fix: Bug - Images and files in chat doesn't load

fix: Restore chat attachments after reload
Wait for persisted attachment metadata before serving or advertising files so reconnecting peers can load images and downloads reliably. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-07-14 11:27:19 +02:00 · 2026-07-14 10:29:37 +02:00 · 2026-07-14 01:54:01 +02:00 · 2026-07-14 01:34:33 +02:00 · 2026-07-14 00:41:05 +02:00 · 2026-07-13 20:18:37 +02:00
276 changed files with 12414 additions and 1100 deletions
@@ -9,14 +9,27 @@ It must stay accurate as new features are introduced, renamed, merged, or remove
 ## Feature list (alphabetical)

 - [App i18n](features/app-i18n.md) — `@ngx-translate/core` localization for the product client; English-only catalog today, same stack as the marketing website.
+- [Attachments](features/attachments.md) — P2P chunked file transfer over WebRTC data channels with Electron/Capacitor disk persistence.
 - [Authentication](features/authentication.md) — signaling-server session tokens, protected REST/WebSocket identity, and client bearer storage.
 - [Custom Emoji](features/custom-emoji.md) — peer-synced user-created emoji assets, chat reaction shortcuts, and composer emoji insertion.
+- [Desktop Local API](features/desktop-local-api.md) — Electron localhost HTTP read API, auth proxy, and offline Docusaurus docs.
+- [Direct Messaging](features/direct-messaging.md) — index entry; full contract in [Messaging](features/messaging.md).
+- [Game Activity](features/game-activity.md) — RAWG game matching, Electron process detection, and P2P now-playing sync.
+- [Invites & Join Requests](features/invites-join-requests.md) — invite links, HTML landing pages, and moderated join approval.
+- [Klipy GIFs](features/klipy-gifs.md) — server-proxied GIF search for chat and DM composers.
+- [Link Preview & Media Proxy](features/link-preview-media-proxy.md) — SSRF-guarded link unfurling and image proxy on the signaling server.
 - [Message Integrity](features/message-integrity.md) — signed P2P message revision chains, inventory `headHash` convergence, and Ed25519 signing-key registration on the signaling server.
+- [Messaging](features/messaging.md) — server-channel chat, direct messages, inventory sync, and DM delivery state machine.
 - [Mobile Capacitor](features/mobile-capacitor.md) — Capacitor native shell, mobile infrastructure facades, and phone-specific call/chat/media integrations.
- [Server Discovery](features/server-discovery.md) — featured/trending public-server REST endpoints (server) consumed by the `/dashboard` and `/servers` client pages.
+- [Plugins](features/plugins.md) — client plugin runtime, server metadata API, Electron plugin data, and P2P message bus.
+- [Push Notifications](features/push-notifications.md) — FCM/APNs device tokens on the server and Capacitor registration.
+- [Server Directory](features/server-directory.md) — multi-endpoint catalog, REST CRUD/join/moderation, and room signal affinity.
+- [Server Discovery](features/server-discovery.md) — featured/trending public-server REST endpoints consumed by `/dashboard` and `/servers`.
+- [Signaling](features/signaling.md) — canonical WebSocket envelope catalog, ordering invariants, and relay rules.
 - [Signal Server Tag](features/signal-server-tag.md) — configurable signal-server display tag shown on profile cards for a user's registration server.
+- [Voice & WebRTC](features/voice-webrtc.md) — voice/camera/screen-share WebRTC with signaling relay and multi-device ownership.

-The product client already documents its bounded contexts at `toju-app/src/app/domains/<name>/README.md` (Access Control, Attachment, Authentication, Chat, Direct Call, Direct Message, Experimental Media, Game Activity, Notifications, Plugins, Profile Avatar, Screen Share, Server Directory, Theme, Voice Connection, Voice Session). Those domain READMEs cover internal product-client behavior.
+The product client also documents its bounded contexts at `toju-app/src/app/domains/<name>/README.md` (Access Control, Attachment, Authentication, Chat, Custom Emoji, Direct Call, Direct Message, Experimental Media, Game Activity, Notifications, Plugins, Profile Avatar, Screen Share, Server Directory, Theme, Voice Connection, Voice Session). Those domain READMEs cover internal product-client behavior.

 `agents-docs/features/<slug>.md` is for **cross-context** contracts and feature areas that span more than one subdomain — WebSocket envelopes, IPC channels, plugin manifests, end-to-end flows that touch client + server + Electron together. Add an entry here the first time you write one.

@@ -25,6 +25,48 @@ Durable rules for AI agents working on this project. Read this file at session s

 ## Lessons

+### Keep `NgOptimizedImage` off runtime blob and data URLs [angular] [images]
+
+- **Trigger:** Angular template lint suggests replacing `[src]` with `ngSrc` for a user-uploaded image rendered from `blob:` or `data:`.
+- **Rule:** Keep a plain `src` binding, document/disable `prefer-ngsrc`, and use native loading/decoding plus the app's own lifecycle controls; Angular throws `NG02952` for blob/data `ngSrc`.
+- **Why:** `NgOptimizedImage` targets network/CDN images and cannot resize, preload, or safely manage renderer-created attachment blobs.
+- **Example:** chat attachment thumbnails use `[src]="attachment.objectUrl" loading="lazy" decoding="async"`, never `[ngSrc]`.
+
+### Read the exact Obsidian bug note before diagnosing a named ticket [workflow] [bugs]
+
+- **Trigger:** The user names a `Bug - …` ticket, but the worktree already contains plausible changes or a similarly named resolved ticket.
+- **Rule:** Resolve the exact note under `Log/Bugs/`, read every reported variant and reproduction step, and only then decide which code changes and status update belong to that ticket.
+- **Why:** attachment reload-host changes looked related to “Images and files in chat doesn't load” but came from a separate resolved ticket and did not cover the reported channel-switch state regression.
+- **Example:** read `/home/ludde/Nextcloud/Obsidian Vault/Log/Bugs/Bug - Images and files in chat doesn't load.md` before implementing or committing its fix.
+
+### Run `npm run i18n:sync` after editing any `public/i18n/catalog/*.json` file [i18n] [testing]
+
+- **Trigger:** Added new `call.errors.*` keys to `toju-app/public/i18n/catalog/call.json` and used them in code; the full test run failed in `app-i18n-catalog.rules.spec.ts` with "Missing i18n keys" even though the keys existed in the catalog file.
+- **Rule:** The runtime and the catalog spec read the merged `toju-app/public/i18n/en.json`, not the per-area `catalog/*.json` files — after any catalog edit, run `npm run i18n:sync` (root script, `tools/sync-app-i18n-catalog.mjs`) and commit the regenerated `en.json` alongside the catalog change.
+- **Why:** without the sync the new strings silently fall back to raw keys at runtime and the catalog spec fails, but only in the full suite — targeted spec runs of the feature under change pass, so the failure surfaces late.
+- **Example:** `npm run i18n:sync && npm run test` after adding `call.errors.microphonePermissionDenied` to `catalog/call.json`.
+
+### Match direct-call recipients against every local identity alias, exactly like DMs already do [direct-call] [identity]
+
+- **Trigger:** "User receiving direct call doesn't get notified" — a caller who met the callee through a room on the caller's signal server addressed the ring by the callee's *provisioned actor id*; `handleIncomingCallEvent` admitted only `payload.participantIds.includes(oderId || id)`, so the ring was silently dropped, the caller sat "In Voice", and the callee saw nothing. DMs had the identical bug fixed earlier (`baa350e`), but the fix stopped at `DirectMessageService` and never reached `DirectCallService`.
+- **Rule:** every self check on a cross-user event (admission, sender-echo filter, remote-participant filtering, DM-header peer lookup) must span all local aliases — home id, entity id, peer id, plus each `SignalServerCredentialStoreService.listValidCredentials()` actor id — and incoming aliases must be normalized onto the canonical local id before session state is keyed (`normalizeDirectCallPayloadSelfAliases`).
+- **Why:** the failure only reproduces when caller and callee have different home signal servers, which no same-server e2e covers; and when one identity-alias bug is fixed in a domain, grep for the same `=== currentUserId` pattern in sibling domains that share the transport — the direct-call domain reused `PeerDeliveryService` but kept the naive check for another month.
+- **Example:** `direct-call-participant-identity.rules.ts#directCallPayloadIncludesAnyId` / `normalizeDirectCallPayloadSelfAliases`; regression e2e `e2e/tests/voice/dm-header-call-ring.spec.ts` registers Bob on a secondary signal server, meets in a primary-signal room, and asserts the DM-header call rings Bob's incoming-call modal (fails on old code, passes after).
+
+### Decide attachment receive admission once at request time; never re-gate size in the chunk handler [attachments]
+
+- **Trigger:** "Sending files between users doesn't really work" — a browser user clicked Request on a 10–50 MB generic file, the request gate (`canReceiveAttachment`) admitted it for in-memory receive, the sender streamed chunks, but `handleFileChunk` still had a leftover hard `size > MAX_AUTO_SAVE_SIZE_BYTES` rejection on the in-memory path, so every chunk was dropped, no ack was ever sent, the sender's `waitForAck` timed out, and the GUI never changed.
+- **Rule:** `canReceiveAttachment` (request time) is the single admission decision; the chunk handler may only route between disk-streaming and in-memory assembly — any stricter size check there silently drops chunks the request gate already admitted.
+- **Why:** the failure is invisible in logs-from-the-outside: the sender's per-chunk sends look like a working transfer ("packages with size 32kb") until the ack timeout, and the receiver sets `requestError` only into memory that a re-request immediately clears — the user just sees a dead Request button.
+- **Example:** removed the `MAX_AUTO_SAVE_SIZE_BYTES` guard in `attachment-transfer.service.ts#handleFileChunk`; regression e2e `e2e/tests/chat/large-generic-file-transfer.spec.ts` sends an 11 MB `.bin` between two browser clients and asserts Request → progress → Download (fails on the old code, passes after).
+
+### Re-queue attachment auto-downloads on every message/room binding event; never trust one transport's ordering [attachments] [realtime]
+
+- **Trigger:** cross-user attachment sync e2e (`chat-message-features.spec.ts`) flaked ~50%: `file-announce` (WebRTC data channel) beat `chat-message` (signaling websocket) to the receiver, so the announce-time auto-download resolved `roomId=null`, silently gave up, and nothing ever retried — the receiver showed "Waiting for image source..." forever. A related bug: the stalled-download reset keyed only on "receivedBytes>0 && no pending request", but the pending-request marker is deleted on the *first* chunk, so any auto-download pass during an active transfer cancelled it mid-stream and the retry deadlocked against the sender's active-transfer dedupe.
+- **Rule:** events that complete the `messageId -> roomId` binding (`chat-message` in `messages-incoming.handlers.ts`) must call `queueAutoDownloadsForMessage` again — never assume `file-announce` arrives after the message, they ride different transports; and stall detection must gate on chunk-progress staleness (`lastUpdateMs` older than `ATTACHMENT_STALLED_DOWNLOAD_THRESHOLD_MS`), never on the absence of a pending-request marker alone.
+- **Why:** both halves fail silently (no error, no requestError set), so the UI just sits at 0 bytes; the flake is timing-dependent and invisible in single-client tests — only the two-client e2e with `--repeat-each` exposed it deterministically enough to fix.
+- **Example:** `handleChatMessage` now calls `attachments.queueAutoDownloadsForMessage(message.id)` after `rememberMessageRoom`; `shouldResetStalledAttachmentDownload(attachment, hasPendingRequest, nowMs)` in `attachment-autodownload.rules.ts`. Verified with `npx playwright test -g "syncs image and file attachments|syncs multi-chunk" --repeat-each=4` (8/8 after, ~50% before).
+
 ### Scope per-user UI state by user id, not by the client database [persistence] [multi-user] [custom-emoji]

 - **Trigger:** custom emoji "saved library" membership was a single `savedByUser` flag on the shared emoji row plus a long-lived singleton (`CustomEmojiService`) that merged state across logins — so a second account on the same client (and the Electron shared SQLite DB) inherited the first user's picker.
@@ -1,7 +1,14 @@
 # App i18n

+> **Status:** Active
+> **Last updated:** 2026-07-05
+
 Client-side UI string localization for the product client (`toju-app`), using the same `@ngx-translate/core` stack as the marketing website.

+## Migration status
+
+Only **English** ships today (`SUPPORTED_APP_LOCALES = ['en']`). The catalog workflow and `translate` pipe are in place, but many components still use hardcoded strings — new user-visible copy should use i18n keys; migrate adjacent strings when touching a component. There is no locale preference UI yet.
+
 ## Responsibilities

 - Bundle locale JSON under `toju-app/public/i18n/`.
@@ -60,3 +67,14 @@ The sync script also extracts `theme.registry.*` labels/descriptions from `theme
 - `toju-app/src/app/core/i18n/app-i18n.rules.spec.ts`
 - `toju-app/src/app/core/i18n/app-i18n.service.spec.ts`
 - `toju-app/src/app/core/i18n/app-i18n.testing.ts` — `provideAppI18nForTests()` / `initializeAppI18nForTests()` for Vitest injectors
+
+## Related
+
+- `toju-app/AGENTS.md` — i18n usage rules for agents
+- Marketing site i18n is separate: `website/public/i18n/`
+
+## Changelog
+
+| Date | Change |
+|------|--------|
+| 2026-07-05 | Documented partial migration status and locale UI gap |
@@ -0,0 +1,136 @@
+# Attachments
+
+> **Area:** attachments
+> **Status:** Active
+> **Last updated:** 2026-07-05
+
+## Overview
+
+Attachments move file bytes peer-to-peer over the WebRTC ordered data channel using a announce → request → chunk protocol. Chat and DMs attach metadata to messages; the signaling server does not store or relay file payloads. Sibling devices learn attachment **metadata** via `account_sync` `chat-sync-batch` but must still download bytes from a peer that has them.
+
+Domain internals: [`toju-app/src/app/domains/attachment/README.md`](../../toju-app/src/app/domains/attachment/README.md).
+
+## Responsibilities
+
+- Chunked P2P transfer with flow control and cancel semantics.
+- Auto-download when policy allows; disk streaming on Electron/Capacitor.
+- Ownership vs "shared from your device" UI rules.
+- Persist attachment rows + filesystem paths on desktop/mobile.
+
+This area does **not** own:
+
+- Message envelopes or delivery states → [messaging.md](messaging.md).
+- WebRTC negotiation → [voice-webrtc.md](voice-webrtc.md).
+
+## Key concepts
+
+- **Announce** — sender advertises `fileId`, name, size, mime without sending bytes.
+- **Mirror host** — peer that holds a complete copy and can serve chunks.
+- **Buffered send** — waits for data-channel back-pressure (4 MB high / 1 MB low water marks on chat channel).
+
+---
+
+## P2P protocol
+
+| type | Purpose |
+|------|---------|
+| `file-announce` | Metadata only |
+| `file-request` | Receiver starts download |
+| `file-chunk` | Base64 chunk (`index`, `total`, `data`) |
+| `file-chunk-ack` | Per-chunk flow control |
+| `file-cancel` | Abort in flight |
+| `file-not-found` | Host lacks bytes |
+
+**Chunk size:** `FILE_CHUNK_SIZE_BYTES` = **64 KB** (`attachment-transfer.constants.ts`).
+
+**Electron send path:** reads one chunk at a time from disk via IPC (`append-file-bytes` / read chunk) to avoid loading whole files into renderer memory.
+
+---
+
+## Persistence
+
+| Runtime | Metadata | Bytes |
+|---------|----------|-------|
+| Browser | In-memory / optional save | Below **10 MB** auto-save cap (`MAX_AUTO_SAVE_SIZE_BYTES`) |
+| Electron | SQLite `attachments` + CQRS | `user/<username>/…` via `AttachmentStorageService` / IPC |
+| Capacitor | SQLite | App-private attachment directory — [mobile-capacitor.md](mobile-capacitor.md) |
+
+---
+
+## Download / export to user location
+
+`AttachmentDownloadService.downloadToUserLocation` picks the runtime-appropriate export path:
+
+| Runtime | Behavior |
+|---------|----------|
+| Electron | `saveExistingFileAs` (disk-backed) or `saveFileAs` (blob) native save dialog |
+| Browser | Anchor `download` click on the object URL |
+| Capacitor | `CapacitorAttachmentExportService.exportToDevice`: copies the disk file from `Directory.Data` into `Directory.Documents` (or fetches the object URL and writes base64) using `buildAttachmentExportFileName` (timestamp suffix so exports never collide — Android 11+ rejects overwrites of files the app did not create). Anchor downloads do nothing in the Android WebView. |
+
+## Multi-device
+
+`chat-sync-batch` in `account_sync` carries an `attachments` map (local paths stripped). Sibling devices discover files exist; P2P `file-request` still required for bytes.
+
+---
+
+## Business rules and invariants
+
+- Transfers are between connected peers only (no server CDN).
+- Receive strategy is decided once at request time by `canReceiveAttachment` (`attachment.logic.ts`): ≤ 10 MB assembles in memory everywhere; > 10 MB streams to disk on Electron/Capacitor, assembles in memory on the browser up to its 50 MB persist cap, and is rejected with a visible `fileTooLarge` error beyond that. `handleFileChunk` must accept whatever the request gate admitted — a stricter chunk-time size cap silently drops chunks and stalls the transfer.
+- Visibility-based blob lifecycle on desktop: revoke `blob:` URLs when messages scroll off-screen if disk can rehydrate.
+- Startup hydration is an availability boundary: file requests and host re-announcements wait for persisted metadata before inspecting local files. A host re-announces persisted files after reload and on peer connection even from non-chat routes, and can recover an original Electron source path by copying it into app data on demand before serving.
+- Startup database hydration merges persisted metadata into the live runtime attachment map; it must preserve attachments announced during initialization and completed runtime state (`available`, progress, display URL) while filling missing local paths. Replacing the map can regress a completed download to Retry, spinner, or 100% after navigation.
+- Starting a request updates the runtime version immediately so inline cards and galleries show pending/download state at zero bytes; exhausting all candidate peers surfaces `fileNotFound` instead of silently clearing the pending request. A repeat host announce re-queues guarded auto-download recovery for eligible media.
+- Display-blob memory invariants (added 2026-07-14, RAM investigation):
+  - Inline hydration (`chat-message-item` effect) only runs for messages that are visible or within the `IntersectionObserver` root margin — gated by `attachment-hydration-visibility.rules.ts`. Off-screen rows never load blobs.
+  - Visibility observation uses the rendered message row (`componentHost.firstElementChild`), not the boxless Angular component host; otherwise returning to a channel leaves revoked attachments on permanent spinners.
+  - Disk-to-blob hydration is deduplicated per attachment and capped at two active tasks. Offscreen/destroy lifecycle cancellation is checked after every IPC read and before object-URL assignment, so rapid channel switches cannot accumulate stale full-file buffers or orphaned blobs; pinned fullscreen/gallery attachments are exempt.
+  - Disk-hydrated blobs are **not** duplicated into `AttachmentRuntimeStore.originalFiles`; peer requests are served from the disk path (`streamRequestedFile` prefers `resolveExistingPath`). `originalFiles` only holds uploads/downloads that have no disk copy yet.
+  - `revokeAttachmentDisplayBlob` also drops the `originalFiles` entry when `savedPath` exists, so revocation actually frees the bytes.
+  - Message rows always revoke their display blobs on destroy (pins are respected), not only when they were visible.
+  - Room switch sweeps display blobs of all other rooms (`releaseDisplayBlobsForInactiveRooms`, driven by `collectMessageIdsForInactiveRoomBlobRelease`). Messages with unknown room mapping are left alone.
+- "Shared from your device" badge only when bytes are local to the viewing user.
+- Blob-backed chat thumbnails use plain `src` with native lazy loading and async decoding. `NgOptimizedImage` is forbidden for these URLs because Angular rejects `blob:` inputs; fullscreen images remain eager.
+
+---
+
+## Technical implementation
+
+- Facade: `AttachmentFacade` → `AttachmentManagerService`
+- Protocol: `AttachmentTransferService` + `AttachmentTransferTransportService`
+- Electron IPC: `read-file-chunk`, `append-file-bytes`, `write-file`, `delete-file`, etc.
+
+---
+
+## Testing
+
+- Domain logic specs under `attachment/`
+- E2E: `e2e/tests/chat/chat-message-features.spec.ts`, `local-attachment-persistence.spec.ts`, `multi-device-attachment-sharing.spec.ts`, `large-generic-file-transfer.spec.ts` (browser receiver, generic file above the 10 MB auto-save cap)
+
+---
+
+## Security considerations
+
+- No server-side virus scanning; peers trust senders they are connected to.
+- Files stay in user data directories (Electron path jail).
+
+---
+
+## Related features
+
+- [messaging.md](messaging.md) — message + attachment metadata coupling
+- [authentication.md](authentication.md) — `account_sync` batches
+- [mobile-capacitor.md](mobile-capacitor.md) — mobile storage
+
+## Changelog
+
+| Date | Change |
+|------|--------|
+| 2026-07-14 | Bounded display hydration to two deduplicated tasks, cancelled stale channel work before blob assignment, and added native lazy/async thumbnail hints |
+| 2026-07-14 | Fixed channel-return hydration by observing the rendered message row instead of the boxless component host |
+| 2026-07-14 | Made zero-byte requests visible, surfaced async peer-exhaustion failures, and retried eligible media when a host re-announces |
+| 2026-07-14 | Preserved live attachment/download state when startup database hydration completes after realtime events |
+| 2026-07-14 | Prevented reload-time `file-not-found` responses by waiting for metadata hydration, re-announcing hosts outside chat routes, and recovering persisted source paths on demand |
+| 2026-07-14 | Blob-memory invariants: visibility-gated hydration, no `originalFiles` duplication for disk-backed blobs, revoke-on-destroy, inactive-room blob sweep |
+| 2026-07-13 | Capacitor download/export to public `Documents` via `CapacitorAttachmentExportService` |
+| 2026-07-05 | Expanded to full contract style |
@@ -1,6 +1,14 @@
 # Authentication

-Session-token authentication for the signaling server and product client.
+> **Area:** authentication
+> **Status:** Active
+> **Last updated:** 2026-07-05
+
+## Overview
+
+Session-token authentication binds REST mutations and WebSocket `identify` to a user identity on each signaling server. The product client may hold **multiple** server credentials (home + foreign auto-provisioned accounts) while keeping one local user profile. Multi-device tabs share one identity via separate `clientInstanceId` values and `account_sync` relay.
+
+WebSocket details: [signaling.md](signaling.md). Local API tokens: [desktop-local-api.md](desktop-local-api.md).

 ## Trust boundaries

@@ -8,8 +16,8 @@ Session-token authentication for the signaling server and product client.
 |---|---|---|
 | Signaling server REST (mutations) | `Authorization: Bearer <token>` | Actor user IDs in request bodies are ignored; server derives `authUserId` from the token |
 | Signaling server REST (discovery) | None | `GET /api/servers`, featured/trending/search remain public |
-| Signaling server WebSocket | `identify.token` | Connections must identify before any other message type |
-| Electron Local API | Separate in-memory bearer tokens | Proxies login to allowed signaling servers only |
+| Signaling server WebSocket | `identify.token` | Connections must identify before any other message type — see [signaling.md](signaling.md) |
+| Electron Local API | Separate in-memory bearer tokens | Proxies login to allowed signaling servers only — see [desktop-local-api.md](desktop-local-api.md) |
 | Product client local DB | OS user account | SQLite and attachments are plaintext at rest |

 ## Client logout
@@ -36,13 +44,81 @@ Session-token authentication for the signaling server and product client.

 ## Protected REST routes

-Require `Authorization: Bearer`:
+Require `Authorization: Bearer` (`requireAuth` middleware). Public routes are listed for contrast.

- `PUT/POST/DELETE` under `/api/servers/*` (except public `GET`)
- `PUT /api/requests/:id`
- Plugin-support mutations under `/api/servers/:serverId/plugins/*`
- `/api/users/device-tokens/*`
- `POST /api/users/logout`
+### Users (`/api/users`)
+
+| Method | Path | Auth |
+|--------|------|------|
+| POST | `/register` | Public |
+| POST | `/login` | Public |
+| GET | `/:id/signing-public-key` | Public |
+| PUT | `/me/signing-key` | Bearer |
+| POST | `/logout` | Bearer |
+
+### Device tokens (`/api/users/device-tokens`)
+
+All routes require bearer; `userId` in body or path must equal `authUserId` (`403` otherwise).
+
+| Method | Path |
+|--------|------|
+| POST | `/` |
+| GET | `/:userId` |
+| POST | `/:userId/dispatch` |
+
+### Servers (`/api/servers`)
+
+| Method | Path | Auth |
+|--------|------|------|
+| GET | `/`, `/featured`, `/trending`, `/:id` | Public |
+| POST | `/` | Bearer |
+| PUT | `/:id` | Bearer |
+| DELETE | `/:id` | Bearer |
+| POST | `/:id/join` | Bearer |
+| POST | `/:id/leave` | Bearer |
+| POST | `/:id/heartbeat` | Bearer |
+| POST | `/:id/invites` | Bearer |
+| GET | `/:id/requests` | Bearer |
+| POST | `/:id/moderation/kick` | Bearer |
+| POST | `/:id/moderation/ban` | Bearer |
+| POST | `/:id/moderation/unban` | Bearer |
+
+### Join requests (`/api/requests`)
+
+| Method | Path | Auth |
+|--------|------|------|
+| PUT | `/:id` | Bearer (approve/deny) |
+
+### Plugin support (`/api/servers/:serverId/plugins`)
+
+| Method | Path | Auth |
+|--------|------|------|
+| GET | `/` | Public (metadata read) |
+| PUT | `/:pluginId/requirement` | Bearer |
+| DELETE | `/:pluginId/requirement` | Bearer |
+| PUT | `/:pluginId/events/:eventName` | Bearer |
+| DELETE | `/:pluginId/events/:eventName` | Bearer |
+| GET/PUT/DELETE | `/:pluginId/data/*` | **410 Gone** (server plugin data disabled) |
+
+### Public (no bearer)
+
+- `GET /api/health`, `/api/time`
+- `GET /api/link-metadata`, `/api/image-proxy`
+- `GET /api/klipy/config`, `/api/klipy/gifs`
+- `POST /api/games/match`
+- `GET /api/invites/:id`
+- `GET /invite/:id` (HTML invite page)
+- OpenAPI docs routes (`/api/openapi.json`, `/api/docs`, …) — gated by server config, not session auth
+
+Full server-directory semantics: [server-directory.md](server-directory.md).
+
+## Message signing key registration
+
+Ed25519 signing keys for [message-integrity.md](message-integrity.md) register via `PUT /api/users/me/signing-key` with `{ publicKeyJwk }`.
+
+- **When registered:** `AuthenticationService` calls `MessageSigningService.registerSigningPublicKeyIfNeeded()` after successful **home** `POST /login` and `POST /register` only (`authentication.service.ts`).
+- **Scope:** registration uses the **active** signaling server's API base (`ServerDirectoryFacade.activeServer()`). Foreign-server auto-provision (`authorizeSignalServer` / `SignalServerProvisionerService`) does **not** currently call signing-key registration — message integrity on foreign servers depends on a later login path or manual registration when that server becomes active.
+- **Storage:** private key in `localStorage` (`metoyou.messageSigningKeyPair`); public key directory on server SQLite only.

 ## WebSocket identify contract

@@ -119,7 +195,7 @@ A per-install **provision secret** enables silent account creation on newly adde
 | Foreign login/register | `authorizeSignalServer` | Upserts credential for that URL only; home session unchanged |
 | Auto-provision | `SignalServerProvisionerService` | Registers or logs in on foreign server using provision secret; on username collision tries suffixed username (`alice-<homeUserIdPrefix>`) and prefixes the display name with `#<homeUserIdPrefix> #<signalServerTag>` so same-name accounts stay distinguishable |
 | Create/join on foreign server | `RoomsEffects.createRoom$`, invite/join flows | `ensureCredentialForServerUrl` provisions (or reuses) the per-server session token first; REST/WebSocket calls use the **actor user id** for that signal URL, not the home registration id |
-| Foreign auth failure | `signalServerAuthFailed` | Clears that URL's credential and re-provisions when home token is still valid; global logout only when home server rejects auth |
+| Foreign auth failure | `signalServerAuthFailed` | `auth_required` (message raced ahead of identify) re-identifies or is ignored while a valid local credential exists; `auth_error` (token rejected) clears that URL's credential and re-provisions on foreign servers or expires the home session |

 Unreachable or offline signal servers must **not** open `/login?mode=authorize`. `ensureEndpointVersionCompatibility()` treats only `online` endpoints as connectable, and `ensureCredentialForServerUrl()` skips authorize navigation when health checks report the server offline (or provisioning fails over the network).

@@ -135,3 +211,17 @@ Startup routing for signed-out visitors is decided by `resolveUnauthenticatedSta
 - CORS allowlist: optional `corsAllowlist` in `server/data/variables.json` or `CORS_ALLOWLIST` env (comma-separated). Empty allowlist keeps permissive CORS for local development.
 - Push-token routes require bearer auth and user-id match.
 - RTC relay: direct-message/direct-call types always relay; server-icon types require shared server membership; WebRTC offer/answer/ice remain open for cross-server DM WebRTC.
+
+## Related
+
+- [signaling.md](signaling.md) — WebSocket `identify`, `account_sync`, ordering invariants
+- [desktop-local-api.md](desktop-local-api.md) — Electron Local API bearer tokens
+- [message-integrity.md](message-integrity.md) — signing keys and revision chains
+- [server-directory.md](server-directory.md) — protected server REST mutations
+
+## Changelog
+
+| Date | Change |
+|------|--------|
+| 2026-07-14 | Distinguish `auth_required` vs `auth_error` on `signalServerAuthFailed`; stop false home-session expiry; leave `/login` when in-memory user still authenticated |
+| 2026-07-05 | Expanded protected-route inventory; clarified signing-key registration scope; cross-links |
@@ -2,64 +2,125 @@

 > **Area:** custom-emoji
 > **Status:** Active
-> **Last updated:** 2026-06-05
+> **Last updated:** 2026-07-05

 ## Overview

-Custom emoji lets users upload small image emoji, use them in chat messages and reactions, and sync emoji assets needed for rendering to connected peers over the existing data-channel mesh.
+Custom emoji lets users upload small image emoji, use them in chat messages and reactions, and sync the image bytes to connected peers over the WebRTC data channel (and to sibling devices via `account_sync`). The signaling server never stores emoji assets.
+
+Internal UI and NgRx wiring: [`toju-app/src/app/domains/custom-emoji/README.md`](../../toju-app/src/app/domains/custom-emoji/README.md). Chat composer integration: [`toju-app/src/app/domains/chat/README.md`](../../toju-app/src/app/domains/chat/README.md).

