Merge pull request #3825 from vitorpamplona/claude/intent-receivers-feed-sharing-rkwiv1

Add media share targets for Pictures, Shorts, and Video feeds
fix: address audit findings on the media share targets
2026-07-30 19:46:17 +00:00 · 2026-07-30 12:22:44 -04:00 · 2026-07-30 16:07:52 +00:00 · 2026-07-30 15:11:56 +00:00 · 2026-07-29 22:17:41 -04:00 · 2026-07-30 02:08:04 +00:00
234 changed files with 14895 additions and 1492 deletions
@@ -7,7 +7,7 @@ description: Integration guide for using the Quartz Nostr KMP library in externa

 Reference for integrating `com.vitorpamplona.quartz:quartz` into external Nostr KMP projects.

-**Published artifact**: `com.vitorpamplona.quartz:quartz:1.13.0` (Maven Central)
+**Published artifact**: `com.vitorpamplona.quartz:quartz:1.13.1` (Maven Central)
 **Targets**: JVM 21+, Android (minSdk 21+), iOS (XCFramework `quartz-kmpKit`)
 **License**: MIT

@@ -19,7 +19,7 @@ Reference for integrating `com.vitorpamplona.quartz:quartz` into external Nostr

 ```toml
 [versions]
-quartz = "1.13.0"
+quartz = "1.13.1"

 [libraries]
 quartz = { module = "com.vitorpamplona.quartz:quartz", version.ref = "quartz" }
@@ -41,7 +41,7 @@ kotlin {

 ```kotlin
 dependencies {
-    implementation("com.vitorpamplona.quartz:quartz:1.13.0")
+    implementation("com.vitorpamplona.quartz:quartz:1.13.1")
 }
 ```

@@ -3,7 +3,7 @@
 ## Current version

 ```
-com.vitorpamplona.quartz:quartz:1.13.0
+com.vitorpamplona.quartz:quartz:1.13.1
 ```

 Check latest: https://central.sonatype.com/artifact/com.vitorpamplona.quartz/quartz
@@ -16,7 +16,7 @@ Check latest: https://central.sonatype.com/artifact/com.vitorpamplona.quartz/qua

 ```toml
 [versions]
-quartz = "1.13.0"
+quartz = "1.13.1"

 [libraries]
 quartz = { module = "com.vitorpamplona.quartz:quartz", version.ref = "quartz" }
@@ -55,7 +55,7 @@ kotlin {
 ```kotlin
 // build.gradle.kts (app module)
 dependencies {
-    implementation("com.vitorpamplona.quartz:quartz:1.13.0")
+    implementation("com.vitorpamplona.quartz:quartz:1.13.1")
 }
 ```

@@ -70,7 +70,7 @@ plugins {
 }

 dependencies {
-    implementation("com.vitorpamplona.quartz:quartz:1.13.0")
+    implementation("com.vitorpamplona.quartz:quartz:1.13.1")
    // JNA needed for libsodium (NIP-44) on JVM
    implementation("net.java.dev.jna:jna:5.18.1")
 }
@@ -0,0 +1,73 @@
+name: Resolve Release
+description: >-
+  Resolve a bump workflow's target tag and that release's real published state.
+  Companion to assert-stable-release: this one FETCHES the facts, that one
+  ENFORCES them. Split so the enforcement stays a pure function of its inputs.
+
+  Handles both entry points of the bump workflows:
+    - workflow_run  -> tag comes from the triggering run's head_branch
+    - workflow_dispatch (manual recovery) -> tag comes from the input
+  In both cases draft/prerelease are read back from the GitHub API rather than
+  inferred, so a draft or prerelease can never slip through to a third-party
+  package repo just because the trigger payload lacked the flags.
+
+inputs:
+  tag:
+    description: "Release tag to resolve (e.g. vX.Y.Z)"
+    required: true
+  github_token:
+    description: "Token used to read the release via the GH API"
+    required: true
+
+outputs:
+  tag:
+    description: "The resolved tag, verbatim (e.g. v1.13.1)"
+    value: ${{ steps.resolve.outputs.tag }}
+  ver:
+    description: "The tag with the leading 'v' stripped (e.g. 1.13.1)"
+    value: ${{ steps.resolve.outputs.ver }}
+  is_prerelease:
+    description: "'true' if the GH Release is flagged prerelease"
+    value: ${{ steps.resolve.outputs.is_prerelease }}
+  is_draft:
+    description: "'true' if the GH Release is still a draft"
+    value: ${{ steps.resolve.outputs.is_draft }}
+
+runs:
+  using: composite
+  steps:
+    - name: Resolve tag and release state
+      id: resolve
+      shell: bash
+      env:
+        TAG: ${{ inputs.tag }}
+        GH_TOKEN: ${{ inputs.github_token }}
+        REPO: ${{ github.repository }}
+      run: |
+        set -euo pipefail
+
+        if [[ -z "$TAG" ]]; then
+          echo "::error::No tag to resolve (neither workflow_run.head_branch nor the dispatch input was set)"
+          exit 1
+        fi
+
+        # A missing release here is a real fault, not something to paper over:
+        # every caller is about to publish this version to an external package
+        # manager. Fail loudly and let the caller's Report-failure step file it.
+        if ! META=$(gh release view "$TAG" --repo "$REPO" --json isDraft,isPrerelease 2>&1); then
+          echo "::error::No GH Release found for tag $TAG in $REPO -- refusing to bump"
+          echo "$META"
+          exit 1
+        fi
+
+        IS_DRAFT=$(echo "$META" | jq -r '.isDraft')
+        IS_PRERELEASE=$(echo "$META" | jq -r '.isPrerelease')
+
+        {
+          echo "tag=$TAG"
+          echo "ver=${TAG#v}"
+          echo "is_draft=$IS_DRAFT"
+          echo "is_prerelease=$IS_PRERELEASE"
+        } >> "$GITHUB_OUTPUT"
+
+        echo "resolved tag=$TAG ver=${TAG#v} draft=$IS_DRAFT prerelease=$IS_PRERELEASE"
@@ -19,9 +19,14 @@ name: Bump Homebrew Formula (amy CLI)
 # auto-bump here (symmetric to the cask action in bump-homebrew.yml) — see the
 # "TODO(bootstrap)" note at the bottom of this file.

+# Trigger: after "Create Release Assets" succeeds for a tag push. NOT
+# `release: types: [released]` — that event never fires, because the release is
+# created by create-release.yml under GITHUB_TOKEN and GitHub suppresses
+# workflow-triggering events for it. See the full note in bump-homebrew.yml.
 on:
-  release:
-    types: [released]
+  workflow_run:
+    workflows: ["Create Release Assets"]
+    types: [completed]
  workflow_dispatch:
    inputs:
      tag:
@@ -38,44 +43,49 @@ permissions:

 concurrency:
  # Serialize per tag; do not cancel in-progress runs.
-  group: bump-homebrew-formula-${{ github.event.release.tag_name || inputs.tag }}
+  group: bump-homebrew-formula-${{ github.event.workflow_run.head_branch || inputs.tag }}
  cancel-in-progress: false

 jobs:
  sync-formula:
-    if: github.event_name == 'workflow_dispatch' || github.event.release.prerelease == false
+    # See bump-homebrew.yml for why these three conditions: successful, tag-push
+    # (not a dry-run dispatch), v-prefixed. Exact format enforced downstream.
+    if: >-
+      github.event_name == 'workflow_dispatch' ||
+      (github.event.workflow_run.conclusion == 'success' &&
+       github.event.workflow_run.event == 'push' &&
+       startsWith(github.event.workflow_run.head_branch, 'v'))
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout code
        uses: actions/checkout@v7

+      - name: Resolve release
+        id: rel
+        uses: ./.github/actions/resolve-release
+        with:
+          tag: ${{ github.event.workflow_run.head_branch || inputs.tag }}
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+
      - name: Re-assert stable release
        uses: ./.github/actions/assert-stable-release
        with:
-          tag: ${{ github.event.release.tag_name || inputs.tag }}
-          is_prerelease: ${{ github.event.release.prerelease || 'false' }}
-          is_draft: ${{ github.event.release.draft || 'false' }}
-
-      - name: Resolve version
-        id: ver
-        run: |
-          set -euo pipefail
-          TAG="${{ github.event.release.tag_name || inputs.tag }}"
-          VER="${TAG#v}"
-          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
-          echo "ver=$VER" >> "$GITHUB_OUTPUT"
+          tag: ${{ steps.rel.outputs.tag }}
+          is_prerelease: ${{ steps.rel.outputs.is_prerelease }}
+          is_draft: ${{ steps.rel.outputs.is_draft }}

      - name: Download jvm bundle and compute sha256
        id: asset
        run: |
          set -euo pipefail
-          TAG="${{ steps.ver.outputs.tag }}"
-          VER="${{ steps.ver.outputs.ver }}"
+          TAG="${{ steps.rel.outputs.tag }}"
+          VER="${{ steps.rel.outputs.ver }}"
          URL="https://github.com/${{ github.repository }}/releases/download/${TAG}/amy-${VER}-jvm.tar.gz"
          echo "Fetching $URL"
-          # The `released` event can fire a hair before every matrix leg finishes
-          # uploading; retry with backoff (mirrors the repo's push/pull retry ethos).
+          # workflow_run fires only after every upload leg has finished, so the
+          # asset should already be there. Retry anyway for release-CDN
+          # propagation (mirrors the repo's push/pull retry ethos).
          ok=0
          for i in 1 2 3 4 5; do
            if curl -fsSL -o amy-jvm.tar.gz "$URL"; then ok=1; break; fi
@@ -110,13 +120,13 @@ jobs:
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          base: main
-          branch: chore/bump-amy-formula-${{ steps.ver.outputs.tag }}
+          branch: chore/bump-amy-formula-${{ steps.rel.outputs.tag }}
          add-paths: cli/packaging/homebrew/amy.rb
-          commit-message: 'chore: sync amy Homebrew formula to ${{ steps.ver.outputs.tag }}'
-          title: 'chore: sync amy Homebrew formula to ${{ steps.ver.outputs.tag }}'
+          commit-message: 'chore: sync amy Homebrew formula to ${{ steps.rel.outputs.tag }}'
+          title: 'chore: sync amy Homebrew formula to ${{ steps.rel.outputs.tag }}'
          body: |
            Auto-synced `cli/packaging/homebrew/amy.rb` to the
-            `${{ steps.ver.outputs.tag }}` release:
+            `${{ steps.rel.outputs.tag }}` release:

            - `url`    -> `${{ steps.asset.outputs.url }}`
            - `sha256` -> `${{ steps.asset.outputs.sha256 }}`
@@ -124,19 +134,21 @@ jobs:
            Opened by `.github/workflows/bump-homebrew-formula.yml`. Merge to keep
            the reference formula ready for the homebrew-core submission/bump.

-      # TODO(bootstrap): once `amy` is accepted into Homebrew/homebrew-core, add a
-      # step here that opens the homebrew-core bump PR automatically — symmetric to
-      # the cask bump in bump-homebrew.yml (a pinned macauley/action-homebrew-bump-
-      # formula, or `brew bump-formula-pr amy --url=<url> --sha256=<sha>` with a
-      # HOMEBREW_TOKEN). It is intentionally omitted until then because
-      # bump-formula-pr errors on a formula that is not yet in the tap.
+      # TODO(bootstrap): once `amy` is accepted into Homebrew/homebrew-core, add
+      # a LOCAL script mirroring scripts/bump-homebrew-cask.sh that runs `brew
+      # bump-formula-pr amy --url=<url> --sha256=<sha>` from a maintainer's
+      # machine. Do NOT wire that into CI: bump-formula-pr forks homebrew-core
+      # into the token owner's account, which needs a classic `repo`-scoped PAT,
+      # and that scope grants write to every repo the account can reach —
+      # including this one — to anyone with push access here. See
+      # BUILDING.md § Homebrew cask for the full reasoning.

      - name: Report failure
        if: failure()
        uses: actions/github-script@v9
        with:
          script: |
-            const tag = context.payload.release?.tag_name || context.payload.inputs?.tag || 'unknown';
+            const tag = context.payload.workflow_run?.head_branch || context.payload.inputs?.tag || 'unknown';
            const runUrl = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;
            await github.rest.issues.create({
              owner: context.repo.owner,
@@ -17,9 +17,14 @@ name: Bump Homebrew Formula (geode relay)
 # human-reviewed new-formula PR (the one-time bootstrap). Once it lands, wire the
 # auto-bump here — see the "TODO(bootstrap)" note at the bottom of this file.

+# Trigger: after "Create Release Assets" succeeds for a tag push. NOT
+# `release: types: [released]` — that event never fires, because the release is
+# created by create-release.yml under GITHUB_TOKEN and GitHub suppresses
+# workflow-triggering events for it. See the full note in bump-homebrew.yml.
 on:
-  release:
-    types: [released]
+  workflow_run:
+    workflows: ["Create Release Assets"]
+    types: [completed]
  workflow_dispatch:
    inputs:
      tag:
@@ -36,44 +41,49 @@ permissions:

 concurrency:
  # Serialize per tag; do not cancel in-progress runs.
-  group: bump-homebrew-geode-formula-${{ github.event.release.tag_name || inputs.tag }}
+  group: bump-homebrew-geode-formula-${{ github.event.workflow_run.head_branch || inputs.tag }}
  cancel-in-progress: false

 jobs:
  sync-formula:
-    if: github.event_name == 'workflow_dispatch' || github.event.release.prerelease == false
+    # See bump-homebrew.yml for why these three conditions: successful, tag-push
+    # (not a dry-run dispatch), v-prefixed. Exact format enforced downstream.
+    if: >-
+      github.event_name == 'workflow_dispatch' ||
+      (github.event.workflow_run.conclusion == 'success' &&
+       github.event.workflow_run.event == 'push' &&
+       startsWith(github.event.workflow_run.head_branch, 'v'))
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout code
        uses: actions/checkout@v7

+      - name: Resolve release
+        id: rel
+        uses: ./.github/actions/resolve-release
+        with:
+          tag: ${{ github.event.workflow_run.head_branch || inputs.tag }}
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+
      - name: Re-assert stable release
        uses: ./.github/actions/assert-stable-release
        with:
-          tag: ${{ github.event.release.tag_name || inputs.tag }}
-          is_prerelease: ${{ github.event.release.prerelease || 'false' }}
-          is_draft: ${{ github.event.release.draft || 'false' }}
-
-      - name: Resolve version
-        id: ver
-        run: |
-          set -euo pipefail
-          TAG="${{ github.event.release.tag_name || inputs.tag }}"
-          VER="${TAG#v}"
-          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
-          echo "ver=$VER" >> "$GITHUB_OUTPUT"
+          tag: ${{ steps.rel.outputs.tag }}
+          is_prerelease: ${{ steps.rel.outputs.is_prerelease }}
+          is_draft: ${{ steps.rel.outputs.is_draft }}

      - name: Download jvm bundle and compute sha256
        id: asset
        run: |
          set -euo pipefail
-          TAG="${{ steps.ver.outputs.tag }}"
-          VER="${{ steps.ver.outputs.ver }}"
+          TAG="${{ steps.rel.outputs.tag }}"
+          VER="${{ steps.rel.outputs.ver }}"
          URL="https://github.com/${{ github.repository }}/releases/download/${TAG}/geode-${VER}-jvm.tar.gz"
          echo "Fetching $URL"
-          # The `released` event can fire a hair before every matrix leg finishes
-          # uploading; retry with backoff (mirrors the repo's push/pull retry ethos).
+          # workflow_run fires only after every upload leg has finished, so the
+          # asset should already be there. Retry anyway for release-CDN
+          # propagation (mirrors the repo's push/pull retry ethos).
          ok=0
          for i in 1 2 3 4 5; do
            if curl -fsSL -o geode-jvm.tar.gz "$URL"; then ok=1; break; fi
@@ -108,13 +118,13 @@ jobs:
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          base: main
-          branch: chore/bump-geode-formula-${{ steps.ver.outputs.tag }}
+          branch: chore/bump-geode-formula-${{ steps.rel.outputs.tag }}
          add-paths: geode/packaging/homebrew/geode.rb
-          commit-message: 'chore: sync geode Homebrew formula to ${{ steps.ver.outputs.tag }}'
-          title: 'chore: sync geode Homebrew formula to ${{ steps.ver.outputs.tag }}'
+          commit-message: 'chore: sync geode Homebrew formula to ${{ steps.rel.outputs.tag }}'
+          title: 'chore: sync geode Homebrew formula to ${{ steps.rel.outputs.tag }}'
          body: |
            Auto-synced `geode/packaging/homebrew/geode.rb` to the
-            `${{ steps.ver.outputs.tag }}` release:
+            `${{ steps.rel.outputs.tag }}` release:

            - `url`    -> `${{ steps.asset.outputs.url }}`
            - `sha256` -> `${{ steps.asset.outputs.sha256 }}`
@@ -122,19 +132,19 @@ jobs:
            Opened by `.github/workflows/bump-homebrew-geode-formula.yml`. Merge to
            keep the reference formula ready for the homebrew-core submission/bump.

-      # TODO(bootstrap): once `geode` is accepted into Homebrew/homebrew-core, add
-      # a step here that opens the homebrew-core bump PR automatically (a pinned
-      # macauley/action-homebrew-bump-formula, or `brew bump-formula-pr geode
-      # --url=<url> --sha256=<sha>` with a HOMEBREW_TOKEN). It is intentionally
-      # omitted until then because bump-formula-pr errors on a formula that is not
-      # yet in the tap.
+      # TODO(bootstrap): once `geode` is accepted into Homebrew/homebrew-core,
+      # add a LOCAL script mirroring scripts/bump-homebrew-cask.sh that runs
+      # `brew bump-formula-pr geode --url=<url> --sha256=<sha>` from a
+      # maintainer's machine. Do NOT wire that into CI — it needs a classic
+      # `repo`-scoped PAT, which as a CI secret would hand write access to this
+      # repo to anyone with push access. See BUILDING.md § Homebrew cask.

      - name: Report failure
        if: failure()
        uses: actions/github-script@v9
        with:
          script: |
-            const tag = context.payload.release?.tag_name || context.payload.inputs?.tag || 'unknown';
+            const tag = context.payload.workflow_run?.head_branch || context.payload.inputs?.tag || 'unknown';
            const runUrl = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;
            await github.rest.issues.create({
              owner: context.repo.owner,
@@ -1,75 +1,181 @@
-name: Bump Homebrew Cask
+name: Sync Homebrew Cask Reference

-# Fires when a GH Release is published (not draft, not prerelease).
-# `release.types: [released]` event fires only for stable releases — still
-# double-checked by .github/actions/assert-stable-release for defense-in-depth.
+# Sibling of bump-homebrew-formula.yml (amy) and bump-homebrew-geode-formula.yml
+# (geode). Same mechanism, third artifact:
+#   - this workflow -> Cask `amethyst-nostr` (the desktop GUI app / DMG)
+#
+# What it does: after a stable release, download the published macOS DMG, assert
+# it is notarized + stapled, compute its sha256, and open a PR syncing
+# `desktopApp/packaging/homebrew/amethyst-nostr.rb` to that release.
+#
+# What it does NOT do: open a PR against Homebrew/homebrew-cask. That step is
+# deliberately MANUAL and runs on a maintainer's machine —
+# `scripts/bump-homebrew-cask.sh`. Reason: `brew bump-cask-pr` forks
+# homebrew-cask into the token owner's account, which requires a CLASSIC PAT
+# with the `repo` scope; that scope grants write to every repository the account
+# can reach, and stored as a CI secret it would be usable by anyone with push
+# access to this repo. Keeping it in a maintainer's shell instead of a CI secret
+# removes that blast radius entirely, at the cost of one command per release.
+# See BUILDING.md § Homebrew cask.
+#
+# Consequence: this workflow needs NO external token. GITHUB_TOKEN is enough,
+# exactly like the two formula workflows.
+#
+# Trigger: after "Create Release Assets" succeeds for a tag push. NOT
+# `release: types: [released]` — that event never fires, because the release is
+# created by create-release.yml under GITHUB_TOKEN and GitHub suppresses
+# workflow-triggering events for it. See the note in bump-homebrew-formula.yml.
 on:
-  release:
-    types: [released]
+  workflow_run:
+    workflows: ["Create Release Assets"]
+    types: [completed]
  workflow_dispatch:
    inputs:
      tag:
-        description: 'Release tag to bump (for manual recovery)'
+        description: 'Release tag to sync (for manual recovery)'
        required: true
        type: string

 permissions:
-  contents: read
-  # The "Report failure" step below opens a [release-ops] issue via
-  # github.rest.issues.create; that needs issues:write. Without it the failure
-  # reporter itself 403s and no alert is ever filed.
+  contents: write
+  pull-requests: write
+  # The "Report failure" step opens a [release-ops] issue via
+  # github.rest.issues.create, which needs issues:write.
  issues: write

 concurrency:
-  # Serialize bumps per tag; do not cancel in-progress bumps.
-  group: bump-homebrew-${{ github.event.release.tag_name || inputs.tag }}
+  # Serialize per tag; do not cancel in-progress runs.
+  group: bump-homebrew-${{ github.event.workflow_run.head_branch || inputs.tag }}
  cancel-in-progress: false

 jobs:
-  bump:
-    if: github.event_name == 'workflow_dispatch' || github.event.release.prerelease == false
-    runs-on: ubuntu-latest   # brew runs on Linux — saves macOS runner quota
-    timeout-minutes: 30
+  sync-cask:
+    # See bump-homebrew-formula.yml for why these three conditions: successful,
+    # tag-push (not a dry-run dispatch), v-prefixed. Format enforced downstream.
+    if: >-
+      github.event_name == 'workflow_dispatch' ||
+      (github.event.workflow_run.conclusion == 'success' &&
+       github.event.workflow_run.event == 'push' &&
+       startsWith(github.event.workflow_run.head_branch, 'v'))
+    # macOS runner: `xcrun stapler` is the only way to verify the notarization
+    # ticket, and shipping an unnotarized DMG to the cask is the failure mode
+    # this whole channel is most exposed to.
+    runs-on: macos-latest
+    timeout-minutes: 20
    steps:
      - name: Checkout code
        uses: actions/checkout@v7

+      - name: Resolve release
+        id: rel
+        uses: ./.github/actions/resolve-release
+        with:
+          tag: ${{ github.event.workflow_run.head_branch || inputs.tag }}
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+
      - name: Re-assert stable release
        uses: ./.github/actions/assert-stable-release
        with:
-          tag: ${{ github.event.release.tag_name || inputs.tag }}
-          is_prerelease: ${{ github.event.release.prerelease || 'false' }}
-          is_draft: ${{ github.event.release.draft || 'false' }}
+          tag: ${{ steps.rel.outputs.tag }}
+          is_prerelease: ${{ steps.rel.outputs.is_prerelease }}
+          is_draft: ${{ steps.rel.outputs.is_draft }}

-      - name: Bump cask (push-or-update PR)
-        uses: macauley/action-homebrew-bump-cask@ad984534de44a9489a53aefd81eb77f87c70dc60  # v4.0.0
+      - name: Download DMG, verify notarization, compute sha256
+        id: asset
+        run: |
+          set -euo pipefail
+          TAG="${{ steps.rel.outputs.tag }}"
+          VER="${{ steps.rel.outputs.ver }}"
+          URL="https://github.com/${{ github.repository }}/releases/download/${TAG}/amethyst-desktop-${VER}-macos-arm64.dmg"
+          echo "Fetching $URL"
+          # workflow_run fires only after every upload leg has finished, so the
+          # asset should already be there. Retry anyway for release-CDN
+          # propagation (mirrors the repo's push/pull retry ethos).
+          ok=0
+          for i in 1 2 3 4 5; do
+            if curl -fsSL -o amethyst.dmg "$URL"; then ok=1; break; fi
+            wait=$(( 2 ** i ))
+            echo "attempt $i failed; retrying in ${wait}s"
+            sleep "$wait"
+          done
+          [[ "$ok" == 1 ]] || { echo "::error::could not download $URL"; exit 1; }
+          test -s amethyst.dmg
+
+          # A cask must point at a notarized+stapled DMG or every user hits a
+          # Gatekeeper block. Refuse to advertise one that is not.
+          if ! xcrun stapler validate amethyst.dmg; then
+            echo "::error::${TAG} DMG has no stapled notarization ticket -- refusing to sync the cask. Check the notarizeReleaseDmg step in create-release.yml."
+            exit 1
+          fi
+
+          SHA=$(shasum -a 256 amethyst.dmg | awk '{print $1}')
+          echo "sha256=$SHA" >> "$GITHUB_OUTPUT"
+          echo "amethyst-desktop-${VER}-macos-arm64.dmg -> $SHA"
+
+      - name: Update reference cask
+        run: |
+          set -euo pipefail
+          CASK=desktopApp/packaging/homebrew/amethyst-nostr.rb
+          VER="${{ steps.rel.outputs.ver }}"
+          SHA="${{ steps.asset.outputs.sha256 }}"
+          # Anchor on the 2-space indent so the header comment's example lines
+          # are never touched.
+          sed -i '' -E "s|^(  version ).*|\1\"${VER}\"|" "$CASK"
+          sed -i '' -E "s|^(  sha256 ).*|\1\"${SHA}\"|" "$CASK"
+          echo "----- $CASK -----"
+          grep -E "^  (version|sha256) " "$CASK"
+
+      - name: Open or update the cask-sync PR
+        # peter-evans/create-pull-request is MIT-licensed CI-only tooling (not
+        # linked into any shipped artifact). It no-ops when there is no diff.
+        uses: peter-evans/create-pull-request@v8
        with:
-          token: ${{ secrets.HOMEBREW_TOKEN }}
-          tap: homebrew/cask
-          cask: amethyst-nostr
-          tag: ${{ github.event.release.tag_name || inputs.tag }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+          base: main
+          branch: chore/bump-amethyst-cask-${{ steps.rel.outputs.tag }}
+          add-paths: desktopApp/packaging/homebrew/amethyst-nostr.rb
+          commit-message: 'chore: sync amethyst-nostr cask to ${{ steps.rel.outputs.tag }}'
+          title: 'chore: sync amethyst-nostr cask to ${{ steps.rel.outputs.tag }}'
+          body: |
+            Auto-synced `desktopApp/packaging/homebrew/amethyst-nostr.rb` to the
+            `${{ steps.rel.outputs.tag }}` release:
+
+            - `version` -> `${{ steps.rel.outputs.ver }}`
+            - `sha256`  -> `${{ steps.asset.outputs.sha256 }}`
+
+            The DMG was verified notarized + stapled before this PR was opened.
+
+            **Merge this, then push it upstream from a maintainer machine:**
+
+            ```bash
+            scripts/bump-homebrew-cask.sh ${{ steps.rel.outputs.tag }}
+            ```
+
+            That step is manual on purpose — it needs a classic PAT with the
+            `repo` scope, which is deliberately NOT stored as a CI secret. See
+            BUILDING.md § Homebrew cask.

      - name: Report failure
        if: failure()
        uses: actions/github-script@v9
        with:
          script: |
-            const tag = context.payload.release?.tag_name || context.payload.inputs?.tag || 'unknown';
+            const tag = context.payload.workflow_run?.head_branch || context.payload.inputs?.tag || 'unknown';
            const runUrl = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;
            await github.rest.issues.create({
              owner: context.repo.owner,
              repo: context.repo.repo,
-              title: `[release-ops] bump-homebrew failed for ${tag}`,
+              title: `[release-ops] sync-homebrew-cask failed for ${tag}`,
              body: [
-                `Homebrew cask bump failed for release \`${tag}\`.`,
+                `amethyst-nostr cask sync failed for release \`${tag}\`.`,
                ``,
                `- Run: ${runUrl}`,
                `- Channel: Homebrew Cask (\`amethyst-nostr\`)`,
                ``,
                `Recovery options:`,
-                `1. Re-run the workflow once underlying issue is fixed`,
-                `2. Manually run \`brew bump-cask-pr amethyst-nostr --version ${tag.replace(/^v/, '')}\``,
-                `3. File PR directly against Homebrew/homebrew-cask`
+                `1. Re-run the workflow once the underlying issue is fixed`,
+                `2. Check the DMG is notarized: \`xcrun stapler validate\` on the release asset`,
+                `3. Manually update \`desktopApp/packaging/homebrew/amethyst-nostr.rb\` (version + sha256)`
              ].join('\n'),
              labels: ['release-ops', 'bug']
            });
@@ -1,72 +1,214 @@
-name: Bump Winget Manifest
+name: Sync Winget Manifest Reference

+# Fourth sibling of the three Homebrew sync workflows, same shape:
+#   bump-homebrew-formula.yml       -> Formula `amy`
+#   bump-homebrew-geode-formula.yml -> Formula `geode`
+#   bump-homebrew.yml               -> Cask    `amethyst-nostr`
+#   this workflow                   -> Winget  `VitorPamplona.Amethyst`
+#
+# What it does: after a stable release, download the published Windows MSI,
+# compute its sha256, read its ProductCode, and open a PR syncing
+# desktopApp/packaging/winget/*.yaml to that release.
+#
+# What it does NOT do: open a PR against microsoft/winget-pkgs. That step is
+# deliberately MANUAL and runs on a maintainer's machine —
+# `scripts/bump-winget.sh`. Reason: submitting requires push access to a fork of
+# winget-pkgs. The previous design stored a classic `public_repo` PAT as
+# WINGET_TOKEN and handed it to a third-party action; that scope grants write to
+# every public repo the account can reach, and as an Actions secret it was
+# usable by anyone with push access to this repo. The local script uses the
+# maintainer's existing `gh` auth instead, so no PAT is created at all.
+# See BUILDING.md § Winget.
+#
+# Consequence: this workflow needs NO external token and no third-party action.
+#
+# Trigger: after "Create Release Assets" succeeds for a tag push. NOT
+# `release: types: [released]` — that event never fires, because the release is
+# created by create-release.yml under GITHUB_TOKEN and GitHub suppresses
+# workflow-triggering events for it. See the note in bump-homebrew-formula.yml.
 on:
-  release:
-    types: [released]
+  workflow_run:
+    workflows: ["Create Release Assets"]
+    types: [completed]
  workflow_dispatch:
    inputs:
      tag:
-        description: 'Release tag to submit (for manual recovery)'
+        description: 'Release tag to sync (for manual recovery)'
        required: true
        type: string

 permissions:
-  contents: read
-  # The "Report failure" step below opens a [release-ops] issue via
-  # github.rest.issues.create; that needs issues:write. Without it the failure
-  # reporter itself 403s and no alert is ever filed.
+  contents: write
+  pull-requests: write
+  # The "Report failure" step opens a [release-ops] issue via
+  # github.rest.issues.create, which needs issues:write.
  issues: write

 concurrency:
-  group: bump-winget-${{ github.event.release.tag_name || inputs.tag }}
+  group: bump-winget-${{ github.event.workflow_run.head_branch || inputs.tag }}
  cancel-in-progress: false

 jobs:
-  bump:
-    if: github.event_name == 'workflow_dispatch' || github.event.release.prerelease == false
-    runs-on: windows-latest
-    timeout-minutes: 30
+  sync-manifest:
+    # See bump-homebrew-formula.yml for why these three conditions: successful,
+    # tag-push (not a dry-run dispatch), v-prefixed. Format enforced downstream.
+    if: >-
+      github.event_name == 'workflow_dispatch' ||
+      (github.event.workflow_run.conclusion == 'success' &&
+       github.event.workflow_run.event == 'push' &&
+       startsWith(github.event.workflow_run.head_branch, 'v'))
+    # Linux, not Windows: msitools reads the MSI Property table just as well, and
+    # this leg is billed 1x instead of 2x.
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
    steps:
      - name: Checkout code
        uses: actions/checkout@v7

+      - name: Resolve release
+        id: rel
+        uses: ./.github/actions/resolve-release
+        with:
+          tag: ${{ github.event.workflow_run.head_branch || inputs.tag }}
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+
      - name: Re-assert stable release
        uses: ./.github/actions/assert-stable-release
        with:
-          tag: ${{ github.event.release.tag_name || inputs.tag }}
-          is_prerelease: ${{ github.event.release.prerelease || 'false' }}
-          is_draft: ${{ github.event.release.draft || 'false' }}
+          tag: ${{ steps.rel.outputs.tag }}
+          is_prerelease: ${{ steps.rel.outputs.is_prerelease }}
+          is_draft: ${{ steps.rel.outputs.is_draft }}

-      - name: Submit manifest to winget-pkgs
-        uses: vedantmgoyal9/winget-releaser@4ffc7888bffd451b357355dc214d43bb9f23917e  # v2
+      - name: Install msitools
+        run: sudo apt-get update -qq && sudo apt-get install -y -qq msitools
+
+      - name: Download MSI, compute sha256 + ProductCode
+        id: asset
+        run: |
+          set -euo pipefail
+          TAG="${{ steps.rel.outputs.tag }}"
+          VER="${{ steps.rel.outputs.ver }}"
+          URL="https://github.com/${{ github.repository }}/releases/download/${TAG}/amethyst-desktop-${VER}-windows-x64.msi"
+          echo "Fetching $URL"
+          # workflow_run fires only after every upload leg has finished, so the
+          # asset should already be there. Retry anyway for release-CDN
+          # propagation (mirrors the repo's push/pull retry ethos).
+          ok=0
+          for i in 1 2 3 4 5; do
+            if curl -fsSL -o amethyst.msi "$URL"; then ok=1; break; fi
+            wait=$(( 2 ** i ))
+            echo "attempt $i failed; retrying in ${wait}s"
+            sleep "$wait"
+          done
+          [[ "$ok" == 1 ]] || { echo "::error::could not download $URL"; exit 1; }
+          test -s amethyst.msi
+
+          SHA=$(sha256sum amethyst.msi | awk '{print $1}' | tr '[:lower:]' '[:upper:]')
+
+          # ProductCode is the ARP key winget uses to detect an existing install.
+          # jpackage regenerates it per build, so read it rather than pin it.
+          PRODUCT_CODE=$(msiinfo export amethyst.msi Property \
+            | awk -F'\t' '$1 == "ProductCode" { print $2 }' | tr -d '\r')
+          if [[ ! "$PRODUCT_CODE" =~ ^\{[0-9A-Fa-f-]{36}\}$ ]]; then
+            echo "::error::could not read a valid ProductCode from the MSI (got: '${PRODUCT_CODE}')"
+            exit 1
+          fi
+
+          echo "url=$URL" >> "$GITHUB_OUTPUT"
+          echo "sha256=$SHA" >> "$GITHUB_OUTPUT"
+          echo "product_code=$PRODUCT_CODE" >> "$GITHUB_OUTPUT"
+          echo "sha256=$SHA"
+          echo "ProductCode=$PRODUCT_CODE"
+
+      - name: Update reference manifests
+        run: |
+          set -euo pipefail
+          DIR=desktopApp/packaging/winget
+          TAG="${{ steps.rel.outputs.tag }}"
+          VER="${{ steps.rel.outputs.ver }}"
+          SHA="${{ steps.asset.outputs.sha256 }}"
+          URL="${{ steps.asset.outputs.url }}"
+          PC="${{ steps.asset.outputs.product_code }}"
+
+          # Anchored substitutions so the header comments are never touched.
+          sed -i -E "s|^(PackageVersion: ).*|\1${VER}|" \
+            "$DIR/VitorPamplona.Amethyst.yaml" \
+            "$DIR/VitorPamplona.Amethyst.installer.yaml" \
+            "$DIR/VitorPamplona.Amethyst.locale.en-US.yaml"
+          sed -i -E "s|^(  InstallerUrl: ).*|\1${URL}|"    "$DIR/VitorPamplona.Amethyst.installer.yaml"
+          # Quoted: an all-digit 64-char digest would otherwise parse as a YAML
+          # integer and fail the schema's `string` type.
+          sed -i -E "s|^(  InstallerSha256: ).*|\1'${SHA}'|" "$DIR/VitorPamplona.Amethyst.installer.yaml"
+          sed -i -E "s|^(  ProductCode: ).*|\1'${PC}'|"    "$DIR/VitorPamplona.Amethyst.installer.yaml"
+          sed -i -E "s|^(ReleaseNotesUrl: ).*|\1https://github.com/${{ github.repository }}/releases/tag/${TAG}|" \
+            "$DIR/VitorPamplona.Amethyst.locale.en-US.yaml"
+
+          echo "----- synced -----"
+          grep -hE "^(PackageVersion|  InstallerUrl|  InstallerSha256|  ProductCode|ReleaseNotesUrl): " "$DIR"/*.yaml
+
+      - name: Sanity-check the manifests still parse
+        run: |
+          set -euo pipefail
+          python3 - <<'PY'
+          import glob, sys, yaml
+          for f in sorted(glob.glob('desktopApp/packaging/winget/*.yaml')):
+              d = yaml.safe_load(open(f))
+              assert d['PackageIdentifier'] == 'VitorPamplona.Amethyst', f
+              assert d['PackageVersion'], f
+              print('OK', f, d['ManifestType'])
+          PY
+
+      - name: Open or update the manifest-sync PR
+        # peter-evans/create-pull-request is MIT-licensed CI-only tooling (not
+        # linked into any shipped artifact). It no-ops when there is no diff.
+        uses: peter-evans/create-pull-request@v8
        with:
-          identifier: VitorPamplona.Amethyst
-          version: ${{ github.event.release.tag_name || inputs.tag }}
-          # Asset naming contract: scripts/asset-name.sh
-          installers-regex: '^amethyst-desktop-.*-windows-x64\.msi$'
-          token: ${{ secrets.WINGET_TOKEN }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+          base: main
+          branch: chore/bump-winget-manifest-${{ steps.rel.outputs.tag }}
+          add-paths: desktopApp/packaging/winget
+          commit-message: 'chore: sync winget manifests to ${{ steps.rel.outputs.tag }}'
+          title: 'chore: sync winget manifests to ${{ steps.rel.outputs.tag }}'
+          body: |
+            Auto-synced `desktopApp/packaging/winget/` to the
+            `${{ steps.rel.outputs.tag }}` release:
+
+            - `PackageVersion`  -> `${{ steps.rel.outputs.ver }}`
+            - `InstallerSha256` -> `${{ steps.asset.outputs.sha256 }}`
+            - `ProductCode`     -> `${{ steps.asset.outputs.product_code }}`
+
+            **Merge this, then push it upstream from a maintainer machine:**
+
+            ```bash
+            scripts/bump-winget.sh ${{ steps.rel.outputs.tag }}
+            ```
+
+            That step is manual on purpose — it needs push access to a fork of
+            `microsoft/winget-pkgs`, which is deliberately NOT stored as a CI
+            secret. The script uses your existing `gh` auth. See
+            BUILDING.md § Winget.

      - name: Report failure
        if: failure()
        uses: actions/github-script@v9
        with:
          script: |
-            const tag = context.payload.release?.tag_name || context.payload.inputs?.tag || 'unknown';
+            const tag = context.payload.workflow_run?.head_branch || context.payload.inputs?.tag || 'unknown';
            const runUrl = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;
            await github.rest.issues.create({
              owner: context.repo.owner,
              repo: context.repo.repo,
-              title: `[release-ops] bump-winget failed for ${tag}`,
+              title: `[release-ops] sync-winget-manifest failed for ${tag}`,
              body: [
-                `Winget manifest submission failed for release \`${tag}\`.`,
+                `Winget manifest sync failed for release \`${tag}\`.`,
                ``,
                `- Run: ${runUrl}`,
                `- Channel: Winget (\`VitorPamplona.Amethyst\`)`,
                ``,
                `Recovery options:`,
-                `1. Re-run the workflow once underlying issue is fixed`,
-                `2. Manually submit via \`wingetcreate update VitorPamplona.Amethyst -v ${tag.replace(/^v/, '')}\``,
-                `3. File PR directly against microsoft/winget-pkgs`
+                `1. Re-run the workflow once the underlying issue is fixed`,
+                `2. Check the release actually published \`amethyst-desktop-${tag.replace(/^v/, '')}-windows-x64.msi\``,
+                `3. Manually update \`desktopApp/packaging/winget/*.yaml\` (version, sha256, ProductCode)`
              ].join('\n'),
              labels: ['release-ops', 'bug']
            });
@@ -155,8 +155,44 @@ jobs:
          AMETHYST_NOTARY_TEAM_ID: ${{ secrets.MAC_NOTARY_TEAM_ID }}
        with:
          max_attempts: 2
-          timeout_minutes: 15
-          command: ./gradlew --no-daemon :desktopApp:${{ matrix.tasks }}
+          # macOS needs far longer: notarizeReleaseDmg blocks on `notarytool
+          # submit --wait`, which is minutes-to-tens-of-minutes on Apple's side.
+          timeout_minutes: ${{ matrix.family == 'macos' && 45 || 15 }}
+          # Append notarization on the macOS leg. `packageReleaseDmg` only SIGNS
+          # the DMG — notarization is a separate Compose task, and because it was
+          # never invoked every release up to v1.13.1 shipped a signed but
+          # UNNOTARIZED DMG that Gatekeeper blocks on first launch. The task runs
+          # `notarytool submit --wait` and then `stapler staple`, in place, so the
+          # asset-collection step below still finds the same file.
+          #
+          # Gated on the cert AND all three notary secrets being present, so forks
+          # and credential-less runs keep producing a plain unsigned DMG exactly as
+          # before instead of failing.
+          command: ./gradlew --no-daemon :desktopApp:${{ matrix.tasks }}${{ (matrix.family == 'macos' && steps.mac_keychain.outputs.signing == 'true' && secrets.MAC_NOTARY_APPLE_ID != '' && secrets.MAC_NOTARY_PASSWORD != '' && secrets.MAC_NOTARY_TEAM_ID != '') && ' :desktopApp:notarizeReleaseDmg' || '' }}
+
+      # Regression guard. The missing-notarization bug was invisible for many
+      # releases precisely because nothing ever asserted the outcome; assert it
+      # now so a silently-dropped notarization step can never ship again.
+      - name: Verify the DMG is notarized and stapled (macOS leg)
+        if: matrix.family == 'macos'
+        env:
+          EXPECT_NOTARIZED: ${{ (steps.mac_keychain.outputs.signing == 'true' && secrets.MAC_NOTARY_APPLE_ID != '' && secrets.MAC_NOTARY_PASSWORD != '' && secrets.MAC_NOTARY_TEAM_ID != '') && 'true' || 'false' }}
+        run: |
+          set -euo pipefail
+          DMG=$(find desktopApp/build/compose/binaries -name "*.dmg" -print -quit)
+          [[ -n "$DMG" ]] || { echo "::error::no DMG produced"; exit 1; }
+          echo "Checking $DMG"
+
+          if [[ "$EXPECT_NOTARIZED" != "true" ]]; then
+            echo "::warning::Apple signing/notary credentials are not configured; this DMG is unsigned and unnotarized. Gatekeeper will block it, and it is not eligible for the Homebrew cask."
+            exit 0
+          fi
+
+          if ! xcrun stapler validate "$DMG"; then
+            echo "::error::$DMG has no stapled notarization ticket -- notarizeReleaseDmg did not run or failed"
+            exit 1
+          fi
+          echo "notarization ticket stapled OK"

      # jpackage pins libicu to the build host's version (libicu74 on
      # ubuntu-24.04). Rewrite the .deb so it installs across Debian/Ubuntu.
@@ -325,15 +325,29 @@ Quartz library in one pipeline.

 3. **Wait** for the `Create Release Assets` workflow to finish (~25–30 min).

-4. **Verify**:
-   - GH Release contains 8 desktop assets + 12 Android assets
+4. **Verify** — the GH Release should hold **31 assets**:
+   - **8 desktop** — `dmg` (macOS arm64), `msi` + `zip` (Windows), `deb`, `rpm`,
+     `AppImage`, `flatpak`, `tar.gz` (Linux). There is **no Intel/x64 macOS
+     DMG** — `jpackage` cannot cross-compile and no Intel runner leg is
+     configured, so macOS ships arm64-only.
+   - **13 Android** — 5 Google Play APKs + 5 F-Droid APKs + 2 AABs + the
+     F-Droid `.apks` set built for Accrescent.
+   - **5 amy** + **5 geode** bundles.
   - Asset sizes look sane (see §Enforce asset size budget — CI auto-fails at 1 GB/asset)
-   - Intel + ARM DMGs both present
   - Android flow unchanged

+   Quick diff against the previous release, which catches a silently-dropped
+   matrix leg better than any count:
+
+   ```bash
+   diff <(gh release view v1.13.0 --json assets --jq '.assets[].name' | sed 's/1\.13\.0/VER/g' | sort) \
+        <(gh release view v1.13.1 --json assets --jq '.assets[].name' | sed 's/1\.13\.1/VER/g' | sort)
+   ```
+
 5. **Stable vs prerelease** — a tag containing `-rc`, `-beta`, `-alpha`, `-dev`,
-   or `-snapshot` is auto-classified as prerelease. Stable tags trigger the
-   Homebrew + Winget bump workflows.
+   or `-snapshot` is auto-classified as prerelease. Only stable tags run the
+   Homebrew + Winget bump workflows (and those are no-ops until the one-time
+   bootstrap PRs land — see § Bootstrap).

 ### Dry-run (no tag push)

@@ -389,8 +403,8 @@ provided automatically; everything else you set yourself.)
 | `MAC_NOTARY_APPLE_ID` | Apple ID email of the notarization account | Apple notarization (`notarytool`) |
 | `MAC_NOTARY_PASSWORD` | **App-specific** password for that Apple ID (not the login password) | Same |
 | `MAC_NOTARY_TEAM_ID` | 10-char Apple Developer **Team ID** | Same |
-| `HOMEBREW_TOKEN` | PAT for `Homebrew/homebrew-cask` | Desktop cask bump (stable tags) |
-| `WINGET_TOKEN` | PAT for `microsoft/winget-pkgs` | Desktop winget bump (stable tags) |
+| ~~`HOMEBREW_TOKEN`~~ | *Not used.* The cask bump runs on a maintainer's machine — see § Homebrew cask | — |
+| ~~`WINGET_TOKEN`~~ | *Not used.* The winget bump runs on a maintainer's machine — see § Winget | — |
 | `CROWDIN_PERSONAL_TOKEN`, `CROWDIN_PROJECT_ID` | Crowdin API creds | Translation sync (separate workflow, not the release) |

 Note the **three distinct signing identities** people often conflate:
@@ -473,11 +487,11 @@ distributes; the official Amethyst rollout for each is in
 | Channel | How it ships | Push or pull |
 |---|---|---|
 | **GitHub Releases** | The release workflow builds + signs all assets and attaches them to the tag's Release | Automatic (CI) |
-| **Maven Central** | Same workflow runs `publishAllPublicationsToMavenCentral` for `quartz` | Automatic (CI) |
+| **Maven Central** | Same workflow runs `publishAllPublicationsToMavenCentral` for `quartz` — a *step* at the end of the `deploy-android` job, not a job of its own, so it does not appear in a job list | Automatic (CI) |
 | **Google Play** | Download the signed `amethyst-googleplay-<version>.aab` from the GH Release and upload it in Play Console | **Manual push** |
 | **F-Droid** | F-Droid's build server detects the new tag and **builds the `fdroid` flavor from source** per its recipe in the external [`fdroiddata`](https://gitlab.com/fdroid/fdroiddata) repo, then signs + publishes itself | **Pull (build-from-source)** |
 | **Zapstore** | The [`zsp`](https://zapstore.dev/) CLI reads [`zapstore.yaml`](zapstore.yaml) and publishes a Nostr software-release event signed with the app's nsec | **Manual push (Nostr)** |
-| **Homebrew + Winget** | `bump-homebrew.yml` / `bump-winget.yml` open version-bump PRs on stable tags | Automatic (CI) |
+| **Homebrew + Winget** | `bump-homebrew.yml` / `bump-winget.yml` open version-bump PRs on stable tags — **currently no-ops**: neither package has been bootstrapped upstream yet (§ Bootstrap) | Automatic (CI), inactive |

 Two channels need the build to stay split into product flavors (see
 `amethyst/build.gradle.kts` → `productFlavors`):
@@ -498,20 +512,88 @@ reads an optional per-release changelog from

 ## Bootstrap runbook (one-time)

-### Secrets to provision in GitHub repo settings
+> **Status as of v1.13.1: neither Homebrew nor Winget has been bootstrapped.**
+> `https://formulae.brew.sh/api/cask/amethyst-nostr.json` and
+> `microsoft/winget-pkgs/manifests/v/VitorPamplona/Amethyst` both 404, so
+> **Amethyst does not currently ship through either channel.** The bump
+> workflows detect this and skip with a `::warning::` instead of failing, so a
+> green release run does *not* mean Homebrew/Winget shipped. The two subsections
+> below are the work that activates them; until then treat the desktop app as
+> GitHub-Releases-only on macOS and Windows.
+
+### Package-manager credentials (and why there are none)

 The full secret inventory is in [§ Secrets the CI needs](#secrets-the-ci-needs).
-The two that need the most setup care are the package-manager PATs, because of
-their token type and scope:
+Neither package-manager channel adds anything to it:

-| Secret | Purpose | Scope |
-|---|---|---|
-| `HOMEBREW_TOKEN` | Bump Homebrew cask | Fine-grained PAT — `Homebrew/homebrew-cask` only — `Contents: write` + `Pull requests: write` — 90d expiry |
-| `WINGET_TOKEN` | Submit Winget manifests | Classic PAT — `public_repo` — 90d expiry (dedicated bot account preferred; `vedantmgoyal9/winget-releaser` does not support fine-grained) |
+**There are deliberately no package-manager PATs in CI.** Both the Homebrew
+cask and the Winget manifest bumps run on a maintainer's machine. The reasoning
+is worth keeping, because it is the reason this repo has no third secret to
+rotate:

-Rotate both on a 90-day cadence. Owner: assigned via `RELEASE_OPS.md`
-or equivalent issue tracker. On rotation, paste new token and run
-`gh workflow run bump-homebrew.yml` on the most recent stable tag to verify.
+`brew bump-cask-pr` forks `Homebrew/homebrew-cask` **into the token owner's
+account** (`POST /repos/Homebrew/homebrew-cask/forks`), pushes a branch to that
+fork, then opens the PR upstream. That shape forces a **classic** PAT with the
+`repo` scope:
+
+- A fine-grained PAT cannot express it. Its "Repository access" selector only
+  lists repos owned by the resource owner, so `Homebrew/homebrew-cask` can never
+  be selected — and Homebrew's API layer authorises against classic OAuth scopes
+  (`x-oauth-scopes`), which fine-grained tokens do not emit.
+- Homebrew declares the requirement in source as
+  `CREATE_ISSUE_FORK_OR_PR_SCOPES = ["repo"]` (`utils/github.rb`).
+
+And `repo` cannot be narrowed: it grants write to *every* repository the owning
+account can reach — including `vitorpamplona/amethyst` itself. Stored as an
+Actions secret it would be usable by **anyone with push access to this repo**,
+since a pushed branch containing a workflow runs with repo secrets. That is a
+strict escalation for a channel that ships one DMG a month.
+
+So the split is:
+
+- **CI** (`bump-homebrew.yml`, `GITHUB_TOKEN` only) does the error-prone
+  bookkeeping: downloads the DMG, asserts it is notarized + stapled, computes
+  the sha256, and opens an in-repo PR syncing
+  `desktopApp/packaging/homebrew/amethyst-nostr.rb`.
+- **A maintainer** merges that PR and runs `scripts/bump-homebrew-cask.sh`,
+  which re-verifies the sha256 and the notarization ticket against the live
+  asset before calling `brew bump-cask-pr`.
+
+The token then lives only in that maintainer's shell:
+
+```bash
+export HOMEBREW_GITHUB_API_TOKEN=ghp_...   # classic PAT, `repo` scope
+scripts/bump-homebrew-cask.sh v1.13.2
+```
+
+Create one at
+<https://github.com/settings/tokens/new?scopes=repo&description=Homebrew%20cask%20bump>.
+Prefer a dedicated bot account whose only asset is a fork of `homebrew-cask`, so
+a leak reaches nothing else.
+
+### Winget
+
+Same split, and it needs **no token at all**. `scripts/bump-winget.sh` drives
+`gh`, which a maintainer is already authenticated with, and it does not need
+`wingetcreate` (Windows-only) because winget manifests are plain YAML — so it
+runs fine from macOS or Linux:
+
+```bash
+scripts/bump-winget.sh v1.13.2
+```
+
+CI (`bump-winget.yml`, `GITHUB_TOKEN` only) does the bookkeeping: downloads the
+MSI, computes the sha256, reads the `ProductCode` out of the MSI Property table
+with `msitools`, and opens an in-repo PR syncing
+`desktopApp/packaging/winget/*.yaml`. The script re-verifies the sha256 against
+the live asset, then forks `microsoft/winget-pkgs`, commits the three manifests
+to `manifests/v/VitorPamplona/Amethyst/<version>/`, and opens the PR.
+
+The previous design stored a classic `public_repo` PAT as `WINGET_TOKEN` and
+passed it to the third-party `vedantmgoyal9/winget-releaser` action — a token
+with write access to every public repo the account owns, handed to code we do
+not control, in a place any push-access collaborator could read it from. None of
+that is needed.

