Merge pull request #3836 from vitorpamplona/feat/nip66-relay-monitor

NIP-66: measure relays from the traffic a client already makes

.github/actions/resolve-release/action.yml

@@ -0,0 +1,73 @@
+name: Resolve Release
+description: >-
+  Resolve a bump workflow's target tag and that release's real published state.
+  Companion to assert-stable-release: this one FETCHES the facts, that one
+  ENFORCES them. Split so the enforcement stays a pure function of its inputs.
+
+  Handles both entry points of the bump workflows:
+    - workflow_run  -> tag comes from the triggering run's head_branch
+    - workflow_dispatch (manual recovery) -> tag comes from the input
+  In both cases draft/prerelease are read back from the GitHub API rather than
+  inferred, so a draft or prerelease can never slip through to a third-party
+  package repo just because the trigger payload lacked the flags.
+
+inputs:
+  tag:
+    description: "Release tag to resolve (e.g. vX.Y.Z)"
+    required: true
+  github_token:
+    description: "Token used to read the release via the GH API"
+    required: true
+
+outputs:
+  tag:
+    description: "The resolved tag, verbatim (e.g. v1.13.1)"
+    value: ${{ steps.resolve.outputs.tag }}
+  ver:
+    description: "The tag with the leading 'v' stripped (e.g. 1.13.1)"
+    value: ${{ steps.resolve.outputs.ver }}
+  is_prerelease:
+    description: "'true' if the GH Release is flagged prerelease"
+    value: ${{ steps.resolve.outputs.is_prerelease }}
+  is_draft:
+    description: "'true' if the GH Release is still a draft"
+    value: ${{ steps.resolve.outputs.is_draft }}
+
+runs:
+  using: composite
+  steps:
+    - name: Resolve tag and release state
+      id: resolve
+      shell: bash
+      env:
+        TAG: ${{ inputs.tag }}
+        GH_TOKEN: ${{ inputs.github_token }}
+        REPO: ${{ github.repository }}
+      run: |
+        set -euo pipefail
+
+        if [[ -z "$TAG" ]]; then
+          echo "::error::No tag to resolve (neither workflow_run.head_branch nor the dispatch input was set)"
+          exit 1
+        fi
+
+        # A missing release here is a real fault, not something to paper over:
+        # every caller is about to publish this version to an external package
+        # manager. Fail loudly and let the caller's Report-failure step file it.
+        if ! META=$(gh release view "$TAG" --repo "$REPO" --json isDraft,isPrerelease 2>&1); then
+          echo "::error::No GH Release found for tag $TAG in $REPO -- refusing to bump"
+          echo "$META"
+          exit 1
+        fi
+
+        IS_DRAFT=$(echo "$META" | jq -r '.isDraft')
+        IS_PRERELEASE=$(echo "$META" | jq -r '.isPrerelease')
+
+        {
+          echo "tag=$TAG"
+          echo "ver=${TAG#v}"
+          echo "is_draft=$IS_DRAFT"
+          echo "is_prerelease=$IS_PRERELEASE"
+        } >> "$GITHUB_OUTPUT"
+
+        echo "resolved tag=$TAG ver=${TAG#v} draft=$IS_DRAFT prerelease=$IS_PRERELEASE"

.github/workflows/build.yml

@@ -22,7 +22,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Set up JDK 21
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v5.6.0
         with:
           distribution: 'temurin'
           java-version: 21
@@ -69,7 +69,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Set up JDK 21
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v5.6.0
         with:
           distribution: 'temurin'
           java-version: 21
@@ -126,7 +126,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Set up JDK 21
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v5.6.0
         with:
           distribution: 'temurin'
           java-version: 21
@@ -161,7 +161,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Set up JDK 21
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v5.6.0
         with:
           distribution: 'temurin'
           java-version: 21
@@ -220,7 +220,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Set up JDK 21
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v5.6.0
         with:
           distribution: 'temurin'
           java-version: 21

.github/workflows/bump-homebrew-formula.yml

@@ -19,9 +19,14 @@ name: Bump Homebrew Formula (amy CLI)
 # auto-bump here (symmetric to the cask action in bump-homebrew.yml) — see the
 # "TODO(bootstrap)" note at the bottom of this file.
 
+# Trigger: after "Create Release Assets" succeeds for a tag push. NOT
+# `release: types: [released]` — that event never fires, because the release is
+# created by create-release.yml under GITHUB_TOKEN and GitHub suppresses
+# workflow-triggering events for it. See the full note in bump-homebrew.yml.
 on:
-  release:
-    types: [released]
+  workflow_run:
+    workflows: ["Create Release Assets"]
+    types: [completed]
   workflow_dispatch:
     inputs:
       tag:
@@ -38,44 +43,49 @@ permissions:
 
 concurrency:
   # Serialize per tag; do not cancel in-progress runs.
-  group: bump-homebrew-formula-${{ github.event.release.tag_name || inputs.tag }}
+  group: bump-homebrew-formula-${{ github.event.workflow_run.head_branch || inputs.tag }}
   cancel-in-progress: false
 
 jobs:
   sync-formula:
-    if: github.event_name == 'workflow_dispatch' || github.event.release.prerelease == false
+    # See bump-homebrew.yml for why these three conditions: successful, tag-push
+    # (not a dry-run dispatch), v-prefixed. Exact format enforced downstream.
+    if: >-
+      github.event_name == 'workflow_dispatch' ||
+      (github.event.workflow_run.conclusion == 'success' &&
+       github.event.workflow_run.event == 'push' &&
+       startsWith(github.event.workflow_run.head_branch, 'v'))
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
 
+      - name: Resolve release
+        id: rel
+        uses: ./.github/actions/resolve-release
+        with:
+          tag: ${{ github.event.workflow_run.head_branch || inputs.tag }}
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Re-assert stable release
         uses: ./.github/actions/assert-stable-release
         with:
-          tag: ${{ github.event.release.tag_name || inputs.tag }}
-          is_prerelease: ${{ github.event.release.prerelease || 'false' }}
-          is_draft: ${{ github.event.release.draft || 'false' }}
-
-      - name: Resolve version
-        id: ver
-        run: |
-          set -euo pipefail
-          TAG="${{ github.event.release.tag_name || inputs.tag }}"
-          VER="${TAG#v}"
-          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
-          echo "ver=$VER" >> "$GITHUB_OUTPUT"
+          tag: ${{ steps.rel.outputs.tag }}
+          is_prerelease: ${{ steps.rel.outputs.is_prerelease }}
+          is_draft: ${{ steps.rel.outputs.is_draft }}
 
       - name: Download jvm bundle and compute sha256
         id: asset
         run: |
           set -euo pipefail
-          TAG="${{ steps.ver.outputs.tag }}"
-          VER="${{ steps.ver.outputs.ver }}"
+          TAG="${{ steps.rel.outputs.tag }}"
+          VER="${{ steps.rel.outputs.ver }}"
           URL="https://github.com/${{ github.repository }}/releases/download/${TAG}/amy-${VER}-jvm.tar.gz"
           echo "Fetching $URL"
-          # The `released` event can fire a hair before every matrix leg finishes
-          # uploading; retry with backoff (mirrors the repo's push/pull retry ethos).
+          # workflow_run fires only after every upload leg has finished, so the
+          # asset should already be there. Retry anyway for release-CDN
+          # propagation (mirrors the repo's push/pull retry ethos).
           ok=0
           for i in 1 2 3 4 5; do
             if curl -fsSL -o amy-jvm.tar.gz "$URL"; then ok=1; break; fi
@@ -110,13 +120,13 @@ jobs:
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           base: main
-          branch: chore/bump-amy-formula-${{ steps.ver.outputs.tag }}
+          branch: chore/bump-amy-formula-${{ steps.rel.outputs.tag }}
           add-paths: cli/packaging/homebrew/amy.rb
-          commit-message: 'chore: sync amy Homebrew formula to ${{ steps.ver.outputs.tag }}'
-          title: 'chore: sync amy Homebrew formula to ${{ steps.ver.outputs.tag }}'
+          commit-message: 'chore: sync amy Homebrew formula to ${{ steps.rel.outputs.tag }}'
+          title: 'chore: sync amy Homebrew formula to ${{ steps.rel.outputs.tag }}'
           body: |
             Auto-synced `cli/packaging/homebrew/amy.rb` to the
-            `${{ steps.ver.outputs.tag }}` release:
+            `${{ steps.rel.outputs.tag }}` release:
 
             - `url`    -> `${{ steps.asset.outputs.url }}`
             - `sha256` -> `${{ steps.asset.outputs.sha256 }}`
@@ -124,19 +134,21 @@ jobs:
             Opened by `.github/workflows/bump-homebrew-formula.yml`. Merge to keep
             the reference formula ready for the homebrew-core submission/bump.
 
-      # TODO(bootstrap): once `amy` is accepted into Homebrew/homebrew-core, add a
-      # step here that opens the homebrew-core bump PR automatically — symmetric to
-      # the cask bump in bump-homebrew.yml (a pinned macauley/action-homebrew-bump-
-      # formula, or `brew bump-formula-pr amy --url=<url> --sha256=<sha>` with a
-      # HOMEBREW_TOKEN). It is intentionally omitted until then because
-      # bump-formula-pr errors on a formula that is not yet in the tap.
+      # TODO(bootstrap): once `amy` is accepted into Homebrew/homebrew-core, add
+      # a LOCAL script mirroring scripts/bump-homebrew-cask.sh that runs `brew
+      # bump-formula-pr amy --url=<url> --sha256=<sha>` from a maintainer's
+      # machine. Do NOT wire that into CI: bump-formula-pr forks homebrew-core
+      # into the token owner's account, which needs a classic `repo`-scoped PAT,
+      # and that scope grants write to every repo the account can reach —
+      # including this one — to anyone with push access here. See
+      # BUILDING.md § Homebrew cask for the full reasoning.
 
       - name: Report failure
         if: failure()
         uses: actions/github-script@v9
         with:
           script: |
-            const tag = context.payload.release?.tag_name || context.payload.inputs?.tag || 'unknown';
+            const tag = context.payload.workflow_run?.head_branch || context.payload.inputs?.tag || 'unknown';
             const runUrl = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;
             await github.rest.issues.create({
               owner: context.repo.owner,

.github/workflows/bump-homebrew-geode-formula.yml

@@ -17,9 +17,14 @@ name: Bump Homebrew Formula (geode relay)
 # human-reviewed new-formula PR (the one-time bootstrap). Once it lands, wire the
 # auto-bump here — see the "TODO(bootstrap)" note at the bottom of this file.
 
+# Trigger: after "Create Release Assets" succeeds for a tag push. NOT
+# `release: types: [released]` — that event never fires, because the release is
+# created by create-release.yml under GITHUB_TOKEN and GitHub suppresses
+# workflow-triggering events for it. See the full note in bump-homebrew.yml.
 on:
-  release:
-    types: [released]
+  workflow_run:
+    workflows: ["Create Release Assets"]
+    types: [completed]
   workflow_dispatch:
     inputs:
       tag:
@@ -36,44 +41,49 @@ permissions:
 
 concurrency:
   # Serialize per tag; do not cancel in-progress runs.
-  group: bump-homebrew-geode-formula-${{ github.event.release.tag_name || inputs.tag }}
+  group: bump-homebrew-geode-formula-${{ github.event.workflow_run.head_branch || inputs.tag }}
   cancel-in-progress: false
 
 jobs:
   sync-formula:
-    if: github.event_name == 'workflow_dispatch' || github.event.release.prerelease == false
+    # See bump-homebrew.yml for why these three conditions: successful, tag-push
+    # (not a dry-run dispatch), v-prefixed. Exact format enforced downstream.
+    if: >-
+      github.event_name == 'workflow_dispatch' ||
+      (github.event.workflow_run.conclusion == 'success' &&
+       github.event.workflow_run.event == 'push' &&
+       startsWith(github.event.workflow_run.head_branch, 'v'))
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
 
+      - name: Resolve release
+        id: rel
+        uses: ./.github/actions/resolve-release
+        with:
+          tag: ${{ github.event.workflow_run.head_branch || inputs.tag }}
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Re-assert stable release
         uses: ./.github/actions/assert-stable-release
         with:
-          tag: ${{ github.event.release.tag_name || inputs.tag }}
-          is_prerelease: ${{ github.event.release.prerelease || 'false' }}
-          is_draft: ${{ github.event.release.draft || 'false' }}
-
-      - name: Resolve version
-        id: ver
-        run: |
-          set -euo pipefail
-          TAG="${{ github.event.release.tag_name || inputs.tag }}"
-          VER="${TAG#v}"
-          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
-          echo "ver=$VER" >> "$GITHUB_OUTPUT"
+          tag: ${{ steps.rel.outputs.tag }}
+          is_prerelease: ${{ steps.rel.outputs.is_prerelease }}
+          is_draft: ${{ steps.rel.outputs.is_draft }}
 
       - name: Download jvm bundle and compute sha256
         id: asset
         run: |
           set -euo pipefail
-          TAG="${{ steps.ver.outputs.tag }}"
-          VER="${{ steps.ver.outputs.ver }}"
+          TAG="${{ steps.rel.outputs.tag }}"
+          VER="${{ steps.rel.outputs.ver }}"
           URL="https://github.com/${{ github.repository }}/releases/download/${TAG}/geode-${VER}-jvm.tar.gz"
           echo "Fetching $URL"
-          # The `released` event can fire a hair before every matrix leg finishes
-          # uploading; retry with backoff (mirrors the repo's push/pull retry ethos).
+          # workflow_run fires only after every upload leg has finished, so the
+          # asset should already be there. Retry anyway for release-CDN
+          # propagation (mirrors the repo's push/pull retry ethos).
           ok=0
           for i in 1 2 3 4 5; do
             if curl -fsSL -o geode-jvm.tar.gz "$URL"; then ok=1; break; fi
@@ -108,13 +118,13 @@ jobs:
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           base: main
-          branch: chore/bump-geode-formula-${{ steps.ver.outputs.tag }}
+          branch: chore/bump-geode-formula-${{ steps.rel.outputs.tag }}
           add-paths: geode/packaging/homebrew/geode.rb
-          commit-message: 'chore: sync geode Homebrew formula to ${{ steps.ver.outputs.tag }}'
-          title: 'chore: sync geode Homebrew formula to ${{ steps.ver.outputs.tag }}'
+          commit-message: 'chore: sync geode Homebrew formula to ${{ steps.rel.outputs.tag }}'
+          title: 'chore: sync geode Homebrew formula to ${{ steps.rel.outputs.tag }}'
           body: |
             Auto-synced `geode/packaging/homebrew/geode.rb` to the
-            `${{ steps.ver.outputs.tag }}` release:
+            `${{ steps.rel.outputs.tag }}` release:
 
             - `url`    -> `${{ steps.asset.outputs.url }}`
             - `sha256` -> `${{ steps.asset.outputs.sha256 }}`
@@ -122,19 +132,19 @@ jobs:
             Opened by `.github/workflows/bump-homebrew-geode-formula.yml`. Merge to
             keep the reference formula ready for the homebrew-core submission/bump.
 
-      # TODO(bootstrap): once `geode` is accepted into Homebrew/homebrew-core, add
-      # a step here that opens the homebrew-core bump PR automatically (a pinned
-      # macauley/action-homebrew-bump-formula, or `brew bump-formula-pr geode
-      # --url=<url> --sha256=<sha>` with a HOMEBREW_TOKEN). It is intentionally
-      # omitted until then because bump-formula-pr errors on a formula that is not
-      # yet in the tap.
+      # TODO(bootstrap): once `geode` is accepted into Homebrew/homebrew-core,
+      # add a LOCAL script mirroring scripts/bump-homebrew-cask.sh that runs
+      # `brew bump-formula-pr geode --url=<url> --sha256=<sha>` from a
+      # maintainer's machine. Do NOT wire that into CI — it needs a classic
+      # `repo`-scoped PAT, which as a CI secret would hand write access to this
+      # repo to anyone with push access. See BUILDING.md § Homebrew cask.
 
       - name: Report failure
         if: failure()
         uses: actions/github-script@v9
         with:
           script: |
-            const tag = context.payload.release?.tag_name || context.payload.inputs?.tag || 'unknown';
+            const tag = context.payload.workflow_run?.head_branch || context.payload.inputs?.tag || 'unknown';
             const runUrl = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;
             await github.rest.issues.create({
               owner: context.repo.owner,

.github/workflows/bump-homebrew.yml

@@ -1,75 +1,181 @@
-name: Bump Homebrew Cask
+name: Sync Homebrew Cask Reference
 
-# Fires when a GH Release is published (not draft, not prerelease).
-# `release.types: [released]` event fires only for stable releases — still
-# double-checked by .github/actions/assert-stable-release for defense-in-depth.
+# Sibling of bump-homebrew-formula.yml (amy) and bump-homebrew-geode-formula.yml
+# (geode). Same mechanism, third artifact:
+#   - this workflow -> Cask `amethyst-nostr` (the desktop GUI app / DMG)
+#
+# What it does: after a stable release, download the published macOS DMG, assert
+# it is notarized + stapled, compute its sha256, and open a PR syncing
+# `desktopApp/packaging/homebrew/amethyst-nostr.rb` to that release.
+#
+# What it does NOT do: open a PR against Homebrew/homebrew-cask. That step is
+# deliberately MANUAL and runs on a maintainer's machine —
+# `scripts/bump-homebrew-cask.sh`. Reason: `brew bump-cask-pr` forks
+# homebrew-cask into the token owner's account, which requires a CLASSIC PAT
+# with the `repo` scope; that scope grants write to every repository the account
+# can reach, and stored as a CI secret it would be usable by anyone with push
+# access to this repo. Keeping it in a maintainer's shell instead of a CI secret
+# removes that blast radius entirely, at the cost of one command per release.
+# See BUILDING.md § Homebrew cask.
+#
+# Consequence: this workflow needs NO external token. GITHUB_TOKEN is enough,
+# exactly like the two formula workflows.
+#
+# Trigger: after "Create Release Assets" succeeds for a tag push. NOT
+# `release: types: [released]` — that event never fires, because the release is
+# created by create-release.yml under GITHUB_TOKEN and GitHub suppresses
+# workflow-triggering events for it. See the note in bump-homebrew-formula.yml.
 on:
-  release:
-    types: [released]
+  workflow_run:
+    workflows: ["Create Release Assets"]
+    types: [completed]
   workflow_dispatch:
     inputs:
       tag:
-        description: 'Release tag to bump (for manual recovery)'
+        description: 'Release tag to sync (for manual recovery)'
         required: true
         type: string
 
 permissions:
-  contents: read
-  # The "Report failure" step below opens a [release-ops] issue via
-  # github.rest.issues.create; that needs issues:write. Without it the failure
-  # reporter itself 403s and no alert is ever filed.
+  contents: write
+  pull-requests: write
+  # The "Report failure" step opens a [release-ops] issue via
+  # github.rest.issues.create, which needs issues:write.
   issues: write
 
 concurrency:
-  # Serialize bumps per tag; do not cancel in-progress bumps.
-  group: bump-homebrew-${{ github.event.release.tag_name || inputs.tag }}
+  # Serialize per tag; do not cancel in-progress runs.
+  group: bump-homebrew-${{ github.event.workflow_run.head_branch || inputs.tag }}
   cancel-in-progress: false
 
 jobs:
-  bump:
-    if: github.event_name == 'workflow_dispatch' || github.event.release.prerelease == false
-    runs-on: ubuntu-latest   # brew runs on Linux — saves macOS runner quota
-    timeout-minutes: 30
+  sync-cask:
+    # See bump-homebrew-formula.yml for why these three conditions: successful,
+    # tag-push (not a dry-run dispatch), v-prefixed. Format enforced downstream.
+    if: >-
+      github.event_name == 'workflow_dispatch' ||
+      (github.event.workflow_run.conclusion == 'success' &&
+       github.event.workflow_run.event == 'push' &&
+       startsWith(github.event.workflow_run.head_branch, 'v'))
+    # macOS runner: `xcrun stapler` is the only way to verify the notarization
+    # ticket, and shipping an unnotarized DMG to the cask is the failure mode
+    # this whole channel is most exposed to.
+    runs-on: macos-latest
+    timeout-minutes: 20
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
 
+      - name: Resolve release
+        id: rel
+        uses: ./.github/actions/resolve-release
+        with:
+          tag: ${{ github.event.workflow_run.head_branch || inputs.tag }}
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Re-assert stable release
         uses: ./.github/actions/assert-stable-release
         with:
-          tag: ${{ github.event.release.tag_name || inputs.tag }}
-          is_prerelease: ${{ github.event.release.prerelease || 'false' }}
-          is_draft: ${{ github.event.release.draft || 'false' }}
+          tag: ${{ steps.rel.outputs.tag }}
+          is_prerelease: ${{ steps.rel.outputs.is_prerelease }}
+          is_draft: ${{ steps.rel.outputs.is_draft }}
 
-      - name: Bump cask (push-or-update PR)
-        uses: macauley/action-homebrew-bump-cask@ad984534de44a9489a53aefd81eb77f87c70dc60  # v4.0.0
+      - name: Download DMG, verify notarization, compute sha256
+        id: asset
+        run: |
+          set -euo pipefail
+          TAG="${{ steps.rel.outputs.tag }}"
+          VER="${{ steps.rel.outputs.ver }}"
+          URL="https://github.com/${{ github.repository }}/releases/download/${TAG}/amethyst-desktop-${VER}-macos-arm64.dmg"
+          echo "Fetching $URL"
+          # workflow_run fires only after every upload leg has finished, so the
+          # asset should already be there. Retry anyway for release-CDN
+          # propagation (mirrors the repo's push/pull retry ethos).
+          ok=0
+          for i in 1 2 3 4 5; do
+            if curl -fsSL -o amethyst.dmg "$URL"; then ok=1; break; fi
+            wait=$(( 2 ** i ))
+            echo "attempt $i failed; retrying in ${wait}s"
+            sleep "$wait"
+          done
+          [[ "$ok" == 1 ]] || { echo "::error::could not download $URL"; exit 1; }
+          test -s amethyst.dmg
+
+          # A cask must point at a notarized+stapled DMG or every user hits a
+          # Gatekeeper block. Refuse to advertise one that is not.
+          if ! xcrun stapler validate amethyst.dmg; then
+            echo "::error::${TAG} DMG has no stapled notarization ticket -- refusing to sync the cask. Check the notarizeReleaseDmg step in create-release.yml."
+            exit 1
+          fi
+
+          SHA=$(shasum -a 256 amethyst.dmg | awk '{print $1}')
+          echo "sha256=$SHA" >> "$GITHUB_OUTPUT"
+          echo "amethyst-desktop-${VER}-macos-arm64.dmg -> $SHA"
+
+      - name: Update reference cask
+        run: |
+          set -euo pipefail
+          CASK=desktopApp/packaging/homebrew/amethyst-nostr.rb
+          VER="${{ steps.rel.outputs.ver }}"
+          SHA="${{ steps.asset.outputs.sha256 }}"
+          # Anchor on the 2-space indent so the header comment's example lines
+          # are never touched.
+          sed -i '' -E "s|^(  version ).*|\1\"${VER}\"|" "$CASK"
+          sed -i '' -E "s|^(  sha256 ).*|\1\"${SHA}\"|" "$CASK"
+          echo "----- $CASK -----"
+          grep -E "^  (version|sha256) " "$CASK"
+
+      - name: Open or update the cask-sync PR
+        # peter-evans/create-pull-request is MIT-licensed CI-only tooling (not
+        # linked into any shipped artifact). It no-ops when there is no diff.
+        uses: peter-evans/create-pull-request@v8
         with:
-          token: ${{ secrets.HOMEBREW_TOKEN }}
-          tap: homebrew/cask
-          cask: amethyst-nostr
-          tag: ${{ github.event.release.tag_name || inputs.tag }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+          base: main
+          branch: chore/bump-amethyst-cask-${{ steps.rel.outputs.tag }}
+          add-paths: desktopApp/packaging/homebrew/amethyst-nostr.rb
+          commit-message: 'chore: sync amethyst-nostr cask to ${{ steps.rel.outputs.tag }}'
+          title: 'chore: sync amethyst-nostr cask to ${{ steps.rel.outputs.tag }}'
+          body: |
+            Auto-synced `desktopApp/packaging/homebrew/amethyst-nostr.rb` to the
+            `${{ steps.rel.outputs.tag }}` release:
+
+            - `version` -> `${{ steps.rel.outputs.ver }}`
+            - `sha256`  -> `${{ steps.asset.outputs.sha256 }}`
+
+            The DMG was verified notarized + stapled before this PR was opened.
+
+            **Merge this, then push it upstream from a maintainer machine:**
+
+            ```bash
+            scripts/bump-homebrew-cask.sh ${{ steps.rel.outputs.tag }}
+            ```
+
+            That step is manual on purpose — it needs a classic PAT with the
+            `repo` scope, which is deliberately NOT stored as a CI secret. See
+            BUILDING.md § Homebrew cask.
 
       - name: Report failure
         if: failure()
         uses: actions/github-script@v9
         with:
           script: |
-            const tag = context.payload.release?.tag_name || context.payload.inputs?.tag || 'unknown';
+            const tag = context.payload.workflow_run?.head_branch || context.payload.inputs?.tag || 'unknown';
             const runUrl = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;
             await github.rest.issues.create({
               owner: context.repo.owner,
               repo: context.repo.repo,
-              title: `[release-ops] bump-homebrew failed for ${tag}`,
+              title: `[release-ops] sync-homebrew-cask failed for ${tag}`,
               body: [
-                `Homebrew cask bump failed for release \`${tag}\`.`,
+                `amethyst-nostr cask sync failed for release \`${tag}\`.`,
                 ``,
                 `- Run: ${runUrl}`,
                 `- Channel: Homebrew Cask (\`amethyst-nostr\`)`,
                 ``,
                 `Recovery options:`,
-                `1. Re-run the workflow once underlying issue is fixed`,
-                `2. Manually run \`brew bump-cask-pr amethyst-nostr --version ${tag.replace(/^v/, '')}\``,
-                `3. File PR directly against Homebrew/homebrew-cask`
+                `1. Re-run the workflow once the underlying issue is fixed`,
+                `2. Check the DMG is notarized: \`xcrun stapler validate\` on the release asset`,
+                `3. Manually update \`desktopApp/packaging/homebrew/amethyst-nostr.rb\` (version + sha256)`
               ].join('\n'),
               labels: ['release-ops', 'bug']
             });

.github/workflows/bump-winget.yml

@@ -1,72 +1,214 @@
-name: Bump Winget Manifest
+name: Sync Winget Manifest Reference
 
+# Fourth sibling of the three Homebrew sync workflows, same shape:
+#   bump-homebrew-formula.yml       -> Formula `amy`
+#   bump-homebrew-geode-formula.yml -> Formula `geode`
+#   bump-homebrew.yml               -> Cask    `amethyst-nostr`
+#   this workflow                   -> Winget  `VitorPamplona.Amethyst`
+#
+# What it does: after a stable release, download the published Windows MSI,
+# compute its sha256, read its ProductCode, and open a PR syncing
+# desktopApp/packaging/winget/*.yaml to that release.
+#
+# What it does NOT do: open a PR against microsoft/winget-pkgs. That step is
+# deliberately MANUAL and runs on a maintainer's machine —
+# `scripts/bump-winget.sh`. Reason: submitting requires push access to a fork of
+# winget-pkgs. The previous design stored a classic `public_repo` PAT as
+# WINGET_TOKEN and handed it to a third-party action; that scope grants write to
+# every public repo the account can reach, and as an Actions secret it was
+# usable by anyone with push access to this repo. The local script uses the
+# maintainer's existing `gh` auth instead, so no PAT is created at all.
+# See BUILDING.md § Winget.
+#
+# Consequence: this workflow needs NO external token and no third-party action.
+#
+# Trigger: after "Create Release Assets" succeeds for a tag push. NOT
+# `release: types: [released]` — that event never fires, because the release is
+# created by create-release.yml under GITHUB_TOKEN and GitHub suppresses
+# workflow-triggering events for it. See the note in bump-homebrew-formula.yml.
 on:
-  release:
-    types: [released]
+  workflow_run:
+    workflows: ["Create Release Assets"]
+    types: [completed]
   workflow_dispatch:
     inputs:
       tag:
-        description: 'Release tag to submit (for manual recovery)'
+        description: 'Release tag to sync (for manual recovery)'
         required: true
         type: string
 
 permissions:
-  contents: read
-  # The "Report failure" step below opens a [release-ops] issue via
-  # github.rest.issues.create; that needs issues:write. Without it the failure
-  # reporter itself 403s and no alert is ever filed.
+  contents: write
+  pull-requests: write
+  # The "Report failure" step opens a [release-ops] issue via
+  # github.rest.issues.create, which needs issues:write.
   issues: write
 
 concurrency:
-  group: bump-winget-${{ github.event.release.tag_name || inputs.tag }}
+  group: bump-winget-${{ github.event.workflow_run.head_branch || inputs.tag }}
   cancel-in-progress: false
 
 jobs:
-  bump:
-    if: github.event_name == 'workflow_dispatch' || github.event.release.prerelease == false
-    runs-on: windows-latest
-    timeout-minutes: 30
+  sync-manifest:
+    # See bump-homebrew-formula.yml for why these three conditions: successful,
+    # tag-push (not a dry-run dispatch), v-prefixed. Format enforced downstream.
+    if: >-
+      github.event_name == 'workflow_dispatch' ||
+      (github.event.workflow_run.conclusion == 'success' &&
+       github.event.workflow_run.event == 'push' &&
+       startsWith(github.event.workflow_run.head_branch, 'v'))
+    # Linux, not Windows: msitools reads the MSI Property table just as well, and
+    # this leg is billed 1x instead of 2x.
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
 
+      - name: Resolve release
+        id: rel
+        uses: ./.github/actions/resolve-release
+        with:
+          tag: ${{ github.event.workflow_run.head_branch || inputs.tag }}
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Re-assert stable release
         uses: ./.github/actions/assert-stable-release
         with:
-          tag: ${{ github.event.release.tag_name || inputs.tag }}
-          is_prerelease: ${{ github.event.release.prerelease || 'false' }}
-          is_draft: ${{ github.event.release.draft || 'false' }}
+          tag: ${{ steps.rel.outputs.tag }}
+          is_prerelease: ${{ steps.rel.outputs.is_prerelease }}
+          is_draft: ${{ steps.rel.outputs.is_draft }}
 
-      - name: Submit manifest to winget-pkgs
-        uses: vedantmgoyal9/winget-releaser@4ffc7888bffd451b357355dc214d43bb9f23917e  # v2
+      - name: Install msitools
+        run: sudo apt-get update -qq && sudo apt-get install -y -qq msitools
+
+      - name: Download MSI, compute sha256 + ProductCode
+        id: asset
+        run: |
+          set -euo pipefail
+          TAG="${{ steps.rel.outputs.tag }}"
+          VER="${{ steps.rel.outputs.ver }}"
+          URL="https://github.com/${{ github.repository }}/releases/download/${TAG}/amethyst-desktop-${VER}-windows-x64.msi"
+          echo "Fetching $URL"
+          # workflow_run fires only after every upload leg has finished, so the
+          # asset should already be there. Retry anyway for release-CDN
+          # propagation (mirrors the repo's push/pull retry ethos).
+          ok=0
+          for i in 1 2 3 4 5; do
+            if curl -fsSL -o amethyst.msi "$URL"; then ok=1; break; fi
+            wait=$(( 2 ** i ))
+            echo "attempt $i failed; retrying in ${wait}s"
+            sleep "$wait"
+          done
+          [[ "$ok" == 1 ]] || { echo "::error::could not download $URL"; exit 1; }
+          test -s amethyst.msi
+
+          SHA=$(sha256sum amethyst.msi | awk '{print $1}' | tr '[:lower:]' '[:upper:]')
+
+          # ProductCode is the ARP key winget uses to detect an existing install.
+          # jpackage regenerates it per build, so read it rather than pin it.
+          PRODUCT_CODE=$(msiinfo export amethyst.msi Property \
+            | awk -F'\t' '$1 == "ProductCode" { print $2 }' | tr -d '\r')
+          if [[ ! "$PRODUCT_CODE" =~ ^\{[0-9A-Fa-f-]{36}\}$ ]]; then
+            echo "::error::could not read a valid ProductCode from the MSI (got: '${PRODUCT_CODE}')"
+            exit 1
+          fi
+
+          echo "url=$URL" >> "$GITHUB_OUTPUT"
+          echo "sha256=$SHA" >> "$GITHUB_OUTPUT"
+          echo "product_code=$PRODUCT_CODE" >> "$GITHUB_OUTPUT"
+          echo "sha256=$SHA"
+          echo "ProductCode=$PRODUCT_CODE"
+
+      - name: Update reference manifests
+        run: |
+          set -euo pipefail
+          DIR=desktopApp/packaging/winget
+          TAG="${{ steps.rel.outputs.tag }}"
+          VER="${{ steps.rel.outputs.ver }}"
+          SHA="${{ steps.asset.outputs.sha256 }}"
+          URL="${{ steps.asset.outputs.url }}"
+          PC="${{ steps.asset.outputs.product_code }}"
+
+          # Anchored substitutions so the header comments are never touched.
+          sed -i -E "s|^(PackageVersion: ).*|\1${VER}|" \
+            "$DIR/VitorPamplona.Amethyst.yaml" \
+            "$DIR/VitorPamplona.Amethyst.installer.yaml" \
+            "$DIR/VitorPamplona.Amethyst.locale.en-US.yaml"
+          sed -i -E "s|^(  InstallerUrl: ).*|\1${URL}|"    "$DIR/VitorPamplona.Amethyst.installer.yaml"
+          # Quoted: an all-digit 64-char digest would otherwise parse as a YAML
+          # integer and fail the schema's `string` type.
+          sed -i -E "s|^(  InstallerSha256: ).*|\1'${SHA}'|" "$DIR/VitorPamplona.Amethyst.installer.yaml"
+          sed -i -E "s|^(  ProductCode: ).*|\1'${PC}'|"    "$DIR/VitorPamplona.Amethyst.installer.yaml"
+          sed -i -E "s|^(ReleaseNotesUrl: ).*|\1https://github.com/${{ github.repository }}/releases/tag/${TAG}|" \
+            "$DIR/VitorPamplona.Amethyst.locale.en-US.yaml"
+
+          echo "----- synced -----"
+          grep -hE "^(PackageVersion|  InstallerUrl|  InstallerSha256|  ProductCode|ReleaseNotesUrl): " "$DIR"/*.yaml
+
+      - name: Sanity-check the manifests still parse
+        run: |
+          set -euo pipefail
+          python3 - <<'PY'
+          import glob, sys, yaml
+          for f in sorted(glob.glob('desktopApp/packaging/winget/*.yaml')):
+              d = yaml.safe_load(open(f))
+              assert d['PackageIdentifier'] == 'VitorPamplona.Amethyst', f
+              assert d['PackageVersion'], f
+              print('OK', f, d['ManifestType'])
+          PY
+
+      - name: Open or update the manifest-sync PR
+        # peter-evans/create-pull-request is MIT-licensed CI-only tooling (not
+        # linked into any shipped artifact). It no-ops when there is no diff.
+        uses: peter-evans/create-pull-request@v8
         with:
-          identifier: VitorPamplona.Amethyst
-          version: ${{ github.event.release.tag_name || inputs.tag }}
-          # Asset naming contract: scripts/asset-name.sh
-          installers-regex: '^amethyst-desktop-.*-windows-x64\.msi$'
-          token: ${{ secrets.WINGET_TOKEN }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+          base: main
+          branch: chore/bump-winget-manifest-${{ steps.rel.outputs.tag }}
+          add-paths: desktopApp/packaging/winget
+          commit-message: 'chore: sync winget manifests to ${{ steps.rel.outputs.tag }}'
+          title: 'chore: sync winget manifests to ${{ steps.rel.outputs.tag }}'
+          body: |
+            Auto-synced `desktopApp/packaging/winget/` to the
+            `${{ steps.rel.outputs.tag }}` release:
+
+            - `PackageVersion`  -> `${{ steps.rel.outputs.ver }}`
+            - `InstallerSha256` -> `${{ steps.asset.outputs.sha256 }}`
+            - `ProductCode`     -> `${{ steps.asset.outputs.product_code }}`
+
+            **Merge this, then push it upstream from a maintainer machine:**
+
+            ```bash
+            scripts/bump-winget.sh ${{ steps.rel.outputs.tag }}
+            ```
+
+            That step is manual on purpose — it needs push access to a fork of
+            `microsoft/winget-pkgs`, which is deliberately NOT stored as a CI
+            secret. The script uses your existing `gh` auth. See
+            BUILDING.md § Winget.
 
       - name: Report failure
         if: failure()
         uses: actions/github-script@v9
         with:
           script: |
-            const tag = context.payload.release?.tag_name || context.payload.inputs?.tag || 'unknown';
+            const tag = context.payload.workflow_run?.head_branch || context.payload.inputs?.tag || 'unknown';
             const runUrl = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;
             await github.rest.issues.create({
               owner: context.repo.owner,
               repo: context.repo.repo,
-              title: `[release-ops] bump-winget failed for ${tag}`,
+              title: `[release-ops] sync-winget-manifest failed for ${tag}`,
               body: [
-                `Winget manifest submission failed for release \`${tag}\`.`,
+                `Winget manifest sync failed for release \`${tag}\`.`,
                 ``,
                 `- Run: ${runUrl}`,
                 `- Channel: Winget (\`VitorPamplona.Amethyst\`)`,
                 ``,
                 `Recovery options:`,
-                `1. Re-run the workflow once underlying issue is fixed`,
-                `2. Manually submit via \`wingetcreate update VitorPamplona.Amethyst -v ${tag.replace(/^v/, '')}\``,
-                `3. File PR directly against microsoft/winget-pkgs`
+                `1. Re-run the workflow once the underlying issue is fixed`,
+                `2. Check the release actually published \`amethyst-desktop-${tag.replace(/^v/, '')}-windows-x64.msi\``,
+                `3. Manually update \`desktopApp/packaging/winget/*.yaml\` (version, sha256, ProductCode)`
               ].join('\n'),
               labels: ['release-ops', 'bug']
             });

.github/workflows/create-release.yml

@@ -53,7 +53,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Set up JDK 21
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v5.6.0
         with:
           distribution: 'temurin'
           java-version: 21
@@ -155,8 +155,44 @@ jobs:
           AMETHYST_NOTARY_TEAM_ID: ${{ secrets.MAC_NOTARY_TEAM_ID }}
         with:
           max_attempts: 2
-          timeout_minutes: 15
-          command: ./gradlew --no-daemon :desktopApp:${{ matrix.tasks }}
+          # macOS needs far longer: notarizeReleaseDmg blocks on `notarytool
+          # submit --wait`, which is minutes-to-tens-of-minutes on Apple's side.
+          timeout_minutes: ${{ matrix.family == 'macos' && 45 || 15 }}
+          # Append notarization on the macOS leg. `packageReleaseDmg` only SIGNS
+          # the DMG — notarization is a separate Compose task, and because it was
+          # never invoked every release up to v1.13.1 shipped a signed but
+          # UNNOTARIZED DMG that Gatekeeper blocks on first launch. The task runs
+          # `notarytool submit --wait` and then `stapler staple`, in place, so the
+          # asset-collection step below still finds the same file.
+          #
+          # Gated on the cert AND all three notary secrets being present, so forks
+          # and credential-less runs keep producing a plain unsigned DMG exactly as
+          # before instead of failing.
+          command: ./gradlew --no-daemon :desktopApp:${{ matrix.tasks }}${{ (matrix.family == 'macos' && steps.mac_keychain.outputs.signing == 'true' && secrets.MAC_NOTARY_APPLE_ID != '' && secrets.MAC_NOTARY_PASSWORD != '' && secrets.MAC_NOTARY_TEAM_ID != '') && ' :desktopApp:notarizeReleaseDmg' || '' }}
+
+      # Regression guard. The missing-notarization bug was invisible for many
+      # releases precisely because nothing ever asserted the outcome; assert it
+      # now so a silently-dropped notarization step can never ship again.
+      - name: Verify the DMG is notarized and stapled (macOS leg)
+        if: matrix.family == 'macos'
+        env:
+          EXPECT_NOTARIZED: ${{ (steps.mac_keychain.outputs.signing == 'true' && secrets.MAC_NOTARY_APPLE_ID != '' && secrets.MAC_NOTARY_PASSWORD != '' && secrets.MAC_NOTARY_TEAM_ID != '') && 'true' || 'false' }}
+        run: |
+          set -euo pipefail
+          DMG=$(find desktopApp/build/compose/binaries -name "*.dmg" -print -quit)
+          [[ -n "$DMG" ]] || { echo "::error::no DMG produced"; exit 1; }
+          echo "Checking $DMG"
+
+          if [[ "$EXPECT_NOTARIZED" != "true" ]]; then
+            echo "::warning::Apple signing/notary credentials are not configured; this DMG is unsigned and unnotarized. Gatekeeper will block it, and it is not eligible for the Homebrew cask."
+            exit 0
+          fi
+
+          if ! xcrun stapler validate "$DMG"; then
+            echo "::error::$DMG has no stapled notarization ticket -- notarizeReleaseDmg did not run or failed"
+            exit 1
+          fi
+          echo "notarization ticket stapled OK"
 
       # jpackage pins libicu to the build host's version (libicu74 on
       # ubuntu-24.04). Rewrite the .deb so it installs across Debian/Ubuntu.
@@ -249,7 +285,7 @@ jobs:
 
       - name: Upload to GH Release (skip on dry-run)
         if: github.event_name != 'workflow_dispatch' || github.event.inputs.dry_run != 'true'
-        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b  # v3.0.1
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228  # v3.0.2
         with:
           files: dist/*
           tag_name: ${{ steps.ver.outputs.tag }}
@@ -301,7 +337,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Set up JDK 21
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v5.6.0
         with:
           distribution: 'temurin'
           java-version: 21
@@ -500,7 +536,7 @@ jobs:
 
       - name: Upload to GH Release (skip on dry-run)
         if: github.event_name != 'workflow_dispatch' || github.event.inputs.dry_run != 'true'
-        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b  # v3.0.1
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228  # v3.0.2
         with:
           files: dist/*
           tag_name: ${{ steps.ver.outputs.tag }}
@@ -550,7 +586,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Set up JDK 21
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v5.6.0
         with:
           distribution: 'temurin'
           java-version: 21
@@ -741,7 +777,7 @@ jobs:
 
       - name: Upload to GH Release (skip on dry-run)
         if: github.event_name != 'workflow_dispatch' || github.event.inputs.dry_run != 'true'
-        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b  # v3.0.1
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228  # v3.0.2
         with:
           files: dist/*
           tag_name: ${{ steps.ver.outputs.tag }}
@@ -795,17 +831,17 @@ jobs:
           echo "image=$IMAGE" >> "$GITHUB_OUTPUT"
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Log in to GHCR
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build and push image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: geode/Dockerfile
@@ -830,7 +866,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Set up JDK 21
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v5.6.0
         with:
           distribution: 'temurin'
           java-version: 21
@@ -974,7 +1010,7 @@ jobs:
           fi
 
       - name: Upload Android assets to GH Release
-        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b  # v3.0.1
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228  # v3.0.2
         with:
           files: dist/*
           tag_name: ${{ github.ref_name }}

.github/workflows/smoke-test-desktop.yml

@@ -28,7 +28,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Set up JDK 21
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v5.6.0
         with:
           distribution: 'temurin'
           java-version: 21
@@ -58,7 +58,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Set up JDK 21
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v5.6.0
         with:
           distribution: 'temurin'
           java-version: 21

BUILDING.md

@@ -325,15 +325,29 @@ Quartz library in one pipeline.
 
 3. **Wait** for the `Create Release Assets` workflow to finish (~25–30 min).
 