 ## Responsibilities

- Own custom emoji asset validation, local persistence, user-saved library membership, shortcut ranking, and peer-to-peer asset sync.
- Expose a shared picker consumed by chat message reactions and the chat composer.
- Keep usage ranking local to the current user; usage counts are not synced.
- Does not store custom emoji on the signaling server.
+- Validate uploads (size, MIME), persist image assets locally, and track per-user **saved library** membership.
+- Rank shortcuts by local usage (not synced across devices).
+- Sync assets P2P (`custom-emoji-*` envelopes) and proactively push referenced emoji when sending messages.
+- Relay the same envelopes on `account_sync` for multi-device library convergence.
+- Expose `CustomEmojiPickerComponent` for composer and reactions.

-## Key Concepts
+This area does **not** own:

- **Custom emoji asset**: A user-created image stored as a data URL with id, name, mime, size, hash, creator, timestamps, and optional saved-library membership.
- **Known custom emoji**: A synced asset available for message rendering and forwarding, but not shown in the current user's picker unless saved.
- **Saved custom emoji**: A known asset the current user added to their library; saved emoji appear in the picker and shortcut ranking. Library membership is **user-bound, not client-bound** — it is tracked per signed-in user (keyed by user id), so a second account on the same device never inherits the first account's library.
- **Emoji shortcut row**: The seven most-used emoji entries for the current user plus an eighth control that opens the full selector.
- **Custom emoji token**: The stable message/reaction representation `:emoji[id](name)`, resolved locally to the synced image asset when rendering.
- **Composer emoji alias**: The readable inline draft representation `:name:`. The composer rewrites known aliases to stable custom emoji tokens only when sending.
+- Message send/edit transport → [messaging.md](messaging.md).
+- Profile avatar bytes → `toju-app/src/app/domains/profile-avatar/README.md`.
+- Server-side storage (none).

-## Peer Envelope Contract
+## Key concepts

-Custom emoji uses `ChatEvent` data-channel envelopes:
+- **Custom emoji asset** — image with `id`, `name`, `mime`, `size`, `hash`, `creatorUserId`, `dataUrl` (or reconstructed from chunks).
+- **Known emoji** — synced for rendering; not necessarily in the picker.
+- **Saved emoji** — in the active user's library (`metoyou_custom_emoji_saved:<userId>`); shown in picker and shortcut row.
+- **Token** — stable wire form `:emoji[id](name)` in message/reaction bodies.
+- **Composer alias** — draft form `:name:` rewritten to a token on send when the name is known.
+- **Shortcut row** — seven most-used saved entries plus opener for full picker.

- `custom-emoji-summary`: `{ customEmojiSummaries: [{ id, hash, updatedAt }] }`
- `custom-emoji-request`: `{ ids: string[] }`
- `custom-emoji-full`: `{ customEmojiTransfer: Omit<CustomEmoji, 'dataUrl'>, total: number }`
- `custom-emoji-chunk`: `{ customEmojiId, index, total, data }`
+---

-When a peer connects, each side sends a summary of known assets. The receiver requests missing or stale emoji by id, and the owner replies with a small manifest followed by bounded base64 chunks using buffered peer sends. Creating a new emoji also streams that manifest and chunk sequence to every currently connected peer. Outgoing room chat messages, edits, reactions, and direct messages proactively push every referenced custom emoji asset to connected peers in parallel with the message event, so receivers do not wait for a request round-trip. Small assets that fit under `CUSTOM_EMOJI_INLINE_MAX_JSON_BYTES` travel inline in one `custom-emoji-full` event; larger assets use manifest plus chunks. Incoming chat messages and chat-sync batches still scan for `:emoji[id](name)` tokens and request any missing assets from the sender as a repair path. Full inline `customEmoji` payloads remain accepted for backward compatibility.
+## Peer envelope contract (P2P)

-## Business Rules
+| type | Payload |
+|------|---------|
+| `custom-emoji-summary` | `{ customEmojiSummaries: [{ id, hash, updatedAt }] }` |
+| `custom-emoji-request` | `{ ids: string[] }` |
+| `custom-emoji-full` | manifest (`customEmojiTransfer`) ± inline bytes |
+| `custom-emoji-chunk` | `{ customEmojiId, index, total, data }` base64 |

- Uploads are capped at 1 MB.
- Accepted image types match profile avatars: WebP, GIF, JPG, and JPEG.
- Local shortcut ranking is keyed by the active user and includes Unicode emoji plus saved custom emoji only.
- Saved-library membership is bound to the user, not the client: `CustomEmojiService` tracks the set of saved emoji ids per user id in `localStorage` (`metoyou_custom_emoji_saved:<userId>`, mirroring the per-user usage ranking). The picker shows only emoji in the active user's saved set, so signing in as a different account on the same client never exposes the previous account's library. On first load after this change the set is seeded from legacy `savedByUser` rows the user actually created (`creatorUserId === userId`), so creators keep their library while other local accounts stay empty.
- Message rendering reserves inline emoji space with a transparent placeholder image while a referenced custom emoji asset is not yet available; deferred markdown placeholders rewrite tokens to readable `:name:` aliases so raw `:emoji[id](name)` text never flashes in chat.
- Seen custom emoji are not added to the picker automatically; right-click a rendered custom emoji in chat or on a custom emoji reaction and choose **Add to emoji library** from the app context menu (`NativeContextMenuComponent`).
- Saved custom emoji can be removed from the picker library by right-clicking them inside the emoji picker and choosing **Remove from emoji library**; the asset stays available for rendering messages that already reference it.
- Emoji hosts are marked with `data-custom-emoji` / `data-custom-emoji-library` plus `data-custom-emoji-id` so the global context menu can distinguish them from regular images and suppress the default **Copy Image** action.
- The full emoji picker includes a search field that filters built-in Unicode emoji by common terms and saved custom emoji by name.
- Custom emoji data-channel chunks are capped below typical SCTP message limits; back-pressure alone is not enough because a single oversized send can fire `RTCDataChannel.onerror`.
- Completed transfers are persisted only when the reconstructed data URL matches the manifest size and hash; corrupt local rows are dropped before summaries are advertised.
+**Handshake:** on peer connect both sides send summaries; receiver requests stale/missing ids; owner sends manifest then chunked payloads via buffered sends.

-## Data Access
+**Proactive push:** outgoing chat/DM messages scan for tokens and push assets to connected peers in parallel with the message event.

- Browser runtime stores custom emoji image assets in IndexedDB store `customEmojis` (per-user database scope).
- Electron runtime stores custom emoji image assets in SQLite table `custom_emojis`, created by migration `1000000000011-AddCustomEmojis` (a single shared desktop database).
- Renderer access goes through `DatabaseService` methods `saveCustomEmoji`, `getCustomEmojis`, and `deleteCustomEmoji`. These persist the image **assets** only; they are not scoped per user (the Electron table is shared across local accounts). Per-user **library membership** lives separately in `localStorage` (`metoyou_custom_emoji_saved:<userId>`), which is what keeps the picker user-bound even on a shared client database.
+**Inline threshold:** assets ≤ `CUSTOM_EMOJI_INLINE_MAX_JSON_BYTES` (48 KiB) ship in one `custom-emoji-full`; larger assets use manifest + chunks.
+
+**Repair path:** incoming messages and `chat-sync-batch` scan for tokens and request missing assets from the sender.
+
+### Multi-device (`account_sync`)
+
+Relayable types (`account-sync.rules.ts`): `custom-emoji-summary`, `custom-emoji-request`, `custom-emoji-full`, `custom-emoji-chunk`. See [signaling.md](signaling.md) and [authentication.md](authentication.md).
+
+---
+
+## Business rules and invariants
+
+- Max upload **1 MB**; MIME: WebP, GIF, JPEG/JPG (same set as profile avatars).
+- Library membership is **per user id**, not per device — second account on same machine does not inherit another user's saved set.
+- Seeing an emoji in chat does **not** add it to the library; user must **Add to emoji library** from context menu.
+- Remove from library hides picker entry but keeps asset for messages that already reference it.
+- Chunks stay below SCTP-safe sizes; oversized single sends can trigger `RTCDataChannel.onerror` even when back-pressure is idle.
+- Persist only when reconstructed `dataUrl` matches manifest **size and hash**; corrupt rows are dropped before advertising summaries.
+- Placeholder rendering avoids flashing raw tokens while assets are in flight.
+
+---
+
+## Storage
+
+| Runtime | Asset bytes | Library membership |
+|---------|-------------|-------------------|
+| Browser | IndexedDB `customEmojis` (per-user DB scope) | `localStorage` `metoyou_custom_emoji_saved:<userId>` |
+| Electron | SQLite `custom_emojis` (shared desktop DB) | same localStorage key |
+| Capacitor | SQLite `custom_emojis` in `metoyou__<userId>` | same localStorage key |
+
+API: `DatabaseService.saveCustomEmoji` / `getCustomEmojis` / `deleteCustomEmoji`.
+
+---
+
+## Technical implementation
+
+- Rules: `domains/custom-emoji/domain/custom-emoji.rules.ts`
+- Service: `CustomEmojiService`; effects: `CustomEmojiSyncEffects`
+- Picker: `feature/custom-emoji-picker/`
+- Context menu: `data-custom-emoji` / `data-custom-emoji-library` attributes on rendered hosts
+
+---

 ## Testing

- Unit tests cover upload size validation, shortcut selection, picker search filtering, custom emoji token generation, data-channel chunk splitting, readable composer alias rewriting, transfer integrity, saved-library membership, and add/remove library context-menu actions.
+- `custom-emoji.rules.spec.ts`, `custom-emoji.service.spec.ts`, `custom-emoji-picker.component.spec.ts`
+- `account-sync.rules.spec.ts` (relayable types)
+- E2E: `e2e/tests/chat/custom-emoji-user-binding.spec.ts`

-## Security Considerations
+---

- Emoji payloads are image-only and size-limited before persistence or broadcast.
- Assets sync only to already connected peers; the signaling server does not persist or proxy emoji images.
+## Security considerations
+
+- Image-only, size-capped payloads before persist or broadcast.
+- Assets reach only connected peers (or same-account devices via `account_sync`); server never proxies bytes.
+
+---
+
+## Known limitations
+
+- Usage counts and shortcut ranking are **local only**.
+- Electron asset table is **shared across OS users** on one desktop install; library keys remain per MetoYou user id.
+
+---
+
+## Related features
+
+- [messaging.md](messaging.md) — tokens in message bodies, proactive push on send
+- [signaling.md](signaling.md) — `account_sync`
+- [mobile-capacitor.md](mobile-capacitor.md) — Capacitor SQLite path
+
+## Changelog
+
+| Date | Change |
+|------|--------|
+| 2026-07-05 | Restructured to match messaging doc style; fixed duplicate sections; Capacitor + account_sync |
@@ -0,0 +1,53 @@
+# Desktop Local API
+
+> **Status:** Active
+> **Last updated:** 2026-07-05
+
+## Overview
+
+Electron hosts an optional **localhost HTTP API** that exposes read-only access to the local SQLite database, proxies login to allowed signaling servers, and serves bundled Docusaurus documentation offline.
+
+## Responsibilities
+
+| Layer | Owns |
+|-------|------|
+| Electron `api/router.ts` | HTTP routes, bearer token store, CQRS query dispatch |
+| Desktop settings | Enable/disable Local API, port, allowed signal servers |
+| `docs-site` build | Static bundle mounted at `/docusaurus/*` |
+
+## Trust boundary
+
+Separate **in-memory bearer tokens** from signaling-server session tokens. Login via Local API issues a local token; read routes require `Authorization: Bearer`. See [authentication.md](authentication.md).
+
+## Routes (summary)
+
+| Method | Path | Auth | Purpose |
+|--------|------|------|---------|
+| GET | `/api/health` | No | Local API liveness |
+| GET | `/api/openapi.json`, `/docs`, `/scalar/api-reference.js` | No | API docs (Scalar) |
+| GET | `/docusaurus/*` | No | In-app documentation site |
+| POST | `/api/auth/login` | No | Proxy to configured signaling server; returns local bearer |
+| POST | `/api/auth/logout` | Bearer | Revoke local token |
+| GET | `/api/profile` | Bearer | Current user profile |
+| GET | `/api/rooms`, `/api/rooms/{roomId}`, `.../users`, `.../messages`, `.../bans` | Bearer | Read-only room data |
+| GET | `/api/messages/{messageId}`, `.../reactions`, `.../attachments` | Bearer | Message graph |
+| GET | `/api/users/{userId}`, `/api/attachments`, `/api/plugin-data` | Bearer | User + plugin data reads |
+| GET | `/api/meta/{key}` | Bearer | Meta key lookup |
+
+Database routes return **503** when SQLite is not initialised.
+
+## IPC
+
+- `get-local-api-status`, `open-local-api-docs`, `open-docusaurus-docs`
+
+## Related
+
+- [authentication.md](authentication.md) — trust table
+- `electron/CONTEXT.md` — Local API vocabulary
+- `docs-site/CONTEXT.md` — documentation bundle
+
+## Changelog
+
+| Date | Change |
+|------|--------|
+| 2026-07-05 | Initial Local API route catalog |
@@ -0,0 +1,29 @@
+# Direct Messaging
+
+> **Area:** messaging
+> **Status:** Active
+> **Last updated:** 2026-07-05
+
+## Overview
+
+Direct messaging (1:1 and group PMs) is documented in full in **[messaging.md](messaging.md)** — transports, delivery state machine, sync protocol, storage, and security. This file remains as an index entry in [FEATURES.md](../FEATURES.md).
+
+## Quick reference
+
+- **Domain:** `toju-app/src/app/domains/direct-message/`
+- **Entry points:** `DirectMessageService`, `PeerDeliveryService`, `FriendService`
+- **Persistence:** `metoyou_direct_message_*` (per-user local storage)
+- **P2P types:** `direct-message`, `direct-message-status`, `direct-message-mutation`, `direct-message-typing`, `direct-message-sync-request`, `direct-message-sync`
+- **Calls:** `direct-call` shares `PeerDeliveryService` → [voice-webrtc.md](voice-webrtc.md)
+
+## Related
+
+- [messaging.md](messaging.md) — full cross-context contract
+- [signaling.md](signaling.md) — WebSocket relay
+- Domain README: [`toju-app/src/app/domains/direct-message/README.md`](../../toju-app/src/app/domains/direct-message/README.md)
+
+## Changelog
+
+| Date | Change |
+|------|--------|
+| 2026-07-05 | Slimmed to index; comprehensive content moved to messaging.md |
@@ -0,0 +1,54 @@
+# Game Activity
+
+> **Status:** Active
+> **Last updated:** 2026-07-05
+
+## Overview
+
+"Now playing" game detection: Electron foreground-window/process heuristics, RAWG metadata match via signaling server, and P2P `game-activity` broadcast to peers. Shown on profile cards and room sidebars.
+
+## Responsibilities
+
+| Layer | Owns |
+|-------|------|
+| `game-activity` domain | Scan loop, confidence scoring, P2P broadcast, user store updates |
+| Electron IPC | `get-running-process-names`, `get-active-game-candidate` |
+| Signaling server | `POST /api/games/match` (RAWG proxy + miss cache) |
+| P2P | `game-activity` data-channel event |
+
+## Server API
+
+### `POST /api/games/match`
+
+- **Auth:** Public
+- **Body:** `{ processNames: string[], candidates?: { processName, score }[] }` (bounded list sizes)
+- **Response:** `{ game: MatchedGame | null }` — RAWG-backed title, cover art, store links
+
+Misses cached in server SQLite (`GameMatchMiss`) to limit API calls.
+
+## Client detection
+
+- Periodic scan (default 10 s, configurable 5–60 s in localStorage `metoyou_game_scan_interval_ms`).
+- Ignores launcher/helper processes via `IGNORED_PROCESS_NAMES` and regex patterns.
+- **Electron:** suppresses scan when MetoYou window is focused; prefers foreground-window candidate from `get-active-game-candidate`.
+- **Browser/Capacitor:** no process scan — activity only from P2P peers.
+
+## P2P event
+
+```json
+{ "type": "game-activity", "activity": { "game", "startedAt", "processName", ... } }
+```
+
+Peers merge into `User.gameActivity` in NgRx store.
+
+## Related
+
+- [signaling.md](signaling.md) — not WS-relayed
+- [server-directory.md](server-directory.md) — API base URL for match endpoint
+- Domain README: [`toju-app/src/app/domains/game-activity/README.md`](../../toju-app/src/app/domains/game-activity/README.md)
+
+## Changelog
+
+| Date | Change |
+|------|--------|
+| 2026-07-05 | Initial cross-context game-activity contract |
@@ -0,0 +1,65 @@
+# Invites & Join Requests
+
+> **Status:** Active
+> **Last updated:** 2026-07-05
+
+## Overview
+
+Invite links and join-request approval let users join private or moderated chat-servers without public listing. Spans signaling **server** REST + HTML invite pages and the product **client** `server-directory` invite feature.
+
+## Responsibilities
+
+- Server: create time-limited invites, resolve invite metadata, record join requests, notify requesters on moderation decisions.
+- Client: create/copy invite links, render invite landing UX, call join API with invite codes/passwords.
+- It does NOT own: WebSocket room membership (`join_server` after REST join succeeds).
+
+## Key concepts
+
+- **Invite:** opaque id mapping to a server; may expire.
+- **Join request:** pending membership when server requires approval.
+- **request_update:** server-pushed WebSocket notification when a moderator approves/denies.
+
+## REST API
+
+### Invites
+
+| Method | Path | Auth | Purpose |
+|--------|------|------|---------|
+| POST | `/api/servers/:id/invites` | Bearer | Create invite (moderator) |
+| GET | `/api/invites/:id` | Public | Resolve invite metadata + server card |
+| GET | `/invite/:id` | Public | HTML invite landing page (browser) |
+
+### Join
+
+| Method | Path | Auth | Purpose |
+|--------|------|------|---------|
+| POST | `/api/servers/:id/join` | Bearer | Join with password, invite id, or public access; may create join request |
+
+### Join requests (moderation)
+
+| Method | Path | Auth | Purpose |
+|--------|------|------|---------|
+| GET | `/api/servers/:id/requests` | Bearer (`manageServer`) | List pending requests |
+| PUT | `/api/requests/:id` | Bearer (`manageServer`) | Approve or deny; body `{ status }` |
+
+`PUT /api/requests/:id` validates optional `ownerId` matches authenticated user, checks `manageServer` permission, updates status, and sends `notifyUser(request.userId, { type: 'request_update', request })`.
+
+## Client flow
+
+1. Moderator creates invite via `ServerDirectoryFacade.createInvite()`.
+2. Recipient opens `/invite/:id` or deep link; client resolves `GET /api/invites/:id`.
+3. Authenticated user calls `POST /api/servers/:id/join` with invite payload.
+4. On approval-required servers, user waits for `request_update` or polls requests list (moderator UI).
+
+## Related
+
+- [server-directory.md](server-directory.md) — join/leave REST
+- [authentication.md](authentication.md) — bearer on mutations
+- [signaling.md](signaling.md) — `join_server` after join
+- Domain README: [`toju-app/src/app/domains/server-directory/README.md`](../../toju-app/src/app/domains/server-directory/README.md)
+
+## Changelog
+
+| Date | Change |
+|------|--------|
+| 2026-07-05 | Initial cross-context invite/join-request contract |
@@ -0,0 +1,44 @@
+# Klipy GIFs
+
+> **Status:** Active
+> **Last updated:** 2026-07-05
+
+## Overview
+
+GIF search in chat and DM composers via a **Klipy API proxy** on the signaling server. API keys stay server-side; clients call same-origin routes on the active signal server.
+
+## Responsibilities
+
+- Server: proxy/search Klipy API (`variables.json` `klipyApiKey`).
+- Client `chat` domain: `KlipyService`, composer picker; DMs reuse the same integration.
+
+## API
+
+### `GET /api/klipy/config`
+
+- **Auth:** Public
+- **Response:** `{ enabled: boolean }` — `enabled` when server has a configured API key
+
+### `GET /api/klipy/gifs`
+
+- **Auth:** Public
+- **Query:** `q` (search), `page`, `per_page` (default 24, max 50)
+- **Response:** Normalised `{ gifs: [{ id, slug, title, url, previewUrl, width, height }], hasNext }`
+- **Upstream:** `https://api.klipy.com/api/v1` with 8 s timeout
+
+## Client behavior
+
+- GIF picker visibility is resolved against the **current chat-server's** signal server (not a global offline endpoint) so KLIPY availability matches the room's backend.
+- Selected GIFs send as markdown image messages; rendering uses [link-preview-media-proxy.md](link-preview-media-proxy.md) image proxy when needed.
+
+## Related
+
+- [server-directory.md](server-directory.md) — per-room signal server for config
+- [direct-messaging.md](direct-messaging.md) — DM composer reuse
+- Domain README: [`toju-app/src/app/domains/chat/README.md`](../../toju-app/src/app/domains/chat/README.md)
+
+## Changelog
+
+| Date | Change |
+|------|--------|
+| 2026-07-05 | Initial Klipy proxy contract |
@@ -0,0 +1,46 @@
+# Link Preview & Media Proxy
+
+> **Status:** Active
+> **Last updated:** 2026-07-05
+
+## Overview
+
+The signaling server fetches untrusted URLs on behalf of clients for **link embed previews** and **image proxying**, with SSRF guards. Chat and DM composers render embeds using these endpoints.
+
+## Responsibilities
+
+- Server: outbound fetch with host validation, caching, size limits.
+- Client `chat` domain: request metadata when messages contain URLs; render cards in message list.
+- It does NOT store embeds long-term on the server beyond in-memory cache.
+
+## API
+
+### `GET /api/link-metadata`
+
+- **Auth:** Public
+- **Query:** `url` (http/https)
+- **Response:** `{ title?, description?, imageUrl?, siteName? }`
+- **Guards:** `resolveAndValidateHost` + `safeFetch`; 8 s timeout; HTML capped at 512 KB; in-memory cache sized by `variables.json` link-preview config
+
+### `GET /api/image-proxy`
+
+- **Auth:** Public
+- **Query:** `url` (http/https)
+- **Response:** Raw image bytes (`Content-Type` from origin)
+- **Limits:** image/* only; max 8 MB; 8 s timeout; SSRF validation
+- **Cache:** `Cache-Control: public, max-age=3600`
+
+## Client usage
+
+Message markdown / link-embed pipeline calls link-metadata for unfurling; proxied images load through `/api/image-proxy` when direct fetch would fail (CORS, mixed content).
+
+## Related
+
+- [server-directory.md](server-directory.md) — requests use active server's API base
+- Domain README: [`toju-app/src/app/domains/chat/README.md`](../../toju-app/src/app/domains/chat/README.md)
+
+## Changelog
+
+| Date | Change |
+|------|--------|
+| 2026-07-05 | Initial link preview / image proxy contract |
@@ -1,6 +1,14 @@
 # Message Integrity

-Signed, append-only **message revisions** give P2P chat a verifiable history without central message storage. The materialized `Message` row in local SQLite/IDB is a cache; peers converge via inventory snapshots and revision events.
+> **Area:** messaging
+> **Status:** Active
+> **Last updated:** 2026-07-05
+
+## Overview
+
+Signed, append-only **message revisions** give P2P chat a verifiable history without central message storage. The materialized `Message` row in local SQLite/IDB is a cache; peers converge via inventory snapshots (`revision`, `headHash`) and `message-revision` events.
+
+Parent transport and sync context: [messaging.md](messaging.md).

 ## Responsibilities

@@ -15,7 +23,7 @@ Signed, append-only **message revisions** give P2P chat a verifiable history wit
 | --- | --- |
 | Product client (`toju-app`) | Revision construction, merge, verification, P2P broadcast, local persistence |
 | Signaling server (`server`) | `PUT /api/users/me/signing-key`, `GET /api/users/:id/signing-public-key` — key directory only, no message storage |
-| Electron / mobile persistence | `revision` + `headHash` on message rows; revision audit log (IDB store / SQLite meta) |
+| Electron / mobile persistence | `revision` + `headHash` on message rows; revision audit log in IDB store (browser), SQLite `meta` table (Electron **and Capacitor** — keys `message-revision:<messageId>:<revision>`) |

 Plugin API messages may emit unsigned revisions (`plugin-edit` / `plugin-delete`) when the actor is a synthetic plugin user.

@@ -47,7 +55,23 @@ Plugin API messages may emit unsigned revisions (`plugin-edit` / `plugin-delete`
 | `PUT` | `/api/users/me/signing-key` | Bearer | `{ publicKeyJwk }` — stores Ed25519 public JWK on the user row |
 | `GET` | `/api/users/:id/signing-public-key` | Public | `{ publicKeyJwk }` — used by peers to verify signatures |

-Registration runs automatically after login/register via `AuthenticationService`.
+Registration runs automatically after **home** login/register via `AuthenticationService` — see [authentication.md](authentication.md) for foreign-server scope.
+
+## Multi-device relay (`account_sync`)
+
+`message-revision` chat events are relayable to sibling connections via WebSocket `account_sync` (alongside legacy `chat-message` paths documented in [authentication.md](authentication.md)). Inventory convergence still prefers P2P data-channel sync when peers are connected.
+
+## Related
+
+- [authentication.md](authentication.md) — signing-key registration, `account_sync` chat batches
+- [signaling.md](signaling.md) — `account_sync` envelope
+- [mobile-capacitor.md](mobile-capacitor.md) — Capacitor `meta` revision keys
+
+## Changelog
+
+| Date | Change |
+|------|--------|
+| 2026-07-05 | Capacitor meta persistence; account_sync cross-ref; signing registration scope |

