessionProvider).isInSession) {
+      state = MobileHuddlePresentation.drawer;
+    }
+  }
+
+  void hide() => state = MobileHuddlePresentation.hidden;
+}
+
+final mobileHuddlePresentationProvider =
+    NotifierProvider<
+      MobileHuddlePresentationNotifier,
+      MobileHuddlePresentation
+    >(MobileHuddlePresentationNotifier.new);
+
+/// Loads the backing-channel human count used by desktop's leave rule.
+///
+/// A disconnected or failed lookup throws so [MobileHuddleController.leave]
+/// can take desktop's safe fallback: assume another human remains and avoid
+/// ending the Huddle on transient relay failure.
+final huddleHumanCountProvider = Provider<HuddleHumanCountLoader>((ref) {
+  return (channelId) async {
+    if (ref.read(relaySessionProvider).status != SessionStatus.connected) {
+      throw StateError('Relay is unavailable for Huddle member lookup.');
+    }
+    // Desktop always queries the relay's current kind:39002 snapshot here.
+    // The UI-facing provider intentionally preserves cached members through
+    // reconnects, but that cache can lag a leave event and must not decide
+    // whether the room ends for everyone.
+    final events = await ref
+        .read(relaySessionProvider.notifier)
+        .fetchHistory(NostrFilters.channelMembers(channelId));
+    if (ref.read(relaySessionProvider).status != SessionStatus.connected) {
+      throw StateError('Relay disconnected during Huddle member lookup.');
+    }
+    if (events.isEmpty) return 0;
+    return membersFromEvent(
+      events.first,
+    ).where((member) => member.role != 'bot').length;
+  };
+});
+
+/// Complete parent-channel Huddle lifecycle, independent of timeline paging.
+final huddleLifecycleProvider = FutureProvider.family<List<NostrEvent>, String>(
+  (ref, channelId) async {
+    if (ref.watch(relaySessionProvider).status != SessionStatus.connected) {
+      return const [];
+    }
+    return ref
+        .read(relaySessionProvider.notifier)
+        .fetchHistory(NostrFilters.huddleLifecycle(channelId));
+  },
+);
+
+/// One successful relay admission. Its epoch changes only when a newer join or
+/// start attempt begins, so duplicate teardown calls cannot invalidate the
+/// cleanup already in flight for the same admission.
+final class _HuddleAdmissionToken {
+  final int epoch;
+  final String backingChannelId;
+
+  const _HuddleAdmissionToken(this.epoch, this.backingChannelId);
+}
+
+/// Coordinates the Nostr lifecycle around the foreground audio session.
+final class MobileHuddleController extends Notifier<bool> {
+  var _generation = 0;
+  var _admissionEpoch = 0;
+  String? _latestAdmissionTargetBackingChannelId;
+  _HuddleAdmissionToken? _admissionToken;
+  final Set<_HuddleAdmissionToken> _finishedLifecycleAdmissions = {};
+
+  @override
+  bool build() {
+    final unregisterBeforePause = ref
+        .read(relaySessionProvider.notifier)
+        .registerBeforePause(_leaveForBackground);
+    final unregisterBeforeCommunityTransition = ref
+        .read(communityTransitionProvider)
+        .register(_leaveForTransition);
+    ref.onDispose(unregisterBeforePause);
+    ref.onDispose(unregisterBeforeCommunityTransition);
+    ref.listen(huddleSessionProvider, (previous, next) {
+      if (previous?.wasAdmitted == true &&
+          next.phase == HuddleSessionPhase.failed) {
+        _startFailureCleanup(next);
+      }
+    });
+    ref.listen(appLifecycleProvider, (_, next) {
+      if (next == AppLifecycleState.paused ||
+          next == AppLifecycleState.detached) {
+        unawaited(_leaveForBackground());
+      }
+    });
+    return false;
+  }
+
+  Future<void>? _startFuture;
+
+  Future<void> start({required String parentChannelId}) {
+    final inFlight = _startFuture;
+    if (inFlight != null) return inFlight;
+
+    late final Future<void> startFuture;
+    startFuture = _start(parentChannelId: parentChannelId).whenComplete(() {
+      if (identical(_startFuture, startFuture)) _startFuture = null;
+    });
+    _startFuture = startFuture;
+    return startFuture;
+  }
+
+  Future<void> _start({required String parentChannelId}) async {
+    if (state) return;
+    final generation = ++_generation;
+    final admissionEpoch = ++_admissionEpoch;
+    state = true;
+    final actions = ref.read(channelActionsProvider);
+    String? backingChannelId;
+    var announced = false;
+    try {
+      backingChannelId = await actions.createHuddleBackingChannel();
+      _latestAdmissionTargetBackingChannelId = backingChannelId;
+      _ensureCurrent(generation);
+      final start = await actions.announceHuddleStarted(
+        parentChannelId: parentChannelId,
+        ephemeralChannelId: backingChannelId,
+      );
+      announced = true;
+      _ensureCurrent(generation);
+      final parameters = _parameters(
+        parentChannelId: parentChannelId,
+        ephemeralChannelId: backingChannelId,
+      );
+      await ref
+          .read(huddleSessionProvider.notifier)
+          .join(
+            parameters,
+            currentPubkey: ref.read(currentPubkeyProvider),
+            isCreator: true,
+            startedEventId: start.id,
+          );
+      _ensureCurrent(generation);
+      final session = ref.read(huddleSessionProvider);
+      if (session.phase == HuddleSessionPhase.failed) {
+        throw StateError(session.error ?? 'Unable to join the new Huddle.');
+      }
+      _admissionToken = _HuddleAdmissionToken(admissionEpoch, backingChannelId);
+    } catch (_) {
+      if (admissionEpoch == _admissionEpoch) {
+        _latestAdmissionTargetBackingChannelId = null;
+      }
+      if (backingChannelId != null) {
+        if (announced) {
+          try {
+            await actions.announceHuddleEnded(
+              parentChannelId: parentChannelId,
+              ephemeralChannelId: backingChannelId,
+            );
+          } catch (_) {
+            // Continue the best-effort rollback with channel archival.
+          }
+        }
+        try {
+          await actions.archiveChannel(backingChannelId);
+        } catch (_) {
+          // The original start failure is more useful to the caller.
+        }
+      }
+      rethrow;
+    } finally {
+      if (generation == _generation) state = false;
+    }
+  }
+
+  Future<void> join({
+    required String parentChannelId,
+    required String ephemeralChannelId,
+    required String startedBy,
+    required String startedEventId,
+  }) async {
+    ++_generation;
+    final admissionEpoch = ++_admissionEpoch;
+    _latestAdmissionTargetBackingChannelId = ephemeralChannelId;
+    final currentPubkey = ref.read(currentPubkeyProvider);
+    try {
+      await ref
+          .read(huddleSessionProvider.notifier)
+          .join(
+            _parameters(
+              parentChannelId: parentChannelId,
+              ephemeralChannelId: ephemeralChannelId,
+            ),
+            currentPubkey: currentPubkey,
+            isCreator:
+                currentPubkey != null &&
+                currentPubkey.toLowerCase() == startedBy.toLowerCase(),
+            startedEventId: startedEventId,
+          );
+    } catch (_) {
+      if (admissionEpoch == _admissionEpoch) {
+        _latestAdmissionTargetBackingChannelId = null;
+      }
+      rethrow;
+    }
+    final session = ref.read(huddleSessionProvider);
+    if (session.wasAdmitted) {
+      _admissionToken = _HuddleAdmissionToken(
+        admissionEpoch,
+        ephemeralChannelId,
+      );
+    }
+  }
+
+  Future<void>? _backgroundLeave;
+  Future<void>? _failureCleanup;
+  final Set<Future<void>> _lifecycleCleanups = {};
+
+  Future<void> _leaveForBackground() {
+    final inFlight = _backgroundLeave;
+    if (inFlight != null) return inFlight;
+
+    late final Future<void> backgroundLeave;
+    backgroundLeave = _finishBackgroundLeave().whenComplete(() {
+      if (identical(_backgroundLeave, backgroundLeave)) {
+        _backgroundLeave = null;
+      }
+    });
+    _backgroundLeave = backgroundLeave;
+    return backgroundLeave;
+  }
+
+  Future<void> _finishBackgroundLeave() async {
+    Object? leaveFailure;
+    StackTrace? leaveFailureStackTrace;
+    try {
+      await leave();
+    } catch (error, stackTrace) {
+      leaveFailure = error;
+      leaveFailureStackTrace = stackTrace;
+    }
+
+    final failureCleanup = _failureCleanup;
+    if (failureCleanup != null) await failureCleanup;
+    if (_lifecycleCleanups.isNotEmpty) {
+      await Future.wait(_lifecycleCleanups.toList());
+    }
+    if (leaveFailure != null) {
+      Error.throwWithStackTrace(leaveFailure, leaveFailureStackTrace!);
+    }
+  }
+
+  void _startFailureCleanup(HuddleSessionState session) {
+    final cleanup = _cleanupAfterLocalTeardown(session);
+    _failureCleanup = cleanup;
+    unawaited(
+      cleanup.whenComplete(() {
+        if (identical(_failureCleanup, cleanup)) _failureCleanup = null;
+      }),
+    );
+  }
+
+  Future<void> _leaveForTransition() async {
+    final startFuture = _startFuture;
+    if (startFuture != null) {
+      ++_generation;
+      state = false;
+      try {
+        await startFuture;
+      } catch (_) {
+        // Cancellation is observed by the in-flight start, whose rollback must
+        // settle before the relay is rebound to the next community.
+      }
+    }
+    final failureCleanup = _failureCleanup;
+    if (failureCleanup != null) await failureCleanup;
+    final backgroundLeave = _backgroundLeave;
+    if (backgroundLeave != null) await backgroundLeave;
+    if (ref.read(huddleSessionProvider).isInSession) {
+      await leave();
+    }
+    if (_lifecycleCleanups.isNotEmpty) {
+      await Future.wait(_lifecycleCleanups.toList());
+    }
+  }
+
+  Future<void> leave() async {
+    ++_generation;
+    state = false;
+    final session = ref.read(huddleSessionProvider);
+    final admissionToken = session.wasAdmitted ? _admissionToken : null;
+    if (identical(_admissionToken, admissionToken)) _admissionToken = null;
+    final parentChannelId = session.parentChannelId;
+    final backingChannelId = session.ephemeralChannelId;
+    final humanCount = !session.wasAdmitted || backingChannelId == null
+        ? null
+        : ref
+              .read(huddleHumanCountProvider)(backingChannelId)
+              .catchError((_) => 2);
+
+    // Match desktop's user-facing ordering: release capture and transport
+    // before waiting on relay lifecycle work. The membership query can take
+    // several seconds or time out; it must never keep the microphone active
+    // or hold the call page open after the user hangs up.
+    Object? localFailure;
+    StackTrace? localFailureStackTrace;
+    try {
+      await ref.read(huddleSessionProvider.notifier).leave();
+    } catch (error, stackTrace) {
+      localFailure = error;
+      localFailureStackTrace = stackTrace;
+    }
+
+    if (backingChannelId != null &&
+        humanCount != null &&
+        admissionToken != null) {
+      await _trackLifecycleCleanup(
+        _finishLeaveLifecycle(
+          admissionToken: admissionToken,
+          parentChannelId: parentChannelId,
+          backingChannelId: backingChannelId,
+          humanCount: humanCount,
+        ),
+      );
+    }
+    if (localFailure != null) {
+      Error.throwWithStackTrace(localFailure, localFailureStackTrace!);
+    }
+  }
+
+  Future<void> _cleanupAfterLocalTeardown(HuddleSessionState session) async {
+    final backingChannelId = session.ephemeralChannelId;
+    final admissionToken = session.wasAdmitted ? _admissionToken : null;
+    if (admissionToken == null || backingChannelId == null) return;
+    if (identical(_admissionToken, admissionToken)) _admissionToken = null;
+    final humanCount = ref
+        .read(huddleHumanCountProvider)(backingChannelId)
+        .catchError((_) => 2);
+    await _trackLifecycleCleanup(
+      _finishLeaveLifecycle(
+        admissionToken: admissionToken,
+        parentChannelId: session.parentChannelId,
+        backingChannelId: backingChannelId,
+        humanCount: humanCount,
+      ),
+    );
+  }
+
+  Future<void> _trackLifecycleCleanup(Future<void> cleanup) async {
+    _lifecycleCleanups.add(cleanup);
+    try {
+      await cleanup;
+    } finally {
+      _lifecycleCleanups.remove(cleanup);
+    }
+  }
+
+  Future<void> _finishLeaveLifecycle({
+    required _HuddleAdmissionToken admissionToken,
+    required String? parentChannelId,
+    required String backingChannelId,
+    required Future<int> humanCount,
+  }) async {
+    final actions = ref.read(channelActionsProvider);
+    final humansRemaining = await humanCount;
+    if (_newerAdmissionTargetsSameHuddle(admissionToken)) return;
+    final currentSession = ref.read(huddleSessionProvider);
+    if (currentSession.isInSession &&
+        currentSession.ephemeralChannelId == backingChannelId) {
+      return;
+    }
+    if (!_finishedLifecycleAdmissions.add(admissionToken)) return;
+    if (humansRemaining <= 1 && parentChannelId != null) {
+      // Desktop auto-ends when the departing person is the last human.
+      // Both lifecycle publication and archival are best effort there.
+      try {
+        await actions.announceHuddleEnded(
+          parentChannelId: parentChannelId,
+          ephemeralChannelId: backingChannelId,
+        );
+      } catch (_) {}
+      if (_newerAdmissionTargetsSameHuddle(admissionToken)) return;
+      final resumedSession = ref.read(huddleSessionProvider);
+      if (resumedSession.isInSession &&
+          resumedSession.ephemeralChannelId == backingChannelId) {
+        return;
+      }
+      try {
+        await actions.archiveChannel(backingChannelId);
+      } catch (_) {}
+      return;
+    }
+
+    try {
+      await actions.leaveChannel(backingChannelId);
+    } catch (_) {
+      // The audio relay may already have auto-ended and archived the room.
+    }
+  }
+
+  Future<void> end() async {
+    ++_generation;
+    state = false;
+    final session = ref.read(huddleSessionProvider);
+    final admissionToken = session.wasAdmitted ? _admissionToken : null;
+    final parentChannelId = session.parentChannelId;
+    final backingChannelId = session.ephemeralChannelId;
+    if (!session.isCreator ||
+        admissionToken == null ||
+        parentChannelId == null ||
+        backingChannelId == null) {
+      throw StateError('Only the Huddle creator can end it.');
+    }
+    if (identical(_admissionToken, admissionToken)) _admissionToken = null;
+
+    final actions = ref.read(channelActionsProvider);
+    if (!_finishedLifecycleAdmissions.add(admissionToken)) return;
+    Object? failure;
+    try {
+      await ref.read(huddleSessionProvider.notifier).leave();
+    } catch (error) {
+      failure = error;
+    }
+    if (_newerAdmissionTargetsSameHuddle(admissionToken)) {
+      if (failure != null) throw failure;
+      return;
+    }
+    try {
+      await actions.announceHuddleEnded(
+        parentChannelId: parentChannelId,
+        ephemeralChannelId: backingChannelId,
+      );
+    } catch (error) {
+      failure = error;
+    }
+    if (_newerAdmissionTargetsSameHuddle(admissionToken)) {
+      if (failure != null) throw failure;
+      return;
+    }
+    try {
+      await actions.archiveChannel(backingChannelId);
+    } catch (error) {
+      failure ??= error;
+    }
+    if (_newerAdmissionTargetsSameHuddle(admissionToken)) {
+      if (failure != null) throw failure;
+      return;
+    }
+    if (failure != null) throw failure;
+  }
+
+  bool _newerAdmissionTargetsSameHuddle(_HuddleAdmissionToken admissionToken) {
+    if (admissionToken.epoch == _admissionEpoch) return false;
+    return _latestAdmissionTargetBackingChannelId ==
+        admissionToken.backingChannelId;
+  }
+
+  HuddleConnectionParameters _parameters({
+    required String parentChannelId,
+    required String ephemeralChannelId,
+  }) {
+    final config = ref.read(relayConfigProvider);
+    final nsec = config.nsec;
+    if (nsec == null || nsec.isEmpty) {
+      throw StateError('A paired identity is required.');
+    }
+    return HuddleConnectionParameters(
+      relayWebSocketUrl: config.wsUrl,
+      nsec: nsec,
+      parentChannelId: parentChannelId,
+      ephemeralChannelId: ephemeralChannelId,
+    );
+  }
+
+  void _ensureCurrent(int generation) {
+    if (generation != _generation) {
+      throw StateError('Huddle start was cancelled.');
+    }
+  }
+}
+
+/// Foreground Huddle lifecycle operations and their start-in-progress flag.
+final mobileHuddleControllerProvider =
+    NotifierProvider<MobileHuddleController, bool>(MobileHuddleController.new);
diff --git a/mobile/lib/features/channels/send_message_provider.dart b/mobile/lib/features/channels/send_message_provider.dart
index 607be269b12..757275c60ac 100644
--- a/mobile/lib/features/channels/send_message_provider.dart
+++ b/mobile/lib/features/channels/send_message_provider.dart
@@ -7,6 +7,7 @@ import '../../shared/profile/user_profile.dart';
 import 'channel.dart';
 import 'channel_messages_provider.dart';
 import 'message_mention_pubkeys.dart';
+import 'local_message_send_animation_provider.dart';
 
 /// Sends messages by signing an event with the user's nsec and publishing it
 /// over the relay's NIP-42-authenticated WebSocket session.
@@ -15,6 +16,8 @@ class SendMessage {
   final Future<List<ChannelMember>> Function(String channelId) _fetchMembers;
   final Map<String, UserProfile> Function() _readUserCache;
   final void Function(String channelId, NostrEvent event) _addLocalMessage;
+  final void Function(String channelId, String eventId)
+  _markLocalMessageForAnimation;
   final void Function(String channelId, String eventId) _completeLocalMessage;
   final void Function(String channelId, String eventId) _removeLocalMessage;
   final bool Function()? _isDeliveryValid;
@@ -25,6 +28,8 @@ class SendMessage {
     fetchMembers,
     required Map<String, UserProfile> Function() readUserCache,
     required void Function(String channelId, NostrEvent event) addLocalMessage,
+    void Function(String channelId, String eventId)?
+    markLocalMessageForAnimation,
     required void Function(String channelId, String eventId)
     completeLocalMessage,
     required void Function(String channelId, String eventId) removeLocalMessage,
@@ -33,6 +38,8 @@ class SendMessage {
        _fetchMembers = fetchMembers,
        _readUserCache = readUserCache,
        _addLocalMessage = addLocalMessage,
+       _markLocalMessageForAnimation =
+           markLocalMessageForAnimation ?? ((_, _) {}),
        _completeLocalMessage = completeLocalMessage,
        _removeLocalMessage = removeLocalMessage,
        _isDeliveryValid = isDeliveryValid;
@@ -96,6 +103,7 @@ class SendMessage {
         tags: tags,
         onSigned: (event) {
           localMessage = event;
+          _markLocalMessageForAnimation(channelId, event.id);
           _addLocalMessage(channelId, event);
         },
       );
@@ -230,6 +238,9 @@ final sendMessageProvider = Provider<SendMessage>((ref) {
     addLocalMessage: (channelId, event) => ref
         .read(channelMessagesProvider(channelId).notifier)
         .addLocalMessage(event),
+    markLocalMessageForAnimation: (channelId, eventId) => ref
+        .read(localMessageSendAnimationProvider(channelId).notifier)
+        .mark(eventId),
     completeLocalMessage: (channelId, eventId) => ref
         .read(channelMessagesProvider(channelId).notifier)
         .completeLocalMessage(eventId),
diff --git a/mobile/lib/features/channels/thread_detail_helpers.dart b/mobile/lib/features/channels/thread_detail_helpers.dart
index 4e13e1f3928..9b535397659 100644
--- a/mobile/lib/features/channels/thread_detail_helpers.dart
+++ b/mobile/lib/features/channels/thread_detail_helpers.dart
@@ -1,5 +1,18 @@
 part of 'thread_detail_page.dart';
 
+/// Returns whether a bounded tail correction reached the effective end.
+///
+/// Item positions can lag the active scroll position by a frame, so an exact
+/// end-of-scroll measurement is sufficient even while the tail item still
+/// reports outside the visible boundary.
+@visibleForTesting
+bool threadTailCorrectionReachedEnd({
+  required bool tailIsVisible,
+  required double? extentAfter,
+}) =>
+    tailIsVisible ||
+    (extentAfter != null && extentAfter <= _threadTailScrollTolerance);
+
 int _threadTailIndex(int replyCount) => replyCount;
 
 void _resumeThreadTailFollow({
diff --git a/mobile/lib/features/channels/thread_detail_page.dart b/mobile/lib/features/channels/thread_detail_page.dart
index 407cb3cd566..cbac3cff843 100644
--- a/mobile/lib/features/channels/thread_detail_page.dart
+++ b/mobile/lib/features/channels/thread_detail_page.dart
@@ -12,6 +12,7 @@ import '../../shared/theme/theme.dart';
 import '../../shared/widgets/avatar_image.dart';
 import '../../shared/widgets/frosted_app_bar.dart';
 import '../../shared/widgets/frosted_scaffold.dart';
+import '../../shared/widgets/ios_glass_navigation_button.dart';
 import '../../shared/widgets/keyboard_dismiss_on_drag.dart';
 import '../../shared/widgets/message_author_meta.dart';
 import '../../shared/profile/user_cache_provider.dart';
@@ -32,8 +33,11 @@ import 'initial_thread_tail_settle.dart';
 import 'laid_out_viewport.dart';
 import 'jump_to_latest_button.dart';
 import 'jump_to_latest_switcher.dart';
+import 'local_message_send_animation_provider.dart';
+import 'local_message_send_transition.dart';
 import '../profile/user_profile_sheet.dart';
 import 'message_actions.dart';
+import 'message_action_backdrop_state.dart';
 import 'message_long_press_region.dart';
 import 'message_content.dart';
 import 'reaction_row.dart';
@@ -56,6 +60,7 @@ const _landingHighlightDuration = Duration(seconds: 3);
 const _landingHighlightDelay = Duration(milliseconds: 50);
 const _landingHighlightTransitionDuration = Duration(milliseconds: 300);
 const _landingHighlightOpacity = 0.12;
+const _threadTailScrollTolerance = 0.5;
 
 // Keep the direct-position correction finite in case the viewport cannot
 // expose its tail (for example, continuously changing media dimensions).
@@ -101,6 +106,9 @@ class ThreadDetailPage extends HookConsumerWidget {
       return session.registerVisibleChannel(channelId);
     }, [channelId]);
     final sendMessage = ref.read(sendMessageProvider);
+    final localSendAnimations = ref.watch(
+      localMessageSendAnimationProvider(channelId),
+    );
     // Relay thread queries are keyed by the outermost root, even when this
     // page displays a nested branch. Query that root, then select this head's
     // direct children from the returned subtree below.
@@ -243,6 +251,7 @@ class ThreadDetailPage extends HookConsumerWidget {
     final tailIntent = useMemoized(_ThreadTailIntent.new);
     final initialTailSettle = useMemoized(InitialThreadTailSettle.new);
     final isAtThreadTail = useState(true);
+    final isNavigatingToThreadTail = useState(false);
     final tailCorrectionInProgress = useRef(false);
     final tailCorrectionGeneration = useRef(0);
     final activeThreadScrollPosition = useRef<ScrollPosition?>(null);
@@ -371,6 +380,7 @@ class ThreadDetailPage extends HookConsumerWidget {
           tailIntent.isDragging ||
           userOptedOutOfTailFollow.value) {
         tailCorrectionInProgress.value = false;
+        isNavigatingToThreadTail.value = false;
         isAtThreadTail.value = threadTailIsVisible();
         return;
       }
@@ -391,8 +401,19 @@ class ThreadDetailPage extends HookConsumerWidget {
         return;
       }
       tailCorrectionInProgress.value = false;
+      isNavigatingToThreadTail.value = false;
       if (revealViewport) initialViewportReady.value = true;
-      isAtThreadTail.value = reachedTail;
+      // Item positions can trail the ScrollPosition by a frame after an
+      // animated jump. Once the bounded lazy-layout correction is exhausted,
+      // trust an exact end-of-scroll position too: there is nowhere further
+      // for Latest to navigate, so leaving the control visible is misleading.
+      final position = activeThreadScrollPosition.value;
+      isAtThreadTail.value = threadTailCorrectionReachedEnd(
+        tailIsVisible: reachedTail,
+        extentAfter: position != null && position.hasContentDimensions
+            ? position.extentAfter
+            : null,
+      );
     }
 
     void correctThreadTailInstantly() {
@@ -470,6 +491,7 @@ class ThreadDetailPage extends HookConsumerWidget {
       userOptedOutOfTailFollow.value = false;
       userDragDetachedTailFollow.value = false;
       followsThreadTail.value = true;
+      isNavigatingToThreadTail.value = true;
       tailCorrectionInProgress.value = true;
       final generation = ++tailCorrectionGeneration.value;
 
@@ -477,6 +499,7 @@ class ThreadDetailPage extends HookConsumerWidget {
         if (!await animateActiveScrollPositionToTail()) {
           if (generation == tailCorrectionGeneration.value) {
             tailCorrectionInProgress.value = false;
+            isNavigatingToThreadTail.value = false;
           }
           return;
         }
@@ -802,11 +825,33 @@ class ThreadDetailPage extends HookConsumerWidget {
         channelNamesMap[ch.name.toLowerCase()] = ch.id;
       }
     });
+    final usesNativeIosGlassBackButton =
+        Navigator.canPop(context) &&
+        Theme.of(context).platform == TargetPlatform.iOS;
 
     return FrostedScaffold(
       resizeToAvoidBottomInset: !usesFixedAndroidImeViewport,
-      appBar: const FrostedAppBar(
-        title: Text('Thread'),
+      appBar: FrostedAppBar(
+        leading: usesNativeIosGlassBackButton
+            ? IosGlassNavigationButton(
+                key: const ValueKey('thread-ios-glass-back'),
+                icon: IosGlassNavigationIcon.back,
+                semanticLabel: 'Back',
+                onPressed: () => Navigator.of(context).maybePop(),
+                width: iosGlassChannelHeaderLeadingWidth,
+                buttonCenterX: iosGlassChannelHeaderButtonCenterX,
+                nativeViewSuppressed: messageActionBackdropActive,
+              )
+            : null,
+        iconColor: context.colors.primary,
+        title: Padding(
+          padding: EdgeInsets.only(
+            left: usesNativeIosGlassBackButton
+                ? iosGlassChannelHeaderTitleSpacing
+                : 0,
+          ),
+          child: const Text('Thread', key: ValueKey('thread-app-bar-title')),
+        ),
         titleStyle: channelTitleTextStyle,
       ),
       body: Stack(
@@ -821,6 +866,7 @@ class ThreadDetailPage extends HookConsumerWidget {
                     initialTailSettle.abandon();
                     initialViewportReady.value = true;
                     tailCorrectionInProgress.value = false;
+                    isNavigatingToThreadTail.value = false;
                     tailIntent.beginDrag();
                     userOptedOutOfTailFollow.value = true;
                     userDragDetachedTailFollow.value = true;
@@ -852,6 +898,7 @@ class ThreadDetailPage extends HookConsumerWidget {
                   itemPositionsListener: itemPositionsListener,
                   bottomInset: timelineBottomInset,
                   replies: replies,
+                  localSendAnimations: localSendAnimations,
                   trackActiveScrollPosition: trackActiveScrollPosition,
                   headIsDeleted: liveDeletionHidesHead,
                   head: liveHead,
@@ -933,6 +980,7 @@ class ThreadDetailPage extends HookConsumerWidget {
                 visible:
                     threadViewportVisible &&
                     hasFetchedReplies &&
+                    !isNavigatingToThreadTail.value &&
                     !isAtThreadTail.value,
                 onPressed: scrollToThreadLatest,
               ),
diff --git a/mobile/lib/features/channels/thread_detail_page/message_list.dart b/mobile/lib/features/channels/thread_detail_page/message_list.dart
index 0010cd7f8da..90e227ab7df 100644
--- a/mobile/lib/features/channels/thread_detail_page/message_list.dart
+++ b/mobile/lib/features/channels/thread_detail_page/message_list.dart
@@ -9,6 +9,7 @@ class _ThreadMessageList extends StatelessWidget {
   final ItemPositionsListener itemPositionsListener;
   final double bottomInset;
   final List<TimelineMessage> replies;
+  final Map<String, DateTime> localSendAnimations;
   final Widget Function(Widget child) trackActiveScrollPosition;
   final bool headIsDeleted;
   final TimelineMessage head;
@@ -33,6 +34,7 @@ class _ThreadMessageList extends StatelessWidget {
     required this.itemPositionsListener,
     required this.bottomInset,
     required this.replies,
+    required this.localSendAnimations,
     required this.trackActiveScrollPosition,
     required this.headIsDeleted,
     required this.head,
@@ -183,45 +185,55 @@ class _ThreadMessageList extends StatelessWidget {
                     : null;
 
                 return trackActiveScrollPosition(
-                  Padding(
-                    key: ValueKey('thread-message-group-${reply.id}'),
-                    // Tail spacing comes from the list's own bottom padding now
-                    // that the list runs top-down; the reversed list used to
-                    // need it here because item 0 sat against the composer.
-                    padding: EdgeInsets.zero,
-                    child: Column(
-                      crossAxisAlignment: CrossAxisAlignment.start,
-                      children: [
-                        if (showDayDivider)
-                          DayDivider(
-                            label: formatDayHeading(reply.createdAt),
-                            dayTimestamp: reply.createdAt,
-                            stickyDayTimestamp: stickyDayTimestamp,
-                          ),
-                        _ThreadMessage(
-                          message: reply,
-                          channelNames: channelNames,
-                          channelId: channelId,
-                          currentPubkey: currentPubkey,
-                          showAuthor: showAuthor,
-                          isHighlighted: reply.id == highlightedMessageId,
-                          allMessages: allMessages,
-                          isMember: isMember,
-                          isArchived: isArchived,
-                          composerFocusNode: composerFocusNode,
-                          restoreComposerFocus: restoreComposerFocus,
-                        ),
-                        if (nestedSummary != null)
-                          _NestedThreadSummaryRow(
-                            summary: nestedSummary,
-                            replyMessage: reply,
-                            allMessages: allMessages,
+                  LocalMessageSendTransition(
+                    key: ValueKey('thread-message-send-${reply.id}'),
+                    animate: isRecentLocalMessageSendAnimation(
+                      localSendAnimations,
+                      reply.id,
+                    ),
+                    startOffsetFactor: showAuthor
+                        ? localMessageSendTransitionAvatarStartOffset
+                        : localMessageSendTransitionStartOffset,
+                    child: Padding(
+                      key: ValueKey('thread-message-group-${reply.id}'),
+                      // Tail spacing comes from the list's own bottom padding now
+                      // that the list runs top-down; the reversed list used to
+                      // need it here because item 0 sat against the composer.
+                      padding: EdgeInsets.zero,
+                      child: Column(
+                        crossAxisAlignment: CrossAxisAlignment.start,
+                        children: [
+                          if (showDayDivider)
+                            DayDivider(
+                              label: formatDayHeading(reply.createdAt),
+                              dayTimestamp: reply.createdAt,
+                              stickyDayTimestamp: stickyDayTimestamp,
+                            ),
+                          _ThreadMessage(
+                            message: reply,
+                            channelNames: channelNames,
                             channelId: channelId,
                             currentPubkey: currentPubkey,
+                            showAuthor: showAuthor,
+                            isHighlighted: reply.id == highlightedMessageId,
+                            allMessages: allMessages,
                             isMember: isMember,
                             isArchived: isArchived,
+                            composerFocusNode: composerFocusNode,
+                            restoreComposerFocus: restoreComposerFocus,
                           ),
-                      ],
+                          if (nestedSummary != null)
+                            _NestedThreadSummaryRow(
+                              summary: nestedSummary,
+                              replyMessage: reply,
+                              allMessages: allMessages,
+                              channelId: channelId,
+                              currentPubkey: currentPubkey,
+                              isMember: isMember,
+                              isArchived: isArchived,
+                            ),
+                        ],
+                      ),
                     ),
                   ),
                 );
diff --git a/mobile/lib/features/channels/timeline_message.dart b/mobile/lib/features/channels/timeline_message.dart
index 411902ea863..716e9f247dd 100644
--- a/mobile/lib/features/channels/timeline_message.dart
+++ b/mobile/lib/features/channels/timeline_message.dart
@@ -26,6 +26,7 @@ class SystemEvent {
   final String? targetPubkey;
   final String? topic;
   final String? purpose;
+  final String? ephemeralChannelId;
 
   const SystemEvent({
     required this.type,
@@ -33,6 +34,7 @@ class SystemEvent {
     this.targetPubkey,
     this.topic,
     this.purpose,
+    this.ephemeralChannelId,
   });
 
   /// Parse a system event from the JSON content of a kind-40099 event.
@@ -80,7 +82,21 @@ class SystemEvent {
     };
     if (type == null) return null;
 
-    return SystemEvent(type: type, actorPubkey: event.pubkey);
+    String? ephemeralChannelId;
+    try {
+      final content = jsonDecode(event.content);
+      if (content is Map) {
+        ephemeralChannelId = _readString(content, 'ephemeral_channel_id');
+      }
+    } catch (_) {
+      // The row still renders, but joining requires the validated room ID.
+    }
+
+    return SystemEvent(
+      type: type,
+      actorPubkey: event.pubkey,
+      ephemeralChannelId: ephemeralChannelId,
+    );
   }
 
   /// Human-readable description. [resolveLabel] maps a pubkey to a display
diff --git a/mobile/lib/features/pairing/pairing_page.dart b/mobile/lib/features/pairing/pairing_page.dart
index 97687c4ed6e..4f70ca184e5 100644
--- a/mobile/lib/features/pairing/pairing_page.dart
+++ b/mobile/lib/features/pairing/pairing_page.dart
@@ -10,6 +10,7 @@ import 'package:lucide_icons_flutter/lucide_icons.dart';
 import '../../shared/security/sensitive_action_authorizer.dart';
 import '../../shared/theme/theme.dart';
 import '../../shared/widgets/buzz_loading_indicator.dart';
+import '../../shared/widgets/ios_glass_navigation_button.dart';
 import '../../shared/widgets/tappable_flapping_bee.dart';
 import 'pairing_provider.dart';
 import 'pairing_qr_scanner.dart';
@@ -94,10 +95,27 @@ class PairingPage extends HookConsumerWidget {
         ? AppBar(
             foregroundColor: _onboardingInk,
             systemOverlayStyle: onboardingSystemOverlayStyle,
-            leading: IconButton(
-              icon: const Icon(LucideIcons.arrowLeft),
-              onPressed: () => Navigator.of(context).pop(),
-            ),
+            leadingWidth: Theme.of(context).platform == TargetPlatform.iOS
+                ? Grid.quarter + iosGlassChannelHeaderLeadingWidth
+                : null,
+            leading: Theme.of(context).platform == TargetPlatform.iOS
+                ? Padding(
+                    padding: const EdgeInsets.only(left: Grid.quarter),
+                    child: IosGlassNavigationButton(
+                      key: const ValueKey('pairing-ios-glass-back'),
+                      icon: IosGlassNavigationIcon.back,
+                      semanticLabel: 'Back',
+                      onPressed: () => Navigator.of(context).maybePop(),
+                      width: iosGlassChannelHeaderLeadingWidth,
+                      buttonCenterX: iosGlassChannelHeaderButtonCenterX,
+                      foregroundColor: _onboardingInk,
+                    ),
+                  )
+                : IconButton(
+                    icon: const Icon(LucideIcons.arrowLeft),
+                    tooltip: 'Back',
+                    onPressed: () => Navigator.of(context).pop(),
+                  ),
             title: Text(
               identityRecoveryOnly ? 'Send to Desktop' : 'Add Community',
               style: context.textTheme.titleMedium?.copyWith(
diff --git a/mobile/lib/features/settings/settings_page.dart b/mobile/lib/features/settings/settings_page.dart
index e888060614b..eb4194eb155 100644
--- a/mobile/lib/features/settings/settings_page.dart
+++ b/mobile/lib/features/settings/settings_page.dart
@@ -18,6 +18,7 @@ import '../../shared/widgets/app_list.dart';
 import '../../shared/widgets/app_list_card.dart';
 import '../../shared/widgets/frosted_app_bar.dart';
 import '../../shared/widgets/frosted_scaffold.dart';
+import '../../shared/widgets/ios_glass_navigation_button.dart';
 import '../../shared/widgets/modal_presentation.dart';
 import 'accent_picker_page.dart';
 import 'theme_picker_page.dart';
@@ -59,19 +60,30 @@ class SettingsPage extends HookConsumerWidget {
         automaticallyImplyLeading: false,
         horizontalInset: Grid.gutter,
         showBottomDivider: false,
-        leading: SizedBox(
-          width: Grid.xl,
-          height: Grid.xl,
-          child: IconButton(
-            tooltip: 'Close settings',
-            onPressed: () {
-              unawaited(HapticFeedback.lightImpact());
-              Navigator.of(context).pop();
-            },
-            color: navigationPrimaryForeground(context),
-            icon: const Icon(LucideIcons.x),
-          ),
-        ),
+        leading: Theme.of(context).platform == TargetPlatform.iOS
+            ? IosGlassNavigationButton(
+                key: const ValueKey('settings-ios-glass-close'),
+                icon: IosGlassNavigationIcon.close,
+                semanticLabel: 'Close settings',
+                onPressed: () {
+                  unawaited(HapticFeedback.lightImpact());
+                  Navigator.of(context).pop();
+                },
+                foregroundColor: navigationPrimaryForeground(context),
+              )
+            : SizedBox(
+                width: Grid.xl,
+                height: Grid.xl,
+                child: IconButton(
+                  tooltip: 'Close settings',
+                  onPressed: () {
+                    unawaited(HapticFeedback.lightImpact());
+                    Navigator.of(context).pop();
+                  },
+                  color: navigationPrimaryForeground(context),
+                  icon: const Icon(LucideIcons.x),
+                ),
+              ),
         bottomHeight: Grid.xxs,
         bottom: const SizedBox.expand(),
       ),
diff --git a/mobile/lib/shared/auth/auth_provider.dart b/mobile/lib/shared/auth/auth_provider.dart
index ade2220264a..ef79934e3fe 100644
--- a/mobile/lib/shared/auth/auth_provider.dart
+++ b/mobile/lib/shared/auth/auth_provider.dart
@@ -53,45 +53,51 @@ class AuthNotifier extends AsyncNotifier<AuthState> {
   /// Authenticate with a community. Saves it and switches to it.
   /// Writes to storage directly to avoid circular dependency with community
   /// providers.
-  Future<void> authenticateWithCommunity(Community community) async {
-    final storage = ref.read(communityStorageProvider);
-    await storage.save(community);
-    await storage.saveActiveId(community.id);
-
-    // Invalidate community providers so other consumers pick up the new data.
-    ref.invalidate(communityListProvider);
-    ref.invalidate(activeCommunityProvider);
+  Future<void> authenticateWithCommunity(Community community) {
+    return ref.read(communityTransitionProvider).runExclusive(() async {
+      await ref.read(communityTransitionProvider).run();
+      final storage = ref.read(communityStorageProvider);
+      await storage.save(community);
+      await storage.saveActiveId(community.id);
+
+      // Invalidate community providers so other consumers pick up the new data.
+      ref.invalidate(communityListProvider);
+      ref.invalidate(activeCommunityProvider);
 
-    state = AsyncData(
-      AuthState(status: AuthStatus.authenticated, community: community),
-    );
+      state = AsyncData(
+        AuthState(status: AuthStatus.authenticated, community: community),
+      );
+    });
   }
 
-  Future<void> signOut() async {
-    final storage = ref.read(communityStorageProvider);
-    final activeId = await storage.loadActiveId();
-    if (activeId != null) {
-      await storage.remove(activeId);
-      await storage.clearActiveId();
-    }
+  Future<void> signOut() {
+    return ref.read(communityTransitionProvider).runExclusive(() async {
+      await ref.read(communityTransitionProvider).run();
+      final storage = ref.read(communityStorageProvider);
+      final activeId = await storage.loadActiveId();
+      if (activeId != null) {
+        await storage.remove(activeId);
+        await storage.clearActiveId();
+      }
 
-    // Check if other communities remain — switch to the next one instead of
-    // forcing the user back to the pairing screen.
-    final remaining = await storage.loadAll();
-
-    // Invalidate community providers so other consumers pick up the change.
-    ref.invalidate(communityListProvider);
-    ref.invalidate(activeCommunityProvider);
-
-    if (remaining.isNotEmpty) {
-      final next = remaining.first;
-      await storage.saveActiveId(next.id);
-      // Re-run build() to validate the next community's credentials.
-      ref.invalidateSelf();
-      await future;
-    } else {
-      state = const AsyncData(AuthState(status: AuthStatus.unauthenticated));
-    }
+      // Check if other communities remain — switch to the next one instead of
+      // forcing the user back to the pairing screen.
+      final remaining = await storage.loadAll();
+
+      // Invalidate community providers so other consumers pick up the change.
+      ref.invalidate(communityListProvider);
+      ref.invalidate(activeCommunityProvider);
+
+      if (remaining.isNotEmpty) {
+        final next = remaining.first;
+        await storage.saveActiveId(next.id);
+        // Re-run build() to validate the next community's credentials.
+        ref.invalidateSelf();
+        await future;
+      } else {
+        state = const AsyncData(AuthState(status: AuthStatus.unauthenticated));
+      }
+    });
   }
 }
 
diff --git a/mobile/lib/shared/community/community_provider.dart b/mobile/lib/shared/community/community_provider.dart
index d014c23b505..ce03de7003a 100644
--- a/mobile/lib/shared/community/community_provider.dart
+++ b/mobile/lib/shared/community/community_provider.dart
@@ -1,9 +1,70 @@
+import 'dart:developer' as developer;
+
 import 'package:hooks_riverpod/hooks_riverpod.dart';
 
 import '../auth/auth_provider.dart';
 import 'community.dart';
 import 'community_storage.dart';
 
+final class CommunityTransitionCoordinator {
+  final Map<Object, Future<void> Function()> _callbacks = {};
+  Future<void>? _inFlight;
+  Future<void> _operationTail = Future.value();
+
+  void Function() register(Future<void> Function() callback) {
+    final owner = Object();
+    _callbacks[owner] = callback;
+    return () => _callbacks.remove(owner);
+  }
+
+  /// Runs a complete community mutation after every earlier mutation finishes.
+  ///
+  /// Cleanup alone is intentionally memoized by [run], but callers that also
+  /// mutate credentials or the active community must queue the whole operation
+  /// here so they cannot race after sharing the same cleanup future.
+  Future<void> runExclusive(Future<void> Function() operation) {
+    final result = _operationTail.then((_) => operation());
+    _operationTail = result.then<void>(
+      (_) {},
+      onError: (Object _, StackTrace _) {},
+    );
+    return result;
+  }
+
+  Future<void> run() {
+    final inFlight = _inFlight;
+    if (inFlight != null) return inFlight;
+
+    final run = _runCallbacks();
+    _inFlight = run;
+    run.whenComplete(() {
+      if (identical(_inFlight, run)) _inFlight = null;
+    });
+    return run;
+  }
+
+  Future<void> _runCallbacks() async {
+    await Future.wait(
+      _callbacks.values.map((callback) async {
+        try {
+          await callback();
+        } catch (error, stackTrace) {
+          developer.log(
+            'Community transition cleanup failed',
+            name: 'buzz.community',
+            error: error,
+            stackTrace: stackTrace,
+          );
+        }
+      }),
+    );
+  }
+}
+
+final communityTransitionProvider = Provider<CommunityTransitionCoordinator>(
+  (ref) => CommunityTransitionCoordinator(),
+);
+
 final communityStorageProvider = Provider<CommunityStorage>((ref) {
   return CommunityStorage();
 });
@@ -44,38 +105,51 @@ class CommunityListNotifier extends AsyncNotifier<List<Community>> {
     return community.id;
   }
 
-  Future<void> removeCommunity(String id) async {
-    final storage = ref.read(communityStorageProvider);
-    await storage.remove(id);
-
-    final current = state.value ?? [];
-    state = AsyncData(current.where((w) => w.id != id).toList());
-
-    // If we removed the active community, switch to another or sign out.
-    final activeId = await storage.loadActiveId();
-    if (activeId == id) {
-      final remaining = state.value ?? [];
-      if (remaining.isNotEmpty) {
-        await switchCommunity(remaining.first.id);
-      } else {
-        await storage.clearActiveId();
-        // Invalidate auth so it re-evaluates against the now-empty storage
-        // and transitions to unauthenticated.
-        ref.invalidate(authProvider);
+  Future<void> removeCommunity(String id) {
+    return ref.read(communityTransitionProvider).runExclusive(() async {
+      final storage = ref.read(communityStorageProvider);
+      final activeId = await storage.loadActiveId();
+      if (activeId == id) {
+        await ref.read(communityTransitionProvider).run();
       }
-    }
+      await storage.remove(id);
+
+      final current = state.value ?? [];
+      state = AsyncData(current.where((w) => w.id != id).toList());
+
+      // If we removed the active community, switch to another or sign out.
+      if (activeId == id) {
+        final remaining = state.value ?? [];
+        if (remaining.isNotEmpty) {
+          await storage.saveActiveId(remaining.first.id);
+          // Reassign list state so activeCommunityProvider picks up the new ID.
+          state = AsyncData([...remaining]);
+          ref.invalidate(authProvider);
+        } else {
+          await storage.clearActiveId();
+          // Invalidate auth so it re-evaluates against the now-empty storage
+          // and transitions to unauthenticated.
+          ref.invalidate(authProvider);
+        }
+      }
+    });
   }
 
-  Future<void> switchCommunity(String id) async {
-    final storage = ref.read(communityStorageProvider);
-    await storage.saveActiveId(id);
-    // Reassign list state to trigger activeCommunityProvider (which watches
-    // communityListProvider.future) to rebuild and pick up the new active ID.
-    // We can't use ref.invalidate(activeCommunityProvider) here because that
-    // creates a circular dependency — activeCommunityProvider watches us.
-    state = AsyncData([...state.value ?? []]);
-    // Invalidate auth so AuthState.community reflects the new active community.
-    ref.invalidate(authProvider);
+  Future<void> switchCommunity(String id) {
+    return ref.read(communityTransitionProvider).runExclusive(() async {
+      final storage = ref.read(communityStorageProvider);
+      final activeId = await storage.loadActiveId();
+      if (activeId == id) return;
+      await ref.read(communityTransitionProvider).run();
+      await storage.saveActiveId(id);
+      // Reassign list state to trigger activeCommunityProvider (which watches
+      // communityListProvider.future) to rebuild and pick up the new active ID.
+      // We can't use ref.invalidate(activeCommunityProvider) here because that
+      // creates a circular dependency — activeCommunityProvider watches us.
+      state = AsyncData([...state.value ?? []]);
+      // Invalidate auth so AuthState.community reflects the new active community.
+      ref.invalidate(authProvider);
+    });
   }
 
   Future<void> renameCommunity(String id, String name) async {
diff --git a/mobile/lib/shared/emoji/emoji_burst.dart b/mobile/lib/shared/emoji/emoji_burst.dart
index 7717ea3746e..b0ade73fa87 100644
--- a/mobile/lib/shared/emoji/emoji_burst.dart
+++ b/mobile/lib/shared/emoji/emoji_burst.dart
@@ -155,6 +155,7 @@ class _Particle {
 class EmojiBurstController extends ChangeNotifier {
   final List<_Particle> _particles = [];
   final Random _random;
+  Offset? _lastBurstOrigin;
 
   /// Set when a spawn arrives so the overlay knows to start its ticker.
   VoidCallback? onSpawn;
@@ -163,12 +164,16 @@ class EmojiBurstController extends ChangeNotifier {
 
   bool get hasParticles => _particles.isNotEmpty;
 