-4. **Verify**:
-   - GH Release contains 8 desktop assets + 12 Android assets
+4. **Verify** — the GH Release should hold **31 assets**:
+   - **8 desktop** — `dmg` (macOS arm64), `msi` + `zip` (Windows), `deb`, `rpm`,
+     `AppImage`, `flatpak`, `tar.gz` (Linux). There is **no Intel/x64 macOS
+     DMG** — `jpackage` cannot cross-compile and no Intel runner leg is
+     configured, so macOS ships arm64-only.
+   - **13 Android** — 5 Google Play APKs + 5 F-Droid APKs + 2 AABs + the
+     F-Droid `.apks` set built for Accrescent.
+   - **5 amy** + **5 geode** bundles.
    - Asset sizes look sane (see §Enforce asset size budget — CI auto-fails at 1 GB/asset)
-   - Intel + ARM DMGs both present
    - Android flow unchanged
 
+   Quick diff against the previous release, which catches a silently-dropped
+   matrix leg better than any count:
+
+   ```bash
+   diff <(gh release view v1.13.0 --json assets --jq '.assets[].name' | sed 's/1\.13\.0/VER/g' | sort) \
+        <(gh release view v1.13.1 --json assets --jq '.assets[].name' | sed 's/1\.13\.1/VER/g' | sort)
+   ```
+
 5. **Stable vs prerelease** — a tag containing `-rc`, `-beta`, `-alpha`, `-dev`,
-   or `-snapshot` is auto-classified as prerelease. Stable tags trigger the
-   Homebrew + Winget bump workflows.
+   or `-snapshot` is auto-classified as prerelease. Only stable tags run the
+   Homebrew + Winget bump workflows (and those are no-ops until the one-time
+   bootstrap PRs land — see § Bootstrap).
 
 ### Dry-run (no tag push)
 
@@ -389,8 +403,8 @@ provided automatically; everything else you set yourself.)
 | `MAC_NOTARY_APPLE_ID` | Apple ID email of the notarization account | Apple notarization (`notarytool`) |
 | `MAC_NOTARY_PASSWORD` | **App-specific** password for that Apple ID (not the login password) | Same |
 | `MAC_NOTARY_TEAM_ID` | 10-char Apple Developer **Team ID** | Same |
-| `HOMEBREW_TOKEN` | PAT for `Homebrew/homebrew-cask` | Desktop cask bump (stable tags) |
-| `WINGET_TOKEN` | PAT for `microsoft/winget-pkgs` | Desktop winget bump (stable tags) |
+| ~~`HOMEBREW_TOKEN`~~ | *Not used.* The cask bump runs on a maintainer's machine — see § Homebrew cask | — |
+| ~~`WINGET_TOKEN`~~ | *Not used.* The winget bump runs on a maintainer's machine — see § Winget | — |
 | `CROWDIN_PERSONAL_TOKEN`, `CROWDIN_PROJECT_ID` | Crowdin API creds | Translation sync (separate workflow, not the release) |
 
 Note the **three distinct signing identities** people often conflate:
@@ -473,11 +487,11 @@ distributes; the official Amethyst rollout for each is in
 | Channel | How it ships | Push or pull |
 |---|---|---|
 | **GitHub Releases** | The release workflow builds + signs all assets and attaches them to the tag's Release | Automatic (CI) |
-| **Maven Central** | Same workflow runs `publishAllPublicationsToMavenCentral` for `quartz` | Automatic (CI) |
+| **Maven Central** | Same workflow runs `publishAllPublicationsToMavenCentral` for `quartz` — a *step* at the end of the `deploy-android` job, not a job of its own, so it does not appear in a job list | Automatic (CI) |
 | **Google Play** | Download the signed `amethyst-googleplay-<version>.aab` from the GH Release and upload it in Play Console | **Manual push** |
 | **F-Droid** | F-Droid's build server detects the new tag and **builds the `fdroid` flavor from source** per its recipe in the external [`fdroiddata`](https://gitlab.com/fdroid/fdroiddata) repo, then signs + publishes itself | **Pull (build-from-source)** |
 | **Zapstore** | The [`zsp`](https://zapstore.dev/) CLI reads [`zapstore.yaml`](zapstore.yaml) and publishes a Nostr software-release event signed with the app's nsec | **Manual push (Nostr)** |
-| **Homebrew + Winget** | `bump-homebrew.yml` / `bump-winget.yml` open version-bump PRs on stable tags | Automatic (CI) |
+| **Homebrew + Winget** | `bump-homebrew.yml` / `bump-winget.yml` open version-bump PRs on stable tags — **currently no-ops**: neither package has been bootstrapped upstream yet (§ Bootstrap) | Automatic (CI), inactive |
 
 Two channels need the build to stay split into product flavors (see
 `amethyst/build.gradle.kts` → `productFlavors`):
@@ -498,20 +512,88 @@ reads an optional per-release changelog from
 
 ## Bootstrap runbook (one-time)
 
-### Secrets to provision in GitHub repo settings
+> **Status as of v1.13.1: neither Homebrew nor Winget has been bootstrapped.**
+> `https://formulae.brew.sh/api/cask/amethyst-nostr.json` and
+> `microsoft/winget-pkgs/manifests/v/VitorPamplona/Amethyst` both 404, so
+> **Amethyst does not currently ship through either channel.** The bump
+> workflows detect this and skip with a `::warning::` instead of failing, so a
+> green release run does *not* mean Homebrew/Winget shipped. The two subsections
+> below are the work that activates them; until then treat the desktop app as
+> GitHub-Releases-only on macOS and Windows.
+
+### Package-manager credentials (and why there are none)
 
 The full secret inventory is in [§ Secrets the CI needs](#secrets-the-ci-needs).
-The two that need the most setup care are the package-manager PATs, because of
-their token type and scope:
+Neither package-manager channel adds anything to it:
 
-| Secret | Purpose | Scope |
-|---|---|---|
-| `HOMEBREW_TOKEN` | Bump Homebrew cask | Fine-grained PAT — `Homebrew/homebrew-cask` only — `Contents: write` + `Pull requests: write` — 90d expiry |
-| `WINGET_TOKEN` | Submit Winget manifests | Classic PAT — `public_repo` — 90d expiry (dedicated bot account preferred; `vedantmgoyal9/winget-releaser` does not support fine-grained) |
+**There are deliberately no package-manager PATs in CI.** Both the Homebrew
+cask and the Winget manifest bumps run on a maintainer's machine. The reasoning
+is worth keeping, because it is the reason this repo has no third secret to
+rotate:
 
-Rotate both on a 90-day cadence. Owner: assigned via `RELEASE_OPS.md`
-or equivalent issue tracker. On rotation, paste new token and run
-`gh workflow run bump-homebrew.yml` on the most recent stable tag to verify.
+`brew bump-cask-pr` forks `Homebrew/homebrew-cask` **into the token owner's
+account** (`POST /repos/Homebrew/homebrew-cask/forks`), pushes a branch to that
+fork, then opens the PR upstream. That shape forces a **classic** PAT with the
+`repo` scope:
+
+- A fine-grained PAT cannot express it. Its "Repository access" selector only
+  lists repos owned by the resource owner, so `Homebrew/homebrew-cask` can never
+  be selected — and Homebrew's API layer authorises against classic OAuth scopes
+  (`x-oauth-scopes`), which fine-grained tokens do not emit.
+- Homebrew declares the requirement in source as
+  `CREATE_ISSUE_FORK_OR_PR_SCOPES = ["repo"]` (`utils/github.rb`).
+
+And `repo` cannot be narrowed: it grants write to *every* repository the owning
+account can reach — including `vitorpamplona/amethyst` itself. Stored as an
+Actions secret it would be usable by **anyone with push access to this repo**,
+since a pushed branch containing a workflow runs with repo secrets. That is a
+strict escalation for a channel that ships one DMG a month.
+
+So the split is:
+
+- **CI** (`bump-homebrew.yml`, `GITHUB_TOKEN` only) does the error-prone
+  bookkeeping: downloads the DMG, asserts it is notarized + stapled, computes
+  the sha256, and opens an in-repo PR syncing
+  `desktopApp/packaging/homebrew/amethyst-nostr.rb`.
+- **A maintainer** merges that PR and runs `scripts/bump-homebrew-cask.sh`,
+  which re-verifies the sha256 and the notarization ticket against the live
+  asset before calling `brew bump-cask-pr`.
+
+The token then lives only in that maintainer's shell:
+
+```bash
+export HOMEBREW_GITHUB_API_TOKEN=ghp_...   # classic PAT, `repo` scope
+scripts/bump-homebrew-cask.sh v1.13.2
+```
+
+Create one at
+<https://github.com/settings/tokens/new?scopes=repo&description=Homebrew%20cask%20bump>.
+Prefer a dedicated bot account whose only asset is a fork of `homebrew-cask`, so
+a leak reaches nothing else.
+
+### Winget
+
+Same split, and it needs **no token at all**. `scripts/bump-winget.sh` drives
+`gh`, which a maintainer is already authenticated with, and it does not need
+`wingetcreate` (Windows-only) because winget manifests are plain YAML — so it
+runs fine from macOS or Linux:
+
+```bash
+scripts/bump-winget.sh v1.13.2
+```
+
+CI (`bump-winget.yml`, `GITHUB_TOKEN` only) does the bookkeeping: downloads the
+MSI, computes the sha256, reads the `ProductCode` out of the MSI Property table
+with `msitools`, and opens an in-repo PR syncing
+`desktopApp/packaging/winget/*.yaml`. The script re-verifies the sha256 against
+the live asset, then forks `microsoft/winget-pkgs`, commits the three manifests
+to `manifests/v/VitorPamplona/Amethyst/<version>/`, and opens the PR.
+
+The previous design stored a classic `public_repo` PAT as `WINGET_TOKEN` and
+passed it to the third-party `vedantmgoyal9/winget-releaser` action — a token
+with write access to every public repo the account owns, handed to code we do
+not control, in a place any push-access collaborator could read it from. None of
+that is needed.
 
 ### Homebrew cask (one-time initial PR)
 
@@ -636,12 +718,19 @@ by any other channel.
 
 | OS | App location | State directories |
 |---|---|---|
-| macOS | `/Applications/Amethyst.app` | `~/Library/Application Support/Amethyst`<br>`~/Library/Preferences/com.vitorpamplona.amethyst.desktop.plist`<br>`~/Library/Caches/Amethyst` |
+| macOS | `/Applications/Amethyst.app` | `~/.amethyst` (accounts + keys)<br>`~/Library/Application Support/Amethyst` (Tor)<br>`~/Library/Caches/AmethystDesktop` (image cache)<br>`~/Library/Preferences/com.apple.java.util.prefs.plist` (**shared** — see below) |
 | Windows | `%LOCALAPPDATA%\Amethyst` or `C:\Program Files\Amethyst` | `%APPDATA%\Amethyst`<br>`%LOCALAPPDATA%\Amethyst` |
 | Linux (deb/rpm) | `/opt/amethyst` | `~/.config/amethyst`<br>`~/.local/share/amethyst`<br>`~/.cache/amethyst` |
 | Linux (AppImage/tar.gz) | user-chosen | Same as above |
 | Linux (Flatpak) | `/var/lib/flatpak` or `~/.local/share/flatpak` | `~/.var/app/com.vitorpamplona.amethyst.Desktop/` |
 
+**macOS preferences are in a SHARED file.** `DesktopPreferences` uses the Java
+Preferences API, which on macOS writes into
+`~/Library/Preferences/com.apple.java.util.prefs.plist` — one plist for *every*
+Java application on the machine, not a per-app file. Never delete it to "reset
+Amethyst": that wipes unrelated apps' settings. This is why the Homebrew cask's
+`zap` stanza deliberately omits it.
+
 Uninstall:
 
 - Homebrew: `brew uninstall --cask amethyst-nostr && brew zap amethyst-nostr`

RELEASE_OPS.md

@@ -14,7 +14,7 @@ specific to shipping the official Amethyst artifacts.
 
 ## At a glance
 
-A release is one tag push that fans out to five distribution channels:
+A release is one tag push that fans out to four live distribution channels:
 
 | Channel | Mechanism | Who pushes |
 |---|---|---|
@@ -22,10 +22,11 @@ A release is one tag push that fans out to five distribution channels:
 | **Google Play** | **Manual** — download the signed AAB from the GH Release, upload in Play Console | Maintainer |
 | **F-Droid** | **Pull** — F-Droid's build server builds the `fdroid` flavor from source when it sees the new tag | F-Droid (we just maintain the recipe + metadata) |
 | **Zapstore** | `zsp publish` reads `zapstore.yaml`, signs a Nostr release event with Amethyst's nsec | Maintainer |
-| **Homebrew + Winget** | Automatic — `bump-homebrew.yml` / `bump-winget.yml` fire on stable tags | CI |
+| **Homebrew + Winget** | ⚠️ **Not shipping.** The bump workflows run, but skip: neither package exists upstream yet | Nobody (see § 3) |
 
 Maven Central (the `quartz` library) also publishes automatically from the same
-workflow.
+workflow — as a *step* at the end of the `deploy-android` job, not a job of its
+own, so don't expect to find it in the run's job list.
 
 ---
 
@@ -61,8 +62,10 @@ workflow.
    `scripts/translators.sh --seed` with `CROWDIN_PROJECT_ID` /
    `CROWDIN_PERSONAL_TOKEN` set, which refreshes the file.)
 
-3. **Publish the release-notes note on Nostr** with Amethyst's account and paste
-   its event id into `amethyst/build.gradle.kts`:
+3. **Publish the release-notes note on Nostr** — *minor releases only.* In
+   practice this id has only ever been bumped on `x.y.0` (1.11.0, 1.12.0,
+   1.13.0); patch releases leave it pointing at their minor's note. Publish with
+   Amethyst's account and paste the event id into `amethyst/build.gradle.kts`:
    ```kotlin
    buildConfigField("String", "RELEASE_NOTES_ID", "\"<new-event-id-hex>\"")
    ```
@@ -85,17 +88,33 @@ workflow.
 Commit, tag, push — see [`BUILDING.md` § Release runbook](BUILDING.md#release-runbook)
 for the exact commands. The tag must equal `app` from the catalog (the workflow
 asserts this and fails fast otherwise). A clean `vMAJOR.MINOR.PATCH` tag is
-classified **stable** and triggers the Homebrew/Winget bumps; anything with a
-`-rc`/`-beta`/`-alpha`/`-dev` suffix is a prerelease and skips them.
+classified **stable** and runs the Homebrew/Winget bump workflows; anything with
+a `-rc`/`-beta`/`-alpha`/`-dev` suffix is a prerelease and skips them.
+
+Heads-up on the `git push`: this repo has `git-credential-manager` configured as
+a credential helper, and it blocks on an interactive prompt (a plain
+`GIT_TERMINAL_PROMPT=0` does **not** stop it — the push just hangs). If that
+happens, push using `gh`'s helper for the one command:
+
+```bash
+git -c credential.helper= -c credential.helper='!gh auth git-credential' push upstream main
+```
 
 When the `Create Release Assets` workflow finishes (~25–30 min) the GH Release
-holds, per the asset-name contract:
+holds **31 assets**, per the asset-name contract:
 
-- **Android:** 5 Google Play APKs + 5 F-Droid APKs + 2 AABs
-  (`amethyst-googleplay-*-v…apk` / `.aab`, `amethyst-fdroid-*-v…apk` / `.aab`)
-- **Desktop:** 8 assets (DMG/MSI/DEB/RPM/AppImage/zip/tar.gz)
-- **CLI:** the `amy` artifacts
-- **Maven Central:** `com.vitorpamplona.quartz:quartz:<version>` published
+- **Android (13):** 5 Google Play APKs + 5 F-Droid APKs + 2 AABs + the F-Droid
+  `.apks` set for Accrescent
+  (`amethyst-googleplay-*-v…apk` / `.aab`, `amethyst-fdroid-*-v…apk` / `.aab` / `.apks`)
+- **Desktop (8):** DMG (macOS **arm64 only** — there is no Intel DMG),
+  MSI + zip, DEB, RPM, AppImage, flatpak, tar.gz
+- **CLI (5):** the `amy` artifacts
+- **Relay (5):** the `geode` artifacts, plus the geode Docker image
+- **Maven Central:** `com.vitorpamplona.quartz:quartz:<version>` published.
+  `repo1.maven.org` lags the publish by tens of minutes — a 404 right after the
+  run is normal. Confirm the step's log says "Deployment is being published to
+  Maven Central", and compare against the *previous* version's POM before
+  concluding anything is broken.
 
 ---
 
@@ -165,11 +184,53 @@ RELAY_URLS="wss://relay.zapstore.dev,wss://relay.damus.io,wss://nos.lol,wss://vi
 Keep `wss://relay.zapstore.dev` in the list — that is the relay the Zapstore app
 itself reads from.
 
-### Homebrew + Winget — automatic
-`bump-homebrew.yml` and `bump-winget.yml` fire on stable tags and open PRs
-against `Homebrew/homebrew-cask` (cask `amethyst-nostr`) and
-`microsoft/winget-pkgs` (`VitorPamplona.Amethyst`). No action unless one fails —
-then see BUILDING.md § Bootstrap and § Incident response.
+### Homebrew + Winget — ⚠️ not shipping yet
+
+`bump-homebrew.yml` and `bump-winget.yml` are wired to open PRs against
+`Homebrew/homebrew-cask` (cask `amethyst-nostr`) and `microsoft/winget-pkgs`
+(`VitorPamplona.Amethyst`) — but **neither package has ever been submitted
+upstream**, so both workflows detect that and skip with a `::warning::`. As of
+**v1.13.1** these two channels deliver nothing; macOS and Windows users get the
+desktop app from GitHub Releases only.
+
+Two separate faults kept this invisible until v1.13.1, both now fixed:
+
+1. **The workflows never ran at all** — for *any* release. They triggered on
+   `release: types: [released]`, and GitHub does not raise workflow-triggering
+   events for a release created by `GITHUB_TOKEN`, which is exactly how
+   `create-release.yml` creates it. They now trigger on `workflow_run` after
+   `Create Release Assets` succeeds, which also fixes a latent race — the old
+   event fired while assets were still uploading.
+2. **Nothing exists upstream to bump.** `brew bump-cask-pr` and
+   `winget-releaser` can only *update* an existing package. The first
+   submission is a manual, human-reviewed PR: BUILDING.md § Homebrew cask
+   (one-time initial PR) and § Winget (one-time initial submission).
+
+Until someone does that bootstrap, a green release run means the bump workflows
+*skipped cleanly* — not that Homebrew/Winget shipped. Check the run's warnings
+if you want to confirm which case you're in.
+
+**Both bumps are half-manual by design.** CI does the bookkeeping with
+`GITHUB_TOKEN` only — verifying the artifact, computing hashes, and opening an
+in-repo PR syncing the reference packaging files. Pushing upstream needs
+credentials that would be dangerous as CI secrets (a `repo`-scoped PAT is
+readable by anyone with push access here), so a maintainer runs the last step:
+
+```bash
+# after merging the sync PRs
+export HOMEBREW_GITHUB_API_TOKEN=ghp_...     # classic PAT, `repo` scope
+scripts/bump-homebrew-cask.sh v1.13.2
+
+scripts/bump-winget.sh v1.13.2               # no token — uses your `gh` auth
+```
+
+Both scripts re-verify the published artifact's sha256 before submitting, and
+the Homebrew one additionally refuses if the DMG is not notarized + stapled.
+See BUILDING.md § Package-manager credentials.
+
+All four in-repo sync workflows (`amy` formula, `geode` formula,
+`amethyst-nostr` cask, winget manifests) open PRs against *this* repo on every
+release. Merge them to keep the reference packaging files current.
 
 ---
 
@@ -211,7 +272,7 @@ ownership:
 | `SIGNING_KEY`, `KEY_ALIAS`, `KEY_STORE_PASSWORD`, `KEY_PASSWORD` | The **Android upload keystore** — losing/leaking it is the worst case; Play app signing identity | Keep the keystore backed up offline; never rotate casually (Play upload key reset is a support process) |
 | `SONATYPE_USERNAME`, `SONATYPE_PASSWORD` | Maven Central namespace `com.vitorpamplona` | On compromise |
 | `SIGNING_PRIVATE_KEY`, `SIGNING_PASSWORD` | The **GPG key** signing Maven artifacts | Per GPG key expiry |
-| `HOMEBREW_TOKEN`, `WINGET_TOKEN` | Cask + winget bump PRs | **90-day cadence** (see BUILDING.md § Bootstrap) |
+| *(none for Homebrew/Winget)* | — | Both bumps run on a maintainer's machine — `scripts/bump-homebrew-cask.sh` and `scripts/bump-winget.sh` — so neither channel's PAT ever becomes a CI secret. See BUILDING.md § Package-manager credentials |
 | `CROWDIN_PERSONAL_TOKEN`, `CROWDIN_PROJECT_ID` | Translation sync | On compromise |
 
 Owner assignments and rotation reminders live with the team (issue tracker).
@@ -222,13 +283,23 @@ Owner assignments and rotation reminders live with the team (issue tracker).
 
 ## 6. Post-release verification
 
-- [ ] GH Release: expected asset count, Intel + ARM DMGs, sizes sane.
-- [ ] Maven Central: `quartz:<version>` resolves (allow propagation time).
+- [ ] GH Release: 31 assets, sizes sane, and the asset-name set matches the
+      previous release (see the `diff` one-liner in BUILDING.md § Release
+      runbook). macOS is arm64-only — do **not** look for an Intel DMG.
+- [ ] Maven Central: `quartz:<version>` resolves (allow tens of minutes of
+      propagation; the publish step's log is the authoritative signal).
 - [ ] Play Console: rollout started, no policy rejection.
 - [ ] Zapstore: release event visible.
 - [ ] F-Droid: new version detected (may lag days).
-- [ ] Homebrew + Winget bump PRs opened (stable only).
-- [ ] In-app "Release Notes" link opens the note matching `RELEASE_NOTES_ID`.
+- [ ] Four sync PRs opened against this repo (`amy` formula, `geode` formula,
+      `amethyst-nostr` cask, winget manifests) — merge them.
+- [ ] Cask pushed upstream: `scripts/bump-homebrew-cask.sh vX.Y.Z` (manual, needs
+      `HOMEBREW_GITHUB_API_TOKEN` in your shell).
+- [ ] Winget pushed upstream: `scripts/bump-winget.sh vX.Y.Z` (manual, no token —
+      uses your `gh` auth).
+      Both scripts error clearly until the one-time bootstrap PRs land (§ 3).
+- [ ] In-app "Release Notes" link opens the note matching `RELEASE_NOTES_ID`
+      (only bumped on minor releases — patches keep pointing at the x.y.0 note).
 - [ ] Push still works on a `play` build (only if the push contract changed —
       see § 4); UnifiedPush still works on an `fdroid` build.
 

amethyst/plans/2026-07-29-location-foreground-gate.md

@@ -0,0 +1,808 @@
+# Location: foreground-gate the listener, trim the request, fix the meter
+
+Date: 2026-07-29
+Module: `amethyst`
+Origin: Finding 1 of `2026-07-29-resource-report-1.13.0-analysis.md` (1.13.0-PLAY,
+Pixel 9a / Android 17)
+Revision: 2 — incorporates spec review of 2026-07-29
+
+## Context
+
+The 1.13.0 resource report showed **7.13 h of location listening against 9.1
+seconds of app foreground**, and the accompanying analysis called it the leading
+suspect for that day's 11 pp of background battery drain. Root cause given: 30
+`SharingStarted.Eagerly` top-nav filter states on the account scope
+(`Account.kt:843-933`), one of which is always `TopFilter.AroundMe` because
+`AccountSettings.kt:256` ships that as the Products default. The `AroundMe`
+branch collects `locationFlow()`, and an `Eagerly`-shared subscriber holds
+`LocationState`'s `WhileSubscribed(5000)` open for the life of the process.
+
+That chain is real. **The battery conclusion drawn from it is not**, and this
+spec is written against the measurement rather than the inference.
+
+### What the device reports
+
+`amethyst/src/main/AndroidManifest.xml:80` declares **only**
+`ACCESS_COARSE_LOCATION` — no `ACCESS_FINE_LOCATION`, no
+`ACCESS_BACKGROUND_LOCATION` — and no service declares
+`foregroundServiceType="location"` (the declared types are `mediaPlayback`,
+`microphone`, `camera`, `phoneCall`, `shortService`, `dataSync`, `specialUse`).
+`targetSdk = 37`.
+
+`adb shell dumpsys location`, Pixel 9a, 21 d 7 h of uptime. **These are the
+`com.vitorpamplona.amethyst` rows** of the per-provider *Historical Aggregate
+Location Provider Data* block — not system-wide totals:
+
+| provider | registration held | **active** | **foreground** | fixes |
+|---|---|---|---|---|
+| passive | 9 d 14 h 20 m | 8 h 26 m 14 s | 8 h 14 m 50 s | 107 |
+| network | 9 d 14 h 20 m | 8 h 26 m 13 s | 8 h 14 m 49 s | 95 |
+| fused | 9 d 14 h 20 m | 8 h 26 m 12 s | 8 h 14 m 48 s | 95 |
+| gps | 9 d 14 h 20 m | 8 h 26 m 11 s | 8 h 14 m 47 s | 98 |
+
+Roughly **11 minutes of background-active location in three weeks**, and about
+100 delivered fixes per provider. With the app backgrounded at the time of the
+dump: `gps provider: service: ProviderRequest[OFF]`, `gps_hardware:
+mStarted=false`.
+
+The cleanest assumption-free comparison: the ledger's **two-day** `location.ms`
+total (3.57 h + 7.13 h = 10.70 h) **exceeds the OS's three-week active total**
+(8 h 26 m) by 27 %. `location.ms` is not measuring what its label implies.
+
+**One figure does not reconcile, and is left open.** Registration-held is
+9 d 14 h over 21 d 7 h ≈ 10.8 h/day, whereas `location.ms` averages 5.35 h/day
+across the two ledger days. If `location.ms` measured subscription existence
+these should agree; they are ~2× apart. Candidates: segments open at process
+death are lost (the pre-flush hook does not run on a kill, and the report shows
+6 process starts across the two days); the ledger covers 2 days while dumpsys
+spans 21 with different usage. Not investigated. It does not affect the
+conclusion below, which rests on `location.ms` versus OS-*active* time, not
+versus registration-held.
+
+### How far the "no background location" claim generalises
+
+This matters because the "no behaviour change" argument rests on it, so it is
+scoped rather than asserted universally:
+
+- **API 29+ (Android 10 and up):** `ACCESS_BACKGROUND_LOCATION` gates background
+  access, and for `targetSdk ≥ 29` an FGS additionally needs
+  `foregroundServiceType="location"`. Amethyst has neither, so background
+  registrations are suspended. This is the case the Pixel 9a measurement above
+  covers.
+- **API 26–28 (Android 8–9):** `ACCESS_BACKGROUND_LOCATION` does not exist.
+  Amethyst *can* receive background location there, throttled by the platform to
+  a few updates per hour. The gate is a genuine, if small, improvement on these
+  releases rather than a no-op.
+
+So "structural" applies to API 29+; on 26–28 the change has real effect.
+
+### What is actually wrong
+
+1. **The meter lies.** `location.ms` measures how long a *subscription* existed,
+   not how long anything listened. That is what made Finding 1 read as the
+   top-priority battery bug.
+2. **The request is 4× redundant.** `LocationFlow.kt:55` iterates
+   `locationManager.allProviders` and calls `requestLocationUpdates` on each —
+   passive, network, fused **and** gps (the last tagged `HIGH_ACCURACY`) — every
+   one at `@+10s0ms, minUpdateDistance=100.0`, to produce a **5 km** geohash.
+   This burns during the 8 h 14 m the app genuinely is foreground.
+3. **The subscription is held for 45 % of device uptime** doing nothing, because
+   `Eagerly` never lets go.
+4. **Every user is exposed**, since Products defaults to `AroundMe` and needs no
+   opt-in.
+5. **Location may be entirely broken on Android 8–11** — see Hypothesis H1.
+
+## Hypothesis H1 — location is dead below API 31 (unverified)
+
+Through Android 11, AOSP's `getMinimumPermissionForProvider` required
+`ACCESS_FINE_LOCATION` for the `gps`, `passive` and `fused` providers; only
+`network` accepted `ACCESS_COARSE_LOCATION`. Approximate-location, which lets a
+coarse-only app request any provider and receive a fuzzed result, is an Android
+12 (API 31) change.
+
+Amethyst holds coarse only. So on API 26–30 today's `allProviders` loop should
+throw `SecurityException` on three of the four providers. Two consequences:
+
+- The throw escapes the `callbackFlow` builder → `.catch` in `LocationState` →
+  `LackPermission`. Location would be **non-functional** on Android 8–11.
+- The builder aborting means `awaitClose` never runs, so `removeUpdates` is
+  never called and any registration made before the throw **leaks** for the life
+  of the process.
+
+**The leak is iteration-order dependent, and may not occur at all.**
+`getLastKnownLocation` is permission-checked per provider too, and
+`LocationFlow.kt:56-68` calls it *before* `requestLocationUpdates` on each
+iteration. If a fine-only provider comes first in `allProviders` — `passive`
+does, in the common AOSP ordering — the throw lands before any registration
+exists: dead, but not leaking. A leak requires `network` to precede a fine-only
+provider.
+
+`@SuppressLint("MissingPermission")` at `LocationFlow.kt:40` suppresses the lint
+warning, not the runtime check, so this would not have been caught statically.
+
+**Not reproduced.** Verify before implementing, on the existing
+`Medium_Phone_API_26_8_` AVD: grant coarse only, open a screen that subscribes,
+and capture **both** the `SecurityException` *and* the actual
+`locationManager.allProviders` order (log it). The PR should claim only what that
+run observed — "location is dead on Android 8–11" and "registrations leak" are
+separate claims and the second may not hold.
+
+The design below is written to be correct either way (§B excludes
+permission-incompatible providers by API level, and catches `SecurityException`
+per provider). If H1 holds, this change also **fixes location on Android 8–11**,
+which should be called out in the PR.
+
+### H1 verification result (2026-07-30, Pixel 9a, API 37)
+
+Partial. The API-level claim could **not** be tested on this hardware: API 31+
+grants coarse-only apps access to every provider, so no `SecurityException` can
+appear regardless of whether H1 is true. Only an API ≤ 30 image can settle it.
+
+What *was* settled is the ordering, which decides the leak sub-claim.
+`dumpsys location` recent-events shows the same iteration order on every
+registration cycle across two days, all four sharing one registration id
+(`88A8E679`), confirming a single `LocationFlow` subscription:
+
+```
+07-30 07:09:58.282: passive provider +registration .../88A8E679
+07-30 07:09:58.291: network provider +registration .../88A8E679
+07-30 07:09:58.293: fused  provider +registration .../88A8E679
+07-30 07:09:58.299: gps    provider +registration .../88A8E679
+```
+
+`allProviders` yields **passive first**, and `passive` is one of the fine-only
+providers below API 31. So on Android 8–11 the throw would land on the first
+iteration, before any registration exists:
+
+- "location is dead on Android 8–11" — **still unverified**, needs API ≤ 30.
+- "registrations leak" — **disproved for this ordering**. Dead, but not leaking.
+
+The PR must not claim the leak. Caveat: the ordering is observed on API 37 and
+`getAllProviders()` could order differently on API 26.
+
+**Unrelated but decisive "before" datum, same session:** with
+`mWakefulness=Dozing` (screen off, device dozing) and `MainActivity` sitting in
+`mLastPausedActivity`, Amethyst held **four** live registrations at
+`@+10s0ms / minUpdateDistance=100.0`. That is the state §A's gate exists to
+eliminate, captured on the owner's daily-driver device rather than an emulator.
+
+## Goals
+
+- Release the location registration whenever no activity is started.
+- Register on one appropriate, permission-compatible provider at an interval
+  matched to the precision actually needed.
+- Make `location.ms` reflect real listening time, correctly, under concurrency.
+- No user-visible behaviour change to the "Around Me" feed or geohash chats.
+
+## Non-goals
+
+- Changing the Products `AroundMe` default (`AccountSettings.kt:256`). With the
+  gate in place its cost is bounded to foreground use. Worth revisiting
+  separately as a product decision.
+- Requesting `ACCESS_FINE_LOCATION` or `ACCESS_BACKGROUND_LOCATION`.
+- Findings 2–6 of the source analysis. Finding 2 (the relay reconnect storm,
+  1.65 GB/day at a 75 % dial-failure rate) is the more likely explanation for
+  the background battery drain and should be taken next.
+
+## Design
+
+### A. The gate
+
+`LocationState` gains an `isForeground: StateFlow<Boolean>` parameter, wired in
+`AppModules.kt:251` from the existing `foregroundTracker` (`AppModules.kt:333`,
+registered at `Amethyst.kt:122`). `locationManager` is `by lazy`, so
+initialisation order is safe.
+
+Today's `hasLocationPermission.transformLatest { … }` becomes a three-state gate
+over *permission × foreground*, applied identically to `geohashStateFlow` and
+`preciseGeohashStateFlow`:
+
+| gate state | behaviour |
+|---|---|
+| no permission | emit `LackPermission` (unchanged) |
+| permitted, foreground | **R1**: emit `Loading` *only if* no `Success` is cached; then `emitAll(locationSource(…))` |
+| permitted, backgrounded | emit nothing; the registration is released and the `StateFlow` retains its last value |
+
+**R1 is a requirement, not an improvement.** `AroundMeFeedFlow.convert` collapses
+to `geotags = emptySet()` for anything that is not `Success`. Without R1 the gate
+would make the "Around Me" feed flash empty on **every** return to foreground — a
+new, frequent, user-visible regression introduced by this change. (It also fixes
+the same flash on permission grant, which exists today.)
+
+**R1 corollary: the `NoPermission` branch must not clear the cache.** Today's
+code emits `LackPermission` without touching `latestLocation`
+(`LocationState.kt:94-96`), and that stays. Clearing it is superficially
+attractive — a revoked permission arguably should not leave a fix readable — but
+consumers already see `LackPermission` from the `StateFlow`; `latestLocation` is
+private and its only jobs are seeding `stateIn` and deciding whether `Loading` is
+emitted. Clearing it would therefore buy no privacy and would cost an
+empty-feed flash on every permission flap, which is precisely what R1 exists to
+prevent. The cache is in-memory and dies with the process regardless.
+
+The `.catch` branch **does** clear the cache, and keeps doing so. That asymmetry
+looks arbitrary next to the paragraph above, so to be explicit: it is inherited,
+not introduced. Both branches preserve today's behaviour exactly
+(`LocationState.kt:87-91` clears on failure, `:94-96` does not clear on missing
+permission). This corollary argues against *adding* a clear, not for removing
+the existing one — changing it would be an unmotivated behaviour change. The
+asymmetry is also defensible on its own terms: a source that failed mid-stream
+says something about the fix's provenance, whereas a permission known to be
+absent says nothing about a fix already taken.
+
+**R2 — grace period on the background edge.** The gate must delay the
+`foreground → background` transition by **5 s** before tearing down. Without it a
+one-second app switch destroys and rebuilds the registration, including a full
+`getLastKnownLocation` sweep, so a user flipping between apps pays more than the
+steady state. 5 s matches the existing `WhileSubscribed(5000)` and is the same
+intent. The `background → foreground` edge is **not** delayed.
+
+Mechanism, stated because the obvious operator is the wrong one: `debounce(5000)`
+delays both edges, and the duration-selector overload that would allow an
+asymmetric delay is `@FlowPreview`. Use `transformLatest`, already in this file
+and already opted into via `@OptIn(ExperimentalCoroutinesApi::class)`:
+
+```kotlin
+isForeground.transformLatest { fg ->
+    if (!fg) delay(BACKGROUND_GRACE_MS)
+    emit(fg)
+}
+```
+
+`transformLatest` cancels the pending `delay` if foreground returns first, which
+is exactly the stated semantics, with no preview opt-in.
+
+**R3 — the retained-value contract.** The "emit nothing" branch is what keeps
+this behaviour-neutral: `stateIn` holds the last `Success`, so the ~60
+synchronous `.value` reads across the feed filters
+(`HomeNewThreadFeedFilter.kt`, `VideoFeedFilter.kt`,
+`DiscoverLongFormFeedFilter.kt`, …) keep seeing the last known geohash. A 5 km
+cell does not meaningfully decay while backgrounded.
+
+**R4 — memory visibility.** `latestLocation` and `latestPreciseLocation`
+(`LocationState.kt:63-64`) are plain `var`s today, used only as `stateIn` initial
+values. R1 promotes them to control flow, read from a different coroutine than
+the `onEach` that writes them. They must become `@Volatile` (or
+`MutableStateFlow`).
+
+**Rejected alternative:** switching `FeedTopNavFilterState.flow` from `Eagerly`
+to `WhileSubscribed`. Roughly 60 call sites read
+`account.live*FollowLists.value` synchronously rather than collecting; under
+`WhileSubscribed` those reads would silently serve a stale or initial value
+whenever no collector happened to be active. That is a correctness regression,
+not a battery fix.
+
+**Rejected alternative:** gating only at the `AppModules` wiring point
+(`geolocationFlow = { … }`). Smaller diff, but it leaves the raw
+`geohashStateFlow` as a loaded gun for the next eager consumer, does nothing for
+`preciseGeohashStateFlow`, and introduces a second `StateFlow` layer over the
+same data.
+
+### B. Request shape
+
+`LocationFlow.get` registers on **one** provider, chosen by a ladder over
+**provider existence and permission compatibility** — both static facts:
+
+```
+chooseProviders(sdkInt, hasFine, exists) -> List<String>:
+  API 31+ or hasFine → [FUSED, NETWORK, GPS, PASSIVE] filtered by exists
+  API < 31, coarse   → [NETWORK]              filtered by exists   (see H1)
+```
+
+It returns the **ordered candidate list**, not a single choice, because the
+per-provider `SecurityException` fall-through below needs somewhere to fall to.
+An empty list means no compatible provider exists.
+
+**The ladder deliberately does not consult `isProviderEnabled`.** Today's code
+registers regardless of enabled state, and such a registration goes live by
+itself when the user enables location — including from the quick-settings shade
+without leaving the app, which is exactly what someone does after seeing "Around
+Me" empty. A guard evaluated once at subscription start would lose that, and the
+foreground-transition restart does not cover the in-app path. Selecting on
+existence keeps the property with no `PROVIDERS_CHANGED_ACTION` receiver. If
+field reports show dead feeds on devices where the chosen provider exists but is
+disabled while another is enabled, adding that receiver is the follow-up.
+
+`requestLocationUpdates` is wrapped in a per-provider `SecurityException` catch
+that falls through to the next rung, so H1 cannot abort the builder and leak
+registrations regardless of how the AOSP check actually behaves.
+
+**When no provider can be registered** — the candidate list was empty, or every
+rung threw — `LocationFlow` **throws** `SecurityException`. It cannot emit
+`LackPermission`: the seam is `(Long, Float) -> Flow<Location>`, and
+`LackPermission` is a `LocationState.LocationResult`, which `LocationFlow` has no
+way to express. Throwing routes it through the `.catch` already present in
+`LocationState` (`LocationState.kt:87-91`, `:126-130`), which sets
+`latestLocation = LackPermission` and emits it — the existing, unchanged path.
+
+Throwing covers **both** failure cases, and it subsumes R5's `registered`-flag
+guard: the throw happens before the acquire, so `onListening(true)` cannot fire
+without a live registration and no separate flag is needed. That is only half of
+R5's pairing, though — see R5 for the release half, which the throw does **not**
+cover and which needs `try`/`finally`.
+
+**Stated decision: `LackPermission` stays conflated with "no usable provider".**
+That value renders `R.string.lack_location_permissions` — "No Location
+Permissions" — at `DisplayLocationObserver.kt:49` and `FeedFilterSpinner.kt:224`,
+which is wrong for a coarse-only pre-31 device that has no `network` provider.
+The conflation is accepted rather than introduced: if H1 holds, today's
+`SecurityException` already lands in the same `.catch` and shows the same wrong
+message. Adding an `Unavailable` state would ripple through four UI `when`s plus
+`LocationState` (10 references across 5 files) and belongs with the H1 fix
+messaging, not here. Recorded as a follow-up.
+
+The `getLastKnownLocation` seed stays a sweep across all providers, taking the
+freshest result. It requires no registration and is what makes the first geohash
+appear immediately rather than after a fix.
+
+`MIN_TIME` / `MIN_DISTANCE` split into two profiles, passed per call:
+
+| flow | precision | interval / distance | provider set |
+|---|---|---|---|
+| `geohashStateFlow` | `KM_5_X_5` | 10 s / 100 m → **60 s / 500 m** | 4 → 1 |
+| `preciseGeohashStateFlow` | `BUILDING` (8 chars) | 10 s / 100 m (kept) | 4 → 1 |
+
+Both rows change: the ladder narrows the precise flow's provider set too, and
+below API 31 that means `network` only, no GPS. Academic while the app holds
+coarse only (see Follow-ups), but it is not "unchanged".
+
+At 120 km/h a 5 km cell takes 2.5 minutes to cross, so 60 s / 500 m has no
+observable effect on the feed.
+
+**Rejected alternative — one shared source at the fine profile,** deriving the
+coarse geohash by prefix truncation. It halves registrations and removes the need
+for `RefCountedSession` entirely, but it upgrades the **common** case — the
+"Around Me" feed alone, which is always on via the Products default — from
+60 s/500 m to 10 s/100 m. That trades the change's main win for a rarer one.
+
+**Rejected alternative — one shared source whose profile tracks the finest
+active subscriber.** Recovers the above and is the best of the three on both
+axes, but it is refcounting with the counter moved from the meter into the
+request path, for a benefit bounded by how often the two flows overlap. They
+overlap only while one of three composable-scoped, foreground-only screens is
+open (`GeohashChatScreen`, `NewGeohashChatScreen`,
+`GeohashLocationPickerDialog`). Not worth the machinery; revisit if that changes.
+
+### C. The meter
+
+`AppModules.kt:251` hands both flows the same non-refcounted
+`SessionTimeIntegrator`, so `setActive(false)` from either closes the segment
+while the other is still listening. Both can be live at once — the "Around Me"
+feed plus an open geohash chat.
+
+**R5 — the hook moves inside `LocationFlow`, and both edges are paired.** Today
+`onListening(true)` is an `onStart` on the flow returned by `LocationFlow.get`,
+so it fires on *collection* whether or not anything was registered — meaning a
+device with no usable provider accrues `location.ms` with nothing listening,
+reintroducing the exact defect this section exists to fix. The hook must instead
+fire from inside the `callbackFlow`, after `requestLocationUpdates` returns
+without throwing, and again on the way out.
+
+The obvious "way out" is `awaitClose`, and that would introduce a worse bug than
+it fixes — twice over. First, `awaitClose` runs on every normal
+completion, including one where no rung ever registered, so it would fire an
+**unpaired** `onListening(false)`. With R6 that does not merely under-count — it
+decrements a holder it never acquired, stealing another flow's. Concretely:
+`geohashStateFlow` registers (`holders = 1`), `preciseGeohashStateFlow` fails to
+register and closes (`holders = 0`), and the session latches off while the coarse
+flow is still listening. `coerceAtLeast(0)` does not help; the count never went
+negative.
+
+Second — and this is the one that survives fixing the first — `awaitClose` also
+fails to run at all on some paths that *did* register. See below.
+
+The pair therefore has to be guaranteed from **both** ends, and the two ends need
+different mechanisms.
+
+*No acquire without a registration* is §B's **throw**: if no rung registers, the
+builder throws before reaching the acquire at all.
+
+*No acquire without a release* needs `try`/`finally`, **not** `awaitClose`. This
+is the subtlest point in the document, so the justification below is the one that
+was **demonstrated**, not the one that sounds most obvious.
+
+Anything between the acquire and `awaitClose` that unwinds skips cleanup parked
+inside `awaitClose`, because `awaitClose` is never reached to register it. The
+registration then leaks and the refcount sticks at ≥ 1 for the life of the
+process, so `location.ms` accrues forever with nothing listening — this exact
+defect, arrived at from the other direction, and unrecoverable once hit.
+
+The **proven** path is the seed throwing a non-cancellation exception:
+`getLastKnownLocation` is a binder call and can fail. The regression test
+`releasesTheRegistrationWhenTheSeedThrows` provokes exactly this and was watched
+failing against an `awaitClose`-only implementation
+(`expected:<[true, false]> but was:<[true]>`).
+
+A cancellation during the seed is *in principle* a second such path, since `send`
+is a suspending call. Recorded honestly: **this one could not be reproduced.**
+Two attempts during implementation both produced tests that passed against a
+deliberately broken implementation, because `callbackFlow`'s channel is buffered,
+so `send` returns without suspending and never observes the cancel. Do not treat
+the cancellation story as the reason for the `try`/`finally`; a future reader who
+tries to reproduce it, fails, and concludes the guard is unnecessary would
+reintroduce the leak.
+
+```kotlin
+var registered: String? = null
+for (provider in candidates) {
+    try {
+        locationManager.requestLocationUpdates(provider, minTimeMs, minDistanceM, callback, Looper.getMainLooper())
+        registered = provider
+        break
+    } catch (e: SecurityException) { /* next rung */ }
+}
+if (registered == null) throw SecurityException("no usable location provider")
+
+onListening?.invoke(true)                       // cannot fire without a registration
+try {
+    freshestLastKnownLocation(providers)?.let { send(it) }   // suspends — cancellable
+    awaitClose { }                              // only to satisfy callbackFlow's contract
+} finally {
+    locationManager.removeUpdates(callback)
+    onListening?.invoke(false)                  // cannot be skipped
+}
+```
+
+`onListening?.invoke(true)` sits immediately before the `try`, with no suspension
+between them, so the acquire cannot happen outside the block that guarantees its
+release.
+
+`trySend` for the seed would also close this particular hole, being
+non-suspending. It is rejected because it leaves the invariant resting on nobody
+adding a suspending call to that block later — vigilance rather than
+impossibility, which is the standard the rest of R5 is held to.
+
+**R6 — refcounting.** An `AtomicInteger` beside the `setActive` call is not
+sufficient: two threads can leave the counter at 1 while the last
+`setActive(false)` lands after the `setActive(true)`, latching the session off.
+The count and the transition must move under one lock. New class in
+`service/resourceusage/`:
+
+```kotlin
+class RefCountedSession(private val setSessionActive: (Boolean) -> Unit) {
+    private val lock = Any()
+    private var holders = 0
+
+    fun setActive(active: Boolean) =
+        synchronized(lock) {
+            holders = if (active) holders + 1 else (holders - 1).coerceAtLeast(0)
+            setSessionActive(holders > 0)
+        }
+}
+```
+
+It takes the setter as a lambda rather than a `SessionTimeIntegrator` because
+that is all it needs, and because constructing a real integrator in a unit test
+would drag in a `ResourceUsageAccountant`, a `ResourceUsageStore` and a temp
+file to observe one boolean.
+
+`AppModules` wires `RefCountedSession(locationSession::setActive)` and passes
+`onListening = { locationRefCount.setActive(it) }`. The outer
+lock serialises entry into `SessionTimeIntegrator.setActive`, whose own lock is
+then nested but never acquired in the reverse order, so there is no deadlock.
+`coerceAtLeast(0)` guards an unmatched release.
+
+### What `location.ms` means after this change
+
+Stated plainly, because the finding that opened this spec is "the meter lies"
+and the next reader should not over-trust the fixed number the way the last one
+over-trusted the broken one:
+
+> `location.ms` measures **how long a location registration was held while the
+> app was in the foreground**. It is not radio-on time and not an energy
+> figure. A `network`-provider registration at 60 s costs close to nothing; a
+> `gps` registration at 10 s costs a great deal. The counter cannot tell them
+> apart.
+
+Reading it as a battery signal requires knowing which provider was chosen —
+which the ledger does not record. Recording the chosen provider as a separate
+counter is a possible follow-up.
+
+## Testing
+
+JVM unit tests — JUnit + MockK + `kotlinx-coroutines-test`, no Robolectric,
+alongside the existing `service/resourceusage/ResourceUsageLedgerTest.kt`.
+
+**Gate.** `LocationState` gains `locationSource: (Long, Float) -> Flow<Location>`,
+defaulting to `LocationFlow(context.getSystemService(…) as LocationManager)::get`
+(see *Registration pairing* for why `LocationFlow` now takes the manager rather
+than the `Context`). That is the seam:
+`Location.toGeoHash` is `GeoHash.encode(lat, lon, chars)` from quartz — pure
+Kotlin — and `unitTests.isReturnDefaultValues = true` is already set, so a
+`mockk<Location>` with stubbed `latitude`/`longitude` suffices. Against a
+counting fake source:
+
+- backgrounded + permitted → source never subscribed
+- foreground + permitted → subscribed exactly once
+- foreground → background → subscription released after the R2 grace period,
+  last `Success` still readable via `.value`
+- background edge shorter than the grace period → subscription **not** torn down
+- return to foreground with a cached `Success` → **no** `Loading` emission (R1)
+- return to foreground with no cached fix → `Loading` first
+- permission revoked → `LackPermission` regardless of foreground state
+
+**Provider ladder.** Extracted as a pure function
+`chooseProviders(sdkInt: Int, hasFine: Boolean, exists: (String) -> Boolean):
+List<String>` so §B is covered rather than sitting below the seam. Cases: rungs
+returned in order; missing rungs filtered out; API < 31 coarse-only yields
+`[network]`; API < 31 with fine yields the full ladder; no compatible provider
+yields an empty list.
+
+`hasFine` is **always `false` in production** — the non-goals rule out ever
+requesting `ACCESS_FINE_LOCATION`. It is a parameter rather than a constant so
+that the function is total over the permission axis and the API < 31 branch can
+be tested from both sides, not because fine access is anticipated. If that
+changes, the ladder is already correct.
+
+R5 sits below the `locationSource` seam, so a fake source never fires it. It gets
+its own tests against a mocked `LocationManager` — see *Registration pairing*
+below.
+
+**Meter.** `RefCountedSession`: overlapping holders keep the session open;
+balanced pairs close it; an unmatched release does not drive the count negative.
+
+Note what this class **cannot** do: it cannot distinguish an unpaired release
+from a legitimate one, so `acquire → unpaired release` closes the session even
+while another holder is listening. That is precisely the R5 bug, and
+`coerceAtLeast(0)` is no defence against it. **The pairing guarantee belongs to
+`LocationFlow`, not here** — which is why it needs its own test below.
+
+**Registration pairing (R5).** To make this testable rather than device-only,
+`LocationFlow` takes a `LocationManager` instead of a `Context`
+(`LocationFlow(context)` → `LocationFlow(locationManager)`; the caller in
+`LocationState` does the `getSystemService` lookup). A `mockk<LocationManager>`
+then covers:
+
+- every rung throws `SecurityException` → the flow throws and `onListening` fires
+  **neither** edge
+- `chooseProviders` returns an empty list → same: throws, neither edge
+- an earlier rung throws and a later one succeeds → registration falls through,
+  exactly one `true`
+- a successful registration → exactly one `true`, and exactly one `false` plus
+  `removeUpdates` on cancellation
+- **cancellation mid-seed**, while the `getLastKnownLocation` sweep is in flight
+  → both edges still fire and `removeUpdates` is still called. This is the case
+  the `try`/`finally` exists for; without it the test fails by hanging the
+  refcount at 1 rather than by throwing, so assert on the edges, not on the
+  absence of an exception.
+These cover the *semantics* only — the two-thread interleaving that motivates the
+lock is made unobservable by the lock itself and is not reproduced by any test
+here.
+
+## Acceptance criteria
+
+On device, re-running the measurement above:
+
+- **Backgrounded:** after the 5 s grace period, `adb shell dumpsys location`
+  shows no `com.vitorpamplona.amethyst` entry under any provider's `listeners:`,
+  and a `-registration` in the recent-events log.
+- **Foregrounded:** **one registration per actively-collected flow — at most
+  two**, and one in the steady state where only the "Around Me" feed is live
+  (§C exists precisely because the two flows may overlap). Not four. The coarse
+  registration reads `@+60s0ms` / `minUpdateDistance=500.0` rather than
+  `@+10s0ms` / `100.0`.
+- The historical aggregates are cumulative since boot; compare deltas across a
+  foreground/background cycle, not absolute totals.
+- **Invariant:** a subsequent in-app Resource Usage Report shows
+
+  ```
+  location.ms  ≤  app.fgms + 5 s × (background transitions)
+  ```
+
+  Both counters are driven by the same `foregroundTracker.isForeground` flow, so
+  without R2 this would hold exactly. R2 is deliberately the error term: the
+  registration really *is* live during the grace period, so counting it is the
+  honest reading, and a stated fudge factor beats an invariant quietly known to
+  be false. The term is not negligible — the source report shows 6 process
+  starts across two days, and app switches are far more frequent than that — so
+  writing `location.ms ≤ app.fgms` would guarantee that the first person to
+  check it files a bug against this change.
+
+  Second caveat: Finding 4 of the source analysis suspects `app.fgms` of
+  under-reporting, so a violation beyond the grace term indicts that counter
+  rather than this one.
+- If H1 holds: location works on the API 26 AVD after the change and did not
+  before.
+
+### Verified on device (2026-07-30, Pixel 9a / Android 17, API 37)
+
+Measured against the `benchmark` variant — `initWith(release)`, so R8-minified with
+the shipping proguard rules, installed as `com.vitorpamplona.amethyst.benchmark`
+beside the untouched Play install. The Play install was force-stopped for the
+duration so its own (unfixed) registrations could not be mistaken for these.
+
+| criterion | before | after |
+|---|---|---|
+| registrations, foreground | **4** (passive, network, fused, gps) | **1** (fused) |
+| request profile | `@+10s0ms HIGH_ACCURACY`, `minUpdateDistance=100.0` | `@+1m0s0ms BALANCED`, `minUpdateDistance=500.0` |
+| registrations, backgrounded | **4**, held while `mWakefulness=Dozing` | **0** |
+
+Event trace for one full cycle, process alive throughout (pid 28682):
+
+```
+17:57:00.117  +registration fused …/40F5A6D7  @+1m0s0ms BALANCED, minUpdateDistance=500.0
+17:57:33.894  -registration fused …/40F5A6D7          ← HOME pressed, released after the grace
+17:58:05.798  +registration fused …/091EDA96  @+1m0s0ms BALANCED, minUpdateDistance=500.0
+              (HOME then reopen within 2 s — no -/+ pair; 091EDA96 survives)
+```
+
+- **§A gate** — zero registrations while backgrounded, with the process still
+  alive. That is the state the change exists to create; before, four
+  registrations survived screen-off and doze.
+- **§B request shape** — one provider, top of the ladder (`fused`), at exactly
+  `COARSE_MIN_TIME` / `COARSE_MIN_DISTANCE`. The OS tags it `(COARSE)` and
+  coalesces the effective service request to `@+10m0s0ms LOW_POWER`.
+- **R2 grace period** — a sub-grace app switch produced **no** teardown/rebuild
+  pair, so a brief switch no longer costs a re-registration and a fresh
+  `getLastKnownLocation` sweep.
+
+**The OS aggregate after four foreground/background cycles is the headline
+result**, because it is the same counter shape `location.ms` measures:
+
+```
+com.vitorpamplona.amethyst.benchmark:
+  min/max interval = 60s/60s
+  total/active/foreground duration = +2m33s542ms / +2m33s456ms / +2m33s531ms
+  locations = 4
+```
+
+Total ≈ active ≈ foreground, all three within 90 ms — against the Play install's
+`9d14h20m / 8h26m / 8h14m`, where registration was held for 45 % of uptime while
+only 1.7 % was active. The four foreground windows sum to 153.6 s, matching the
+aggregate exactly, so nothing is held outside them. Registration-held time now
+*equals* foreground time, which is precisely what makes `location.ms` honest: the
+counter measures registration lifetime, and that quantity is no longer divorced
+from reality.
+
+**A fix arrives within milliseconds of every re-registration**, which bounds the
+staleness the coarser profile was feared to introduce:
+
+```
+17:57:00.117 +registration → 17:57:00.127 delivered location[1]   (10 ms)
+17:58:05.798 +registration → 17:58:05.802 delivered location[1]   ( 4 ms)
+17:59:09.965 +registration → 17:59:09.967 delivered location[1]   ( 2 ms)
+18:00:09.206 +registration → 18:00:09.213 delivered location[1]   ( 7 ms)
+```
+
+The `fused` provider hands over its cached fix on registration, so the window in
+which a returning user could act on a stale geohash is milliseconds, not the 60 s
+poll interval. Caveat: that cache is warm on this device because Maps and GMS
+keep it fresh; on a device with no other location consumer it could be colder,
+which is what `freshestLastKnownLocation` exists to cover.
+
+**Side-by-side A/B, same device, same instant, both clients backgrounded and
+running.** The unmodified release client (1.13.1, installed via Obtainium, pid
+5552) and the benchmark build of this branch (pid 28682) were sampled together:
+
+```
+com.vitorpamplona.amethyst/B7B299BE  {bg, na} (COARSE) Request[PASSIVE,     minUpdateDistance=100.0]  (inactive)
+com.vitorpamplona.amethyst/B7B299BE  {bg, na} (COARSE) Request[@+10m LOW_POWER, minUpdateDistance=100.0]  (inactive)
+com.vitorpamplona.amethyst/B7B299BE  {bg, na} (COARSE) Request[@+10m LOW_POWER, minUpdateDistance=100.0]  (inactive)
+com.vitorpamplona.amethyst/B7B299BE  {bg, na} (COARSE) Request[@+10m LOW_POWER, minUpdateDistance=100.0]  (inactive)
+                                     ← com.vitorpamplona.amethyst.benchmark: no rows at all
+```
+
+Four held registrations versus zero. Note the release client's rows are all
+`{bg, na} … (inactive)`: the OS has throttled the effective interval to 10
+minutes and suspended delivery, exactly as §"What the device reports" describes —
+but the **registration is still held**, and registration-held time is precisely
+what `location.ms` counts. That is the inflation, visible in one frame.
+
+Naming note for anyone re-reading the numbers above: both artifacts are `play`
+**flavor** builds and differ only by buildType, so "the Play install" is an
+ambiguous label. The unmodified client here is the *release* build, and on this
+device it came from Obtainium rather than Google Play.
+
+### Ledger invariant confirmed (2026-07-31, benchmark client, in-app report)
+
+The acceptance criterion `location.ms ≤ app.fgms + 5 s × transitions` now checks
+out against accumulated data:
+
+| | `location.ms` | `app.fgms` | ratio |
+|---|---|---|---|
+| release client 1.13.0, day 20663 (before) | 25,660,172 | 9,147 | **2,805×** |
+| benchmark, day 20664 (permission granted mid-day) | 3m7.3s | 11m31.0s | 0.27× |
+| benchmark, **day 20665** (granted all day) | **2m10.8s** | **1m56.9s** | **1.12×** |
+
+Day 20665 is the clean case: `location.ms` exceeds `app.fgms` by 13.9 s, which
+requires ≥ 3 background transitions to fall inside the grace allowance — met by
+the report navigation plus an `am start`. Day 20664 independently reconciles with
+the `dumpsys` measurement: 2m33.5s of OS registration-held + 4 × 5 s grace =
+~2m53.5s predicted, 3m7.3s actual, the residual being foreground use after the
+measurement ended. **The ledger and the OS now agree**, where before they were
+irreconcilable (10.7 h ledger vs 8h26m OS-active over three weeks).
+
+**Limitation:** this is not a within-package before/after. `location.ms` is
+absent from days 20648–20663 because the benchmark client had location permission
+*denied* until 2026-07-30; the "before" is no data, not inflated data.
+
+### The same data closes the battery question
+
+Over days 20659–20665 on this device: **5m18s** of location listening against
+**596 pp** of background battery drain (~85 pp/day). Location cannot be a
+meaningful contributor at that ratio — Finding 1 is settled, and not in the
+direction the original analysis assumed.
+
+Three consumers visible in the same report, none of them location:
+
+- `service.alwayson.ms` ≈ **23.9 h/day** (148.9 h over 7 days) — an always-on
+  foreground service running essentially continuously. Largest structural
+  difference from a stock client; worth confirming it is deliberately enabled.
+- **Finding 2, unchanged.** 3,732 relay-hours over 7 days. Day 20664 alone:
+  9,831 successful dials against 25,133 failures = **71.9 %**, matching the
+  original report's 75 %.
+- **Finding 4, now on cellular.** Day 20664 `net.other.mobile.bg.activems =
+  52,392,613` — **14.6 h** of background mobile active time with **0 requests and
+  0 bytes**. The three-moment `isForeground()` sampling, exactly as diagnosed, so
+  the fg/bg split in this report still cannot be trusted.
+
+Caveat: the benchmark client's round-the-clock always-on service makes its
+battery figures non-comparable to a stock install. The relay and `net.other`
+figures do match the release client's original report closely.
+
+### Smoke test on a clean install (2026-07-31, benchmark client)
+
+Uninstalled and reinstalled from branch HEAD so the account, ledger and
+permission grant all started empty — which is what makes the first-grant and
+empty-cache paths reachable. UID changed 10805 → 10806, cleanly separating the
+new data.
+
+- **R1 — no `Loading` flash on return to foreground: PASS.** Observed directly:
+  granted the permission, set a feed to Around Me, backgrounded for 10 s,
+  reopened — the geohash was present immediately with no blank feed. This was the
+  last open acceptance criterion on the branch and the only one no test could
+  cover. `dumpsys` shows why it works: the fix is delivered 1–6 ms after each
+  re-registration.
+- **Precise profile live and distinct: PASS.** Geohash screens produce
+  `@+10s0ms BALANCED, minUpdateDistance=100.0`, and the aggregate's `min/max
+  interval` moved from `60s/60s` to `10s/60s`. Both profiles are real in
+  production, not just in the unit tests.
+- **Refcount under concurrent flows: PASS.** The coarse registration `766C58A4`
+  came up at 15:49:10 and survived **four complete precise-flow cycles**
+  untouched (15:49:41–46, 15:50:47–52, 15:52:07–15:53:05, 15:53:17–22), with
+  both live simultaneously during the first. Opening and closing geohash chats
+  never closes the "Around Me" registration — `RefCountedSession` doing on a real
+  device what `LocationLedgerCompositionTest` asserts.
+- **No hang in the location picker.** Every precise registration received a fix
+  within ~1 ms; none stuck open. That path does
+  `preciseGeohashStateFlow.first { it is Success }`, which would hang rather than
+  crash if the gate failed to yield.
+- **Aggregate:** total 6m7.553s / active 6m7.401s (152 ms apart) / foreground
+  5m49.441s. Foreground trails total by 18.1 s across ~7 background transitions,
+  ≈ 2.6 s each — the grace period, visible at a scale where it is easy to check.
+
+**Measurement note:** counting listeners with `grep -c` on the package name is
+unreliable — the `service: ProviderRequest[…]` summary line also names the
+package when it is the only requester, inflating the count by one. List the rows
+and exclude that line instead. A count of zero is unambiguous either way.
+
+Still not verified: nothing on the gate itself. The `location.ms ≤ app.fgms +
+5 s × transitions` invariant was separately confirmed from accumulated ledger
+data (see above); the clean install reset that counter, so it will need another
+day of use to re-check at scale.
+
+## Follow-ups (not in this change)
+
+- **`preciseGeohashStateFlow` is not actually building-level.** With only
+  `ACCESS_COARSE_LOCATION`, Android fuzzes every fix to roughly a 3 km grid, so
+  the 8-char geohash and the location chat channels built on it are far coarser
+  than they claim (`LocationState.kt:104-141`, `GeohashChatScreen.kt:165`,
+  `NewGeohashChatScreen.kt:309`). The profile is kept intact here so the intent
+  survives if the app ever requests `ACCESS_FINE_LOCATION`; whether to request
+  it, or to stop advertising building-level precision, is a separate decision.
+- **`GeohashChatScreen.kt:161-163` is a one-way permission latch** — it calls
+  `setLocationPermission(true)` inside an `if (isGranted)` rather than passing
+  the boolean, as every other caller does (`LoggedInPage.kt:144`,
+  `LocationAsHash.kt:64`, `NewGeohashChatScreen.kt:285`,
+  `GeohashLocationPickerDialog.kt:270`). Once set, a revoked permission is never
+  reflected back into the shared `LocationState`. Small, in the blast radius,
+  and cheap.
+- **An `Unavailable` `LocationResult`**, distinct from `LackPermission`, so a
+  device with no usable provider stops being told "No Location Permissions" when
+  it has them. Ten references across five files
+  (`DisplayLocationObserver.kt`, `FeedFilterSpinner.kt`, `HomeScreen.kt`,
+  `NewGeohashChatScreen.kt`, `LocationState.kt`). Belongs with the H1 fix
+  messaging — see the stated decision in §B.
+- Recording the chosen provider as a ledger counter, so `location.ms` can be
+  read as a cost signal.
+- Whether Products should still default to `TopFilter.AroundMe`.
+- Finding 2 — the relay reconnect storm.