 ## Degraded-mode behavior

@@ -0,0 +1,211 @@
+# Messaging
+
+> **Area:** messaging
+> **Status:** Active
+> **Last updated:** 2026-07-13
+
+## Overview
+
+Messaging in MetoYou covers two transports that share inventory-sync concepts and (for DMs) a monotonic delivery state machine. **Server-channel chat** is broadcast by the signaling server over WebSocket (`chat_message`) as a narrow fallback when P2P data channels are down — the server does not persist message bodies. **Direct messages** (1:1 and group DMs) are primarily peer-to-peer over the WebRTC ordered data channel, with WebSocket signaling relay when no channel is open and an offline queue when neither path succeeds.
+
+On both transports the client maintains local history (Electron SQLite / browser IndexedDB for server channels; user-scoped `localStorage` for DMs) and a **chunked inventory-sync protocol** so peers reconcile missing rows without flooding the link.
+
+This document is the cross-context contract: envelope names, sync protocol, delivery states, edit/delete rules, and storage boundaries. Internal NgRx orchestration lives in [`toju-app/src/app/domains/chat/README.md`](../../toju-app/src/app/domains/chat/README.md) and [`toju-app/src/app/domains/direct-message/README.md`](../../toju-app/src/app/domains/direct-message/README.md). WebSocket relay rules: [signaling.md](signaling.md). Signed revision chains: [message-integrity.md](message-integrity.md).
+
+## Responsibilities
+
+- Send server-channel chat over WebSocket fallback (`chat_message`) and primarily over P2P (`chat-message`, `edit-message`, `delete-message`, `message-revision`).
+- Send, edit, delete, and react in direct messages over the data channel with signaling fallback.
+- Carry typing indicators: server channels (`typing` → `user_typing`) and DMs (`direct-message-typing`).
+- Reconcile peer history via the inventory protocol (`chat-inventory` / `chat-sync-batch`; DM `direct-message-sync`).
+- Drive a monotonic DM delivery state machine: `QUEUED → SENT → DELIVERED → ACKNOWLEDGED`.
+- Relay multi-device chat via `account_sync` (`chat-message`, `message-revision`, `chat-sync-batch`).
+
+This area does **not** own:
+
+- Attachment payloads or chunked file transfer → [attachments.md](attachments.md).
+- WebRTC session setup and data-channel lifecycle → [voice-webrtc.md](voice-webrtc.md).
+- Write permission resolution (`writeMessages`, `manageMessages`, bans) → `toju-app/src/app/domains/access-control/README.md`.
+- Full WebSocket envelope catalog (identity, voice, plugins) → [signaling.md](signaling.md).
+
+## Key concepts
+
+- **Server-channel message** — room-scoped text in a saved chat-server. Primary path: P2P `chat-message` on the data channel. Fallback: server broadcasts `chat_message` to other connections in the room.
+- **Direct message** — 1:1 or group PM. Persisted per user under `metoyou_direct_message_*` keys (domain-owned storage, not the global messages CQRS table).
+- **Conversation** — DM thread (`direct` or `group`). Upgrading a 1:1 call to a group creates a **new** group conversation; the original 1:1 history is not copied.
+- **Inventory event** — `chat-inventory` (P2P): sender announces message ids plus integrity fields (`ts`, `rc`, `ac`, `revision`, `headHash`); receiver requests missing or stale ids.
+- **Sync batch** — `chat-sync-batch`: chunked response, **200 messages per envelope** (`CHUNK_SIZE` in `message-sync.rules.ts`).
+- **Delivery state** — DM-only enum: `QUEUED (0) → SENT (1) → DELIVERED (2) → ACKNOWLEDGED (3)`. Advanced only via `advanceDirectMessageStatus` (never backwards).
+- **Peer delivery** — `PeerDeliveryService` tries data channel, then signaling forward, then offline queue.
+
+---
+
+## Transports
+
+### Server-channel chat
+
+**P2P (primary):** `chat-message`, `edit-message`, `delete-message`, `message-revision`, reactions, and inventory events on the ordered data channel. See [message-integrity.md](message-integrity.md) for dual-emit revision behavior.
+
+**WebSocket (fallback):** Client sends `chat_message`; `handleChatMessage` (`server/src/websocket/handler.ts`) broadcasts to other connections in the room. The server does **not** handle `edit_message` or `delete_message` on the wire — edits and deletes are P2P (and `account_sync` for sibling devices).
+
+**Typing:** Client sends `typing`; server broadcasts `user_typing` (transient, no persistence).
+
+**Multi-device:** Sibling tabs receive live chat via `account_sync` payloads (`chat-message`, `message-revision`, `chat-sync-batch`). See [authentication.md](authentication.md).
+
+### Direct messages
+
+**P2P (primary):** Events on the shared ordered data channel (same peer connections as voice/chat).
+
+**WebSocket (fallback):** `PeerDeliveryService.sendViaSignaling` forwards these types to `targetUserId` without requiring shared server membership:
+
+| type | Purpose |
+|------|---------|
+| `direct-message` | New message |
+| `direct-message-status` | Delivery / ack |
+| `direct-message-mutation` | Edit, delete, reactions |
+| `direct-message-typing` | Typing indicator |
+| `direct-message-sync-request` | Request snapshot |
+| `direct-message-sync` | Bounded history merge |
+
+**Offline queue:** When both paths fail, `OfflineMessageQueueService` retains message ids; replay runs on `peerConnected$` / `networkRestored$` (no scheduled retry timer).
+
+### Storage
+
+| Data | Where |
+|------|--------|
+| Server-channel messages | `DatabaseService` → Electron SQLite or browser IndexedDB (`messages` store) |
+| Direct messages | `metoyou_direct_message_*` via direct-message repositories |
+| Signaling server | **No message bytes** — broadcast/relay only |
+
+---
+
+## Inventory / sync protocol
+
+Shared shapes in `toju-app/src/app/shared-kernel/chat-events.ts`:
+
+| Event | Role |
+|-------|------|
+| `chat-inventory-request` | Ask peer for inventory |
+| `chat-inventory` | Announce ids + integrity snapshots |
+| `chat-sync-request` | Request specific missing ids |
+| `chat-sync-batch` | Up to **200** messages per envelope |
+| `direct-message-sync-request` / `direct-message-sync` | DM-scoped snapshot merge |
+
+Rules (`message-sync.rules.ts`, `message-integrity.rules.ts`):
+
+- Merges are **additive** — sparser peers never wipe richer local history.
+- `findMissingIds` compares remote inventory to local `revision` / `headHash` (and legacy `ts` / `rc` / `ac`).
+- `INVENTORY_LIMIT` = `FULL_SYNC_LIMIT` = **20_000** (2026-07-14, RAM investigation; previously 1_000_000). Building an inventory or full-sync batch loads full message rows into memory, so the ceiling must stay bounded. Only the most recent 20k messages per room are reconciled peer-to-peer; older messages stay local-only. `ACCOUNT_SYNC_MESSAGE_LIMIT` follows `FULL_SYNC_LIMIT`.
+- Sync polling: 10 s when catching up, 15 min after a clean cycle (`SYNC_POLL_FAST_MS` / `SYNC_POLL_SLOW_MS`).
+- NgRx store retention: on room switch, inactive rooms are pruned to the most recent `CACHED_INACTIVE_ROOM_MESSAGE_LIMIT` = **100** messages each (`messages.reducer.ts`), keeping return-visit rendering instant while bounding store growth across many rooms. The active room is never pruned; the local DB keeps full history.
+
+---
+
+## Delivery state machine (DMs only)
+
+| Value | Numeric | Meaning |
+|-------|---------|---------|
+| `QUEUED` | 0 | Composed locally; no successful send yet |
+| `SENT` | 1 | Data channel or signaling forward accepted the payload |
+| `DELIVERED` | 2 | At least one recipient acknowledged receipt |
+| `ACKNOWLEDGED` | 3 | Full recipient set acknowledged (1:1: the peer; group: every participant) |
+
+`advanceDirectMessageStatus` only moves forward (`direct-message.logic.ts`). Server-channel messages have no application-level delivery enum; the UI treats them as sent once the transport accepts the event.
+
+---
+
+## Edit and delete
+
+**Server channels:** Outgoing edits check `canEditMessage(message, userId)` before broadcast. Incoming P2P `edit-message` / `delete-message` merge via NgRx handlers; signed paths prefer `message-revision` when integrity is enabled.
+
+**DMs:** `direct-message-mutation` with types `edit`, `delete`, `reaction-add`, `reaction-remove`. `applyMutation` in `DirectMessageService` updates by `messageId` but **does not verify** the mutator is the original author — a non-cooperating peer could mutate another user's row. Server chat enforces authorship on **outgoing** edits only.
+
+Deletes keep tombstone semantics (`isDeleted`, empty `content`) so inventory sync can converge.
+
+---
+
+## Business rules and invariants
+
+- The signaling server is **not authoritative** for message content — it relays `chat_message` and DM types opaquely.
+- DM events are **ignored** unless the local user is in `recipients` / `participants` or already has the conversation locally.
+- Recipient matching (DM **and** `direct-call`) must accept **every local identity alias** — home id, entity id, peer id, and each provisioned signal-server actor id from `SignalServerCredentialStoreService` — because senders who met the recipient on a foreign signal server address them by the provisioned actor id (`direct-message-identity.rules.ts`, `direct-call-participant-identity.rules.ts`).
+- DM status transitions are **monotonic**.
+- Inventory merges never downgrade a row with a newer `revision` / `headHash`.
+- 1:1 → group upgrade **does not copy** private history into the new group thread.
+- Unread counts are **idempotent by message id** — re-sync does not double-increment.
+- Incoming DMs raise a system notification via `NotificationsFacade.handleIncomingDirectMessage` (title = sender name; `shouldDeliverDirectMessageNotification` suppresses only when the conversation is on screen in an active window, notifications are disabled, or the user is busy). System messages (e.g. call-started) and deletions never notify. On Capacitor this flows through the same `DesktopNotificationService` → LocalNotifications routing as server chat.
+
+---
+
+## Technical implementation
+
+### Server
+
+- `server/src/websocket/handler.ts` — `handleChatMessage`, `handleTyping`, DM forward via `forwardRtcMessage` / `DIRECT_SIGNALING_TYPES`.
+- No message CQRS or entities on the server.
+
+### Product client
+
+| Area | Location |
+|------|----------|
+| Server chat effects / handlers | `store/messages/`, `domains/chat/` |
+| DM service / queue | `domains/direct-message/application/services/` |
+| Sync rules | `domains/chat/domain/rules/message-sync.rules.ts` |
+| Wire types | `shared-kernel/chat-events.ts`, `direct-message-contracts.ts` |
+| Account sync relay | `infrastructure/realtime/account-sync/` |
+
+### Electron
+
+- Server-channel rows: TypeORM `Message` entity + CQRS `save-message` / `delete-message`.
+- DMs: renderer `localStorage` repositories (not the main message table).
+
+---
+
+## Testing
+
+- Unit: `message-sync.rules.spec.ts`, `message-integrity.rules.spec.ts`, `message.rules.spec.ts`, `direct-message.service.spec.ts`, `direct-message.logic` specs, `messages-incoming.handlers.spec.ts`, `account-sync-chat.helper.spec.ts`.
+- E2E: `e2e/tests/chat/chat-message-features.spec.ts`, `multi-client-chat-sync.spec.ts`, `dm-flow.spec.ts`, `multi-device-attachment-sharing.spec.ts`, `e2e/tests/voice/dm-header-call-ring.spec.ts` (DM-header call ring, incl. cross-signal actor-id addressing).
+
+---
+
+## Performance considerations
+
+- Sync batches: **200 messages per `chat-sync-batch` envelope**.
+- `chat_message` broadcast is O(connections in room) per send.
+- Group DMs: O(recipients) transport attempts per message.
+
+---
+
+## Security considerations
+
+- **No end-to-end encryption** for message bodies. WebRTC data channels use DTLS; signaling fallback is TLS WebSocket; local DBs store plaintext.
+- **DM `applyMutation` does not verify authorship** on incoming mutations.
+- **No server-side rate limit** on `chat_message` volume.
+
+---
+
+## Known issues and limitations
+
+- **No server-side chat log** — late joiners depend on peers with local history or `account_sync` from a sibling device.
+- **DM mutation authorship** not verified on receive.
+- **Offline queue** replays only on peer connect / network restore events.
+
+---
+
+## Related features
+
+- [signaling.md](signaling.md) — WebSocket relay and ordering invariants
+- [message-integrity.md](message-integrity.md) — signed revision chains
+- [attachments.md](attachments.md) — file payloads alongside chat events
+- [voice-webrtc.md](voice-webrtc.md) — data channel transport
+- [authentication.md](authentication.md) — `account_sync` multi-device relay
+- [direct-messaging.md](direct-messaging.md) — short index (defers here)
+
+## Changelog
+
+| Date | Change |
+|------|--------|
+| 2026-07-14 | RAM bounds: `INVENTORY_LIMIT`/`FULL_SYNC_LIMIT` lowered to 20k (most recent messages reconcile); NgRx prunes inactive rooms to 100 cached messages on room switch |
+| 2026-07-13 | Incoming DMs raise system notifications through the notifications domain (previously unread-badge only) |
+| 2026-07-13 | Recipient matching for DM and `direct-call` events must span all local identity aliases (provisioned actor ids included) |
+| 2026-07-05 | Initial comprehensive messaging contract (replaces thin direct-messaging summary) |
@@ -31,10 +31,6 @@ npm run cap:sync
 npm run cap:open:android
 npm run cap:open:ios

-### Linux: Android Studio path
-
-Capacitor defaults to `/usr/local/android-studio/bin/studio.sh`. If Android Studio is installed elsewhere (common with **Flatpak** from Flathub), `npm run cap:open:android` uses `tools/resolve-android-studio-path.js` to locate `studio.sh` (Flatpak `active` symlink, Toolbox, snap, `/opt`, etc.). Override anytime with `CAPACITOR_ANDROID_STUDIO_PATH`.
-
 # Convenience (build + sync + open)
 npm run cap:build:android
 npm run cap:build:ios
@@ -44,6 +40,10 @@ npm run cap:apk:android
 # → toju-app/android/app/build/outputs/apk/debug/app-debug.apk
 ```

+### Linux: Android Studio path
+
+Capacitor defaults to `/usr/local/android-studio/bin/studio.sh`. If Android Studio is installed elsewhere (common with **Flatpak** from Flathub), `npm run cap:open:android` uses `tools/resolve-android-studio-path.js` to locate `studio.sh` (Flatpak `active` symlink, Toolbox, snap, `/opt`, etc.). Override anytime with `CAPACITOR_ANDROID_STUDIO_PATH`.
+
 Config: `toju-app/capacitor.config.ts` (`webDir: ../dist/client/browser`).

 ### CI (Gitea)
@@ -85,13 +85,15 @@ Re-run `npm run cap:assets:android` whenever `images/icon-new-rounded.png` chang
 | Feature | Status | Notes |
 |---------|--------|-------|
 | Push/local notifications | **Working (partial)** | Local notifications always available; remote push (FCM/APNs) registers only when Firebase/APNs is configured — app starts normally without `google-services.json` |
+| Chat message notifications | **Working** | `DesktopNotificationService` routes to `MobileNotificationsService.showMessage()` on Capacitor (LocalNotifications channel `toju-messages`); web `Notification` API is never used on native shells |
 | Server push dispatch | **Working (configured)** | Tokens persist in server SQLite; outbound FCM/APNs via env credentials |
 | In-call notifications | **Working (Capacitor)** | Persistent notification with answer/mute/hang-up actions |
 | Stream pop-out (PiP) | **Working (partial)** | Document PiP when WebView supports it; Android native PiP fallback via `MetoyouMobile` plugin |
 | Background voice | **Working (partial)** | Android foreground service; iOS `UIBackgroundModes` audio + CallKit active-call bridge |
 | iOS CallKit | **Working (partial)** | `MetoyouMobile.startCallKitSession` reports active calls; requires Xcode target wiring after `cap:sync` |
-| Screensharing | **Limited** | Disabled on iOS WebView; Android `getDisplayMedia` may work |
+| Screensharing | **Hidden on native mobile** | `getDisplayMedia` is unavailable in mobile WebViews; all screen-share buttons (private call, voice controls, floating controls, voice workspace) are gated behind `!viewport.isMobile() && !MobilePlatformService.isNativeMobile()` |
 | Composer attachments | **Working** | Mobile attachment button + hidden file input |
+| Attachment download/export | **Working** | `AttachmentDownloadService` delegates to `CapacitorAttachmentExportService` on native shells: copies disk-backed files (or fetches the object URL) into the public `Documents` directory with a timestamped name; anchor `download` links do nothing in the Android WebView |
 | Camera sharing | **Working** | Existing `getUserMedia` camera path in WebRTC stack |
 | Speakerphone | **Working (partial)** | Android `AudioManager` via `MetoyouMobile`; iOS `@capgo/capacitor-audio-session`; direct-call speaker toggle on native mobile |
 | Local DB (SQLite) | **Working** | `DatabaseService` routes Capacitor shells to `CapacitorDatabaseService` (native SQLite CRUD) |
@@ -103,7 +105,7 @@ Re-run `npm run cap:assets:android` whenever `images/icon-new-rounded.png` chang
 - **iOS CallKit:** Plugin Swift source ships in `ios/App/App/MetoyouMobilePlugin.swift`; add it to the Xcode target if not auto-linked. Incoming-call UI is not fully bridged to WebRTC answer/hang-up yet.
 - **iOS screenshare:** `getDisplayMedia` is not available in WKWebView.
 - **Android PiP:** Native PiP enters activity-level PiP; WebView video may not always render inside PiP on all OEM WebViews.
- **Production discovery:** `signal.toju.app` may not expose `/api/servers/featured` or `/trending`; client skips those calls for known hosts.
+- **Legacy discovery endpoints:** Older signal servers may not expose `/api/servers/featured` or `/trending` (they resolve as `/servers/:id` and return 404). The client still calls those routes on every online endpoint and **falls back per-endpoint to `GET /api/servers`** when 404 is returned — see [server-discovery.md](server-discovery.md).
 - **Push delivery:** Requires FCM service account and APNs key configuration on the signaling server.

 ## Push notification setup (FCM / APNs)
@@ -133,8 +135,11 @@ Declared in `toju-app/android/app/src/main/AndroidManifest.xml`:
 | `BLUETOOTH_CONNECT` | Bluetooth headset routing during calls (Android 12+) |
 | `POST_NOTIFICATIONS` | Incoming/active call notifications |
 | `FOREGROUND_SERVICE` / `FOREGROUND_SERVICE_MICROPHONE` | Background voice session |
+| `READ_EXTERNAL_STORAGE` (maxSdk 32) / `WRITE_EXTERNAL_STORAGE` (maxSdk 29) | Attachment export to public `Documents` on Android 10 and below |

-Before WebRTC capture, the client calls `MobileMediaService.ensureVoiceCapturePermissions()` / `ensureCameraCapturePermissions()`, which delegate to `MetoyouMobile.requestVoiceCapturePermissions()` / `requestCameraCapturePermissions()` on Capacitor shells. If the native plugin is unavailable or the bridge call fails, capture preflight defers to the WebView `getUserMedia` permission flow instead of aborting voice/camera joins.
+Before WebRTC capture, the client calls `MobileMediaService.ensureVoiceCapturePermissions()` / `ensureCameraCapturePermissions()`, which delegate to `MetoyouMobile.requestVoiceCapturePermissions()` / `requestCameraCapturePermissions()` on Capacitor shells. If the native plugin is unavailable or the bridge call fails, capture preflight defers to the WebView `getUserMedia` permission flow instead of aborting voice/camera joins. Preflight only blocks capture on an explicit native `denied` state (`mobile-media-permission.rules.ts`); a `prompt` state is deferred to the WebView so the user still gets the permission dialog.
+
+Join and capture failures are surfaced in the UI instead of failing silently: `DirectCallService.joinCall` sets a `joinError` signal (`call.errors.*` i18n keys for signaling, capture-unsupported, mic permission, and mic unavailable cases), and the private-call and voice-controls components surface camera errors the same way.

 On Capacitor startup, `MobileRuntimePermissionsService` (via `MobileAppLifecycleService.initialize()`) proactively prompts for microphone, camera, local-notification, and push-notification runtime permissions so Android 13+ shells do not keep every permission in the "Not allowed" state until the user joins voice or receives a call.

@@ -165,16 +170,19 @@ Tokens persist in server SQLite (`device_tokens` table). Outbound push uses repo
 | `APNS_BUNDLE_ID` | Defaults to `com.metoyou.app` |
 | `APNS_USE_SANDBOX` | `true` for development builds |

-Manual dispatch (ops/testing):
+Manual dispatch (ops/testing). Requires `Authorization: Bearer`; `:userId` in the path **must match** the authenticated user (`403` otherwise):