 ### Homebrew cask (one-time initial PR)

@@ -636,12 +718,19 @@ by any other channel.

 | OS | App location | State directories |
 |---|---|---|
-| macOS | `/Applications/Amethyst.app` | `~/Library/Application Support/Amethyst`<br>`~/Library/Preferences/com.vitorpamplona.amethyst.desktop.plist`<br>`~/Library/Caches/Amethyst` |
+| macOS | `/Applications/Amethyst.app` | `~/.amethyst` (accounts + keys)<br>`~/Library/Application Support/Amethyst` (Tor)<br>`~/Library/Caches/AmethystDesktop` (image cache)<br>`~/Library/Preferences/com.apple.java.util.prefs.plist` (**shared** — see below) |
 | Windows | `%LOCALAPPDATA%\Amethyst` or `C:\Program Files\Amethyst` | `%APPDATA%\Amethyst`<br>`%LOCALAPPDATA%\Amethyst` |
 | Linux (deb/rpm) | `/opt/amethyst` | `~/.config/amethyst`<br>`~/.local/share/amethyst`<br>`~/.cache/amethyst` |
 | Linux (AppImage/tar.gz) | user-chosen | Same as above |
 | Linux (Flatpak) | `/var/lib/flatpak` or `~/.local/share/flatpak` | `~/.var/app/com.vitorpamplona.amethyst.Desktop/` |

+**macOS preferences are in a SHARED file.** `DesktopPreferences` uses the Java
+Preferences API, which on macOS writes into
+`~/Library/Preferences/com.apple.java.util.prefs.plist` — one plist for *every*
+Java application on the machine, not a per-app file. Never delete it to "reset
+Amethyst": that wipes unrelated apps' settings. This is why the Homebrew cask's
+`zap` stanza deliberately omits it.
+
 Uninstall:

 - Homebrew: `brew uninstall --cask amethyst-nostr && brew zap amethyst-nostr`
@@ -328,16 +328,16 @@ repositories {
 Add the following line to your `commonMain` dependencies:

 ```gradle
-implementation('com.vitorpamplona.quartz:quartz:1.13.0')
+implementation('com.vitorpamplona.quartz:quartz:1.13.1')
 ```

 Variations to each platform are also available:

 ```gradle
-implementation('com.vitorpamplona.quartz:quartz-android:1.13.0')
-implementation('com.vitorpamplona.quartz:quartz-jvm:1.13.0')
-implementation('com.vitorpamplona.quartz:quartz-iosarm64:1.13.0')
-implementation('com.vitorpamplona.quartz:quartz-iossimulatorarm64:1.13.0')
+implementation('com.vitorpamplona.quartz:quartz-android:1.13.1')
+implementation('com.vitorpamplona.quartz:quartz-jvm:1.13.1')
+implementation('com.vitorpamplona.quartz:quartz-iosarm64:1.13.1')
+implementation('com.vitorpamplona.quartz:quartz-iossimulatorarm64:1.13.1')
 ```

 Check versions on [MavenCentral](https://central.sonatype.com/search?q=com.vitorpamplona.quartz)
@@ -14,7 +14,7 @@ specific to shipping the official Amethyst artifacts.

 ## At a glance

-A release is one tag push that fans out to five distribution channels:
+A release is one tag push that fans out to four live distribution channels:

 | Channel | Mechanism | Who pushes |
 |---|---|---|
@@ -22,10 +22,11 @@ A release is one tag push that fans out to five distribution channels:
 | **Google Play** | **Manual** — download the signed AAB from the GH Release, upload in Play Console | Maintainer |
 | **F-Droid** | **Pull** — F-Droid's build server builds the `fdroid` flavor from source when it sees the new tag | F-Droid (we just maintain the recipe + metadata) |
 | **Zapstore** | `zsp publish` reads `zapstore.yaml`, signs a Nostr release event with Amethyst's nsec | Maintainer |
-| **Homebrew + Winget** | Automatic — `bump-homebrew.yml` / `bump-winget.yml` fire on stable tags | CI |
+| **Homebrew + Winget** | ⚠️ **Not shipping.** The bump workflows run, but skip: neither package exists upstream yet | Nobody (see § 3) |

 Maven Central (the `quartz` library) also publishes automatically from the same
-workflow.
+workflow — as a *step* at the end of the `deploy-android` job, not a job of its
+own, so don't expect to find it in the run's job list.

 ---

@@ -61,8 +62,10 @@ workflow.
   `scripts/translators.sh --seed` with `CROWDIN_PROJECT_ID` /
   `CROWDIN_PERSONAL_TOKEN` set, which refreshes the file.)

-3. **Publish the release-notes note on Nostr** with Amethyst's account and paste
-   its event id into `amethyst/build.gradle.kts`:
+3. **Publish the release-notes note on Nostr** — *minor releases only.* In
+   practice this id has only ever been bumped on `x.y.0` (1.11.0, 1.12.0,
+   1.13.0); patch releases leave it pointing at their minor's note. Publish with
+   Amethyst's account and paste the event id into `amethyst/build.gradle.kts`:
   ```kotlin
   buildConfigField("String", "RELEASE_NOTES_ID", "\"<new-event-id-hex>\"")
   ```
@@ -85,17 +88,33 @@ workflow.
 Commit, tag, push — see [`BUILDING.md` § Release runbook](BUILDING.md#release-runbook)
 for the exact commands. The tag must equal `app` from the catalog (the workflow
 asserts this and fails fast otherwise). A clean `vMAJOR.MINOR.PATCH` tag is
-classified **stable** and triggers the Homebrew/Winget bumps; anything with a
-`-rc`/`-beta`/`-alpha`/`-dev` suffix is a prerelease and skips them.
+classified **stable** and runs the Homebrew/Winget bump workflows; anything with
+a `-rc`/`-beta`/`-alpha`/`-dev` suffix is a prerelease and skips them.
+
+Heads-up on the `git push`: this repo has `git-credential-manager` configured as
+a credential helper, and it blocks on an interactive prompt (a plain
+`GIT_TERMINAL_PROMPT=0` does **not** stop it — the push just hangs). If that
+happens, push using `gh`'s helper for the one command:
+
+```bash
+git -c credential.helper= -c credential.helper='!gh auth git-credential' push upstream main
+```

 When the `Create Release Assets` workflow finishes (~25–30 min) the GH Release
-holds, per the asset-name contract:
+holds **31 assets**, per the asset-name contract:

- **Android:** 5 Google Play APKs + 5 F-Droid APKs + 2 AABs
-  (`amethyst-googleplay-*-v…apk` / `.aab`, `amethyst-fdroid-*-v…apk` / `.aab`)
- **Desktop:** 8 assets (DMG/MSI/DEB/RPM/AppImage/zip/tar.gz)
- **CLI:** the `amy` artifacts
- **Maven Central:** `com.vitorpamplona.quartz:quartz:<version>` published
+- **Android (13):** 5 Google Play APKs + 5 F-Droid APKs + 2 AABs + the F-Droid
+  `.apks` set for Accrescent
+  (`amethyst-googleplay-*-v…apk` / `.aab`, `amethyst-fdroid-*-v…apk` / `.aab` / `.apks`)
+- **Desktop (8):** DMG (macOS **arm64 only** — there is no Intel DMG),
+  MSI + zip, DEB, RPM, AppImage, flatpak, tar.gz
+- **CLI (5):** the `amy` artifacts
+- **Relay (5):** the `geode` artifacts, plus the geode Docker image
+- **Maven Central:** `com.vitorpamplona.quartz:quartz:<version>` published.
+  `repo1.maven.org` lags the publish by tens of minutes — a 404 right after the
+  run is normal. Confirm the step's log says "Deployment is being published to
+  Maven Central", and compare against the *previous* version's POM before
+  concluding anything is broken.

 ---

@@ -165,11 +184,53 @@ RELAY_URLS="wss://relay.zapstore.dev,wss://relay.damus.io,wss://nos.lol,wss://vi
 Keep `wss://relay.zapstore.dev` in the list — that is the relay the Zapstore app
 itself reads from.

-### Homebrew + Winget — automatic
-`bump-homebrew.yml` and `bump-winget.yml` fire on stable tags and open PRs
-against `Homebrew/homebrew-cask` (cask `amethyst-nostr`) and
-`microsoft/winget-pkgs` (`VitorPamplona.Amethyst`). No action unless one fails —
-then see BUILDING.md § Bootstrap and § Incident response.
+### Homebrew + Winget — ⚠️ not shipping yet
+
+`bump-homebrew.yml` and `bump-winget.yml` are wired to open PRs against
+`Homebrew/homebrew-cask` (cask `amethyst-nostr`) and `microsoft/winget-pkgs`
+(`VitorPamplona.Amethyst`) — but **neither package has ever been submitted
+upstream**, so both workflows detect that and skip with a `::warning::`. As of
+**v1.13.1** these two channels deliver nothing; macOS and Windows users get the
+desktop app from GitHub Releases only.
+
+Two separate faults kept this invisible until v1.13.1, both now fixed:
+
+1. **The workflows never ran at all** — for *any* release. They triggered on
+   `release: types: [released]`, and GitHub does not raise workflow-triggering
+   events for a release created by `GITHUB_TOKEN`, which is exactly how
+   `create-release.yml` creates it. They now trigger on `workflow_run` after
+   `Create Release Assets` succeeds, which also fixes a latent race — the old
+   event fired while assets were still uploading.
+2. **Nothing exists upstream to bump.** `brew bump-cask-pr` and
+   `winget-releaser` can only *update* an existing package. The first
+   submission is a manual, human-reviewed PR: BUILDING.md § Homebrew cask
+   (one-time initial PR) and § Winget (one-time initial submission).
+
+Until someone does that bootstrap, a green release run means the bump workflows
+*skipped cleanly* — not that Homebrew/Winget shipped. Check the run's warnings
+if you want to confirm which case you're in.
+
+**Both bumps are half-manual by design.** CI does the bookkeeping with
+`GITHUB_TOKEN` only — verifying the artifact, computing hashes, and opening an
+in-repo PR syncing the reference packaging files. Pushing upstream needs
+credentials that would be dangerous as CI secrets (a `repo`-scoped PAT is
+readable by anyone with push access here), so a maintainer runs the last step:
+
+```bash
+# after merging the sync PRs
+export HOMEBREW_GITHUB_API_TOKEN=ghp_...     # classic PAT, `repo` scope
+scripts/bump-homebrew-cask.sh v1.13.2
+
+scripts/bump-winget.sh v1.13.2               # no token — uses your `gh` auth
+```
+
+Both scripts re-verify the published artifact's sha256 before submitting, and
+the Homebrew one additionally refuses if the DMG is not notarized + stapled.
+See BUILDING.md § Package-manager credentials.
+
+All four in-repo sync workflows (`amy` formula, `geode` formula,
+`amethyst-nostr` cask, winget manifests) open PRs against *this* repo on every
+release. Merge them to keep the reference packaging files current.

 ---

@@ -211,7 +272,7 @@ ownership:
 | `SIGNING_KEY`, `KEY_ALIAS`, `KEY_STORE_PASSWORD`, `KEY_PASSWORD` | The **Android upload keystore** — losing/leaking it is the worst case; Play app signing identity | Keep the keystore backed up offline; never rotate casually (Play upload key reset is a support process) |
 | `SONATYPE_USERNAME`, `SONATYPE_PASSWORD` | Maven Central namespace `com.vitorpamplona` | On compromise |
 | `SIGNING_PRIVATE_KEY`, `SIGNING_PASSWORD` | The **GPG key** signing Maven artifacts | Per GPG key expiry |
-| `HOMEBREW_TOKEN`, `WINGET_TOKEN` | Cask + winget bump PRs | **90-day cadence** (see BUILDING.md § Bootstrap) |
+| *(none for Homebrew/Winget)* | — | Both bumps run on a maintainer's machine — `scripts/bump-homebrew-cask.sh` and `scripts/bump-winget.sh` — so neither channel's PAT ever becomes a CI secret. See BUILDING.md § Package-manager credentials |
 | `CROWDIN_PERSONAL_TOKEN`, `CROWDIN_PROJECT_ID` | Translation sync | On compromise |

 Owner assignments and rotation reminders live with the team (issue tracker).
@@ -222,13 +283,23 @@ Owner assignments and rotation reminders live with the team (issue tracker).

 ## 6. Post-release verification

- [ ] GH Release: expected asset count, Intel + ARM DMGs, sizes sane.
- [ ] Maven Central: `quartz:<version>` resolves (allow propagation time).
+- [ ] GH Release: 31 assets, sizes sane, and the asset-name set matches the
+      previous release (see the `diff` one-liner in BUILDING.md § Release
+      runbook). macOS is arm64-only — do **not** look for an Intel DMG.
+- [ ] Maven Central: `quartz:<version>` resolves (allow tens of minutes of
+      propagation; the publish step's log is the authoritative signal).
 - [ ] Play Console: rollout started, no policy rejection.
 - [ ] Zapstore: release event visible.
 - [ ] F-Droid: new version detected (may lag days).
- [ ] Homebrew + Winget bump PRs opened (stable only).
- [ ] In-app "Release Notes" link opens the note matching `RELEASE_NOTES_ID`.
+- [ ] Four sync PRs opened against this repo (`amy` formula, `geode` formula,
+      `amethyst-nostr` cask, winget manifests) — merge them.
+- [ ] Cask pushed upstream: `scripts/bump-homebrew-cask.sh vX.Y.Z` (manual, needs
+      `HOMEBREW_GITHUB_API_TOKEN` in your shell).
+- [ ] Winget pushed upstream: `scripts/bump-winget.sh vX.Y.Z` (manual, no token —
+      uses your `gh` auth).
+      Both scripts error clearly until the one-time bootstrap PRs land (§ 3).
+- [ ] In-app "Release Notes" link opens the note matching `RELEASE_NOTES_ID`
+      (only bumped on minor releases — patches keep pointing at the x.y.0 note).
 - [ ] Push still works on a `play` build (only if the push contract changed —
      see § 4); UnifiedPush still works on an `fdroid` build.

@@ -295,6 +295,93 @@
            </intent-filter>
        </activity-alias>

+        <!-- "New Picture" share target: a gallery (or camera) shares an image and it goes straight
+             into the picture feed as a NIP-68 kind-20 post instead of a text note with a link. The
+             android:name simple class ("ShareAsPictureAlias") is matched at runtime by
+             ShareIntentRouting.SHARE_AS_PICTURE_ALIAS_SIMPLE_NAME; keep the two in sync. -->
+        <activity-alias
+            android:name=".ui.ShareAsPictureAlias"
+            android:exported="true"
+            android:label="@string/share_target_as_picture"
+            android:targetActivity=".ui.MainActivity">
+
+            <intent-filter android:label="@string/share_target_as_picture">
+                <action android:name="android.intent.action.SEND" />
+                <category android:name="android.intent.category.DEFAULT" />
+                <data android:mimeType="image/*" />
+            </intent-filter>
+
+            <intent-filter android:label="@string/share_target_as_picture">
+                <action android:name="android.intent.action.SEND_MULTIPLE" />
+                <category android:name="android.intent.category.DEFAULT" />
+                <data android:mimeType="image/*" />
+            </intent-filter>
+        </activity-alias>
+
+        <!-- "New Short" share target: a video shared here always becomes a NIP-71 kind-22 short so
+             it lands in the Shorts feed, whatever its orientation. Video-only — a short is a video.
+             The android:name simple class ("ShareAsShortVideoAlias") is matched at runtime by
+             ShareIntentRouting.SHARE_AS_SHORT_VIDEO_ALIAS_SIMPLE_NAME; keep the two in sync. -->
+        <activity-alias
+            android:name=".ui.ShareAsShortVideoAlias"
+            android:exported="true"
+            android:label="@string/share_target_as_short_video"
+            android:targetActivity=".ui.MainActivity">
+
+            <intent-filter android:label="@string/share_target_as_short_video">
+                <action android:name="android.intent.action.SEND" />
+                <category android:name="android.intent.category.DEFAULT" />
+                <data android:mimeType="video/*" />
+            </intent-filter>
+
+            <intent-filter android:label="@string/share_target_as_short_video">
+                <action android:name="android.intent.action.SEND_MULTIPLE" />
+                <category android:name="android.intent.category.DEFAULT" />
+                <data android:mimeType="video/*" />
+            </intent-filter>
+        </activity-alias>
+
+        <!-- "New Video" share target: opens the Video feed's media composer, which publishes a
+             NIP-71 video event (kind 21 or 22 by orientation) instead of a text note. The
+             android:name simple class ("ShareAsVideoAlias") is matched at runtime by
+             ShareIntentRouting.SHARE_AS_VIDEO_ALIAS_SIMPLE_NAME; keep the two in sync. -->
+        <activity-alias
+            android:name=".ui.ShareAsVideoAlias"
+            android:exported="true"
+            android:label="@string/share_target_as_video"
+            android:targetActivity=".ui.MainActivity">
+
+            <intent-filter android:label="@string/share_target_as_video">
+                <action android:name="android.intent.action.SEND" />
+                <category android:name="android.intent.category.DEFAULT" />
+                <data android:mimeType="video/*" />
+            </intent-filter>
+
+            <intent-filter android:label="@string/share_target_as_video">
+                <action android:name="android.intent.action.SEND_MULTIPLE" />
+                <category android:name="android.intent.category.DEFAULT" />
+                <data android:mimeType="video/*" />
+            </intent-filter>
+        </activity-alias>
+
+        <!-- "New Highlight" share target: a browser (or reader) shares a selected passage of
+             text and it opens the NIP-84 highlight composer. Text-only — a highlight is a text
+             passage, so no image/video filters here. The android:name simple class
+             ("ShareAsHighlightAlias") is matched at runtime by
+             ShareIntentRouting.SHARE_AS_HIGHLIGHT_ALIAS_SIMPLE_NAME; keep the two in sync. -->
+        <activity-alias
+            android:name=".ui.ShareAsHighlightAlias"
+            android:exported="true"
+            android:label="@string/share_target_as_highlight"
+            android:targetActivity=".ui.MainActivity">
+
+            <intent-filter android:label="@string/share_target_as_highlight">
+                <action android:name="android.intent.action.SEND" />
+                <category android:name="android.intent.category.DEFAULT" />
+                <data android:mimeType="text/plain" />
+            </intent-filter>
+        </activity-alias>
+
        <!-- Health Connect privacy-policy rationale on Android 14+. Without this activity-alias
             the permission request fails silently (no dialog appears). The system launches it,
             guarded by START_VIEW_PERMISSION_USAGE, to show our privacy policy; it routes into
@@ -56,11 +56,36 @@ import java.io.File
 */
 class Amethyst : Application() {
    init {
-        Log.minLevel = if (BuildConfig.DEBUG) LogLevel.DEBUG else LogLevel.ERROR
+        Log.minLevel = DEFAULT_LOG_LEVEL
        Log.d("AmethystApp") { "Creating App $this" }
    }

    companion object {
+        /**
+         * Restores the full firehose in debug builds: per-socket relay lifecycle
+         * (`Connecting…`/`Disconnected`/`OnOpen`), per-second event throughput, per-stream Arti
+         * SOCKS errors and per-relay census detail.
+         *
+         * Off by default. A cold start on the outbox model dials ~400 relays, and those sources
+         * alone emit ~3.7k of the ~6.2k lines an 80s boot produces — which buries the boot
+         * narrative and the relay-protocol warnings (`auth-required`, `rate-limited`,
+         * `unsupported: too many filters`) that are the actionable ones. Flip this, or set
+         * [Log.minLevel] at runtime, when you need the per-socket detail back.
+         */
+        const val VERBOSE_LOGS = false
+
+        /**
+         * Debug defaults to INFO so a boot reads as a narrative plus warnings; release defaults to
+         * WARN rather than ERROR so relay-protocol refusals stay visible in the field — they are
+         * the highest-value-per-line diagnostics we emit and were previously dropped entirely.
+         */
+        val DEFAULT_LOG_LEVEL: LogLevel =
+            when {
+                !BuildConfig.DEBUG -> LogLevel.WARN
+                VERBOSE_LOGS -> LogLevel.DEBUG
+                else -> LogLevel.INFO
+            }
+
        lateinit var instance: AppModules
            private set
    }
@@ -83,10 +108,15 @@ class Amethyst : Application() {
        // is self-contained (WebView + IPC), so we skip all app init there and
        // leave `instance` unset; any accidental use fails fast.
        if (isNappletSandbox) {
-            Log.d("AmethystApp") { "Skipping AppModules init in sandbox process" }
+            // Milestone, not chatter: this is the one line that explains why `instance` is unset
+            // and `LocalCache` is empty in this process. Without it a napplet-process log looks
+            // like a broken app rather than a deliberately secret-free sandbox.
+            Log.i("AmethystApp") { "Napplet sandbox process starting — no account, no AppModules" }
            return
        }

+        Log.i("AmethystApp") { "Amethyst ${BuildConfig.VERSION_NAME} starting in main process (log level ${Log.minLevel})" }
+
        instance = AppModules(this)

        // Hydrate the device-local favorite-apps list (main process only; the sandbox never reads it).
@@ -51,6 +51,7 @@ import com.vitorpamplona.amethyst.model.preferences.BuzzChannelStarPreferences
 import com.vitorpamplona.amethyst.model.preferences.BuzzWorkspacePreferences
 import com.vitorpamplona.amethyst.model.preferences.NamecoinSharedPreferences
 import com.vitorpamplona.amethyst.model.preferences.OtsSharedPreferences
+import com.vitorpamplona.amethyst.model.preferences.RelayGroupDeletionPreferences
 import com.vitorpamplona.amethyst.model.preferences.TorSharedPreferences
 import com.vitorpamplona.amethyst.model.preferences.UiSharedPreferences
 import com.vitorpamplona.amethyst.model.privacyOptions.RoleBasedHttpClientBuilder
@@ -73,6 +74,8 @@ import com.vitorpamplona.amethyst.service.notifications.AlwaysOnNotificationServ
 import com.vitorpamplona.amethyst.service.notifications.NotificationDispatcher
 import com.vitorpamplona.amethyst.service.notifications.NwcPaymentNotificationWatcher
 import com.vitorpamplona.amethyst.service.notifications.PokeyReceiver
+import com.vitorpamplona.amethyst.service.okhttp.BlossomReadAuthInterceptor
+import com.vitorpamplona.amethyst.service.okhttp.BlossomReadAuthTokenProvider
 import com.vitorpamplona.amethyst.service.okhttp.DualHttpClientManager
 import com.vitorpamplona.amethyst.service.okhttp.DualHttpClientManagerForRelays
 import com.vitorpamplona.amethyst.service.okhttp.EncryptionKeyCache
@@ -285,6 +288,11 @@ class AppModules(
    // Restore + persist the user's starred Buzz workspace channels across restarts (device-global).
    val buzzChannelStarPrefs = BuzzChannelStarPreferences(appContext, applicationIOScope)

+    // Restore + persist the set of relay-group channels deleted (kind-9008) on this device, so a
+    // deleted channel stays hidden across a restart even if the host relay re-announces a stale
+    // kind-44100 for it (device-global; a delete is authoritative and terminal for everyone).
+    val relayGroupDeletionPrefs = RelayGroupDeletionPreferences(appContext, applicationIOScope)
+
    // Service that will run at all times to receive events from Pokey
    val pokeyReceiver = PokeyReceiver()

@@ -424,6 +432,16 @@ class AppModules(
            },
            onionCache = onionLocationCache,
            usageInterceptor = httpUsageInterceptor,
+            // Retries auth-gated Blossom blob downloads (e.g. Buzz's private
+            // media relay) with a BUD-01 read-auth token signed by the current
+            // account on a 401. Reads the signer at call time so it always
+            // tracks the logged-in account.
+            blossomReadAuth =
+                BlossomReadAuthInterceptor(
+                    BlossomReadAuthTokenProvider(
+                        signerProvider = { sessionManager.loggedInAccount()?.signer },
+                    )::authHeader,
+                ),
        )

    // Offers easy methods to know when connections are happening through Tor or not
@@ -1212,6 +1230,14 @@ class AppModules(
                        blossomResolver.uriToUrlCache.evictAll()
                        blossomResolver.blossomHitCache.cache.evictAll()
                        localBlossomCacheProbe.invalidate()
+                        // Re-probe immediately so enabling the feature activates it
+                        // this session. Otherwise `available` only advances when a
+                        // `blossom:` URI is resolved, and the common feed-image path
+                        // never routes through the resolver until `available` is
+                        // already true — so a freshly-enabled toggle (or a cache that
+                        // came up after launch) would stay dormant and the settings
+                        // "detected" chip would read stale.
+                        localBlossomCacheProbe.isAvailable()
                    }
                }
            }
@@ -33,6 +33,7 @@ import com.vitorpamplona.amethyst.commons.model.nip47WalletConnect.NwcWalletEntr
 import com.vitorpamplona.amethyst.commons.model.nip47WalletConnect.NwcWalletEntryNorm
 import com.vitorpamplona.amethyst.commons.relayauth.RelayAuthPolicy
 import com.vitorpamplona.amethyst.model.AccountSettings
+import com.vitorpamplona.amethyst.model.HomeFeedType
 import com.vitorpamplona.amethyst.model.TopFilter
 import com.vitorpamplona.amethyst.model.UiSettings
 import com.vitorpamplona.amethyst.service.checkNotInMainThread
@@ -72,6 +73,7 @@ import com.vitorpamplona.quartz.nip78AppData.AppSpecificDataEvent
 import com.vitorpamplona.quartz.nip85TrustedAssertions.list.TrustProviderListEvent
 import com.vitorpamplona.quartz.nipB1Bolt12Zaps.offer.Bolt12OfferListEvent
 import com.vitorpamplona.quartz.utils.Log
+import com.vitorpamplona.quartz.utils.TimeUtils
 import kotlinx.coroutines.CancellationException
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.async
@@ -131,6 +133,7 @@ private object PrefKeys {
    const val DEFAULT_NSITES_FOLLOW_LIST = "defaultNsitesFollowList"
    const val DEFAULT_WORKOUTS_FOLLOW_LIST = "defaultWorkoutsFollowList"
    const val DEFAULT_GIT_REPOSITORIES_FOLLOW_LIST = "defaultGitRepositoriesFollowList"
+    const val DEFAULT_HIGHLIGHTS_FOLLOW_LIST = "defaultHighlightsFollowList"
    const val DEFAULT_CALENDARS_FOLLOW_LIST = "defaultCalendarsFollowList"
    const val DEFAULT_PRODUCTS_FOLLOW_LIST = "defaultProductsFollowList"
    const val DEFAULT_SHORTS_FOLLOW_LIST = "defaultShortsFollowList"
@@ -188,6 +191,10 @@ private object PrefKeys {
    // Stores the DISABLED chat feed types (comma-joined codes) so absence = all-on and any newly
    // added type defaults enabled for accounts that customized before it existed.
    const val DISABLED_CHAT_FEEDS = "disabled_chat_feeds"
+
+    // Same convention as DISABLED_CHAT_FEEDS but for the Home feed's event-kind groups: stores the
+    // DISABLED codes so absence = all-on and any newly added group defaults enabled.
+    const val DISABLED_HOME_FEED_TYPES = "disabled_home_feed_types"
    const val RELAY_AUTH_TRUST_MY_RELAYS = "relay_auth_trust_my_relays_and_venues"
    const val RELAY_AUTH_TRUST_READ_FOLLOWS = "relay_auth_trust_read_follows"
    const val RELAY_AUTH_TRUST_MESSAGE_FOLLOWS = "relay_auth_trust_message_follows"
@@ -319,6 +326,9 @@ object LocalPreferences {
                    }

                if (!newSystemOfAccounts.isNullOrEmpty()) {
+                    // How many accounts are in play is the first thing you need when reading any
+                    // boot log: nearly every per-account subsystem below multiplies by this number.
+                    Log.i("LocalPreferences") { "Found ${newSystemOfAccounts.size} saved account(s)" }
                    newSystemOfAccounts
                } else {
                    val oldAccounts = getString(PrefKeys.SAVED_ACCOUNTS, null)?.split(COMMA) ?: listOf()
@@ -517,6 +527,7 @@ object LocalPreferences {
                    putString(PrefKeys.DEFAULT_NSITES_FOLLOW_LIST, JsonMapper.toJson(settings.defaultNsitesFollowList.value))
                    putString(PrefKeys.DEFAULT_WORKOUTS_FOLLOW_LIST, JsonMapper.toJson(settings.defaultWorkoutsFollowList.value))
                    putString(PrefKeys.DEFAULT_GIT_REPOSITORIES_FOLLOW_LIST, JsonMapper.toJson(settings.defaultGitRepositoriesFollowList.value))
+                    putString(PrefKeys.DEFAULT_HIGHLIGHTS_FOLLOW_LIST, JsonMapper.toJson(settings.defaultHighlightsFollowList.value))
                    putString(PrefKeys.DEFAULT_CALENDARS_FOLLOW_LIST, JsonMapper.toJson(settings.defaultCalendarsFollowList.value))
                    putString(PrefKeys.DEFAULT_PRODUCTS_FOLLOW_LIST, JsonMapper.toJson(settings.defaultProductsFollowList.value))
                    putString(PrefKeys.DEFAULT_SHORTS_FOLLOW_LIST, JsonMapper.toJson(settings.defaultShortsFollowList.value))
@@ -604,6 +615,7 @@ object LocalPreferences {
                    putString(PrefKeys.RELAY_GROUP_VIEW_MODE, settings.relayGroupViewMode.value.name)
                    putString(PrefKeys.CONCORD_VIEW_MODE, settings.concordViewMode.value.name)
                    putString(PrefKeys.DISABLED_CHAT_FEEDS, ChatFeedType.encode(ChatFeedType.ALL - settings.enabledChatFeeds.value))
+                    putString(PrefKeys.DISABLED_HOME_FEED_TYPES, HomeFeedType.encode(HomeFeedType.ALL - settings.enabledHomeFeedTypes.value))
                    putBoolean(PrefKeys.RELAY_AUTH_TRUST_MY_RELAYS, settings.relayAuthTrustMyRelaysAndVenues.value)
                    putBoolean(PrefKeys.RELAY_AUTH_TRUST_READ_FOLLOWS, settings.relayAuthTrustReadFollows.value)
                    putBoolean(PrefKeys.RELAY_AUTH_TRUST_MESSAGE_FOLLOWS, settings.relayAuthTrustMessageFollows.value)
@@ -704,6 +716,7 @@ object LocalPreferences {

    private suspend fun innerLoadCurrentAccountFromEncryptedStorage(npub: String?): AccountSettings? {
        Log.d("LocalPreferences") { "Load account from file $npub" }
+        val startedAtMs = TimeUtils.nowMillis()
        val result =
            withContext(Dispatchers.IO) {
                return@withContext with(encryptedPreferences(npub)) {
@@ -731,17 +744,10 @@ object LocalPreferences {
                    val hideNIP17WarningDialog = getBoolean(PrefKeys.HIDE_NIP_17_WARNING_DIALOG, false)
                    val callsEnabled = getBoolean(PrefKeys.CALLS_ENABLED, true)
                    val alwaysOnNotificationService = getBoolean(PrefKeys.ALWAYS_ON_NOTIFICATION_SERVICE, false)
-                    val defaultRelayAuthPolicy =
-                        getString(PrefKeys.DEFAULT_RELAY_AUTH_POLICY, null)
-                            ?.let { runCatching { RelayAuthPolicy.valueOf(it) }.getOrNull() }
-                            ?: RelayAuthPolicy.CUSTOM
-                    val relayGroupViewMode = RelayGroupViewMode.fromName(getString(PrefKeys.RELAY_GROUP_VIEW_MODE, null))
-                    val concordViewMode = ConcordViewMode.fromName(getString(PrefKeys.CONCORD_VIEW_MODE, null))
-                    val enabledChatFeeds = ChatFeedType.ALL - ChatFeedType.decode(getString(PrefKeys.DISABLED_CHAT_FEEDS, null))
-                    val relayAuthTrustMyRelays = getBoolean(PrefKeys.RELAY_AUTH_TRUST_MY_RELAYS, true)
-                    val relayAuthTrustReadFollows = getBoolean(PrefKeys.RELAY_AUTH_TRUST_READ_FOLLOWS, true)
-                    val relayAuthTrustMessageFollows = getBoolean(PrefKeys.RELAY_AUTH_TRUST_MESSAGE_FOLLOWS, true)
-                    val relayAuthTrustMessageStrangers = getBoolean(PrefKeys.RELAY_AUTH_TRUST_MESSAGE_STRANGERS, false)
+                    // Read as a group via a helper: this load lambda sits right at the JVM's
+                    // per-method bytecode limit (see the note above the awaits below), so keeping
+                    // these heavy string/enum decodes out of it preserves headroom.
+                    val inboxPrefs = readInboxPrefs()
                    val splitNotificationsEnabled = getBoolean(PrefKeys.SPLIT_NOTIFICATIONS_ENABLED, false)
                    val showMessagesInNotifications = getBoolean(PrefKeys.SHOW_MESSAGES_IN_NOTIFICATIONS, true)
                    val hasDonatedInVersion = getStringSet(PrefKeys.HAS_DONATED_IN_VERSION, null) ?: setOf()
@@ -936,6 +942,7 @@ object LocalPreferences {
                        defaultNsitesFollowList = MutableStateFlow(followListPrefs.nsites),
                        defaultWorkoutsFollowList = MutableStateFlow(followListPrefs.workouts),
                        defaultGitRepositoriesFollowList = MutableStateFlow(followListPrefs.gitRepositories),
+                        defaultHighlightsFollowList = MutableStateFlow(followListPrefs.highlights),
                        defaultCalendarsFollowList = MutableStateFlow(followListPrefs.calendars),
                        defaultProductsFollowList = MutableStateFlow(followListPrefs.products),
                        defaultShortsFollowList = MutableStateFlow(followListPrefs.shorts),
@@ -968,14 +975,15 @@ object LocalPreferences {
                        hideBlockAlertDialog = hideBlockAlertDialog,
                        hideNIP17WarningDialog = hideNIP17WarningDialog,
                        alwaysOnNotificationService = MutableStateFlow(alwaysOnNotificationService),
-                        defaultRelayAuthPolicy = MutableStateFlow(defaultRelayAuthPolicy),
-                        relayGroupViewMode = MutableStateFlow(relayGroupViewMode),
-                        concordViewMode = MutableStateFlow(concordViewMode),
-                        enabledChatFeeds = MutableStateFlow(enabledChatFeeds),
-                        relayAuthTrustMyRelaysAndVenues = MutableStateFlow(relayAuthTrustMyRelays),
-                        relayAuthTrustReadFollows = MutableStateFlow(relayAuthTrustReadFollows),
-                        relayAuthTrustMessageFollows = MutableStateFlow(relayAuthTrustMessageFollows),
-                        relayAuthTrustMessageStrangers = MutableStateFlow(relayAuthTrustMessageStrangers),
+                        defaultRelayAuthPolicy = MutableStateFlow(inboxPrefs.defaultRelayAuthPolicy),
+                        relayGroupViewMode = MutableStateFlow(inboxPrefs.relayGroupViewMode),
+                        concordViewMode = MutableStateFlow(inboxPrefs.concordViewMode),
+                        enabledChatFeeds = MutableStateFlow(inboxPrefs.enabledChatFeeds),
+                        enabledHomeFeedTypes = MutableStateFlow(inboxPrefs.enabledHomeFeedTypes),
+                        relayAuthTrustMyRelaysAndVenues = MutableStateFlow(inboxPrefs.relayAuthTrustMyRelays),
+                        relayAuthTrustReadFollows = MutableStateFlow(inboxPrefs.relayAuthTrustReadFollows),
+                        relayAuthTrustMessageFollows = MutableStateFlow(inboxPrefs.relayAuthTrustMessageFollows),
+                        relayAuthTrustMessageStrangers = MutableStateFlow(inboxPrefs.relayAuthTrustMessageStrangers),
                        splitNotificationsEnabled = MutableStateFlow(splitNotificationsEnabled),
                        showMessagesInNotifications = MutableStateFlow(showMessagesInNotifications),
                        backupUserMetadata = latestUserMetadataResolved,
@@ -1014,7 +1022,11 @@ object LocalPreferences {
                    )
                }
            }
-        Log.d("LocalPreferences") { "Loaded account from file $npub" }
+        // Milestone with its cost attached. Decrypting and parsing one account's settings is one of
+        // the most expensive things a cold start does (it resolves a fan of backup events), it runs
+        // once per account, and "which account was slow" is the first question when a boot drags.
+        // The six intermediate steps above stay at DEBUG.
+        Log.i("LocalPreferences") { "Loaded account $npub in ${TimeUtils.nowMillis() - startedAtMs}ms" }
        return result
    }

@@ -1044,6 +1056,7 @@ object LocalPreferences {
        val nsites: TopFilter,
        val workouts: TopFilter,
        val gitRepositories: TopFilter,
+        val highlights: TopFilter,
        val calendars: TopFilter,
        val products: TopFilter,
        val shorts: TopFilter,
@@ -1101,6 +1114,7 @@ object LocalPreferences {
            nsites = parseTopFilterOrDefault(getString(PrefKeys.DEFAULT_NSITES_FOLLOW_LIST, null), TopFilter.Global),
            workouts = parseTopFilterOrDefault(getString(PrefKeys.DEFAULT_WORKOUTS_FOLLOW_LIST, null), TopFilter.Global),
            gitRepositories = parseTopFilterOrDefault(getString(PrefKeys.DEFAULT_GIT_REPOSITORIES_FOLLOW_LIST, null), TopFilter.Global),
+            highlights = parseTopFilterOrDefault(getString(PrefKeys.DEFAULT_HIGHLIGHTS_FOLLOW_LIST, null), TopFilter.Global),
            calendars = parseTopFilterOrDefault(getString(PrefKeys.DEFAULT_CALENDARS_FOLLOW_LIST, null), TopFilter.Global),
            products = parseTopFilterOrDefault(getString(PrefKeys.DEFAULT_PRODUCTS_FOLLOW_LIST, null), TopFilter.AroundMe),
            shorts = parseTopFilterOrDefault(getString(PrefKeys.DEFAULT_SHORTS_FOLLOW_LIST, null), TopFilter.Global),
@@ -1184,3 +1198,36 @@ object LocalPreferences {
        }
    }
 }
+
+/**
+ * The inbox / relay-auth / feed-type preferences, read as one group. Extracted out of
+ * [LocalPreferences]' account-load lambda (which is right at the JVM's per-method bytecode limit)
+ * so these enum/set decodes don't count against that method's budget.
+ */
+private class InboxPrefs(
+    val defaultRelayAuthPolicy: RelayAuthPolicy,
+    val relayGroupViewMode: RelayGroupViewMode,
+    val concordViewMode: ConcordViewMode,
+    val enabledChatFeeds: Set<ChatFeedType>,
+    val enabledHomeFeedTypes: Set<HomeFeedType>,
+    val relayAuthTrustMyRelays: Boolean,
+    val relayAuthTrustReadFollows: Boolean,
+    val relayAuthTrustMessageFollows: Boolean,
+    val relayAuthTrustMessageStrangers: Boolean,
+)
+
+private fun SharedPreferences.readInboxPrefs() =
+    InboxPrefs(
+        defaultRelayAuthPolicy =
+            getString(PrefKeys.DEFAULT_RELAY_AUTH_POLICY, null)
+                ?.let { runCatching { RelayAuthPolicy.valueOf(it) }.getOrNull() }
+                ?: RelayAuthPolicy.CUSTOM,
+        relayGroupViewMode = RelayGroupViewMode.fromName(getString(PrefKeys.RELAY_GROUP_VIEW_MODE, null)),
+        concordViewMode = ConcordViewMode.fromName(getString(PrefKeys.CONCORD_VIEW_MODE, null)),
+        enabledChatFeeds = ChatFeedType.ALL - ChatFeedType.decode(getString(PrefKeys.DISABLED_CHAT_FEEDS, null)),
+        enabledHomeFeedTypes = HomeFeedType.ALL - HomeFeedType.decode(getString(PrefKeys.DISABLED_HOME_FEED_TYPES, null)),
+        relayAuthTrustMyRelays = getBoolean(PrefKeys.RELAY_AUTH_TRUST_MY_RELAYS, true),
+        relayAuthTrustReadFollows = getBoolean(PrefKeys.RELAY_AUTH_TRUST_READ_FOLLOWS, true),
+        relayAuthTrustMessageFollows = getBoolean(PrefKeys.RELAY_AUTH_TRUST_MESSAGE_FOLLOWS, true),
+        relayAuthTrustMessageStrangers = getBoolean(PrefKeys.RELAY_AUTH_TRUST_MESSAGE_STRANGERS, false),
+    )
@@ -50,6 +50,7 @@ import com.vitorpamplona.amethyst.commons.model.nip28PublicChats.PublicChatChann
 import com.vitorpamplona.amethyst.commons.model.nip28PublicChats.PublicChatListDecryptionCache
 import com.vitorpamplona.amethyst.commons.model.nip28PublicChats.PublicChatListState
 import com.vitorpamplona.amethyst.commons.model.nip29RelayGroups.RelayGroupChannel
+import com.vitorpamplona.amethyst.commons.model.nip29RelayGroups.RelayGroupDeletions
 import com.vitorpamplona.amethyst.commons.model.nip29RelayGroups.RelayGroupListDecryptionCache
 import com.vitorpamplona.amethyst.commons.model.nip29RelayGroups.RelayGroupListState
 import com.vitorpamplona.amethyst.commons.model.nip29RelayGroups.RelayGroupMembership
@@ -299,6 +300,7 @@ import com.vitorpamplona.quartz.nip29RelayGroups.hTag
 import com.vitorpamplona.quartz.nip29RelayGroups.metadata.GroupMetadataEvent
 import com.vitorpamplona.quartz.nip29RelayGroups.moderation.CreateGroupEvent
 import com.vitorpamplona.quartz.nip29RelayGroups.moderation.CreateInviteEvent
+import com.vitorpamplona.quartz.nip29RelayGroups.moderation.DeleteGroupEvent
 import com.vitorpamplona.quartz.nip29RelayGroups.moderation.EditMetadataEvent
 import com.vitorpamplona.quartz.nip29RelayGroups.moderation.PutUserEvent
 import com.vitorpamplona.quartz.nip29RelayGroups.moderation.RemoveUserEvent
@@ -872,6 +874,9 @@ class Account(
    val liveGitRepositoriesFollowLists: StateFlow<IFeedTopNavFilter> = topNavFilterFlow(settings.defaultGitRepositoriesFollowList)
    val liveGitRepositoriesFollowListsPerRelay = OutboxLoaderState(liveGitRepositoriesFollowLists, cache, scope).flow

+    val liveHighlightsFollowLists: StateFlow<IFeedTopNavFilter> = topNavFilterFlow(settings.defaultHighlightsFollowList)
+    val liveHighlightsFollowListsPerRelay = OutboxLoaderState(liveHighlightsFollowLists, cache, scope).flow
+
    val liveCalendarsFollowLists: StateFlow<IFeedTopNavFilter> = topNavFilterFlow(settings.defaultCalendarsFollowList)
    val liveCalendarsFollowListsPerRelay = OutboxLoaderState(liveCalendarsFollowLists, cache, scope).flow

@@ -3451,6 +3456,22 @@ class Account(
        unfollow(channel)
    }

+    /**
+     * Delete the whole group with a kind 9008 delete-group event (owner/admin only — the relay
+     * enforces this). Unlike [leaveRelayGroup], this destroys the channel for everyone rather than
+     * just removing me; the relay drops the group and its messages. Also drops it from our own list
+     * so it disappears from Messages immediately instead of lingering as a now-dead id.
+     */
+    suspend fun deleteRelayGroup(channel: RelayGroupChannel) {
+        val template = DeleteGroupEvent.build(channel.groupId.id)
+        signAndSendPrivatelyOrBroadcast(template) { channel.relays().toList() }
+        unfollow(channel)
+        // Remember the deletion so the channel leaves the community's browse list immediately and
+        // stays gone across a restart — the relay drops the group but our cached 39000 metadata (and a
+        // stale re-announced 44100 on a Buzz relay) would otherwise keep it visible.
+        RelayGroupDeletions.markDeleted(channel.groupId)
+    }
+
    /**
     * Create a new group on [relay]: kind 9007 (create-group) then kind 9002
     * (edit-metadata) with the chosen name/visibility, then remember it. Returns
@@ -3655,6 +3676,10 @@ class Account(
        parent: String? = channel.parentGroupId(),
        children: List<String> = channel.childGroupIds(),
    ) {
+        // On a Buzz relay, visibility rides a `visibility` ("open"/"private") tag — the relay does NOT
+        // read NIP-29's `private` status flag — so a Buzz channel's visibility only actually changes on
+        // edit when we send that tag. A plain NIP-29 relay ignores it and honours the status flag.
+        val isBuzz = BuzzRelayDialect.isBuzz(channel.groupId.relayUrl)
        val template =
            EditMetadataEvent.build(
                channel.groupId.id,
@@ -3666,10 +3691,24 @@ class Account(
                geohashes = geohashes,
                parent = parent,
                children = children,
+                visibility = if (isBuzz) (if (isPrivate) BUZZ_VISIBILITY_PRIVATE else BUZZ_VISIBILITY_OPEN) else null,
            )
        signAndSendPrivatelyOrBroadcast(template) { channel.relays().toList() }
    }

+    /**
+     * Archive or unarchive a Buzz channel (a minimal kind-9002 carrying only the `archived` tag). The
+     * relay hides an archived channel from the sidebar and stamps the 39000, but keeps it and its
+     * history — the reversible counterpart to [deleteRelayGroup]. Admin/owner only; the relay enforces.
+     */
+    suspend fun archiveRelayGroup(
+        channel: RelayGroupChannel,
+        archived: Boolean,
+    ) {
+        val template = EditMetadataEvent.build(channel.groupId.id, archived = archived)
+        signAndSendPrivatelyOrBroadcast(template) { channel.relays().toList() }
+    }
+
    suspend fun follow(community: AddressableNote) = sendMyPublicAndPrivateOutbox(communityList.follow(community))

    suspend fun unfollow(community: AddressableNote) = sendMyPublicAndPrivateOutbox(communityList.unfollow(community))
@@ -4106,6 +4145,7 @@ class Account(
        alt: String?,
        contentWarningReason: String?,
        originalHash: String? = null,
+        videoKind: VideoPostKind = VideoPostKind.AUTO,
    ) {
        if (!isWriteable()) return

@@ -4149,7 +4189,10 @@ class Account(
                        thumbhash = headerInfo.thumbHash?.thumbhash,
                    )

-                if (headerInfo.dim.height > headerInfo.dim.width) {
+                // The composer forces the kind when it was opened from a feed that only reads one of
+                // them (Shorts, Longs) or from that feed's share target, so the post lands where the
+                // user asked for it. Everywhere else the orientation decides.
+                if (videoKind.isShort(headerInfo.dim)) {
                    VideoShortEvent.build(videoMeta, alt ?: "") {
                        contentWarningReason?.let { contentWarning(contentWarningReason) }
                    }
@@ -251,6 +251,7 @@ class AccountSettings(
    val defaultNsitesFollowList: MutableStateFlow<TopFilter> = MutableStateFlow(TopFilter.Global),
    val defaultWorkoutsFollowList: MutableStateFlow<TopFilter> = MutableStateFlow(TopFilter.Global),
    val defaultGitRepositoriesFollowList: MutableStateFlow<TopFilter> = MutableStateFlow(TopFilter.Global),
+    val defaultHighlightsFollowList: MutableStateFlow<TopFilter> = MutableStateFlow(TopFilter.Global),
    val defaultCalendarsFollowList: MutableStateFlow<TopFilter> = MutableStateFlow(TopFilter.Global),
    val defaultProductsFollowList: MutableStateFlow<TopFilter> = MutableStateFlow(TopFilter.AroundMe),
    val defaultShortsFollowList: MutableStateFlow<TopFilter> = MutableStateFlow(TopFilter.Global),
@@ -341,6 +342,9 @@ class AccountSettings(
    // Which conversation protocols the Messages inbox loads and shows. A disabled type is both hidden
    // from the inbox and dropped from the always-on downloading routes. Defaults to everything on.
    val enabledChatFeeds: MutableStateFlow<Set<ChatFeedType>> = MutableStateFlow(ChatFeedType.ALL),
+    // Which event-kind groups the Home feed downloads (assembler) and renders (DAL). A disabled group
+    // is both dropped from the always-on home relay filters and hidden from the tabs. Everything on by default.
+    val enabledHomeFeedTypes: MutableStateFlow<Set<HomeFeedType>> = MutableStateFlow(HomeFeedType.ALL),
    // The per-situation toggles applied under RelayAuthPolicy.CUSTOM.
    val relayAuthTrustMyRelaysAndVenues: MutableStateFlow<Boolean> = MutableStateFlow(true),
    val relayAuthTrustReadFollows: MutableStateFlow<Boolean> = MutableStateFlow(true),
@@ -391,6 +395,20 @@ class AccountSettings(
        }
    }