amethyst/src/androidTest/java/com/vitorpamplona/amethyst/NotificationFeedFilterModeOverrideTest.kt

@@ -22,7 +22,6 @@ package com.vitorpamplona.amethyst
 
 import androidx.test.ext.junit.runners.AndroidJUnit4
 import com.vitorpamplona.amethyst.commons.relayClient.assemblers.CashuMintDirectoryFilterAssembler
-import com.vitorpamplona.amethyst.commons.relayClient.assemblers.CashuWalletFilterAssembler
 import com.vitorpamplona.amethyst.model.Account
 import com.vitorpamplona.amethyst.model.AccountSettings
 import com.vitorpamplona.amethyst.model.LocalCache
@@ -86,7 +85,6 @@ class NotificationFeedFilterModeOverrideTest {
                 signer = NostrSignerInternal(keyPair),
                 geolocationFlow = { MutableStateFlow<LocationState.LocationResult>(LocationState.LocationResult.Loading) },
                 nwcFilterAssembler = { NWCPaymentFilterAssembler(client) },
-                cashuWalletFilterAssembler = { CashuWalletFilterAssembler(client) },
                 cashuMintDirectoryFilterAssembler = { CashuMintDirectoryFilterAssembler(client) },
                 okHttpClientForMoney = { OkHttpClient() },
                 otsResolverBuilder = { EmptyOtsResolverBuilder.build() },

amethyst/src/androidTest/java/com/vitorpamplona/amethyst/ThreadDualAxisChartAssemblerTest.kt

@@ -23,7 +23,6 @@ package com.vitorpamplona.amethyst
 import androidx.test.ext.junit.runners.AndroidJUnit4
 import com.fasterxml.jackson.module.kotlin.readValue
 import com.vitorpamplona.amethyst.commons.relayClient.assemblers.CashuMintDirectoryFilterAssembler
-import com.vitorpamplona.amethyst.commons.relayClient.assemblers.CashuWalletFilterAssembler
 import com.vitorpamplona.amethyst.commons.viewmodels.thread.ThreadFeedFilter
 import com.vitorpamplona.amethyst.model.Account
 import com.vitorpamplona.amethyst.model.AccountSettings
@@ -77,7 +76,6 @@ class ThreadDualAxisChartAssemblerTest {
                 signer = NostrSignerInternal(keyPair),
                 geolocationFlow = { MutableStateFlow<LocationState.LocationResult>(LocationState.LocationResult.Loading) },
                 nwcFilterAssembler = { NWCPaymentFilterAssembler(client) },
-                cashuWalletFilterAssembler = { CashuWalletFilterAssembler(client) },
                 cashuMintDirectoryFilterAssembler = { CashuMintDirectoryFilterAssembler(client) },
                 okHttpClientForMoney = { OkHttpClient() },
                 otsResolverBuilder = { EmptyOtsResolverBuilder.build() },

amethyst/src/main/AndroidManifest.xml

@@ -295,6 +295,93 @@
             </intent-filter>
         </activity-alias>
 
+        <!-- "New Picture" share target: a gallery (or camera) shares an image and it goes straight
+             into the picture feed as a NIP-68 kind-20 post instead of a text note with a link. The
+             android:name simple class ("ShareAsPictureAlias") is matched at runtime by
+             ShareIntentRouting.SHARE_AS_PICTURE_ALIAS_SIMPLE_NAME; keep the two in sync. -->
+        <activity-alias
+            android:name=".ui.ShareAsPictureAlias"
+            android:exported="true"
+            android:label="@string/share_target_as_picture"
+            android:targetActivity=".ui.MainActivity">
+
+            <intent-filter android:label="@string/share_target_as_picture">
+                <action android:name="android.intent.action.SEND" />
+                <category android:name="android.intent.category.DEFAULT" />
+                <data android:mimeType="image/*" />
+            </intent-filter>
+
+            <intent-filter android:label="@string/share_target_as_picture">
+                <action android:name="android.intent.action.SEND_MULTIPLE" />
+                <category android:name="android.intent.category.DEFAULT" />
+                <data android:mimeType="image/*" />
+            </intent-filter>
+        </activity-alias>
+
+        <!-- "New Short" share target: a video shared here always becomes a NIP-71 kind-22 short so
+             it lands in the Shorts feed, whatever its orientation. Video-only — a short is a video.
+             The android:name simple class ("ShareAsShortVideoAlias") is matched at runtime by
+             ShareIntentRouting.SHARE_AS_SHORT_VIDEO_ALIAS_SIMPLE_NAME; keep the two in sync. -->
+        <activity-alias
+            android:name=".ui.ShareAsShortVideoAlias"
+            android:exported="true"
+            android:label="@string/share_target_as_short_video"
+            android:targetActivity=".ui.MainActivity">
+
+            <intent-filter android:label="@string/share_target_as_short_video">
+                <action android:name="android.intent.action.SEND" />
+                <category android:name="android.intent.category.DEFAULT" />
+                <data android:mimeType="video/*" />
+            </intent-filter>
+
+            <intent-filter android:label="@string/share_target_as_short_video">
+                <action android:name="android.intent.action.SEND_MULTIPLE" />
+                <category android:name="android.intent.category.DEFAULT" />
+                <data android:mimeType="video/*" />
+            </intent-filter>
+        </activity-alias>
+
+        <!-- "New Video" share target: opens the Video feed's media composer, which publishes a
+             NIP-71 video event (kind 21 or 22 by orientation) instead of a text note. The
+             android:name simple class ("ShareAsVideoAlias") is matched at runtime by
+             ShareIntentRouting.SHARE_AS_VIDEO_ALIAS_SIMPLE_NAME; keep the two in sync. -->
+        <activity-alias
+            android:name=".ui.ShareAsVideoAlias"
+            android:exported="true"
+            android:label="@string/share_target_as_video"
+            android:targetActivity=".ui.MainActivity">
+
+            <intent-filter android:label="@string/share_target_as_video">
+                <action android:name="android.intent.action.SEND" />
+                <category android:name="android.intent.category.DEFAULT" />
+                <data android:mimeType="video/*" />
+            </intent-filter>
+
+            <intent-filter android:label="@string/share_target_as_video">
+                <action android:name="android.intent.action.SEND_MULTIPLE" />
+                <category android:name="android.intent.category.DEFAULT" />
+                <data android:mimeType="video/*" />
+            </intent-filter>
+        </activity-alias>
+
+        <!-- "New Highlight" share target: a browser (or reader) shares a selected passage of
+             text and it opens the NIP-84 highlight composer. Text-only — a highlight is a text
+             passage, so no image/video filters here. The android:name simple class
+             ("ShareAsHighlightAlias") is matched at runtime by
+             ShareIntentRouting.SHARE_AS_HIGHLIGHT_ALIAS_SIMPLE_NAME; keep the two in sync. -->
+        <activity-alias
+            android:name=".ui.ShareAsHighlightAlias"
+            android:exported="true"
+            android:label="@string/share_target_as_highlight"
+            android:targetActivity=".ui.MainActivity">
+
+            <intent-filter android:label="@string/share_target_as_highlight">
+                <action android:name="android.intent.action.SEND" />
+                <category android:name="android.intent.category.DEFAULT" />
+                <data android:mimeType="text/plain" />
+            </intent-filter>
+        </activity-alias>
+
         <!-- Health Connect privacy-policy rationale on Android 14+. Without this activity-alias
              the permission request fails silently (no dialog appears). The system launches it,
              guarded by START_VIEW_PERMISSION_USAGE, to show our privacy policy; it routes into

amethyst/src/main/java/com/vitorpamplona/amethyst/Amethyst.kt

@@ -56,11 +56,36 @@ import java.io.File
  */
 class Amethyst : Application() {
     init {
-        Log.minLevel = if (BuildConfig.DEBUG) LogLevel.DEBUG else LogLevel.ERROR
+        Log.minLevel = DEFAULT_LOG_LEVEL
         Log.d("AmethystApp") { "Creating App $this" }
     }
 
     companion object {
+        /**
+         * Restores the full firehose in debug builds: per-socket relay lifecycle
+         * (`Connecting…`/`Disconnected`/`OnOpen`), per-second event throughput, per-stream Arti
+         * SOCKS errors and per-relay census detail.
+         *
+         * Off by default. A cold start on the outbox model dials ~400 relays, and those sources
+         * alone emit ~3.7k of the ~6.2k lines an 80s boot produces — which buries the boot
+         * narrative and the relay-protocol warnings (`auth-required`, `rate-limited`,
+         * `unsupported: too many filters`) that are the actionable ones. Flip this, or set
+         * [Log.minLevel] at runtime, when you need the per-socket detail back.
+         */
+        const val VERBOSE_LOGS = false
+
+        /**
+         * Debug defaults to INFO so a boot reads as a narrative plus warnings; release defaults to
+         * WARN rather than ERROR so relay-protocol refusals stay visible in the field — they are
+         * the highest-value-per-line diagnostics we emit and were previously dropped entirely.
+         */
+        val DEFAULT_LOG_LEVEL: LogLevel =
+            when {
+                !BuildConfig.DEBUG -> LogLevel.WARN
+                VERBOSE_LOGS -> LogLevel.DEBUG
+                else -> LogLevel.INFO
+            }
+
         lateinit var instance: AppModules
             private set
     }
@@ -83,10 +108,15 @@ class Amethyst : Application() {
         // is self-contained (WebView + IPC), so we skip all app init there and
         // leave `instance` unset; any accidental use fails fast.
         if (isNappletSandbox) {
-            Log.d("AmethystApp") { "Skipping AppModules init in sandbox process" }
+            // Milestone, not chatter: this is the one line that explains why `instance` is unset
+            // and `LocalCache` is empty in this process. Without it a napplet-process log looks
+            // like a broken app rather than a deliberately secret-free sandbox.
+            Log.i("AmethystApp") { "Napplet sandbox process starting — no account, no AppModules" }
             return
         }
 
+        Log.i("AmethystApp") { "Amethyst ${BuildConfig.VERSION_NAME} starting in main process (log level ${Log.minLevel})" }
+
         instance = AppModules(this)
 
         // Hydrate the device-local favorite-apps list (main process only; the sandbox never reads it).

amethyst/src/main/java/com/vitorpamplona/amethyst/AppModules.kt

@@ -51,6 +51,7 @@ import com.vitorpamplona.amethyst.model.preferences.BuzzChannelStarPreferences
 import com.vitorpamplona.amethyst.model.preferences.BuzzWorkspacePreferences
 import com.vitorpamplona.amethyst.model.preferences.NamecoinSharedPreferences
 import com.vitorpamplona.amethyst.model.preferences.OtsSharedPreferences
+import com.vitorpamplona.amethyst.model.preferences.RelayGroupDeletionPreferences
 import com.vitorpamplona.amethyst.model.preferences.TorSharedPreferences
 import com.vitorpamplona.amethyst.model.preferences.UiSharedPreferences
 import com.vitorpamplona.amethyst.model.privacyOptions.RoleBasedHttpClientBuilder
@@ -94,6 +95,7 @@ import com.vitorpamplona.amethyst.service.relayClient.authCommand.model.AuthCoor
 import com.vitorpamplona.amethyst.service.relayClient.diagnostics.BootRelayDiagnostics
 import com.vitorpamplona.amethyst.service.relayClient.notifyCommand.model.NotifyCoordinator
 import com.vitorpamplona.amethyst.service.relayClient.reqCommand.RelaySubscriptionsCoordinator
+import com.vitorpamplona.amethyst.service.relayClient.reqCommand.account.AccountSubscriptionRegistry
 import com.vitorpamplona.amethyst.service.relayClient.reqCommand.event.EventFinderQueryState
 import com.vitorpamplona.amethyst.service.relayClient.reqCommand.user.UserFinderQueryState
 import com.vitorpamplona.amethyst.service.relayClient.speedLogger.RelaySpeedLogger
@@ -104,6 +106,7 @@ import com.vitorpamplona.amethyst.service.resourceusage.HttpUsageMeter
 import com.vitorpamplona.amethyst.service.resourceusage.MeteringNostrSigner
 import com.vitorpamplona.amethyst.service.resourceusage.ProcessCpuSampler
 import com.vitorpamplona.amethyst.service.resourceusage.RadioBurstEstimator
+import com.vitorpamplona.amethyst.service.resourceusage.RefCountedSession
 import com.vitorpamplona.amethyst.service.resourceusage.RelayConnectionTimeIntegrator
 import com.vitorpamplona.amethyst.service.resourceusage.RelayUsageListener
 import com.vitorpamplona.amethyst.service.resourceusage.ResourceUsageAccountant
@@ -245,10 +248,17 @@ class AppModules(
         OtsSharedPreferences(appContext, applicationIOScope)
     }
 
-    // App services that should be run as soon as there are subscribers to their flows
+    // App services that should be run as soon as there are subscribers to their
+    // flows. Location additionally releases its OS registration whenever no
+    // activity is started — see the foreground gate inside LocationState.
     val locationManager by lazy {
         Log.d("AppModules", "LocationManager Init")
-        LocationState(appContext, applicationIOScope, onListening = { locationSession.setActive(it) })
+        LocationState(
+            appContext,
+            applicationIOScope,
+            isForeground = foregroundTracker.isForeground,
+            onListening = { locationRefCount.setActive(it) },
+        )
     }
     val connManager = ConnectivityManager(appContext, applicationIOScope)
 
@@ -287,6 +297,11 @@ class AppModules(
     // Restore + persist the user's starred Buzz workspace channels across restarts (device-global).
     val buzzChannelStarPrefs = BuzzChannelStarPreferences(appContext, applicationIOScope)
 
+    // Restore + persist the set of relay-group channels deleted (kind-9008) on this device, so a
+    // deleted channel stays hidden across a restart even if the host relay re-announces a stale
+    // kind-44100 for it (device-global; a delete is authoritative and terminal for everyone).
+    val relayGroupDeletionPrefs = RelayGroupDeletionPreferences(appContext, applicationIOScope)
+
     // Service that will run at all times to receive events from Pokey
     val pokeyReceiver = PokeyReceiver()
 
@@ -368,6 +383,11 @@ class AppModules(
     private val torSession = SessionTimeIntegrator(resourceUsage, UsageKeys.TOR_MS, UsageKeys.TOR_STARTS).also { it.registerFlushHook() }
     private val locationSession = SessionTimeIntegrator(resourceUsage, UsageKeys.LOCATION_MS).also { it.registerFlushHook() }
 
+    // LocationState exposes two independent flows that can both be listening at
+    // once (the "Around Me" feed plus an open geohash chat). Refcounting keeps
+    // either one stopping from closing the other's segment.
+    private val locationRefCount = RefCountedSession(locationSession::setActive)
+
     // Time-per-screen (route base names only — arguments never reach the
     // ledger). Fed by the navigation listener in AppNavigation; foreground
     // gating means backgrounding on a screen closes its segment.
@@ -865,7 +885,6 @@ class AppModules(
         AccountCacheState(
             geolocationFlow = { locationManager.geohashStateFlow },
             nwcFilterAssembler = { sources.nwc },
-            cashuWalletFilterAssembler = { sources.cashuWallet },
             cashuMintDirectoryFilterAssembler = { sources.cashuMintDirectory },
             okHttpClientForMoney = roleBasedHttpClientBuilder::okHttpClientForMoney,
             contentResolverFn = { appContext.contentResolver },
@@ -951,6 +970,12 @@ class AppModules(
         )
     }
 
+    // Gives every account that opted into running in the background its own
+    // account-level subscriptions (notifications, DMs, gift wraps, wallet), with no
+    // AccountViewModel behind it. Driven by alwaysOnNotificationServiceManager below,
+    // which already tracks which accounts opted in.
+    val accountSubscriptions = AccountSubscriptionRegistry(sources.account)
+
     // Manages always-on notification service lifecycle. Preloads every saved
     // writable account while enabled so GiftWraps for non-active accounts still
     // get unwrapped by their owning account's newNotesPreProcessor.
@@ -960,6 +985,8 @@ class AppModules(
             scope = applicationIOScope,
             accountsCache = accountsCache,
             localPreferences = LocalPreferences,
+            subscriptions = accountSubscriptions,
+            isForeground = foregroundTracker.isForeground,
             activePubKeyProvider = { sessionManager.loggedInAccount()?.pubKey },
         )
 
@@ -1224,6 +1251,14 @@ class AppModules(
                         blossomResolver.uriToUrlCache.evictAll()
                         blossomResolver.blossomHitCache.cache.evictAll()
                         localBlossomCacheProbe.invalidate()
+                        // Re-probe immediately so enabling the feature activates it
+                        // this session. Otherwise `available` only advances when a
+                        // `blossom:` URI is resolved, and the common feed-image path
+                        // never routes through the resolver until `available` is
+                        // already true — so a freshly-enabled toggle (or a cache that
+                        // came up after launch) would stay dormant and the settings
+                        // "detected" chip would read stale.
+                        localBlossomCacheProbe.isAvailable()
                     }
                 }
             }

amethyst/src/main/java/com/vitorpamplona/amethyst/LocalPreferences.kt

@@ -73,6 +73,7 @@ import com.vitorpamplona.quartz.nip78AppData.AppSpecificDataEvent
 import com.vitorpamplona.quartz.nip85TrustedAssertions.list.TrustProviderListEvent
 import com.vitorpamplona.quartz.nipB1Bolt12Zaps.offer.Bolt12OfferListEvent
 import com.vitorpamplona.quartz.utils.Log
+import com.vitorpamplona.quartz.utils.TimeUtils
 import kotlinx.coroutines.CancellationException
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.async
@@ -132,6 +133,7 @@ private object PrefKeys {
     const val DEFAULT_NSITES_FOLLOW_LIST = "defaultNsitesFollowList"
     const val DEFAULT_WORKOUTS_FOLLOW_LIST = "defaultWorkoutsFollowList"
     const val DEFAULT_GIT_REPOSITORIES_FOLLOW_LIST = "defaultGitRepositoriesFollowList"
+    const val DEFAULT_HIGHLIGHTS_FOLLOW_LIST = "defaultHighlightsFollowList"
     const val DEFAULT_CALENDARS_FOLLOW_LIST = "defaultCalendarsFollowList"
     const val DEFAULT_PRODUCTS_FOLLOW_LIST = "defaultProductsFollowList"
     const val DEFAULT_SHORTS_FOLLOW_LIST = "defaultShortsFollowList"
@@ -324,6 +326,9 @@ object LocalPreferences {
                     }
 
                 if (!newSystemOfAccounts.isNullOrEmpty()) {
+                    // How many accounts are in play is the first thing you need when reading any
+                    // boot log: nearly every per-account subsystem below multiplies by this number.
+                    Log.i("LocalPreferences") { "Found ${newSystemOfAccounts.size} saved account(s)" }
                     newSystemOfAccounts
                 } else {
                     val oldAccounts = getString(PrefKeys.SAVED_ACCOUNTS, null)?.split(COMMA) ?: listOf()
@@ -522,6 +527,7 @@ object LocalPreferences {
                     putString(PrefKeys.DEFAULT_NSITES_FOLLOW_LIST, JsonMapper.toJson(settings.defaultNsitesFollowList.value))
                     putString(PrefKeys.DEFAULT_WORKOUTS_FOLLOW_LIST, JsonMapper.toJson(settings.defaultWorkoutsFollowList.value))
                     putString(PrefKeys.DEFAULT_GIT_REPOSITORIES_FOLLOW_LIST, JsonMapper.toJson(settings.defaultGitRepositoriesFollowList.value))
+                    putString(PrefKeys.DEFAULT_HIGHLIGHTS_FOLLOW_LIST, JsonMapper.toJson(settings.defaultHighlightsFollowList.value))
                     putString(PrefKeys.DEFAULT_CALENDARS_FOLLOW_LIST, JsonMapper.toJson(settings.defaultCalendarsFollowList.value))
                     putString(PrefKeys.DEFAULT_PRODUCTS_FOLLOW_LIST, JsonMapper.toJson(settings.defaultProductsFollowList.value))
                     putString(PrefKeys.DEFAULT_SHORTS_FOLLOW_LIST, JsonMapper.toJson(settings.defaultShortsFollowList.value))
@@ -710,6 +716,7 @@ object LocalPreferences {
 
     private suspend fun innerLoadCurrentAccountFromEncryptedStorage(npub: String?): AccountSettings? {
         Log.d("LocalPreferences") { "Load account from file $npub" }
+        val startedAtMs = TimeUtils.nowMillis()
         val result =
             withContext(Dispatchers.IO) {
                 return@withContext with(encryptedPreferences(npub)) {
@@ -935,6 +942,7 @@ object LocalPreferences {
                         defaultNsitesFollowList = MutableStateFlow(followListPrefs.nsites),
                         defaultWorkoutsFollowList = MutableStateFlow(followListPrefs.workouts),
                         defaultGitRepositoriesFollowList = MutableStateFlow(followListPrefs.gitRepositories),
+                        defaultHighlightsFollowList = MutableStateFlow(followListPrefs.highlights),
                         defaultCalendarsFollowList = MutableStateFlow(followListPrefs.calendars),
                         defaultProductsFollowList = MutableStateFlow(followListPrefs.products),
                         defaultShortsFollowList = MutableStateFlow(followListPrefs.shorts),
@@ -1014,7 +1022,11 @@ object LocalPreferences {
                     )
                 }
             }
-        Log.d("LocalPreferences") { "Loaded account from file $npub" }
+        // Milestone with its cost attached. Decrypting and parsing one account's settings is one of
+        // the most expensive things a cold start does (it resolves a fan of backup events), it runs
+        // once per account, and "which account was slow" is the first question when a boot drags.
+        // The six intermediate steps above stay at DEBUG.
+        Log.i("LocalPreferences") { "Loaded account $npub in ${TimeUtils.nowMillis() - startedAtMs}ms" }
         return result
     }
 