+  @visibleForTesting
+  Offset? get debugLastBurstOrigin => _lastBurstOrigin;
+
   /// Spawn a burst of [emoji] centred on [origin] (global coordinates).
   /// Mirrors desktop's `spawnPickerEmojiBurst`.
   void burst(String emoji, Offset origin) {
     final trimmed = emoji.trim();
     if (trimmed.isEmpty) return;
     if (_particles.length + _particlesPerBurst > _maxActiveParticles) return;
+    _lastBurstOrigin = origin;
 
     for (var i = 0; i < _particlesPerBurst; i += 1) {
       final horizontalDrift = (_random.nextDouble() - 0.5) * 4.4;
@@ -211,6 +216,7 @@ class EmojiBurstController extends ChangeNotifier {
   }
 
   void clear() {
+    _lastBurstOrigin = null;
     if (_particles.isEmpty) return;
     _particles.clear();
     notifyListeners();
diff --git a/mobile/lib/shared/huddle/huddle.dart b/mobile/lib/shared/huddle/huddle.dart
new file mode 100644
index 00000000000..a9972dcd59b
--- /dev/null
+++ b/mobile/lib/shared/huddle/huddle.dart
@@ -0,0 +1,5 @@
+export 'huddle_auth.dart';
+export 'huddle_media.dart';
+export 'huddle_session.dart';
+export 'huddle_transport.dart';
+export 'huddle_wire.dart';
diff --git a/mobile/lib/shared/huddle/huddle_auth.dart b/mobile/lib/shared/huddle/huddle_auth.dart
new file mode 100644
index 00000000000..c74bdf21771
--- /dev/null
+++ b/mobile/lib/shared/huddle/huddle_auth.dart
@@ -0,0 +1,124 @@
+import 'package:flutter/foundation.dart';
+import 'package:nostr/nostr.dart' as nostr;
+
+import '../relay/nostr_models.dart';
+import 'huddle_wire.dart';
+
+/// Immutable connection inputs for one Huddle audio WebSocket.
+@immutable
+final class HuddleConnectionParameters {
+  final String relayWebSocketUrl;
+  final String nsec;
+  final String parentChannelId;
+  final String ephemeralChannelId;
+
+  HuddleConnectionParameters({
+    required this.relayWebSocketUrl,
+    required this.nsec,
+    required this.parentChannelId,
+    required this.ephemeralChannelId,
+  }) {
+    final relayUri = Uri.tryParse(relayWebSocketUrl);
+    if (relayUri == null ||
+        !relayUri.hasAuthority ||
+        (relayUri.scheme != 'ws' && relayUri.scheme != 'wss')) {
+      throw ArgumentError.value(
+        relayWebSocketUrl,
+        'relayWebSocketUrl',
+        'must be an absolute ws:// or wss:// relay URL',
+      );
+    }
+    if (relayUri.hasQuery || relayUri.hasFragment) {
+      throw ArgumentError.value(
+        relayWebSocketUrl,
+        'relayWebSocketUrl',
+        'must not contain a query or fragment',
+      );
+    }
+    _validateUuid(parentChannelId, 'parentChannelId');
+    _validateUuid(ephemeralChannelId, 'ephemeralChannelId');
+    if (nsec.trim().isEmpty) {
+      throw ArgumentError.value(nsec, 'nsec', 'must not be empty');
+    }
+  }
+
+  /// The endpoint is derived from the relay origin, but NIP-42's `relay` tag
+  /// must remain [relayWebSocketUrl], not this Huddle-specific URL.
+  Uri get audioWebSocketUri {
+    final base = Uri.parse(relayWebSocketUrl);
+    return base.replace(
+      path: '/huddle/${Uri.encodeComponent(ephemeralChannelId)}/audio',
+      query: null,
+      fragment: null,
+    );
+  }
+}
+
+/// Fixed NIP-42 + Huddle auth envelope used after the audio relay challenge.
+abstract final class HuddleAuthV3 {
+  static Map<String, dynamic> buildMessage({
+    required HuddleConnectionParameters parameters,
+    required String challenge,
+    int? createdAt,
+  }) {
+    if (challenge.isEmpty) {
+      throw const HuddleAuthException('Relay challenge must not be empty.');
+    }
+
+    final secretKey = _decodeSecretKey(parameters.nsec);
+    final event = nostr.Event.from(
+      kind: EventKind.auth,
+      content: '',
+      tags: [
+        ['relay', parameters.relayWebSocketUrl],
+        ['challenge', challenge],
+      ],
+      secretKey: secretKey,
+      createdAt: createdAt ?? DateTime.now().millisecondsSinceEpoch ~/ 1000,
+      verify: false,
+    );
+
+    return {
+      'type': 'auth',
+      'event': event.toMap(),
+      'parent_channel_id': parameters.parentChannelId,
+      'protocol_version': HuddleWireV3.protocolVersion,
+    };
+  }
+
+  static String _decodeSecretKey(String value) {
+    final trimmed = value.trim();
+    if (RegExp(r'^[0-9a-fA-F]{64}$').hasMatch(trimmed)) {
+      return trimmed.toLowerCase();
+    }
+    try {
+      final decoded = nostr.Nip19.decode(payload: trimmed).data;
+      if (RegExp(r'^[0-9a-fA-F]{64}$').hasMatch(decoded)) {
+        return decoded.toLowerCase();
+      }
+    } catch (_) {
+      // Fall through to the stable domain error below.
+    }
+    throw const HuddleAuthException('Invalid Nostr signing key.');
+  }
+}
+
+final class HuddleAuthException implements Exception {
+  final String message;
+
+  const HuddleAuthException(this.message);
+
+  @override
+  String toString() => 'HuddleAuthException: $message';
+}
+
+final _canonicalUuid = RegExp(
+  r'^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-'
+  r'[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$',
+);
+
+void _validateUuid(String value, String name) {
+  if (!_canonicalUuid.hasMatch(value)) {
+    throw ArgumentError.value(value, name, 'must be a canonical UUID');
+  }
+}
diff --git a/mobile/lib/shared/huddle/huddle_media.dart b/mobile/lib/shared/huddle/huddle_media.dart
new file mode 100644
index 00000000000..78c4b05c5a2
--- /dev/null
+++ b/mobile/lib/shared/huddle/huddle_media.dart
@@ -0,0 +1,759 @@
+import 'dart:async';
+
+import 'package:flutter/foundation.dart';
+import 'package:flutter/services.dart';
+
+import 'huddle_wire.dart';
+
+const huddleMediaMethodChannelName = 'buzz/huddle_media';
+
+enum HuddleMediaPhase {
+  idle,
+  discovering,
+  preparing,
+  prepared,
+  active,
+  stopping,
+  stopped,
+  unavailable,
+  failed,
+}
+
+enum HuddleMicrophonePermission {
+  undetermined,
+  granted,
+  denied,
+  restricted,
+  unavailable,
+}
+
+enum HuddleMediaErrorCode {
+  invalidState,
+  unavailable,
+  permissionDenied,
+  unsupported,
+  platformFailure,
+  malformedNativeEvent,
+  disposed,
+}
+
+@immutable
+final class HuddleMediaError implements Exception {
+  final HuddleMediaErrorCode code;
+  final String message;
+  final Object? cause;
+
+  const HuddleMediaError({
+    required this.code,
+    required this.message,
+    this.cause,
+  });
+
+  @override
+  String toString() => 'HuddleMediaError.${code.name}: $message';
+}
+
+/// Native media capabilities are deliberately granular.
+///
+/// Flutter joins only when every media capability is present. Android and iOS
+/// report full-duplex support only after probing their platform Opus codecs.
+/// This prevents a transport-only client from appearing in a room as a silent
+/// participant.
+@immutable
+final class HuddleMediaCapabilities {
+  final String platform;
+  final bool supportsAudioSession;
+  final bool supportsMicrophonePermission;
+  final bool supportsCapture;
+  final bool supportsPlayback;
+  final bool supportsOpusEncoding;
+  final bool supportsOpusDecoding;
+
+  const HuddleMediaCapabilities({
+    required this.platform,
+    required this.supportsAudioSession,
+    required this.supportsMicrophonePermission,
+    required this.supportsCapture,
+    required this.supportsPlayback,
+    required this.supportsOpusEncoding,
+    required this.supportsOpusDecoding,
+  });
+
+  static const unavailable = HuddleMediaCapabilities(
+    platform: 'unavailable',
+    supportsAudioSession: false,
+    supportsMicrophonePermission: false,
+    supportsCapture: false,
+    supportsPlayback: false,
+    supportsOpusEncoding: false,
+    supportsOpusDecoding: false,
+  );
+
+  bool get supportsFullDuplexOpus =>
+      supportsCapture &&
+      supportsPlayback &&
+      supportsOpusEncoding &&
+      supportsOpusDecoding;
+
+  factory HuddleMediaCapabilities.fromMap(Map<dynamic, dynamic> value) =>
+      HuddleMediaCapabilities(
+        platform: value['platform'] as String? ?? 'unknown',
+        supportsAudioSession: value['audioSession'] == true,
+        supportsMicrophonePermission: value['microphonePermission'] == true,
+        supportsCapture: value['capture'] == true,
+        supportsPlayback: value['playback'] == true,
+        supportsOpusEncoding: value['opusEncoding'] == true,
+        supportsOpusDecoding: value['opusDecoding'] == true,
+      );
+}
+
+/// Aggregate debug telemetry for the microphone signal immediately before Opus.
+///
+/// It contains levels and platform configuration only. PCM, Opus packets, and
+/// speech content are never retained by this diagnostic path.
+@immutable
+final class HuddleCaptureDiagnostics {
+  final int frameCount;
+  final Map<int, int> rmsDbovHistogram;
+  final Map<int, int> peakDbovHistogram;
+  final int maxPeakDbov;
+  final int audioSource;
+  final String audioSourceLabel;
+  final int? deviceId;
+  final int? deviceType;
+  final String? deviceLabel;
+  final bool acousticEchoCancelerAvailable;
+  final bool? acousticEchoCancelerEnabled;
+  final bool noiseSuppressorAvailable;
+  final bool? noiseSuppressorEnabled;
+  final bool automaticGainControlAvailable;
+  final bool? automaticGainControlEnabled;
+
+  const HuddleCaptureDiagnostics({
+    required this.frameCount,
+    required this.rmsDbovHistogram,
+    required this.peakDbovHistogram,
+    required this.maxPeakDbov,
+    required this.audioSource,
+    required this.audioSourceLabel,
+    required this.deviceId,
+    required this.deviceType,
+    required this.deviceLabel,
+    required this.acousticEchoCancelerAvailable,
+    required this.acousticEchoCancelerEnabled,
+    required this.noiseSuppressorAvailable,
+    required this.noiseSuppressorEnabled,
+    required this.automaticGainControlAvailable,
+    required this.automaticGainControlEnabled,
+  });
+
+  factory HuddleCaptureDiagnostics.fromMap(
+    Map<dynamic, dynamic> value,
+  ) => HuddleCaptureDiagnostics(
+    frameCount: (value['frameCount'] as num).toInt(),
+    rmsDbovHistogram: _parseDbovHistogram(value['rmsDbovHistogram']),
+    peakDbovHistogram: _parseDbovHistogram(value['peakDbovHistogram']),
+    maxPeakDbov: (value['maxPeakDbov'] as num).toInt(),
+    audioSource: (value['audioSource'] as num).toInt(),
+    audioSourceLabel: value['audioSourceLabel'] as String,
+    deviceId: (value['deviceId'] as num?)?.toInt(),
+    deviceType: (value['deviceType'] as num?)?.toInt(),
+    deviceLabel: value['deviceLabel'] as String?,
+    acousticEchoCancelerAvailable:
+        value['acousticEchoCancelerAvailable'] as bool,
+    acousticEchoCancelerEnabled: value['acousticEchoCancelerEnabled'] as bool?,
+    noiseSuppressorAvailable: value['noiseSuppressorAvailable'] as bool,
+    noiseSuppressorEnabled: value['noiseSuppressorEnabled'] as bool?,
+    automaticGainControlAvailable:
+        value['automaticGainControlAvailable'] as bool,
+    automaticGainControlEnabled: value['automaticGainControlEnabled'] as bool?,
+  );
+
+  String get debugSummary =>
+      'frames=$frameCount rmsDbov=$rmsDbovHistogram '
+      'peakDbov=$peakDbovHistogram maxPeakDbov=$maxPeakDbov '
+      'source=$audioSourceLabel($audioSource) '
+      'device=${deviceLabel ?? 'unknown'}($deviceType/$deviceId) '
+      'aec=$acousticEchoCancelerEnabled/$acousticEchoCancelerAvailable '
+      'ns=$noiseSuppressorEnabled/$noiseSuppressorAvailable '
+      'agc=$automaticGainControlEnabled/$automaticGainControlAvailable';
+}
+
+Map<int, int> _parseDbovHistogram(Object? value) {
+  if (value is! Map) throw const FormatException('missing dBov histogram');
+  final result = <int, int>{};
+  for (final entry in value.entries) {
+    final level = int.tryParse(entry.key.toString());
+    final count = entry.value;
+    if (level == null || count is! num) {
+      throw const FormatException('malformed dBov histogram');
+    }
+    result[level] = count.toInt();
+  }
+  return Map.unmodifiable(result);
+}
+
+@immutable
+final class HuddleMediaState {
+  final HuddleMediaPhase phase;
+  final HuddleMediaCapabilities? capabilities;
+  final bool isMuted;
+  final bool isSpeakerEnabled;
+  final bool isInterrupted;
+  final HuddleCaptureDiagnostics? captureDiagnostics;
+  final HuddleMediaError? error;
+
+  const HuddleMediaState({
+    required this.phase,
+    this.capabilities,
+    this.isMuted = false,
+    this.isSpeakerEnabled = false,
+    this.isInterrupted = false,
+    this.captureDiagnostics,
+    this.error,
+  });
+}
+
+@immutable
+final class HuddleLocalAudioFrame {
+  final HuddleAudioHeader header;
+  final Uint8List opusPayload;
+
+  const HuddleLocalAudioFrame({
+    required this.header,
+    required this.opusPayload,
+  });
+}
+
+abstract interface class HuddleMedia {
+  HuddleMediaState get state;
+  Stream<HuddleMediaState> get states;
+  Stream<HuddleLocalAudioFrame> get localAudioFrames;
+
+  Future<HuddleMediaCapabilities> discoverCapabilities();
+  Future<HuddleMicrophonePermission> requestMicrophonePermission();
+
+  /// Open the OS app-settings screen so the user can grant a microphone
+  /// permission that was previously denied. Returns `true` when the settings
+  /// UI was launched. A no-op-safe fallback returns `false` on platforms that
+  /// cannot open settings (e.g. the plugin is missing).
+  Future<bool> openSystemSettings();
+
+  Future<void> prepare();
+  Future<void> start();
+  Future<void> setMuted(bool muted);
+  Future<void> setSpeakerEnabled(bool enabled);
+  Future<void> playRemoteFrame(HuddleRemoteAudioFrame frame);
+  Future<void> removeRemotePeer(int peerIndex);
+  Future<void> stop();
+  Future<void> dispose();
+}
+
+/// Flutter-facing bridge for the native realtime media engine.
+///
+/// The method names and payloads are intentionally codec-agnostic except for
+/// the fixed Huddle v2 constants. Native capture pushes `localOpusFrame` calls
+/// into [_handleNativeCall], and Flutter sends those compressed frames through
+/// [HuddleTransport] without moving realtime PCM through the Flutter bridge.
+final class MethodChannelHuddleMedia implements HuddleMedia {
+  final MethodChannel _channel;
+  final StreamController<HuddleMediaState> _stateController =
+      StreamController.broadcast(sync: true);
+  final StreamController<HuddleLocalAudioFrame> _localFrameController =
+      StreamController.broadcast(sync: true);
+
+  HuddleMediaState _state = const HuddleMediaState(
+    phase: HuddleMediaPhase.idle,
+  );
+  HuddleMediaCapabilities? _capabilities;
+  bool _disposed = false;
+
+  MethodChannelHuddleMedia({MethodChannel? channel})
+    : _channel = channel ?? const MethodChannel(huddleMediaMethodChannelName) {
+    _channel.setMethodCallHandler(_handleNativeCall);
+  }
+
+  @override
+  HuddleMediaState get state => _state;
+
+  @override
+  Stream<HuddleMediaState> get states => _stateController.stream;
+
+  @override
+  Stream<HuddleLocalAudioFrame> get localAudioFrames =>
+      _localFrameController.stream;
+
+  @override
+  Future<HuddleMediaCapabilities> discoverCapabilities() async {
+    _ensureNotDisposed();
+    _emit(const HuddleMediaState(phase: HuddleMediaPhase.discovering));
+    try {
+      final result = await _channel.invokeMapMethod<dynamic, dynamic>(
+        'getCapabilities',
+      );
+      if (result == null) {
+        throw const HuddleMediaError(
+          code: HuddleMediaErrorCode.platformFailure,
+          message: 'Native Huddle media capabilities were missing.',
+        );
+      }
+      final capabilities = HuddleMediaCapabilities.fromMap(result);
+      _capabilities = capabilities;
+      _emit(
+        HuddleMediaState(
+          phase: HuddleMediaPhase.idle,
+          capabilities: capabilities,
+          isMuted: _state.isMuted,
+          isSpeakerEnabled: _state.isSpeakerEnabled,
+          captureDiagnostics: _state.captureDiagnostics,
+        ),
+      );
+      return capabilities;
+    } on MissingPluginException {
+      _capabilities = HuddleMediaCapabilities.unavailable;
+      _emit(
+        const HuddleMediaState(
+          phase: HuddleMediaPhase.unavailable,
+          capabilities: HuddleMediaCapabilities.unavailable,
+        ),
+      );
+      return HuddleMediaCapabilities.unavailable;
+    } on HuddleMediaError catch (error) {
+      _fail(error);
+      rethrow;
+    } on PlatformException catch (error) {
+      final failure = _platformFailure(error);
+      _fail(failure);
+      throw failure;
+    }
+  }
+
+  @override
+  Future<HuddleMicrophonePermission> requestMicrophonePermission() async {
+    _ensureNotDisposed();
+    try {
+      final value = await _channel.invokeMethod<String>(
+        'requestMicrophonePermission',
+      );
+      return switch (value) {
+        'granted' => HuddleMicrophonePermission.granted,
+        'denied' => HuddleMicrophonePermission.denied,
+        'restricted' => HuddleMicrophonePermission.restricted,
+        'undetermined' => HuddleMicrophonePermission.undetermined,
+        _ => HuddleMicrophonePermission.unavailable,
+      };
+    } on MissingPluginException {
+      return HuddleMicrophonePermission.unavailable;
+    } on PlatformException catch (error) {
+      final failure = _platformFailure(error);
+      _fail(failure);
+      throw failure;
+    }
+  }
+
+  @override
+  Future<bool> openSystemSettings() async {
+    _ensureNotDisposed();
+    try {
+      final opened = await _channel.invokeMethod<bool>('openSystemSettings');
+      return opened ?? false;
+    } on MissingPluginException {
+      return false;
+    } on PlatformException {
+      // Opening settings is a best-effort recovery affordance; a platform
+      // failure here must not tear down the (already-failed) session.
+      return false;
+    }
+  }
+
+  @override
+  Future<void> prepare() async {
+    _ensureNotDisposed();
+    if (_state.phase != HuddleMediaPhase.idle &&
+        _state.phase != HuddleMediaPhase.stopped) {
+      throw HuddleMediaError(
+        code: HuddleMediaErrorCode.invalidState,
+        message: 'Cannot prepare media while it is ${_state.phase.name}.',
+      );
+    }
+    final capabilities = _capabilities ?? await discoverCapabilities();
+    if (!capabilities.supportsAudioSession) {
+      throw const HuddleMediaError(
+        code: HuddleMediaErrorCode.unavailable,
+        message: 'Native Huddle audio sessions are unavailable.',
+      );
+    }
+
+    _emit(
+      HuddleMediaState(
+        phase: HuddleMediaPhase.preparing,
+        capabilities: capabilities,
+        isMuted: _state.isMuted,
+        isSpeakerEnabled: _state.isSpeakerEnabled,
+        captureDiagnostics: _state.captureDiagnostics,
+      ),
+    );
+    try {
+      final result = await _channel
+          .invokeMapMethod<dynamic, dynamic>('prepare', {
+            'protocolVersion': HuddleWireV3.protocolVersion,
+            'sampleRateHz': HuddleWireV3.sampleRateHz,
+            'channels': HuddleWireV3.channels,
+            'frameSamples': HuddleWireV3.frameSamples,
+          });
+      if (result?['audioSessionPrepared'] != true) {
+        throw const HuddleMediaError(
+          code: HuddleMediaErrorCode.platformFailure,
+          message: 'Native Huddle audio session was not prepared.',
+        );
+      }
+      _emit(
+        HuddleMediaState(
+          phase: HuddleMediaPhase.prepared,
+          capabilities: capabilities,
+          isMuted: false,
+          isSpeakerEnabled: _state.isSpeakerEnabled,
+          captureDiagnostics: _state.captureDiagnostics,
+        ),
+      );
+    } on HuddleMediaError catch (error) {
+      _fail(error);
+      rethrow;
+    } on PlatformException catch (error) {
+      final failure = error.code == 'microphone_permission_denied'
+          ? HuddleMediaError(
+              code: HuddleMediaErrorCode.permissionDenied,
+              message: error.message ?? 'Microphone permission is required.',
+              cause: error,
+            )
+          : _platformFailure(error);
+      _fail(failure);
+      throw failure;
+    }
+  }
+
+  @override
+  Future<void> start() async {
+    _ensureNotDisposed();
+    if (_state.phase != HuddleMediaPhase.prepared) {
+      throw HuddleMediaError(
+        code: HuddleMediaErrorCode.invalidState,
+        message: 'Cannot start media while it is ${_state.phase.name}.',
+      );
+    }
+    final capabilities = _capabilities;
+    if (capabilities == null || !capabilities.supportsFullDuplexOpus) {
+      throw const HuddleMediaError(
+        code: HuddleMediaErrorCode.unsupported,
+        message: 'Native full-duplex Opus media is not implemented yet.',
+      );
+    }
+
+    try {
+      await _channel.invokeMethod<void>('start');
+      _emit(
+        HuddleMediaState(
+          phase: HuddleMediaPhase.active,
+          capabilities: capabilities,
+          isMuted: false,
+          isSpeakerEnabled: _state.isSpeakerEnabled,
+          captureDiagnostics: _state.captureDiagnostics,
+        ),
+      );
+    } on PlatformException catch (error) {
+      final failure = _platformFailure(error);
+      _fail(failure);
+      throw failure;
+    }
+  }
+
+  @override
+  Future<void> setMuted(bool muted) async {
+    _ensureNotDisposed();
+    if (_state.phase != HuddleMediaPhase.active) {
+      throw HuddleMediaError(
+        code: HuddleMediaErrorCode.invalidState,
+        message: 'Cannot change mute while media is ${_state.phase.name}.',
+      );
+    }
+    try {
+      await _channel.invokeMethod<void>('setMuted', {'muted': muted});
+      _emit(
+        HuddleMediaState(
+          phase: HuddleMediaPhase.active,
+          capabilities: _capabilities,
+          isMuted: muted,
+          isSpeakerEnabled: _state.isSpeakerEnabled,
+          isInterrupted: _state.isInterrupted,
+          captureDiagnostics: _state.captureDiagnostics,
+        ),
+      );
+    } on PlatformException catch (error) {
+      final failure = _platformFailure(error);
+      _fail(failure);
+      throw failure;
+    }
+  }
+
+  @override
+  Future<void> setSpeakerEnabled(bool enabled) async {
+    _ensureNotDisposed();
+    if (_state.phase != HuddleMediaPhase.active) {
+      throw HuddleMediaError(
+        code: HuddleMediaErrorCode.invalidState,
+        message:
+            'Cannot change audio output while media is ${_state.phase.name}.',
+      );
+    }
+    try {
+      await _channel.invokeMethod<void>('setSpeakerEnabled', {
+        'enabled': enabled,
+      });
+      _emit(
+        HuddleMediaState(
+          phase: HuddleMediaPhase.active,
+          capabilities: _capabilities,
+          isMuted: _state.isMuted,
+          isSpeakerEnabled: enabled,
+          isInterrupted: _state.isInterrupted,
+          captureDiagnostics: _state.captureDiagnostics,
+        ),
+      );
+    } on PlatformException catch (error) {
+      final failure = _platformFailure(error);
+      _fail(failure);
+      throw failure;
+    }
+  }
+
+  @override
+  Future<void> playRemoteFrame(HuddleRemoteAudioFrame frame) async {
+    _ensureNotDisposed();
+    if (_state.phase != HuddleMediaPhase.active) {
+      throw HuddleMediaError(
+        code: HuddleMediaErrorCode.invalidState,
+        message: 'Cannot play audio while media is ${_state.phase.name}.',
+      );
+    }
+    if (_capabilities?.supportsOpusDecoding != true) {
+      throw const HuddleMediaError(
+        code: HuddleMediaErrorCode.unsupported,
+        message: 'Native Opus playout is not implemented yet.',
+      );
+    }
+    try {
+      await _channel.invokeMethod<void>('playRemoteOpusFrame', {
+        'peerIndex': frame.peerIndex,
+        'sequence': frame.header.sequence,
+        'timestamp48k': frame.header.timestamp48k,
+        'levelDbov': frame.header.levelDbov,
+        'flags': frame.header.flags,
+        'opus': frame.opusPayload,
+      });
+    } on PlatformException catch (error) {
+      final failure = _platformFailure(error);
+      _fail(failure);
+      throw failure;
+    }
+  }
+
+  @override
+  Future<void> removeRemotePeer(int peerIndex) async {
+    _ensureNotDisposed();
+    if (_state.phase != HuddleMediaPhase.active) return;
+    try {
+      await _channel.invokeMethod<void>('removeRemotePeer', {
+        'peerIndex': peerIndex,
+      });
+    } on PlatformException catch (error) {
+      final failure = _platformFailure(error);
+      _fail(failure);
+      throw failure;
+    }
+  }
+
+  @override
+  Future<void> stop() async {
+    if (_disposed ||
+        _state.phase == HuddleMediaPhase.idle ||
+        _state.phase == HuddleMediaPhase.stopped ||
+        _state.phase == HuddleMediaPhase.unavailable) {
+      return;
+    }
+    _emit(
+      HuddleMediaState(
+        phase: HuddleMediaPhase.stopping,
+        capabilities: _capabilities,
+        isMuted: _state.isMuted,
+        isSpeakerEnabled: _state.isSpeakerEnabled,
+        captureDiagnostics: _state.captureDiagnostics,
+      ),
+    );
+    try {
+      await _channel.invokeMethod<void>('stop');
+      _emit(
+        HuddleMediaState(
+          phase: HuddleMediaPhase.stopped,
+          capabilities: _capabilities,
+          isMuted: _state.isMuted,
+          isSpeakerEnabled: _state.isSpeakerEnabled,
+          captureDiagnostics: _state.captureDiagnostics,
+        ),
+      );
+    } on MissingPluginException {
+      _emit(
+        const HuddleMediaState(
+          phase: HuddleMediaPhase.unavailable,
+          capabilities: HuddleMediaCapabilities.unavailable,
+        ),
+      );
+    } on PlatformException catch (error) {
+      final failure = _platformFailure(error);
+      _fail(failure);
+      throw failure;
+    }
+  }
+
+  @override
+  Future<void> dispose() async {
+    if (_disposed) return;
+    await stop();
+    _disposed = true;
+    _channel.setMethodCallHandler(null);
+    await _stateController.close();
+    await _localFrameController.close();
+  }
+
+  Future<dynamic> _handleNativeCall(MethodCall call) async {
+    if (_disposed) return null;
+    switch (call.method) {
+      case 'localOpusFrame':
+        final arguments = call.arguments;
+        if (arguments is! Map) {
+          _reportMalformedNativeEvent();
+          return null;
+        }
+        try {
+          final opus = arguments['opus'];
+          if (opus is! Uint8List || opus.isEmpty) {
+            throw const FormatException('missing Opus payload');
+          }
+          _localFrameController.add(
+            HuddleLocalAudioFrame(
+              header: HuddleAudioHeader.checked(
+                sequence: arguments['sequence'] as int,
+                timestamp48k: arguments['timestamp48k'] as int,
+                levelDbov: arguments['levelDbov'] as int,
+                flags: arguments['flags'] as int,
+              ),
+              opusPayload: Uint8List.fromList(opus),
+            ),
+          );
+        } catch (_) {
+          _reportMalformedNativeEvent();
+        }
+      case 'nativeError':
+        final arguments = call.arguments;
+        final message = arguments is Map ? arguments['message'] : null;
+        _fail(
+          HuddleMediaError(
+            code: HuddleMediaErrorCode.platformFailure,
+            message: message is String && message.isNotEmpty
+                ? message
+                : 'Native Huddle audio failed.',
+          ),
+        );
+      case 'interruptionChanged':
+        final arguments = call.arguments;
+        final interrupted = arguments is Map ? arguments['interrupted'] : null;
+        if (interrupted is! bool) {
+          _reportMalformedNativeEvent();
+          return null;
+        }
+        _emit(
+          HuddleMediaState(
+            phase: HuddleMediaPhase.active,
+            capabilities: _capabilities,
+            isMuted: _state.isMuted,
+            isSpeakerEnabled: _state.isSpeakerEnabled,
+            isInterrupted: interrupted,
+            captureDiagnostics: _state.captureDiagnostics,
+          ),
+        );
+      case 'captureDiagnostics':
+        final arguments = call.arguments;
+        if (arguments is! Map) {
+          _reportMalformedNativeEvent();
+          return null;
+        }
+        try {
+          final diagnostics = HuddleCaptureDiagnostics.fromMap(arguments);
+          _emit(
+            HuddleMediaState(
+              phase: _state.phase,
+              capabilities: _capabilities,
+              isMuted: _state.isMuted,
+              isSpeakerEnabled: _state.isSpeakerEnabled,
+              isInterrupted: _state.isInterrupted,
+              captureDiagnostics: diagnostics,
+              error: _state.error,
+            ),
+          );
+          if (kDebugMode) {
+            debugPrint(
+              '[HuddleCaptureDiagnostics] ${diagnostics.debugSummary}',
+            );
+          }
+        } catch (_) {
+          _reportMalformedNativeEvent();
+        }
+      default:
+        return null;
+    }
+    return null;
+  }
+
+  void _reportMalformedNativeEvent() {
+    _fail(
+      const HuddleMediaError(
+        code: HuddleMediaErrorCode.malformedNativeEvent,
+        message: 'Native Huddle media emitted a malformed Opus frame.',
+      ),
+    );
+  }
+
+  void _ensureNotDisposed() {
+    if (_disposed) {
+      throw const HuddleMediaError(
+        code: HuddleMediaErrorCode.disposed,
+        message: 'Huddle media has been disposed.',
+      );
+    }
+  }
+
+  HuddleMediaError _platformFailure(PlatformException error) =>
+      HuddleMediaError(
+        code: HuddleMediaErrorCode.platformFailure,
+        message: error.message ?? 'Native Huddle media failed.',
+        cause: error,
+      );
+
+  void _fail(HuddleMediaError error) {
+    _emit(
+      HuddleMediaState(
+        phase: HuddleMediaPhase.failed,
+        capabilities: _capabilities,
+        isMuted: _state.isMuted,
+        isSpeakerEnabled: _state.isSpeakerEnabled,
+        isInterrupted: _state.isInterrupted,
+        captureDiagnostics: _state.captureDiagnostics,
+        error: error,
+      ),
+    );
+  }
+
+  void _emit(HuddleMediaState next) {
+    _state = next;
+    if (!_stateController.isClosed) _stateController.add(next);
+  }
+}
diff --git a/mobile/lib/shared/huddle/huddle_session.dart b/mobile/lib/shared/huddle/huddle_session.dart
new file mode 100644
index 00000000000..bb96f2aa2c8
--- /dev/null
+++ b/mobile/lib/shared/huddle/huddle_session.dart
@@ -0,0 +1,771 @@
+import 'dart:async';
+import 'dart:collection';
+
+import 'package:flutter/foundation.dart';
+import 'package:hooks_riverpod/hooks_riverpod.dart';
+
+import 'huddle_auth.dart';
+import 'huddle_media.dart';
+import 'huddle_transport.dart';
+import 'huddle_wire.dart';
+
+enum HuddleSessionPhase {
+  idle,
+  checkingSupport,
+  requestingPermission,
+  preparingMedia,
+  connecting,
+  reconnecting,
+  interrupted,
+  connected,
+  leaving,
+  failed,
+}
+
+const _notProvided = Object();
+
+@immutable
+final class HuddleSessionState {
+  final HuddleSessionPhase phase;
+  final String? parentChannelId;
+  final String? ephemeralChannelId;
+  final String? startedEventId;
+  final String? currentPubkey;
+  final bool isCreator;
+
+  /// Whether the audio relay admitted this identity during this session.
+  final bool wasAdmitted;
+  final bool isMuted;
+  final bool isSpeakerEnabled;
+  final int participantCount;
+  final List<String> participantPubkeys;
+  final Set<String> activeSpeakerPubkeys;
+  final Map<String, double> speakerLevels;
+  final int reconnectAttempt;
+  final int receivedFrameCount;
+  final int sentFrameCount;
+  final String? issue;
+  final String? error;
+
+  /// Whether the current [HuddleSessionPhase.failed] state was caused by a
+  /// denied microphone permission. On iOS a denied permission is not
+  /// re-prompted, so a blind retry deterministically fails again — the UI
+  /// uses this to offer an OS-settings recovery path instead of a bare retry.
+  final bool microphonePermissionRequired;
+
+  const HuddleSessionState({
+    required this.phase,
+    this.parentChannelId,
+    this.ephemeralChannelId,
+    this.startedEventId,
+    this.currentPubkey,
+    this.isCreator = false,
+    this.wasAdmitted = false,
+    this.isMuted = false,
+    this.isSpeakerEnabled = false,
+    this.participantCount = 0,
+    this.participantPubkeys = const [],
+    this.activeSpeakerPubkeys = const {},
+    this.speakerLevels = const {},
+    this.reconnectAttempt = 0,
+    this.receivedFrameCount = 0,
+    this.sentFrameCount = 0,
+    this.issue,
+    this.error,
+    this.microphonePermissionRequired = false,
+  });
+
+  static const idle = HuddleSessionState(phase: HuddleSessionPhase.idle);
+
+  bool get isConnected => phase == HuddleSessionPhase.connected;
+
+  bool get isInSession => switch (phase) {
+    HuddleSessionPhase.checkingSupport ||
+    HuddleSessionPhase.requestingPermission ||
+    HuddleSessionPhase.preparingMedia ||
+    HuddleSessionPhase.connecting ||
+    HuddleSessionPhase.reconnecting ||
+    HuddleSessionPhase.interrupted ||
+    HuddleSessionPhase.connected ||
+    HuddleSessionPhase.leaving => true,
+    HuddleSessionPhase.idle || HuddleSessionPhase.failed => false,
+  };
+
+  HuddleSessionState copyWith({
+    HuddleSessionPhase? phase,
+    Object? parentChannelId = _notProvided,
+    Object? ephemeralChannelId = _notProvided,
+    Object? startedEventId = _notProvided,
+    Object? currentPubkey = _notProvided,
+    bool? isCreator,
+    bool? wasAdmitted,
+    bool? isMuted,
+    bool? isSpeakerEnabled,
+    int? participantCount,
+    List<String>? participantPubkeys,
+    Set<String>? activeSpeakerPubkeys,
+    Map<String, double>? speakerLevels,
+    int? reconnectAttempt,
+    int? receivedFrameCount,
+    int? sentFrameCount,
+    Object? issue = _notProvided,
+    Object? error = _notProvided,
+    bool? microphonePermissionRequired,
+  }) => HuddleSessionState(
+    phase: phase ?? this.phase,
+    parentChannelId: parentChannelId == _notProvided
+        ? this.parentChannelId
+        : parentChannelId as String?,
+    ephemeralChannelId: ephemeralChannelId == _notProvided
+        ? this.ephemeralChannelId
+        : ephemeralChannelId as String?,
+    startedEventId: startedEventId == _notProvided
+        ? this.startedEventId
+        : startedEventId as String?,
+    currentPubkey: currentPubkey == _notProvided
+        ? this.currentPubkey
+        : currentPubkey as String?,
+    isCreator: isCreator ?? this.isCreator,
+    wasAdmitted: wasAdmitted ?? this.wasAdmitted,
+    isMuted: isMuted ?? this.isMuted,
+    isSpeakerEnabled: isSpeakerEnabled ?? this.isSpeakerEnabled,
+    participantCount: participantCount ?? this.participantCount,
+    participantPubkeys: participantPubkeys ?? this.participantPubkeys,
+    activeSpeakerPubkeys: activeSpeakerPubkeys ?? this.activeSpeakerPubkeys,
+    speakerLevels: speakerLevels ?? this.speakerLevels,
+    reconnectAttempt: reconnectAttempt ?? this.reconnectAttempt,
+    receivedFrameCount: receivedFrameCount ?? this.receivedFrameCount,
+    sentFrameCount: sentFrameCount ?? this.sentFrameCount,
+    issue: issue == _notProvided ? this.issue : issue as String?,
+    error: error == _notProvided ? this.error : error as String?,
+    microphonePermissionRequired:
+        microphonePermissionRequired ?? this.microphonePermissionRequired,
+  );
+}
+
+typedef HuddleMediaFactory = HuddleMedia Function();
+typedef HuddleTransportFactory =
+    HuddleTransportClient Function(HuddleConnectionParameters parameters);
+
+final huddleMediaFactoryProvider = Provider<HuddleMediaFactory>(
+  (_) => MethodChannelHuddleMedia.new,
+);
+
+final huddleTransportFactoryProvider = Provider<HuddleTransportFactory>(
+  (_) =>
+      (parameters) => HuddleTransport(parameters: parameters),
+);
+
+final huddleReconnectDelaysProvider = Provider<List<Duration>>(
+  (_) => const [
+    Duration.zero,
+    Duration(milliseconds: 100),
+    Duration(milliseconds: 250),
+    Duration(milliseconds: 500),
+    Duration(seconds: 1),
+    Duration(seconds: 2),
+    Duration(seconds: 2),
+  ],
+);
+
+final huddleSessionProvider =
+    NotifierProvider<HuddleSessionNotifier, HuddleSessionState>(
+      HuddleSessionNotifier.new,
+    );
+
+/// Owns one foreground mobile Huddle and wires native Opus media to its socket.
+final class HuddleSessionNotifier extends Notifier<HuddleSessionState> {
+  HuddleMedia? _media;
+  HuddleTransportClient? _transport;
+  StreamSubscription<HuddleMediaState>? _mediaStateSubscription;
+  StreamSubscription<HuddleLocalAudioFrame>? _localFrameSubscription;
+  StreamSubscription<HuddleTransportState>? _transportStateSubscription;
+  StreamSubscription<HuddleRemoteAudioFrame>? _remoteFrameSubscription;
+  StreamSubscription<HuddleTransportError>? _transportIssueSubscription;
+  StreamSubscription<HuddlePeerEvent>? _peerEventSubscription;
+  var _generation = 0;
+  var _receivedFrames = 0;
+  var _sentFrames = 0;
+  static const _playbackQueueCapacityPerPeer = 10;
+
+  final Map<int, Queue<HuddleRemoteAudioFrame>> _playbackQueues = {};
+  Future<void>? _playbackDrain;
+  int? _lastPlaybackPeerIndex;
+  final Map<String, Timer> _speakerTimers = {};
+  final Map<String, double> _pendingSpeakerLevels = {};
+  Timer? _speakerLevelFlushTimer;
+  Timer? _reconnectTimer;
+  var _reconnectAttempt = 0;
+  var _reconnectInFlight = false;
+  var _wasConnected = false;
+
+  @override
+  HuddleSessionState build() {
+    ref.onDispose(() {
+      _generation += 1;
+      unawaited(_disposeResources());
+    });
+    return HuddleSessionState.idle;
+  }
+
+  Future<void> join(
+    HuddleConnectionParameters parameters, {
+    String? currentPubkey,
+    bool isCreator = false,
+    String? startedEventId,
+  }) async {
+    if (state.isInSession) {
+      if (state.ephemeralChannelId == parameters.ephemeralChannelId) return;
+      state = state.copyWith(
+        error: 'Leave the current Huddle before joining another one.',
+      );
+      return;
+    }
+
+    final generation = ++_generation;
+    await _disposeResources();
+    if (!_isCurrent(generation)) return;
+    _receivedFrames = 0;
+    _sentFrames = 0;
+    _reconnectAttempt = 0;
+    _reconnectInFlight = false;
+    _wasConnected = false;
+    state = HuddleSessionState(
+      phase: HuddleSessionPhase.checkingSupport,
+      parentChannelId: parameters.parentChannelId,
+      ephemeralChannelId: parameters.ephemeralChannelId,
+      startedEventId: startedEventId,
+      currentPubkey: currentPubkey?.toLowerCase(),
+      isCreator: isCreator,
+    );
+
+    try {
+      final media = ref.read(huddleMediaFactoryProvider)();
+      _media = media;
+      _mediaStateSubscription = media.states.listen((mediaState) {
+        if (!_isCurrent(generation)) return;
+        if (mediaState.phase == HuddleMediaPhase.failed) {
+          unawaited(
+            _fail(
+              mediaState.error?.message ?? 'Native Huddle audio failed.',
+              generation,
+              microphonePermissionRequired:
+                  mediaState.error?.code ==
+                  HuddleMediaErrorCode.permissionDenied,
+            ),
+          );
+          return;
+        }
+        if (mediaState.phase != HuddleMediaPhase.active) return;
+        if (mediaState.isInterrupted && state.isConnected) {
+          state = state.copyWith(phase: HuddleSessionPhase.interrupted);
+        } else if (!mediaState.isInterrupted &&
+            state.phase == HuddleSessionPhase.interrupted) {
+          state = state.copyWith(phase: HuddleSessionPhase.connected);
+        }
+      });
+
+      final capabilities = await media.discoverCapabilities();
+      _ensureCurrent(generation);
+      if (!capabilities.supportsFullDuplexOpus) {
+        throw const HuddleMediaError(
+          code: HuddleMediaErrorCode.unsupported,
+          message: 'Full-duplex mobile Huddle audio is unavailable here.',
+        );
+      }
+
+      state = state.copyWith(phase: HuddleSessionPhase.requestingPermission);
+      final permission = await media.requestMicrophonePermission();
+      _ensureCurrent(generation);
+      if (permission != HuddleMicrophonePermission.granted) {
+        throw const HuddleMediaError(
+          code: HuddleMediaErrorCode.permissionDenied,
+          message: 'Microphone permission is required to join a Huddle.',
+        );
+      }
+
+      state = state.copyWith(phase: HuddleSessionPhase.preparingMedia);
+      await media.prepare();
+      _ensureCurrent(generation);
+      await media.start();
+      _ensureCurrent(generation);
+
+      final transport = ref.read(huddleTransportFactoryProvider)(parameters);
+      _transport = transport;
+      _wireMediaAndTransport(media, transport, generation);
+      state = state.copyWith(
+        phase: HuddleSessionPhase.connecting,
+        isMuted: false,
+      );
+      await transport.connect();
+      _ensureCurrent(generation);
+      state = state.copyWith(
+        phase: media.state.isInterrupted
+            ? HuddleSessionPhase.interrupted
+            : HuddleSessionPhase.connected,
+        isMuted: media.state.isMuted,
+        isSpeakerEnabled: media.state.isSpeakerEnabled,
+        wasAdmitted: true,
+        participantCount: transport.state.peers.length,
+        participantPubkeys: _participantPubkeys(transport.state),
+        reconnectAttempt: 0,
+        issue: null,
+        error: null,
+      );
+    } catch (error) {
+      if (_isCurrent(generation)) {
+        await _fail(
+          _messageFor(error),
+          generation,
+          microphonePermissionRequired: _isPermissionDenied(error),
+        );
+      }
+    }
+  }
+
+  /// Open the OS app-settings screen so the user can grant a denied microphone
+  /// permission. Used by the failed-call UI's recovery path — a blind retry
+  /// deterministically fails again on iOS, which never re-prompts once denied.
+  /// Returns `true` when the settings UI was launched. Uses a transient media
+  /// instance because the session's own media was disposed on failure.
+  Future<bool> openMicrophoneSettings() async {
+    final media = _media ?? ref.read(huddleMediaFactoryProvider)();
+    try {
+      return await media.openSystemSettings();
+    } finally {
+      if (!identical(media, _media)) {
+        await media.dispose();
+      }
+    }
+  }
+
+  Future<void> setMuted(bool muted) async {
+    if (state.phase != HuddleSessionPhase.connected &&
+        state.phase != HuddleSessionPhase.interrupted) {
+      return;
+    }
+    final generation = _generation;
+    final media = _media;
+    if (media == null) return;
+    try {
+      await media.setMuted(muted);
+      if (_isCurrent(generation)) state = state.copyWith(isMuted: muted);
+    } catch (error) {
+      if (_isCurrent(generation)) {
+        await _fail(_messageFor(error), generation);
+      }
+    }
+  }
+
+  Future<void> setSpeakerEnabled(bool enabled) async {
+    if (state.phase != HuddleSessionPhase.connected &&
+        state.phase != HuddleSessionPhase.interrupted) {
+      return;
+    }
+    final generation = _generation;
+    final media = _media;
+    if (media == null) return;
+    try {
+      await media.setSpeakerEnabled(enabled);
+      if (_isCurrent(generation)) {
+        state = state.copyWith(isSpeakerEnabled: enabled);
+      }
+    } catch (error) {
+      if (_isCurrent(generation)) {
+        await _fail(_messageFor(error), generation);
+      }
+    }
+  }
+
+  Future<void> leave() async {
+    if (state.phase == HuddleSessionPhase.idle ||
+        state.phase == HuddleSessionPhase.leaving) {
+      return;
+    }
+    final generation = ++_generation;
+    state = state.copyWith(phase: HuddleSessionPhase.leaving, error: null);
+    try {
+      await _disposeResources();
+    } finally {
+      if (_isCurrent(generation)) state = HuddleSessionState.idle;
+    }
+  }
+
+  void _wireMediaAndTransport(
+    HuddleMedia media,
+    HuddleTransportClient transport,
+    int generation,
+  ) {
+    _localFrameSubscription = media.localAudioFrames.listen((frame) {
+      if (!_isCurrent(generation) ||
+          state.phase != HuddleSessionPhase.connected ||
+          state.isMuted) {
+        return;
+      }
+      try {
+        transport.sendOpusFrame(
+          header: frame.header,
+          opusPayload: frame.opusPayload,
+        );
+        if (!frame.header.isDtx && frame.header.levelDbov >= -55) {
+          final currentPubkey = state.currentPubkey;
+          if (currentPubkey != null) {
+            _recordSpeakerPubkey(
+              currentPubkey,
+              frame.header.levelDbov,
+              generation,
+            );
+          }
+        }
+        _sentFrames += 1;
+        _emitStatsIfNeeded(sent: true);
+      } catch (error) {
+        if (_wasConnected) {
+          _scheduleReconnect(transport, generation, _messageFor(error));
+        } else {
+          unawaited(_fail(_messageFor(error), generation));
+        }
+      }
+    });
+    _remoteFrameSubscription = transport.remoteAudioFrames.listen((frame) {
+      if (!_isCurrent(generation)) return;
+      _recordSpeaker(frame, transport, generation);
+      _receivedFrames += 1;
+      _emitStatsIfNeeded(sent: false);
+      _enqueuePlayback(media, frame, generation);
+    });
+    _transportStateSubscription = transport.states.listen((transportState) {
+      if (!_isCurrent(generation)) return;
+      if (transportState.phase == HuddleTransportPhase.connected) {
+        _wasConnected = true;
+        _reconnectTimer?.cancel();
+        _reconnectTimer = null;
+        _reconnectAttempt = 0;
+        _reconnectInFlight = false;
+        state = state.copyWith(
+          phase: media.state.isInterrupted
+              ? HuddleSessionPhase.interrupted
+              : HuddleSessionPhase.connected,
+          wasAdmitted: true,
+          participantCount: transportState.peers.length,
+          participantPubkeys: _participantPubkeys(transportState),
+          reconnectAttempt: 0,
+          issue: null,
+          error: null,
+        );
+      } else if (transportState.phase == HuddleTransportPhase.failed) {
+        final message =
+            transportState.error?.message ?? 'Huddle connection failed.';
+        if (_wasConnected) {
+          _scheduleReconnect(transport, generation, message);
+        } else {
+          unawaited(_fail(message, generation));
+        }
+      }
+    });
+    _peerEventSubscription = transport.peerEvents.listen((event) {
+      if (!_isCurrent(generation)) return;
+      if (event.type == HuddlePeerEventType.left ||
+          event.type == HuddlePeerEventType.replaced) {
+        _clearSpeaker(event.peer.pubkey);
+        _clearPlaybackPeer(event.peer.peerIndex);
+        unawaited(
+          media.removeRemotePeer(event.peer.peerIndex).catchError((
+            Object error,
+          ) async {
+            if (_isCurrent(generation)) {
+              await _fail(_messageFor(error), generation);
+            }
+          }),
+        );
+      }
+    });
+    _transportIssueSubscription = transport.issues.listen((issue) {
+      if (_isCurrent(generation)) state = state.copyWith(issue: issue.message);
+    });
+  }
+
+  void _enqueuePlayback(
+    HuddleMedia media,
+    HuddleRemoteAudioFrame frame,
+    int generation,
+  ) {
+    final queue = _playbackQueues.putIfAbsent(frame.peerIndex, Queue.new);
+    if (queue.length == _playbackQueueCapacityPerPeer) {
+      queue.removeFirst();
+    }
+    queue.addLast(frame);
+    if (_playbackDrain != null) return;
+
+    final drain = _drainPlayback(media, generation);
+    _playbackDrain = drain;
+    unawaited(
+      drain.whenComplete(() {
+        if (identical(_playbackDrain, drain)) _playbackDrain = null;
+      }),
+    );
+  }
+
+  Future<void> _drainPlayback(HuddleMedia media, int generation) async {
+    try {
+      while (_isCurrent(generation)) {
+        final peerIndexes = _playbackQueues.keys.toList()..sort();
+        if (peerIndexes.isEmpty) return;
+        final next = _lastPlaybackPeerIndex == null
+            ? 0
+            : peerIndexes.indexWhere(
+                (index) => index > _lastPlaybackPeerIndex!,
+              );
+        final start = next < 0 ? 0 : next;
+        HuddleRemoteAudioFrame? frame;
+        for (var offset = 0; offset < peerIndexes.length; offset++) {
+          final index = peerIndexes[(start + offset) % peerIndexes.length];
+          final queue = _playbackQueues[index];
+          if (queue != null && queue.isNotEmpty) {
+            frame = queue.removeFirst();
+            _lastPlaybackPeerIndex = index;
+            break;
+          }
+        }
+        if (frame == null) return;
+        await media.playRemoteFrame(frame);
+      }
+    } catch (error) {
+      if (_isCurrent(generation)) await _fail(_messageFor(error), generation);
+    }
+  }
+
+  void _clearPlaybackPeer(int peerIndex) {
+    _playbackQueues.remove(peerIndex)?.clear();
+  }
+
+  List<String> _participantPubkeys(HuddleTransportState transportState) {
+    final peers = transportState.peers.values.toList()
+      ..sort((left, right) => left.peerIndex.compareTo(right.peerIndex));
+    return List.unmodifiable(peers.map((peer) => peer.pubkey.toLowerCase()));
+  }
+
+  void _recordSpeaker(
+    HuddleRemoteAudioFrame frame,
+    HuddleTransportClient transport,
+    int generation,
+  ) {
+    if (frame.header.isDtx || frame.header.levelDbov < -55) return;
+    final pubkey = transport.state.peers[frame.peerIndex]?.pubkey.toLowerCase();
+    if (pubkey == null) return;
+    _recordSpeakerPubkey(pubkey, frame.header.levelDbov, generation);
+  }
+
+  void _recordSpeakerPubkey(String pubkey, int levelDbov, int generation) {
+    final normalized = pubkey.toLowerCase();
+    final wasActive = state.activeSpeakerPubkeys.contains(normalized);
+    final level = _speakerLevelFromDbov(levelDbov);
+    if (!wasActive) {
+      final speakers = {...state.activeSpeakerPubkeys, normalized};
+      final levels = {...state.speakerLevels, normalized: level};
+      state = state.copyWith(
+        activeSpeakerPubkeys: Set.unmodifiable(speakers),
+        speakerLevels: Map.unmodifiable(levels),
+      );
+    } else {
+      _pendingSpeakerLevels[normalized] = level;
+      _scheduleSpeakerLevelFlush(generation);
+    }
+    _speakerTimers.remove(normalized)?.cancel();
+    _speakerTimers[normalized] = Timer(const Duration(milliseconds: 600), () {
+      if (!_isCurrent(generation)) return;
+      _clearSpeaker(normalized);
+    });
+  }
+
+  void _clearSpeaker(String pubkey) {
+    final normalized = pubkey.toLowerCase();
+    _speakerTimers.remove(normalized)?.cancel();
+    _pendingSpeakerLevels.remove(normalized);
+    if (!state.activeSpeakerPubkeys.contains(normalized) &&
+        !state.speakerLevels.containsKey(normalized)) {
+      return;
+    }
+    final levels = Map<String, double>.from(state.speakerLevels)
+      ..remove(normalized);
+    state = state.copyWith(
+      activeSpeakerPubkeys: Set.unmodifiable(
+        state.activeSpeakerPubkeys.where((value) => value != normalized),
+      ),
+      speakerLevels: Map.unmodifiable(levels),
+    );
+  }
+
+  void _scheduleSpeakerLevelFlush(int generation) {
+    if (_speakerLevelFlushTimer != null) return;
+    _speakerLevelFlushTimer = Timer(const Duration(milliseconds: 50), () {
+      _speakerLevelFlushTimer = null;
+      if (!_isCurrent(generation)) {
+        _pendingSpeakerLevels.clear();
+        return;
+      }
+      if (_pendingSpeakerLevels.isEmpty) return;
+      final levels = {...state.speakerLevels, ..._pendingSpeakerLevels};
+      _pendingSpeakerLevels.clear();
+      state = state.copyWith(speakerLevels: Map.unmodifiable(levels));
+    });
+  }
+
+  void _scheduleReconnect(
+    HuddleTransportClient transport,
+    int generation,
+    String issue,
+  ) {
+    if (!_isCurrent(generation) ||
+        _reconnectInFlight ||
+        _reconnectTimer != null ||
+        state.phase == HuddleSessionPhase.leaving) {
+      return;
+    }
+    final delays = ref.read(huddleReconnectDelaysProvider);
+    if (_reconnectAttempt >= delays.length) {
+      unawaited(_fail('Huddle connection could not be restored.', generation));
+      return;
+    }
+    final attempt = ++_reconnectAttempt;
+    state = state.copyWith(
+      phase: HuddleSessionPhase.reconnecting,
+      reconnectAttempt: attempt,
+      issue: issue,
+    );
+    _reconnectTimer = Timer(delays[attempt - 1], () async {
+      _reconnectTimer = null;
+      if (!_isCurrent(generation)) return;
+      _reconnectInFlight = true;
+      try {
+        await transport.connect();
+      } catch (error) {
+        if (!_isCurrent(generation)) return;
+        _reconnectInFlight = false;
+        _scheduleReconnect(transport, generation, _messageFor(error));
+      }
+    });
+  }
+
+  void _emitStatsIfNeeded({required bool sent}) {
+    final count = sent ? _sentFrames : _receivedFrames;
+    if (count != 1 && count % 10 != 0) return;
+    state = state.copyWith(
+      sentFrameCount: _sentFrames,
+      receivedFrameCount: _receivedFrames,
+    );
+  }
+
+  Future<void> _fail(
+    String message,
+    int generation, {
+    bool microphonePermissionRequired = false,
+  }) async {
+    if (!_isCurrent(generation)) return;
+    final failureGeneration = ++_generation;
+    final failedState = state.copyWith(
+      phase: HuddleSessionPhase.failed,
+      isMuted: true,
+      error: message,
+      microphonePermissionRequired: microphonePermissionRequired,
+    );
+    // Failure teardown follows the same local-first contract as an explicit
+    // hangup. Publish the failed state only after capture and transport are
+    // closed, so lifecycle observers cannot begin relay work while native
+    // audio is still active.
+    try {
+      await _disposeResources();
+    } catch (error) {
+      debugPrint('Unable to fully release failed Huddle resources: $error');
+    }
+    if (_isCurrent(failureGeneration)) state = failedState;
+  }
+
+  Future<void> _disposeResources() async {
+    final subscriptions = <StreamSubscription<dynamic>?>[
+      _mediaStateSubscription,
+      _localFrameSubscription,
+      _transportStateSubscription,
+      _remoteFrameSubscription,
+      _transportIssueSubscription,
+      _peerEventSubscription,
+    ];
+    _mediaStateSubscription = null;
+    _localFrameSubscription = null;
+    _transportStateSubscription = null;
+    _remoteFrameSubscription = null;
+    _transportIssueSubscription = null;
+    _peerEventSubscription = null;
+    _reconnectTimer?.cancel();
+    _reconnectTimer = null;
+    _reconnectInFlight = false;
+    for (final timer in _speakerTimers.values) {
+      timer.cancel();
+    }
+    _speakerTimers.clear();
+    _speakerLevelFlushTimer?.cancel();
+    _speakerLevelFlushTimer = null;
+    _pendingSpeakerLevels.clear();
+    final transport = _transport;
+    final media = _media;
+    _transport = null;
+    _media = null;
+
+    // Stop native capture first. Cancelling a subscription to a synchronous
+    // media stream can wait for an in-flight callback, which must never keep
+    // the microphone active after the user hangs up. The generation guard
+    // above makes any final state/frame callbacks harmless during disposal.
+    Object? failure;
+    StackTrace? failureStackTrace;
+    try {
+      await media?.dispose();
+    } catch (error, stackTrace) {
+      failure = error;
+      failureStackTrace = stackTrace;
+    }
+    try {
+      await transport?.dispose();
+    } catch (error, stackTrace) {
+      failure ??= error;
+      failureStackTrace ??= stackTrace;
+    }
+    for (final subscription
+        in subscriptions.whereType<StreamSubscription<dynamic>>()) {
+      unawaited(
+        subscription.cancel().catchError((Object error, StackTrace stackTrace) {
+          debugPrint('Unable to detach a Huddle stream listener: $error');
+        }),
+      );
+    }
+    _playbackQueues.clear();
+    _playbackDrain = null;
+    _lastPlaybackPeerIndex = null;
+    if (failure != null) {
+      Error.throwWithStackTrace(failure, failureStackTrace!);
+    }
+  }
+
+  bool _isCurrent(int generation) => generation == _generation;
+
+  void _ensureCurrent(int generation) {
+    if (!_isCurrent(generation)) {
+      throw const HuddleTransportError(
+        code: HuddleTransportErrorCode.cancelled,
+        message: 'Huddle join was cancelled.',
+      );
+    }
+  }
+
+  String _messageFor(Object error) => switch (error) {
+    HuddleMediaError() => error.message,
+    HuddleTransportError() => error.message,
+    _ => 'Unable to join the Huddle.',
+  };
+
+  bool _isPermissionDenied(Object error) =>
+      error is HuddleMediaError &&
+      error.code == HuddleMediaErrorCode.permissionDenied;
+}
+
+double _speakerLevelFromDbov(int levelDbov) =>
+    ((levelDbov + 55) / 55).clamp(0.0, 1.0).toDouble();
diff --git a/mobile/lib/shared/huddle/huddle_transport.dart b/mobile/lib/shared/huddle/huddle_transport.dart
new file mode 100644
index 00000000000..b4efaa507f9
--- /dev/null
+++ b/mobile/lib/shared/huddle/huddle_transport.dart
@@ -0,0 +1,935 @@
+import 'dart:async';
+import 'dart:collection';
+import 'dart:convert';
+
+import 'package:flutter/foundation.dart';
+import 'package:web_socket_channel/io.dart';
+import 'package:web_socket_channel/web_socket_channel.dart';
+
+import 'huddle_auth.dart';
+import 'huddle_wire.dart';
+
+typedef HuddleWebSocketFactory = WebSocketChannel Function(Uri uri);
+
+WebSocketChannel _openHuddleWebSocket(Uri uri) =>
+    IOWebSocketChannel.connect(uri, pingInterval: const Duration(seconds: 30));
+
+enum HuddleTransportPhase {
+  idle,
+  connecting,
+  awaitingChallenge,
+  authenticating,
+  connected,
+  closing,
+  disconnected,
+  failed,
+}
+
+enum HuddleTransportErrorCode {
+  invalidState,
+  connectionFailed,
+  handshakeTimeout,
+  authenticationFailed,
+  relayRejected,
+  protocolViolation,
+  socketClosed,
+  sendFailed,
+  cancelled,
+  disposed,
+}
+
+@immutable
+final class HuddleTransportError implements Exception {
+  final HuddleTransportErrorCode code;
+  final String message;
+  final String? relayCode;
+  final Object? cause;
+
+  const HuddleTransportError({
+    required this.code,
+    required this.message,
+    this.relayCode,
+    this.cause,
+  });
+
+  @override
+  String toString() {
+    final suffix = relayCode == null ? '' : ' ($relayCode)';
+    return 'HuddleTransportError.${code.name}$suffix: $message';
+  }
+}
+
+@immutable
+final class HuddlePeer {
+  final String pubkey;
+  final int peerIndex;
+
+  /// Occupancy epoch of `peerIndex` for this pubkey. Advances each time the
+  /// index is reused by another occupancy; media frames are fenced against it
+  /// so a prior occupant's in-flight audio cannot be mis-attributed after reuse.
+  final int epoch;
+
+  const HuddlePeer({
+    required this.pubkey,
+    required this.peerIndex,
+    required this.epoch,
+  });
+}
+
+enum HuddlePeerEventType { joined, left, replaced }
+
+@immutable
+final class HuddlePeerEvent {
+  final HuddlePeerEventType type;
+  final HuddlePeer peer;
+  final HuddlePeer? replacement;
+
+  const HuddlePeerEvent({
+    required this.type,
+    required this.peer,
+    this.replacement,
+  });
+}
+
+@immutable
+final class HuddleTransportState {
+  final HuddleTransportPhase phase;
+  final int? localPeerIndex;
+  final int? rosterRevision;
+  final UnmodifiableMapView<int, HuddlePeer> peers;
+  final HuddleTransportError? error;
+
+  HuddleTransportState({
+    required this.phase,
+    this.localPeerIndex,
+    this.rosterRevision,
+    Map<int, HuddlePeer> peers = const {},
+    this.error,
+  }) : peers = UnmodifiableMapView(Map<int, HuddlePeer>.from(peers));
+
+  factory HuddleTransportState.idle() =>
+      HuddleTransportState(phase: HuddleTransportPhase.idle);
+}
+
+/// Dedicated Huddle audio transport.
+///
+/// This socket intentionally does not reuse [RelaySocket]: the main Nostr
+/// connection speaks JSON arrays and ignores binary messages, while Huddle
+/// audio uses JSON objects for its handshake/control plane and binary Opus v3
+/// frames for media. [connect] completes only after the relay's `joined`
+/// response, making authentication and room admission observable to callers.
+abstract interface class HuddleTransportClient {
+  HuddleTransportState get state;
+  Stream<HuddleTransportState> get states;
+  Stream<HuddleRemoteAudioFrame> get remoteAudioFrames;
+  Stream<HuddlePeerEvent> get peerEvents;
+  Stream<HuddleTransportError> get issues;
+
+  Future<void> connect();
+  void sendOpusFrame({
+    required HuddleAudioHeader header,
+    required Uint8List opusPayload,
+  });
+  Future<void> disconnect();
+  Future<void> dispose();
+}
+
+final class HuddleTransport implements HuddleTransportClient {
+  final HuddleConnectionParameters parameters;
+  final Duration connectTimeout;
+  final Duration handshakeTimeout;
+  final HuddleWebSocketFactory _channelFactory;
+
+  final StreamController<HuddleTransportState> _stateController =
+      StreamController.broadcast(sync: true);
+  final StreamController<HuddleRemoteAudioFrame> _audioController =
+      StreamController.broadcast(sync: true);
+  static const _audioIngressCapacity = 50;
+  final Queue<HuddleRemoteAudioFrame> _audioIngress = Queue();
+  Timer? _audioIngressTimer;
+  final StreamController<HuddlePeerEvent> _peerController =
+      StreamController.broadcast(sync: true);
+  final StreamController<HuddleTransportError> _issueController =
+      StreamController.broadcast(sync: true);
+
+  HuddleTransportState _state = HuddleTransportState.idle();
+  WebSocketChannel? _channel;
+  StreamSubscription<dynamic>? _subscription;
+  Completer<void>? _handshakeCompleter;
+  Timer? _handshakeTimer;
+  int _generation = 0;
+  bool _disposed = false;
+  bool _intentionalClose = false;
+  bool _hasAdmitted = false;
+  Map<int, HuddlePeer>? _admissionPreviousPeers;
+
+  HuddleTransport({
+    required this.parameters,
+    this.connectTimeout = const Duration(seconds: 8),
+    this.handshakeTimeout = const Duration(seconds: 5),
+    HuddleWebSocketFactory channelFactory = _openHuddleWebSocket,
+  }) : _channelFactory = channelFactory;
+
+  @override
+  HuddleTransportState get state => _state;
+  @override
+  Stream<HuddleTransportState> get states => _stateController.stream;
+  @override
+  Stream<HuddleRemoteAudioFrame> get remoteAudioFrames =>
+      _audioController.stream;
+  @override
+  Stream<HuddlePeerEvent> get peerEvents => _peerController.stream;
+
+  /// Recoverable packet/control problems that do not tear down a joined room.
+  @override
+  Stream<HuddleTransportError> get issues => _issueController.stream;
+
+  @override
+  Future<void> connect() async {
+    if (_disposed) {
+      throw const HuddleTransportError(
+        code: HuddleTransportErrorCode.disposed,
+        message: 'Huddle transport has been disposed.',
+      );
+    }
+    if (_state.phase != HuddleTransportPhase.idle &&
+        _state.phase != HuddleTransportPhase.disconnected &&
+        _state.phase != HuddleTransportPhase.failed) {
+      throw HuddleTransportError(
+        code: HuddleTransportErrorCode.invalidState,
+        message: 'Cannot connect while transport is ${_state.phase.name}.',
+      );
+    }
+
+    if (_state.phase == HuddleTransportPhase.failed ||
+        _state.phase == HuddleTransportPhase.disconnected) {
+      _handshakeTimer?.cancel();
+      _handshakeTimer = null;
+      final previousSubscription = _subscription;
+      _subscription = null;
+      await previousSubscription?.cancel();
+      final previousChannel = _channel;
+      _channel = null;
+      await previousChannel?.sink.close();
+      _handshakeCompleter = null;
+    }
+
+    final generation = ++_generation;
+    _intentionalClose = false;
+    _admissionPreviousPeers = Map<int, HuddlePeer>.from(_state.peers);
+    _emitState(
+      HuddleTransportState(
+        phase: HuddleTransportPhase.connecting,
+        localPeerIndex: _state.localPeerIndex,
+        // Roster revisions are scoped to one relay process/room lifetime. A
+        // fresh socket admission establishes a new authoritative baseline.
+        rosterRevision: null,
+        peers: _state.peers,
+      ),
+    );
+
+    try {
+      final channel = _channelFactory(parameters.audioWebSocketUri);
+      _channel = channel;
+      await channel.ready.timeout(connectTimeout);
+      if (!_isCurrent(generation)) {
+        throw const HuddleTransportError(
+          code: HuddleTransportErrorCode.cancelled,
+          message: 'Huddle connection was superseded.',
+        );
+      }
+
+      _handshakeCompleter = Completer<void>();
+      _subscription = channel.stream.listen(
+        (raw) => _handleRawMessage(raw, generation),
+        onError: (Object error, StackTrace stackTrace) =>
+            _handleSocketFailure(error, generation),
+        onDone: () => _handleSocketClosed(generation),
+        cancelOnError: false,
+      );
+      _emitState(
+        HuddleTransportState(
+          phase: HuddleTransportPhase.awaitingChallenge,
+          localPeerIndex: _state.localPeerIndex,
+          rosterRevision: _state.rosterRevision,
+          peers: _state.peers,
+        ),
+      );
+      _handshakeTimer = Timer(handshakeTimeout, () {
+        _fail(
+          const HuddleTransportError(
+            code: HuddleTransportErrorCode.handshakeTimeout,
+            message: 'Timed out waiting for Huddle room admission.',
+          ),
+          generation,
+        );
+      });
+
+      await _handshakeCompleter!.future;
+    } on HuddleTransportError {
+      rethrow;
+    } catch (error) {
+      final failure = HuddleTransportError(
+        code: HuddleTransportErrorCode.connectionFailed,
+        message: 'Unable to connect to the Huddle audio relay.',
+        cause: error,
+      );
+      _fail(failure, generation);
+      throw failure;
+    }
+  }
+
+  @override
+  void sendOpusFrame({
+    required HuddleAudioHeader header,
+    required Uint8List opusPayload,
+  }) {
+    final channel = _channel;
+    if (_disposed ||
+        channel == null ||
+        _state.phase != HuddleTransportPhase.connected) {
+      throw HuddleTransportError(
+        code: HuddleTransportErrorCode.invalidState,
+        message: 'Cannot send audio while transport is ${_state.phase.name}.',
+      );
+    }
+
+    try {
+      channel.sink.add(HuddleWireV3.encodeClientFrame(header, opusPayload));
+    } catch (error) {
+      throw HuddleTransportError(
+        code: HuddleTransportErrorCode.sendFailed,
+        message: 'Unable to send Huddle audio.',
+        cause: error,
+      );
+    }
+  }
+
+  @override
+  Future<void> disconnect() async {
+    if (_disposed ||
+        _state.phase == HuddleTransportPhase.idle ||
+        _state.phase == HuddleTransportPhase.disconnected) {
+      return;
+    }
+
+    _generation++;
+    _intentionalClose = true;
+    _handshakeTimer?.cancel();
+    _handshakeTimer = null;
+    if (_handshakeCompleter case final completer? when !completer.isCompleted) {
+      completer.completeError(
+        const HuddleTransportError(
+          code: HuddleTransportErrorCode.cancelled,
+          message: 'Huddle connection was closed.',
+        ),
+      );
+    }
+    _emitState(HuddleTransportState(phase: HuddleTransportPhase.closing));
+
+    final subscription = _subscription;
+    _subscription = null;
+    await subscription?.cancel();
+    final channel = _channel;
+    _channel = null;
+    await channel?.sink.close();
+    _handshakeCompleter = null;
+    _emitState(HuddleTransportState(phase: HuddleTransportPhase.disconnected));
+  }
+
+  @override
+  Future<void> dispose() async {
+    if (_disposed) return;
+    await disconnect();
+    _disposed = true;
+    _audioIngressTimer?.cancel();
+    _audioIngressTimer = null;
+    _audioIngress.clear();
+    await _stateController.close();
+    await _audioController.close();
+    await _peerController.close();
+    await _issueController.close();
+  }
+
+  void _handleRawMessage(dynamic raw, int generation) {
+    if (!_isCurrent(generation)) return;
+    if (raw is String) {
+      _handleTextMessage(raw, generation);
+      return;
+    }
+    if (raw is List<int>) {
+      _handleBinaryMessage(Uint8List.fromList(raw), generation);
+      return;
+    }
+    _handleProtocolProblem('Unsupported Huddle WebSocket message.', generation);
+  }
+
+  void _handleTextMessage(String raw, int generation) {
+    final Map<String, dynamic> message;
+    try {
+      final decoded = jsonDecode(raw);
+      if (decoded is! Map) throw const FormatException('expected object');
+      message = Map<String, dynamic>.from(decoded);
+    } catch (error) {
+      _handleProtocolProblem('Malformed Huddle control message.', generation);
+      return;
+    }
+
+    switch (message['type']) {
+      case 'challenge':
+        _handleChallenge(message, generation);
+      case 'joined':
+        _handleJoined(message, generation);
+      case 'left':
+        _handleLeft(message, generation);
+      case 'roster':
+        _handleRoster(message, generation);
+      case 'error':
+        _handleRelayError(message, generation);
+      default:
+        _handleProtocolProblem('Unknown Huddle control message.', generation);
+    }
+  }
+
+  void _handleChallenge(Map<String, dynamic> message, int generation) {
+    if (_state.phase != HuddleTransportPhase.awaitingChallenge) {
+      _handleProtocolProblem('Unexpected Huddle auth challenge.', generation);
+      return;
+    }
+    final challenge = message['challenge'];
+    if (challenge is! String || challenge.isEmpty) {
+      _fail(
+        const HuddleTransportError(
+          code: HuddleTransportErrorCode.protocolViolation,
+          message: 'Huddle auth challenge was missing.',
+        ),
+        generation,
+      );
+      return;
+    }
+
+    try {
+      final auth = HuddleAuthV3.buildMessage(
+        parameters: parameters,
+        challenge: challenge,
+      );
+      _channel?.sink.add(jsonEncode(auth));
+      _emitState(
+        HuddleTransportState(
+          phase: HuddleTransportPhase.authenticating,
+          localPeerIndex: _state.localPeerIndex,
+          rosterRevision: _state.rosterRevision,
+          peers: _state.peers,
+        ),
+      );
+    } catch (error) {
+      _fail(
+        HuddleTransportError(
+          code: HuddleTransportErrorCode.authenticationFailed,
+          message: 'Unable to sign Huddle authentication.',
+          cause: error,
+        ),
+        generation,
+      );
+    }
+  }
+
+  void _handleJoined(Map<String, dynamic> message, int generation) {
+    if (_state.phase != HuddleTransportPhase.authenticating &&
+        _state.phase != HuddleTransportPhase.connected) {
+      _handleProtocolProblem('Unexpected Huddle joined message.', generation);
+      return;
+    }
+
+    final pubkey = message['pubkey'];
+    final peerIndex = message['peer_index'];
+    final epoch = _parseEpoch(message['epoch']);
+    if (pubkey is! String ||
+        pubkey.isEmpty ||
+        peerIndex is! int ||
+        peerIndex < 0 ||
+        peerIndex > 255 ||
+        epoch == null) {
+      _handleProtocolProblem('Malformed Huddle joined message.', generation);
+      return;
+    }
+
+    final initialAdmission =
+        _state.phase == HuddleTransportPhase.authenticating;
+    final previousAdmissionPeers = initialAdmission
+        ? (_admissionPreviousPeers ?? _state.peers)
+        : _state.peers;
+    final revision = message['revision'];
+    if (revision != null && (revision is! int || revision < 0)) {
+      _handleProtocolProblem('Malformed Huddle joined revision.', generation);
+      return;
+    }
+    final currentRevision = _state.rosterRevision;
+    final staleAdmission =
+        initialAdmission &&
+        currentRevision != null &&
+        revision is int &&
+        revision < currentRevision;
+    final peers = Map<int, HuddlePeer>.from(_state.peers);
+    final replaced = peers[peerIndex];
+    final snapshot = message['peers'];
+    if (snapshot is List) {
+      final parsed = _parsePeerSnapshot(snapshot);
+      if (parsed == null) {
+        _handleProtocolProblem('Malformed Huddle joined roster.', generation);
+        return;
+      }
+      if (initialAdmission && !staleAdmission) {
+        peers
+          ..clear()
+          ..addAll(parsed);
+      } else if (!initialAdmission && revision == null) {
+        // Legacy, unrevisioned relays used this field as a best-effort roster
+        // snapshot. Revisioned joined controls are deltas; merging their
+        // payload before inspecting the occupied slot would hide index reuse.
+        peers.addAll(parsed);
+      }
+    }
+    if (!initialAdmission &&
+        !_acceptDeltaRevision(revision as int?, generation)) {
+      return;
+    }
+    if (initialAdmission && revision == null) {
+      final selfPresent = peers.values.any(
+        (candidate) => candidate.pubkey.toLowerCase() == pubkey.toLowerCase(),
+      );
+      if (!selfPresent) {
+        peers[peerIndex] = HuddlePeer(
+          pubkey: pubkey,
+          peerIndex: peerIndex,
+          epoch: epoch,
+        );
+      }
+    }
+    final peer = HuddlePeer(pubkey: pubkey, peerIndex: peerIndex, epoch: epoch);
+    if (!initialAdmission || revision == null) {
+      peers[peerIndex] = peer;
+    }
+    if (initialAdmission && _hasAdmitted) {
+      _emitAdmissionRosterChanges(previousAdmissionPeers, peers);
+    }
+    if (!initialAdmission &&
+        replaced != null &&
+        !_sameOccupancy(replaced, peer)) {
+      _purgeAudioIngress({peerIndex});
+    }
+
+    _emitState(
+      HuddleTransportState(
+        phase: HuddleTransportPhase.connected,
+        localPeerIndex: initialAdmission ? peerIndex : _state.localPeerIndex,
+        rosterRevision: initialAdmission
+            ? (staleAdmission ? currentRevision : revision as int?)
+            : (revision as int? ?? _state.rosterRevision),
+        peers: peers,
+      ),
+    );
+    if (!initialAdmission) {
+      if (replaced != null && !_sameOccupancy(replaced, peer)) {
+        _peerController.add(
+          HuddlePeerEvent(
+            type: HuddlePeerEventType.replaced,
+            peer: replaced,
+            replacement: peer,
+          ),
+        );
+      } else {
+        _peerController.add(
+          HuddlePeerEvent(type: HuddlePeerEventType.joined, peer: peer),
+        );
+      }
+    }
+    _handshakeTimer?.cancel();
+    _handshakeTimer = null;
+    if (initialAdmission) {
+      _hasAdmitted = true;
+      _admissionPreviousPeers = null;
+    }
+    if (_handshakeCompleter case final completer? when !completer.isCompleted) {
+      completer.complete();
+    }
+  }
+
+  void _emitAdmissionRosterChanges(
+    Map<int, HuddlePeer> previous,
+    Map<int, HuddlePeer> current,
+  ) {
+    final removedOrReplacedIndices = <int>{};
+    for (final entry in previous.entries) {
+      final replacement = current[entry.key];
+      // A fresh socket admission may follow a relay restart that reused the
+      // same pubkey/index/epoch while resetting its Opus sequence. Native
+      // playout survives reconnects, so every re-admitted remote slot must
+      // reset that prior decoder and jitter state.
+      if (replacement == null) {
+        removedOrReplacedIndices.add(entry.key);
+        _peerController.add(
+          HuddlePeerEvent(type: HuddlePeerEventType.left, peer: entry.value),
+        );
+      } else {
+        removedOrReplacedIndices.add(entry.key);
+        _peerController.add(
+          HuddlePeerEvent(
+            type: HuddlePeerEventType.replaced,
+            peer: entry.value,
+            replacement: replacement,
+          ),
+        );
+      }
+    }
+    _purgeAudioIngress(removedOrReplacedIndices);
+  }
+
+  void _handleLeft(Map<String, dynamic> message, int generation) {
+    if (_state.phase != HuddleTransportPhase.connected) {
+      _handleProtocolProblem('Unexpected Huddle left message.', generation);
+      return;
+    }
+    final pubkey = message['pubkey'];
+    final peerIndex = message['peer_index'];
+    final revision = message['revision'];
+    if (pubkey is! String ||
+        peerIndex is! int ||
+        peerIndex < 0 ||
+        peerIndex > 255 ||
+        (revision != null && (revision is! int || revision < 0))) {
+      _handleProtocolProblem('Malformed Huddle left message.', generation);
+      return;
+    }
+    if (!_acceptDeltaRevision(revision as int?, generation)) return;
+
+    final existing = _state.peers[peerIndex];
+    if (existing != null && existing.pubkey != pubkey) {
+      _requestRosterResync(generation);
+      return;
+    }
+    final peers = Map<int, HuddlePeer>.from(_state.peers);
+    final removed = peers.remove(peerIndex);
+    if (removed == null) return;
+    _purgeAudioIngress({peerIndex});
+    _emitState(
+      HuddleTransportState(
+        phase: HuddleTransportPhase.connected,
+        localPeerIndex: _state.localPeerIndex,
+        rosterRevision: revision ?? _state.rosterRevision,
+        peers: peers,
+      ),
+    );
+    _peerController.add(
+      HuddlePeerEvent(type: HuddlePeerEventType.left, peer: removed),
+    );
+  }
+
+  void _handleRoster(Map<String, dynamic> message, int generation) {
+    if (_state.phase == HuddleTransportPhase.authenticating) {
+      _handleInitialRoster(message, generation);
+      return;
+    }
+    if (_state.phase != HuddleTransportPhase.connected) {
+      _handleProtocolProblem('Unexpected Huddle roster message.', generation);
+      return;
+    }
+    final revision = message['revision'];
+    final snapshot = message['peers'];
+    if (revision is! int || revision < 0 || snapshot is! List) {
+      _handleProtocolProblem('Malformed Huddle roster message.', generation);
+      return;
+    }
+    final previousRevision = _state.rosterRevision;
+    if (previousRevision != null && revision <= previousRevision) return;
+    final peers = _parsePeerSnapshot(snapshot);
+    if (peers == null) {
+      _handleProtocolProblem('Malformed Huddle roster message.', generation);
+      return;
+    }
+
+    final previous = _state.peers;
+    final removedOrReplacedIndices = <int>{};
+    for (final entry in previous.entries) {
+      final replacement = peers[entry.key];
+      if (replacement == null || !_sameOccupancy(replacement, entry.value)) {
+        removedOrReplacedIndices.add(entry.key);
+      }
+    }
+    _purgeAudioIngress(removedOrReplacedIndices);
+    for (final entry in previous.entries) {
+      final replacement = peers[entry.key];
+      if (replacement == null) {
+        _peerController.add(
+          HuddlePeerEvent(type: HuddlePeerEventType.left, peer: entry.value),
+        );
+      } else if (!_sameOccupancy(replacement, entry.value)) {
+        _peerController.add(
+          HuddlePeerEvent(
+            type: HuddlePeerEventType.replaced,
+            peer: entry.value,
+            replacement: replacement,
+          ),
+        );
+      }
+    }
+    for (final entry in peers.entries) {
+      if (!previous.containsKey(entry.key)) {
+        _peerController.add(
+          HuddlePeerEvent(type: HuddlePeerEventType.joined, peer: entry.value),
+        );
+      }
+    }
+    _emitState(
+      HuddleTransportState(
+        phase: HuddleTransportPhase.connected,
+        localPeerIndex: _state.localPeerIndex,
+        rosterRevision: revision,
+        peers: peers,
+      ),
+    );
+  }
+
+  void _handleInitialRoster(Map<String, dynamic> message, int generation) {
+    final revision = message['revision'];
+    final snapshot = message['peers'];
+    if (revision is! int || revision < 0 || snapshot is! List) {
+      _handleProtocolProblem('Malformed Huddle roster message.', generation);
+      return;
+    }
+    final peers = _parsePeerSnapshot(snapshot);
+    if (peers == null) {
+      _handleProtocolProblem('Malformed Huddle roster message.', generation);
+      return;
+    }
+    // Mesh owners may repair a snapshot-to-delta race before the admission
+    // message reaches this client. Retain that newer authoritative snapshot;
+    // the following joined admission is allowed to establish localPeerIndex
+    // without replacing it with older state.
+    _emitState(
+      HuddleTransportState(
+        phase: HuddleTransportPhase.authenticating,
+        rosterRevision: revision,
+        peers: peers,
+      ),
+    );
+  }
+
+  bool _acceptDeltaRevision(int? revision, int generation) {
+    final current = _state.rosterRevision;
+    // Single-node relays do not revision their legacy joined/left controls.
+    // Once a revisioned snapshot/delta is observed, every later delta must be
+    // exactly sequential; gaps are repaired by an authoritative snapshot.
+    if (revision == null) return current == null;
+    if (current == null || revision == current + 1) return true;
+    if (revision <= current) return false;
+    _requestRosterResync(generation);
+    return false;
+  }
+
+  void _requestRosterResync(int generation) {
+    if (!_isCurrent(generation) ||
+        _state.phase != HuddleTransportPhase.connected) {
+      return;
+    }
+    _fail(
+      const HuddleTransportError(
+        code: HuddleTransportErrorCode.protocolViolation,
+        message: 'Huddle roster revision gap; reconnecting for a fresh roster.',
+      ),
+      generation,
+    );
+  }
+
+  Map<int, HuddlePeer>? _parsePeerSnapshot(List<dynamic> snapshot) {
+    final peers = <int, HuddlePeer>{};
+    for (final candidate in snapshot) {
+      if (candidate is! Map) return null;
+      final pubkey = candidate['pubkey'];
+      final peerIndex = candidate['peer_index'];
+      final epoch = _parseEpoch(candidate['epoch']);
+      if (pubkey is! String ||
+          pubkey.isEmpty ||
+          peerIndex is! int ||
+          peerIndex < 0 ||
+          peerIndex > 255 ||
+          epoch == null ||
+          peers.containsKey(peerIndex)) {
+        return null;
+      }
+      peers[peerIndex] = HuddlePeer(
+        pubkey: pubkey,
+        peerIndex: peerIndex,
+        epoch: epoch,
+      );
+    }
+    return peers;
+  }
+
+  static bool _sameOccupancy(HuddlePeer left, HuddlePeer right) =>
+      left.pubkey == right.pubkey && left.epoch == right.epoch;
+
+  /// Parse an optional wire `epoch` field. A current relay always sends it; a
+  /// missing value defaults to `0` so the fence degrades to a no-op against a
+  /// legacy relay rather than rejecting every frame. A present-but-malformed
+  /// value (wrong type or out of the `u8` range) is a protocol error and
+  /// yields `null`, mirroring `peer_index` strictness.
+  static int? _parseEpoch(Object? raw) {
+    if (raw == null) return 0;
+    if (raw is! int || raw < 0 || raw > 255) return null;
+    return raw;
+  }
+
+  void _handleRelayError(Map<String, dynamic> message, int generation) {
+    final relayCode = message['code'] is String
+        ? message['code'] as String
+        : null;
+    final relayMessage = message['message'] is String
+        ? message['message'] as String
+        : 'Huddle audio relay rejected the connection.';
+    _fail(
+      HuddleTransportError(
+        code: HuddleTransportErrorCode.relayRejected,
+        message: relayMessage,
+        relayCode: relayCode,
+      ),
+      generation,
+    );
+  }
+
+  void _handleBinaryMessage(Uint8List bytes, int generation) {
+    if (_state.phase != HuddleTransportPhase.connected) {
+      _handleProtocolProblem(
+        'Received Huddle audio before room admission.',
+        generation,
+      );
+      return;
+    }
+    try {
+      final frame = HuddleWireV3.decodeRelayFrame(bytes);
+      // The authoritative control roster owns the routing table. Packets from
+      // absent/recycled slots are stale and must never allocate playback state.
+      // The epoch fences the reuse race: an in-flight frame authored by a
+      // departed occupant that arrives after its index is reassigned carries
+      // the old epoch and is dropped rather than mis-attributed.
+      if (!_isCurrentOccupant(frame.peerIndex, frame.epoch)) return;
+      if (_audioIngress.length == _audioIngressCapacity) {
+        _audioIngress.removeFirst();
+      }
+      _audioIngress.addLast(frame);
+      _audioIngressTimer ??= Timer(Duration.zero, _drainAudioIngress);
+    } on HuddleWireException catch (error) {
+      _issueController.add(
+        HuddleTransportError(
+          code: HuddleTransportErrorCode.protocolViolation,
+          message: error.message,
+          cause: error,
+        ),
+      );
+    }
+  }
+
+  /// Whether `peerIndex` is currently occupied at exactly `epoch`. A frame is
+  /// deliverable only when both match the authoritative roster: an absent slot
+  /// is stale, and a slot reused by a later occupant has advanced its epoch, so
+  /// a departed occupant's in-flight frame is fenced rather than mis-attributed.
+  bool _isCurrentOccupant(int peerIndex, int epoch) {
+    final occupant = _state.peers[peerIndex];
+    return occupant != null && occupant.epoch == epoch;
+  }
+
+  void _purgeAudioIngress(Set<int> peerIndices) {
+    if (peerIndices.isEmpty || _audioIngress.isEmpty) return;
+    _audioIngress.removeWhere((frame) => peerIndices.contains(frame.peerIndex));
+  }
+
+  void _drainAudioIngress() {
+    _audioIngressTimer = null;
+    if (_disposed) {
+      _audioIngress.clear();
+      return;
+    }
+    while (_audioIngress.isNotEmpty) {
+      final frame = _audioIngress.removeFirst();
+      // Control and media are handled by the same socket callback, but queued
+      // media drains on later event-loop turns. Revalidate here so a removal
+      // or index replacement wins over every frame queued before that control.
+      // The epoch check rejects a frame whose slot was reused after it queued.
+      if (_isCurrentOccupant(frame.peerIndex, frame.epoch)) {
+        _audioController.add(frame);
+        break;
+      }
+    }
+    if (_audioIngress.isNotEmpty) {
+      _audioIngressTimer = Timer(Duration.zero, _drainAudioIngress);
+    }
+  }
+
+  void _handleProtocolProblem(String message, int generation) {
+    final error = HuddleTransportError(
+      code: HuddleTransportErrorCode.protocolViolation,
+      message: message,
+    );
+    if (_state.phase == HuddleTransportPhase.connected) {
+      _issueController.add(error);
+    } else {
+      _fail(error, generation);
+    }
+  }
+
+  void _handleSocketFailure(Object error, int generation) {
+    if (_intentionalClose || !_isCurrent(generation)) return;
+    _fail(
+      HuddleTransportError(
+        code: HuddleTransportErrorCode.connectionFailed,
+        message: 'Huddle audio socket failed.',
+        cause: error,
+      ),
+      generation,
+    );
+  }
+
+  void _handleSocketClosed(int generation) {
+    if (_intentionalClose || !_isCurrent(generation)) return;
+    _fail(
+      const HuddleTransportError(
+        code: HuddleTransportErrorCode.socketClosed,
+        message: 'Huddle audio socket closed unexpectedly.',
+      ),
+      generation,
+    );
+  }
+
+  void _fail(HuddleTransportError error, int generation) {
+    if (!_isCurrent(generation) ||
+        _state.phase == HuddleTransportPhase.failed) {
+      return;
+    }
+    _handshakeTimer?.cancel();
+    _handshakeTimer = null;
+    _emitState(
+      HuddleTransportState(
+        phase: HuddleTransportPhase.failed,
+        localPeerIndex: _state.localPeerIndex,
+        rosterRevision: _state.rosterRevision,
+        peers: _state.peers,
+        error: error,
+      ),
+    );
+    if (_handshakeCompleter case final completer? when !completer.isCompleted) {
+      completer.completeError(error);
+    }
+    _subscription?.cancel();
+    _subscription = null;
+    final channel = _channel;
+    _channel = null;
+    unawaited(channel?.sink.close() ?? Future<void>.value());
+  }
+
+  bool _isCurrent(int generation) => !_disposed && generation == _generation;
+
+  void _emitState(HuddleTransportState next) {
+    _state = next;
+    if (!_stateController.isClosed) _stateController.add(next);
+  }
+}
diff --git a/mobile/lib/shared/huddle/huddle_wire.dart b/mobile/lib/shared/huddle/huddle_wire.dart
new file mode 100644
index 00000000000..50702ee7364
--- /dev/null
+++ b/mobile/lib/shared/huddle/huddle_wire.dart
@@ -0,0 +1,193 @@
+import 'package:flutter/foundation.dart';
+
+/// Fixed audio framing contract shared with Buzz Desktop and `buzz-relay`.
+///
+/// Huddle audio rooms pin the first participant's protocol version. New mobile
+/// clients request v3 because relay-to-client frames add an occupancy epoch to
+/// v2's one-byte peer prefix. They must not silently fall back: the relay
+/// rejects mixed-version rooms with `upgrade_required`.
+abstract final class HuddleWireV3 {
+  static const protocolVersion = 3;
+  static const sampleRateHz = 48000;
+  static const channels = 1;
+  static const frameSamples = 960;
+  static const frameDuration = Duration(milliseconds: 20);
+  static const headerLength = 8;
+  static const relayPeerPrefixLength = 2;
+  static const dtxFlag = 0x01;
+  static const maxBinaryFrameLength = 4096;
+
+  /// Encodes a client-to-relay frame: `header | opus payload`.
+  static Uint8List encodeClientFrame(
+    HuddleAudioHeader header,
+    Uint8List opusPayload,
+  ) {
+    if (opusPayload.isEmpty) {
+      throw const HuddleWireException('Opus payload must not be empty.');
+    }
+    final length = headerLength + opusPayload.length;
+    if (length > maxBinaryFrameLength) {
+      throw HuddleWireException(
+        'Huddle audio frame is $length bytes; maximum is '
+        '$maxBinaryFrameLength.',
+      );
+    }
+
+    return Uint8List.fromList([...header.encode(), ...opusPayload]);
+  }
+
+  /// Decodes a relay-to-client frame:
+  /// `peer index | epoch | header | opus payload`.
+  static HuddleRemoteAudioFrame decodeRelayFrame(Uint8List bytes) {
+    final minimumLength = relayPeerPrefixLength + headerLength + 1;
+    if (bytes.length < minimumLength) {
+      throw HuddleWireException(
+        'Relay audio frame is ${bytes.length} bytes; expected at least '
+        '$minimumLength.',
+      );
+    }
+    if (bytes.length > maxBinaryFrameLength + relayPeerPrefixLength) {
+      throw HuddleWireException(
+        'Relay audio frame is ${bytes.length} bytes; maximum is '
+        '${maxBinaryFrameLength + relayPeerPrefixLength}.',
+      );
+    }
+
+    return HuddleRemoteAudioFrame(
+      peerIndex: bytes[0],
+      epoch: bytes[1],
+      header: HuddleAudioHeader.decode(bytes, offset: relayPeerPrefixLength),
+      opusPayload: Uint8List.fromList(
+        bytes.sublist(relayPeerPrefixLength + headerLength),
+      ),
+    );
+  }
+}
+
+/// The fixed eight-byte v2 header, encoded in network byte order.
+///
+/// Layout:
+/// - bytes 0-1: wrapping sequence number (`u16`)
+/// - bytes 2-5: sender media timestamp at 48 kHz (`u32`)
+/// - byte 6: sender-authored audio level in dBov (`i8`, `-127...0`)
+/// - byte 7: flags (`bit 0 = Opus DTX`; unknown bits are ignored)
+@immutable
+final class HuddleAudioHeader {
+  final int sequence;
+  final int timestamp48k;
+  final int levelDbov;
+  final int flags;
+
+  const HuddleAudioHeader({
+    required this.sequence,
+    required this.timestamp48k,
+    required this.levelDbov,
+    required this.flags,
+  }) : assert(sequence >= 0 && sequence <= 0xffff),
+       assert(timestamp48k >= 0 && timestamp48k <= 0xffffffff),
+       assert(levelDbov >= -127 && levelDbov <= 0),
+       assert(flags >= 0 && flags <= 0xff);
+
+  /// Builds a header while enforcing the wire ranges in release builds too.
+  factory HuddleAudioHeader.checked({
+    required int sequence,
+    required int timestamp48k,
+    required int levelDbov,
+    required int flags,
+  }) {
+    _validateValues(sequence, timestamp48k, levelDbov, flags);
+    return HuddleAudioHeader(
+      sequence: sequence,
+      timestamp48k: timestamp48k,
+      levelDbov: levelDbov,
+      flags: flags,
+    );
+  }
+
+  bool get isDtx => flags & HuddleWireV3.dtxFlag != 0;
+
+  Uint8List encode() {
+    _validate();
+    final bytes = Uint8List(HuddleWireV3.headerLength);
+    final view = ByteData.sublistView(bytes);
+    view.setUint16(0, sequence, Endian.big);
+    view.setUint32(2, timestamp48k, Endian.big);
+    view.setInt8(6, levelDbov);
+    view.setUint8(7, flags);
+    return bytes;
+  }
+
+  static HuddleAudioHeader decode(Uint8List bytes, {int offset = 0}) {
+    if (offset < 0 || bytes.length - offset < HuddleWireV3.headerLength) {
+      throw const HuddleWireException(
+        'Huddle audio header requires eight bytes.',
+      );
+    }
+    final view = ByteData.sublistView(
+      bytes,
+      offset,
+      offset + HuddleWireV3.headerLength,
+    );
+    final rawLevel = view.getInt8(6);
+    // Match the desktop contract: malformed VU telemetry becomes the silent
+    // floor but never causes an otherwise valid Opus packet to be dropped.
+    final level = rawLevel >= -127 && rawLevel <= 0 ? rawLevel : -127;
+    return HuddleAudioHeader(
+      sequence: view.getUint16(0, Endian.big),
+      timestamp48k: view.getUint32(2, Endian.big),
+      levelDbov: level,
+      flags: view.getUint8(7),
+    );
+  }
+
+  void _validate() => _validateValues(sequence, timestamp48k, levelDbov, flags);
+
+  static void _validateValues(
+    int sequence,
+    int timestamp48k,
+    int levelDbov,
+    int flags,
+  ) {
+    if (sequence < 0 || sequence > 0xffff) {
+      throw RangeError.range(sequence, 0, 0xffff, 'sequence');
+    }
+    if (timestamp48k < 0 || timestamp48k > 0xffffffff) {
+      throw RangeError.range(timestamp48k, 0, 0xffffffff, 'timestamp48k');
+    }
+    if (levelDbov < -127 || levelDbov > 0) {
+      throw RangeError.range(levelDbov, -127, 0, 'levelDbov');
+    }
+    if (flags < 0 || flags > 0xff) {
+      throw RangeError.range(flags, 0, 0xff, 'flags');
+    }
+  }
+}
+
+@immutable
+final class HuddleRemoteAudioFrame {
+  final int peerIndex;
+
+  /// Occupancy epoch of `peerIndex` this frame was authored under. Fenced by
+  /// the transport against the current roster occupant's epoch so a frame from
+  /// a departed occupant that arrives after its slot is reused is dropped
+  /// rather than mis-attributed to the new occupant.
+  final int epoch;
+  final HuddleAudioHeader header;
+  final Uint8List opusPayload;
+
+  const HuddleRemoteAudioFrame({
+    required this.peerIndex,
+    required this.epoch,
+    required this.header,
+    required this.opusPayload,
+  });
+}
+
+final class HuddleWireException implements Exception {
+  final String message;
+
+  const HuddleWireException(this.message);
+
+  @override
+  String toString() => 'HuddleWireException: $message';
+}
diff --git a/mobile/lib/shared/profile/user_cache_provider.dart b/mobile/lib/shared/profile/user_cache_provider.dart
index 4354cc2b164..c04bf952ae1 100644
--- a/mobile/lib/shared/profile/user_cache_provider.dart
+++ b/mobile/lib/shared/profile/user_cache_provider.dart
@@ -44,6 +44,16 @@ class UserCacheNotifier extends Notifier<Map<String, UserProfile>> {
     _batchTimer ??= Timer(const Duration(milliseconds: 50), _flushPending);
   }
 