 ```http
 POST /api/users/device-tokens/:userId/dispatch
+Authorization: Bearer <token>
 { "title": "Incoming call", "body": "Alice is calling" }
 ```

+`POST /api/users/device-tokens` and `GET /api/users/device-tokens/:userId` apply the same rule: body/param `userId` must equal the bearer identity.
+
 ## Android foreground service

-`VoiceCallForegroundService` starts when `MobileCallSessionService` begins an active call. Required manifest permissions:
+`VoiceCallForegroundService` starts when `MobileCallSessionService` begins an active call. The voice-channel path also starts/stops it directly: `MediaManager.enableVoice()` / `disableVoice()` call `startMobileVoiceForegroundSession()` / `stopMobileVoiceForegroundSession()` (`infrastructure/mobile/logic/mobile-voice-foreground-session.ts`) so channel voice keeps the mic alive when the app backgrounds. Required manifest permissions:

 - `FOREGROUND_SERVICE`
 - `FOREGROUND_SERVICE_MICROPHONE`
@@ -193,10 +201,13 @@ The service shows a low-importance ongoing notification while a call is active.
 - Routing: `infrastructure/persistence/database-backend.rules.ts` — Capacitor uses SQLite, not IndexedDB.
 - Per-user database files: `metoyou__<userId>` via `mobile-sqlite-database-name.rules.ts`.
 - First launch runs DDL migrations stored in the `meta` table. Schema init failures are cached per database file so the client does not retry in a loop.
+- **Custom emoji assets** persist in the `custom_emojis` table (`CapacitorDatabaseService.saveCustomEmoji` / `getCustomEmojis` / `deleteCustomEmoji`).
+- **Message revisions** persist in `meta` under keys `message-revision:<messageId>:<revision>` (JSON payload). See [message-integrity.md](message-integrity.md) and [custom-emoji.md](custom-emoji.md).

 ## Capacitor plugin loading

- `infrastructure/mobile/adapters/capacitor/capacitor-plugin-loader.ts` uses **static** `@capacitor/*` imports and `Capacitor.isPluginAvailable()` before returning a plugin. Do not `import()` plugin modules dynamically or `await` plugin objects (Capacitor proxies expose a throwing `.then()` stub).
+- `infrastructure/mobile/adapters/capacitor/capacitor-plugin-loader.ts` loads `@capacitor/*` modules via **dynamic `import()`** only when `isCapacitorNativeRuntime()` is true, and checks `Capacitor.isPluginAvailable()` before returning a plugin. Electron and browser shells never evaluate these imports at startup.
+- Do not `await` a Capacitor plugin proxy object directly — Capacitor proxies expose a throwing `.then()` stub; always call methods on the resolved plugin instance.
 - After adding or upgrading Capacitor plugins, run `npm run build:prod && npm run cap:sync` so Android/iOS native projects register `App`, `AppUpdate`, `LocalNotifications`, push, and SQLite.

 ## Safe area (Android)
@@ -267,10 +278,16 @@ Phase 3 delivered:
 3. iOS CallKit bridge (partial) via `MetoyouMobile` plugin and `MobileCallKitService`.
 4. Android Firebase Gradle wiring with `google-services.json.example` (real file gitignored).
 5. Capacitor plugin availability checks to avoid hard failures when plugins are missing pre-sync.
-6. Discovery endpoint skip for production signal hosts without featured/trending routes.
+6. Discovery 404 fallback to public server listing on legacy signal hosts (see [server-discovery.md](server-discovery.md)).

 Remaining work:

 - Wire CallKit answer/end actions back into `DirectCallService`.
 - Migrate legacy IndexedDB mobile data into SQLite where needed.
- Deploy featured/trending routes to production signal servers or add capability negotiation in health checks.
+
+## Changelog
+
+| Date | Change |
+|------|--------|
+| 2026-07-13 | Chat notifications routed to LocalNotifications (`toju-messages` channel + `ic_stat_metoyou` status icon); capture preflight blocks only on native `denied`; call join/camera errors surfaced via `call.errors.*`; voice channels start the foreground service; screen share hidden on native mobile; attachment export to `Documents`; full-screen overlays use `metoyou-fixed-safe-viewport` |
+| 2026-07-05 | Corrected discovery fallback (not host skip), plugin-loader dynamic imports, markdown fence; added Capacitor custom-emoji/revision persistence and dispatch auth rules |
@@ -0,0 +1,70 @@
+# Plugins
+
+> **Status:** Active
+> **Last updated:** 2026-07-05
+
+## Overview
+
+Client-only plugin runtime with server-stored **metadata** (install requirements, event definitions) and Electron-local **plugin data** persistence. Plugins extend chat slash commands, toolbar actions, DOM mounts, and a P2P message bus — they never execute on the signaling server.
+
+## Responsibilities
+
+| Layer | Owns |
+|-------|------|
+| Product client (`plugins` domain) | Manifest validation, load order, `PluginHostService`, UI registry, store installs |
+| Electron | Local manifest discovery (`plugins/`, `plugin-bundles/`), `plugin_data` CQRS table, path jail |
+| Signaling server | Requirement/event metadata REST + `plugin_event` WebSocket broadcast; **no** plugin code execution |
+| P2P data channel | `plugin-message-bus` events (ignored by chat reducers) |
+
+Server plugin **data** HTTP routes return **410 Gone** (`PLUGIN_DATA_DISABLED`).
+
+## Server REST (`/api/servers/:serverId/plugins`)
+
+| Method | Path | Auth |
+|--------|------|------|
+| GET | `/` | Public (metadata snapshot) |
+| PUT | `/:pluginId/requirement` | Bearer |
+| DELETE | `/:pluginId/requirement` | Bearer |
+| PUT | `/:pluginId/events/:eventName` | Bearer |
+| DELETE | `/:pluginId/events/:eventName` | Bearer |
+| GET/PUT/DELETE | `/:pluginId/data/*` | 410 (disabled) |
+
+## WebSocket
+
+| type | Direction | Purpose |
+|------|-----------|---------|
+| `plugin_requirements` | Server → client | Snapshot after `join_server` / `view_server` |
+| `plugin_event` | Client → server → room | Validated broadcast of plugin events |
+| `plugin_error` | Server → client | Validation failure |
+
+See [signaling.md](signaling.md).
+
+## Manifest scopes
+
+- `scope: "client"` — global desktop/browser plugins (Settings → Client plugins).
+- `scope: "server"` — per chat-server plugins; join may block until user consents to required plugins.
+
+Store source manifests support HTTPS `bundle`/`bundleUrl` with optional SHA-256 `integrity` verification before `import()`.
+
+## Electron IPC / storage
+
+- `list-local-plugin-manifests`, `get-local-plugins-path`, `grant-plugin-read-root`
+- Plugin preferences and `api.clientData` / `api.serverData` → `plugin_data` table (user-scoped)
+- Cached bundles: `plugin-bundles/<plugin-id>/<version>/main.js`
+
+## Client API surface (summary)
+
+Plugins receive `TojuClientPluginApi`: `commands`, `ui.mountElement`, `ui.registerToolbarAction`, `messageBus`, `messages.setTyping`, `context.getCurrent()`, `clientData`/`serverData` async storage.
+
+## Related
+
+- [signaling.md](signaling.md) — `plugin_event`, `plugin_requirements`
+- [server-directory.md](server-directory.md) — server-scoped install on join
+- [authentication.md](authentication.md) — bearer on metadata mutations
+- Domain README: [`toju-app/src/app/domains/plugins/README.md`](../../toju-app/src/app/domains/plugins/README.md)
+
+## Changelog
+
+| Date | Change |
+|------|--------|
+| 2026-07-05 | Initial cross-context plugin contract |
@@ -0,0 +1,53 @@
+# Push Notifications
+
+> **Status:** Active
+> **Last updated:** 2026-07-05
+
+## Overview
+
+Mobile remote push (FCM/APNs) and server-side device token storage. Desktop uses local/Electron notifications via the `notifications` domain.
+
+## Responsibilities
+
+| Layer | Owns |
+|-------|------|
+| Signaling server | `device_tokens` SQLite table; FCM/APNs dispatch |
+| Capacitor client | Token registration via `MobilePushRegistrationService` |
+| Server env | FCM service account + APNs key configuration |
+
+## REST API (`/api/users/device-tokens`)
+
+All routes require bearer; `userId` must match authenticated identity.
+
+| Method | Path | Purpose |
+|--------|------|---------|
+| POST | `/` | Upsert `{ userId, platform: "android"\|"ios", token }` |
+| GET | `/:userId` | List tokens for user |
+| POST | `/:userId/dispatch` | Manual push `{ title, body, data? }` (ops/testing) |
+
+## Server configuration
+
+Repository-root `.env`:
+
+| Variable | Purpose |
+|----------|---------|
+| `FCM_SERVICE_ACCOUNT_PATH` or `FCM_SERVICE_ACCOUNT_JSON` | Android FCM HTTP v1 |
+| `APNS_KEY_PATH`, `APNS_KEY_ID`, `APNS_TEAM_ID` | iOS APNs HTTP/2 |
+| `APNS_BUNDLE_ID` | Default `com.metoyou.app` |
+| `APNS_USE_SANDBOX` | Development builds |
+
+## Mobile client
+
+- Optional Firebase: app starts without `google-services.json`; registration skipped when remote push not configured.
+- See [mobile-capacitor.md](mobile-capacitor.md) for FCM/APNs setup, permissions, and in-call local notifications.
+
+## Related
+
+- [authentication.md](authentication.md) — bearer + userId match rules
+- [mobile-capacitor.md](mobile-capacitor.md) — client registration and foreground service
+
+## Changelog
+
+| Date | Change |
+|------|--------|
+| 2026-07-05 | Initial push notification contract |
@@ -0,0 +1,96 @@
+# Server Directory
+
+> **Area:** server-directory
+> **Status:** Active
+> **Last updated:** 2026-07-05
+
+## Overview
+
+Server directory is the cross-context contract for **which signaling servers exist**, how clients health-check and route to them, and how public/private chat-servers are created, joined, updated, moderated, and discovered over REST. It spans the signaling **server** (`server/src/routes/servers.ts`, CQRS handlers) and the product **client** (`server-directory` domain + `ServerDirectoryFacade`).
+
+Curated browse lists (featured/trending) are documented separately in [server-discovery.md](server-discovery.md). WebSocket membership (`join_server`, presence) is in [signaling.md](signaling.md).
+
+## Responsibilities
+
+- Server: persist public server records, memberships, channels, roles, bans, invites, join requests; expose REST CRUD and access checks.
+- Client: maintain configured endpoint list, health/compatibility probes, canonical endpoint dedup by `serverInstanceId`, room `sourceId`/`sourceUrl` affinity, and HTTP orchestration for all server operations.
+- It does NOT own: P2P chat transport, voice WebRTC, or local Electron room/message persistence (except mirroring server metadata into local DB after join).
+
+## Key concepts
+
+- **ServerEndpoint:** configured signaling base URL with health status, latency, and version compatibility.
+- **ServerInfo:** public server card shape returned by search/discovery/GET — includes `sourceId`, `sourceName`, `sourceUrl` filled by the client API layer.
+- **Room signal affinity:** each saved room records which endpoint registered it; reconnect prefers that URL before fallback endpoints.
+- **serverInstanceId:** stable id from `GET /api/health` used to collapse alias URLs to one canonical endpoint.
+
+## Public REST (no bearer)
+
+| Method | Path | Purpose |
+|--------|------|---------|
+| GET | `/api/health` | Liveness, `serverVersion`, `serverInstanceId`, optional `serverTag` |
+| GET | `/api/servers` | Free-text search / public listing (`q`, `limit`) |
+| GET | `/api/servers/featured` | Curated popular list — [server-discovery.md](server-discovery.md) |
+| GET | `/api/servers/trending` | Curated active list — [server-discovery.md](server-discovery.md) |
+| GET | `/api/servers/:id` | Single server metadata |
+
+## Protected REST (bearer required)
+
+All mutations derive the actor from the session token; body user ids are not trusted.
+
+| Method | Path | Purpose |
+|--------|------|---------|
+| POST | `/api/servers` | Register a new public server |
+| PUT | `/api/servers/:id` | Update name, description, channels, icon metadata, access settings |
+| DELETE | `/api/servers/:id` | Unregister server (owner) |
+| POST | `/api/servers/:id/join` | Join or request access (password, invite, public) |
+| POST | `/api/servers/:id/leave` | Leave membership |
+| POST | `/api/servers/:id/heartbeat` | Refresh `lastSeen` for trending ranking |
+| POST | `/api/servers/:id/invites` | Create invite link — [invites-join-requests.md](invites-join-requests.md) |
+| GET | `/api/servers/:id/requests` | List pending join requests (moderators) |
+| POST | `/api/servers/:id/moderation/kick` | Remove member |
+| POST | `/api/servers/:id/moderation/ban` | Ban member (optional expiry) |
+| POST | `/api/servers/:id/moderation/unban` | Lift ban |
+
+Join-request approval: `PUT /api/requests/:id` — [invites-join-requests.md](invites-join-requests.md).
+
+Plugin metadata under `/api/servers/:serverId/plugins` — [plugins.md](plugins.md).
+
+## Client endpoint lifecycle
+
+1. Load endpoints from `localStorage` (`metoyou_server_endpoints`); reconcile with environment defaults.
+2. `testAllServers()` probes `GET /api/health` (5 s timeout); on failure falls back to `GET /api/servers`.
+3. Mark incompatible when `serverVersion` fails semantic compatibility check.
+4. `resolveCanonicalEndpoint()` collapses aliases sharing the same `serverInstanceId`.
+5. Cold-start room reconnect waits for the initial health sweep before opening WebSockets.
+
+## Multi-endpoint behavior
+
+| Operation | Fan-out |
+|-----------|---------|
+| Search (`searchServers` with `searchAllServers`) | All online endpoints, dedupe by server id |
+| Discovery (featured/trending) | All online endpoints + 404→public list fallback |
+| Room CRUD/join | Authoritative room `sourceUrl` first; temporary fallback to other compatible endpoints on outage |
+
+Only `status === 'incompatible'` stops fallback with an update-required message. Network errors and Cloudflare 521/522 must continue to the next endpoint.
+
+## Server-owned channel metadata
+
+`PUT /api/servers/:id` persists the server's `channels` array (text + voice). The client round-trips channel create/rename/delete through this API — local-only channel state is not authoritative. Server-side normalisation deduplicates names within each channel type.
+
+## WebSocket complement
+
+After REST join, the client sends `join_server` on the room's signaling URL. Presence (`server_users`, `user_joined`, `user_left`) is room-scoped on the WebSocket — see [signaling.md](signaling.md).
+
+## Related
+
+- [server-discovery.md](server-discovery.md) — featured/trending ranking and browse UI
+- [authentication.md](authentication.md) — bearer tokens for mutations
+- [invites-join-requests.md](invites-join-requests.md) — invite links and approval workflow
+- [signal-server-tag.md](signal-server-tag.md) — `serverTag` on health + profile cards
+- Product-client domain README: [`toju-app/src/app/domains/server-directory/README.md`](../../toju-app/src/app/domains/server-directory/README.md)
+
+## Changelog
+
+| Date | Change |
+|------|--------|
+| 2026-07-05 | Initial cross-context server-directory REST contract |
@@ -2,7 +2,7 @@

 > **Area:** server-directory
 > **Status:** Active
-> **Last updated:** 2025-02-14
+> **Last updated:** 2026-07-05

 ## Overview

@@ -67,13 +67,24 @@ Both endpoints live in `server/src/routes/servers.ts` and **must be registered b
 ## Client internals

 - `ServerDirectoryApiService.getFeaturedServers()` / `getTrendingServers()` call the routes through a shared private `getDiscoveryServers(path)` helper and normalise into `ServerInfo[]`.
+- **Multi-endpoint fan-out:** discovery queries **every online endpoint** (`getSearchableEndpoints()` + `forkJoin`), deduplicated by server ID — mirroring free-text search. Querying only the active endpoint made the default `/servers` view appear empty when populated servers lived on other endpoints.
+- **Legacy 404 fallback:** when `GET /api/servers/featured` or `/trending` returns **404** (older signal servers resolve those paths as `/servers/:id`), `fetchDiscoveryFromEndpoint` falls back per-endpoint to the public `GET /api/servers` listing (`fetchPublicServerListForDiscovery`) instead of returning `[]`. Verified in `server-directory-api.service.spec.ts` (including production hosts like `signal.toju.app`).
 - `ServerDirectoryService` → `ServerDirectoryFacade` expose `getFeaturedServers()` / `getTrendingServers()` as the domain boundary.
 - `FindServersComponent` (`/servers`) composes **Recently active** (the user's saved rooms, capped at 6), **Featured**, and **Trending** sections, all rendered through `app-server-browser` with `[showMyServers]="true"`.
 - `DashboardComponent` (`/dashboard`) is a single-column landing page (max-width centered, no in-page sidebars): a header greeting (no emoji), a global search with `Ctrl+K` focus and localStorage-backed **Recent Searches** chips shown beneath it, three primary action cards (Find People → `/people`, Find Servers → `/servers`, Create Server → `/create-server` — one link each), and discovery panels **People you might know**, **Popular Servers**, **Your Friends**, and **Recently Active Servers**. Each list is capped at 5 (`DISCOVERY_LIMIT`). It loads `popularServers` on init from `getFeaturedServers(5)`, falling back to `getTrendingServers(5)` when featured is empty; reuses `app-friend-button` for Add and `app-user-avatar` for people rows. `peopleYouMightKnow` excludes existing friends (via `FriendService.friendIds()`); `friends` lists discovered people who are friends. "See all" header links route to the matching `/people` or `/servers` page (no duplicated footer links). Recent searches are recorded on Enter (deduped, most-recent-first, capped at 8) and persisted under `metoyou_dashboard_recent_searches`.
 - The servers-rail top button (`servers-rail.component`) is the **Dashboard** button (`lucideLayoutDashboard`, `title="Dashboard"`); its `goToDashboard()` handler deselects any active voice server and navigates to `/dashboard`. A **Create a server** button (`lucidePlus`, `data-testid="server-rail-create"`) sits below the saved-server icons and opens `app-create-server-dialog` (a Toju modal on desktop / bottom sheet on mobile) which dispatches `RoomsActions.createRoom` directly; the dashboard / `/create-server` route remains as an alternative entry point. Rail icons (`h-12 w-12`, `md:h-11 w-11`) animate their corner radius on hover and `:active` for a Discord-style squircle effect.
- On mobile (`ViewportService.isMobile()`), `DashboardComponent`, `FindPeopleComponent` (`/people`), and `FindServersComponent` (`/servers`) each mount their page body inside a single `<swiper-container>` slide next to `app-servers-rail` (rail `shrink-0`, content `flex-1` with a left border), mirroring the chat-room / DM-workspace mobile layout so the primary navigation rail stays reachable. The page body is shared between the desktop and mobile branches via an `<ng-template #pageContent>` + `[ngTemplateOutlet]`, and each component declares `schemas: [CUSTOM_ELEMENTS_SCHEMA]` for the Swiper custom elements.
+- On mobile (`ViewportService.isMobile()`), discovery routes (`/dashboard`, `/people`, `/servers`) render their page body full-width via `<ng-template #pageContent>` + `[ngTemplateOutlet]`. The **servers rail is global** in `app.html` (`shouldShowMobileAppServersRail` in `core/platform/mobile-shell-layout.rules.ts`) — discovery pages must **not** embed a second `<app-servers-rail>` or Swiper stack. Chat-room and DM-workspace routes keep their own embedded rail inside Swiper and hide the global shell rail (see `toju-app/AGENTS.md`).

 ## Related

 - Product-client domain README: `toju-app/src/app/domains/server-directory/README.md`
+- Full server-directory REST contract (CRUD, join, moderation): [server-directory.md](server-directory.md)
 - People discovery (`/people`): `toju-app/src/app/domains/direct-message/README.md`
+- Mobile shell: [mobile-capacitor.md](mobile-capacitor.md)
+
+## Changelog
+
+| Date       | Change                                                                                                         |
+| ---------- | -------------------------------------------------------------------------------------------------------------- |
+| 2026-07-05 | Added multi-endpoint fan-out and 404 fallback; corrected mobile shell layout (global rail, no per-page Swiper) |
+| 2025-02-14 | Initial documentation                                                                                          |
@@ -1,10 +1,18 @@
 # Signal Server Tag

+> **Status:** Active
+> **Last updated:** 2026-07-05
+
 Users registered on a signal server can show that server's display tag on their profile card (opened by clicking their name or avatar).

+## Responsibilities
+
+- Server: expose a human-readable tag per **endpoint** (not per user identity).
+- Client: resolve tag for a user's **home** signaling server (`homeSignalServerUrl`) and render on profile cards.
+
 ## Server configuration

-`server/data/variables.json` accepts an optional `serverTag` string. When omitted, the server falls back to its public URL built from `serverProtocol`, `serverHost`, and `serverPort`.
+`server/data/variables.json` accepts an optional `serverTag` string. When omitted, the server falls back to its public URL built from `serverProtocol`, `serverHost`, and `serverPort` (`server/src/config/variables.ts`).

 ## Health API

@@ -12,11 +20,27 @@ Users registered on a signal server can show that server's display tag on their

 ## WebSocket presence

-The client sends `homeSignalServerUrl` in `identify` messages. The signaling server echoes that value in `server_users` and `user_joined` payloads so other clients can resolve the correct tag.
+The client sends `homeSignalServerUrl` in `identify` messages. The signaling server echoes that value in `server_users` and `user_joined` payloads so other clients can resolve the correct tag. See [signaling.md](signaling.md).

 ## Client behavior

 - Login and registration store `homeSignalServerUrl` on the current user.
- Profile cards show the resolved tag beside the username in muted text.
+- Profile cards show the resolved tag beside the username in muted text (`profile-signal-server-tag.component`).
 - Configured labels render as `#tag`; URL fallbacks render as a globe icon with the URL in a tooltip.
- Tag resolution prefers the endpoint's cached `serverTag` from health checks, then falls back to the stored home URL.
+- Tag resolution (`signal-server-tag.rules.ts`): match `homeSignalServerUrl` against configured endpoints and prefer cached health `serverTag`; otherwise show the raw URL fallback.
+
+## Testing
+
+- `toju-app/src/app/domains/server-directory/domain/logic/signal-server-tag.rules.spec.ts`
+- `server/src/websocket/handler-status.spec.ts` (presence payload includes `homeSignalServerUrl`)
+
+## Related
+
+- [server-directory.md](server-directory.md) — endpoint health cache
+- [authentication.md](authentication.md) — `homeSignalServerUrl` on identify
+
+## Changelog
+
+| Date | Change |
+|------|--------|
+| 2026-07-05 | Clarified per-endpoint tag vs per-user home URL; added test references |
@@ -0,0 +1,152 @@
+# Signaling (WebSocket)
+
+> **Area:** realtime
+> **Status:** Active
+> **Last updated:** 2026-07-05
+
+## Overview
+
+The signaling server exposes a single WebSocket per origin that carries identity, room membership, presence, WebRTC SDP/ICE relay, selected server-relayed chat/DM/voice fallbacks, plugin events, and multi-device `account_sync`. The product client implements the consumer in `toju-app/src/app/infrastructure/realtime/signaling/`.
+
+**Canonical contract:** this document and [`server/src/websocket/handler.ts`](../../server/src/websocket/handler.ts). Do **not** treat `toju-app/src/app/shared-kernel/signaling-contracts.ts` as authoritative — it lists legacy types (`join`, `leave`, `chat`, `ice-candidate`) that do not match the live server.
+
+## Responsibilities
+
+- Authenticate connections via `identify` (session token).
+- Track per-connection room membership and broadcast room-scoped presence.
+- Relay WebRTC offers/answers/ICE between peers that share server membership (or DM/direct-call rules).
+- Relay narrow server fallbacks when P2P data channels are unavailable (chat, DM, voice presence).
+- Forward `account_sync` payloads to sibling connections for the same user identity.
+- It does NOT own: P2P data-channel payloads (attachments, message inventory, custom emoji chunks, plugin message bus), local persistence, or REST server-directory APIs.
+
+## Key concepts
+
+- **Envelope:** JSON object with required `type` string; additional fields vary by type.
+- **oderId:** user identity on the wire (legacy spelling, matches server code).
+- **clientInstanceId:** per-tab/device id stored in `sessionStorage`; multiple open connections per `oderId` are allowed.
+- **connectionScope:** optional string grouping connections (e.g. browser profile).
+- **voiceActive:** server marks the connection that owns outbound RTC relay for a user; updated from `voice_state` payloads.
+
+## Ordering invariants
+
+1. **`identify` before anything else** — unauthenticated connections receive `auth_required` for all types except `identify` and `keepalive`.
+2. **Per-connection serialization** — `handleWebSocketMessage` chains handlers per `connectionId` so `join_server` cannot run while `identify` is still awaiting the token DB lookup.
+3. **Client replay on reconnect** — `SignalingManager.reIdentifyAndRejoin` sends `identify` then re-joins rooms; see [`toju-app/src/app/infrastructure/realtime/README.md`](../../toju-app/src/app/infrastructure/realtime/README.md).
+
+## Connection lifecycle (server → client)
+
+On connect the server assigns a `connectionId` and may emit:
+
+| type | When |
+|------|------|
+| `connected` | Immediately after WebSocket open (`server/src/websocket/index.ts`) |
+
+On disconnect, if the connection was voice-active, the server broadcasts a cleared `voice_state` via `finalizeVoiceDisconnectForConnection`.
+
+## Inbound types (client → server)
+
+| type | Auth | Behavior |
+|------|------|----------|
+| `keepalive` | Optional | Responds `keepalive_ack` with `serverTime` |
+| `identify` | N/A (establishes auth) | Validates session token; sets `oderId`, profile fields; evicts stale same `(oderId, connectionScope, clientInstanceId)` sockets; emits `account_sync_peer_online` to siblings |
+| `join_server` | Required | Access check; adds `serverId` to connection; sends `server_users` + `plugin_requirements`; may broadcast `user_joined` (identity-aware) |
+| `view_server` | Required | Switches `viewedServerId`; refreshes `server_users` + `plugin_requirements` |
+| `leave_server` | Required | Removes membership; may broadcast `user_left` with remaining `serverIds` |
+| `offer`, `answer`, `ice_candidate` | Required | Relay to `targetUserId` when peers share server membership |
+| `direct-message`, `direct-message-status`, `direct-message-mutation`, `direct-message-typing`, `direct-message-sync-request`, `direct-message-sync`, `direct-call` | Required | Relay to `targetUserId` (DM rules — no shared-server requirement) |
+| `server_icon_peer_request`, `server_icon_peer_data` | Required | Relay when both users share `serverId` membership |
+| `chat_message` | Required | Broadcast to server members (excludes sender connection) |
+| `voice_state` | Required | Updates `voiceActive` / snapshot; broadcast to server members |
+| `voice_client_takeover` | Required | Notifies sibling connections via `notifyOtherConnectionsForOderId` |
+| `account_sync` | Required | Forwards `payload` object to other connections for same `oderId` |
+| `typing` | Required | Broadcast `user_typing` to server members |
+| `status_update` | Required | Broadcast `status_update` (`online` \| `away` \| `busy` \| `offline`) to joined servers |
+| `server_icon_available` | Required | Records local `iconUpdatedAt` per server on the connection |
+| `server_icon_sync_request` | Required | Responds `server_icon_sync_peers` with peers having newer icons |
+| `plugin_event` | Required | Validates against server plugin metadata; broadcast or `plugin_error` |
+
+Unknown inbound types are logged and ignored.
+
+### `identify` request fields
+
+| Field | Required | Notes |
+|-------|----------|-------|
+| `token` | Yes | Session token from REST login/register |
+| `oderId` | No | If present, must match token user id |
+| `displayName` | No | Defaults to existing or `"User"` |
+| `description`, `profileUpdatedAt`, `homeSignalServerUrl` | No | Profile card fields |
+| `clientInstanceId` | No | Per-tab id for multi-device and voice ownership |
+| `connectionScope` | No | Eviction scope for stale sockets |
+
+Errors: `auth_error` with `MISSING_TOKEN`, `INVALID_TOKEN`, or `USER_ID_MISMATCH`.
+
+## Server-emitted types (server → client)
+
+| type | Trigger |
+|------|---------|
+| `keepalive_ack` | Response to `keepalive` |
+| `auth_required` | Message before `identify` |
+| `auth_error` | Failed `identify` |
+| `access_denied` | `join_server` rejected (`serverId`, `reason`) |
+| `server_users` | After join/view; lists unique users in room |
+| `user_joined` | New identity in server (excludes same identity's connections) |
+| `user_left` | Identity fully left server (`serverIds` = remaining rooms) |
+| `plugin_requirements` | Plugin install snapshot after join/view |
+| `plugin_error` | Invalid plugin event |
+| `server_icon_sync_peers` | Response to `server_icon_sync_request` |
+| `account_sync_peer_online` | Sibling connection came online |
+| `account_sync` | Relayed multi-device payload |
+| `chat_message` | Relayed room chat fallback |
+| `user_typing` | Typing indicator |
+| `status_update` | Presence status change |
+| `voice_state` | Voice roster / disconnect cleanup |
+| `voice_client_takeover` | Another tab took voice ownership |
+| `plugin_event` | Broadcast plugin event |
+| Forwarded RTC/DM | Copies of client messages with `fromUserId` set |
+
+## Relay rules
+
+- **RTC (`offer` / `answer` / `ice_candidate`):** forwarded when sender and target share any server membership.
+- **Direct signaling types:** forwarded to `targetUserId` without shared-server check.
+- **Server icon P2P:** both users must be members of `message.serverId`.
+- **Broadcasts** (`chat_message`, `voice_state`, `typing`, etc.): exclude sender **connection id** (not whole identity) so multi-device sessions still receive updates.
+- **`user_joined` / `user_left`:** exclude whole **identity** so other users do not see duplicate join/leave for multiple tabs.
+
+## P2P vs signaling split
+
+| Transport | Carries |
+|-----------|---------|
+| **WebRTC data channel** | Chat events, attachments, custom emoji, message revisions/inventory, profile avatar bytes, voice/screen control, plugin message bus, game activity |