@@ -1044,6 +1056,7 @@ object LocalPreferences {
         val nsites: TopFilter,
         val workouts: TopFilter,
         val gitRepositories: TopFilter,
+        val highlights: TopFilter,
         val calendars: TopFilter,
         val products: TopFilter,
         val shorts: TopFilter,
@@ -1101,6 +1114,7 @@ object LocalPreferences {
             nsites = parseTopFilterOrDefault(getString(PrefKeys.DEFAULT_NSITES_FOLLOW_LIST, null), TopFilter.Global),
             workouts = parseTopFilterOrDefault(getString(PrefKeys.DEFAULT_WORKOUTS_FOLLOW_LIST, null), TopFilter.Global),
             gitRepositories = parseTopFilterOrDefault(getString(PrefKeys.DEFAULT_GIT_REPOSITORIES_FOLLOW_LIST, null), TopFilter.Global),
+            highlights = parseTopFilterOrDefault(getString(PrefKeys.DEFAULT_HIGHLIGHTS_FOLLOW_LIST, null), TopFilter.Global),
             calendars = parseTopFilterOrDefault(getString(PrefKeys.DEFAULT_CALENDARS_FOLLOW_LIST, null), TopFilter.Global),
             products = parseTopFilterOrDefault(getString(PrefKeys.DEFAULT_PRODUCTS_FOLLOW_LIST, null), TopFilter.AroundMe),
             shorts = parseTopFilterOrDefault(getString(PrefKeys.DEFAULT_SHORTS_FOLLOW_LIST, null), TopFilter.Global),

amethyst/src/main/java/com/vitorpamplona/amethyst/model/Account.kt

@@ -50,6 +50,7 @@ import com.vitorpamplona.amethyst.commons.model.nip28PublicChats.PublicChatChann
 import com.vitorpamplona.amethyst.commons.model.nip28PublicChats.PublicChatListDecryptionCache
 import com.vitorpamplona.amethyst.commons.model.nip28PublicChats.PublicChatListState
 import com.vitorpamplona.amethyst.commons.model.nip29RelayGroups.RelayGroupChannel
+import com.vitorpamplona.amethyst.commons.model.nip29RelayGroups.RelayGroupDeletions
 import com.vitorpamplona.amethyst.commons.model.nip29RelayGroups.RelayGroupListDecryptionCache
 import com.vitorpamplona.amethyst.commons.model.nip29RelayGroups.RelayGroupListState
 import com.vitorpamplona.amethyst.commons.model.nip29RelayGroups.RelayGroupMembership
@@ -440,7 +441,6 @@ class Account(
     override val signer: NostrSigner,
     val geolocationFlow: () -> StateFlow<LocationState.LocationResult>,
     val nwcFilterAssembler: () -> NWCPaymentFilterAssembler,
-    val cashuWalletFilterAssembler: () -> com.vitorpamplona.amethyst.commons.relayClient.assemblers.CashuWalletFilterAssembler,
     val cashuMintDirectoryFilterAssembler: () -> com.vitorpamplona.amethyst.commons.relayClient.assemblers.CashuMintDirectoryFilterAssembler,
     val okHttpClientForMoney: (String) -> okhttp3.OkHttpClient,
     val otsResolverBuilder: () -> OtsResolver,
@@ -740,7 +740,6 @@ class Account(
             signer = signer,
             cache = cache,
             scope = scope,
-            assembler = cashuWalletFilterAssembler(),
             outboxRelaysFlow = outboxRelays.flow,
             inboxRelaysFlow = notificationRelays.flow,
             dmRelaysFlow = dmRelays.flow,
@@ -873,6 +872,9 @@ class Account(
     val liveGitRepositoriesFollowLists: StateFlow<IFeedTopNavFilter> = topNavFilterFlow(settings.defaultGitRepositoriesFollowList)
     val liveGitRepositoriesFollowListsPerRelay = OutboxLoaderState(liveGitRepositoriesFollowLists, cache, scope).flow
 
+    val liveHighlightsFollowLists: StateFlow<IFeedTopNavFilter> = topNavFilterFlow(settings.defaultHighlightsFollowList)
+    val liveHighlightsFollowListsPerRelay = OutboxLoaderState(liveHighlightsFollowLists, cache, scope).flow
+
     val liveCalendarsFollowLists: StateFlow<IFeedTopNavFilter> = topNavFilterFlow(settings.defaultCalendarsFollowList)
     val liveCalendarsFollowListsPerRelay = OutboxLoaderState(liveCalendarsFollowLists, cache, scope).flow
 
@@ -3187,9 +3189,14 @@ class Account(
         val filters =
             entries.flatMap { entry ->
                 val state = concordSessions.sessionFor(entry.id)?.state?.value ?: return@flatMap emptyList()
-                ConcordSubscriptionPlanner.channelPreviewFilters(entry, state, lastReadFor = { channelIdHex ->
-                    loadLastRead(concordChannelLastReadRoute(entry.id, channelIdHex))
-                })
+                ConcordSubscriptionPlanner.channelPreviewFilters(
+                    entry,
+                    state,
+                    lastReadFor = { channelIdHex ->
+                        loadLastRead(concordChannelLastReadRoute(entry.id, channelIdHex))
+                    },
+                    accountPubKey = userProfile().pubkeyHex,
+                )
             }
         if (filters.isEmpty()) return
         val byRelay = filters.groupBy { it.relay }.mapValues { (_, group) -> group.map { it.filter } }
@@ -3462,6 +3469,10 @@ class Account(
         val template = DeleteGroupEvent.build(channel.groupId.id)
         signAndSendPrivatelyOrBroadcast(template) { channel.relays().toList() }
         unfollow(channel)
+        // Remember the deletion so the channel leaves the community's browse list immediately and
+        // stays gone across a restart — the relay drops the group but our cached 39000 metadata (and a
+        // stale re-announced 44100 on a Buzz relay) would otherwise keep it visible.
+        RelayGroupDeletions.markDeleted(channel.groupId)
     }
 
     /**
@@ -3668,6 +3679,10 @@ class Account(
         parent: String? = channel.parentGroupId(),
         children: List<String> = channel.childGroupIds(),
     ) {
+        // On a Buzz relay, visibility rides a `visibility` ("open"/"private") tag — the relay does NOT
+        // read NIP-29's `private` status flag — so a Buzz channel's visibility only actually changes on
+        // edit when we send that tag. A plain NIP-29 relay ignores it and honours the status flag.
+        val isBuzz = BuzzRelayDialect.isBuzz(channel.groupId.relayUrl)
         val template =
             EditMetadataEvent.build(
                 channel.groupId.id,
@@ -3679,10 +3694,24 @@ class Account(
                 geohashes = geohashes,
                 parent = parent,
                 children = children,
+                visibility = if (isBuzz) (if (isPrivate) BUZZ_VISIBILITY_PRIVATE else BUZZ_VISIBILITY_OPEN) else null,
             )
         signAndSendPrivatelyOrBroadcast(template) { channel.relays().toList() }
     }
 
+    /**
+     * Archive or unarchive a Buzz channel (a minimal kind-9002 carrying only the `archived` tag). The
+     * relay hides an archived channel from the sidebar and stamps the 39000, but keeps it and its
+     * history — the reversible counterpart to [deleteRelayGroup]. Admin/owner only; the relay enforces.
+     */
+    suspend fun archiveRelayGroup(
+        channel: RelayGroupChannel,
+        archived: Boolean,
+    ) {
+        val template = EditMetadataEvent.build(channel.groupId.id, archived = archived)
+        signAndSendPrivatelyOrBroadcast(template) { channel.relays().toList() }
+    }
+
     suspend fun follow(community: AddressableNote) = sendMyPublicAndPrivateOutbox(communityList.follow(community))
 
     suspend fun unfollow(community: AddressableNote) = sendMyPublicAndPrivateOutbox(communityList.unfollow(community))
@@ -4119,6 +4148,7 @@ class Account(
         alt: String?,
         contentWarningReason: String?,
         originalHash: String? = null,
+        videoKind: VideoPostKind = VideoPostKind.AUTO,
     ) {
         if (!isWriteable()) return
 
@@ -4162,7 +4192,10 @@ class Account(
                         thumbhash = headerInfo.thumbHash?.thumbhash,
                     )
 
-                if (headerInfo.dim.height > headerInfo.dim.width) {
+                // The composer forces the kind when it was opened from a feed that only reads one of
+                // them (Shorts, Longs) or from that feed's share target, so the post lands where the
+                // user asked for it. Everywhere else the orientation decides.
+                if (videoKind.isShort(headerInfo.dim)) {
                     VideoShortEvent.build(videoMeta, alt ?: "") {
                         contentWarningReason?.let { contentWarning(contentWarningReason) }
                     }

amethyst/src/main/java/com/vitorpamplona/amethyst/model/AccountSettings.kt

@@ -251,6 +251,7 @@ class AccountSettings(
     val defaultNsitesFollowList: MutableStateFlow<TopFilter> = MutableStateFlow(TopFilter.Global),
     val defaultWorkoutsFollowList: MutableStateFlow<TopFilter> = MutableStateFlow(TopFilter.Global),
     val defaultGitRepositoriesFollowList: MutableStateFlow<TopFilter> = MutableStateFlow(TopFilter.Global),
+    val defaultHighlightsFollowList: MutableStateFlow<TopFilter> = MutableStateFlow(TopFilter.Global),
     val defaultCalendarsFollowList: MutableStateFlow<TopFilter> = MutableStateFlow(TopFilter.Global),
     val defaultProductsFollowList: MutableStateFlow<TopFilter> = MutableStateFlow(TopFilter.AroundMe),
     val defaultShortsFollowList: MutableStateFlow<TopFilter> = MutableStateFlow(TopFilter.Global),
@@ -895,6 +896,17 @@ class AccountSettings(
         }
     }
 
+    fun changeDefaultHighlightsFollowList(name: FeedDefinition) {
+        changeDefaultHighlightsFollowList(name.code)
+    }
+
+    fun changeDefaultHighlightsFollowList(name: TopFilter) {
+        if (defaultHighlightsFollowList.value != name) {
+            defaultHighlightsFollowList.tryEmit(name)
+            saveAccountSettings()
+        }
+    }
+
     fun changeDefaultCalendarsFollowList(name: FeedDefinition) {
         changeDefaultCalendarsFollowList(name.code)
     }

amethyst/src/main/java/com/vitorpamplona/amethyst/model/AntiSpamFilter.kt

@@ -89,7 +89,13 @@ class AntiSpamFilter {
                 val link2 = njumpLink(NAddress.create(event.kind, event.pubKey, event.dTag(), relay))
                 val link1 = existingAddress?.let { njumpLink(NAddress.create(it.kind, it.pubKeyHex, it.dTag, relay)) } ?: link2
 
-                Log.w("Duplicated/SPAM") { "${relay?.url} $link1 $link2" }
+                // Debug, not warn: a duplicate detection is this filter working, not a fault, and
+                // it is already reported where it can be acted on — relayStats.newSpam below and
+                // the flowSpam emission that drives the UI. On a normal boot this fires ~34 times
+                // with a pair of njump links each, which is the widest line in the log and says
+                // nothing the spam counters don't. Keep the links at DEBUG for when you need to
+                // open the two events and compare them.
+                Log.d("Duplicated/SPAM") { "${relay?.url} $link1 $link2" }
 
                 // Log down offenders
                 val spammer = logOffender(hash, event)
@@ -118,7 +124,13 @@ class AntiSpamFilter {
                 // LRU cache while the spammer record still matches this hash.
                 val link1 = existingEvent?.let { njumpLink(NEvent.create(it, null, null, relay)) } ?: link2
 
-                Log.w("Duplicated/SPAM") { "${relay?.url} $link1 $link2" }
+                // Debug, not warn: a duplicate detection is this filter working, not a fault, and
+                // it is already reported where it can be acted on — relayStats.newSpam below and
+                // the flowSpam emission that drives the UI. On a normal boot this fires ~34 times
+                // with a pair of njump links each, which is the widest line in the log and says
+                // nothing the spam counters don't. Keep the links at DEBUG for when you need to
+                // open the two events and compare them.
+                Log.d("Duplicated/SPAM") { "${relay?.url} $link1 $link2" }
 
                 // Log down offenders
                 val spammer = logOffender(hash, event)

amethyst/src/main/java/com/vitorpamplona/amethyst/model/HomeFeedType.kt

@@ -40,12 +40,18 @@ import com.vitorpamplona.quartz.nip18Reposts.GenericRepostEvent
 import com.vitorpamplona.quartz.nip18Reposts.RepostEvent
 import com.vitorpamplona.quartz.nip22Comments.CommentEvent
 import com.vitorpamplona.quartz.nip23LongContent.LongTextNoteEvent
+import com.vitorpamplona.quartz.nip35Torrents.TorrentEvent
 import com.vitorpamplona.quartz.nip53LiveActivities.chat.LiveActivitiesChatMessageEvent
 import com.vitorpamplona.quartz.nip53LiveActivities.streaming.LiveActivitiesEvent
 import com.vitorpamplona.quartz.nip54Wiki.WikiNoteEvent
 import com.vitorpamplona.quartz.nip64Chess.challenge.offer.LiveChessGameChallengeEvent
 import com.vitorpamplona.quartz.nip64Chess.end.LiveChessGameEndEvent
 import com.vitorpamplona.quartz.nip64Chess.game.ChessGameEvent
+import com.vitorpamplona.quartz.nip68Picture.PictureEvent
+import com.vitorpamplona.quartz.nip71Video.VideoHorizontalEvent
+import com.vitorpamplona.quartz.nip71Video.VideoNormalEvent
+import com.vitorpamplona.quartz.nip71Video.VideoShortEvent
+import com.vitorpamplona.quartz.nip71Video.VideoVerticalEvent
 import com.vitorpamplona.quartz.nip84Highlights.HighlightEvent
 import com.vitorpamplona.quartz.nip88Polls.poll.PollEvent
 import com.vitorpamplona.quartz.nip88Polls.response.PollResponseEvent
@@ -72,11 +78,15 @@ enum class HomeFeedType(
     TEXT_NOTES("text_notes", listOf(TextNoteEvent.KIND)),
     REPOSTS("reposts", listOf(RepostEvent.KIND, GenericRepostEvent.KIND)),
     COMMENTS("comments", listOf(CommentEvent.KIND)),
+    PICTURES("pictures", listOf(PictureEvent.KIND)),
+    VIDEOS("videos", listOf(VideoNormalEvent.KIND, VideoHorizontalEvent.KIND)),
+    SHORTS("shorts", listOf(VideoShortEvent.KIND, VideoVerticalEvent.KIND)),
     ARTICLES("articles", listOf(LongTextNoteEvent.KIND)),
     WIKI("wiki", listOf(WikiNoteEvent.KIND)),
     HIGHLIGHTS("highlights", listOf(HighlightEvent.KIND)),
     POLLS("polls", listOf(PollEvent.KIND, ZapPollEvent.KIND, PollResponseEvent.KIND)),
     CLASSIFIEDS("classifieds", listOf(ClassifiedsEvent.KIND)),
+    TORRENTS("torrents", listOf(TorrentEvent.KIND)),
     VOICE("voice", listOf(VoiceEvent.KIND, VoiceReplyEvent.KIND)),
     LIVE_ACTIVITIES("live_activities", listOf(LiveActivitiesEvent.KIND, LiveActivitiesChatMessageEvent.KIND)),
     EPHEMERAL_CHAT("ephemeral_chat", listOf(EphemeralChatEvent.KIND)),

amethyst/src/main/java/com/vitorpamplona/amethyst/model/LocalCache.kt

@@ -41,6 +41,7 @@ import com.vitorpamplona.amethyst.commons.model.emphChat.EphemeralChatChannel
 import com.vitorpamplona.amethyst.commons.model.geohashChat.GeohashChatChannel
 import com.vitorpamplona.amethyst.commons.model.nip28PublicChats.PublicChatChannel
 import com.vitorpamplona.amethyst.commons.model.nip29RelayGroups.RelayGroupChannel
+import com.vitorpamplona.amethyst.commons.model.nip29RelayGroups.RelayGroupDeletions
 import com.vitorpamplona.amethyst.commons.model.nip53LiveActivities.LiveActivitiesChannel
 import com.vitorpamplona.amethyst.commons.model.observables.CreatedAtIdHexComparator
 import com.vitorpamplona.amethyst.commons.model.observables.EventListMatchingFilter
@@ -114,6 +115,7 @@ import com.vitorpamplona.quartz.buzz.stream.StreamMessageScheduledEvent
 import com.vitorpamplona.quartz.buzz.stream.StreamMessageV2Event
 import com.vitorpamplona.quartz.buzz.stream.StreamReminderEvent
 import com.vitorpamplona.quartz.buzz.stream.SystemMessageEvent
+import com.vitorpamplona.quartz.buzz.stream.SystemMessagePayload
 import com.vitorpamplona.quartz.buzz.stream.sidecars.ChannelSummaryEvent
 import com.vitorpamplona.quartz.buzz.stream.sidecars.PresenceSnapshotEvent
 import com.vitorpamplona.quartz.buzz.teams.TeamEvent
@@ -2223,6 +2225,30 @@ object LocalCache : ILocalCache, ICacheProvider, Dao {
             attachToRelayGroupIfScoped(event, relay)
         }
 
+    /**
+     * A Buzz kind-40099 system message. It renders as a narration row in the channel feed (via
+     * [consumeBuzzTimelineEvent]), but a `channel_deleted` one is also the **authoritative signal that
+     * a channel is gone**: the relay soft-deletes the channel and its 39000/39001/39002 discovery
+     * events but emits no member-removed notification and never retracts the kind-44100 that seeds the
+     * browse list — so without this the deleted channel keeps re-appearing (a stale 44100 re-announced
+     * every restart, its metadata now blank so it shows optimistically). Recording the delete in
+     * [RelayGroupDeletions] filters it out of every list and persists it across restarts.
+     *
+     * Gated on [isRelaySignedGroupEvent] (the 40099 is signed by the relay keypair) so a spoofed
+     * system message from a stray author can't hide a channel. Cross-device by construction: the relay
+     * replays this on subscribe, so a channel deleted on Buzz web/desktop is honored here too.
+     */
+    private fun consume(
+        event: SystemMessageEvent,
+        relay: NormalizedRelayUrl?,
+        wasVerified: Boolean,
+    ): Boolean =
+        consumeBuzzTimelineEvent(event, relay, wasVerified).also {
+            if (relay != null && isRelaySignedGroupEvent(event, relay) && event.payload()?.type == SystemMessagePayload.CHANNEL_DELETED) {
+                event.channel()?.let { channelId -> RelayGroupDeletions.markDeleted(GroupId(channelId, relay)) }
+            }
+        }
+
     /** Store-only consume for Buzz kinds that carry no channel timeline row. */
     private fun consumeBuzzRegularEvent(
         event: Event,
@@ -4798,7 +4824,7 @@ object LocalCache : ILocalCache, ICacheProvider, Dao {
                 is StreamMessageV2Event -> consumeBuzzTimelineEvent(event, relay, wasVerified)
                 is StreamMessageEditEvent -> consume(event, relay, wasVerified)
                 is StreamMessageDiffEvent -> consumeBuzzTimelineEvent(event, relay, wasVerified)
-                is SystemMessageEvent -> consumeBuzzTimelineEvent(event, relay, wasVerified)
+                is SystemMessageEvent -> consume(event, relay, wasVerified)
                 is CanvasEvent -> consume(event, relay, wasVerified)
                 // Forum root (45001) is a thread, not a chat row → Threads collection. Comments (45003)
                 // and votes (45002) are store-only: the forum-thread detail loads them on demand by root.

amethyst/src/main/java/com/vitorpamplona/amethyst/model/VideoPostKind.kt

@@ -0,0 +1,53 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.model
+
+import com.vitorpamplona.quartz.nip94FileMetadata.tags.DimensionTag
+
+/**
+ * Which NIP-71 kind a video upload is published as. Only videos are affected — whether an upload
+ * is a picture (NIP-68 kind 20) or a video is decided by the file's mime type and can't be
+ * overridden.
+ *
+ * The composer picks this from the feed it was opened on, so a post always lands in the feed the
+ * user was standing in (or shared to): the Shorts feed reads kind 22, the Longs feed reads kind 21
+ * and the Video feed reads both.
+ */
+enum class VideoPostKind {
+    /** Derive from the video's dimensions: portrait -> kind 22, landscape -> kind 21. */
+    AUTO,
+
+    /** Always NIP-71 kind 22 (short-form video), regardless of orientation. */
+    SHORT,
+
+    /** Always NIP-71 kind 21 (normal video), regardless of orientation. */
+    NORMAL,
+
+    ;
+
+    /** True when a video of [dim] should be published as a NIP-71 kind 22 short. */
+    fun isShort(dim: DimensionTag): Boolean =
+        when (this) {
+            SHORT -> true
+            NORMAL -> false
+            AUTO -> dim.height > dim.width
+        }
+}

amethyst/src/main/java/com/vitorpamplona/amethyst/model/accountsCache/AccountCacheState.kt

@@ -59,7 +59,6 @@ import java.io.File
 class AccountCacheState(
     val geolocationFlow: () -> StateFlow<LocationState.LocationResult>,
     val nwcFilterAssembler: () -> NWCPaymentFilterAssembler,
-    val cashuWalletFilterAssembler: () -> com.vitorpamplona.amethyst.commons.relayClient.assemblers.CashuWalletFilterAssembler,
     val cashuMintDirectoryFilterAssembler: () -> com.vitorpamplona.amethyst.commons.relayClient.assemblers.CashuMintDirectoryFilterAssembler,
     val okHttpClientForMoney: (String) -> okhttp3.OkHttpClient,
     val contentResolverFn: () -> ContentResolver,
@@ -266,7 +265,6 @@ class AccountCacheState(
             signer = signerWithClientTag,
             geolocationFlow = geolocationFlow,
             nwcFilterAssembler = nwcFilterAssembler,
-            cashuWalletFilterAssembler = cashuWalletFilterAssembler,
             cashuMintDirectoryFilterAssembler = cashuMintDirectoryFilterAssembler,
             okHttpClientForMoney = okHttpClientForMoney,
             otsResolverBuilder = otsResolverBuilder,

amethyst/src/main/java/com/vitorpamplona/amethyst/model/nip60Cashu/CashuWalletState.kt

@@ -28,8 +28,6 @@ import com.vitorpamplona.amethyst.commons.cashu.ops.RestoreOutcome
 import com.vitorpamplona.amethyst.commons.cashu.ops.SendTokenCompleted
 import com.vitorpamplona.amethyst.commons.cashu.ops.TokenEntry
 import com.vitorpamplona.amethyst.commons.cashu.ops.describeMintError
-import com.vitorpamplona.amethyst.commons.relayClient.assemblers.CashuWalletFilterAssembler
-import com.vitorpamplona.amethyst.commons.relayClient.assemblers.CashuWalletQueryState
 import com.vitorpamplona.amethyst.model.AccountSettings
 import com.vitorpamplona.amethyst.model.LocalCache
 import com.vitorpamplona.quartz.nip01Core.core.Event
@@ -102,7 +100,6 @@ class CashuWalletState(
     private val signer: NostrSigner,
     private val cache: LocalCache,
     private val scope: CoroutineScope,
-    private val assembler: CashuWalletFilterAssembler,
     private val outboxRelaysFlow: StateFlow<Set<NormalizedRelayUrl>>,
     private val inboxRelaysFlow: StateFlow<Set<NormalizedRelayUrl>>,
     private val dmRelaysFlow: StateFlow<Set<NormalizedRelayUrl>>,
@@ -391,7 +388,6 @@ class CashuWalletState(
     // Lifecycle
     // ============================================================
     private val jobs = mutableListOf<Job>()
-    private var currentSubscription: CashuWalletQueryState? = null
 
     @Volatile private var started = false
 
@@ -469,21 +465,11 @@ class CashuWalletState(
         //    our own kind:10019 — and another client may have published that
         //    with relays unrelated to our NIP-65 lists — so we listen on the
         //    union of those plus our NIP-65 inbox + DM relays.
-        jobs +=
-            scope.launch(Dispatchers.IO) {
-                combine(
-                    outboxRelaysFlow,
-                    inboxRelaysFlow,
-                    dmRelaysFlow,
-                    _nutzapInfoEvent,
-                ) { outbox, inbox, dm, info ->
-                    CashuWalletQueryState(
-                        pubkey = pubKey,
-                        ownEventRelays = outbox,
-                        inboxRelays = inbox + dm + (info?.relays() ?: emptyList()),
-                    )
-                }.collect { syncSubscription(it) }
-            }
+        // The relay subscription for this wallet is NOT here. It lives in
+        // CashuWalletEoseManager, inside the account-level assembler group, so it mounts and
+        // unmounts with every other account-level loader instead of running for the whole life of
+        // the Account object. What stays below is wallet *state*: indexing what arrives, and the
+        // local bookkeeping around it.
 
         // Reactive incremental update: any new event arrival that matches our
         // pubkey + the NIP-60/61 kinds we care about gets indexed.
@@ -538,25 +524,6 @@ class CashuWalletState(
     fun destroy() {
         jobs.forEach { it.cancel() }
         jobs.clear()
-        currentSubscription?.let { runCatching { assembler.unsubscribe(it) } }
-        currentSubscription = null
-    }
-
-    // ============================================================
-    // Subscription management
-    // ============================================================
-    private fun syncSubscription(next: CashuWalletQueryState) {
-        val previous = currentSubscription
-        if (next.ownEventRelays.isEmpty() && next.inboxRelays.isEmpty()) {
-            previous?.let { runCatching { assembler.unsubscribe(it) } }
-            currentSubscription = null
-            return
-        }
-        if (previous == next) return // unchanged
-
-        previous?.let { runCatching { assembler.unsubscribe(it) } }
-        currentSubscription = next
-        assembler.subscribe(next)
     }
 
     // ============================================================

amethyst/src/main/java/com/vitorpamplona/amethyst/model/preferences/RelayGroupDeletionPreferences.kt

@@ -0,0 +1,77 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.model.preferences
+
+import android.content.Context
+import androidx.compose.runtime.Stable
+import androidx.datastore.preferences.core.edit
+import androidx.datastore.preferences.core.stringSetPreferencesKey
+import com.vitorpamplona.amethyst.commons.model.nip29RelayGroups.RelayGroupDeletions
+import com.vitorpamplona.quartz.utils.Log
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.flow.drop
+import kotlinx.coroutines.flow.first
+import kotlinx.coroutines.launch
+import kotlin.coroutines.cancellation.CancellationException
+
+/**
+ * Device-global persistence for the set of deleted NIP-29 relay-group channels ([RelayGroupDeletions]),
+ * so a channel the user deleted (kind-9008) stays gone across a restart — even if the host relay keeps
+ * re-announcing a stale kind-44100 for it. Mirrors [BuzzChannelStarPreferences]: app-wide (not
+ * per-account), loads the saved keys into the singleton on construction, then writes every later change
+ * back. Construct once, eagerly.
+ */
+@Stable
+class RelayGroupDeletionPreferences(
+    private val context: Context,
+    private val scope: CoroutineScope,
+) {
+    init {
+        scope.launch {
+            restoreFromDisk()
+            // drop(1) skips the value present at collection start, which restoreFromDisk already wrote.
+            RelayGroupDeletions.flow.drop(1).collect { persist(it) }
+        }
+    }
+
+    private suspend fun restoreFromDisk() {
+        try {
+            val raw = context.sharedPreferencesDataStore.data.first()[KEY] ?: return
+            if (raw.isNotEmpty()) RelayGroupDeletions.restore(raw)
+        } catch (e: Exception) {
+            if (e is CancellationException) throw e
+            Log.e("RelayGroupDeletionPrefs") { "Error reading deleted channels: ${e.message}" }
+        }
+    }
+
+    private suspend fun persist(keys: Set<String>) {
+        try {
+            context.sharedPreferencesDataStore.edit { prefs -> prefs[KEY] = keys }
+        } catch (e: Exception) {
+            if (e is CancellationException) throw e
+            Log.e("RelayGroupDeletionPrefs") { "Error writing deleted channels: ${e.message}" }
+        }
+    }
+
+    companion object {
+        private val KEY = stringSetPreferencesKey("nip29.deletedChannels")
+    }
+}

amethyst/src/main/java/com/vitorpamplona/amethyst/model/topNavFeeds/IFeedTopNavFilter.kt

@@ -20,6 +20,7 @@
  */
 package com.vitorpamplona.amethyst.model.topNavFeeds
 
+import com.vitorpamplona.amethyst.commons.model.topNavFeeds.IFeedTopNavPerRelayFilterSet
 import com.vitorpamplona.amethyst.model.LocalCache
 import com.vitorpamplona.quartz.nip01Core.core.Event
 import com.vitorpamplona.quartz.nip01Core.core.HexKey

amethyst/src/main/java/com/vitorpamplona/amethyst/model/topNavFeeds/OutboxLoaderState.kt

@@ -20,8 +20,9 @@
  */
 package com.vitorpamplona.amethyst.model.topNavFeeds
 
+import com.vitorpamplona.amethyst.commons.model.topNavFeeds.IFeedTopNavPerRelayFilterSet
+import com.vitorpamplona.amethyst.commons.model.topNavFeeds.unknown.UnknownTopNavPerRelayFilterSet
 import com.vitorpamplona.amethyst.model.LocalCache
-import com.vitorpamplona.amethyst.model.topNavFeeds.unknown.UnknownTopNavPerRelayFilterSet
 import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.ExperimentalCoroutinesApi

amethyst/src/main/java/com/vitorpamplona/amethyst/model/topNavFeeds/allFollows/AllFollowsByOutboxTopNavFilter.kt

@@ -21,6 +21,8 @@
 package com.vitorpamplona.amethyst.model.topNavFeeds.allFollows
 
 import androidx.compose.runtime.Immutable
+import com.vitorpamplona.amethyst.commons.model.topNavFeeds.allFollows.AllFollowsTopNavPerRelayFilter
+import com.vitorpamplona.amethyst.commons.model.topNavFeeds.allFollows.AllFollowsTopNavPerRelayFilterSet
 import com.vitorpamplona.amethyst.model.LocalCache
 import com.vitorpamplona.amethyst.model.topNavFeeds.CommunityRelayLoader
 import com.vitorpamplona.amethyst.model.topNavFeeds.IFeedTopNavFilter

amethyst/src/main/java/com/vitorpamplona/amethyst/model/topNavFeeds/allFollows/AllFollowsByProxyTopNavFilter.kt

@@ -21,6 +21,8 @@
 package com.vitorpamplona.amethyst.model.topNavFeeds.allFollows
 
 import androidx.compose.runtime.Immutable
+import com.vitorpamplona.amethyst.commons.model.topNavFeeds.allFollows.AllFollowsTopNavPerRelayFilter
+import com.vitorpamplona.amethyst.commons.model.topNavFeeds.allFollows.AllFollowsTopNavPerRelayFilterSet
 import com.vitorpamplona.amethyst.model.LocalCache
 import com.vitorpamplona.amethyst.model.topNavFeeds.IFeedTopNavFilter
 import com.vitorpamplona.quartz.nip01Core.core.Event

amethyst/src/main/java/com/vitorpamplona/amethyst/model/topNavFeeds/allUserFollows/AllUserFollowsByOutboxTopNavFilter.kt

@@ -21,11 +21,11 @@
 package com.vitorpamplona.amethyst.model.topNavFeeds.allUserFollows
 
 import androidx.compose.runtime.Immutable
+import com.vitorpamplona.amethyst.commons.model.topNavFeeds.noteBased.author.AuthorsTopNavPerRelayFilter
+import com.vitorpamplona.amethyst.commons.model.topNavFeeds.noteBased.author.AuthorsTopNavPerRelayFilterSet
 import com.vitorpamplona.amethyst.model.LocalCache
 import com.vitorpamplona.amethyst.model.topNavFeeds.IFeedTopNavFilter
 import com.vitorpamplona.amethyst.model.topNavFeeds.OutboxRelayLoader
-import com.vitorpamplona.amethyst.model.topNavFeeds.noteBased.author.AuthorsTopNavPerRelayFilter
-import com.vitorpamplona.amethyst.model.topNavFeeds.noteBased.author.AuthorsTopNavPerRelayFilterSet
 import com.vitorpamplona.quartz.nip01Core.core.Event
 import com.vitorpamplona.quartz.nip01Core.core.HexKey
 import com.vitorpamplona.quartz.nip01Core.relay.normalizer.NormalizedRelayUrl

amethyst/src/main/java/com/vitorpamplona/amethyst/model/topNavFeeds/allUserFollows/AllUserFollowsByProxyTopNavFilter.kt

@@ -21,10 +21,10 @@
 package com.vitorpamplona.amethyst.model.topNavFeeds.allUserFollows
 
 import androidx.compose.runtime.Immutable
+import com.vitorpamplona.amethyst.commons.model.topNavFeeds.noteBased.author.AuthorsTopNavPerRelayFilter
+import com.vitorpamplona.amethyst.commons.model.topNavFeeds.noteBased.author.AuthorsTopNavPerRelayFilterSet
 import com.vitorpamplona.amethyst.model.LocalCache
 import com.vitorpamplona.amethyst.model.topNavFeeds.IFeedTopNavFilter
-import com.vitorpamplona.amethyst.model.topNavFeeds.noteBased.author.AuthorsTopNavPerRelayFilter
-import com.vitorpamplona.amethyst.model.topNavFeeds.noteBased.author.AuthorsTopNavPerRelayFilterSet
 import com.vitorpamplona.quartz.nip01Core.core.Event
 import com.vitorpamplona.quartz.nip01Core.core.HexKey
 import com.vitorpamplona.quartz.nip01Core.relay.normalizer.NormalizedRelayUrl

amethyst/src/main/java/com/vitorpamplona/amethyst/model/topNavFeeds/aroundMe/AroundMeFeedFlow.kt

@@ -20,6 +20,7 @@
  */
 package com.vitorpamplona.amethyst.model.topNavFeeds.aroundMe
 
+import com.vitorpamplona.amethyst.commons.model.topNavFeeds.aroundMe.compute50kmRange
 import com.vitorpamplona.amethyst.model.topNavFeeds.IFeedFlowsType
 import com.vitorpamplona.amethyst.model.topNavFeeds.IFeedTopNavFilter
 import com.vitorpamplona.amethyst.service.location.LocationState

amethyst/src/main/java/com/vitorpamplona/amethyst/model/topNavFeeds/aroundMe/LocationTopNavFilter.kt

@@ -21,6 +21,8 @@
 package com.vitorpamplona.amethyst.model.topNavFeeds.aroundMe
 
 import androidx.compose.runtime.Immutable
+import com.vitorpamplona.amethyst.commons.model.topNavFeeds.aroundMe.LocationTopNavPerRelayFilter
+import com.vitorpamplona.amethyst.commons.model.topNavFeeds.aroundMe.LocationTopNavPerRelayFilterSet
 import com.vitorpamplona.amethyst.model.LocalCache
 import com.vitorpamplona.amethyst.model.topNavFeeds.IFeedTopNavFilter
 import com.vitorpamplona.quartz.nip01Core.core.Event

amethyst/src/main/java/com/vitorpamplona/amethyst/model/topNavFeeds/favoriteAlgoFeeds/AllFavoriteAlgoFeedsTopNavFilter.kt

@@ -21,6 +21,8 @@
 package com.vitorpamplona.amethyst.model.topNavFeeds.favoriteAlgoFeeds
 
 import androidx.compose.runtime.Immutable
+import com.vitorpamplona.amethyst.commons.model.topNavFeeds.favoriteAlgoFeeds.FavoriteAlgoFeedTopNavPerRelayFilter
+import com.vitorpamplona.amethyst.commons.model.topNavFeeds.favoriteAlgoFeeds.FavoriteAlgoFeedTopNavPerRelayFilterSet
 import com.vitorpamplona.amethyst.model.LocalCache
 import com.vitorpamplona.amethyst.model.topNavFeeds.IFeedTopNavFilter
 import com.vitorpamplona.quartz.nip01Core.core.AddressableEvent

amethyst/src/main/java/com/vitorpamplona/amethyst/model/topNavFeeds/favoriteAlgoFeeds/FavoriteAlgoFeedTopNavFilter.kt

@@ -21,6 +21,8 @@
 package com.vitorpamplona.amethyst.model.topNavFeeds.favoriteAlgoFeeds
 
 import androidx.compose.runtime.Immutable
+import com.vitorpamplona.amethyst.commons.model.topNavFeeds.favoriteAlgoFeeds.FavoriteAlgoFeedTopNavPerRelayFilter
+import com.vitorpamplona.amethyst.commons.model.topNavFeeds.favoriteAlgoFeeds.FavoriteAlgoFeedTopNavPerRelayFilterSet
 import com.vitorpamplona.amethyst.model.LocalCache
 import com.vitorpamplona.amethyst.model.topNavFeeds.IFeedTopNavFilter
 import com.vitorpamplona.quartz.nip01Core.core.Address

amethyst/src/main/java/com/vitorpamplona/amethyst/model/topNavFeeds/global/GlobalTopNavFilter.kt

@@ -21,6 +21,8 @@
 package com.vitorpamplona.amethyst.model.topNavFeeds.global
 
 import androidx.compose.runtime.Immutable
+import com.vitorpamplona.amethyst.commons.model.topNavFeeds.global.GlobalTopNavPerRelayFilter
+import com.vitorpamplona.amethyst.commons.model.topNavFeeds.global.GlobalTopNavPerRelayFilterSet
 import com.vitorpamplona.amethyst.model.LocalCache
 import com.vitorpamplona.amethyst.model.topNavFeeds.IFeedTopNavFilter
 import com.vitorpamplona.quartz.nip01Core.core.Event

amethyst/src/main/java/com/vitorpamplona/amethyst/model/topNavFeeds/hashtag/HashtagTopNavFilter.kt

@@ -21,6 +21,8 @@
 package com.vitorpamplona.amethyst.model.topNavFeeds.hashtag
 
 import androidx.compose.runtime.Immutable
+import com.vitorpamplona.amethyst.commons.model.topNavFeeds.hashtag.HashtagTopNavPerRelayFilter
+import com.vitorpamplona.amethyst.commons.model.topNavFeeds.hashtag.HashtagTopNavPerRelayFilterSet
 import com.vitorpamplona.amethyst.model.LocalCache
 import com.vitorpamplona.amethyst.model.topNavFeeds.IFeedTopNavFilter
 import com.vitorpamplona.quartz.nip01Core.core.Event

amethyst/src/main/java/com/vitorpamplona/amethyst/model/topNavFeeds/noteBased/allcommunities/AllCommunitiesTopNavFilter.kt

@@ -21,6 +21,8 @@
 package com.vitorpamplona.amethyst.model.topNavFeeds.noteBased.allcommunities
 
 import androidx.compose.runtime.Immutable
+import com.vitorpamplona.amethyst.commons.model.topNavFeeds.noteBased.allcommunities.AllCommunitiesTopNavPerRelayFilter
+import com.vitorpamplona.amethyst.commons.model.topNavFeeds.noteBased.allcommunities.AllCommunitiesTopNavPerRelayFilterSet
 import com.vitorpamplona.amethyst.model.LocalCache
 import com.vitorpamplona.amethyst.model.topNavFeeds.CommunityRelayLoader
 import com.vitorpamplona.amethyst.model.topNavFeeds.IFeedTopNavFilter

amethyst/src/main/java/com/vitorpamplona/amethyst/model/topNavFeeds/noteBased/author/AuthorsByOutboxTopNavFilter.kt

@@ -21,6 +21,8 @@
 package com.vitorpamplona.amethyst.model.topNavFeeds.noteBased.author
 
 import androidx.compose.runtime.Immutable
+import com.vitorpamplona.amethyst.commons.model.topNavFeeds.noteBased.author.AuthorsTopNavPerRelayFilter
+import com.vitorpamplona.amethyst.commons.model.topNavFeeds.noteBased.author.AuthorsTopNavPerRelayFilterSet
 import com.vitorpamplona.amethyst.model.LocalCache
 import com.vitorpamplona.amethyst.model.topNavFeeds.IFeedTopNavFilter
 import com.vitorpamplona.amethyst.model.topNavFeeds.OutboxRelayLoader

amethyst/src/main/java/com/vitorpamplona/amethyst/model/topNavFeeds/noteBased/author/AuthorsByProxyTopNavFilter.kt

@@ -21,6 +21,8 @@
 package com.vitorpamplona.amethyst.model.topNavFeeds.noteBased.author
 
 import androidx.compose.runtime.Immutable
+import com.vitorpamplona.amethyst.commons.model.topNavFeeds.noteBased.author.AuthorsTopNavPerRelayFilter
+import com.vitorpamplona.amethyst.commons.model.topNavFeeds.noteBased.author.AuthorsTopNavPerRelayFilterSet
 import com.vitorpamplona.amethyst.model.LocalCache
 import com.vitorpamplona.amethyst.model.topNavFeeds.IFeedTopNavFilter
 import com.vitorpamplona.quartz.nip01Core.core.Event

amethyst/src/main/java/com/vitorpamplona/amethyst/model/topNavFeeds/noteBased/community/SingleCommunityTopNavFilter.kt

@@ -21,6 +21,8 @@
 package com.vitorpamplona.amethyst.model.topNavFeeds.noteBased.community
 
 import androidx.compose.runtime.Immutable
+import com.vitorpamplona.amethyst.commons.model.topNavFeeds.noteBased.community.SingleCommunityTopNavPerRelayFilter
+import com.vitorpamplona.amethyst.commons.model.topNavFeeds.noteBased.community.SingleCommunityTopNavPerRelayFilterSet
 import com.vitorpamplona.amethyst.model.LocalCache
 import com.vitorpamplona.amethyst.model.topNavFeeds.IFeedTopNavFilter
 import com.vitorpamplona.amethyst.model.topNavFeeds.OutboxRelayLoader

amethyst/src/main/java/com/vitorpamplona/amethyst/model/topNavFeeds/noteBased/muted/MutedAuthorsByOutboxTopNavFilter.kt

@@ -21,6 +21,8 @@
 package com.vitorpamplona.amethyst.model.topNavFeeds.noteBased.muted
 
 import androidx.compose.runtime.Immutable
+import com.vitorpamplona.amethyst.commons.model.topNavFeeds.noteBased.muted.MutedAuthorsTopNavPerRelayFilter
+import com.vitorpamplona.amethyst.commons.model.topNavFeeds.noteBased.muted.MutedAuthorsTopNavPerRelayFilterSet
 import com.vitorpamplona.amethyst.model.LocalCache
 import com.vitorpamplona.amethyst.model.topNavFeeds.IFeedTopNavFilter
 import com.vitorpamplona.amethyst.model.topNavFeeds.OutboxRelayLoader

amethyst/src/main/java/com/vitorpamplona/amethyst/model/topNavFeeds/noteBased/muted/MutedAuthorsByProxyTopNavFilter.kt

@@ -21,6 +21,8 @@
 package com.vitorpamplona.amethyst.model.topNavFeeds.noteBased.muted
 
 import androidx.compose.runtime.Immutable
+import com.vitorpamplona.amethyst.commons.model.topNavFeeds.noteBased.muted.MutedAuthorsTopNavPerRelayFilter
+import com.vitorpamplona.amethyst.commons.model.topNavFeeds.noteBased.muted.MutedAuthorsTopNavPerRelayFilterSet
 import com.vitorpamplona.amethyst.model.LocalCache
 import com.vitorpamplona.amethyst.model.topNavFeeds.IFeedTopNavFilter
 import com.vitorpamplona.quartz.nip01Core.core.Event

amethyst/src/main/java/com/vitorpamplona/amethyst/model/topNavFeeds/relay/RelayTopNavFilter.kt

@@ -21,6 +21,7 @@
 package com.vitorpamplona.amethyst.model.topNavFeeds.relay
 
 import androidx.compose.runtime.Immutable
+import com.vitorpamplona.amethyst.commons.model.topNavFeeds.relay.RelayTopNavPerRelayFilterSet
 import com.vitorpamplona.amethyst.model.LocalCache
 import com.vitorpamplona.amethyst.model.topNavFeeds.IFeedTopNavFilter
 import com.vitorpamplona.quartz.nip01Core.core.Event

amethyst/src/main/java/com/vitorpamplona/amethyst/model/topNavFeeds/unknown/UnknownTopNavFilter.kt

@@ -21,6 +21,7 @@
 package com.vitorpamplona.amethyst.model.topNavFeeds.unknown
 
 import androidx.compose.runtime.Immutable
+import com.vitorpamplona.amethyst.commons.model.topNavFeeds.unknown.UnknownTopNavPerRelayFilterSet
 import com.vitorpamplona.amethyst.model.LocalCache
 import com.vitorpamplona.amethyst.model.TopFilter
 import com.vitorpamplona.amethyst.model.topNavFeeds.IFeedTopNavFilter

amethyst/src/main/java/com/vitorpamplona/amethyst/service/location/LocationFlow.kt