+  /// Applies a live kind:0 profile event to the cache.
+  ///
+  /// Surfaces that keep a participant-scoped profile subscription can use this
+  /// to update names and avatars without discarding the rest of the cache.
+  void cacheProfileEvent(NostrEvent event) {
+    if (event.kind != 0) return;
+    final profile = _profileFromEvent(event);
+    state = {...state, profile.pubkey: profile};
+  }
+
   void _scheduleFetch(String pubkey) {
     if (state.containsKey(pubkey) || _pending.contains(pubkey)) return;
     _pending.add(pubkey);
@@ -65,16 +75,8 @@ class UserCacheNotifier extends Notifier<Map<String, UserProfile>> {
 
       final updated = Map<String, UserProfile>.from(state);
       for (final event in events) {
-        final data = ProfileData.fromEvent(event);
-        final pk = data.pubkey.toLowerCase();
-        updated[pk] = UserProfile(
-          pubkey: pk,
-          displayName: data.displayName,
-          avatarUrl: data.avatarUrl,
-          about: data.about,
-          nip05Handle: data.nip05,
-          ownerPubkey: verifiedOaOwnerPubkey(event.tags, event.pubkey),
-        );
+        final profile = _profileFromEvent(event);
+        updated[profile.pubkey] = profile;
       }
 
       state = updated;
@@ -82,6 +84,19 @@ class UserCacheNotifier extends Notifier<Map<String, UserProfile>> {
       // Silently fail — we'll just show pubkeys.
     }
   }
+
+  UserProfile _profileFromEvent(NostrEvent event) {
+    final data = ProfileData.fromEvent(event);
+    final pubkey = data.pubkey.toLowerCase();
+    return UserProfile(
+      pubkey: pubkey,
+      displayName: data.displayName,
+      avatarUrl: data.avatarUrl,
+      about: data.about,
+      nip05Handle: data.nip05,
+      ownerPubkey: verifiedOaOwnerPubkey(event.tags, event.pubkey),
+    );
+  }
 }
 
 final userCacheProvider =
diff --git a/mobile/lib/shared/relay/nostr_filters.dart b/mobile/lib/shared/relay/nostr_filters.dart
index d9d7a0b6f7e..b0391b654a2 100644
--- a/mobile/lib/shared/relay/nostr_filters.dart
+++ b/mobile/lib/shared/relay/nostr_filters.dart
@@ -49,6 +49,15 @@ abstract final class NostrFilters {
     until: until,
   );
 
+  /// Huddle lifecycle state for one parent channel, independent of timeline paging.
+  static NostrFilter huddleLifecycle(String channelId) => NostrFilter(
+    kinds: [EventKind.huddleStarted, EventKind.huddleEnded],
+    tags: {
+      '#h': [channelId],
+    },
+    limit: 200,
+  );
+
   /// Reactions (kind:7) on a specific event.
   static NostrFilter reactions(String eventId) => NostrFilter(
     kinds: [7],
diff --git a/mobile/lib/shared/relay/nostr_models.dart b/mobile/lib/shared/relay/nostr_models.dart
index 43b34c0e172..98039ff2ab2 100644
--- a/mobile/lib/shared/relay/nostr_models.dart
+++ b/mobile/lib/shared/relay/nostr_models.dart
@@ -92,6 +92,7 @@ abstract final class EventKind {
     jobCancel,
     jobError,
     huddleStarted,
+    huddleEnded,
   ];
 }
 
diff --git a/mobile/lib/shared/relay/relay_session.dart b/mobile/lib/shared/relay/relay_session.dart
index d6c094d82e1..77e10e66ede 100644
--- a/mobile/lib/shared/relay/relay_session.dart
+++ b/mobile/lib/shared/relay/relay_session.dart
@@ -75,8 +75,7 @@ class _BufferedEvent {
   _BufferedEvent(this.subId, this.event);
 }
 
-/// Manages websocket subscriptions, event batching, reconnection with replay,
-/// and pending event tracking. Equivalent to the desktop's RelayClientSession.
+/// Manages websocket subscriptions, batching, reconnection, and pending events.
 typedef RelaySocketFactory =
     RelaySocket Function({
       required String wsUrl,
@@ -139,6 +138,7 @@ class RelaySessionNotifier extends Notifier<SessionState> {
   bool _hasConnectedOnce = false;
   int _connectionGeneration = 0;
   final Map<Object, String> _visibleChannelsByOwner = {};
+  final Map<Object, Future<void> Function()> _beforePauseCallbacks = {};
   bool _socketConnected = false;
   bool _closedRetryReplayScheduled = false;
 
@@ -398,11 +398,30 @@ class RelaySessionNotifier extends Notifier<SessionState> {
     await _connect(config);
   }
 
+  /// Registers work that must settle before the background grace disconnect.
+  void Function() registerBeforePause(Future<void> Function() callback) {
+    final owner = Object();
+    _beforePauseCallbacks[owner] = callback;
+    return () => _beforePauseCallbacks.remove(owner);
+  }
+
   /// Called by the app lifecycle provider when the app goes to background.
   void onAppPaused() {
     _backgroundedAt = _now();
     _backgroundGraceTimer?.cancel();
-    _backgroundGraceTimer = Timer(_backgroundGraceDuration, _pauseNow);
+    _backgroundGraceTimer = Timer(_backgroundGraceDuration, () {
+      unawaited(_pauseAfterCallbacks());
+    });
+  }
+
+  Future<void> _pauseAfterCallbacks() async {
+    final callbacks = _beforePauseCallbacks.values.toList();
+    try {
+      await Future.wait(callbacks.map((callback) => callback()));
+    } catch (error) {
+      debugPrint('Background cleanup failed: $error');
+    }
+    if (_backgroundedAt != null) _pauseNow();
   }
 
   void _pauseNow() {
@@ -917,6 +936,7 @@ class RelaySessionNotifier extends Notifier<SessionState> {
 
   void _dispose() {
     _disposed = true;
+    _beforePauseCallbacks.clear();
     _connectionGeneration++;
     _reconnectTimer?.cancel();
     _flushTimer?.cancel();
diff --git a/mobile/lib/shared/theme/app_colors.dart b/mobile/lib/shared/theme/app_colors.dart
index 2a937ec6b6c..bb56234bc73 100644
--- a/mobile/lib/shared/theme/app_colors.dart
+++ b/mobile/lib/shared/theme/app_colors.dart
@@ -5,6 +5,9 @@ class AppColors extends ThemeExtension<AppColors> {
   final Color success;
   final Color warning;
   final Color accent;
+  final Color huddleDrawerSurface;
+  final Color huddleControlSurface;
+  final Color onHuddleDrawer;
 
   /// Gradient for the app's top section, non-null only under the Buzz themes.
   /// Carried on the theme rather than read from a provider so any surface can
@@ -16,6 +19,9 @@ class AppColors extends ThemeExtension<AppColors> {
     required this.success,
     required this.warning,
     required this.accent,
+    required this.huddleDrawerSurface,
+    required this.huddleControlSurface,
+    required this.onHuddleDrawer,
     this.topSectionGradient,
   });
 
@@ -24,11 +30,17 @@ class AppColors extends ThemeExtension<AppColors> {
     Color? success,
     Color? warning,
     Color? accent,
+    Color? huddleDrawerSurface,
+    Color? huddleControlSurface,
+    Color? onHuddleDrawer,
     Gradient? topSectionGradient,
   }) => AppColors(
     success: success ?? this.success,
     warning: warning ?? this.warning,
     accent: accent ?? this.accent,
+    huddleDrawerSurface: huddleDrawerSurface ?? this.huddleDrawerSurface,
+    huddleControlSurface: huddleControlSurface ?? this.huddleControlSurface,
+    onHuddleDrawer: onHuddleDrawer ?? this.onHuddleDrawer,
     topSectionGradient: topSectionGradient ?? this.topSectionGradient,
   );
 
@@ -39,6 +51,17 @@ class AppColors extends ThemeExtension<AppColors> {
       success: Color.lerp(success, other.success, t)!,
       warning: Color.lerp(warning, other.warning, t)!,
       accent: Color.lerp(accent, other.accent, t)!,
+      huddleDrawerSurface: Color.lerp(
+        huddleDrawerSurface,
+        other.huddleDrawerSurface,
+        t,
+      )!,
+      huddleControlSurface: Color.lerp(
+        huddleControlSurface,
+        other.huddleControlSurface,
+        t,
+      )!,
+      onHuddleDrawer: Color.lerp(onHuddleDrawer, other.onHuddleDrawer, t)!,
       topSectionGradient: Gradient.lerp(
         topSectionGradient,
         other.topSectionGradient,
diff --git a/mobile/lib/shared/theme/app_theme.dart b/mobile/lib/shared/theme/app_theme.dart
index 1407357062e..38e27b84882 100644
--- a/mobile/lib/shared/theme/app_theme.dart
+++ b/mobile/lib/shared/theme/app_theme.dart
@@ -33,6 +33,9 @@ class AppTheme {
       success: const Color(0xFF40A02B), // Catppuccin Latte Green — universal
       warning: const Color(0xFFDF8E1D), // Latte Yellow
       accent: scheme.tertiary,
+      huddleDrawerSurface: const Color(0xFF000000),
+      huddleControlSurface: const Color(0xFF333333),
+      onHuddleDrawer: const Color(0xFFFAFAFA),
       topSectionGradient: topSectionGradient,
     );
 
@@ -56,6 +59,12 @@ class AppTheme {
       ), // Catppuccin Macchiato Green — universal
       warning: const Color(0xFFEED49F), // Macchiato Yellow
       accent: scheme.tertiary,
+      huddleDrawerSurface: scheme.primaryContainer,
+      huddleControlSurface: Color.alphaBlend(
+        scheme.onPrimaryContainer.withValues(alpha: 0.18),
+        scheme.primaryContainer,
+      ),
+      onHuddleDrawer: scheme.onPrimaryContainer,
       topSectionGradient: topSectionGradient,
     );
 
diff --git a/mobile/lib/shared/widgets/buzz_action_tile.dart b/mobile/lib/shared/widgets/buzz_action_tile.dart
index 9aae8ad996b..24a0946b8c6 100644
--- a/mobile/lib/shared/widgets/buzz_action_tile.dart
+++ b/mobile/lib/shared/widgets/buzz_action_tile.dart
@@ -14,14 +14,19 @@ class BuzzActionTile extends StatelessWidget {
     required this.icon,
     required this.label,
     required this.onTap,
+    this.iconWidget,
     this.isEnabled = true,
     this.isLoading = false,
     this.loadingSemanticLabel,
+    this.iconColor,
   });
 
   /// Icon shown when the tile is not loading.
   final IconData? icon;
 
+  /// Optional custom icon widget shown instead of [icon].
+  final Widget? iconWidget;
+
   /// Label shown below the icon.
   final String label;
 
@@ -37,6 +42,9 @@ class BuzzActionTile extends StatelessWidget {
   /// Accessibility label for the loading indicator.
   final String? loadingSemanticLabel;
 
+  /// Optional icon tint used to communicate a selected action state.
+  final Color? iconColor;
+
   @override
   Widget build(BuildContext context) {
     final canTap = isEnabled && !isLoading;
@@ -75,7 +83,12 @@ class BuzzActionTile extends StatelessWidget {
                     semanticLabel: loadingSemanticLabel ?? label,
                   )
                 else
-                  Icon(icon, size: 22, color: context.colors.onSurface),
+                  iconWidget ??
+                      Icon(
+                        icon,
+                        size: 22,
+                        color: iconColor ?? context.colors.onSurface,
+                      ),
                 const SizedBox(height: Grid.xxs),
                 Text(
                   label,
diff --git a/mobile/lib/shared/widgets/buzz_sheet_header.dart b/mobile/lib/shared/widgets/buzz_sheet_header.dart
index 3168ad1d53b..fed46a8d607 100644
--- a/mobile/lib/shared/widgets/buzz_sheet_header.dart
+++ b/mobile/lib/shared/widgets/buzz_sheet_header.dart
@@ -5,6 +5,7 @@ import 'package:flutter/services.dart';
 import 'package:lucide_icons_flutter/lucide_icons.dart';
 
 import '../theme/theme.dart';
+import 'ios_glass_navigation_button.dart';
 
 /// A titled sheet header with balanced actions and an exactly centered title.
 class BuzzSheetHeader extends StatelessWidget {
@@ -75,14 +76,27 @@ class _SheetCloseButton extends StatelessWidget {
 
   @override
   Widget build(BuildContext context) {
+    void closeSheet() {
+      unawaited(HapticFeedback.lightImpact());
+      Navigator.of(context).pop();
+    }
+
+    if (Theme.of(context).platform == TargetPlatform.iOS) {
+      return IosGlassNavigationButton(
+        key: const ValueKey('buzz-sheet-ios-glass-close'),
+        icon: IosGlassNavigationIcon.close,
+        semanticLabel: 'Close sheet',
+        onPressed: closeSheet,
+        width: 44,
+        height: 44,
+      );
+    }
+
     return SizedBox.square(
       dimension: 44,
       child: IconButton(
         tooltip: 'Close sheet',
-        onPressed: () {
-          unawaited(HapticFeedback.lightImpact());
-          Navigator.of(context).pop();
-        },
+        onPressed: closeSheet,
         style: IconButton.styleFrom(
           padding: EdgeInsets.zero,
           backgroundColor: context.colors.surfaceContainerHighest,
diff --git a/mobile/lib/shared/widgets/concentric_sheet_surface.dart b/mobile/lib/shared/widgets/concentric_sheet_surface.dart
index 1cf7a67220c..2a8878acdf8 100644
--- a/mobile/lib/shared/widgets/concentric_sheet_surface.dart
+++ b/mobile/lib/shared/widgets/concentric_sheet_surface.dart
@@ -1,3 +1,5 @@
+import 'dart:async';
+
 import 'package:flutter/foundation.dart';
 import 'package:flutter/material.dart';
 import 'package:flutter/rendering.dart';
@@ -6,19 +8,33 @@ import 'package:flutter_hooks/flutter_hooks.dart';
 
 import '../theme/theme.dart';
 
-/// An iOS-native sheet surface that adopts the system's concentric corners on
-/// iOS 26 and newer. Other platforms keep the normal Flutter shape.
+enum ConcentricSurfaceCorners { all, bottom }
+
+/// An iOS-native surface that adopts the system's concentric corners on iOS 26
+/// and newer. Other platforms keep the normal Flutter shape.
 class ConcentricSheetSurface extends HookWidget {
   const ConcentricSheetSurface({
     required this.child,
     required this.enabled,
     this.color,
+    this.backdropColor,
+    this.corners = ConcentricSurfaceCorners.all,
+    this.padding = const EdgeInsets.only(
+      left: Grid.xxs,
+      right: Grid.xxs,
+      bottom: Grid.xxs,
+    ),
+    this.providesSheetSurface = true,
     super.key,
   });
 
   final Widget child;
   final bool enabled;
   final Color? color;
+  final Color? backdropColor;
+  final ConcentricSurfaceCorners corners;
+  final EdgeInsetsGeometry padding;
+  final bool providesSheetSurface;
 
   static bool providesSurfaceOf(BuildContext context) =>
       context
@@ -29,6 +45,13 @@ class ConcentricSheetSurface extends HookWidget {
   static const _surfaceChannel = MethodChannel('buzz/concentric_sheet_surface');
   static const _nativeContentClipRadius = Radii.dialog * 2;
 
+  BorderRadius _borderRadius(double radius) => switch (corners) {
+    ConcentricSurfaceCorners.all => BorderRadius.circular(radius),
+    ConcentricSurfaceCorners.bottom => BorderRadius.vertical(
+      bottom: Radius.circular(radius),
+    ),
+  };
+
   Future<bool> _checkNativeSurfaceSupport() async {
     try {
       final supported = await _surfaceChannel.invokeMethod<bool>('isSupported');
@@ -42,6 +65,23 @@ class ConcentricSheetSurface extends HookWidget {
     }
   }
 
+  Future<void> _updateNativeSurfaceColors({
+    required MethodChannel channel,
+    required Color surfaceColor,
+    required Color? backdropColor,
+  }) async {
+    try {
+      await channel.invokeMethod<void>('updateColors', <String, Object?>{
+        'color': surfaceColor.toARGB32(),
+        'backdropColor': backdropColor?.toARGB32(),
+      });
+    } on MissingPluginException {
+      // The platform view may have been disposed while its theme was changing.
+    } on PlatformException {
+      // The native surface is optional; retain its last successfully sent color.
+    }
+  }
+
   @override
   Widget build(BuildContext context) {
     final shouldCheckNativeSurface =
@@ -53,19 +93,42 @@ class ConcentricSheetSurface extends HookWidget {
       [shouldCheckNativeSurface],
     );
     final nativeSurfaceSupported = useFuture(supportFuture).data ?? false;
+    final surfaceColor = color ?? context.colors.surface;
+    final nativeSurfaceChannel = useState<MethodChannel?>(null);
+    useEffect(
+      () {
+        final channel = nativeSurfaceChannel.value;
+        if (!shouldCheckNativeSurface ||
+            !nativeSurfaceSupported ||
+            channel == null) {
+          return null;
+        }
+        unawaited(
+          _updateNativeSurfaceColors(
+            channel: channel,
+            surfaceColor: surfaceColor,
+            backdropColor: backdropColor,
+          ),
+        );
+        return null;
+      },
+      [
+        shouldCheckNativeSurface,
+        nativeSurfaceSupported,
+        nativeSurfaceChannel.value,
+        surfaceColor,
+        backdropColor,
+      ],
+    );
 
     if (!shouldCheckNativeSurface) {
       return _ConcentricSheetSurfaceScope(providesSurface: false, child: child);
     }
 
-    final surfaceColor = color ?? context.colors.surface;
+    final fallbackBorderRadius = _borderRadius(Radii.dialog);
 
     return Padding(
-      padding: const EdgeInsets.only(
-        left: Grid.xxs,
-        right: Grid.xxs,
-        bottom: Grid.xxs,
-      ),
+      padding: padding,
       child: Stack(
         children: [
           if (nativeSurfaceSupported)
@@ -74,9 +137,17 @@ class ConcentricSheetSurface extends HookWidget {
                 child: UiKitView(
                   viewType: 'buzz/concentric_sheet_surface',
                   hitTestBehavior: PlatformViewHitTestBehavior.transparent,
+                  onPlatformViewCreated: (viewId) {
+                    nativeSurfaceChannel.value = MethodChannel(
+                      'buzz/concentric_sheet_surface/$viewId',
+                    );
+                  },
                   creationParams: <String, Object>{
                     'color': surfaceColor.toARGB32(),
+                    if (backdropColor case final color?)
+                      'backdropColor': color.toARGB32(),
                     'minimumRadius': Radii.dialog,
+                    'corners': corners.name,
                   },
                   creationParamsCodec: const StandardMessageCodec(),
                 ),
@@ -86,7 +157,7 @@ class ConcentricSheetSurface extends HookWidget {
             Positioned.fill(
               child: Material(
                 color: surfaceColor,
-                borderRadius: BorderRadius.circular(Radii.dialog),
+                borderRadius: fallbackBorderRadius,
                 clipBehavior: Clip.antiAlias,
               ),
             ),
@@ -97,14 +168,16 @@ class ConcentricSheetSurface extends HookWidget {
             // the Flutter content inside that continuous outline; a 24pt
             // circular clip still lets scrolling rows show through the native
             // corner cutouts.
-            borderRadius: BorderRadius.circular(
+            borderRadius: _borderRadius(
               nativeSurfaceSupported ? _nativeContentClipRadius : Radii.dialog,
             ),
             clipBehavior: Clip.antiAlias,
-            child: _ConcentricSheetSurfaceScope(
-              providesSurface: true,
-              child: child,
-            ),
+            child: providesSheetSurface
+                ? _ConcentricSheetSurfaceScope(
+                    providesSurface: true,
+                    child: child,
+                  )
+                : child,
           ),
         ],
       ),
diff --git a/mobile/lib/shared/widgets/frosted_app_bar.dart b/mobile/lib/shared/widgets/frosted_app_bar.dart
index 2a2993f330f..d20b4dcf99b 100644
--- a/mobile/lib/shared/widgets/frosted_app_bar.dart
+++ b/mobile/lib/shared/widgets/frosted_app_bar.dart
@@ -5,6 +5,7 @@ import 'package:lucide_icons_flutter/lucide_icons.dart';
 
 import '../theme/theme.dart';
 import 'directional_transition_scope.dart';
+import 'ios_glass_navigation_button.dart';
 