+    fun isHomeFeedTypeEnabled(type: HomeFeedType): Boolean = type in enabledHomeFeedTypes.value
+
+    fun setHomeFeedTypeEnabled(
+        type: HomeFeedType,
+        enabled: Boolean,
+    ) {
+        val current = enabledHomeFeedTypes.value
+        val next = if (enabled) current + type else current - type
+        if (next != current) {
+            enabledHomeFeedTypes.tryEmit(next)
+            saveAccountSettings()
+        }
+    }
+
    // ---
    // Always-on Notification Service
    // ---
@@ -878,6 +896,17 @@ class AccountSettings(
        }
    }

+    fun changeDefaultHighlightsFollowList(name: FeedDefinition) {
+        changeDefaultHighlightsFollowList(name.code)
+    }
+
+    fun changeDefaultHighlightsFollowList(name: TopFilter) {
+        if (defaultHighlightsFollowList.value != name) {
+            defaultHighlightsFollowList.tryEmit(name)
+            saveAccountSettings()
+        }
+    }
+
    fun changeDefaultCalendarsFollowList(name: FeedDefinition) {
        changeDefaultCalendarsFollowList(name.code)
    }
@@ -89,7 +89,13 @@ class AntiSpamFilter {
                val link2 = njumpLink(NAddress.create(event.kind, event.pubKey, event.dTag(), relay))
                val link1 = existingAddress?.let { njumpLink(NAddress.create(it.kind, it.pubKeyHex, it.dTag, relay)) } ?: link2

-                Log.w("Duplicated/SPAM") { "${relay?.url} $link1 $link2" }
+                // Debug, not warn: a duplicate detection is this filter working, not a fault, and
+                // it is already reported where it can be acted on — relayStats.newSpam below and
+                // the flowSpam emission that drives the UI. On a normal boot this fires ~34 times
+                // with a pair of njump links each, which is the widest line in the log and says
+                // nothing the spam counters don't. Keep the links at DEBUG for when you need to
+                // open the two events and compare them.
+                Log.d("Duplicated/SPAM") { "${relay?.url} $link1 $link2" }

                // Log down offenders
                val spammer = logOffender(hash, event)
@@ -118,7 +124,13 @@ class AntiSpamFilter {
                // LRU cache while the spammer record still matches this hash.
                val link1 = existingEvent?.let { njumpLink(NEvent.create(it, null, null, relay)) } ?: link2

-                Log.w("Duplicated/SPAM") { "${relay?.url} $link1 $link2" }
+                // Debug, not warn: a duplicate detection is this filter working, not a fault, and
+                // it is already reported where it can be acted on — relayStats.newSpam below and
+                // the flowSpam emission that drives the UI. On a normal boot this fires ~34 times
+                // with a pair of njump links each, which is the widest line in the log and says
+                // nothing the spam counters don't. Keep the links at DEBUG for when you need to
+                // open the two events and compare them.
+                Log.d("Duplicated/SPAM") { "${relay?.url} $link1 $link2" }

                // Log down offenders
                val spammer = logOffender(hash, event)
@@ -0,0 +1,140 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.model
+
+import com.vitorpamplona.quartz.experimental.agora.FundraiserEvent
+import com.vitorpamplona.quartz.experimental.attestations.attestation.AttestationEvent
+import com.vitorpamplona.quartz.experimental.attestations.proficiency.AttestorProficiencyEvent
+import com.vitorpamplona.quartz.experimental.attestations.recommendation.AttestorRecommendationEvent
+import com.vitorpamplona.quartz.experimental.attestations.request.AttestationRequestEvent
+import com.vitorpamplona.quartz.experimental.audio.header.AudioHeaderEvent
+import com.vitorpamplona.quartz.experimental.audio.track.AudioTrackEvent
+import com.vitorpamplona.quartz.experimental.birdstar.BirdDetectionEvent
+import com.vitorpamplona.quartz.experimental.birdstar.BirdexEvent
+import com.vitorpamplona.quartz.experimental.ephemChat.chat.EphemeralChatEvent
+import com.vitorpamplona.quartz.experimental.interactiveStories.InteractiveStoryPrologueEvent
+import com.vitorpamplona.quartz.experimental.music.playlist.MusicPlaylistEvent
+import com.vitorpamplona.quartz.experimental.music.track.MusicTrackEvent
+import com.vitorpamplona.quartz.experimental.nipsOnNostr.NipTextEvent
+import com.vitorpamplona.quartz.experimental.zapPolls.ZapPollEvent
+import com.vitorpamplona.quartz.nip10Notes.TextNoteEvent
+import com.vitorpamplona.quartz.nip18Reposts.GenericRepostEvent
+import com.vitorpamplona.quartz.nip18Reposts.RepostEvent
+import com.vitorpamplona.quartz.nip22Comments.CommentEvent
+import com.vitorpamplona.quartz.nip23LongContent.LongTextNoteEvent
+import com.vitorpamplona.quartz.nip35Torrents.TorrentEvent
+import com.vitorpamplona.quartz.nip53LiveActivities.chat.LiveActivitiesChatMessageEvent
+import com.vitorpamplona.quartz.nip53LiveActivities.streaming.LiveActivitiesEvent
+import com.vitorpamplona.quartz.nip54Wiki.WikiNoteEvent
+import com.vitorpamplona.quartz.nip64Chess.challenge.offer.LiveChessGameChallengeEvent
+import com.vitorpamplona.quartz.nip64Chess.end.LiveChessGameEndEvent
+import com.vitorpamplona.quartz.nip64Chess.game.ChessGameEvent
+import com.vitorpamplona.quartz.nip68Picture.PictureEvent
+import com.vitorpamplona.quartz.nip71Video.VideoHorizontalEvent
+import com.vitorpamplona.quartz.nip71Video.VideoNormalEvent
+import com.vitorpamplona.quartz.nip71Video.VideoShortEvent
+import com.vitorpamplona.quartz.nip71Video.VideoVerticalEvent
+import com.vitorpamplona.quartz.nip84Highlights.HighlightEvent
+import com.vitorpamplona.quartz.nip88Polls.poll.PollEvent
+import com.vitorpamplona.quartz.nip88Polls.response.PollResponseEvent
+import com.vitorpamplona.quartz.nip99Classifieds.ClassifiedsEvent
+import com.vitorpamplona.quartz.nipA0VoiceMessages.VoiceEvent
+import com.vitorpamplona.quartz.nipA0VoiceMessages.VoiceReplyEvent
+import com.vitorpamplona.quartz.nipF4Podcasts.episode.PodcastEpisodeEvent
+import com.vitorpamplona.quartz.nipF4Podcasts.metadata.PodcastMetadataEvent
+
+/**
+ * The distinct event-kind groups the Home feed downloads (in the relay assembler) and renders (in
+ * the DAL). Each is independently toggleable in Settings › Home: turning one off both drops its
+ * kinds from the always-on home relay filters AND hides them from the New Threads / Conversations /
+ * Everything tabs.
+ *
+ * [code] is the stable on-disk identifier (do NOT rename — it is what [encode]/[decode] persist);
+ * the enum ordinal is never stored, so entries may be reordered freely. [kinds] are the Nostr event
+ * kinds this group governs; they must stay disjoint across entries so a single toggle owns each kind.
+ */
+enum class HomeFeedType(
+    val code: String,
+    val kinds: List<Int>,
+) {
+    TEXT_NOTES("text_notes", listOf(TextNoteEvent.KIND)),
+    REPOSTS("reposts", listOf(RepostEvent.KIND, GenericRepostEvent.KIND)),
+    COMMENTS("comments", listOf(CommentEvent.KIND)),
+    PICTURES("pictures", listOf(PictureEvent.KIND)),
+    VIDEOS("videos", listOf(VideoNormalEvent.KIND, VideoHorizontalEvent.KIND)),
+    SHORTS("shorts", listOf(VideoShortEvent.KIND, VideoVerticalEvent.KIND)),
+    ARTICLES("articles", listOf(LongTextNoteEvent.KIND)),
+    WIKI("wiki", listOf(WikiNoteEvent.KIND)),
+    HIGHLIGHTS("highlights", listOf(HighlightEvent.KIND)),
+    POLLS("polls", listOf(PollEvent.KIND, ZapPollEvent.KIND, PollResponseEvent.KIND)),
+    CLASSIFIEDS("classifieds", listOf(ClassifiedsEvent.KIND)),
+    TORRENTS("torrents", listOf(TorrentEvent.KIND)),
+    VOICE("voice", listOf(VoiceEvent.KIND, VoiceReplyEvent.KIND)),
+    LIVE_ACTIVITIES("live_activities", listOf(LiveActivitiesEvent.KIND, LiveActivitiesChatMessageEvent.KIND)),
+    EPHEMERAL_CHAT("ephemeral_chat", listOf(EphemeralChatEvent.KIND)),
+    INTERACTIVE_STORIES("interactive_stories", listOf(InteractiveStoryPrologueEvent.KIND)),
+    CHESS("chess", listOf(ChessGameEvent.KIND, LiveChessGameChallengeEvent.KIND, LiveChessGameEndEvent.KIND)),
+    BIRDS("birds", listOf(BirdDetectionEvent.KIND, BirdexEvent.KIND)),
+    ATTESTATIONS(
+        "attestations",
+        listOf(
+            AttestationEvent.KIND,
+            AttestationRequestEvent.KIND,
+            AttestorRecommendationEvent.KIND,
+            AttestorProficiencyEvent.KIND,
+        ),
+    ),
+    NIPS("nips", listOf(NipTextEvent.KIND)),
+    MUSIC("music", listOf(AudioTrackEvent.KIND, MusicTrackEvent.KIND, MusicPlaylistEvent.KIND, AudioHeaderEvent.KIND)),
+    PODCASTS("podcasts", listOf(PodcastEpisodeEvent.KIND, PodcastMetadataEvent.KIND)),
+    FUNDRAISERS("fundraisers", listOf(FundraiserEvent.KIND)),
+    ;
+
+    companion object {
+        /** Every group, enabled by default so a fresh (or never-customized) account loads everything. */
+        val ALL: Set<HomeFeedType> = entries.toSet()
+
+        fun fromCode(code: String?): HomeFeedType? = entries.firstOrNull { it.code == code }
+
+        /** Serializes a set of groups as their comma-joined [code]s, for SharedPreferences. */
+        fun encode(types: Set<HomeFeedType>): String = types.joinToString(",") { it.code }
+
+        /** Parses a comma-joined [code] list back to a set, dropping any unknown codes. */
+        fun decode(joined: String?): Set<HomeFeedType> =
+            joined
+                ?.split(",")
+                ?.mapNotNull { fromCode(it.trim()) }
+                ?.toSet()
+                ?: emptySet()
+
+        /**
+         * The event kinds to drop from the home relay filters and the home DAL, given the currently
+         * [enabled] set. A kind stays live if ANY enabled group still owns it (guards against a
+         * future overlap between two groups), so disabling one group never silently hides a kind a
+         * still-enabled group also wants.
+         */
+        fun disabledKinds(enabled: Set<HomeFeedType>): Set<Int> {
+            if (enabled.size == ALL.size) return emptySet()
+            val enabledKinds = enabled.flatMapTo(HashSet()) { it.kinds }
+            return (ALL - enabled).flatMapTo(HashSet()) { it.kinds }.apply { removeAll(enabledKinds) }
+        }
+    }
+}
@@ -41,6 +41,7 @@ import com.vitorpamplona.amethyst.commons.model.emphChat.EphemeralChatChannel
 import com.vitorpamplona.amethyst.commons.model.geohashChat.GeohashChatChannel
 import com.vitorpamplona.amethyst.commons.model.nip28PublicChats.PublicChatChannel
 import com.vitorpamplona.amethyst.commons.model.nip29RelayGroups.RelayGroupChannel
+import com.vitorpamplona.amethyst.commons.model.nip29RelayGroups.RelayGroupDeletions
 import com.vitorpamplona.amethyst.commons.model.nip53LiveActivities.LiveActivitiesChannel
 import com.vitorpamplona.amethyst.commons.model.observables.CreatedAtIdHexComparator
 import com.vitorpamplona.amethyst.commons.model.observables.EventListMatchingFilter
@@ -114,6 +115,7 @@ import com.vitorpamplona.quartz.buzz.stream.StreamMessageScheduledEvent
 import com.vitorpamplona.quartz.buzz.stream.StreamMessageV2Event
 import com.vitorpamplona.quartz.buzz.stream.StreamReminderEvent
 import com.vitorpamplona.quartz.buzz.stream.SystemMessageEvent
+import com.vitorpamplona.quartz.buzz.stream.SystemMessagePayload
 import com.vitorpamplona.quartz.buzz.stream.sidecars.ChannelSummaryEvent
 import com.vitorpamplona.quartz.buzz.stream.sidecars.PresenceSnapshotEvent
 import com.vitorpamplona.quartz.buzz.teams.TeamEvent
@@ -2223,6 +2225,30 @@ object LocalCache : ILocalCache, ICacheProvider, Dao {
            attachToRelayGroupIfScoped(event, relay)
        }

+    /**
+     * A Buzz kind-40099 system message. It renders as a narration row in the channel feed (via
+     * [consumeBuzzTimelineEvent]), but a `channel_deleted` one is also the **authoritative signal that
+     * a channel is gone**: the relay soft-deletes the channel and its 39000/39001/39002 discovery
+     * events but emits no member-removed notification and never retracts the kind-44100 that seeds the
+     * browse list — so without this the deleted channel keeps re-appearing (a stale 44100 re-announced
+     * every restart, its metadata now blank so it shows optimistically). Recording the delete in
+     * [RelayGroupDeletions] filters it out of every list and persists it across restarts.
+     *
+     * Gated on [isRelaySignedGroupEvent] (the 40099 is signed by the relay keypair) so a spoofed
+     * system message from a stray author can't hide a channel. Cross-device by construction: the relay
+     * replays this on subscribe, so a channel deleted on Buzz web/desktop is honored here too.
+     */
+    private fun consume(
+        event: SystemMessageEvent,
+        relay: NormalizedRelayUrl?,
+        wasVerified: Boolean,
+    ): Boolean =
+        consumeBuzzTimelineEvent(event, relay, wasVerified).also {
+            if (relay != null && isRelaySignedGroupEvent(event, relay) && event.payload()?.type == SystemMessagePayload.CHANNEL_DELETED) {
+                event.channel()?.let { channelId -> RelayGroupDeletions.markDeleted(GroupId(channelId, relay)) }
+            }
+        }
+
    /** Store-only consume for Buzz kinds that carry no channel timeline row. */
    private fun consumeBuzzRegularEvent(
        event: Event,
@@ -4798,7 +4824,7 @@ object LocalCache : ILocalCache, ICacheProvider, Dao {
                is StreamMessageV2Event -> consumeBuzzTimelineEvent(event, relay, wasVerified)
                is StreamMessageEditEvent -> consume(event, relay, wasVerified)
                is StreamMessageDiffEvent -> consumeBuzzTimelineEvent(event, relay, wasVerified)
-                is SystemMessageEvent -> consumeBuzzTimelineEvent(event, relay, wasVerified)
+                is SystemMessageEvent -> consume(event, relay, wasVerified)
                is CanvasEvent -> consume(event, relay, wasVerified)
                // Forum root (45001) is a thread, not a chat row → Threads collection. Comments (45003)
                // and votes (45002) are store-only: the forum-thread detail loads them on demand by root.
@@ -0,0 +1,53 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.model
+
+import com.vitorpamplona.quartz.nip94FileMetadata.tags.DimensionTag
+
+/**
+ * Which NIP-71 kind a video upload is published as. Only videos are affected — whether an upload
+ * is a picture (NIP-68 kind 20) or a video is decided by the file's mime type and can't be
+ * overridden.
+ *
+ * The composer picks this from the feed it was opened on, so a post always lands in the feed the
+ * user was standing in (or shared to): the Shorts feed reads kind 22, the Longs feed reads kind 21
+ * and the Video feed reads both.
+ */
+enum class VideoPostKind {
+    /** Derive from the video's dimensions: portrait -> kind 22, landscape -> kind 21. */
+    AUTO,
+
+    /** Always NIP-71 kind 22 (short-form video), regardless of orientation. */
+    SHORT,
+
+    /** Always NIP-71 kind 21 (normal video), regardless of orientation. */
+    NORMAL,
+
+    ;
+
+    /** True when a video of [dim] should be published as a NIP-71 kind 22 short. */
+    fun isShort(dim: DimensionTag): Boolean =
+        when (this) {
+            SHORT -> true
+            NORMAL -> false
+            AUTO -> dim.height > dim.width
+        }
+}
@@ -0,0 +1,77 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.model.preferences
+
+import android.content.Context
+import androidx.compose.runtime.Stable
+import androidx.datastore.preferences.core.edit
+import androidx.datastore.preferences.core.stringSetPreferencesKey
+import com.vitorpamplona.amethyst.commons.model.nip29RelayGroups.RelayGroupDeletions
+import com.vitorpamplona.quartz.utils.Log
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.flow.drop
+import kotlinx.coroutines.flow.first
+import kotlinx.coroutines.launch
+import kotlin.coroutines.cancellation.CancellationException
+
+/**
+ * Device-global persistence for the set of deleted NIP-29 relay-group channels ([RelayGroupDeletions]),
+ * so a channel the user deleted (kind-9008) stays gone across a restart — even if the host relay keeps
+ * re-announcing a stale kind-44100 for it. Mirrors [BuzzChannelStarPreferences]: app-wide (not
+ * per-account), loads the saved keys into the singleton on construction, then writes every later change
+ * back. Construct once, eagerly.
+ */
+@Stable
+class RelayGroupDeletionPreferences(
+    private val context: Context,
+    private val scope: CoroutineScope,
+) {
+    init {
+        scope.launch {
+            restoreFromDisk()
+            // drop(1) skips the value present at collection start, which restoreFromDisk already wrote.
+            RelayGroupDeletions.flow.drop(1).collect { persist(it) }
+        }
+    }
+
+    private suspend fun restoreFromDisk() {
+        try {
+            val raw = context.sharedPreferencesDataStore.data.first()[KEY] ?: return
+            if (raw.isNotEmpty()) RelayGroupDeletions.restore(raw)
+        } catch (e: Exception) {
+            if (e is CancellationException) throw e
+            Log.e("RelayGroupDeletionPrefs") { "Error reading deleted channels: ${e.message}" }
+        }
+    }
+
+    private suspend fun persist(keys: Set<String>) {
+        try {
+            context.sharedPreferencesDataStore.edit { prefs -> prefs[KEY] = keys }
+        } catch (e: Exception) {
+            if (e is CancellationException) throw e
+            Log.e("RelayGroupDeletionPrefs") { "Error writing deleted channels: ${e.message}" }
+        }
+    }
+
+    companion object {
+        private val KEY = stringSetPreferencesKey("nip29.deletedChannels")
+    }
+}
@@ -389,7 +389,7 @@ object NotificationUtils {
                PendingIntent.FLAG_MUTABLE or PendingIntent.FLAG_UPDATE_CURRENT,
            )
        return NotificationCompat.Action
-            .Builder(R.drawable.ic_notif_reply, stringRes(applicationContext, R.string.app_notification_reply_label), replyPendingIntent)
+            .Builder(R.drawable.ic_action_reply, stringRes(applicationContext, R.string.app_notification_reply_label), replyPendingIntent)
            .addRemoteInput(replyRemoteInput(applicationContext))
            .setAllowGeneratedReplies(true)
            .setSemanticAction(NotificationCompat.Action.SEMANTIC_ACTION_REPLY)
@@ -460,7 +460,7 @@ object NotificationUtils {
                PendingIntent.FLAG_IMMUTABLE or PendingIntent.FLAG_UPDATE_CURRENT,
            )
        return NotificationCompat.Action
-            .Builder(R.drawable.ic_notif_message, stringRes(applicationContext, R.string.app_notification_mark_read_label), markReadPendingIntent)
+            .Builder(R.drawable.ic_action_mark_read, stringRes(applicationContext, R.string.app_notification_mark_read_label), markReadPendingIntent)
            .setSemanticAction(NotificationCompat.Action.SEMANTIC_ACTION_MARK_AS_READ)
            .build()
    }
@@ -0,0 +1,132 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.service.okhttp
+
+import com.vitorpamplona.quartz.nip01Core.core.HexKey
+import com.vitorpamplona.quartz.utils.Hex
+import okhttp3.Interceptor
+import okhttp3.Request
+import okhttp3.Response
+import java.util.concurrent.ConcurrentHashMap
+
+/**
+ * Retries a Blossom blob download with a BUD-01 `t=get` authorization when the
+ * server answers `401`.
+ *
+ * Most Blossom / NIP-96 hosts serve blobs anonymously, so images load without
+ * any signing overhead. A few gate reads behind auth — Buzz's private media
+ * relay (`*.communities.buzz.xyz`) returns
+ * `401 {"error":"authentication failed"}` to an anonymous `GET`. For those we
+ * sign a kind-24242 read-auth event (via [authHeaderProvider]) and replay the
+ * request once with `Authorization: Nostr <base64-event>`.
+ *
+ * Gating is deliberately narrow so we never turn an unrelated `401` into a
+ * second request storm:
+ *  - only `GET` requests,
+ *  - only when the request doesn't already carry an `Authorization` header,
+ *  - only when the URL's last path segment is a Blossom sha256 filename
+ *    (`<64-hex>` optionally followed by an extension such as `.png` or
+ *    `.thumb.jpg`),
+ *  - only after the anonymous attempt actually returned `401`,
+ *  - and at most one retry (an application interceptor's second `chain.proceed`
+ *    runs the downstream chain again, it does not re-enter this interceptor).
+ *
+ * [authHeaderProvider] is `(host, sha256) -> header?`. It is synchronous by
+ * contract (the caller bridges the suspend signer), returns `null` when no
+ * signer is available or signing times out, and is only consulted on a real
+ * `401`, so an unauthenticated user simply keeps seeing the broken image
+ * rather than paying any signing cost.
+ *
+ * The first blob from an auth-gated host costs an extra round trip (anonymous
+ * `GET` → `401` → signed retry), but that host is then remembered in
+ * [knownAuthHosts] so every later blob from it is signed **up front** — one
+ * round trip, not two. This matters on a Buzz community feed where nearly every
+ * image comes from the same gated host: without it each image would keep paying
+ * the wasted 401 probe. The learned host also short-circuits to anonymous when
+ * no signer is available, so a logged-out user never re-probes needlessly.
+ */
+class BlossomReadAuthInterceptor(
+    private val authHeaderProvider: (host: String, sha256: HexKey) -> String?,
+) : Interceptor {
+    // Hosts observed to answer 401 to an anonymous Blossom GET. Small (a user
+    // follows a handful of auth-gated servers at most) and shared across all
+    // clients derived from the same factory. newKeySet() is thread-safe for the
+    // concurrent reads/writes of parallel feed downloads.
+    private val knownAuthHosts: MutableSet<String> = ConcurrentHashMap.newKeySet()
+
+    override fun intercept(chain: Interceptor.Chain): Response {
+        val request = chain.request()
+
+        if (!request.method.equals("GET", ignoreCase = true) ||
+            request.header("Authorization") != null
+        ) {
+            return chain.proceed(request)
+        }
+
+        val sha256 = blossomHashOrNull(request.url.encodedPath) ?: return chain.proceed(request)
+        val host = request.url.host
+
+        // Known-gated host: skip the anonymous probe and sign the first attempt.
+        // Falls through to anonymous only when we can't produce a token (no
+        // signer / timeout) — the server would 401 either way.
+        if (host in knownAuthHosts) {
+            authHeaderProvider(host, sha256)?.let { header ->
+                return chain.proceed(request.withAuth(header))
+            }
+        }
+
+        val response = chain.proceed(request)
+        if (response.code != 401) return response
+
+        // Learn the host so its next blob is signed up front.
+        knownAuthHosts.add(host)
+
+        val header = authHeaderProvider(host, sha256) ?: return response
+
+        // Close the 401 body before replaying so the connection can be reused.
+        response.close()
+
+        return chain.proceed(request.withAuth(header))
+    }
+
+    private fun Request.withAuth(header: String) =
+        newBuilder()
+            .header("Authorization", header)
+            .build()
+
+    companion object {
+        /**
+         * Extracts the sha256 blob id from a Blossom URL path. The blob is the
+         * last path segment, up to its first `.` — so both `<hash>.png` and the
+         * derived `<hash>.thumb.jpg` resolve to `<hash>`. Returns `null` when the
+         * segment isn't a 64-char hex string.
+         *
+         * Uses Quartz's unrolled [Hex.isHex64] rather than a regex — this runs on
+         * every media URL the feed loads. [Hex.isHex64] only checks the first 64
+         * chars and doesn't verify total length, so the `length == 64` guard is
+         * what rejects longer segments.
+         */
+        fun blossomHashOrNull(encodedPath: String): HexKey? {
+            val base = encodedPath.substringAfterLast('/').substringBefore('.').lowercase()
+            return if (base.length == 64 && Hex.isHex64(base)) base else null
+        }
+    }
+}
@@ -0,0 +1,90 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.service.okhttp
+
+import com.vitorpamplona.amethyst.commons.service.upload.BlossomAuth
+import com.vitorpamplona.quartz.nip01Core.core.HexKey
+import com.vitorpamplona.quartz.nip01Core.signers.NostrSigner
+import kotlinx.coroutines.runBlocking
+import kotlinx.coroutines.withTimeoutOrNull
+import java.util.concurrent.ConcurrentHashMap
+
+/**
+ * Signs and caches BUD-01 read-auth headers for [BlossomReadAuthInterceptor].
+ *
+ * The interceptor is synchronous (it runs on an OkHttp dispatcher thread) but
+ * signing is `suspend`, so [authHeader] bridges with [runBlocking] guarded by a
+ * timeout: an internal key signs instantly, while a remote (NIP-46) or external
+ * (NIP-55) signer that hangs or needs user interaction simply yields `null` and
+ * the download stays unauthenticated instead of pinning the thread.
+ *
+ * Tokens are cached per host, not per blob. A BUD-11 `server`-scoped token
+ * grants reads for every blob on the host (thumbnails included), so one signed
+ * event covers a whole feed's worth of images from an auth-gated host for the
+ * life of the token. The blob hash of the request that first triggered signing
+ * is still included as the `x` tag for BUD-01 servers that check it.
+ */
+class BlossomReadAuthTokenProvider(
+    private val signerProvider: () -> NostrSigner?,
+    private val clock: () -> Long = { System.currentTimeMillis() },
+) {
+    private class CachedToken(
+        val header: String,
+        val expiresAtMs: Long,
+    )
+
+    private val cache = ConcurrentHashMap<String, CachedToken>()
+
+    fun authHeader(
+        host: String,
+        sha256: HexKey,
+    ): String? {
+        val now = clock()
+
+        cache[host]?.let { if (it.expiresAtMs > now) return it.header }
+
+        val signer = signerProvider() ?: return null
+
+        val header =
+            runBlocking {
+                withTimeoutOrNull(SIGN_TIMEOUT_MS) {
+                    BlossomAuth.createGetAuth(
+                        hash = sha256,
+                        alt = "Downloading media from $host",
+                        signer = signer,
+                        servers = listOf(host),
+                    )
+                }
+            } ?: return null
+
+        cache[host] = CachedToken(header, now + CACHE_TTL_MS)
+        return header
+    }
+
+    companion object {
+        // The signed event expires one hour out (BlossomAuthorizationEvent), so
+        // refresh a little early to avoid handing over a token that dies mid-flight.
+        private const val CACHE_TTL_MS = 55L * 60L * 1000L
+
+        // Bounds how long an image download may block waiting on a slow signer.
+        private const val SIGN_TIMEOUT_MS = 8_000L
+    }
+}
@@ -50,8 +50,11 @@ class DualHttpClientManager(
    // Resource-usage ledger counter, installed on the shared base client so
    // every derived client is accounted. See [OkHttpClientFactory].
    usageInterceptor: Interceptor? = null,
+    // Signs BUD-01 read-auth to retry auth-gated Blossom downloads on 401.
+    // See [BlossomReadAuthInterceptor].
+    blossomReadAuth: Interceptor? = null,
 ) : IHttpClientManager {
-    val factory = OkHttpClientFactory(keyCache, userAgent, dns, shouldBridgeBlossomCache, onionCache, usageInterceptor)
+    val factory = OkHttpClientFactory(keyCache, userAgent, dns, shouldBridgeBlossomCache, onionCache, usageInterceptor, blossomReadAuth)

    val defaultHttpClient: StateFlow<OkHttpClient> =
        combine(proxyPortProvider, isMobileDataProvider) { proxy, mobile ->
@@ -69,6 +69,13 @@ class OkHttpClientFactory(
     * tests / pre-configuration call sites.
     */
    private val usageInterceptor: Interceptor? = null,
+    /**
+     * Retries auth-gated Blossom blob downloads with a signed BUD-01 `t=get`
+     * token when the host answers `401` (e.g. Buzz's private media relay). Null
+     * in tests / pre-configuration call sites, in which case such downloads stay
+     * anonymous. See [BlossomReadAuthInterceptor].
+     */
+    private val blossomReadAuth: Interceptor? = null,
 ) {
    // val logging = LoggingInterceptor()
    val keyDecryptor = EncryptedBlobInterceptor(keyCache)
@@ -116,6 +123,12 @@ class OkHttpClientFactory(
            .apply {
                blossomCacheRedirect?.let { addInterceptor(it) }
            }
+            // Sits outside the network interceptors so its retry re-runs the
+            // full stack (content-type, blossom cache, key decryptor) for the
+            // authenticated response. Only signs on an actual 401.
+            .apply {
+                blossomReadAuth?.let { addInterceptor(it) }
+            }
            // .addNetworkInterceptor(logging)
            .addNetworkInterceptor(keyDecryptor)
            // Passively populates [onionCache] from any HTTP/WebSocket response
@@ -53,9 +53,9 @@ import com.vitorpamplona.amethyst.service.playback.composable.controls.RenderTop
 import com.vitorpamplona.amethyst.service.playback.composable.controls.TopGradientOverlay
 import com.vitorpamplona.amethyst.service.playback.composable.controls.fullscreenSwipeControls
 import com.vitorpamplona.amethyst.service.playback.composable.mediaitem.LoadedMediaItem
+import com.vitorpamplona.amethyst.service.playback.composable.mediaitem.isHlsMedia
 import com.vitorpamplona.amethyst.service.playback.composable.wavefront.AudioPlayingAnimation
 import com.vitorpamplona.amethyst.service.playback.composable.wavefront.rememberIsAudioTrack
-import com.vitorpamplona.amethyst.service.playback.diskCache.isLiveStreaming
 import com.vitorpamplona.amethyst.ui.components.getDialogWindow
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.AccountViewModel

@@ -105,7 +105,7 @@ fun RenderVideoPlayer(
    // unnecessary recomposition of the whole player tree just to update a value that is only
    // ever read inside the onDoubleTap callback below.
    val containerWidth = remember { intArrayOf(0) }
-    val isLive = remember(mediaItem.src.videoUri) { isLiveStreaming(mediaItem.src.videoUri) }
+    val isLive = remember(mediaItem.src.videoUri, mediaItem.src.mimeType) { isHlsMedia(mediaItem.src.videoUri, mediaItem.src.mimeType) }

    val swipeState = remember { FullscreenSwipeControlsState() }
    val context = LocalContext.current
@@ -63,7 +63,7 @@ import com.vitorpamplona.amethyst.service.cast.CastSessionState
 import com.vitorpamplona.amethyst.service.playback.composable.DEFAULT_MUTED_SETTING
 import com.vitorpamplona.amethyst.service.playback.composable.MediaControllerState
 import com.vitorpamplona.amethyst.service.playback.composable.mediaitem.MediaItemData
-import com.vitorpamplona.amethyst.service.playback.diskCache.isLiveStreaming
+import com.vitorpamplona.amethyst.service.playback.composable.mediaitem.isHlsMedia
 import com.vitorpamplona.amethyst.service.playback.pip.PipVideoActivity
 import com.vitorpamplona.amethyst.ui.cast.CastDevicePickerDialog
 import com.vitorpamplona.amethyst.ui.components.ShareMediaAction
@@ -113,7 +113,7 @@ fun RenderTopButtons(
    accountViewModel: AccountViewModel,
 ) {
    val context = LocalContext.current
-    val isLive = remember(mediaData.videoUri) { isLiveStreaming(mediaData.videoUri) }
+    val isLive = remember(mediaData.videoUri, mediaData.mimeType) { isHlsMedia(mediaData.videoUri, mediaData.mimeType) }
    val pipSupported =
        remember {
            context.packageManager.hasSystemFeature(PackageManager.FEATURE_PICTURE_IN_PICTURE)
@@ -0,0 +1,51 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.service.playback.composable.mediaitem
+
+import androidx.media3.common.MimeTypes
+
+/**
+ * Whether a URL plus its imeta mime identifies HLS.
+ *
+ * This is the caller-side form for code that holds a URL and a mime but no `MediaItem` yet — UI that
+ * has a [MediaItemData] or a `MediaUrlContent`. Once a `MediaItem` exists,
+ * `isHlsMediaItem` is the equivalent, and both must answer the same way: the UI decides what to
+ * render, the factory decides how to load it, and a disagreement shows up as a player that streams
+ * something the surrounding chrome says is a still image.
+ *
+ * Defined in terms of [MediaItemCache.toExoPlayerMimeType] rather than re-deriving the rules, so it
+ * cannot drift from the mime that actually reaches ExoPlayer. That normalizer prefers an explicit
+ * mime (mapping the four HLS aliases onto [MimeTypes.APPLICATION_M3U8]) and otherwise falls back to a
+ * **path-anchored** `.m3u8` test.
+ *
+ * Both halves matter. A BUD-10 blossom playlist is `https://host/<sha256>` with no extension at all,
+ * so only the mime identifies it; and anchoring to the path stops `video.mp4?ref=a.m3u8` counting as
+ * HLS on the strength of its query string.
+ *
+ * Note this answers *is it HLS*, which callers use as a proxy for *is it live*. The proxy is
+ * imprecise in the same way for every HLS URL — an on-demand HLS playlist also answers true — and
+ * that imprecision is older than this function. Liveness is only truly knowable from
+ * `#EXT-X-ENDLIST` once the playlist is loaded, which is what `HlsLivenessCache` records.
+ */
+fun isHlsMedia(
+    url: String,
+    mimeType: String?,
+): Boolean = MediaItemCache.toExoPlayerMimeType(mimeType, url) == MimeTypes.APPLICATION_M3U8
@@ -20,10 +20,13 @@
 */
 package com.vitorpamplona.amethyst.service.playback.playerPool

+import androidx.media3.common.C
 import androidx.media3.common.MediaItem
 import androidx.media3.common.util.UnstableApi
+import androidx.media3.common.util.Util
 import androidx.media3.datasource.DataSource
 import androidx.media3.exoplayer.drm.DrmSessionManagerProvider
+import androidx.media3.exoplayer.hls.HlsMediaSource
 import androidx.media3.exoplayer.source.DefaultMediaSourceFactory
 import androidx.media3.exoplayer.source.MediaSource
 import androidx.media3.exoplayer.upstream.LoadErrorHandlingPolicy
@@ -31,7 +34,6 @@ import com.vitorpamplona.amethyst.service.playback.PLAYBACK_DIAG_TAG
 import com.vitorpamplona.amethyst.service.playback.composable.mediaitem.MediaItemCache
 import com.vitorpamplona.amethyst.service.playback.diskCache.HlsLivenessCache
 import com.vitorpamplona.amethyst.service.playback.diskCache.VideoCache
-import com.vitorpamplona.amethyst.service.playback.diskCache.isLiveStreaming
 import com.vitorpamplona.quartz.utils.Log

 /**
@@ -58,6 +60,26 @@ internal fun shouldBypassCache(
        else -> true
    }

+/**
+ * Whether a [MediaItem] is HLS, via media3's own content-type inference.
+ *
+ * This is the one "is this HLS?" predicate for playback routing. [CustomMediaSourceFactory] uses it
+ * to pick both the cache route and the media-source factory, and [HlsLivenessRecorder] uses it to
+ * decide which items are worth learning a liveness verdict for. Those two **must** agree: if the
+ * recorder tested more narrowly than the factory, an item the factory treats as HLS would never be
+ * classified, [HlsLivenessCache] would answer `isKnownOnDemand = false` for it forever, and
+ * [shouldBypassCache] would keep it out of the disk cache permanently.
+ *
+ * It reads back the mimeType [MediaItemCache] already normalised, which is what makes it correct for
+ * BUD-10 blossom URIs — `https://host/<sha256>`, no extension, mime as the only signal. A `.m3u8`
+ * substring test on the URL misses those, and separately gives a false positive on a query string
+ * over progressive media (`video.mp4?ref=a.m3u8`).
+ */
+internal fun isHlsMediaItem(mediaItem: MediaItem?): Boolean {
+    val config = mediaItem?.localConfiguration ?: return false
+    return Util.inferContentTypeForUriAndMimeType(config.uri, config.mimeType) == C.CONTENT_TYPE_HLS
+}
+
 /**
 * Decides whether a [MediaItem] plays through the caching data source or bypasses it.
 *
@@ -81,20 +103,42 @@ class CustomMediaSourceFactory(
    videoCache: VideoCache,
    dataSourceFactory: DataSource.Factory,
 ) : MediaSource.Factory {
-    private var cachingFactory: MediaSource.Factory =
-        DefaultMediaSourceFactory(videoCache.get(dataSourceFactory))
-    private var nonCachingFactory: MediaSource.Factory =
+    private val cachingDataSource: DataSource.Factory = videoCache.get(dataSourceFactory)
+
+    private val cachingFactory: MediaSource.Factory =
+        DefaultMediaSourceFactory(cachingDataSource)
+    private val nonCachingFactory: MediaSource.Factory =
        DefaultMediaSourceFactory(dataSourceFactory)

+    // Stateless, so one instance serves both HLS factories.
+    private val playlistParserFactory = LowLatencyStrippingHlsPlaylistParserFactory()
+
+    // HLS is built explicitly rather than through DefaultMediaSourceFactory, which exposes no hook
+    // for a playlist parser factory. See LowLatencyStrippingHlsPlaylistParserFactory for why we need
+    // one. Everything else still routes through the Default factories above.
+    //
+    // The cost of bypassing it: HLS items skip what DefaultMediaSourceFactory wraps around the
+    // source — side-loaded subtitleConfigurations (MergingMediaSource), clipping, ad insertion, and
+    // live target-offset defaults. None are reachable today (MediaItemCache sets none of them, and
+    // the live setters aren't on the MediaSource.Factory interface), but anything added later must
+    // be mirrored here.
+    private val cachingHlsFactory: MediaSource.Factory = hlsFactory(cachingDataSource)
+    private val nonCachingHlsFactory: MediaSource.Factory = hlsFactory(dataSourceFactory)
+
+    private fun hlsFactory(dataSource: DataSource.Factory): MediaSource.Factory =
+        HlsMediaSource
+            .Factory(dataSource)
+            .setPlaylistParserFactory(playlistParserFactory)
+
+    private val allFactories = listOf(cachingFactory, nonCachingFactory, cachingHlsFactory, nonCachingHlsFactory)
+
    override fun setDrmSessionManagerProvider(drmSessionManagerProvider: DrmSessionManagerProvider): MediaSource.Factory {
-        cachingFactory.setDrmSessionManagerProvider(drmSessionManagerProvider)
-        nonCachingFactory.setDrmSessionManagerProvider(drmSessionManagerProvider)
+        allFactories.forEach { it.setDrmSessionManagerProvider(drmSessionManagerProvider) }
        return this
    }

    override fun setLoadErrorHandlingPolicy(loadErrorHandlingPolicy: LoadErrorHandlingPolicy): MediaSource.Factory {
-        cachingFactory.setLoadErrorHandlingPolicy(loadErrorHandlingPolicy)
-        nonCachingFactory.setLoadErrorHandlingPolicy(loadErrorHandlingPolicy)
+        allFactories.forEach { it.setLoadErrorHandlingPolicy(loadErrorHandlingPolicy) }
        return this
    }

@@ -103,18 +147,24 @@ class CustomMediaSourceFactory(
    override fun createMediaSource(mediaItem: MediaItem): MediaSource {
        val id = mediaItem.mediaId
        val flaggedLive = isFlaggedLive(mediaItem)
-        val hls = isLiveStreaming(id)
+
+        // One predicate governs both the cache routing below and which factory builds the source, so
+        // the two can never disagree. See isHlsMediaItem.
+        val hls = isHlsMediaItem(mediaItem)
+
        val knownOnDemand = HlsLivenessCache.isKnownOnDemand(id)
        val bypassCache = shouldBypassCache(flaggedLive, hls, knownOnDemand)

-        val source =
-            if (bypassCache) {
-                nonCachingFactory.createMediaSource(mediaItem)
+        val factory =
+            if (hls) {
+                if (bypassCache) nonCachingHlsFactory else cachingHlsFactory
            } else {
-                cachingFactory.createMediaSource(mediaItem)
+                if (bypassCache) nonCachingFactory else cachingFactory
            }
-        // Logs the three routing inputs directly rather than a re-derived label, so it can't drift
-        // from shouldBypassCache.
+        val source = factory.createMediaSource(mediaItem)
+
+        // Logs the routing inputs directly rather than a re-derived label, so it can't drift from
+        // shouldBypassCache.
        Log.d(PLAYBACK_DIAG_TAG) {
            "SOURCE ${if (bypassCache) "BYPASS" else "CACHE"} flaggedLive=$flaggedLive hls=$hls knownOnDemand=$knownOnDemand " +
                "mime=${mediaItem.localConfiguration?.mimeType} -> ${source::class.java.simpleName} id=$id"
@@ -25,7 +25,6 @@ import androidx.media3.common.Player
 import androidx.media3.common.Timeline
 import com.vitorpamplona.amethyst.service.playback.PLAYBACK_DIAG_TAG
 import com.vitorpamplona.amethyst.service.playback.diskCache.HlsLivenessCache
-import com.vitorpamplona.amethyst.service.playback.diskCache.isLiveStreaming
 import com.vitorpamplona.quartz.utils.Log

 /**
@@ -66,7 +65,7 @@ internal fun livenessVerdictToRecord(
 * reliable live/on-demand discriminator (`#EXT-X-ENDLIST`) is inside the playlist, so it is knowable
 * only once ExoPlayer has loaded it — hence learning it here rather than from the URL.
 *
- * Only `.m3u8` items are considered; progressive media is unambiguous and never routed by liveness.
+ * Only HLS items are considered; progressive media is unambiguous and never routed by liveness.
 */
 class HlsLivenessRecorder(
    private val player: Player,
@@ -85,8 +84,11 @@ class HlsLivenessRecorder(

    private fun maybeRecord(allowOnDemand: Boolean) {
        if (player.currentTimeline.isEmpty) return
-        val url = player.currentMediaItem?.mediaId ?: return
-        if (!isLiveStreaming(url)) return
+        val mediaItem = player.currentMediaItem ?: return
+        // Must be the same predicate CustomMediaSourceFactory routes on — see isHlsMediaItem for
+        // what goes wrong when the two disagree.
+        if (!isHlsMediaItem(mediaItem)) return
+        val url = mediaItem.mediaId

        val known = HlsLivenessCache.verdict(url)
        val toRecord =
@@ -0,0 +1,165 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.service.playback.playerPool
+
+import android.net.Uri
+import androidx.media3.common.util.UnstableApi
+import androidx.media3.exoplayer.hls.playlist.DefaultHlsPlaylistParserFactory
+import androidx.media3.exoplayer.hls.playlist.HlsMediaPlaylist
+import androidx.media3.exoplayer.hls.playlist.HlsMultivariantPlaylist
+import androidx.media3.exoplayer.hls.playlist.HlsPlaylist
+import androidx.media3.exoplayer.hls.playlist.HlsPlaylistParserFactory
+import androidx.media3.exoplayer.upstream.ParsingLoadable
+import java.io.ByteArrayInputStream
+import java.io.InputStream
+
+/**
+ * Low-Latency HLS tags that we remove before media3's playlist parser sees them.
+ *
+ * `EXT-X-PART` and `EXT-X-PRELOAD-HINT` are the ones that matter: they are the only things in these
+ * playlists that produce a **byte-range-bounded** chunk, which is what triggers the crash documented
+ * on [LowLatencyStrippingHlsPlaylistParserFactory]. `EXT-X-PART-INF` and `EXT-X-SERVER-CONTROL` go
+ * with them — leaving those behind advertises a low-latency contract (PART-TARGET, PART-HOLD-BACK,
+ * CAN-BLOCK-RELOAD) that the stripped playlist can no longer honour.
+ *
+ * Deliberately **not** stripped:
+ * - `EXT-X-SKIP` — marks a delta playlist whose segments were legitimately omitted. Removing the tag
+ *   while the segments stay missing would corrupt the playlist. Dropping `EXT-X-SERVER-CONTROL`
+ *   already stops media3 requesting deltas (`_HLS_skip=YES`), so this should never appear anyway.
+ * - `EXT-X-RENDITION-REPORT` — inert once the parts are gone.
+ */
+private val LOW_LATENCY_TAGS =
+    listOf(
+        "#EXT-X-PART:",
+        "#EXT-X-PART-INF:",
+        "#EXT-X-PRELOAD-HINT:",
+        "#EXT-X-SERVER-CONTROL:",
+    )
+
+/**
+ * Removes the Low-Latency HLS tags from a playlist, leaving every other byte untouched.
+ *
+ * Line separators are preserved exactly: the split/join round-trips `\n`, keeps the `\r` of a CRLF
+ * playlist as trailing content, and keeps a trailing newline (which `split` surfaces as a final
+ * empty element). Blank lines are never dropped.
+ */
+internal fun stripLowLatencyTags(playlist: String): String {
+    // Cheap pre-check: the overwhelming majority of playlists carry no LL tags at all, and this
+    // runs on every playlist reload of every live stream.
+    if (LOW_LATENCY_TAGS.none { playlist.contains(it) }) return playlist
+
+    return playlist
+        .split("\n")
+        .filterNot { line ->
+            val trimmed = line.trimStart()
+            LOW_LATENCY_TAGS.any { trimmed.startsWith(it) }
+        }.joinToString("\n")
+}
+
+/**
+ * The byte-level form: decode as UTF-8, strip, re-encode.
+ *
+ * Split out from [LowLatencyStrippingParser] so the charset round-trip is reachable from a plain JVM
+ * unit test — `parse` takes an `android.net.Uri`, which stubs to null under
+ * `unitTests.isReturnDefaultValues`, so nothing that goes through it is testable without Robolectric.
+ *
+ * A UTF-8 BOM survives: decoding leaves U+FEFF in the string, `trimStart` does not treat it as
+ * whitespace, and re-encoding reproduces the same three bytes. When there is nothing to strip the
+ * *original array* is returned, so the common path neither re-encodes nor copies.
+ */
+internal fun stripLowLatencyTags(playlist: ByteArray): ByteArray {
+    val original = playlist.toString(Charsets.UTF_8)
+    val stripped = stripLowLatencyTags(original)
+    return if (stripped === original) playlist else stripped.toByteArray(Charsets.UTF_8)
+}
+
+/**
+ * Wraps a media3 playlist parser and strips the Low-Latency tags before delegating.
+ *
+ * Playlists are a few KB, so reading the stream fully into memory is cheaper than the alternative of
+ * a streaming line filter and keeps the transform a pure, testable [stripLowLatencyTags] call.
+ */
+@UnstableApi
+internal class LowLatencyStrippingParser(
+    private val delegate: ParsingLoadable.Parser<HlsPlaylist>,
+) : ParsingLoadable.Parser<HlsPlaylist> {
+    override fun parse(
+        uri: Uri,
+        inputStream: InputStream,
+    ): HlsPlaylist = delegate.parse(uri, ByteArrayInputStream(stripLowLatencyTags(inputStream.readBytes())))
+}
+
+/**
+ * Serves media3 a de-low-latency-ed view of every HLS playlist.
+ *
+ * ## Why
+ *
+ * media3 crashes fatally on a Low-Latency HLS playlist whose parts are byte ranges — which is what
+ * zap-stream-core emits (`#EXT-X-PART:URI="…",DURATION=…,BYTERANGE="359712@0"`). Reproduced on
+ * media3 1.10.1, Pixel 9a / Android 17, ~0.6s after `ExoPlayerImpl.Init`:
+ *
+ * ```
+ * IllegalArgumentException
+ *   at androidx.media3.datasource.DataSpec.<init>          // checkArgument(length > 0 || length == LENGTH_UNSET)
+ *   at androidx.media3.datasource.DataSpec.subrange
+ *   at androidx.media3.exoplayer.hls.HlsMediaChunk.feedDataToExtractor
+ *   at androidx.media3.exoplayer.hls.HlsMediaChunk.loadMedia
+ * ```
+ *
+ * `HlsMediaChunk.feedDataToExtractor` re-enters as `dataSpec.subrange(nextLoadPosition)`. Once the
+ * whole bounded range has been fed to the extractor, `nextLoadPosition == length`, so `subrange`
+ * asks for a zero-length `DataSpec` and the constructor's `length > 0` precondition throws. The
+ * early-return guard in `subrange` only covers `offset == 0`, so a fully-consumed chunk falls
+ * straight through. Unbounded chunks are safe — `length == C.LENGTH_UNSET` short-circuits — so this
+ * is reachable only via a byte-range part.
+ *
+ * The failure is unrecoverable rather than merely retried: `Loader` wraps it as
+ * `UnexpectedLoaderException`, which `DefaultLoadErrorHandlingPolicy` lists as non-retriable, so it
+ * becomes a fatal `ExoPlaybackException: Source error`. Forcing a retry would not help either — the
+ * `HlsMediaChunk` instance keeps its `nextLoadPosition`, so it would throw identically forever.
+ *
+ * Still present verbatim in media3 1.11.0-rc01, so there is no version to upgrade to.
+ *
+ * **Tracking: https://github.com/androidx/media/issues/3350** — delete this whole file and its test
+ * once that is fixed and we are on a media3 release carrying the fix, then drop the explicit
+ * `HlsMediaSource.Factory` in [CustomMediaSourceFactory] and let `DefaultMediaSourceFactory` build
+ * HLS again. That also restores low latency, and removes the caveat about the wrapping
+ * `DefaultMediaSourceFactory` features documented there.
+ *
+ * ## Trade-off
+ *
+ * We lose low latency on LL-HLS streams: playback falls back to whole segments, roughly one
+ * `TARGETDURATION` further behind the live edge. LL playlists still list their complete segments
+ * below the part tags, so they play normally otherwise. Given the alternative is a hard failure
+ * within a second, and that media3 offers no per-stream way to decline just the parts, disabling it
+ * globally is the conservative trade.
+ */
+@UnstableApi
+internal class LowLatencyStrippingHlsPlaylistParserFactory(
+    private val delegate: HlsPlaylistParserFactory = DefaultHlsPlaylistParserFactory(),
+) : HlsPlaylistParserFactory {
+    override fun createPlaylistParser(): ParsingLoadable.Parser<HlsPlaylist> = LowLatencyStrippingParser(delegate.createPlaylistParser())
+
+    override fun createPlaylistParser(
+        multivariantPlaylist: HlsMultivariantPlaylist,
+        previousMediaPlaylist: HlsMediaPlaylist?,
+    ): ParsingLoadable.Parser<HlsPlaylist> = LowLatencyStrippingParser(delegate.createPlaylistParser(multivariantPlaylist, previousMediaPlaylist))
+}
@@ -22,7 +22,7 @@ package com.vitorpamplona.amethyst.service.playback.playerPool.positions

 import androidx.media3.common.MediaItem
 import androidx.media3.common.Player
-import com.vitorpamplona.amethyst.service.playback.diskCache.isLiveStreaming
+import com.vitorpamplona.amethyst.service.playback.playerPool.isHlsMediaItem
 import kotlin.math.abs

 class CurrentPlayPositionCacher(
@@ -41,7 +41,10 @@ class CurrentPlayPositionCacher(
            isLiveStreaming = false
        } else {
            currentUrl = mediaItem.mediaId
-            isLiveStreaming = isLiveStreaming(mediaItem.mediaId)
+            // Same predicate the source factory routes on, so a blossom-hosted playlist — which has
+            // no `.m3u8` in its URL — is recognised here too and doesn't get a resume position
+            // persisted against a stream that has no stable position to return to.
+            isLiveStreaming = isHlsMediaItem(mediaItem)
        }
    }