@@ -21,56 +21,137 @@
 package com.vitorpamplona.amethyst.service.location
 
 import android.annotation.SuppressLint
-import android.content.Context
 import android.location.Location
 import android.location.LocationListener
 import android.location.LocationManager
+import android.os.Build
 import android.os.Looper
-import com.vitorpamplona.amethyst.service.location.LocationState.Companion.MIN_DISTANCE
-import com.vitorpamplona.amethyst.service.location.LocationState.Companion.MIN_TIME
 import com.vitorpamplona.quartz.utils.Log
 import kotlinx.coroutines.channels.awaitClose
 import kotlinx.coroutines.flow.Flow
 import kotlinx.coroutines.flow.callbackFlow
 import kotlinx.coroutines.launch
 
+/**
+ * Wraps [LocationManager] update registration as a cold [Flow].
+ *
+ * Registers on **one** provider, chosen by [LocationProviderLadder], rather than
+ * on every provider the device reports. The previous shotgun cost four
+ * simultaneous registrations — passive, network, fused and gps, the last at
+ * HIGH_ACCURACY — to produce a 5 km geohash.
+ *
+ * Takes a [LocationManager] rather than a `Context` so the registration
+ * behaviour is unit-testable; the caller does the `getSystemService` lookup.
+ *
+ * [onListening] is fired from inside the flow, after a registration succeeds, and
+ * released again from the `try`/`finally` that wraps everything after it, never
+ * as an `onStart`/`onCompletion` pair on the returned flow. The distinction
+ * matters: an `onStart` fires on collection even when nothing registered, so a
+ * device with no usable provider would accrue location time with no location
+ * running, and — because the ledger refcounts the two [LocationState] flows
+ * together — the unpaired close would steal the other flow's holder.
+ *
+ * The pair is kept honest from both ends. The acquire cannot fire without a
+ * registration, because a failure to register throws before reaching it. The
+ * release cannot be skipped, because everything after the acquire runs inside a
+ * `try`/`finally` rather than inside `awaitClose` — [freshestLastKnownLocation]
+ * (the seed sweep below) can throw a non-cancellation exception and unwind
+ * before `awaitClose` is ever reached, and `try`/`finally` is what still runs
+ * the release on that path; see `releasesTheRegistrationWhenTheSeedThrows` in
+ * `LocationFlowTest`. (In principle a collector cancelling mid-seed would also
+ * unwind past `awaitClose` the same way, but that path could not be
+ * reproduced — `callbackFlow`'s buffer is empty at this point, so the single
+ * seed send returns without suspending and never observes the cancellation.)
+ */
 class LocationFlow(
-    private val context: Context,
+    private val locationManager: LocationManager,
+    private val sdkInt: Int = Build.VERSION.SDK_INT,
 ) {
     @SuppressLint("MissingPermission")
     fun get(
-        minTimeMs: Long = MIN_TIME,
-        minDistanceM: Float = MIN_DISTANCE,
+        minTimeMs: Long,
+        minDistanceM: Float,
+        onListening: ((Boolean) -> Unit)? = null,
     ): Flow<Location> =
         callbackFlow {
-            Log.i("LocationFlow", "Start")
-            val locationManager = context.getSystemService(Context.LOCATION_SERVICE) as LocationManager
-
             val locationCallback =
                 LocationListener { location ->
                     Log.d("LocationFlow") { "onLocationChanged $location" }
                     launch { send(location) }
                 }
 
-            locationManager.allProviders.forEach {
-                val location = locationManager.getLastKnownLocation(it)
-                Log.d("LocationFlow") { "Last Known location is $location" }
-                if (location != null) {
-                    send(location)
-                }
-                Log.d("LocationFlow", "Requesting Updates")
-                locationManager.requestLocationUpdates(
-                    it,
-                    minTimeMs,
-                    minDistanceM,
-                    locationCallback,
-                    Looper.getMainLooper(),
-                )
-            }
+            // One binder call, reused for both the ladder filter and the seed.
+            val providers = locationManager.allProviders
 
-            awaitClose {
-                Log.i("LocationFlow", "Stop")
+            val candidates = LocationProviderLadder.chooseProviders(sdkInt) { it in providers }
+
+            val registered =
+                candidates.firstOrNull { requestUpdates(it, minTimeMs, minDistanceM, locationCallback) }
+                    ?: throw SecurityException("No usable location provider. Candidates: $candidates")
+
+            Log.i("LocationFlow") { "Listening on $registered every ${minTimeMs}ms / ${minDistanceM}m" }
+            onListening?.invoke(true)
+
+            // Cleanup lives in this finally, not in awaitClose — see the class
+            // KDoc, and `releasesTheRegistrationWhenTheSeedThrows` in
+            // LocationFlowTest, which fails if it moves.
+            try {
+                // Seeded after registration so the no-provider path throws
+                // without having emitted anything; seeding first would show the
+                // consumer Success -> LackPermission on a device with no
+                // compatible provider.
+                freshestLastKnownLocation(candidates)?.let {
+                    Log.d("LocationFlow") { "Last known location is $it" }
+                    send(it)
+                }
+
+                awaitClose { }
+            } finally {
+                Log.i("LocationFlow") { "Stopped listening on $registered" }
                 locationManager.removeUpdates(locationCallback)
+                onListening?.invoke(false)
             }
         }
+
+    /** True when the registration was accepted; false when the provider refused it. */
+    @SuppressLint("MissingPermission")
+    private fun requestUpdates(
+        provider: String,
+        minTimeMs: Long,
+        minDistanceM: Float,
+        locationCallback: LocationListener,
+    ): Boolean =
+        try {
+            locationManager.requestLocationUpdates(
+                provider,
+                minTimeMs,
+                minDistanceM,
+                locationCallback,
+                Looper.getMainLooper(),
+            )
+            true
+        } catch (e: SecurityException) {
+            Log.w("LocationFlow", "Provider $provider refused the update request", e)
+            false
+        }
+
+    /**
+     * The freshest cached fix across the providers the ladder deemed usable.
+     * Sweeping every provider the device reports instead would, on the
+     * coarse-only legacy path, pay a guaranteed-to-throw binder call per
+     * fine-only provider on every flow start. Still guarded per provider, like
+     * the update request is — on a device where one refuses us, the others
+     * should still seed.
+     */
+    @SuppressLint("MissingPermission")
+    private fun freshestLastKnownLocation(providers: List<String>): Location? =
+        providers
+            .mapNotNull { provider ->
+                try {
+                    locationManager.getLastKnownLocation(provider)
+                } catch (e: SecurityException) {
+                    Log.w("LocationFlow", "No permission to read the last known location of $provider", e)
+                    null
+                }
+            }.maxByOrNull { it.time }
 }

amethyst/src/main/java/com/vitorpamplona/amethyst/service/location/LocationProviderLadder.kt

@@ -0,0 +1,72 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.service.location
+
+import android.location.LocationManager
+import android.os.Build
+
+/**
+ * Picks which location providers to try, in order.
+ *
+ * Deliberately selects on **provider existence**, never on
+ * [LocationManager.isProviderEnabled]. A registration on a disabled provider
+ * goes live by itself when the user enables location — including from the
+ * quick-settings shade without leaving the app, which is exactly what someone
+ * does after seeing an empty "Around Me" feed. An enabled-state guard evaluated
+ * once at subscription start would lose that.
+ *
+ * Below API 31, `gps`, `passive` and `fused` required `ACCESS_FINE_LOCATION`;
+ * only `network` accepted `ACCESS_COARSE_LOCATION`. Approximate location, which
+ * lets a coarse-only app request any provider and receive a fuzzed result, is an
+ * Android 12 change. Amethyst declares coarse only, so the legacy branch is
+ * unconditional below API 31.
+ *
+ * Adding `ACCESS_FINE_LOCATION` later would **not** widen this on its own — the
+ * branch below has no permission input, so pre-31 devices would keep getting
+ * `network` alone and silently lose the precision the new permission was granted
+ * for. Whoever adds it must widen the condition here too.
+ *
+ * Returns the ordered candidate list rather than a single choice so the caller
+ * can fall through to the next rung if a registration is refused. An empty list
+ * means no compatible provider exists.
+ */
+object LocationProviderLadder {
+    // Compile-time String constants, inlined by the compiler, so naming
+    // FUSED_PROVIDER (added in API 31) is safe on older runtimes.
+    private val FULL_LADDER =
+        listOf(
+            LocationManager.FUSED_PROVIDER,
+            LocationManager.NETWORK_PROVIDER,
+            LocationManager.GPS_PROVIDER,
+            LocationManager.PASSIVE_PROVIDER,
+        )
+
+    private val COARSE_ONLY_LEGACY_LADDER = listOf(LocationManager.NETWORK_PROVIDER)
+
+    fun chooseProviders(
+        sdkInt: Int,
+        exists: (String) -> Boolean,
+    ): List<String> {
+        val ladder = if (sdkInt >= Build.VERSION_CODES.S) FULL_LADDER else COARSE_ONLY_LEGACY_LADDER
+
+        return ladder.filter(exists)
+    }
+}

amethyst/src/main/java/com/vitorpamplona/amethyst/service/location/LocationState.kt

@@ -21,32 +21,83 @@
 package com.vitorpamplona.amethyst.service.location
 
 import android.content.Context
+import android.location.Location
+import android.location.LocationManager
 import com.vitorpamplona.quartz.experimental.bitchat.geohash.GeohashChannelLevel
 import com.vitorpamplona.quartz.nip01Core.tags.geohash.GeoHash
 import com.vitorpamplona.quartz.nip01Core.tags.geohash.GeohashPrecision
 import com.vitorpamplona.quartz.utils.Log
 import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.ExperimentalCoroutinesApi
+import kotlinx.coroutines.delay
+import kotlinx.coroutines.flow.Flow
 import kotlinx.coroutines.flow.MutableStateFlow
 import kotlinx.coroutines.flow.SharingStarted
+import kotlinx.coroutines.flow.StateFlow
 import kotlinx.coroutines.flow.catch
+import kotlinx.coroutines.flow.combine
+import kotlinx.coroutines.flow.distinctUntilChanged
 import kotlinx.coroutines.flow.emitAll
 import kotlinx.coroutines.flow.map
-import kotlinx.coroutines.flow.onCompletion
 import kotlinx.coroutines.flow.onEach
-import kotlinx.coroutines.flow.onStart
 import kotlinx.coroutines.flow.stateIn
 import kotlinx.coroutines.flow.transformLatest
 
+// `toGeoHash` is an extension on Location declared in LocationGeoHash.kt, same
+// package, so it needs no import.
+
+/**
+ * Turns the device's location into geohashes, listening **only while the app is
+ * in the foreground**.
+ *
+ * The gate is not an optimisation of last resort: `Account` builds 30
+ * `SharingStarted.Eagerly` top-nav filter states on the account scope, and
+ * `AccountSettings.defaultProductsFollowList` ships as `TopFilter.AroundMe`, so
+ * without it every user with location permission holds a registration for the
+ * life of the process. See `amethyst/plans/2026-07-29-location-foreground-gate.md`.
+ *
+ * Switching the *consumers* to `WhileSubscribed` is not an option: roughly 60
+ * call sites read `account.live*FollowLists.value` synchronously rather than
+ * collecting, and would silently serve a stale or initial value.
+ */
 class LocationState(
     context: Context,
-    scope: CoroutineScope,
-    /** Resource-ledger hook: true while GPS/location updates are actively requested. */
+    private val scope: CoroutineScope,
+    private val isForeground: StateFlow<Boolean>,
+    /**
+     * Resource-ledger hook: true while location updates are actively
+     * registered. Reaches the OS only through the default [locationSource],
+     * which hands it to [LocationFlow] — a caller that overrides
+     * [locationSource] (the tests do) is responsible for firing it, or not.
+     */
     private val onListening: ((Boolean) -> Unit)? = null,
+    private val locationSource: (Long, Float) -> Flow<Location> = { minTimeMs, minDistanceM ->
+        LocationFlow(context.getSystemService(Context.LOCATION_SERVICE) as LocationManager)
+            .get(minTimeMs, minDistanceM, onListening)
+    },
 ) {
     companion object {
-        const val MIN_TIME: Long = 10000L
-        const val MIN_DISTANCE: Float = 100.0f
+        /** A 5 km cell takes 2.5 minutes to cross at 120 km/h; 60s/500m is ample. */
+        const val COARSE_MIN_TIME: Long = 60_000L
+        const val COARSE_MIN_DISTANCE: Float = 500.0f
+
+        /** Building-level geohashes need the tighter profile. */
+        const val PRECISE_MIN_TIME: Long = 10_000L
+        const val PRECISE_MIN_DISTANCE: Float = 100.0f
+
+        /**
+         * How long to keep listening after the last activity stops, so a
+         * one-second app switch doesn't destroy and rebuild the registration.
+         * Same intent as [SUBSCRIPTION_STOP_TIMEOUT_MS], on the other axis.
+         */
+        const val BACKGROUND_GRACE_MS: Long = 5_000L
+
+        /**
+         * How long `stateIn` keeps the upstream alive after the last collector
+         * leaves, so a screen rotation or a tab switch doesn't rebuild the
+         * registration either.
+         */
+        const val SUBSCRIPTION_STOP_TIMEOUT_MS: Long = 5_000L
     }
 
     sealed class LocationResult {
@@ -59,9 +110,16 @@ class LocationState(
         object Loading : LocationResult()
     }
 
+    private enum class Gate { NoPermission, Paused, Listen }
+
     private var hasLocationPermission = MutableStateFlow(false)
-    private var latestLocation: LocationResult = LocationResult.Loading
-    private var latestPreciseLocation: LocationResult = LocationResult.Loading
+
+    // Read by R1 below to decide whether to emit Loading, from a different
+    // coroutine than the onEach that writes it — hence a StateFlow rather than
+    // a plain field.
+    private val latestLocation = MutableStateFlow<LocationResult>(LocationResult.Loading)
+
+    private val latestPreciseLocation = MutableStateFlow<LocationResult>(LocationResult.Loading)
 
     fun setLocationPermission(newValue: Boolean) {
         if (newValue != hasLocationPermission.value) {
@@ -69,36 +127,92 @@ class LocationState(
         }
     }
 
+    /**
+     * Foreground with an asymmetric delay: leaving the foreground waits out
+     * [BACKGROUND_GRACE_MS], returning to it is immediate.
+     *
+     * `debounce(5000)` would delay both edges, and the duration-selector
+     * overload that allows an asymmetric delay is `@FlowPreview`.
+     * `transformLatest` cancels the pending `delay` when foreground returns
+     * first, which is exactly the semantics wanted, with no preview opt-in.
+     *
+     * Known and harmless: [ForegroundTracker] starts at `false`, so on a
+     * process that starts backgrounded the first emission — and therefore the
+     * first gate verdict, including `LackPermission` — is delayed by
+     * [BACKGROUND_GRACE_MS]. Nothing renders while backgrounded, and a process
+     * that starts into the foreground emits immediately, because the activity's
+     * `onStart` cancels the pending delay.
+     */
     @OptIn(ExperimentalCoroutinesApi::class)
-    val geohashStateFlow by lazy {
-        hasLocationPermission
-            .transformLatest {
-                if (it) {
-                    emit(LocationResult.Loading)
-                    val result =
-                        LocationFlow(context)
-                            .get(MIN_TIME, MIN_DISTANCE)
-                            .onStart { onListening?.invoke(true) }
-                            .onCompletion { onListening?.invoke(false) }
-                            .map {
-                                LocationResult.Success(it.toGeoHash(GeohashPrecision.KM_5_X_5.digits)) as LocationResult
-                            }.onEach {
-                                latestLocation = it
-                            }.catch { e ->
-                                Log.w("GeohashStateFlow", "Exception in the flow", e)
-                                latestLocation = LocationResult.LackPermission
-                                emit(LocationResult.LackPermission)
-                            }
+    private val settledForeground: Flow<Boolean> =
+        isForeground.transformLatest { foreground ->
+            if (!foreground) delay(BACKGROUND_GRACE_MS)
+            emit(foreground)
+        }
 
-                    emitAll(result)
-                } else {
-                    emit(LocationResult.LackPermission)
+    private val gate: Flow<Gate> =
+        combine(hasLocationPermission, settledForeground) { permitted, foreground ->
+            when {
+                !permitted -> Gate.NoPermission
+                foreground -> Gate.Listen
+                else -> Gate.Paused
+            }
+        }.distinctUntilChanged()
+
+    @OptIn(ExperimentalCoroutinesApi::class)
+    private fun buildGeohashStateFlow(
+        tag: String,
+        charsCount: Int,
+        minTimeMs: Long,
+        minDistanceM: Float,
+        cache: MutableStateFlow<LocationResult>,
+    ): StateFlow<LocationResult> =
+        gate
+            .transformLatest { state ->
+                when (state) {
+                    // Deliberately does NOT write to the cache. Today's code emits
+                    // LackPermission without touching the cache, and wiping it
+                    // here would cost a Loading emission — and so an empty-feed
+                    // flash — on every permission flap, which is the regression R1
+                    // exists to prevent. Consumers already see LackPermission from
+                    // the StateFlow; the cache is internal and only decides whether
+                    // Loading is emitted.
+                    Gate.NoPermission -> emit(LocationResult.LackPermission)
+
+                    // Emit nothing: stateIn keeps the last value, so every
+                    // synchronous .value reader still sees the last known geohash
+                    // while the OS registration is released.
+                    Gate.Paused -> Unit
+
+                    Gate.Listen -> {
+                        // Only when there is nothing cached. Emitting Loading on
+                        // every foreground return would flash the "Around Me" feed
+                        // empty, because AroundMeFeedFlow.convert maps anything
+                        // that is not Success to an empty geotag set.
+                        if (cache.value !is LocationResult.Success) emit(LocationResult.Loading)
+
+                        emitAll(
+                            locationSource(minTimeMs, minDistanceM)
+                                .map { LocationResult.Success(it.toGeoHash(charsCount)) as LocationResult }
+                                .onEach { cache.value = it }
+                                .catch { e ->
+                                    Log.w(tag, "Exception in the flow", e)
+                                    cache.value = LocationResult.LackPermission
+                                    emit(LocationResult.LackPermission)
+                                },
+                        )
+                    }
                 }
-            }.stateIn(
-                scope,
-                SharingStarted.WhileSubscribed(5000),
-                latestLocation,
-            )
+            }.stateIn(scope, SharingStarted.WhileSubscribed(SUBSCRIPTION_STOP_TIMEOUT_MS), cache.value)
+
+    val geohashStateFlow: StateFlow<LocationResult> by lazy {
+        buildGeohashStateFlow(
+            tag = "GeohashStateFlow",
+            charsCount = GeohashPrecision.KM_5_X_5.digits,
+            minTimeMs = COARSE_MIN_TIME,
+            minDistanceM = COARSE_MIN_DISTANCE,
+            cache = latestLocation,
+        )
     }
 
     /**
@@ -107,36 +221,19 @@ class LocationState(
      * to every coarser level (a geohash is a prefix code), so one fix yields the
      * whole region→building ladder. Kept separate so the coarser
      * [geohashStateFlow] the "around me" feed relies on is unchanged.
+     *
+     * Note that Amethyst declares only `ACCESS_COARSE_LOCATION`, so Android
+     * fuzzes every fix to roughly a 3 km grid and this is not in fact
+     * building-level today. The profile is kept so the intent survives if the
+     * app ever requests `ACCESS_FINE_LOCATION`.
      */
-    @OptIn(ExperimentalCoroutinesApi::class)
-    val preciseGeohashStateFlow by lazy {
-        hasLocationPermission
-            .transformLatest {
-                if (it) {
-                    emit(LocationResult.Loading)
-                    val result =
-                        LocationFlow(context)
-                            .get(MIN_TIME, MIN_DISTANCE)
-                            .onStart { onListening?.invoke(true) }
-                            .onCompletion { onListening?.invoke(false) }
-                            .map {
-                                LocationResult.Success(it.toGeoHash(GeohashChannelLevel.BUILDING.chars)) as LocationResult
-                            }.onEach {
-                                latestPreciseLocation = it
-                            }.catch { e ->
-                                Log.w("GeohashStateFlow", "Exception in the precise flow", e)
-                                latestPreciseLocation = LocationResult.LackPermission
-                                emit(LocationResult.LackPermission)
-                            }
-
-                    emitAll(result)
-                } else {
-                    emit(LocationResult.LackPermission)
-                }
-            }.stateIn(
-                scope,
-                SharingStarted.WhileSubscribed(5000),
-                latestPreciseLocation,
-            )
+    val preciseGeohashStateFlow: StateFlow<LocationResult> by lazy {
+        buildGeohashStateFlow(
+            tag = "PreciseGeohashStateFlow",
+            charsCount = GeohashChannelLevel.BUILDING.chars,
+            minTimeMs = PRECISE_MIN_TIME,
+            minDistanceM = PRECISE_MIN_DISTANCE,
+            cache = latestPreciseLocation,
+        )
     }
 }

amethyst/src/main/java/com/vitorpamplona/amethyst/service/notifications/AlwaysOnNotificationServiceManager.kt

@@ -22,13 +22,17 @@ package com.vitorpamplona.amethyst.service.notifications
 
 import android.content.Context
 import com.vitorpamplona.amethyst.LocalPreferences
+import com.vitorpamplona.amethyst.model.Account
 import com.vitorpamplona.amethyst.model.accountsCache.AccountCacheState
+import com.vitorpamplona.amethyst.service.relayClient.reqCommand.account.AccountSubscriptionRegistry
 import com.vitorpamplona.quartz.nip01Core.core.HexKey
 import com.vitorpamplona.quartz.utils.Log
 import kotlinx.coroutines.CancellationException
 import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.ExperimentalCoroutinesApi
 import kotlinx.coroutines.Job
+import kotlinx.coroutines.flow.Flow
+import kotlinx.coroutines.flow.StateFlow
 import kotlinx.coroutines.flow.collectLatest
 import kotlinx.coroutines.flow.combine
 import kotlinx.coroutines.flow.distinctUntilChanged
@@ -45,31 +49,45 @@ import kotlinx.coroutines.launch
  * L4 - BootCompletedReceiver (restart on boot)
  * L5 - ServiceWatchdogManager (AlarmManager, 5-min health check)
  *
- * Two switches gate the system:
+ * It also decides **which accounts pull from relays**, which is a different question from
+ * whether the service runs, and the two are deliberately not gated the same way.
  *
- * - The **global master** ([LocalPreferences.notificationServiceEnabledFlow], the
- *   "Background notification service" toggle / Quick Settings tile). When off, every
- *   layer is torn down and nothing restarts, regardless of any account's setting —
- *   this is the battery-saver "airplane mode". Persisted, so an explicit off survives
- *   restarts and crashes.
- * - The **per-account participation** flag ([com.vitorpamplona.amethyst.model.AccountSettings.alwaysOnNotificationService],
- *   "Keep this account active in the background") **or** its NIP-46 signer toggle
- *   ([com.vitorpamplona.amethyst.model.AccountSettings.nip46SignerEnabled]). While the master is
- *   on, the service runs as long as **at least one** writable account has either flag on — the
- *   background signer relies on the same foreground service to keep answering requests.
+ * ## Who subscribes
  *
- * While the master is on, every saved writable account is kept loaded in
- * [AccountCacheState] so (a) its participation flag is observable and (b) GiftWraps
- * addressed to any of them (delivered via open relay subscriptions) get unwrapped by
- * the owning account's `newNotesPreProcessor`. Without this, wraps for non-active
- * accounts would sit in [com.vitorpamplona.amethyst.model.LocalCache] with no
- * subscriber able to decrypt them.
+ * - **While a screen is up: every loaded account.** The user can switch accounts at any moment
+ *   and expects the one they land on to be current, so all of them keep their own notifications,
+ *   DMs and gift wraps live. This costs nothing once the app is away — it ends with the screen.
+ * - **While the app is away: only the accounts that opted in**, via
+ *   [com.vitorpamplona.amethyst.model.AccountSettings.alwaysOnNotificationService] ("Keep this
+ *   account active in the background") or their NIP-46 signer toggle
+ *   ([com.vitorpamplona.amethyst.model.AccountSettings.nip46SignerEnabled]).
+ *
+ * That is what the setting's name promises, and for a while it did not hold: participation gated
+ * subscriptions everywhere, so an account you had not opted in for showed no notifications even
+ * with the app open in front of you.
+ *
+ * ## Whether the service runs
+ *
+ * The five layers are a background concern, so they stay gated on **both** the global master
+ * ([LocalPreferences.notificationServiceEnabledFlow], the "Background notification service"
+ * toggle / Quick Settings tile — the battery-saver "airplane mode", persisted so an explicit off
+ * survives restarts) **and** at least one account having opted in. A foreground-only account must
+ * never start a foreground service that outlives the screen that wanted it.
+ *
+ * Every saved writable account is kept loaded in [AccountCacheState] whenever either condition
+ * holds, so (a) participation flags are observable and (b) GiftWraps addressed to any of them get
+ * unwrapped by the owning account's `newNotesPreProcessor`. Without this, wraps for non-active
+ * accounts would sit in [com.vitorpamplona.amethyst.model.LocalCache] with no subscriber able to
+ * decrypt them.
  */
 class AlwaysOnNotificationServiceManager(
     private val context: Context,
     private val scope: CoroutineScope,
     private val accountsCache: AccountCacheState,
     private val localPreferences: LocalPreferences,
+    private val subscriptions: AccountSubscriptionRegistry,
+    /** True while any activity is STARTED — see [com.vitorpamplona.amethyst.service.resourceusage.ForegroundTracker]. */
+    private val isForeground: StateFlow<Boolean>,
     private val activePubKeyProvider: () -> HexKey?,
 ) {
     companion object {
@@ -98,55 +116,84 @@ class AlwaysOnNotificationServiceManager(
         wasEnabled = false
         watchJob =
             scope.launch {
-                localPreferences.notificationServiceEnabledFlow().collectLatest { masterEnabled ->
-                    if (!masterEnabled) {
-                        // Global airplane mode: suppress every layer regardless of
-                        // per-account participation, and stop keeping accounts loaded.
-                        if (wasEnabled) {
-                            disableServiceLayers()
-                            wasEnabled = false
-                        }
-                        stopMultiAccountPreload()
-                        return@collectLatest
-                    }
-
-                    // Master on: keep every writable account loaded so its participation
-                    // flag is observable and its gift wraps can decrypt, then run the
-                    // service only while at least one account is participating. An account
-                    // participates when its always-on setting OR its NIP-46 signer toggle is
-                    // on — the background signer needs the same foreground service alive.
-                    startMultiAccountPreload()
-                    accountsCache.accounts
-                        .flatMapLatest { accounts ->
-                            val flags =
-                                accounts.values.map { account ->
-                                    account.settings.alwaysOnNotificationService
-                                        .combine(account.settings.nip46SignerEnabled) { alwaysOn, signer -> alwaysOn || signer }
-                                }
-                            if (flags.isEmpty()) {
-                                flowOf(false)
-                            } else {
-                                combine(flags) { values -> values.any { it } }
-                            }
-                        }.distinctUntilChanged()
-                        .collectLatest { anyParticipating ->
-                            if (anyParticipating) {
-                                wasEnabled = true
-                                enableServiceLayers()
-                            } else if (wasEnabled) {
+                localPreferences
+                    .notificationServiceEnabledFlow()
+                    .combine(isForeground) { masterEnabled, foreground -> masterEnabled to foreground }
+                    .collectLatest { (masterEnabled, foreground) ->
+                        if (!masterEnabled && !foreground) {
+                            // Nothing wants the accounts: the master is off and no screen is up.
+                            // Suppress every layer and stop keeping accounts loaded.
+                            if (wasEnabled) {
                                 disableServiceLayers()
                                 wasEnabled = false
                             }
+                            stopMultiAccountPreload()
+                            return@collectLatest
                         }
-                }
+
+                        // Keep every writable account loaded — in the foreground so they can all
+                        // pull, and with the master on so participation flags are observable and
+                        // gift wraps can decrypt.
+                        startMultiAccountPreload()
+
+                        accountsAndParticipants()
+                            .distinctUntilChanged()
+                            .collectLatest { (all, participating) ->
+                                // The rule the "keep this account active in the background" setting
+                                // actually describes: while a screen is up, EVERY loaded account
+                                // pulls its own notifications, DMs and gift wraps, because the user
+                                // can switch to any of them and expects them current. The setting
+                                // only decides which ones keep doing it once the app is away.
+                                subscriptions.sync(if (foreground) all else participating)
+
+                                // The service layers are a background concern, so they stay tied to
+                                // the master switch and to somebody having opted in. A foreground-only
+                                // account must not start a foreground service that outlives the screen.
+                                //
+                                // Edge-triggered, deliberately. This flow re-emits whenever the account
+                                // map changes identity or the app crosses foreground — far more often
+                                // than the old boolean did — and ServiceWatchdogManager.schedule()
+                                // replaces its alarm with one starting `now + 5min`. Calling it on every
+                                // emission pushed the watchdog's first fire past every screen-on, so the
+                                // layer that exists to restart a dead service would never have run.
+                                val shouldRun = masterEnabled && participating.isNotEmpty()
+                                if (shouldRun != wasEnabled) {
+                                    if (shouldRun) enableServiceLayers() else disableServiceLayers()
+                                    wasEnabled = shouldRun
+                                }
+                            }
+                    }
             }
     }
 
+    /**
+     * Every loaded account paired with the subset that opted into running in the background.
+     *
+     * Both come from one flow because they change together and the two decisions below — who
+     * subscribes, and whether the service runs — must never be made from different snapshots.
+     */
+    @OptIn(ExperimentalCoroutinesApi::class)
+    private fun accountsAndParticipants(): Flow<Pair<List<Account>, List<Account>>> =
+        accountsCache.accounts.flatMapLatest { accounts ->
+            val all = accounts.values.toList()
+            val flags =
+                all.map { account ->
+                    account.settings.alwaysOnNotificationService
+                        .combine(account.settings.nip46SignerEnabled) { alwaysOn, signer ->
+                            if (alwaysOn || signer) account else null
+                        }
+                }
+            if (flags.isEmpty()) {
+                flowOf(all to emptyList())
+            } else {
+                combine(flags) { values -> all to values.filterNotNull() }
+            }
+        }
+
     fun stop() {
         watchJob?.cancel()
         watchJob = null
-        preloadJob?.cancel()
-        preloadJob = null
+        stopMultiAccountPreload()
         // Logout/terminate: tear the layers down explicitly. Otherwise the watchdog alarm
         // and periodic worker stay scheduled and would resurrect the service for a
         // logged-out user (nobody participating).
@@ -211,10 +258,15 @@ class AlwaysOnNotificationServiceManager(
      * Cancels the preload collector and releases every cached account except the
      * currently active one, so users with the master off return to single-account
      * memory/battery footprint.
+     *
+     * Unmounts the background subscriptions too: with the master off, the only
+     * account that should be talking to relays is the one on screen, and its
+     * subscription comes from the screen's own mount.
      */
     private fun stopMultiAccountPreload() {
         preloadJob?.cancel()
         preloadJob = null
+        subscriptions.clear()
         // remove this because we don't know which other accounts might be getting used.
         // val active = activePubKeyProvider()
         // if (active != null) {

amethyst/src/main/java/com/vitorpamplona/amethyst/service/notifications/NotificationRelayService.kt

@@ -36,6 +36,7 @@ import android.os.SystemClock
 import androidx.core.app.NotificationCompat
 import androidx.core.app.ServiceCompat
 import androidx.core.content.ContextCompat
+import androidx.core.net.toUri
 import com.vitorpamplona.amethyst.Amethyst
 import com.vitorpamplona.amethyst.LocalPreferences
 import com.vitorpamplona.amethyst.R
@@ -79,6 +80,10 @@ class NotificationRelayService : Service() {
     companion object {
         private const val TAG = "NotificationRelayService"
         private const val CHANNEL_ID = "notification_relay_service"
+
+        /** Parsed back into `Route.ActiveSubscriptions` by `MainActivity.uriToRoute`. */
+        private const val ACTIVE_SUBSCRIPTIONS_URI = "activesubs"
+
         private const val NOTIFICATION_ID = 9832
 
         private const val ACTION_START = "com.vitorpamplona.amethyst.START_NOTIFICATION_SERVICE"
@@ -141,6 +146,9 @@ class NotificationRelayService : Service() {
     private var relayServiceCollectorJob: Job? = null
     private var connectedRelayCount = 0
 
+    /** Last non-empty per-job breakdown, kept so a reconnect does not blank the expanded view. */
+    private var lastBreakdown: List<String> = emptyList()
+
     override fun onBind(intent: Intent?): IBinder? = null
 
     override fun onCreate() {
@@ -336,9 +344,12 @@ class NotificationRelayService : Service() {
                     pluralStringRes(this, R.plurals.always_on_notif_connected, connectedRelays, connectedRelays)
             }
 
+        // Tapping goes to the screen that answers the question the notification raises — "why is it
+        // connected to N relays" — rather than to whatever tab was last open.
         val openAppIntent =
             Intent(this, MainActivity::class.java).apply {
                 flags = Intent.FLAG_ACTIVITY_SINGLE_TOP
+                data = ACTIVE_SUBSCRIPTIONS_URI.toUri()
             }
         val pendingIntent =
             PendingIntent.getActivity(
@@ -348,11 +359,34 @@ class NotificationRelayService : Service() {
                 PendingIntent.FLAG_IMMUTABLE or PendingIntent.FLAG_UPDATE_CURRENT,
             )
 
+        // Expanded only. The collapsed line stays the bare count it has always been — that is all
+        // most people want from an ongoing notification — and the per-job breakdown appears solely
+        // when someone deliberately expands it to ask why the phone is talking to N relays.
+        //
+        // Held across reconnects rather than recomputed blindly: the breakdown is derived from the
+        // *connected* relays, so a drop to zero (the "connecting…" state) would otherwise empty it and
+        // the expanded view would collapse to a single line exactly when someone is most likely
+        // looking at it. What each connection is *for* does not change while it is re-establishing,
+        // so the last known answer is still the right one; only the count above it goes stale, and
+        // that count is already labelled "connecting".
+        val fresh = RelayPurposeSummary.lines(this)
+        if (fresh.isNotEmpty()) lastBreakdown = fresh
+        val breakdown = fresh.ifEmpty { lastBreakdown }.takeIf { it.isNotEmpty() }
+
         return NotificationCompat
             .Builder(this, CHANNEL_ID)
             .setContentTitle(getString(R.string.always_on_notif_title))
             .setContentText(contentText)
-            .setSmallIcon(R.drawable.amethyst_service)
+            .apply {
+                breakdown?.let {
+                    setStyle(
+                        NotificationCompat
+                            .BigTextStyle()
+                            .setBigContentTitle(getString(R.string.always_on_notif_title))
+                            .bigText(contentText + "\n\n" + it.joinToString("\n")),
+                    )
+                }
+            }.setSmallIcon(R.drawable.amethyst_service)
             .setContentIntent(pendingIntent)
             .setOngoing(true)
             .setSilent(true)

amethyst/src/main/java/com/vitorpamplona/amethyst/service/notifications/NotificationUtils.kt

@@ -389,7 +389,7 @@ object NotificationUtils {
                 PendingIntent.FLAG_MUTABLE or PendingIntent.FLAG_UPDATE_CURRENT,
             )
         return NotificationCompat.Action
-            .Builder(R.drawable.ic_notif_reply, stringRes(applicationContext, R.string.app_notification_reply_label), replyPendingIntent)
+            .Builder(R.drawable.ic_action_reply, stringRes(applicationContext, R.string.app_notification_reply_label), replyPendingIntent)
             .addRemoteInput(replyRemoteInput(applicationContext))
             .setAllowGeneratedReplies(true)
             .setSemanticAction(NotificationCompat.Action.SEMANTIC_ACTION_REPLY)
@@ -460,7 +460,7 @@ object NotificationUtils {
                 PendingIntent.FLAG_IMMUTABLE or PendingIntent.FLAG_UPDATE_CURRENT,
             )
         return NotificationCompat.Action
-            .Builder(R.drawable.ic_notif_message, stringRes(applicationContext, R.string.app_notification_mark_read_label), markReadPendingIntent)
+            .Builder(R.drawable.ic_action_mark_read, stringRes(applicationContext, R.string.app_notification_mark_read_label), markReadPendingIntent)
             .setSemanticAction(NotificationCompat.Action.SEMANTIC_ACTION_MARK_AS_READ)
             .build()
     }

amethyst/src/main/java/com/vitorpamplona/amethyst/service/notifications/RelayPurposeSummary.kt

@@ -0,0 +1,84 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.service.notifications
+
+import android.content.Context
+import com.vitorpamplona.amethyst.Amethyst
+import com.vitorpamplona.amethyst.R
+import com.vitorpamplona.amethyst.commons.relayClient.subscriptions.SubPurpose
+import com.vitorpamplona.amethyst.commons.relayClient.subscriptions.purposes
+import com.vitorpamplona.amethyst.ui.pluralStringRes
+import com.vitorpamplona.amethyst.ui.screen.loggedIn.relays.common.SubPurposeLabels
+import com.vitorpamplona.quartz.nip01Core.relay.normalizer.NormalizedRelayUrl
+
+/**
+ * The per-job breakdown behind the always-on notification's relay count.
+ *
+ * **Only ever shown expanded.** The collapsed line stays exactly what it was — a count — because
+ * that is all most people ever want from an ongoing notification. This is for the moment someone
+ * taps to ask *why* their phone is talking to 40 relays.
+ *
+ * A relay usually serves several jobs at once (measured: a typical relay carries four), so these
+ * counts deliberately **overlap and sum to more than the relay count**. They answer "how many relays
+ * carry my DMs", not "how is the pool partitioned" — there is no partition.
+ *
+ * Purposes with no label — feeds and whatever screen is open — collapse into one "browsing" line.
+ * Those disappear on their own once the app is backgrounded, which is exactly when this notification
+ * matters most, so spelling them out would add noise precisely when the user is least interested.
+ */
+object RelayPurposeSummary {
+    /**
+     * Lines for the expanded notification, busiest first. Empty when nothing is attributed yet —
+     * the caller must then fall back to the bare count rather than render an empty section.
+     */
+    fun lines(ctx: Context): List<String> {
+        val client = Amethyst.instance.client
+        val named = mutableMapOf<SubPurpose, MutableSet<NormalizedRelayUrl>>()
+        val browsing = mutableSetOf<NormalizedRelayUrl>()
+
+        client.connectedRelaysFlow().value.forEach { relay ->
+            client
+                .activeRequests(relay)
+                .values
+                .flatten()
+                .purposes()
+                .forEach { purpose ->
+                    if (SubPurposeLabels.isWorthNamingInNotification(purpose)) {
+                        named.getOrPut(purpose) { mutableSetOf() }.add(relay)
+                    } else {
+                        browsing.add(relay)
+                    }
+                }
+        }
+
+        val lines =
+            named.entries
+                .sortedWith(compareByDescending<Map.Entry<SubPurpose, Set<NormalizedRelayUrl>>> { it.value.size }.thenBy { it.key.name })
+                .map { (purpose, relays) ->
+                    pluralStringRes(ctx, R.plurals.relay_purpose_line, relays.size, ctx.getString(SubPurposeLabels.labelOf(purpose)), relays.size)
+                }.toMutableList()
+
+        if (browsing.isNotEmpty()) {
+            lines.add(pluralStringRes(ctx, R.plurals.relay_purpose_line, browsing.size, ctx.getString(R.string.relay_purpose_browsing), browsing.size))
+        }
+        return lines
+    }
+}

amethyst/src/main/java/com/vitorpamplona/amethyst/service/playback/composable/RenderVideoPlayer.kt

@@ -53,9 +53,9 @@ import com.vitorpamplona.amethyst.service.playback.composable.controls.RenderTop
 import com.vitorpamplona.amethyst.service.playback.composable.controls.TopGradientOverlay
 import com.vitorpamplona.amethyst.service.playback.composable.controls.fullscreenSwipeControls
 import com.vitorpamplona.amethyst.service.playback.composable.mediaitem.LoadedMediaItem
+import com.vitorpamplona.amethyst.service.playback.composable.mediaitem.isHlsMedia
 import com.vitorpamplona.amethyst.service.playback.composable.wavefront.AudioPlayingAnimation
 import com.vitorpamplona.amethyst.service.playback.composable.wavefront.rememberIsAudioTrack
-import com.vitorpamplona.amethyst.service.playback.diskCache.isLiveStreaming
 import com.vitorpamplona.amethyst.ui.components.getDialogWindow
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.AccountViewModel
 
@@ -105,7 +105,7 @@ fun RenderVideoPlayer(
     // unnecessary recomposition of the whole player tree just to update a value that is only
     // ever read inside the onDoubleTap callback below.
     val containerWidth = remember { intArrayOf(0) }
-    val isLive = remember(mediaItem.src.videoUri) { isLiveStreaming(mediaItem.src.videoUri) }
+    val isLive = remember(mediaItem.src.videoUri, mediaItem.src.mimeType) { isHlsMedia(mediaItem.src.videoUri, mediaItem.src.mimeType) }
 
     val swipeState = remember { FullscreenSwipeControlsState() }
     val context = LocalContext.current

amethyst/src/main/java/com/vitorpamplona/amethyst/service/playback/composable/controls/RenderTopButtons.kt

@@ -63,7 +63,7 @@ import com.vitorpamplona.amethyst.service.cast.CastSessionState
 import com.vitorpamplona.amethyst.service.playback.composable.DEFAULT_MUTED_SETTING
 import com.vitorpamplona.amethyst.service.playback.composable.MediaControllerState
 import com.vitorpamplona.amethyst.service.playback.composable.mediaitem.MediaItemData
-import com.vitorpamplona.amethyst.service.playback.diskCache.isLiveStreaming
+import com.vitorpamplona.amethyst.service.playback.composable.mediaitem.isHlsMedia
 import com.vitorpamplona.amethyst.service.playback.pip.PipVideoActivity
 import com.vitorpamplona.amethyst.ui.cast.CastDevicePickerDialog
 import com.vitorpamplona.amethyst.ui.components.ShareMediaAction
@@ -113,7 +113,7 @@ fun RenderTopButtons(
     accountViewModel: AccountViewModel,
 ) {
     val context = LocalContext.current
-    val isLive = remember(mediaData.videoUri) { isLiveStreaming(mediaData.videoUri) }
+    val isLive = remember(mediaData.videoUri, mediaData.mimeType) { isHlsMedia(mediaData.videoUri, mediaData.mimeType) }
     val pipSupported =
         remember {
             context.packageManager.hasSystemFeature(PackageManager.FEATURE_PICTURE_IN_PICTURE)

amethyst/src/main/java/com/vitorpamplona/amethyst/service/playback/composable/mediaitem/IsHlsMedia.kt

@@ -0,0 +1,51 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.service.playback.composable.mediaitem
+
+import androidx.media3.common.MimeTypes
+
+/**
+ * Whether a URL plus its imeta mime identifies HLS.
+ *
+ * This is the caller-side form for code that holds a URL and a mime but no `MediaItem` yet — UI that
+ * has a [MediaItemData] or a `MediaUrlContent`. Once a `MediaItem` exists,
+ * `isHlsMediaItem` is the equivalent, and both must answer the same way: the UI decides what to
+ * render, the factory decides how to load it, and a disagreement shows up as a player that streams
+ * something the surrounding chrome says is a still image.
+ *
+ * Defined in terms of [MediaItemCache.toExoPlayerMimeType] rather than re-deriving the rules, so it
+ * cannot drift from the mime that actually reaches ExoPlayer. That normalizer prefers an explicit
+ * mime (mapping the four HLS aliases onto [MimeTypes.APPLICATION_M3U8]) and otherwise falls back to a
+ * **path-anchored** `.m3u8` test.
+ *
+ * Both halves matter. A BUD-10 blossom playlist is `https://host/<sha256>` with no extension at all,
+ * so only the mime identifies it; and anchoring to the path stops `video.mp4?ref=a.m3u8` counting as
+ * HLS on the strength of its query string.
+ *
+ * Note this answers *is it HLS*, which callers use as a proxy for *is it live*. The proxy is
+ * imprecise in the same way for every HLS URL — an on-demand HLS playlist also answers true — and
+ * that imprecision is older than this function. Liveness is only truly knowable from
+ * `#EXT-X-ENDLIST` once the playlist is loaded, which is what `HlsLivenessCache` records.
+ */
+fun isHlsMedia(
+    url: String,
+    mimeType: String?,
+): Boolean = MediaItemCache.toExoPlayerMimeType(mimeType, url) == MimeTypes.APPLICATION_M3U8

amethyst/src/main/java/com/vitorpamplona/amethyst/service/playback/playerPool/CustomMediaSourceFactory.kt