+| **WebSocket signaling** | Identity, membership, presence, RTC SDP/ICE, chat/DM/voice fallbacks, `account_sync`, plugin events |
+
+Server-relayed chat (`chat_message`) and DM types exist so users see written chat and delivery state while data channels are down. Media, attachments, and inventory sync remain peer-plane responsibilities.
+
+## Multi-device (`account_sync`)
+
+The client wraps relayable local changes in `account_sync` envelopes. The server forwards the inner `payload` to other open connections for the same `oderId`. When a device identifies, siblings receive `account_sync_peer_online` and push snapshots (saved servers, friends, emoji library, chat history batches, etc.). See [authentication.md](authentication.md) and domain-specific feature docs.
+
+## Client implementation map
+
+| Concern | Location |
+|---------|----------|
+| One socket per signal URL | `signaling/signaling.manager.ts` |
+| Route picker | `signaling/signaling-transport-handler.ts` |
+| Room affinity | `signaling/server-signaling-coordinator.ts` |
+| Inbound dispatch | `signaling/signaling-message-handler.ts` |
+| Constants (intervals, types) | `realtime.constants.ts` |
+
+## Related
+
+- [authentication.md](authentication.md) — session tokens and `identify` trust boundary
+- [direct-messaging.md](direct-messaging.md) — DM envelope relay types
+- [voice-webrtc.md](voice-webrtc.md) — RTC relay and `voice_state`
+- [plugins.md](plugins.md) — `plugin_event` / `plugin_requirements`
+- [message-integrity.md](message-integrity.md) — signed revisions (P2P; `account_sync` relay)
+- Product client deep dive: [`toju-app/src/app/infrastructure/realtime/README.md`](../../toju-app/src/app/infrastructure/realtime/README.md)
+- Server handler: [`server/src/websocket/handler.ts`](../../server/src/websocket/handler.ts)
+
+## Changelog
+
+| Date | Change |
+|------|--------|
+| 2026-07-05 | Initial canonical envelope catalog; deprecates `shared-kernel/signaling-contracts.ts` as wire source |
@@ -0,0 +1,68 @@
+# Voice & WebRTC
+
+> **Status:** Active
+> **Last updated:** 2026-07-05
+
+## Overview
+
+Voice channels, camera, and screen-share use direct **WebRTC** peer connections between clients. The signaling server relays SDP offers/answers/ICE and **voice presence** (`voice_state`); media never flows through the server.
+
+## Responsibilities
+
+| Layer | Owns |
+|-------|------|
+| `infrastructure/realtime/` | WebRTC sessions, negotiation, data channels, RNNoise worklet |
+| `voice-connection` / `voice-session` domains | Facades, workspace UI, settings, multi-device ownership |
+| `screen-share` domain | Source picker, quality presets (Electron) |
+| Signaling server | RTC relay + `voice_state` / `voice_client_takeover` broadcast |
+
+## WebSocket signaling types
+
+| type | Purpose |
+|------|---------|
+| `offer`, `answer`, `ice_candidate` | WebRTC negotiation relay to `targetUserId` |
+| `voice_state` | Voice roster (mute/deafen/speaking, channel id); sets `voiceActive` on one connection per user |
+| `voice_client_takeover` | Notify sibling tabs to yield voice ownership |
+
+Relay rules: RTC messages require shared server membership (except DM-specific types). See [signaling.md](signaling.md).
+
+## Multi-device voice
+
+- Only one connection per `oderId` may be `voiceActive`; RTC offers route to that connection (fallback: any open connection).
+- Other tabs show passive UI and may send `voice_client_takeover`.
+- `clientInstanceId` in `identify` and voice payloads distinguishes tabs.
+
+## Media pipeline (client)
+
+- **Voice:** `getUserMedia` → optional RNNoise AudioWorklet → gain → same-room peer routing only.
+- **Camera:** separate video track; same-room filter.
+- **Screen share:** on-demand via data-channel `SCREEN_SHARE_REQUEST`; platform-specific capture (browser `getDisplayMedia`, Electron picker, Linux PulseAudio routing).
+
+## P2P data channel
+
+Carries voice/screen control messages, chat, attachments, and state sync — not server-relayed. Data-channel failure triggers peer renegotiation or full rebuild (see realtime README). When a failed control channel is replaced (`replaceDataChannel`), the old channel is closed first so its SCTP resources are released.
+
+## Media memory invariants (2026-07-14, RAM investigation)
+
+- `removePeer` / `closeAllPeers` clear **all four** remote stream maps, including `remotePeerCameraStreams` (previously leaked per departed peer).
+- Video tiles (`voice-workspace-stream-tile`) pause and null `srcObject` in `ngOnDestroy` (`voice-workspace-stream-video.rules.ts`) so Chromium releases decoder/frame buffers immediately.
+- `debug-network-metrics` drops a peer's entry when the peer is fully removed and caps the store at `MAX_TRACKED_DEBUG_NETWORK_PEERS` = 200 (oldest evicted).
+- Electron registers `setDisplayMediaRequestHandler` once per app run (guarded in `create-window.ts`), not on every window recreation.
+
+## Mobile / Capacitor
+
+Background voice uses Android foreground service + iOS audio/CallKit bridges — [mobile-capacitor.md](mobile-capacitor.md). Screen share is limited on mobile WebViews.
+
+## Related
+
+- [signaling.md](signaling.md) — envelope catalog
+- [direct-messaging.md](direct-messaging.md) — private calls share `PeerDeliveryService`
+- [`toju-app/src/app/infrastructure/realtime/README.md`](../../toju-app/src/app/infrastructure/realtime/README.md) — negotiation, recovery, RNNoise
+- Domain READMEs: `voice-connection`, `voice-session`, `screen-share`
+
+## Changelog
+
+| Date | Change |
+|------|--------|
+| 2026-07-14 | Media memory invariants: camera-stream map cleanup, tile `srcObject` release, debug-metrics cap, single display-media handler registration, replaced data channels closed |
+| 2026-07-05 | Initial cross-context voice/WebRTC contract |
@@ -0,0 +1,72 @@
+import { expect, type Page } from '@playwright/test';
+
+/** Read how many signaling managers are currently connected for this page. */
+export async function getConnectedSignalManagerCount(page: Page): Promise<number> {
+  return page.evaluate(() => {
+    interface AngularDebugApi {
+      getComponent: (element: Element) => Record<string, unknown>;
+    }
+
+    const host = document.querySelector('app-rooms-side-panel');
+    const debugApi = (window as { ng?: AngularDebugApi }).ng;
+
+    if (!host || !debugApi?.getComponent) {
+      return 0;
+    }
+
+    const component = debugApi.getComponent(host);
+    const realtime = component['realtime'] as {
+      signalingTransportHandler?: {
+        getConnectedSignalingManagers?: () => unknown[];
+      };
+    } | undefined;
+
+    return realtime?.signalingTransportHandler?.getConnectedSignalingManagers?.().length ?? 0;
+  });
+}
+
+/**
+ * Dual-signal setups create one RTCPeerConnection per remote peer per active
+ * signaling manager, so the harness tracks `remotePeerCount * signalCount`
+ * connected peer connections.
+ */
+export async function waitForConnectedRemotePeerMesh(
+  page: Page,
+  remotePeerCount: number,
+  timeout = 45_000
+): Promise<void> {
+  const signalCount = Math.max(await getConnectedSignalManagerCount(page), 1);
+  const expectedCount = remotePeerCount * signalCount;
+  const minimumCount = Math.max(remotePeerCount, expectedCount - signalCount);
+
+  await page.waitForFunction(
+    (min) => ((window as unknown as {
+      __rtcConnections?: RTCPeerConnection[];
+    }).__rtcConnections ?? []).filter(
+      (pc) => pc.connectionState === 'connected'
+    ).length >= min,
+    minimumCount,
+    { timeout }
+  );
+}
+
+export async function getMinimumConnectedPeerMeshCount(
+  page: Page,
+  remotePeerCount: number
+): Promise<number> {
+  const signalCount = Math.max(await getConnectedSignalManagerCount(page), 1);
+  const expectedCount = remotePeerCount * signalCount;
+
+  return Math.max(remotePeerCount, expectedCount - signalCount);
+}
+
+export async function waitForConnectedSignalManagerCount(
+  page: Page,
+  expectedCount: number,
+  timeout = 30_000
+): Promise<void> {
+  await expect.poll(async () => await getConnectedSignalManagerCount(page), {
+    timeout,
+    intervals: [500, 1_000]
+  }).toBe(expectedCount);
+}
@@ -0,0 +1,49 @@
+import { type Page } from '@playwright/test';
+
+/** Wait until the side-panel roster under a voice channel lists the expected user count. */
+export async function waitForVoiceRosterCount(
+  page: Page,
+  channelName: string,
+  expectedCount: number,
+  timeout = 45_000
+): Promise<void> {
+  await page.waitForFunction(
+    ({ expected, name }) => {
+      const buttons = document.querySelectorAll(
+        `app-rooms-side-panel button[data-channel-type="voice"][data-channel-name="${name}"]`
+      );
+
+      for (const button of buttons) {
+        const panel = button.closest('app-rooms-side-panel');
+
+        if (!panel || panel.getBoundingClientRect().width === 0) {
+          continue;
+        }
+
+        const rosterDiv = button.nextElementSibling;
+
+        if (!rosterDiv) {
+          continue;
+        }
+
+        const displayNames = new Set<string>();
+
+        rosterDiv.querySelectorAll('[appThemeNode="roomVoiceUserItem"] span.text-sm').forEach((element) => {
+          const label = element.textContent?.trim();
+
+          if (label) {
+            displayNames.add(label);
+          }
+        });
+
+        if (displayNames.size === expected) {
+          return true;
+        }
+      }
+
+      return false;
+    },
+    { expected: expectedCount, name: channelName },
+    { timeout }
+  );
+}
@@ -8,10 +8,6 @@ interface ScreenShareMediaStream extends MediaStream {
  __isScreenShare?: boolean;
 }

-function webRtcHarnessWindow(scope: Window = window): WebRtcTestHarnessWindow {
-  return scope as unknown as WebRtcTestHarnessWindow;
-}
-
 /**
 * Install RTCPeerConnection monkey-patch on a page BEFORE navigating.
 * Tracks all created peer connections and their remote tracks so tests
@@ -32,7 +28,7 @@ export async function installWebRTCTracking(target: BrowserContext | Page): Prom
      source?: AudioScheduledSourceNode;
      drawIntervalId?: number;
    }[] = [];
-    const harness = webRtcHarnessWindow();
+    const harness = window as unknown as WebRtcTestHarnessWindow;

    harness.__rtcConnections = connections;
    harness.__rtcDataChannels = dataChannels;
@@ -160,6 +156,7 @@ export async function installWebRTCTracking(target: BrowserContext | Page): Prom

      return resultStream;
    };
+
  });
 }

@@ -181,7 +178,7 @@ export async function installWebRTCTracking(target: BrowserContext | Page): Prom
 export async function installAutoResumeAudioContext(page: Page): Promise<void> {
  await page.addInitScript(() => {
    const OrigAudioContext = window.AudioContext;
-    const audioHarness = webRtcHarnessWindow();
+    const audioHarness = window as unknown as WebRtcTestHarnessWindow;

    audioHarness.AudioContext = function(this: AudioContext, ...args: AudioContextArgs) {
      const ctx: AudioContext = new OrigAudioContext(...args);
@@ -211,7 +208,7 @@ export async function installAutoResumeAudioContext(page: Page): Promise<void> {

 export async function waitForPeerConnected(page: Page, timeout = 30_000): Promise<void> {
  await page.waitForFunction(
-    () => webRtcHarnessWindow().__rtcConnections?.some(
+    () => (window as unknown as WebRtcTestHarnessWindow).__rtcConnections?.some(
      (pc: RTCPeerConnection) => pc.connectionState === 'connected'
    ) ?? false,
    undefined,
@@ -224,7 +221,7 @@ export async function waitForPeerConnected(page: Page, timeout = 30_000): Promis
 */
 export async function isPeerStillConnected(page: Page): Promise<boolean> {
  return page.evaluate(
-    () => webRtcHarnessWindow().__rtcConnections?.some(
+    () => (window as unknown as WebRtcTestHarnessWindow).__rtcConnections?.some(
      (pc: RTCPeerConnection) => pc.connectionState === 'connected'
    ) ?? false
  );
@@ -233,7 +230,7 @@ export async function isPeerStillConnected(page: Page): Promise<boolean> {
 /** Returns the number of tracked peer connections in `connected` state. */
 export async function getConnectedPeerCount(page: Page): Promise<number> {
  return page.evaluate(
-    () => (webRtcHarnessWindow().__rtcConnections as RTCPeerConnection[] | undefined)?.filter(
+    () => ((window as unknown as WebRtcTestHarnessWindow).__rtcConnections as RTCPeerConnection[] | undefined)?.filter(
      (pc) => pc.connectionState === 'connected'
    ).length ?? 0
  );
@@ -241,19 +238,36 @@ export async function getConnectedPeerCount(page: Page): Promise<number> {

 /** Wait until the expected number of peer connections are `connected`. */
 export async function waitForConnectedPeerCount(page: Page, expectedCount: number, timeout = 45_000): Promise<void> {
-  await page.waitForFunction(
-    (count) => (webRtcHarnessWindow().__rtcConnections as RTCPeerConnection[] | undefined)?.filter(
-      (pc) => pc.connectionState === 'connected'
-    ).length === count,
-    expectedCount,
-    { timeout }
-  );
+  try {
+    await page.waitForFunction(
+      (count) => ((window as unknown as WebRtcTestHarnessWindow).__rtcConnections as RTCPeerConnection[] | undefined)?.filter(
+        (pc) => pc.connectionState === 'connected'
+      ).length === count,
+      expectedCount,
+      { timeout }
+    );
+  } catch (error) {
+    const diagnostics = await page.evaluate(() => {
+      const connections = (window as unknown as WebRtcTestHarnessWindow).__rtcConnections ?? [];
+
+      return {
+        connected: connections.filter((pc) => pc.connectionState === 'connected').length,
+        states: connections.map((pc) => pc.connectionState)
+      };
+    });
+
+    throw new Error(
+      `Expected ${expectedCount} connected peers within ${timeout}ms; `
+      + `saw ${diagnostics.connected} connected (${diagnostics.states.join(', ') || 'none'})`,
+      { cause: error }
+    );
+  }
 }

 /** Returns the number of tracked RTCDataChannels in the open state. */
 export async function getOpenDataChannelCount(page: Page): Promise<number> {
  return page.evaluate(
-    () => (webRtcHarnessWindow().__rtcDataChannels as RTCDataChannel[] | undefined)?.filter(
+    () => ((window as unknown as WebRtcTestHarnessWindow).__rtcDataChannels as RTCDataChannel[] | undefined)?.filter(
      (channel) => channel.readyState === 'open'
    ).length ?? 0
  );
@@ -262,7 +276,7 @@ export async function getOpenDataChannelCount(page: Page): Promise<number> {
 /** Wait until the expected number of tracked RTCDataChannels are open. */
 export async function waitForOpenDataChannelCount(page: Page, expectedCount: number, timeout = 45_000): Promise<void> {
  await page.waitForFunction(
-    (count) => (webRtcHarnessWindow().__rtcDataChannels as RTCDataChannel[] | undefined)?.filter(
+    (count) => ((window as unknown as WebRtcTestHarnessWindow).__rtcDataChannels as RTCDataChannel[] | undefined)?.filter(
      (channel) => channel.readyState === 'open'
    ).length === count,
    expectedCount,
@@ -273,7 +287,7 @@ export async function waitForOpenDataChannelCount(page: Page, expectedCount: num
 /** Close every currently-open RTCDataChannel and return how many were closed. */
 export async function closeOpenDataChannels(page: Page): Promise<number> {
  return page.evaluate(() => {
-    const channels = (webRtcHarnessWindow().__rtcDataChannels as RTCDataChannel[] | undefined) ?? [];
+    const channels = ((window as unknown as WebRtcTestHarnessWindow).__rtcDataChannels as RTCDataChannel[] | undefined) ?? [];

    let closed = 0;

@@ -293,7 +307,7 @@ export async function closeOpenDataChannels(page: Page): Promise<number> {
 /** Dispatch a synthetic data-channel error event on each open channel. */
 export async function dispatchDataChannelErrors(page: Page): Promise<number> {
  return page.evaluate(() => {
-    const channels = (webRtcHarnessWindow().__rtcDataChannels as RTCDataChannel[] | undefined) ?? [];
+    const channels = ((window as unknown as WebRtcTestHarnessWindow).__rtcDataChannels as RTCDataChannel[] | undefined) ?? [];

    let dispatched = 0;

@@ -354,7 +368,7 @@ interface PerPeerAudioStat {
 /** Get per-peer audio stats for every tracked RTCPeerConnection. */
 export async function getPerPeerAudioStats(page: Page): Promise<PerPeerAudioStat[]> {
  return page.evaluate(async () => {
-    const connections = webRtcHarnessWindow().__rtcConnections as RTCPeerConnection[] | undefined;
+    const connections = (window as unknown as WebRtcTestHarnessWindow).__rtcConnections as RTCPeerConnection[] | undefined;

    if (!connections?.length) {
      return [];
@@ -472,7 +486,7 @@ export async function getAudioStats(page: Page): Promise<{
  inbound: { bytesReceived: number; packetsReceived: number } | null;
 }> {
  return page.evaluate(async () => {
-    const connections = webRtcHarnessWindow().__rtcConnections as RTCPeerConnection[] | undefined;
+    const connections = (window as unknown as WebRtcTestHarnessWindow).__rtcConnections as RTCPeerConnection[] | undefined;

    if (!connections?.length)
      return { outbound: null, inbound: null };
@@ -486,8 +500,8 @@ export async function getAudioStats(page: Page): Promise<{
      hasInbound: boolean;
    };

-    const hwm: Record<number, HWMEntry> = webRtcHarnessWindow().__rtcStatsHWM =
-      (webRtcHarnessWindow().__rtcStatsHWM as Record<number, HWMEntry> | undefined) ?? {};
+    const hwm: Record<number, HWMEntry> = (window as unknown as WebRtcTestHarnessWindow).__rtcStatsHWM =
+      ((window as unknown as WebRtcTestHarnessWindow).__rtcStatsHWM as Record<number, HWMEntry> | undefined) ?? {};

    for (let idx = 0; idx < connections.length; idx++) {
      let stats: RTCStatsReport;
@@ -596,7 +610,7 @@ export async function getAudioStatsDelta(page: Page, durationMs = 3_000): Promis
 export async function waitForAudioStatsPresent(page: Page, timeout = 15_000): Promise<void> {
  await page.waitForFunction(
    async () => {
-      const connections = webRtcHarnessWindow().__rtcConnections as RTCPeerConnection[] | undefined;
+      const connections = (window as unknown as WebRtcTestHarnessWindow).__rtcConnections as RTCPeerConnection[] | undefined;

      if (!connections?.length)
        return false;
@@ -705,7 +719,7 @@ export async function getVideoStats(page: Page): Promise<{
  inbound: { bytesReceived: number; packetsReceived: number } | null;
 }> {
  return page.evaluate(async () => {
-    const connections = webRtcHarnessWindow().__rtcConnections as RTCPeerConnection[] | undefined;
+    const connections = (window as unknown as WebRtcTestHarnessWindow).__rtcConnections as RTCPeerConnection[] | undefined;

    if (!connections?.length)
      return { outbound: null, inbound: null };
@@ -719,8 +733,8 @@ export async function getVideoStats(page: Page): Promise<{
      hasInbound: boolean;
    }

-    const hwm: Record<number, VHWM> = webRtcHarnessWindow().__rtcVideoStatsHWM =
-      (webRtcHarnessWindow().__rtcVideoStatsHWM as Record<number, VHWM> | undefined) ?? {};
+    const hwm: Record<number, VHWM> = (window as unknown as WebRtcTestHarnessWindow).__rtcVideoStatsHWM =
+      ((window as unknown as WebRtcTestHarnessWindow).__rtcVideoStatsHWM as Record<number, VHWM> | undefined) ?? {};

    for (let idx = 0; idx < connections.length; idx++) {
      let stats: RTCStatsReport;
@@ -804,7 +818,7 @@ export async function getVideoStats(page: Page): Promise<{
 export async function waitForVideoStatsPresent(page: Page, timeout = 15_000): Promise<void> {
  await page.waitForFunction(
    async () => {
-      const connections = webRtcHarnessWindow().__rtcConnections as RTCPeerConnection[] | undefined;
+      const connections = (window as unknown as WebRtcTestHarnessWindow).__rtcConnections as RTCPeerConnection[] | undefined;

      if (!connections?.length)
        return false;
@@ -972,7 +986,7 @@ export async function waitForInboundVideoFlow(
 */
 export async function dumpRtcDiagnostics(page: Page): Promise<string> {
  return page.evaluate(async () => {
-    const conns = webRtcHarnessWindow().__rtcConnections as RTCPeerConnection[] | undefined;
+    const conns = (window as unknown as WebRtcTestHarnessWindow).__rtcConnections as RTCPeerConnection[] | undefined;

    if (!conns?.length)
      return 'No connections tracked';
@@ -31,6 +31,14 @@ test.describe('Multi-device session', () => {
      expect(instanceA).not.toEqual(instanceB);
    });

+    await test.step('shows one self identity in the members panel on each device', async () => {
+      for (const client of [scenario.clientA, scenario.clientB]) {
+        await expect(
+          membersSidePanel(client.page).getByText(scenario.credentials.displayName, { exact: true })
+        ).toHaveCount(1, { timeout: 20_000 });
+      }
+    });
+
    await test.step('syncs chat from device A to device B', async () => {
      await expectCrossDeviceMessage(scenario.messagesA, scenario.messagesB, messageAtoB);
    });
@@ -0,0 +1,114 @@
+import { test, expect } from '../../fixtures/multi-client';
+import { RegisterPage } from '../../pages/register.page';
+import { ServerSearchPage } from '../../pages/server-search.page';
+import { ChatMessagesPage } from '../../pages/chat-messages.page';
+
+/**
+ * Regression coverage for "Sending files between users doesn't really work":
+ * a generic (non-media) file above the 10 MB auto-save cap sent to a browser
+ * receiver. The receiver clicks Request; previously the chunk handler dropped
+ * every incoming chunk with a silent file-too-large error, the sender's ack
+ * wait timed out, and the GUI never changed.
+ */
+const LARGE_FILE_SIZE_BYTES = 11 * 1024 * 1024;
+
+test.describe('Large generic file transfer', () => {
+  test.describe.configure({ timeout: 420_000, retries: 1 });
+
+  test('browser receiver can request and download a generic file above the auto-save cap', async ({ createClient }) => {
+    const suffix = uniqueName('largefile');
+    const serverName = `Large File Server ${suffix}`;
+    const fileName = `${suffix}-dataset.bin`;
+    const caption = `Large file upload ${suffix}`;
+    const alice = await createClient();
+    const bob = await createClient();
+    const aliceMessages = new ChatMessagesPage(alice.page);
+    const bobMessages = new ChatMessagesPage(bob.page);
+
+    await test.step('Alice and Bob register and meet in a server', async () => {
+      const aliceRegister = new RegisterPage(alice.page);
+
+      await aliceRegister.goto();
+      await aliceRegister.register(`alice_${suffix}`, 'Alice', 'TestPass123!');
+      await expect(alice.page).toHaveURL(/\/dashboard/, { timeout: 15_000 });
+
+      const bobRegister = new RegisterPage(bob.page);
+
+      await bobRegister.goto();
+      await bobRegister.register(`bob_${suffix}`, 'Bob', 'TestPass123!');
+      await expect(bob.page).toHaveURL(/\/dashboard/, { timeout: 15_000 });
+
+      const aliceSearch = new ServerSearchPage(alice.page);
+
+      await aliceSearch.createServer(serverName, { description: 'Large generic file transfer coverage' });
+      await expect(alice.page).toHaveURL(/\/room\//, { timeout: 15_000 });
+
+      const bobSearch = new ServerSearchPage(bob.page);
+
+      await bobSearch.joinServerFromSearch(serverName);
+      await expect(bob.page).toHaveURL(/\/room\//, { timeout: 15_000 });
+
+      await aliceMessages.waitForReady();
+      await bobMessages.waitForReady();
+    });
+
+    await test.step('Alice sends an 11 MB generic file', async () => {
+      await attachGeneratedBinaryFile(aliceMessages, fileName, LARGE_FILE_SIZE_BYTES);
+      await aliceMessages.sendMessage(caption);
+      await expect(aliceMessages.getMessageItemByText(caption)).toBeVisible({ timeout: 30_000 });
+    });
+
+    const bobBubble = bobMessages.getMessageItemByText(caption);
+
+    await test.step('Bob sees the attachment card with a Request button', async () => {
+      await expect(bobBubble).toBeVisible({ timeout: 30_000 });
+      await expect(bobBubble.getByText(fileName, { exact: false })).toBeVisible({ timeout: 30_000 });
+      await expect(bobBubble.getByRole('button', { name: /request/i })).toBeVisible({ timeout: 20_000 });
+    });
+
+    await test.step('Bob requests the file and it downloads to completion', async () => {
+      await bobBubble.getByRole('button', { name: /request/i }).click();
+
+      // The transfer must visibly progress (Cancel replaces Request) instead of
+      // silently stalling at 0 bytes like the original bug.
+      await expect(bobBubble.getByRole('button', { name: /cancel/i })).toBeVisible({ timeout: 30_000 });
+
+      await expect(bobBubble.getByRole('button', { name: /download/i })).toBeVisible({ timeout: 300_000 });
+      await expect(bobBubble.getByText(/too large/i)).toHaveCount(0);
+    });
+  });
+});
+
+/**
+ * Builds the file inside the page so the multi-megabyte payload never crosses
+ * the CDP protocol as a base64 string.
+ */
+async function attachGeneratedBinaryFile(
+  messages: ChatMessagesPage,
+  fileName: string,
+  sizeBytes: number
+): Promise<void> {
+  await messages.waitForReady();
+
+  await messages.composerInput.evaluate((element, { name, size }) => {
+    const bytes = new Uint8Array(size);
+
+    for (let index = 0; index < size; index++) {
+      bytes[index] = (index * 31 + 7) & 0xff;
+    }
+
+    const dataTransfer = new DataTransfer();
+
+    dataTransfer.items.add(new File([bytes], name, { type: 'application/octet-stream' }));
+    element.dispatchEvent(new DragEvent('drop', {
+      bubbles: true,
+      cancelable: true,
+      dataTransfer
+    }));
+  }, { name: fileName, size: sizeBytes });
+}
+
+function uniqueName(prefix: string): string {
+  return `${prefix}-${Date.now()}-${Math.random().toString(36)
+    .slice(2, 8)}`;
+}
@@ -85,6 +85,61 @@ test.describe('Multi-device attachment sharing', () => {
      await expect(getButton.first()).toBeVisible({ timeout: 20_000 });
    });
  });
+
+  test('relays file-announce metadata to a sibling device that is already online during upload', async ({
+    createClient
+  }) => {
+    const suffix = uniqueMultiDeviceName('attach-online');
+    const credentials = {
+      username: `online_${suffix}`,
+      displayName: 'Multi Device User',
+      password: MULTI_DEVICE_PASSWORD
+    };
+    const serverName = `Attachment Online Relay ${suffix}`;
+    const fileName = `${suffix}-relay.bin`;
+    const caption = `Uploaded while device B was online ${suffix}`;
+    const fileAttachment = createBinaryFilePayload(fileName, 'application/octet-stream', `relay-body-${suffix}`);
+    const clientA = await createClient();
+    const clientB = await createClient();
+    const messagesA = new ChatMessagesPage(clientA.page);
+    const messagesB = new ChatMessagesPage(clientB.page);
+
+    await test.step('device A registers and creates a server', async () => {
+      const registerPage = new RegisterPage(clientA.page);
+
+      await registerPage.goto();
+      await registerPage.register(credentials.username, credentials.displayName, credentials.password);
+      await expect(clientA.page).toHaveURL(/\/dashboard/, { timeout: 15_000 });
+
+      const search = new ServerSearchPage(clientA.page);
+
+      await search.createServer(serverName, { description: 'Sibling online file-announce relay coverage' });
+      await expect(clientA.page).toHaveURL(/\/room\//, { timeout: 15_000 });
+      await messagesA.waitForReady();
+    });
+
+    await test.step('device B logs into the same server before the upload starts', async () => {
+      await loginSecondDeviceIntoServer(clientB.page, credentials, serverName);
+      await clientA.page.bringToFront();
+      await messagesA.waitForReady();
+      await clientB.page.bringToFront();
+      await messagesB.waitForReady();
+    });
+
+    await test.step('device A uploads while device B is already in the room', async () => {
+      await clientA.page.bringToFront();
+      await messagesA.attachFiles([fileAttachment]);
+      await messagesA.sendMessage(caption);
+      await expect(messagesA.getMessageItemByText(caption)).toBeVisible({ timeout: 30_000 });
+    });
+
+    await test.step('device B learns attachment metadata without a server-rail click dance', async () => {
+      await clientB.page.bringToFront();
+      await expect(messagesB.getMessageItemByText(caption)).toBeVisible({ timeout: 90_000 });
+      await expect(messagesB.getMessageItemByText(caption).getByText(fileName, { exact: false }))
+        .toBeVisible({ timeout: 90_000 });
+    });
+  });
 });

 function createBinaryFilePayload(name: string, mimeType: string, content: string): ChatDropFilePayload {
@@ -0,0 +1,61 @@
+import { test, expect } from '../../fixtures/multi-client';
+import { RegisterPage } from '../../pages/register.page';
+import { ServerSearchPage } from '../../pages/server-search.page';
+import { ChatMessagesPage, type ChatDropFilePayload } from '../../pages/chat-messages.page';
+
+test.describe('Multi-image gallery grouping', () => {
+  test.describe.configure({ timeout: 180_000 });
+
+  test('groups three images in one message bubble with a visible grid', async ({ createClient }) => {
+    const suffix = uniqueName('gallery');
+    const client = await createClient();
+    const registerPage = new RegisterPage(client.page);
+    const search = new ServerSearchPage(client.page);
+    const messages = new ChatMessagesPage(client.page);
+    const serverName = `Gallery Group ${suffix}`;
+    const imageNames = [
+      `${suffix}-one.svg`,
+      `${suffix}-two.svg`,
+      `${suffix}-three.svg`
+    ];
+    const images = imageNames.map((name) => createSvgFilePayload(name));
+
+    await registerPage.goto();
+    await registerPage.register(`gallery_${suffix}`, 'Gallery User', 'TestPass123!');
+    await expect(client.page).toHaveURL(/\/dashboard/, { timeout: 15_000 });
+
+    await search.createServer(serverName, { description: 'Multi-image gallery regression server' });
+    await expect(client.page).toHaveURL(/\/room\//, { timeout: 15_000 });
+    await messages.waitForReady();
+
+    await messages.attachFiles(images);
+    await messages.sendPendingAttachments();
+
+    for (const imageName of imageNames) {
+      await messages.expectMessageImageLoaded(imageName);
+    }
+
+    const messageId = await messages.getMessageIdContainingImage(imageNames[0]);
+
+    expect(messageId).toBeTruthy();
+
+    const bubble = client.page.locator(`[data-message-id="${messageId}"]`);
+
+    await expect(bubble.locator('img[alt$=".svg"]')).toHaveCount(3, { timeout: 20_000 });
+    await expect(bubble.locator('.chat-image-grid')).toBeVisible({ timeout: 20_000 });