@@ -221,6 +221,13 @@ class AuthCoordinator(
                relayUrl = relayUrl,
                pendingEvents = client.activeOutboxEvents(relayUrl),
                myRelays = account.trustedRelays.flow.value,
+                // A NIP-29 relay group the user explicitly joined (kind-10009) is a first-party reason
+                // to authenticate with its host relay: private/closed group content is `#h`-scoped and
+                // never names the user, so it fails the pubkey checks above — without this, a joined
+                // private group's messages are refused with `auth-required` and the group stays empty.
+                myGroupRelays =
+                    account.relayGroupList.liveRelayGroupIds.value
+                        .mapTo(mutableSetOf()) { it.relayUrl },
            )

    fun destroy() {
@@ -34,7 +34,14 @@ import com.vitorpamplona.quartz.nip01Core.relay.normalizer.NormalizedRelayUrl
 *  - it is publishing its own event there ([pendingEvents] authored by it — e.g. delivering a DM to
 *    the recipient's inbox relay), or
 *  - the relay is one it configured itself ([myRelays] — its NIP-65 / DM / search / … lists, which
- *    is where its own inbox/outbox reads are routed anyway).
+ *    is where its own inbox/outbox reads are routed anyway), or
+ *  - the relay hosts a NIP-29 relay group the account explicitly joined ([myGroupRelays], from its
+ *    kind-10009 list). A private/closed group's content (kind-9 chat, kind-11 threads, …) is
+ *    `#h`-scoped and served only to authenticated members; that read never names the user, so it
+ *    can't qualify via [pendingEvents], and a group host relay is not one of the account's own
+ *    NIP-65/DM/… lists, so it can't qualify via [myRelays] either. Without this, a joined private
+ *    group is refused with `auth-required` and renders empty — the group's own metadata (39000) is
+ *    public and still loads, so the group appears but shows no messages.
 *
 * Crucially, an active subscription merely *naming* the account (a `#p` tag or `authors` entry) is
 * NOT a first-party reason: the app packs several accounts' pubkeys into one merged filter and fans
@@ -49,8 +56,10 @@ object RelayAuthFirstParty {
        relayUrl: NormalizedRelayUrl,
        pendingEvents: List<Event>,
        myRelays: Set<NormalizedRelayUrl>,
+        myGroupRelays: Set<NormalizedRelayUrl> = emptySet(),
    ): Boolean {
        if (pendingEvents.any { it.pubKey == me }) return true
-        return relayUrl in myRelays
+        if (relayUrl in myRelays) return true
+        return relayUrl in myGroupRelays
    }
 }
@@ -56,7 +56,10 @@ import kotlin.concurrent.thread
 */
 class BootRelayDiagnostics(
    val client: INostrClient,
-    val dumpAtSeconds: List<Long> = listOf(20, 45, 90),
+    // 5s first: the pool is assembled and dialling well before 20s, and the early datapoint is what
+    // distinguishes "slow to connect" from "connected fine, slow to serve". Affordable because the
+    // rollup is now 3 INFO lines rather than 5 — the ===== banners moved to DEBUG.
+    val dumpAtSeconds: List<Long> = listOf(5, 20, 45, 90),
 ) {
    companion object {
        const val TAG = "BootRelayDiag"
@@ -197,8 +200,13 @@ class BootRelayDiagnostics(
    fun detach() = client.removeConnectionListener(listener)

    /**
-     * One line per relay plus a rollup. Kept to a single Log.w per line so the whole census
+     * One line per relay plus a rollup. Kept to a single Log call per line so the whole census
     * survives logcat's per-tag rate limiting on a busy boot.
+     *
+     * The rollup goes out at INFO — it is the one boot line worth reading by default, and it
+     * carries the aggregate that per-socket failure logging used to spell out a few hundred
+     * times. The per-relay WASTE/SERVE tables are DEBUG: useful when you are chasing a specific
+     * relay, too long (up to 45 lines a census) to sit in the default log.
     */
    fun dump(atSeconds: Long) {
        val snapshot = records.toMap()
@@ -214,27 +222,27 @@ class BootRelayDiagnostics(
            r.closed.forEach { (k, v) -> closedTotals[k] = (closedTotals[k] ?: 0) + v.get() }
        }

-        Log.w(TAG, "===== boot census @${atSeconds}s =====")
-        Log.w(
+        Log.d(TAG, "===== boot census @${atSeconds}s =====")
+        Log.i(
            TAG,
-            "pool=${snapshot.size} opened=${opened.size} served_events=${served.size} never_opened=${neverOpened.size} " +
+            "census @${atSeconds}s pool=${snapshot.size} opened=${opened.size} served_events=${served.size} never_opened=${neverOpened.size} " +
                "dials=${snapshot.values.sumOf { it.tentatives.get() }} " +
                "events=${snapshot.values.sumOf { it.events.get() }} " +
                "reqs=${snapshot.values.sumOf { it.reqsSent.get() }} " +
                "auths=${snapshot.values.sumOf { it.authsSent.get() }}",
        )
-        Log.w(TAG, "failures_by_cause=" + causeTotals.entries.sortedByDescending { it.value }.joinToString { "${it.key}:${it.value}" })
-        Log.w(TAG, "closed_by_prefix=" + closedTotals.entries.sortedByDescending { it.value }.joinToString { "${it.key}:${it.value}" })
+        Log.i(TAG, "census @${atSeconds}s failures_by_cause=" + causeTotals.entries.sortedByDescending { it.value }.joinToString { "${it.key}:${it.value}" })
+        Log.i(TAG, "census @${atSeconds}s closed_by_prefix=" + closedTotals.entries.sortedByDescending { it.value }.joinToString { "${it.key}:${it.value}" })

        // Relays that cost us dials and gave nothing back, worst first: the wasted-effort list.
-        Log.w(TAG, "--- top wasted dials (no events received) ---")
+        Log.d(TAG, "--- top wasted dials (no events received) ---")
        snapshot
            .filter { it.value.events.get() == 0 }
            .entries
            .sortedByDescending { it.value.tentatives.get() }
            .take(25)
            .forEach { (url, r) ->
-                Log.w(
+                Log.d(
                    TAG,
                    "WASTE ${url.url} dials=${r.tentatives.get()} opens=${r.opens.get()} " +
                        "fail=[${r.failures.entries.joinToString { "${it.key}:${it.value.get()}" }}] " +
@@ -245,17 +253,17 @@ class BootRelayDiagnostics(

        // The relays actually carrying the boot, so a suppression change can be checked for
        // coverage loss rather than just CLOSED reduction.
-        Log.w(TAG, "--- top event providers ---")
+        Log.d(TAG, "--- top event providers ---")
        served.entries
            .sortedByDescending { it.value.events.get() }
            .take(20)
            .forEach { (url, r) ->
-                Log.w(
+                Log.d(
                    TAG,
                    "SERVE ${url.url} events=${r.events.get()} reqs=${r.reqsSent.get()} eose=${r.eoses.get()} " +
                        "openMs=${r.firstOpenAtMs.get()} eoseMs=${r.firstEoseAtMs.get()} dials=${r.tentatives.get()}",
                )
            }
-        Log.w(TAG, "===== end census @${atSeconds}s =====")
+        Log.d(TAG, "===== end census @${atSeconds}s =====")
    }
 }
@@ -61,6 +61,7 @@ import com.vitorpamplona.amethyst.ui.screen.loggedIn.geohash.datasource.GeoHashF
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.gitRepo.datasource.RepositoryFilterAssembler
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.gitRepositories.datasource.GitRepositoriesFilterAssembler
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.hashtag.datasource.HashtagFilterAssembler
+import com.vitorpamplona.amethyst.ui.screen.loggedIn.highlights.datasource.HighlightsFilterAssembler
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.home.datasource.HomeFilterAssembler
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.livestreams.datasource.LiveStreamsFilterAssembler
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.longs.datasource.LongsFilterAssembler
@@ -170,6 +171,7 @@ class RelaySubscriptionsCoordinator(
    val pictures = PicturesFilterAssembler(client)
    val workouts = WorkoutsFilterAssembler(client)
    val gitRepositories = GitRepositoriesFilterAssembler(client)
+    val highlights = HighlightsFilterAssembler(client)
    val calendars = CalendarsFilterAssembler(client)
    val products = ProductsFilterAssembler(client)
    val shorts = ShortsFilterAssembler(client)
@@ -235,6 +237,7 @@ class RelaySubscriptionsCoordinator(
            pictures,
            workouts,
            gitRepositories,
+            highlights,
            calendars,
            products,
            shorts,
@@ -29,11 +29,14 @@ import com.vitorpamplona.quartz.nip01Core.core.isValid
 import com.vitorpamplona.quartz.nipB7Blossom.BlossomServersEvent
 import com.vitorpamplona.quartz.nipB7Blossom.BlossomUri
 import com.vitorpamplona.quartz.utils.firstNotNullOrNullAsync
+import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.ExperimentalCoroutinesApi
+import kotlinx.coroutines.IO
 import kotlinx.coroutines.flow.Flow
 import kotlinx.coroutines.flow.first
 import kotlinx.coroutines.flow.merge
 import kotlinx.coroutines.flow.transformLatest
+import kotlinx.coroutines.withContext
 import kotlinx.coroutines.withTimeoutOrNull
 import okhttp3.OkHttpClient

@@ -57,9 +60,16 @@ class BlossomServerResolver(
    suspend fun findServers(uriStr: String): BlossomUriServer? {
        uriToUrlCache[uriStr]?.let { return it }

+        // Confined to Dispatchers.IO: this is reached from Compose
+        // `produceState`/`LaunchedEffect` (RichTextViewer, MarmotGroupIconDisplay),
+        // which run on the main dispatcher. The pre-suspension work here —
+        // BlossomUri parsing, LruCache lookups, the local-cache probe's client
+        // build, and the server-list flow setup — must stay off the UI thread.
        val result =
-            withTimeoutOrNull(10000) {
-                findServersInner(uriStr)
+            withContext(Dispatchers.IO) {
+                withTimeoutOrNull(10000) {
+                    findServersInner(uriStr)
+                }
            }

        if (result != null) {
@@ -22,10 +22,13 @@ package com.vitorpamplona.amethyst.service.uploads.blossom.bud10

 import com.vitorpamplona.amethyst.model.privacyOptions.IRoleBasedHttpClientBuilder
 import kotlinx.coroutines.CancellationException
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.IO
 import kotlinx.coroutines.flow.MutableStateFlow
 import kotlinx.coroutines.flow.StateFlow
 import kotlinx.coroutines.sync.Mutex
 import kotlinx.coroutines.sync.withLock
+import kotlinx.coroutines.withContext
 import okhttp3.Request
 import okhttp3.coroutines.executeAsync
 import java.util.concurrent.TimeUnit
@@ -77,33 +80,39 @@ class LocalBlossomCacheProbe(
        cachedAtMs = 0L
    }

+    // Confined to Dispatchers.IO because callers reach this through suspend
+    // resolvers invoked from Compose `LaunchedEffect`/`produceState`, which run
+    // on the main dispatcher: building the OkHttp client and issuing the HEAD
+    // must not touch the UI thread.
    private suspend fun probe(): Boolean =
-        try {
-            val baseClient = httpClientBuilder.okHttpClientForPreview(LOCAL_CACHE_BASE)
-            val client =
-                baseClient
-                    .newBuilder()
-                    .connectTimeout(PROBE_TIMEOUT_MS, TimeUnit.MILLISECONDS)
-                    .readTimeout(PROBE_TIMEOUT_MS, TimeUnit.MILLISECONDS)
-                    .callTimeout(PROBE_TIMEOUT_MS, TimeUnit.MILLISECONDS)
-                    .build()
+        withContext(Dispatchers.IO) {
+            try {
+                val baseClient = httpClientBuilder.okHttpClientForPreview(LOCAL_CACHE_BASE)
+                val client =
+                    baseClient
+                        .newBuilder()
+                        .connectTimeout(PROBE_TIMEOUT_MS, TimeUnit.MILLISECONDS)
+                        .readTimeout(PROBE_TIMEOUT_MS, TimeUnit.MILLISECONDS)
+                        .callTimeout(PROBE_TIMEOUT_MS, TimeUnit.MILLISECONDS)
+                        .build()

-            val request =
-                Request
-                    .Builder()
-                    .url("$LOCAL_CACHE_BASE/")
-                    .head()
-                    .build()
+                val request =
+                    Request
+                        .Builder()
+                        .url("$LOCAL_CACHE_BASE/")
+                        .head()
+                        .build()

-            client.newCall(request).executeAsync().use { response ->
-                // Spec says HEAD / returns 2xx when available. Some implementations
-                // may answer 405 (method not allowed) while still being a working
-                // Blossom cache, so treat that as available too.
-                response.isSuccessful || response.code == 405
+                client.newCall(request).executeAsync().use { response ->
+                    // Spec says HEAD / returns 2xx when available. Some implementations
+                    // may answer 405 (method not allowed) while still being a working
+                    // Blossom cache, so treat that as available too.
+                    response.isSuccessful || response.code == 405
+                }
+            } catch (e: Exception) {
+                if (e is CancellationException) throw e
+                false
            }
-        } catch (e: Exception) {
-            if (e is CancellationException) throw e
-            false
        }

    private fun currentTimeMs(): Long = System.currentTimeMillis()
@@ -31,6 +31,7 @@ import androidx.lifecycle.viewModelScope
 import com.vitorpamplona.amethyst.R
 import com.vitorpamplona.amethyst.commons.richtext.RichTextParser
 import com.vitorpamplona.amethyst.model.Account
+import com.vitorpamplona.amethyst.model.VideoPostKind
 import com.vitorpamplona.amethyst.service.uploads.MediaCompressor
 import com.vitorpamplona.amethyst.service.uploads.MultiOrchestrator
 import com.vitorpamplona.amethyst.service.uploads.SuspendableConfirmation
@@ -73,15 +74,21 @@ open class NewMediaModel : ViewModel() {
    // Strip location and sensitive metadata from files before upload
    var stripMetadata by mutableStateOf(true)

+    // Which NIP-71 kind videos in this batch are published as. Set by the composer's host feed.
+    var videoKind: VideoPostKind = VideoPostKind.AUTO
+
    open fun load(
        account: Account,
        uris: ImmutableList<SelectedMedia>,
+        videoKind: VideoPostKind = VideoPostKind.AUTO,
+        caption: String = "",
    ) {
-        this.caption = ""
+        this.caption = caption
        this.account = account
        this.multiOrchestrator = MultiOrchestrator(uris)
        this.selectedServer = defaultServer()
        this.stripMetadata = account.settings.stripLocationOnUpload
+        this.videoKind = videoKind
    }

    fun isImage(
@@ -180,6 +187,7 @@ open class NewMediaModel : ViewModel() {
                                alt = caption,
                                contentWarningReason = if (sensitiveContent) "" else null,
                                originalHash = it.uploadedHash,
+                                videoKind = videoKind,
                            )
                        }
                    }
@@ -54,6 +54,7 @@ import androidx.compose.ui.unit.dp
 import androidx.compose.ui.window.Dialog
 import androidx.compose.ui.window.DialogProperties
 import com.vitorpamplona.amethyst.R
+import com.vitorpamplona.amethyst.model.VideoPostKind
 import com.vitorpamplona.amethyst.ui.actions.mediaServers.DEFAULT_MEDIA_SERVERS
 import com.vitorpamplona.amethyst.ui.actions.uploads.SelectedMedia
 import com.vitorpamplona.amethyst.ui.actions.uploads.ShowImageUploadGallery
@@ -79,14 +80,16 @@ fun NewMediaView(
    postViewModel: NewMediaModel,
    accountViewModel: AccountViewModel,
    nav: INav,
+    videoKind: VideoPostKind = VideoPostKind.AUTO,
+    initialCaption: String = "",
 ) {
    val account = accountViewModel.account
    val context = LocalContext.current

    val scrollState = rememberScrollState()

-    LaunchedEffect(uris) {
-        postViewModel.load(account, uris)
+    LaunchedEffect(uris, videoKind, initialCaption) {
+        postViewModel.load(account, uris, videoKind, initialCaption)
    }

    StrippingFailureDialog(postViewModel.strippingFailureConfirmation)
@@ -22,6 +22,9 @@ package com.vitorpamplona.amethyst.ui.actions.uploads

 import android.content.Context
 import androidx.core.net.toUri
+import kotlinx.collections.immutable.ImmutableList
+import kotlinx.collections.immutable.persistentListOf
+import kotlinx.collections.immutable.toImmutableList
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.withContext

@@ -40,3 +43,20 @@ suspend fun resolveSharedMedia(
            SelectedMedia(uri, context.contentResolver.getType(uri))
        }
    }
+
+/**
+ * Batch form for SEND_MULTIPLE shares: resolves every URI in one trip to the IO dispatcher
+ * instead of one context switch per file. Blank entries are dropped, so an empty list in means
+ * an empty list out and the composer stays closed.
+ */
+suspend fun resolveSharedMedia(
+    context: Context,
+    uriStrings: List<String>,
+): ImmutableList<SelectedMedia> {
+    val uris = uriStrings.mapNotNull { it.ifBlank { null }?.toUri() }
+    if (uris.isEmpty()) return persistentListOf()
+
+    return withContext(Dispatchers.IO) {
+        uris.map { SelectedMedia(it, context.contentResolver.getType(it)) }.toImmutableList()
+    }
+}
@@ -52,13 +52,10 @@ fun LoadUrlPreview(
 }

@Composable
-fun LoadUrlPreviewDirect(
+fun rememberUrlPreviewState(
    url: String,
-    urlText: String,
-    callbackUri: String? = null,
    accountViewModel: AccountViewModel,
-    nav: INav? = null,
-) {
+): UrlPreviewState {
    @Suppress("ProduceStateDoesNotAssignValue")
    val urlPreviewState by
        produceState(
@@ -69,6 +66,18 @@ fun LoadUrlPreviewDirect(
                accountViewModel.urlPreview(url) { value = it }
            }
        }
+    return urlPreviewState
+}
+
+@Composable
+fun LoadUrlPreviewDirect(
+    url: String,
+    urlText: String,
+    callbackUri: String? = null,
+    accountViewModel: AccountViewModel,
+    nav: INav? = null,
+) {
+    val urlPreviewState = rememberUrlPreviewState(url, accountViewModel)

    CrossfadeIfEnabled(
        targetState = urlPreviewState,
@@ -23,13 +23,17 @@ package com.vitorpamplona.amethyst.ui.components
 import androidx.compose.foundation.ExperimentalFoundationApi
 import androidx.compose.foundation.combinedClickable
 import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.Row
 import androidx.compose.foundation.layout.Spacer
+import androidx.compose.material3.IconButton
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.Text
 import androidx.compose.runtime.Composable
 import androidx.compose.runtime.mutableStateOf
 import androidx.compose.runtime.remember
 import androidx.compose.runtime.rememberCoroutineScope
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
 import androidx.compose.ui.graphics.Color
 import androidx.compose.ui.layout.ContentScale
 import androidx.compose.ui.platform.LocalClipboard
@@ -37,12 +41,14 @@ import androidx.compose.ui.platform.LocalUriHandler
 import androidx.compose.ui.text.style.TextOverflow
 import coil3.compose.AsyncImage
 import com.vitorpamplona.amethyst.R
+import com.vitorpamplona.amethyst.commons.icons.symbols.Icon
 import com.vitorpamplona.amethyst.commons.icons.symbols.MaterialSymbols
 import com.vitorpamplona.amethyst.commons.preview.UrlInfoItem
 import com.vitorpamplona.amethyst.ui.components.util.setText
 import com.vitorpamplona.amethyst.ui.stringRes
 import com.vitorpamplona.amethyst.ui.theme.DoubleVertSpacer
 import com.vitorpamplona.amethyst.ui.theme.MaxWidthWithHorzPadding
+import com.vitorpamplona.amethyst.ui.theme.Size14Modifier
 import com.vitorpamplona.amethyst.ui.theme.innerPostModifier
 import com.vitorpamplona.amethyst.ui.theme.previewCardImageModifier
 import kotlinx.coroutines.launch
@@ -53,6 +59,7 @@ fun UrlPreviewCard(
    url: String,
    previewInfo: UrlInfoItem,
    onUrlComments: (() -> Unit)? = null,
+    onCardClick: (() -> Unit)? = null,
 ) {
    val uri = LocalUriHandler.current
    val popupExpanded =
@@ -95,7 +102,11 @@ fun UrlPreviewCard(
            MaterialTheme.colorScheme.innerPostModifier
                .combinedClickable(
                    onClick = {
-                        runCatching { uri.openUri(url) }
+                        if (onCardClick != null) {
+                            onCardClick()
+                        } else {
+                            runCatching { uri.openUri(url) }
+                        }
                    },
                    onLongClick = {
                        popupExpanded.value = true
@@ -109,14 +120,34 @@ fun UrlPreviewCard(
            modifier = previewCardImageModifier,
        )

-        Text(
-            text = previewInfo.verifiedUrl?.host ?: previewInfo.url,
-            style = MaterialTheme.typography.bodySmall,
+        Row(
            modifier = MaxWidthWithHorzPadding,
-            color = Color.Gray,
-            maxLines = 1,
-            overflow = TextOverflow.Ellipsis,
-        )
+            verticalAlignment = Alignment.CenterVertically,
+        ) {
+            Text(
+                text = previewInfo.verifiedUrl?.host ?: previewInfo.url,
+                style = MaterialTheme.typography.bodySmall,
+                modifier = Modifier.weight(1f, fill = false),
+                color = Color.Gray,
+                maxLines = 1,
+                overflow = TextOverflow.Ellipsis,
+            )
+
+            // Only meaningful when the card's own tap does something else (e.g. opening the
+            // comment thread); otherwise it would duplicate the card's open-in-browser tap.
+            if (onCardClick != null) {
+                IconButton(
+                    onClick = { runCatching { uri.openUri(url) } },
+                ) {
+                    Icon(
+                        symbol = MaterialSymbols.AutoMirrored.OpenInNew,
+                        contentDescription = stringRes(R.string.url_preview_open_in_browser),
+                        modifier = Size14Modifier,
+                        tint = Color.Gray,
+                    )
+                }
+            }
+        }

        Text(
            text = previewInfo.title,
@@ -98,7 +98,7 @@ import com.vitorpamplona.amethyst.commons.richtext.MediaUrlVideo
 import com.vitorpamplona.amethyst.commons.richtext.toCoilModel
 import com.vitorpamplona.amethyst.model.MediaAspectRatioCache
 import com.vitorpamplona.amethyst.service.playback.composable.VideoViewInner
-import com.vitorpamplona.amethyst.service.playback.diskCache.isLiveStreaming
+import com.vitorpamplona.amethyst.service.playback.composable.mediaitem.isHlsMedia
 import com.vitorpamplona.amethyst.ui.actions.MediaSaverToDisk
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.AccountViewModel
 import com.vitorpamplona.amethyst.ui.stringRes
@@ -431,7 +431,7 @@ private fun DialogContent(
                    }

                    val isPdfOrStaticImage = myContent is MediaUrlImage || myContent is MediaLocalImage || myContent is MediaUrlPdf
-                    val isNotLiveStream = myContent !is MediaUrlContent || !isLiveStreaming(myContent.url)
+                    val isNotLiveStream = myContent !is MediaUrlContent || !isHlsMedia(myContent.url, myContent.mimeType)
                    if (isPdfOrStaticImage && isNotLiveStream) {
                        val localContext = LocalContext.current

@@ -47,6 +47,7 @@ fun FeedLoaded(
    routeForLastRead: String?,
    accountViewModel: AccountViewModel,
    nav: INav,
+    header: (@Composable () -> Unit)? = null,
 ) {
    val items by loaded.feed.collectAsStateWithLifecycle()

@@ -54,6 +55,12 @@ fun FeedLoaded(
        contentPadding = rememberFeedContentPadding(FeedPadding),
        state = listState,
    ) {
+        if (header != null) {
+            item {
+                header()
+            }
+        }
+
        itemsIndexed(
            items.list,
            key = { _, item -> item.idHex },
@@ -51,6 +51,8 @@ import com.vitorpamplona.quartz.nip10Notes.TextNoteEvent
 import com.vitorpamplona.quartz.nip14Subject.subject
 import com.vitorpamplona.quartz.nip22Comments.CommentEvent
 import com.vitorpamplona.quartz.nip71Video.image
+import com.vitorpamplona.quartz.nip73ExternalIds.scope
+import com.vitorpamplona.quartz.nip73ExternalIds.urls.UrlId
 import com.vitorpamplona.quartz.nip92IMeta.IMetaTag
 import com.vitorpamplona.quartz.nip92IMeta.imetas
 import com.vitorpamplona.quartz.nip94FileMetadata.tags.MimeTypeTag
@@ -313,10 +315,10 @@ private class WarmTargets {

 /**
 * Collects everything worth warming for this note. Reads NIP-92 imeta tags (every
- * kind), then the free-text body: text notes and comments go through the shared
- * render cache — which both warms the renderer and yields a fully classified body
- * — while every other kind gets a cheap URL scan. Returns null only when the note
- * has no event.
+ * kind), the NIP-73 external-content scope (kind 1111 only), then the free-text
+ * body: text notes and comments go through the shared render cache — which both
+ * warms the renderer and yields a fully classified body — while every other kind
+ * gets a cheap URL scan. Returns null only when the note has no event.
 */
 private fun Note.collectWarmTargets(): WarmTargets? {
    val ev = event ?: return null
@@ -335,6 +337,13 @@ private fun Note.collectWarmTargets(): WarmTargets? {
    // imetas() above misses these entirely.
    targets.addFileHeaderMedia(ev)

+    // NIP-73 external-content scope. Only kind 1111 carries one, so the type check
+    // keeps every other kind out of the tag walk. Reuses scope() — the same accessor
+    // the renderer uses — so we only warm a URL that will actually be shown.
+    if (ev is CommentEvent) {
+        (ev.scope() as? UrlId)?.let { targets.link(it.url) }
+    }
+
    // Free-text body. The reproducible-key kinds parse through the shared cache
    // (which also warms the render); everything else is scanned for URLs only.
    val rendered = warmRenderCache(ev)
@@ -69,6 +69,7 @@ object ScrollStateKeys {
    const val PICTURES_SCREEN = "PicturesFeed"
    const val WORKOUTS_SCREEN = "WorkoutsFeed"
    const val GIT_REPOSITORIES_SCREEN = "GitRepositoriesFeed"
+    const val HIGHLIGHTS_SCREEN = "HighlightsFeed"
    const val RELAY_GROUPS_DISCOVERY_SCREEN = "RelayGroupsDiscoveryFeed"
    const val CALENDARS_SCREEN = "CalendarsFeed"
    const val CALENDAR_COLLECTIONS_SCREEN = "CalendarCollectionsFeed"
@@ -72,6 +72,7 @@ import com.vitorpamplona.amethyst.ui.navigation.bottombars.TabReselectCoordinato
 import com.vitorpamplona.amethyst.ui.navigation.bottombars.favoriteIds
 import com.vitorpamplona.amethyst.ui.navigation.navs.Nav
 import com.vitorpamplona.amethyst.ui.navigation.navs.rememberNav
+import com.vitorpamplona.amethyst.ui.navigation.routes.MediaFeedRoute
 import com.vitorpamplona.amethyst.ui.navigation.routes.Route
 import com.vitorpamplona.amethyst.ui.navigation.routes.getRouteWithArguments
 import com.vitorpamplona.amethyst.ui.navigation.routes.isBaseRoute
@@ -193,6 +194,8 @@ import com.vitorpamplona.amethyst.ui.screen.loggedIn.gitRepo.GitRepositoryScreen
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.gitRepositories.GitRepositoriesScreen
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.hashtag.HashtagPostScreen
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.hashtag.HashtagScreen
+import com.vitorpamplona.amethyst.ui.screen.loggedIn.highlights.HighlightsScreen
+import com.vitorpamplona.amethyst.ui.screen.loggedIn.highlights.NewHighlightScreen
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.home.HomeScreen
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.home.ShortNotePostScreen
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.home.VoiceReplyScreen
@@ -310,6 +313,7 @@ import com.vitorpamplona.amethyst.ui.screen.loggedOff.AddAccountDialog
 import com.vitorpamplona.amethyst.ui.uriToRoute
 import com.vitorpamplona.quartz.nip01Core.core.Address
 import com.vitorpamplona.quartz.nip19Bech32.Nip19Parser
+import com.vitorpamplona.quartz.nip84Highlights.parse.SharedHighlightParser
 import kotlinx.coroutines.delay
 import kotlinx.coroutines.launch
 import java.net.URI
@@ -425,7 +429,7 @@ fun BuildNavigation(
    ) {
        composableCapped<Route.Home> { HomeScreen(accountViewModel, nav) }
        composable<Route.Message> { MessagesScreen(accountViewModel, nav) }
-        composableCapped<Route.Video> { VideoScreen(accountViewModel, nav) }
+        composableArgs<Route.Video> { VideoScreen(accountViewModel, nav, it.attachments, it.message) }
        composableArgs<Route.Discover> { DiscoverScreen(it.initialTab, accountViewModel, nav) }
        composableArgs<Route.Notification> { NotificationScreen(it.scrollToEventId, accountViewModel, nav) }
        composableFromEnd<Route.Polls> { PollsScreen(accountViewModel, nav) }
@@ -436,9 +440,11 @@ fun BuildNavigation(
        composableFromEnd<Route.ProfileBadges> { ProfileBadgesScreen(accountViewModel, nav) }
        composableFromEnd<Route.ProfileAppRecommendations> { ProfileAppRecommendationsScreen(accountViewModel, nav) }
        composableFromBottomArgs<Route.AwardBadge> { AwardBadgeScreen(it.kind, it.pubKeyHex, it.dTag, accountViewModel, nav) }
-        composableFromEnd<Route.Pictures> { PicturesScreen(accountViewModel, nav) }
+        composableFromEndArgs<Route.Pictures> { PicturesScreen(accountViewModel, nav, it.attachments, it.message) }
        composableFromEnd<Route.Workouts> { WorkoutsScreen(accountViewModel, nav) }
        composableFromEnd<Route.GitRepositories> { GitRepositoriesScreen(accountViewModel, nav) }
+
+        composableFromEnd<Route.Highlights> { HighlightsScreen(accountViewModel, nav) }
        composableFromEnd<Route.SoftwareApps> { SoftwareAppsScreen(accountViewModel, nav) }
        composableFromEnd<Route.Napplets> { NappletsScreen(accountViewModel, nav) }
        composableFromEnd<Route.Nsites> { NsitesScreen(accountViewModel, nav) }
@@ -464,7 +470,7 @@ fun BuildNavigation(
        }
        composableFromBottomArgs<Route.NewCalendarCollection> { NewCalendarCollectionScreen(nav, accountViewModel, it.dTag) }
        composableFromEnd<Route.Products> { ProductsScreen(accountViewModel, nav) }
-        composableFromEnd<Route.Shorts> { ShortsScreen(accountViewModel, nav) }
+        composableFromEndArgs<Route.Shorts> { ShortsScreen(accountViewModel, nav, it.attachments, it.message) }
        composableFromEnd<Route.PublicChats> { PublicChatsScreen(accountViewModel, nav) }
        composableFromEnd<Route.RelayGroups> { RelayGroupDiscoveryScreen(accountViewModel, nav) }
        composableFromEndArgs<Route.BuzzDmList> { BuzzDmListScreen(it.relayUrl, accountViewModel, nav) }
@@ -785,6 +791,7 @@ fun BuildNavigation(
        composableFromEndArgs<Route.RelayGroupCreate> {
            RelayGroupCreateScreen(
                relayUrl = it.relayUrl,
+                isForum = it.isForum,
                accountViewModel = accountViewModel,
                nav = nav,
            )
@@ -935,6 +942,22 @@ fun BuildNavigation(
            )
        }

+        composableFromBottomArgs<Route.NewHighlight> {
+            NewHighlightScreen(
+                quote = it.quote,
+                url = it.url,
+                prefix = it.prefix,
+                suffix = it.suffix,
+                comment = it.comment,
+                context = it.context,
+                sourceAddress = it.sourceAddress,
+                sourceEventId = it.sourceEventId,
+                author = it.author,
+                accountViewModel = accountViewModel,
+                nav = nav,
+            )
+        }
+
        composableFromBottomArgs<Route.VoiceReply> {
            VoiceReplyScreen(
                replyToNoteId = it.replyToNoteId,
@@ -949,6 +972,42 @@ fun BuildNavigation(
    }
 }

+/** True for both share flavors: a single file/text (SEND) and a multi-file selection (SEND_MULTIPLE). */
+private fun Intent.isShareAction(): Boolean = action == Intent.ACTION_SEND || action == Intent.ACTION_SEND_MULTIPLE
+
+/** The text Android sent with the share — a caption, a URL, or the whole payload of a text-only share. */
+private fun Intent.sharedText(): String? = getStringExtra(Intent.EXTRA_TEXT)?.ifBlank { null }
+
+/**
+ * Every content URI the share carries, in the order the sending app listed them. SEND_MULTIPLE
+ * puts them in a parcelable ArrayList; plain SEND has at most one. Only the media targets declare
+ * SEND_MULTIPLE, so every other caller can just take the first.
+ */
+private fun Intent.sharedStreamUris(): List<String> =
+    if (action == Intent.ACTION_SEND_MULTIPLE) {
+        IntentCompat
+            .getParcelableArrayListExtra(this, Intent.EXTRA_STREAM, Uri::class.java)
+            ?.map { it.toString() }
+            .orEmpty()
+    } else {
+        listOfNotNull(IntentCompat.getParcelableExtra(this, Intent.EXTRA_STREAM, Uri::class.java)?.toString())
+    }
+
+/**
+ * Opens a media feed on a share. Sharing again while an earlier share is still on screen replaces
+ * it instead of stacking a second copy of the feed — but only when the entry on top is itself a
+ * share (it carries attachments). A feed the user opened from the bottom bar carries none, so it
+ * stays put underneath and keeps its tab-root marker.
+ */
+private inline fun <reified T> Nav.navToSharedFeed(route: T) where T : Route, T : MediaFeedRoute {
+    val current = getRouteWithArguments(T::class, controller)
+    if (current is MediaFeedRoute && current.attachments.isNotEmpty()) {
+        popUpTo(route, T::class)
+    } else {
+        newStack(route)
+    }
+}
+
@Composable
 private fun NavigateIfIntentRequested(
    nav: Nav,
@@ -965,36 +1024,43 @@ private fun NavigateIfIntentRequested(

    val activity = LocalContext.current.getActivity()

-    if (activity.intent.action == Intent.ACTION_SEND) {
-        val isShareAsDm = ShareIntentRouting.isShareAsDm(activity.intent.component?.className)
+    if (activity.intent.isShareAction()) {
+        val target = ShareIntentRouting.targetOf(activity.intent.component?.className)

        // avoids restarting the destination screen when the intent is for the screen.
-        // Microsoft's swift key sends Gifs as new actions
-        if (isShareAsDm) {
-            if (isBaseRoute<Route.ShareToDM>(nav.controller)) return
-        } else {
-            if (isBaseRoute<Route.NewShortNote>(nav.controller)) return
+        // Microsoft's swift key sends Gifs as new actions.
+        // The media targets land on a feed the user may well be standing on already, so they can't
+        // guard on the destination — they rely on the intent being consumed below instead.
+        when (target) {
+            ShareTarget.HIGHLIGHT -> if (isBaseRoute<Route.NewHighlight>(nav.controller)) return
+            ShareTarget.DIRECT_MESSAGE -> if (isBaseRoute<Route.ShareToDM>(nav.controller)) return
+            ShareTarget.NEW_POST -> if (isBaseRoute<Route.NewShortNote>(nav.controller)) return
+            ShareTarget.PICTURE, ShareTarget.SHORT_VIDEO, ShareTarget.VIDEO -> Unit
        }

        // saves the intent to avoid processing again
-        var message by remember {
-            mutableStateOf(
-                activity.intent.getStringExtra(Intent.EXTRA_TEXT)?.let {
-                    it.ifBlank { null }
-                },
-            )
-        }
+        val message = remember { activity.intent.sharedText() }
+        val attachments = remember { activity.intent.sharedStreamUris() }

-        var media by remember {
-            mutableStateOf(
-                IntentCompat.getParcelableExtra(activity.intent, Intent.EXTRA_STREAM, Uri::class.java),
-            )
-        }
-
-        if (isShareAsDm) {
-            nav.newStack(Route.ShareToDM(message = message, attachment = media?.toString()))
-        } else {
-            nav.newStack(Route.NewShortNote(message = message, attachment = media.toString()))
+        when (target) {
+            ShareTarget.HIGHLIGHT -> {
+                val parsed = message?.let { SharedHighlightParser.parse(it) }
+                nav.newStack(
+                    Route.NewHighlight(
+                        quote = parsed?.quote,
+                        url = parsed?.url,
+                        prefix = parsed?.prefix,
+                        suffix = parsed?.suffix,
+                    ),
+                )
+            }
+            // The single-file composers take the first URI: only the media targets declare
+            // SEND_MULTIPLE, so anything else can only be carrying one.
+            ShareTarget.DIRECT_MESSAGE -> nav.newStack(Route.ShareToDM(message = message, attachment = attachments.firstOrNull()))
+            ShareTarget.PICTURE -> nav.navToSharedFeed(Route.Pictures(attachments = attachments, message = message))
+            ShareTarget.SHORT_VIDEO -> nav.navToSharedFeed(Route.Shorts(attachments = attachments, message = message))
+            ShareTarget.VIDEO -> nav.navToSharedFeed(Route.Video(attachments = attachments, message = message))
+            ShareTarget.NEW_POST -> nav.newStack(Route.NewShortNote(message = message, attachment = attachments.firstOrNull()))
        }

        // Consume the launch intent so a later recomposition can't re-fire
@@ -1061,25 +1127,44 @@ private fun NavigateIfIntentRequested(
        DisposableEffect(nav, activity) {
            val consumer =
                Consumer<Intent> { intent ->
-                    if (intent.action == Intent.ACTION_SEND) {
-                        val isShareAsDm = ShareIntentRouting.isShareAsDm(intent.component?.className)
-                        // avoids restarting the destination screen when the intent is for the screen.
-                        // Microsoft's swift key sends Gifs as new actions
-                        if (isShareAsDm) {
-                            if (!isBaseRoute<Route.ShareToDM>(nav.controller)) {
-                                val message = intent.getStringExtra(Intent.EXTRA_TEXT)?.ifBlank { null }
-                                val attachment =
-                                    IntentCompat.getParcelableExtra(intent, Intent.EXTRA_STREAM, Uri::class.java)?.toString()
-                                nav.newStack(Route.ShareToDM(message = message, attachment = attachment))
-                            }
-                        } else if (!isBaseRoute<Route.NewShortNote>(nav.controller)) {
-                            intent.getStringExtra(Intent.EXTRA_TEXT)?.let {
-                                nav.newStack(Route.NewShortNote(message = it))
-                            }
+                    if (intent.isShareAction()) {
+                        val target = ShareIntentRouting.targetOf(intent.component?.className)
+                        val message = intent.sharedText()
+                        val attachments = intent.sharedStreamUris()
+                        val attachment = attachments.firstOrNull()

-                            IntentCompat.getParcelableExtra(intent, Intent.EXTRA_STREAM, Uri::class.java)?.let {
-                                nav.newStack(Route.NewShortNote(attachment = it.toString()))
-                            }
+                        // avoids restarting the destination screen when the intent is for the screen.
+                        // Microsoft's swift key sends Gifs as new actions.
+                        // The media targets land on a feed the user may well be standing on already, so
+                        // they always navigate: the route carries the attachment, so the composer opens
+                        // on the newly shared file even when the feed itself is already on screen.
+                        when (target) {
+                            ShareTarget.HIGHLIGHT ->
+                                if (!isBaseRoute<Route.NewHighlight>(nav.controller)) {
+                                    val parsed = message?.let { SharedHighlightParser.parse(it) }
+                                    nav.newStack(
+                                        Route.NewHighlight(
+                                            quote = parsed?.quote,
+                                            url = parsed?.url,
+                                            prefix = parsed?.prefix,
+                                            suffix = parsed?.suffix,
+                                        ),
+                                    )
+                                }
+
+                            ShareTarget.DIRECT_MESSAGE ->
+                                if (!isBaseRoute<Route.ShareToDM>(nav.controller)) {
+                                    nav.newStack(Route.ShareToDM(message = message, attachment = attachment))
+                                }
+
+                            ShareTarget.PICTURE -> nav.navToSharedFeed(Route.Pictures(attachments = attachments, message = message))
+                            ShareTarget.SHORT_VIDEO -> nav.navToSharedFeed(Route.Shorts(attachments = attachments, message = message))
+                            ShareTarget.VIDEO -> nav.navToSharedFeed(Route.Video(attachments = attachments, message = message))
+
+                            ShareTarget.NEW_POST ->
+                                if (!isBaseRoute<Route.NewShortNote>(nav.controller) && (message != null || attachment != null)) {
+                                    nav.newStack(Route.NewShortNote(message = message, attachment = attachment))
+                                }
                        }
                    } else {
                        val uri = intent.data?.toString()
@@ -20,10 +20,31 @@
 */
 package com.vitorpamplona.amethyst.ui.navigation

+/** Which entry of Android's share sheet the user picked. */
+enum class ShareTarget {
+    /** The default "New Post" target: a kind-1 note with the shared text/media. */
+    NEW_POST,
+
+    /** "Send as DM": a NIP-17 private message. */
+    DIRECT_MESSAGE,
+
+    /** "New Highlight": a NIP-84 highlight of the shared passage. */
+    HIGHLIGHT,
+
+    /** "New Picture": a NIP-68 picture post, straight into the picture feed. */
+    PICTURE,
+
+    /** "New Short": a NIP-71 kind 22 video, straight into the Shorts feed. */
+    SHORT_VIDEO,
+
+    /** "New Video": a NIP-71 video, straight into the Video feed. */
+    VIDEO,
+}
+
 /**
- * Distinguishes the "Send as DM" share target from the default "New Post" share
- * target. Both intent-filters resolve to MainActivity; they are told apart by the
- * component class name of the launching intent (the activity-alias name).
+ * Tells the share targets apart. Every SEND intent-filter resolves to MainActivity; which target
+ * the user picked is only visible in the component class name of the launching intent (the
+ * `<activity-alias>` name), so each alias below maps to the composer it opens.
 */
 object ShareIntentRouting {
    /**
@@ -34,5 +55,42 @@ object ShareIntentRouting {
     */
    const val SHARE_AS_DM_ALIAS_SIMPLE_NAME = "ShareAsDMAlias"

-    fun isShareAsDm(componentClassName: String?): Boolean = componentClassName?.endsWith(".$SHARE_AS_DM_ALIAS_SIMPLE_NAME") == true
+    /**
+     * Simple class name of the `<activity-alias>` declared in AndroidManifest.xml
+     * (android:name=".ui.ShareAsHighlightAlias"). MUST stay in sync with the manifest —
+     * see the caveat on [SHARE_AS_DM_ALIAS_SIMPLE_NAME].
+     */
+    const val SHARE_AS_HIGHLIGHT_ALIAS_SIMPLE_NAME = "ShareAsHighlightAlias"
+
+    /** See the caveat on [SHARE_AS_DM_ALIAS_SIMPLE_NAME]. */
+    const val SHARE_AS_PICTURE_ALIAS_SIMPLE_NAME = "ShareAsPictureAlias"
+
+    /** See the caveat on [SHARE_AS_DM_ALIAS_SIMPLE_NAME]. */
+    const val SHARE_AS_SHORT_VIDEO_ALIAS_SIMPLE_NAME = "ShareAsShortVideoAlias"
+
+    /** See the caveat on [SHARE_AS_DM_ALIAS_SIMPLE_NAME]. */
+    const val SHARE_AS_VIDEO_ALIAS_SIMPLE_NAME = "ShareAsVideoAlias"
+
+    private val TARGET_BY_ALIAS =
+        mapOf(
+            SHARE_AS_DM_ALIAS_SIMPLE_NAME to ShareTarget.DIRECT_MESSAGE,
+            SHARE_AS_HIGHLIGHT_ALIAS_SIMPLE_NAME to ShareTarget.HIGHLIGHT,
+            SHARE_AS_PICTURE_ALIAS_SIMPLE_NAME to ShareTarget.PICTURE,
+            SHARE_AS_SHORT_VIDEO_ALIAS_SIMPLE_NAME to ShareTarget.SHORT_VIDEO,
+            SHARE_AS_VIDEO_ALIAS_SIMPLE_NAME to ShareTarget.VIDEO,
+        )
+
+    /**
+     * Resolves the launching component to its target. Flavors can change the resolved package
+     * prefix, so the match is on the simple name; anything that isn't one of our aliases (chiefly
+     * MainActivity itself) is the default New Post target.
+     */
+    fun targetOf(componentClassName: String?): ShareTarget {
+        if (componentClassName == null) return ShareTarget.NEW_POST
+
+        return TARGET_BY_ALIAS.entries
+            .firstOrNull { componentClassName.endsWith(".${it.key}") }
+            ?.value
+            ?: ShareTarget.NEW_POST
+    }
 }
@@ -55,6 +55,7 @@ enum class NavBarItem {
    PICTURES,
    WORKOUTS,
    GIT_REPOSITORIES,
+    HIGHLIGHTS,
    SOFTWARE_APPS,
    NAPPLETS,
    NSITES,
@@ -111,7 +112,7 @@ val NavBarCatalog: Map<NavBarItem, NavBarItemDef> =
                id = NavBarItem.VIDEO,
                labelRes = R.string.route_video,
                icon = MaterialSymbols.Subscriptions,
-                resolveRoute = { Route.Video },
+                resolveRoute = { Route.Video() },
            ),
        NavBarItem.DISCOVER to
            NavBarItemDef(
@@ -230,7 +231,7 @@ val NavBarCatalog: Map<NavBarItem, NavBarItemDef> =
                id = NavBarItem.PICTURES,
                labelRes = R.string.pictures,
                icon = MaterialSymbols.Photo,
-                resolveRoute = { Route.Pictures },
+                resolveRoute = { Route.Pictures() },
            ),
        NavBarItem.WORKOUTS to
            NavBarItemDef(
@@ -246,6 +247,13 @@ val NavBarCatalog: Map<NavBarItem, NavBarItemDef> =
                icon = MaterialSymbols.Code,
                resolveRoute = { Route.GitRepositories },
            ),
+        NavBarItem.HIGHLIGHTS to
+            NavBarItemDef(
+                id = NavBarItem.HIGHLIGHTS,
+                labelRes = R.string.highlights,
+                icon = MaterialSymbols.FormatQuote,
+                resolveRoute = { Route.Highlights },
+            ),
        NavBarItem.SOFTWARE_APPS to
            NavBarItemDef(
                id = NavBarItem.SOFTWARE_APPS,
@@ -300,7 +308,7 @@ val NavBarCatalog: Map<NavBarItem, NavBarItemDef> =
                id = NavBarItem.SHORTS,
                labelRes = R.string.shorts,
                icon = MaterialSymbols.PlayCircle,
-                resolveRoute = { Route.Shorts },
+                resolveRoute = { Route.Shorts() },
            ),
        NavBarItem.MUSIC_TRACKS to
            NavBarItemDef(
@@ -534,6 +542,7 @@ val BottomBarCategories: List<NavBarCategory> =
                NavBarItem.PRODUCTS,
                NavBarItem.WORKOUTS,
                NavBarItem.GIT_REPOSITORIES,
+                NavBarItem.HIGHLIGHTS,
                NavBarItem.COMMUNITIES,
                NavBarItem.FOLLOW_PACKS,
                NavBarItem.CALENDARS,
@@ -574,6 +583,7 @@ val DrawerFeedsItems: List<NavBarItem> =
        NavBarItem.PRODUCTS,
        NavBarItem.WORKOUTS,
        NavBarItem.GIT_REPOSITORIES,
+        NavBarItem.HIGHLIGHTS,
        NavBarItem.LIVE_STREAMS,
        NavBarItem.NESTS,
        NavBarItem.COMMUNITIES,
@@ -28,9 +28,10 @@ import androidx.compose.runtime.Stable
 import androidx.compose.runtime.getValue
 import androidx.compose.runtime.mutableStateOf
 import androidx.compose.runtime.setValue
+import androidx.lifecycle.viewmodel.compose.LocalViewModelStoreOwner
+import androidx.navigation.NavBackStackEntry
 import androidx.navigation.NavGraph.Companion.findStartDestination
 import androidx.navigation.NavHostController
-import androidx.navigation.compose.currentBackStackEntryAsState
 import com.vitorpamplona.amethyst.ui.navigation.BOTTOM_NAV_ROOT_KEY
 import com.vitorpamplona.amethyst.ui.navigation.isBottomNavRoot
 import com.vitorpamplona.amethyst.ui.navigation.routes.Route
@@ -115,19 +116,35 @@ class Nav(