@@ -20,10 +20,13 @@
  */
 package com.vitorpamplona.amethyst.service.playback.playerPool
 
+import androidx.media3.common.C
 import androidx.media3.common.MediaItem
 import androidx.media3.common.util.UnstableApi
+import androidx.media3.common.util.Util
 import androidx.media3.datasource.DataSource
 import androidx.media3.exoplayer.drm.DrmSessionManagerProvider
+import androidx.media3.exoplayer.hls.HlsMediaSource
 import androidx.media3.exoplayer.source.DefaultMediaSourceFactory
 import androidx.media3.exoplayer.source.MediaSource
 import androidx.media3.exoplayer.upstream.LoadErrorHandlingPolicy
@@ -31,7 +34,6 @@ import com.vitorpamplona.amethyst.service.playback.PLAYBACK_DIAG_TAG
 import com.vitorpamplona.amethyst.service.playback.composable.mediaitem.MediaItemCache
 import com.vitorpamplona.amethyst.service.playback.diskCache.HlsLivenessCache
 import com.vitorpamplona.amethyst.service.playback.diskCache.VideoCache
-import com.vitorpamplona.amethyst.service.playback.diskCache.isLiveStreaming
 import com.vitorpamplona.quartz.utils.Log
 
 /**
@@ -58,6 +60,26 @@ internal fun shouldBypassCache(
         else -> true
     }
 
+/**
+ * Whether a [MediaItem] is HLS, via media3's own content-type inference.
+ *
+ * This is the one "is this HLS?" predicate for playback routing. [CustomMediaSourceFactory] uses it
+ * to pick both the cache route and the media-source factory, and [HlsLivenessRecorder] uses it to
+ * decide which items are worth learning a liveness verdict for. Those two **must** agree: if the
+ * recorder tested more narrowly than the factory, an item the factory treats as HLS would never be
+ * classified, [HlsLivenessCache] would answer `isKnownOnDemand = false` for it forever, and
+ * [shouldBypassCache] would keep it out of the disk cache permanently.
+ *
+ * It reads back the mimeType [MediaItemCache] already normalised, which is what makes it correct for
+ * BUD-10 blossom URIs — `https://host/<sha256>`, no extension, mime as the only signal. A `.m3u8`
+ * substring test on the URL misses those, and separately gives a false positive on a query string
+ * over progressive media (`video.mp4?ref=a.m3u8`).
+ */
+internal fun isHlsMediaItem(mediaItem: MediaItem?): Boolean {
+    val config = mediaItem?.localConfiguration ?: return false
+    return Util.inferContentTypeForUriAndMimeType(config.uri, config.mimeType) == C.CONTENT_TYPE_HLS
+}
+
 /**
  * Decides whether a [MediaItem] plays through the caching data source or bypasses it.
  *
@@ -81,20 +103,42 @@ class CustomMediaSourceFactory(
     videoCache: VideoCache,
     dataSourceFactory: DataSource.Factory,
 ) : MediaSource.Factory {
-    private var cachingFactory: MediaSource.Factory =
-        DefaultMediaSourceFactory(videoCache.get(dataSourceFactory))
-    private var nonCachingFactory: MediaSource.Factory =
+    private val cachingDataSource: DataSource.Factory = videoCache.get(dataSourceFactory)
+
+    private val cachingFactory: MediaSource.Factory =
+        DefaultMediaSourceFactory(cachingDataSource)
+    private val nonCachingFactory: MediaSource.Factory =
         DefaultMediaSourceFactory(dataSourceFactory)
 
+    // Stateless, so one instance serves both HLS factories.
+    private val playlistParserFactory = LowLatencyStrippingHlsPlaylistParserFactory()
+
+    // HLS is built explicitly rather than through DefaultMediaSourceFactory, which exposes no hook
+    // for a playlist parser factory. See LowLatencyStrippingHlsPlaylistParserFactory for why we need
+    // one. Everything else still routes through the Default factories above.
+    //
+    // The cost of bypassing it: HLS items skip what DefaultMediaSourceFactory wraps around the
+    // source — side-loaded subtitleConfigurations (MergingMediaSource), clipping, ad insertion, and
+    // live target-offset defaults. None are reachable today (MediaItemCache sets none of them, and
+    // the live setters aren't on the MediaSource.Factory interface), but anything added later must
+    // be mirrored here.
+    private val cachingHlsFactory: MediaSource.Factory = hlsFactory(cachingDataSource)
+    private val nonCachingHlsFactory: MediaSource.Factory = hlsFactory(dataSourceFactory)
+
+    private fun hlsFactory(dataSource: DataSource.Factory): MediaSource.Factory =
+        HlsMediaSource
+            .Factory(dataSource)
+            .setPlaylistParserFactory(playlistParserFactory)
+
+    private val allFactories = listOf(cachingFactory, nonCachingFactory, cachingHlsFactory, nonCachingHlsFactory)
+
     override fun setDrmSessionManagerProvider(drmSessionManagerProvider: DrmSessionManagerProvider): MediaSource.Factory {
-        cachingFactory.setDrmSessionManagerProvider(drmSessionManagerProvider)
-        nonCachingFactory.setDrmSessionManagerProvider(drmSessionManagerProvider)
+        allFactories.forEach { it.setDrmSessionManagerProvider(drmSessionManagerProvider) }
         return this
     }
 
     override fun setLoadErrorHandlingPolicy(loadErrorHandlingPolicy: LoadErrorHandlingPolicy): MediaSource.Factory {
-        cachingFactory.setLoadErrorHandlingPolicy(loadErrorHandlingPolicy)
-        nonCachingFactory.setLoadErrorHandlingPolicy(loadErrorHandlingPolicy)
+        allFactories.forEach { it.setLoadErrorHandlingPolicy(loadErrorHandlingPolicy) }
         return this
     }
 
@@ -103,18 +147,24 @@ class CustomMediaSourceFactory(
     override fun createMediaSource(mediaItem: MediaItem): MediaSource {
         val id = mediaItem.mediaId
         val flaggedLive = isFlaggedLive(mediaItem)
-        val hls = isLiveStreaming(id)
+
+        // One predicate governs both the cache routing below and which factory builds the source, so
+        // the two can never disagree. See isHlsMediaItem.
+        val hls = isHlsMediaItem(mediaItem)
+
         val knownOnDemand = HlsLivenessCache.isKnownOnDemand(id)
         val bypassCache = shouldBypassCache(flaggedLive, hls, knownOnDemand)
 
-        val source =
-            if (bypassCache) {
-                nonCachingFactory.createMediaSource(mediaItem)
+        val factory =
+            if (hls) {
+                if (bypassCache) nonCachingHlsFactory else cachingHlsFactory
             } else {
-                cachingFactory.createMediaSource(mediaItem)
+                if (bypassCache) nonCachingFactory else cachingFactory
             }
-        // Logs the three routing inputs directly rather than a re-derived label, so it can't drift
-        // from shouldBypassCache.
+        val source = factory.createMediaSource(mediaItem)
+
+        // Logs the routing inputs directly rather than a re-derived label, so it can't drift from
+        // shouldBypassCache.
         Log.d(PLAYBACK_DIAG_TAG) {
             "SOURCE ${if (bypassCache) "BYPASS" else "CACHE"} flaggedLive=$flaggedLive hls=$hls knownOnDemand=$knownOnDemand " +
                 "mime=${mediaItem.localConfiguration?.mimeType} -> ${source::class.java.simpleName} id=$id"

amethyst/src/main/java/com/vitorpamplona/amethyst/service/playback/playerPool/HlsLivenessRecorder.kt

@@ -25,7 +25,6 @@ import androidx.media3.common.Player
 import androidx.media3.common.Timeline
 import com.vitorpamplona.amethyst.service.playback.PLAYBACK_DIAG_TAG
 import com.vitorpamplona.amethyst.service.playback.diskCache.HlsLivenessCache
-import com.vitorpamplona.amethyst.service.playback.diskCache.isLiveStreaming
 import com.vitorpamplona.quartz.utils.Log
 
 /**
@@ -66,7 +65,7 @@ internal fun livenessVerdictToRecord(
  * reliable live/on-demand discriminator (`#EXT-X-ENDLIST`) is inside the playlist, so it is knowable
  * only once ExoPlayer has loaded it — hence learning it here rather than from the URL.
  *
- * Only `.m3u8` items are considered; progressive media is unambiguous and never routed by liveness.
+ * Only HLS items are considered; progressive media is unambiguous and never routed by liveness.
  */
 class HlsLivenessRecorder(
     private val player: Player,
@@ -85,8 +84,11 @@ class HlsLivenessRecorder(
 
     private fun maybeRecord(allowOnDemand: Boolean) {
         if (player.currentTimeline.isEmpty) return
-        val url = player.currentMediaItem?.mediaId ?: return
-        if (!isLiveStreaming(url)) return
+        val mediaItem = player.currentMediaItem ?: return
+        // Must be the same predicate CustomMediaSourceFactory routes on — see isHlsMediaItem for
+        // what goes wrong when the two disagree.
+        if (!isHlsMediaItem(mediaItem)) return
+        val url = mediaItem.mediaId
 
         val known = HlsLivenessCache.verdict(url)
         val toRecord =

amethyst/src/main/java/com/vitorpamplona/amethyst/service/playback/playerPool/LowLatencyHlsStripper.kt

@@ -0,0 +1,165 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.service.playback.playerPool
+
+import android.net.Uri
+import androidx.media3.common.util.UnstableApi
+import androidx.media3.exoplayer.hls.playlist.DefaultHlsPlaylistParserFactory
+import androidx.media3.exoplayer.hls.playlist.HlsMediaPlaylist
+import androidx.media3.exoplayer.hls.playlist.HlsMultivariantPlaylist
+import androidx.media3.exoplayer.hls.playlist.HlsPlaylist
+import androidx.media3.exoplayer.hls.playlist.HlsPlaylistParserFactory
+import androidx.media3.exoplayer.upstream.ParsingLoadable
+import java.io.ByteArrayInputStream
+import java.io.InputStream
+
+/**
+ * Low-Latency HLS tags that we remove before media3's playlist parser sees them.
+ *
+ * `EXT-X-PART` and `EXT-X-PRELOAD-HINT` are the ones that matter: they are the only things in these
+ * playlists that produce a **byte-range-bounded** chunk, which is what triggers the crash documented
+ * on [LowLatencyStrippingHlsPlaylistParserFactory]. `EXT-X-PART-INF` and `EXT-X-SERVER-CONTROL` go
+ * with them — leaving those behind advertises a low-latency contract (PART-TARGET, PART-HOLD-BACK,
+ * CAN-BLOCK-RELOAD) that the stripped playlist can no longer honour.
+ *
+ * Deliberately **not** stripped:
+ * - `EXT-X-SKIP` — marks a delta playlist whose segments were legitimately omitted. Removing the tag
+ *   while the segments stay missing would corrupt the playlist. Dropping `EXT-X-SERVER-CONTROL`
+ *   already stops media3 requesting deltas (`_HLS_skip=YES`), so this should never appear anyway.
+ * - `EXT-X-RENDITION-REPORT` — inert once the parts are gone.
+ */
+private val LOW_LATENCY_TAGS =
+    listOf(
+        "#EXT-X-PART:",
+        "#EXT-X-PART-INF:",
+        "#EXT-X-PRELOAD-HINT:",
+        "#EXT-X-SERVER-CONTROL:",
+    )
+
+/**
+ * Removes the Low-Latency HLS tags from a playlist, leaving every other byte untouched.
+ *
+ * Line separators are preserved exactly: the split/join round-trips `\n`, keeps the `\r` of a CRLF
+ * playlist as trailing content, and keeps a trailing newline (which `split` surfaces as a final
+ * empty element). Blank lines are never dropped.
+ */
+internal fun stripLowLatencyTags(playlist: String): String {
+    // Cheap pre-check: the overwhelming majority of playlists carry no LL tags at all, and this
+    // runs on every playlist reload of every live stream.
+    if (LOW_LATENCY_TAGS.none { playlist.contains(it) }) return playlist
+
+    return playlist
+        .split("\n")
+        .filterNot { line ->
+            val trimmed = line.trimStart()
+            LOW_LATENCY_TAGS.any { trimmed.startsWith(it) }
+        }.joinToString("\n")
+}
+
+/**
+ * The byte-level form: decode as UTF-8, strip, re-encode.
+ *
+ * Split out from [LowLatencyStrippingParser] so the charset round-trip is reachable from a plain JVM
+ * unit test — `parse` takes an `android.net.Uri`, which stubs to null under
+ * `unitTests.isReturnDefaultValues`, so nothing that goes through it is testable without Robolectric.
+ *
+ * A UTF-8 BOM survives: decoding leaves U+FEFF in the string, `trimStart` does not treat it as
+ * whitespace, and re-encoding reproduces the same three bytes. When there is nothing to strip the
+ * *original array* is returned, so the common path neither re-encodes nor copies.
+ */
+internal fun stripLowLatencyTags(playlist: ByteArray): ByteArray {
+    val original = playlist.toString(Charsets.UTF_8)
+    val stripped = stripLowLatencyTags(original)
+    return if (stripped === original) playlist else stripped.toByteArray(Charsets.UTF_8)
+}
+
+/**
+ * Wraps a media3 playlist parser and strips the Low-Latency tags before delegating.
+ *
+ * Playlists are a few KB, so reading the stream fully into memory is cheaper than the alternative of
+ * a streaming line filter and keeps the transform a pure, testable [stripLowLatencyTags] call.
+ */
+@UnstableApi
+internal class LowLatencyStrippingParser(
+    private val delegate: ParsingLoadable.Parser<HlsPlaylist>,
+) : ParsingLoadable.Parser<HlsPlaylist> {
+    override fun parse(
+        uri: Uri,
+        inputStream: InputStream,
+    ): HlsPlaylist = delegate.parse(uri, ByteArrayInputStream(stripLowLatencyTags(inputStream.readBytes())))
+}
+
+/**
+ * Serves media3 a de-low-latency-ed view of every HLS playlist.
+ *
+ * ## Why
+ *
+ * media3 crashes fatally on a Low-Latency HLS playlist whose parts are byte ranges — which is what
+ * zap-stream-core emits (`#EXT-X-PART:URI="…",DURATION=…,BYTERANGE="359712@0"`). Reproduced on
+ * media3 1.10.1, Pixel 9a / Android 17, ~0.6s after `ExoPlayerImpl.Init`:
+ *
+ * ```
+ * IllegalArgumentException
+ *   at androidx.media3.datasource.DataSpec.<init>          // checkArgument(length > 0 || length == LENGTH_UNSET)
+ *   at androidx.media3.datasource.DataSpec.subrange
+ *   at androidx.media3.exoplayer.hls.HlsMediaChunk.feedDataToExtractor
+ *   at androidx.media3.exoplayer.hls.HlsMediaChunk.loadMedia
+ * ```
+ *
+ * `HlsMediaChunk.feedDataToExtractor` re-enters as `dataSpec.subrange(nextLoadPosition)`. Once the
+ * whole bounded range has been fed to the extractor, `nextLoadPosition == length`, so `subrange`
+ * asks for a zero-length `DataSpec` and the constructor's `length > 0` precondition throws. The
+ * early-return guard in `subrange` only covers `offset == 0`, so a fully-consumed chunk falls
+ * straight through. Unbounded chunks are safe — `length == C.LENGTH_UNSET` short-circuits — so this
+ * is reachable only via a byte-range part.
+ *
+ * The failure is unrecoverable rather than merely retried: `Loader` wraps it as
+ * `UnexpectedLoaderException`, which `DefaultLoadErrorHandlingPolicy` lists as non-retriable, so it
+ * becomes a fatal `ExoPlaybackException: Source error`. Forcing a retry would not help either — the
+ * `HlsMediaChunk` instance keeps its `nextLoadPosition`, so it would throw identically forever.
+ *
+ * Still present verbatim in media3 1.11.0-rc01, so there is no version to upgrade to.
+ *
+ * **Tracking: https://github.com/androidx/media/issues/3350** — delete this whole file and its test
+ * once that is fixed and we are on a media3 release carrying the fix, then drop the explicit
+ * `HlsMediaSource.Factory` in [CustomMediaSourceFactory] and let `DefaultMediaSourceFactory` build
+ * HLS again. That also restores low latency, and removes the caveat about the wrapping
+ * `DefaultMediaSourceFactory` features documented there.
+ *
+ * ## Trade-off
+ *
+ * We lose low latency on LL-HLS streams: playback falls back to whole segments, roughly one
+ * `TARGETDURATION` further behind the live edge. LL playlists still list their complete segments
+ * below the part tags, so they play normally otherwise. Given the alternative is a hard failure
+ * within a second, and that media3 offers no per-stream way to decline just the parts, disabling it
+ * globally is the conservative trade.
+ */
+@UnstableApi
+internal class LowLatencyStrippingHlsPlaylistParserFactory(
+    private val delegate: HlsPlaylistParserFactory = DefaultHlsPlaylistParserFactory(),
+) : HlsPlaylistParserFactory {
+    override fun createPlaylistParser(): ParsingLoadable.Parser<HlsPlaylist> = LowLatencyStrippingParser(delegate.createPlaylistParser())
+
+    override fun createPlaylistParser(
+        multivariantPlaylist: HlsMultivariantPlaylist,
+        previousMediaPlaylist: HlsMediaPlaylist?,
+    ): ParsingLoadable.Parser<HlsPlaylist> = LowLatencyStrippingParser(delegate.createPlaylistParser(multivariantPlaylist, previousMediaPlaylist))
+}

amethyst/src/main/java/com/vitorpamplona/amethyst/service/playback/playerPool/positions/CurrentPlayPositionCacher.kt

@@ -22,7 +22,7 @@ package com.vitorpamplona.amethyst.service.playback.playerPool.positions
 
 import androidx.media3.common.MediaItem
 import androidx.media3.common.Player
-import com.vitorpamplona.amethyst.service.playback.diskCache.isLiveStreaming
+import com.vitorpamplona.amethyst.service.playback.playerPool.isHlsMediaItem
 import kotlin.math.abs
 
 class CurrentPlayPositionCacher(
@@ -41,7 +41,10 @@ class CurrentPlayPositionCacher(
             isLiveStreaming = false
         } else {
             currentUrl = mediaItem.mediaId
-            isLiveStreaming = isLiveStreaming(mediaItem.mediaId)
+            // Same predicate the source factory routes on, so a blossom-hosted playlist — which has
+            // no `.m3u8` in its URL — is recognised here too and doesn't get a resume position
+            // persisted against a stream that has no stable position to return to.
+            isLiveStreaming = isHlsMediaItem(mediaItem)
         }
     }
 

amethyst/src/main/java/com/vitorpamplona/amethyst/service/relayClient/AccountScopedQuery.kt

@@ -18,6 +18,22 @@
  * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
  * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
  */
-package com.vitorpamplona.amethyst.model.topNavFeeds
+package com.vitorpamplona.amethyst.service.relayClient
 
-interface IFeedTopNavPerRelayFilterSet
+import com.vitorpamplona.amethyst.model.Account
+
+/**
+ * A subscription query state that belongs to one logged-in account.
+ *
+ * Around 66 query-state classes already carry an `account`, but nothing tied them together, so a
+ * subscription manager could not ask "whose subscription is this?" without knowing the concrete
+ * type. That is why the Active Relay Subscriptions screen filed the home feed under "not attributed"
+ * despite it being built from one specific person's follow list: the base manager checked for
+ * `AccountQueryState` and the home feed uses `HomeQueryState`.
+ *
+ * Implement this on any query state whose subscriptions belong to a single account, and the base
+ * managers attribute them automatically.
+ */
+interface AccountScopedQuery {
+    val account: Account
+}

amethyst/src/main/java/com/vitorpamplona/amethyst/service/relayClient/diagnostics/BootRelayDiagnostics.kt

@@ -56,7 +56,10 @@ import kotlin.concurrent.thread
  */
 class BootRelayDiagnostics(
     val client: INostrClient,
-    val dumpAtSeconds: List<Long> = listOf(20, 45, 90),
+    // 5s first: the pool is assembled and dialling well before 20s, and the early datapoint is what
+    // distinguishes "slow to connect" from "connected fine, slow to serve". Affordable because the
+    // rollup is now 3 INFO lines rather than 5 — the ===== banners moved to DEBUG.
+    val dumpAtSeconds: List<Long> = listOf(5, 20, 45, 90),
 ) {
     companion object {
         const val TAG = "BootRelayDiag"
@@ -197,8 +200,13 @@ class BootRelayDiagnostics(
     fun detach() = client.removeConnectionListener(listener)
 
     /**
-     * One line per relay plus a rollup. Kept to a single Log.w per line so the whole census
+     * One line per relay plus a rollup. Kept to a single Log call per line so the whole census
      * survives logcat's per-tag rate limiting on a busy boot.
+     *
+     * The rollup goes out at INFO — it is the one boot line worth reading by default, and it
+     * carries the aggregate that per-socket failure logging used to spell out a few hundred
+     * times. The per-relay WASTE/SERVE tables are DEBUG: useful when you are chasing a specific
+     * relay, too long (up to 45 lines a census) to sit in the default log.
      */
     fun dump(atSeconds: Long) {
         val snapshot = records.toMap()
@@ -214,27 +222,27 @@ class BootRelayDiagnostics(
             r.closed.forEach { (k, v) -> closedTotals[k] = (closedTotals[k] ?: 0) + v.get() }
         }
 
-        Log.w(TAG, "===== boot census @${atSeconds}s =====")
-        Log.w(
+        Log.d(TAG, "===== boot census @${atSeconds}s =====")
+        Log.i(
             TAG,
-            "pool=${snapshot.size} opened=${opened.size} served_events=${served.size} never_opened=${neverOpened.size} " +
+            "census @${atSeconds}s pool=${snapshot.size} opened=${opened.size} served_events=${served.size} never_opened=${neverOpened.size} " +
                 "dials=${snapshot.values.sumOf { it.tentatives.get() }} " +
                 "events=${snapshot.values.sumOf { it.events.get() }} " +
                 "reqs=${snapshot.values.sumOf { it.reqsSent.get() }} " +
                 "auths=${snapshot.values.sumOf { it.authsSent.get() }}",
         )
-        Log.w(TAG, "failures_by_cause=" + causeTotals.entries.sortedByDescending { it.value }.joinToString { "${it.key}:${it.value}" })
-        Log.w(TAG, "closed_by_prefix=" + closedTotals.entries.sortedByDescending { it.value }.joinToString { "${it.key}:${it.value}" })
+        Log.i(TAG, "census @${atSeconds}s failures_by_cause=" + causeTotals.entries.sortedByDescending { it.value }.joinToString { "${it.key}:${it.value}" })
+        Log.i(TAG, "census @${atSeconds}s closed_by_prefix=" + closedTotals.entries.sortedByDescending { it.value }.joinToString { "${it.key}:${it.value}" })
 
         // Relays that cost us dials and gave nothing back, worst first: the wasted-effort list.
-        Log.w(TAG, "--- top wasted dials (no events received) ---")
+        Log.d(TAG, "--- top wasted dials (no events received) ---")
         snapshot
             .filter { it.value.events.get() == 0 }
             .entries
             .sortedByDescending { it.value.tentatives.get() }
             .take(25)
             .forEach { (url, r) ->
-                Log.w(
+                Log.d(
                     TAG,
                     "WASTE ${url.url} dials=${r.tentatives.get()} opens=${r.opens.get()} " +
                         "fail=[${r.failures.entries.joinToString { "${it.key}:${it.value.get()}" }}] " +
@@ -245,17 +253,17 @@ class BootRelayDiagnostics(
 
         // The relays actually carrying the boot, so a suppression change can be checked for
         // coverage loss rather than just CLOSED reduction.
-        Log.w(TAG, "--- top event providers ---")
+        Log.d(TAG, "--- top event providers ---")
         served.entries
             .sortedByDescending { it.value.events.get() }
             .take(20)
             .forEach { (url, r) ->
-                Log.w(
+                Log.d(
                     TAG,
                     "SERVE ${url.url} events=${r.events.get()} reqs=${r.reqsSent.get()} eose=${r.eoses.get()} " +
                         "openMs=${r.firstOpenAtMs.get()} eoseMs=${r.firstEoseAtMs.get()} dials=${r.tentatives.get()}",
                 )
             }
-        Log.w(TAG, "===== end census @${atSeconds}s =====")
+        Log.d(TAG, "===== end census @${atSeconds}s =====")
     }
 }

amethyst/src/main/java/com/vitorpamplona/amethyst/service/relayClient/eoseManagers/PerUniqueIdEoseManager.kt

@@ -21,6 +21,8 @@
 package com.vitorpamplona.amethyst.service.relayClient.eoseManagers
 
 import com.vitorpamplona.amethyst.commons.relayClient.eoseManagers.BaseEoseManager
+import com.vitorpamplona.amethyst.commons.relayClient.subscriptions.attributedTo
+import com.vitorpamplona.amethyst.service.relayClient.AccountScopedQuery
 import com.vitorpamplona.amethyst.service.relays.EOSEByKey
 import com.vitorpamplona.amethyst.service.relays.SincePerRelayMap
 import com.vitorpamplona.quartz.nip01Core.core.Event
@@ -114,7 +116,13 @@ abstract class PerUniqueIdEoseManager<T, U : Any>(
 
         uniqueSubscribedAccounts.forEach {
             val mainKey = id(it)
-            val newFilters = updateFilter(it, since(it))?.ifEmpty { null }
+            val newFilters =
+                updateFilter(it, since(it))
+                    ?.ifEmpty { null }
+                    // Attribute to the account that owns this subscription, once, here — rather than
+                    // threading a pubkey through every filter builder underneath. Builders that already
+                    // know their account keep what they set.
+                    ?.let { f -> accountPubKeyOf(it)?.let { pk -> f.attributedTo(pk) } ?: f }
             findOrCreateSubFor(it).updateFilters(newFilters?.groupByRelay())
 
             updated.add(mainKey)
@@ -131,4 +139,13 @@ abstract class PerUniqueIdEoseManager<T, U : Any>(
     ): List<RelayBasedFilter>?
 
     abstract fun id(key: T): U
+
+    /**
+     * The account behind [key], when the key is account-scoped. Null for keys about other users.
+     *
+     * Keyed on [AccountScopedQuery] rather than a concrete query-state type: the home feed uses
+     * HomeQueryState, notifications use AccountQueryState, and checking one concrete class filed the
+     * other under "not attributed" despite both being built from a single account's data.
+     */
+    private fun accountPubKeyOf(key: Any?): String? = (key as? AccountScopedQuery)?.account?.userProfile()?.pubkeyHex
 }

amethyst/src/main/java/com/vitorpamplona/amethyst/service/relayClient/eoseManagers/PerUserAndFollowListEoseManager.kt

@@ -21,7 +21,9 @@
 package com.vitorpamplona.amethyst.service.relayClient.eoseManagers
 
 import com.vitorpamplona.amethyst.commons.relayClient.eoseManagers.BaseEoseManager
+import com.vitorpamplona.amethyst.commons.relayClient.subscriptions.attributedTo
 import com.vitorpamplona.amethyst.model.User
+import com.vitorpamplona.amethyst.service.relayClient.AccountScopedQuery
 import com.vitorpamplona.amethyst.service.relays.EOSEAccountKey
 import com.vitorpamplona.amethyst.service.relays.SincePerRelayMap
 import com.vitorpamplona.quartz.nip01Core.core.Event
@@ -127,7 +129,13 @@ abstract class PerUserAndFollowListEoseManager<T, U : Any>(
         uniqueSubscribedAccounts.forEach {
             val user = user(it)
             val sub = findOrCreateSubFor(it)
-            val newFilters = updateFilter(it, since(it))?.ifEmpty { null }
+            val newFilters =
+                updateFilter(it, since(it))
+                    ?.ifEmpty { null }
+                    // Attribute to the account that owns this subscription, once, here — rather than
+                    // threading a pubkey through every filter builder underneath. Builders that already
+                    // know their account keep what they set.
+                    ?.let { f -> accountPubKeyOf(it)?.let { pk -> f.attributedTo(pk) } ?: f }
             sub.updateFilters(newFilters?.groupByRelay())
             updated.add(user)
         }
@@ -145,4 +153,13 @@ abstract class PerUserAndFollowListEoseManager<T, U : Any>(
     abstract fun user(key: T): User
 
     abstract fun list(key: T): U
+
+    /**
+     * The account behind [key], when the key is account-scoped. Null for keys about other users.
+     *
+     * Keyed on [AccountScopedQuery] rather than a concrete query-state type: the home feed uses
+     * HomeQueryState, notifications use AccountQueryState, and checking one concrete class filed the
+     * other under "not attributed" despite both being built from a single account's data.
+     */
+    private fun accountPubKeyOf(key: Any?): String? = (key as? AccountScopedQuery)?.account?.userProfile()?.pubkeyHex
 }

amethyst/src/main/java/com/vitorpamplona/amethyst/service/relayClient/eoseManagers/PerUserEoseManager.kt

@@ -21,7 +21,9 @@
 package com.vitorpamplona.amethyst.service.relayClient.eoseManagers
 
 import com.vitorpamplona.amethyst.commons.relayClient.eoseManagers.BaseEoseManager
+import com.vitorpamplona.amethyst.commons.relayClient.subscriptions.attributedTo
 import com.vitorpamplona.amethyst.model.User
+import com.vitorpamplona.amethyst.service.relayClient.AccountScopedQuery
 import com.vitorpamplona.amethyst.service.relays.EOSEAccountFast
 import com.vitorpamplona.amethyst.service.relays.SincePerRelayMap
 import com.vitorpamplona.quartz.nip01Core.core.Event
@@ -113,7 +115,13 @@ abstract class PerUserEoseManager<T>(
 
         uniqueSubscribedAccounts.forEach {
             val user = user(it)
-            val newFilters = updateFilter(it, since(it))?.ifEmpty { null }
+            val newFilters =
+                updateFilter(it, since(it))
+                    ?.ifEmpty { null }
+                    // Attribute to the account that owns this subscription, once, here — rather than
+                    // threading a pubkey through every filter builder underneath. Builders that already
+                    // know their account keep what they set.
+                    ?.let { f -> accountPubKeyOf(it)?.let { pk -> f.attributedTo(pk) } ?: f }
 
             findOrCreateSubFor(it).updateFilters(newFilters?.groupByRelay())
 
@@ -131,4 +139,13 @@ abstract class PerUserEoseManager<T>(
     ): List<RelayBasedFilter>?
 
     abstract fun user(key: T): User
+
+    /**
+     * The account behind [key], when the key is account-scoped. Null for keys about other users.
+     *
+     * Keyed on [AccountScopedQuery] rather than a concrete query-state type: the home feed uses
+     * HomeQueryState, notifications use AccountQueryState, and checking one concrete class filed the
+     * other under "not attributed" despite both being built from a single account's data.
+     */
+    private fun accountPubKeyOf(key: Any?): String? = (key as? AccountScopedQuery)?.account?.userProfile()?.pubkeyHex
 }

amethyst/src/main/java/com/vitorpamplona/amethyst/service/relayClient/eoseManagers/SingleSubNoEoseCacheEoseManager.kt

@@ -21,6 +21,8 @@
 package com.vitorpamplona.amethyst.service.relayClient.eoseManagers
 
 import com.vitorpamplona.amethyst.commons.relayClient.eoseManagers.BaseEoseManager
+import com.vitorpamplona.amethyst.commons.relayClient.subscriptions.attributedTo
+import com.vitorpamplona.amethyst.service.relayClient.AccountScopedQuery
 import com.vitorpamplona.quartz.nip01Core.core.Event
 import com.vitorpamplona.quartz.nip01Core.relay.client.INostrClient
 import com.vitorpamplona.quartz.nip01Core.relay.client.pool.RelayBasedFilter
@@ -66,11 +68,26 @@ abstract class SingleSubNoEoseCacheEoseManager<T>(
 
     override fun updateSubscriptions(keys: Set<T>) {
         val uniqueSubscribedAccounts = keys.distinctBy { distinct(it) }
-        val newFilters = updateFilter(uniqueSubscribedAccounts)?.ifEmpty { null }
+        val newFilters =
+            updateFilter(uniqueSubscribedAccounts)
+                ?.ifEmpty { null }
+                // Attribute to the account that owns this subscription, once, here — rather than
+                // threading a pubkey through every filter builder underneath. Builders that already
+                // know their account keep what they set.
+                ?.let { f -> accountPubKeyOf(uniqueSubscribedAccounts.firstOrNull())?.let { pk -> f.attributedTo(pk) } ?: f }
         sub.updateFilters(newFilters?.groupByRelay())
     }
 
     abstract fun updateFilter(keys: List<T>): List<RelayBasedFilter>?
 
     abstract fun distinct(key: T): Any
+
+    /**
+     * The account behind [key], when the key is account-scoped. Null for keys about other users.
+     *
+     * Keyed on [AccountScopedQuery] rather than a concrete query-state type: the home feed uses
+     * HomeQueryState, notifications use AccountQueryState, and checking one concrete class filed the
+     * other under "not attributed" despite both being built from a single account's data.
+     */
+    private fun accountPubKeyOf(key: Any?): String? = (key as? AccountScopedQuery)?.account?.userProfile()?.pubkeyHex
 }

amethyst/src/main/java/com/vitorpamplona/amethyst/service/relayClient/reqCommand/RelaySubscriptionsCoordinator.kt

@@ -21,7 +21,6 @@
 package com.vitorpamplona.amethyst.service.relayClient.reqCommand
 
 import com.vitorpamplona.amethyst.commons.relayClient.assemblers.CashuMintDirectoryFilterAssembler
-import com.vitorpamplona.amethyst.commons.relayClient.assemblers.CashuWalletFilterAssembler
 import com.vitorpamplona.amethyst.model.LocalCache
 import com.vitorpamplona.amethyst.service.relayClient.reqCommand.account.AccountFilterAssembler
 import com.vitorpamplona.amethyst.service.relayClient.reqCommand.account.AccountForegroundFilterAssembler
@@ -61,6 +60,7 @@ import com.vitorpamplona.amethyst.ui.screen.loggedIn.geohash.datasource.GeoHashF
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.gitRepo.datasource.RepositoryFilterAssembler
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.gitRepositories.datasource.GitRepositoriesFilterAssembler
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.hashtag.datasource.HashtagFilterAssembler
+import com.vitorpamplona.amethyst.ui.screen.loggedIn.highlights.datasource.HighlightsFilterAssembler
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.home.datasource.HomeFilterAssembler
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.livestreams.datasource.LiveStreamsFilterAssembler
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.longs.datasource.LongsFilterAssembler
@@ -170,6 +170,7 @@ class RelaySubscriptionsCoordinator(
     val pictures = PicturesFilterAssembler(client)
     val workouts = WorkoutsFilterAssembler(client)
     val gitRepositories = GitRepositoriesFilterAssembler(client)
+    val highlights = HighlightsFilterAssembler(client)
     val calendars = CalendarsFilterAssembler(client)
     val products = ProductsFilterAssembler(client)
     val shorts = ShortsFilterAssembler(client)
@@ -202,10 +203,6 @@ class RelaySubscriptionsCoordinator(
     // active when the wallet's on-chain transactions screen is on top.
     val onchainZaps = OnchainZapsFilterAssembler(client)
 
-    // active when a NIP-60 Cashu wallet exists for the account.
-    // Subscribes to kinds 17375/7375/7376/7374/10019 by author + inbound 9321 #p=self.
-    val cashuWallet = CashuWalletFilterAssembler(client)
-
     // active while the user is browsing the NIP-87 mint picker. Subscribes to
     // kind:38172 cashu mint announcements + kind:38000 cashu-scoped
     // recommendations on the configured relay set.
@@ -235,6 +232,7 @@ class RelaySubscriptionsCoordinator(
             pictures,
             workouts,
             gitRepositories,
+            highlights,
             calendars,
             products,
             shorts,
@@ -276,7 +274,6 @@ class RelaySubscriptionsCoordinator(
             chess,
             nwc,
             onchainZaps,
-            cashuWallet,
             cashuMintDirectory,
         )
 

amethyst/src/main/java/com/vitorpamplona/amethyst/service/relayClient/reqCommand/account/AccountFilterAssembler.kt

@@ -23,6 +23,7 @@ package com.vitorpamplona.amethyst.service.relayClient.reqCommand.account
 import androidx.compose.runtime.Stable
 import com.vitorpamplona.amethyst.commons.relayClient.composeSubscriptionManagers.ComposeSubscriptionManager
 import com.vitorpamplona.amethyst.model.Account
+import com.vitorpamplona.amethyst.service.relayClient.AccountScopedQuery
 import com.vitorpamplona.amethyst.service.relayClient.reqCommand.account.drafts.AccountDraftsEoseManager
 import com.vitorpamplona.amethyst.service.relayClient.reqCommand.account.marmot.MarmotGroupEventsEoseManager
 import com.vitorpamplona.amethyst.service.relayClient.reqCommand.account.metadata.AccountMetadataEoseManager
@@ -31,17 +32,48 @@ import com.vitorpamplona.amethyst.service.relayClient.reqCommand.account.nip01No
 import com.vitorpamplona.amethyst.service.relayClient.reqCommand.account.nip47WalletConnect.NwcNotificationsEoseManager
 import com.vitorpamplona.amethyst.service.relayClient.reqCommand.account.nip59GiftWraps.AccountGiftWrapsEoseManager
 import com.vitorpamplona.amethyst.service.relayClient.reqCommand.account.nip59GiftWraps.AccountGiftWrapsHistoryEoseManager
+import com.vitorpamplona.amethyst.service.relayClient.reqCommand.account.nip60Cashu.CashuWalletEoseManager
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.AccountFeedContentStates
 import com.vitorpamplona.quartz.nip01Core.core.HexKey
 import com.vitorpamplona.quartz.nip01Core.relay.client.INostrClient
 
 // This allows multiple screen to be listening to logged-in accounts.
+//
+// Carries only what an account can supply with no screen attached, so the
+// background registry can mount the always-on loaders for accounts the user
+// opted into keeping active while the app is away. Screens use the richer
+// [AccountUiQueryState] below.
 @Stable
-class AccountQueryState(
-    val account: Account,
-    val feedContentStates: AccountFeedContentStates,
+open class AccountQueryState(
+    override val account: Account,
     val otherAccounts: Set<HexKey>,
-)
+) : AccountScopedQuery {
+    /**
+     * The feeds this account renders, when a screen is attached — null for
+     * background accounts.
+     *
+     * The only always-on reader is
+     * [com.vitorpamplona.amethyst.service.relayClient.reqCommand.account.nip01Notifications.AccountNotificationsEoseFromInboxRelaysManager],
+     * which reads it as a cold-start `since` floor via `lastNoteCreatedAtIfFilled()`.
+     * That floor only arms once the feed holds a full page, and nothing fills a
+     * feed that has no UI — so for a background account it could only ever
+     * return null anyway. Leaving the field off the background key states that
+     * rather than pretending there is a feed to consult.
+     */
+    open val feedContentStates: AccountFeedContentStates? = null
+}
+
+/**
+ * The key for an account with a screen attached. Adds the feed states, which
+ * lets the notification loaders floor their cold-start queries at the depth the
+ * rendered feed already reaches instead of asking all-time again.
+ */
+@Stable
+class AccountUiQueryState(
+    account: Account,
+    override val feedContentStates: AccountFeedContentStates,
+    otherAccounts: Set<HexKey>,
+) : AccountQueryState(account, otherAccounts)
 
 /**
  * Always-on account loaders: metadata, gift wraps, drafts, inbox-relay
@@ -53,30 +85,51 @@ class AccountFilterAssembler(
     client: INostrClient,
 ) : ComposeSubscriptionManager<AccountQueryState>() {
     // Live tail: the recent week of gift wraps, always open at the top for new messages.
-    val giftWraps = AccountGiftWrapsEoseManager(client, ::allKeys)
+    val giftWraps = AccountGiftWrapsEoseManager(client, ::preferredKeys)
 
     // History: older gift wraps, loaded on demand in bounded one-shot slices.
-    val giftWrapsHistory = AccountGiftWrapsHistoryEoseManager(client, ::allKeys)
+    val giftWrapsHistory = AccountGiftWrapsHistoryEoseManager(client, ::preferredKeys)
 
     // Live tail: the recent week of notifications from the inbox + group host relays.
-    val notifications = AccountNotificationsEoseFromInboxRelaysManager(client, ::allKeys)
+    val notifications = AccountNotificationsEoseFromInboxRelaysManager(client, ::preferredKeys)
 
     // History: older notifications, paged backward by until+limit per relay, driven by the feed's markers.
-    val notificationsHistory = AccountNotificationsHistoryEoseManager(client, ::allKeys)
+    val notificationsHistory = AccountNotificationsHistoryEoseManager(client, ::preferredKeys)
 
     val group =
         listOf(
-            AccountMetadataEoseManager(client, ::allKeys),
+            AccountMetadataEoseManager(client, ::preferredKeys),
             giftWraps,
             giftWrapsHistory,
-            AccountDraftsEoseManager(client, ::allKeys),
+            AccountDraftsEoseManager(client, ::preferredKeys),
             notifications,
             notificationsHistory,
             // Live tail: NIP-47 wallet notifications (payment_received) on each connected wallet's own relay.
-            NwcNotificationsEoseManager(client, ::allKeys),
-            MarmotGroupEventsEoseManager(client, ::allKeys),
+            NwcNotificationsEoseManager(client, ::preferredKeys),
+            // NIP-60 wallet + NIP-61 nutzap inbox. Mounted here rather than run from a collector
+            // inside CashuWalletState, so it starts and stops with every other account-level loader.
+            CashuWalletEoseManager(client, ::preferredKeys),
+            MarmotGroupEventsEoseManager(client, ::preferredKeys),
         )
 
+    /**
+     * One key per account, preferring a screen's [AccountUiQueryState] over the
+     * background registry's key.
+     *
+     * An account can be mounted twice — the user is looking at it *and* asked to keep
+     * it running in the background. The managers below all dedup by user, but by
+     * keeping whichever key they meet first, which is just whoever mounted first.
+     * Resolving it here means the account being looked at keeps the feed-backed
+     * cold-start floor instead of losing it to a race.
+     */
+    private fun preferredKeys(): Set<AccountQueryState> =
+        allKeys()
+            .groupBy { it.account.userProfile().pubkeyHex }
+            .values
+            .mapTo(mutableSetOf()) { keys ->
+                keys.firstOrNull { it.feedContentStates != null } ?: keys.first()
+            }
+
     override fun invalidateKeys() = invalidateFilters()
 
     override fun invalidateFilters() = group.forEach { it.invalidateFilters() }

amethyst/src/main/java/com/vitorpamplona/amethyst/service/relayClient/reqCommand/account/AccountFilterAssemblerSubscription.kt

@@ -41,7 +41,7 @@ fun AccountFilterAssemblerSubscription(
     // even if they are tracking the same tag.
     val state =
         remember(accountViewModel) {
-            AccountQueryState(accountViewModel.account, accountViewModel.feedStates, accountViewModel.trustedAccounts.value)
+            AccountUiQueryState(accountViewModel.account, accountViewModel.feedStates, accountViewModel.trustedAccounts.value)
         }
 
     KeyDataSourceSubscription(state, dataSource)

amethyst/src/main/java/com/vitorpamplona/amethyst/service/relayClient/reqCommand/account/AccountForegroundFilterAssembler.kt