+  });
+});
+
+function uniqueName(prefix: string): string {
+  return `${prefix}-${Date.now()}-${Math.floor(Math.random() * 10_000)}`;
+}
+
+function createSvgFilePayload(name: string): ChatDropFilePayload {
+  const svg = '<svg xmlns="http://www.w3.org/2000/svg" width="32" height="32"><rect width="32" height="32" fill="#4A217A"/></svg>';
+
+  return {
+    name,
+    mimeType: 'image/svg+xml',
+    base64: Buffer.from(svg, 'utf8').toString('base64')
+  };
+}
@@ -0,0 +1,237 @@
+import { expect, type Page } from '@playwright/test';
+import { test } from '../../fixtures/multi-client';
+import { installTestServerEndpoints } from '../../helpers/seed-test-endpoint';
+import { startTestServer } from '../../helpers/test-server';
+import { readSignalServerCredentialFromPage } from '../../helpers/auth-api';
+import { RegisterPage } from '../../pages/register.page';
+import { ServerSearchPage } from '../../pages/server-search.page';
+import { ChatMessagesPage } from '../../pages/chat-messages.page';
+
+/**
+ * Regression coverage for "User receiving direct call doesn't get notified":
+ * starting a call from the DM chat header (steps: open DM of a user, click
+ * call) must ring the recipient - incoming-call modal, ring audio, and a
+ * server-rail call entry. Includes the cross-signal topology where the callee
+ * is addressed by a provisioned actor id instead of their home identity.
+ */
+const USER_PASSWORD = 'TestPass123!';
+const PRIMARY_SIGNAL_ID = 'e2e-dm-ring-primary';
+const SECONDARY_SIGNAL_ID = 'e2e-dm-ring-secondary';
+
+test.describe('DM header call ring', () => {
+  test.describe.configure({ timeout: 240_000 });
+
+  test('callee is notified when the caller starts the call from the DM chat header', async ({ createClient }) => {
+    const suffix = uniqueName('dm-ring');
+    const serverName = `DM Ring Server ${suffix}`;
+    const alice = await createClient();
+    const bob = await createClient();
+
+    await installRingInstrumentation(bob.page);
+
+    await test.step('Alice and Bob register and meet in a server', async () => {
+      await registerUser(alice.page, `alice_${suffix}`, 'Alice');
+      await registerUser(bob.page, `bob_${suffix}`, 'Bob');
+
+      const aliceSearch = new ServerSearchPage(alice.page);
+
+      await aliceSearch.createServer(serverName, { description: 'DM header call ring regression coverage' });
+      await expect(alice.page).toHaveURL(/\/room\//, { timeout: 20_000 });
+      await new ChatMessagesPage(alice.page).waitForReady();
+
+      const bobSearch = new ServerSearchPage(bob.page);
+
+      await bobSearch.joinServerFromSearch(serverName);
+      await expect(bob.page).toHaveURL(/\/room\//, { timeout: 20_000 });
+      await new ChatMessagesPage(bob.page).waitForReady();
+    });
+
+    await test.step('Both users open the DM view; live DM delivery confirms the transport works', async () => {
+      const bobUserCard = alice.page.locator('[data-testid^="room-user-card-"]', { hasText: 'Bob' }).first();
+
+      await expect(bobUserCard).toBeVisible({ timeout: 20_000 });
+      await bobUserCard.getByRole('button', { name: 'Message Bob' }).click();
+      await expect(alice.page).toHaveURL(/\/dm\//, { timeout: 15_000 });
+
+      const aliceUserCard = bob.page.locator('[data-testid^="room-user-card-"]', { hasText: 'Alice' }).first();
+
+      await expect(aliceUserCard).toBeVisible({ timeout: 20_000 });
+      await aliceUserCard.getByRole('button', { name: 'Message Alice' }).click();
+      await expect(bob.page).toHaveURL(/\/dm\//, { timeout: 15_000 });
+
+      // Mirrors the bug report: the users are in the DM view (not a server
+      // room) when the call starts. The message must arrive live so a broken
+      // ring cannot be blamed on a dead transport.
+      await alice.page.getByTestId('dm-input').fill(`hello before call ${suffix}`);
+      await alice.page.getByTestId('dm-input').press('Enter');
+      await expect(bob.page.locator('app-dm-chat').getByText(`hello before call ${suffix}`)).toBeVisible({ timeout: 20_000 });
+    });
+
+    await test.step('Alice starts the call from the DM chat header', async () => {
+      const callButton = alice.page.locator('app-dm-chat header').getByRole('button', { name: 'Call Bob' });
+
+      await expect(callButton).toBeVisible({ timeout: 20_000 });
+      await expect(callButton).toBeEnabled({ timeout: 20_000 });
+      await callButton.click();
+      await expect(alice.page).toHaveURL(/\/call\//, { timeout: 20_000 });
+    });
+
+    await test.step('Bob gets the incoming-call modal, ring audio, and rail entry', async () => {
+      await expect(bob.page.getByRole('dialog', { name: /is calling/ })).toBeVisible({ timeout: 20_000 });
+      await expect(bob.page.locator('[data-testid^="server-rail-call-"]')).toHaveCount(1, { timeout: 20_000 });
+
+      await expect
+        .poll(async () => await getCallAudioPlayCount(bob.page), {
+          timeout: 20_000,
+          intervals: [500, 1_000]
+        })
+        .toBeGreaterThan(0);
+    });
+  });
+
+  test('callee homed on another signal server is notified when called via their provisioned actor id', async ({ createClient, testServer }) => {
+    const secondaryServer = await startTestServer();
+
+    try {
+      const suffix = uniqueName('xsig-ring');
+      const serverName = `Cross Signal Ring ${suffix}`;
+      const alice = await createClient();
+      const bob = await createClient();
+      const endpoints = [
+        {
+          id: PRIMARY_SIGNAL_ID,
+          name: 'E2E Ring Signal A',
+          url: testServer.url,
+          isActive: true,
+          status: 'online'
+        },
+        {
+          id: SECONDARY_SIGNAL_ID,
+          name: 'E2E Ring Signal B',
+          url: secondaryServer.url,
+          isActive: true,
+          status: 'online'
+        }
+      ];
+
+      await installTestServerEndpoints(alice.context, endpoints);
+      await installTestServerEndpoints(bob.context, endpoints);
+      await installRingInstrumentation(bob.page);
+
+      await test.step('Alice registers on the primary signal, Bob on the secondary', async () => {
+        const aliceRegister = new RegisterPage(alice.page);
+
+        await aliceRegister.goto();
+        await aliceRegister.serverSelect.selectOption(PRIMARY_SIGNAL_ID);
+        await aliceRegister.register(`alice_${suffix}`, 'Alice', USER_PASSWORD);
+        await expect(alice.page).toHaveURL(/\/dashboard/, { timeout: 20_000 });
+
+        const bobRegister = new RegisterPage(bob.page);
+
+        await bobRegister.goto();
+        await bobRegister.serverSelect.selectOption(SECONDARY_SIGNAL_ID);
+        await bobRegister.register(`bob_${suffix}`, 'Bob', USER_PASSWORD);
+        await expect(bob.page).toHaveURL(/\/dashboard/, { timeout: 20_000 });
+      });
+
+      await test.step('They meet in a room on the primary signal; Bob gets a provisioned actor identity', async () => {
+        const aliceSearch = new ServerSearchPage(alice.page);
+
+        await aliceSearch.createServer(serverName, {
+          description: 'Cross-signal DM call ring coverage',
+          sourceId: PRIMARY_SIGNAL_ID
+        });
+
+        await expect(alice.page).toHaveURL(/\/room\//, { timeout: 20_000 });
+        await new ChatMessagesPage(alice.page).waitForReady();
+
+        const bobSearch = new ServerSearchPage(bob.page);
+
+        await bobSearch.joinServerFromSearch(serverName);
+        await expect(bob.page).toHaveURL(/\/room\//, { timeout: 20_000 });
+        await new ChatMessagesPage(bob.page).waitForReady();
+
+        await expect.poll(async () =>
+          await readSignalServerCredentialFromPage(bob.page, testServer.url),
+        { timeout: 30_000 }
+        ).not.toBeNull();
+      });
+
+      await test.step('Alice opens the DM with Bob and calls from the DM chat header', async () => {
+        const bobUserCard = alice.page.locator('[data-testid^="room-user-card-"]', { hasText: 'Bob' }).first();
+
+        await expect(bobUserCard).toBeVisible({ timeout: 20_000 });
+        await bobUserCard.getByRole('button', { name: 'Message Bob' }).click();
+        await expect(alice.page).toHaveURL(/\/dm\//, { timeout: 15_000 });
+
+        const callButton = alice.page.locator('app-dm-chat header').getByRole('button', { name: 'Call Bob' });
+
+        await expect(callButton).toBeVisible({ timeout: 20_000 });
+        await expect(callButton).toBeEnabled({ timeout: 20_000 });
+        await callButton.click();
+        await expect(alice.page).toHaveURL(/\/call\//, { timeout: 20_000 });
+      });
+
+      await test.step('Bob gets the incoming-call modal and ring audio', async () => {
+        await expect(bob.page.getByRole('dialog', { name: /is calling/ })).toBeVisible({ timeout: 20_000 });
+
+        await expect
+          .poll(async () => await getCallAudioPlayCount(bob.page), {
+            timeout: 20_000,
+            intervals: [500, 1_000]
+          })
+          .toBeGreaterThan(0);
+      });
+    } finally {
+      await secondaryServer.stop();
+    }
+  });
+});
+
+async function registerUser(page: Page, username: string, displayName: string): Promise<void> {
+  const registerPage = new RegisterPage(page);
+
+  await registerPage.goto();
+  await registerPage.register(username, displayName, USER_PASSWORD);
+  await expect(page).toHaveURL(/\/dashboard/, { timeout: 20_000 });
+}
+
+async function installRingInstrumentation(page: Page): Promise<void> {
+  await page.addInitScript(() => {
+    const OriginalAudio = window.Audio;
+    const callAudioState = { playCount: 0 };
+
+    (window as Window & { __callAudioState?: typeof callAudioState }).__callAudioState = callAudioState;
+
+    function isCallAudio(audio: HTMLAudioElement): boolean {
+      return audio.src.includes('/assets/audio/call.wav') || audio.src.endsWith('assets/audio/call.wav');
+    }
+
+    (window as unknown as { Audio: typeof Audio }).Audio = function(this: HTMLAudioElement, src?: string) {
+      const audio = new OriginalAudio(src);
+      const originalPlay = audio.play.bind(audio);
+
+      audio.play = () => {
+        if (isCallAudio(audio)) {
+          callAudioState.playCount += 1;
+        }
+
+        return originalPlay();
+      };
+
+      return audio;
+    } as typeof Audio;
+
+    window.Audio.prototype = OriginalAudio.prototype;
+    Object.setPrototypeOf(window.Audio, OriginalAudio);
+  });
+}
+
+async function getCallAudioPlayCount(page: Page): Promise<number> {
+  return await page.evaluate(() => (window as Window & { __callAudioState?: { playCount: number } }).__callAudioState?.playCount ?? 0);
+}
+
+function uniqueName(prefix: string): string {
+  return `${prefix}-${Date.now()}-${Math.random().toString(36)
+    .slice(2, 8)}`;
+}
@@ -10,9 +10,9 @@ import {
  dumpRtcDiagnostics,
  getConnectedPeerCount,
  installWebRTCTracking,
+  installAutoResumeAudioContext,
  waitForAllPeerAudioFlow,
  waitForAudioStatsPresent,
-  waitForConnectedPeerCount,
  waitForPeerConnected
 } from '../../helpers/webrtc-helpers';
 import {
@@ -24,6 +24,8 @@ import {
 import { RegisterPage } from '../../pages/register.page';
 import { ServerSearchPage } from '../../pages/server-search.page';
 import { ChatRoomPage } from '../../pages/chat-room.page';
+import { waitForVoiceRosterCount } from '../../helpers/voice-roster';
+import { getMinimumConnectedPeerMeshCount, waitForConnectedRemotePeerMesh } from '../../helpers/signal-manager';
 import { ChatMessagesPage } from '../../pages/chat-messages.page';

 // ── Signal endpoint identifiers ──────────────────────────────────────
@@ -132,7 +134,8 @@ test.describe('Mixed signal-config voice', () => {

        await installTestServerEndpoints(client.context, groupEndpoints);
        await installDeterministicVoiceSettings(client.page);
-        await installWebRTCTracking(client.page);
+        await installWebRTCTracking(client.context);
+        await installAutoResumeAudioContext(client.page);

        clients.push({ ...client, user });
      }
@@ -300,8 +303,11 @@ test.describe('Mixed signal-config voice', () => {

        for (const client of clients) {
          await joinVoiceChannelUntilConnected(client.page, VOICE_CHANNEL);
+          await client.page.waitForTimeout(2_000);
        }

+        await clients[0].page.waitForTimeout(10_000);
+
        for (const client of clients) {
          await waitForVoiceRosterCount(client.page, VOICE_CHANNEL, USER_COUNT);
        }
@@ -310,11 +316,11 @@ test.describe('Mixed signal-config voice', () => {
      // ── Audio mesh ──────────────────────────────────────────────
      await test.step('All users discover peers and audio flows pairwise', async () => {
        await Promise.all(clients.map((client) =>
-          waitForPeerConnected(client.page, 45_000)
+          waitForPeerConnected(client.page, 90_000)
        ));

        await Promise.all(clients.map((client) =>
-          waitForConnectedPeerCount(client.page, EXPECTED_REMOTE_PEERS, 90_000)
+          waitForConnectedRemotePeerMesh(client.page, EXPECTED_REMOTE_PEERS, 180_000)
        ));

        await Promise.all(clients.map((client) =>
@@ -324,7 +330,7 @@ test.describe('Mixed signal-config voice', () => {
        await clients[0].page.waitForTimeout(5_000);

        await Promise.all(clients.map((client) =>
-          waitForAllPeerAudioFlow(client.page, EXPECTED_REMOTE_PEERS, 90_000)
+          waitForAllPeerAudioFlow(client.page, EXPECTED_REMOTE_PEERS, 300_000)
        ));
      });

@@ -335,7 +341,6 @@ test.describe('Mixed signal-config voice', () => {

          await openVoiceWorkspace(client.page);
          await expect(room.voiceWorkspace).toBeVisible({ timeout: 10_000 });
-          await waitForVoiceWorkspaceUserCount(client.page, USER_COUNT);
          await waitForVoiceRosterCount(client.page, VOICE_CHANNEL, USER_COUNT);
        }
      });
@@ -372,18 +377,28 @@ test.describe('Mixed signal-config voice', () => {

        while (Date.now() < deadline) {
          for (const client of stayers) {
-            await expect.poll(async () => await getConnectedPeerCount(client.page), {
+            await expect.poll(async () => {
+              const actual = await getConnectedPeerCount(client.page);
+              const minimum = await getMinimumConnectedPeerMeshCount(client.page, EXPECTED_REMOTE_PEERS);
+
+              return actual >= minimum;
+            }, {
              timeout: 10_000,
              intervals: [500, 1_000]
-            }).toBe(EXPECTED_REMOTE_PEERS);
+            }).toBe(true);
          }

          // Check chatters still have voice peers even while viewing another room
          for (const chatter of chatters) {
-            await expect.poll(async () => await getConnectedPeerCount(chatter.page), {
+            await expect.poll(async () => {
+              const actual = await getConnectedPeerCount(chatter.page);
+              const minimum = await getMinimumConnectedPeerMeshCount(chatter.page, EXPECTED_REMOTE_PEERS);
+
+              return actual >= minimum;
+            }, {
              timeout: 10_000,
              intervals: [500, 1_000]
-            }).toBe(EXPECTED_REMOTE_PEERS);
+            }).toBe(true);
          }

          if (Date.now() < deadline) {
@@ -749,63 +764,6 @@ async function waitForLocalVoiceChannelConnection(page: Page, channelName: strin

 // ── Roster / state helpers ───────────────────────────────────────────

-async function waitForVoiceWorkspaceUserCount(page: Page, expectedCount: number): Promise<void> {
-  await page.waitForFunction(
-    (count) => {
-      interface AngularDebugApi {
-        getComponent: (element: Element) => Record<string, unknown>;
-      }
-
-      const host = document.querySelector('app-voice-workspace');
-      const debugApi = (window as { ng?: AngularDebugApi }).ng;
-
-      if (!host || !debugApi?.getComponent) {
-        return false;
-      }
-
-      const component = debugApi.getComponent(host);
-      const connectedUsers = (component['connectedVoiceUsers'] as (() => unknown[]) | undefined)?.() ?? [];
-
-      return connectedUsers.length === count;
-    },
-    expectedCount,
-    { timeout: 45_000 }
-  );
-}
-
-async function waitForVoiceRosterCount(page: Page, channelName: string, expectedCount: number): Promise<void> {
-  await page.waitForFunction(
-    ({ expected, name }) => {
-      interface ChannelShape { id: string; name: string; type: 'text' | 'voice' }
-      interface RoomShape { channels?: ChannelShape[] }
-      interface AngularDebugApi {
-        getComponent: (element: Element) => Record<string, unknown>;
-      }
-
-      const host = document.querySelector('app-rooms-side-panel');
-      const debugApi = (window as { ng?: AngularDebugApi }).ng;
-
-      if (!host || !debugApi?.getComponent) {
-        return false;
-      }
-
-      const component = debugApi.getComponent(host);
-      const currentRoom = (component['currentRoom'] as (() => RoomShape | null) | undefined)?.() ?? null;
-      const channelId = currentRoom?.channels?.find((ch) => ch.type === 'voice' && ch.name === name)?.id;
-
-      if (!channelId) {
-        return false;
-      }
-
-      const roster = (component['voiceUsersInRoom'] as ((roomId: string) => unknown[]) | undefined)?.(channelId) ?? [];
-
-      return roster.length === expected;
-    },
-    { expected: expectedCount, name: channelName },
-    { timeout: 30_000 }
-  );
-}
-
 async function waitForVoiceStateAcrossPages(
  clients: readonly TestClient[],
  displayName: string,
@@ -6,14 +6,21 @@ import {
  dumpRtcDiagnostics,
  getConnectedPeerCount,
  installWebRTCTracking,
+  installAutoResumeAudioContext,
  waitForAllPeerAudioFlow,
  waitForAudioStatsPresent,
-  waitForConnectedPeerCount,
  waitForPeerConnected
 } from '../../helpers/webrtc-helpers';
 import { RegisterPage } from '../../pages/register.page';
 import { ServerSearchPage } from '../../pages/server-search.page';
 import { ChatRoomPage } from '../../pages/chat-room.page';
+import { waitForVoiceRosterCount } from '../../helpers/voice-roster';
+import {
+  getConnectedSignalManagerCount,
+  getMinimumConnectedPeerMeshCount,
+  waitForConnectedRemotePeerMesh,
+  waitForConnectedSignalManagerCount
+} from '../../helpers/signal-manager';

 const PRIMARY_SIGNAL_ID = 'e2e-test-server-a';
 const SECONDARY_SIGNAL_ID = 'e2e-test-server-b';
@@ -116,8 +123,11 @@ test.describe('Dual-signal multi-user voice', () => {

        for (const client of clients) {
          await joinVoiceChannelUntilConnected(client.page, VOICE_CHANNEL);
+          await client.page.waitForTimeout(2_000);
        }

+        await clients[0].page.waitForTimeout(10_000);
+
        for (const client of clients) {
          await waitForVoiceRosterCount(client.page, VOICE_CHANNEL, USER_COUNT);
        }
@@ -126,12 +136,12 @@ test.describe('Dual-signal multi-user voice', () => {
      await test.step('All users discover all peers and audio flows pairwise', async () => {
        // Wait for all clients to have at least one connected peer (fast)
        await Promise.all(clients.map((client) =>
-          waitForPeerConnected(client.page, 45_000)
+          waitForPeerConnected(client.page, 90_000)
        ));

        // Wait for all clients to have all 7 peers connected
        await Promise.all(clients.map((client) =>
-          waitForConnectedPeerCount(client.page, EXPECTED_REMOTE_PEERS, 90_000)
+          waitForConnectedRemotePeerMesh(client.page, EXPECTED_REMOTE_PEERS, 180_000)
        ));

        // Wait for audio stats to appear on all clients
@@ -146,7 +156,7 @@ test.describe('Dual-signal multi-user voice', () => {

        // Check bidirectional audio flow on each client
        await Promise.all(clients.map((client) =>
-          waitForAllPeerAudioFlow(client.page, EXPECTED_REMOTE_PEERS, 90_000)
+          waitForAllPeerAudioFlow(client.page, EXPECTED_REMOTE_PEERS, 300_000)
        ));
      });

@@ -156,7 +166,6 @@ test.describe('Dual-signal multi-user voice', () => {

          await openVoiceWorkspace(client.page);
          await expect(room.voiceWorkspace).toBeVisible({ timeout: 10_000 });
-          await waitForVoiceWorkspaceUserCount(client.page, USER_COUNT);
          await waitForVoiceRosterCount(client.page, VOICE_CHANNEL, USER_COUNT);
          await waitForConnectedSignalManagerCount(client.page, 2);
        }
@@ -167,10 +176,15 @@ test.describe('Dual-signal multi-user voice', () => {

        while (Date.now() < deadline) {
          for (const client of clients) {
-            await expect.poll(async () => await getConnectedPeerCount(client.page), {
+            await expect.poll(async () => {
+              const actual = await getConnectedPeerCount(client.page);
+              const minimum = await getMinimumConnectedPeerMeshCount(client.page, EXPECTED_REMOTE_PEERS);
+
+              return actual >= minimum;
+            }, {
              timeout: 10_000,
              intervals: [500, 1_000]
-            }).toBe(EXPECTED_REMOTE_PEERS);
+            }).toBe(true);

            await expect.poll(async () => await getConnectedSignalManagerCount(client.page), {
              timeout: 10_000,
@@ -292,7 +306,8 @@ async function createTrackedClients(

    await installTestServerEndpoints(client.context, endpoints);
    await installDeterministicVoiceSettings(client.page);
-    await installWebRTCTracking(client.page);
+    await installWebRTCTracking(client.context);
+    await installAutoResumeAudioContext(client.page);

    clients.push({
      ...client,
@@ -576,124 +591,6 @@ async function getVoiceJoinDiagnostics(page: Page, channelName: string): Promise
  }, channelName);
 }

-async function waitForConnectedSignalManagerCount(page: Page, expectedCount: number): Promise<void> {
-  await page.waitForFunction(
-    (count) => {
-      interface AngularDebugApi {
-        getComponent: (element: Element) => Record<string, unknown>;
-      }
-
-      const host = document.querySelector('app-rooms-side-panel');
-      const debugApi = (window as { ng?: AngularDebugApi }).ng;
-
-      if (!host || !debugApi?.getComponent) {
-        return false;
-      }
-
-      const component = debugApi.getComponent(host);
-      const realtime = component['realtime'] as {
-        signalingTransportHandler?: {
-          getConnectedSignalingManagers?: () => { signalUrl: string }[];
-        };
-      } | undefined;
-      const countValue = realtime?.signalingTransportHandler?.getConnectedSignalingManagers?.().length ?? 0;
-
-      return countValue === count;
-    },
-    expectedCount,
-    { timeout: 30_000 }
-  );
-}
-
-async function getConnectedSignalManagerCount(page: Page): Promise<number> {
-  return await page.evaluate(() => {
-    interface AngularDebugApi {
-      getComponent: (element: Element) => Record<string, unknown>;
-    }
-
-    const host = document.querySelector('app-rooms-side-panel');
-    const debugApi = (window as { ng?: AngularDebugApi }).ng;
-
-    if (!host || !debugApi?.getComponent) {
-      return 0;
-    }
-
-    const component = debugApi.getComponent(host);
-    const realtime = component['realtime'] as {
-      signalingTransportHandler?: {
-        getConnectedSignalingManagers?: () => { signalUrl: string }[];
-      };
-    } | undefined;
-
-    return realtime?.signalingTransportHandler?.getConnectedSignalingManagers?.().length ?? 0;
-  });
-}
-
-async function waitForVoiceWorkspaceUserCount(page: Page, expectedCount: number): Promise<void> {
-  await page.waitForFunction(
-    (count) => {
-      interface AngularDebugApi {
-        getComponent: (element: Element) => Record<string, unknown>;
-      }
-
-      const host = document.querySelector('app-voice-workspace');
-      const debugApi = (window as { ng?: AngularDebugApi }).ng;
-
-      if (!host || !debugApi?.getComponent) {
-        return false;
-      }
-
-      const component = debugApi.getComponent(host);
-      const connectedUsers = (component['connectedVoiceUsers'] as (() => unknown[]) | undefined)?.() ?? [];
-
-      return connectedUsers.length === count;
-    },
-    expectedCount,
-    { timeout: 45_000 }
-  );
-}
-
-async function waitForVoiceRosterCount(page: Page, channelName: string, expectedCount: number): Promise<void> {
-  await page.waitForFunction(
-    ({ expected, name }) => {
-      interface ChannelShape {
-        id: string;
-        name: string;
-        type: 'text' | 'voice';
-      }
-
-      interface RoomShape {
-        channels?: ChannelShape[];
-      }
-
-      interface AngularDebugApi {
-        getComponent: (element: Element) => Record<string, unknown>;
-      }
-
-      const host = document.querySelector('app-rooms-side-panel');
-      const debugApi = (window as { ng?: AngularDebugApi }).ng;
-
-      if (!host || !debugApi?.getComponent) {
-        return false;
-      }
-
-      const component = debugApi.getComponent(host);
-      const currentRoom = (component['currentRoom'] as (() => RoomShape | null) | undefined)?.() ?? null;
-      const channelId = currentRoom?.channels?.find((channel) => channel.type === 'voice' && channel.name === name)?.id;
-
-      if (!channelId) {
-        return false;
-      }
-
-      const roster = (component['voiceUsersInRoom'] as ((roomId: string) => unknown[]) | undefined)?.(channelId) ?? [];
-
-      return roster.length === expected;
-    },
-    { expected: expectedCount, name: channelName },
-    { timeout: 30_000 }
-  );
-}
-
 async function waitForVoiceStateAcrossPages(
  clients: readonly TestClient[],
  displayName: string,
@@ -0,0 +1,127 @@
+import { test, expect } from '../../fixtures/multi-client';
+import {
+  MULTI_DEVICE_PASSWORD,
+  MULTI_DEVICE_VOICE_CHANNEL,
+  closeClient,
+  loginSecondDeviceIntoServer,
+  uniqueMultiDeviceName
+} from '../../helpers/multi-device-session';
+import { RegisterPage } from '../../pages/register.page';
+import { ServerSearchPage } from '../../pages/server-search.page';
+import { ChatRoomPage } from '../../pages/chat-room.page';
+
+async function waitForVoiceMuteState(
+  page: import('@playwright/test').Page,
+  displayName: string,
+  expectedMuted: boolean,
+  timeout = 45_000
+): Promise<void> {
+  await page.waitForFunction(
+    ({ expectedDisplayName, expectedMuted: muted }) => {
+      interface VoiceStateShape { isMuted?: boolean }
+      interface UserShape { displayName: string; voiceState?: VoiceStateShape }
+      interface ChannelShape { id: string; type: 'text' | 'voice' }
+      interface RoomShape { channels?: ChannelShape[] }
+      interface AngularDebugApi {
+        getComponent: (element: Element) => Record<string, unknown>;
+      }
+
+      const host = document.querySelector('app-rooms-side-panel');
+      const debugApi = (window as { ng?: AngularDebugApi }).ng;
+
+      if (!host || !debugApi?.getComponent) {
+        return false;
+      }
+
+      const component = debugApi.getComponent(host);
+      const currentRoom = (component['currentRoom'] as (() => RoomShape | null) | undefined)?.() ?? null;
+      const voiceChannel = currentRoom?.channels?.find((channel) => channel.type === 'voice');
+
+      if (!voiceChannel) {
+        return false;
+      }
+
+      const roster = (component['voiceUsersInRoom'] as ((roomId: string) => UserShape[]) | undefined)?.(voiceChannel.id) ?? [];
+      const entry = roster.find((userEntry) => userEntry.displayName === expectedDisplayName);
+
+      return entry?.voiceState?.isMuted === muted;
+    },
+    { expectedDisplayName: displayName, expectedMuted },
+    { timeout }
+  );
+}
+
+test.describe('Voice mute state reset', () => {
+  test.describe.configure({ timeout: 300_000, retries: 1 });
+
+  test('clears stale mute state after abrupt disconnect and voice rejoin', async ({ createClient }) => {
+    const suffix = uniqueMultiDeviceName('voice-mute-reset');
+    const hostCredentials = {
+      username: `host_${suffix}`,
+      displayName: 'Voice Host',
+      password: MULTI_DEVICE_PASSWORD
+    };
+    const guestCredentials = {
+      username: `guest_${suffix}`,
+      displayName: 'Voice Guest',
+      password: MULTI_DEVICE_PASSWORD
+    };
+    const serverName = `Voice Mute Reset ${suffix}`;
+
+    let hostClient = await createClient();
+
+    const guestClient = await createClient();
+
+    await test.step('host creates the shared server', async () => {
+      const registerPage = new RegisterPage(hostClient.page);
+
+      await registerPage.goto();
+      await registerPage.register(hostCredentials.username, hostCredentials.displayName, hostCredentials.password);
+      await expect(hostClient.page).toHaveURL(/\/dashboard/, { timeout: 15_000 });
+
+      const search = new ServerSearchPage(hostClient.page);
+
+      await search.createServer(serverName, { description: 'Voice mute reset coverage' });
+      await expect(hostClient.page).toHaveURL(/\/room\//, { timeout: 15_000 });
+    });
+
+    const hostRoom = new ChatRoomPage(hostClient.page);
+
+    await hostRoom.ensureVoiceChannelExists(MULTI_DEVICE_VOICE_CHANNEL);
+
+    await test.step('guest joins the server', async () => {
+      const registerPage = new RegisterPage(guestClient.page);
+
+      await registerPage.goto();
+      await registerPage.register(guestCredentials.username, guestCredentials.displayName, guestCredentials.password);
+      await expect(guestClient.page).toHaveURL(/\/dashboard/, { timeout: 15_000 });
+
+      const search = new ServerSearchPage(guestClient.page);
+
+      await search.joinServerFromSearch(serverName);
+      await expect(guestClient.page).toHaveURL(/\/room\//, { timeout: 20_000 });
+    });
+
+    await test.step('host joins voice muted and guest observes the muted state', async () => {
+      await hostRoom.joinVoiceChannel(MULTI_DEVICE_VOICE_CHANNEL);
+      await expect(hostRoom.voiceControls).toBeVisible({ timeout: 20_000 });
+      await hostRoom.muteButton.click();
+
+      await waitForVoiceMuteState(guestClient.page, hostCredentials.displayName, true);
+    });
+
+    await test.step('abrupt host disconnect clears stale mute before rejoin', async () => {
+      await closeClient(hostClient);
+
+      hostClient = await createClient();
+      await loginSecondDeviceIntoServer(hostClient.page, hostCredentials, serverName);
+
+      const reopenedRoom = new ChatRoomPage(hostClient.page);
+
+      await reopenedRoom.joinVoiceChannel(MULTI_DEVICE_VOICE_CHANNEL);
+      await expect(reopenedRoom.voiceControls).toBeVisible({ timeout: 20_000 });
+
+      await waitForVoiceMuteState(guestClient.page, hostCredentials.displayName, false);