 /// Minimum height of the frosted app bar content area below the safe area.
 const _kBarContentMinHeight = Grid.xxs + 32 + Grid.xxs; // 48
@@ -170,20 +171,34 @@ class FrostedAppBar extends StatelessWidget {
       titleStyle,
       titleContentHeight,
     );
+    final usesAutomaticIosGlassBackButton =
+        leading == null &&
+        automaticallyImplyLeading &&
+        canPop &&
+        Theme.of(context).platform == TargetPlatform.iOS;
 
     final effectiveLeading =
         leading ??
         (automaticallyImplyLeading && canPop
-            ? SizedBox(
-                width: 48,
-                height: 48,
-                child: IconButton(
-                  onPressed: () => Navigator.of(context).pop(),
-                  color: iconColor,
-                  icon: const Icon(LucideIcons.chevronLeft),
-                  tooltip: 'Back',
-                ),
-              )
+            ? usesAutomaticIosGlassBackButton
+                  ? IosGlassNavigationButton(
+                      icon: IosGlassNavigationIcon.back,
+                      semanticLabel: 'Back',
+                      onPressed: () => Navigator.of(context).maybePop(),
+                      width: iosGlassChannelHeaderLeadingWidth,
+                      buttonCenterX: iosGlassChannelHeaderButtonCenterX,
+                      foregroundColor: iconColor,
+                    )
+                  : SizedBox(
+                      width: 48,
+                      height: 48,
+                      child: IconButton(
+                        onPressed: () => Navigator.of(context).pop(),
+                        color: iconColor,
+                        icon: const Icon(LucideIcons.chevronLeft),
+                        tooltip: 'Back',
+                      ),
+                    )
             : null);
 
     final titleRow = SizedBox(
@@ -200,7 +215,9 @@ class FrostedAppBar extends StatelessWidget {
                   child: Padding(
                     padding: EdgeInsets.only(
                       left: effectiveLeading != null
-                          ? 0
+                          ? usesAutomaticIosGlassBackButton
+                                ? iosGlassChannelHeaderTitleSpacing
+                                : 0
                           : horizontalInset < Grid.gutter
                           ? Grid.gutter - horizontalInset
                           : 0,
diff --git a/mobile/lib/shared/widgets/ios_glass_navigation_button.dart b/mobile/lib/shared/widgets/ios_glass_navigation_button.dart
new file mode 100644
index 00000000000..f54c898d7cb
--- /dev/null
+++ b/mobile/lib/shared/widgets/ios_glass_navigation_button.dart
@@ -0,0 +1,164 @@
+import 'dart:async';
+
+import 'package:flutter/foundation.dart';
+import 'package:flutter/material.dart';
+import 'package:flutter/rendering.dart' show PlatformViewHitTestBehavior;
+import 'package:flutter/services.dart';
+import 'package:flutter_hooks/flutter_hooks.dart';
+
+import '../theme/theme.dart';
+
+/// The navigation glyph displayed by [IosGlassNavigationButton].
+enum IosGlassNavigationIcon { back, close }
+
+/// Leading width used by iOS channel-style headers.
+const iosGlassChannelHeaderLeadingWidth = 58.0;
+
+/// Horizontal center of the native button inside a channel-style leading.
+const iosGlassChannelHeaderButtonCenterX = 38.0;
+
+/// Space between the leading region and a channel-style title.
+const iosGlassChannelHeaderTitleSpacing = Grid.xs;
+
+/// A native iOS navigation control using the system glass button treatment.
+///
+/// Callers should only insert this widget on iOS and retain their existing
+/// Flutter control on other platforms.
+class IosGlassNavigationButton extends HookWidget {
+  const IosGlassNavigationButton({
+    super.key,
+    required this.icon,
+    required this.semanticLabel,
+    required this.onPressed,
+    this.width = 48,
+    this.height = 48,
+    this.buttonCenterX,
+    this.foregroundColor,
+    this.nativeViewSuppressed,
+  });
+
+  static const viewType = 'buzz/navigation_glass';
+
+  final IosGlassNavigationIcon icon;
+  final String semanticLabel;
+  final VoidCallback? onPressed;
+  final double width;
+  final double height;
+  final double? buttonCenterX;
+  final Color? foregroundColor;
+  final ValueListenable<bool>? nativeViewSuppressed;
+
+  @override
+  Widget build(BuildContext context) {
+    assert(defaultTargetPlatform == TargetPlatform.iOS);
+    final nativeChannel = useState<MethodChannel?>(null);
+    final onPressedRef = useRef(onPressed)..value = onPressed;
+    final brightness = context.theme.brightness.name;
+    final effectiveForeground = foregroundColor ?? context.colors.primary;
+    final foregroundValue = effectiveForeground.toARGB32();
+    final enabled = onPressed != null;
+
+    useEffect(() {
+      final channel = nativeChannel.value;
+      if (channel == null) return null;
+      channel.setMethodCallHandler((call) async {
+        if (call.method == 'pressed') {
+          onPressedRef.value?.call();
+        }
+      });
+      return () => channel.setMethodCallHandler(null);
+    }, [nativeChannel.value]);
+
+    useEffect(() {
+      final channel = nativeChannel.value;
+      if (channel != null) {
+        unawaited(
+          channel.invokeMethod<void>('setAppearance', <String, Object>{
+            'brightness': brightness,
+            'foregroundColor': foregroundValue,
+            'enabled': enabled,
+          }),
+        );
+      }
+      return null;
+    }, [nativeChannel.value, brightness, foregroundValue, enabled]);
+
+    Widget buildControl({required bool suppressNativeView}) {
+      if (suppressNativeView) {
+        final resolvedButtonCenterX = buttonCenterX ?? width / 2;
+        return Semantics(
+          container: true,
+          button: true,
+          enabled: enabled,
+          label: semanticLabel,
+          onTap: onPressed,
+          child: ExcludeSemantics(
+            child: Stack(
+              key: const ValueKey('ios-glass-navigation-flutter-fallback'),
+              children: [
+                Positioned(
+                  left: resolvedButtonCenterX - 20,
+                  top: (height - 40) / 2,
+                  width: 40,
+                  height: 40,
+                  child: DecoratedBox(
+                    decoration: BoxDecoration(
+                      color: context.colors.surface.withValues(alpha: 0.72),
+                      shape: BoxShape.circle,
+                      border: Border.all(
+                        color: context.colors.inverseSurface.withValues(
+                          alpha: 0.07,
+                        ),
+                      ),
+                    ),
+                    child: Icon(
+                      icon == IosGlassNavigationIcon.back
+                          ? Icons.arrow_back_ios_new_rounded
+                          : Icons.close_rounded,
+                      size: 20,
+                      color: effectiveForeground,
+                    ),
+                  ),
+                ),
+              ],
+            ),
+          ),
+        );
+      }
+      return UiKitView(
+        viewType: viewType,
+        hitTestBehavior: PlatformViewHitTestBehavior.opaque,
+        creationParams: <String, Object>{
+          'icon': icon.name,
+          'accessibilityLabel': semanticLabel,
+          'brightness': brightness,
+          'foregroundColor': foregroundValue,
+          'enabled': enabled,
+          'buttonCenterX': buttonCenterX ?? width / 2,
+          'hitTargetWidth': width,
+          'hitTargetHeight': height,
+        },
+        creationParamsCodec: const StandardMessageCodec(),
+        onPlatformViewCreated: (viewId) {
+          nativeChannel.value = MethodChannel('$viewType/$viewId');
+        },
+      );
+    }
+
+    return Tooltip(
+      message: semanticLabel,
+      excludeFromSemantics: true,
+      child: SizedBox(
+        width: width,
+        height: height,
+        child: nativeViewSuppressed == null
+            ? buildControl(suppressNativeView: false)
+            : ValueListenableBuilder<bool>(
+                valueListenable: nativeViewSuppressed!,
+                builder: (context, suppressNativeView, _) =>
+                    buildControl(suppressNativeView: suppressNativeView),
+              ),
+      ),
+    );
+  }
+}
diff --git a/mobile/lib/shared/widgets/lucide_star_icon.dart b/mobile/lib/shared/widgets/lucide_star_icon.dart
new file mode 100644
index 00000000000..5d6bf3b20d5
--- /dev/null
+++ b/mobile/lib/shared/widgets/lucide_star_icon.dart
@@ -0,0 +1,67 @@
+import 'dart:math' as math;
+
+import 'package:flutter/material.dart';
+
+/// A Lucide-shaped star that can fill without changing its geometry.
+class LucideStarIcon extends StatelessWidget {
+  /// Creates a Lucide star using [color], optionally filled.
+  const LucideStarIcon({
+    super.key,
+    required this.color,
+    this.filled = false,
+    this.size = 22,
+  });
+
+  /// Color of the star's stroke or fill.
+  final Color color;
+
+  /// Whether to paint the star filled instead of outlined.
+  final bool filled;
+
+  /// Width and height of the square icon canvas.
+  final double size;
+
+  @override
+  Widget build(BuildContext context) => CustomPaint(
+    size: Size.square(size),
+    painter: _LucideStarPainter(color: color, filled: filled),
+  );
+}
+
+class _LucideStarPainter extends CustomPainter {
+  const _LucideStarPainter({required this.color, required this.filled});
+
+  final Color color;
+  final bool filled;
+
+  @override
+  void paint(Canvas canvas, Size size) {
+    final scale = math.min(size.width, size.height) / 24;
+    final path = Path()
+      ..moveTo(12 * scale, 2 * scale)
+      ..lineTo(15.09 * scale, 8.26 * scale)
+      ..lineTo(22 * scale, 9.27 * scale)
+      ..lineTo(17 * scale, 14.14 * scale)
+      ..lineTo(18.18 * scale, 21.02 * scale)
+      ..lineTo(12 * scale, 17.77 * scale)
+      ..lineTo(5.82 * scale, 21.02 * scale)
+      ..lineTo(7 * scale, 14.14 * scale)
+      ..lineTo(2 * scale, 9.27 * scale)
+      ..lineTo(8.91 * scale, 8.26 * scale)
+      ..close();
+
+    canvas.drawPath(
+      path,
+      Paint()
+        ..color = color
+        ..style = filled ? PaintingStyle.fill : PaintingStyle.stroke
+        ..strokeWidth = 2 * scale
+        ..strokeCap = StrokeCap.round
+        ..strokeJoin = StrokeJoin.round,
+    );
+  }
+
+  @override
+  bool shouldRepaint(_LucideStarPainter oldDelegate) =>
+      color != oldDelegate.color || filled != oldDelegate.filled;
+}
diff --git a/mobile/pubspec.lock b/mobile/pubspec.lock
index cb9bc0268c7..d83c73b98d0 100644
--- a/mobile/pubspec.lock
+++ b/mobile/pubspec.lock
@@ -289,6 +289,14 @@ packages:
       url: "https://pub.dev"
     source: hosted
     version: "1.0.2"
+  cupertino_icons:
+    dependency: "direct main"
+    description:
+      name: cupertino_icons
+      sha256: "41e005c33bd814be4d3096aff55b1908d419fde52ca656c8c47719ec745873cd"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.0.9"
   custom_lint:
     dependency: "direct dev"
     description:
diff --git a/mobile/pubspec.yaml b/mobile/pubspec.yaml
index 2cc049c5fea..cd1eac39ac1 100644
--- a/mobile/pubspec.yaml
+++ b/mobile/pubspec.yaml
@@ -9,6 +9,7 @@ environment:
 dependencies:
   flutter:
     sdk: flutter
+  cupertino_icons: ^1.0.8
   # Grapheme-cluster segmentation, for deciding whether a message body is
   # nothing but emoji. Already present transitively via the Flutter SDK;
   # declared here because we import it directly.
diff --git a/mobile/test/features/channels/channel_detail_page_test.dart b/mobile/test/features/channels/channel_detail_page_test.dart
index facf466daab..726f92a5699 100644
--- a/mobile/test/features/channels/channel_detail_page_test.dart
+++ b/mobile/test/features/channels/channel_detail_page_test.dart
@@ -1,20 +1,27 @@
 import 'dart:async';
+import 'dart:collection';
 import 'dart:convert';
 
 import 'package:flutter/foundation.dart';
 import 'package:flutter/material.dart';
-import 'package:flutter/rendering.dart' show ScrollDirection, SemanticsAction;
+import 'package:flutter/rendering.dart'
+    show RenderParagraph, ScrollDirection, SemanticsAction;
 import 'package:flutter/services.dart';
 import 'package:flutter_test/flutter_test.dart';
 import 'package:hooks_riverpod/hooks_riverpod.dart';
 import 'package:http/http.dart' as http;
 import 'package:http/testing.dart' as http_testing;
 import 'package:lucide_icons_flutter/lucide_icons.dart';
+import 'package:nostr/nostr.dart' as nostr;
 import 'package:scrollable_positioned_list/scrollable_positioned_list.dart';
 import 'package:buzz/features/channels/channel.dart';
 import 'package:buzz/features/channels/channel_detail_page.dart';
 import 'package:buzz/features/channels/channel_management_provider.dart';
 import 'package:buzz/features/channels/channel_messages_provider.dart';
+import 'package:buzz/features/channels/channel_mutes/channel_mutes_provider.dart';
+import 'package:buzz/features/channels/channel_mutes/channel_mutes_storage.dart';
+import 'package:buzz/features/channels/channel_stars/channel_stars_provider.dart';
+import 'package:buzz/features/channels/channel_stars/channel_stars_storage.dart';
 import 'package:buzz/features/channels/channel_typing_provider.dart';
 import 'package:buzz/features/channels/members_sheet.dart';
 import 'package:buzz/features/channels/composer_dock_size_reporter.dart';
@@ -22,8 +29,10 @@ import 'package:buzz/features/channels/date_formatters.dart';
 import 'package:buzz/features/channels/day_divider.dart';
 import 'package:buzz/features/channels/emoji_picker.dart';
 import 'package:buzz/features/channels/ime_metrics_settle_observer.dart';
+import 'package:buzz/features/channels/local_message_send_animation_provider.dart';
 import 'package:buzz/features/channels/message_action_backdrop_state.dart';
 import 'package:buzz/features/channels/message_actions.dart';
+import 'package:buzz/features/channels/mobile_huddle_controller.dart';
 import 'package:buzz/features/channels/reaction_row.dart';
 import 'package:buzz/features/channels/thread_detail_page.dart';
 import 'package:buzz/features/channels/thread_replies_provider.dart';
@@ -36,19 +45,33 @@ import 'package:buzz/features/profile/profile_provider.dart';
 import 'package:buzz/shared/profile/user_cache_provider.dart';
 import 'package:buzz/shared/profile/user_profile.dart';
 import 'package:buzz/features/profile/user_profile_sheet.dart';
+import 'package:buzz/shared/community/community_provider.dart';
+import 'package:buzz/shared/emoji/emoji_burst.dart';
 import 'package:buzz/shared/mentions/agent_identity_provider.dart';
+import 'package:buzz/shared/huddle/huddle.dart';
 import 'package:buzz/shared/relay/relay.dart';
 import 'package:buzz/shared/theme/theme.dart';
 import 'package:buzz/shared/widgets/app_list_card.dart';
 import 'package:buzz/shared/widgets/avatar_image.dart';
 import 'package:buzz/shared/widgets/frosted_app_bar.dart';
 import 'package:buzz/shared/widgets/frosted_scaffold.dart';
+import 'package:buzz/shared/widgets/flapping_bee.dart';
 import 'package:buzz/shared/widgets/keyboard_dismiss_on_drag.dart';
+import 'package:buzz/shared/widgets/ios_glass_navigation_button.dart';
+import 'package:buzz/shared/widgets/lucide_star_icon.dart';
 import 'package:buzz/shared/widgets/masked_avatar_badge.dart';
 import 'package:buzz/shared/widgets/skeleton.dart';
 import 'package:shared_preferences/shared_preferences.dart';
 
-const _channelId = 'test-channel';
+const _channelId = '11111111-2222-4333-8444-555555555555';
+const _huddleChannelId = '8d764100-fd8f-44cf-9c98-6d8fbd739b8c';
+const _otherChannelId = '22222222-3333-4444-8555-666666666666';
+const _otherHuddleChannelId = '9e875211-ae90-45df-8da9-7e9ace84ca9d';
+
+final _mutableHuddleMembersProvider =
+    NotifierProvider<_MutableHuddleMembersNotifier, List<ChannelMember>>(
+      () => _MutableHuddleMembersNotifier(const []),
+    );
 
 /// Shared mock prefs for providers that read [savedPrefsProvider]
 /// (e.g. the compose bar's draft store). Initialized in [main].
@@ -106,6 +129,7 @@ NostrEvent _huddleMsg({
   required int kind,
   String pubkey = 'alice',
   int createdAt = 1000,
+  String ephemeralChannelId = _huddleChannelId,
 }) => NostrEvent(
   id: id,
   pubkey: pubkey,
@@ -114,9 +138,7 @@ NostrEvent _huddleMsg({
   tags: [
     ['h', _channelId],
   ],
-  content: jsonEncode({
-    'ephemeral_channel_id': '8d764100-fd8f-44cf-9c98-6d8fbd739b8c',
-  }),
+  content: jsonEncode({'ephemeral_channel_id': ephemeralChannelId}),
   sig: '',
 );
 
@@ -180,6 +202,8 @@ Widget _buildTestable({
   Map<String, UserProfile> users = const {},
   _FakeUserCacheNotifier? userCacheNotifier,
   List<ChannelMember> members = const [],
+  List<ChannelMember> huddleMembers = const [],
+  _MutableHuddleMembersNotifier? huddleMembersNotifier,
   Channel? channel,
   List<Channel>? channels,
   _FakeChannelsNotifier? channelsNotifier,
@@ -205,10 +229,17 @@ Widget _buildTestable({
   bool disableRetries = false,
   Duration? Function(int retryCount, Object error)? providerRetry,
   RelaySessionNotifier? relaySessionNotifier,
+  RelayConfigNotifier? relayConfigNotifier,
+  HuddleMediaFactory? huddleMediaFactory,
+  HuddleTransportFactory? huddleTransportFactory,
+  HuddleHumanCountLoader? huddleHumanCountLoader,
+  List<NostrEvent> huddleLifecycle = const [],
+  String? huddleCurrentPubkey,
   http.Client? mediaClient,
   Widget? home,
 }) {
   final resolvedChannel = channel ?? _testChannel;
+  final navigatorKey = GlobalKey<NavigatorState>();
   final fakeChannelsNotifier =
       channelsNotifier ?? _FakeChannelsNotifier(channels ?? [resolvedChannel]);
   final fakeMessagesNotifier =
@@ -227,6 +258,8 @@ Widget _buildTestable({
       ),
       profileProvider.overrideWith(() => _FakeProfileNotifier()),
       channelsProvider.overrideWith(() => fakeChannelsNotifier),
+      channelStarsProvider.overrideWith(_FakeChannelStarsNotifier.new),
+      channelMutesProvider.overrideWith(_FakeChannelMutesNotifier.new),
       channelDetailsProvider(_channelId).overrideWith(
         (ref) async => ChannelDetails.fromChannel(resolvedChannel),
       ),
@@ -240,9 +273,22 @@ Widget _buildTestable({
       channelMembersProvider(_channelId).overrideWith(
         (ref) async => loadMembers != null ? loadMembers() : members,
       ),
+      channelMembersProvider(_huddleChannelId).overrideWith(
+        (ref) async => huddleMembersNotifier == null
+            ? huddleMembers
+            : ref.watch(_mutableHuddleMembersProvider),
+      ),
+      if (huddleMembersNotifier != null)
+        _mutableHuddleMembersProvider.overrideWith(() => huddleMembersNotifier),
       channelBotPubkeysProvider(
         _channelId,
       ).overrideWith((ref) async => const <String>{}),
+      channelBotPubkeysProvider(_huddleChannelId).overrideWith(
+        (ref) async => {
+          for (final member in huddleMembers)
+            if (member.isBot) member.pubkey.toLowerCase(),
+        },
+      ),
       agentOwnersProvider.overrideWith((ref) async => const <String, String>{}),
       if (directoryUsers != null)
         relayDirectoryUsersProvider.overrideWith((ref) async => directoryUsers),
@@ -283,17 +329,34 @@ Widget _buildTestable({
       ],
       if (relaySessionNotifier != null)
         relaySessionProvider.overrideWith(() => relaySessionNotifier),
+      if (relayConfigNotifier != null)
+        relayConfigProvider.overrideWith(() => relayConfigNotifier),
+      if (huddleMediaFactory != null)
+        huddleMediaFactoryProvider.overrideWithValue(huddleMediaFactory),
+      if (huddleTransportFactory != null)
+        huddleTransportFactoryProvider.overrideWithValue(
+          huddleTransportFactory,
+        ),
+      if (huddleHumanCountLoader != null)
+        huddleHumanCountProvider.overrideWithValue(huddleHumanCountLoader),
+      huddleLifecycleProvider(
+        _channelId,
+      ).overrideWith((ref) async => huddleLifecycle),
+      if (huddleCurrentPubkey != null)
+        currentPubkeyProvider.overrideWith((ref) => huddleCurrentPubkey),
+      appLifecycleProvider.overrideWith(_TestAppLifecycleNotifier.new),
       // Compose bar drafts persist through SharedPreferences.
       savedPrefsProvider.overrideWithValue(_testPrefs),
     ],
     child: MaterialApp(
+      navigatorKey: navigatorKey,
       theme: AppTheme.light(),
       builder: (context, child) => MediaQuery(
         data: MediaQuery.of(context).copyWith(
           textScaler: textScaler,
           disableAnimations: disableAnimations,
         ),
-        child: child!,
+        child: MobileHuddleShell(navigatorKey: navigatorKey, child: child!),
       ),
       navigatorObservers: navigatorObservers,
       home:
@@ -1060,7 +1123,7 @@ void main() {
       final starSemantics = tester.getSemantics(
         find.byKey(const ValueKey('channel-details-star-action')),
       );
-      expect(starSemantics.label, 'Star channel');
+      expect(starSemantics.label, 'Star');
       expect(starSemantics.flagsCollection.isButton, isTrue);
       expect(
         starSemantics.flagsCollection.isEnabled.toString(),
@@ -1086,6 +1149,56 @@ void main() {
       );
     });
 
+    testWidgets(
+      'star and mute actions update their visible state immediately',
+      (tester) async {
+        await tester.pumpWidget(_buildTestable(messages: const []));
+        await tester.pumpAndSettle();
+
+        await tester.tap(
+          find.byKey(const ValueKey('channel-header-settings-trigger')),
+        );
+        await tester.pumpAndSettle();
+
+        final starAction = find.byKey(
+          const ValueKey('channel-details-star-action'),
+        );
+        final muteAction = find.byKey(
+          const ValueKey('channel-details-mute-action'),
+        );
+        expect(find.text('Star'), findsOneWidget);
+        var star = tester.widget<LucideStarIcon>(find.byType(LucideStarIcon));
+        expect(star.filled, isFalse);
+        expect(find.text('Mute'), findsOneWidget);
+        expect(find.byIcon(LucideIcons.bellOff), findsOneWidget);
+
+        await tester.tap(starAction);
+        await tester.pump();
+
+        expect(find.text('Unstar'), findsOneWidget);
+        star = tester.widget<LucideStarIcon>(find.byType(LucideStarIcon));
+        expect(star.filled, isTrue);
+        expect(star.color, AppTheme.light().colorScheme.primary);
+
+        await tester.tap(muteAction);
+        await tester.pump();
+
+        expect(find.text('Unmute'), findsOneWidget);
+        final activeBell = tester.widget<Icon>(find.byIcon(LucideIcons.bell));
+        expect(activeBell.color, AppTheme.light().colorScheme.primary);
+
+        await tester.tap(starAction);
+        await tester.tap(muteAction);
+        await tester.pump();
+
+        expect(find.text('Star'), findsOneWidget);
+        expect(find.text('Mute'), findsOneWidget);
+        star = tester.widget<LucideStarIcon>(find.byType(LucideStarIcon));
+        expect(star.filled, isFalse);
+        expect(find.byIcon(LucideIcons.bellOff), findsOneWidget);
+      },
+    );
+
     testWidgets('action tiles grow together for large text on a narrow page', (
       tester,
     ) async {
@@ -1116,8 +1229,8 @@ void main() {
       final editAction = find.byKey(
         const ValueKey('channel-details-edit-action'),
       );
-      expect(find.text('Star channel'), findsOneWidget);
-      expect(find.text('Mute channel'), findsOneWidget);
+      expect(find.text('Star'), findsOneWidget);
+      expect(find.text('Mute'), findsOneWidget);
       expect(find.text('Edit'), findsOneWidget);
       expect(tester.getSize(starAction).height, greaterThan(84));
       expect(
@@ -1649,7 +1762,7 @@ void main() {
       );
       await tester.pumpAndSettle();
 
-      expect(find.text('Mute channel'), findsOneWidget);
+      expect(find.text('Mute'), findsOneWidget);
       expect(find.text('Leave channel'), findsNothing);
       expect(find.text('Topic'), findsNothing);
       expect(find.text('Purpose'), findsNothing);
@@ -2502,7 +2615,13 @@ void main() {
       );
       expect(unreadButton, findsOneWidget);
       expect(find.byTooltip('Jump to oldest unread message'), findsOneWidget);
-      expect(find.byIcon(LucideIcons.chevronUp), findsOneWidget);
+      expect(
+        find.descendant(
+          of: unreadButton,
+          matching: find.byIcon(LucideIcons.chevronUp),
+        ),
+        findsOneWidget,
+      );
       expect(tester.getSize(unreadButton), const Size.square(48));
       final unreadRect = tester.getRect(unreadButton);
       expect(
@@ -3464,6 +3583,70 @@ void main() {
       );
     });
 
+    testWidgets(
+      'a same-second local send follows its inserted row when the tail ID stays unchanged',
+      (tester) async {
+        tester.view.physicalSize = const Size(400, 600);
+        tester.view.devicePixelRatio = 1;
+        addTearDown(tester.view.reset);
+
+        final initialMessages = [
+          for (var i = 0; i < 39; i++)
+            _textMsg(
+              id: 'msg$i',
+              pubkey: 'alice',
+              content: 'Message $i',
+              createdAt: 1000 + i,
+            ),
+          _textMsg(
+            id: 'z-final',
+            pubkey: 'alice',
+            content: List.filled(20, 'Tall final message').join('\n'),
+            createdAt: 2000,
+          ),
+        ];
+        final messagesNotifier = _FakeMessagesNotifier(initialMessages);
+
+        await tester.pumpWidget(
+          _buildTestable(
+            messages: const [],
+            messagesNotifier: messagesNotifier,
+            users: const {
+              'alice': UserProfile(pubkey: 'alice', displayName: 'Alice'),
+              'self': UserProfile(pubkey: 'self', displayName: 'Self'),
+            },
+          ),
+        );
+        await tester.pumpAndSettle();
+
+        final messageList = find.byKey(const ValueKey('channel-message-list'));
+        await tester.drag(messageList, const Offset(0, 300));
+        await tester.pumpAndSettle();
+        expect(findRichText('My same-second send'), findsNothing);
+
+        final localSend = _textMsg(
+          id: 'a-local',
+          pubkey: 'self',
+          content: 'My same-second send',
+          createdAt: 2000,
+        );
+        final container = ProviderScope.containerOf(
+          tester.element(find.byType(ChannelDetailPage)),
+        );
+        container
+            .read(localMessageSendAnimationProvider(_channelId).notifier)
+            .mark(localSend.id);
+        messagesNotifier.setMessages([...initialMessages, localSend]);
+        await tester.pumpAndSettle();
+
+        expect(findRichText('My same-second send'), findsOneWidget);
+        expect(
+          find.byKey(const ValueKey('channel-jump-to-latest')),
+          findsNothing,
+        );
+      },
+    );
+
     testWidgets(
       'Latest reveals the channel tail while the Android keyboard stays open',
       (tester) async {
@@ -4125,190 +4308,2241 @@ void main() {
       );
     });
 
-    for (final huddleEvent in [
-      (kind: EventKind.huddleStarted, action: 'started a huddle'),
-      (kind: EventKind.huddleEnded, action: 'ended the huddle'),
-    ]) {
-      testWidgets(
-        '${huddleEvent.action} aligns its author and body with a regular message',
-        (tester) async {
-          await tester.pumpWidget(
-            _buildTestable(
-              messages: [
-                _textMsg(
-                  id: 'regular-message',
-                  pubkey: 'alice',
-                  content: 'Regular message',
-                  createdAt: 1000,
-                ),
-                _huddleMsg(
-                  id: 'huddle-message',
-                  kind: huddleEvent.kind,
-                  pubkey: 'bob',
-                  createdAt: 1010,
-                ),
-              ],
-              users: {
-                'alice': const UserProfile(
-                  pubkey: 'alice',
-                  displayName: 'Alice',
-                ),
-                'bob': const UserProfile(pubkey: 'bob', displayName: 'Bob'),
-              },
-            ),
-          );
-          await tester.pumpAndSettle();
-
-          final regularRow = find.byKey(
-            const ValueKey('message-row-regular-message'),
-          );
-          final huddleRow = find.byKey(
-            const ValueKey('system-message-row-huddle-message'),
-          );
-          final regularAvatar = tester.getRect(
-            find
-                .descendant(of: regularRow, matching: find.byType(CircleAvatar))
-                .first,
-          );
-          final huddleAvatar = tester.getRect(
-            find
-                .descendant(of: huddleRow, matching: find.byType(CircleAvatar))
-                .first,
-          );
-          final regularAuthor = tester.getRect(
-            find.byKey(const ValueKey('message-author-regular-message')),
-          );
-          final huddleAuthor = tester.getRect(
-            find.byKey(const ValueKey('system-message-author-bob')),
-          );
-          final regularBody = tester.getRect(findRichText('Regular message'));
-          final huddleBody = tester.getRect(findRichText(huddleEvent.action));
-
-          expect(
-            huddleAuthor.top - huddleAvatar.top,
-            closeTo(regularAuthor.top - regularAvatar.top, 0.01),
-          );
-          expect(
-            huddleBody.top - huddleAuthor.bottom,
-            closeTo(regularBody.top - regularAuthor.bottom, 0.01),
-          );
-        },
-      );
-    }
-
-    testWidgets(
-      'keeps membership and huddle rows evenly spaced with authored messages',
-      (tester) async {
-        await tester.pumpWidget(
-          _buildTestable(
-            messages: [
-              _textMsg(
-                id: 'message-alice',
-                pubkey: 'alice',
-                content: 'First message',
-                createdAt: 1000,
-              ),
-              _textMsg(
-                id: 'message-bob',
-                pubkey: 'bob',
-                content: 'Second message',
-                createdAt: 1010,
-              ),
-              _systemMsg(
-                id: 'membership-carol',
-                payload: {
-                  'type': 'member_joined',
-                  'actor': 'alice',
-                  'target': 'carol',
-                },
-                createdAt: 1020,
-              ),
-              _huddleMsg(
-                id: 'huddle-dave',
-                kind: EventKind.huddleStarted,
-                pubkey: 'dave',
-                createdAt: 1030,
-              ),
-              _textMsg(
-                id: 'message-erin',
-                pubkey: 'erin',
-                content: 'Third message',
-                createdAt: 1040,
-              ),
-            ],
-            users: {
-              for (final name in ['alice', 'bob', 'carol', 'dave', 'erin'])
-                name: UserProfile(pubkey: name, displayName: name),
-            },
-          ),
-        );
-        await tester.pumpAndSettle();
-
-        Rect avatarRect(String rowKey) => tester.getRect(
-          find
-              .descendant(
-                of: find.byKey(ValueKey(rowKey)),
-                matching: find.byType(CircleAvatar),
-              )
-              .first,
-        );
-
-        final avatars = [
-          avatarRect('message-row-message-alice'),
-          avatarRect('message-row-message-bob'),
-          avatarRect('system-message-row-membership-carol'),
-          avatarRect('system-message-row-huddle-dave'),
-          avatarRect('message-row-message-erin'),
-        ];
-        final authoredMessageGap = avatars[1].top - avatars[0].bottom;
-
-        for (var index = 2; index < avatars.length; index++) {
-          expect(
-            avatars[index].top - avatars[index - 1].bottom,
-            closeTo(authoredMessageGap, 1),
-            reason: 'row $index should use the authored-message gap',
-          );
-        }
-      },
-    );
-
-    testWidgets('renders member_joined (self-join) system event', (
+    testWidgets('top action discovers a Huddle outside the timeline window', (
       tester,
     ) async {
-      final messages = [
-        _systemMsg(
-          id: 'sys1',
-          payload: {'type': 'member_joined', 'actor': 'bob', 'target': 'bob'},
-        ),
-      ];
-
+      final now = DateTime.now().millisecondsSinceEpoch ~/ 1000;
       await tester.pumpWidget(
         _buildTestable(
-          messages: messages,
-          users: {'bob': const UserProfile(pubkey: 'bob', displayName: 'Bob')},
+          messages: const [],
+          huddleLifecycle: [
+            _huddleMsg(
+              id: 'off-window-huddle',
+              kind: EventKind.huddleStarted,
+              createdAt: now,
+            ),
+          ],
         ),
       );
       await tester.pumpAndSettle();
 
-      expect(find.text('Bob'), findsOneWidget);
-      expect(findRichText('joined the channel'), findsOneWidget);
-      expect(
-        tester.getSize(find.byType(CircleAvatar)),
-        const Size.square(messageAvatarSize),
-      );
+      expect(find.byTooltip('Open Huddle'), findsOneWidget);
+      expect(find.text('Huddle in progress'), findsNothing);
     });
 