    @Composable
    override fun canPop(): Boolean {
-        // Observe the current entry as State so consumers recompose when the
-        // back stack settles after a navigation or back-swipe transition.
-        // A non-reactive read would leave a stale value behind: e.g. on
-        // back-swipe to Home, previousBackStackEntry is still the popping
-        // entry until the gesture finishes, and nothing would re-evaluate
-        // canPop afterwards.
-        val current by controller.currentBackStackEntryAsState()
-        val entry = current ?: return false
+        // Decide the back arrow / bottom-bar visibility from THIS screen's own
+        // back-stack entry — the one the NavHost hands to each destination
+        // through LocalViewModelStoreOwner — instead of the globally-current
+        // entry.
+        //
+        // A pop commits the moment it is accepted (most visibly during a
+        // predictive back-swipe, whose exit animation is long and finger-driven):
+        // controller.currentBackStackEntry flips to the destination while the
+        // screen being dismissed is still on screen, sliding out and still
+        // composing its top bar. Reading the global entry there re-evaluated
+        // canPop against the incoming destination and dropped the arrow before
+        // the outgoing screen had finished leaving. An entry is intrinsic to its
+        // screen and never changes for the life of that composition, so the arrow
+        // now stays put until the screen itself is gone.
+        //
+        // Outside a NavHost destination (shell chrome, drawer) the current owner
+        // is the account-scoped ViewModelStoreOwner, not an entry; fall back to
+        // the globally-current entry so those callers keep their prior behavior.
+        val entry =
+            (LocalViewModelStoreOwner.current as? NavBackStackEntry)
+                ?: controller.currentBackStackEntry
+                ?: return false
+
+        // Hidden on tab roots (reached via the bottom nav) and on Home (the
+        // graph's start destination): nothing sits below either that a back
+        // arrow could return to. Every other entry is a push on top of Home,
+        // so it can always pop.
        if (entry.isBottomNavRoot()) return false
-        // Home is the graph's start destination and nothing can sit below
-        // it, so a back arrow there is never meaningful.
-        if (entry.destination.id == controller.graph.findStartDestination().id) return false
-        return controller.previousBackStackEntry != null
+        return entry.destination.id != controller.graph.findStartDestination().id
    }

    override fun popBack() {
@@ -30,12 +30,32 @@ import com.vitorpamplona.quartz.nip17Dm.base.ChatroomKey
 import kotlinx.serialization.Serializable
 import kotlin.reflect.KClass

+/**
+ * A feed whose composer can be pre-loaded from an Android share. [attachments] holds the shared
+ * content URIs and [message] the text sent alongside them; both are empty/null for every other way
+ * of reaching the feed, which is how the share flow tells its own entries apart from an ordinary
+ * bottom-bar visit.
+ */
+sealed interface MediaFeedRoute {
+    val attachments: List<String>
+    val message: String?
+}
+
 sealed class Route {
    @Serializable object Home : Route()

    @Serializable object Message : Route()

-    @Serializable object Video : Route()
+    /**
+     * The mixed media feed. [attachments] and [message] are set by the "New Video" share target: the content
+     * URIs of the shared files and the text Android sent alongside them, which pre-load the media
+     * composer and its caption. Empty for every other way of reaching the feed.
+     */
+    @Serializable data class Video(
+        override val attachments: List<String> = emptyList(),
+        override val message: String? = null,
+    ) : Route(),
+        MediaFeedRoute

    @Serializable data class Discover(
        val initialTab: DiscoverTab? = null,
@@ -81,12 +101,23 @@ sealed class Route {
        )
    }

-    @Serializable object Pictures : Route()
+    /**
+     * The picture feed. [attachments] and [message] are set by the "New Picture" share target: the content
+     * URIs of the shared files and the text Android sent alongside them, which pre-load the media
+     * composer and its caption. Empty for every other way of reaching the feed.
+     */
+    @Serializable data class Pictures(
+        override val attachments: List<String> = emptyList(),
+        override val message: String? = null,
+    ) : Route(),
+        MediaFeedRoute

    @Serializable object Workouts : Route()

    @Serializable object GitRepositories : Route()

+    @Serializable object Highlights : Route()
+
    @Serializable object SoftwareApps : Route()

    @Serializable object Napplets : Route()
@@ -173,7 +204,16 @@ sealed class Route {

    @Serializable object Products : Route()

-    @Serializable object Shorts : Route()
+    /**
+     * The short-video feed. [attachments] and [message] are set by the "New Short" share target: the content
+     * URIs of the shared files and the text Android sent alongside them, which pre-load the media
+     * composer and its caption. Empty for every other way of reaching the feed.
+     */
+    @Serializable data class Shorts(
+        override val attachments: List<String> = emptyList(),
+        override val message: String? = null,
+    ) : Route(),
+        MediaFeedRoute

    @Serializable object PublicChats : Route()

@@ -739,6 +779,9 @@ sealed class Route {

    @Serializable data class RelayGroupCreate(
        val relayUrl: String,
+        // Buzz only: start the create flow on a `forum` channel (threaded posts) instead of a
+        // `stream` (chat) one — set by the community screen's per-section "+" buttons.
+        val isForum: Boolean = false,
    ) : Route()

    @Serializable data class RelayGroupEdit(
@@ -987,6 +1030,26 @@ sealed class Route {
        val draft: String? = null,
    ) : Route()

+    /**
+     * The NIP-84 highlight composer. Opened by the "Add highlight" action (all fields null) or
+     * when a browser shares a text selection to Amethyst — in which case the shared string has
+     * already been run through SharedHighlightParser and the pieces arrive pre-split here.
+     */
+    @Serializable
+    data class NewHighlight(
+        val quote: String? = null,
+        val url: String? = null,
+        val prefix: String? = null,
+        val suffix: String? = null,
+        val comment: String? = null,
+        val context: String? = null,
+        // A nostr source (set when highlighting a nostr article/note rather than a web page):
+        // an addressable coordinate (`a`), a specific event id (`e`) and the author (`p`).
+        val sourceAddress: String? = null,
+        val sourceEventId: String? = null,
+        val author: String? = null,
+    ) : Route()
+
    @Serializable data object NewHlsVideo : Route()

    @Serializable
@@ -327,10 +327,7 @@ import com.vitorpamplona.quartz.nip64Chess.game.ChessGameEvent
 import com.vitorpamplona.quartz.nip65RelayList.AdvertisedRelayListEvent
 import com.vitorpamplona.quartz.nip66RelayMonitor.discovery.RelayDiscoveryEvent
 import com.vitorpamplona.quartz.nip68Picture.PictureEvent
-import com.vitorpamplona.quartz.nip71Video.VideoHorizontalEvent
-import com.vitorpamplona.quartz.nip71Video.VideoNormalEvent
-import com.vitorpamplona.quartz.nip71Video.VideoShortEvent
-import com.vitorpamplona.quartz.nip71Video.VideoVerticalEvent
+import com.vitorpamplona.quartz.nip71Video.VideoEvent
 import com.vitorpamplona.quartz.nip72ModCommunities.approval.CommunityPostApprovalEvent
 import com.vitorpamplona.quartz.nip72ModCommunities.communityAddress
 import com.vitorpamplona.quartz.nip72ModCommunities.definition.CommunityDefinitionEvent
@@ -1514,19 +1511,9 @@ private fun RenderNoteRow(
            FileHeaderDisplay(baseNote, true, ContentScale.FillWidth, accountViewModel)
        }

-        is VideoHorizontalEvent -> {
-            VideoDisplay(baseNote, makeItShort, canPreview, backgroundColor, ContentScale.FillWidth, accountViewModel, nav)
-        }
-
-        is VideoVerticalEvent -> {
-            VideoDisplay(baseNote, makeItShort, canPreview, backgroundColor, ContentScale.FillWidth, accountViewModel, nav)
-        }
-
-        is VideoNormalEvent -> {
-            VideoDisplay(baseNote, makeItShort, canPreview, backgroundColor, ContentScale.FillWidth, accountViewModel, nav)
-        }
-
-        is VideoShortEvent -> {
+        // Covers every NIP-71 video kind (21, 22, 34235, 34236) via the shared interface,
+        // so new video subtypes render automatically instead of falling through to text.
+        is VideoEvent -> {
            VideoDisplay(baseNote, makeItShort, canPreview, backgroundColor, ContentScale.FillWidth, accountViewModel, nav)
        }

@@ -766,6 +766,7 @@ private fun geohashBounds(geohash: String): BoundingBox? {
 /** A rough physical size for a geohash cell at this precision, for the chip subtitle. */
 private fun GeohashChannelLevel.areaSize(): String =
    when (this) {
+        GeohashChannelLevel.CONTINENT -> "~5000 km"
        GeohashChannelLevel.REGION -> "~1250 km"
        GeohashChannelLevel.PROVINCE -> "~39 km"
        GeohashChannelLevel.CITY -> "~5 km"
@@ -171,6 +171,25 @@ fun noteActionSections(
                    }
                },
            )
+            // Highlight this note/article as its source: opens the NIP-84 composer with the
+            // nostr source pre-tagged (`a` for an addressable article, else `e`) plus the author,
+            // and the passage left for the user to type or paste. Prose kinds only, and never a
+            // private rumor (a public highlight would e-tag the unsigned rumor onto relays).
+            if (!isPrivateRumor && (note.event is TextNoteEvent || note.event is LongTextNoteEvent)) {
+                add(
+                    NoteAction(MaterialSymbols.FormatQuote, stringRes(R.string.highlight_action)) {
+                        val author = note.author?.pubkeyHex
+                        val route =
+                            if (note is AddressableNote) {
+                                Route.NewHighlight(sourceAddress = note.address.toValue(), author = author)
+                            } else {
+                                Route.NewHighlight(sourceEventId = note.idHex, author = author)
+                            }
+                        nav.nav(route)
+                        handlers.onDismiss()
+                    },
+                )
+            }
            if (!isPrivateRumor) {
                add(NoteAction(MaterialSymbols.Share, stringRes(R.string.quick_action_share), onClick = handlers.onShare))
            }
@@ -28,6 +28,7 @@ import androidx.compose.material3.LocalTextStyle
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.Text
 import androidx.compose.runtime.Composable
+import androidx.compose.runtime.staticCompositionLocalOf
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.text.LinkAnnotation
@@ -41,6 +42,9 @@ import com.vitorpamplona.amethyst.R
 import com.vitorpamplona.amethyst.commons.icons.symbols.Icon
 import com.vitorpamplona.amethyst.commons.icons.symbols.MaterialSymbol
 import com.vitorpamplona.amethyst.commons.icons.symbols.MaterialSymbols
+import com.vitorpamplona.amethyst.commons.ui.components.UrlPreviewState
+import com.vitorpamplona.amethyst.ui.components.UrlPreviewCard
+import com.vitorpamplona.amethyst.ui.components.rememberUrlPreviewState
 import com.vitorpamplona.amethyst.ui.navigation.navs.INav
 import com.vitorpamplona.amethyst.ui.navigation.routes.Route
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.AccountViewModel
@@ -52,6 +56,14 @@ import com.vitorpamplona.quartz.nip73ExternalIds.location.GeohashId
 import com.vitorpamplona.quartz.nip73ExternalIds.topics.HashtagId
 import com.vitorpamplona.quartz.nip73ExternalIds.urls.UrlId

+/**
+ * The normalized scope (e.g. [ExternalId.toScope]) of the external content a screen is
+ * currently dedicated to, if any. A screen built entirely around one external scope (e.g.
+ * the URL thread screen) provides this so nested comments sharing that same scope don't
+ * redundantly repeat the preview the screen itself already shows.
+ */
+val LocalCurrentExternalScope = staticCompositionLocalOf<String?> { null }
+
@Composable
 fun DisplayExternalId(
    externalId: ExternalId,
@@ -68,7 +80,7 @@ fun DisplayExternalId(
        }

        is UrlId -> {
-            DisplayUrlExternalId(externalId, nav)
+            DisplayUrlExternalId(externalId, accountViewModel, nav)
        }

        else -> {
@@ -80,14 +92,36 @@ fun DisplayExternalId(
@Composable
 fun DisplayUrlExternalId(
    externalId: UrlId,
+    accountViewModel: AccountViewModel,
    nav: INav,
 ) {
-    DisplayExternalIdChip(
-        symbol = MaterialSymbols.Link,
-        contentDescription = stringRes(id = R.string.external_url_scope),
-        label = externalId.url,
-        linkInteractionListener = { nav.nav(Route.Url(externalId.url)) },
-    )
+    val url = externalId.url
+    val chip =
+        @Composable {
+            DisplayExternalIdChip(
+                symbol = MaterialSymbols.Link,
+                contentDescription = stringRes(id = R.string.external_url_scope),
+                label = url,
+                linkInteractionListener = { nav.nav(Route.Url(url)) },
+            )
+        }
+
+    // Respect the data-saver/privacy gate: fetching the preview reaches out to the
+    // third-party page, so when previews are off this stays a plain link chip.
+    if (!accountViewModel.settings.showUrlPreview()) {
+        chip()
+        return
+    }
+
+    when (val state = rememberUrlPreviewState(url, accountViewModel)) {
+        is UrlPreviewState.Loaded -> {
+            UrlPreviewCard(url, state.previewInfo, onCardClick = { nav.nav(Route.Url(url)) })
+        }
+
+        else -> {
+            chip()
+        }
+    }
 }

@Composable
@@ -40,10 +40,13 @@ import androidx.compose.runtime.remember
 import androidx.compose.runtime.setValue
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.graphics.Color
+import androidx.compose.ui.platform.LocalContext
 import androidx.compose.ui.tooling.preview.Preview
 import androidx.compose.ui.unit.dp
 import com.vitorpamplona.amethyst.commons.model.EmptyTagList
+import com.vitorpamplona.amethyst.commons.model.ImmutableListOfLists
 import com.vitorpamplona.amethyst.commons.model.highlights.HighlightQuote
+import com.vitorpamplona.amethyst.commons.model.toImmutableListOfLists
 import com.vitorpamplona.amethyst.commons.ui.components.ClickableTextPrimary
 import com.vitorpamplona.amethyst.commons.ui.note.HighlightQuoteIndent
 import com.vitorpamplona.amethyst.commons.ui.note.HighlightQuoteSpacing
@@ -54,7 +57,6 @@ import com.vitorpamplona.amethyst.service.relayClient.reqCommand.event.observeNo
 import com.vitorpamplona.amethyst.service.relayClient.reqCommand.user.observeUserInfo
 import com.vitorpamplona.amethyst.ui.components.ClickableUrl
 import com.vitorpamplona.amethyst.ui.components.CreateClickableTextWithEmoji
-import com.vitorpamplona.amethyst.ui.components.DisplayEvent
 import com.vitorpamplona.amethyst.ui.components.RenderUserAsClickableText
 import com.vitorpamplona.amethyst.ui.components.TranslatableRichTextViewer
 import com.vitorpamplona.amethyst.ui.components.measureSpaceWidth
@@ -64,6 +66,7 @@ import com.vitorpamplona.amethyst.ui.navigation.navs.INav
 import com.vitorpamplona.amethyst.ui.navigation.routes.routeFor
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.AccountViewModel
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.mockAccountViewModel
+import com.vitorpamplona.amethyst.ui.screen.loggedIn.relays.kindNameFor
 import com.vitorpamplona.amethyst.ui.theme.ThemeComparisonColumn
 import com.vitorpamplona.quartz.nip01Core.core.Address
 import com.vitorpamplona.quartz.nip01Core.core.firstTagValueFor
@@ -91,6 +94,7 @@ fun RenderHighlight(

    DisplayHighlight(
        comment = noteEvent.comment(),
+        commentTags = remember(noteEvent) { noteEvent.tags.toImmutableListOfLists() },
        highlight = noteEvent.quote(),
        context = noteEvent.contextOrReconstructed(),
        authorHex = noteEvent.author(),
@@ -160,6 +164,7 @@ fun DisplayHighlightPreviewNewLine() {
@Composable
 fun DisplayHighlight(
    comment: String?,
+    commentTags: ImmutableListOfLists<String> = EmptyTagList,
    highlight: String,
    context: String?,
    authorHex: String?,
@@ -181,7 +186,7 @@ fun DisplayHighlight(
            canPreview = canPreview && !makeItShort,
            quotesLeft = quotesLeft,
            modifier = Modifier.fillMaxWidth(),
-            tags = EmptyTagList,
+            tags = commentTags,
            backgroundColor = backgroundColor,
            id = it,
            callbackUri = null,
@@ -406,7 +411,11 @@ fun DisplayEntryForNote(

    val noteEvent = noteState.note.event as? BaseThreadedEvent ?: return

-    val description = remember(noteEvent) { noteEvent.tags.firstTagValueFor("title", "subject", "alt") }
+    // A real title/subject from an article or wiki page describes the source well. `alt`
+    // (NIP-31) is deliberately excluded: it's accessibility fallback text, not a caption, and
+    // clients such as Jumble fill it with a generic "This event was published by …" line that
+    // has nothing to do with the highlighted passage.
+    val description = remember(noteEvent) { noteEvent.tags.firstTagValueFor("title", "subject") }

    Text("-", maxLines = 1)

@@ -416,7 +425,13 @@ fun DisplayEntryForNote(
            onClick = { routeFor(note, accountViewModel.account)?.let { nav.nav(it) } },
        )
    } else {
-        DisplayEvent(noteEvent.id, note.toNostrUri(), null, accountViewModel, nav)
+        // No title to show — name the source by its event kind (e.g. "Note", "Blogs") rather
+        // than a raw @note1… id, and keep it clickable through to the source event.
+        val kindName = kindNameFor(LocalContext.current, noteEvent.kind)
+        ClickableTextPrimary(
+            text = kindName,
+            onClick = { routeFor(note, accountViewModel.account)?.let { nav.nav(it) } },
+        )
    }
 }

@@ -49,13 +49,16 @@ import com.vitorpamplona.amethyst.model.Note
 import com.vitorpamplona.amethyst.service.relayClient.reqCommand.user.observeUserName
 import com.vitorpamplona.amethyst.ui.components.RobohashFallbackAsyncImage
 import com.vitorpamplona.amethyst.ui.navigation.navs.INav
+import com.vitorpamplona.amethyst.ui.navigation.routes.Route
 import com.vitorpamplona.amethyst.ui.navigation.routes.routeFor
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.AccountViewModel
+import com.vitorpamplona.amethyst.ui.screen.loggedIn.chats.publicChannels.relayGroup.RelayNameChip
 import com.vitorpamplona.amethyst.ui.theme.StdVertSpacer
 import com.vitorpamplona.amethyst.ui.theme.replyModifier
 import com.vitorpamplona.quartz.buzz.workspace.buzzParticipants
 import com.vitorpamplona.quartz.buzz.workspace.isBuzzDm
 import com.vitorpamplona.quartz.nip01Core.core.HexKey
+import com.vitorpamplona.quartz.nip01Core.relay.normalizer.displayUrl
 import com.vitorpamplona.quartz.nipC7Chats.ChatEvent

 /**
@@ -100,7 +103,14 @@ fun RenderRelayGroupMessage(
    }
 }

-/** A compact, tappable header naming the Buzz group (or DM participant) a message belongs to. */
+/**
+ * A compact, tappable header naming the Buzz group (or DM participant) a message belongs to, plus a
+ * [RelayNameChip] naming its host relay — the same pairing the Messages row uses, and the NIP-29
+ * analog of the [com.vitorpamplona.amethyst.ui.screen.loggedIn.chats.publicChannels.concord.ConcordCommunityPill]
+ * a Concord message wears on these same cards. A group id is only unique within its host relay, so
+ * without the relay a notification from `#general` doesn't say *which* `#general` it came from. The
+ * chip taps through to the relay's channel list, while the name/avatar open the room itself.
+ */
@Composable
 fun RelayGroupChannelHeader(
    channel: RelayGroupChannel,
@@ -129,16 +139,21 @@ fun RelayGroupChannelHeader(
        )

        if (dmOther != null) {
-            RelayGroupDmName(dmOther, channel, accountViewModel, Modifier.weight(1f))
+            RelayGroupDmName(dmOther, channel, accountViewModel, Modifier.weight(1f, fill = false))
        } else {
            Text(
                text = channel.toBestDisplayName(),
                fontWeight = FontWeight.Bold,
                maxLines = 1,
                overflow = TextOverflow.Ellipsis,
-                modifier = Modifier.weight(1f),
+                modifier = Modifier.weight(1f, fill = false),
            )
        }
+
+        RelayNameChip(
+            label = channel.groupId.relayUrl.displayUrl(),
+            onClick = { nav.nav(Route.RelayGroupServer(channel.groupId.relayUrl.url)) },
+        )
    }
 }

@@ -47,6 +47,7 @@ import com.vitorpamplona.amethyst.ui.note.LoadDecryptedContent
 import com.vitorpamplona.amethyst.ui.note.ReplyNoteComposition
 import com.vitorpamplona.amethyst.ui.note.elements.DisplayUncitedHashtags
 import com.vitorpamplona.amethyst.ui.note.nip22Comments.DisplayExternalId
+import com.vitorpamplona.amethyst.ui.note.nip22Comments.LocalCurrentExternalScope
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.AccountViewModel
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.threadview.datasources.PreloadThreadForReply
 import com.vitorpamplona.amethyst.ui.theme.HalfVertSpacer
@@ -142,9 +143,11 @@ fun RenderTextEvent(
            }
        } else if (!makeItShort && noteEvent is CommentEvent) {
            // A comment scoped to an external identifier (`I` tag) has no in-cache parent
-            // note. Show the scope itself as the reply context.
+            // note. Show the scope itself as the reply context -- unless the screen we're
+            // in is already dedicated to this exact scope (e.g. the URL thread screen),
+            // in which case every row would otherwise redundantly repeat the same preview.
            val scope = remember(note) { noteEvent.scope() }
-            if (scope != null) {
+            if (scope != null && scope.toScope() != LocalCurrentExternalScope.current) {
                DisplayExternalId(scope, accountViewModel, nav)
                Spacer(modifier = StdVertSpacer)
            }
@@ -63,8 +63,8 @@ import com.vitorpamplona.amethyst.service.playback.composable.controls.PictureIn
 import com.vitorpamplona.amethyst.service.playback.composable.mediaitem.GetMediaItem
 import com.vitorpamplona.amethyst.service.playback.composable.mediaitem.LoadedMediaItem
 import com.vitorpamplona.amethyst.service.playback.composable.mediaitem.MediaItemData
+import com.vitorpamplona.amethyst.service.playback.composable.mediaitem.isHlsMedia
 import com.vitorpamplona.amethyst.service.playback.composable.wavefront.Waveform
-import com.vitorpamplona.amethyst.service.playback.diskCache.isLiveStreaming
 import com.vitorpamplona.amethyst.service.playback.pip.PipVideoActivity
 import com.vitorpamplona.amethyst.ui.components.ShareMediaAction
 import com.vitorpamplona.amethyst.ui.components.getActivity
@@ -349,7 +349,7 @@ fun RenderTopButtonsForVoice(
    accountViewModel: AccountViewModel,
 ) {
    Row(modifier) {
-        if (!isLiveStreaming(mediaData.videoUri)) {
+        if (!isHlsMedia(mediaData.videoUri, mediaData.mimeType)) {
            AnimatedShareButton(controllerVisible) { popupExpanded, toggle ->
                ShareMediaAction(
                    popupExpanded = popupExpanded,
@@ -337,6 +337,24 @@ class TopNavFilterState(
            )
        }

+    private val _highlightsRoutes =
+        combineTransform(
+            livePeopleListsFlow,
+            liveInterestFlows,
+        ) { peopleLists, interests ->
+            checkNotInMainThread()
+            emit(
+                listOf(
+                    // Highlights can be narrowed by author, hashtag and geohash, so this mirrors
+                    // the kind3 catalog plus "Mine" — the user's own highlights.
+                    listOf(allFollows, userFollows, kind3Follows, aroundMe, teleport, globalFollow, mineFollow),
+                    peopleLists,
+                    interests,
+                    listOf(muteListFollow),
+                ).flatten().toImmutableList(),
+            )
+        }
+
    private val _relayGroupsDiscoveryRoutes =
        combineTransform(
            livePeopleListsFlow,
@@ -470,6 +488,11 @@ class TopNavFilterState(
            .flowOn(Dispatchers.IO)
            .stateIn(scope, SharingStarted.Eagerly, persistentListOf(allFollows, userFollows, kind3Follows, aroundMe, teleport, globalFollow, mineFollow, muteListFollow))

+    val highlightsRoutes =
+        _highlightsRoutes
+            .flowOn(Dispatchers.IO)
+            .stateIn(scope, SharingStarted.Eagerly, persistentListOf(allFollows, userFollows, kind3Follows, aroundMe, teleport, globalFollow, mineFollow, muteListFollow))
+
    val relayGroupsDiscoveryRoutes =
        _relayGroupsDiscoveryRoutes
            .flowOn(Dispatchers.IO)
@@ -49,6 +49,7 @@ import com.vitorpamplona.amethyst.ui.screen.loggedIn.drafts.dal.DraftEventsFeedF
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.emojipacks.browse.dal.BrowseEmojiSetsFeedFilter
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.followPacks.list.dal.FollowPacksFeedFilter
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.gitRepositories.dal.GitRepositoriesFeedFilter
+import com.vitorpamplona.amethyst.ui.screen.loggedIn.highlights.dal.HighlightsFeedFilter
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.home.dal.HomeConversationsFeedFilter
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.home.dal.HomeEverythingFeedFilter
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.home.dal.HomeLiveFilter
@@ -117,6 +118,7 @@ class AccountFeedContentStates(
    val picturesFeed = FeedContentState(PictureFeedFilter(account), scope, LocalCache)
    val workoutsFeed = FeedContentState(WorkoutFeedFilter(account), scope, LocalCache)
    val gitRepositoriesFeed = FeedContentState(GitRepositoriesFeedFilter(account), scope, LocalCache)
+    val highlightsFeed = FeedContentState(HighlightsFeedFilter(account), scope, LocalCache)
    val relayGroupsDiscoveryFeed = FeedContentState(RelayGroupDiscoveryFeedFilter(account), scope, LocalCache)
    val calendarAppointmentsFeed = FeedContentState(CalendarAppointmentsFeedFilter(account), scope, LocalCache)
    val calendarCollectionsFeed = FeedContentState(CalendarCollectionsFeedFilter(account), scope, LocalCache)
@@ -248,6 +250,19 @@ class AccountFeedContentStates(
                }
        }

+        // Toggling a Home content type on/off in Settings › Home changes which event kinds the tabs
+        // render, but no event flows through LocalCache — force a rebuild of all three home feeds so
+        // hidden kinds disappear (and re-enabled ones reappear from cache) immediately.
+        scope.launch(Dispatchers.IO) {
+            account.settings.enabledHomeFeedTypes
+                .drop(1)
+                .collect {
+                    homeNewThreads.invalidateData()
+                    homeReplies.invalidateData()
+                    homeEverything.invalidateData()
+                }
+        }
+
        // Pinning/unpinning a room only changes sort order, not membership, so no
        // chat event flows through LocalCache. Force a rebuild to re-sort. This
        // also fires when pins arrive via the synced AppSpecificData event.
@@ -314,6 +329,7 @@ class AccountFeedContentStates(
        picturesFeed.updateFeedWith(newNotes)
        workoutsFeed.updateFeedWith(newNotes)
        gitRepositoriesFeed.updateFeedWith(newNotes)
+        highlightsFeed.updateFeedWith(newNotes)
        relayGroupsDiscoveryFeed.updateFeedWith(newNotes)
        productsFeed.updateFeedWith(newNotes)
        shortsFeed.updateFeedWith(newNotes)
@@ -377,6 +393,7 @@ class AccountFeedContentStates(
        picturesFeed.deleteFromFeed(newNotes)
        workoutsFeed.deleteFromFeed(newNotes)
        gitRepositoriesFeed.deleteFromFeed(newNotes)
+        highlightsFeed.deleteFromFeed(newNotes)
        relayGroupsDiscoveryFeed.deleteFromFeed(newNotes)
        productsFeed.deleteFromFeed(newNotes)
        shortsFeed.deleteFromFeed(newNotes)
@@ -436,6 +453,7 @@ class AccountFeedContentStates(
        picturesFeed.trimToSize(maxItems)
        workoutsFeed.trimToSize(maxItems)
        gitRepositoriesFeed.trimToSize(maxItems)
+        highlightsFeed.trimToSize(maxItems)
        relayGroupsDiscoveryFeed.trimToSize(maxItems)
        calendarAppointmentsFeed.trimToSize(maxItems)
        calendarCollectionsFeed.trimToSize(maxItems)
@@ -1672,18 +1672,67 @@ class AccountViewModel(

    fun leaveRelayGroup(channel: RelayGroupChannel) = launchSigner { account.leaveRelayGroup(channel) }

+    /** Delete the channel/group for everyone (kind-9008). Owner/admin only; the relay enforces it. */
+    fun deleteRelayGroup(channel: RelayGroupChannel) = launchSigner { account.deleteRelayGroup(channel) }
+
    /**
-     * Accept a channel somebody added me to: write it into my kind-10009 so it shows on Messages and
-     * follows me to other devices. No kind-9021 join — the relay already put me in the roster, which is
-     * why the channel opens and accepts posts today; this only records *my* decision to surface it.
+     * Archive/unarchive a Buzz channel (kind-9002 `archived` tag) — hides it from the sidebar without
+     * destroying it, and is reversible. Owner/admin only; the relay enforces it.
     */
-    fun acceptChannelInvite(channel: RelayGroupChannel) =
+    fun archiveRelayGroup(
+        channel: RelayGroupChannel,
+        archived: Boolean,
+    ) = launchSigner { account.archiveRelayGroup(channel, archived) }
+
+    /**
+     * Take a relay group off Messages WITHOUT leaving it: drop it from my kind-10009 list so it stops
+     * showing, but send no kind-9022 — I stay in the relay roster and can still read/post, and re-joining
+     * re-surfaces it instantly. Also records it in `dismissedChannelInvites` so a Buzz relay re-announcing
+     * my membership (kind-44100) can't bounce it back in as a pending invite. This is the soft counterpart
+     * to [leaveRelayGroup]; "Remove from Messages" vs "Leave" is the same split the invite card offers.
+     */
+    fun removeRelayGroupFromMessages(channel: RelayGroupChannel) =
+        launchSigner {
+            account.settings.dismissChannelInvite(channel.groupId.id)
+            account.unfollow(channel)
+        }
+
+    /**
+     * Put a relay group (back) on Messages: write it into my kind-10009 so it shows and follows me to
+     * other devices, and clear the dismissal [removeRelayGroupFromMessages] left behind so a Buzz relay
+     * re-announcing my membership isn't filtered out. No kind-9021 join — the relay roster is untouched
+     * by both halves of this toggle; this only records *my* decision to surface the channel.
+     */
+    fun addRelayGroupToMessages(channel: RelayGroupChannel) =
        launchSigner {
            account.settings.undismissChannelInvite(channel.groupId.id)
            account.follow(channel)
            BuzzChannelInvites.remove(account.userProfile().pubkeyHex, channel.groupId.id)
        }

+    /**
+     * Accept a channel somebody added me to. Identical to [addRelayGroupToMessages] — accepting an
+     * invite *is* surfacing the channel, since the relay already put me in the roster (which is why
+     * the channel opens and accepts posts today).
+     */
+    fun acceptChannelInvite(channel: RelayGroupChannel) = addRelayGroupToMessages(channel)
+
+    /**
+     * Hide a Buzz DM from Messages (kind-41012). DM-specific — a DM has no kind-10009 entry; the relay
+     * republishes my per-viewer 30622 hidden snapshot, dropping it from the inbox until I re-open it.
+     */
+    fun hideBuzzDm(channel: RelayGroupChannel) = launchSigner { account.hideBuzzDm(channel) }
+
+    /**
+     * Bring a hidden Buzz DM back to Messages: Buzz has no "unhide", so re-open the conversation with
+     * the same [participants] (a kind-41010 resolving to the same canonical channel), which drops it
+     * from the 30622 hidden snapshot.
+     */
+    fun unhideBuzzDm(
+        relay: NormalizedRelayUrl,
+        participants: List<HexKey>,
+    ) = launchSigner { account.openBuzzDm(relay, participants) }
+
    /**
     * Keep the channel off Messages without touching membership. Local and reversible — I stay in the
     * roster and can still open and post; [leaveChannelInvite] is the one that actually removes me.
@@ -36,6 +36,7 @@ import com.vitorpamplona.amethyst.ui.screen.loggedIn.discover.datasource.Discove
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.emojipacks.browse.datasource.BrowseEmojiSetsFilterAssemblerSubscription
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.followPacks.list.datasource.FollowPacksFilterAssemblerSubscription
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.gitRepositories.datasource.GitRepositoriesFilterAssemblerSubscription
+import com.vitorpamplona.amethyst.ui.screen.loggedIn.highlights.datasource.HighlightsFilterAssemblerSubscription
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.home.datasource.HomeFilterAssemblerSubscription
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.livestreams.datasource.LiveStreamsFilterAssemblerSubscription
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.longs.datasource.LongsFilterAssemblerSubscription
@@ -100,6 +101,8 @@ private fun PreloadFor(

        NavBarItem.GIT_REPOSITORIES -> GitRepositoriesFilterAssemblerSubscription(accountViewModel)

+        NavBarItem.HIGHLIGHTS -> HighlightsFilterAssemblerSubscription(accountViewModel)
+
        NavBarItem.SOFTWARE_APPS -> SoftwareAppsFilterAssemblerSubscription(accountViewModel)

        // Napplets & nSites read directly from the local cache; their screens open the discovery
@@ -608,7 +608,12 @@ class GroupEventHandler(
            return
        }
        if (!manager.isMember(groupId)) {
-            Log.w("MarmotDbg") {
+            // Debug, not warn: relays serve kind:445 for every group they carry, so traffic for
+            // groups we are not in is the expected steady state, not an anomaly — unlike the null
+            // manager and missing 'h' tag above, which stay warnings because they mean we cannot
+            // process a group we *should* be handling. Fires ~22 times a boot (the same handful of
+            // events, re-offered on each pass), which drowns the two real warnings next to it.
+            Log.d("MarmotDbg") {
                "GroupEventHandler.add: not a member of group=${groupId.take(8)}… — dropping kind:445 ${event.id.take(8)}…"
            }
            return
@@ -56,7 +56,9 @@ import androidx.compose.runtime.rememberCoroutineScope
 import androidx.compose.runtime.setValue
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
+import androidx.compose.ui.draw.alpha
 import androidx.compose.ui.draw.clip
+import androidx.compose.ui.res.pluralStringResource
 import androidx.compose.ui.text.font.FontWeight
 import androidx.compose.ui.text.style.TextOverflow
 import androidx.compose.ui.unit.dp
@@ -82,6 +84,12 @@ import com.vitorpamplona.quartz.nip19Bech32.decodePublicKeyAsHexOrNull
 import com.vitorpamplona.quartz.nip29RelayGroups.GroupId
 import kotlinx.coroutines.launch

+/**
+ * Bottom room the inbox leaves for its extended FAB — same clearance the community view uses, and
+ * wide enough for the taller extended variant.
+ */
+private val FAB_CLEARANCE = 96.dp
+
 /**
 * The **Buzz Direct Messages** inbox. A Buzz DM is a relay-authoritative NIP-29 group
 * whose id is a UUID, so tapping a row opens the very same [Route.RelayGroup] chat screen
@@ -99,6 +107,11 @@ fun BuzzDmListScreen(
    viewModel.bind(accountViewModel.account, relayUrl)

    val rows by viewModel.rows.collectAsStateWithLifecycle()
+    val hiddenRows by viewModel.hiddenRows.collectAsStateWithLifecycle()
+
+    // Hidden conversations stay collapsed behind a header — they are off Messages by the user's own
+    // choice, so they must not compete with the live inbox; they only need to be *reachable* again.
+    var showHidden by remember { mutableStateOf(false) }

    Scaffold(
        topBar = { TopBarWithBackButton(stringRes(R.string.buzz_dm_title), nav) },
@@ -110,26 +123,79 @@ fun BuzzDmListScreen(
            )
        },
    ) { padding ->
-        if (rows.isEmpty()) {
+        if (rows.isEmpty() && hiddenRows.isEmpty()) {
            EmptyDmInbox(modifier = Modifier.padding(padding))
        } else {
            LazyColumn(
                modifier = Modifier.padding(padding).fillMaxSize(),
-                contentPadding = PaddingValues(16.dp),
+                // Extra room at the bottom so the last row's overflow clears the FAB, which the
+                // Scaffold's padding deliberately doesn't account for (a FAB overlays content).
+                contentPadding = PaddingValues(start = 16.dp, end = 16.dp, top = 16.dp, bottom = FAB_CLEARANCE),
                verticalArrangement = Arrangement.spacedBy(10.dp),
            ) {
                items(rows, key = { it.channelId }) { row ->
-                    DmRowCard(row, accountViewModel, nav)
+                    DmRowCard(row, isHidden = false, viewModel = viewModel, accountViewModel = accountViewModel, nav = nav)
+                }
+                if (hiddenRows.isNotEmpty()) {
+                    item(key = "hidden-header") {
+                        HiddenDmHeader(
+                            count = hiddenRows.size,
+                            expanded = showHidden,
+                            onToggle = { showHidden = !showHidden },
+                        )
+                    }
+                    if (showHidden) {
+                        items(hiddenRows, key = { "hidden-${it.channelId}" }) { row ->
+                            DmRowCard(row, isHidden = true, viewModel = viewModel, accountViewModel = accountViewModel, nav = nav)
+                        }
+                    }
                }
            }
        }
    }
 }

+/**
+ * The collapsible "Hidden (N)" divider between the live inbox and the conversations I took off it.
+ * Shared with the community view's inline Direct Messages section, so a hidden DM is reachable from
+ * wherever the user's DMs are — this inbox screen is only reachable behind a "see all" row.
+ */
+@Composable
+fun HiddenDmHeader(
+    count: Int,
+    expanded: Boolean,
+    onToggle: () -> Unit,
+    modifier: Modifier = Modifier,
+) {
+    Row(
+        modifier =
+            modifier
+                .fillMaxWidth()
+                .clickable(onClick = onToggle)
+                .padding(vertical = 8.dp),
+        verticalAlignment = Alignment.CenterVertically,
+        horizontalArrangement = Arrangement.spacedBy(6.dp),
+    ) {
+        Icon(
+            symbol = if (expanded) MaterialSymbols.ExpandMore else MaterialSymbols.ChevronRight,
+            contentDescription = null,
+            tint = MaterialTheme.colorScheme.onSurfaceVariant,
+            modifier = Modifier.size(18.dp),
+        )
+        Text(
+            text = pluralStringResource(R.plurals.buzz_dm_hidden_count, count, count),
+            style = MaterialTheme.typography.labelLarge,
+            color = MaterialTheme.colorScheme.onSurfaceVariant,
+        )
+    }
+}
+
 /** One conversation: a participant avatar (stacked for group DMs), names, host, last-seen, kebab. */
@Composable
 private fun DmRowCard(
    row: BuzzDmListViewModel.DmRow,
+    isHidden: Boolean,
+    viewModel: BuzzDmListViewModel,
    accountViewModel: AccountViewModel,
    nav: INav,
 ) {
@@ -156,7 +222,9 @@ private fun DmRowCard(
        modifier = Modifier.fillMaxWidth(),
    ) {
        Row(
-            modifier = Modifier.padding(12.dp),
+            // A hidden DM is still openable (it's a live conversation I merely took off the list), so
+            // it renders faded rather than disabled — visibly parked, not broken.
+            modifier = Modifier.padding(12.dp).alpha(if (isHidden) 0.55f else 1f),
            verticalAlignment = Alignment.CenterVertically,
        ) {
            DmAvatars(row.others, accountViewModel, nav)
@@ -204,21 +272,21 @@ private fun DmRowCard(
                            addMemberOpen = true
                        },
                    )
+                    // A toggle, like the channel rows: hiding a DM is a per-viewer, reversible
+                    // relay-side flag (kind-41012 / the 30622 snapshot), never a departure — so a
+                    // hidden conversation must offer its own way back rather than vanishing for good.
                    DropdownMenuItem(
-                        text = { Text(stringRes(R.string.buzz_dm_hide)) },
+                        text = { Text(stringRes(if (isHidden) R.string.add_to_messages else R.string.remove_from_messages)) },
                        leadingIcon = {
                            Icon(
-                                symbol = MaterialSymbols.VisibilityOff,
+                                symbol = if (isHidden) MaterialSymbols.Add else MaterialSymbols.VisibilityOff,
                                contentDescription = null,
                                modifier = Modifier.size(20.dp),
                            )
                        },
                        onClick = {
                            menuOpen = false
-                            scope.launch {
-                                val channel = LocalCache.getOrCreateRelayGroupChannel(groupId)
-                                accountViewModel.account.hideBuzzDm(channel)
-                            }
+                            if (isHidden) viewModel.addToMessages(row) else viewModel.removeFromMessages(row)
                        },
                    )
                }
@@ -71,8 +71,11 @@ import java.util.concurrent.ConcurrentHashMap
 *   `t` = `dm` — that same 39000 also carries the roster the shared chat composer's member gate
 *   needs, and the DM participants;
 * - subscribes the per-viewer [DmVisibilityEvent] (`kind:30622`) so a hidden DM (tracked in
- *   [BuzzDmRegistry]) drops out;
- * - projects the visible DMs into [rows], sorted by last message time.
+ *   [BuzzDmRegistry]) moves from [rows] to [hiddenRows];
+ * - projects the visible DMs into [rows] and the hidden ones into [hiddenRows], both sorted by
+ *   last message time. Hidden DMs stay projected (rather than being dropped on the floor) so the
+ *   inbox can offer them back — hiding is reversible, and a conversation with no way back is a
+ *   conversation the user has lost.
 */
 class BuzzDmListViewModel : ViewModel() {
    @Volatile private var account: Account? = null
@@ -88,6 +91,10 @@ class BuzzDmListViewModel : ViewModel() {
    private val _rows = MutableStateFlow<List<DmRow>>(emptyList())
    val rows: StateFlow<List<DmRow>> = _rows.asStateFlow()

+    /** The DMs I hid (per the relay's 30622 snapshot), newest-first — offered back under "Hidden". */
+    private val _hiddenRows = MutableStateFlow<List<DmRow>>(emptyList())
+    val hiddenRows: StateFlow<List<DmRow>> = _hiddenRows.asStateFlow()
+
    private val _isLoading = MutableStateFlow(false)
    val isLoading: StateFlow<Boolean> = _isLoading.asStateFlow()

@@ -211,14 +218,17 @@ class BuzzDmListViewModel : ViewModel() {
        account.client.fetchAllWithHooks(filters = byRelay, timeoutMs = 8_000, pendingOnAuthRequired = true) { _, _ -> false }
    }

-    /** Project the discovered DM channels (metadata `t` = `dm`), minus my hidden set, newest-first. */
+    /**
+     * Project the discovered DM channels (metadata `t` = `dm`) newest-first, split by my hidden set
+     * (the relay's 30622 snapshot) into [rows] and [hiddenRows]. Both halves come from one pass so a
+     * DM can only ever be in one of them.
+     */
    private fun rebuildRows(account: Account) {
        val myPubkey = account.userProfile().pubkeyHex
        val hidden = BuzzDmRegistry.hiddenFor(myPubkey)
-        _rows.value =
+        val (hiddenDms, visibleDms) =
            memberChannels.entries
                .mapNotNull { (channelId, relay) ->
-                    if (channelId in hidden) return@mapNotNull null
                    val channel = LocalCache.getOrCreateRelayGroupChannel(GroupId(channelId, relay))
                    val metadata = channel.event ?: return@mapNotNull null
                    if (!metadata.isBuzzDm()) return@mapNotNull null
@@ -231,6 +241,38 @@ class BuzzDmListViewModel : ViewModel() {
                        lastActivity = lastActivityFor(channelId),
                    )
                }.sortedByDescending { it.lastActivity }
+                .partition { it.channelId in hidden }
+        _rows.value = visibleDms
+        _hiddenRows.value = hiddenDms
+    }
+
+    /**
+     * Take [row] off Messages with a kind-41012 hide command. Server-side and per-viewer: the relay
+     * republishes my 30622 snapshot with this channel in it, which moves the row to [hiddenRows].
+     * Membership is untouched — nobody else's inbox changes, and [addToMessages] brings it back.
+     */
+    fun removeFromMessages(row: DmRow) {
+        val account = account ?: return
+        viewModelScope.launch(Dispatchers.IO) {
+            account.hideBuzzDm(LocalCache.getOrCreateRelayGroupChannel(GroupId(row.channelId, row.relayUrl)))
+        }
+    }
+
+    /**
+     * Put a hidden DM back on Messages. Buzz has no "unhide" command — re-opening the conversation is
+     * the un-hide: a kind-41010 with the same participants resolves to the same canonical channel and
+     * drops it from the 30622 hidden snapshot. A self-DM has no `others`, so send myself, which is
+     * what the relay derived that channel from (and satisfies kind-41010's 1-8 participant rule).
+     */
+    fun addToMessages(row: DmRow) {
+        val account = account ?: return
+        viewModelScope.launch(Dispatchers.IO) {
+            val me = account.userProfile().pubkeyHex
+            account.openBuzzDm(row.relayUrl, row.others.ifEmpty { listOf(me) })
+            // The relay's new 30622 normally arrives on the live subscription; refresh anyway so the
+            // row returns even if this screen's socket missed the snapshot.
+            refresh()
+        }
    }

    /** Newest message `created_at` for [channelId] from [LocalCache], or 0 when the DM is empty. */
@@ -21,6 +21,7 @@
 package com.vitorpamplona.amethyst.ui.screen.loggedIn.buzz

 import androidx.compose.foundation.background
+import androidx.compose.foundation.clickable
 import androidx.compose.foundation.layout.Arrangement
 import androidx.compose.foundation.layout.Box
 import androidx.compose.foundation.layout.Column
@@ -31,17 +32,11 @@ import androidx.compose.foundation.layout.padding
 import androidx.compose.foundation.layout.size
 import androidx.compose.foundation.layout.width
 import androidx.compose.foundation.shape.CircleShape
-import androidx.compose.material3.Card
-import androidx.compose.material3.DropdownMenu
-import androidx.compose.material3.DropdownMenuItem
-import androidx.compose.material3.IconButton
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.Text
 import androidx.compose.runtime.Composable
 import androidx.compose.runtime.getValue
-import androidx.compose.runtime.mutableStateOf
 import androidx.compose.runtime.remember
-import androidx.compose.runtime.setValue
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.draw.clip
@@ -63,46 +58,39 @@ import com.vitorpamplona.amethyst.service.relayClient.reqCommand.user.observeUse
 import com.vitorpamplona.amethyst.ui.note.timeAgo
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.AccountViewModel
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.chats.feed.types.buzzTimelinePreviewSummary
-import com.vitorpamplona.amethyst.ui.screen.loggedIn.chats.publicChannels.concord.ConcordAuthorFacepile
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.chats.publicChannels.concord.ConcordUnreadBadge
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.chats.publicChannels.relayGroup.datasource.RelayGroupCardWarmupSubscription
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.chats.publicChannels.relayGroup.newestTimelineNote
-import com.vitorpamplona.amethyst.ui.screen.loggedIn.chats.publicChannels.relayGroup.recentAuthorHexes
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.chats.publicChannels.relayGroup.relayGroupChannelUnreadCountFlow
 import com.vitorpamplona.amethyst.ui.stringRes
 import com.vitorpamplona.quartz.nip29RelayGroups.GroupId

-/** How many recent-poster avatars a channel row's facepile shows at most. */
-private const val FACEPILE_MAX = 4
-
 /** A first screen's worth of recent messages to prefetch per visible card, so previews fill in. */
 private const val CARD_WARMUP_LIMIT = 10

 /**
 * One channel row in a Buzz workspace's community view: a channel the user is a member of (via
- * kind-44100), rendered like the Concord server view — a colored monogram, the channel name with a
- * recent-posters facepile, a preview of the last message (author + snippet, or the Buzz activity
- * summary for system/diff/job rows), the relative time of that message, and an unread-count badge.
- * Tapping the card opens the channel ([onOpen]); the trailing overflow (3-dot) menu holds the
- * per-channel actions — Pin/Unpin and Add-to-my-list — so the row stays clean.
+ * kind-44100), rendered like the Concord server view — a colored monogram, the channel name with the
+ * last message's relative time, and below it a preview of the last message (author + snippet, or the
+ * Buzz activity summary for system/diff/job rows) with an unread-count badge.
+ * Tapping the card opens the channel ([onOpen]); the row itself is a clean tap-to-open target — its
+ * per-channel actions (Pin/Unpin, Add/Remove-from-Messages) live in the opened channel's/forum's
+ * top-bar overflow, not on the row. A pinned channel still shows a pin marker here ([isStarred]).
 *
 * Reused by the relay group-list screen where Buzz membership discovery is folded in.
 *
 * [showActivityPreview] gates the chat-activity machinery — the recent-message warmup, the
- * last-message preview, the recent-posters facepile and the unread badge. Enable it for **chat**
- * channels (whose content lives in [RelayGroupChannel.notes]); leave it off for **forum** channels,
- * whose posts are threads (a separate store), so the row doesn't open a kind-9 chat subscription that
- * would return nothing and drives a member-count summary instead.
+ * last-message preview and the unread badge. Enable it for **chat** channels (whose content lives in
+ * [RelayGroupChannel.notes]); leave it off for **forum** channels, whose posts are threads (a
+ * separate store), so the row doesn't open a kind-9 chat subscription that would return nothing and
+ * drives a member-count summary instead.
 */
@Composable
 fun BuzzImportRow(
    groupId: GroupId,
-    isAdded: Boolean,
-    onAdd: () -> Unit,
    accountViewModel: AccountViewModel,
    onOpen: (() -> Unit)? = null,
    isStarred: Boolean = false,
-    onToggleStar: (() -> Unit)? = null,
    showActivityPreview: Boolean = true,
 ) {
    val account = accountViewModel.account
@@ -129,11 +117,10 @@ fun BuzzImportRow(
    val memberCount = channel.memberCount()
    val isPrivate = channel.isPrivate()