@@ -45,7 +45,7 @@ class AccountForegroundFilterAssembler(
     authenticator: IAuthStatus,
     failureTracker: RelayOfflineTracker,
     scope: CoroutineScope,
-) : ComposeSubscriptionManager<AccountQueryState>() {
+) : ComposeSubscriptionManager<AccountUiQueryState>() {
     val group =
         listOf(
             AccountFollowsLoaderSubAssembler(client, cache, scope, authenticator, failureTracker, ::allKeys),

amethyst/src/main/java/com/vitorpamplona/amethyst/service/relayClient/reqCommand/account/AccountForegroundFilterAssemblerSubscription.kt

@@ -39,7 +39,7 @@ fun AccountForegroundFilterAssemblerSubscription(
 ) {
     val state =
         remember(accountViewModel) {
-            AccountQueryState(accountViewModel.account, accountViewModel.feedStates, accountViewModel.trustedAccounts.value)
+            AccountUiQueryState(accountViewModel.account, accountViewModel.feedStates, accountViewModel.trustedAccounts.value)
         }
 
     LifecycleAwareKeyDataSourceSubscription(state, dataSource)

amethyst/src/main/java/com/vitorpamplona/amethyst/service/relayClient/reqCommand/account/AccountSubscriptionRegistry.kt

@@ -0,0 +1,100 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.service.relayClient.reqCommand.account
+
+import com.vitorpamplona.amethyst.model.Account
+import com.vitorpamplona.quartz.nip01Core.core.HexKey
+import com.vitorpamplona.quartz.utils.Log
+
+/**
+ * Mounts the account-level loaders — notifications, DMs, gift wraps, drafts,
+ * metadata — for accounts that have no screen of their own.
+ *
+ * Every other mount of [AccountFilterAssembler] comes from a composable holding an
+ * `AccountViewModel`, which means it only ever covers the account the user is
+ * looking at. Every other logged-in account was merely resident in memory so pushed
+ * gift wraps could be decrypted by their owner; everything else about them depended
+ * on a push message arriving. On a device with no push (no Play Services, no
+ * UnifiedPush distributor, Pokey not installed) they pulled nothing at all.
+ *
+ * This registry is the pull side. It holds one [AccountQueryState] per account it is
+ * given and drives [AccountFilterAssembler.subscribe] /
+ * [AccountFilterAssembler.unsubscribe] directly — those are plain functions, not
+ * composables, so no UI has to exist.
+ *
+ * The keys carry no feed states (see [AccountQueryState.feedContentStates]) and no
+ * `otherAccounts` — populating the account switcher's avatars is a screen's job, and
+ * these accounts have no screen.
+ *
+ * It deliberately decides nothing about *which* accounts those are: it mounts exactly
+ * the set it is handed, so the foreground/background rule lives in one place, in
+ * [com.vitorpamplona.amethyst.service.notifications.AlwaysOnNotificationServiceManager],
+ * which already watches the switches that define it and calls [sync] on every change.
+ */
+class AccountSubscriptionRegistry(
+    private val assembler: AccountFilterAssembler,
+) {
+    companion object {
+        private const val TAG = "AccountSubscriptions"
+    }
+
+    private val mounted = mutableMapOf<HexKey, AccountQueryState>()
+
+    /**
+     * Makes the mounted set match [accounts] exactly: subscribes the ones that just
+     * joined it, unsubscribes the ones that left or were unloaded, and leaves the
+     * rest untouched.
+     *
+     * Idempotent, so callers can hand it the same set on every emission of the flows
+     * behind it without churning subscriptions.
+     */
+    @Synchronized
+    fun sync(accounts: Collection<Account>) {
+        val wanted = accounts.associateBy { it.userProfile().pubkeyHex }
+
+        // Unmount accounts that dropped out, and accounts whose Account object was
+        // replaced (re-login rebuilds it) — the stale instance holds the old
+        // signer and relay lists, so its filters would be built from dead state.
+        val stale = mounted.filter { (pubkey, state) -> wanted[pubkey] !== state.account }
+        stale.forEach { (pubkey, state) ->
+            mounted.remove(pubkey)
+            assembler.unsubscribe(state)
+        }
+
+        var added = 0
+        wanted.forEach { (pubkey, account) ->
+            if (pubkey !in mounted) {
+                val state = AccountQueryState(account, emptySet())
+                mounted[pubkey] = state
+                assembler.subscribe(state)
+                added++
+            }
+        }
+
+        if (added > 0 || stale.isNotEmpty()) {
+            Log.d(TAG) { "Account subscriptions: ${mounted.size} mounted (+$added, -${stale.size})" }
+        }
+    }
+
+    /** Unmounts everything. Used when the app goes away with the master off, and on logout. */
+    @Synchronized
+    fun clear() = sync(emptyList())
+}

amethyst/src/main/java/com/vitorpamplona/amethyst/service/relayClient/reqCommand/account/drafts/FilterDraftsAndReportsFromKey.kt

@@ -20,9 +20,10 @@
  */
 package com.vitorpamplona.amethyst.service.relayClient.reqCommand.account.drafts
 
+import com.vitorpamplona.amethyst.commons.relayClient.subscriptions.ExplainedFilter
+import com.vitorpamplona.amethyst.commons.relayClient.subscriptions.SubPurpose
 import com.vitorpamplona.quartz.nip01Core.core.HexKey
 import com.vitorpamplona.quartz.nip01Core.relay.client.pool.RelayBasedFilter
-import com.vitorpamplona.quartz.nip01Core.relay.filters.Filter
 import com.vitorpamplona.quartz.nip01Core.relay.normalizer.NormalizedRelayUrl
 import com.vitorpamplona.quartz.nip37Drafts.DraftWrapEvent
 
@@ -42,7 +43,8 @@ fun filterDraftsFromKey(
         RelayBasedFilter(
             relay = relay,
             filter =
-                Filter(
+                ExplainedFilter(
+                    purpose = SubPurpose.ACCOUNT_DATA,
                     kinds = DraftKinds,
                     authors = listOf(pubkey),
                     since = since,

amethyst/src/main/java/com/vitorpamplona/amethyst/service/relayClient/reqCommand/account/follows/AccountFollowsLoaderSubAssembler.kt

@@ -21,12 +21,14 @@
 package com.vitorpamplona.amethyst.service.relayClient.reqCommand.account.follows
 
 import com.vitorpamplona.amethyst.commons.relayClient.eoseManagers.IEoseManager
+import com.vitorpamplona.amethyst.commons.relayClient.subscriptions.ExplainedFilter
+import com.vitorpamplona.amethyst.commons.relayClient.subscriptions.SubPurpose
 import com.vitorpamplona.amethyst.isDebug
 import com.vitorpamplona.amethyst.model.Account
 import com.vitorpamplona.amethyst.model.LocalCache
 import com.vitorpamplona.amethyst.model.User
 import com.vitorpamplona.amethyst.service.BundledUpdate
-import com.vitorpamplona.amethyst.service.relayClient.reqCommand.account.AccountQueryState
+import com.vitorpamplona.amethyst.service.relayClient.reqCommand.account.AccountUiQueryState
 import com.vitorpamplona.amethyst.service.relays.EOSEAccountFast
 import com.vitorpamplona.quartz.nip01Core.core.Event
 import com.vitorpamplona.quartz.nip01Core.relay.client.INostrClient
@@ -60,7 +62,7 @@ class AccountFollowsLoaderSubAssembler(
     val scope: CoroutineScope,
     val authStatus: IAuthStatus,
     val failureTracker: RelayOfflineTracker,
-    val allKeys: () -> Set<AccountQueryState>,
+    val allKeys: () -> Set<AccountUiQueryState>,
 ) : IEoseManager {
     private val logTag = "AccountFollowsLoaderSubAssembler"
     private val orchestrator = SubscriptionController(client)
@@ -157,6 +159,15 @@ class AccountFollowsLoaderSubAssembler(
 
         val connectedRelays = client.connectedRelaysFlow().value
 
+        // Attributed only when one account is asking. The follow lists above are unioned across every
+        // logged-in account and the relays are then picked from that union, so with several accounts
+        // active no single one owns a given filter. Deduped by pubkey because `Account` uses identity
+        // equality.
+        val soleAccountPubKey =
+            accounts
+                .mapTo(mutableSetOf()) { it.userProfile().pubkeyHex }
+                .singleOrNull()
+
         val perRelay = pickRelaysToLoadUsers(users, accounts, connectedRelays, failureTracker.cannotConnectRelays, hasTried)
 
         hasTried.removeEveryoneBut(users)
@@ -165,7 +176,13 @@ class AccountFollowsLoaderSubAssembler(
             if (users.isNotEmpty()) {
                 RelayBasedFilter(
                     relay = relay,
-                    filter = Filter(kinds = listOf(AdvertisedRelayListEvent.KIND), authors = users.sorted()),
+                    filter =
+                        ExplainedFilter(
+                            purpose = SubPurpose.RELAY_LISTS,
+                            kinds = listOf(AdvertisedRelayListEvent.KIND),
+                            authors = users.sorted(),
+                            accountPubKeys = listOfNotNull(soleAccountPubKey),
+                        ),
                 )
             } else {
                 null
@@ -173,7 +190,7 @@ class AccountFollowsLoaderSubAssembler(
         }
     }
 
-    fun updateSubscriptions(keys: Set<AccountQueryState>) {
+    fun updateSubscriptions(keys: Set<AccountUiQueryState>) {
         val uniqueSubscribedAccounts = keys.associate { it.account.userProfile() to it.account }
 
         val allFilters = updateFilterForAllAccounts(uniqueSubscribedAccounts.values)

amethyst/src/main/java/com/vitorpamplona/amethyst/service/relayClient/reqCommand/account/marmot/MarmotGroupEventsEoseManager.kt

@@ -21,6 +21,8 @@
 package com.vitorpamplona.amethyst.service.relayClient.reqCommand.account.marmot
 
 import com.vitorpamplona.amethyst.commons.model.chats.ChatFeedType
+import com.vitorpamplona.amethyst.commons.relayClient.subscriptions.ExplainedFilter
+import com.vitorpamplona.amethyst.commons.relayClient.subscriptions.SubPurpose
 import com.vitorpamplona.amethyst.model.User
 import com.vitorpamplona.amethyst.service.relayClient.eoseManagers.PerUserEoseManager
 import com.vitorpamplona.amethyst.service.relayClient.eoseManagers.launchChatFeedToggleObserver
@@ -89,7 +91,7 @@ class MarmotGroupEventsEoseManager(
                     "(metadataRelays=${groupRelays?.size ?: 0}, usingFallback=${groupRelays.isNullOrEmpty()}): ${relaysForGroup.map { it.url }}"
             }
             for (relay in relaysForGroup) {
-                result.add(RelayBasedFilter(relay = relay, filter = filter))
+                result.add(RelayBasedFilter(relay = relay, filter = ExplainedFilter.of(filter, SubPurpose.ENCRYPTED_GROUPS, "MLS group messages", entityIds = listOf(groupId))))
             }
         }
 
@@ -97,7 +99,7 @@ class MarmotGroupEventsEoseManager(
         if (fallbackRelays.isNotEmpty()) {
             val ownKeyPackageFilter = manager.subscriptionManager.ownKeyPackageFilter()
             for (relay in fallbackRelays) {
-                result.add(RelayBasedFilter(relay = relay, filter = ownKeyPackageFilter))
+                result.add(RelayBasedFilter(relay = relay, filter = ExplainedFilter.of(ownKeyPackageFilter, SubPurpose.ENCRYPTED_GROUPS, "own MLS key package")))
             }
         }
 

amethyst/src/main/java/com/vitorpamplona/amethyst/service/relayClient/reqCommand/account/metadata/AccountMetadataEoseManager.kt

@@ -20,66 +20,110 @@
  */
 package com.vitorpamplona.amethyst.service.relayClient.reqCommand.account.metadata
 
+import com.vitorpamplona.amethyst.commons.relayClient.eoseManagers.MergedAuthorTracker
+import com.vitorpamplona.amethyst.commons.relayClient.eoseManagers.SingleSubEoseManager
 import com.vitorpamplona.amethyst.model.User
-import com.vitorpamplona.amethyst.service.relayClient.eoseManagers.PerUserEoseManager
 import com.vitorpamplona.amethyst.service.relayClient.reqCommand.account.AccountQueryState
 import com.vitorpamplona.amethyst.service.relays.SincePerRelayMap
 import com.vitorpamplona.quartz.nip01Core.relay.client.INostrClient
 import com.vitorpamplona.quartz.nip01Core.relay.client.pool.RelayBasedFilter
-import com.vitorpamplona.quartz.nip01Core.relay.client.subscriptions.Subscription
+import com.vitorpamplona.quartz.nip01Core.relay.normalizer.NormalizedRelayUrl
 import com.vitorpamplona.quartz.utils.TimeUtils
 import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.FlowPreview
 import kotlinx.coroutines.Job
 import kotlinx.coroutines.flow.collectLatest
 import kotlinx.coroutines.launch
 
+/**
+ * Each account's own profile, lists and recent posts — for **every** logged-in account, in one
+ * subscription.
+ *
+ * Every filter here is `authors`-keyed, so a relay that several accounts read from can be asked
+ * about all of them at once by widening `authors` rather than opening a REQ per account. This was
+ * the largest single contributor to blowing a relay's `max_subscriptions`: seven filters in a
+ * subscription, repeated once per account.
+ *
+ * The per-account `limit`s are summed rather than shared. These are mostly replaceable events, so
+ * the limit is a safety bound rather than a page size, and scaling it by the number of accounts
+ * keeps each one exactly the headroom it had alone.
+ */
 class AccountMetadataEoseManager(
     client: INostrClient,
     allKeys: () -> Set<AccountQueryState>,
-) : PerUserEoseManager<AccountQueryState>(client, allKeys) {
-    override fun user(key: AccountQueryState) = key.account.userProfile()
+) : SingleSubEoseManager<AccountQueryState>(client, allKeys) {
+    override fun distinct(key: AccountQueryState) = key.account.userProfile()
 
     fun relayFlow(query: AccountQueryState) = query.account.homeRelays.flow
 
     override fun updateFilter(
-        key: AccountQueryState,
+        keys: List<AccountQueryState>,
         since: SincePerRelayMap?,
-    ): List<RelayBasedFilter> =
-        relayFlow(key).value.flatMap {
-            val since = since?.get(it)?.time
-            listOf(
-                filterAccountInfoAndListsFromKey(it, user(key).pubkeyHex, since),
-                filterFollowsAndMutesFromKey(it, user(key).pubkeyHex, since),
-                filterBookmarksAndReportsFromKey(it, user(key).pubkeyHex, since),
-                filterLastPostsFromKey(it, user(key).pubkeyHex, since ?: TimeUtils.oneMonthAgo()),
-                filterBasicAccountInfoFromKeys(it, key.otherAccounts.minus(key.account.userProfile().pubkeyHex).toList(), since),
-            ).flatten()
+    ): List<RelayBasedFilter> {
+        val accountsPerRelay = mutableMapOf<NormalizedRelayUrl, MutableList<AccountQueryState>>()
+        keys.forEach { key ->
+            relayFlow(key).value.forEach { relay ->
+                accountsPerRelay.getOrPut(relay) { mutableListOf() }.add(key)
+            }
         }
 
-    val userJobMap = mutableMapOf<User, List<Job>>()
+        return accountsPerRelay.flatMap { (relay, accounts) ->
+            val pubkeys = accounts.map { it.account.userProfile().pubkeyHex }
+
+            // An account joining a relay this subscription already covers must not inherit the cursor
+            // the earlier accounts earned — it would never ask for its own profile, follows or lists.
+            // This matters more here than for notifications: there is no backward pager to rescue it,
+            // so the account would go without until the next launch cleared the in-memory cursor.
+            // Drop the stored cursor AND ignore it for this pass, so the refetch does not depend on
+            // `since` being a live view of the map we just mutated.
+            val gained = authorsPerRelay.gainedAuthors(relay, pubkeys)
+            if (gained) clearEoseFor(relay)
+
+            val relaySince = if (gained) null else since?.get(relay)?.time
+
+            // The account-switcher avatars: other logged-in accounts this screen wants to name.
+            // Screens supply them; the background registry does not, so this is usually empty.
+            val otherAccounts = accounts.flatMapTo(mutableSetOf()) { it.otherAccounts }.minus(pubkeys.toSet())
 
-    @OptIn(FlowPreview::class)
-    override fun newSub(key: AccountQueryState): Subscription {
-        val user = user(key)
-        userJobMap[user]?.forEach { it.cancel() }
-        userJobMap[user] =
             listOf(
-                key.account.scope.launch(Dispatchers.IO) {
-                    relayFlow(key).collectLatest {
-                        invalidateFilters()
-                    }
-                },
-            )
-
-        return super.newSub(key)
+                filterAccountInfoAndListsFromKey(relay, pubkeys, relaySince),
+                filterFollowsAndMutesFromKey(relay, pubkeys, relaySince),
+                filterBookmarksAndReportsFromKey(relay, pubkeys, relaySince),
+                filterLastPostsFromKey(relay, pubkeys, relaySince ?: TimeUtils.oneMonthAgo()),
+                filterBasicAccountInfoFromKeys(relay, otherAccounts.toList(), relaySince, pubkeys),
+            ).flatten()
+        }
     }
 
-    override fun endSub(
-        key: User,
-        subId: String,
-    ) {
-        super.endSub(key, subId)
-        userJobMap[key]?.forEach { it.cancel() }
+    private val authorsPerRelay = MergedAuthorTracker()
+
+    /** Per-account relay watchers, reconciled as accounts come and go. See the notifications manager. */
+    private val userJobMap = mutableMapOf<User, List<Job>>()
+
+    override fun updateSubscriptions(keys: Set<AccountQueryState>) {
+        val wanted = keys.associateBy { it.account.userProfile() }
+
+        (userJobMap.keys - wanted.keys).toList().forEach { user ->
+            userJobMap.remove(user)?.forEach { it.cancel() }
+        }
+
+        wanted.forEach { (user, key) ->
+            if (user !in userJobMap) {
+                userJobMap[user] =
+                    listOf(
+                        key.account.scope.launch(Dispatchers.IO) {
+                            relayFlow(key).collectLatest { invalidateFilters() }
+                        },
+                    )
+            }
+        }
+
+        super.updateSubscriptions(keys)
+    }
+
+    override fun destroy() {
+        authorsPerRelay.clear()
+        userJobMap.values.forEach { jobs -> jobs.forEach { it.cancel() } }
+        userJobMap.clear()
+        super.destroy()
     }
 }

amethyst/src/main/java/com/vitorpamplona/amethyst/service/relayClient/reqCommand/account/metadata/FilterAccountInfoAndListsFromKey.kt

@@ -21,6 +21,8 @@
 package com.vitorpamplona.amethyst.service.relayClient.reqCommand.account.metadata
 
 import com.vitorpamplona.amethyst.commons.relayClient.assemblers.filterContactCardsByAuthorInTheRelay
+import com.vitorpamplona.amethyst.commons.relayClient.subscriptions.ExplainedFilter
+import com.vitorpamplona.amethyst.commons.relayClient.subscriptions.SubPurpose
 import com.vitorpamplona.amethyst.model.nip78AppSpecific.AppSpecificState.Companion.APP_SPECIFIC_DATA_D_TAG
 import com.vitorpamplona.quartz.concord.cord02Community.ConcordCommunityListEvent
 import com.vitorpamplona.quartz.experimental.nipA3.PaymentTargetsEvent
@@ -28,7 +30,6 @@ import com.vitorpamplona.quartz.marmot.mip00KeyPackages.KeyPackageRelayListEvent
 import com.vitorpamplona.quartz.nip01Core.core.HexKey
 import com.vitorpamplona.quartz.nip01Core.metadata.MetadataEvent
 import com.vitorpamplona.quartz.nip01Core.relay.client.pool.RelayBasedFilter
-import com.vitorpamplona.quartz.nip01Core.relay.filters.Filter
 import com.vitorpamplona.quartz.nip01Core.relay.normalizer.NormalizedRelayUrl
 import com.vitorpamplona.quartz.nip02FollowList.ContactListEvent
 import com.vitorpamplona.quartz.nip17Dm.settings.ChatMessageRelayListEvent
@@ -108,29 +109,33 @@ val AmethystMetadataTagMapFilter = mapOf("d" to listOf(APP_SPECIFIC_DATA_D_TAG))
 
 fun filterAccountInfoAndListsFromKey(
     relay: NormalizedRelayUrl,
-    pubkey: HexKey,
+    pubkeys: List<HexKey>,
     since: Long?,
 ): List<RelayBasedFilter> {
-    if (pubkey.isEmpty()) return emptyList()
+    if (pubkeys.isEmpty()) return emptyList()
 
     return listOf(
         RelayBasedFilter(
             relay = relay,
             filter =
-                Filter(
+                ExplainedFilter(
+                    purpose = SubPurpose.ACCOUNT_DATA,
+                    accountPubKeys = pubkeys,
                     kinds = AccountInfoAndListsFromKeyKinds,
-                    authors = listOf(pubkey),
-                    limit = 20,
+                    authors = pubkeys,
+                    limit = 20 * pubkeys.size,
                     since = since,
                 ),
         ),
         RelayBasedFilter(
             relay = relay,
             filter =
-                Filter(
+                ExplainedFilter(
+                    purpose = SubPurpose.ACCOUNT_DATA,
+                    accountPubKeys = pubkeys,
                     kinds = AccountInfoAndListsFromKeyKinds2,
-                    authors = listOf(pubkey),
-                    limit = 80,
+                    authors = pubkeys,
+                    limit = 80 * pubkeys.size,
                     since = since,
                 ),
         ),
@@ -138,17 +143,19 @@ fun filterAccountInfoAndListsFromKey(
         // Addressable — one card per target user — hence its own larger-limit filter.
         filterContactCardsByAuthorInTheRelay(
             relay = relay,
-            author = pubkey,
+            authors = pubkeys,
             since = since,
         ),
         RelayBasedFilter(
             relay = relay,
             filter =
-                Filter(
+                ExplainedFilter(
+                    purpose = SubPurpose.ACCOUNT_DATA,
+                    accountPubKeys = pubkeys,
                     kinds = AmethystMetadataKinds,
-                    authors = listOf(pubkey),
+                    authors = pubkeys,
                     tags = AmethystMetadataTagMapFilter,
-                    limit = 1,
+                    limit = pubkeys.size,
                     since = since,
                 ),
         ),

amethyst/src/main/java/com/vitorpamplona/amethyst/service/relayClient/reqCommand/account/metadata/FilterBasicAccountInfoFromKeys.kt

@@ -20,11 +20,12 @@
  */
 package com.vitorpamplona.amethyst.service.relayClient.reqCommand.account.metadata
 
+import com.vitorpamplona.amethyst.commons.relayClient.subscriptions.ExplainedFilter
+import com.vitorpamplona.amethyst.commons.relayClient.subscriptions.SubPurpose
 import com.vitorpamplona.quartz.marmot.mip00KeyPackages.KeyPackageRelayListEvent
 import com.vitorpamplona.quartz.nip01Core.core.HexKey
 import com.vitorpamplona.quartz.nip01Core.metadata.MetadataEvent
 import com.vitorpamplona.quartz.nip01Core.relay.client.pool.RelayBasedFilter
-import com.vitorpamplona.quartz.nip01Core.relay.filters.Filter
 import com.vitorpamplona.quartz.nip01Core.relay.normalizer.NormalizedRelayUrl
 import com.vitorpamplona.quartz.nip02FollowList.ContactListEvent
 import com.vitorpamplona.quartz.nip17Dm.settings.ChatMessageRelayListEvent
@@ -78,6 +79,12 @@ fun filterBasicAccountInfoFromKeys(
     relay: NormalizedRelayUrl,
     otherAccounts: List<HexKey>?,
     since: Long?,
+    /**
+     * Who wants these profiles. The `authors` here are OTHER people — the account-switcher's
+     * avatars — so unlike every other builder in this package the authors are NOT the accounts
+     * asking, and attribution has to be passed in or the row reads as unattributed.
+     */
+    requestedBy: List<HexKey>,
 ): List<RelayBasedFilter> {
     if (otherAccounts.isNullOrEmpty()) return emptyList()
 
@@ -85,7 +92,9 @@ fun filterBasicAccountInfoFromKeys(
         RelayBasedFilter(
             relay = relay,
             filter =
-                Filter(
+                ExplainedFilter(
+                    purpose = SubPurpose.ACCOUNT_DATA,
+                    accountPubKeys = requestedBy,
                     kinds = BasicAccountInfoKinds,
                     authors = otherAccounts.toList(),
                     limit = otherAccounts.size * BasicAccountInfoKinds.size,
@@ -95,7 +104,9 @@ fun filterBasicAccountInfoFromKeys(
         RelayBasedFilter(
             relay = relay,
             filter =
-                Filter(
+                ExplainedFilter(
+                    purpose = SubPurpose.ACCOUNT_DATA,
+                    accountPubKeys = requestedBy,
                     kinds = BasicAccountInfoKinds2,
                     authors = otherAccounts.toList(),
                     limit = otherAccounts.size * BasicAccountInfoKinds2.size,

amethyst/src/main/java/com/vitorpamplona/amethyst/service/relayClient/reqCommand/account/metadata/FilterBookmarksAndReportsFromKey.kt

@@ -20,9 +20,10 @@
  */
 package com.vitorpamplona.amethyst.service.relayClient.reqCommand.account.metadata
 
+import com.vitorpamplona.amethyst.commons.relayClient.subscriptions.ExplainedFilter
+import com.vitorpamplona.amethyst.commons.relayClient.subscriptions.SubPurpose
 import com.vitorpamplona.quartz.nip01Core.core.HexKey
 import com.vitorpamplona.quartz.nip01Core.relay.client.pool.RelayBasedFilter
-import com.vitorpamplona.quartz.nip01Core.relay.filters.Filter
 import com.vitorpamplona.quartz.nip01Core.relay.normalizer.NormalizedRelayUrl
 import com.vitorpamplona.quartz.nip51Lists.PinListEvent
 import com.vitorpamplona.quartz.nip51Lists.bookmarkList.BookmarkListEvent
@@ -43,18 +44,20 @@ val ReportsAndBookmarksFromKeyKinds =
 
 fun filterBookmarksAndReportsFromKey(
     relay: NormalizedRelayUrl,
-    pubkey: HexKey?,
+    pubkeys: List<HexKey>,
     since: Long?,
 ): List<RelayBasedFilter> {
-    if (pubkey.isNullOrEmpty()) return emptyList()
+    if (pubkeys.isEmpty()) return emptyList()
 
     return listOf(
         RelayBasedFilter(
             relay = relay,
             filter =
-                Filter(
+                ExplainedFilter(
+                    purpose = SubPurpose.ACCOUNT_DATA,
+                    accountPubKeys = pubkeys,
                     kinds = ReportsAndBookmarksFromKeyKinds,
-                    authors = listOf(pubkey),
+                    authors = pubkeys,
                     since = since,
                 ),
         ),

amethyst/src/main/java/com/vitorpamplona/amethyst/service/relayClient/reqCommand/account/metadata/FilterFollowsAndMutesFromKey.kt

@@ -20,10 +20,11 @@
  */
 package com.vitorpamplona.amethyst.service.relayClient.reqCommand.account.metadata
 
+import com.vitorpamplona.amethyst.commons.relayClient.subscriptions.ExplainedFilter
+import com.vitorpamplona.amethyst.commons.relayClient.subscriptions.SubPurpose
 import com.vitorpamplona.quartz.experimental.ephemChat.list.EphemeralChatListEvent
 import com.vitorpamplona.quartz.nip01Core.core.HexKey
 import com.vitorpamplona.quartz.nip01Core.relay.client.pool.RelayBasedFilter
-import com.vitorpamplona.quartz.nip01Core.relay.filters.Filter
 import com.vitorpamplona.quartz.nip01Core.relay.normalizer.NormalizedRelayUrl
 import com.vitorpamplona.quartz.nip28PublicChat.list.ChannelListEvent
 import com.vitorpamplona.quartz.nip30CustomEmoji.selection.EmojiPackSelectionEvent
@@ -47,19 +48,21 @@ val FollowAndMutesFromKeyKinds =
 
 fun filterFollowsAndMutesFromKey(
     relay: NormalizedRelayUrl,
-    pubkey: HexKey,
+    pubkeys: List<HexKey>,
     since: Long?,
 ): List<RelayBasedFilter> {
-    if (pubkey.isEmpty()) return emptyList()
+    if (pubkeys.isEmpty()) return emptyList()
 
     return listOf(
         RelayBasedFilter(
             relay = relay,
             filter =
-                Filter(
+                ExplainedFilter(
+                    purpose = SubPurpose.ACCOUNT_DATA,
+                    accountPubKeys = pubkeys,
                     kinds = FollowAndMutesFromKeyKinds,
-                    authors = listOf(pubkey),
-                    limit = 100,
+                    authors = pubkeys,
+                    limit = 100 * pubkeys.size,
                     since = since,
                 ),
         ),

amethyst/src/main/java/com/vitorpamplona/amethyst/service/relayClient/reqCommand/account/metadata/FilterLastPostsFromKey.kt

@@ -20,25 +20,28 @@
  */
 package com.vitorpamplona.amethyst.service.relayClient.reqCommand.account.metadata
 
+import com.vitorpamplona.amethyst.commons.relayClient.subscriptions.ExplainedFilter
+import com.vitorpamplona.amethyst.commons.relayClient.subscriptions.SubPurpose
 import com.vitorpamplona.quartz.nip01Core.core.HexKey
 import com.vitorpamplona.quartz.nip01Core.relay.client.pool.RelayBasedFilter
-import com.vitorpamplona.quartz.nip01Core.relay.filters.Filter
 import com.vitorpamplona.quartz.nip01Core.relay.normalizer.NormalizedRelayUrl
 
 fun filterLastPostsFromKey(
     relay: NormalizedRelayUrl,
-    pubkey: HexKey,
+    pubkeys: List<HexKey>,
     since: Long?,
 ): List<RelayBasedFilter> {
-    if (pubkey.isEmpty()) return emptyList()
+    if (pubkeys.isEmpty()) return emptyList()
 
     return listOf(
         RelayBasedFilter(
             relay = relay,
             filter =
-                Filter(
-                    authors = listOf(pubkey),
-                    limit = 100,
+                ExplainedFilter(
+                    purpose = SubPurpose.ACCOUNT_DATA,
+                    accountPubKeys = pubkeys,
+                    authors = pubkeys,
+                    limit = 100 * pubkeys.size,
                     since = since,
                 ),
         ),

amethyst/src/main/java/com/vitorpamplona/amethyst/service/relayClient/reqCommand/account/nip01Notifications/AccountNotificationsEoseFromInboxRelaysManager.kt

@@ -20,13 +20,14 @@
  */
 package com.vitorpamplona.amethyst.service.relayClient.reqCommand.account.nip01Notifications
 
+import com.vitorpamplona.amethyst.commons.relayClient.eoseManagers.MergedAuthorTracker
+import com.vitorpamplona.amethyst.commons.relayClient.eoseManagers.SingleSubEoseManager
 import com.vitorpamplona.amethyst.model.User
-import com.vitorpamplona.amethyst.service.relayClient.eoseManagers.PerUserEoseManager
 import com.vitorpamplona.amethyst.service.relayClient.reqCommand.account.AccountQueryState
 import com.vitorpamplona.amethyst.service.relays.SincePerRelayMap
 import com.vitorpamplona.quartz.nip01Core.relay.client.INostrClient
 import com.vitorpamplona.quartz.nip01Core.relay.client.pool.RelayBasedFilter
-import com.vitorpamplona.quartz.nip01Core.relay.client.subscriptions.Subscription
+import com.vitorpamplona.quartz.nip01Core.relay.normalizer.NormalizedRelayUrl
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.FlowPreview
 import kotlinx.coroutines.Job
@@ -34,96 +35,162 @@ import kotlinx.coroutines.flow.collectLatest
 import kotlinx.coroutines.flow.sample
 import kotlinx.coroutines.launch
 
+/**
+ * The live notification tail, for **every** logged-in account, in one subscription.
+ *
+ * Notifications are `#p`-scoped, so a relay that serves several of the user's accounts can be asked
+ * about all of them in one filter naming every pubkey — the query is identical in shape, only wider.
+ * That is what keeps this within a relay's `max_subscriptions`: one REQ per relay instead of one per
+ * (account, relay). With four accounts open, the per-account form pushed strfry relays past their
+ * 20-subscription cap and they answered `ERROR: too many concurrent REQs` — a NOTICE, carrying no
+ * subscription id, so the client could not even tell which REQ had been dropped. Those filters stayed
+ * "live" in our books and silently never delivered.
+ *
+ * Gift wraps deliberately do **not** merge this way. They are unsolicited and their content is opaque
+ * to the relay, so it cannot rate-limit them per recipient; a merged query would let one spammed
+ * account consume the shared `limit` and starve every other account's DMs. Each account keeps its own
+ * budget there — see [com.vitorpamplona.amethyst.service.relayClient.reqCommand.account.nip59GiftWraps.AccountGiftWrapsEoseManager].
+ *
+ * ## The `limit` here is shared, and deliberately not scaled
+ *
+ * [com.vitorpamplona.amethyst.service.relayClient.reqCommand.account.metadata.AccountMetadataEoseManager]
+ * multiplies its limits by the number of merged accounts; this one does not, and the difference is the
+ * kind of event. Metadata is replaceable, so the limit is a safety bound and widening it costs nothing.
+ * Notifications are a stream, so the limit is a page size: scaling it by four accounts would ask four
+ * times the data of every relay on every cold start, and most would clamp it anyway (`max_limit` is 500
+ * on strfry — already below the 2000 the summary filter asks for).
+ *
+ * So on a cold start a busy account can crowd a quiet one out of the shared newest-N. What recovers it
+ * is [AccountNotificationsHistoryEoseManager], which pages backward per account and stays unmerged for
+ * exactly that reason.
+ */
 class AccountNotificationsEoseFromInboxRelaysManager(
     client: INostrClient,
     allKeys: () -> Set<AccountQueryState>,
-) : PerUserEoseManager<AccountQueryState>(client, allKeys) {
-    override fun user(key: AccountQueryState) = key.account.userProfile()
+) : SingleSubEoseManager<AccountQueryState>(client, allKeys) {
+    override fun distinct(key: AccountQueryState) = key.account.userProfile()
 
     /**
-     * Downloads most notifications from the user's own inbox relays.
-     * But also connects to all the follows relays to check for new notifications that are not in the user's
-     * own inbox.
+     * One filter set per inbox relay, naming every account that reads from it.
+     *
+     * The `since` floor is per relay rather than per account, because the merged filter is per relay:
+     * the **oldest** of the participating accounts' floors wins, so widening the query for one account
+     * can never cut another one short.
      */
     override fun updateFilter(
-        key: AccountQueryState,
+        keys: List<AccountQueryState>,
         since: SincePerRelayMap?,
     ): List<RelayBasedFilter> {
-        // Backward-paging boundary: once the feed has filled a page, ask for everything older than
-        // its oldest card. It stays null until then — see the note on the missing week floor below,
-        // which is what let it stay null forever on a quiet inbox.
-        val pagingBoundary = key.feedContentStates.notifications.lastNoteCreatedAtIfFilled()
-
-        val inbox =
-            key.account.notificationRelays.flow.value.flatMap {
-                // No `since` floor on the first fetch. These filters are scoped by `#p` to my own
-                // key and carry a relay-side `limit`, so an all-time query costs one index scan and
-                // returns at most `limit` events, newest first — exactly what Home does (it passes
-                // `since ?: boundary`, i.e. null on a cold start).
-                //
-                // This used to fall back to `oneWeekAgo()`, which silently emptied the tab for
-                // anyone whose last mention was older than a week: EOSE `since` is in-memory only,
-                // so EVERY cold start re-pinned the window to 7 days, and the paging boundary above
-                // could never rescue it — it only arms once the feed holds a full page, and the feed
-                // could not fill because the query only ever asked for a week. A fresh install of an
-                // established account hit the same deadlock.
-                val notificationSince = since?.get(it)?.time ?: pagingBoundary
-
-                filterSummaryNotificationsToPubkey(
-                    relay = it,
-                    pubkey = user(key).pubkeyHex,
-                    since = notificationSince,
-                ) +
-                    filterNotificationsToPubkey(
-                        relay = it,
-                        pubkey = user(key).pubkeyHex,
-                        since = notificationSince,
-                    )
+        val accountsPerRelay = mutableMapOf<NormalizedRelayUrl, MutableList<AccountQueryState>>()
+        keys.forEach { key ->
+            key.account.notificationRelays.flow.value.forEach { relay ->
+                accountsPerRelay.getOrPut(relay) { mutableListOf() }.add(key)
             }
+        }
 
-        // NIP-29 group activity (reactions/replies to my messages) is deliberately NOT requested here.
-        // It lives on the group's host relay and used to be one `#h` filter per relay carrying every
-        // joined group id — but this subscription also carries the inbox filters above, which have no
-        // `#h` at all, and `block/buzz` downgrades any subscription with a channel-less (or multi-
-        // channel) filter to "global", a class that by design never receives channel-scoped events. So
-        // those filters answered the stored query at EOSE and then went deaf until the next launch.
-        //
-        // Group and Buzz-DM activity now rides the per-channel subscriptions that are already scoped to
-        // exactly one channel — RelayGroupJoinedChatTailSubAssembler and BuzzDmJoinedChatTailSubAssembler,
-        // both mounted app-wide from LoggedInPage, so coverage is unchanged and delivery is live.
-        return inbox
+        return accountsPerRelay.flatMap { (relay, accounts) ->
+            val pubkeys = accounts.map { it.account.userProfile().pubkeyHex }
+
+            // An account that joins a relay this subscription already covers would otherwise inherit
+            // the cursor the earlier accounts earned, and never ask for anything older than it. Drop
+            // the stored cursor AND ignore it for this pass — not just the former, which would leave
+            // the refetch depending on `since` being a live view of the map we just mutated.
+            val gained = authorsPerRelay.gainedAuthors(relay, pubkeys)
+            if (gained) clearEoseFor(relay)
+
+            // A cold-start floor, NOT paging — backward paging lives in
+            // [AccountNotificationsHistoryEoseManager]. Read only when a relay has no EOSE yet; once it
+            // does, the EOSE time wins and this is never consulted.
+            //
+            // `since` means *newer than*, so this floors the query at the depth the feed already reaches
+            // rather than asking all-time again. It stays null until the feed holds a full page — and a
+            // background account has no feed at all (no screen ever mounted one), which is why the key
+            // carries none and this reads null there. Null for ANY account on the relay means no floor
+            // at all, since a floor derived from one account's feed would truncate the others'.
+            val floors = accounts.map { it.feedContentStates?.notifications?.lastNoteCreatedAtIfFilled() }
+            val pagingBoundary = if (floors.any { it == null }) null else floors.filterNotNull().min()
+
+            // No `since` floor on the first fetch. These filters are scoped by `#p` to my own
+            // keys and carry a relay-side `limit`, so an all-time query costs one index scan and
+            // returns at most `limit` events, newest first — exactly what Home does (it passes
+            // `since ?: boundary`, i.e. null on a cold start).
+            //
+            // This used to fall back to `oneWeekAgo()`, which silently emptied the tab for
+            // anyone whose last mention was older than a week: EOSE `since` is in-memory only,
+            // so EVERY cold start re-pinned the window to 7 days, and the paging boundary above
+            // could never rescue it — it only arms once the feed holds a full page, and the feed
+            // could not fill because the query only ever asked for a week. A fresh install of an
+            // established account hit the same deadlock.
+            val notificationSince = (if (gained) null else since?.get(relay)?.time) ?: pagingBoundary
+
+            // NIP-29 group activity (reactions/replies to my messages) is deliberately NOT requested
+            // here. It lives on the group's host relay and used to be one `#h` filter per relay carrying
+            // every joined group id — but this subscription also carries the inbox filters below, which
+            // have no `#h` at all, and `block/buzz` downgrades any subscription with a channel-less (or
+            // multi-channel) filter to "global", a class that by design never receives channel-scoped
+            // events. So those filters answered the stored query at EOSE and then went deaf until the
+            // next launch.
+            //
+            // Group and Buzz-DM activity now rides the per-channel subscriptions that are already scoped
+            // to exactly one channel — RelayGroupJoinedChatTailSubAssembler and
+            // BuzzDmJoinedChatTailSubAssembler, both mounted app-wide from LoggedInPage, so coverage is
+            // unchanged and delivery is live.
+            filterSummaryNotificationsToPubkeys(relay = relay, pubkeys = pubkeys, since = notificationSince) +
+                filterNotificationsToPubkeys(relay = relay, pubkeys = pubkeys, since = notificationSince)
+        }
     }
 
-    val userJobMap = mutableMapOf<User, List<Job>>()
+    /**
+     * Per-account watchers, rebuilt as accounts come and go.
+     *
+     * There is only one subscription now, so these cannot hang off a per-key `newSub`. They are keyed
+     * by user and reconciled here: an account that leaves has its jobs cancelled, and one that arrives
+     * gets its own. Re-entrancy is safe — the watchers call `invalidateFilters()`, which lands back
+     * here and finds every account already watched.
+     */
+    private val authorsPerRelay = MergedAuthorTracker()
+
+    private val userJobMap = mutableMapOf<User, List<Job>>()
 
     @OptIn(FlowPreview::class)
-    override fun newSub(key: AccountQueryState): Subscription {
-        val user = user(key)
-        userJobMap[user]?.forEach { it.cancel() }
-        userJobMap[user] =
-            listOf(
-                key.account.scope.launch(Dispatchers.IO) {
-                    key.account.notificationRelays.flow.sample(1000).collectLatest {
-                        invalidateFilters()
-                    }
-                },
-                // No group/Buzz-DM watchers here any more: those filters moved to the per-channel
-                // subscriptions, which mount and unmount with the channel itself.
-                key.account.scope.launch(Dispatchers.IO) {
-                    key.feedContentStates.notifications.lastNoteCreatedAtWhenFullyLoaded.sample(5000).collectLatest {
-                        invalidateFilters()
-                    }
-                },
-            )
+    override fun updateSubscriptions(keys: Set<AccountQueryState>) {
+        val wanted = keys.associateBy { it.account.userProfile() }
 
-        return super.newSub(key)
+        (userJobMap.keys - wanted.keys).toList().forEach { user ->
+            userJobMap.remove(user)?.forEach { it.cancel() }
+        }
+
+        wanted.forEach { (user, key) ->
+            if (user !in userJobMap) {
+                userJobMap[user] =
+                    listOf(
+                        key.account.scope.launch(Dispatchers.IO) {
+                            key.account.notificationRelays.flow.sample(1000).collectLatest {
+                                invalidateFilters()
+                            }
+                        },
+                    ) +
+                    // Only a screen can fill a feed, so there is nothing to watch for a
+                    // background account.
+                    listOfNotNull(
+                        key.feedContentStates?.let { feeds ->
+                            key.account.scope.launch(Dispatchers.IO) {
+                                feeds.notifications.lastNoteCreatedAtWhenFullyLoaded.sample(5000).collectLatest {
+                                    invalidateFilters()
+                                }
+                            }
+                        },
+                    )
+            }
+        }
+
+        super.updateSubscriptions(keys)
     }
 
-    override fun endSub(
-        key: User,
-        subId: String,
-    ) {
-        super.endSub(key, subId)
-        userJobMap[key]?.forEach { it.cancel() }
+    override fun destroy() {
+        authorsPerRelay.clear()
+        userJobMap.values.forEach { jobs -> jobs.forEach { it.cancel() } }
+        userJobMap.clear()
+        super.destroy()
     }
 }

amethyst/src/main/java/com/vitorpamplona/amethyst/service/relayClient/reqCommand/account/nip01Notifications/AccountNotificationsEoseFromRandomRelaysManager.kt