-    testWidgets('opens a profile sheet from a membership system avatar', (
+    testWidgets('offers Join for a recent desktop-started huddle', (
       tester,
     ) async {
+      final now = DateTime.now().millisecondsSinceEpoch ~/ 1000;
       await tester.pumpWidget(
         _buildTestable(
           messages: [
-            _systemMsg(
-              id: 'sys-membership-avatar',
-              payload: {
-                'type': 'member_joined',
-                'actor': 'alice',
+            _huddleMsg(
+              id: 'active-huddle',
+              kind: EventKind.huddleStarted,
+              createdAt: now,
+            ),
+          ],
+          users: {
+            'alice': const UserProfile(pubkey: 'alice', displayName: 'Alice'),
+          },
+        ),
+      );
+      await tester.pumpAndSettle();
+
+      expect(find.text('Huddle in progress'), findsOneWidget);
+      final join = tester.widget<FilledButton>(
+        find.widgetWithText(FilledButton, 'Join'),
+      );
+      expect(join.onPressed, isNotNull);
+    });
+
+    testWidgets('disables a different Huddle card during an active call', (
+      tester,
+    ) async {
+      const otherHuddleChannelId = 'other-huddle-channel';
+      final now = DateTime.now().millisecondsSinceEpoch ~/ 1000;
+      await tester.pumpWidget(
+        _buildTestable(
+          messages: [
+            _huddleMsg(
+              id: 'current-huddle',
+              kind: EventKind.huddleStarted,
+              pubkey: 'self',
+              createdAt: now,
+            ),
+            _huddleMsg(
+              id: 'other-huddle',
+              kind: EventKind.huddleStarted,
+              pubkey: 'alice',
+              createdAt: now,
+              ephemeralChannelId: otherHuddleChannelId,
+            ),
+          ],
+          users: const {
+            'alice': UserProfile(pubkey: 'alice', displayName: 'Alice'),
+            'self': UserProfile(pubkey: 'self', displayName: 'Self'),
+          },
+          relayConfigNotifier: _HuddleRelayConfigNotifier(),
+          huddleCurrentPubkey: 'self',
+          huddleMediaFactory: _HuddleTestMedia.new,
+          huddleTransportFactory: (_) => _HuddleTestTransport(),
+        ),
+      );
+      await tester.pumpAndSettle();
+
+      await tester.tap(
+        find.byKey(const ValueKey('huddle-Join-$_huddleChannelId')),
+      );
+      await tester.pumpAndSettle();
+      await tester.tap(find.byKey(const ValueKey('huddle-minimize')));
+      await tester.pumpAndSettle();
+
+      final otherJoin = tester.widget<FilledButton>(
+        find.byKey(const ValueKey('huddle-Join-$otherHuddleChannelId')),
+      );
+      expect(otherJoin.onPressed, isNull);
+    });
+
+    testWidgets('marks an expired Huddle card as ended', (tester) async {
+      final now = DateTime.now().millisecondsSinceEpoch ~/ 1000;
+      await tester.pumpWidget(
+        _buildTestable(
+          messages: [
+            _huddleMsg(
+              id: 'expired-huddle',
+              kind: EventKind.huddleStarted,
+              createdAt: now - const Duration(hours: 2).inSeconds,
+            ),
+          ],
+          users: {
+            'alice': const UserProfile(pubkey: 'alice', displayName: 'Alice'),
+          },
+        ),
+      );
+      await tester.pumpAndSettle();
+
+      expect(find.text('Huddle ended'), findsOneWidget);
+      expect(find.widgetWithText(FilledButton, 'Join'), findsNothing);
+      final ended = tester.widget<FilledButton>(
+        find.widgetWithText(FilledButton, 'Ended'),
+      );
+      expect(ended.onPressed, isNull);
+    });
+
+    testWidgets(
+      'offers a new Huddle when a stale invitation is no longer joinable',
+      (tester) async {
+        final now = DateTime.now().millisecondsSinceEpoch ~/ 1000;
+        final relaySession = _ReconnectingRelaySession();
+        var transportCount = 0;
+
+        await tester.pumpWidget(
+          _buildTestable(
+            messages: [
+              _huddleMsg(
+                id: 'stale-huddle',
+                kind: EventKind.huddleStarted,
+                pubkey: 'desktop',
+                createdAt: now,
+              ),
+            ],
+            users: const {
+              'desktop': UserProfile(pubkey: 'desktop'),
+              'self': UserProfile(pubkey: 'self'),
+            },
+            relayConfigNotifier: _HuddleRelayConfigNotifier(),
+            relaySessionNotifier: relaySession,
+            huddleCurrentPubkey: 'self',
+            huddleMediaFactory: _HuddleTestMedia.new,
+            huddleTransportFactory: (_) {
+              transportCount++;
+              return _HuddleTestTransport(
+                connectError: transportCount == 1
+                    ? const HuddleTransportError(
+                        code: HuddleTransportErrorCode.relayRejected,
+                        message: 'not a member',
+                      )
+                    : null,
+              );
+            },
+          ),
+        );
+        await tester.pumpAndSettle();
+
+        await tester.tap(find.widgetWithText(FilledButton, 'Join'));
+        await tester.pumpAndSettle();
+
+        expect(
+          find.text('This Huddle is no longer available.'),
+          findsOneWidget,
+        );
+        expect(find.byTooltip('Start a new Huddle'), findsOneWidget);
+        expect(
+          find.descendant(
+            of: find.byKey(const ValueKey('huddle-retry')),
+            matching: find.byIcon(LucideIcons.refreshCw),
+          ),
+          findsNothing,
+        );
+
+        await tester.tap(find.byKey(const ValueKey('huddle-retry')));
+        await tester.pumpAndSettle();
+
+        expect(relaySession.publishedKinds.take(2), [
+          9007,
+          EventKind.huddleStarted,
+        ]);
+        expect(
+          find.byKey(const ValueKey('huddle-mute-toggle')),
+          findsOneWidget,
+        );
+        expect(find.byKey(const ValueKey('huddle-retry')), findsNothing);
+      },
+    );
+
+    testWidgets(
+      'offers a Settings recovery path instead of a blind retry after a '
+      'microphone denial',
+      (tester) async {
+        final now = DateTime.now().millisecondsSinceEpoch ~/ 1000;
+        final media = _HuddleTestMedia(
+          permission: HuddleMicrophonePermission.denied,
+        );
+        await tester.pumpWidget(
+          _buildTestable(
+            messages: [
+              _huddleMsg(
+                id: 'mic-denied-huddle',
+                kind: EventKind.huddleStarted,
+                pubkey: 'desktop',
+                createdAt: now,
+              ),
+            ],
+            users: const {
+              'desktop': UserProfile(pubkey: 'desktop'),
+              'self': UserProfile(pubkey: 'self'),
+            },
+            relayConfigNotifier: _HuddleRelayConfigNotifier(),
+            huddleCurrentPubkey: 'self',
+            huddleMediaFactory: () => media,
+            huddleTransportFactory: (_) => _HuddleTestTransport(),
+          ),
+        );
+        await tester.pumpAndSettle();
+
+        await tester.tap(find.widgetWithText(FilledButton, 'Join'));
+        await tester.pumpAndSettle();
+
+        // A denied microphone must NOT surface the generic "Try again" that
+        // deterministically fails again — only the Settings recovery path.
+        expect(find.byTooltip('Try again'), findsNothing);
+        expect(find.byTooltip('Open Settings'), findsOneWidget);
+        expect(
+          find.descendant(
+            of: find.byKey(const ValueKey('huddle-retry')),
+            matching: find.byIcon(LucideIcons.settings),
+          ),
+          findsOneWidget,
+        );
+
+        await tester.tap(find.byKey(const ValueKey('huddle-retry')));
+        await tester.pumpAndSettle();
+
+        expect(media.openSettingsCalls, 1);
+      },
+    );
+
+    testWidgets('does not leave a stale Huddle card in a retry loop', (
+      tester,
+    ) async {
+      final now = DateTime.now().millisecondsSinceEpoch ~/ 1000;
+      await tester.pumpWidget(
+        _buildTestable(
+          messages: [
+            _huddleMsg(
+              id: 'stale-huddle-card',
+              kind: EventKind.huddleStarted,
+              pubkey: 'desktop',
+              createdAt: now,
+            ),
+          ],
+          users: const {
+            'desktop': UserProfile(pubkey: 'desktop'),
+            'self': UserProfile(pubkey: 'self'),
+          },
+          relayConfigNotifier: _HuddleRelayConfigNotifier(),
+          huddleCurrentPubkey: 'self',
+          huddleMediaFactory: _HuddleTestMedia.new,
+          huddleTransportFactory: (_) => _HuddleTestTransport(
+            connectError: const HuddleTransportError(
+              code: HuddleTransportErrorCode.relayRejected,
+              message: 'not a member',
+            ),
+          ),
+        ),
+      );
+      await tester.pumpAndSettle();
+
+      await tester.tap(find.widgetWithText(FilledButton, 'Join'));
+      await tester.pumpAndSettle();
+      await tester.tap(find.byKey(const ValueKey('huddle-minimize')));
+      await tester.pumpAndSettle();
+
+      expect(find.widgetWithText(FilledButton, 'Retry'), findsNothing);
+      expect(find.widgetWithText(FilledButton, 'Start new'), findsOneWidget);
+      expect(find.byTooltip('Start Huddle'), findsOneWidget);
+      expect(
+        find.descendant(
+          of: find.byKey(const ValueKey('channel-huddle-button')),
+          matching: find.byIcon(LucideIcons.headphones),
+        ),
+        findsOneWidget,
+      );
+      expect(find.byIcon(LucideIcons.headphoneOff), findsNothing);
+    });
+
+    testWidgets('failed admission cannot publish Huddle leave lifecycle', (
+      tester,
+    ) async {
+      final now = DateTime.now().millisecondsSinceEpoch ~/ 1000;
+      final relaySession = _ReconnectingRelaySession();
+      await tester.pumpWidget(
+        _buildTestable(
+          messages: [
+            _huddleMsg(
+              id: 'unavailable-huddle',
+              kind: EventKind.huddleStarted,
+              pubkey: 'desktop',
+              createdAt: now,
+            ),
+          ],
+          users: const {
+            'desktop': UserProfile(pubkey: 'desktop'),
+            'self': UserProfile(pubkey: 'self'),
+          },
+          relayConfigNotifier: _HuddleRelayConfigNotifier(),
+          relaySessionNotifier: relaySession,
+          huddleCurrentPubkey: 'self',
+          huddleMediaFactory: _HuddleTestMedia.new,
+          huddleTransportFactory: (_) => _HuddleTestTransport(
+            connectError: const HuddleTransportError(
+              code: HuddleTransportErrorCode.relayRejected,
+              message: 'not a member',
+            ),
+          ),
+        ),
+      );
+      await tester.pumpAndSettle();
+
+      await tester.tap(find.widgetWithText(FilledButton, 'Join'));
+      await tester.pumpAndSettle();
+
+      await tester.tap(find.byKey(const ValueKey('huddle-leave')));
+      await tester.pumpAndSettle();
+
+      expect(relaySession.publishedKinds, isEmpty);
+    });
+
+    testWidgets('shows the flapping bee instead of an avatar while joining', (
+      tester,
+    ) async {
+      final now = DateTime.now().millisecondsSinceEpoch ~/ 1000;
+      final connectGate = Completer<void>();
+      final transport = _HuddleTestTransport(connectGate: connectGate.future);
+
+      await tester.pumpWidget(
+        _buildTestable(
+          messages: [
+            _huddleMsg(
+              id: 'loading-call-layout',
+              kind: EventKind.huddleStarted,
+              pubkey: 'desktop',
+              createdAt: now,
+            ),
+          ],
+          users: const {
+            'desktop': UserProfile(pubkey: 'desktop'),
+            'self': UserProfile(pubkey: 'self'),
+          },
+          relayConfigNotifier: _HuddleRelayConfigNotifier(),
+          huddleCurrentPubkey: 'self',
+          huddleMediaFactory: _HuddleTestMedia.new,
+          huddleTransportFactory: (_) => transport,
+        ),
+      );
+      await tester.pumpAndSettle();
+
+      await tester.tap(find.widgetWithText(FilledButton, 'Join'));
+      await tester.pump();
+      await tester.pump();
+
+      final loadingBee = find.byKey(const ValueKey('huddle-loading-bee'));
+      expect(loadingBee, findsOneWidget);
+      expect(find.byType(FlappingBee), findsOneWidget);
+      expect(tester.widget<FlappingBee>(loadingBee).width, 60);
+      expect(find.bySemanticsLabel('Joining Huddle'), findsOneWidget);
+      expect(
+        find.byKey(const ValueKey('huddle-participant-avatar-self')),
+        findsNothing,
+      );
+      final initialFlap = tester.widget<FlappingBee>(loadingBee).flapAmount;
+      await tester.pump(const Duration(milliseconds: 120));
+      expect(
+        tester.widget<FlappingBee>(loadingBee).flapAmount,
+        isNot(initialFlap),
+      );
+
+      connectGate.complete();
+      await tester.pumpAndSettle();
+
+      expect(loadingBee, findsNothing);
+      expect(
+        find.byKey(const ValueKey('huddle-participant-avatar-self')),
+        findsOneWidget,
+      );
+    });
+
+    testWidgets(
+      'opens the sparse full-screen call with avatar and audio controls',
+      (tester) async {
+        final now = DateTime.now().millisecondsSinceEpoch ~/ 1000;
+        final media = _HuddleTestMedia();
+        final transport = _HuddleTestTransport(
+          peers: const {
+            1: HuddlePeer(pubkey: 'desktop', peerIndex: 1, epoch: 0),
+            2: HuddlePeer(pubkey: 'self', peerIndex: 2, epoch: 0),
+            3: HuddlePeer(pubkey: 'agent', peerIndex: 3, epoch: 0),
+          },
+        );
+        final navigator = _RecordingNavigatorObserver();
+        String? leftChannelId;
+
+        await tester.pumpWidget(
+          _buildTestable(
+            messages: [
+              _huddleMsg(
+                id: 'active-call-layout',
+                kind: EventKind.huddleStarted,
+                pubkey: 'self',
+                createdAt: now,
+              ),
+            ],
+            users: const {
+              'desktop': UserProfile(pubkey: 'desktop', displayName: 'Miles'),
+              'agent': UserProfile(pubkey: 'agent', displayName: 'Pollen'),
+              'self': UserProfile(pubkey: 'self', displayName: 'Self'),
+            },
+            huddleMembers: [
+              ChannelMember(
+                pubkey: 'agent',
+                role: 'bot',
+                joinedAt: DateTime(2025),
+              ),
+            ],
+            navigatorObservers: [navigator],
+            relayConfigNotifier: _HuddleRelayConfigNotifier(),
+            huddleCurrentPubkey: 'self',
+            huddleHumanCountLoader: (_) async => 2,
+            huddleMediaFactory: () => media,
+            huddleTransportFactory: (_) => transport,
+            createChannelActions: (ref) => _FakeChannelActions(
+              ref,
+              onLeaveChannel: (channelId) async => leftChannelId = channelId,
+            ),
+          ),
+        );
+        await tester.pumpAndSettle();
+
+        await tester.tap(find.widgetWithText(FilledButton, 'Join'));
+        await tester.pumpAndSettle();
+
+        expect(navigator.pushedRoutes.last, isA<PageRouteBuilder<void>>());
+        final route = navigator.pushedRoutes.last as PageRouteBuilder<void>;
+        expect(route.transitionDuration, const Duration(milliseconds: 280));
+        expect(find.byKey(const ValueKey('huddle-minimize')), findsOneWidget);
+        expect(find.byKey(const ValueKey('huddle-leave')), findsOneWidget);
+        expect(
+          tester.getSize(find.byKey(const ValueKey('huddle-leave'))),
+          const Size.square(64),
+        );
+        expect(
+          tester.getSize(find.byKey(const ValueKey('huddle-speaker-toggle'))),
+          const Size.square(80),
+        );
+        expect(
+          tester.getSize(find.byKey(const ValueKey('huddle-mute-toggle'))),
+          const Size.square(80),
+        );
+        expect(
+          tester.getSize(find.byKey(const ValueKey('huddle-emoji-reactions'))),
+          const Size.square(80),
+        );
+        expect(
+          (tester
+                      .widget<Padding>(
+                        find.byKey(const ValueKey('huddle-call-controls')),
+                      )
+                      .padding
+                  as EdgeInsets)
+              .bottom,
+          0,
+        );
+        final speakerCenter = tester.getCenter(
+          find.byKey(const ValueKey('huddle-speaker-toggle')),
+        );
+        final muteCenter = tester.getCenter(
+          find.byKey(const ValueKey('huddle-mute-toggle')),
+        );
+        final emojiCenter = tester.getCenter(
+          find.byKey(const ValueKey('huddle-emoji-reactions')),
+        );
+        expect(speakerCenter.dy, closeTo(muteCenter.dy, 0.01));
+        expect(emojiCenter.dy, closeTo(muteCenter.dy, 0.01));
+        expect(
+          (speakerCenter.dx + emojiCenter.dx) / 2,
+          closeTo(muteCenter.dx, 0.01),
+        );
+        expect(find.text('Miles'), findsNothing);
+        expect(find.text('Pollen'), findsNothing);
+        expect(find.text('You'), findsNothing);
+        expect(
+          find.byWidgetPredicate(
+            (widget) => widget is Semantics && widget.properties.label == 'You',
+          ),
+          findsOneWidget,
+        );
+        expect(
+          tester
+              .widget<Align>(
+                find.byKey(const ValueKey('huddle-remote-participant-group')),
+              )
+              .alignment,
+          const Alignment(0, 0.35),
+        );
+        expect(
+          tester
+              .widget<Align>(
+                find.byKey(const ValueKey('huddle-local-participant')),
+              )
+              .alignment,
+          const Alignment(0, -0.35),
+        );
+        expect(
+          tester
+              .getCenter(
+                find.byKey(const ValueKey('huddle-speaking-ring-desktop')),
+              )
+              .dy,
+          lessThan(
+            tester
+                .getCenter(
+                  find.byKey(const ValueKey('huddle-speaking-ring-self')),
+                )
+                .dy,
+          ),
+        );
+        expect(
+          tester.getSize(find.byType(CircleAvatar).first),
+          const Size.square(104),
+        );
+        expect(find.byIcon(LucideIcons.userRound), findsNWidgets(3));
+        await tester.tap(
+          find.byKey(const ValueKey('huddle-participant-avatar-desktop')),
+        );
+        await tester.pump();
+        final milesLabel = find.byKey(
+          const ValueKey('huddle-participant-label-desktop'),
+        );
+        final milesReveal = find
+            .ancestor(of: milesLabel, matching: find.byType(FadeTransition))
+            .first;
+        expect(tester.widget<FadeTransition>(milesReveal).opacity.value, 0);
+        await tester.pump(const Duration(milliseconds: 90));
+        expect(
+          tester.widget<FadeTransition>(milesReveal).opacity.value,
+          allOf(greaterThan(0), lessThan(1)),
+        );
+        expect(find.text('Miles'), findsOneWidget);
+        expect(find.text('Pollen'), findsNothing);
+        expect(find.byKey(const ValueKey('huddle-leave')), findsOneWidget);
+
+        await tester.tap(
+          find.byKey(const ValueKey('huddle-participant-avatar-agent')),
+        );
+        await tester.pump();
+        expect(find.text('Pollen'), findsOneWidget);
+
+        await tester.tap(
+          find.byKey(const ValueKey('huddle-participant-avatar-self')),
+        );
+        await tester.pumpAndSettle();
+        expect(find.text('You'), findsOneWidget);
+        final selfLabel = find.byKey(
+          const ValueKey('huddle-participant-label-self'),
+        );
+        final selfAvatar = find.byKey(
+          const ValueKey('huddle-speaking-ring-self'),
+        );
+        expect(
+          tester.getCenter(selfLabel).dx,
+          closeTo(tester.getCenter(selfAvatar).dx, 0.01),
+        );
+        expect(
+          tester.getTopLeft(selfLabel).dy,
+          greaterThanOrEqualTo(tester.getBottomLeft(selfAvatar).dy),
+        );
+        expect(find.text('Connected'), findsNothing);
+        expect(find.text('Waiting for remote audio'), findsNothing);
+        expect(find.text('Microphone muted'), findsNothing);
+
+        expect(find.byKey(const ValueKey('huddle-more')), findsNothing);
+        expect(find.byKey(const ValueKey('huddle-end')), findsNothing);
+        expect(find.text('End for everyone'), findsNothing);
+
+        transport.emitRemoteAudio();
+        await tester.pump();
+        expect(
+          find.bySemanticsLabel(RegExp(r'Miles, speaking')),
+          findsOneWidget,
+        );
+        final speakingHalo = tester.widget<Container>(
+          find.byKey(const ValueKey('huddle-speaking-halo-desktop')),
+        );
+        final speakingHaloDecoration =
+            speakingHalo.decoration! as BoxDecoration;
+        expect(speakingHaloDecoration.border, isNull);
+        expect(speakingHaloDecoration.color?.a, closeTo(0.07, 0.001));
+        await tester.pump(const Duration(milliseconds: 70));
+        final mediumScaleMidTransition = tester
+            .widget<Transform>(
+              find.byKey(const ValueKey('huddle-speaking-halo-scale-desktop')),
+            )
+            .transform
+            .storage
+            .first;
+        expect(mediumScaleMidTransition, greaterThan(1));
+        expect(mediumScaleMidTransition, lessThan(1.772));
+        await tester.pump(const Duration(milliseconds: 70));
+        final mediumSpeakingScale = tester
+            .widget<Transform>(
+              find.byKey(const ValueKey('huddle-speaking-halo-scale-desktop')),
+            )
+            .transform
+            .storage
+            .first;
+        expect(mediumSpeakingScale, closeTo(1.772, 0.01));
+
+        transport.emitRemoteAudio(levelDbov: -10, sequence: 2);
+        await tester.pump(const Duration(milliseconds: 50));
+        await tester.pump(const Duration(milliseconds: 70));
+        final loudScaleMidTransition = tester
+            .widget<Transform>(
+              find.byKey(const ValueKey('huddle-speaking-halo-scale-desktop')),
+            )
+            .transform
+            .storage
+            .first;
+        expect(loudScaleMidTransition, greaterThan(mediumSpeakingScale));
+        expect(loudScaleMidTransition, lessThan(2.291));
+        await tester.pump(const Duration(milliseconds: 70));
+        final loudSpeakingScale = tester
+            .widget<Transform>(
+              find.byKey(const ValueKey('huddle-speaking-halo-scale-desktop')),
+            )
+            .transform
+            .storage
+            .first;
+        expect(loudSpeakingScale, closeTo(2.291, 0.01));
+        expect(loudSpeakingScale, greaterThan(mediumSpeakingScale));
+        expect(loudSpeakingScale, lessThanOrEqualTo(2.55));
+
+        expect(
+          find.descendant(
+            of: find.byKey(const ValueKey('huddle-speaker-toggle')),
+            matching: find.byIcon(LucideIcons.volume2),
+          ),
+          findsOneWidget,
+        );
+        final speakerIcon = find.descendant(
+          of: find.byKey(const ValueKey('huddle-speaker-toggle')),
+          matching: find.byIcon(LucideIcons.volume2),
+        );
+        final leaveIcon = find.descendant(
+          of: find.byKey(const ValueKey('huddle-leave')),
+          matching: find.byIcon(LucideIcons.phoneOff),
+        );
+        expect(tester.widget<Icon>(speakerIcon).size, 28);
+        expect(tester.widget<Icon>(leaveIcon).size, 28);
+        final inactiveSpeakerButton = tester.widget<IconButton>(
+          find.descendant(
+            of: find.byKey(const ValueKey('huddle-speaker-toggle')),
+            matching: find.byType(IconButton),
+          ),
+        );
+        expect(
+          tester
+              .widget<Semantics>(
+                find
+                    .descendant(
+                      of: find.byKey(const ValueKey('huddle-speaker-toggle')),
+                      matching: find.byType(Semantics),
+                    )
+                    .first,
+              )
+              .properties
+              .toggled,
+          isFalse,
+        );
+        final inactiveSpeakerFill = inactiveSpeakerButton.style?.backgroundColor
+            ?.resolve(const <WidgetState>{});
+        await tester.tap(find.byKey(const ValueKey('huddle-speaker-toggle')));
+        await tester.pump();
+        expect(
+          find.descendant(
+            of: find.byKey(const ValueKey('huddle-speaker-toggle')),
+            matching: find.byIcon(LucideIcons.volume2),
+          ),
+          findsOneWidget,
+        );
+        final activeSpeakerButton = tester.widget<IconButton>(
+          find.descendant(
+            of: find.byKey(const ValueKey('huddle-speaker-toggle')),
+            matching: find.byType(IconButton),
+          ),
+        );
+        expect(
+          activeSpeakerButton.style?.backgroundColor?.resolve(
+            const <WidgetState>{},
+          ),
+          isNot(inactiveSpeakerFill),
+        );
+        expect(
+          tester
+              .widget<Semantics>(
+                find
+                    .descendant(
+                      of: find.byKey(const ValueKey('huddle-speaker-toggle')),
+                      matching: find.byType(Semantics),
+                    )
+                    .first,
+              )
+              .properties
+              .toggled,
+          isTrue,
+        );
+
+        expect(
+          find.descendant(
+            of: find.byKey(const ValueKey('huddle-mute-toggle')),
+            matching: find.byIcon(LucideIcons.mic),
+          ),
+          findsOneWidget,
+        );
+        expect(
+          tester
+              .widget<Icon>(
+                find.descendant(
+                  of: find.byKey(const ValueKey('huddle-mute-toggle')),
+                  matching: find.byIcon(LucideIcons.mic),
+                ),
+              )
+              .size,
+          28,
+        );
+        await tester.tap(find.byKey(const ValueKey('huddle-mute-toggle')));
+        await tester.pump();
+        expect(
+          find.descendant(
+            of: find.byKey(const ValueKey('huddle-mute-toggle')),
+            matching: find.byIcon(LucideIcons.micOff),
+          ),
+          findsOneWidget,
+        );
+        expect(
+          tester
+              .widget<Semantics>(
+                find
+                    .descendant(
+                      of: find.byKey(const ValueKey('huddle-mute-toggle')),
+                      matching: find.byType(Semantics),
+                    )
+                    .first,
+              )
+              .properties
+              .toggled,
+          isTrue,
+        );
+
+        final emojiIcon = find.descendant(
+          of: find.byKey(const ValueKey('huddle-emoji-reactions')),
+          matching: find.byIcon(LucideIcons.smilePlus),
+        );
+        expect(emojiIcon, findsOneWidget);
+        expect(tester.widget<Icon>(emojiIcon).size, 28);
+        expect(find.bySemanticsLabel('Emoji reactions'), findsOneWidget);
+        final huddleContainer = ProviderScope.containerOf(
+          tester.element(find.byType(MobileHuddleShell)),
+        );
+        final localBurstController = huddleContainer.read(
+          emojiBurstControllerProvider,
+        )..clear();
+        final localAvatarCenter = tester.getCenter(
+          find.byKey(const ValueKey('huddle-speaking-ring-self')),
+        );
+        await tester.tap(find.byKey(const ValueKey('huddle-emoji-reactions')));
+        await tester.pump(const Duration(milliseconds: 500));
+        expect(find.byType(EmojiPickerSheet), findsOneWidget);
+        tester
+            .widget<EmojiPickerSheet>(find.byType(EmojiPickerSheet))
+            .onSelect('🎉');
+        await tester.pump();
+        expect(localBurstController.debugLastBurstOrigin, localAvatarCenter);
+        await tester.pump(const Duration(milliseconds: 500));
+
+        await tester.tap(find.byKey(const ValueKey('huddle-minimize')));
+        await tester.pumpAndSettle();
+        expect(find.widgetWithText(FilledButton, 'Open'), findsOneWidget);
+        expect(
+          tester
+              .widget<AnimatedPositioned>(
+                find.byKey(
+                  const ValueKey('mobile-huddle-app-surface-position'),
+                ),
+              )
+              .bottom,
+          80,
+        );
+        final appSurface = tester.widget<AnimatedContainer>(
+          find.byKey(const ValueKey('mobile-huddle-app-surface')),
+        );
+        final appSurfaceDecoration = appSurface.decoration! as BoxDecoration;
+        final appSurfaceRadius =
+            appSurfaceDecoration.borderRadius! as BorderRadius;
+        expect(appSurfaceRadius.bottomLeft.x, 24);
+        expect(appSurfaceRadius.bottomRight.x, 24);
+        expect(
+          tester.getSize(find.byKey(const ValueKey('huddle-drawer-expand'))),
+          const Size.square(64),
+        );
+        expect(
+          tester.getSize(
+            find.byKey(const ValueKey('huddle-drawer-speaker-toggle')),
+          ),
+          const Size.square(64),
+        );
+        expect(
+          tester.getSize(
+            find.byKey(const ValueKey('huddle-drawer-mute-toggle')),
+          ),
+          const Size.square(64),
+        );
+        expect(
+          tester.getSize(find.byKey(const ValueKey('huddle-drawer-leave'))),
+          const Size.square(64),
+        );
+        expect(
+          find.descendant(
+            of: find.byKey(const ValueKey('huddle-drawer-expand')),
+            matching: find.byIcon(LucideIcons.chevronUp),
+          ),
+          findsOneWidget,
+        );
+        expect(
+          find.descendant(
+            of: find.byKey(const ValueKey('huddle-drawer-mute-toggle')),
+            matching: find.byIcon(LucideIcons.micOff),
+          ),
+          findsOneWidget,
+        );
+        expect(find.bySemanticsLabel('Unmute'), findsOneWidget);
+
+        await tester.tap(
+          find.byKey(const ValueKey('huddle-drawer-mute-toggle')),
+        );
+        await tester.pump();
+        expect(
+          tester
+              .widget<AnimatedPositioned>(
+                find.byKey(
+                  const ValueKey('mobile-huddle-app-surface-position'),
+                ),
+              )
+              .bottom,
+          80,
+        );
+
+        final drawerRect = tester.getRect(
+          find.byKey(const ValueKey('mobile-huddle-drawer')),
+        );
+        final drawerOffset = tester.widget<Transform>(
+          find.byKey(const ValueKey('huddle-drawer-control-offset')),
+        );
+        expect(drawerOffset.transform.storage[13], -8);
+        final primaryControlsRect = tester.getRect(
+          find.byKey(const ValueKey('huddle-drawer-primary-controls')),
+        );
+        final leaveRect = tester.getRect(
+          find.byKey(const ValueKey('huddle-drawer-leave')),
+        );
+        expect(
+          primaryControlsRect.left,
+          closeTo(drawerRect.left + Grid.gutter, 0.01),
+        );
+        expect(leaveRect.right, closeTo(drawerRect.right - Grid.gutter, 0.01));
+        final drawerControlCenter = drawerRect.center.dy;
+        for (final key in const [
+          ValueKey('huddle-drawer-expand'),
+          ValueKey('huddle-drawer-speaker-toggle'),
+          ValueKey('huddle-drawer-mute-toggle'),
+          ValueKey('huddle-drawer-leave'),
+        ]) {
+          expect(
+            tester.getCenter(find.byKey(key)).dy,
+            closeTo(drawerControlCenter - 8, 0.01),
+          );
+        }
+        await tester.tap(find.byKey(const ValueKey('huddle-drawer-expand')));
+        await tester.pumpAndSettle();
+        expect(find.byKey(const ValueKey('huddle-minimize')), findsOneWidget);
+        expect(
+          tester
+              .widget<AnimatedPositioned>(
+                find.byKey(
+                  const ValueKey('mobile-huddle-app-surface-position'),
+                ),
+              )
+              .bottom,
+          0,
+        );
+
+        await tester.tap(find.byKey(const ValueKey('huddle-minimize')));
+        await tester.pumpAndSettle();
+        await tester.tap(find.byKey(const ValueKey('huddle-drawer-leave')));
+        await tester.pump();
+        expect(
+          tester
+              .widget<AnimatedPositioned>(
+                find.byKey(
+                  const ValueKey('mobile-huddle-app-surface-position'),
+                ),
+              )
+              .bottom,
+          0,
+        );
+        for (
+          var attempt = 0;
+          attempt < 100 && leftChannelId == null;
+          attempt++
+        ) {
+          await tester.pump();
+        }
+        expect(media.state.phase, HuddleMediaPhase.stopped);
+        expect(leftChannelId, _huddleChannelId);
+      },
+    );
+
+    testWidgets(
+      'fits a dense Huddle roster without scrolling and shrinks avatars',
+      (tester) async {
+        tester.view.physicalSize = const Size(390, 844);
+        tester.view.devicePixelRatio = 1;
+        addTearDown(tester.view.resetPhysicalSize);
+        addTearDown(tester.view.resetDevicePixelRatio);
+
+        final now = DateTime.now().millisecondsSinceEpoch ~/ 1000;
+        // The relay caps a room at 25 peers, so 24 remotes plus the local
+        // participant exercises the densest supported call.
+        final remotePubkeys = List.generate(24, (index) => 'guest-$index');
+        final transport = _HuddleTestTransport(
+          peers: {
+            0: const HuddlePeer(pubkey: 'self', peerIndex: 0, epoch: 0),
+            for (var index = 0; index < remotePubkeys.length; index++)
+              index + 1: HuddlePeer(
+                pubkey: remotePubkeys[index],
+                peerIndex: index + 1,
+                epoch: 0,
+              ),
+          },
+        );
+
+        await tester.pumpWidget(
+          _buildTestable(
+            messages: [
+              _huddleMsg(
+                id: 'dense-call-layout',
+                kind: EventKind.huddleStarted,
+                pubkey: 'self',
+                createdAt: now,
+              ),
+            ],
+            users: {
+              'self': const UserProfile(pubkey: 'self', displayName: 'Self'),
+              for (final pubkey in remotePubkeys)
+                pubkey: UserProfile(pubkey: pubkey, displayName: pubkey),
+            },
+            huddleMembers: [
+              for (final pubkey in remotePubkeys)
+                ChannelMember(
+                  pubkey: pubkey,
+                  role: 'member',
+                  joinedAt: DateTime(2025),
+                ),
+            ],
+            relayConfigNotifier: _HuddleRelayConfigNotifier(),
+            huddleCurrentPubkey: 'self',
+            huddleMediaFactory: _HuddleTestMedia.new,
+            huddleTransportFactory: (_) => transport,
+          ),
+        );
+        await tester.pumpAndSettle();
+
+        await tester.tap(find.widgetWithText(FilledButton, 'Join'));
+        await tester.pumpAndSettle();
+
+        final remoteRegion = find.byKey(
+          const ValueKey('huddle-remote-participant-region'),
+        );
+        expect(
+          tester.widget<FractionallySizedBox>(remoteRegion).heightFactor,
+          0.58,
+        );
+        expect(
+          find.descendant(
+            of: remoteRegion,
+            matching: find.byType(SingleChildScrollView),
+          ),
+          findsNothing,
+        );
+        for (final pubkey in remotePubkeys) {
+          expect(
+            find.byKey(ValueKey('huddle-participant-entry-$pubkey')),
+            findsOneWidget,
+          );
+        }
+
+        final firstRemoteRing = find.byKey(
+          const ValueKey('huddle-speaking-ring-guest-0'),
+        );
+        final firstRemoteAvatar = find
+            .descendant(
+              of: firstRemoteRing,
+              matching: find.byType(CircleAvatar),
+            )
+            .first;
+        expect(tester.getSize(firstRemoteAvatar).width, lessThan(104));
+        expect(tester.takeException(), isNull);
+      },
+    );
+
+    testWidgets(
+      'bursts remote Huddle reactions and ignores the local relay echo',
+      (tester) async {
+        final now = DateTime.now().millisecondsSinceEpoch ~/ 1000;
+        final relaySession = _HuddleReactionRelaySession();
+
+        await tester.pumpWidget(
+          _buildTestable(
+            messages: [
+              _huddleMsg(
+                id: 'reaction-call',
+                kind: EventKind.huddleStarted,
+                pubkey: 'desktop',
+                createdAt: now,
+              ),
+            ],
+            users: const {
+              'desktop': UserProfile(pubkey: 'desktop', displayName: 'Miles'),
+              'self': UserProfile(pubkey: 'self', displayName: 'Self'),
+            },
+            relayConfigNotifier: _HuddleRelayConfigNotifier(),
+            relaySessionNotifier: relaySession,
+            huddleCurrentPubkey: 'self',
+            huddleMediaFactory: _HuddleTestMedia.new,
+            huddleTransportFactory: (_) => _HuddleTestTransport(),
+          ),
+        );
+        await tester.pumpAndSettle();
+
+        await tester.tap(find.widgetWithText(FilledButton, 'Join'));
+        await tester.pumpAndSettle();
+        for (
+          var attempt = 0;
+          attempt < 20 && relaySession.reactionFilter == null;
+          attempt++
+        ) {
+          await tester.pump();
+        }
+
+        expect(
+          relaySession.reactionFilter?.kinds,
+          contains(EventKind.huddleReaction),
+        );
+        expect(relaySession.reactionFilter?.tags['#h'], [_huddleChannelId]);
+        expect(relaySession.reactionFilter?.since, isNotNull);
+
+        final container = ProviderScope.containerOf(
+          tester.element(find.byType(MobileHuddleShell)),
+        );
+        final burstController = container.read(emojiBurstControllerProvider);
+        expect(burstController.hasParticles, isFalse);
+        final remoteAvatarCenter = tester.getCenter(
+          find.byKey(const ValueKey('huddle-speaking-ring-desktop')),
+        );
+
+        relaySession.emitReaction(pubkey: 'self', emoji: '🎉');
+        await tester.pump();
+        expect(burstController.hasParticles, isFalse);
+
+        relaySession.emitReaction(pubkey: 'desktop', emoji: '🎉');
+        await tester.pump();
+        expect(burstController.hasParticles, isTrue);
+        expect(burstController.debugLastBurstOrigin, remoteAvatarCenter);
+      },
+    );
+
+    testWidgets(
+      'centers a solo participant and moves them when another person joins',
+      (tester) async {
+        const guestPubkey = 'guest';
+        final now = DateTime.now().millisecondsSinceEpoch ~/ 1000;
+        final transport = _HuddleTestTransport(
+          peers: const {2: HuddlePeer(pubkey: 'self', peerIndex: 2, epoch: 0)},
+        );
+
+        await tester.pumpWidget(
+          _buildTestable(
+            messages: [
+              _huddleMsg(
+                id: 'solo-call-motion',
+                kind: EventKind.huddleStarted,
+                pubkey: 'self',
+                createdAt: now,
+              ),
+            ],
+            users: const {
+              'self': UserProfile(pubkey: 'self', displayName: 'Self'),
+              guestPubkey: UserProfile(
+                pubkey: guestPubkey,
+                displayName: 'Guest',
+              ),
+            },
+            relayConfigNotifier: _HuddleRelayConfigNotifier(),
+            relaySessionNotifier: _ReconnectingRelaySession(),
+            huddleCurrentPubkey: 'self',
+            huddleMediaFactory: _HuddleTestMedia.new,
+            huddleTransportFactory: (_) => transport,
+          ),
+        );
+        await tester.pumpAndSettle();
+        await tester.tap(find.widgetWithText(FilledButton, 'Join'));
+        await tester.pumpAndSettle();
+
+        final stage = find.byKey(const ValueKey('huddle-participant-stage'));
+        final localAvatar = find.byKey(
+          const ValueKey('huddle-speaking-ring-self'),
+        );
+        final soloCenter = tester.getCenter(localAvatar).dy;
+        expect(soloCenter, closeTo(tester.getCenter(stage).dy, 1));
+
+        transport.emitPeerJoin(
+          const HuddlePeer(pubkey: guestPubkey, peerIndex: 1, epoch: 0),
+        );
+        await tester.pump();
+        await tester.pump(const Duration(milliseconds: 130));
+        final movingCenter = tester.getCenter(localAvatar).dy;
+        expect(movingCenter, greaterThan(soloCenter));
+
+        await tester.pumpAndSettle();
+        final occupiedCenter = tester.getCenter(localAvatar).dy;
+        expect(occupiedCenter, greaterThan(movingCenter));
+        expect(
+          tester
+              .getCenter(
+                find.byKey(const ValueKey('huddle-speaking-ring-$guestPubkey')),
+              )
+              .dy,
+          lessThan(occupiedCenter),
+        );
+      },
+    );
+
+    testWidgets('does not add backing-channel members after relay admission', (
+      tester,
+    ) async {
+      const staleMemberPubkey =
+          'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa';
+      final now = DateTime.now().millisecondsSinceEpoch ~/ 1000;
+      final membersNotifier = _MutableHuddleMembersNotifier(const []);
+
+      await tester.pumpWidget(
+        _buildTestable(
+          messages: [
+            _huddleMsg(
+              id: 'authoritative-live-roster',
+              kind: EventKind.huddleStarted,
+              pubkey: 'self',
+              createdAt: now,
+            ),
+          ],
+          users: const {
+            'desktop': UserProfile(pubkey: 'desktop', displayName: 'Miles'),
+            'self': UserProfile(pubkey: 'self', displayName: 'Self'),
+            staleMemberPubkey: UserProfile(
+              pubkey: staleMemberPubkey,
+              displayName: 'Stale member',
+            ),
+          },
+          huddleMembersNotifier: membersNotifier,
+          relayConfigNotifier: _HuddleRelayConfigNotifier(),
+          relaySessionNotifier: _ReconnectingRelaySession(),
+          huddleCurrentPubkey: 'self',
+          huddleMediaFactory: _HuddleTestMedia.new,
+          huddleTransportFactory: (_) => _HuddleTestTransport(),
+        ),
+      );
+      await tester.pumpAndSettle();
+      await tester.tap(find.widgetWithText(FilledButton, 'Join'));
+      await tester.pumpAndSettle();
+
+      membersNotifier.replace([
+        ChannelMember(
+          pubkey: staleMemberPubkey,
+          role: 'member',
+          joinedAt: DateTime(2025),
+        ),
+      ]);
+      await tester.pump();
+      await tester.pump();
+
+      expect(
+        find.byKey(
+          const ValueKey('huddle-participant-avatar-$staleMemberPubkey'),
+        ),
+        findsNothing,
+      );
+      expect(
+        find.byKey(const ValueKey('huddle-participant-avatar-desktop')),
+        findsOneWidget,
+      );
+    });
+
+    testWidgets('top-right call end leaves audio and the backing channel', (
+      tester,
+    ) async {
+      final now = DateTime.now().millisecondsSinceEpoch ~/ 1000;
+      final media = _HuddleTestMedia();
+      final transport = _HuddleTestTransport();
+      String? leftChannelId;
+
+      await tester.pumpWidget(
+        _buildTestable(
+          messages: [
+            _huddleMsg(
+              id: 'active-call-leave',
+              kind: EventKind.huddleStarted,
+              pubkey: 'desktop',
+              createdAt: now,
+            ),
+          ],
+          users: const {
+            'desktop': UserProfile(pubkey: 'desktop'),
+            'self': UserProfile(pubkey: 'self'),
+          },
+          relayConfigNotifier: _HuddleRelayConfigNotifier(),
+          relaySessionNotifier: _ReconnectingRelaySession(),
+          huddleCurrentPubkey: 'self',
+          huddleHumanCountLoader: (_) async => 2,
+          huddleMediaFactory: () => media,
+          huddleTransportFactory: (_) => transport,
+          createChannelActions: (ref) => _FakeChannelActions(
+            ref,
+            onLeaveChannel: (channelId) async => leftChannelId = channelId,
+          ),
+        ),
+      );
+      await tester.pumpAndSettle();
+
+      await tester.tap(find.widgetWithText(FilledButton, 'Join'));
+      await tester.pumpAndSettle();
+      final hangup = find.byKey(const ValueKey('huddle-leave'));
+      expect(
+        tester.getCenter(hangup).dy,
+        lessThan(
+          tester.getCenter(find.byKey(const ValueKey('huddle-mute-toggle'))).dy,
+        ),
+      );
+
+      await tester.tap(hangup);
+      await tester.pump();
+      for (var attempt = 0; attempt < 100 && leftChannelId == null; attempt++) {
+        await tester.pump();
+      }
+      for (var attempt = 0; attempt < 20; attempt++) {
+        await tester.pump();
+      }
+      await tester.pump(const Duration(milliseconds: 300));
+      await tester.pump(const Duration(milliseconds: 300));
+      await tester.pump();
+
+      expect(leftChannelId, '8d764100-fd8f-44cf-9c98-6d8fbd739b8c');
+    });
+
+    testWidgets('top-right call end auto-ends for the last human', (
+      tester,
+    ) async {
+      final now = DateTime.now().millisecondsSinceEpoch ~/ 1000;
+      final media = _HuddleTestMedia();
+      final transport = _HuddleTestTransport();
+      final relaySession = _ReconnectingRelaySession();
+      String? leftChannelId;
+      String? archivedChannelId;
+
+      await tester.pumpWidget(
+        _buildTestable(
+          messages: [
+            _huddleMsg(
+              id: 'last-human-call-leave',
+              kind: EventKind.huddleStarted,
+              pubkey: 'desktop',
+              createdAt: now,
+            ),
+          ],
+          users: const {
+            'desktop': UserProfile(pubkey: 'desktop'),
+            'agent': UserProfile(pubkey: 'agent', displayName: 'Pollen'),
+            'self': UserProfile(pubkey: 'self'),
+          },
+          relayConfigNotifier: _HuddleRelayConfigNotifier(),
+          relaySessionNotifier: relaySession,
+          huddleCurrentPubkey: 'self',
+          huddleMembers: [
+            ChannelMember(
+              pubkey: 'self',
+              role: 'member',
+              joinedAt: DateTime(2025),
+            ),
+            ChannelMember(
+              pubkey: 'agent',
+              role: 'bot',
+              joinedAt: DateTime(2025),
+            ),
+          ],
+          huddleMediaFactory: () => media,
+          huddleTransportFactory: (_) => transport,
+          createChannelActions: (ref) => _FakeChannelActions(
+            ref,
+            onLeaveChannel: (channelId) async => leftChannelId = channelId,
+            onArchiveChannel: (channelId) async =>
+                archivedChannelId = channelId,
+          ),
+        ),
+      );
+      await tester.pumpAndSettle();
+
+      await tester.tap(find.widgetWithText(FilledButton, 'Join'));
+      await tester.pumpAndSettle();
+      relaySession.connect();
+      await tester.pump();
+      await tester.tap(find.byKey(const ValueKey('huddle-leave')));
+      await tester.pump();
+      for (
+        var attempt = 0;
+        attempt < 100 && archivedChannelId == null;
+        attempt++
+      ) {
+        await tester.pump();
+      }
+      for (var attempt = 0; attempt < 20; attempt++) {
+        await tester.pump();
+      }
+      await tester.pump(const Duration(milliseconds: 300));
+      await tester.pump(const Duration(milliseconds: 300));
+      await tester.pump();
+
+      expect(leftChannelId, isNull);
+      expect(archivedChannelId, '8d764100-fd8f-44cf-9c98-6d8fbd739b8c');
+      expect(relaySession.publishedKinds, contains(EventKind.huddleEnded));
+    });
+
+    testWidgets(
+      'duplicate hangup still completes the admitted lifecycle after local teardown',
+      (tester) async {
+        final now = DateTime.now().millisecondsSinceEpoch ~/ 1000;
+        final media = _HuddleTestMedia();
+        final transport = _HuddleTestTransport();
+        final humanCount = Completer<int>();
+        final relaySession = _ReconnectingRelaySession();
+        String? archivedChannelId;
+
+        await tester.pumpWidget(
+          _buildTestable(
+            messages: [
+              _huddleMsg(
+                id: 'pending-member-lookup-leave',
+                kind: EventKind.huddleStarted,
+                pubkey: 'self',
+                createdAt: now,
+              ),
+            ],
+            users: const {'self': UserProfile(pubkey: 'self')},
+            relayConfigNotifier: _HuddleRelayConfigNotifier(),
+            relaySessionNotifier: relaySession,
+            huddleCurrentPubkey: 'self',
+            huddleHumanCountLoader: (_) => humanCount.future,
+            huddleMediaFactory: () => media,
+            huddleTransportFactory: (_) => transport,
+            createChannelActions: (ref) => _FakeChannelActions(
+              ref,
+              onArchiveChannel: (channelId) async =>
+                  archivedChannelId = channelId,
+            ),
+          ),
+        );
+        await tester.pumpAndSettle();
+
+        await tester.tap(find.widgetWithText(FilledButton, 'Join'));
+        await tester.pumpAndSettle();
+        await tester.tap(find.byKey(const ValueKey('huddle-leave')));
+        final huddleContainer = ProviderScope.containerOf(
+          tester.element(find.byType(MobileHuddleShell)),
+        );
+        unawaited(
+          huddleContainer.read(mobileHuddleControllerProvider.notifier).leave(),
+        );
+        for (var attempt = 0; attempt < 20; attempt++) {
+          await tester.pump();
+        }
+        await tester.pump(const Duration(milliseconds: 300));
+
+        expect(find.byKey(const ValueKey('huddle-leave')), findsNothing);
+        expect(media.state.phase, HuddleMediaPhase.stopped);
+        expect(archivedChannelId, isNull);
+
+        humanCount.complete(1);
+        for (
+          var attempt = 0;
+          attempt < 100 && archivedChannelId == null;
+          attempt++
+        ) {
+          await tester.pump();
+        }
+
+        expect(archivedChannelId, _huddleChannelId);
+        expect(relaySession.publishedKinds, contains(EventKind.huddleEnded));
+      },
+    );
+
+    testWidgets(
+      'rejected non-creator end preserves the later leave lifecycle',
+      (tester) async {
+        final now = DateTime.now().millisecondsSinceEpoch ~/ 1000;
+        String? leftChannelId;
+
+        await tester.pumpWidget(
+          _buildTestable(
+            messages: [
+              _huddleMsg(
+                id: 'non-creator-end',
+                kind: EventKind.huddleStarted,
+                pubkey: 'desktop',
+                createdAt: now,
+              ),
+            ],
+            users: const {
+              'desktop': UserProfile(pubkey: 'desktop'),
+              'self': UserProfile(pubkey: 'self'),
+            },
+            relayConfigNotifier: _HuddleRelayConfigNotifier(),
+            relaySessionNotifier: _ReconnectingRelaySession(),
+            huddleCurrentPubkey: 'self',
+            huddleHumanCountLoader: (_) async => 2,
+            huddleMediaFactory: _HuddleTestMedia.new,
+            huddleTransportFactory: (_) => _HuddleTestTransport(),
+            createChannelActions: (ref) => _FakeChannelActions(
+              ref,
+              onLeaveChannel: (channelId) async => leftChannelId = channelId,
+            ),
+          ),
+        );
+        await tester.pumpAndSettle();
+        await tester.tap(find.widgetWithText(FilledButton, 'Join'));
+        await tester.pumpAndSettle();
+
+        final controller = ProviderScope.containerOf(
+          tester.element(find.byType(MobileHuddleShell)),
+        ).read(mobileHuddleControllerProvider.notifier);
+        await expectLater(controller.end(), throwsStateError);
+        await controller.leave();
+
+        expect(leftChannelId, _huddleChannelId);
+      },
+    );
+
+    testWidgets(
+      'community transition cancels and awaits an in-flight Huddle start',
+      (tester) async {
+        final createGate = Completer<void>();
+        final relaySession = _ReconnectingRelaySession(
+          huddleCreatePublishGate: createGate.future,
+        );
+        String? archivedChannelId;
+
+        await tester.pumpWidget(
+          _buildTestable(
+            messages: const [],
+            users: const {'self': UserProfile(pubkey: 'self')},
+            relayConfigNotifier: _HuddleRelayConfigNotifier(),
+            relaySessionNotifier: relaySession,
+            huddleCurrentPubkey: 'self',
+            huddleMediaFactory: _HuddleTestMedia.new,
+            huddleTransportFactory: (_) => _HuddleTestTransport(),
+            createChannelActions: (ref) => _FakeChannelActions(
+              ref,
+              onArchiveChannel: (channelId) async =>
+                  archivedChannelId = channelId,
+            ),
+          ),
+        );
+        await tester.pumpAndSettle();
+
+        await tester.tap(find.byKey(const ValueKey('channel-huddle-button')));
+        await relaySession.huddleCreatePublishStarted.future;
+        var transitionCompleted = false;
+        final transition =
+            ProviderScope.containerOf(
+              tester.element(find.byType(MobileHuddleShell)),
+            ).read(communityTransitionProvider).run().then((_) {
+              transitionCompleted = true;
+            });
+        await tester.pump();
+
+        expect(transitionCompleted, isFalse);
+        createGate.complete();
+        await transition;
+
+        expect(archivedChannelId, isNotNull);
+        expect(
+          relaySession.publishedKinds,
+          isNot(contains(EventKind.huddleStarted)),
+        );
+        await tester.pump(const Duration(seconds: 1));
+      },
+    );
+
+    testWidgets(
+      'community transition leaves a newer call after background cleanup',
+      (tester) async {
+        final now = DateTime.now().millisecondsSinceEpoch ~/ 1000;
+        final oldMedia = _HuddleTestMedia();
+        final currentMedia = _HuddleTestMedia();
+        final media = Queue<_HuddleTestMedia>.of([oldMedia, currentMedia]);
+        final transports = Queue<_HuddleTestTransport>.of([
+          _HuddleTestTransport(),
+          _HuddleTestTransport(),
+        ]);
+        final oldHumanCount = Completer<int>();
+        var humanCountCalls = 0;
+
+        await tester.pumpWidget(
+          _buildTestable(
+            messages: [
+              _huddleMsg(
+                id: 'background-transition-call',
+                kind: EventKind.huddleStarted,
+                pubkey: 'desktop',
+                createdAt: now,
+              ),
+            ],
+            users: const {
+              'desktop': UserProfile(pubkey: 'desktop'),
+              'self': UserProfile(pubkey: 'self'),
+            },
+            relayConfigNotifier: _HuddleRelayConfigNotifier(),
+            relaySessionNotifier: _ReconnectingRelaySession(),
+            huddleCurrentPubkey: 'self',
+            huddleHumanCountLoader: (_) {
+              humanCountCalls++;
+              return humanCountCalls == 1
+                  ? oldHumanCount.future
+                  : Future.value(2);
+            },
+            huddleMediaFactory: media.removeFirst,
+            huddleTransportFactory: (_) => transports.removeFirst(),
+          ),
+        );
+        await tester.pumpAndSettle();
+        await tester.tap(find.widgetWithText(FilledButton, 'Join'));
+        await tester.pumpAndSettle();
+
+        final container = ProviderScope.containerOf(
+          tester.element(find.byType(MobileHuddleShell)),
+        );
+        final lifecycle = container.read(appLifecycleProvider.notifier);
+        expect(lifecycle, isA<_TestAppLifecycleNotifier>());
+        (lifecycle as _TestAppLifecycleNotifier).setLifecycle(
+          AppLifecycleState.paused,
+        );
+        await oldMedia.stopStarted.future;
+        await tester.pump();
+        await container
+            .read(mobileHuddleControllerProvider.notifier)
+            .join(
+              parentChannelId: _channelId,
+              ephemeralChannelId: _huddleChannelId,
+              startedBy: 'desktop',
+              startedEventId: 'background-transition-call',
+            );
+
+        var transitionCompleted = false;
+        final transition = container
+            .read(communityTransitionProvider)
+            .run()
+            .then((_) => transitionCompleted = true);
+        await tester.pump();
+        expect(transitionCompleted, isFalse);
+
+        oldHumanCount.complete(2);
+        await transition;
+
+        expect(currentMedia.state.phase, HuddleMediaPhase.stopped);
+        expect(container.read(huddleSessionProvider).isInSession, isFalse);
+      },
+    );
+
+    testWidgets(
+      'community transition awaits failed-session lifecycle cleanup',
+      (tester) async {
+        final now = DateTime.now().millisecondsSinceEpoch ~/ 1000;
+        final media = _HuddleTestMedia();
+        final humanCount = Completer<int>();
+        String? leftChannelId;
+
+        await tester.pumpWidget(
+          _buildTestable(
+            messages: [
+              _huddleMsg(
+                id: 'failed-call-transition',
+                kind: EventKind.huddleStarted,
+                pubkey: 'desktop',
+                createdAt: now,
+              ),
+            ],
+            users: const {
+              'desktop': UserProfile(pubkey: 'desktop'),
+              'self': UserProfile(pubkey: 'self'),
+            },
+            relayConfigNotifier: _HuddleRelayConfigNotifier(),
+            relaySessionNotifier: _ReconnectingRelaySession(),
+            huddleCurrentPubkey: 'self',
+            huddleHumanCountLoader: (_) => humanCount.future,
+            huddleMediaFactory: () => media,
+            huddleTransportFactory: (_) => _HuddleTestTransport(),
+            createChannelActions: (ref) => _FakeChannelActions(
+              ref,
+              onLeaveChannel: (channelId) async => leftChannelId = channelId,
+            ),
+          ),
+        );
+        await tester.pumpAndSettle();
+        await tester.tap(find.widgetWithText(FilledButton, 'Join'));
+        await tester.pumpAndSettle();
+
+        media.emitFailure();
+        await tester.pump();
+        for (var attempt = 0; attempt < 20; attempt++) {
+          await tester.pump();
+        }
+        final container = ProviderScope.containerOf(
+          tester.element(find.byType(MobileHuddleShell)),
+        );
+        var transitionCompleted = false;
+        final transition = container
+            .read(communityTransitionProvider)
+            .run()
+            .then((_) => transitionCompleted = true);
+        await tester.pump();
+
+        expect(transitionCompleted, isFalse);
+        expect(leftChannelId, isNull);
+        humanCount.complete(2);
+        await transition;
+
+        expect(leftChannelId, _huddleChannelId);
+      },
+    );
+
+    testWidgets(
+      'background relay pause awaits failed-session lifecycle cleanup',
+      (tester) async {
+        final now = DateTime.now().millisecondsSinceEpoch ~/ 1000;
+        final media = _HuddleTestMedia();
+        final humanCount = Completer<int>();
+        final relaySession = _ReconnectingRelaySession();
+        String? leftChannelId;
+
+        await tester.pumpWidget(
+          _buildTestable(
+            messages: [
+              _huddleMsg(
+                id: 'failed-call-background',
+                kind: EventKind.huddleStarted,
+                pubkey: 'desktop',
+                createdAt: now,
+              ),
+            ],
+            users: const {
+              'desktop': UserProfile(pubkey: 'desktop'),
+              'self': UserProfile(pubkey: 'self'),
+            },
+            relayConfigNotifier: _HuddleRelayConfigNotifier(),
+            relaySessionNotifier: relaySession,
+            huddleCurrentPubkey: 'self',
+            huddleHumanCountLoader: (_) => humanCount.future,
+            huddleMediaFactory: () => media,
+            huddleTransportFactory: (_) => _HuddleTestTransport(),
+            createChannelActions: (ref) => _FakeChannelActions(
+              ref,
+              onLeaveChannel: (channelId) async => leftChannelId = channelId,
+            ),
+          ),
+        );
+        await tester.pumpAndSettle();
+        await tester.tap(find.widgetWithText(FilledButton, 'Join'));
+        await tester.pumpAndSettle();
+
+        media.emitFailure();
+        await tester.pump();
+        relaySession.onAppPaused();
+        await tester.pump(const Duration(seconds: 5));
+        await tester.pump();
+
+        expect(relaySession.state.status, SessionStatus.reconnecting);
+        expect(leftChannelId, isNull);
+
+        humanCount.complete(2);
+        for (
+          var attempt = 0;
+          attempt < 20 &&
+              relaySession.state.status != SessionStatus.disconnected;
+          attempt++
+        ) {
+          await tester.pump();
+        }
+
+        expect(leftChannelId, _huddleChannelId);
+        expect(relaySession.state.status, SessionStatus.disconnected);
+      },
+    );
+
+    testWidgets(
+      'last-human leave superseded during count by another Huddle archives the old room',
+      (tester) async {
+        final now = DateTime.now().millisecondsSinceEpoch ~/ 1000;
+        final humanCount = Completer<int>();
+        final media = Queue<_HuddleTestMedia>.of([
+          _HuddleTestMedia(),
+          _HuddleTestMedia(),
+        ]);
+        final transports = Queue<_HuddleTestTransport>.of([
+          _HuddleTestTransport(),
+          _HuddleTestTransport(),
+        ]);
+        final relaySession = _ReconnectingRelaySession();
+        String? archivedChannelId;
+
+        await tester.pumpWidget(
+          _buildTestable(
+            messages: [
+              _huddleMsg(
+                id: 'different-huddle-during-count',
+                kind: EventKind.huddleStarted,
+                pubkey: 'self',
+                createdAt: now,
+              ),
+            ],
+            users: const {'self': UserProfile(pubkey: 'self')},
+            relayConfigNotifier: _HuddleRelayConfigNotifier(),
+            relaySessionNotifier: relaySession,
+            huddleCurrentPubkey: 'self',
+            huddleHumanCountLoader: (_) => humanCount.future,
+            huddleMediaFactory: media.removeFirst,
+            huddleTransportFactory: (_) => transports.removeFirst(),
+            createChannelActions: (ref) => _FakeChannelActions(
+              ref,
+              onArchiveChannel: (channelId) async =>
+                  archivedChannelId = channelId,
+            ),
+          ),
+        );
+        await tester.pumpAndSettle();
+        await tester.tap(find.widgetWithText(FilledButton, 'Join'));
+        await tester.pumpAndSettle();
+
+        final container = ProviderScope.containerOf(
+          tester.element(find.byType(MobileHuddleShell)),
+        );
+        final controller = container.read(
+          mobileHuddleControllerProvider.notifier,
+        );
+        final staleLeave = controller.leave();
+        await tester.pump();
+        await controller.join(
+          parentChannelId: _otherChannelId,
+          ephemeralChannelId: _otherHuddleChannelId,
+          startedBy: 'self',
+          startedEventId: 'different-huddle-start',
+        );
+        humanCount.complete(1);
+        await staleLeave;
+        await tester.pump();
+
+        expect(relaySession.publishedKinds, contains(EventKind.huddleEnded));
+        expect(archivedChannelId, _huddleChannelId);
+        expect(
+          container.read(huddleSessionProvider).ephemeralChannelId,
+          _otherHuddleChannelId,
+        );
+        await tester.pumpWidget(const SizedBox.shrink());
+        await tester.pump(const Duration(milliseconds: 100));
+      },
+    );
+
+    testWidgets(
+      'last-human leave superseded during end publish by another Huddle archives the old room',
+      (tester) async {
+        final now = DateTime.now().millisecondsSinceEpoch ~/ 1000;
+        final endPublishGate = Completer<void>();
+        final media = Queue<_HuddleTestMedia>.of([
+          _HuddleTestMedia(),
+          _HuddleTestMedia(),
+        ]);
+        final transports = Queue<_HuddleTestTransport>.of([
+          _HuddleTestTransport(),
+          _HuddleTestTransport(),
+        ]);
+        final relaySession = _ReconnectingRelaySession(
+          huddleEndPublishGate: endPublishGate.future,
+        );
+        String? archivedChannelId;
+
+        await tester.pumpWidget(
+          _buildTestable(
+            messages: [
+              _huddleMsg(
+                id: 'different-huddle-during-end',
+                kind: EventKind.huddleStarted,
+                pubkey: 'self',
+                createdAt: now,
+              ),
+            ],
+            users: const {'self': UserProfile(pubkey: 'self')},
+            relayConfigNotifier: _HuddleRelayConfigNotifier(),
+            relaySessionNotifier: relaySession,
+            huddleCurrentPubkey: 'self',
+            huddleHumanCountLoader: (_) async => 1,
+            huddleMediaFactory: media.removeFirst,
+            huddleTransportFactory: (_) => transports.removeFirst(),
+            createChannelActions: (ref) => _FakeChannelActions(
+              ref,
+              onArchiveChannel: (channelId) async =>
+                  archivedChannelId = channelId,
+            ),
+          ),
+        );
+        await tester.pumpAndSettle();
+        await tester.tap(find.widgetWithText(FilledButton, 'Join'));
+        await tester.pumpAndSettle();
+
+        final container = ProviderScope.containerOf(
+          tester.element(find.byType(MobileHuddleShell)),
+        );
+        final controller = container.read(
+          mobileHuddleControllerProvider.notifier,
+        );
+        final staleLeave = controller.leave();
+        await relaySession.huddleEndPublishStarted.future;
+        await controller.join(
+          parentChannelId: _otherChannelId,
+          ephemeralChannelId: _otherHuddleChannelId,
+          startedBy: 'self',
+          startedEventId: 'different-huddle-start',
+        );
+        endPublishGate.complete();
+        await staleLeave;
+        await tester.pump();
+
+        expect(relaySession.publishedKinds, contains(EventKind.huddleEnded));
+        expect(archivedChannelId, _huddleChannelId);
+        expect(
+          container.read(huddleSessionProvider).ephemeralChannelId,
+          _otherHuddleChannelId,
+        );
+        await tester.pumpWidget(const SizedBox.shrink());
+        await tester.pump(const Duration(milliseconds: 100));
+      },
+    );
+
+    testWidgets(
+      'last-human leave superseded by same-Huddle rejoin cannot archive it',
+      (tester) async {
+        final now = DateTime.now().millisecondsSinceEpoch ~/ 1000;
+        final endPublishGate = Completer<void>();
+        final media = Queue<_HuddleTestMedia>.of([
+          _HuddleTestMedia(),
+          _HuddleTestMedia(),
+        ]);
+        final transports = Queue<_HuddleTestTransport>.of([
+          _HuddleTestTransport(),
+          _HuddleTestTransport(),
+        ]);
+        final relaySession = _ReconnectingRelaySession(
+          huddleEndPublishGate: endPublishGate.future,
+        );
+        String? archivedChannelId;
+
+        await tester.pumpWidget(
+          _buildTestable(
+            messages: [
+              _huddleMsg(
+                id: 'last-human-rejoin',
+                kind: EventKind.huddleStarted,
+                pubkey: 'self',
+                createdAt: now,
+              ),
+            ],
+            users: const {'self': UserProfile(pubkey: 'self')},
+            relayConfigNotifier: _HuddleRelayConfigNotifier(),
+            relaySessionNotifier: relaySession,
+            huddleCurrentPubkey: 'self',
+            huddleHumanCountLoader: (_) async => 1,
+            huddleMediaFactory: media.removeFirst,
+            huddleTransportFactory: (_) => transports.removeFirst(),
+            createChannelActions: (ref) => _FakeChannelActions(
+              ref,
+              onArchiveChannel: (channelId) async =>
+                  archivedChannelId = channelId,
+            ),
+          ),
+        );
+        await tester.pumpAndSettle();
+        await tester.tap(find.widgetWithText(FilledButton, 'Join'));
+        await tester.pumpAndSettle();
+
+        final container = ProviderScope.containerOf(
+          tester.element(find.byType(MobileHuddleShell)),
+        );
+        final controller = container.read(
+          mobileHuddleControllerProvider.notifier,
+        );
+        final staleLeave = controller.leave();
+        await relaySession.huddleEndPublishStarted.future;
+        final rejoin = controller.join(
+          parentChannelId: _channelId,
+          ephemeralChannelId: _huddleChannelId,
+          startedBy: 'self',
+          startedEventId: 'last-human-rejoin',
+        );
+        endPublishGate.complete();
+        await staleLeave;
+        await rejoin;
+        await tester.pump();
+
+        expect(relaySession.publishedKinds, contains(EventKind.huddleEnded));
+        expect(archivedChannelId, isNull);
+        expect(container.read(huddleSessionProvider).isConnected, isTrue);
+        await tester.pumpWidget(const SizedBox.shrink());
+        await tester.pump(const Duration(milliseconds: 100));
+      },
+    );
+
+    testWidgets(
+      'creator end publish superseded by rejoin cannot archive new admission',
+      (tester) async {
+        final now = DateTime.now().millisecondsSinceEpoch ~/ 1000;
+        final endPublishGate = Completer<void>();
+        final media = Queue<_HuddleTestMedia>.of([
+          _HuddleTestMedia(),
+          _HuddleTestMedia(),
+        ]);
+        final transports = Queue<_HuddleTestTransport>.of([
+          _HuddleTestTransport(),
+          _HuddleTestTransport(),
+        ]);
+        final relaySession = _ReconnectingRelaySession(
+          huddleEndPublishGate: endPublishGate.future,
+        );
+        String? archivedChannelId;
+
+        await tester.pumpWidget(
+          _buildTestable(
+            messages: [
+              _huddleMsg(
+                id: 'stale-creator-end',
+                kind: EventKind.huddleStarted,
+                pubkey: 'self',
+                createdAt: now,
+              ),
+            ],
+            users: const {'self': UserProfile(pubkey: 'self')},
+            relayConfigNotifier: _HuddleRelayConfigNotifier(),
+            relaySessionNotifier: relaySession,
+            huddleCurrentPubkey: 'self',
+            huddleMediaFactory: media.removeFirst,
+            huddleTransportFactory: (_) => transports.removeFirst(),
+            createChannelActions: (ref) => _FakeChannelActions(
+              ref,
+              onArchiveChannel: (channelId) async =>
+                  archivedChannelId = channelId,
+            ),
+          ),
+        );
+        await tester.pumpAndSettle();
+        await tester.tap(find.widgetWithText(FilledButton, 'Join'));
+        await tester.pumpAndSettle();
+
+        final container = ProviderScope.containerOf(
+          tester.element(find.byType(MobileHuddleShell)),
+        );
+        final controller = container.read(
+          mobileHuddleControllerProvider.notifier,
+        );
+        final staleEnd = controller.end();
+        await relaySession.huddleEndPublishStarted.future;
+        final rejoin = controller.join(
+          parentChannelId: _channelId,
+          ephemeralChannelId: _huddleChannelId,
+          startedBy: 'self',
+          startedEventId: 'stale-creator-end',
+        );
+        endPublishGate.complete();
+        await staleEnd;
+        await rejoin;
+        await tester.pump();
+
+        expect(relaySession.publishedKinds, contains(EventKind.huddleEnded));
+        expect(archivedChannelId, isNull);
+        await tester.pumpWidget(const SizedBox.shrink());
+        await tester.pump(const Duration(milliseconds: 100));
+      },
+    );
+
+    testWidgets('disables Join after the matching huddle end event', (
+      tester,
+    ) async {
+      final now = DateTime.now().millisecondsSinceEpoch ~/ 1000;
+      await tester.pumpWidget(
+        _buildTestable(
+          messages: [
+            _huddleMsg(
+              id: 'ended-huddle-start',
+              kind: EventKind.huddleStarted,
+              createdAt: now,
+            ),
+            _huddleMsg(
+              id: 'ended-huddle-end',
+              kind: EventKind.huddleEnded,
+              createdAt: now + 1,
+            ),
+          ],
+          users: {
+            'alice': const UserProfile(pubkey: 'alice', displayName: 'Alice'),
+          },
+        ),
+      );
+      await tester.pumpAndSettle();
+
+      expect(find.text('Huddle ended'), findsOneWidget);
+      final ended = tester.widget<FilledButton>(
+        find.widgetWithText(FilledButton, 'Ended'),
+      );
+      expect(ended.onPressed, isNull);
+    });
+
+    for (final huddleEvent in [
+      (kind: EventKind.huddleStarted, action: 'started a huddle'),
+      (kind: EventKind.huddleEnded, action: 'ended the huddle'),
+    ]) {
+      testWidgets(
+        '${huddleEvent.action} aligns its author and body with a regular message',
+        (tester) async {
+          await tester.pumpWidget(
+            _buildTestable(
+              messages: [
+                _textMsg(
+                  id: 'regular-message',
+                  pubkey: 'alice',
+                  content: 'Regular message',
+                  createdAt: 1000,
+                ),
+                _huddleMsg(
+                  id: 'huddle-message',
+                  kind: huddleEvent.kind,
+                  pubkey: 'bob',
+                  createdAt: 1010,
+                ),
+              ],
+              users: {
+                'alice': const UserProfile(
+                  pubkey: 'alice',
+                  displayName: 'Alice',
+                ),
+                'bob': const UserProfile(pubkey: 'bob', displayName: 'Bob'),
+              },
+            ),
+          );
+          await tester.pumpAndSettle();
+
+          final regularRow = find.byKey(
+            const ValueKey('message-row-regular-message'),
+          );
+          final huddleRow = find.byKey(
+            const ValueKey('system-message-row-huddle-message'),
+          );
+          final regularAvatar = tester.getRect(
+            find
+                .descendant(of: regularRow, matching: find.byType(CircleAvatar))
+                .first,
+          );
+          final huddleAvatar = tester.getRect(
+            find
+                .descendant(of: huddleRow, matching: find.byType(CircleAvatar))
+                .first,
+          );
+          final regularAuthor = tester.getRect(
+            find.byKey(const ValueKey('message-author-regular-message')),
+          );
+          final huddleAuthor = tester.getRect(
+            find.byKey(const ValueKey('system-message-author-bob')),
+          );
+          final regularBody = tester.getRect(findRichText('Regular message'));
+          final huddleBody = tester.getRect(findRichText(huddleEvent.action));
+
+          expect(
+            huddleAuthor.top - huddleAvatar.top,
+            closeTo(regularAuthor.top - regularAvatar.top, 0.01),
+          );
+          expect(
+            huddleBody.top - huddleAuthor.bottom,
+            closeTo(regularBody.top - regularAuthor.bottom, 0.01),
+          );
+        },
+      );
+    }
+
+    testWidgets(
+      'keeps membership and huddle rows evenly spaced with authored messages',
+      (tester) async {
+        await tester.pumpWidget(
+          _buildTestable(
+            messages: [
+              _textMsg(
+                id: 'message-alice',
+                pubkey: 'alice',
+                content: 'First message',
+                createdAt: 1000,
+              ),
+              _textMsg(
+                id: 'message-bob',
+                pubkey: 'bob',
+                content: 'Second message',
+                createdAt: 1010,
+              ),
+              _systemMsg(
+                id: 'membership-carol',
+                payload: {
+                  'type': 'member_joined',
+                  'actor': 'alice',
+                  'target': 'carol',
+                },
+                createdAt: 1020,
+              ),
+              _huddleMsg(
+                id: 'huddle-dave',
+                kind: EventKind.huddleEnded,
+                pubkey: 'dave',
+                createdAt: 1030,
+              ),
+              _textMsg(
+                id: 'message-erin',
+                pubkey: 'erin',
+                content: 'Third message',
+                createdAt: 1040,
+              ),
+            ],
+            users: {
+              for (final name in ['alice', 'bob', 'carol', 'dave', 'erin'])
+                name: UserProfile(pubkey: name, displayName: name),
+            },
+          ),
+        );
+        await tester.pumpAndSettle();
+
+        Rect avatarRect(String rowKey) => tester.getRect(
+          find
+              .descendant(
+                of: find.byKey(ValueKey(rowKey)),
+                matching: find.byType(CircleAvatar),
+              )
+              .first,
+        );
+
+        final avatars = [
+          avatarRect('message-row-message-alice'),
+          avatarRect('message-row-message-bob'),
+          avatarRect('system-message-row-membership-carol'),
+          avatarRect('system-message-row-huddle-dave'),
+          avatarRect('message-row-message-erin'),
+        ];
+        final authoredMessageGap = avatars[1].top - avatars[0].bottom;
+
+        for (var index = 2; index < avatars.length; index++) {
+          expect(
+            avatars[index].top - avatars[index - 1].bottom,
+            closeTo(authoredMessageGap, 1),
+            reason: 'row $index should use the authored-message gap',
+          );
+        }
+      },
+    );
+
+    testWidgets('renders member_joined (self-join) system event', (
+      tester,
+    ) async {
+      final messages = [
+        _systemMsg(
+          id: 'sys1',
+          payload: {'type': 'member_joined', 'actor': 'bob', 'target': 'bob'},
+        ),
+      ];
+
+      await tester.pumpWidget(
+        _buildTestable(
+          messages: messages,
+          users: {'bob': const UserProfile(pubkey: 'bob', displayName: 'Bob')},
+        ),
+      );
+      await tester.pumpAndSettle();
+
+      expect(find.text('Bob'), findsOneWidget);
+      expect(findRichText('joined the channel'), findsOneWidget);
+      expect(
+        tester.getSize(find.byType(CircleAvatar)),
+        const Size.square(messageAvatarSize),
+      );
+    });
+
+    testWidgets('opens a profile sheet from a membership system avatar', (
+      tester,
+    ) async {
+      await tester.pumpWidget(
+        _buildTestable(
+          messages: [
+            _systemMsg(
+              id: 'sys-membership-avatar',
+              payload: {
+                'type': 'member_joined',
+                'actor': 'alice',
                 'target': 'bob',
               },
             ),
@@ -5182,19 +7416,332 @@ void main() {
       await tester.tap(find.text('Message #general'));
       await tester.pumpAndSettle();
 