-    // The channel's own notes flow drives the preview/facepile so they update the moment a message
-    // folds in, independent of the metadata-scoped [observeChannel] above. Only collected for chat
-    // channels; a forum row shows a member-count summary with no facepile/unread.
+    // The channel's own notes flow drives the preview so it updates the moment a message folds in,
+    // independent of the metadata-scoped [observeChannel] above. Only collected for chat channels; a
+    // forum row shows a member-count summary with no unread.
    val lastNote: Note?
-    val faceAuthors: List<String>
    val unread: Int
    if (showActivityPreview) {
        val notesState by channel
@@ -141,14 +128,12 @@ fun BuzzImportRow(
            .notes.stateFlow
            .collectAsStateWithLifecycle()
        lastNote = remember(notesState) { channel.newestTimelineNote(account) }
-        faceAuthors = remember(notesState) { channel.recentAuthorHexes(account, FACEPILE_MAX) }
        unread =
            remember(groupId) { relayGroupChannelUnreadCountFlow(account, groupId) }
                .collectAsStateWithLifecycle(0)
                .value
    } else {
        lastNote = null
-        faceAuthors = emptyList()
        unread = 0
    }
    val hasUnread = unread > 0
@@ -161,20 +146,20 @@ fun BuzzImportRow(
                isPrivate = isPrivate,
                memberCount = memberCount,
                lastNote = lastNote,
-                faceAuthors = faceAuthors,
                unread = unread,
                hasUnread = hasUnread,
-                isAdded = isAdded,
                isStarred = isStarred,
-                onToggleStar = onToggleStar,
-                onAdd = onAdd,
                accountViewModel = accountViewModel,
            )
        }
+    // A plain row on the screen background, not a filled Card. Each row used to be its own Card, and
+    // because they stack with no gaps their container colour merged into one grey slab behind the
+    // whole Channels section — reading as a box around the channels that the Direct Messages rows
+    // right below (plain rows) didn't have. Matches [BuzzDmInlineRow] and the Concord server list.
    if (onOpen != null) {
-        Card(onClick = onOpen, modifier = Modifier.fillMaxWidth()) { content() }
+        Box(Modifier.fillMaxWidth().clickable(onClick = onOpen)) { content() }
    } else {
-        Card(modifier = Modifier.fillMaxWidth()) { content() }
+        Box(Modifier.fillMaxWidth()) { content() }
    }
 }

@@ -185,24 +170,20 @@ private fun BuzzImportRowContent(
    isPrivate: Boolean,
    memberCount: Int,
    lastNote: Note?,
-    faceAuthors: List<String>,
    unread: Int,
    hasUnread: Boolean,
-    isAdded: Boolean,
    isStarred: Boolean,
-    onToggleStar: (() -> Unit)?,
-    onAdd: () -> Unit,
    accountViewModel: AccountViewModel,
 ) {
    Row(
-        modifier = Modifier.padding(start = 12.dp, top = 10.dp, bottom = 10.dp, end = 4.dp),
+        modifier = Modifier.padding(start = 12.dp, top = 10.dp, bottom = 10.dp, end = 16.dp),
        verticalAlignment = Alignment.CenterVertically,
    ) {
        BuzzImportAvatar(name = name, seed = seed)
        Spacer(Modifier.width(12.dp))
        Column(modifier = Modifier.weight(1f), verticalArrangement = Arrangement.spacedBy(2.dp)) {
-            // Line 1: a lock (private), the channel name, a pin marker (starred), and the recent-
-            // posters facepile pushed to the right.
+            // Line 1: a lock (private), the channel name, a pin marker (starred), and the last-message
+            // time pushed to the right.
            Row(verticalAlignment = Alignment.CenterVertically, horizontalArrangement = Arrangement.spacedBy(4.dp)) {
                if (isPrivate) {
                    Icon(
@@ -228,13 +209,6 @@ private fun BuzzImportRowContent(
                        modifier = Modifier.size(14.dp),
                    )
                }
-                ConcordAuthorFacepile(faceAuthors, accountViewModel)
-            }
-            // Line 2: the last-message preview, then the time + unread badge.
-            Row(verticalAlignment = Alignment.CenterVertically, horizontalArrangement = Arrangement.spacedBy(8.dp)) {
-                Box(Modifier.weight(1f)) {
-                    BuzzChannelPreviewLine(lastNote, memberCount, accountViewModel)
-                }
                lastNote?.createdAt()?.let { ts ->
                    Text(
                        timeAgo(ts, LocalContext.current, prefix = ""),
@@ -243,15 +217,15 @@ private fun BuzzImportRowContent(
                        maxLines = 1,
                    )
                }
+            }
+            // Line 2: the last-message preview, then the unread-message badge.
+            Row(verticalAlignment = Alignment.CenterVertically, horizontalArrangement = Arrangement.spacedBy(8.dp)) {
+                Box(Modifier.weight(1f)) {
+                    BuzzChannelPreviewLine(lastNote, memberCount, accountViewModel)
+                }
                ConcordUnreadBadge(unread)
            }
        }
-        BuzzChannelRowMenu(
-            isAdded = isAdded,
-            onAdd = onAdd,
-            isStarred = isStarred,
-            onToggleStar = onToggleStar,
-        )
    }
 }

@@ -299,65 +273,6 @@ private fun BuzzChannelPreviewLine(
    )
 }

-/**
- * The per-channel overflow (3-dot) menu: Pin/Unpin and Add-to-my-list. Moved off the row itself so a
- * channel card reads as a clean Concord-style row, with its actions one tap behind the kebab.
- */
-@Composable
-private fun BuzzChannelRowMenu(
-    isAdded: Boolean,
-    onAdd: () -> Unit,
-    isStarred: Boolean,
-    onToggleStar: (() -> Unit)?,
-) {
-    var expanded by remember { mutableStateOf(false) }
-    Box {
-        IconButton(onClick = { expanded = true }) {
-            Icon(
-                symbol = MaterialSymbols.MoreVert,
-                contentDescription = stringRes(R.string.more_options),
-                tint = MaterialTheme.colorScheme.onSurfaceVariant,
-                modifier = Modifier.size(20.dp),
-            )
-        }
-        DropdownMenu(expanded = expanded, onDismissRequest = { expanded = false }) {
-            if (onToggleStar != null) {
-                DropdownMenuItem(
-                    leadingIcon = {
-                        Icon(
-                            symbol = MaterialSymbols.PushPin,
-                            contentDescription = null,
-                            tint = if (isStarred) MaterialTheme.colorScheme.primary else MaterialTheme.colorScheme.onSurfaceVariant,
-                            modifier = Modifier.size(20.dp),
-                        )
-                    },
-                    text = { Text(stringRes(if (isStarred) R.string.buzz_unpin else R.string.buzz_pin)) },
-                    onClick = {
-                        expanded = false
-                        onToggleStar()
-                    },
-                )
-            }
-            DropdownMenuItem(
-                leadingIcon = {
-                    Icon(
-                        symbol = if (isAdded) MaterialSymbols.Check else MaterialSymbols.Add,
-                        contentDescription = null,
-                        tint = if (isAdded) MaterialTheme.colorScheme.primary else MaterialTheme.colorScheme.onSurfaceVariant,
-                        modifier = Modifier.size(20.dp),
-                    )
-                },
-                text = { Text(stringRes(if (isAdded) R.string.buzz_import_added else R.string.buzz_import_add)) },
-                enabled = !isAdded,
-                onClick = {
-                    expanded = false
-                    onAdd()
-                },
-            )
-        }
-    }
-}
-
 /** A round monogram whose color is derived deterministically from the channel id. */
@Composable
 private fun BuzzImportAvatar(
@@ -23,11 +23,13 @@ package com.vitorpamplona.amethyst.ui.screen.loggedIn.buzz
 import androidx.lifecycle.ViewModel
 import androidx.lifecycle.viewModelScope
 import com.vitorpamplona.amethyst.commons.model.buzz.BuzzWorkspaces
+import com.vitorpamplona.amethyst.commons.model.nip29RelayGroups.RelayGroupDeletions
 import com.vitorpamplona.amethyst.commons.relayauth.RelayAuthDecision
 import com.vitorpamplona.amethyst.model.Account
 import com.vitorpamplona.amethyst.model.LocalCache
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.chats.publicChannels.relayGroup.datasource.RELAY_GROUP_METADATA_KINDS
 import com.vitorpamplona.quartz.buzz.notifications.MemberAddedNotificationEvent
+import com.vitorpamplona.quartz.buzz.stream.SystemMessageEvent
 import com.vitorpamplona.quartz.buzz.workspace.isBuzzDm
 import com.vitorpamplona.quartz.nip01Core.relay.client.accessories.fetchAllWithHooks
 import com.vitorpamplona.quartz.nip01Core.relay.filters.Filter
@@ -39,7 +41,6 @@ import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.flow.MutableStateFlow
 import kotlinx.coroutines.flow.StateFlow
 import kotlinx.coroutines.flow.asStateFlow
-import kotlinx.coroutines.flow.update
 import kotlinx.coroutines.launch
 import java.util.Collections

@@ -79,7 +80,12 @@ class BuzzRelayImportViewModel : ViewModel() {
    private val _channels = MutableStateFlow<List<GroupId>>(emptyList())
    val channels: StateFlow<List<GroupId>> = _channels.asStateFlow()

-    /** Channel ids already present in the user's kind-10009 list (seeded + updated as they add). */
+    /**
+     * Channel ids on this relay that are currently in the user's kind-10009 list. Mirrors the live
+     * list rather than snapshotting it: it used to be seeded once at [bind] and only ever grow, so a
+     * channel taken off Messages anywhere else still rendered as "Added" — with the Add action
+     * disabled, leaving no way back.
+     */
    private val _added = MutableStateFlow<Set<String>>(emptySet())
    val added: StateFlow<Set<String>> = _added.asStateFlow()

@@ -110,12 +116,13 @@ class BuzzRelayImportViewModel : ViewModel() {
        // every other `#p=me`-gated read on the shared socket.
        if (newlyJoined) account.client.reconnect(onlyIfChanged = false, ignoreRetryDelays = true)

-        // Seed "already added" from the current kind-10009 list so channels the user already has
-        // render as added rather than offering a duplicate Add.
-        _added.value =
-            account.relayGroupList.liveRelayGroupList.value
-                .filter { RelayUrlNormalizer.normalizeOrNull(it.relayUrl) == normalized }
-                .mapTo(mutableSetOf()) { it.groupId }
+        // Track "already added" against the live kind-10009 list, scoped to this relay, so the rows
+        // follow every add/remove — from here, from the channel's top bar, or from another device.
+        viewModelScope.launch(Dispatchers.IO) {
+            account.relayGroupList.liveRelayGroupIds.collect { groups ->
+                _added.value = groups.filter { it.relayUrl == normalized }.mapTo(mutableSetOf()) { it.id }
+            }
+        }

        discover(account, normalized)
    }
@@ -149,22 +156,49 @@ class BuzzRelayImportViewModel : ViewModel() {
                    false
                }

-                // 2. Fetch each channel's NIP-29 metadata (39000-39003) so its name + Buzz `t` type load.
+                // 2. Fetch each channel's NIP-29 metadata (39000-39003, `#d`-scoped) so its name + Buzz
+                //    `t` type load, AND the relay's kind-40099 system messages (`#h`-scoped) so a
+                //    `channel_deleted` one is seen. The relay soft-deletes a deleted channel's 39000
+                //    and never retracts the kind-44100 that seeded `channelIds`, so without pulling the
+                //    40099 a deleted channel — its metadata now blank — would show optimistically here
+                //    forever. LocalCache records the delete into RelayGroupDeletions on consume.
                if (channelIds.isNotEmpty()) {
                    account.client.fetchAllWithHooks(
-                        filters = mapOf(relay to listOf(Filter(kinds = RELAY_GROUP_METADATA_KINDS, tags = mapOf("d" to channelIds.toList())))),
+                        filters =
+                            mapOf(
+                                relay to
+                                    listOf(
+                                        Filter(kinds = RELAY_GROUP_METADATA_KINDS, tags = mapOf("d" to channelIds.toList())),
+                                        Filter(kinds = listOf(SystemMessageEvent.KIND), tags = mapOf("h" to channelIds.toList())),
+                                    ),
+                            ),
                        timeoutMs = 8_000,
                        pendingOnAuthRequired = true,
                    ) { _, _ -> false }
                }

-                // 3. Keep only non-DM workspace channels; a channel whose metadata hasn't arrived
-                //    (type unknown) is optimistically shown as a workspace channel.
+                // 3. Keep only the non-DM workspace channels the relay still serves metadata for.
+                //
+                //    A deleted (or never-really-there) channel keeps its kind-44100 — the relay never
+                //    retracts it — but the relay soft-deletes its 39000, so it arrives here with NO
+                //    metadata. That absence is the reliable "it's gone" signal (the relay does not serve
+                //    a `channel_deleted` 40099 for an already-deleted channel, so the fetch above can't
+                //    catch this case). Before, such a channel showed optimistically — as a bare UUID row
+                //    with "No messages yet", which is exactly the leak reported.
+                //
+                //    So drop channels with no metadata — but ONLY when the fetch clearly worked (at least
+                //    one channel came back with a 39000). If none did, the read failed (auth/connectivity)
+                //    and we keep the whole set rather than blank the community; a genuinely new channel
+                //    whose 39000 is merely slow re-appears on the next bind once its metadata is cached.
+                val channels = channelIds.associateWith { LocalCache.getOrCreateRelayGroupChannel(GroupId(it, relay)) }
+                val fetchHadMetadata = channels.values.any { it.event != null }
                _channels.value =
                    channelIds
                        .mapNotNull { id ->
                            val groupId = GroupId(id, relay)
-                            val channel = LocalCache.getOrCreateRelayGroupChannel(groupId)
+                            if (RelayGroupDeletions.isDeleted(groupId)) return@mapNotNull null
+                            val channel = channels.getValue(id)
+                            if (fetchHadMetadata && channel.event == null) return@mapNotNull null
                            if (channel.event?.isBuzzDm() == true) null else groupId
                        }.sortedBy { it.id }
                _status.value = Status.Ready
@@ -176,13 +210,32 @@ class BuzzRelayImportViewModel : ViewModel() {
        }
    }

-    /** Append [groupId] to the user's kind-10009 list (public group tag), so it shows in Messages. */
+    /**
+     * Append [groupId] to the user's kind-10009 list (public group tag), so it shows in Messages, and
+     * clear any earlier dismissal so the relay's kind-44100 re-announcement isn't filtered back out.
+     * [_added] is not touched here — the live-list collector in [bind] reflects the new event.
+     */
    fun add(groupId: GroupId) {
        val account = account ?: return
        viewModelScope.launch(Dispatchers.IO) {
            val channel = LocalCache.getOrCreateRelayGroupChannel(groupId)
+            account.settings.undismissChannelInvite(groupId.id)
            account.follow(channel)
-            _added.update { it + groupId.id }
+        }
+    }
+
+    /**
+     * Take [groupId] off the kind-10009 list without leaving the channel: no kind-9022, so the relay
+     * roster (and therefore this very list of channels) is untouched and it can be added back. The
+     * dismissal keeps a Buzz relay's kind-44100 re-announcement from bouncing it back as an invite —
+     * mirrors `AccountViewModel.removeRelayGroupFromMessages`.
+     */
+    fun remove(groupId: GroupId) {
+        val account = account ?: return
+        viewModelScope.launch(Dispatchers.IO) {
+            val channel = LocalCache.getOrCreateRelayGroupChannel(groupId)
+            account.settings.dismissChannelInvite(groupId.id)
+            account.unfollow(channel)
        }
    }

@@ -29,7 +29,10 @@ import androidx.compose.foundation.LocalIndication
 import androidx.compose.foundation.background
 import androidx.compose.foundation.clickable
 import androidx.compose.foundation.combinedClickable
-import androidx.compose.foundation.gestures.detectHorizontalDragGestures
+import androidx.compose.foundation.gestures.awaitEachGesture
+import androidx.compose.foundation.gestures.awaitFirstDown
+import androidx.compose.foundation.gestures.awaitTouchSlopOrCancellation
+import androidx.compose.foundation.gestures.horizontalDrag
 import androidx.compose.foundation.interaction.MutableInteractionSource
 import androidx.compose.foundation.interaction.collectIsPressedAsState
 import androidx.compose.foundation.layout.Arrangement
@@ -47,20 +50,24 @@ import androidx.compose.material3.Text
 import androidx.compose.runtime.Composable
 import androidx.compose.runtime.LaunchedEffect
 import androidx.compose.runtime.MutableState
+import androidx.compose.runtime.derivedStateOf
 import androidx.compose.runtime.getValue
 import androidx.compose.runtime.mutableFloatStateOf
 import androidx.compose.runtime.mutableStateOf
 import androidx.compose.runtime.remember
 import androidx.compose.runtime.rememberCoroutineScope
+import androidx.compose.runtime.rememberUpdatedState
 import androidx.compose.runtime.setValue
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.draw.clip
+import androidx.compose.ui.geometry.Offset
 import androidx.compose.ui.graphics.Color
 import androidx.compose.ui.graphics.compositeOver
 import androidx.compose.ui.graphics.graphicsLayer
 import androidx.compose.ui.hapticfeedback.HapticFeedbackType
 import androidx.compose.ui.input.pointer.pointerInput
+import androidx.compose.ui.input.pointer.positionChange
 import androidx.compose.ui.platform.LocalDensity
 import androidx.compose.ui.platform.LocalHapticFeedback
 import androidx.compose.ui.text.font.FontWeight
@@ -174,6 +181,12 @@ fun ChatBubbleLayout(
    var dragOffset by remember { mutableFloatStateOf(0f) }
    var settleJob by remember { mutableStateOf<Job?>(null) }
    val swipeScope = rememberCoroutineScope()
+    // The caller passes a fresh onSwipeReply lambda every recomposition (it captures
+    // the note), so read it through updated-state and key pointerInput on the stable
+    // isLoggedInUser instead. Keying on the lambda would tear down and restart the
+    // detector on every recomposition — stranding an in-flight drag and churning the
+    // gesture coroutine on every idle row update.
+    val latestOnSwipeReply by rememberUpdatedState(onSwipeReply)
    val density = LocalDensity.current
    val swipeThresholdPx = remember(density) { with(density) { SwipeReplyThreshold.toPx() } }
    val swipeMaxPx = remember(density) { with(density) { SwipeReplyMaxDrag.toPx() } }
@@ -187,13 +200,18 @@ fun ChatBubbleLayout(
            },
    ) {
        if (onSwipeReply != null) {
-            val progress = (abs(dragOffset) / swipeThresholdPx).coerceIn(0f, 1f)
-            if (progress > 0f) {
+            // Gate composition on a boolean that flips only at the 0<->non-0 edges, so
+            // the icon is added/removed twice per gesture instead of recomposing every
+            // frame; the fade/scale reads dragOffset inside graphicsLayer (layer phase),
+            // so the whole swipe animates without recomposing ChatBubbleLayout.
+            val swiping by remember { derivedStateOf { dragOffset != 0f } }
+            if (swiping) {
                Box(
                    modifier =
                        Modifier
                            .align(if (isLoggedInUser) Alignment.CenterEnd else Alignment.CenterStart)
                            .graphicsLayer {
+                                val progress = (abs(dragOffset) / swipeThresholdPx).coerceIn(0f, 1f)
                                alpha = progress
                                scaleX = 0.6f + 0.4f * progress
                                scaleY = 0.6f + 0.4f * progress
@@ -208,7 +226,7 @@ fun ChatBubbleLayout(
            if (onSwipeReply != null) {
                Modifier
                    .graphicsLayer { translationX = dragOffset }
-                    .pointerInput(onSwipeReply) {
+                    .pointerInput(isLoggedInUser) {
                        // Drag toward the screen center only; a haptic tick marks the
                        // commit point, releasing past it fires the reply.
                        var crossedThreshold = false
@@ -220,20 +238,7 @@ fun ChatBubbleLayout(
                                }
                        }

-                        detectHorizontalDragGestures(
-                            onDragStart = {
-                                settleJob?.cancel()
-                                crossedThreshold = false
-                            },
-                            onDragEnd = {
-                                if (abs(dragOffset) >= swipeThresholdPx) {
-                                    onSwipeReply()
-                                }
-                                settleBack()
-                            },
-                            onDragCancel = { settleBack() },
-                        ) { change, dragAmount ->
-                            change.consume()
+                        val applyDrag = { dragAmount: Float ->
                            val newOffset =
                                if (isLoggedInUser) {
                                    (dragOffset + dragAmount).coerceIn(-swipeMaxPx, 0f)
@@ -246,6 +251,50 @@ fun ChatBubbleLayout(
                            }
                            dragOffset = newOffset
                        }
+
+                        awaitEachGesture {
+                            val down = awaitFirstDown(requireUnconsumed = false)
+
+                            // Claim the pointer only once the motion is clearly more
+                            // horizontal than vertical; a mostly-vertical drag leaves the
+                            // pointer unconsumed so the enclosing scroll keeps it and the
+                            // bubble never moves while you scroll.
+                            var overSlop = Offset.Zero
+                            val drag =
+                                awaitTouchSlopOrCancellation(down.id) { change, over ->
+                                    if (abs(over.x) > abs(over.y)) {
+                                        change.consume()
+                                        overSlop = over
+                                    }
+                                }
+
+                            if (drag != null) {
+                                // Take over from any in-flight settle only now that we've
+                                // committed to a horizontal drag. Cancelling earlier (on
+                                // the down) would strand dragOffset when the gesture turns
+                                // out to be a vertical scroll, since settleBack() below
+                                // only runs on this path.
+                                settleJob?.cancel()
+                                crossedThreshold = false
+                                applyDrag(overSlop.x)
+                                try {
+                                    val completed =
+                                        horizontalDrag(drag.id) { change ->
+                                            applyDrag(change.positionChange().x)
+                                            change.consume()
+                                        }
+                                    if (completed && abs(dragOffset) >= swipeThresholdPx) {
+                                        latestOnSwipeReply?.invoke()
+                                    }
+                                } finally {
+                                    // Settle even if the drag coroutine is cancelled (e.g.
+                                    // the bubble leaves composition mid-swipe); settleBack
+                                    // launches on swipeScope, not this pointer coroutine,
+                                    // so it still runs while that scope is alive.
+                                    settleBack()
+                                }
+                            }
+                        }
                    }
            } else {
                Modifier
@@ -377,6 +377,7 @@ private fun TeleportCard(onClick: () -> Unit) {

 internal fun GeohashChannelLevel.label(): String =
    when (this) {
+        GeohashChannelLevel.CONTINENT -> "Continent"
        GeohashChannelLevel.REGION -> "Region"
        GeohashChannelLevel.PROVINCE -> "Province"
        GeohashChannelLevel.CITY -> "City"
@@ -25,6 +25,7 @@ import androidx.compose.foundation.clickable
 import androidx.compose.foundation.layout.Arrangement
 import androidx.compose.foundation.layout.Box
 import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.PaddingValues
 import androidx.compose.foundation.layout.Row
 import androidx.compose.foundation.layout.fillMaxSize
 import androidx.compose.foundation.layout.fillMaxWidth
@@ -45,7 +46,6 @@ import androidx.compose.material3.OutlinedTextField
 import androidx.compose.material3.Scaffold
 import androidx.compose.material3.Text
 import androidx.compose.material3.TextButton
-import androidx.compose.material3.TopAppBar
 import androidx.compose.runtime.Composable
 import androidx.compose.runtime.LaunchedEffect
 import androidx.compose.runtime.getValue
@@ -73,6 +73,7 @@ import com.vitorpamplona.amethyst.ui.components.util.setText
 import com.vitorpamplona.amethyst.ui.navigation.bottombars.AppBottomBar
 import com.vitorpamplona.amethyst.ui.navigation.navs.INav
 import com.vitorpamplona.amethyst.ui.navigation.routes.Route
+import com.vitorpamplona.amethyst.ui.navigation.topbars.ShorterTopAppBar
 import com.vitorpamplona.amethyst.ui.note.timeAgo
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.AccountViewModel
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.chats.publicChannels.concord.datasource.ConcordChannelPreviewLoader
@@ -222,7 +223,7 @@ fun ConcordChannelListScreen(

    Scaffold(
        topBar = {
-            TopAppBar(
+            ShorterTopAppBar(
                title = { Text(communityName, maxLines = 1) },
                navigationIcon = {
                    // Back arrow only when pushed from elsewhere; as a bottom-nav tab the bar takes its place.
@@ -321,7 +322,15 @@ fun ConcordChannelListScreen(
                )
            }
        } else {
-            LazyColumn(Modifier.fillMaxSize().padding(padding)) {
+            // Bottom room for the FAB, which the Scaffold's `padding` deliberately doesn't account for
+            // (a FAB overlays content) — without it the last row's manager overflow menu sits under it
+            // and can't be tapped. As contentPadding so rows scroll *through* the strip rather than the
+            // viewport shrinking. Gated on [canManageChannels] because that is what renders the FAB:
+            // a plain member has nothing to clear, and no reason to lose the space.
+            LazyColumn(
+                Modifier.fillMaxSize().padding(padding),
+                contentPadding = PaddingValues(bottom = if (canManageChannels) FAB_CLEARANCE else 0.dp),
+            ) {
                items(channels, key = { it.key }) { entry ->
                    val def = entry.value.definition
                    val name = def.name.ifBlank { entry.key }
@@ -394,8 +403,6 @@ private fun ConcordChannelListRow(
        remember(communityId, channelKey) { concordChannelUnreadCountFlow(account, communityId, channelKey) }
            .collectAsStateWithLifecycle(0)
    val hasUnread = unread > 0
-    // The recent posters' faces — recomputed as the channel's notes change (keyed on channelState).
-    val faceAuthors = remember(channelState) { channel.recentAuthorHexes(FACEPILE_MAX) }

    Row(
        Modifier
@@ -412,7 +419,7 @@ private fun ConcordChannelListRow(
            tint = if (hasUnread) MaterialTheme.colorScheme.onSurface else MaterialTheme.colorScheme.onSurfaceVariant,
        )
        Column(Modifier.weight(1f), verticalArrangement = Arrangement.spacedBy(2.dp)) {
-            // Line 1: channel name + the recent-posters facepile pushed to the right.
+            // Line 1: channel name + the last-message time pushed to the right.
            Row(verticalAlignment = Alignment.CenterVertically, horizontalArrangement = Arrangement.spacedBy(8.dp)) {
                Text(
                    channelName,
@@ -422,13 +429,6 @@ private fun ConcordChannelListRow(
                    maxLines = 1,
                    overflow = TextOverflow.Ellipsis,
                )
-                ConcordAuthorFacepile(faceAuthors, accountViewModel)
-            }
-            // Line 2: the last-message preview (or a live "typing…"), then the time + unread badge.
-            Row(verticalAlignment = Alignment.CenterVertically, horizontalArrangement = Arrangement.spacedBy(8.dp)) {
-                Box(Modifier.weight(1f)) {
-                    ConcordChannelPreviewLine(lastNote, isVoice, typingAuthors, accountViewModel)
-                }
                lastNote?.createdAt()?.let { ts ->
                    Text(
                        timeAgo(ts, LocalContext.current, prefix = ""),
@@ -437,6 +437,12 @@ private fun ConcordChannelListRow(
                        maxLines = 1,
                    )
                }
+            }
+            // Line 2: the last-message preview (or a live "typing…"), then the unread-message badge.
+            Row(verticalAlignment = Alignment.CenterVertically, horizontalArrangement = Arrangement.spacedBy(8.dp)) {
+                Box(Modifier.weight(1f)) {
+                    ConcordChannelPreviewLine(lastNote, isVoice, typingAuthors, accountViewModel)
+                }
                ConcordUnreadBadge(unread)
            }
        }
@@ -449,8 +455,12 @@ private fun ConcordChannelListRow(
    }
 }

-/** How many recent-poster avatars a channel row's facepile shows at most. */
-private const val FACEPILE_MAX = 4
+/**
+ * Bottom room the list leaves for the floating action button: a 56dp FAB + the Scaffold's 16dp margin
+ * + slack, so the last row's overflow menu stays tappable instead of sitting under the FAB. Matches
+ * the value `JobBoardScreen` and the relay-group list screens use.
+ */
+private val FAB_CLEARANCE = 96.dp

 /**
 * The line under a channel name. When someone is composing it shows a live italic "X is typing…";
@@ -529,7 +539,7 @@ private fun rememberConcordDisplayName(
 * so leaving is what actually retires the community for them.
 */
@Composable
-private fun ConcordLeaveDialog(
+internal fun ConcordLeaveDialog(
    communityName: String,
    isOwner: Boolean,
    onDismiss: () -> Unit,
@@ -1,84 +0,0 @@
-/*
- * Copyright (c) 2025 Vitor Pamplona
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy of
- * this software and associated documentation files (the "Software"), to deal in
- * the Software without restriction, including without limitation the rights to use,
- * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
- * Software, and to permit persons to whom the Software is furnished to do so,
- * subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in all
- * copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
- * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
- * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
- * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
- * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
- */
-package com.vitorpamplona.amethyst.ui.screen.loggedIn.chats.publicChannels.concord
-
-import androidx.compose.foundation.background
-import androidx.compose.foundation.layout.Arrangement
-import androidx.compose.foundation.layout.Box
-import androidx.compose.foundation.layout.Row
-import androidx.compose.foundation.layout.padding
-import androidx.compose.foundation.layout.size
-import androidx.compose.foundation.shape.CircleShape
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.runtime.Composable
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.draw.clip
-import androidx.compose.ui.unit.Dp
-import androidx.compose.ui.unit.dp
-import androidx.compose.ui.zIndex
-import com.vitorpamplona.amethyst.ui.note.DisplayBlankAuthor
-import com.vitorpamplona.amethyst.ui.note.ObserveAndDrawInnerUserPicture
-import com.vitorpamplona.amethyst.ui.screen.loggedIn.AccountViewModel
-import com.vitorpamplona.amethyst.ui.screen.loggedIn.chats.rooms.LoadUser
-import com.vitorpamplona.quartz.nip01Core.core.HexKey
-
-/**
- * A horizontal stack of overlapping avatars for the recent posters in a channel — the "who's here"
- * cue that makes a busy channel feel alive. Each avatar wears a thin ring in the row's background
- * colour so the overlap reads as a deck of cards; the newest poster sits on top (leftmost, highest
- * z-index). Renders nothing for an empty [authorHexes], so callers can drop it in unconditionally.
- */
-@Composable
-fun ConcordAuthorFacepile(
-    authorHexes: List<HexKey>,
-    accountViewModel: AccountViewModel,
-    modifier: Modifier = Modifier,
-    avatarSize: Dp = 22.dp,
-    maxShown: Int = 4,
-) {
-    if (authorHexes.isEmpty()) return
-    val shown = authorHexes.take(maxShown)
-    // A ring one-and-a-half dp wide, and each avatar pulled left over its neighbour by a third of
-    // its width — enough overlap to read as a stack without hiding faces.
-    val ring = 1.5.dp
-    val overlap = avatarSize * 0.36f
-    Row(modifier, horizontalArrangement = Arrangement.spacedBy(-overlap)) {
-        shown.forEachIndexed { index, hex ->
-            Box(
-                Modifier
-                    // Newest (index 0) on top so it isn't clipped by the one after it.
-                    .zIndex((shown.size - index).toFloat())
-                    .size(avatarSize)
-                    .clip(CircleShape)
-                    .background(MaterialTheme.colorScheme.surface)
-                    .padding(ring),
-            ) {
-                LoadUser(baseUserHex = hex, accountViewModel) { user ->
-                    if (user != null) {
-                        ObserveAndDrawInnerUserPicture(user, avatarSize - ring * 2, accountViewModel)
-                    } else {
-                        DisplayBlankAuthor(avatarSize - ring * 2, Modifier, accountViewModel)
-                    }
-                }
-            }
-        }
-    }
-}
@@ -39,7 +39,6 @@ import androidx.compose.material3.IconButton
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.Scaffold
 import androidx.compose.material3.Text
-import androidx.compose.material3.TopAppBar
 import androidx.compose.runtime.Composable
 import androidx.compose.runtime.LaunchedEffect
 import androidx.compose.runtime.getValue
@@ -68,6 +67,7 @@ import com.vitorpamplona.amethyst.ui.navigation.bottombars.AppBottomBar
 import com.vitorpamplona.amethyst.ui.navigation.bottombars.FabBottomBarPadded
 import com.vitorpamplona.amethyst.ui.navigation.navs.INav
 import com.vitorpamplona.amethyst.ui.navigation.routes.Route
+import com.vitorpamplona.amethyst.ui.navigation.topbars.ShorterTopAppBar
 import com.vitorpamplona.amethyst.ui.note.timeAgo
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.AccountViewModel
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.chats.publicChannels.concord.datasource.ConcordChannelSubscription
@@ -115,7 +115,7 @@ fun ConcordHomeScreen(

    Scaffold(
        topBar = {
-            TopAppBar(
+            ShorterTopAppBar(
                title = { Text(stringRes(R.string.concord_home_title)) },
                navigationIcon = {
                    // Back arrow only when this is a pushed screen (from the drawer / a deep link);
@@ -310,7 +310,11 @@ private fun CommunityHeader(
            loadRobohash = accountViewModel.settings.isNotPerformanceMode(),
            autoPlayGif = autoPlayGif,
        )
-        Column(Modifier.weight(1f)) {
+        // The identity block — icon *and* name/subtitle — opens the community; the rest of the row and
+        // the chevron expand it. Tapping a title to open the thing it names is the convention users
+        // arrive with, and the name previously fell through to the row's expand, leaving the 40dp
+        // avatar as the only way in with nothing to suggest it was a separate target.
+        Column(Modifier.weight(1f).clickable(onClick = onOpen)) {
            Text(
                name,
                style = MaterialTheme.typography.bodyLarge,
@@ -26,7 +26,6 @@ import com.vitorpamplona.amethyst.model.Account
 import com.vitorpamplona.amethyst.model.LocalCache
 import com.vitorpamplona.amethyst.model.Note
 import com.vitorpamplona.quartz.concord.cord03Channels.ConcordChannelId
-import com.vitorpamplona.quartz.nip01Core.core.HexKey
 import com.vitorpamplona.quartz.nip22Comments.CommentEvent
 import kotlinx.coroutines.ExperimentalCoroutinesApi
 import kotlinx.coroutines.flow.Flow
@@ -135,22 +134,3 @@ private fun ConcordChannel.newMessagesSince(
    notes.count { _, note ->
        (note.createdAt() ?: 0L) > sinceSecs && isConcordTimelineMessage(note, account)
    }
-
-/**
- * The pubkeys of the [limit] most-recent distinct posters in this channel, newest first — the
- * facepile shown on a channel row. One O(notes) pass keeps each author's latest post time, so a
- * chatty author counts once (at their newest message) rather than crowding out quieter voices.
- */
-fun ConcordChannel.recentAuthorHexes(limit: Int): List<HexKey> {
-    val latestByAuthor = HashMap<HexKey, Long>()
-    for (note in notes.values()) {
-        val author = note.author?.pubkeyHex ?: continue
-        val at = note.createdAt() ?: continue
-        val prev = latestByAuthor[author]
-        if (prev == null || at > prev) latestByAuthor[author] = at
-    }
-    return latestByAuthor.entries
-        .sortedByDescending { it.value }
-        .take(limit)
-        .map { it.key }
-}
@@ -0,0 +1,104 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.ui.screen.loggedIn.chats.publicChannels.relayGroup
+
+import androidx.compose.foundation.layout.size
+import androidx.compose.material3.DropdownMenuItem
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.Text
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.getValue
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.unit.dp
+import androidx.lifecycle.compose.collectAsStateWithLifecycle
+import com.vitorpamplona.amethyst.R
+import com.vitorpamplona.amethyst.commons.icons.symbols.Icon
+import com.vitorpamplona.amethyst.commons.icons.symbols.MaterialSymbols
+import com.vitorpamplona.amethyst.commons.model.buzz.BuzzChannelStars
+import com.vitorpamplona.amethyst.commons.model.nip29RelayGroups.RelayGroupChannel
+import com.vitorpamplona.amethyst.ui.screen.loggedIn.AccountViewModel
+import com.vitorpamplona.amethyst.ui.stringRes
+import com.vitorpamplona.quartz.nip29RelayGroups.GroupId
+
+/**
+ * Pin/Unpin a Buzz channel (a device-local favorite — [BuzzChannelStars]). Moved off the per-channel
+ * list row into the opened channel's/forum's top-bar overflow, so the list row stays a clean
+ * tap-to-open target. Reads the live starred set so the label + icon reflect the current state.
+ */
+@Composable
+fun BuzzPinDropdownItem(
+    groupId: GroupId,
+    closeMenu: () -> Unit,
+) {
+    val starred by BuzzChannelStars.flow.collectAsStateWithLifecycle()
+    val isStarred = groupId.id in starred
+    DropdownMenuItem(
+        leadingIcon = {
+            Icon(
+                symbol = MaterialSymbols.PushPin,
+                contentDescription = null,
+                tint = if (isStarred) MaterialTheme.colorScheme.primary else MaterialTheme.colorScheme.onSurfaceVariant,
+                modifier = Modifier.size(20.dp),
+            )
+        },
+        text = { Text(stringRes(if (isStarred) R.string.buzz_unpin else R.string.buzz_pin)) },
+        onClick = {
+            closeMenu()
+            BuzzChannelStars.toggle(groupId.id)
+        },
+    )
+}
+
+/**
+ * Add/Remove this relay-group [channel] from my kind-10009 list (whether it shows in Messages). A
+ * reversible toggle that never touches my relay membership — same split as "Leave" — so it stays
+ * readable either way. Reads the live kind-10009 list so it flips as the change lands. Moved off the
+ * per-channel list row into the opened screen's top-bar overflow.
+ */
+@Composable
+fun RelayGroupMessagesDropdownItem(
+    channel: RelayGroupChannel,
+    accountViewModel: AccountViewModel,
+    closeMenu: () -> Unit,
+) {
+    val joinedGroupIds by accountViewModel.account.relayGroupList.liveRelayGroupIds
+        .collectAsStateWithLifecycle()
+    val onMyList = channel.groupId in joinedGroupIds
+    DropdownMenuItem(
+        leadingIcon = {
+            Icon(
+                symbol = if (onMyList) MaterialSymbols.VisibilityOff else MaterialSymbols.Add,
+                contentDescription = null,
+                tint = MaterialTheme.colorScheme.onSurfaceVariant,
+                modifier = Modifier.size(20.dp),
+            )
+        },
+        text = { Text(stringRes(if (onMyList) R.string.remove_from_messages else R.string.add_to_messages)) },
+        onClick = {
+            closeMenu()
+            if (onMyList) {
+                accountViewModel.removeRelayGroupFromMessages(channel)
+            } else {
+                accountViewModel.addRelayGroupToMessages(channel)
+            }
+        },
+    )
+}
@@ -24,6 +24,7 @@ import androidx.compose.foundation.clickable
 import androidx.compose.foundation.layout.Arrangement
 import androidx.compose.foundation.layout.Box
 import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.PaddingValues
 import androidx.compose.foundation.layout.Row
 import androidx.compose.foundation.layout.Spacer
 import androidx.compose.foundation.layout.fillMaxSize
@@ -31,7 +32,6 @@ import androidx.compose.foundation.layout.fillMaxWidth
 import androidx.compose.foundation.layout.padding
 import androidx.compose.foundation.layout.size
 import androidx.compose.foundation.lazy.LazyColumn
-import androidx.compose.foundation.lazy.items
 import androidx.compose.foundation.lazy.itemsIndexed
 import androidx.compose.foundation.shape.CircleShape
 import androidx.compose.material3.Card
@@ -45,6 +45,7 @@ import androidx.compose.material3.Scaffold
 import androidx.compose.material3.Text
 import androidx.compose.runtime.Composable
 import androidx.compose.runtime.LaunchedEffect
+import androidx.compose.runtime.derivedStateOf
 import androidx.compose.runtime.getValue
 import androidx.compose.runtime.mutableStateOf
 import androidx.compose.runtime.produceState
@@ -53,6 +54,7 @@ import androidx.compose.runtime.rememberCoroutineScope
 import androidx.compose.runtime.setValue
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
+import androidx.compose.ui.draw.alpha
 import androidx.compose.ui.draw.clip
 import androidx.compose.ui.draw.rotate
 import androidx.compose.ui.res.pluralStringResource
@@ -70,7 +72,7 @@ import com.vitorpamplona.amethyst.commons.model.buzz.BuzzChannelStars
 import com.vitorpamplona.amethyst.commons.model.buzz.BuzzCommunityMembership
 import com.vitorpamplona.amethyst.commons.model.buzz.BuzzRelayDialect
 import com.vitorpamplona.amethyst.commons.model.nip29RelayGroups.RelayGroupChannel
-import com.vitorpamplona.amethyst.commons.tor.TorType
+import com.vitorpamplona.amethyst.commons.model.nip29RelayGroups.RelayGroupDeletions
 import com.vitorpamplona.amethyst.commons.util.sortedBySnapshot
 import com.vitorpamplona.amethyst.model.LocalCache
 import com.vitorpamplona.amethyst.model.nip11RelayInfo.isRelaySignedRelayGroup
@@ -90,12 +92,14 @@ import com.vitorpamplona.amethyst.ui.screen.loggedIn.buzz.BuzzDmListViewModel
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.buzz.BuzzImportRow
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.buzz.BuzzRelayImportViewModel
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.buzz.BuzzWorkspaceOverflowMenu
+import com.vitorpamplona.amethyst.ui.screen.loggedIn.buzz.HiddenDmHeader
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.buzz.PresenceDot
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.chats.feed.types.buzzTimelinePreviewSummary
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.chats.publicChannels.relayGroup.datasource.RelayGroupCardWarmupSubscription
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.chats.publicChannels.relayGroup.datasource.RelayGroupsOnRelaySubscription
 import com.vitorpamplona.amethyst.ui.stringRes
 import com.vitorpamplona.amethyst.ui.theme.warningColor
+import com.vitorpamplona.amethyst.ui.tor.TorServiceStatus
 import com.vitorpamplona.quartz.buzz.workspace.BUZZ_CHANNEL_TYPE_DM
 import com.vitorpamplona.quartz.buzz.workspace.BUZZ_CHANNEL_TYPE_FORUM
 import com.vitorpamplona.quartz.nip01Core.core.HexKey
@@ -110,9 +114,44 @@ import kotlinx.coroutines.launch
 /** A first screen's worth of recent messages to prefetch per visible group card, ahead of a tap. */
 private const val CHANNEL_LIST_WARMUP_LIMIT = 10

-/** Grace period before offering the Tor→clearnet escape hatch, so a slow-but-working relay isn't nagged. */
+/**
+ * How long this relay's socket must stay down before the Tor→clearnet escape hatch is offered, so a
+ * slow first connect (or a reconnect) isn't mistaken for a relay that blocks Tor exits.
+ */
 private const val TOR_CLEARNET_HINT_DELAY_MS = 6_000L

+/**
+ * Whether to offer the Tor→clearnet escape hatch for this relay ([TorClearnetBanner]).
+ *
+ * The banner accuses *this relay* of blocking Tor exits and offers a privacy downgrade to work
+ * around it, so it has to rule out every other explanation — and be able to deliver:
+ *
+ * - [usesTor]: this relay is *actually* routed over Tor right now (`TorRelayEvaluation.useTor`, the
+ *   same predicate the pool dials with). Tor being enabled globally says nothing about one relay —
+ *   onion, localhost and the per-role presets (trusted / DM / new) each decide independently.
+ * - [torIsUp]: the SOCKS proxy is Active. While Tor is still bootstrapping *nothing* Tor-routed
+ *   connects, which is Tor's problem (and its own dialog's), not this relay's.
+ * - [trustingMovesToClearnet]: the action on offer — adding the relay to the kind-10089 Trusted list —
+ *   would actually change its routing. Under a preset that keeps trusted relays on Tor it wouldn't,
+ *   and the button would be inert.
+ * - [disconnectedLongEnough]: the socket has been continuously down for [TOR_CLEARNET_HINT_DELAY_MS].
+ *   A relay that answers is reachable by definition, and one that merely reconnects is not a relay
+ *   that blocks Tor — only a sustained silence is.
+ */
+internal fun shouldOfferTorClearnetFallback(
+    usesTor: Boolean,
+    torIsUp: Boolean,
+    trustingMovesToClearnet: Boolean,
+    disconnectedLongEnough: Boolean,
+): Boolean = usesTor && torIsUp && trustingMovesToClearnet && disconnectedLongEnough
+
+/**
+ * Bottom room the list leaves for the floating action button: a 56dp FAB + the Scaffold's 16dp margin
+ * + slack, so the last row's overflow menu stays tappable instead of sitting under the FAB. Matches
+ * the value `JobBoardScreen` already uses.
+ */
+private val FAB_CLEARANCE = 96.dp
+
 /**
 * Lists every channel a relay hosts (its kind 39000-39003 directory), so the user
 * can browse and open channels on that relay. The relay's directory is streamed by
@@ -161,6 +200,11 @@ fun RelayGroupChannelListScreen(
            }
    }

+    // Channels this device has deleted (kind-9008). A delete is terminal — the relay drops the group —
+    // but our cached 39000 (and a Buzz relay's stale re-announced 44100) would keep it in the list, so
+    // filter them out everywhere below. Collected as a StateFlow so a delete removes the row live.
+    val deletedChannels by RelayGroupDeletions.flow.collectAsStateWithLifecycle()
+
    // Prefer the relay's own genuine, relay-signed groups (39000 author == the NIP-11 `self`).
    // Recomputes as the NIP-11 doc resolves so real groups fill in and fakes stay hidden. But if
    // NIP-11 is unreachable (e.g. a Cloudflare-fronted relay that resets the plain HTTP GET while
@@ -168,20 +212,22 @@ fun RelayGroupChannelListScreen(
    // its de-facto signer — so its relay-signed groups still show while a stray user-published 39000
    // (a different author) stays filtered.
    val channels =
-        remember(allChannels, relayInfo) {
+        remember(allChannels, relayInfo, deletedChannels) {
            val nip11Known = relayInfo.self != null || relayInfo.supported_nips != null
-            if (nip11Known) {
-                allChannels.filter { isRelaySignedRelayGroup(it, relayInfo) }
-            } else {
-                val dominantSigner =
-                    allChannels
-                        .mapNotNull { it.event?.pubKey }
-                        .groupingBy { it }
-                        .eachCount()
-                        .maxByOrNull { it.value }
-                        ?.key
-                if (dominantSigner != null) allChannels.filter { it.event?.pubKey == dominantSigner } else allChannels
-            }
+            val signed =
+                if (nip11Known) {
+                    allChannels.filter { isRelaySignedRelayGroup(it, relayInfo) }
+                } else {
+                    val dominantSigner =
+                        allChannels
+                            .mapNotNull { it.event?.pubKey }
+                            .groupingBy { it }
+                            .eachCount()
+                            .maxByOrNull { it.value }
+                            ?.key
+                    if (dominantSigner != null) allChannels.filter { it.event?.pubKey == dominantSigner } else allChannels
+                }
+            signed.filterNot { it.groupId.toKey() in deletedChannels }
        }

    // Buzz relays expose no public group directory (membership is server-side), so `channels` above
@@ -189,6 +235,15 @@ fun RelayGroupChannelListScreen(
    // (kind-44100) so browsing the relay lists the channels you already belong to — each addable to
    // your kind-10009 list (so it then shows in Messages / Relay Groups). Same screen, one Browse.
    val isBuzz = BuzzRelayDialect.isBuzz(relay) || relayInfo.software?.contains("buzz", ignoreCase = true) == true
+
+    // A Buzz relay lets any community member create a channel/forum (the creator becomes its owner),
+    // and the relay rejects a non-member's kind-9007. We don't hard-gate the "+" on membership: the
+    // NIP-43 roster (kind 13534) isn't fetched on this screen, so gating on it hid the "+" even from
+    // admins. Instead we offer it on any Buzz community and let the relay enforce — the same approach
+    // as the workspace overflow menu (Add people / Invite), whose own doc notes "any member sees them,
+    // the relay only serves the owner/admin ones."
+    val myPubkey = accountViewModel.account.signer.pubKey
+
    val buzzVm: BuzzRelayImportViewModel = viewModel(key = "BuzzImport-${relay.url}")
    LaunchedEffect(relay, isBuzz) { if (isBuzz) buzzVm.bind(accountViewModel.account, relay.url) }
    val buzzChannels by buzzVm.channels.collectAsStateWithLifecycle()
@@ -200,6 +255,12 @@ fun RelayGroupChannelListScreen(
    val dmVm: BuzzDmListViewModel = viewModel(key = "BuzzDmInline-${relay.url}")
    LaunchedEffect(relay, isBuzz) { if (isBuzz) dmVm.bind(accountViewModel.account, relay.url) }
    val dmRows by dmVm.rows.collectAsStateWithLifecycle()
+    val hiddenDmRows by dmVm.hiddenRows.collectAsStateWithLifecycle()
+    // DMs I took off Messages, parked behind a collapsed "Hidden (N)" tail below the section. They
+    // live here and not only on the full inbox screen because that screen sits behind a "see all"
+    // row that never appears until a community has more DMs than fit inline — so without this, a
+    // hidden DM in a small workspace would have no way back at all.
+    var showHiddenDms by remember { mutableStateOf(false) }

    // A Buzz workspace's channels come in three flavours, distinguished by the relay-signed 39000
    // `channel_type`: chat "stream" channels, "forum" channels (threaded posts), and "dm" channels
@@ -209,9 +270,13 @@ fun RelayGroupChannelListScreen(
    // ids so nothing the old flat list showed disappears.
    val channelsById = remember(allChannels) { allChannels.associateBy { it.groupId.id } }
    val buzzGroupIds =
-        remember(buzzChannels, channels) {
+        remember(buzzChannels, channels, deletedChannels) {
            val seen = LinkedHashSet<String>()
-            (buzzChannels + channels.map { it.groupId }).filter { seen.add(it.id) }
+            // `channels` is already delete-filtered; also drop deleted ids from the membership-scoped
+            // `buzzChannels` (kind-44100), which the relay can keep re-announcing after a delete.
+            (buzzChannels + channels.map { it.groupId })
+                .filterNot { it.toKey() in deletedChannels }
+                .filter { seen.add(it.id) }
        }

    fun buzzTypeOf(groupId: GroupId): String? = channelsById[groupId.id]?.event?.buzzChannelType()
@@ -228,21 +293,34 @@ fun RelayGroupChannelListScreen(

    fun buzzSortKey(groupId: GroupId): String = channelsById[groupId.id]?.toBestDisplayName()?.lowercase() ?: groupId.id