+    });
+  });
+});
@@ -4,6 +4,10 @@ export interface AppMetricsProcessSnapshot {
  pid: number;
  type: string;
  workingSetKb: number | null;
+  peakWorkingSetKb: number | null;
+  privateBytesKb: number | null;
+  creationTime: number | null;
+  cpuPercent: number | null;
 }

 export interface AppMetricsSnapshot {
@@ -17,7 +21,17 @@ export function collectAppMetricsSnapshot(): AppMetricsSnapshot {
    processes: app.getAppMetrics().map((metric) => ({
      pid: metric.pid,
      type: metric.type,
-      workingSetKb: metric.memory?.workingSetSize ?? null
+      workingSetKb: metric.memory?.workingSetSize ?? null,
+      peakWorkingSetKb: readOptionalKilobytes(metric.memory?.peakWorkingSetSize),
+      privateBytesKb: readOptionalKilobytes(metric.memory?.privateBytes),
+      creationTime: metric.creationTime ?? null,
+      cpuPercent: typeof metric.cpu?.percentCPUUsage === 'number'
+        ? Math.round(metric.cpu.percentCPUUsage * 10) / 10
+        : null
    }))
  };
 }
+
+function readOptionalKilobytes(value: number | undefined): number | null {
+  return typeof value === 'number' && value >= 0 ? value : null;
+}
@@ -25,7 +25,9 @@ import { startIdleMonitor, stopIdleMonitor } from '../idle/idle-monitor';
 import {
  attachRendererDiagnosticsHooks,
  ensurePerfDiagIpcRegistered,
+  shutdownHighMemoryMonitoring,
  shutdownPerfDiagnostics,
+  startHighMemoryMonitoring,
  startPerfDiagnostics
 } from '../diagnostics';

@@ -39,6 +41,7 @@ function startLocalApiAfterWindowReady(): void {

 export function registerAppLifecycle(): void {
  ensurePerfDiagIpcRegistered();
+  startHighMemoryMonitoring();

  app.whenReady().then(async () => {
    const dockIconPath = getDockIconPath();
@@ -83,6 +86,7 @@ export function registerAppLifecycle(): void {

  app.on('before-quit', async (event) => {
    prepareWindowForAppQuit();
+    shutdownHighMemoryMonitoring();
    await shutdownPerfDiagnostics();

    if (getDataSource()?.isInitialized) {
@@ -8,7 +8,7 @@ import { isPerfDiagEnabled } from './diagnostics.flags';
 describe('isPerfDiagEnabled', () => {
  it('returns false when the flag is unset', () => {
    expect(isPerfDiagEnabled({}, false)).toBe(false);
-    expect(isPerfDiagEnabled({}, true)).toBe(false);
+    expect(isPerfDiagEnabled({}, true)).toBe(true);
  });

  it('returns true in development when METOYOU_PERF_DIAG is truthy', () => {
@@ -17,11 +17,12 @@ describe('isPerfDiagEnabled', () => {
    expect(isPerfDiagEnabled({ METOYOU_PERF_DIAG: 'on' }, false)).toBe(true);
  });

-  it('returns false in packaged builds unless force is set', () => {
-    expect(isPerfDiagEnabled({ METOYOU_PERF_DIAG: '1' }, true)).toBe(false);
-    expect(isPerfDiagEnabled({
-      METOYOU_PERF_DIAG: '1',
-      METOYOU_PERF_DIAG_FORCE: '1'
-    }, true)).toBe(true);
+  it('returns true in packaged Electron builds without env flags', () => {
+    expect(isPerfDiagEnabled({}, true)).toBe(true);
+    expect(isPerfDiagEnabled({ METOYOU_PERF_DIAG: '0' }, true)).toBe(true);
+  });
+
+  it('returns false in development when the flag is unset', () => {
+    expect(isPerfDiagEnabled({}, false)).toBe(false);
  });
 });
@@ -17,13 +17,9 @@ export function isPerfDiagEnabled(
  env: NodeJS.ProcessEnv,
  isPackaged: boolean
 ): boolean {
-  if (!isTruthyFlag(env[PERF_DIAG_ENV])) {
-    return false;
+  if (isPackaged) {
+    return true;
  }

-  if (isPackaged && !isTruthyFlag(env[PERF_DIAG_FORCE_ENV])) {
-    return false;
-  }
-
-  return true;
+  return isTruthyFlag(env[PERF_DIAG_ENV]);
 }
@@ -1,20 +1,36 @@
 import {
  app,
  BrowserWindow,
-  ipcMain
+  ipcMain,
+  shell
 } from 'electron';
-import { collectAppMetricsSnapshot } from '../app-metrics';
+import { collectAppMetricsSnapshot, type AppMetricsSnapshot } from '../app-metrics';
+import { getMainWindow } from '../window/create-window';
+import { resolveReadablePath } from '../path-jail';
 import { sumWorkingSetKb } from './process-metrics.rules';
 import { isPerfDiagEnabled } from './diagnostics.flags';
+import { exceedsHighMemoryThreshold } from './high-memory-alert.rules';
+import { captureHighMemoryDiagnostics } from './high-memory-capture';
+import { collectSessionContext } from './session-context.collector';
+import {
+  clearHighMemoryAlert,
+  readHighMemoryAlert,
+  writeHighMemoryAlert,
+  type HighMemoryAlertRecord
+} from './high-memory-alert.store';
 import type { PerfDiagEntry } from './diagnostics.models';
 import { PerfDiagWriter } from './diagnostics.writer';

 const PROCESS_POLL_INTERVAL_MS = 5_000;

+export const HIGH_MEMORY_ALERT_PENDING_CHANNEL = 'high-memory-alert-pending';
+
 let activeWriter: PerfDiagWriter | null = null;
 let processPollTimer: NodeJS.Timeout | null = null;
 let diagnosticsEnabled = false;
 let ipcRegistered = false;
+let highMemoryAlertTriggeredThisSession = false;
+let sessionStartedAt = 0;

 export function isPerfDiagActive(): boolean {
  return diagnosticsEnabled;
@@ -43,14 +59,103 @@ export function ensurePerfDiagIpcRegistered(): void {
      return false;
    }
  });
+
+  ipcMain.handle('get-pending-high-memory-alert', async () => {
+    return readHighMemoryAlert(app.getPath('userData'));
+  });
+
+  ipcMain.handle('acknowledge-high-memory-alert', async () => {
+    await clearHighMemoryAlert(app.getPath('userData'));
+    return true;
+  });
+
+  ipcMain.handle('export-high-memory-diagnostics', async () => {
+    const metrics = collectAppMetricsSnapshot();
+    const totalKb = sumWorkingSetKb(metrics.processes) ?? 0;
+    const record = await captureHighMemoryDiagnostics({
+      userDataPath: app.getPath('userData'),
+      sessionStartedAt,
+      metrics,
+      totalWorkingSetKb: totalKb,
+      writer: activeWriter,
+      mainWindow: getMainWindow(),
+      reason: 'manual'
+    });
+
+    await persistAndNotifyHighMemoryAlert(record);
+
+    return record;
+  });
+
+  ipcMain.handle('show-log-file-in-folder', async (_event, filePath: string) => {
+    if (typeof filePath !== 'string' || !filePath.trim()) {
+      return {
+        shown: false,
+        reason: 'missing-path'
+      };
+    }
+
+    const scopedPath = await resolveReadablePath(filePath);
+
+    if (!scopedPath) {
+      return {
+        shown: false,
+        reason: 'outside-app-data'
+      };
+    }
+
+    shell.showItemInFolder(scopedPath);
+
+    return { shown: true };
+  });
 }

 export function getActivePerfDiagWriter(): PerfDiagWriter | null {
  return activeWriter;
 }

+export function startHighMemoryMonitoring(): void {
+  ensurePerfDiagIpcRegistered();
+
+  if (!sessionStartedAt) {
+    sessionStartedAt = Date.now();
+    highMemoryAlertTriggeredThisSession = false;
+  }
+
+  if (processPollTimer) {
+    return;
+  }
+
+  const sample = (): void => {
+    try {
+      const metrics = collectAppMetricsSnapshot();
+      const totalKb = sumWorkingSetKb(metrics.processes);
+
+      if (activeWriter && diagnosticsEnabled) {
+        activeWriter.append({
+          collectedAt: metrics.collectedAt,
+          source: 'main',
+          type: 'process',
+          payload: {
+            totalWorkingSetKb: totalKb,
+            processes: metrics.processes
+          }
+        });
+      }
+
+      void maybeTriggerHighMemoryAlert(metrics, totalKb);
+    } catch {
+      // Collector failures must never affect the app.
+    }
+  };
+
+  sample();
+  processPollTimer = setInterval(sample, PROCESS_POLL_INTERVAL_MS);
+}
+
 export function startPerfDiagnostics(): PerfDiagWriter | null {
  ensurePerfDiagIpcRegistered();
+  startHighMemoryMonitoring();
  diagnosticsEnabled = isPerfDiagEnabled(process.env, app.isPackaged);

  if (!diagnosticsEnabled) {
@@ -65,7 +170,8 @@ export function startPerfDiagnostics(): PerfDiagWriter | null {

  activeWriter = writer;
  registerProcessCrashHandlers(writer);
-  startProcessMetricsPolling(writer);
+
+  const userDataPath = app.getPath('userData');

  writer.append({
    collectedAt: Date.now(),
@@ -78,6 +184,18 @@ export function startPerfDiagnostics(): PerfDiagWriter | null {
    }
  });

+  writer.append({
+    collectedAt: Date.now(),
+    source: 'main',
+    type: 'environment',
+    payload: {
+      ...collectSessionContext({
+        sessionStartedAt,
+        userDataPath
+      })
+    }
+  });
+
  return writer;
 }

@@ -127,14 +245,15 @@ export async function shutdownPerfDiagnostics(): Promise<void> {
  }

  await activeWriter.flushSnapshot('shutdown');
+  activeWriter = null;
+  diagnosticsEnabled = false;
+}

+export function shutdownHighMemoryMonitoring(): void {
  if (processPollTimer) {
    clearInterval(processPollTimer);
    processPollTimer = null;
  }
-
-  activeWriter = null;
-  diagnosticsEnabled = false;
 }

 function registerProcessCrashHandlers(writer: PerfDiagWriter): void {
@@ -180,28 +299,36 @@ function registerProcessCrashHandlers(writer: PerfDiagWriter): void {
  });
 }

-function startProcessMetricsPolling(writer: PerfDiagWriter): void {
-  const sample = (): void => {
-    try {
-      const metrics = collectAppMetricsSnapshot();
-      const totalKb = sumWorkingSetKb(metrics.processes);
+async function maybeTriggerHighMemoryAlert(
+  metrics: AppMetricsSnapshot,
+  totalWorkingSetKb: number | null
+): Promise<void> {
+  if (highMemoryAlertTriggeredThisSession || !exceedsHighMemoryThreshold(totalWorkingSetKb)) {
+    return;
+  }

-      writer.append({
-        collectedAt: metrics.collectedAt,
-        source: 'main',
-        type: 'process',
-        payload: {
-          totalWorkingSetKb: totalKb,
-          processes: metrics.processes
-        }
-      });
-    } catch {
-      // Collector failures must never affect the app.
-    }
-  };
+  highMemoryAlertTriggeredThisSession = true;

-  sample();
-  processPollTimer = setInterval(sample, PROCESS_POLL_INTERVAL_MS);
+  const record = await captureHighMemoryDiagnostics({
+    userDataPath: app.getPath('userData'),
+    sessionStartedAt,
+    metrics,
+    totalWorkingSetKb: totalWorkingSetKb ?? 0,
+    writer: activeWriter,
+    mainWindow: getMainWindow(),
+    reason: 'threshold'
+  });
+
+  await persistAndNotifyHighMemoryAlert(record);
+}
+
+async function persistAndNotifyHighMemoryAlert(record: HighMemoryAlertRecord): Promise<void> {
+  await writeHighMemoryAlert(app.getPath('userData'), record);
+  notifyHighMemoryAlert(record);
+}
+
+function notifyHighMemoryAlert(record: HighMemoryAlertRecord): void {
+  getMainWindow()?.webContents.send(HIGH_MEMORY_ALERT_PENDING_CHANNEL, record);
 }

 function normalizeRendererEntry(entry: PerfDiagEntry): PerfDiagEntry {
@@ -2,10 +2,12 @@ export type PerfDiagSource = 'main' | 'renderer';

 export type PerfDiagEntryType =
  | 'session'
+  | 'environment'
  | 'process'
  | 'store'
  | 'components'
  | 'heap'
+  | 'high-memory'
  | 'crash'
  | 'unresponsive';

@@ -7,7 +7,7 @@ import {
  resolveDiagnosticsFilePath
 } from './diagnostics.rules';

-const DEFAULT_RING_CAPACITY = 120;
+const DEFAULT_RING_CAPACITY = 300;
 const FLUSH_DEBOUNCE_MS = 250;

 export interface PerfDiagWriterOptions {
@@ -18,6 +18,7 @@ export interface PerfDiagWriterOptions {

 export class PerfDiagWriter {
  private readonly filePath: string;
+  private readonly sessionIdValue: string;
  private readonly ringCapacity: number;
  private readonly pendingLines: string[] = [];
  private ring: PerfDiagEntry[] = [];
@@ -26,10 +27,15 @@ export class PerfDiagWriter {
  private disabled = false;

  constructor(options: PerfDiagWriterOptions) {
+    this.sessionIdValue = options.sessionId;
    this.filePath = resolveDiagnosticsFilePath(options.userDataPath, options.sessionId);
    this.ringCapacity = options.ringCapacity ?? DEFAULT_RING_CAPACITY;
  }

+  get sessionId(): string {
+    return this.sessionIdValue;
+  }
+
  get snapshotFilePath(): string {
    return this.filePath;
  }
@@ -0,0 +1,27 @@
+import {
+  describe,
+  expect,
+  it
+} from 'vitest';
+import {
+  exceedsHighMemoryThreshold,
+  formatWorkingSetGb,
+  HIGH_MEMORY_THRESHOLD_KB
+} from './high-memory-alert.rules';
+
+describe('high-memory-alert.rules', () => {
+  it('uses a 2 GiB working-set threshold', () => {
+    expect(HIGH_MEMORY_THRESHOLD_KB).toBe(2 * 1024 * 1024);
+  });
+
+  it('detects totals at or above the threshold', () => {
+    expect(exceedsHighMemoryThreshold(HIGH_MEMORY_THRESHOLD_KB - 1)).toBe(false);
+    expect(exceedsHighMemoryThreshold(HIGH_MEMORY_THRESHOLD_KB)).toBe(true);
+    expect(exceedsHighMemoryThreshold(HIGH_MEMORY_THRESHOLD_KB + 1024)).toBe(true);
+  });
+
+  it('formats working set totals in gigabytes', () => {
+    expect(formatWorkingSetGb(1536 * 1024)).toBe('1.50');
+    expect(formatWorkingSetGb(HIGH_MEMORY_THRESHOLD_KB)).toBe('2.00');
+  });
+});
@@ -0,0 +1,11 @@
+/** 2 GiB working-set threshold for writing a diagnostics snapshot. */
+export const HIGH_MEMORY_THRESHOLD_KB = 2 * 1024 * 1024;
+
+export function exceedsHighMemoryThreshold(totalWorkingSetKb: number | null | undefined): boolean {
+  return typeof totalWorkingSetKb === 'number'
+    && totalWorkingSetKb >= HIGH_MEMORY_THRESHOLD_KB;
+}
+
+export function formatWorkingSetGb(totalWorkingSetKb: number): string {
+  return (totalWorkingSetKb / (1024 * 1024)).toFixed(2);
+}
@@ -0,0 +1,65 @@
+import * as fsp from 'fs/promises';
+import * as os from 'os';
+import * as path from 'path';
+import {
+  afterEach,
+  describe,
+  expect,
+  it
+} from 'vitest';
+import {
+  clearHighMemoryAlert,
+  readHighMemoryAlert,
+  resolveHighMemoryAlertPath,
+  writeHighMemoryAlert
+} from './high-memory-alert.store';
+
+describe('high-memory-alert.store', () => {
+  const tempDirs: string[] = [];
+
+  afterEach(async () => {
+    await Promise.all(tempDirs.splice(0).map((dir) => fsp.rm(dir, {
+      recursive: true,
+      force: true
+    })));
+  });
+
+  it('writes and reads a pending startup alert record', async () => {
+    const userDataPath = await fsp.mkdtemp(path.join(os.tmpdir(), 'metoyou-high-memory-'));
+
+    tempDirs.push(userDataPath);
+
+    const record = {
+      logFilePath: path.join(userDataPath, 'diagnostics', 'perf-session.jsonl'),
+      detectedAt: 1_700_000_000_000,
+      peakWorkingSetKb: 2_200_000,
+      sessionId: 'session-1',
+      reason: 'threshold' as const
+    };
+
+    await writeHighMemoryAlert(userDataPath, record);
+
+    expect(resolveHighMemoryAlertPath(userDataPath)).toBe(
+      path.join(userDataPath, 'diagnostics', 'high-memory-pending.json')
+    );
+
+    expect(await readHighMemoryAlert(userDataPath)).toEqual(record);
+  });
+
+  it('clears the pending startup alert record', async () => {
+    const userDataPath = await fsp.mkdtemp(path.join(os.tmpdir(), 'metoyou-high-memory-'));
+
+    tempDirs.push(userDataPath);
+
+    await writeHighMemoryAlert(userDataPath, {
+      logFilePath: '/tmp/perf.jsonl',
+      detectedAt: Date.now(),
+      peakWorkingSetKb: 2_100_000,
+      sessionId: 'session-2'
+    });
+
+    await clearHighMemoryAlert(userDataPath);
+
+    expect(await readHighMemoryAlert(userDataPath)).toBeNull();
+  });
+});
@@ -0,0 +1,63 @@
+import * as fsp from 'fs/promises';
+import * as path from 'path';
+
+export type HighMemoryAlertReason = 'manual' | 'threshold';
+
+export interface HighMemoryAlertRecord {
+  logFilePath: string;
+  detectedAt: number;
+  peakWorkingSetKb: number;
+  sessionId: string;
+  reason?: HighMemoryAlertReason;
+}
+
+export function resolveHighMemoryAlertPath(userDataPath: string): string {
+  return path.join(userDataPath, 'diagnostics', 'high-memory-pending.json');
+}
+
+export async function readHighMemoryAlert(userDataPath: string): Promise<HighMemoryAlertRecord | null> {
+  try {
+    const raw = await fsp.readFile(resolveHighMemoryAlertPath(userDataPath), 'utf8');
+    const parsed = JSON.parse(raw) as Partial<HighMemoryAlertRecord>;
+
+    if (
+      typeof parsed.logFilePath !== 'string'
+      || !parsed.logFilePath.trim()
+      || typeof parsed.detectedAt !== 'number'
+      || typeof parsed.peakWorkingSetKb !== 'number'
+      || typeof parsed.sessionId !== 'string'
+    ) {
+      return null;
+    }
+
+    return {
+      logFilePath: parsed.logFilePath,
+      detectedAt: parsed.detectedAt,
+      peakWorkingSetKb: parsed.peakWorkingSetKb,
+      sessionId: parsed.sessionId,
+      ...(parsed.reason === 'manual' || parsed.reason === 'threshold'
+        ? { reason: parsed.reason }
+        : {})
+    };
+  } catch {
+    return null;
+  }
+}
+
+export async function writeHighMemoryAlert(
+  userDataPath: string,
+  record: HighMemoryAlertRecord
+): Promise<void> {
+  const filePath = resolveHighMemoryAlertPath(userDataPath);
+
+  await fsp.mkdir(path.dirname(filePath), { recursive: true });
+  await fsp.writeFile(filePath, `${JSON.stringify(record, null, 2)}\n`, 'utf8');
+}
+
+export async function clearHighMemoryAlert(userDataPath: string): Promise<void> {
+  try {
+    await fsp.unlink(resolveHighMemoryAlertPath(userDataPath));
+  } catch {
+    // Missing pending alert is fine.
+  }
+}
@@ -0,0 +1,57 @@
+import {
+  beforeEach,
+  describe,
+  expect,
+  it,
+  vi
+} from 'vitest';
+import * as os from 'os';
+import * as path from 'path';
+import * as fsp from 'fs/promises';
+
+import { captureHighMemoryDiagnostics } from './high-memory-capture';
+
+vi.mock('./immediate-renderer-samples.collector', () => ({
+  collectImmediateRendererSamples: vi.fn(async () => [])
+}));
+
+vi.mock('./session-context.collector', () => ({
+  collectSessionContext: vi.fn(() => ({
+    platform: 'linux',
+    userDataPath: '/tmp/user-data'
+  }))
+}));
+
+describe('captureHighMemoryDiagnostics', () => {
+  let userDataPath = '';
+
+  beforeEach(async () => {
+    userDataPath = await fsp.mkdtemp(path.join(os.tmpdir(), 'metoyou-high-memory-capture-'));
+  });
+
+  it('writes a diagnostics snapshot and returns an alert record', async () => {
+    const record = await captureHighMemoryDiagnostics({
+      userDataPath,
+      sessionStartedAt: Date.now() - 60_000,
+      metrics: {
+        collectedAt: Date.now(),
+        processes: [
+          {
+            pid: 1,
+            type: 'Browser',
+            workingSetKb: 2_200_000
+          }
+        ]
+      },
+      totalWorkingSetKb: 2_200_000,
+      writer: null,
+      mainWindow: null,
+      reason: 'manual'
+    });
+
+    expect(record.peakWorkingSetKb).toBe(2_200_000);
+    expect(record.reason).toBe('manual');
+    expect(record.logFilePath).toContain(userDataPath);
+    await expect(fsp.stat(record.logFilePath)).resolves.toBeDefined();
+  });
+});
@@ -0,0 +1,80 @@
+import type { BrowserWindow } from 'electron';
+import type { AppMetricsSnapshot } from '../app-metrics';
+import { buildHighMemoryDiagnosticPayload } from './high-memory-snapshot.rules';
+import { collectImmediateRendererSamples } from './immediate-renderer-samples.collector';
+import { collectSessionContext } from './session-context.collector';
+import type { HighMemoryAlertRecord } from './high-memory-alert.store';
+import type { PerfDiagEntry } from './diagnostics.models';
+import { PerfDiagWriter } from './diagnostics.writer';
+
+export type HighMemoryCaptureReason = 'manual' | 'threshold';
+
+export interface CaptureHighMemoryDiagnosticsInput {
+  userDataPath: string;
+  sessionStartedAt: number;
+  metrics: AppMetricsSnapshot;
+  totalWorkingSetKb: number;
+  writer: PerfDiagWriter | null;
+  mainWindow: BrowserWindow | null;
+  reason: HighMemoryCaptureReason;
+}
+
+export async function captureHighMemoryDiagnostics(
+  input: CaptureHighMemoryDiagnosticsInput
+): Promise<HighMemoryAlertRecord> {
+  const detectedAt = Date.now();
+  const writer = input.writer ?? new PerfDiagWriter({
+    userDataPath: input.userDataPath,
+    sessionId: `${input.reason}-${detectedAt.toString(36)}-${process.pid}`
+  });
+  const immediateRendererEntries = await collectImmediateRendererSamples(input.mainWindow);
+  const environment = collectSessionContext({
+    sessionStartedAt: input.sessionStartedAt,
+    userDataPath: input.userDataPath
+  });
+
+  appendEntries(writer, immediateRendererEntries);
+  appendEntries(writer, [
+    {
+      collectedAt: detectedAt,
+      source: 'main',
+      type: 'environment',
+      payload: {
+        ...environment
+      }
+    },
+    {
+      collectedAt: detectedAt,
+      source: 'main',
+      type: 'high-memory',
+      payload: buildHighMemoryDiagnosticPayload({
+        detectedAt,
+        totalWorkingSetKb: input.totalWorkingSetKb,
+        metrics: input.metrics,
+        environment,
+        mainProcessMemory: process.memoryUsage(),
+        ringEntries: writer.bufferedEntries,
+        immediateRendererEntries,
+        sessionId: writer.sessionId
+      })
+    }
+  ]);
+
+  await writer.flushSnapshot(
+    input.reason === 'manual' ? 'manual-export' : 'high-memory-threshold'
+  );
+
+  return {
+    logFilePath: writer.snapshotFilePath,
+    detectedAt,
+    peakWorkingSetKb: input.totalWorkingSetKb,
+    sessionId: writer.sessionId,
+    reason: input.reason
+  };
+}
+
+function appendEntries(writer: PerfDiagWriter, entries: readonly PerfDiagEntry[]): void {
+  for (const entry of entries) {
+    writer.append(entry);
+  }
+}
@@ -0,0 +1,201 @@
+import {
+  describe,
+  expect,
+  it
+} from 'vitest';
+import type { PerfDiagEntry } from './diagnostics.models';
+import {
+  buildHighMemoryDiagnosticPayload,
+  buildHighMemorySummary,
+  extractLatestRendererSamples,
+  extractProcessHistory,
+  formatMemoryUsageMb,
+  rankProcessesByWorkingSet,
+  summarizeRingBuffer
+} from './high-memory-snapshot.rules';
+
+function createProcess(overrides: Partial<{
+  pid: number;
+  type: string;
+  workingSetKb: number | null;
+  peakWorkingSetKb: number | null;
+  privateBytesKb: number | null;
+  creationTime: number | null;
+  cpuPercent: number | null;
+}> = {}) {
+  return {
+    pid: 1,
+    type: 'Tab',
+    workingSetKb: 1024,
+    peakWorkingSetKb: null,
+    privateBytesKb: null,
+    creationTime: null,
+    cpuPercent: null,
+    ...overrides
+  };
+}
+
+describe('high-memory-snapshot.rules', () => {
+  it('ranks processes by working set and computes share percentages', () => {
+    const tabProcess = createProcess({ pid: 1, type: 'Tab', workingSetKb: 512_000 });
+    const gpuProcess = createProcess({ pid: 2, type: 'GPU', workingSetKb: 1_536_000 });
+    const ranked = rankProcessesByWorkingSet([tabProcess, gpuProcess], 2_048_000);
+
+    expect(ranked[0]?.type).toBe('GPU');
+    expect(ranked[0]?.sharePercent).toBe(75);
+    expect(ranked[1]?.sharePercent).toBe(25);
+  });
+
+  it('extracts the latest renderer store, heap, and component samples', () => {
+    const entries: PerfDiagEntry[] = [
+      {
+        collectedAt: 1,
+        source: 'renderer',
+        type: 'store',
+        payload: { domains: { chat: 100 } }
+      },
+      {
+        collectedAt: 2,
+        source: 'renderer',
+        type: 'heap',
+        payload: { usedJsHeapMb: 120 }
+      },
+      {
+        collectedAt: 3,
+        source: 'renderer',
+        type: 'components',
+        payload: { suspectedLeaks: [{ name: 'ChatMessageItem', count: 40, expected: 20 }] }
+      },
+      {
+        collectedAt: 4,
+        source: 'renderer',
+        type: 'store',
+        payload: { domains: { chat: 500 } }
+      }
+    ];
+
+    expect(extractLatestRendererSamples(entries)).toEqual({
+      store: { domains: { chat: 500 } },
+      heap: { usedJsHeapMb: 120 },
+      components: { suspectedLeaks: [{ name: 'ChatMessageItem', count: 40, expected: 20 }] }
+    });
+  });
+
+  it('extracts recent process history from the ring buffer', () => {
+    const entries: PerfDiagEntry[] = [
+      {
+        collectedAt: 1,
+        source: 'main',
+        type: 'process',
+        payload: { totalWorkingSetKb: 1000 }
+      },
+      {
+        collectedAt: 2,
+        source: 'main',
+        type: 'session',
+        payload: { event: 'noop' }
+      },
+      {
+        collectedAt: 3,
+        source: 'main',
+        type: 'process',
+        payload: { totalWorkingSetKb: 2000 }
+      }
+    ];
+
+    expect(extractProcessHistory(entries)).toEqual([{ collectedAt: 1, totalWorkingSetKb: 1000 }, { collectedAt: 3, totalWorkingSetKb: 2000 }]);
+  });
+
+  it('summarizes ring buffer entry counts', () => {
+    expect(summarizeRingBuffer([
+      { collectedAt: 1, source: 'main', type: 'process', payload: {} },
+      { collectedAt: 2, source: 'renderer', type: 'heap', payload: {} },
+      { collectedAt: 3, source: 'main', type: 'process', payload: {} }
+    ])).toEqual({
+      'main:process': 2,
+      'renderer:heap': 1
+    });
+  });
+
+  it('builds a high-memory summary with threshold context', () => {
+    const summary = buildHighMemorySummary(
+      2_200_000,
+      [createProcess({ workingSetKb: 2_200_000 })],
+      1_700_000_000_000
+    );
+
+    expect(summary.totalWorkingSetGb).toBe('2.10');
+    expect(summary.thresholdGb).toBe('2.00');
+    expect(summary.topProcesses).toHaveLength(1);
+  });
+
+  it('builds a comprehensive high-memory diagnostic payload', () => {
+    const payload = buildHighMemoryDiagnosticPayload({
+      detectedAt: 1_700_000_000_000,
+      totalWorkingSetKb: 2_200_000,
+      metrics: {
+        collectedAt: 1_700_000_000_000,
+        processes: [
+          createProcess({
+            workingSetKb: 2_200_000,
+            peakWorkingSetKb: 2_300_000,
+            privateBytesKb: 1_800_000,
+            creationTime: 1,
+            cpuPercent: 12
+          })
+        ]
+      },
+      environment: { appVersion: '1.0.0' },
+      mainProcessMemory: {
+        rss: 64 * 1024 * 1024,
+        heapTotal: 32 * 1024 * 1024,
+        heapUsed: 16 * 1024 * 1024,
+        external: 8 * 1024 * 1024,
+        arrayBuffers: 1024
+      },
+      ringEntries: [
+        {
+          collectedAt: 1,
+          source: 'main',
+          type: 'process',
+          payload: { totalWorkingSetKb: 2_000_000 }
+        }
+      ],
+      immediateRendererEntries: [
+        {
+          collectedAt: 2,
+          source: 'renderer',
+          type: 'heap',
+          payload: { usedJsHeapMb: 300, route: '/room/abc' }
+        }
+      ],
+      sessionId: 'session-1'
+    });
+
+    expect(payload.event).toBe('high-memory-threshold');
+    expect(payload.summary).toMatchObject({
+      totalWorkingSetKb: 2_200_000
+    });
+
+    expect(payload.processHistory).toHaveLength(1);
+    expect(payload.recentRendererSamples).toEqual({
+      store: null,
+      heap: { usedJsHeapMb: 300, route: '/room/abc' },
+      components: null
+    });
+
+    expect(formatMemoryUsageMb({
+      rss: 64 * 1024 * 1024,
+      heapTotal: 32 * 1024 * 1024,
+      heapUsed: 16 * 1024 * 1024,
+      external: 8 * 1024 * 1024,
+      arrayBuffers: 1024
+    })).toEqual({
+      rssMb: 64,
+      heapTotalMb: 32,
+      heapUsedMb: 16,
+      externalMb: 8,
+      arrayBuffersMb: 0
+    });
+  });
+});
@@ -0,0 +1,179 @@
+import type { AppMetricsProcessSnapshot, AppMetricsSnapshot } from '../app-metrics';
+import type { PerfDiagEntry } from './diagnostics.models';
+import { formatWorkingSetGb, HIGH_MEMORY_THRESHOLD_KB } from './high-memory-alert.rules';
+import type { SessionContextSnapshot } from './session-context.collector';
+
+export interface RankedProcessSnapshot extends AppMetricsProcessSnapshot {
+  sharePercent: number;
+}
+
+export interface HighMemorySummary {
+  detectedAt: number;
+  thresholdKb: number;
+  thresholdGb: string;
+  totalWorkingSetKb: number;
+  totalWorkingSetGb: string;
+  topProcesses: RankedProcessSnapshot[];
+}
+
+export interface LatestRendererSamples {
+  store: Record<string, unknown> | null;
+  heap: Record<string, unknown> | null;
+  components: Record<string, unknown> | null;
+}
+
+export function rankProcessesByWorkingSet(
+  processes: readonly AppMetricsProcessSnapshot[],
+  totalWorkingSetKb: number | null
+): RankedProcessSnapshot[] {
+  const total = totalWorkingSetKb ?? 0;
+
+  return [...processes]
+    .filter((process) => process.workingSetKb != null && process.workingSetKb > 0)
+    .sort((left, right) => (right.workingSetKb ?? 0) - (left.workingSetKb ?? 0))
+    .map((process) => ({
+      ...process,
+      sharePercent: total > 0
+        ? Math.round(((process.workingSetKb ?? 0) / total) * 1000) / 10
+        : 0
+    }));
+}
+
+export function extractLatestRendererSamples(entries: readonly PerfDiagEntry[]): LatestRendererSamples {
+  let store: Record<string, unknown> | null = null;
+  let heap: Record<string, unknown> | null = null;
+  let components: Record<string, unknown> | null = null;
+
+  for (let index = entries.length - 1; index >= 0; index -= 1) {
+    const entry = entries[index];
+
+    if (entry.source !== 'renderer') {
+      continue;
+    }
+
+    if (!store && entry.type === 'store') {
+      store = entry.payload;
+    }
+
+    if (!heap && entry.type === 'heap') {
+      heap = entry.payload;
+    }
+
+    if (!components && entry.type === 'components') {
+      components = entry.payload;
+    }
+
+    if (store && heap && components) {
+      break;
+    }
+  }
+
+  return {
+    store,
+    heap,
+    components
+  };
+}
+
+export function extractProcessHistory(
+  entries: readonly PerfDiagEntry[],
+  limit = 24
+): Record<string, unknown>[] {
+  const history: Record<string, unknown>[] = [];
+
+  for (let index = entries.length - 1; index >= 0; index -= 1) {
+    const entry = entries[index];
+
+    if (entry.type !== 'process') {
+      continue;
+    }
+
+    history.unshift({
+      collectedAt: entry.collectedAt,
+      ...entry.payload
+    });
+
+    if (history.length >= limit) {
+      break;
+    }
+  }
+
+  return history;
+}
+
+export function summarizeRingBuffer(entries: readonly PerfDiagEntry[]): Record<string, number> {
+  const counts: Record<string, number> = {};
+
+  for (const entry of entries) {
+    const key = `${entry.source}:${entry.type}`;
+
+    counts[key] = (counts[key] ?? 0) + 1;
+  }
+
+  return counts;
+}
+
+export function buildHighMemorySummary(
+  totalWorkingSetKb: number,
+  processes: readonly AppMetricsProcessSnapshot[],
+  detectedAt: number
+): HighMemorySummary {
+  return {
+    detectedAt,
+    thresholdKb: HIGH_MEMORY_THRESHOLD_KB,
+    thresholdGb: formatWorkingSetGb(HIGH_MEMORY_THRESHOLD_KB),
+    totalWorkingSetKb,
+    totalWorkingSetGb: formatWorkingSetGb(totalWorkingSetKb),
+    topProcesses: rankProcessesByWorkingSet(processes, totalWorkingSetKb).slice(0, 12)
+  };
+}
+
+export function formatMemoryUsageMb(memoryUsage: NodeJS.MemoryUsage): Record<string, number> {
+  return {