-      expect(find.byType(TextField), findsOneWidget);
-      expect(find.byIcon(LucideIcons.arrowUp).hitTestable(), findsOneWidget);
-    });
+      expect(find.byType(TextField), findsOneWidget);
+      expect(find.byIcon(LucideIcons.arrowUp).hitTestable(), findsOneWidget);
+    });
+
+    testWidgets('shows hint text', (tester) async {
+      await tester.pumpWidget(_buildTestable(messages: []));
+      await tester.pumpAndSettle();
+
+      expect(find.text('Message #general'), findsOneWidget);
+    });
+  });
+
+  group('App bar', () {
+    testWidgets('aligns the Channel Details iOS back control with channels', (
+      tester,
+    ) async {
+      debugDefaultTargetPlatformOverride = TargetPlatform.iOS;
+      addTearDown(() => debugDefaultTargetPlatformOverride = null);
+
+      await tester.pumpWidget(
+        _buildTestable(
+          messages: const [],
+          home: Builder(
+            builder: (context) => Scaffold(
+              body: TextButton(
+                onPressed: () => Navigator.of(context).push(
+                  MaterialPageRoute<void>(
+                    builder: (_) => ChannelDetailPage(channel: _testChannel),
+                  ),
+                ),
+                child: const Text('Open channel'),
+              ),
+            ),
+          ),
+        ),
+      );
+      await tester.pumpAndSettle();
+
+      await tester.tap(find.text('Open channel'));
+      await tester.pumpAndSettle();
+
+      final channelBack = find.byKey(const ValueKey('channel-ios-glass-back'));
+      final channelNativeView = tester.widget<UiKitView>(
+        find.descendant(of: channelBack, matching: find.byType(UiKitView)),
+      );
+      final channelParams =
+          channelNativeView.creationParams as Map<String, Object>;
+      final channelButtonCenter =
+          tester.getTopLeft(channelBack).dx +
+          (channelParams['buttonCenterX']! as double);
+
+      await tester.tap(
+        find.byKey(const ValueKey('channel-header-settings-trigger')),
+      );
+      await tester.pumpAndSettle();
+
+      final detailsBack = find.byKey(
+        const ValueKey('channel-details-ios-glass-back'),
+      );
+      final detailsNativeView = tester.widget<UiKitView>(
+        find.descendant(of: detailsBack, matching: find.byType(UiKitView)),
+      );
+      final detailsParams =
+          detailsNativeView.creationParams as Map<String, Object>;
+      final detailsButtonCenter =
+          tester.getTopLeft(detailsBack).dx +
+          (detailsParams['buttonCenterX']! as double);
+      debugDefaultTargetPlatformOverride = null;
+
+      expect(detailsBack, findsOneWidget);
+      expect(
+        detailsParams['buttonCenterX'],
+        iosGlassChannelHeaderButtonCenterX,
+      );
+      expect(
+        detailsParams['hitTargetWidth'],
+        iosGlassChannelHeaderLeadingWidth,
+      );
+      expect(detailsButtonCenter, moreOrLessEquals(channelButtonCenter));
+      expect(
+        tester.getRect(detailsBack).width,
+        iosGlassChannelHeaderLeadingWidth,
+      );
+      expect(tester.takeException(), isNull);
+    });
+
+    testWidgets('matches the channel header placement on iOS', (tester) async {
+      debugDefaultTargetPlatformOverride = TargetPlatform.iOS;
+      addTearDown(() => debugDefaultTargetPlatformOverride = null);
+      const nativeChannel = MethodChannel('buzz/navigation_glass/43');
+      tester.binding.defaultBinaryMessenger.setMockMethodCallHandler(
+        nativeChannel,
+        (_) async => null,
+      );
+      addTearDown(
+        () => tester.binding.defaultBinaryMessenger.setMockMethodCallHandler(
+          nativeChannel,
+          null,
+        ),
+      );
+
+      final root = _textMsg(
+        id: 'thread-header-root',
+        pubkey: 'alice',
+        content: 'Thread root',
+      );
+      final timelineMessages = formatTimeline([root]);
+
+      await tester.pumpWidget(
+        _buildTestable(
+          messages: [root],
+          textScaler: const TextScaler.linear(2),
+          home: Builder(
+            builder: (context) => Scaffold(
+              body: TextButton(
+                onPressed: () => Navigator.of(context).push(
+                  MaterialPageRoute<void>(
+                    builder: (_) => ThreadDetailPage(
+                      threadHead: timelineMessages.single,
+                      allMessages: timelineMessages,
+                      channelId: _testChannel.id,
+                      currentPubkey: null,
+                      isMember: true,
+                      isArchived: false,
+                    ),
+                  ),
+                ),
+                child: const Text('Open thread'),
+              ),
+            ),
+          ),
+        ),
+      );
+      await tester.pumpAndSettle();
+
+      await tester.tap(find.text('Open thread'));
+      await tester.pumpAndSettle();
+
+      final backFinder = find.byKey(const ValueKey('thread-ios-glass-back'));
+      final nativeView = tester.widget<UiKitView>(
+        find.descendant(of: backFinder, matching: find.byType(UiKitView)),
+      );
+      expect(nativeView.viewType, IosGlassNavigationButton.viewType);
+      expect(
+        (nativeView.creationParams as Map<String, Object>)['buttonCenterX'],
+        iosGlassChannelHeaderButtonCenterX,
+      );
+      expect(
+        (nativeView.creationParams as Map<String, Object>)['hitTargetWidth'],
+        iosGlassChannelHeaderLeadingWidth,
+      );
+      expect(
+        (nativeView.creationParams as Map<String, Object>)['hitTargetHeight'],
+        48.0,
+      );
+
+      final backRect = tester.getRect(backFinder);
+      final titleRect = tester.getRect(
+        find.byKey(const ValueKey('thread-app-bar-title')),
+      );
+      expect(backRect.width, iosGlassChannelHeaderLeadingWidth);
+      expect(
+        titleRect.left - backRect.right,
+        moreOrLessEquals(iosGlassChannelHeaderTitleSpacing),
+      );
+      expect(tester.takeException(), isNull);
+
+      nativeView.onPlatformViewCreated!(43);
+      await tester.pump();
+      await tester.binding.defaultBinaryMessenger.handlePlatformMessage(
+        nativeChannel.name,
+        nativeChannel.codec.encodeMethodCall(const MethodCall('pressed')),
+        (_) {},
+      );
+      await tester.pumpAndSettle();
+
+      expect(find.byType(ThreadDetailPage), findsNothing);
+      expect(find.text('Open thread'), findsOneWidget);
+      debugDefaultTargetPlatformOverride = null;
+    });
+
+    testWidgets(
+      'keeps the native iOS glass header aligned at large text sizes',
+      (tester) async {
+        debugDefaultTargetPlatformOverride = TargetPlatform.iOS;
+        addTearDown(() => debugDefaultTargetPlatformOverride = null);
+
+        final message = _textMsg(
+          id: 'avatar-alignment',
+          pubkey: 'alice',
+          content: 'Hello',
+          createdAt: 1000,
+        );
+
+        await tester.pumpWidget(
+          _buildTestable(
+            messages: [message],
+            textScaler: const TextScaler.linear(2),
+            users: const {
+              'alice': UserProfile(pubkey: 'alice', displayName: 'Alice'),
+            },
+            home: Builder(
+              builder: (context) => Scaffold(
+                body: TextButton(
+                  onPressed: () => Navigator.of(context).push(
+                    MaterialPageRoute<void>(
+                      builder: (_) => ChannelDetailPage(channel: _testChannel),
+                    ),
+                  ),
+                  child: const Text('Open channel'),
+                ),
+              ),
+            ),
+          ),
+        );
+        await tester.pumpAndSettle();
+
+        await tester.tap(find.text('Open channel'));
+        await tester.pumpAndSettle();
+
+        final nativeViewFinder = find.descendant(
+          of: find.byKey(const ValueKey('channel-ios-glass-back')),
+          matching: find.byType(UiKitView),
+        );
+        final nativeView = tester.widget<UiKitView>(nativeViewFinder);
+        expect(nativeView.viewType, 'buzz/navigation_glass');
+        expect(
+          (nativeView.creationParams as Map<String, Object>)['icon'],
+          'back',
+        );
+        expect(
+          (nativeView.creationParams as Map<String, Object>)['brightness'],
+          'light',
+        );
+        expect(
+          (nativeView.creationParams as Map<String, Object>)['buttonCenterX'],
+          38.0,
+        );
+        final backButtonRect = tester.getRect(
+          find.byKey(const ValueKey('channel-ios-glass-back')),
+        );
+        expect(backButtonRect.width, 58);
+        final channelIconRect = tester.getRect(
+          find.byKey(const ValueKey('channel-header-avatar')),
+        );
+        expect(
+          channelIconRect.left - backButtonRect.right,
+          moreOrLessEquals(Grid.xs),
+        );
+        expect(
+          backButtonRect.center.dy,
+          moreOrLessEquals(channelIconRect.center.dy),
+        );
+        expect(tester.takeException(), isNull);
+        debugDefaultTargetPlatformOverride = null;
+      },
+    );
+
+    for (final platform in [TargetPlatform.android, TargetPlatform.iOS]) {
+      testWidgets(
+        'keeps a narrow long channel title aligned on ${platform.name}',
+        (tester) async {
+          final previousPlatform = debugDefaultTargetPlatformOverride;
+          debugDefaultTargetPlatformOverride = platform;
+          addTearDown(
+            () => debugDefaultTargetPlatformOverride = previousPlatform,
+          );
+          tester.view.physicalSize = const Size(320, 700);
+          tester.view.devicePixelRatio = 1;
+          addTearDown(tester.view.reset);
+          final channel = _testChannel.copyWith(
+            name: 'a-very-long-channel-name-that-must-truncate',
+          );
+
+          await tester.pumpWidget(
+            _buildTestable(
+              messages: const [],
+              channel: channel,
+              home: Builder(
+                builder: (context) => Scaffold(
+                  body: TextButton(
+                    onPressed: () => Navigator.of(context).push(
+                      MaterialPageRoute<void>(
+                        builder: (_) => ChannelDetailPage(channel: channel),
+                      ),
+                    ),
+                    child: const Text('Open channel'),
+                  ),
+                ),
+              ),
+            ),
+          );
+          await tester.pumpAndSettle();
+
+          await tester.tap(find.text('Open channel'));
+          await tester.pumpAndSettle();
 
-    testWidgets('shows hint text', (tester) async {
-      await tester.pumpWidget(_buildTestable(messages: []));
-      await tester.pumpAndSettle();
+          final backRect = platform == TargetPlatform.iOS
+              ? tester.getRect(
+                  find.byKey(const ValueKey('channel-ios-glass-back')),
+                )
+              : tester.getRect(find.byTooltip('Back'));
+          final avatarRect = tester.getRect(
+            find.byKey(const ValueKey('channel-header-avatar')),
+          );
+          final titleSpacing = avatarRect.left - backRect.right;
+          final title = tester.renderObject<RenderParagraph>(
+            find.byKey(const ValueKey('channel-header-name')),
+          );
+          final titleDidExceedMaxLines = title.didExceedMaxLines;
+          debugDefaultTargetPlatformOverride = previousPlatform;
 
-      expect(find.text('Message #general'), findsOneWidget);
-    });
-  });
+          expect(
+            titleSpacing,
+            moreOrLessEquals(
+              platform == TargetPlatform.iOS
+                  ? iosGlassChannelHeaderTitleSpacing
+                  : 0,
+            ),
+          );
+          expect(titleDidExceedMaxLines, isTrue);
+          expect(tester.takeException(), isNull);
+        },
+      );
+    }
 
-  group('App bar', () {
     testWidgets('shows a tappable channel name and collective member count', (
       tester,
     ) async {
@@ -5221,12 +7768,66 @@ void main() {
         tester.getSize(find.byKey(const ValueKey('channel-header-avatar'))),
         const Size.square(40),
       );
+      final channelHeaderAvatarRect = tester.getRect(
+        find.byKey(const ValueKey('channel-header-avatar')),
+      );
+      final channelHeaderTextStackRect = tester.getRect(
+        find.byKey(const ValueKey('channel-header-text-stack')),
+      );
+      expect(channelHeaderTextStackRect.height, 40);
+      expect(
+        channelHeaderTextStackRect.center.dy,
+        moreOrLessEquals(channelHeaderAvatarRect.center.dy),
+      );
       expect(
         tester
             .widget<Text>(find.byKey(const ValueKey('channel-header-name')))
             .style
             ?.fontSize,
-        AppTheme.light().textTheme.titleMedium?.fontSize,
+        AppTheme.light().textTheme.titleSmall?.fontSize,
+      );
+      expect(
+        tester
+            .widget<Text>(find.byKey(const ValueKey('channel-header-name')))
+            .style
+            ?.fontWeight,
+        FontWeight.w600,
+      );
+      final channelHeaderAvatar = tester.widget<Container>(
+        find.byKey(const ValueKey('channel-header-avatar')),
+      );
+      expect(
+        (channelHeaderAvatar.decoration as BoxDecoration).color,
+        AppTheme.light().colorScheme.surface,
+      );
+      final channelHeaderAvatarBorder =
+          (channelHeaderAvatar.decoration as BoxDecoration).border! as Border;
+      expect(
+        channelHeaderAvatarBorder.top.color,
+        AppTheme.light().colorScheme.inverseSurface.withValues(alpha: 0.07),
+      );
+      expect(channelHeaderAvatarBorder.top.width, 1);
+      expect(
+        channelHeaderAvatarBorder.top.strokeAlign,
+        BorderSide.strokeAlignOutside,
+      );
+      expect(
+        tester
+            .widget<Icon>(
+              find.descendant(
+                of: find.byKey(const ValueKey('channel-header-avatar')),
+                matching: find.byIcon(LucideIcons.hash),
+              ),
+            )
+            .color,
+        AppTheme.light().colorScheme.primary,
+      );
+      expect(
+        tester.getRect(find.byKey(const ValueKey('channel-header-name'))).left -
+            tester
+                .getRect(find.byKey(const ValueKey('channel-header-avatar')))
+                .right,
+        moreOrLessEquals(Grid.twelve),
       );
       expect(
         tester
@@ -5237,6 +7838,15 @@ void main() {
             ?.fontSize,
         AppTheme.light().textTheme.bodySmall?.fontSize,
       );
+      expect(
+        tester
+            .widget<Text>(
+              find.byKey(const ValueKey('channel-header-member-count')),
+            )
+            .style
+            ?.color,
+        AppTheme.light().colorScheme.onSurface.withValues(alpha: 0.65),
+      );
       expect(find.byTooltip('View members'), findsNothing);
       expect(find.byTooltip('Channel actions'), findsNothing);
 
@@ -5261,8 +7871,8 @@ void main() {
       expect(find.text('General discussion'), findsOneWidget);
       expect(find.text('5 members'), findsOneWidget);
       expect(find.text('Preferences'), findsNothing);
-      expect(find.text('Star channel'), findsOneWidget);
-      expect(find.text('Mute channel'), findsOneWidget);
+      expect(find.text('Star'), findsOneWidget);
+      expect(find.text('Mute'), findsOneWidget);
       expect(find.text('Edit'), findsOneWidget);
       expect(find.text('Actions'), findsNothing);
       expect(find.byTooltip('Back'), findsOneWidget);
@@ -8690,6 +11300,20 @@ void main() {
       expect(find.byKey(const ValueKey('thread-jump-to-latest')), findsNothing);
     });
 
+    test(
+      'thread tail accepts exact scroll extent while item positions lag',
+      () {
+        expect(
+          threadTailCorrectionReachedEnd(tailIsVisible: false, extentAfter: 0),
+          isTrue,
+        );
+        expect(
+          threadTailCorrectionReachedEnd(tailIsVisible: false, extentAfter: 1),
+          isFalse,
+        );
+      },
+    );
+
     testWidgets('thread Latest settles across expanding lazy scroll extents', (
       tester,
     ) async {
@@ -8892,6 +11516,14 @@ void main() {
         await tester.tap(find.byKey(const ValueKey('thread-jump-to-latest')));
         await tester.pump();
 
+        expect(
+          find.byKey(const ValueKey('thread-jump-to-latest-hidden')),
+          findsOneWidget,
+          reason:
+              'Latest should leave immediately once its navigation starts, '
+              'rather than lingering over the thread at the tail.',
+        );
+
         expect(
           find.descendant(of: list, matching: find.byType(Scrollable)),
           findsOneWidget,
@@ -9347,6 +11979,13 @@ class _ErrorMessagesNotifier extends ChannelMessagesNotifier {
       AsyncError('Connection failed', StackTrace.current);
 }
 
+class _TestAppLifecycleNotifier extends AppLifecycleNotifier {
+  @override
+  AppLifecycleState build() => AppLifecycleState.resumed;
+
+  void setLifecycle(AppLifecycleState value) => state = value;
+}
+
 class _TrackingRelaySession extends RelaySessionNotifier {
   final visibleChannels = <String>[];
 
@@ -9369,6 +12008,17 @@ class _TrackingRelaySession extends RelaySessionNotifier {
 }
 
 class _ReconnectingRelaySession extends RelaySessionNotifier {
+  _ReconnectingRelaySession({
+    this.huddleCreatePublishGate,
+    this.huddleEndPublishGate,
+  });
+
+  final Future<void>? huddleCreatePublishGate;
+  final Future<void>? huddleEndPublishGate;
+  final huddleCreatePublishStarted = Completer<void>();
+  final huddleEndPublishStarted = Completer<void>();
+  final List<int> publishedKinds = [];
+
   @override
   SessionState build() =>
       const SessionState(status: SessionStatus.reconnecting);
@@ -9379,11 +12029,93 @@ class _ReconnectingRelaySession extends RelaySessionNotifier {
     Duration timeout = const Duration(seconds: 8),
   }) async => [];
 
+  @override
+  Future<NostrEvent> publish(
+    NostrEvent event, {
+    Duration timeout = const Duration(seconds: 8),
+  }) async {
+    publishedKinds.add(event.kind);
+    if (event.kind == 9007) {
+      if (huddleCreatePublishGate case final gate?) {
+        if (!huddleCreatePublishStarted.isCompleted) {
+          huddleCreatePublishStarted.complete();
+        }
+        await gate;
+      }
+    }
+    if (event.kind == EventKind.huddleEnded) {
+      if (huddleEndPublishGate case final gate?) {
+        if (!huddleEndPublishStarted.isCompleted) {
+          huddleEndPublishStarted.complete();
+        }
+        await gate;
+      }
+    }
+    return event;
+  }
+
   void connect() {
     state = const SessionState(status: SessionStatus.connected);
   }
 }
 
+class _HuddleReactionRelaySession extends RelaySessionNotifier {
+  NostrFilter? reactionFilter;
+  void Function(NostrEvent)? _reactionListener;
+  var _nextEventId = 0;
+
+  @override
+  SessionState build() => const SessionState(status: SessionStatus.connected);
+
+  @override
+  Future<List<NostrEvent>> fetchHistory(
+    NostrFilter filter, {
+    Duration timeout = const Duration(seconds: 8),
+  }) async => const [];
+
+  @override
+  Future<NostrEvent> publish(
+    NostrEvent event, {
+    Duration timeout = const Duration(seconds: 8),
+  }) async => event;
+
+  @override
+  Future<void Function()> subscribe(
+    NostrFilter filter,
+    void Function(NostrEvent) onEvent, {
+    void Function(String message)? onClosed,
+  }) async {
+    if (filter.kinds.contains(EventKind.huddleReaction)) {
+      reactionFilter = filter;
+      _reactionListener = onEvent;
+      return () {
+        if (identical(_reactionListener, onEvent)) {
+          _reactionListener = null;
+        }
+      };
+    }
+    return () {};
+  }
+
+  void emitReaction({required String pubkey, required String emoji}) {
+    _reactionListener?.call(
+      NostrEvent(
+        id: 'huddle-reaction-${_nextEventId++}',
+        pubkey: pubkey,
+        createdAt: DateTime.now().millisecondsSinceEpoch ~/ 1000,
+        kind: EventKind.huddleReaction,
+        tags: [
+          ['h', _huddleChannelId],
+          ['reaction', emoji],
+          ['sender_name', 'Remote'],
+        ],
+        content: emoji,
+        sig: 'sig',
+      ),
+    );
+  }
+}
+
 class _FakeTypingNotifier extends ChannelTypingNotifier {
   final List<TypingEntry> _entries;
   _FakeTypingNotifier(this._entries, {String channelId = _channelId})
@@ -9421,6 +12153,54 @@ class _FakeProfileNotifier extends ProfileNotifier {
       const UserProfile(pubkey: 'self', displayName: 'Self');
 }
 
+class _FakeChannelStarsNotifier extends ChannelStarsNotifier {
+  @override
+  ChannelStarsState build() => const ChannelStarsState(isReady: true);
+
+  @override
+  void starChannel(String channelId) => _setStarred(channelId, true);
+
+  @override
+  void unstarChannel(String channelId) => _setStarred(channelId, false);
+
+  void _setStarred(String channelId, bool starred) {
+    state = ChannelStarsState(
+      isReady: true,
+      store: ChannelStarStore(
+        channels: {
+          ...state.store.channels,
+          channelId: ChannelStarEntry(starred: starred, updatedAt: 1),
+        },
+      ),
+      version: state.version + 1,
+    );
+  }
+}
+
+class _FakeChannelMutesNotifier extends ChannelMutesNotifier {
+  @override
+  ChannelMutesState build() => const ChannelMutesState(isReady: true);
+
+  @override
+  void muteChannel(String channelId) => _setMuted(channelId, true);
+
+  @override
+  void unmuteChannel(String channelId) => _setMuted(channelId, false);
+
+  void _setMuted(String channelId, bool muted) {
+    state = ChannelMutesState(
+      isReady: true,
+      store: ChannelMuteStore(
+        channels: {
+          ...state.store.channels,
+          channelId: ChannelMuteEntry(muted: muted, updatedAt: 1),
+        },
+      ),
+      version: state.version + 1,
+    );
+  }
+}
+
 class _FakeUserCacheNotifier extends UserCacheNotifier {
   final Map<String, UserProfile> _users;
   _FakeUserCacheNotifier(this._users);
@@ -9436,6 +12216,17 @@ class _FakeUserCacheNotifier extends UserCacheNotifier {
   }
 }
 
+class _MutableHuddleMembersNotifier extends Notifier<List<ChannelMember>> {
+  _MutableHuddleMembersNotifier(this._initialMembers);
+
+  final List<ChannelMember> _initialMembers;
+
+  @override
+  List<ChannelMember> build() => _initialMembers;
+
+  void replace(List<ChannelMember> members) => state = members;
+}
+
 class _FakeChannelsNotifier extends ChannelsNotifier {
   List<Channel> _channels;
   final Map<String, Map<String, ObservedUnreadEvent>> _observedUnread;
@@ -9463,6 +12254,8 @@ class _FakeChannelsNotifier extends ChannelsNotifier {
 
 class _FakeChannelActions extends ChannelActions {
   final Future<void> Function(String channelId)? onJoinChannel;
+  final Future<void> Function(String channelId)? onLeaveChannel;
+  final Future<void> Function(String channelId)? onArchiveChannel;
   final Future<void> Function(String channelId, List<String> pubkeys)?
   onAddMembers;
   final Future<void> Function(
@@ -9475,6 +12268,8 @@ class _FakeChannelActions extends ChannelActions {
   _FakeChannelActions(
     Ref ref, {
     this.onJoinChannel,
+    this.onLeaveChannel,
+    this.onArchiveChannel,
     this.onAddMembers,
     this.onUpdateChannel,
   }) : super(
@@ -9482,7 +12277,7 @@ class _FakeChannelActions extends ChannelActions {
          session: ref.read(relaySessionProvider.notifier),
          signedEventRelay: SignedEventRelay(
            session: ref.read(relaySessionProvider.notifier),
-           nsec: null,
+           nsec: ref.read(relayConfigProvider).nsec,
          ),
          currentPubkey: 'self',
        );
@@ -9503,7 +12298,12 @@ class _FakeChannelActions extends ChannelActions {
 
   @override
   Future<void> leaveChannel(String channelId) async {
-    return;
+    await onLeaveChannel?.call(channelId);
+  }
+
+  @override
+  Future<void> archiveChannel(String channelId) async {
+    await onArchiveChannel?.call(channelId);
   }
 
   @override
@@ -9516,6 +12316,261 @@ class _FakeChannelActions extends ChannelActions {
   }
 }
 
+class _RecordingNavigatorObserver extends NavigatorObserver {
+  final List<Route<dynamic>> pushedRoutes = [];
+
+  @override
+  void didPush(Route<dynamic> route, Route<dynamic>? previousRoute) {
+    super.didPush(route, previousRoute);
+    pushedRoutes.add(route);
+  }
+}
+
+class _HuddleRelayConfigNotifier extends RelayConfigNotifier {
+  final String _nsec = nostr.Keys.generate().nsec;
+
+  @override
+  RelayConfig build() =>
+      RelayConfig(baseUrl: 'https://relay.example', nsec: _nsec);
+}
+
+final class _HuddleTestMedia implements HuddleMedia {
+  _HuddleTestMedia({
+    this.stopGate,
+    this.permission = HuddleMicrophonePermission.granted,
+  });
+
+  final Future<void>? stopGate;
+  final HuddleMicrophonePermission permission;
+  final stopStarted = Completer<void>();
+  final _states = StreamController<HuddleMediaState>.broadcast(sync: true);
+  final _localFrames = StreamController<HuddleLocalAudioFrame>.broadcast(
+    sync: true,
+  );
+  HuddleMediaState _state = const HuddleMediaState(
+    phase: HuddleMediaPhase.idle,
+  );
+
+  @override
+  HuddleMediaState get state => _state;
+
+  @override
+  Stream<HuddleMediaState> get states => _states.stream;
+
+  @override
+  Stream<HuddleLocalAudioFrame> get localAudioFrames => _localFrames.stream;
+
+  @override
+  Future<HuddleMediaCapabilities> discoverCapabilities() async {
+    const capabilities = HuddleMediaCapabilities(
+      platform: 'test',
+      supportsAudioSession: true,
+      supportsMicrophonePermission: true,
+      supportsCapture: true,
+      supportsPlayback: true,
+      supportsOpusEncoding: true,
+      supportsOpusDecoding: true,
+    );
+    _state = const HuddleMediaState(
+      phase: HuddleMediaPhase.idle,
+      capabilities: capabilities,
+    );
+    return capabilities;
+  }
+
+  @override
+  Future<HuddleMicrophonePermission> requestMicrophonePermission() async =>
+      permission;
+
+  var openSettingsCalls = 0;
+
+  @override
+  Future<bool> openSystemSettings() async {
+    openSettingsCalls += 1;
+    return true;
+  }
+
+  @override
+  Future<void> prepare() async {
+    _emit(
+      HuddleMediaState(
+        phase: HuddleMediaPhase.prepared,
+        capabilities: _state.capabilities,
+      ),
+    );
+  }
+
+  @override
+  Future<void> start() async {
+    _emit(
+      HuddleMediaState(
+        phase: HuddleMediaPhase.active,
+        capabilities: _state.capabilities,
+      ),
+    );
+  }
+
+  @override
+  Future<void> setMuted(bool muted) async {
+    _emit(
+      HuddleMediaState(
+        phase: HuddleMediaPhase.active,
+        capabilities: _state.capabilities,
+        isMuted: muted,
+        isSpeakerEnabled: _state.isSpeakerEnabled,
+      ),
+    );
+  }
+
+  @override
+  Future<void> setSpeakerEnabled(bool enabled) async {
+    _emit(
+      HuddleMediaState(
+        phase: HuddleMediaPhase.active,
+        capabilities: _state.capabilities,
+        isMuted: _state.isMuted,
+        isSpeakerEnabled: enabled,
+      ),
+    );
+  }
+
+  void emitFailure() {
+    scheduleMicrotask(() {
+      _emit(
+        HuddleMediaState(
+          phase: HuddleMediaPhase.failed,
+          capabilities: _state.capabilities,
+          error: const HuddleMediaError(
+            code: HuddleMediaErrorCode.platformFailure,
+            message: 'Native audio failed.',
+          ),
+        ),
+      );
+    });
+  }
+
+  @override
+  Future<void> playRemoteFrame(HuddleRemoteAudioFrame frame) async {}
+
+  @override
+  Future<void> removeRemotePeer(int peerIndex) async {}
+
+  @override
+  Future<void> stop() async {
+    if (!stopStarted.isCompleted) stopStarted.complete();
+    if (stopGate case final gate?) await gate;
+    scheduleMicrotask(() {
+      _emit(
+        HuddleMediaState(
+          phase: HuddleMediaPhase.stopped,
+          capabilities: _state.capabilities,
+        ),
+      );
+    });
+  }
+
+  @override
+  Future<void> dispose() => stop();
+
+  void _emit(HuddleMediaState state) {
+    _state = state;
+    _states.add(state);
+  }
+}
+
+final class _HuddleTestTransport implements HuddleTransportClient {
+  _HuddleTestTransport({
+    this.connectError,
+    this.connectGate,
+    Map<int, HuddlePeer> peers = const {
+      1: HuddlePeer(pubkey: 'desktop', peerIndex: 1, epoch: 0),
+      2: HuddlePeer(pubkey: 'self', peerIndex: 2, epoch: 0),
+    },
+  }) : _peers = Map<int, HuddlePeer>.from(peers);
+
+  final HuddleTransportError? connectError;
+  final Future<void>? connectGate;
+  final Map<int, HuddlePeer> _peers;
+  final _states = StreamController<HuddleTransportState>.broadcast(sync: true);
+  final _remoteFrames = StreamController<HuddleRemoteAudioFrame>.broadcast(
+    sync: true,
+  );
+  final _peerEvents = StreamController<HuddlePeerEvent>.broadcast(sync: true);
+  final _issues = StreamController<HuddleTransportError>.broadcast(sync: true);
+  HuddleTransportState _state = HuddleTransportState.idle();
+
+  void emitPeerJoin(HuddlePeer peer) {
+    _peers[peer.peerIndex] = peer;
+    _state = HuddleTransportState(
+      phase: HuddleTransportPhase.connected,
+      localPeerIndex: _state.localPeerIndex,
+      peers: _peers,
+    );
+    _states.add(_state);
+    _peerEvents.add(
+      HuddlePeerEvent(type: HuddlePeerEventType.joined, peer: peer),
+    );
+  }
+
+  void emitRemoteAudio({int levelDbov = -30, int sequence = 1}) {
+    _remoteFrames.add(
+      HuddleRemoteAudioFrame(
+        peerIndex: 1,
+        epoch: 0,
+        header: HuddleAudioHeader(
+          sequence: sequence,
+          timestamp48k: 960,
+          levelDbov: levelDbov,
+          flags: 0,
+        ),
+        opusPayload: Uint8List.fromList([1, 2, 3]),
+      ),
+    );
+  }
+
+  @override
+  HuddleTransportState get state => _state;
+
+  @override
+  Stream<HuddleTransportState> get states => _states.stream;
+
+  @override
+  Stream<HuddleRemoteAudioFrame> get remoteAudioFrames => _remoteFrames.stream;
+
+  @override
+  Stream<HuddlePeerEvent> get peerEvents => _peerEvents.stream;
+
+  @override
+  Stream<HuddleTransportError> get issues => _issues.stream;
+
+  @override
+  Future<void> connect() async {
+    if (connectGate case final gate?) await gate;
+    if (connectError case final error?) throw error;
+    _state = HuddleTransportState(
+      phase: HuddleTransportPhase.connected,
+      localPeerIndex: 2,
+      peers: _peers,
+    );
+    _states.add(_state);
+  }
+
+  @override
+  void sendOpusFrame({
+    required HuddleAudioHeader header,
+    required Uint8List opusPayload,
+  }) {}
+
+  @override
+  Future<void> disconnect() async {
+    _state = HuddleTransportState(phase: HuddleTransportPhase.disconnected);
+    _states.add(_state);
+  }
+
+  @override
+  Future<void> dispose() => disconnect();
+}
+
 class _RecordingRelaySocket extends RelaySocket {
   _RecordingRelaySocket()
     : super(
diff --git a/mobile/test/features/channels/channel_management_provider_test.dart b/mobile/test/features/channels/channel_management_provider_test.dart
index 0add357c988..5700bfae966 100644
--- a/mobile/test/features/channels/channel_management_provider_test.dart
+++ b/mobile/test/features/channels/channel_management_provider_test.dart
@@ -1,6 +1,8 @@
 import 'package:flutter_test/flutter_test.dart';
 import 'package:hooks_riverpod/hooks_riverpod.dart';
+import 'package:nostr/nostr.dart' as nostr;
 import 'package:buzz/features/channels/channel_management_provider.dart';
+import 'package:buzz/features/channels/mobile_huddle_controller.dart';
 import 'package:buzz/shared/relay/relay.dart';
 
 /// Tests for [channelDetailsFromEvent].
@@ -244,6 +246,143 @@ void main() {
     });
   });
 
+  group('Huddle channel lifecycle', () {
+    test(
+      'starts from accepted signed events without refreshing all channels',
+      () async {
+        final keys = nostr.Keys.generate();
+        final session = _RecordingPublishRelaySession();
+        final actionsProvider = Provider<ChannelActions>((ref) {
+          return ChannelActions(
+            ref: ref,
+            session: session,
+            signedEventRelay: SignedEventRelay(
+              session: session,
+              nsec: keys.nsec,
+            ),
+            currentPubkey: keys.public,
+          );
+        });
+        final container = ProviderContainer(
+          retry: (_, _) => null,
+          overrides: [
+            relaySessionProvider.overrideWith(() => session),
+            myPubkeyProvider.overrideWithValue(keys.public),
+          ],
+        );
+        addTearDown(container.dispose);
+
+        final actions = container.read(actionsProvider);
+        final backingChannelId = await actions.createHuddleBackingChannel();
+        final started = await actions.announceHuddleStarted(
+          parentChannelId: _channelId,
+          ephemeralChannelId: backingChannelId,
+        );
+
+        expect(session.historyQueryCount, 0);
+        expect(session.publishedEvents, hasLength(2));
+        final create = session.publishedEvents.first;
+        expect(create.kind, 9007);
+        expect(create.tags, contains(equals(['h', backingChannelId])));
+        expect(create.tags, contains(equals(['visibility', 'private'])));
+        expect(create.tags, contains(equals(['channel_type', 'stream'])));
+        expect(create.tags, contains(equals(['ttl', '3600'])));
+
+        final start = session.publishedEvents.last;
+        expect(start.kind, EventKind.huddleStarted);
+        expect(start.tags, [
+          ['h', _channelId],
+        ]);
+        expect(start.content, '{"ephemeral_channel_id":"$backingChannelId"}');
+        expect(started.id, start.id);
+      },
+    );
+
+    test(
+      'publishes ephemeral Huddle reactions on the backing channel',
+      () async {
+        final keys = nostr.Keys.generate();
+        final session = _RecordingPublishRelaySession();
+        final actionsProvider = Provider<ChannelActions>((ref) {
+          return ChannelActions(
+            ref: ref,
+            session: session,
+            signedEventRelay: SignedEventRelay(
+              session: session,
+              nsec: keys.nsec,
+            ),
+            currentPubkey: keys.public,
+          );
+        });
+        final container = ProviderContainer(
+          retry: (_, _) => null,
+          overrides: [
+            relaySessionProvider.overrideWith(() => session),
+            myPubkeyProvider.overrideWithValue(keys.public),
+          ],
+        );
+        addTearDown(container.dispose);
+
+        await container
+            .read(actionsProvider)
+            .sendHuddleReaction(
+              channelId: _channelId,
+              emoji: ' 🎉 ',
+              senderName: 'Self',
+            );
+
+        expect(session.publishedEvents, hasLength(1));
+        final reaction = session.publishedEvents.single;
+        expect(reaction.kind, EventKind.huddleReaction);
+        expect(reaction.content, '🎉');
+        expect(reaction.tags, [
+          ['h', _channelId],
+          ['reaction', '🎉'],
+          ['sender_name', 'Self'],
+        ]);
+      },
+    );
+
+    test('last-human count ignores a stale cached roster', () async {
+      final session = _ConnectionAwareRelaySession();
+      final container = ProviderContainer(
+        retry: (_, _) => null,
+        overrides: [
+          relaySessionProvider.overrideWith(() => session),
+          channelMembersProvider(_channelId).overrideWith(
+            (ref) async => [
+              ChannelMember(
+                pubkey: _memberPubkey,
+                role: 'admin',
+                joinedAt: DateTime(2025),
+              ),
+              ChannelMember(
+                pubkey:
+                    'bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb',
+                role: 'member',
+                joinedAt: DateTime(2025),
+              ),
+            ],
+          ),
+        ],
+      );
+      addTearDown(container.dispose);
+      container.read(relaySessionProvider);
+      session.connect();
+      expect(
+        await container.read(channelMembersProvider(_channelId).future),
+        hasLength(2),
+      );
+
+      final humanCount = await container.read(huddleHumanCountProvider)(
+        _channelId,
+      );
+
+      expect(humanCount, 1);
+      expect(session.historyQueryCount, 1);
+    });
+  });
+
   test(
     'stale channel actions cannot publish after a community switch',
     () async {
@@ -512,6 +651,32 @@ const _channelId = '11111111-1111-4111-8111-111111111111';
 const _memberPubkey =
     'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa';
 
+class _RecordingPublishRelaySession extends RelaySessionNotifier {
+  final publishedEvents = <NostrEvent>[];
+  int historyQueryCount = 0;
+
+  @override
+  SessionState build() => const SessionState(status: SessionStatus.connected);
+
+  @override
+  Future<NostrEvent> publish(
+    NostrEvent event, {
+    Duration timeout = const Duration(seconds: 8),
+  }) async {
+    publishedEvents.add(event);
+    return event;
+  }
+
+  @override
+  Future<List<NostrEvent>> fetchHistory(
+    NostrFilter filter, {
+    Duration timeout = const Duration(seconds: 8),
+  }) async {
+    historyQueryCount++;
+    return const [];
+  }
+}
+
 class _FixedRelayConfigNotifier extends RelayConfigNotifier {
   @override
   RelayConfig build() =>
diff --git a/mobile/test/features/channels/channel_messages_provider_test.dart b/mobile/test/features/channels/channel_messages_provider_test.dart
index cbeb00182c0..f23b68b1465 100644
--- a/mobile/test/features/channels/channel_messages_provider_test.dart
+++ b/mobile/test/features/channels/channel_messages_provider_test.dart
@@ -101,6 +101,57 @@ void main() {
     },
   );
 
+  test('retains historical and live Huddle end events in the window', () async {
+    final relaySession = _RecordingRelaySessionNotifier(
+      queryResults: [
+        [
+          _huddleEvent(
+            id: 'ended-history',
+            kind: EventKind.huddleEnded,
+            createdAt: 20,
+          ),
+          _huddleEvent(
+            id: 'started',
+            kind: EventKind.huddleStarted,
+            createdAt: 10,
+          ),
+          _bounds(),
+        ],
+      ],
+    );
+    final container = _buildContainer(relaySession);
+    addTearDown(container.dispose);
+
+    container.read(channelMessagesProvider(_channelId));
+    await relaySession.subscribed;
+    await _pumpEventQueue();
+
+    expect(
+      container
+          .read(channelMessagesProvider(_channelId))
+          .value
+          ?.map((event) => event.id),
+      ['started', 'ended-history'],
+    );
+
+    relaySession.emit(
+      _huddleEvent(
+        id: 'ended-live',
+        kind: EventKind.huddleEnded,
+        createdAt: 30,
+      ),
+    );
+    await _pumpEventQueue();
+
+    expect(
+      container
+          .read(channelMessagesProvider(_channelId))
+          .value
+          ?.map((event) => event.id),
+      ['started', 'ended-history', 'ended-live'],
+    );
+  });
+
   test('still loads history when live subscription fails', () async {
     final relaySession = _RecordingRelaySessionNotifier(failSubscribe: true);
     final container = _buildContainer(relaySession);
@@ -740,6 +791,26 @@ NostrEvent _event({
   );
 }
 
+NostrEvent _huddleEvent({
+  required String id,
+  required int kind,
+  required int createdAt,
+}) {
+  return NostrEvent(
+    id: id,
+    pubkey: 'alice',
+    createdAt: createdAt,
+    kind: kind,
+    tags: const [
+      ['h', _channelId],
+    ],
+    content: jsonEncode({
+      'ephemeral_channel_id': '22222222-2222-4222-8222-222222222222',
+    }),
+    sig: 'sig',
+  );
+}
+
 NostrEvent _summary({
   required String rootId,
   required int replyCount,
diff --git a/mobile/test/features/channels/channel_preferences_manager_test.dart b/mobile/test/features/channels/channel_preferences_manager_test.dart
new file mode 100644
index 00000000000..776221ae317
--- /dev/null
+++ b/mobile/test/features/channels/channel_preferences_manager_test.dart
@@ -0,0 +1,57 @@
+import 'package:buzz/features/channels/channel_mutes/channel_mutes_manager.dart';
+import 'package:buzz/features/channels/channel_stars/channel_stars_manager.dart';
+import 'package:flutter_test/flutter_test.dart';
+import 'package:nostr/nostr.dart' as nostr;
+import 'package:shared_preferences/shared_preferences.dart';
+
+void main() {
+  setUp(() => SharedPreferences.setMockInitialValues({}));
+
+  test('local star changes notify listeners immediately', () async {
+    final prefs = await SharedPreferences.getInstance();
+    final keys = nostr.Keys.generate();
+    var changes = 0;
+    final manager = ChannelStarsManager(
+      pubkey: keys.public,
+      prefs: prefs,
+      crypto: ChannelStarsCrypto(keys.nsec, keys.public),
+      relaySession: null,
+      signedEventRelay: null,
+      remoteEnabled: false,
+      onChanged: () => changes += 1,
+    );
+    addTearDown(manager.dispose);
+
+    manager.starChannel('general');
+    expect(manager.store.channels['general']?.starred, isTrue);
+    expect(changes, 1);
+
+    manager.unstarChannel('general');
+    expect(manager.store.channels['general']?.starred, isFalse);
+    expect(changes, 2);
+  });
+
+  test('local mute changes notify listeners immediately', () async {
+    final prefs = await SharedPreferences.getInstance();
+    final keys = nostr.Keys.generate();
+    var changes = 0;
+    final manager = ChannelMutesManager(
+      pubkey: keys.public,
+      prefs: prefs,
+      crypto: ChannelMutesCrypto(keys.nsec, keys.public),
+      relaySession: null,
+      signedEventRelay: null,
+      remoteEnabled: false,
+      onChanged: () => changes += 1,
+    );
+    addTearDown(manager.dispose);
+
+    manager.muteChannel('general');
+    expect(manager.store.channels['general']?.muted, isTrue);
+    expect(changes, 1);
+
+    manager.unmuteChannel('general');
+    expect(manager.store.channels['general']?.muted, isFalse);
+    expect(changes, 2);
+  });
+}
diff --git a/mobile/test/features/channels/channels_provider_test.dart b/mobile/test/features/channels/channels_provider_test.dart
index ea33fb79444..fa5d3a0e118 100644
--- a/mobile/test/features/channels/channels_provider_test.dart
+++ b/mobile/test/features/channels/channels_provider_test.dart
@@ -415,6 +415,129 @@ void main() {
     expect(ephemeral.ttlSeconds, 86400);
   });
 
+  test(
+    'Huddle-linked one-hour private streams stay out of channel lists',
+    () async {
+      final now = DateTime.now().millisecondsSinceEpoch ~/ 1000;
+      final session = _FakeRelaySession(
+        memberships: [
+          _membership(_channelA, myPk),
+          _membership(_channelB, myPk, ownerPubkey: myPk),
+        ],
+        metadata: [
+          _meta(id: _channelA, name: 'general'),
+          _meta(
+            id: _channelB,
+            name: 'huddle-22222222',
+            ttlSeconds: 3600,
+            visibility: 'private',
+          ),
+        ],
+        huddleStarts: [
+          NostrEvent(
+            id: 'huddle-start',
+            pubkey: myPk,
+            createdAt: now,
+            kind: EventKind.huddleStarted,
+            tags: const [
+              ['h', _channelA],
+            ],
+            content: '{"ephemeral_channel_id":"$_channelB"}',
+            sig: 'sig',
+          ),
+        ],
+      );
+      final container = _buildContainer(session: session);
+      addTearDown(container.dispose);
+
+      final channels = await container.read(channelsProvider.future);
+
+      expect(channels.map((channel) => channel.id), [_channelA]);
+    },
+  );
+
+  test(
+    'Huddle-linked private streams stay hidden when relay overrides the TTL',
+    () async {
+      final now = DateTime.now().millisecondsSinceEpoch ~/ 1000;
+      final session = _FakeRelaySession(
+        memberships: [
+          _membership(_channelA, myPk),
+          _membership(_channelB, myPk, ownerPubkey: myPk),
+        ],
+        metadata: [
+          _meta(id: _channelA, name: 'general'),
+          _meta(
+            id: _channelB,
+            name: 'huddle-22222222',
+            ttlSeconds: 60,
+            visibility: 'private',
+          ),
+        ],
+        huddleStarts: [
+          NostrEvent(
+            id: 'huddle-start',
+            pubkey: myPk,
+            createdAt: now,
+            kind: EventKind.huddleStarted,
+            tags: const [
+              ['h', _channelA],
+            ],
+            content: '{"ephemeral_channel_id":"$_channelB"}',
+            sig: 'sig',
+          ),
+        ],
+      );
+      final container = _buildContainer(session: session);
+      addTearDown(container.dispose);
+
+      final channels = await container.read(channelsProvider.future);
+
+      expect(channels.map((channel) => channel.id), [_channelA]);
+    },
+  );
+
+  test(
+    'forged Huddle links do not hide unrelated one-hour private streams',
+    () async {
+      final now = DateTime.now().millisecondsSinceEpoch ~/ 1000;
+      final session = _FakeRelaySession(
+        memberships: [
+          _membership(_channelA, myPk),
+          _membership(_channelB, myPk, ownerPubkey: 'actual-owner'),
+        ],
+        metadata: [
+          _meta(id: _channelA, name: 'general'),
+          _meta(
+            id: _channelB,
+            name: 'private-hour-stream',
+            ttlSeconds: 3600,
+            visibility: 'private',
+          ),
+        ],
+        huddleStarts: [
+          NostrEvent(
+            id: 'forged-huddle-start',
+            pubkey: myPk,
+            createdAt: now,
+            kind: EventKind.huddleStarted,
+            tags: const [
+              ['h', _channelA],
+            ],
+            content: '{"ephemeral_channel_id":"$_channelB"}',
+            sig: 'sig',
+          ),
+        ],
+      );
+      final container = _buildContainer(session: session);
+      addTearDown(container.dispose);
+
+      final channels = await container.read(channelsProvider.future);
+
+      expect(channels.map((channel) => channel.id), contains(_channelB));
+    },
+  );
+
   test('hidden DMs are filtered from the channel list', () async {
     final session = _FakeRelaySession(
       memberships: [_membership(_channelA, myPk), _membership(_channelB, myPk)],
@@ -665,6 +788,7 @@ NostrEvent _membership(
   String channelId,
   String pubkey, {
   String? additionalPubkey,
+  String? ownerPubkey,
 }) => NostrEvent(
   id: 'mem-$channelId',
   pubkey: 'creator',
@@ -672,7 +796,8 @@ NostrEvent _membership(
   kind: 39002,
   tags: [
     ['d', channelId],
-    ['p', pubkey],
+    if (ownerPubkey != null) ['p', ownerPubkey, '', 'owner'],
+    if (ownerPubkey == null || ownerPubkey != pubkey) ['p', pubkey],
     if (additionalPubkey != null) ['p', additionalPubkey],
   ],
   content: '',
@@ -701,6 +826,7 @@ NostrEvent _meta({
   String channelType = 'stream',
   int createdAt = 1,
   int? ttlSeconds,
+  String visibility = 'open',
   bool archived = false,
 }) => NostrEvent(
   id: 'meta-$id',
@@ -711,7 +837,7 @@ NostrEvent _meta({
     ['d', id],
     ['name', name],
     ['t', channelType],
-    ['public'],
+    [visibility == 'private' ? 'private' : 'public'],
     if (ttlSeconds != null) ['ttl', '$ttlSeconds'],
     if (archived) ['archived', 'true'],
   ],
@@ -745,6 +871,7 @@ class _FakeRelaySession extends RelaySessionNotifier {
     required this.memberships,
     required this.metadata,
     this.hiddenDmEvents = const [],
+    this.huddleStarts = const [],
     this.recentMessages = const [],
     this.membershipFailures = 0,
   });
@@ -752,6 +879,7 @@ class _FakeRelaySession extends RelaySessionNotifier {
   List<NostrEvent> memberships;
   List<NostrEvent> metadata;
   final List<NostrEvent> hiddenDmEvents;
+  final List<NostrEvent> huddleStarts;
   final List<NostrEvent> recentMessages;
   int membershipFailures;
 
@@ -802,6 +930,12 @@ class _FakeRelaySession extends RelaySessionNotifier {
     Duration timeout = const Duration(seconds: 8),
   }) async {
     historyFilters.add(filter);
+    if (filter.kinds.contains(39002) && filter.tags['#d'] != null) {
+      final ids = (filter.tags['#d'] ?? const <String>[]).toSet();
+      return memberships
+          .where((event) => ids.contains(event.getTagValue('d')))
+          .toList();
+    }
     if (filter.kinds.contains(39002) && filter.tags['#p'] != null) {
       if (membershipFailures > 0) {
         membershipFailures--;
@@ -819,6 +953,9 @@ class _FakeRelaySession extends RelaySessionNotifier {
     if (filter.kinds.contains(EventKind.dmVisibility)) {
       return hiddenDmEvents;
     }
+    if (filter.kinds.contains(EventKind.huddleStarted)) {
+      return huddleStarts;
+    }
     if (filter.kinds.contains(39000)) {
       // Metadata query — return all metadata events whose `d` tag matches.
       final ids = (filter.tags['#d'] ?? const <String>[]).toSet();
diff --git a/mobile/test/features/channels/compose_bar_test.dart b/mobile/test/features/channels/compose_bar_test.dart
index 775c9f4f719..d1e2e633840 100644
--- a/mobile/test/features/channels/compose_bar_test.dart
+++ b/mobile/test/features/channels/compose_bar_test.dart
@@ -378,6 +378,10 @@ class _RecordingRelaySocket extends RelaySocket {
   final List<Map<String, dynamic>> events;
   final void Function(List<dynamic> message) handleMessage;
 
+  /// Invoked after an event is handed to the socket but before its relay
+  /// acknowledgement is delivered. Tests may defer that acknowledgement.
+  final Future<void> Function(Map<String, dynamic> event)? beforeAcknowledged;
+
   /// Invoked after an event has been recorded and acknowledged, before the
   /// caller's `await` resumes. Lets a test interleave state changes (such as
   /// a community switch) between two relay round trips.
@@ -386,6 +390,7 @@ class _RecordingRelaySocket extends RelaySocket {
   _RecordingRelaySocket(
     this.events,
     this.handleMessage, {
+    this.beforeAcknowledged,
     this.onEventAcknowledged,
   }) : super(
          wsUrl: 'ws://localhost',
@@ -403,8 +408,18 @@ class _RecordingRelaySocket extends RelaySocket {
     if (payload case ['EVENT', final Map<String, dynamic> event]) {
       events.add(event);
       final id = event['id'] as String;
-      super.debugHandleOkForTest(['OK', id, true, '']);
-      onEventAcknowledged?.call(event);
+      final pending = beforeAcknowledged?.call(event);
+      if (pending == null) {
+        super.debugHandleOkForTest(['OK', id, true, '']);
+        onEventAcknowledged?.call(event);
+      } else {
+        unawaited(
+          pending.then((_) {
+            super.debugHandleOkForTest(['OK', id, true, '']);
+            onEventAcknowledged?.call(event);
+          }),
+        );
+      }
     }
   }
 
@@ -913,6 +928,124 @@ void main() {
       expect(sentContent, 'First line\nSecond line');
     });
 
+    testWidgets('clears text before the optimistic send completes', (
+      tester,
+    ) async {
+      final delivery = Completer<void>();
+      await tester.pumpWidget(
+        _buildComposeBar(
+          uploadService: _testUploadService(nostr.Keys.generate().nsec),
+          onSend:
+              (content, mentionPubkeys, {mediaTags = const <List<String>>[]}) =>
+                  delivery.future,
+        ),
+      );
+
+      await _expandComposer(tester);
+      await tester.enterText(find.byType(TextField), 'hello');
+      await tester.pumpAndSettle();
+      await tester.tap(find.byIcon(LucideIcons.arrowUp));
+      for (var i = 0; i < 20; i++) {
+        await tester.pump(const Duration(milliseconds: 20));
+        if (tester
+            .widget<TextField>(find.byType(TextField))
+            .controller!
+            .text
+            .isEmpty) {
+          break;
+        }
+      }
+
+      expect(
+        tester.widget<TextField>(find.byType(TextField)).controller!.text,
+        '',
+      );
+
+      delivery.complete();
+      await tester.pumpAndSettle();
+    });
+
+    testWidgets('a failed send restores an untouched cleared draft', (
+      tester,
+    ) async {
+      final delivery = Completer<void>();
+      await tester.pumpWidget(
+        _buildComposeBar(
+          uploadService: _testUploadService(nostr.Keys.generate().nsec),
+          onSend:
+              (content, mentionPubkeys, {mediaTags = const <List<String>>[]}) =>
+                  delivery.future,
+        ),
+      );
+
+      await _expandComposer(tester);
+      await tester.enterText(find.byType(TextField), 'retry me');
+      await tester.pumpAndSettle();
+      await tester.tap(find.byIcon(LucideIcons.arrowUp));
+      for (var i = 0; i < 20; i++) {
+        await tester.pump(const Duration(milliseconds: 20));
+        if (tester
+            .widget<TextField>(find.byType(TextField))
+            .controller!
+            .text
+            .isEmpty) {
+          break;
+        }
+      }
+      expect(
+        tester.widget<TextField>(find.byType(TextField)).controller!.text,
+        '',
+      );
+
+      delivery.completeError(Exception('relay rejected'));
+      await tester.pumpAndSettle();
+
+      expect(
+        tester.widget<TextField>(find.byType(TextField)).controller!.text,
+        'retry me',
+      );
+    });
+
+    testWidgets('a failed send does not overwrite a new draft', (tester) async {
+      final delivery = Completer<void>();
+      await tester.pumpWidget(
+        _buildComposeBar(
+          uploadService: _testUploadService(nostr.Keys.generate().nsec),
+          onSend:
+              (content, mentionPubkeys, {mediaTags = const <List<String>>[]}) =>
+                  delivery.future,
+        ),
+      );
+
+      await _expandComposer(tester);
+      await tester.enterText(find.byType(TextField), 'first draft');
+      await tester.pumpAndSettle();
+      await tester.tap(find.byIcon(LucideIcons.arrowUp));
+      for (var i = 0; i < 20; i++) {
+        await tester.pump(const Duration(milliseconds: 20));
+        if (tester
+            .widget<TextField>(find.byType(TextField))
+            .controller!
+            .text
+            .isEmpty) {
+          break;
+        }
+      }
+      expect(
+        tester.widget<TextField>(find.byType(TextField)).controller!.text,
+        '',
+      );
+
+      await tester.enterText(find.byType(TextField), 'new draft');
+      delivery.completeError(StateError('relay rejected'));
+      await tester.pumpAndSettle();
+
+      expect(
+        tester.widget<TextField>(find.byType(TextField)).controller!.text,
+        'new draft',
+      );
+    });
+
     testWidgets('smoothly resizes the text field when a new line is added', (
       tester,
     ) async {
@@ -3734,6 +3867,78 @@ void main() {
       ]);
     });
 