+    // Archived channels (relay-signed `archived` tag on the 39000) drop out of their normal section and
+    // gather in a collapsed "Archived" tail — the same hide-from-the-sidebar behavior the Buzz client
+    // has. They stay reachable there so an admin can open one and Unarchive it from the top bar.
+    fun isArchived(groupId: GroupId): Boolean = channelsById[groupId.id]?.isArchived() == true
+
    val buzzChatChannels =
        remember(buzzGroupIds, channelsById, starred) {
            buzzGroupIds
-                .filter { buzzTypeOf(it).let { t -> t != BUZZ_CHANNEL_TYPE_FORUM && t != BUZZ_CHANNEL_TYPE_DM } }
+                .filter { buzzTypeOf(it).let { t -> t != BUZZ_CHANNEL_TYPE_FORUM && t != BUZZ_CHANNEL_TYPE_DM } && !isArchived(it) }
                .sortedWith(compareByDescending<GroupId> { it.id in starred }.thenBy { buzzSortKey(it) })
        }
    val buzzForumChannels =
        remember(buzzGroupIds, channelsById, starred) {
            buzzGroupIds
-                .filter { buzzTypeOf(it) == BUZZ_CHANNEL_TYPE_FORUM }
+                .filter { buzzTypeOf(it) == BUZZ_CHANNEL_TYPE_FORUM && !isArchived(it) }
                .sortedWith(compareByDescending<GroupId> { it.id in starred }.thenBy { buzzSortKey(it) })
        }
+    // Every archived non-DM channel (chat + forum together), newest section at the bottom.
+    val buzzArchivedChannels =
+        remember(buzzGroupIds, channelsById) {
+            buzzGroupIds
+                .filter { buzzTypeOf(it) != BUZZ_CHANNEL_TYPE_DM && isArchived(it) }
+                .sortedBy { buzzSortKey(it) }
+        }

-    // Which sections the user has collapsed (session-scoped). Keyed by section id below.
-    var collapsedSections by remember { mutableStateOf(emptySet<String>()) }
+    // Which sections the user has collapsed (session-scoped). Keyed by section id below. Archived
+    // starts collapsed — it's the out-of-the-way tail, expanded only when someone goes looking.
+    var collapsedSections by remember { mutableStateOf(setOf("archived")) }

    fun toggleSection(key: String) {
        collapsedSections = if (key in collapsedSections) collapsedSections - key else collapsedSections + key
@@ -254,19 +332,54 @@ fun RelayGroupChannelListScreen(
    var showAddPeople by remember { mutableStateOf(false) }

    // Tor-failure escape hatch: a Cloudflare-fronted (or otherwise Tor-hostile) relay times out over
-    // Tor. When Tor is on, the relay isn't an onion, it isn't already trusted, and nothing has loaded
-    // after a grace period, offer to reach it over clearnet — which adds it to the kind-10089 Trusted
-    // Relay List (connected over clearnet even while Tor stays on for everything else).
-    val torType by Amethyst.instance.torPrefs.torType
-        .collectAsStateWithLifecycle(TorType.OFF)
-    val isOnion = remember(relay) { relay.url.contains(".onion") }
-    var connectTimedOut by remember(relay) { mutableStateOf(false) }
-    LaunchedEffect(relay) {
-        delay(TOR_CLEARNET_HINT_DELAY_MS)
-        connectTimedOut = true
+    // Tor. Offer to reach it over clearnet — which adds it to the kind-10089 Trusted Relay List
+    // (connected over clearnet even while Tor stays on for everything else).
+    //
+    // Every input below is a live signal, because a grace timer on its own says nothing about the
+    // relay: the banner used to fire on `torType != OFF && !onion && !trusted` plus a 6s delay, so on
+    // a working, answering relay it appeared after six seconds and never went away — the socket state
+    // was never consulted, and neither was whether this relay is Tor-routed at all (Tor being *on*
+    // doesn't mean this relay goes through it; the per-role presets decide).
+    val torEvaluation =
+        Amethyst.instance.torEvaluatorFlow.flow
+            .collectAsStateWithLifecycle()
+    // The same predicate the relay pool itself dials with, so the banner can't claim Tor for a relay
+    // the app is reaching over clearnet (onion / localhost / trusted-off-Tor are all folded in here).
+    val usesTor by remember(relay) { derivedStateOf { torEvaluation.value.useTor(relay) } }
+
+    // While Tor is bootstrapping every Tor-routed relay is silent — that's Tor's own failure (and its
+    // own dialog), so don't let it read as "this relay blocks Tor exits".
+    val torStatus by Amethyst.instance.torManager.status
+        .collectAsStateWithLifecycle()
+    val torIsUp = torStatus is TorServiceStatus.Active
+
+    // The offer adds the relay to the kind-10089 Trusted list, which only moves it to clearnet while
+    // trusted relays are *off* Tor. Under the Small-Payloads / Full-Privacy presets they are on Tor,
+    // so the button would add an entry and change no routing at all — don't offer what can't help.
+    val trustingMovesToClearnet by remember { derivedStateOf { !torEvaluation.value.torSettings.trustedRelaysViaTor } }
+
+    // Global flow (any relay's connect/disconnect re-emits), so derive this relay's boolean.
+    val connectedRelays =
+        accountViewModel.account.client
+            .connectedRelaysFlow()
+            .collectAsStateWithLifecycle()
+    val isConnected by remember(relay) { derivedStateOf { relay in connectedRelays.value } }
+
+    // Debounced on the *connection* rather than armed once per screen: the countdown restarts every
+    // time the socket drops and clears the moment it comes back, so a reconnect can't flash the
+    // banner, and circuits that die mid-session still surface it. Keying the wait on cached content
+    // instead would have hidden the offer exactly when a working relay went dark with a full screen.
+    var disconnectedLongEnough by remember(relay) { mutableStateOf(false) }
+    LaunchedEffect(relay, isConnected) {
+        if (isConnected) {
+            disconnectedLongEnough = false
+        } else {
+            delay(TOR_CLEARNET_HINT_DELAY_MS)
+            disconnectedLongEnough = true
+        }
    }
    val scope = rememberCoroutineScope()
-    val showTorHint = torType != TorType.OFF && !isOnion && relay !in trustedRelays && connectTimedOut
+    val showTorHint = shouldOfferTorClearnetFallback(usesTor, torIsUp, trustingMovesToClearnet, disconnectedLongEnough)

    // A pinned relay works both as a pushed detail (from the drawer or another screen) and as a
    // bottom-nav tab. Read once here (it is @Composable): the back arrow shows only when pushed;
@@ -309,17 +422,20 @@ fun RelayGroupChannelListScreen(
            }
        },
        floatingActionButton = {
-            FloatingActionButton(onClick = { nav.nav(Route.RelayGroupCreate(relay.url)) }, shape = CircleShape) {
-                Icon(
-                    symbol = MaterialSymbols.Add,
-                    contentDescription =
-                        stringRes(if (isBuzz) R.string.buzz_channel_create_title else R.string.relay_group_create_title),
-                    modifier = Modifier.size(24.dp),
-                )
+            // A Buzz community creates channels/forums from the per-section "+" in their labels (like
+            // Direct Messages), so no FAB there. A vanilla NIP-29 relay is a flat directory with no
+            // sections, so it keeps the FAB to create a group.
+            if (!isBuzz) {
+                FloatingActionButton(onClick = { nav.nav(Route.RelayGroupCreate(relay.url)) }, shape = CircleShape) {
+                    Icon(
+                        symbol = MaterialSymbols.Add,
+                        contentDescription = stringRes(R.string.relay_group_create_title),
+                        modifier = Modifier.size(24.dp),
+                    )
+                }
            }
        },
    ) { padding ->
-        val myPubkey = accountViewModel.userProfile().pubkeyHex
        // A Buzz relay is a community, so always render its sectioned list (Channels, Forums, Direct
        // Messages, Agent Console) even before anything loads, rather than the generic "empty" text.
        if (channels.isEmpty() && !isBuzz) {
@@ -345,7 +461,16 @@ fun RelayGroupChannelListScreen(
                }
            }
        } else {
-            LazyColumn(modifier = Modifier.padding(padding)) {
+            // The Scaffold's `padding` carries the top/bottom bars but deliberately not the FAB — a FAB
+            // overlays content by design, so clearing it is the list's job. As contentPadding (not a
+            // modifier) so rows scroll *through* that strip and only come to rest clear of it; the
+            // modifier form would shrink the viewport and leave the FAB floating over dead space.
+            // Only the vanilla NIP-29 path has a FAB now; a Buzz community creates from its section
+            // headers, so it needs no bottom clearance.
+            LazyColumn(
+                modifier = Modifier.padding(padding),
+                contentPadding = PaddingValues(bottom = if (isBuzz) 0.dp else FAB_CLEARANCE),
+            ) {
                if (showTorHint) {
                    item(key = "tor-hint") {
                        TorClearnetBanner(
@@ -358,16 +483,15 @@ fun RelayGroupChannelListScreen(
                }

                if (isBuzz) {
+                    // While the membership fetch is still running and nothing has loaded, show a
+                    // "Loading…" line. The old "you're not a member — accept the invite in the browser"
+                    // empty text is gone: the section labels below now each carry a "+" to create a
+                    // channel/forum, so an empty community is a starting point, not a dead end.
                    val noChannelsYet = buzzChatChannels.isEmpty() && buzzForumChannels.isEmpty()
-                    if (noChannelsYet) {
-                        item(key = "buzz-no-channels") {
+                    if (noChannelsYet && buzzStatus is BuzzRelayImportViewModel.Status.Loading) {
+                        item(key = "buzz-loading") {
                            Text(
-                                text =
-                                    if (buzzStatus is BuzzRelayImportViewModel.Status.Loading) {
-                                        stringRes(R.string.buzz_import_loading)
-                                    } else {
-                                        stringRes(R.string.buzz_import_empty_body)
-                                    },
+                                text = stringRes(R.string.buzz_import_loading),
                                style = MaterialTheme.typography.bodyMedium,
                                color = MaterialTheme.colorScheme.onSurfaceVariant,
                                modifier = Modifier.fillMaxWidth().padding(24.dp),
@@ -375,53 +499,61 @@ fun RelayGroupChannelListScreen(
                        }
                    }

-                    // -- CHANNELS -- (Add-all now lives in the community's top-bar overflow menu)
-                    if (buzzChatChannels.isNotEmpty()) {
+                    // -- CHANNELS -- The label carries a "+" to create a channel (the community's FAB
+                    // moved here, like Direct Messages). Add-all lives in the top-bar overflow menu.
+                    // The header always shows so the "+" is available even before any channel loads;
+                    // the collapse toggle is offered only when there's something to collapse.
+                    run {
                        val channelsCollapsed = "channels" in collapsedSections
                        item(key = "sec-channels") {
                            RelayGroupSectionHeader(
                                title = stringRes(R.string.relay_group_section_channels),
                                collapsed = channelsCollapsed,
-                                onToggle = { toggleSection("channels") },
-                            )
+                                onToggle = if (buzzChatChannels.isNotEmpty()) ({ toggleSection("channels") }) else null,
+                            ) {
+                                SectionAddButton(stringRes(R.string.buzz_channel_create_title)) {
+                                    nav.nav(Route.RelayGroupCreate(relay.url))
+                                }
+                            }
                        }
-                        if (!channelsCollapsed) {
-                            items(buzzChatChannels, key = { "chat-${it.id}" }) { groupId ->
+                        if (buzzChatChannels.isNotEmpty() && !channelsCollapsed) {
+                            itemsIndexed(buzzChatChannels, key = { _, it -> "chat-${it.id}" }) { index, groupId ->
+                                RowHairline(index)
                                BuzzImportRow(
                                    groupId = groupId,
-                                    isAdded = groupId.id in buzzAdded,
-                                    onAdd = { buzzVm.add(groupId) },
                                    accountViewModel = accountViewModel,
                                    onOpen = { nav.nav(Route.RelayGroup(groupId.id, relay.url)) },
                                    isStarred = groupId.id in starred,
-                                    onToggleStar = { BuzzChannelStars.toggle(groupId.id) },
                                )
                            }
                        }
                    }

-                    // -- FORUMS --
-                    if (buzzForumChannels.isNotEmpty()) {
+                    // -- FORUMS -- Same treatment: an always-visible label with a "+" that starts the
+                    // create flow on a forum channel (threaded posts) instead of a chat one.
+                    run {
                        val forumsCollapsed = "forums" in collapsedSections
                        item(key = "sec-forums") {
                            RelayGroupSectionHeader(
                                title = stringRes(R.string.relay_group_section_forums),
                                collapsed = forumsCollapsed,
-                                onToggle = { toggleSection("forums") },
-                            )
+                                onToggle = if (buzzForumChannels.isNotEmpty()) ({ toggleSection("forums") }) else null,
+                            ) {
+                                SectionAddButton(stringRes(R.string.buzz_forum_create_title)) {
+                                    nav.nav(Route.RelayGroupCreate(relay.url, isForum = true))
+                                }
+                            }
                        }
-                        if (!forumsCollapsed) {
-                            items(buzzForumChannels, key = { "forum-${it.id}" }) { groupId ->
+                        if (buzzForumChannels.isNotEmpty() && !forumsCollapsed) {
+                            itemsIndexed(buzzForumChannels, key = { _, it -> "forum-${it.id}" }) { index, groupId ->
+                                RowHairline(index)
                                BuzzImportRow(
                                    groupId = groupId,
-                                    isAdded = groupId.id in buzzAdded,
-                                    onAdd = { buzzVm.add(groupId) },
                                    accountViewModel = accountViewModel,
                                    // A forum channel's primary content is its threads (kind-45001 posts), not a
                                    // kind-9 chat, so open the forum/threads view directly instead of the chat.
                                    onOpen = { nav.nav(Route.RelayGroupThreads(groupId.id, relay.url)) },
                                    isStarred = groupId.id in starred,
-                                    onToggleStar = { BuzzChannelStars.toggle(groupId.id) },
                                    // Forum posts live in a separate thread store, not the chat notes the
                                    // activity preview reads — so don't warm a kind-9 sub that returns nothing.
                                    showActivityPreview = false,
@@ -430,6 +562,38 @@ fun RelayGroupChannelListScreen(
                        }
                    }

+                    // -- ARCHIVED -- Channels the relay has archived (chat + forum), tucked into a
+                    // collapsed tail. Opening one and using the top-bar Unarchive brings it back.
+                    if (buzzArchivedChannels.isNotEmpty()) {
+                        val archivedCollapsed = "archived" in collapsedSections
+                        item(key = "sec-archived") {
+                            RelayGroupSectionHeader(
+                                title = stringRes(R.string.relay_group_section_archived),
+                                collapsed = archivedCollapsed,
+                                onToggle = { toggleSection("archived") },
+                            )
+                        }
+                        if (!archivedCollapsed) {
+                            itemsIndexed(buzzArchivedChannels, key = { _, it -> "archived-${it.id}" }) { index, groupId ->
+                                RowHairline(index)
+                                val isForum = buzzTypeOf(groupId) == BUZZ_CHANNEL_TYPE_FORUM
+                                BuzzImportRow(
+                                    groupId = groupId,
+                                    accountViewModel = accountViewModel,
+                                    onOpen = {
+                                        if (isForum) {
+                                            nav.nav(Route.RelayGroupThreads(groupId.id, relay.url))
+                                        } else {
+                                            nav.nav(Route.RelayGroup(groupId.id, relay.url))
+                                        }
+                                    },
+                                    isStarred = groupId.id in starred,
+                                    showActivityPreview = !isForum,
+                                )
+                            }
+                        }
+                    }
+
                    // -- DIRECT MESSAGES -- (this community's private conversations, most recent first)
                    item(key = "sec-dms") {
                        RelayGroupSectionHeader(title = stringRes(R.string.buzz_dm_title)) {
@@ -454,8 +618,15 @@ fun RelayGroupChannelListScreen(
                        }
                    } else {
                        val shown = dmRows.take(INLINE_DM_LIMIT)
-                        items(shown, key = { "dm-${it.channelId}" }) { row ->
-                            BuzzDmInlineRow(row, myPubkey, accountViewModel, nav) {
+                        itemsIndexed(shown, key = { _, it -> "dm-${it.channelId}" }) { index, row ->
+                            RowHairline(index)
+                            BuzzDmInlineRow(
+                                row = row,
+                                myPubkey = myPubkey,
+                                isHidden = false,
+                                accountViewModel = accountViewModel,
+                                nav = nav,
+                            ) {
                                nav.nav(Route.RelayGroup(row.channelId, row.relayUrl.url))
                            }
                        }
@@ -468,13 +639,35 @@ fun RelayGroupChannelListScreen(
                            }
                        }
                    }
+                    if (hiddenDmRows.isNotEmpty()) {
+                        item(key = "dm-hidden-header") {
+                            HiddenDmHeader(
+                                count = hiddenDmRows.size,
+                                expanded = showHiddenDms,
+                                onToggle = { showHiddenDms = !showHiddenDms },
+                                modifier = Modifier.padding(horizontal = 16.dp),
+                            )
+                        }
+                        if (showHiddenDms) {
+                            itemsIndexed(hiddenDmRows, key = { _, it -> "dm-hidden-${it.channelId}" }) { index, row ->
+                                RowHairline(index)
+                                BuzzDmInlineRow(
+                                    row = row,
+                                    myPubkey = myPubkey,
+                                    isHidden = true,
+                                    accountViewModel = accountViewModel,
+                                    nav = nav,
+                                ) {
+                                    nav.nav(Route.RelayGroup(row.channelId, row.relayUrl.url))
+                                }
+                            }
+                        }
+                    }
                    // Agent Console now lives in the community's top-bar overflow menu, not a footer card.
                } else {
                    // Vanilla NIP-29 relay: flat channel directory (no forums/DMs/console).
                    itemsIndexed(channels, key = { _, channel -> channel.groupId.id }) { index, channel ->
-                        if (index > 0) {
-                            HorizontalDivider(thickness = 0.25.dp, color = MaterialTheme.colorScheme.outlineVariant)
-                        }
+                        RowHairline(index)
                        RelayGroupChannelRow(channel, myPubkey, accountViewModel) { nav.nav(routeFor(channel)) }
                    }
                }
@@ -493,6 +686,17 @@ fun RelayGroupChannelListScreen(
    }
 }

+/**
+ * The hairline separating two adjacent rows within a section. Drawn *before* row [index], and never
+ * before the first one, so a section's own header keeps providing the separation at its boundaries.
+ */
+@Composable
+private fun RowHairline(index: Int) {
+    if (index > 0) {
+        HorizontalDivider(thickness = 0.25.dp, color = MaterialTheme.colorScheme.outlineVariant)
+    }
+}
+
 /** A first screen's worth of a community's DMs shown inline; the rest live behind the See-all row. */
 private const val INLINE_DM_LIMIT = 6

@@ -570,16 +774,40 @@ private fun RelayGroupSectionHeader(
    }
 }

+/**
+ * The trailing "+" for a section label (Channels / Forums), matching the Direct Messages header's
+ * New-message icon: a primary-tinted Add glyph that creates a new item of that section's type.
+ */
+@Composable
+private fun SectionAddButton(
+    contentDescription: String,
+    onClick: () -> Unit,
+) {
+    IconButton(onClick = onClick) {
+        Icon(
+            symbol = MaterialSymbols.Add,
+            contentDescription = contentDescription,
+            tint = MaterialTheme.colorScheme.primary,
+            modifier = Modifier.size(22.dp),
+        )
+    }
+}
+
 /**
 * One inline Direct-Message conversation row inside the community view: the counterpart's avatar +
 * name (or a "+N" cluster label for a group DM), a preview of the last message, and a compact
 * last-activity time. The channel's recent content is warmed while the row is visible so the preview
- * fills in ahead of a tap. Tapping opens the DM as its relay-group chat.
+ * fills in ahead of a tap. Tapping opens the DM as its relay-group chat; the Add/Remove-from-Messages
+ * (hide/unhide) action lives in that chat screen's top-bar overflow, not on this row.
+ *
+ * [isHidden] renders the row faded — a hidden DM is a live conversation the viewer merely parked, so
+ * it stays openable and reversible from the opened conversation.
 */
@Composable
 private fun BuzzDmInlineRow(
    row: BuzzDmListViewModel.DmRow,
    myPubkey: HexKey,
+    isHidden: Boolean,
    accountViewModel: AccountViewModel,
    nav: INav,
    onClick: () -> Unit,
@@ -612,7 +840,8 @@ private fun BuzzDmInlineRow(
            Modifier
                .fillMaxWidth()
                .clickable(onClick = onClick)
-                .padding(horizontal = 16.dp, vertical = 10.dp),
+                .padding(start = 16.dp, end = 16.dp, top = 10.dp, bottom = 10.dp)
+                .alpha(if (isHidden) 0.55f else 1f),
        verticalAlignment = Alignment.CenterVertically,
        horizontalArrangement = Arrangement.spacedBy(12.dp),
    ) {
@@ -97,10 +97,15 @@ fun RelayGroupCreateScreen(
    relayUrl: String,
    accountViewModel: AccountViewModel,
    nav: INav,
+    // Buzz only: pre-select the `forum` channel type (the Forums section's "+" routes here with true).
+    isForum: Boolean = false,
 ) {
    val relay = remember(relayUrl) { RelayUrlNormalizer.normalizeOrNull(relayUrl) } ?: return
    val viewModel: RelayGroupMetadataViewModel = viewModel(key = "RelayGroupCreate:$relayUrl")
-    LaunchedEffect(relay) { viewModel.initCreate(accountViewModel, relay) }
+    LaunchedEffect(relay) {
+        viewModel.initCreate(accountViewModel, relay)
+        if (isForum) viewModel.isForum = true
+    }

    // A group only works if the relay actually runs NIP-29 (otherwise it stores our 9007/9002 as
    // ordinary events, never emits metadata/roster, and the "group" is a dead hex id). Gate creation
@@ -197,8 +202,15 @@ private fun RelayGroupMetadataScaffold(
    Scaffold(
        topBar = {
            if (viewModel.isNewGroup) {
+                // The type is fixed by the caller (the community's per-section "+"), so the title names
+                // it — "New forum" vs "New channel" on Buzz — rather than offering a toggle to change it.
                CreatingTopBar(
-                    titleRes = if (viewModel.isBuzzRelay) R.string.buzz_channel_create_title else R.string.relay_group_create_title,
+                    titleRes =
+                        when {
+                            !viewModel.isBuzzRelay -> R.string.relay_group_create_title
+                            viewModel.isForum -> R.string.buzz_forum_create_title
+                            else -> R.string.buzz_channel_create_title
+                        },
                    isActive = { viewModel.canPost && (nip29Support == true || viewModel.isBuzzRelay) },
                    onCancel = nav::popBack,
                    onPost = onSubmit,
@@ -410,21 +422,11 @@ private fun GroupMetadataFields(viewModel: RelayGroupMetadataViewModel) {
        viewModel.markTouched()
    }

-    if (viewModel.isBuzzRelay) {
-        // Buzz's `channel_type`. Only offered on create: the relay takes it on the 9007 and its
-        // 9002 handler has no `channel_type` key, so an existing channel cannot be converted.
-        if (viewModel.isNewGroup) {
-            LabeledSwitchRow(
-                label = stringRes(R.string.buzz_channel_flag_forum),
-                description = stringRes(R.string.buzz_channel_flag_forum_desc),
-                checked = viewModel.isForum,
-            ) {
-                viewModel.isForum = it
-                viewModel.markTouched()
-            }
-        }
-        return
-    }
+    // A Buzz channel's type (chat vs forum) is fixed by the caller — the community's per-section "+" —
+    // and isn't editable (the relay's 9002 has no `channel_type` key), so there's no toggle here. The
+    // remaining vanilla NIP-29 flags (invite-only / restricted below) don't apply to Buzz either, so
+    // stop here for a Buzz relay.
+    if (viewModel.isBuzzRelay) return

    LabeledSwitchRow(
        label = stringRes(R.string.relay_group_flag_invite_only),
@@ -34,15 +34,20 @@ import androidx.compose.foundation.lazy.LazyListState
 import androidx.compose.foundation.lazy.itemsIndexed
 import androidx.compose.foundation.lazy.rememberLazyListState
 import androidx.compose.foundation.shape.CircleShape
+import androidx.compose.material3.DropdownMenu
+import androidx.compose.material3.DropdownMenuItem
 import androidx.compose.material3.FloatingActionButton
 import androidx.compose.material3.HorizontalDivider
+import androidx.compose.material3.IconButton
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.Scaffold
 import androidx.compose.material3.Text
 import androidx.compose.runtime.Composable
 import androidx.compose.runtime.LaunchedEffect
 import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
 import androidx.compose.runtime.remember
+import androidx.compose.runtime.setValue
 import androidx.compose.runtime.snapshotFlow
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
@@ -57,6 +62,7 @@ import com.vitorpamplona.amethyst.commons.icons.symbols.MaterialSymbols
 import com.vitorpamplona.amethyst.commons.model.Note
 import com.vitorpamplona.amethyst.commons.model.buzz.BuzzRelayDialect
 import com.vitorpamplona.amethyst.commons.model.nip29RelayGroups.RelayGroupChannel
+import com.vitorpamplona.amethyst.commons.model.nip29RelayGroups.RelayGroupMembership
 import com.vitorpamplona.amethyst.service.relayClient.reqCommand.event.observeNoteReplyCount
 import com.vitorpamplona.amethyst.ui.navigation.navs.INav
 import com.vitorpamplona.amethyst.ui.navigation.routes.Route
@@ -166,6 +172,37 @@ private fun RelayGroupThreads(
                        )
                    }
                },
+                actions = {
+                    // The forum's per-item actions, moved off the community-list row into this screen's
+                    // top-bar overflow: Pin/Unpin and the Add/Remove-from-Messages toggle, plus the
+                    // admin-only Archive/Unarchive (so an archived forum can be brought back from here).
+                    // Buzz-only, which every forum channel is.
+                    if (isBuzz) {
+                        var menuOpen by remember { mutableStateOf(false) }
+                        val isAdmin = channel.membershipOf(accountViewModel.userProfile().pubkeyHex) == RelayGroupMembership.ADMIN
+                        IconButton(onClick = { menuOpen = true }) {
+                            Icon(
+                                symbol = MaterialSymbols.MoreVert,
+                                contentDescription = stringRes(R.string.more_options),
+                                modifier = Modifier.size(22.dp),
+                            )
+                        }
+                        DropdownMenu(expanded = menuOpen, onDismissRequest = { menuOpen = false }) {
+                            BuzzPinDropdownItem(channel.groupId) { menuOpen = false }
+                            RelayGroupMessagesDropdownItem(channel, accountViewModel) { menuOpen = false }
+                            if (isAdmin) {
+                                val archived = channel.isArchived()
+                                DropdownMenuItem(
+                                    text = { Text(stringRes(if (archived) R.string.buzz_channel_unarchive else R.string.buzz_channel_archive)) },
+                                    onClick = {
+                                        menuOpen = false
+                                        accountViewModel.archiveRelayGroup(channel, !archived)
+                                    },
+                                )
+                            }
+                        }
+                    }
+                },
                popBack = nav::popBack,
            )
        },
@@ -28,6 +28,7 @@ import androidx.compose.foundation.layout.Row
 import androidx.compose.foundation.layout.padding
 import androidx.compose.foundation.layout.size
 import androidx.compose.foundation.shape.RoundedCornerShape
+import androidx.compose.material3.AlertDialog
 import androidx.compose.material3.DropdownMenu
 import androidx.compose.material3.DropdownMenuItem
 import androidx.compose.material3.FilledTonalButton
@@ -35,6 +36,7 @@ import androidx.compose.material3.IconButton
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.Surface
 import androidx.compose.material3.Text
+import androidx.compose.material3.TextButton
 import androidx.compose.runtime.Composable
 import androidx.compose.runtime.LaunchedEffect
 import androidx.compose.runtime.State
@@ -51,6 +53,7 @@ import androidx.lifecycle.compose.collectAsStateWithLifecycle
 import com.vitorpamplona.amethyst.R
 import com.vitorpamplona.amethyst.commons.icons.symbols.Icon
 import com.vitorpamplona.amethyst.commons.icons.symbols.MaterialSymbols
+import com.vitorpamplona.amethyst.commons.model.buzz.BuzzDmRegistry
 import com.vitorpamplona.amethyst.commons.model.buzz.BuzzRelayDialect
 import com.vitorpamplona.amethyst.commons.model.buzz.BuzzWorkspaceStates
 import com.vitorpamplona.amethyst.commons.model.nip29RelayGroups.RelayGroupChannel
@@ -112,8 +115,19 @@ fun RelayGroupTopBar(
    val dmOther = if (isDm) channel.event?.buzzParticipants()?.firstOrNull { it != myPubkey } else null

    var menuOpen by remember { mutableStateOf(false) }
+    // My kind-10009 list, live: drives the Add/Remove-from-Messages toggle in the overflow below.
+    val joinedGroupIds by accountViewModel.account.relayGroupList.liveRelayGroupIds
+        .collectAsStateWithLifecycle()
+    // A Buzz DM is hidden via its own per-viewer 30622 snapshot, not the kind-10009 list, so the
+    // Messages toggle branches on this for DMs.
+    val hiddenDms by BuzzDmRegistry.hidden.collectAsStateWithLifecycle()
+    // Read once here (nav.canPop() is @Composable) so the post-action navigation can pop from a menu
+    // callback — leaving a group shouldn't strand the user on the screen of a group they left.
+    val canPop = nav.canPop()
    var showInvite by remember { mutableStateOf(false) }
    var showJoinCode by remember { mutableStateOf(false) }
+    var confirmDelete by remember { mutableStateOf(false) }
+    val isBuzzRelay = remember(channel.groupId.relayUrl) { BuzzRelayDialect.isBuzz(channel.groupId.relayUrl) }

    TopBarExtensibleWithBackButton(
        title = {
@@ -181,7 +195,6 @@ fun RelayGroupTopBar(
            // outright. So a DM shows the icon only when a canvas already exists — which is also what
            // keeps us from advertising "start a shared doc" in a two-person conversation.
            val hasCanvas by observeBuzzCanvas(channel.groupId.id)
-            val isBuzzRelay = remember(channel.groupId.relayUrl) { BuzzRelayDialect.isBuzz(channel.groupId.relayUrl) }
            if (isBuzzRelay && (!isDm || hasCanvas)) {
                IconButton(onClick = { nav.nav(Route.BuzzCanvas(channel.groupId.id, channel.groupId.relayUrl.url)) }) {
                    Icon(
@@ -228,7 +241,9 @@ fun RelayGroupTopBar(
            // Buzz `t=stream` channel it is always empty (forum posts live in `t=forum` channels, which
            // the relay's channel list already surfaces in their own section), so it read as a broken
            // feature on every chat. Demoted to the overflow, where the frequency of use actually is.
-            if (!isDm || naddr != null || showMembershipActions) {
+            // A Buzz DM always gets the overflow too — its hide/unhide (below) is the DM row's old
+            // action, and it must be reachable even where the membership actions aren't offered.
+            if (!isDm || naddr != null || showMembershipActions || (isDm && isBuzzRelay)) {
                IconButton(onClick = { menuOpen = true }) {
                    Icon(
                        symbol = MaterialSymbols.MoreVert,
@@ -237,6 +252,33 @@ fun RelayGroupTopBar(
                    )
                }
                DropdownMenu(expanded = menuOpen, onDismissRequest = { menuOpen = false }) {
+                    // Pin/Unpin moved here off the community-list row. A local favorite, so it's offered
+                    // for any Buzz channel/forum regardless of membership; DMs are never pinned.
+                    if (isBuzzRelay && !isDm) {
+                        BuzzPinDropdownItem(channel.groupId) { menuOpen = false }
+                    }
+                    // A DM's Add/Remove-from-Messages, moved off the DM list row. It rides the per-viewer
+                    // 30622 hide snapshot (kind-41012 hide / re-open), not the kind-10009 list, and is
+                    // shown regardless of the membership gate below.
+                    if (isBuzzRelay && isDm) {
+                        val dmHidden = channel.groupId.id in (hiddenDms[myPubkey] ?: emptySet())
+                        DropdownMenuItem(
+                            text = { Text(stringRes(if (dmHidden) R.string.add_to_messages else R.string.remove_from_messages)) },
+                            onClick = {
+                                menuOpen = false
+                                if (dmHidden) {
+                                    val participants =
+                                        channel.event
+                                            ?.buzzParticipants()
+                                            ?.filter { it != myPubkey }
+                                            .orEmpty()
+                                    accountViewModel.unhideBuzzDm(channel.groupId.relayUrl, participants.ifEmpty { listOf(myPubkey) })
+                                } else {
+                                    accountViewModel.hideBuzzDm(channel)
+                                }
+                            },
+                        )
+                    }
                    if (!isDm) {
                        DropdownMenuItem(
                            text = { Text(stringRes(R.string.relay_group_threads_title)) },
@@ -296,13 +338,68 @@ fun RelayGroupTopBar(
                                },
                            )
                        }
+                        // Two distinct actions, never conflated: the Messages toggle adds/drops the group
+                        // on my kind-10009 list but keeps my relay membership either way; "Leave" sends
+                        // the kind-9022 that actually removes me. Same split as the channel-invite card.
+                        // (A DM's Messages toggle is the hide/unhide item above — it rides a different
+                        // mechanism and must show even when these membership actions don't.)
+                        //
+                        // Reads the live kind-10009 list rather than assuming the group is on it: this
+                        // bar also opens for channels reached from the workspace browse (a Buzz relay
+                        // lists every channel you're a member of, joined or not) and for ones you removed
+                        // earlier — both need the "Add" half. And because it's a reversible toggle, remove
+                        // does NOT pop back: you're still a member reading the channel, and staying is
+                        // what makes the entry flip so the action is visibly undoable. Leave still pops.
+                        val onMyList = channel.groupId in joinedGroupIds
                        DropdownMenuItem(
-                            text = { Text(stringRes(R.string.leave)) },
+                            text = { Text(stringRes(if (onMyList) R.string.remove_from_messages else R.string.add_to_messages)) },
+                            onClick = {
+                                menuOpen = false
+                                if (onMyList) {
+                                    accountViewModel.removeRelayGroupFromMessages(channel)
+                                } else {
+                                    accountViewModel.addRelayGroupToMessages(channel)
+                                }
+                            },
+                        )
+                        DropdownMenuItem(
+                            text = { Text(stringRes(R.string.leave), color = MaterialTheme.colorScheme.error) },
                            onClick = {
                                menuOpen = false
                                accountViewModel.leaveRelayGroup(channel)
+                                if (canPop) nav.popBack()
                            },
                        )
+                        // Archive/Unarchive (kind-9002 `archived` tag) — a reversible hide-from-the-sidebar,
+                        // Buzz-only and admin-gated like Delete but NOT destructive, so no confirm dialog.
+                        // A DM is never archived (it has its own hide), so this is channels/forums only.
+                        if (isBuzzRelay && !isDm && displayMembership == RelayGroupMembership.ADMIN) {
+                            val archived = channel.isArchived()
+                            DropdownMenuItem(
+                                text = { Text(stringRes(if (archived) R.string.buzz_channel_unarchive else R.string.buzz_channel_archive)) },
+                                onClick = {
+                                    menuOpen = false
+                                    accountViewModel.archiveRelayGroup(channel, !archived)
+                                },
+                            )
+                        }
+                        // Deleting the whole channel/group (kind-9008) is destructive for everyone, so it's
+                        // shown ONLY to an admin/owner — the same authorization gate as Edit above — and
+                        // routed through a confirmation dialog rather than firing on tap.
+                        if (displayMembership == RelayGroupMembership.ADMIN) {
+                            DropdownMenuItem(
+                                text = {
+                                    Text(
+                                        text = stringRes(if (isBuzzRelay) R.string.buzz_channel_delete else R.string.relay_group_delete),
+                                        color = MaterialTheme.colorScheme.error,
+                                    )
+                                },
+                                onClick = {
+                                    menuOpen = false
+                                    confirmDelete = true
+                                },
+                            )
+                        }
                    }
                }
            }
@@ -324,6 +421,36 @@ fun RelayGroupTopBar(
            onDismiss = { showJoinCode = false },
        )
    }
+
+    if (confirmDelete) {
+        val deleteLabel = stringRes(if (isBuzzRelay) R.string.buzz_channel_delete else R.string.relay_group_delete)
+        AlertDialog(
+            onDismissRequest = { confirmDelete = false },
+            title = { Text(deleteLabel) },
+            text = {
+                Text(
+                    stringRes(
+                        if (isBuzzRelay) R.string.buzz_channel_delete_confirm else R.string.relay_group_delete_confirm,
+                        channel.toBestDisplayName(),
+                    ),
+                )
+            },
+            confirmButton = {
+                TextButton(onClick = {
+                    confirmDelete = false
+                    accountViewModel.deleteRelayGroup(channel)
+                    if (canPop) nav.popBack()
+                }) {
+                    Text(deleteLabel, color = MaterialTheme.colorScheme.error)
+                }
+            },
+            dismissButton = {
+                TextButton(onClick = { confirmDelete = false }) {
+                    Text(stringRes(R.string.cancel))
+                }
+            },
+        )
+    }
 }

 /** Title for a Buzz DM: the OTHER participant's display name (reactive), falling back to the channel name. */
@@ -26,7 +26,6 @@ import com.vitorpamplona.amethyst.model.LocalCache
 import com.vitorpamplona.amethyst.model.Note
 import com.vitorpamplona.amethyst.ui.dal.sortedByDefaultFeedOrder
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.chats.isMinichatReply
-import com.vitorpamplona.quartz.nip01Core.core.HexKey
 import com.vitorpamplona.quartz.nip01Core.relay.normalizer.NormalizedRelayUrl
 import com.vitorpamplona.quartz.nip01Core.relay.normalizer.RelayUrlNormalizer
 import com.vitorpamplona.quartz.nip29RelayGroups.GroupId
@@ -112,29 +111,6 @@ fun RelayGroupChannel.newestTimelineNote(account: Account): Note? =
        .sortedByDefaultFeedOrder()
        .firstOrNull()

-/**
- * The pubkeys of the [limit] most-recent distinct posters in this group, newest first — the facepile
- * shown on a channel row. One O(notes) pass keeps each author's latest post time, so a chatty author
- * counts once (at their newest message) rather than crowding out quieter voices.
- */
-fun RelayGroupChannel.recentAuthorHexes(
-    account: Account,
-    limit: Int,
-): List<HexKey> {
-    val latestByAuthor = HashMap<HexKey, Long>()
-    for (note in notes.values()) {
-        if (!isRelayGroupTimelineMessage(note, account)) continue
-        val author = note.author?.pubkeyHex ?: continue
-        val at = note.createdAt() ?: continue
-        val prev = latestByAuthor[author]
-        if (prev == null || at > prev) latestByAuthor[author] = at
-    }
-    return latestByAuthor.entries
-        .sortedByDescending { it.value }
-        .take(limit)
-        .map { it.key }
-}
-
 /** Whether this group's message store holds any acceptable timeline message created after [sinceSecs]. */
 private fun RelayGroupChannel.hasChatNewerThan(
    account: Account,
@@ -0,0 +1,85 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.ui.screen.loggedIn.chats.publicChannels.relayGroup
+
+import androidx.compose.foundation.clickable
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.layout.size
+import androidx.compose.foundation.layout.widthIn
+import androidx.compose.foundation.shape.RoundedCornerShape
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.Surface
+import androidx.compose.material3.Text
+import androidx.compose.runtime.Composable
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.text.style.TextOverflow
+import androidx.compose.ui.unit.dp
+import com.vitorpamplona.amethyst.commons.icons.symbols.Icon
+import com.vitorpamplona.amethyst.commons.icons.symbols.MaterialSymbols
+import com.vitorpamplona.amethyst.ui.theme.ChatLabelMaxWidth
+
+/**
+ * A tappable chip naming the relay a NIP-29 / Buzz group lives on. A group id is only unique within
+ * its host relay, so the relay is part of the room's identity — the same `#general` can exist on two
+ * Buzz servers and only this chip tells them apart.
+ *
+ * Wears the same highlighted wash as [com.vitorpamplona.amethyst.ui.screen.loggedIn.chats.publicChannels.concord.ConcordCommunityPill]
+ * so every "which server / community does this room belong to" chip reads the same way. Unlike the
+ * muted note-header [com.vitorpamplona.amethyst.commons.ui.note.HeaderPill] (PoW/OTS/location
+ * markers), this one is a first-class navigation entry point, so it keeps the stronger
+ * `secondaryContainer` highlight. Shared by the Messages row and the Notifications feed so a Buzz
+ * message reads the same wherever it surfaces; the width is capped at [ChatLabelMaxWidth] with a
+ * middle ellipsis so a long host is truncated instead of crowding the channel name out.
+ */
+@Composable
+fun RelayNameChip(
+    label: String,
+    onClick: () -> Unit,
+) {
+    Surface(
+        shape = RoundedCornerShape(6.dp),
+        color = MaterialTheme.colorScheme.secondaryContainer,
+        modifier = Modifier.widthIn(max = ChatLabelMaxWidth).clickable(onClick = onClick),
+    ) {
+        Row(
+            verticalAlignment = Alignment.CenterVertically,
+            horizontalArrangement = Arrangement.spacedBy(3.dp),
+            modifier = Modifier.padding(horizontal = 6.dp, vertical = 2.dp),
+        ) {
+            Icon(
+                symbol = MaterialSymbols.Dns,
+                contentDescription = null,
+                tint = MaterialTheme.colorScheme.onSecondaryContainer,
+                modifier = Modifier.size(11.dp),
+            )
+            Text(
+                text = label,
+                style = MaterialTheme.typography.labelSmall,
+                color = MaterialTheme.colorScheme.onSecondaryContainer,
+                maxLines = 1,
+                overflow = TextOverflow.MiddleEllipsis,
+            )
+        }
+    }
+}
@@ -20,22 +20,16 @@
 */
 package com.vitorpamplona.amethyst.ui.screen.loggedIn.chats.rooms

-import androidx.compose.foundation.clickable
-import androidx.compose.foundation.layout.Arrangement
 import androidx.compose.foundation.layout.Box
 import androidx.compose.foundation.layout.Row
 import androidx.compose.foundation.layout.RowScope
 import androidx.compose.foundation.layout.Spacer
-import androidx.compose.foundation.layout.padding
-import androidx.compose.foundation.layout.size
 import androidx.compose.foundation.layout.width
 import androidx.compose.foundation.layout.widthIn
-import androidx.compose.foundation.shape.RoundedCornerShape
 import androidx.compose.material3.DropdownMenu
 import androidx.compose.material3.DropdownMenuItem
 import androidx.compose.material3.LocalTextStyle
 import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.Surface
 import androidx.compose.material3.Text
 import androidx.compose.runtime.Composable
 import androidx.compose.runtime.LaunchedEffect
@@ -93,10 +87,12 @@ import com.vitorpamplona.amethyst.ui.screen.loggedIn.chats.marmotGroup.rememberM
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.chats.privateDM.header.RoomNameDisplay
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.chats.privateDM.header.reportWarningContentDescription
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.chats.publicChannels.concord.ConcordCommunityPill
+import com.vitorpamplona.amethyst.ui.screen.loggedIn.chats.publicChannels.concord.ConcordLeaveDialog
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.chats.publicChannels.concord.concordChannelLastReadRoute
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.chats.publicChannels.concord.concordCommunityHasUnreadFlow
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.chats.publicChannels.concord.rememberConcordImageModel
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.chats.publicChannels.ephemChat.LoadEphemeralChatChannel
+import com.vitorpamplona.amethyst.ui.screen.loggedIn.chats.publicChannels.relayGroup.RelayNameChip
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.chats.publicChannels.relayGroup.relayGroupChannelLastReadRoute
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.chats.publicChannels.relayGroup.relayGroupServerHasUnreadFlow
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.chats.rooms.dal.ConcordServerRoomNote
@@ -489,36 +485,61 @@ private fun RelayGroupRoomCompose(
    // A placeholder row (no messages yet) has a null createdAt and never lights the dot.
    val lastReadTime by accountViewModel.account.loadLastReadFlow(relayGroupChannelLastReadRoute(channel.groupId)).collectAsStateWithLifecycle()

-    ChannelName(
-        channelIdHex = channel.groupId.id,
-        channelPicture = channelPicture,
-        channelTitle = { modifier ->
-            Row(verticalAlignment = Alignment.CenterVertically, modifier = modifier) {
-                Text(
-                    text = channel.toBestDisplayName(),
-                    fontWeight = FontWeight.Bold,
-                    maxLines = 1,
-                    overflow = TextOverflow.Ellipsis,
-                    modifier = Modifier.weight(1f, fill = false),
-                )
-                Spacer(Modifier.width(6.dp))
-                RelayNameChip(
-                    label = channel.groupId.relayUrl.displayUrl(),
-                    onClick = { nav.nav(Route.RelayGroupServer(channel.groupId.relayUrl.url)) },
-                )
-            }
-        },
-        channelLastTime = lastMessage.createdAt(),
-        channelLastContent = lastContent,
-        hasNewMessages = (lastMessage.createdAt() ?: Long.MIN_VALUE) > lastReadTime,
-        loadProfilePicture = accountViewModel.settings.showProfilePictures(),
-        loadRobohash = accountViewModel.settings.isNotPerformanceMode(),
-        autoPlayGif =
-            accountViewModel.settings.autoPlayVideosFlow
-                .collectAsStateWithLifecycle()
-                .value,
-        onClick = { nav.nav(Route.RelayGroup(channel.groupId.id, channel.groupId.relayUrl.url)) },
-    )
+    // Long-press brings the group's membership actions to the Messages row itself, mirroring the group
+    // top bar so "Remove from Messages" (drop from my list, stay a member) and "Leave" (kind-9022) are
+    // reachable without opening the group first.
+    var menuOpen by remember { mutableStateOf(false) }
+
+    Box {
+        ChannelName(
+            channelIdHex = channel.groupId.id,
+            channelPicture = channelPicture,
+            channelTitle = { modifier ->
+                Row(verticalAlignment = Alignment.CenterVertically, modifier = modifier) {
+                    Text(
+                        text = channel.toBestDisplayName(),
+                        fontWeight = FontWeight.Bold,
+                        maxLines = 1,
+                        overflow = TextOverflow.Ellipsis,
+                        modifier = Modifier.weight(1f, fill = false),
+                    )
+                    Spacer(Modifier.width(6.dp))
+                    RelayNameChip(
+                        label = channel.groupId.relayUrl.displayUrl(),
+                        onClick = { nav.nav(Route.RelayGroupServer(channel.groupId.relayUrl.url)) },
+                    )
+                }
+            },
+            channelLastTime = lastMessage.createdAt(),
+            channelLastContent = lastContent,
+            hasNewMessages = (lastMessage.createdAt() ?: Long.MIN_VALUE) > lastReadTime,
+            loadProfilePicture = accountViewModel.settings.showProfilePictures(),
+            loadRobohash = accountViewModel.settings.isNotPerformanceMode(),
+            autoPlayGif =
+                accountViewModel.settings.autoPlayVideosFlow
+                    .collectAsStateWithLifecycle()
+                    .value,
+            onClick = { nav.nav(Route.RelayGroup(channel.groupId.id, channel.groupId.relayUrl.url)) },
+            onLongClick = { menuOpen = true },
+        )
+
+        DropdownMenu(expanded = menuOpen, onDismissRequest = { menuOpen = false }) {
+            DropdownMenuItem(
+                text = { Text(stringRes(R.string.remove_from_messages)) },
+                onClick = {
+                    menuOpen = false
+                    accountViewModel.removeRelayGroupFromMessages(channel)
+                },
+            )
+            DropdownMenuItem(
+                text = { Text(stringRes(R.string.leave), color = MaterialTheme.colorScheme.error) },
+                onClick = {
+                    menuOpen = false
+                    accountViewModel.leaveRelayGroup(channel)
+                },
+            )
+        }
+    }
 }

@Composable
@@ -550,40 +571,78 @@ private fun ConcordRoomCompose(
        .loadLastReadFlow(concordChannelLastReadRoute(channel.channelId.communityId, channel.channelId.channelId))
        .collectAsStateWithLifecycle()