@@ -22,7 +22,7 @@ package com.vitorpamplona.amethyst.service.relayClient.reqCommand.account.nip01N
 
 import com.vitorpamplona.amethyst.model.User
 import com.vitorpamplona.amethyst.service.relayClient.eoseManagers.PerUserEoseManager
-import com.vitorpamplona.amethyst.service.relayClient.reqCommand.account.AccountQueryState
+import com.vitorpamplona.amethyst.service.relayClient.reqCommand.account.AccountUiQueryState
 import com.vitorpamplona.amethyst.service.relays.SincePerRelayMap
 import com.vitorpamplona.quartz.nip01Core.relay.client.INostrClient
 import com.vitorpamplona.quartz.nip01Core.relay.client.pool.RelayBasedFilter
@@ -30,24 +30,38 @@ import com.vitorpamplona.quartz.nip01Core.relay.client.subscriptions.Subscriptio
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.FlowPreview
 import kotlinx.coroutines.Job
+import kotlinx.coroutines.delay
 import kotlinx.coroutines.flow.collectLatest
 import kotlinx.coroutines.flow.debounce
 import kotlinx.coroutines.flow.sample
+import kotlinx.coroutines.isActive
 import kotlinx.coroutines.launch
 
 class AccountNotificationsEoseFromRandomRelaysManager(
     client: INostrClient,
-    allKeys: () -> Set<AccountQueryState>,
-) : PerUserEoseManager<AccountQueryState>(client, allKeys) {
-    override fun user(key: AccountQueryState) = key.account.userProfile()
+    allKeys: () -> Set<AccountUiQueryState>,
+) : PerUserEoseManager<AccountUiQueryState>(client, allKeys) {
+    override fun user(key: AccountUiQueryState) = key.account.userProfile()
 
     /**
-     * Downloads most notifications from the user's own inbox relays.
-     * But also connects to all the follows relays to check for new notifications that are not in the user's
-     * own inbox.
+     * Most notifications arrive on the user's own inbox relays. This is the straggler probe for the
+     * rest: other clients sometimes deliver a mention to the author's own relays instead of the
+     * recipient's inbox, so those only ever turn up if we go and look.
+     *
+     * It looks at a **rotating window of [RELAYS_PER_PASS] relays**, not at every relay the follows
+     * post to. The whole set was ~330 relays on a normal account, and subscribing to all of them
+     * held roughly 670 filters permanently — by a wide margin the largest thing the client ran, for
+     * a job that only needs to sweep the space eventually, not watch all of it at once. The window
+     * slides every [PASS_DURATION_MS], so every relay is still visited, just never all at the same
+     * time.
+     *
+     * The window is a contiguous slice of a URL-sorted list rather than a random draw: a fresh
+     * random pick on each invalidation would re-REQ a different set every few seconds, which costs
+     * more than the subscriptions it replaced. Deterministic order means the window only moves when
+     * the rotation timer says so.
      */
     override fun updateFilter(
-        key: AccountQueryState,
+        key: AccountUiQueryState,
         since: SincePerRelayMap?,
     ): List<RelayBasedFilter> {
         // only loads this after the feed is built, so it stays null on a quiet inbox. No week floor
@@ -55,16 +69,30 @@ class AccountNotificationsEoseFromRandomRelaysManager(
         // newest either way — the floor only ever hid notifications older than a week, and since the
         // boundary above needs a full page to arm, a quiet inbox could never page past it.
         val defaultSince = key.feedContentStates.notifications.lastNoteCreatedAtIfFilled()
-        return (key.account.followsPerRelay.value.keys - key.account.notificationRelays.flow.value).flatMap {
+        val candidates =
+            (key.account.followsPerRelay.value.keys - key.account.notificationRelays.flow.value)
+                .sortedBy { it.url }
+        if (candidates.isEmpty()) return emptyList()
+
+        val start = (passIndex * RELAYS_PER_PASS).mod(candidates.size)
+        val window = List(minOf(RELAYS_PER_PASS, candidates.size)) { candidates[(start + it).mod(candidates.size)] }
+
+        return window.flatMap {
             val since = since?.get(it)?.time ?: defaultSince
             filterJustTheLatestNotificationsToPubkeyFromRandomRelays(it, user(key).pubkeyHex, since)
         }
     }
 
+    /**
+     * Which slice of the sorted relay list the current pass is on. Bumped by the rotation job below;
+     * `mod` at the read site keeps it valid however far it runs.
+     */
+    @Volatile private var passIndex = 0
+
     val userJobMap = mutableMapOf<User, List<Job>>()
 
     @OptIn(FlowPreview::class)
-    override fun newSub(key: AccountQueryState): Subscription {
+    override fun newSub(key: AccountUiQueryState): Subscription {
         val user = user(key)
         userJobMap[user]?.forEach { it.cancel() }
         userJobMap[user] =
@@ -80,6 +108,14 @@ class AccountNotificationsEoseFromRandomRelaysManager(
                         invalidateFilters()
                     }
                 },
+                // Slides the window. Cancelled with the others in endSub, so it stops with the account.
+                key.account.scope.launch(Dispatchers.IO) {
+                    while (isActive) {
+                        delay(PASS_DURATION_MS)
+                        passIndex++
+                        invalidateFilters()
+                    }
+                },
             )
 
         return super.newSub(key)
@@ -92,4 +128,15 @@ class AccountNotificationsEoseFromRandomRelaysManager(
         super.endSub(key, subId)
         userJobMap[key]?.forEach { it.cancel() }
     }
+
+    companion object {
+        /**
+         * Relays watched per pass. Small on purpose: this is a background sweep for misdelivered
+         * mentions, and the inbox relays carry the real traffic.
+         */
+        const val RELAYS_PER_PASS = 5
+
+        /** How long a window stays put before sliding. Long enough that re-REQ churn stays negligible. */
+        const val PASS_DURATION_MS = 5 * 60 * 1000L
+    }
 }

amethyst/src/main/java/com/vitorpamplona/amethyst/service/relayClient/reqCommand/account/nip01Notifications/FilterNotificationsToPubkey.kt

@@ -22,6 +22,8 @@
 
 package com.vitorpamplona.amethyst.service.relayClient.reqCommand.account.nip01Notifications
 
+import com.vitorpamplona.amethyst.commons.relayClient.subscriptions.ExplainedFilter
+import com.vitorpamplona.amethyst.commons.relayClient.subscriptions.SubPurpose
 import com.vitorpamplona.quartz.experimental.attestations.recommendation.AttestorRecommendationEvent
 import com.vitorpamplona.quartz.experimental.attestations.request.AttestationRequestEvent
 import com.vitorpamplona.quartz.experimental.ephemChat.chat.EphemeralChatEvent
@@ -30,7 +32,6 @@ import com.vitorpamplona.quartz.experimental.interactiveStories.InteractiveStory
 import com.vitorpamplona.quartz.experimental.zapPolls.ZapPollEvent
 import com.vitorpamplona.quartz.nip01Core.core.HexKey
 import com.vitorpamplona.quartz.nip01Core.relay.client.pool.RelayBasedFilter
-import com.vitorpamplona.quartz.nip01Core.relay.filters.Filter
 import com.vitorpamplona.quartz.nip01Core.relay.normalizer.NormalizedRelayUrl
 import com.vitorpamplona.quartz.nip10Notes.TextNoteEvent
 import com.vitorpamplona.quartz.nip18Reposts.GenericRepostEvent
@@ -154,7 +155,9 @@ fun filterNotificationsHistoryToPubkey(
         RelayBasedFilter(
             relay = relay,
             filter =
-                Filter(
+                ExplainedFilter(
+                    purpose = SubPurpose.NOTIFICATIONS,
+                    accountPubKeys = listOfNotNull(pubkey),
                     kinds = AllNotificationKinds,
                     tags = mapOf("p" to listOf(pubkey)),
                     limit = limit,
@@ -181,7 +184,9 @@ fun filterGroupNotificationsHistoryToPubkey(
         RelayBasedFilter(
             relay = relay,
             filter =
-                Filter(
+                ExplainedFilter(
+                    purpose = SubPurpose.NOTIFICATIONS,
+                    accountPubKeys = listOfNotNull(pubkey),
                     kinds = GroupNotificationKinds,
                     tags = mapOf("p" to listOf(pubkey), "h" to groupIds),
                     limit = limit,
@@ -191,20 +196,22 @@ fun filterGroupNotificationsHistoryToPubkey(
     )
 }
 
-fun filterSummaryNotificationsToPubkey(
+fun filterSummaryNotificationsToPubkeys(
     relay: NormalizedRelayUrl,
-    pubkey: HexKey?,
+    pubkeys: List<HexKey>,
     since: Long?,
 ): List<RelayBasedFilter> {
-    if (pubkey.isNullOrEmpty()) return emptyList()
+    if (pubkeys.isEmpty()) return emptyList()
 
     return listOf(
         RelayBasedFilter(
             relay = relay,
             filter =
-                Filter(
+                ExplainedFilter(
+                    purpose = SubPurpose.NOTIFICATIONS,
+                    accountPubKeys = pubkeys,
                     kinds = SummaryKinds,
-                    tags = mapOf("p" to listOf(pubkey)),
+                    tags = mapOf("p" to pubkeys),
                     limit = 2000,
                     since = since,
                 ),
@@ -212,20 +219,22 @@ fun filterSummaryNotificationsToPubkey(
     )
 }
 
-fun filterNotificationsToPubkey(
+fun filterNotificationsToPubkeys(
     relay: NormalizedRelayUrl,
-    pubkey: HexKey?,
+    pubkeys: List<HexKey>,
     since: Long?,
 ): List<RelayBasedFilter> {
-    if (pubkey.isNullOrEmpty()) return emptyList()
+    if (pubkeys.isEmpty()) return emptyList()
 
     return listOf(
         RelayBasedFilter(
             relay = relay,
             filter =
-                Filter(
+                ExplainedFilter(
+                    purpose = SubPurpose.NOTIFICATIONS,
+                    accountPubKeys = pubkeys,
                     kinds = NotificationsPerKeyKinds,
-                    tags = mapOf("p" to listOf(pubkey)),
+                    tags = mapOf("p" to pubkeys),
                     limit = 500,
                     since = since,
                 ),
@@ -233,9 +242,11 @@ fun filterNotificationsToPubkey(
         RelayBasedFilter(
             relay = relay,
             filter =
-                Filter(
+                ExplainedFilter(
+                    purpose = SubPurpose.NOTIFICATIONS,
+                    accountPubKeys = pubkeys,
                     kinds = NotificationsPerKeyKinds2,
-                    tags = mapOf("p" to listOf(pubkey)),
+                    tags = mapOf("p" to pubkeys),
                     limit = 200,
                     since = since,
                 ),
@@ -243,9 +254,11 @@ fun filterNotificationsToPubkey(
         RelayBasedFilter(
             relay = relay,
             filter =
-                Filter(
+                ExplainedFilter(
+                    purpose = SubPurpose.NOTIFICATIONS,
+                    accountPubKeys = pubkeys,
                     kinds = NotificationsPerKeyKinds3,
-                    tags = mapOf("p" to listOf(pubkey)),
+                    tags = mapOf("p" to pubkeys),
                     limit = 10,
                     since = since,
                 ),
@@ -271,7 +284,9 @@ fun filterGroupNotificationsToPubkey(
         RelayBasedFilter(
             relay = relay,
             filter =
-                Filter(
+                ExplainedFilter(
+                    purpose = SubPurpose.NOTIFICATIONS,
+                    accountPubKeys = listOfNotNull(pubkey),
                     kinds = GroupNotificationKinds,
                     tags = mapOf("p" to listOf(pubkey), "h" to groupIds),
                     limit = 200,
@@ -292,7 +307,9 @@ fun filterJustTheLatestNotificationsToPubkeyFromRandomRelays(
         RelayBasedFilter(
             relay = relay,
             filter =
-                Filter(
+                ExplainedFilter(
+                    purpose = SubPurpose.NOTIFICATIONS,
+                    accountPubKeys = listOfNotNull(pubkey),
                     kinds = SummaryKinds,
                     tags = mapOf("p" to listOf(pubkey)),
                     limit = 20,
@@ -302,7 +319,9 @@ fun filterJustTheLatestNotificationsToPubkeyFromRandomRelays(
         RelayBasedFilter(
             relay = relay,
             filter =
-                Filter(
+                ExplainedFilter(
+                    purpose = SubPurpose.NOTIFICATIONS,
+                    accountPubKeys = listOfNotNull(pubkey),
                     kinds = NotificationsPerKeyKinds,
                     tags = mapOf("p" to listOf(pubkey)),
                     limit = 20,
@@ -312,7 +331,9 @@ fun filterJustTheLatestNotificationsToPubkeyFromRandomRelays(
         RelayBasedFilter(
             relay = relay,
             filter =
-                Filter(
+                ExplainedFilter(
+                    purpose = SubPurpose.NOTIFICATIONS,
+                    accountPubKeys = listOfNotNull(pubkey),
                     kinds = NotificationsPerKeyKinds2,
                     tags = mapOf("p" to listOf(pubkey)),
                     limit = 10,
@@ -322,7 +343,9 @@ fun filterJustTheLatestNotificationsToPubkeyFromRandomRelays(
         RelayBasedFilter(
             relay = relay,
             filter =
-                Filter(
+                ExplainedFilter(
+                    purpose = SubPurpose.NOTIFICATIONS,
+                    accountPubKeys = listOfNotNull(pubkey),
                     kinds = NotificationsPerKeyKinds3,
                     tags = mapOf("p" to listOf(pubkey)),
                     limit = 2,

amethyst/src/main/java/com/vitorpamplona/amethyst/service/relayClient/reqCommand/account/nip47WalletConnect/NwcNotificationsEoseManager.kt

@@ -20,6 +20,8 @@
  */
 package com.vitorpamplona.amethyst.service.relayClient.reqCommand.account.nip47WalletConnect
 
+import com.vitorpamplona.amethyst.commons.relayClient.subscriptions.ExplainedFilter
+import com.vitorpamplona.amethyst.commons.relayClient.subscriptions.SubPurpose
 import com.vitorpamplona.amethyst.model.User
 import com.vitorpamplona.amethyst.service.relayClient.eoseManagers.PerUserEoseManager
 import com.vitorpamplona.amethyst.service.relayClient.reqCommand.account.AccountQueryState
@@ -87,7 +89,8 @@ class NwcNotificationsEoseManager(
                 RelayBasedFilter(
                     relay = wallet.uri.relayUri,
                     filter =
-                        Filter(
+                        ExplainedFilter(
+                            purpose = SubPurpose.NWC,
                             kinds = listOf(NwcNotificationEvent.KIND, NwcNotificationEvent.LEGACY_KIND),
                             authors = listOf(wallet.uri.pubKeyHex),
                             tags = mapOf("p" to listOf(signer.pubKey)),

amethyst/src/main/java/com/vitorpamplona/amethyst/service/relayClient/reqCommand/account/nip60Cashu/CashuWalletEoseManager.kt

@@ -0,0 +1,124 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.service.relayClient.reqCommand.account.nip60Cashu
+
+import com.vitorpamplona.amethyst.commons.relayClient.assemblers.CashuWalletQueryState
+import com.vitorpamplona.amethyst.commons.relayClient.assemblers.cashuWalletFilters
+import com.vitorpamplona.amethyst.model.User
+import com.vitorpamplona.amethyst.service.relayClient.eoseManagers.PerUserEoseManager
+import com.vitorpamplona.amethyst.service.relayClient.reqCommand.account.AccountQueryState
+import com.vitorpamplona.amethyst.service.relays.SincePerRelayMap
+import com.vitorpamplona.quartz.nip01Core.relay.client.INostrClient
+import com.vitorpamplona.quartz.nip01Core.relay.client.pool.RelayBasedFilter
+import com.vitorpamplona.quartz.nip01Core.relay.client.subscriptions.Subscription
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.FlowPreview
+import kotlinx.coroutines.Job
+import kotlinx.coroutines.flow.collectLatest
+import kotlinx.coroutines.flow.sample
+import kotlinx.coroutines.launch
+
+/**
+ * The account's NIP-60 wallet and NIP-61 nutzap inbox.
+ *
+ * This used to run from a collector inside `CashuWalletState`, on the account's own scope, which made
+ * the wallet the only account-level subscription whose lifetime was decided by the model rather than
+ * by a mount. It ran for every [com.vitorpamplona.amethyst.model.Account] object that happened to be
+ * resident — including accounts loaded purely so pushed gift wraps could be decrypted, which have no
+ * wallet anyone is looking at — and the attempt to fix that bolted a "is this pubkey subscribed
+ * anywhere" flow onto the model, so a model object was reading the relay layer's bookkeeping to
+ * decide whether to talk to relays.
+ *
+ * As a manager in [com.vitorpamplona.amethyst.service.relayClient.reqCommand.account.AccountFilterAssembler]'s
+ * group it starts and stops with every other account-level loader: the screen's mount for the account
+ * on show, the registry for the rest, and whatever the foreground/background rule becomes without this
+ * having to know about it. Exactly how NWC already worked.
+ *
+ * Per user, never merged: each account's wallet reads its own outbox for its own events and its own
+ * inbox for nutzaps addressed to it, so there is no shared query to fold them into.
+ */
+class CashuWalletEoseManager(
+    client: INostrClient,
+    allKeys: () -> Set<AccountQueryState>,
+) : PerUserEoseManager<AccountQueryState>(client, allKeys) {
+    override fun user(key: AccountQueryState) = key.account.userProfile()
+
+    override fun updateFilter(
+        key: AccountQueryState,
+        since: SincePerRelayMap?,
+    ): List<RelayBasedFilter> {
+        val account = key.account
+        val wallet = account.cashuWalletState
+
+        // NIP-65 outbox for our own wallet events; inbox + DM relays plus whatever our own kind:10019
+        // advertises for inbound nutzaps, since another client may have published that with relays
+        // unrelated to our NIP-65 lists.
+        return cashuWalletFilters(
+            CashuWalletQueryState(
+                pubkey = account.userProfile().pubkeyHex,
+                ownEventRelays = account.outboxRelays.flow.value,
+                inboxRelays =
+                    account.notificationRelays.flow.value +
+                        account.dmRelays.flow.value +
+                        (wallet.nutzapInfoEvent.value?.relays() ?: emptyList()),
+            ),
+            since,
+        )
+    }
+
+    private val userJobMap = mutableMapOf<User, List<Job>>()
+
+    @OptIn(FlowPreview::class)
+    override fun newSub(key: AccountQueryState): Subscription {
+        val user = user(key)
+        userJobMap[user]?.forEach { it.cancel() }
+
+        // The relay sets and the nutzap-info event all move the query, so each one re-invalidates.
+        // Sampled because a relay-list edit can land as a burst of list events.
+        userJobMap[user] =
+            listOf(
+                key.account.outboxRelays.flow,
+                key.account.notificationRelays.flow,
+                key.account.dmRelays.flow,
+            ).map { flow ->
+                key.account.scope.launch(Dispatchers.IO) {
+                    flow.sample(1000).collectLatest { invalidateFilters() }
+                }
+            } +
+            listOf(
+                key.account.scope.launch(Dispatchers.IO) {
+                    key.account.cashuWalletState.nutzapInfoEvent
+                        .sample(1000)
+                        .collectLatest { invalidateFilters() }
+                },
+            )
+
+        return super.newSub(key)
+    }
+
+    override fun endSub(
+        key: User,
+        subId: String,
+    ) {
+        super.endSub(key, subId)
+        userJobMap.remove(key)?.forEach { it.cancel() }
+    }
+}

amethyst/src/main/java/com/vitorpamplona/amethyst/service/relayClient/reqCommand/channel/ChannelFinderFilterAssemblyGroup.kt

@@ -24,6 +24,7 @@ import androidx.compose.runtime.Stable
 import com.vitorpamplona.amethyst.commons.model.Channel
 import com.vitorpamplona.amethyst.commons.relayClient.composeSubscriptionManagers.ComposeSubscriptionManager
 import com.vitorpamplona.amethyst.model.Account
+import com.vitorpamplona.amethyst.service.relayClient.AccountScopedQuery
 import com.vitorpamplona.amethyst.service.relayClient.reqCommand.channel.mixChatsLive.ChannelMetadataAndLiveActivityWatcherSubAssembler
 import com.vitorpamplona.amethyst.service.relayClient.reqCommand.channel.nip28PublicChats.ChannelLoaderSubAssembler
 import com.vitorpamplona.quartz.nip01Core.relay.client.INostrClient
@@ -32,8 +33,8 @@ import com.vitorpamplona.quartz.nip01Core.relay.client.INostrClient
 @Stable
 class ChannelFinderQueryState(
     val channel: Channel,
-    val account: Account,
-)
+    override val account: Account,
+) : AccountScopedQuery
 
 @Stable
 class ChannelFinderFilterAssemblyGroup(

amethyst/src/main/java/com/vitorpamplona/amethyst/service/relayClient/reqCommand/channel/nip28PublicChats/FilterChannelMetadataCreationById.kt

@@ -23,9 +23,10 @@ package com.vitorpamplona.amethyst.service.relayClient.reqCommand.channel.nip28P
 import com.vitorpamplona.amethyst.commons.defaults.DefaultIndexerRelayList
 import com.vitorpamplona.amethyst.commons.defaults.DefaultSearchRelayList
 import com.vitorpamplona.amethyst.commons.model.nip28PublicChats.PublicChatChannel
+import com.vitorpamplona.amethyst.commons.relayClient.subscriptions.ExplainedFilter
+import com.vitorpamplona.amethyst.commons.relayClient.subscriptions.SubPurpose
 import com.vitorpamplona.amethyst.service.relayClient.reqCommand.channel.ChannelFinderQueryState
 import com.vitorpamplona.quartz.nip01Core.relay.client.pool.RelayBasedFilter
-import com.vitorpamplona.quartz.nip01Core.relay.filters.Filter
 import com.vitorpamplona.quartz.nip28PublicChat.admin.ChannelCreateEvent
 import com.vitorpamplona.quartz.utils.mapOfSet
 
@@ -54,7 +55,9 @@ fun filterMissingChannelsById(keys: List<ChannelFinderQueryState>): List<RelayBa
         RelayBasedFilter(
             relay = relay,
             filter =
-                Filter(
+                ExplainedFilter(
+                    purpose = SubPurpose.PUBLIC_CHATS,
+                    entityIds = channelIds.sorted(),
                     kinds = filterMissingPublicChannelsByIdKinds,
                     ids = channelIds.sorted(),
                 ),

amethyst/src/main/java/com/vitorpamplona/amethyst/service/relayClient/reqCommand/channel/nip28PublicChats/FilterChannelMetadataUpdatesById.kt

@@ -21,8 +21,9 @@
 package com.vitorpamplona.amethyst.service.relayClient.reqCommand.channel.nip28PublicChats
 
 import com.vitorpamplona.amethyst.commons.model.nip28PublicChats.PublicChatChannel
+import com.vitorpamplona.amethyst.commons.relayClient.subscriptions.ExplainedFilter
+import com.vitorpamplona.amethyst.commons.relayClient.subscriptions.SubPurpose
 import com.vitorpamplona.quartz.nip01Core.relay.client.pool.RelayBasedFilter
-import com.vitorpamplona.quartz.nip01Core.relay.filters.Filter
 import com.vitorpamplona.quartz.nip01Core.relay.normalizer.NormalizedRelayUrl
 import com.vitorpamplona.quartz.nip28PublicChat.admin.ChannelMetadataEvent
 
@@ -37,7 +38,9 @@ fun filterChannelMetadataUpdatesById(
         RelayBasedFilter(
             relay = relay,
             filter =
-                Filter(
+                ExplainedFilter(
+                    purpose = SubPurpose.PUBLIC_CHATS,
+                    entityIds = channels.map { it.idHex }.sorted(),
                     kinds = channelMetadataKinds,
                     tags = mapOf("e" to channels.map { it.idHex }),
                     since = since,

amethyst/src/main/java/com/vitorpamplona/amethyst/service/relayClient/reqCommand/channel/nip53LiveActivities/FilterLiveStreamUpdatesByAddress.kt

@@ -21,8 +21,9 @@
 package com.vitorpamplona.amethyst.service.relayClient.reqCommand.channel.nip53LiveActivities
 
 import com.vitorpamplona.amethyst.commons.model.nip53LiveActivities.LiveActivitiesChannel
+import com.vitorpamplona.amethyst.commons.relayClient.subscriptions.ExplainedFilter
+import com.vitorpamplona.amethyst.commons.relayClient.subscriptions.SubPurpose
 import com.vitorpamplona.quartz.nip01Core.relay.client.pool.RelayBasedFilter
-import com.vitorpamplona.quartz.nip01Core.relay.filters.Filter
 import com.vitorpamplona.quartz.nip01Core.relay.normalizer.NormalizedRelayUrl
 import com.vitorpamplona.quartz.nip53LiveActivities.streaming.LiveActivitiesEvent
 
@@ -36,7 +37,8 @@ fun filterLiveStreamUpdatesByAddress(
         RelayBasedFilter(
             relay = relay,
             filter =
-                Filter(
+                ExplainedFilter(
+                    purpose = SubPurpose.LIVE_ROOMS,
                     kinds = listOf(LiveActivitiesEvent.KIND),
                     tags = mapOf("d" to channels.map { it.address.dTag }),
                     authors = channels.map { it.address.pubKeyHex },

amethyst/src/main/java/com/vitorpamplona/amethyst/service/relayClient/reqCommand/event/EventFinderFilterAssembler.kt

@@ -25,6 +25,7 @@ import com.vitorpamplona.amethyst.commons.relayClient.composeSubscriptionManager
 import com.vitorpamplona.amethyst.model.Account
 import com.vitorpamplona.amethyst.model.LocalCache
 import com.vitorpamplona.amethyst.model.Note
+import com.vitorpamplona.amethyst.service.relayClient.AccountScopedQuery
 import com.vitorpamplona.amethyst.service.relayClient.reqCommand.event.loaders.AddressableAuthorRelayLoaderSubAssembler
 import com.vitorpamplona.amethyst.service.relayClient.reqCommand.event.loaders.NoteEventLoaderSubAssembler
 import com.vitorpamplona.amethyst.service.relayClient.reqCommand.event.watchers.EventWatcherSubAssembler
@@ -35,8 +36,8 @@ import com.vitorpamplona.quartz.nip01Core.relay.client.INostrClient
 @Stable
 class EventFinderQueryState(
     val note: Note,
-    val account: Account,
-)
+    override val account: Account,
+) : AccountScopedQuery
 
 @Stable
 class EventFinderFilterAssembler(

amethyst/src/main/java/com/vitorpamplona/amethyst/service/relayClient/reqCommand/event/loaders/FilterMissingAddressables.kt

@@ -20,12 +20,13 @@
  */
 package com.vitorpamplona.amethyst.service.relayClient.reqCommand.event.loaders
 
+import com.vitorpamplona.amethyst.commons.relayClient.subscriptions.ExplainedFilter
+import com.vitorpamplona.amethyst.commons.relayClient.subscriptions.SubPurpose
 import com.vitorpamplona.amethyst.model.AddressableNote
 import com.vitorpamplona.amethyst.model.LocalCache
 import com.vitorpamplona.amethyst.service.relayClient.reqCommand.event.EventFinderQueryState
 import com.vitorpamplona.quartz.nip01Core.core.Address
 import com.vitorpamplona.quartz.nip01Core.relay.client.pool.RelayBasedFilter
-import com.vitorpamplona.quartz.nip01Core.relay.filters.Filter
 import com.vitorpamplona.quartz.nip01Core.relay.normalizer.NormalizedRelayUrl
 import com.vitorpamplona.quartz.utils.mapOfSet
 
@@ -105,7 +106,8 @@ fun filterMissingAddressables(missingAddressables: Map<NormalizedRelayUrl, Set<A
                 RelayBasedFilter(
                     relay = relayEntry.key,
                     filter =
-                        Filter(
+                        ExplainedFilter(
+                            purpose = SubPurpose.REFERENCED_EVENTS,
                             kinds = listOf(address.kind),
                             authors = listOf(address.pubKeyHex),
                             limit = 1,
@@ -115,7 +117,8 @@ fun filterMissingAddressables(missingAddressables: Map<NormalizedRelayUrl, Set<A
                 RelayBasedFilter(
                     relay = relayEntry.key,
                     filter =
-                        Filter(
+                        ExplainedFilter(
+                            purpose = SubPurpose.REFERENCED_EVENTS,
                             kinds = listOf(address.kind),
                             tags = mapOf("d" to listOf(address.dTag)),
                             authors = listOf(address.pubKeyHex),

amethyst/src/main/java/com/vitorpamplona/amethyst/service/relayClient/reqCommand/event/loaders/FilterMissingEvents.kt

@@ -21,13 +21,14 @@
 package com.vitorpamplona.amethyst.service.relayClient.reqCommand.event.loaders
 
 import com.vitorpamplona.amethyst.commons.model.Channel
+import com.vitorpamplona.amethyst.commons.relayClient.subscriptions.ExplainedFilter
+import com.vitorpamplona.amethyst.commons.relayClient.subscriptions.SubPurpose
 import com.vitorpamplona.amethyst.model.AddressableNote
 import com.vitorpamplona.amethyst.model.LocalCache
 import com.vitorpamplona.amethyst.model.Note
 import com.vitorpamplona.amethyst.service.relayClient.reqCommand.event.EventFinderQueryState
 import com.vitorpamplona.quartz.nip01Core.hints.PubKeyHintProvider
 import com.vitorpamplona.quartz.nip01Core.relay.client.pool.RelayBasedFilter
-import com.vitorpamplona.quartz.nip01Core.relay.filters.Filter
 import com.vitorpamplona.quartz.nip01Core.relay.normalizer.NormalizedRelayUrl
 import com.vitorpamplona.quartz.utils.mapOfSet
 
@@ -134,7 +135,7 @@ fun filterMissingEvents(missingEventIds: Map<NormalizedRelayUrl, Set<String>>):
         if (it.value.isNotEmpty()) {
             RelayBasedFilter(
                 relay = it.key,
-                filter = Filter(ids = it.value.sorted()),
+                filter = ExplainedFilter(purpose = SubPurpose.REFERENCED_EVENTS, ids = it.value.sorted()),
             )
         } else {
             null

amethyst/src/main/java/com/vitorpamplona/amethyst/service/relayClient/reqCommand/event/watchers/EventWatcherSubAssembler.kt

@@ -60,6 +60,16 @@ class EventWatcherSubAssembler(
 
         lastNotesOnFilter = keys.map { it.note }
 
+        // Attributed only when one account is watching. The notes here are whatever is rendered, not
+        // anything an account owns, so with several accounts active no single one is the honest owner —
+        // and splitting would re-request the same replies/zaps once per account.
+        // Deduped by pubkey, not by `Account`: that class uses identity equality, so two objects for
+        // the same logged-in user would look like two accounts and suppress attribution entirely.
+        val soleAccountPubKey =
+            keys
+                .mapTo(mutableSetOf()) { it.account.userProfile().pubkeyHex }
+                .singleOrNull()
+
         return groupByRelayPresence(lastNotesOnFilter, latestEOSEs)
             .map { group ->
                 if (group.isNotEmpty()) {
@@ -67,8 +77,8 @@ class EventWatcherSubAssembler(
                     val events = group.mapNotNull { if (it !is AddressableNote) it else null }
 
                     listOfNotNull(
-                        filterRepliesAndReactionsToNotes(events, findMinimumEOSEs(events, latestEOSEs)),
-                        filterRepliesAndReactionsToAddresses(addressables, findMinimumEOSEs(addressables, latestEOSEs)),
+                        filterRepliesAndReactionsToNotes(events, findMinimumEOSEs(events, latestEOSEs), soleAccountPubKey),
+                        filterRepliesAndReactionsToAddresses(addressables, findMinimumEOSEs(addressables, latestEOSEs), soleAccountPubKey),
                     ).flatten()
                 } else {
                     emptyList()

amethyst/src/main/java/com/vitorpamplona/amethyst/service/relayClient/reqCommand/event/watchers/FilterRepliesAndReactionsToAddresses.kt

@@ -20,12 +20,14 @@
  */
 package com.vitorpamplona.amethyst.service.relayClient.reqCommand.event.watchers
 
+import com.vitorpamplona.amethyst.commons.relayClient.subscriptions.ExplainedFilter
+import com.vitorpamplona.amethyst.commons.relayClient.subscriptions.SubPurpose
 import com.vitorpamplona.amethyst.model.AddressableNote
 import com.vitorpamplona.amethyst.service.relays.SincePerRelayMap
 import com.vitorpamplona.quartz.experimental.attestations.attestation.AttestationEvent
 import com.vitorpamplona.quartz.experimental.zapPolls.ZapPollEvent
+import com.vitorpamplona.quartz.nip01Core.core.HexKey
 import com.vitorpamplona.quartz.nip01Core.relay.client.pool.RelayBasedFilter
-import com.vitorpamplona.quartz.nip01Core.relay.filters.Filter
 import com.vitorpamplona.quartz.nip09Deletions.DeletionEvent
 import com.vitorpamplona.quartz.nip10Notes.TextNoteEvent
 import com.vitorpamplona.quartz.nip18Reposts.GenericRepostEvent
@@ -71,6 +73,7 @@ val TextNoteKindList = listOf(TextNoteEvent.KIND)
 fun filterRepliesAndReactionsToAddresses(
     keys: List<AddressableNote>,
     since: SincePerRelayMap?,
+    accountPubKey: HexKey? = null,
 ): List<RelayBasedFilter>? {
     if (keys.isEmpty()) return null
 
@@ -91,7 +94,9 @@ fun filterRepliesAndReactionsToAddresses(
             RelayBasedFilter(
                 relay = relay,
                 filter =
-                    Filter(
+                    ExplainedFilter(
+                        purpose = SubPurpose.ENGAGEMENT,
+                        accountPubKeys = listOfNotNull(accountPubKey),
                         kinds = RepliesAndReactionsToAddressesKinds1,
                         tags = mapOf("a" to sortedList),
                         since = since,
@@ -102,7 +107,9 @@ fun filterRepliesAndReactionsToAddresses(
             RelayBasedFilter(
                 relay = relay,
                 filter =
-                    Filter(
+                    ExplainedFilter(
+                        purpose = SubPurpose.ENGAGEMENT,
+                        accountPubKeys = listOfNotNull(accountPubKey),
                         kinds = PostsAndChatMessagesToAddresses,
                         tags = mapOf("a" to sortedList),
                         since = since,
@@ -113,7 +120,9 @@ fun filterRepliesAndReactionsToAddresses(
             RelayBasedFilter(
                 relay = relay,
                 filter =
-                    Filter(
+                    ExplainedFilter(
+                        purpose = SubPurpose.ENGAGEMENT,
+                        accountPubKeys = listOfNotNull(accountPubKey),
                         kinds = DeletionKindList,
                         tags = mapOf("a" to sortedList),
                         since = since,
@@ -124,7 +133,9 @@ fun filterRepliesAndReactionsToAddresses(
             RelayBasedFilter(
                 relay = relay,
                 filter =
-                    Filter(
+                    ExplainedFilter(
+                        purpose = SubPurpose.ENGAGEMENT,
+                        accountPubKeys = listOfNotNull(accountPubKey),
                         kinds = TextNoteKindList,
                         tags = mapOf("q" to sortedList),
                         since = since,

amethyst/src/main/java/com/vitorpamplona/amethyst/service/relayClient/reqCommand/event/watchers/FilterRepliesAndReactionsToNotes.kt

@@ -22,13 +22,15 @@
 
 package com.vitorpamplona.amethyst.service.relayClient.reqCommand.event.watchers
 
+import com.vitorpamplona.amethyst.commons.relayClient.subscriptions.ExplainedFilter
+import com.vitorpamplona.amethyst.commons.relayClient.subscriptions.SubPurpose
 import com.vitorpamplona.amethyst.model.Note
 import com.vitorpamplona.amethyst.service.relays.SincePerRelayMap
 import com.vitorpamplona.quartz.experimental.attestations.attestation.AttestationEvent
 import com.vitorpamplona.quartz.experimental.edits.TextNoteModificationEvent
 import com.vitorpamplona.quartz.experimental.zapPolls.ZapPollEvent
+import com.vitorpamplona.quartz.nip01Core.core.HexKey
 import com.vitorpamplona.quartz.nip01Core.relay.client.pool.RelayBasedFilter
-import com.vitorpamplona.quartz.nip01Core.relay.filters.Filter
 import com.vitorpamplona.quartz.nip03Timestamp.OtsEvent
 import com.vitorpamplona.quartz.nip09Deletions.DeletionEvent
 import com.vitorpamplona.quartz.nip10Notes.TextNoteEvent
@@ -77,6 +79,7 @@ val RepliesAndReactionsKinds2 =
 fun filterRepliesAndReactionsToNotes(
     events: List<Note>,
     since: SincePerRelayMap?,
+    accountPubKey: HexKey? = null,
 ): List<RelayBasedFilter>? {
     if (events.isEmpty()) return null
 
@@ -98,7 +101,9 @@ fun filterRepliesAndReactionsToNotes(
                 RelayBasedFilter(
                     relay = relay,
                     filter =
-                        Filter(
+                        ExplainedFilter(
+                            purpose = SubPurpose.ENGAGEMENT,
+                            accountPubKeys = listOfNotNull(accountPubKey),
                             kinds = RepliesAndReactionsKinds,
                             tags = mapOf("e" to sortedList),
                             since = since,
@@ -109,7 +114,9 @@ fun filterRepliesAndReactionsToNotes(
                 RelayBasedFilter(
                     relay = relay,
                     filter =
-                        Filter(
+                        ExplainedFilter(
+                            purpose = SubPurpose.ENGAGEMENT,
+                            accountPubKeys = listOfNotNull(accountPubKey),
                             kinds = RepliesAndReactionsKinds2,
                             tags = mapOf("e" to sortedList),
                             since = since,
@@ -119,7 +126,9 @@ fun filterRepliesAndReactionsToNotes(
                 RelayBasedFilter(
                     relay = relay,
                     filter =
-                        Filter(
+                        ExplainedFilter(
+                            purpose = SubPurpose.ENGAGEMENT,
+                            accountPubKeys = listOfNotNull(accountPubKey),
                             kinds = listOf(TextNoteEvent.KIND, CommentEvent.KIND),
                             tags = mapOf("q" to sortedList),
                             since = since,

amethyst/src/main/java/com/vitorpamplona/amethyst/service/relayClient/reqCommand/user/UserFinderFilterAssembler.kt

@@ -25,6 +25,7 @@ import com.vitorpamplona.amethyst.commons.relayClient.composeSubscriptionManager
 import com.vitorpamplona.amethyst.model.Account
 import com.vitorpamplona.amethyst.model.LocalCache
 import com.vitorpamplona.amethyst.model.User
+import com.vitorpamplona.amethyst.service.relayClient.AccountScopedQuery
 import com.vitorpamplona.amethyst.service.relayClient.reqCommand.user.loaders.UserOutboxFinderSubAssembler
 import com.vitorpamplona.amethyst.service.relayClient.reqCommand.user.watchers.UserCardsSubAssembler
 import com.vitorpamplona.amethyst.service.relayClient.reqCommand.user.watchers.UserReportsSubAssembler
@@ -36,8 +37,8 @@ import com.vitorpamplona.quartz.nip01Core.relay.client.accessories.RelayOfflineT
 @Stable
 class UserFinderQueryState(
     val user: User,
-    val account: Account,
-)
+    override val account: Account,
+) : AccountScopedQuery
 
 @Stable
 class UserFinderFilterAssembler(

amethyst/src/main/java/com/vitorpamplona/amethyst/service/relayClient/reqCommand/user/loaders/UserOutboxFinderSubAssembler.kt

@@ -23,6 +23,8 @@ package com.vitorpamplona.amethyst.service.relayClient.reqCommand.user.loaders
 import com.vitorpamplona.amethyst.commons.defaults.DefaultIndexerRelayList
 import com.vitorpamplona.amethyst.commons.defaults.DefaultSearchRelayList
 import com.vitorpamplona.amethyst.commons.relayClient.eoseManagers.BaseEoseManager
+import com.vitorpamplona.amethyst.commons.relayClient.subscriptions.ExplainedFilter
+import com.vitorpamplona.amethyst.commons.relayClient.subscriptions.SubPurpose
 import com.vitorpamplona.amethyst.model.LocalCache
 import com.vitorpamplona.amethyst.model.User
 import com.vitorpamplona.amethyst.service.relayClient.reqCommand.account.follows.pickRelaysToLoadUsers
@@ -101,6 +103,18 @@ class UserOutboxFinderSubAssembler(
         val accounts = keys.mapTo(mutableSetOf()) { it.account }
         val connectedRelays = client.connectedRelaysFlow().value
 
+        // Attributed only when one account is asking. Unlike the reports sweep, the relay choice here
+        // is made from the *union* of every logged-in account's tiers (`pickRelaysToLoadUsers` below),
+        // and the users being resolved are whoever is on screen rather than anyone's follow list — so
+        // with several accounts active there is no single honest owner for a given filter, and
+        // splitting the sweep per account would re-issue the same lookups once per account.
+        // Deduped by pubkey, not by `Account`: that class uses identity equality, so two objects for
+        // the same logged-in user would look like two accounts and suppress attribution entirely.
+        val soleAccountPubKey =
+            accounts
+                .mapTo(mutableSetOf()) { it.userProfile().pubkeyHex }
+                .singleOrNull()
+
         val perRelayKeysBoth =
             pickRelaysToLoadUsers(
                 noOutboxList,
@@ -116,7 +130,13 @@ class UserOutboxFinderSubAssembler(
                 if (sortedUsers.isNotEmpty()) {
                     RelayBasedFilter(
                         relay = it.key,
-                        filter = Filter(kinds = relayListKinds, authors = sortedUsers),
+                        filter =
+                            ExplainedFilter(
+                                kinds = relayListKinds,
+                                authors = sortedUsers,
+                                purpose = SubPurpose.RELAY_LISTS,
+                                accountPubKeys = listOfNotNull(soleAccountPubKey),
+                            ),
                     )
                 } else {
                     null
@@ -146,7 +166,14 @@ class UserOutboxFinderSubAssembler(
             fallbackRelays.map { relay ->
                 RelayBasedFilter(
                     relay = relay,
-                    filter = Filter(kinds = relayListKinds, authors = sortedAbandoned),
+                    filter =
+                        ExplainedFilter(
+                            kinds = relayListKinds,
+                            authors = sortedAbandoned,
+                            purpose = SubPurpose.RELAY_LISTS,
+                            purposeDetail = "outbox discovery for users whose relay list we lost",
+                            accountPubKeys = listOfNotNull(soleAccountPubKey),
+                        ),
                 )
             }
 

amethyst/src/main/java/com/vitorpamplona/amethyst/service/relayClient/reqCommand/user/watchers/FilterReportsToKey.kt

@@ -20,9 +20,10 @@
  */
 package com.vitorpamplona.amethyst.service.relayClient.reqCommand.user.watchers
 
+import com.vitorpamplona.amethyst.commons.relayClient.subscriptions.ExplainedFilter
+import com.vitorpamplona.amethyst.commons.relayClient.subscriptions.SubPurpose
 import com.vitorpamplona.quartz.nip01Core.core.HexKey
 import com.vitorpamplona.quartz.nip01Core.relay.client.pool.RelayBasedFilter
-import com.vitorpamplona.quartz.nip01Core.relay.filters.Filter
 import com.vitorpamplona.quartz.nip01Core.relay.normalizer.NormalizedRelayUrl
 import com.vitorpamplona.quartz.nip56Reports.ReportEvent
 
@@ -33,14 +34,17 @@ fun filterReportsToKeysFromTrusted(
     trustedAccounts: List<HexKey>,
     relay: NormalizedRelayUrl,
     since: Long?,
+    accountPubKey: HexKey? = null,
 ): RelayBasedFilter? {
     if (targets.isEmpty() || trustedAccounts.isEmpty()) return null
     return RelayBasedFilter(
         relay = relay,
         filter =
-            Filter(
+            ExplainedFilter(
+                purpose = SubPurpose.MODERATION,
                 kinds = ReportKindList,
                 authors = trustedAccounts,
+                accountPubKeys = listOfNotNull(accountPubKey),
                 tags = mapOf("p" to targets.sorted()),
                 since = since,
             ),