+    testWidgets('preserves edits made while a mentioned agent is being added', (
+      tester,
+    ) async {
+      final agentPubkey = 'c' * 64;
+      final signer = nostr.Keys.generate();
+      final publishedEvents = <Map<String, dynamic>>[];
+      final addMemberAcknowledgement = Completer<void>();
+      String? sentContent;
+
+      await tester.pumpWidget(
+        _buildComposeBar(
+          uploadService: _testUploadService(signer.nsec),
+          currentPubkey: signer.public,
+          relayAgents: [
+            AgentDirectoryEntry(
+              pubkey: agentPubkey,
+              displayName: 'Helper Bot',
+              respondTo: 'anyone',
+              channelIds: const ['shared-channel'],
+            ),
+          ],
+          channels: [_makeCurrentChannel(), _makeSharedMemberChannel()],
+          onSend:
+              (
+                content,
+                mentionPubkeys, {
+                mediaTags = const <List<String>>[],
+              }) async {
+                sentContent = content;
+              },
+        ),
+      );
+
+      final container = ProviderScope.containerOf(
+        tester.element(find.byType(ComposeBar)),
+      );
+      final session = container.read(relaySessionProvider.notifier);
+      session.debugAttachSocketForTest(
+        _RecordingRelaySocket(
+          publishedEvents,
+          session.debugHandleSocketMessageForTest,
+          beforeAcknowledged: (event) async {
+            if (event['kind'] == 9000) await addMemberAcknowledgement.future;
+          },
+        ),
+      );
+
+      await _expandComposer(tester);
+      await tester.enterText(find.byType(TextField), '@hel');
+      await tester.pumpAndSettle();
+      await tester.tap(find.text('Helper Bot'));
+      await tester.pumpAndSettle();
+      await tester.enterText(find.byType(TextField), 'hello @Helper Bot');
+      await tester.tap(find.byIcon(LucideIcons.arrowUp));
+      await tester.pump();
+
+      expect(
+        publishedEvents.where((event) => event['kind'] == 9000),
+        hasLength(1),
+      );
+
+      await tester.enterText(find.byType(TextField), 'newer draft');
+      addMemberAcknowledgement.complete();
+      await tester.pumpAndSettle();
+
+      expect(sentContent, 'hello @Helper Bot');
+      expect(
+        tester.widget<TextField>(find.byType(TextField)).controller!.text,
+        'newer draft',
+      );
+    });
+
     testWidgets(
       'renders chips only for selected agents outside code and composition',
       (tester) async {
diff --git a/mobile/test/features/channels/local_message_send_transition_test.dart b/mobile/test/features/channels/local_message_send_transition_test.dart
new file mode 100644
index 00000000000..574c12fc518
--- /dev/null
+++ b/mobile/test/features/channels/local_message_send_transition_test.dart
@@ -0,0 +1,107 @@
+import 'package:flutter/material.dart';
+import 'package:flutter_test/flutter_test.dart';
+import 'package:buzz/features/channels/local_message_send_animation_provider.dart';
+import 'package:buzz/features/channels/local_message_send_transition.dart';
+
+Widget _testable({
+  bool animate = true,
+  bool reduceMotion = false,
+  double startOffsetFactor = localMessageSendTransitionStartOffset,
+}) => MaterialApp(
+  home: MediaQuery(
+    data: MediaQueryData(disableAnimations: reduceMotion),
+    child: Scaffold(
+      body: LocalMessageSendTransition(
+        animate: animate,
+        startOffsetFactor: startOffsetFactor,
+        child: const SizedBox(key: ValueKey('message'), width: 100, height: 40),
+      ),
+    ),
+  ),
+);
+
+void main() {
+  Finder sendTranslation() => find.descendant(
+    of: find.byType(LocalMessageSendTransition),
+    matching: find.byType(FractionalTranslation),
+  );
+
+  test('local send claims expire before a later navigation', () {
+    final markedAt = DateTime(2026);
+    final animations = {'event': markedAt};
+
+    expect(
+      isRecentLocalMessageSendAnimation(
+        animations,
+        'event',
+        now: markedAt.add(const Duration(milliseconds: 999)),
+      ),
+      isTrue,
+    );
+    expect(
+      isRecentLocalMessageSendAnimation(
+        animations,
+        'event',
+        now: markedAt.add(const Duration(seconds: 2)),
+      ),
+      isFalse,
+    );
+  });
+
+  testWidgets('local send rises from behind the composer', (tester) async {
+    await tester.pumpWidget(_testable());
+
+    var transition = tester.widget<FractionalTranslation>(sendTranslation());
+    expect(
+      transition.translation,
+      const Offset(0, localMessageSendTransitionStartOffset),
+    );
+    expect(
+      find.descendant(
+        of: find.byType(LocalMessageSendTransition),
+        matching: find.byType(FadeTransition),
+      ),
+      findsNothing,
+    );
+
+    await tester.pump(localMessageSendTransitionDuration ~/ 2);
+    transition = tester.widget<FractionalTranslation>(sendTranslation());
+    expect(transition.translation.dy, greaterThan(0));
+    expect(
+      transition.translation.dy,
+      lessThan(localMessageSendTransitionStartOffset),
+    );
+
+    await tester.pump(localMessageSendTransitionDuration);
+    transition = tester.widget<FractionalTranslation>(sendTranslation());
+    expect(transition.translation, Offset.zero);
+  });
+
+  testWidgets('an avatar row starts deeper behind the composer', (
+    tester,
+  ) async {
+    await tester.pumpWidget(
+      _testable(startOffsetFactor: localMessageSendTransitionAvatarStartOffset),
+    );
+
+    final transition = tester.widget<FractionalTranslation>(sendTranslation());
+    expect(
+      transition.translation,
+      const Offset(0, localMessageSendTransitionAvatarStartOffset),
+    );
+  });
+
+  testWidgets('ordinary messages do not animate', (tester) async {
+    await tester.pumpWidget(_testable(animate: false));
+
+    final transition = tester.widget<FractionalTranslation>(sendTranslation());
+    expect(transition.translation, Offset.zero);
+  });
+
+  testWidgets('reduced motion skips the send translation', (tester) async {
+    await tester.pumpWidget(_testable(reduceMotion: true));
+
+    final transition = tester.widget<FractionalTranslation>(sendTranslation());
+    expect(transition.translation, Offset.zero);
+  });
+}
diff --git a/mobile/test/features/channels/send_message_provider_test.dart b/mobile/test/features/channels/send_message_provider_test.dart
index 2361360d5cb..5766fab2551 100644
--- a/mobile/test/features/channels/send_message_provider_test.dart
+++ b/mobile/test/features/channels/send_message_provider_test.dart
@@ -16,6 +16,7 @@ void main() {
       final localMessages = <NostrEvent>[];
       final removedIds = <String>[];
       final completedIds = <String>[];
+      final animatedIds = <String>[];
       final send = SendMessage(
         signedEventRelay: SignedEventRelay(
           session: session,
@@ -24,6 +25,7 @@ void main() {
         fetchMembers: (_) async => const [],
         readUserCache: () => const {},
         addLocalMessage: (_, event) => localMessages.add(event),
+        markLocalMessageForAnimation: (_, eventId) => animatedIds.add(eventId),
         completeLocalMessage: (_, eventId) => completedIds.add(eventId),
         removeLocalMessage: (_, eventId) => removedIds.add(eventId),
       );
@@ -35,6 +37,7 @@ void main() {
       expect(localMessages.single.id, session.event.id);
       expect(localMessages.single.content, 'hello');
       expect(localMessages.single.channelId, _channelId);
+      expect(animatedIds, [localMessages.single.id]);
       expect(removedIds, isEmpty);
 
       session.accept();
diff --git a/mobile/test/features/channels/timeline_message_test.dart b/mobile/test/features/channels/timeline_message_test.dart
index 3dfaf184c1d..71ed82d0e10 100644
--- a/mobile/test/features/channels/timeline_message_test.dart
+++ b/mobile/test/features/channels/timeline_message_test.dart
@@ -387,6 +387,10 @@ void main() {
           EventKind.huddleEnded,
         ]),
       );
+      expect(
+        EventKind.channelTimelineContentKinds,
+        containsAll([EventKind.huddleStarted, EventKind.huddleEnded]),
+      );
     });
 
     test('passes through text messages', () {
@@ -562,8 +566,16 @@ void main() {
       expect(result, hasLength(2));
       expect(result[0].isSystem, isTrue);
       expect(result[0].systemEvent!.type, SystemEventType.huddleStarted);
+      expect(
+        result[0].systemEvent!.ephemeralChannelId,
+        '8d764100-fd8f-44cf-9c98-6d8fbd739b8c',
+      );
       expect(result[1].isSystem, isTrue);
       expect(result[1].systemEvent!.type, SystemEventType.huddleEnded);
+      expect(
+        result[1].systemEvent!.ephemeralChannelId,
+        '8d764100-fd8f-44cf-9c98-6d8fbd739b8c',
+      );
     });
 
     test('huddle participant events are lifecycle metadata only', () {
diff --git a/mobile/test/features/pairing/pairing_page_test.dart b/mobile/test/features/pairing/pairing_page_test.dart
index e66e9bb3da4..cdcda87f51f 100644
--- a/mobile/test/features/pairing/pairing_page_test.dart
+++ b/mobile/test/features/pairing/pairing_page_test.dart
@@ -11,6 +11,7 @@ import 'package:buzz/shared/community/community.dart';
 import 'package:buzz/shared/security/sensitive_action_authorizer.dart';
 import 'package:buzz/shared/theme/theme.dart';
 import 'package:buzz/shared/widgets/buzz_loading_indicator.dart';
+import 'package:buzz/shared/widgets/ios_glass_navigation_button.dart';
 import 'package:buzz/shared/widgets/tappable_flapping_bee.dart';
 
 import '../../helpers/widget_helpers.dart';
@@ -139,6 +140,36 @@ void main() {
       expect(find.byIcon(LucideIcons.arrowLeft), findsOneWidget);
     });
 
+    testWidgets('uses the native glass back control on iOS', (tester) async {
+      debugDefaultTargetPlatformOverride = TargetPlatform.iOS;
+      addTearDown(() => debugDefaultTargetPlatformOverride = null);
+
+      await tester.pumpWidget(
+        WidgetHelpers.testable(child: const PairingPage(addingCommunity: true)),
+      );
+
+      final nativeBack = tester.widget<UiKitView>(find.byType(UiKitView));
+      expect(nativeBack.viewType, 'buzz/navigation_glass');
+      expect(nativeBack.creationParams, containsPair('icon', 'back'));
+      expect(
+        nativeBack.creationParams,
+        containsPair('buttonCenterX', iosGlassChannelHeaderButtonCenterX),
+      );
+      expect(
+        nativeBack.creationParams,
+        containsPair('hitTargetWidth', iosGlassChannelHeaderLeadingWidth),
+      );
+      final backRect = tester.getRect(
+        find.byKey(const ValueKey('pairing-ios-glass-back')),
+      );
+      expect(
+        backRect.left + iosGlassChannelHeaderButtonCenterX,
+        Grid.quarter + iosGlassChannelHeaderButtonCenterX,
+      );
+      expect(find.byTooltip('Back'), findsOneWidget);
+      debugDefaultTargetPlatformOverride = null;
+    });
+
     testWidgets('reveals pairing code field and connect action', (
       tester,
     ) async {
diff --git a/mobile/test/features/settings/settings_page_test.dart b/mobile/test/features/settings/settings_page_test.dart
index 15e79b0f77d..9242c5b4bc8 100644
--- a/mobile/test/features/settings/settings_page_test.dart
+++ b/mobile/test/features/settings/settings_page_test.dart
@@ -3,11 +3,40 @@ import 'package:buzz/shared/community/community_membership_provider.dart';
 import 'package:buzz/shared/theme/theme.dart';
 import 'package:buzz/shared/widgets/app_list_card.dart';
 import 'package:flutter/material.dart';
+import 'package:flutter/foundation.dart';
 import 'package:flutter_test/flutter_test.dart';
 import 'package:hooks_riverpod/hooks_riverpod.dart';
 import 'package:shared_preferences/shared_preferences.dart';
 
 void main() {
+  testWidgets('uses the native glass close control on iOS', (tester) async {
+    debugDefaultTargetPlatformOverride = TargetPlatform.iOS;
+    addTearDown(() => debugDefaultTargetPlatformOverride = null);
+    SharedPreferences.setMockInitialValues({});
+    final prefs = await SharedPreferences.getInstance();
+
+    await tester.pumpWidget(
+      ProviderScope(
+        overrides: [savedPrefsProvider.overrideWithValue(prefs)],
+        child: MaterialApp(
+          theme: AppTheme.light(),
+          home: SettingsPage(
+            profileHeader: const SizedBox.shrink(),
+            invitePageBuilder: (_) => const SizedBox.shrink(),
+            identityRecoveryPageBuilder: (_) => const SizedBox.shrink(),
+          ),
+        ),
+      ),
+    );
+    await tester.pumpAndSettle();
+
+    final nativeClose = tester.widget<UiKitView>(find.byType(UiKitView));
+    expect(nativeClose.viewType, 'buzz/navigation_glass');
+    expect(nativeClose.creationParams, containsPair('icon', 'close'));
+    expect(find.byTooltip('Close settings'), findsOneWidget);
+    debugDefaultTargetPlatformOverride = null;
+  });
+
   testWidgets('shows community invite navigation to owners and admins', (
     tester,
   ) async {
diff --git a/mobile/test/shared/auth/auth_provider_test.dart b/mobile/test/shared/auth/auth_provider_test.dart
index 7a1e6a66083..72c42cb3ed1 100644
--- a/mobile/test/shared/auth/auth_provider_test.dart
+++ b/mobile/test/shared/auth/auth_provider_test.dart
@@ -1,3 +1,5 @@
+import 'dart:async';
+
 import 'package:flutter_test/flutter_test.dart';
 import 'package:hooks_riverpod/hooks_riverpod.dart';
 import 'package:nostr/nostr.dart' as nostr;
@@ -9,6 +11,121 @@ import 'package:buzz/shared/community/community_storage.dart';
 import '../community/community_storage_test.dart';
 
 void main() {
+  test('waits for transition teardown before replacing credentials', () async {
+    final storage = CommunityStorage(secure: FakeSecureStorage());
+    final active = Community.create(
+      name: 'Active',
+      relayUrl: 'https://active.example',
+      nsec: nostr.Keys.generate().nsec,
+    );
+    final replacement = Community.create(
+      name: 'Replacement',
+      relayUrl: 'https://replacement.example',
+      nsec: nostr.Keys.generate().nsec,
+    );
+    await storage.save(active);
+    await storage.saveActiveId(active.id);
+    final container = ProviderContainer(
+      overrides: [communityStorageProvider.overrideWithValue(storage)],
+    );
+    addTearDown(container.dispose);
+    await container.read(authProvider.future);
+    final teardown = Completer<void>();
+    container.read(communityTransitionProvider).register(() => teardown.future);
+
+    final authenticating = container
+        .read(authProvider.notifier)
+        .authenticateWithCommunity(replacement);
+    await Future<void>.delayed(Duration.zero);
+
+    expect(await storage.loadActiveId(), active.id);
+    expect(
+      (await storage.loadAll()).map((community) => community.id),
+      isNot(contains(replacement.id)),
+    );
+    teardown.complete();
+    await authenticating;
+    expect(await storage.loadActiveId(), replacement.id);
+    expect(
+      (await storage.loadAll()).map((community) => community.id),
+      contains(replacement.id),
+    );
+  });
+
+  test('waits for transition teardown before removing credentials', () async {
+    final storage = CommunityStorage(secure: FakeSecureStorage());
+    final community = Community.create(
+      name: 'Active',
+      relayUrl: 'https://relay.example',
+      nsec: nostr.Keys.generate().nsec,
+    );
+    await storage.save(community);
+    await storage.saveActiveId(community.id);
+    final container = ProviderContainer(
+      overrides: [communityStorageProvider.overrideWithValue(storage)],
+    );
+    addTearDown(container.dispose);
+    await container.read(authProvider.future);
+    final teardown = Completer<void>();
+    container.read(communityTransitionProvider).register(() => teardown.future);
+
+    final signingOut = container.read(authProvider.notifier).signOut();
+    await Future<void>.delayed(Duration.zero);
+
+    expect(await storage.loadActiveId(), community.id);
+    final saved = await storage.loadAll();
+    expect(saved, hasLength(1));
+    expect(saved.single.id, community.id);
+    teardown.complete();
+    await signingOut;
+    expect(await storage.loadActiveId(), isNull);
+    expect(await storage.loadAll(), isEmpty);
+  });
+
+  test('serializes overlapping switch and sign-out mutations', () async {
+    final storage = CommunityStorage(secure: FakeSecureStorage());
+    final active = Community.create(
+      name: 'Active',
+      relayUrl: 'https://active.example',
+      nsec: nostr.Keys.generate().nsec,
+    );
+    final replacement = Community.create(
+      name: 'Replacement',
+      relayUrl: 'https://replacement.example',
+      nsec: nostr.Keys.generate().nsec,
+    );
+    await storage.save(active);
+    await storage.save(replacement);
+    await storage.saveActiveId(active.id);
+    final container = ProviderContainer(
+      overrides: [communityStorageProvider.overrideWithValue(storage)],
+    );
+    addTearDown(container.dispose);
+    await container.read(authProvider.future);
+    await container.read(communityListProvider.future);
+    final teardown = Completer<void>();
+    container.read(communityTransitionProvider).register(() => teardown.future);
+
+    final switching = container
+        .read(communityListProvider.notifier)
+        .switchCommunity(replacement.id);
+    final signingOut = container.read(authProvider.notifier).signOut();
+    await Future<void>.delayed(Duration.zero);
+
+    expect(await storage.loadActiveId(), active.id);
+    teardown.complete();
+    await Future.wait([switching, signingOut]);
+
+    expect(await storage.loadActiveId(), active.id);
+    expect(
+      (await storage.loadAll()).map((community) => community.id),
+      unorderedEquals([active.id]),
+    );
+    final auth = await container.read(authProvider.future);
+    expect(auth.status, AuthStatus.authenticated);
+    expect(auth.community?.id, active.id);
+  });
+
   test(
     'removes an invalid saved community instead of authenticating',
     () async {
diff --git a/mobile/test/shared/community/community_provider_test.dart b/mobile/test/shared/community/community_provider_test.dart
index c58e03c56ae..5396822b319 100644
--- a/mobile/test/shared/community/community_provider_test.dart
+++ b/mobile/test/shared/community/community_provider_test.dart
@@ -1,3 +1,5 @@
+import 'dart:async';
+
 import 'package:flutter_test/flutter_test.dart';
 import 'package:hooks_riverpod/hooks_riverpod.dart';
 import 'package:buzz/shared/community/community.dart';
@@ -63,6 +65,47 @@ void main() {
       expect(communities, isEmpty);
     });
 
+    test(
+      'waits for transition teardown before removing active community',
+      () async {
+        container = createContainer();
+        await container.read(communityListProvider.future);
+
+        final ws1 = Community.create(
+          name: 'One',
+          relayUrl: 'https://one.example.com',
+        );
+        final ws2 = Community.create(
+          name: 'Two',
+          relayUrl: 'https://two.example.com',
+        );
+        final notifier = container.read(communityListProvider.notifier);
+        await notifier.addCommunity(ws1);
+        await notifier.addCommunity(ws2);
+        await notifier.switchCommunity(ws1.id);
+        final teardown = Completer<void>();
+        container
+            .read(communityTransitionProvider)
+            .register(() => teardown.future);
+
+        final removing = notifier.removeCommunity(ws1.id);
+        await Future<void>.delayed(Duration.zero);
+
+        expect(await communityStorage.loadActiveId(), ws1.id);
+        expect(
+          (await communityStorage.loadAll()).map((community) => community.id),
+          contains(ws1.id),
+        );
+        teardown.complete();
+        await removing;
+        expect(await communityStorage.loadActiveId(), ws2.id);
+        expect(
+          (await communityStorage.loadAll()).map((community) => community.id),
+          isNot(contains(ws1.id)),
+        );
+      },
+    );
+
     test('renameCommunity updates name', () async {
       container = createContainer();
       await container.read(communityListProvider.future);
@@ -80,6 +123,101 @@ void main() {
       expect(communities.first.name, 'Renamed');
     });
 
+    test('waits for transition teardown before updating active ID', () async {
+      container = createContainer();
+      await container.read(communityListProvider.future);
+
+      final ws1 = Community.create(
+        name: 'One',
+        relayUrl: 'https://one.example.com',
+      );
+      final ws2 = Community.create(
+        name: 'Two',
+        relayUrl: 'https://two.example.com',
+      );
+      final notifier = container.read(communityListProvider.notifier);
+      await notifier.addCommunity(ws1);
+      await notifier.addCommunity(ws2);
+      await notifier.switchCommunity(ws1.id);
+      final teardown = Completer<void>();
+      container
+          .read(communityTransitionProvider)
+          .register(() => teardown.future);
+
+      final switching = notifier.switchCommunity(ws2.id);
+      await Future<void>.delayed(Duration.zero);
+
+      expect(await communityStorage.loadActiveId(), ws1.id);
+      teardown.complete();
+      await switching;
+      expect(await communityStorage.loadActiveId(), ws2.id);
+    });
+
+    test('overlapping transitions share one callback run', () async {
+      container = createContainer();
+      final coordinator = container.read(communityTransitionProvider);
+      final teardown = Completer<void>();
+      var calls = 0;
+      coordinator.register(() {
+        calls++;
+        return teardown.future;
+      });
+
+      var firstCompleted = false;
+      var secondCompleted = false;
+      final first = coordinator.run().then((_) => firstCompleted = true);
+      final second = coordinator.run().then((_) => secondCompleted = true);
+      await Future<void>.delayed(Duration.zero);
+
+      expect(calls, 1);
+      expect(firstCompleted, isFalse);
+      expect(secondCompleted, isFalse);
+      teardown.complete();
+      await Future.wait([first, second]);
+      expect(firstCompleted, isTrue);
+      expect(secondCompleted, isTrue);
+    });
+
+    test('a later transition starts a new callback run', () async {
+      container = createContainer();
+      final coordinator = container.read(communityTransitionProvider);
+      var calls = 0;
+      coordinator.register(() async => calls++);
+
+      await coordinator.run();
+      await coordinator.run();
+
+      expect(calls, 2);
+    });
+
+    test(
+      'transition callback failure does not block the active ID update',
+      () async {
+        container = createContainer();
+        await container.read(communityListProvider.future);
+
+        final ws1 = Community.create(
+          name: 'One',
+          relayUrl: 'https://one.example.com',
+        );
+        final ws2 = Community.create(
+          name: 'Two',
+          relayUrl: 'https://two.example.com',
+        );
+        final notifier = container.read(communityListProvider.notifier);
+        await notifier.addCommunity(ws1);
+        await notifier.addCommunity(ws2);
+        await notifier.switchCommunity(ws1.id);
+        container.read(communityTransitionProvider).register(() async {
+          throw StateError('native cleanup failed');
+        });
+
+        await notifier.switchCommunity(ws2.id);
+
+        expect(await communityStorage.loadActiveId(), ws2.id);
+      },
+    );
+
     test('switchCommunity updates active ID', () async {
       container = createContainer();
       await container.read(communityListProvider.future);
diff --git a/mobile/test/shared/huddle/huddle_media_test.dart b/mobile/test/shared/huddle/huddle_media_test.dart
new file mode 100644
index 00000000000..b805abb1cab
--- /dev/null
+++ b/mobile/test/shared/huddle/huddle_media_test.dart
@@ -0,0 +1,171 @@
+import 'package:buzz/shared/huddle/huddle_media.dart';
+import 'package:flutter/services.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+void main() {
+  TestWidgetsFlutterBinding.ensureInitialized();
+  const channel = MethodChannel(huddleMediaMethodChannelName);
+  final messenger =
+      TestDefaultBinaryMessengerBinding.instance.defaultBinaryMessenger;
+
+  tearDown(() {
+    messenger.setMockMethodCallHandler(channel, null);
+  });
+
+  test(
+    'prepares the fixed v3 audio session without overstating codecs',
+    () async {
+      final calls = <MethodCall>[];
+      messenger.setMockMethodCallHandler(channel, (call) async {
+        calls.add(call);
+        return switch (call.method) {
+          'getCapabilities' => {
+            'platform': 'android',
+            'audioSession': true,
+            'microphonePermission': true,
+            'capture': false,
+            'playback': false,
+            'opusEncoding': false,
+            'opusDecoding': false,
+          },
+          'requestMicrophonePermission' => 'granted',
+          'prepare' => {'audioSessionPrepared': true},
+          'stop' => null,
+          _ => throw MissingPluginException(),
+        };
+      });
+      final media = MethodChannelHuddleMedia(channel: channel);
+      addTearDown(media.dispose);
+
+      final capabilities = await media.discoverCapabilities();
+      expect(capabilities.supportsAudioSession, isTrue);
+      expect(capabilities.supportsFullDuplexOpus, isFalse);
+      expect(
+        await media.requestMicrophonePermission(),
+        HuddleMicrophonePermission.granted,
+      );
+      await media.prepare();
+
+      expect(media.state.phase, HuddleMediaPhase.prepared);
+      final prepare = calls.singleWhere((call) => call.method == 'prepare');
+      expect(prepare.arguments, {
+        'protocolVersion': 3,
+        'sampleRateHz': 48000,
+        'channels': 1,
+        'frameSamples': 960,
+      });
+      await expectLater(
+        media.start(),
+        throwsA(
+          isA<HuddleMediaError>().having(
+            (error) => error.code,
+            'code',
+            HuddleMediaErrorCode.unsupported,
+          ),
+        ),
+      );
+      expect(media.state.phase, HuddleMediaPhase.prepared);
+    },
+  );
+
+  test('reports a missing native implementation as unavailable', () async {
+    final media = MethodChannelHuddleMedia(channel: channel);
+    addTearDown(media.dispose);
+
+    final capabilities = await media.discoverCapabilities();
+
+    expect(capabilities, same(HuddleMediaCapabilities.unavailable));
+    expect(media.state.phase, HuddleMediaPhase.unavailable);
+  });
+
+  test('opens system settings and reports the native launch result', () async {
+    var invoked = 0;
+    messenger.setMockMethodCallHandler(channel, (call) async {
+      invoked += 1;
+      expect(call.method, 'openSystemSettings');
+      return true;
+    });
+    final media = MethodChannelHuddleMedia(channel: channel);
+    addTearDown(media.dispose);
+
+    expect(await media.openSystemSettings(), isTrue);
+    expect(invoked, 1);
+  });
+
+  test('missing native settings support degrades to not launched', () async {
+    final media = MethodChannelHuddleMedia(channel: channel);
+    addTearDown(media.dispose);
+
+    expect(await media.openSystemSettings(), isFalse);
+  });
+
+  test('starts unmuted and forwards direct mute and speaker changes', () async {
+    final calls = <MethodCall>[];
+    messenger.setMockMethodCallHandler(channel, (call) async {
+      calls.add(call);
+      return switch (call.method) {
+        'getCapabilities' => {
+          'platform': 'android',
+          'audioSession': true,
+          'microphonePermission': true,
+          'capture': true,
+          'playback': true,
+          'opusEncoding': true,
+          'opusDecoding': true,
+        },
+        'prepare' => {'audioSessionPrepared': true},
+        'start' || 'setMuted' || 'setSpeakerEnabled' || 'stop' => null,
+        _ => throw MissingPluginException(),
+      };
+    });
+    final media = MethodChannelHuddleMedia(channel: channel);
+    addTearDown(media.dispose);
+
+    await media.discoverCapabilities();
+    await media.prepare();
+    await media.start();
+    expect(media.state.isMuted, isFalse);
+    expect(media.state.isSpeakerEnabled, isFalse);
+
+    await media.setMuted(true);
+
+    expect(media.state.phase, HuddleMediaPhase.active);
+    expect(media.state.isMuted, isTrue);
+    expect(calls.singleWhere((call) => call.method == 'setMuted').arguments, {
+      'muted': true,
+    });
+
+    await media.setSpeakerEnabled(true);
+
+    expect(media.state.isSpeakerEnabled, isTrue);
+    expect(
+      calls.singleWhere((call) => call.method == 'setSpeakerEnabled').arguments,
+      {'enabled': true},
+    );
+  });
+
+  test('parses aggregate capture diagnostics without audio content', () {
+    final diagnostics = HuddleCaptureDiagnostics.fromMap({
+      'frameCount': 50,
+      'rmsDbovHistogram': {'-42': 30, '-36': 20},
+      'peakDbovHistogram': {'-24': 40, '-18': 10},
+      'maxPeakDbov': -18,
+      'audioSource': 7,
+      'audioSourceLabel': 'voice_communication',
+      'deviceId': 4,
+      'deviceType': 1,
+      'deviceLabel': 'Pixel microphone',
+      'acousticEchoCancelerAvailable': true,
+      'acousticEchoCancelerEnabled': true,
+      'noiseSuppressorAvailable': true,
+      'noiseSuppressorEnabled': true,
+      'automaticGainControlAvailable': true,
+      'automaticGainControlEnabled': false,
+    });
+
+    expect(diagnostics.rmsDbovHistogram, {-42: 30, -36: 20});
+    expect(diagnostics.peakDbovHistogram, {-24: 40, -18: 10});
+    expect(diagnostics.maxPeakDbov, -18);
+    expect(diagnostics.debugSummary, contains('voice_communication'));
+  });
+}
diff --git a/mobile/test/shared/huddle/huddle_session_test.dart b/mobile/test/shared/huddle/huddle_session_test.dart
new file mode 100644
index 00000000000..650771d8de0
--- /dev/null
+++ b/mobile/test/shared/huddle/huddle_session_test.dart
@@ -0,0 +1,597 @@
+import 'dart:async';
+import 'dart:collection';
+import 'dart:typed_data';
+
+import 'package:buzz/shared/huddle/huddle.dart';
+import 'package:flutter_test/flutter_test.dart';
+import 'package:hooks_riverpod/hooks_riverpod.dart';
+
+const _privateKey =
+    '09b3065e3570a3a4054660dccd66e12774a99a904fdb0ca02dbc6c3136249506';
+const _parentChannelId = '11111111-2222-4333-8444-555555555555';
+const _ephemeralChannelId = 'aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee';
+
+void main() {
+  test('joins unmuted and bridges remote and local Opus frames', () async {
+    final media = _FakeMedia();
+    final transport = _FakeTransport();
+    final container = ProviderContainer(
+      overrides: [
+        huddleMediaFactoryProvider.overrideWithValue(() => media),
+        huddleTransportFactoryProvider.overrideWithValue((_) => transport),
+      ],
+    );
+    addTearDown(container.dispose);
+    final controller = container.read(huddleSessionProvider.notifier);
+
+    await controller.join(
+      _parameters(),
+      currentPubkey: 'mobile',
+      isCreator: true,
+      startedEventId: 'start-event',
+    );
+
+    expect(
+      container.read(huddleSessionProvider).phase,
+      HuddleSessionPhase.connected,
+    );
+    expect(container.read(huddleSessionProvider).isMuted, isFalse);
+    expect(container.read(huddleSessionProvider).participantCount, 2);
+    expect(container.read(huddleSessionProvider).participantPubkeys, [
+      'desktop',
+      'mobile',
+    ]);
+    expect(container.read(huddleSessionProvider).isCreator, isTrue);
+
+    final remote = HuddleRemoteAudioFrame(
+      peerIndex: 1,
+      epoch: 0,
+      header: const HuddleAudioHeader(
+        sequence: 3,
+        timestamp48k: 960,
+        levelDbov: -30,
+        flags: 0,
+      ),
+      opusPayload: Uint8List.fromList([1, 2, 3]),
+    );
+    transport.emitRemote(remote);
+    await Future<void>.delayed(Duration.zero);
+    expect(media.playedFrames, [remote]);
+    expect(container.read(huddleSessionProvider).receivedFrameCount, 1);
+    expect(
+      container.read(huddleSessionProvider).activeSpeakerPubkeys,
+      contains('desktop'),
+    );
+    expect(
+      container.read(huddleSessionProvider).speakerLevels['desktop'],
+      closeTo(25 / 55, 0.001),
+    );
+
+    media.emitLocal(
+      HuddleLocalAudioFrame(
+        header: const HuddleAudioHeader(
+          sequence: 4,
+          timestamp48k: 1920,
+          levelDbov: -20,
+          flags: 0,
+        ),
+        opusPayload: Uint8List.fromList([4, 5]),
+      ),
+    );
+
+    expect(transport.sentFrames.single.opusPayload, [4, 5]);
+    expect(container.read(huddleSessionProvider).sentFrameCount, 1);
+    expect(container.read(huddleSessionProvider).isMuted, isFalse);
+    expect(
+      container.read(huddleSessionProvider).speakerLevels['mobile'],
+      closeTo(35 / 55, 0.001),
+    );
+
+    await controller.setMuted(true);
+    media.emitLocal(
+      HuddleLocalAudioFrame(
+        header: const HuddleAudioHeader(
+          sequence: 5,
+          timestamp48k: 2880,
+          levelDbov: -20,
+          flags: 0,
+        ),
+        opusPayload: Uint8List.fromList([6, 7]),
+      ),
+    );
+    expect(transport.sentFrames, hasLength(1));
+    expect(container.read(huddleSessionProvider).isMuted, isTrue);
+
+    await controller.setSpeakerEnabled(true);
+    expect(container.read(huddleSessionProvider).isSpeakerEnabled, isTrue);
+    expect(media.state.isSpeakerEnabled, isTrue);
+    await controller.leave();
+  });
+
+  test('bounds playback per peer, drops oldest, and drains fairly', () async {
+    final media = _FakeMedia(blockPlayback: true);
+    final transport = _FakeTransport();
+    final container = ProviderContainer(
+      overrides: [
+        huddleMediaFactoryProvider.overrideWithValue(() => media),
+        huddleTransportFactoryProvider.overrideWithValue((_) => transport),
+      ],
+    );
+    addTearDown(container.dispose);
+    await container.read(huddleSessionProvider.notifier).join(_parameters());
+
+    for (var sequence = 0; sequence < 20; sequence++) {
+      transport.emitRemote(_remoteFrame(peerIndex: 1, sequence: sequence));
+    }
+    transport.emitRemote(_remoteFrame(peerIndex: 2, sequence: 100));
+    await Future<void>.delayed(Duration.zero);
+    expect(media.playedFrames.single.header.sequence, 0);
+
+    media.releaseNextPlayback();
+    await _waitUntil(() => media.playedFrames.length == 2);
+    expect(media.playedFrames[1].peerIndex, 2);
+    media.releaseNextPlayback();
+    await _waitUntil(() => media.playedFrames.length == 3);
+    expect(media.playedFrames[2].header.sequence, 10);
+  });
+
+  test('peer replacement clears queued and native playback first', () async {
+    final media = _FakeMedia(blockPlayback: true);
+    final transport = _FakeTransport();
+    final container = ProviderContainer(
+      overrides: [
+        huddleMediaFactoryProvider.overrideWithValue(() => media),
+        huddleTransportFactoryProvider.overrideWithValue((_) => transport),
+      ],
+    );
+    addTearDown(container.dispose);
+    await container.read(huddleSessionProvider.notifier).join(_parameters());
+
+    transport.emitRemote(_remoteFrame(peerIndex: 1, sequence: 1));
+    transport.emitRemote(_remoteFrame(peerIndex: 1, sequence: 2));
+    transport.emitReplacement(
+      const HuddlePeer(pubkey: 'desktop', peerIndex: 1, epoch: 0),
+      const HuddlePeer(pubkey: 'new', peerIndex: 1, epoch: 1),
+    );
+    await Future<void>.delayed(Duration.zero);
+    expect(media.removedPeers, [1]);
+
+    media.releaseNextPlayback();
+    await Future<void>.delayed(Duration.zero);
+    expect(media.playedFrames.map((frame) => frame.header.sequence), [1]);
+  });
+
+  test('keeps media alive through a bounded transport reconnect', () async {
+    final media = _FakeMedia();
+    final transport = _FakeTransport();
+    final container = ProviderContainer(
+      overrides: [
+        huddleMediaFactoryProvider.overrideWithValue(() => media),
+        huddleTransportFactoryProvider.overrideWithValue((_) => transport),
+        huddleReconnectDelaysProvider.overrideWithValue(const [Duration.zero]),
+      ],
+    );
+    addTearDown(container.dispose);
+
+    await container.read(huddleSessionProvider.notifier).join(_parameters());
+    transport.emitUnexpectedFailure();
+    await _waitUntil(() => transport.connectCalls == 2);
+
+    expect(
+      container.read(huddleSessionProvider).phase,
+      HuddleSessionPhase.connected,
+    );
+    expect(media.startCalls, 1);
+  });
+
+  test('surfaces native audio interruptions without leaving', () async {
+    final media = _FakeMedia();
+    final transport = _FakeTransport();
+    final container = ProviderContainer(
+      overrides: [
+        huddleMediaFactoryProvider.overrideWithValue(() => media),
+        huddleTransportFactoryProvider.overrideWithValue((_) => transport),
+      ],
+    );
+    addTearDown(container.dispose);
+
+    await container.read(huddleSessionProvider.notifier).join(_parameters());
+    media.emitInterrupted(true);
+    expect(
+      container.read(huddleSessionProvider).phase,
+      HuddleSessionPhase.interrupted,
+    );
+    media.emitInterrupted(false);
+    expect(
+      container.read(huddleSessionProvider).phase,
+      HuddleSessionPhase.connected,
+    );
+  });
+
+  test('permission denial is an explicit failed state', () async {
+    final media = _FakeMedia(permission: HuddleMicrophonePermission.denied);
+    final transport = _FakeTransport();
+    final container = ProviderContainer(
+      overrides: [
+        huddleMediaFactoryProvider.overrideWithValue(() => media),
+        huddleTransportFactoryProvider.overrideWithValue((_) => transport),
+      ],
+    );
+    addTearDown(container.dispose);
+
+    await container.read(huddleSessionProvider.notifier).join(_parameters());
+
+    final state = container.read(huddleSessionProvider);
+    expect(state.phase, HuddleSessionPhase.failed);
+    expect(state.error, contains('Microphone permission'));
+    expect(state.microphonePermissionRequired, isTrue);
+    expect(state.wasAdmitted, isFalse);
+    expect(transport.connectCalls, 0);
+  });
+
+  test(
+    'openMicrophoneSettings delegates to the media settings launcher',
+    () async {
+      final media = _FakeMedia(permission: HuddleMicrophonePermission.denied);
+      final transport = _FakeTransport();
+      final container = ProviderContainer(
+        overrides: [
+          huddleMediaFactoryProvider.overrideWithValue(() => media),
+          huddleTransportFactoryProvider.overrideWithValue((_) => transport),
+        ],
+      );
+      addTearDown(container.dispose);
+
+      await container.read(huddleSessionProvider.notifier).join(_parameters());
+      // The failed join disposed its media, so recovery uses a transient one.
+      final notifier = container.read(huddleSessionProvider.notifier);
+      expect(await notifier.openMicrophoneSettings(), isTrue);
+    },
+  );
+
+  test(
+    'native failure releases media and transport before publishing failure',
+    () async {
+      final release = Completer<void>();
+      final media = _FakeMedia(disposeGate: release.future);
+      final transport = _FakeTransport();
+      final container = ProviderContainer(
+        overrides: [
+          huddleMediaFactoryProvider.overrideWithValue(() => media),
+          huddleTransportFactoryProvider.overrideWithValue((_) => transport),
+        ],
+      );
+      addTearDown(container.dispose);
+
+      await container.read(huddleSessionProvider.notifier).join(_parameters());
+      media.emitFailure();
+      await Future<void>.delayed(Duration.zero);
+
+      expect(media.disposeCalls, 1);
+      expect(transport.disposeCalls, 0);
+      expect(
+        container.read(huddleSessionProvider).phase,
+        HuddleSessionPhase.connected,
+      );
+
+      release.complete();
+      await _waitUntil(
+        () =>
+            container.read(huddleSessionProvider).phase ==
+            HuddleSessionPhase.failed,
+      );
+      expect(transport.disposeCalls, 1);
+    },
+  );
+
+  test(
+    'retains admission evidence after an established transport fails',
+    () async {
+      final media = _FakeMedia();
+      final transport = _FakeTransport();
+      final container = ProviderContainer(
+        overrides: [
+          huddleMediaFactoryProvider.overrideWithValue(() => media),
+          huddleTransportFactoryProvider.overrideWithValue((_) => transport),
+          huddleReconnectDelaysProvider.overrideWithValue(const []),
+        ],
+      );
+      addTearDown(container.dispose);
+
+      await container
+          .read(huddleSessionProvider.notifier)
+          .join(_parameters(), currentPubkey: 'mobile');
+      expect(container.read(huddleSessionProvider).wasAdmitted, isTrue);
+
+      transport.emitUnexpectedFailure();
+      await _waitUntil(
+        () =>
+            container.read(huddleSessionProvider).phase ==
+            HuddleSessionPhase.failed,
+      );
+
+      expect(container.read(huddleSessionProvider).wasAdmitted, isTrue);
+    },
+  );
+}
+
+HuddleRemoteAudioFrame _remoteFrame({
+  required int peerIndex,
+  required int sequence,
+  int epoch = 0,
+}) => HuddleRemoteAudioFrame(
+  peerIndex: peerIndex,
+  epoch: epoch,
+  header: HuddleAudioHeader(
+    sequence: sequence,
+    timestamp48k: sequence * 960,
+    levelDbov: -20,
+    flags: 0,
+  ),
+  opusPayload: Uint8List.fromList([sequence & 0xff]),
+);
+
+HuddleConnectionParameters _parameters() => HuddleConnectionParameters(
+  relayWebSocketUrl: 'wss://buzz.example',
+  nsec: _privateKey,
+  parentChannelId: _parentChannelId,
+  ephemeralChannelId: _ephemeralChannelId,
+);
+
+final class _FakeMedia implements HuddleMedia {
+  _FakeMedia({
+    this.permission = HuddleMicrophonePermission.granted,
+    this.blockPlayback = false,
+    this.disposeGate,
+  });
+
+  final HuddleMicrophonePermission permission;
+  final bool blockPlayback;
+  final Future<void>? disposeGate;
+  final _states = StreamController<HuddleMediaState>.broadcast(sync: true);
+  final _localFrames = StreamController<HuddleLocalAudioFrame>.broadcast(
+    sync: true,
+  );
+  final List<HuddleRemoteAudioFrame> playedFrames = [];
+  final List<int> removedPeers = [];
+  final Queue<Completer<void>> _playbackCompleters = Queue();
+  HuddleMediaState _state = const HuddleMediaState(
+    phase: HuddleMediaPhase.idle,
+  );
+  var startCalls = 0;
+  var disposeCalls = 0;
+
+  void emitLocal(HuddleLocalAudioFrame frame) => _localFrames.add(frame);
+
+  void emitInterrupted(bool interrupted) {
+    _state = HuddleMediaState(
+      phase: HuddleMediaPhase.active,
+      capabilities: _state.capabilities,
+      isMuted: _state.isMuted,
+      isSpeakerEnabled: _state.isSpeakerEnabled,
+      isInterrupted: interrupted,
+    );
+    _states.add(_state);
+  }
+
+  void emitFailure() {
+    _state = HuddleMediaState(
+      phase: HuddleMediaPhase.failed,
+      capabilities: _state.capabilities,
+      error: const HuddleMediaError(
+        code: HuddleMediaErrorCode.platformFailure,
+        message: 'native playback failed',
+      ),
+    );
+    _states.add(_state);
+  }
+
+  @override
+  HuddleMediaState get state => _state;
+
+  @override
+  Stream<HuddleMediaState> get states => _states.stream;
+
+  @override
+  Stream<HuddleLocalAudioFrame> get localAudioFrames => _localFrames.stream;
+
+  @override
+  Future<HuddleMediaCapabilities> discoverCapabilities() async {
+    const capabilities = HuddleMediaCapabilities(
+      platform: 'test',
+      supportsAudioSession: true,
+      supportsMicrophonePermission: true,
+      supportsCapture: true,
+      supportsPlayback: true,
+      supportsOpusEncoding: true,
+      supportsOpusDecoding: true,
+    );
+    _state = const HuddleMediaState(
+      phase: HuddleMediaPhase.idle,
+      capabilities: capabilities,
+    );
+    return capabilities;
+  }
+
+  @override
+  Future<HuddleMicrophonePermission> requestMicrophonePermission() async =>
+      permission;
+
+  var openSettingsCalls = 0;
+  bool openSettingsResult = true;
+
+  @override
+  Future<bool> openSystemSettings() async {
+    openSettingsCalls += 1;
+    return openSettingsResult;
+  }
+
+  @override
+  Future<void> prepare() async {
+    _state = HuddleMediaState(
+      phase: HuddleMediaPhase.prepared,
+      capabilities: _state.capabilities,
+    );
+    _states.add(_state);
+  }
+
+  @override
+  Future<void> start() async {
+    startCalls += 1;
+    _state = HuddleMediaState(
+      phase: HuddleMediaPhase.active,
+      capabilities: _state.capabilities,
+    );
+    _states.add(_state);
+  }
+
+  @override
+  Future<void> setMuted(bool muted) async {
+    _state = HuddleMediaState(
+      phase: HuddleMediaPhase.active,
+      capabilities: _state.capabilities,
+      isMuted: muted,
+    );
+    _states.add(_state);
+  }
+
+  @override
+  Future<void> setSpeakerEnabled(bool enabled) async {
+    _state = HuddleMediaState(
+      phase: HuddleMediaPhase.active,
+      capabilities: _state.capabilities,
+      isMuted: _state.isMuted,
+      isSpeakerEnabled: enabled,
+    );
+    _states.add(_state);
+  }
+
+  @override
+  Future<void> playRemoteFrame(HuddleRemoteAudioFrame frame) async {
+    playedFrames.add(frame);
+    if (blockPlayback) {
+      final completer = Completer<void>();
+      _playbackCompleters.addLast(completer);
+      await completer.future;
+    }
+  }
+
+  void releaseNextPlayback() => _playbackCompleters.removeFirst().complete();
+
+  @override
+  Future<void> removeRemotePeer(int peerIndex) async {
+    removedPeers.add(peerIndex);
+  }
+
+  @override
+  Future<void> stop() async {
+    _state = HuddleMediaState(
+      phase: HuddleMediaPhase.stopped,
+      capabilities: _state.capabilities,
+    );
+    _states.add(_state);
+  }
+
+  @override
+  Future<void> dispose() async {
+    disposeCalls += 1;
+    if (disposeGate case final gate?) await gate;
+    await stop();
+  }
+}
+
+final class _FakeTransport implements HuddleTransportClient {
+  final _states = StreamController<HuddleTransportState>.broadcast(sync: true);
+  final _remoteFrames = StreamController<HuddleRemoteAudioFrame>.broadcast(
+    sync: true,
+  );
+  final _peerEvents = StreamController<HuddlePeerEvent>.broadcast(sync: true);
+  final _issues = StreamController<HuddleTransportError>.broadcast(sync: true);
+  final List<HuddleLocalAudioFrame> sentFrames = [];
+  var connectCalls = 0;
+  var disposeCalls = 0;
+  HuddleTransportState _state = HuddleTransportState.idle();
+
+  void emitRemote(HuddleRemoteAudioFrame frame) => _remoteFrames.add(frame);
+
+  void emitReplacement(HuddlePeer peer, HuddlePeer replacement) {
+    _peerEvents.add(
+      HuddlePeerEvent(
+        type: HuddlePeerEventType.replaced,
+        peer: peer,
+        replacement: replacement,
+      ),
+    );
+  }
+
+  void emitUnexpectedFailure() {
+    _state = HuddleTransportState(
+      phase: HuddleTransportPhase.failed,
+      peers: _state.peers,
+      error: const HuddleTransportError(
+        code: HuddleTransportErrorCode.socketClosed,
+        message: 'socket closed',
+      ),
+    );
+    _states.add(_state);
+  }
+
+  @override
+  HuddleTransportState get state => _state;
+
+  @override
+  Stream<HuddleTransportState> get states => _states.stream;
+
+  @override
+  Stream<HuddleRemoteAudioFrame> get remoteAudioFrames => _remoteFrames.stream;
+
+  @override
+  Stream<HuddlePeerEvent> get peerEvents => _peerEvents.stream;
+
+  @override
+  Stream<HuddleTransportError> get issues => _issues.stream;
+
+  @override
+  Future<void> connect() async {
+    connectCalls += 1;
+    _state = HuddleTransportState(
+      phase: HuddleTransportPhase.connected,
+      localPeerIndex: 2,
+      peers: const {
+        1: HuddlePeer(pubkey: 'desktop', peerIndex: 1, epoch: 0),
+        2: HuddlePeer(pubkey: 'mobile', peerIndex: 2, epoch: 0),
+      },
+    );
+    _states.add(_state);
+  }
+
+  @override
+  void sendOpusFrame({
+    required HuddleAudioHeader header,
+    required Uint8List opusPayload,
+  }) {
+    sentFrames.add(
+      HuddleLocalAudioFrame(header: header, opusPayload: opusPayload),
+    );
+  }
+
+  @override
+  Future<void> disconnect() async {
+    _state = HuddleTransportState(phase: HuddleTransportPhase.disconnected);
+    _states.add(_state);
+  }
+
+  @override
+  Future<void> dispose() async {
+    disposeCalls += 1;
+    await disconnect();
+  }
+}
+
+Future<void> _waitUntil(bool Function() predicate) async {
+  for (var i = 0; i < 100; i++) {
+    if (predicate()) return;
+    await Future<void>.delayed(Duration.zero);
+  }
+  fail('Timed out waiting for asynchronous Huddle state');
+}
diff --git a/mobile/test/shared/huddle/huddle_transport_test.dart b/mobile/test/shared/huddle/huddle_transport_test.dart
new file mode 100644
index 00000000000..ce2d288a8e5
--- /dev/null
+++ b/mobile/test/shared/huddle/huddle_transport_test.dart
@@ -0,0 +1,905 @@
+import 'dart:async';
+import 'dart:convert';
+import 'dart:typed_data';
+
+import 'package:buzz/shared/huddle/huddle_auth.dart';
+import 'package:buzz/shared/huddle/huddle_transport.dart';
+import 'package:buzz/shared/huddle/huddle_wire.dart';
+import 'package:flutter_test/flutter_test.dart';
+import 'package:web_socket_channel/web_socket_channel.dart';
+
+const _privateKey =
+    '09b3065e3570a3a4054660dccd66e12774a99a904fdb0ca02dbc6c3136249506';
+const _parentChannelId = '11111111-2222-4333-8444-555555555555';
+const _ephemeralChannelId = 'aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee';
+
+void main() {
+  test('authenticates with object JSON and admits a v3 room', () async {
+    final channel = _ControlledWebSocketChannel();
+    final transport = _transport(channel);
+    addTearDown(transport.dispose);
+
+    final connect = transport.connect();
+    await _waitForPhase(transport, HuddleTransportPhase.awaitingChallenge);
+    channel.emitText(jsonEncode({'type': 'challenge', 'challenge': 'abc'}));
+    await _waitForPhase(transport, HuddleTransportPhase.authenticating);
+
+    final auth = jsonDecode(channel.sink.sent.single as String);
+    expect(auth, isA<Map<String, dynamic>>());
+    expect(auth['type'], 'auth');
+    expect(auth['parent_channel_id'], _parentChannelId);
+    expect(auth['protocol_version'], 3);
+
+    channel.emitText(
+      jsonEncode({
+        'type': 'joined',
+        'pubkey': 'self',
+        'peer_index': 3,
+        'peers': [
+          {'pubkey': 'desktop', 'peer_index': 1},
+        ],
+      }),
+    );
+    await connect;
+
+    expect(transport.state.phase, HuddleTransportPhase.connected);
+    expect(transport.state.localPeerIndex, 3);
+    expect(transport.state.peers.keys, containsAll([1, 3]));
+  });
+
+  test(
+    'parses inbound relay media and encodes outbound client media',
+    () async {
+      final channel = _ControlledWebSocketChannel();
+      final transport = _transport(channel);
+      addTearDown(transport.dispose);
+      await _connect(
+        channel,
+        transport,
+        peers: const [
+          {'pubkey': 'remote', 'peer_index': 4},
+        ],
+      );
+
+      final inbound = expectLater(
+        transport.remoteAudioFrames,
+        emits(
+          isA<HuddleRemoteAudioFrame>()
+              .having((frame) => frame.peerIndex, 'peer index', 4)
+              .having((frame) => frame.epoch, 'epoch', 0)
+              .having((frame) => frame.header.sequence, 'sequence', 9)
+              .having((frame) => frame.opusPayload, 'Opus', [0xaa]),
+        ),
+      );
+      channel.emitBinary(
+        Uint8List.fromList([4, 0, 0, 9, 0, 0, 3, 0xc0, 0xd8, 0, 0xaa]),
+      );
+      await inbound;
+
+      transport.sendOpusFrame(
+        header: const HuddleAudioHeader(
+          sequence: 10,
+          timestamp48k: 1920,
+          levelDbov: -40,
+          flags: 0,
+        ),
+        opusPayload: Uint8List.fromList([0xbb]),
+      );
+      expect(
+        channel.sink.sent.last,
+        Uint8List.fromList([0, 10, 0, 0, 7, 0x80, 0xd8, 0, 0xbb]),
+      );
+    },
+  );
+
+  test('surfaces malformed media as recoverable issue', () async {
+    final channel = _ControlledWebSocketChannel();
+    final transport = _transport(channel);
+    addTearDown(transport.dispose);
+    await _connect(channel, transport);
+
+    final issue = expectLater(
+      transport.issues,
+      emits(
+        isA<HuddleTransportError>().having(
+          (error) => error.code,
+          'code',
+          HuddleTransportErrorCode.protocolViolation,
+        ),
+      ),
+    );
+    channel.emitBinary(Uint8List.fromList([1, 2, 3]));
+    await issue;
+
+    expect(transport.state.phase, HuddleTransportPhase.connected);
+  });
+
+  test(
+    'revisioned roster is authoritative and deltas are sequential',
+    () async {
+      final channel = _ControlledWebSocketChannel();
+      final transport = _transport(channel);
+      addTearDown(transport.dispose);
+      await _connect(
+        channel,
+        transport,
+        revision: 4,
+        peers: const [
+          {'pubkey': 'desktop', 'peer_index': 1},
+        ],
+      );
+      expect(transport.state.peers.keys, [1]);
+      expect(transport.state.rosterRevision, 4);
+
+      channel.emitText(
+        jsonEncode({
+          'type': 'joined',
+          'revision': 5,
+          'pubkey': 'agent',
+          'peer_index': 2,
+          'peers': [
+            {'pubkey': 'agent', 'peer_index': 2},
+          ],
+        }),
+      );
+      await _waitForRevision(transport, 5);
+      expect(transport.state.peers.keys, containsAll([1, 2]));
+
+      channel.emitText(
+        jsonEncode({
+          'type': 'roster',
+          'revision': 6,
+          'peers': [
+            {'pubkey': 'replacement', 'peer_index': 2},
+          ],
+        }),
+      );
+      await _waitForRevision(transport, 6);
+      expect(transport.state.peers.keys, [2]);
+      expect(transport.state.peers[2]?.pubkey, 'replacement');
+
+      channel.emitText(
+        jsonEncode({'type': 'roster', 'revision': 5, 'peers': const []}),
+      );
+      await Future<void>.delayed(Duration.zero);
+      expect(transport.state.rosterRevision, 6);
+      expect(transport.state.peers[2]?.pubkey, 'replacement');
+    },
+  );
+
+  test(
+    'newer roster arriving before admission remains authoritative',
+    () async {
+      final channel = _ControlledWebSocketChannel();
+      final transport = _transport(channel);
+      addTearDown(transport.dispose);
+
+      final connect = transport.connect();
+      await _waitForPhase(transport, HuddleTransportPhase.awaitingChallenge);
+      channel.emitText(jsonEncode({'type': 'challenge', 'challenge': 'abc'}));
+      await _waitForPhase(transport, HuddleTransportPhase.authenticating);
+      channel.emitText(
+        jsonEncode({
+          'type': 'roster',
+          'revision': 6,
+          'peers': [
+            {'pubkey': 'new', 'peer_index': 4},
+          ],
+        }),
+      );
+      channel.emitText(
+        jsonEncode({
+          'type': 'joined',
+          'revision': 5,
+          'pubkey': 'self',
+          'peer_index': 3,
+          'peers': [
+            {'pubkey': 'old', 'peer_index': 1},
+          ],
+        }),
+      );
+      await connect;
+
+      expect(transport.state.localPeerIndex, 3);
+      expect(transport.state.rosterRevision, 6);
+      expect(transport.state.peers.keys, [4]);
+      expect(transport.state.peers[4]?.pubkey, 'new');
+    },
+  );
+
+  test('revision gap reconnects without applying the gap', () async {
+    final channel = _ControlledWebSocketChannel();
+    final transport = _transport(channel);
+    addTearDown(transport.dispose);
+    await _connect(
+      channel,
+      transport,
+      revision: 2,
+      peers: const [
+        {'pubkey': 'desktop', 'peer_index': 1},
+      ],
+    );
+
+    channel.emitText(
+      jsonEncode({
+        'type': 'left',
+        'revision': 4,
+        'pubkey': 'desktop',
+        'peer_index': 1,
+      }),
+    );
+    await _waitForPhase(transport, HuddleTransportPhase.failed);
+
+    expect(transport.state.rosterRevision, 2);
+    expect(transport.state.peers[1]?.pubkey, 'desktop');
+    expect(transport.state.error?.message, contains('revision gap'));
+  });
+
+  test('revisioned admission does not inject an absent local user', () async {
+    final channel = _ControlledWebSocketChannel();
+    final transport = _transport(channel);
+    addTearDown(transport.dispose);
+    await _connect(
+      channel,
+      transport,
+      revision: 8,
+      peers: const [
+        {'pubkey': 'desktop', 'peer_index': 1},
+      ],
+    );
+
+    expect(transport.state.localPeerIndex, 3);
+    expect(transport.state.peers.keys, [1]);
+  });
+
+  test('revisioned joined delta reports index reuse', () async {
+    final channel = _ControlledWebSocketChannel();
+    final transport = _transport(channel);
+    addTearDown(transport.dispose);
+    await _connect(
+      channel,
+      transport,
+      revision: 1,
+      peers: const [
+        {'pubkey': 'old', 'peer_index': 4},
+      ],
+    );
+    final events = <HuddlePeerEvent>[];
+    final subscription = transport.peerEvents.listen(events.add);
+    addTearDown(subscription.cancel);
+
+    channel.emitText(
+      jsonEncode({
+        'type': 'joined',
+        'revision': 2,
+        'pubkey': 'new',
+        'peer_index': 4,
+        'peers': [
+          {'pubkey': 'new', 'peer_index': 4},
+        ],
+      }),
+    );
+    await _waitForRevision(transport, 2);
+
+    expect(events.single.type, HuddlePeerEventType.replaced);
+    expect(events.single.peer.pubkey, 'old');
+    expect(events.single.replacement?.pubkey, 'new');
+    expect(transport.state.peers[4]?.pubkey, 'new');
+  });
+
+  test('revisioned joined delta reports same-pubkey epoch reuse', () async {
+    final channel = _ControlledWebSocketChannel();
+    final transport = _transport(channel);
+    addTearDown(transport.dispose);
+    await _connect(
+      channel,
+      transport,
+      revision: 1,
+      peers: const [
+        {'pubkey': 'same', 'peer_index': 4, 'epoch': 2},
+      ],
+    );
+    final events = <HuddlePeerEvent>[];
+    final subscription = transport.peerEvents.listen(events.add);
+    addTearDown(subscription.cancel);
+
+    channel.emitText(
+      jsonEncode({
+        'type': 'joined',
+        'revision': 2,
+        'pubkey': 'same',
+        'peer_index': 4,
+        'epoch': 3,
+        'peers': [
+          {'pubkey': 'same', 'peer_index': 4, 'epoch': 3},
+        ],
+      }),
+    );
+    await _waitForRevision(transport, 2);
+
+    expect(events.single.type, HuddlePeerEventType.replaced);
+    expect(events.single.peer.epoch, 2);
+    expect(events.single.replacement?.epoch, 3);
+  });
+
+  test('index replacement is emitted before new media is admitted', () async {
+    final channel = _ControlledWebSocketChannel();
+    final transport = _transport(channel);
+    addTearDown(transport.dispose);
+    await _connect(
+      channel,
+      transport,
+      revision: 1,
+      peers: const [
+        {'pubkey': 'old', 'peer_index': 4},
+      ],
+    );
+    final events = <HuddlePeerEvent>[];
+    final subscription = transport.peerEvents.listen(events.add);
+    addTearDown(subscription.cancel);
+
+    channel.emitText(
+      jsonEncode({
+        'type': 'roster',
+        'revision': 2,
+        'peers': [
+          {'pubkey': 'new', 'peer_index': 4},
+        ],
+      }),
+    );
+    await _waitForRevision(transport, 2);
+
+    expect(events.single.type, HuddlePeerEventType.replaced);
+    expect(events.single.peer.pubkey, 'old');
+    expect(events.single.replacement?.pubkey, 'new');
+  });
+
+  test('exposes relay rejection code and failed lifecycle state', () async {
+    final channel = _ControlledWebSocketChannel();
+    final transport = _transport(channel);
+    addTearDown(transport.dispose);
+
+    final connect = transport.connect();
+    await _waitForPhase(transport, HuddleTransportPhase.awaitingChallenge);
+    channel.emitText(jsonEncode({'type': 'challenge', 'challenge': 'abc'}));
+    await _waitForPhase(transport, HuddleTransportPhase.authenticating);
+    channel.emitText(
+      jsonEncode({
+        'type': 'error',
+        'code': 'upgrade_required',
+        'message': 'room is pinned to v1',
+      }),
+    );
+
+    await expectLater(
+      connect,
+      throwsA(
+        isA<HuddleTransportError>()
+            .having(
+              (error) => error.code,
+              'code',
+              HuddleTransportErrorCode.relayRejected,
+            )
+            .having(
+              (error) => error.relayCode,
+              'relay code',
+              'upgrade_required',
+            ),
+      ),
+    );
+    expect(transport.state.phase, HuddleTransportPhase.failed);
+  });
+
+  test('bounds transport audio ingress', () async {
+    final channel = _ControlledWebSocketChannel();
+    final transport = _transport(channel);
+    addTearDown(transport.dispose);
+    await _connect(
+      channel,
+      transport,
+      revision: 1,
+      peers: const [
+        {'pubkey': 'remote', 'peer_index': 4},
+      ],
+    );
+    final received = <int>[];
+    final drained = Completer<void>();
+    final subscription = transport.remoteAudioFrames.listen((frame) {
+      received.add(frame.header.sequence);
+      if (frame.header.sequence == 99 && !drained.isCompleted) {
+        drained.complete();
+      }
+    });
+    addTearDown(subscription.cancel);
+
+    for (var sequence = 0; sequence < 100; sequence++) {
+      channel.emitBinary(_relayFrame(peerIndex: 4, sequence: sequence));
+    }
+    await drained.future.timeout(const Duration(seconds: 1));
+
+    expect(received, hasLength(50));
+    expect(received.first, 50);
+    expect(received.last, 99);
+  });
+
+  test(
+    'authoritative left purges queued media before same-index rejoin',
+    () async {
+      final channel = _ControlledWebSocketChannel();
+      final transport = _transport(channel);
+      addTearDown(transport.dispose);
+      await _connect(
+        channel,
+        transport,
+        revision: 1,
+        peers: const [
+          {'pubkey': 'old', 'peer_index': 4},
+        ],
+      );
+      final received = <int>[];
+      final subscription = transport.remoteAudioFrames.listen(
+        (frame) => received.add(frame.header.sequence),
+      );
+      addTearDown(subscription.cancel);
+
+      for (var sequence = 0; sequence < 50; sequence++) {
+        channel.emitBinary(_relayFrame(peerIndex: 4, sequence: sequence));
+      }
+      channel.emitText(
+        jsonEncode({
+          'type': 'left',
+          'revision': 2,
+          'pubkey': 'old',
+          'peer_index': 4,
+        }),
+      );
+      channel.emitText(
+        jsonEncode({
+          'type': 'joined',
+          'revision': 3,
+          'pubkey': 'new',
+          'peer_index': 4,
+        }),
+      );
+      channel.emitBinary(_relayFrame(peerIndex: 4, sequence: 50));
+      await _waitForRevision(transport, 3);
+      await Future<void>.delayed(const Duration(milliseconds: 20));
+
+      expect(transport.state.peers[4]?.pubkey, 'new');
+      expect(received, [50]);
+    },
+  );
+
+  test(
+    'stale-epoch frame is fenced after its index is reused by a new occupant',
+    () async {
+      // Blocker 1 causal race: a frame authored by the prior occupant of an
+      // index can be queued in the relay's data path and delivered *after* the
+      // roster control that reassigns the index. Index-only fencing would
+      // mis-attribute it to the new occupant; the epoch rejects it.
+      final channel = _ControlledWebSocketChannel();
+      final transport = _transport(channel);
+      addTearDown(transport.dispose);
+      await _connect(
+        channel,
+        transport,
+        revision: 1,
+        peers: const [
+          {'pubkey': 'old', 'peer_index': 4, 'epoch': 0},
+        ],
+      );
+      final received = <int>[];
+      final subscription = transport.remoteAudioFrames.listen(
+        (frame) => received.add(frame.header.sequence),
+      );
+      addTearDown(subscription.cancel);
+
+      // 'old' (epoch 0) leaves and 'new' reuses index 4 at epoch 1.
+      channel.emitText(
+        jsonEncode({
+          'type': 'joined',
+          'revision': 2,
+          'pubkey': 'new',
+          'peer_index': 4,
+          'epoch': 1,
+          'peers': [
+            {'pubkey': 'new', 'peer_index': 4, 'epoch': 1},
+          ],
+        }),
+      );
+      await _waitForRevision(transport, 2);
+      expect(transport.state.peers[4]?.pubkey, 'new');
+      expect(transport.state.peers[4]?.epoch, 1);
+
+      // A residual frame from 'old' (epoch 0) arrives after the reassignment.
+      // It must be dropped, not delivered as 'new' audio.
+      channel.emitBinary(_relayFrame(peerIndex: 4, epoch: 0, sequence: 7));
+      // A legitimate 'new' frame (epoch 1) is delivered.
+      channel.emitBinary(_relayFrame(peerIndex: 4, epoch: 1, sequence: 8));
+      await Future<void>.delayed(const Duration(milliseconds: 20));
+
+      expect(received, [8]);
+    },
+  );
+
+  test(
+    're-admission reports departed and reused peer indexes before new media',
+    () async {
+      final firstChannel = _ControlledWebSocketChannel();
+      final secondChannel = _ControlledWebSocketChannel();
+      var connection = 0;
+      final transport = HuddleTransport(
+        parameters: HuddleConnectionParameters(
+          relayWebSocketUrl: 'wss://buzz.example',
+          nsec: _privateKey,
+          parentChannelId: _parentChannelId,
+          ephemeralChannelId: _ephemeralChannelId,
+        ),
+        channelFactory: (_) => connection++ == 0 ? firstChannel : secondChannel,
+        connectTimeout: const Duration(seconds: 1),
+        handshakeTimeout: const Duration(seconds: 1),
+      );
+      addTearDown(transport.dispose);
+      await _connect(
+        firstChannel,
+        transport,
+        revision: 1,
+        peers: const [
+          {'pubkey': 'old', 'peer_index': 4},
+          {'pubkey': 'departed', 'peer_index': 5},
+        ],
+      );
+      final events = <HuddlePeerEvent>[];
+      final subscription = transport.peerEvents.listen(events.add);
+      addTearDown(subscription.cancel);
+
+      firstChannel.emitError(StateError('socket lost'));
+      await _waitForPhase(transport, HuddleTransportPhase.failed);
+      final reconnect = transport.connect();
+      await _waitForPhase(transport, HuddleTransportPhase.awaitingChallenge);
+      secondChannel.emitText(
+        jsonEncode({'type': 'challenge', 'challenge': 'reconnect'}),
+      );
+      await _waitForPhase(transport, HuddleTransportPhase.authenticating);
+      secondChannel.emitText(
+        jsonEncode({
+          'type': 'joined',
+          'revision': 4,
+          'pubkey': 'self',
+          'peer_index': 3,
+          'peers': [
+            {'pubkey': 'new', 'peer_index': 4},
+            {'pubkey': 'self', 'peer_index': 3},
+          ],
+        }),
+      );
+      await reconnect;
+
+      expect(transport.state.peers[4]?.pubkey, 'new');
+      expect(events, hasLength(2));
+      expect(events[0].type, HuddlePeerEventType.replaced);
+      expect(events[0].peer.pubkey, 'old');
+      expect(events[0].replacement?.pubkey, 'new');
+      expect(events[1].type, HuddlePeerEventType.left);
+      expect(events[1].peer.pubkey, 'departed');
+    },
+  );
+
+  test('re-admission resets same-pubkey slot when its epoch changes', () async {
+    final firstChannel = _ControlledWebSocketChannel();
+    final secondChannel = _ControlledWebSocketChannel();
+    var connection = 0;
+    final transport = HuddleTransport(
+      parameters: HuddleConnectionParameters(
+        relayWebSocketUrl: 'wss://buzz.example',
+        nsec: _privateKey,
+        parentChannelId: _parentChannelId,
+        ephemeralChannelId: _ephemeralChannelId,
+      ),
+      channelFactory: (_) => connection++ == 0 ? firstChannel : secondChannel,
+      connectTimeout: const Duration(seconds: 1),
+      handshakeTimeout: const Duration(seconds: 1),
+    );
+    addTearDown(transport.dispose);
+    await _connect(
+      firstChannel,
+      transport,
+      revision: 1,
+      peers: const [
+        {'pubkey': 'same', 'peer_index': 4, 'epoch': 0},
+      ],
+    );
+    final events = <HuddlePeerEvent>[];
+    final subscription = transport.peerEvents.listen(events.add);
+    addTearDown(subscription.cancel);
+
+    firstChannel.emitError(StateError('relay restarted'));
+    await _waitForPhase(transport, HuddleTransportPhase.failed);
+    final reconnect = transport.connect();
+    await _waitForPhase(transport, HuddleTransportPhase.awaitingChallenge);
+    secondChannel.emitText(
+      jsonEncode({'type': 'challenge', 'challenge': 'reconnect'}),
+    );
+    await _waitForPhase(transport, HuddleTransportPhase.authenticating);
+    secondChannel.emitText(
+      jsonEncode({
+        'type': 'joined',
+        'revision': 1,
+        'pubkey': 'self',
+        'peer_index': 3,
+        'epoch': 0,
+        'peers': [
+          {'pubkey': 'same', 'peer_index': 4, 'epoch': 1},
+          {'pubkey': 'self', 'peer_index': 3, 'epoch': 0},
+        ],
+      }),
+    );
+    await reconnect;
+
+    expect(events, hasLength(1));
+    expect(events.single.type, HuddlePeerEventType.replaced);
+    expect(events.single.peer.epoch, 0);
+    expect(events.single.replacement?.epoch, 1);
+  });
+
+  test('re-admission resets same slot even when its epoch is reused', () async {
+    final firstChannel = _ControlledWebSocketChannel();
+    final secondChannel = _ControlledWebSocketChannel();
+    var connection = 0;
+    final transport = HuddleTransport(
+      parameters: HuddleConnectionParameters(
+        relayWebSocketUrl: 'wss://buzz.example',
+        nsec: _privateKey,
+        parentChannelId: _parentChannelId,
+        ephemeralChannelId: _ephemeralChannelId,
+      ),
+      channelFactory: (_) => connection++ == 0 ? firstChannel : secondChannel,
+      connectTimeout: const Duration(seconds: 1),
+      handshakeTimeout: const Duration(seconds: 1),
+    );
+    addTearDown(transport.dispose);
+    await _connect(
+      firstChannel,
+      transport,
+      revision: 9,
+      peers: const [
+        {'pubkey': 'same', 'peer_index': 4, 'epoch': 0},
+      ],
+    );
+    final events = <HuddlePeerEvent>[];
+    final subscription = transport.peerEvents.listen(events.add);
+    addTearDown(subscription.cancel);
+
+    firstChannel.emitError(StateError('relay restarted'));
+    await _waitForPhase(transport, HuddleTransportPhase.failed);
+    final reconnect = transport.connect();
+    await _waitForPhase(transport, HuddleTransportPhase.awaitingChallenge);
+    secondChannel.emitText(
+      jsonEncode({'type': 'challenge', 'challenge': 'reconnect'}),
+    );
+    await _waitForPhase(transport, HuddleTransportPhase.authenticating);
+    secondChannel.emitText(
+      jsonEncode({
+        'type': 'joined',
+        'revision': 1,
+        'pubkey': 'self',
+        'peer_index': 3,
+        'epoch': 0,
+        'peers': [
+          {'pubkey': 'same', 'peer_index': 4, 'epoch': 0},
+          {'pubkey': 'self', 'peer_index': 3, 'epoch': 0},
+        ],
+      }),
+    );
+    await reconnect;
+
+    expect(events, hasLength(1));
+    expect(events.single.type, HuddlePeerEventType.replaced);
+    expect(events.single.peer.pubkey, 'same');
+    expect(events.single.replacement?.pubkey, 'same');
+    expect(events.single.replacement?.epoch, 0);
+  });
+
+  test('re-admission accepts a lower revision after relay restart', () async {
+    final firstChannel = _ControlledWebSocketChannel();
+    final secondChannel = _ControlledWebSocketChannel();
+    var connection = 0;
+    final transport = HuddleTransport(
+      parameters: HuddleConnectionParameters(
+        relayWebSocketUrl: 'wss://buzz.example',
+        nsec: _privateKey,
+        parentChannelId: _parentChannelId,
+        ephemeralChannelId: _ephemeralChannelId,
+      ),
+      channelFactory: (_) => connection++ == 0 ? firstChannel : secondChannel,
+      connectTimeout: const Duration(seconds: 1),
+      handshakeTimeout: const Duration(seconds: 1),
+    );
+    addTearDown(transport.dispose);
+    await _connect(
+      firstChannel,
+      transport,
+      revision: 9,
+      peers: const [
+        {'pubkey': 'stale', 'peer_index': 4},
+      ],
+    );
+
+    firstChannel.emitError(StateError('relay restarted'));
+    await _waitForPhase(transport, HuddleTransportPhase.failed);
+    final reconnect = transport.connect();
+    await _waitForPhase(transport, HuddleTransportPhase.awaitingChallenge);
+    secondChannel.emitText(
+      jsonEncode({'type': 'challenge', 'challenge': 'reconnect'}),
+    );
+    await _waitForPhase(transport, HuddleTransportPhase.authenticating);
+    secondChannel.emitText(
+      jsonEncode({
+        'type': 'joined',
+        'revision': 1,
+        'pubkey': 'self',
+        'peer_index': 3,
+        'peers': [
+          {'pubkey': 'fresh', 'peer_index': 4},
+          {'pubkey': 'self', 'peer_index': 3},
+        ],
+      }),
+    );
+    await reconnect;
+
+    expect(transport.state.rosterRevision, 1);
+    expect(transport.state.peers[4]?.pubkey, 'fresh');
+    secondChannel.emitText(
+      jsonEncode({
+        'type': 'joined',
+        'revision': 2,
+        'pubkey': 'next',
+        'peer_index': 5,
+      }),
+    );
+    await _waitForRevision(transport, 2);
+    expect(transport.state.peers[5]?.pubkey, 'next');
+  });
+
+  test(
+    'intentional disconnect reaches disconnected without an error',
+    () async {
+      final channel = _ControlledWebSocketChannel();
+      final transport = _transport(channel);
+      addTearDown(transport.dispose);
+      await _connect(channel, transport);
+
+      await transport.disconnect();
+
+      expect(transport.state.phase, HuddleTransportPhase.disconnected);
+      expect(transport.state.error, isNull);
+    },
+  );
+}
+
+HuddleTransport _transport(_ControlledWebSocketChannel channel) =>
+    HuddleTransport(
+      parameters: HuddleConnectionParameters(
+        relayWebSocketUrl: 'wss://buzz.example',
+        nsec: _privateKey,
+        parentChannelId: _parentChannelId,
+        ephemeralChannelId: _ephemeralChannelId,
+      ),
+      channelFactory: (_) => channel,
+      connectTimeout: const Duration(seconds: 1),
+      handshakeTimeout: const Duration(seconds: 1),
+    );
+
+Future<void> _connect(
+  _ControlledWebSocketChannel channel,
+  HuddleTransport transport, {
+  int? revision,
+  List<Map<String, Object>> peers = const [],
+}) async {
+  final connect = transport.connect();
+  await _waitForPhase(transport, HuddleTransportPhase.awaitingChallenge);
+  channel.emitText(jsonEncode({'type': 'challenge', 'challenge': 'abc'}));
+  await _waitForPhase(transport, HuddleTransportPhase.authenticating);
+  final admission = <String, Object>{
+    'type': 'joined',
+    'pubkey': 'self',
+    'peer_index': 3,
+    'peers': peers,
+  };
+  if (revision != null) admission['revision'] = revision;
+  channel.emitText(jsonEncode(admission));
+  await connect;
+}
+
+Uint8List _relayFrame({
+  required int peerIndex,
+  required int sequence,
+  int epoch = 0,
+}) {
+  final header = HuddleAudioHeader(
+    sequence: sequence,
+    timestamp48k: sequence * 960,
+    levelDbov: -30,
+    flags: 0,
+  );
+  final clientFrame = HuddleWireV3.encodeClientFrame(
+    header,
+    Uint8List.fromList([sequence & 0xff]),
+  );
+  return Uint8List.fromList([peerIndex, epoch, ...clientFrame]);
+}
+
+Future<void> _waitForPhase(
+  HuddleTransport transport,
+  HuddleTransportPhase phase,
+) async {
+  for (var attempt = 0; attempt < 100; attempt++) {
+    if (transport.state.phase == phase) return;
+    await Future<void>.delayed(const Duration(milliseconds: 1));
+  }
+  fail('Transport never reached ${phase.name}; was ${transport.state.phase}.');
+}
+
+Future<void> _waitForRevision(HuddleTransport transport, int revision) async {
+  for (var attempt = 0; attempt < 100; attempt++) {
+    if (transport.state.rosterRevision == revision) return;
+    await Future<void>.delayed(const Duration(milliseconds: 1));
+  }
+  fail(
+    'Transport never reached roster revision $revision; '
+    'was ${transport.state.rosterRevision}.',
+  );
+}
+
+final class _ControlledWebSocketChannel implements WebSocketChannel {
+  final StreamController<dynamic> _streamController = StreamController();
+  final _RecordingWebSocketSink _sink = _RecordingWebSocketSink();
+
+  void emitText(String value) => _streamController.add(value);
+  void emitBinary(Uint8List value) => _streamController.add(value);
+  void emitError(Object error) => _streamController.addError(error);
+
+  @override
+  Future<void> get ready => Future.value();
+
+  @override
+  Stream<dynamic> get stream => _streamController.stream;
+
+  @override
+  _RecordingWebSocketSink get sink => _sink;
+
+  @override
+  int? get closeCode => null;
+
+  @override
+  String? get closeReason => null;
+
+  @override
+  String? get protocol => null;
+
+  @override
+  dynamic noSuchMethod(Invocation invocation) => super.noSuchMethod(invocation);
+}
+
+final class _RecordingWebSocketSink implements WebSocketSink {
+  final List<dynamic> sent = [];
+
+  @override
+  void add(dynamic event) => sent.add(event);
+
+  @override
+  void addError(Object error, [StackTrace? stackTrace]) {}
+
+  @override
+  Future<void> addStream(Stream<dynamic> stream) async {
+    await for (final event in stream) {
+      sent.add(event);
+    }
+  }
+
+  @override
+  Future<void> close([int? closeCode, String? closeReason]) async {}
+
+  @override
+  Future<void> get done => Future.value();
+}
diff --git a/mobile/test/shared/huddle/huddle_wire_test.dart b/mobile/test/shared/huddle/huddle_wire_test.dart
new file mode 100644
index 00000000000..1b992e481bb
--- /dev/null
+++ b/mobile/test/shared/huddle/huddle_wire_test.dart
@@ -0,0 +1,147 @@
+import 'dart:typed_data';
+
+import 'package:buzz/shared/huddle/huddle_auth.dart';
+import 'package:buzz/shared/huddle/huddle_wire.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+const _privateKey =
+    '09b3065e3570a3a4054660dccd66e12774a99a904fdb0ca02dbc6c3136249506';
+const _parentChannelId = '11111111-2222-4333-8444-555555555555';
+const _ephemeralChannelId = 'aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee';
+
+void main() {
+  group('HuddleWireV3', () {
+    test('encodes the desktop-compatible big-endian v3 golden frame', () {
+      const header = HuddleAudioHeader(
+        sequence: 0x1234,
+        timestamp48k: 0x01020304,
+        levelDbov: -42,
+        flags: HuddleWireV3.dtxFlag,
+      );
+
+      expect(
+        HuddleWireV3.encodeClientFrame(
+          header,
+          Uint8List.fromList([0xaa, 0xbb]),
+        ),
+        [0x12, 0x34, 0x01, 0x02, 0x03, 0x04, 0xd6, 0x01, 0xaa, 0xbb],
+      );
+    });
+
+    test('decodes peer prefix, v2 header, and Opus payload', () {
+      final frame = HuddleWireV3.decodeRelayFrame(
+        Uint8List.fromList([
+          0x07,
+          0x00,
+          0x12,
+          0x34,
+          0x01,
+          0x02,
+          0x03,
+          0x04,
+          0xd6,
+          0x01,
+          0xaa,
+          0xbb,
+        ]),
+      );
+
+      expect(frame.peerIndex, 7);
+      expect(frame.epoch, 0);
+      expect(frame.header.sequence, 0x1234);
+      expect(frame.header.timestamp48k, 0x01020304);
+      expect(frame.header.levelDbov, -42);
+      expect(frame.header.isDtx, isTrue);
+      expect(frame.opusPayload, [0xaa, 0xbb]);
+    });
+
+    test('coerces invalid positive dBov telemetry to the silent floor', () {
+      final header = HuddleAudioHeader.decode(
+        Uint8List.fromList([0, 1, 0, 0, 3, 0xc0, 1, 0]),
+      );
+
+      expect(header.levelDbov, -127);
+    });
+
+    test('checked headers enforce wire ranges outside debug assertions', () {
+      expect(
+        () => HuddleAudioHeader.checked(
+          sequence: -1,
+          timestamp48k: 0,
+          levelDbov: -127,
+          flags: 0,
+        ),
+        throwsRangeError,
+      );
+    });
+
+    test('rejects empty and oversized payloads', () {
+      const header = HuddleAudioHeader(
+        sequence: 0,
+        timestamp48k: 0,
+        levelDbov: -127,
+        flags: 0,
+      );
+
+      expect(
+        () => HuddleWireV3.encodeClientFrame(header, Uint8List(0)),
+        throwsA(isA<HuddleWireException>()),
+      );
+      expect(
+        () => HuddleWireV3.encodeClientFrame(
+          header,
+          Uint8List(HuddleWireV3.maxBinaryFrameLength),
+        ),
+        throwsA(isA<HuddleWireException>()),
+      );
+    });
+  });
+
+  group('HuddleAuthV3', () {
+    test('uses the base relay URL and fixed v3 auth envelope', () {
+      final parameters = HuddleConnectionParameters(
+        relayWebSocketUrl: 'wss://buzz.example',
+        nsec: _privateKey,
+        parentChannelId: _parentChannelId,
+        ephemeralChannelId: _ephemeralChannelId,
+      );
+
+      final auth = HuddleAuthV3.buildMessage(
+        parameters: parameters,
+        challenge: 'relay-challenge',
+        createdAt: 1_700_000_000,
+      );
+      final event = auth['event']! as Map<String, dynamic>;
+      final tags = (event['tags']! as List<dynamic>)
+          .map((tag) => (tag as List<dynamic>).cast<String>())
+          .toList();
+
+      expect(auth['type'], 'auth');
+      expect(auth['protocol_version'], 3);
+      expect(auth['parent_channel_id'], _parentChannelId);
+      expect(event['kind'], 22242);
+      expect(tags[0], ['relay', 'wss://buzz.example']);
+      expect(tags[1], ['challenge', 'relay-challenge']);
+      expect(
+        parameters.audioWebSocketUri.toString(),
+        'wss://buzz.example/huddle/$_ephemeralChannelId/audio',
+      );
+      expect(
+        tags.any((tag) => tag.length > 1 && tag[1].contains('/huddle/')),
+        isFalse,
+      );
+    });
+
+    test('rejects malformed channel IDs before opening a socket', () {
+      expect(
+        () => HuddleConnectionParameters(
+          relayWebSocketUrl: 'wss://buzz.example',
+          nsec: _privateKey,
+          parentChannelId: 'not-a-channel',
+          ephemeralChannelId: _ephemeralChannelId,
+        ),
+        throwsArgumentError,
+      );
+    });
+  });
+}
diff --git a/mobile/test/shared/mentions/agent_identity_provider_test.dart b/mobile/test/shared/mentions/agent_identity_provider_test.dart
index 0ea0afb2687..f584aff0419 100644
--- a/mobile/test/shared/mentions/agent_identity_provider_test.dart
+++ b/mobile/test/shared/mentions/agent_identity_provider_test.dart
@@ -30,6 +30,7 @@ void main() {
     await relaySession.subscribed;
     expect(relaySession.liveFilters.single.kinds, const [39002]);
     expect(relaySession.liveFilters.single.tags['#h'], [_channelId]);
+    expect(relaySession.liveFilters.single.tags['#d'], isNull);
 