-    ChannelName(
-        channelIdHex = channel.channelId.channelId,
-        channelPicture = rememberConcordImageModel(channel.communityIcon, accountViewModel),
-        channelTitle = { modifier ->
-            Row(verticalAlignment = Alignment.CenterVertically, modifier = modifier) {
-                Text(
-                    text = channel.toBestDisplayName(),
-                    fontWeight = FontWeight.Bold,
-                    maxLines = 1,
-                    overflow = TextOverflow.Ellipsis,
-                    modifier = Modifier.weight(1f, fill = false),
-                )
-                channel.communityName?.let { communityName ->
-                    Spacer(Modifier.width(6.dp))
-                    // The chip names the parent community and, when tapped, opens that community's
-                    // channel list — the "chip that opens the Concord Channel" entry point.
-                    ConcordCommunityPill(
-                        communityName = communityName,
-                        onClick = { nav.nav(Route.ConcordServer(channel.channelId.communityId)) },
+    // Concord has no server-side membership beyond my own kind-13302 list, so there is no soft
+    // "Remove from Messages" distinct from leaving — the only action is "Leave" (drop the community
+    // from my list = I'm out). Long-press surfaces it on the row with the same confirm the community
+    // screen uses; leaving a channel row leaves the whole community it belongs to (the dialog names it).
+    val communityId = channel.channelId.communityId
+    val isOwner =
+        accountViewModel.account.concordSessions
+            .sessionFor(communityId)
+            ?.entry
+            ?.owner == accountViewModel.account.signer.pubKey
+    var menuOpen by remember { mutableStateOf(false) }
+    var showLeave by remember { mutableStateOf(false) }
+
+    if (showLeave) {
+        ConcordLeaveDialog(
+            communityName = channel.communityName ?: channel.toBestDisplayName(),
+            isOwner = isOwner,
+            onDismiss = { showLeave = false },
+            onConfirm = {
+                showLeave = false
+                accountViewModel.leaveConcordCommunity(communityId)
+            },
+        )
+    }
+
+    Box {
+        ChannelName(
+            channelIdHex = channel.channelId.channelId,
+            channelPicture = rememberConcordImageModel(channel.communityIcon, accountViewModel),
+            channelTitle = { modifier ->
+                Row(verticalAlignment = Alignment.CenterVertically, modifier = modifier) {
+                    Text(
+                        text = channel.toBestDisplayName(),
+                        fontWeight = FontWeight.Bold,
+                        maxLines = 1,
+                        overflow = TextOverflow.Ellipsis,
+                        modifier = Modifier.weight(1f, fill = false),
                    )
+                    channel.communityName?.let { communityName ->
+                        Spacer(Modifier.width(6.dp))
+                        // The chip names the parent community and, when tapped, opens that community's
+                        // channel list — the "chip that opens the Concord Channel" entry point.
+                        ConcordCommunityPill(
+                            communityName = communityName,
+                            onClick = { nav.nav(Route.ConcordServer(channel.channelId.communityId)) },
+                        )
+                    }
                }
-            }
-        },
-        channelLastTime = lastMessage.createdAt(),
-        channelLastContent = lastContent,
-        hasNewMessages = (lastMessage.createdAt() ?: Long.MIN_VALUE) > lastReadTime,
-        loadProfilePicture = accountViewModel.settings.showProfilePictures(),
-        loadRobohash = accountViewModel.settings.isNotPerformanceMode(),
-        autoPlayGif =
-            accountViewModel.settings.autoPlayVideosFlow
-                .collectAsStateWithLifecycle()
-                .value,
-        onClick = { nav.nav(Route.Concord(channel.channelId.communityId, channel.channelId.channelId)) },
-    )
+            },
+            channelLastTime = lastMessage.createdAt(),
+            channelLastContent = lastContent,
+            hasNewMessages = (lastMessage.createdAt() ?: Long.MIN_VALUE) > lastReadTime,
+            loadProfilePicture = accountViewModel.settings.showProfilePictures(),
+            loadRobohash = accountViewModel.settings.isNotPerformanceMode(),
+            autoPlayGif =
+                accountViewModel.settings.autoPlayVideosFlow
+                    .collectAsStateWithLifecycle()
+                    .value,
+            onClick = { nav.nav(Route.Concord(channel.channelId.communityId, channel.channelId.channelId)) },
+            onLongClick = { menuOpen = true },
+        )
+
+        DropdownMenu(expanded = menuOpen, onDismissRequest = { menuOpen = false }) {
+            DropdownMenuItem(
+                text = { Text(stringRes(R.string.leave), color = MaterialTheme.colorScheme.error) },
+                onClick = {
+                    menuOpen = false
+                    showLeave = true
+                },
+            )
+        }
+    }
 }

@Composable
@@ -682,43 +741,6 @@ private fun ConcordServerRoomCompose(
    )
 }

-/**
- * A tappable chip naming the server/community a Messages row belongs to. Unlike the muted
- * note-header [HeaderPill] (PoW/OTS/location markers), this one is a first-class navigation entry
- * point, so it keeps the stronger `secondaryContainer` highlight.
- */
-@Composable
-private fun RelayNameChip(
-    label: String,
-    onClick: () -> Unit,
-) {
-    Surface(
-        shape = RoundedCornerShape(6.dp),
-        color = MaterialTheme.colorScheme.secondaryContainer,
-        modifier = Modifier.widthIn(max = ChatLabelMaxWidth).clickable(onClick = onClick),
-    ) {
-        Row(
-            verticalAlignment = Alignment.CenterVertically,
-            horizontalArrangement = Arrangement.spacedBy(3.dp),
-            modifier = Modifier.padding(horizontal = 6.dp, vertical = 2.dp),
-        ) {
-            Icon(
-                symbol = MaterialSymbols.Dns,
-                contentDescription = null,
-                tint = MaterialTheme.colorScheme.onSecondaryContainer,
-                modifier = Modifier.size(11.dp),
-            )
-            Text(
-                text = label,
-                style = MaterialTheme.typography.labelSmall,
-                color = MaterialTheme.colorScheme.onSecondaryContainer,
-                maxLines = 1,
-                overflow = TextOverflow.MiddleEllipsis,
-            )
-        }
-    }
-}
-
 /**
 * Renders a Messages row title as the channel name followed by a muted [HeaderPill] naming the room
 * type (Public Chat, Marmot Group, ...). The pill mirrors the Concord community chip so every group
@@ -935,6 +957,7 @@ fun ChannelName(
    loadRobohash: Boolean,
    autoPlayGif: Boolean,
    onClick: () -> Unit,
+    onLongClick: (() -> Unit)? = null,
 ) {
    ChannelName(
        channelPicture = {
@@ -953,6 +976,7 @@ fun ChannelName(
        channelLastContent,
        hasNewMessages,
        onClick,
+        onLongClick,
    )
 }

@@ -964,6 +988,7 @@ fun ChannelName(
    channelLastContent: String?,
    hasNewMessages: Boolean,
    onClick: () -> Unit,
+    onLongClick: (() -> Unit)? = null,
 ) {
    ChatHeaderLayout(
        channelPicture = channelPicture,
@@ -998,6 +1023,7 @@ fun ChannelName(
            }
        },
        onClick = onClick,
+        onLongClick = onLongClick,
    )
 }

@@ -139,7 +139,7 @@ fun MessagesPager(
            // same state holder, so the two surfaces cannot disagree.
            headerContent =
                if (tabs[page].resource == R.string.new_requests) {
-                    { ChannelInvitesSection(accountViewModel) }
+                    { ChannelInvitesSection(accountViewModel, nav) }
                } else {
                    null
                },
@@ -0,0 +1,108 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.ui.screen.loggedIn.highlights
+
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.LaunchedEffect
+import androidx.compose.runtime.getValue
+import androidx.lifecycle.compose.collectAsStateWithLifecycle
+import com.vitorpamplona.amethyst.commons.ui.feeds.FeedContentState
+import com.vitorpamplona.amethyst.ui.feeds.RefresheableBox
+import com.vitorpamplona.amethyst.ui.feeds.RenderFeedContentState
+import com.vitorpamplona.amethyst.ui.feeds.SaveableFeedContentState
+import com.vitorpamplona.amethyst.ui.feeds.ScrollStateKeys
+import com.vitorpamplona.amethyst.ui.feeds.WatchLifecycleAndUpdateModel
+import com.vitorpamplona.amethyst.ui.layouts.DisappearingScaffold
+import com.vitorpamplona.amethyst.ui.navigation.bottombars.AppBottomBar
+import com.vitorpamplona.amethyst.ui.navigation.navs.INav
+import com.vitorpamplona.amethyst.ui.navigation.routes.Route
+import com.vitorpamplona.amethyst.ui.screen.loggedIn.AccountViewModel
+import com.vitorpamplona.amethyst.ui.screen.loggedIn.highlights.datasource.HighlightsFilterAssemblerSubscription
+
+@Composable
+fun HighlightsScreen(
+    accountViewModel: AccountViewModel,
+    nav: INav,
+) {
+    HighlightsScreen(
+        highlightsFeedContentState = accountViewModel.feedStates.highlightsFeed,
+        accountViewModel = accountViewModel,
+        nav = nav,
+    )
+}
+
+@Composable
+fun HighlightsScreen(
+    highlightsFeedContentState: FeedContentState,
+    accountViewModel: AccountViewModel,
+    nav: INav,
+) {
+    WatchLifecycleAndUpdateModel(highlightsFeedContentState)
+    WatchAccountForHighlightsScreen(highlightsFeedContentState = highlightsFeedContentState, accountViewModel = accountViewModel)
+    HighlightsFilterAssemblerSubscription(accountViewModel)
+
+    DisappearingScaffold(
+        isInvertedLayout = false,
+        topBar = {
+            HighlightsTopBar(accountViewModel, nav)
+        },
+        bottomBar = {
+            AppBottomBar(Route.Highlights, nav, accountViewModel) { route ->
+                if (route == Route.Highlights) {
+                    highlightsFeedContentState.sendToTop()
+                } else {
+                    nav.navBottomBar(route)
+                }
+            }
+        },
+        floatingButton = {
+            NewHighlightButton(nav)
+        },
+        accountViewModel = accountViewModel,
+    ) {
+        RefresheableBox(highlightsFeedContentState, true) {
+            SaveableFeedContentState(highlightsFeedContentState, scrollStateKey = ScrollStateKeys.HIGHLIGHTS_SCREEN) { listState ->
+                RenderFeedContentState(
+                    feedContentState = highlightsFeedContentState,
+                    accountViewModel = accountViewModel,
+                    listState = listState,
+                    nav = nav,
+                    routeForLastRead = "HighlightsFeed",
+                )
+            }
+        }
+    }
+}
+
+@Composable
+fun WatchAccountForHighlightsScreen(
+    highlightsFeedContentState: FeedContentState,
+    accountViewModel: AccountViewModel,
+) {
+    val listState by accountViewModel.account.liveHighlightsFollowLists.collectAsStateWithLifecycle()
+    val hiddenUsers =
+        accountViewModel.account.hiddenUsers.flow
+            .collectAsStateWithLifecycle()
+
+    LaunchedEffect(accountViewModel, listState, hiddenUsers) {
+        highlightsFeedContentState.checkKeysInvalidateDataAndSendToTop()
+    }
+}
@@ -0,0 +1,70 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.ui.screen.loggedIn.highlights
+
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.getValue
+import androidx.lifecycle.compose.collectAsStateWithLifecycle
+import com.vitorpamplona.amethyst.R
+import com.vitorpamplona.amethyst.model.TopFilter
+import com.vitorpamplona.amethyst.ui.navigation.navs.INav
+import com.vitorpamplona.amethyst.ui.navigation.topbars.FeedFilterSpinner
+import com.vitorpamplona.amethyst.ui.navigation.topbars.UserDrawerSearchTopBar
+import com.vitorpamplona.amethyst.ui.screen.FeedDefinition
+import com.vitorpamplona.amethyst.ui.screen.TopNavFilterState
+import com.vitorpamplona.amethyst.ui.screen.loggedIn.AccountViewModel
+import com.vitorpamplona.amethyst.ui.stringRes
+
+@Composable
+fun HighlightsTopBar(
+    accountViewModel: AccountViewModel,
+    nav: INav,
+) {
+    UserDrawerSearchTopBar(accountViewModel, nav) {
+        val list by accountViewModel.account.settings.defaultHighlightsFollowList
+            .collectAsStateWithLifecycle()
+
+        HighlightsTopNavFilterBar(
+            followListsModel = accountViewModel.feedStates.feedListOptions,
+            listName = list,
+            accountViewModel = accountViewModel,
+            onChange = accountViewModel.account.settings::changeDefaultHighlightsFollowList,
+        )
+    }
+}
+
+@Composable
+private fun HighlightsTopNavFilterBar(
+    followListsModel: TopNavFilterState,
+    listName: TopFilter,
+    accountViewModel: AccountViewModel,
+    onChange: (FeedDefinition) -> Unit,
+) {
+    val allLists by followListsModel.highlightsRoutes.collectAsStateWithLifecycle()
+
+    FeedFilterSpinner(
+        placeholderCode = listName,
+        explainer = stringRes(R.string.select_list_to_filter),
+        options = allLists,
+        onSelect = onChange,
+        accountViewModel = accountViewModel,
+    )
+}
@@ -0,0 +1,53 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.ui.screen.loggedIn.highlights
+
+import androidx.compose.foundation.shape.CircleShape
+import androidx.compose.material3.FloatingActionButton
+import androidx.compose.material3.Icon
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.runtime.Composable
+import com.vitorpamplona.amethyst.R
+import com.vitorpamplona.amethyst.ui.navigation.navs.INav
+import com.vitorpamplona.amethyst.ui.navigation.routes.Route
+import com.vitorpamplona.amethyst.ui.painterRes
+import com.vitorpamplona.amethyst.ui.stringRes
+import com.vitorpamplona.amethyst.ui.theme.Size26Modifier
+import com.vitorpamplona.amethyst.ui.theme.Size55Modifier
+
+@Composable
+fun NewHighlightButton(nav: INav) {
+    FloatingActionButton(
+        onClick = {
+            nav.nav(Route.NewHighlight())
+        },
+        modifier = Size55Modifier,
+        shape = CircleShape,
+        containerColor = MaterialTheme.colorScheme.primary,
+    ) {
+        Icon(
+            painter = painterRes(R.drawable.ic_compose, 4),
+            contentDescription = stringRes(R.string.new_highlight_title),
+            modifier = Size26Modifier,
+            tint = MaterialTheme.colorScheme.onPrimary,
+        )
+    }
+}
@@ -0,0 +1,212 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.ui.screen.loggedIn.highlights
+
+import androidx.compose.foundation.text.input.TextFieldState
+import androidx.compose.foundation.text.input.setTextAndPlaceCursorAtEnd
+import androidx.compose.runtime.Stable
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.setValue
+import androidx.lifecycle.ViewModel
+import com.vitorpamplona.amethyst.commons.model.nip30CustomEmojis.EmojiPackState.EmojiMedia
+import com.vitorpamplona.amethyst.commons.model.nip30CustomEmojis.EmojiSuggestionState
+import com.vitorpamplona.amethyst.commons.ui.text.currentWord
+import com.vitorpamplona.amethyst.commons.ui.text.replaceCurrentWord
+import com.vitorpamplona.amethyst.model.Account
+import com.vitorpamplona.amethyst.model.Note
+import com.vitorpamplona.amethyst.model.User
+import com.vitorpamplona.amethyst.ui.actions.NewMessageTagger
+import com.vitorpamplona.amethyst.ui.note.creators.messagefield.IMessageField
+import com.vitorpamplona.amethyst.ui.note.creators.userSuggestions.UserSuggestionState
+import com.vitorpamplona.amethyst.ui.screen.loggedIn.AccountViewModel
+import com.vitorpamplona.quartz.nip01Core.core.Address
+import com.vitorpamplona.quartz.nip01Core.tags.hashtags.hashtags
+import com.vitorpamplona.quartz.nip01Core.tags.people.pTags
+import com.vitorpamplona.quartz.nip01Core.tags.people.toPTag
+import com.vitorpamplona.quartz.nip01Core.tags.references.references
+import com.vitorpamplona.quartz.nip10Notes.content.findHashtags
+import com.vitorpamplona.quartz.nip10Notes.content.findNostrUris
+import com.vitorpamplona.quartz.nip10Notes.content.findURLs
+import com.vitorpamplona.quartz.nip18Reposts.quotes.quotes
+import com.vitorpamplona.quartz.nip30CustomEmoji.emojis
+import com.vitorpamplona.quartz.nip84Highlights.HighlightEvent
+
+/**
+ * Backs the "New Highlight" composer. A NIP-84 highlight is a quoted passage (the event
+ * `content`), its source, and an optional annotation. The annotation reuses the short-note
+ * composer's rich [message] field via [IMessageField], so it gets @-mention and custom-emoji
+ * autocomplete and inline previews; on publish it becomes the highlight's `comment` tag with
+ * the mentions, emoji, URLs, hashtags and quotes it references emitted as their own tags.
+ *
+ * The passage, the `textquoteselector` prefix/suffix, the surrounding `context`, and the
+ * nostr source (`a`/`e`/`p`) are carried through from the share or the "Highlight this note"
+ * action. When a nostr event is the source, [originalNote] is resolved so the screen can
+ * render it as a reply-style preview instead of showing a URL field.
+ */
+@Stable
+class NewHighlightPostViewModel :
+    ViewModel(),
+    IMessageField {
+    private var accountViewModel: AccountViewModel? = null
+    private var account: Account? = null
+
+    /** The highlighted passage — becomes the event `content`. */
+    var quote by mutableStateOf("")
+
+    /** The source URL — becomes an `r` tag. Hidden when a nostr event is the source. */
+    var url by mutableStateOf("")
+
+    /** The user's annotation — the rich comment field; becomes a `comment` tag. */
+    override val message = TextFieldState()
+
+    /** The source note, when highlighting a nostr article/note, for the reply-style preview. */
+    var originalNote by mutableStateOf<Note?>(null)
+        private set
+
+    var userSuggestions: UserSuggestionState? = null
+    var emojiSuggestions: EmojiSuggestionState? = null
+
+    private var prefix: String? = null
+    private var suffix: String? = null
+    private var context: String? = null
+    private var sourceAddress: String? = null
+    private var sourceEventId: String? = null
+    private var author: String? = null
+
+    private var loaded = false
+
+    fun init(accountViewModel: AccountViewModel) {
+        if (this.accountViewModel == accountViewModel) return
+        this.accountViewModel = accountViewModel
+        this.account = accountViewModel.account
+        userSuggestions = UserSuggestionState(accountViewModel.account, accountViewModel.nip05ClientBuilder())
+        emojiSuggestions = EmojiSuggestionState(accountViewModel.account.emoji)
+    }
+
+    /**
+     * Applies the incoming source once, and resolves [originalNote] for a nostr source. Guarded
+     * so a recomposition can't clobber edits the user already made.
+     */
+    fun load(
+        quote: String?,
+        url: String?,
+        prefix: String?,
+        suffix: String?,
+        comment: String?,
+        context: String?,
+        sourceAddress: String?,
+        sourceEventId: String?,
+        author: String?,
+    ) {
+        if (loaded) return
+        loaded = true
+
+        this.quote = quote.orEmpty()
+        this.url = url.orEmpty()
+        comment?.ifBlank { null }?.let { message.setTextAndPlaceCursorAtEnd(it) }
+        this.prefix = prefix
+        this.suffix = suffix
+        this.context = context
+        this.sourceAddress = sourceAddress
+        this.sourceEventId = sourceEventId
+        this.author = author
+
+        val accountViewModel = accountViewModel
+        if (accountViewModel != null) {
+            originalNote =
+                when {
+                    !sourceAddress.isNullOrBlank() -> Address.parse(sourceAddress)?.let { accountViewModel.getOrCreateAddressableNote(it) }
+                    !sourceEventId.isNullOrBlank() -> accountViewModel.getOrCreateNote(sourceEventId)
+                    else -> null
+                }
+        }
+    }
+
+    override fun onMessageChanged() {
+        if (message.selection.collapsed) {
+            val lastWord = message.currentWord()
+            if (lastWord.startsWith("@")) {
+                userSuggestions?.processCurrentWord(lastWord)
+            } else {
+                userSuggestions?.reset()
+            }
+            emojiSuggestions?.processCurrentWord(lastWord)
+        }
+    }
+
+    fun autocompleteWithUser(item: User) {
+        userSuggestions?.let {
+            val lastWord = message.currentWord()
+            it.replaceCurrentWord(message, lastWord, item)
+            it.reset()
+        }
+    }
+
+    fun autocompleteWithEmoji(item: EmojiMedia) {
+        emojiSuggestions?.autocompleteInto(message, item)
+    }
+
+    fun autocompleteWithEmojiUrl(item: EmojiMedia) {
+        message.replaceCurrentWord(item.link + " ")
+        emojiSuggestions?.reset()
+    }
+
+    fun canPost(): Boolean = quote.isNotBlank()
+
+    suspend fun sendHighlight() {
+        val account = account ?: return
+        val dao = accountViewModel ?: return
+        if (!canPost()) return
+
+        // Resolve @mentions, nostr: refs, emoji, URLs and hashtags out of the annotation the same
+        // way the short-note composer does, so a highlight comment behaves like any other note.
+        val tagger = NewMessageTagger(message.text.toString().trim(), null, null, dao)
+        tagger.run()
+
+        val commentText = tagger.message.ifBlank { null }
+        val mentions = tagger.directMentionsUsers.map { it.toPTag() }
+        val emojiTags = account.emoji.findEmojiTags(tagger.message)
+        val urls = findURLs(tagger.message)
+        val tags = findHashtags(tagger.message)
+        val quotes = findNostrUris(tagger.message)
+
+        account.signAndComputeBroadcast(
+            HighlightEvent.build(
+                quote = quote.trim(),
+                url = url.trim().ifBlank { null },
+                prefix = prefix,
+                suffix = suffix,
+                comment = commentText,
+                context = context,
+                address = sourceAddress,
+                event = sourceEventId,
+                author = author,
+            ) {
+                if (mentions.isNotEmpty()) pTags(mentions)
+                references(urls)
+                hashtags(tags)
+                quotes(quotes)
+                emojis(emojiTags)
+            },
+        )
+    }
+}
@@ -0,0 +1,329 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.ui.screen.loggedIn.highlights
+
+import androidx.compose.foundation.background
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Box
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.IntrinsicSize
+import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.Spacer
+import androidx.compose.foundation.layout.consumeWindowInsets
+import androidx.compose.foundation.layout.fillMaxHeight
+import androidx.compose.foundation.layout.fillMaxSize
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.height
+import androidx.compose.foundation.layout.heightIn
+import androidx.compose.foundation.layout.imePadding
+import androidx.compose.foundation.layout.offset
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.layout.size
+import androidx.compose.foundation.layout.width
+import androidx.compose.foundation.rememberScrollState
+import androidx.compose.foundation.shape.RoundedCornerShape
+import androidx.compose.foundation.text.BasicTextField
+import androidx.compose.foundation.verticalScroll
+import androidx.compose.material3.ExperimentalMaterial3Api
+import androidx.compose.material3.LocalTextStyle
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.OutlinedTextField
+import androidx.compose.material3.Scaffold
+import androidx.compose.material3.Surface
+import androidx.compose.material3.Text
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.LaunchedEffect
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.draw.clip
+import androidx.compose.ui.graphics.Color
+import androidx.compose.ui.graphics.SolidColor
+import androidx.compose.ui.text.font.FontWeight
+import androidx.compose.ui.text.style.TextAlign
+import androidx.compose.ui.unit.dp
+import androidx.compose.ui.unit.em
+import androidx.compose.ui.unit.sp
+import androidx.lifecycle.viewmodel.compose.viewModel
+import com.vitorpamplona.amethyst.R
+import com.vitorpamplona.amethyst.commons.icons.symbols.Icon
+import com.vitorpamplona.amethyst.commons.icons.symbols.MaterialSymbol
+import com.vitorpamplona.amethyst.commons.icons.symbols.MaterialSymbols
+import com.vitorpamplona.amethyst.commons.nip30CustomEmojis.ui.ShowEmojiSuggestionList
+import com.vitorpamplona.amethyst.ui.navigation.navs.Nav
+import com.vitorpamplona.amethyst.ui.navigation.topbars.PostingTopBar
+import com.vitorpamplona.amethyst.ui.note.NoteCompose
+import com.vitorpamplona.amethyst.ui.note.creators.emojiSuggestions.WatchAndLoadMyEmojiList
+import com.vitorpamplona.amethyst.ui.note.creators.messagefield.MessageField
+import com.vitorpamplona.amethyst.ui.note.creators.userSuggestions.ShowUserSuggestionList
+import com.vitorpamplona.amethyst.ui.note.types.ReplyRenderType
+import com.vitorpamplona.amethyst.ui.screen.loggedIn.AccountViewModel
+import com.vitorpamplona.amethyst.ui.stringRes
+import com.vitorpamplona.amethyst.ui.theme.SuggestionListDefaultHeightPage
+import com.vitorpamplona.amethyst.ui.theme.replyModifier
+
+/** A warm highlighter amber — the highlight metaphor reads as yellow regardless of theme. */
+private val MarkerAccent = Color(0xFFF5C518)
+
+/**
+ * The "New Highlight" composer. Reached either from the "Add highlight" action, a browser
+ * share, or the "Highlight" note-action, routed in as
+ * [com.vitorpamplona.amethyst.ui.navigation.routes.Route.NewHighlight].
+ *
+ * A NIP-84 highlight is a quoted passage, its source, and an optional annotation:
+ * - the passage is a pull-quote you craft (accent bar + quotation-mark watermark),
+ * - the source is either a nostr event — rendered as a reply-style preview — or a web URL,
+ * - the annotation is the same rich composer field the short-note screen uses, so it gets
+ *   @-mention and custom-emoji autocomplete and inline previews.
+ */
+@OptIn(ExperimentalMaterial3Api::class)
+@Composable
+fun NewHighlightScreen(
+    quote: String? = null,
+    url: String? = null,
+    prefix: String? = null,
+    suffix: String? = null,
+    comment: String? = null,
+    context: String? = null,
+    sourceAddress: String? = null,
+    sourceEventId: String? = null,
+    author: String? = null,
+    accountViewModel: AccountViewModel,
+    nav: Nav,
+) {
+    val postViewModel: NewHighlightPostViewModel = viewModel()
+    postViewModel.init(accountViewModel)
+
+    WatchAndLoadMyEmojiList(accountViewModel)
+
+    LaunchedEffect(Unit) {
+        postViewModel.load(quote, url, prefix, suffix, comment, context, sourceAddress, sourceEventId, author)
+    }
+
+    Scaffold(
+        topBar = {
+            PostingTopBar(
+                titleRes = R.string.new_highlight_title,
+                isActive = postViewModel::canPost,
+                onCancel = { nav.popBack() },
+                onPost = {
+                    // Uses the accountViewModel scope so releasing the post ViewModel on
+                    // popBack can't cancel the in-flight publish.
+                    accountViewModel.launchSigner {
+                        postViewModel.sendHighlight()
+                        nav.popBack()
+                    }
+                },
+            )
+        },
+    ) { pad ->
+        Column(
+            modifier =
+                Modifier
+                    .padding(pad)
+                    .consumeWindowInsets(pad)
+                    .imePadding()
+                    .fillMaxSize(),
+        ) {
+            Column(
+                modifier =
+                    Modifier
+                        .weight(1f)
+                        .fillMaxWidth()
+                        .verticalScroll(rememberScrollState())
+                        .padding(horizontal = 20.dp, vertical = 16.dp),
+                verticalArrangement = Arrangement.spacedBy(16.dp),
+            ) {
+                HighlightEditorCard(
+                    passage = postViewModel.quote,
+                    onPassageChange = { postViewModel.quote = it },
+                )
+
+                val source = postViewModel.originalNote
+                if (source != null) {
+                    NoteCompose(
+                        baseNote = source,
+                        modifier = MaterialTheme.colorScheme.replyModifier,
+                        isQuotedNote = true,
+                        unPackReply = ReplyRenderType.NONE,
+                        makeItShort = true,
+                        quotesLeft = 1,
+                        accountViewModel = accountViewModel,
+                        nav = nav,
+                    )
+                } else {
+                    IconField(
+                        symbol = MaterialSymbols.Link,
+                        value = postViewModel.url,
+                        onValueChange = { postViewModel.url = it },
+                        label = stringRes(R.string.new_highlight_source_label),
+                        placeholder = "https://example.com/article",
+                        singleLine = true,
+                    )
+                }
+
+                Row(verticalAlignment = Alignment.CenterVertically) {
+                    Icon(
+                        symbol = MaterialSymbols.EditNote,
+                        contentDescription = null,
+                        tint = MaterialTheme.colorScheme.onSurfaceVariant,
+                        modifier = Modifier.size(20.dp),
+                    )
+                    Spacer(Modifier.width(8.dp))
+                    Text(
+                        text = stringRes(R.string.new_highlight_note_label),
+                        style = MaterialTheme.typography.labelLarge,
+                        color = MaterialTheme.colorScheme.onSurfaceVariant,
+                    )
+                }
+                MessageField(
+                    placeholder = R.string.new_highlight_note_placeholder,
+                    viewModel = postViewModel,
+                    requestFocus = false,
+                )
+            }
+
+            postViewModel.userSuggestions?.let {
+                ShowUserSuggestionList(
+                    it,
+                    postViewModel::autocompleteWithUser,
+                    accountViewModel,
+                    modifier = SuggestionListDefaultHeightPage,
+                )
+            }
+
+            postViewModel.emojiSuggestions?.let {
+                ShowEmojiSuggestionList(
+                    it,
+                    postViewModel::autocompleteWithEmoji,
+                    postViewModel::autocompleteWithEmojiUrl,
+                    modifier = SuggestionListDefaultHeightPage,
+                )
+            }
+        }
+    }
+}
+
+/**
+ * The hero: a rounded, tonal card carrying a quotation-mark watermark, a highlighter-yellow
+ * accent bar, and the editable passage set in a large, comfortable type.
+ */
+@Composable
+private fun HighlightEditorCard(
+    passage: String,
+    onPassageChange: (String) -> Unit,
+) {
+    Surface(
+        shape = RoundedCornerShape(24.dp),
+        color = MaterialTheme.colorScheme.surfaceVariant.copy(alpha = 0.5f),
+        tonalElevation = 2.dp,
+        modifier = Modifier.fillMaxWidth(),
+    ) {
+        Box(modifier = Modifier.fillMaxWidth()) {
+            Icon(
+                symbol = MaterialSymbols.FormatQuote,
+                contentDescription = null,
+                tint = MarkerAccent.copy(alpha = 0.20f),
+                modifier =
+                    Modifier
+                        .align(Alignment.TopStart)
+                        .offset(x = 8.dp, y = (-6).dp)
+                        .size(80.dp),
+            )
+
+            Row(
+                modifier =
+                    Modifier
+                        .fillMaxWidth()
+                        .height(IntrinsicSize.Min)
+                        .padding(20.dp),
+            ) {
+                Spacer(
+                    Modifier
+                        .width(4.dp)
+                        .fillMaxHeight()
+                        .clip(RoundedCornerShape(2.dp))
+                        .background(MarkerAccent),
+                )
+                Spacer(Modifier.width(16.dp))
+                Column(modifier = Modifier.weight(1f)) {
+                    BasicTextField(
+                        value = passage,
+                        onValueChange = onPassageChange,
+                        textStyle =
+                            LocalTextStyle.current.copy(
+                                color = MaterialTheme.colorScheme.onSurface,
+                                fontSize = 20.sp,
+                                lineHeight = 1.4.em,
+                                fontWeight = FontWeight.Medium,
+                            ),
+                        cursorBrush = SolidColor(MarkerAccent),
+                        modifier = Modifier.fillMaxWidth().heightIn(min = 88.dp),
+                        decorationBox = { inner ->
+                            if (passage.isEmpty()) {
+                                Text(
+                                    text = stringRes(R.string.new_highlight_passage_placeholder),
+                                    color = MaterialTheme.colorScheme.onSurfaceVariant.copy(alpha = 0.6f),
+                                    fontSize = 20.sp,
+                                    lineHeight = 1.4.em,
+                                )
+                            }
+                            inner()
+                        },
+                    )
+                    Spacer(Modifier.height(10.dp))
+                    Text(
+                        text = "${passage.length}",
+                        style = MaterialTheme.typography.labelSmall,
+                        color = MaterialTheme.colorScheme.onSurfaceVariant,
+                        textAlign = TextAlign.End,
+                        modifier = Modifier.fillMaxWidth(),
+                    )
+                }
+            }
+        }
+    }
+}
+
+@OptIn(ExperimentalMaterial3Api::class)
+@Composable
+private fun IconField(
+    symbol: MaterialSymbol,
+    value: String,
+    onValueChange: (String) -> Unit,
+    label: String,
+    placeholder: String,
+    singleLine: Boolean,
+    minLines: Int = 1,
+) {
+    OutlinedTextField(
+        value = value,
+        onValueChange = onValueChange,
+        modifier = Modifier.fillMaxWidth(),
+        label = { Text(label) },
+        placeholder = { Text(placeholder) },
+        leadingIcon = {
+            Icon(symbol = symbol, contentDescription = null, modifier = Modifier.size(20.dp))
+        },
+        singleLine = singleLine,
+        minLines = minLines,
+        shape = RoundedCornerShape(16.dp),
+    )
+}
@@ -0,0 +1,85 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.ui.screen.loggedIn.highlights.dal
+
+import com.vitorpamplona.amethyst.model.Account
+import com.vitorpamplona.amethyst.model.LocalCache
+import com.vitorpamplona.amethyst.model.Note
+import com.vitorpamplona.amethyst.model.TopFilter
+import com.vitorpamplona.amethyst.ui.dal.AdditiveFeedFilter
+import com.vitorpamplona.amethyst.ui.dal.FilterByListParams
+import com.vitorpamplona.amethyst.ui.dal.sortedByDefaultFeedOrder
+import com.vitorpamplona.quartz.nip84Highlights.HighlightEvent
+
+/**
+ * The client-side data-access layer for the Highlights feed. Mirrors
+ * `GitRepositoriesFeedFilter`, but highlights (kind 9802) are *regular* events rather than
+ * addressable ones, so it scans `LocalCache.notes` instead of `LocalCache.addressables`.
+ * The `FilterByListParams` handles the selected top-nav follow-list, hidden users and
+ * future-dated / spam checks.
+ */
+class HighlightsFeedFilter(
+    val account: Account,
+) : AdditiveFeedFilter<Note>() {
+    override fun feedKey(): String = account.userProfile().pubkeyHex + "-" + followList().code
+
+    override fun limit() = 200
+
+    fun followList(): TopFilter = account.settings.defaultHighlightsFollowList.value
+
+    fun TopFilter.isMuteList() = this is TopFilter.MuteList
+
+    fun TopFilter.isBlockList() = this is TopFilter.PeopleList && this.address == account.blockPeopleList.getBlockListAddress()
+
+    fun TopFilter.wantsToSeeNegativeStuff() = isMuteList() || isBlockList()
+
+    override fun showHiddenKey(): Boolean = followList().wantsToSeeNegativeStuff()
+
+    override fun feed(): List<Note> {
+        val params = buildFilterParams(account)
+        val notes =
+            LocalCache.notes.filterIntoSet { _, it ->
+                val noteEvent = it.event
+                noteEvent is HighlightEvent && params.match(noteEvent, it.relays)
+            }
+
+        return sort(notes)
+    }
+
+    override fun applyFilter(newItems: Set<Note>): Set<Note> = innerApplyFilter(newItems)
+
+    fun buildFilterParams(account: Account): FilterByListParams =
+        FilterByListParams.create(
+            account.liveHighlightsFollowLists.value,
+            account.hiddenUsers.flow.value,
+        )
+
+    private fun innerApplyFilter(collection: Collection<Note>): Set<Note> {
+        val params = buildFilterParams(account)
+
+        return collection.filterTo(HashSet()) {
+            val noteEvent = it.event
+            noteEvent is HighlightEvent && params.match(noteEvent, it.relays)
+        }
+    }
+
+    override fun sort(items: Set<Note>): List<Note> = items.sortedByDefaultFeedOrder()
+}
@@ -0,0 +1,60 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.ui.screen.loggedIn.highlights.datasource
+
+import com.vitorpamplona.amethyst.model.topNavFeeds.IFeedTopNavPerRelayFilterSet
+import com.vitorpamplona.amethyst.model.topNavFeeds.allFollows.AllFollowsTopNavPerRelayFilterSet
+import com.vitorpamplona.amethyst.model.topNavFeeds.aroundMe.LocationTopNavPerRelayFilterSet
+import com.vitorpamplona.amethyst.model.topNavFeeds.global.GlobalTopNavPerRelayFilterSet
+import com.vitorpamplona.amethyst.model.topNavFeeds.hashtag.HashtagTopNavPerRelayFilterSet
+import com.vitorpamplona.amethyst.model.topNavFeeds.noteBased.author.AuthorsTopNavPerRelayFilterSet
+import com.vitorpamplona.amethyst.model.topNavFeeds.noteBased.muted.MutedAuthorsTopNavPerRelayFilterSet
+import com.vitorpamplona.amethyst.service.relays.SincePerRelayMap
+import com.vitorpamplona.amethyst.ui.screen.loggedIn.highlights.datasource.subassemblies.filterHighlightsByAuthors
+import com.vitorpamplona.amethyst.ui.screen.loggedIn.highlights.datasource.subassemblies.filterHighlightsByFollows
+import com.vitorpamplona.amethyst.ui.screen.loggedIn.highlights.datasource.subassemblies.filterHighlightsByGeohashes
+import com.vitorpamplona.amethyst.ui.screen.loggedIn.highlights.datasource.subassemblies.filterHighlightsByHashtag
+import com.vitorpamplona.amethyst.ui.screen.loggedIn.highlights.datasource.subassemblies.filterHighlightsByMutedAuthors
+import com.vitorpamplona.amethyst.ui.screen.loggedIn.highlights.datasource.subassemblies.filterHighlightsGlobal
+import com.vitorpamplona.quartz.nip01Core.relay.client.pool.RelayBasedFilter
+
+/**
+ * Routes the resolved top-nav filter set (author/hashtag/geohash/global/follows, per relay,
+ * via the outbox model) to the matching subassembly that pins kind 9802 to specific relays.
+ *
+ * Highlights are not community-scoped, so — unlike git repositories — the community filter
+ * sets fall through to [emptyList]; those options aren't offered in the top-nav catalog
+ * anyway (see TopNavFilterState._highlightsRoutes).
+ */
+fun makeHighlightsFilter(
+    feedSettings: IFeedTopNavPerRelayFilterSet,
+    since: SincePerRelayMap?,
+    defaultSince: Long? = null,
+): List<RelayBasedFilter> =
+    when (feedSettings) {
+        is AllFollowsTopNavPerRelayFilterSet -> filterHighlightsByFollows(feedSettings, since, defaultSince)
+        is AuthorsTopNavPerRelayFilterSet -> filterHighlightsByAuthors(feedSettings, since, defaultSince)
+        is GlobalTopNavPerRelayFilterSet -> filterHighlightsGlobal(feedSettings, since, defaultSince)
+        is HashtagTopNavPerRelayFilterSet -> filterHighlightsByHashtag(feedSettings, since, defaultSince)
+        is LocationTopNavPerRelayFilterSet -> filterHighlightsByGeohashes(feedSettings, since, defaultSince)
+        is MutedAuthorsTopNavPerRelayFilterSet -> filterHighlightsByMutedAuthors(feedSettings, since, defaultSince)
+        else -> emptyList()
+    }
@@ -0,0 +1,50 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.ui.screen.loggedIn.highlights.datasource
+
+import androidx.compose.runtime.Stable
+import com.vitorpamplona.amethyst.commons.relayClient.composeSubscriptionManagers.ComposeSubscriptionManager
+import com.vitorpamplona.amethyst.model.Account
+import com.vitorpamplona.amethyst.ui.screen.loggedIn.AccountFeedContentStates
+import com.vitorpamplona.quartz.nip01Core.relay.client.INostrClient
+import kotlinx.coroutines.CoroutineScope
+
+class HighlightsQueryState(
+    val account: Account,
+    val feedStates: AccountFeedContentStates,
+    val scope: CoroutineScope,
+)
+
+@Stable
+class HighlightsFilterAssembler(
+    client: INostrClient,
+) : ComposeSubscriptionManager<HighlightsQueryState>() {
+    val group =
+        listOf(
+            HighlightsSubAssembler(client, ::allKeys),
+        )
+
+    override fun invalidateKeys() = invalidateFilters()
+
+    override fun invalidateFilters() = group.forEach { it.invalidateFilters() }
+
+    override fun destroy() = group.forEach { it.destroy() }
+}
@@ -0,0 +1,48 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.ui.screen.loggedIn.highlights.datasource
+
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.remember
+import androidx.lifecycle.viewModelScope
+import com.vitorpamplona.amethyst.commons.relayClient.subscriptions.LifecycleAwareKeyDataSourceSubscription
+import com.vitorpamplona.amethyst.ui.screen.loggedIn.AccountViewModel
+
+@Composable
+fun HighlightsFilterAssemblerSubscription(accountViewModel: AccountViewModel) {
+    HighlightsFilterAssemblerSubscription(
+        accountViewModel.dataSources().highlights,
+        accountViewModel,
+    )
+}
+
+@Composable
+fun HighlightsFilterAssemblerSubscription(
+    dataSource: HighlightsFilterAssembler,
+    accountViewModel: AccountViewModel,
+) {
+    val state =
+        remember(accountViewModel.account) {
+            HighlightsQueryState(accountViewModel.account, accountViewModel.feedStates, accountViewModel.viewModelScope)
+        }
+
+    LifecycleAwareKeyDataSourceSubscription(state, dataSource)
+}
@@ -0,0 +1,100 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.ui.screen.loggedIn.highlights.datasource
+
+import com.vitorpamplona.amethyst.model.TopFilter
+import com.vitorpamplona.amethyst.model.User
+import com.vitorpamplona.amethyst.service.relayClient.eoseManagers.PerUserAndFollowListEoseManager
+import com.vitorpamplona.amethyst.service.relays.SincePerRelayMap
+import com.vitorpamplona.quartz.nip01Core.relay.client.INostrClient
+import com.vitorpamplona.quartz.nip01Core.relay.client.pool.RelayBasedFilter
+import com.vitorpamplona.quartz.nip01Core.relay.client.subscriptions.Subscription
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.FlowPreview
+import kotlinx.coroutines.Job
+import kotlinx.coroutines.flow.collectLatest
+import kotlinx.coroutines.flow.sample
+import kotlinx.coroutines.launch
+
+class HighlightsSubAssembler(
+    client: INostrClient,
+    allKeys: () -> Set<HighlightsQueryState>,
+) : PerUserAndFollowListEoseManager<HighlightsQueryState, TopFilter>(client, allKeys) {
+    override fun updateFilter(
+        key: HighlightsQueryState,
+        since: SincePerRelayMap?,
+    ): List<RelayBasedFilter> {
+        // "Mine" needs no special-case: the shared TopFilter.Mine flow resolves to an author
+        // filter scoped to the user, so followsPerRelay() already carries authors=[me] against the
+        // user's own outbox.
+        val feedSettings = key.followsPerRelay()
+
+        return makeHighlightsFilter(feedSettings, since, key.feedStates.highlightsFeed.lastNoteCreatedAtIfFilled())
+    }
+
+    override fun user(key: HighlightsQueryState) = key.account.userProfile()
+
+    override fun list(key: HighlightsQueryState) = key.listName()
+
+    fun HighlightsQueryState.listNameFlow() = account.settings.defaultHighlightsFollowList
+
+    fun HighlightsQueryState.listName() = listNameFlow().value
+
+    fun HighlightsQueryState.followsPerRelayFlow() = account.liveHighlightsFollowListsPerRelay
+
+    fun HighlightsQueryState.followsPerRelay() = followsPerRelayFlow().value
+
+    val userJobMap = mutableMapOf<User, List<Job>>()
+
+    @OptIn(FlowPreview::class)
+    override fun newSub(key: HighlightsQueryState): Subscription {
+        val user = user(key)
+        userJobMap[user]?.forEach { it.cancel() }
+        userJobMap[user] =
+            listOf(
+                key.scope.launch(Dispatchers.IO) {
+                    key.listNameFlow().collectLatest {
+                        invalidateFilters()
+                    }
+                },
+                key.scope.launch(Dispatchers.IO) {
+                    key.followsPerRelayFlow().sample(500).collectLatest {
+                        invalidateFilters()
+                    }
+                },
+                key.account.scope.launch(Dispatchers.IO) {
+                    key.feedStates.highlightsFeed.lastNoteCreatedAtWhenFullyLoaded.sample(5000).collectLatest {
+                        invalidateFilters()
+                    }
+                },
+            )
+
+        return super.newSub(key)
+    }
+
+    override fun endSub(
+        key: User,
+        subId: String,
+    ) {
+        super.endSub(key, subId)
+        userJobMap[key]?.forEach { it.cancel() }
+    }
+}
@@ -0,0 +1,92 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.ui.screen.loggedIn.highlights.datasource.subassemblies
+
+import com.vitorpamplona.amethyst.model.topNavFeeds.noteBased.author.AuthorsTopNavPerRelayFilterSet
+import com.vitorpamplona.amethyst.model.topNavFeeds.noteBased.muted.MutedAuthorsTopNavPerRelayFilterSet
+import com.vitorpamplona.amethyst.service.relays.SincePerRelayMap
+import com.vitorpamplona.quartz.nip01Core.core.HexKey
+import com.vitorpamplona.quartz.nip01Core.relay.client.pool.RelayBasedFilter
+import com.vitorpamplona.quartz.nip01Core.relay.filters.Filter
+import com.vitorpamplona.quartz.nip01Core.relay.normalizer.NormalizedRelayUrl
+import com.vitorpamplona.quartz.nip84Highlights.HighlightEvent
+
+fun filterHighlightsByAuthors(
+    relay: NormalizedRelayUrl,
+    authors: Set<HexKey>,
+    since: Long? = null,
+): List<RelayBasedFilter> {
+    val authorList = authors.sorted()
+    return listOf(
+        RelayBasedFilter(
+            relay = relay,
+            filter =
+                Filter(
+                    authors = authorList,
+                    kinds = listOf(HighlightEvent.KIND),
+                    limit = 200,
+                    since = since,
+                ),
+        ),
+    )
+}
+
+fun filterHighlightsByAuthors(
+    authorSet: AuthorsTopNavPerRelayFilterSet,
+    since: SincePerRelayMap?,
+    defaultSince: Long? = null,
+): List<RelayBasedFilter> {
+    if (authorSet.set.isEmpty()) return emptyList()
+
+    return authorSet.set
+        .mapNotNull {
+            if (it.value.authors.isEmpty()) {
+                null
+            } else {
+                filterHighlightsByAuthors(
+                    relay = it.key,
+                    authors = it.value.authors,
+                    since = since?.get(it.key)?.time ?: defaultSince,
+                )
+            }
+        }.flatten()
+}
+
+fun filterHighlightsByMutedAuthors(
+    authorSet: MutedAuthorsTopNavPerRelayFilterSet,
+    since: SincePerRelayMap?,
+    defaultSince: Long? = null,
+): List<RelayBasedFilter> {
+    if (authorSet.set.isEmpty()) return emptyList()
+
+    return authorSet.set
+        .mapNotNull {
+            if (it.value.authors.isEmpty()) {
+                null
+            } else {
+                filterHighlightsByAuthors(
+                    relay = it.key,
+                    authors = it.value.authors,
+                    since = since?.get(it.key)?.time ?: defaultSince,
+                )
+            }
+        }.flatten()
+}
@@ -18,6 +18,27 @@
 * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
 * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 */
-package com.vitorpamplona.amethyst.service.playback.diskCache
+package com.vitorpamplona.amethyst.ui.screen.loggedIn.highlights.datasource.subassemblies

-fun isLiveStreaming(url: String) = url.contains(".m3u8", true)
+import com.vitorpamplona.amethyst.model.topNavFeeds.allFollows.AllFollowsTopNavPerRelayFilterSet
+import com.vitorpamplona.amethyst.service.relays.SincePerRelayMap
+import com.vitorpamplona.quartz.nip01Core.relay.client.pool.RelayBasedFilter
+
+fun filterHighlightsByFollows(
+    followsSet: AllFollowsTopNavPerRelayFilterSet,
+    since: SincePerRelayMap?,
+    defaultSince: Long? = null,
+): List<RelayBasedFilter> {
+    if (followsSet.set.isEmpty()) return emptyList()
+
+    return followsSet.set.flatMap {
+        val since = since?.get(it.key)?.time ?: defaultSince
+        val relay = it.key
+
+        listOfNotNull(
+            it.value.authors?.let {
+                filterHighlightsByAuthors(relay, it, since)
+            },
+        ).flatten()
+    }
+}
@@ -0,0 +1,70 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.ui.screen.loggedIn.highlights.datasource.subassemblies
+
+import com.vitorpamplona.amethyst.model.topNavFeeds.aroundMe.LocationTopNavPerRelayFilterSet
+import com.vitorpamplona.amethyst.service.relays.SincePerRelayMap
+import com.vitorpamplona.quartz.nip01Core.relay.client.pool.RelayBasedFilter
+import com.vitorpamplona.quartz.nip01Core.relay.filters.Filter
+import com.vitorpamplona.quartz.nip01Core.relay.normalizer.NormalizedRelayUrl
+import com.vitorpamplona.quartz.nip84Highlights.HighlightEvent
+
+fun filterHighlightsByGeohashes(
+    relay: NormalizedRelayUrl,
+    geotags: Set<String>,
+    since: Long?,
+): List<RelayBasedFilter> {
+    if (geotags.isEmpty()) return emptyList()
+
+    return listOf(
+        RelayBasedFilter(
+            relay = relay,
+            filter =
+                Filter(
+                    kinds = listOf(HighlightEvent.KIND),
+                    tags = mapOf("g" to geotags.sorted()),
+                    limit = 100,
+                    since = since,
+                ),
+        ),
+    )
+}
+
+fun filterHighlightsByGeohashes(
+    geoSet: LocationTopNavPerRelayFilterSet,
+    since: SincePerRelayMap?,
+    defaultSince: Long?,
+): List<RelayBasedFilter> {
+    if (geoSet.set.isEmpty()) return emptyList()
+
+    return geoSet.set
+        .mapNotNull {
+            if (it.value.geotags.isEmpty()) {
+                null
+            } else {
+                filterHighlightsByGeohashes(
+                    relay = it.key,
+                    geotags = it.value.geotags,
+                    since = since?.get(it.key)?.time ?: defaultSince,
+                )
+            }
+        }.flatten()
+}
@@ -0,0 +1,67 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.ui.screen.loggedIn.highlights.datasource.subassemblies
+
+import com.vitorpamplona.amethyst.model.topNavFeeds.hashtag.HashtagTopNavPerRelayFilterSet
+import com.vitorpamplona.amethyst.service.relays.SincePerRelayMap
+import com.vitorpamplona.quartz.nip01Core.relay.client.pool.RelayBasedFilter
+import com.vitorpamplona.quartz.nip01Core.relay.filters.Filter
+import com.vitorpamplona.quartz.nip01Core.relay.normalizer.NormalizedRelayUrl
+import com.vitorpamplona.quartz.nip84Highlights.HighlightEvent
+
+fun filterHighlightsByHashtag(
+    relay: NormalizedRelayUrl,
+    hashtags: Set<String>,
+    since: Long? = null,
+): List<RelayBasedFilter> =
+    listOf(
+        RelayBasedFilter(
+            relay = relay,
+            filter =
+                Filter(
+                    kinds = listOf(HighlightEvent.KIND),
+                    tags = mapOf("t" to hashtags.toList()),
+                    limit = 200,
+                    since = since,
+                ),
+        ),
+    )
+
+fun filterHighlightsByHashtag(
+    hashtagSet: HashtagTopNavPerRelayFilterSet,
+    since: SincePerRelayMap?,
+    defaultSince: Long? = null,
+): List<RelayBasedFilter> {
+    if (hashtagSet.set.isEmpty()) return emptyList()
+
+    return hashtagSet.set
+        .mapNotNull { relayHashSet ->
+            if (relayHashSet.value.hashtags.isEmpty()) {
+                null
+            } else {
+                filterHighlightsByHashtag(
+                    relay = relayHashSet.key,
+                    hashtags = relayHashSet.value.hashtags,
+                    since = since?.get(relayHashSet.key)?.time ?: defaultSince,
+                )
+            }
+        }.flatten()
+}
--- a/Show More
+++ b/Show More