     relaySession.emit(_membershipEvent(role: 'member'));
     await _pumpEventQueue();
diff --git a/mobile/test/shared/theme/app_theme_test.dart b/mobile/test/shared/theme/app_theme_test.dart
index f038c6d9747..161d2cd8006 100644
--- a/mobile/test/shared/theme/app_theme_test.dart
+++ b/mobile/test/shared/theme/app_theme_test.dart
@@ -1,5 +1,6 @@
 import 'package:flutter/material.dart';
 import 'package:flutter_test/flutter_test.dart';
+import 'package:buzz/shared/theme/app_colors.dart';
 import 'package:buzz/shared/theme/app_theme.dart';
 
 void main() {
@@ -24,4 +25,16 @@ void main() {
     expect(side.color, Colors.black.withValues(alpha: 0.04));
     expect(side.width, 1);
   });
+
+  test('keeps inactive Huddle controls distinct in dark mode', () {
+    final colors = AppTheme.dark().extension<AppColors>()!;
+
+    expect(colors.huddleControlSurface, isNot(colors.huddleDrawerSurface));
+    expect(
+      (colors.huddleControlSurface.computeLuminance() -
+              colors.huddleDrawerSurface.computeLuminance())
+          .abs(),
+      greaterThan(0.02),
+    );
+  });
 }
diff --git a/mobile/test/shared/widgets/frosted_app_bar_test.dart b/mobile/test/shared/widgets/frosted_app_bar_test.dart
index bc17f66ee32..8f1f40a8b1b 100644
--- a/mobile/test/shared/widgets/frosted_app_bar_test.dart
+++ b/mobile/test/shared/widgets/frosted_app_bar_test.dart
@@ -1,6 +1,9 @@
 import 'package:buzz/shared/theme/theme.dart';
 import 'package:buzz/shared/widgets/frosted_app_bar.dart';
+import 'package:buzz/shared/widgets/ios_glass_navigation_button.dart';
 import 'package:flutter/material.dart';
+import 'package:flutter/foundation.dart';
+import 'package:flutter/rendering.dart';
 import 'package:flutter_test/flutter_test.dart';
 
 void main() {
@@ -83,4 +86,132 @@ void main() {
     expect(reportedHeight, closeTo(titleContentHeight + Grid.xs + 1, 0.01));
     expect(tester.takeException(), isNull);
   });
+
+  testWidgets('uses the native glass back control on iOS', (tester) async {
+    debugDefaultTargetPlatformOverride = TargetPlatform.iOS;
+    addTearDown(() => debugDefaultTargetPlatformOverride = null);
+
+    await tester.pumpWidget(
+      MaterialApp(
+        theme: AppTheme.light(),
+        home: Builder(
+          builder: (context) => TextButton(
+            onPressed: () => Navigator.of(context).push(
+              MaterialPageRoute<void>(
+                builder: (_) => const Stack(
+                  children: [
+                    FrostedAppBar(
+                      title: Text(
+                        'Destination',
+                        key: ValueKey('destination-title'),
+                      ),
+                    ),
+                  ],
+                ),
+              ),
+            ),
+            child: const Text('Open'),
+          ),
+        ),
+      ),
+    );
+
+    await tester.tap(find.text('Open'));
+    await tester.pumpAndSettle();
+
+    final nativeBack = tester.widget<UiKitView>(find.byType(UiKitView));
+    expect(nativeBack.viewType, 'buzz/navigation_glass');
+    expect(nativeBack.creationParams, containsPair('icon', 'back'));
+    expect(
+      nativeBack.creationParams,
+      containsPair('accessibilityLabel', 'Back'),
+    );
+    expect(
+      nativeBack.creationParams,
+      containsPair('buttonCenterX', iosGlassChannelHeaderButtonCenterX),
+    );
+    expect(
+      nativeBack.creationParams,
+      containsPair('hitTargetWidth', iosGlassChannelHeaderLeadingWidth),
+    );
+    expect(nativeBack.creationParams, containsPair('hitTargetHeight', 48.0));
+    final backRect = tester.getRect(find.byType(IosGlassNavigationButton));
+    final titleRect = tester.getRect(
+      find.byKey(const ValueKey('destination-title')),
+    );
+    expect(titleRect.left - backRect.right, iosGlassChannelHeaderTitleSpacing);
+    expect(find.byTooltip('Back'), findsOneWidget);
+    expect(
+      tester.widget<Tooltip>(find.byTooltip('Back')).excludeFromSemantics,
+      isTrue,
+    );
+    debugDefaultTargetPlatformOverride = null;
+  });
+
+  testWidgets('replaces native glass while a Flutter backdrop is active', (
+    tester,
+  ) async {
+    debugDefaultTargetPlatformOverride = TargetPlatform.iOS;
+    addTearDown(() => debugDefaultTargetPlatformOverride = null);
+    final suppressNativeView = ValueNotifier(false);
+    addTearDown(suppressNativeView.dispose);
+    var pressCount = 0;
+
+    await tester.pumpWidget(
+      MaterialApp(
+        theme: AppTheme.light(),
+        home: Scaffold(
+          body: IosGlassNavigationButton(
+            icon: IosGlassNavigationIcon.back,
+            semanticLabel: 'Back',
+            onPressed: () => pressCount++,
+            nativeViewSuppressed: suppressNativeView,
+          ),
+        ),
+      ),
+    );
+
+    expect(find.byType(UiKitView), findsOneWidget);
+    expect(
+      find.byKey(const ValueKey('ios-glass-navigation-flutter-fallback')),
+      findsNothing,
+    );
+    expect(find.bySemanticsLabel('Back'), findsNothing);
+
+    suppressNativeView.value = true;
+    await tester.pump();
+
+    expect(find.byType(UiKitView), findsNothing);
+    expect(
+      find.byKey(const ValueKey('ios-glass-navigation-flutter-fallback')),
+      findsOneWidget,
+    );
+    final fallbackFinder = find.bySemanticsLabel('Back');
+    expect(fallbackFinder, findsOneWidget);
+    final fallbackSemantics = tester.getSemantics(fallbackFinder);
+    expect(fallbackSemantics.flagsCollection.isButton, isTrue);
+    expect(
+      fallbackSemantics.flagsCollection.isEnabled.toString(),
+      'Tristate.isTrue',
+    );
+    expect(
+      fallbackSemantics.getSemanticsData().hasAction(SemanticsAction.tap),
+      isTrue,
+    );
+    tester.binding.performSemanticsAction(
+      SemanticsActionEvent(
+        type: SemanticsAction.tap,
+        viewId: tester.view.viewId,
+        nodeId: fallbackSemantics.id,
+      ),
+    );
+    await tester.pump();
+    expect(pressCount, 1);
+
+    suppressNativeView.value = false;
+    await tester.pump();
+
+    expect(find.byType(UiKitView), findsOneWidget);
+    debugDefaultTargetPlatformOverride = null;
+  });
 }
diff --git a/mobile/test/shared/widgets/modal_presentation_test.dart b/mobile/test/shared/widgets/modal_presentation_test.dart
index 85767e3f89c..6cd16189125 100644
--- a/mobile/test/shared/widgets/modal_presentation_test.dart
+++ b/mobile/test/shared/widgets/modal_presentation_test.dart
@@ -80,6 +80,141 @@ void main() {
     },
   );
 
+  testWidgets(
+    'native surfaces can limit concentric clipping to bottom corners',
+    (tester) async {
+      debugDefaultTargetPlatformOverride = TargetPlatform.iOS;
+      const surfaceChannel = MethodChannel('buzz/concentric_sheet_surface');
+      tester.binding.defaultBinaryMessenger.setMockMethodCallHandler(
+        surfaceChannel,
+        (call) async => call.method == 'isSupported' ? true : null,
+      );
+      try {
+        await tester.pumpWidget(
+          MaterialApp(
+            theme: AppTheme.light(),
+            home: const ConcentricSheetSurface(
+              enabled: true,
+              color: Colors.red,
+              backdropColor: Colors.black,
+              corners: ConcentricSurfaceCorners.bottom,
+              padding: EdgeInsets.zero,
+              providesSheetSurface: false,
+              child: SizedBox(height: 80, child: Text('App surface')),
+            ),
+          ),
+        );
+        await tester.pump();
+
+        final nativeSurface = tester.widget<UiKitView>(find.byType(UiKitView));
+        expect(nativeSurface.creationParams, containsPair('corners', 'bottom'));
+        expect(
+          nativeSurface.creationParams,
+          containsPair('backdropColor', Colors.black.toARGB32()),
+        );
+        final contentClip = tester.widget<ClipRSuperellipse>(
+          find.byKey(const ValueKey('concentric-sheet-content-clip')),
+        );
+        expect(
+          contentClip.borderRadius,
+          BorderRadius.vertical(bottom: Radius.circular(Radii.dialog * 2)),
+        );
+      } finally {
+        tester.binding.defaultBinaryMessenger.setMockMethodCallHandler(
+          surfaceChannel,
+          null,
+        );
+        debugDefaultTargetPlatformOverride = null;
+      }
+    },
+  );
+
+  testWidgets('native surface colors follow live theme changes', (
+    tester,
+  ) async {
+    debugDefaultTargetPlatformOverride = TargetPlatform.iOS;
+    const supportChannel = MethodChannel('buzz/concentric_sheet_surface');
+    const viewChannel = MethodChannel('buzz/concentric_sheet_surface/42');
+    final colorUpdates = <MethodCall>[];
+    tester.binding.defaultBinaryMessenger.setMockMethodCallHandler(
+      supportChannel,
+      (call) async => call.method == 'isSupported' ? true : null,
+    );
+    tester.binding.defaultBinaryMessenger.setMockMethodCallHandler(
+      viewChannel,
+      (call) async {
+        colorUpdates.add(call);
+        return null;
+      },
+    );
+
+    Widget themedSurface(ThemeData theme) => MaterialApp(
+      theme: theme,
+      home: Builder(
+        builder: (context) => ConcentricSheetSurface(
+          enabled: true,
+          color: context.colors.surface,
+          backdropColor: context.appColors.huddleDrawerSurface,
+          corners: ConcentricSurfaceCorners.bottom,
+          padding: EdgeInsets.zero,
+          providesSheetSurface: false,
+          child: const SizedBox(height: 80, child: Text('App surface')),
+        ),
+      ),
+    );
+
+    try {
+      final darkTheme = AppTheme.dark();
+      await tester.pumpWidget(themedSurface(darkTheme));
+      await tester.pump();
+      tester.widget<UiKitView>(find.byType(UiKitView)).onPlatformViewCreated!(
+        42,
+      );
+      await tester.pump();
+
+      expect(colorUpdates, hasLength(1));
+      expect(colorUpdates.single.method, 'updateColors');
+      expect(
+        colorUpdates.single.arguments,
+        containsPair('color', darkTheme.colorScheme.surface.toARGB32()),
+      );
+      expect(
+        colorUpdates.single.arguments,
+        containsPair(
+          'backdropColor',
+          darkTheme.extension<AppColors>()!.huddleDrawerSurface.toARGB32(),
+        ),
+      );
+
+      final lightTheme = AppTheme.light();
+      await tester.pumpWidget(themedSurface(lightTheme));
+      await tester.pumpAndSettle();
+
+      expect(colorUpdates.length, greaterThanOrEqualTo(2));
+      expect(
+        colorUpdates.last.arguments,
+        containsPair('color', lightTheme.colorScheme.surface.toARGB32()),
+      );
+      expect(
+        colorUpdates.last.arguments,
+        containsPair(
+          'backdropColor',
+          lightTheme.extension<AppColors>()!.huddleDrawerSurface.toARGB32(),
+        ),
+      );
+    } finally {
+      tester.binding.defaultBinaryMessenger.setMockMethodCallHandler(
+        supportChannel,
+        null,
+      );
+      tester.binding.defaultBinaryMessenger.setMockMethodCallHandler(
+        viewChannel,
+        null,
+      );
+      debugDefaultTargetPlatformOverride = null;
+    }
+  });
+
   testWidgets('native titled sheets leave the concentric surface unobscured', (
     tester,
   ) async {
@@ -111,7 +246,13 @@ void main() {
       await tester.tap(find.text('Open sheet'));
       await tester.pumpAndSettle();
 
-      final nativeSurface = tester.widget<UiKitView>(find.byType(UiKitView));
+      final nativeSurface = tester.widget<UiKitView>(
+        find.byWidgetPredicate(
+          (widget) =>
+              widget is UiKitView &&
+              widget.viewType == 'buzz/concentric_sheet_surface',
+        ),
+      );
       expect(
         nativeSurface.creationParams,
         containsPair('color', lightColorScheme.surface.toARGB32()),
@@ -131,6 +272,13 @@ void main() {
       expect(contentClip.borderRadius, BorderRadius.circular(Radii.dialog * 2));
       expect(contentClip.clipBehavior, Clip.antiAlias);
       expect(find.text('Members'), findsOneWidget);
+      final nativeClose = tester.widget<UiKitView>(
+        find.byWidgetPredicate(
+          (widget) =>
+              widget is UiKitView && widget.viewType == 'buzz/navigation_glass',
+        ),
+      );
+      expect(nativeClose.creationParams, containsPair('icon', 'close'));
     } finally {
       tester.binding.defaultBinaryMessenger.setMockMethodCallHandler(
         surfaceChannel,
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index c8be559938c..11fef7c534d 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -143,7 +143,7 @@ importers:
         version: 3.14.9(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       '@tauri-apps/api':
         specifier: ~2.11
-        version: 2.11.0
+        version: 2.11.1
       '@tauri-apps/plugin-notification':
         specifier: ^2.3.3
         version: 2.3.3
@@ -227,7 +227,7 @@ importers:
         version: 4.1.0
       sonner:
         specifier: ^2.0.7
-        version: 2.0.7(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+        version: 2.0.8(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       tailwind-merge:
         specifier: ^3.5.0
         version: 3.6.0
@@ -354,7 +354,7 @@ importers:
         version: 4.0.1
       sonner:
         specifier: ^2.0.7
-        version: 2.0.7(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+        version: 2.0.8(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       tailwind-merge:
         specifier: ^3.5.0
         version: 3.6.0
@@ -1772,8 +1772,8 @@ packages:
     resolution: {integrity: sha512-uhOeFyxLcU41HzvrxsGpiWdcMbScY1EDgbZ5K7DVRMYInbLYWAC0EA/kx9wXAoSM8q82bUG2hRl8+EAjE6XAbA==}
     engines: {node: '>=20.19'}
 
-  '@tauri-apps/api@2.11.0':
-    resolution: {integrity: sha512-7CinYODhky9lmO23xHnUFv0Xt43fbtWMyxZcLcRBlFkcgXKuEirBvHpmtJ89YMhyeGcq20Wuc47Fa4XjyniywA==}
+  '@tauri-apps/api@2.11.1':
+    resolution: {integrity: sha512-M2FPuYND2m+wh5hfW9ZpSdxMPdEJovPBWwoHJmwUpysTYNHaOkVFN419m/K0LIgjb/7KU2vBgsUepJWugQCvAA==}
 
   '@tauri-apps/cli-darwin-arm64@2.11.4':
     resolution: {integrity: sha512-1ryOF3ZhpZ/nemHV5zVwBQBz9jDGKmKPvWPADOhc83ig0P4bMc2iER4NbC6r9sjeIZ6RVQ4g3RZIYvezhcl4TQ==}
@@ -3347,11 +3347,15 @@ packages:
   simple-get@4.0.1:
     resolution: {integrity: sha512-brv7p5WgH0jmQJr1ZDDfKDOSeWWg+OVypG99A/5vYGPqJ6pxiaHLy8nxtFjBA7oMa01ebA9gfh1uMCFqOuXxvA==}
 
-  sonner@2.0.7:
-    resolution: {integrity: sha512-W6ZN4p58k8aDKA4XPcx2hpIQXBRAgyiWVkYhT7CvK6D3iAu7xjvVyhQHg2/iaKJZ1XVJ4r7XuwGL+WGEK37i9w==}
+  sonner@2.0.8:
+    resolution: {integrity: sha512-UM/ByIoFra8yzV75n1o0Puu0bw5U/9UNnDacrJNspekBewIfsQ3D6ez1nvlWpt7aTsO6rujQtifBpycwIivqlg==}
     peerDependencies:
+      '@types/react': ^18.0.0 || ^19.0.0
       react: ^18.0.0 || ^19.0.0 || ^19.0.0-rc
       react-dom: ^18.0.0 || ^19.0.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
 
   source-map-js@1.2.1:
     resolution: {integrity: sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==}
@@ -5019,7 +5023,7 @@ snapshots:
 
   '@tanstack/virtual-file-routes@1.162.0': {}
 
-  '@tauri-apps/api@2.11.0': {}
+  '@tauri-apps/api@2.11.1': {}
 
   '@tauri-apps/cli-darwin-arm64@2.11.4':
     optional: true
@@ -5070,19 +5074,19 @@ snapshots:
 
   '@tauri-apps/plugin-notification@2.3.3':
     dependencies:
-      '@tauri-apps/api': 2.11.0
+      '@tauri-apps/api': 2.11.1
 
   '@tauri-apps/plugin-opener@2.5.4':
     dependencies:
-      '@tauri-apps/api': 2.11.0
+      '@tauri-apps/api': 2.11.1
 
   '@tauri-apps/plugin-process@2.3.1':
     dependencies:
-      '@tauri-apps/api': 2.11.0
+      '@tauri-apps/api': 2.11.1
 
   '@tauri-apps/plugin-updater@2.10.1':
     dependencies:
-      '@tauri-apps/api': 2.11.0
+      '@tauri-apps/api': 2.11.1
 
   '@testing-library/dom@10.4.1':
     dependencies:
@@ -6812,10 +6816,12 @@ snapshots:
       once: 1.4.0
       simple-concat: 1.0.1
 
-  sonner@2.0.7(react-dom@19.2.8(react@19.2.8))(react@19.2.8):
+  sonner@2.0.8(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8):
     dependencies:
       react: 19.2.8
       react-dom: 19.2.8(react@19.2.8)
+    optionalDependencies:
+      '@types/react': 19.2.18
 
   source-map-js@1.2.1: {}
 
diff --git a/renovate.json b/renovate.json
index e827ca8a5af..ee07aae898d 100644
--- a/renovate.json
+++ b/renovate.json
@@ -34,6 +34,12 @@
       "matchManagers": ["cargo"],
       "groupName": "redis"
     },
+    {
+      "description": "earshot 1.2.x is a quantized re-implementation, not a tuning release: RNN weights move f32 -> i16 and the probability scale shifts, so the huddle VAD's calibrated threshold regresses at the shipped operating point (TPR 89.57% -> 88.46%, FPR 1.54% -> 2.79% on a matched 121-clip corpus). Unpin only together with a threshold re-pick against that corpus — see the VAD threshold constants in desktop/src-tauri/src/huddle/stt.rs.",
+      "matchPackageNames": ["earshot"],
+      "matchManagers": ["cargo"],
+      "allowedVersions": "<1.2.0"
+    },
     {
       "description": "tiptap 3.23.x breaks editor lifecycle under real relay latency — pin until upstream stabilizes.",
       "matchPackageNames": ["@tiptap/{/,}**"],
diff --git a/scripts/mobile-worktree-overrides.sh b/scripts/mobile-worktree-overrides.sh
index 176180db1e9..2390954ba1a 100755
--- a/scripts/mobile-worktree-overrides.sh
+++ b/scripts/mobile-worktree-overrides.sh
@@ -14,6 +14,11 @@
 #   mobile/android/worktree.properties             (debug build type only)
 # In the main checkout it removes any stale override files. Release and
 # profile builds never read these overrides.
+#
+# Android-only test builds can opt into a more explicit side-by-side identity:
+#   BUZZ_ANDROID_DEBUG_APP_NAME="Buzz Huddles"
+#   BUZZ_ANDROID_DEBUG_ID_SUFFIX=".huddles_829c"
+# Both values are validated before the generated properties file is written.
 set -euo pipefail
 
 # `just mobile-*` recipes unset these before invoking Flutter; do the same so
@@ -71,7 +76,18 @@ case "$android_slug" in
 esac
 
 ios_bundle_id="com.buzz.buzzMobile.${ios_slug}"
-android_suffix=".${android_slug}"
+android_app_name="${BUZZ_ANDROID_DEBUG_APP_NAME:-Buzz (${label})}"
+android_suffix="${BUZZ_ANDROID_DEBUG_ID_SUFFIX:-.${android_slug}}"
+
+if [[ "$android_app_name" == *$'\n'* || "$android_app_name" == *$'\r'* ]] || \
+    ! printf '%s\n' "$android_app_name" | LC_ALL=C grep -Eq '^[A-Za-z0-9._() -]+$'; then
+    echo "BUZZ_ANDROID_DEBUG_APP_NAME must contain only letters, numbers, spaces, ., _, -, or parentheses" >&2
+    exit 2
+fi
+if [[ ! "$android_suffix" =~ ^\.[a-z][a-z0-9_]*$ ]]; then
+    echo "BUZZ_ANDROID_DEBUG_ID_SUFFIX must match \\.[a-z][a-z0-9_]* (for example .huddles_829c)" >&2
+    exit 2
+fi
 
 cat > "$ios_overrides" <<XCCONFIG
 // Generated by scripts/mobile-worktree-overrides.sh — gitignored, do not edit.
@@ -85,9 +101,10 @@ cat > "$android_props" <<PROPERTIES
 # Generated by scripts/mobile-worktree-overrides.sh — gitignored, do not edit.
 # Applies to the debug build type only (read by android/app/build.gradle.kts).
 label=${label}
+appName=${android_app_name}
 applicationIdSuffix=${android_suffix}
 PROPERTIES
 
 # The printed identifiers are the generated defaults; on iOS a developer's
 # AppOverrides.xcconfig may override them per variable.
-echo "📱 Worktree ${worktree_name}: label \"${label}\" (iOS default ${ios_bundle_id}, Android suffix ${android_suffix})"
+echo "📱 Worktree ${worktree_name}: iOS label \"${label}\" (${ios_bundle_id}); Android label \"${android_app_name}\" (xyz.block.buzz.mobile${android_suffix})"
diff --git a/scripts/test-mobile-worktree-overrides.sh b/scripts/test-mobile-worktree-overrides.sh
index dccffd2ef2b..8a33acd6358 100755
--- a/scripts/test-mobile-worktree-overrides.sh
+++ b/scripts/test-mobile-worktree-overrides.sh
@@ -73,6 +73,9 @@ grep -q '^APP_DISPLAY_NAME = Buzz (Fix_Thing-2)$' "$ios" \
 grep -q '^label=Fix_Thing-2$' "$android" \
   && pass "Android label carries the branch label" \
   || fail "Android label wrong: $(cat "$android")"
+grep -q '^appName=Buzz (Fix_Thing-2)$' "$android" \
+  && pass "Android app name defaults to the branch-labelled name" \
+  || fail "Android app name wrong: $(cat "$android")"
 grep -q '^applicationIdSuffix=\.feature_work_1$' "$android" \
   && pass "Android applicationIdSuffix keys to the worktree directory name" \
   || fail "Android applicationIdSuffix wrong: $(cat "$android")"
@@ -120,6 +123,32 @@ grep -q '^applicationIdSuffix=\.w_2fast$' "$wt2/mobile/android/worktree.properti
   && pass "digit-leading worktree dir yields a valid Android package segment" \
   || fail "digit-leading dir segment wrong: $(cat "$wt2/mobile/android/worktree.properties")"
 
+# ── Explicit Android debug identity: readable and isolated ───────────────────
+BUZZ_ANDROID_DEBUG_APP_NAME="Buzz Huddles" \
+  BUZZ_ANDROID_DEBUG_ID_SUFFIX=".huddles_829c" \
+  "$wt/scripts/mobile-worktree-overrides.sh" > /dev/null
+grep -q '^appName=Buzz Huddles$' "$android" \
+  && pass "explicit Android debug app name is persisted" \
+  || fail "explicit Android debug app name wrong: $(cat "$android")"
+grep -q '^applicationIdSuffix=\.huddles_829c$' "$android" \
+  && pass "explicit Android debug suffix is persisted" \
+  || fail "explicit Android debug suffix wrong: $(cat "$android")"
+grep -q '^APP_DISPLAY_NAME = Buzz (' "$ios" \
+  && ! grep -q 'Buzz Huddles' "$ios" \
+  && pass "Android debug overrides do not change the iOS identity" \
+  || fail "Android debug overrides must not change iOS identity: $(cat "$ios")"
+
+if BUZZ_ANDROID_DEBUG_ID_SUFFIX=".Huddles" "$wt/scripts/mobile-worktree-overrides.sh" >/dev/null 2>&1; then
+  fail "invalid explicit Android debug suffix must be rejected"
+else
+  pass "invalid explicit Android debug suffix is rejected"
+fi
+if BUZZ_ANDROID_DEBUG_APP_NAME=$'Buzz Huddles\nInjected' "$wt/scripts/mobile-worktree-overrides.sh" >/dev/null 2>&1; then
+  fail "unsafe explicit Android debug app name must be rejected"
+else
+  pass "unsafe explicit Android debug app name is rejected"
+fi
+
 # ── Tracked build files: overrides are debug-only, release stays production ──
 debug_xcconfig="$repo_root/mobile/ios/Flutter/Debug.xcconfig"
 release_xcconfig="$repo_root/mobile/ios/Flutter/Release.xcconfig"
@@ -158,6 +187,9 @@ grep -q 'resValue("string", "app_name", "Buzz")' "$gradle" \
 grep -q 'worktreeLabel.matches' "$gradle" \
   && pass "Gradle validates the worktree label before use" \
   || fail "Gradle must validate the worktree label against a safe pattern"
+grep -q 'worktreeAppName.matches' "$gradle" \
+  && pass "Gradle validates the explicit Android app name before use" \
+  || fail "Gradle must validate the explicit Android app name against a safe pattern"
 grep -q 'AppOverrides.properties' "$gradle" \
   && grep -q 'debugAppName' "$gradle" \
   && grep -q 'debugIdSuffix' "$gradle" \