+    rssMb: roundMb(memoryUsage.rss),
+    heapTotalMb: roundMb(memoryUsage.heapTotal),
+    heapUsedMb: roundMb(memoryUsage.heapUsed),
+    externalMb: roundMb(memoryUsage.external),
+    arrayBuffersMb: roundMb(memoryUsage.arrayBuffers ?? 0)
+  };
+}
+
+export function buildHighMemoryDiagnosticPayload(input: {
+  detectedAt: number;
+  totalWorkingSetKb: number;
+  metrics: AppMetricsSnapshot;
+  environment: SessionContextSnapshot;
+  mainProcessMemory: NodeJS.MemoryUsage;
+  ringEntries: readonly PerfDiagEntry[];
+  immediateRendererEntries: readonly PerfDiagEntry[];
+  sessionId: string;
+}): Record<string, unknown> {
+  const mergedRingEntries = [...input.ringEntries, ...input.immediateRendererEntries];
+  const recentRendererSamples = extractLatestRendererSamples(mergedRingEntries);
+
+  return {
+    event: 'high-memory-threshold',
+    sessionId: input.sessionId,
+    summary: buildHighMemorySummary(
+      input.totalWorkingSetKb,
+      input.metrics.processes,
+      input.detectedAt
+    ),
+    environment: input.environment,
+    metrics: input.metrics,
+    mainProcessMemory: input.mainProcessMemory,
+    mainProcessMemoryMb: formatMemoryUsageMb(input.mainProcessMemory),
+    processHistory: extractProcessHistory(mergedRingEntries),
+    ringSummary: summarizeRingBuffer(mergedRingEntries),
+    recentRendererSamples,
+    immediateRendererSamples: input.immediateRendererEntries.map((entry) => ({
+      collectedAt: entry.collectedAt,
+      type: entry.type,
+      payload: entry.payload
+    }))
+  };
+}
+
+function roundMb(bytes: number): number {
+  return Math.round((bytes / (1024 * 1024)) * 100) / 100;
+}
@@ -0,0 +1,39 @@
+import type { BrowserWindow } from 'electron';
+import type { PerfDiagEntry } from './diagnostics.models';
+
+export async function collectImmediateRendererSamples(
+  window: BrowserWindow | null | undefined
+): Promise<PerfDiagEntry[]> {
+  if (!window || window.isDestroyed()) {
+    return [];
+  }
+
+  try {
+    const result = await window.webContents.executeJavaScript(`
+      (function () {
+        const collect = globalThis.__collectPerfDiagSample;
+
+        return typeof collect === 'function' ? collect() : [];
+      })()
+    `, true);
+
+    if (!Array.isArray(result)) {
+      return [];
+    }
+
+    return result
+      .filter((entry) => entry && typeof entry === 'object')
+      .map((entry) => normalizeImmediateRendererEntry(entry as Partial<PerfDiagEntry>));
+  } catch {
+    return [];
+  }
+}
+
+function normalizeImmediateRendererEntry(entry: Partial<PerfDiagEntry>): PerfDiagEntry {
+  return {
+    collectedAt: Number(entry.collectedAt) || Date.now(),
+    source: 'renderer',
+    type: entry.type ?? 'session',
+    payload: entry.payload ?? {}
+  };
+}
@@ -1,10 +1,25 @@
 export { isPerfDiagEnabled, PERF_DIAG_ENV, PERF_DIAG_FORCE_ENV } from './diagnostics.flags';
+export {
+  clearHighMemoryAlert,
+  readHighMemoryAlert,
+  resolveHighMemoryAlertPath,
+  writeHighMemoryAlert
+} from './high-memory-alert.store';
+export type { HighMemoryAlertRecord } from './high-memory-alert.store';
+export {
+  exceedsHighMemoryThreshold,
+  formatWorkingSetGb,
+  HIGH_MEMORY_THRESHOLD_KB
+} from './high-memory-alert.rules';
 export {
  attachRendererDiagnosticsHooks,
  ensurePerfDiagIpcRegistered,
  getActivePerfDiagWriter,
+  HIGH_MEMORY_ALERT_PENDING_CHANNEL,
  isPerfDiagActive,
+  shutdownHighMemoryMonitoring,
  shutdownPerfDiagnostics,
+  startHighMemoryMonitoring,
  startPerfDiagnostics
 } from './diagnostics.lifecycle';
 export type { PerfDiagEntry, PerfDiagEntryType, PerfDiagSource } from './diagnostics.models';
@@ -0,0 +1,91 @@
+import { app, BrowserWindow } from 'electron';
+import * as os from 'os';
+
+export interface SessionWindowSnapshot {
+  id: number;
+  title: string;
+  url: string | null;
+  focused: boolean;
+  visible: boolean;
+  destroyed: boolean;
+}
+
+export interface SessionContextSnapshot {
+  collectedAt: number;
+  sessionStartedAt: number;
+  uptimeMs: number;
+  appVersion: string;
+  electronVersion: string;
+  chromeVersion: string;
+  nodeVersion: string;
+  platform: NodeJS.Platform;
+  arch: string;
+  osType: string;
+  osRelease: string;
+  osVersion: string | null;
+  totalMemKb: number;
+  freeMemKb: number;
+  userDataPath: string;
+  appPath: string;
+  isPackaged: boolean;
+  locale: string;
+  windowCount: number;
+  windows: SessionWindowSnapshot[];
+}
+
+export function collectSessionContext(input: {
+  sessionStartedAt: number;
+  userDataPath: string;
+}): SessionContextSnapshot {
+  const collectedAt = Date.now();
+
+  return {
+    collectedAt,
+    sessionStartedAt: input.sessionStartedAt,
+    uptimeMs: Math.max(0, collectedAt - input.sessionStartedAt),
+    appVersion: app.getVersion(),
+    electronVersion: process.versions.electron ?? 'unknown',
+    chromeVersion: process.versions.chrome ?? 'unknown',
+    nodeVersion: process.versions.node ?? 'unknown',
+    platform: process.platform,
+    arch: process.arch,
+    osType: os.type(),
+    osRelease: os.release(),
+    osVersion: readOsVersion(),
+    totalMemKb: Math.round(os.totalmem() / 1024),
+    freeMemKb: Math.round(os.freemem() / 1024),
+    userDataPath: input.userDataPath,
+    appPath: app.getAppPath(),
+    isPackaged: app.isPackaged,
+    locale: app.getLocale(),
+    windowCount: BrowserWindow.getAllWindows().length,
+    windows: BrowserWindow.getAllWindows().map(collectWindowSnapshot)
+  };
+}
+
+function collectWindowSnapshot(window: BrowserWindow): SessionWindowSnapshot {
+  let url: string | null = null;
+
+  try {
+    url = window.webContents.getURL() || null;
+  } catch {
+    url = null;
+  }
+
+  return {
+    id: window.id,
+    title: window.getTitle(),
+    url,
+    focused: window.isFocused(),
+    visible: window.isVisible(),
+    destroyed: window.isDestroyed()
+  };
+}
+
+function readOsVersion(): string | null {
+  try {
+    return os.version?.() ?? null;
+  } catch {
+    return null;
+  }
+}
@@ -0,0 +1,16 @@
+import {
+  describe,
+  expect,
+  it
+} from 'vitest';
+import { isReadableRegularFile } from './file-read.rules';
+
+describe('file-read.rules', () => {
+  it('accepts regular files', () => {
+    expect(isReadableRegularFile({ isFile: () => true })).toBe(true);
+  });
+
+  it('rejects directories and other non-file paths', () => {
+    expect(isReadableRegularFile({ isFile: () => false })).toBe(false);
+  });
+});
@@ -0,0 +1,6 @@
+import type { Stats } from 'fs';
+
+/** Only regular files can be read through the read-file IPC surface. */
+export function isReadableRegularFile(stats: Pick<Stats, 'isFile'>): boolean {
+  return stats.isFile();
+}
@@ -68,6 +68,7 @@ import {
  grantPluginReadRoot,
  resolveReadablePath
 } from '../path-jail';
+import { isReadableRegularFile } from './file-read.rules';

 const DEFAULT_MIME_TYPE = 'application/octet-stream';
 const MAX_ACTIVE_DESKTOP_NOTIFICATIONS = 20;
@@ -654,9 +655,19 @@ export function setupSystemHandlers(): void {
      return null;
    }

-    const data = await fsp.readFile(scopedPath);
+    try {
+      const stats = await fsp.stat(scopedPath);

-    return data.toString('base64');
+      if (!isReadableRegularFile(stats)) {
+        return null;
+      }
+
+      const data = await fsp.readFile(scopedPath);
+
+      return data.toString('base64');
+    } catch {
+      return null;
+    }
  });

  ipcMain.handle('read-file-chunk', async (_event, filePath: string, start: number, end: number) => {
@@ -666,17 +677,27 @@ export function setupSystemHandlers(): void {
      return null;
    }

-    const fileHandle = await fsp.open(scopedPath, 'r');
-
    try {
-      const safeStart = Math.max(0, Math.trunc(start));
-      const safeEnd = Math.max(safeStart, Math.trunc(end));
-      const buffer = Buffer.alloc(safeEnd - safeStart);
-      const result = await fileHandle.read(buffer, 0, buffer.length, safeStart);
+      const stats = await fsp.stat(scopedPath);

-      return buffer.subarray(0, result.bytesRead).toString('base64');
-    } finally {
-      await fileHandle.close();
+      if (!isReadableRegularFile(stats)) {
+        return null;
+      }
+
+      const fileHandle = await fsp.open(scopedPath, 'r');
+
+      try {
+        const safeStart = Math.max(0, Math.trunc(start));
+        const safeEnd = Math.max(safeStart, Math.trunc(end));
+        const buffer = Buffer.alloc(safeEnd - safeStart);
+        const result = await fileHandle.read(buffer, 0, buffer.length, safeStart);
+
+        return buffer.subarray(0, result.bytesRead).toString('base64');
+      } finally {
+        await fileHandle.close();
+      }
+    } catch {
+      return null;
    }
  });

@@ -728,6 +749,17 @@ export function setupSystemHandlers(): void {
    return true;
  });

+  ipcMain.handle('append-file-bytes', async (_event, filePath: string, bytes: Uint8Array) => {
+    const scopedPath = await resolveWritableUserDataFilePath(filePath);
+
+    if (!scopedPath) {
+      return false;
+    }
+
+    await fsp.appendFile(scopedPath, Buffer.from(bytes));
+    return true;
+  });
+
  ipcMain.handle('delete-file', async (_event, filePath: string) => {
    const scopedPath = await resolveWritableUserDataFilePath(filePath);

@@ -35,6 +35,17 @@ describe('path-jail', () => {
    await expect(assertPathUnderRoot(tempRoot, allowedPath, ['server'])).resolves.toBe(allowedPath);
  });

+  it('accepts diagnostics log paths under diagnostics', async () => {
+    const diagnosticsDir = path.join(tempRoot, 'diagnostics');
+
+    fs.mkdirSync(diagnosticsDir, { recursive: true });
+    const logPath = path.join(diagnosticsDir, 'perf-session.jsonl');
+
+    fs.writeFileSync(logPath, '{}');
+
+    await expect(assertPathUnderRoot(tempRoot, logPath)).resolves.toBe(logPath);
+  });
+
  it('accepts cached plugin bundle paths under plugin-bundles', async () => {
    const bundleDir = path.join(tempRoot, 'plugin-bundles', 'example.plugin', '1.0.0');

@@ -9,7 +9,8 @@ export const DEFAULT_USER_DATA_SUBDIRS = [
  'plugin-bundles',
  'plugin-cache',
  'themes',
-  'metoyou'
+  'metoyou',
+  'diagnostics'
 ] as const;

 export function isPathInside(parentPath: string, candidatePath: string): boolean {
@@ -11,6 +11,7 @@ const AUTO_UPDATE_STATE_CHANGED_CHANNEL = 'auto-update-state-changed';
 const DEEP_LINK_RECEIVED_CHANNEL = 'deep-link-received';
 const WINDOW_STATE_CHANGED_CHANNEL = 'window-state-changed';
 const IDLE_STATE_CHANGED_CHANNEL = 'idle-state-changed';
+const HIGH_MEMORY_ALERT_PENDING_CHANNEL = 'high-memory-alert-pending';

 export interface LinuxScreenShareAudioRoutingInfo {
  available: boolean;
@@ -259,6 +260,29 @@ export interface ElectronAPI {
    type: string;
    payload: Record<string, unknown>;
  }) => Promise<boolean>;
+  getPendingHighMemoryAlert: () => Promise<{
+    logFilePath: string;
+    detectedAt: number;
+    peakWorkingSetKb: number;
+    sessionId: string;
+    reason?: 'manual' | 'threshold';
+  } | null>;
+  acknowledgeHighMemoryAlert: () => Promise<boolean>;
+  exportHighMemoryDiagnostics: () => Promise<{
+    logFilePath: string;
+    detectedAt: number;
+    peakWorkingSetKb: number;
+    sessionId: string;
+    reason?: 'manual' | 'threshold';
+  }>;
+  onHighMemoryAlertPending: (listener: (alert: {
+    logFilePath: string;
+    detectedAt: number;
+    peakWorkingSetKb: number;
+    sessionId: string;
+    reason?: 'manual' | 'threshold';
+  }) => void) => () => void;
+  showLogFileInFolder: (filePath: string) => Promise<{ shown: boolean; reason?: string }>;
  getAppDataPath: () => Promise<string>;
  openCurrentDataFolder: () => Promise<boolean>;
  exportUserData: () => Promise<ExportUserDataResult>;
@@ -327,6 +351,7 @@ export interface ElectronAPI {
  grantPluginReadRoot: (rootPath: string) => Promise<boolean>;
  writeFile: (filePath: string, data: string) => Promise<boolean>;
  appendFile: (filePath: string, data: string) => Promise<boolean>;
+  appendFileBytes: (filePath: string, data: Uint8Array) => Promise<boolean>;
  saveFileAs: (defaultFileName: string, data: string) => Promise<{ saved: boolean; cancelled: boolean }>;
  saveExistingFileAs: (sourceFilePath: string, defaultFileName: string) => Promise<{ saved: boolean; cancelled: boolean }>;
  openFilePath: (filePath: string) => Promise<{ opened: boolean; reason?: string }>;
@@ -400,6 +425,26 @@ const electronAPI: ElectronAPI = {
  getAppMetrics: () => ipcRenderer.invoke('get-app-metrics'),
  isPerfDiagEnabled: () => ipcRenderer.invoke('perf-diag-is-enabled'),
  reportPerfDiagSample: (entry) => ipcRenderer.invoke('perf-diag-report', entry),
+  getPendingHighMemoryAlert: () => ipcRenderer.invoke('get-pending-high-memory-alert'),
+  acknowledgeHighMemoryAlert: () => ipcRenderer.invoke('acknowledge-high-memory-alert'),
+  exportHighMemoryDiagnostics: () => ipcRenderer.invoke('export-high-memory-diagnostics'),
+  onHighMemoryAlertPending: (listener) => {
+    const wrappedListener = (_event: Electron.IpcRendererEvent, alert: {
+      logFilePath: string;
+      detectedAt: number;
+      peakWorkingSetKb: number;
+      sessionId: string;
+    }) => {
+      listener(alert);
+    };
+
+    ipcRenderer.on(HIGH_MEMORY_ALERT_PENDING_CHANNEL, wrappedListener);
+
+    return () => {
+      ipcRenderer.removeListener(HIGH_MEMORY_ALERT_PENDING_CHANNEL, wrappedListener);
+    };
+  },
+  showLogFileInFolder: (filePath) => ipcRenderer.invoke('show-log-file-in-folder', filePath),
  getAppDataPath: () => ipcRenderer.invoke('get-app-data-path'),
  openCurrentDataFolder: () => ipcRenderer.invoke('open-current-data-folder'),
  exportUserData: () => ipcRenderer.invoke('export-user-data'),
@@ -467,6 +512,7 @@ const electronAPI: ElectronAPI = {
  grantPluginReadRoot: (rootPath) => ipcRenderer.invoke('grant-plugin-read-root', rootPath),
  writeFile: (filePath, data) => ipcRenderer.invoke('write-file', filePath, data),
  appendFile: (filePath, data) => ipcRenderer.invoke('append-file', filePath, data),
+  appendFileBytes: (filePath, data) => ipcRenderer.invoke('append-file-bytes', filePath, data),
  saveFileAs: (defaultFileName, data) => ipcRenderer.invoke('save-file-as', defaultFileName, data),
  saveExistingFileAs: (sourceFilePath, defaultFileName) => ipcRenderer.invoke('save-existing-file-as', sourceFilePath, defaultFileName),
  openFilePath: (filePath) => ipcRenderer.invoke('open-file-path', filePath),
@@ -12,12 +12,14 @@ import * as path from 'path';
 import { DESKTOP_APP_DISPLAY_NAME } from '../app/desktop-branding.rules';
 import { readDesktopSettings } from '../desktop-settings';
 import { resolveDevelopmentClientUrl } from './dev-client-url.rules';
+import { shouldRegisterDisplayMediaHandler } from './display-media-handler.rules';

 let mainWindow: BrowserWindow | null = null;
 let tray: Tray | null = null;
 let closeToTrayEnabled = true;
 let appQuitting = false;
 let youtubeRequestHeadersConfigured = false;
+let displayMediaHandlerConfigured = false;

 const WINDOW_STATE_CHANGED_CHANNEL = 'window-state-changed';
 const YOUTUBE_EMBED_REFERRER = 'https://toju.app/';
@@ -189,31 +191,12 @@ function emitWindowState(): void {
  });
 }

-export async function createWindow(): Promise<void> {
-  const windowIconPath = getWindowIconPath();
+function ensureDisplayMediaRequestHandler(): void {
+  if (!shouldRegisterDisplayMediaHandler(process.platform, displayMediaHandlerConfigured)) {
+    return;
+  }

-  closeToTrayEnabled = readDesktopSettings().closeToTray;
-  ensureTray();
-  ensureYoutubeEmbedRequestHeaders();
-
-  mainWindow = new BrowserWindow({
-    width: 1400,
-    height: 900,
-    minWidth: 800,
-    minHeight: 600,
-    frame: false,
-    title: DESKTOP_APP_DISPLAY_NAME,
-    titleBarStyle: 'hidden',
-    backgroundColor: '#0a0a0f',
-    ...(windowIconPath ? { icon: windowIconPath } : {}),
-    webPreferences: {
-      backgroundThrottling: false,
-      nodeIntegration: false,
-      contextIsolation: true,
-      preload: path.join(__dirname, '..', 'preload.js'),
-      webSecurity: true
-    }
-  });
+  displayMediaHandlerConfigured = true;

  if (process.platform === 'linux') {
    session.defaultSession.setDisplayMediaRequestHandler(
@@ -241,41 +224,70 @@ export async function createWindow(): Promise<void> {
      },
      { useSystemPicker: true }
    );
+
+    return;
  }

-  if (process.platform === 'win32') {
-    session.defaultSession.setDisplayMediaRequestHandler(
-      async (request, respond) => {
-        // On Windows the system picker (useSystemPicker: true) is preferred.
-        // This handler is only reached when the system picker is unavailable.
-        // Include loopback audio when the renderer requested it so that
-        // getDisplayMedia receives an audio track and the renderer-side
-        // restrictOwnAudio constraint can keep the app's own voice playback
-        // out of the captured stream.
-        try {
-          const sources = await desktopCapturer.getSources({
-            types: ['window', 'screen'],
-            thumbnailSize: { width: 150, height: 150 }
+  session.defaultSession.setDisplayMediaRequestHandler(
+    async (request, respond) => {
+      // On Windows the system picker (useSystemPicker: true) is preferred.
+      // This handler is only reached when the system picker is unavailable.
+      // Include loopback audio when the renderer requested it so that
+      // getDisplayMedia receives an audio track and the renderer-side
+      // restrictOwnAudio constraint can keep the app's own voice playback
+      // out of the captured stream.
+      try {
+        const sources = await desktopCapturer.getSources({
+          types: ['window', 'screen'],
+          thumbnailSize: { width: 150, height: 150 }
+        });
+        const firstSource = sources[0];
+
+        if (firstSource) {
+          respond({
+            video: firstSource,
+            ...(request.audioRequested ? { audio: 'loopback' } : {})
          });
-          const firstSource = sources[0];

-          if (firstSource) {
-            respond({
-              video: firstSource,
-              ...(request.audioRequested ? { audio: 'loopback' } : {})
-            });
-
-            return;
-          }
-        } catch {
-          // desktopCapturer also unavailable
+          return;
        }
+      } catch {
+        // desktopCapturer also unavailable
+      }

-        respond({});
-      },
-      { useSystemPicker: true }
-    );
-  }
+      respond({});
+    },
+    { useSystemPicker: true }
+  );
+}
+
+export async function createWindow(): Promise<void> {
+  const windowIconPath = getWindowIconPath();
+
+  closeToTrayEnabled = readDesktopSettings().closeToTray;
+  ensureTray();
+  ensureYoutubeEmbedRequestHeaders();
+
+  mainWindow = new BrowserWindow({
+    width: 1400,
+    height: 900,
+    minWidth: 800,
+    minHeight: 600,
+    frame: false,
+    title: DESKTOP_APP_DISPLAY_NAME,
+    titleBarStyle: 'hidden',
+    backgroundColor: '#0a0a0f',
+    ...(windowIconPath ? { icon: windowIconPath } : {}),
+    webPreferences: {
+      backgroundThrottling: false,
+      nodeIntegration: false,
+      contextIsolation: true,
+      preload: path.join(__dirname, '..', 'preload.js'),
+      webSecurity: true
+    }
+  });
+
+  ensureDisplayMediaRequestHandler();

  if (process.env['NODE_ENV'] === 'development') {
    await mainWindow.loadURL(resolveDevelopmentClientUrl(process.env['SSL'] === 'true'));
@@ -0,0 +1,22 @@
+import {
+  describe,
+  expect,
+  it
+} from 'vitest';
+import { shouldRegisterDisplayMediaHandler } from './display-media-handler.rules';
+
+describe('shouldRegisterDisplayMediaHandler', () => {
+  it('registers once for platforms that need a fallback picker', () => {
+    expect(shouldRegisterDisplayMediaHandler('linux', false)).toBe(true);
+    expect(shouldRegisterDisplayMediaHandler('win32', false)).toBe(true);
+  });
+
+  it('does not re-register on window recreation', () => {
+    expect(shouldRegisterDisplayMediaHandler('linux', true)).toBe(false);
+    expect(shouldRegisterDisplayMediaHandler('win32', true)).toBe(false);
+  });
+
+  it('never registers on platforms with a native picker', () => {
+    expect(shouldRegisterDisplayMediaHandler('darwin', false)).toBe(false);
+  });
+});
@@ -0,0 +1,16 @@
+/**
+ * The display-media request handler is a session-level singleton. Registering
+ * it inside `createWindow()` without a guard re-installed a fresh handler
+ * (holding fresh closures) every time the window was recreated from the tray
+ * or a deep link. Registration happens at most once per app run.
+ */
+export function shouldRegisterDisplayMediaHandler(
+  platform: NodeJS.Platform,
+  alreadyConfigured: boolean
+): boolean {
+  if (alreadyConfigured) {
+    return false;
+  }
+
+  return platform === 'linux' || platform === 'win32';
+}
@@ -0,0 +1,105 @@
+import {
+  beforeEach,
+  describe,
+  expect,
+  it
+} from 'vitest';
+import { WebSocket } from 'ws';
+import { connectedUsers } from './state';
+import { ConnectedUser } from './types';
+import { finalizeVoiceDisconnectForConnection } from './handler';
+
+function createMockWs(): WebSocket & { sentMessages: string[] } {
+  const sent: string[] = [];
+  const ws = {
+    readyState: WebSocket.OPEN,
+    send: (data: string) => { sent.push(data); },
+    close: () => {},
+    terminate: () => {},
+    sentMessages: sent
+  } as unknown as WebSocket & { sentMessages: string[] };
+
+  return ws;
+}
+
+function createConnectedUser(
+  connectionId: string,
+  overrides: Partial<ConnectedUser> = {}
+): ConnectedUser {
+  const user: ConnectedUser = {
+    oderId: 'user-1',
+    ws: createMockWs(),
+    authenticated: true,
+    serverIds: new Set(['server-1']),
+    displayName: 'Alice',
+    lastPong: Date.now(),
+    ...overrides
+  };
+
+  connectedUsers.set(connectionId, user);
+
+  return user;
+}
+
+function getSentMessages(user: ConnectedUser): string[] {
+  return (user.ws as WebSocket & { sentMessages: string[] }).sentMessages;
+}
+
+describe('finalizeVoiceDisconnectForConnection', () => {
+  beforeEach(() => {
+    connectedUsers.clear();
+  });
+
+  it('broadcasts a cleared voice_state when a voice-active connection is removed', () => {
+    createConnectedUser('conn-voice', {
+      voiceActive: true,
+      voiceStateSnapshot: {
+        type: 'voice_state',
+        serverId: 'server-1',
+        voiceState: {
+          isConnected: true,
+          isMuted: true,
+          isDeafened: false,
+          roomId: 'voice-1',
+          serverId: 'server-1'
+        }
+      }
+    });
+
+    const observer = createConnectedUser('conn-observer', { oderId: 'user-2' });
+
+    getSentMessages(observer).length = 0;
+
+    finalizeVoiceDisconnectForConnection('conn-voice');
+
+    const messages = getSentMessages(observer).map((raw) => JSON.parse(raw) as {
+      type: string;
+      voiceState?: { isConnected?: boolean; isMuted?: boolean; isDeafened?: boolean };
+    });
+    const voiceState = messages.find((message) => message.type === 'voice_state');
+
+    expect(voiceState).toMatchObject({
+      type: 'voice_state',
+      voiceState: {
+        isConnected: false,
+        isMuted: false,
+        isDeafened: false
+      }
+    });
+
+    expect(connectedUsers.get('conn-voice')?.voiceActive).toBe(false);
+    expect(connectedUsers.get('conn-voice')?.voiceStateSnapshot).toBeUndefined();
+  });
+
+  it('does nothing when the connection was not voice-active', () => {
+    const observer = createConnectedUser('conn-observer', { oderId: 'user-2' });
+
+    createConnectedUser('conn-idle');
+
+    getSentMessages(observer).length = 0;
+
+    finalizeVoiceDisconnectForConnection('conn-idle');
+
+    expect(getSentMessages(observer)).toHaveLength(0);
+  });
+});
@@ -134,6 +134,59 @@ function clearVoiceActiveForOderId(oderId: string, exceptConnectionId?: string):
  });
 }

+function readVoiceStateServerId(snapshot: Record<string, unknown> | undefined): string | undefined {
+  if (!snapshot) {
+    return undefined;
+  }
+
+  const nestedVoiceState = snapshot['voiceState'];
+
+  if (nestedVoiceState && typeof nestedVoiceState === 'object') {
+    const nestedServerId = readMessageId((nestedVoiceState as { serverId?: unknown }).serverId);
+
+    if (nestedServerId) {
+      return nestedServerId;
+    }
+  }
+
+  return readMessageId(snapshot['serverId']);
+}
+
+/** Broadcast a cleared voice_state when a voice-active socket disappears without a graceful leave. */
+export function finalizeVoiceDisconnectForConnection(connectionId: string): void {
+  const user = connectedUsers.get(connectionId);
+
+  if (!user?.authenticated || (!user.voiceActive && !user.voiceStateSnapshot)) {
+    return;
+  }
+
+  const serverId = readVoiceStateServerId(user.voiceStateSnapshot) ?? user.viewedServerId;
+
+  if (serverId && user.serverIds.has(serverId)) {
+    broadcastToServer(
+      serverId,
+      {
+        type: 'voice_state',
+        serverId,
+        oderId: user.oderId,
+        displayName: normalizeDisplayName(user.displayName),
+        voiceState: {
+          isConnected: false,
+          isMuted: false,
+          isDeafened: false,
+          isSpeaking: false
+        }
+      },
+      { excludeConnectionId: connectionId }
+    );
+  }
+
+  user.voiceActive = false;
+  user.voiceStateSnapshot = undefined;
+  connectedUsers.set(connectionId, user);
+  clearVoiceActiveForOderId(user.oderId, connectionId);
+}
+
 function sendVoiceStateSnapshotToConnection(user: ConnectedUser, snapshot: Record<string, unknown>): void {
  user.ws.send(JSON.stringify({
    type: 'voice_state',
@@ -11,7 +11,7 @@ import {
  getServerIdsForOderId,
  isOderIdConnectedToServer
 } from './broadcast';
-import { handleWebSocketMessage } from './handler';
+import { handleWebSocketMessage, finalizeVoiceDisconnectForConnection } from './handler';

 type IncomingWebSocketMessage = Parameters<typeof handleWebSocketMessage>[1];

@@ -26,6 +26,8 @@ function removeDeadConnection(connectionId: string): void {
  if (user) {
    console.log(`Removing dead connection: ${user.displayName ?? 'Unknown'} (${user.oderId})`);

+    finalizeVoiceDisconnectForConnection(connectionId);
+
    const remainingServerIds = getServerIdsForOderId(user.oderId, connectionId);

    user.serverIds.forEach((sid) => {
@@ -59,4 +59,11 @@
    <uses-permission android:name="android.permission.FOREGROUND_SERVICE" />
    <uses-permission android:name="android.permission.FOREGROUND_SERVICE_MICROPHONE" />
    <uses-permission android:name="android.permission.WAKE_LOCK" />
+    <!-- Attachment export to public Documents needs legacy storage permissions on Android 10 and below. -->
+    <uses-permission
+        android:name="android.permission.READ_EXTERNAL_STORAGE"
+        android:maxSdkVersion="32" />
+    <uses-permission
+        android:name="android.permission.WRITE_EXTERNAL_STORAGE"
+        android:maxSdkVersion="29" />
 </manifest>
@@ -13,8 +13,8 @@ const config: CapacitorConfig = {
      style: 'DARK'
    },
    LocalNotifications: {
-      smallIcon: 'ic_stat_icon_config_sample',
-      iconColor: '#488AFF',
+      smallIcon: 'ic_stat_metoyou',
+      iconColor: '#4A217A',
      sound: 'call.wav'
    },
    PushNotifications: {
@@ -15,6 +15,18 @@
      "downloadedMessage": "The update has already been downloaded. Restart the app when you're ready to finish applying it.",
      "updateSettings": "Update settings",
      "restartNow": "Restart now"
+    },
+    "highMemoryAlert": {
+      "badge": "High memory usage",
+      "thresholdTitle": "The app is using {{usageGb}} GB of RAM",
+      "thresholdMessage": "MetoYou crossed the 2 GB memory threshold. A diagnostics log was saved so you can inspect what was using memory or share it with support.",
+      "manualTitle": "RAM diagnostics exported ({{usageGb}} GB in use)",
+      "manualMessage": "A snapshot of current memory usage was saved. Open the log, reveal it in your file manager, or copy the path to share with support.",
+      "openLog": "Open log file",
+      "showInFolder": "Show in folder",
+      "copyPath": "Copy path",
+      "dismiss": "Dismiss",
+      "dismissAriaLabel": "Dismiss high memory alert"
    }
  }
 }
@@ -8,7 +8,8 @@
      "chunksOutOfOrder": "Received media chunks out of order. Retry the download.",
      "writeDownloadFailed": "Could not write media download to disk.",
      "openDownloadFailed": "Could not open completed media download from disk.",
-      "downloadFailed": "Media download failed. Retry the download."
+      "downloadFailed": "Media download failed. Retry the download.",
+      "fileTooLarge": "This file is too large to download in this client. Use the desktop app or ask the sender to share a smaller file."
    }
  }
 }
@@ -43,7 +43,13 @@
    },
    "errors": {
      "noRecipient": "Direct message conversation has no recipient to call.",
-      "noCurrentUser": "Cannot use calls without a current user."
+      "noCurrentUser": "Cannot use calls without a current user.",
+      "signalingUnavailable": "Not connected to the call server. Check your connection and try again.",
+      "captureUnsupported": "Voice capture is not available on this device.",
+      "microphonePermissionDenied": "Microphone access is blocked. Allow the microphone permission in system settings to join calls.",
+      "microphoneUnavailable": "Could not start the microphone. Close other apps that use it and try again.",
+      "cameraPermissionDenied": "Camera access is blocked. Allow the camera permission in system settings to share video.",
+      "cameraUnavailable": "Could not start the camera. Close other apps that use it and try again."
    }
  }
 }
@@ -24,6 +24,7 @@
    "notifications": {
      "incomingCallsChannel": "Incoming calls",
      "activeCallsChannel": "Active calls",
+      "messagesChannel": "Messages",
      "answer": "Answer",
      "decline": "Decline",
      "mute": "Mute",
@@ -441,7 +441,9 @@
      "title": "App-wide debugging",
      "description": "Capture UI events, navigation activity, console output, and global runtime errors in a live debug console.",
      "processRam": "Process RAM",
-      "ramHint": "Live total working set from Electron app metrics. Updates every 2 seconds.",
+      "exportRamDiagnostics": "Export RAM diagnostics",
+      "exportRamDiagnosticsWorking": "Exporting...",
+      "ramHint": "Live total working set from Electron app metrics. Updates every 2 seconds. Export saves a diagnostics log and opens the high-memory alert dialog.",
      "capturedEvents": "Captured events",
      "lastUpdate": "Last update: {{label}}",
      "noLogsYet": "No logs yet",
@@ -15,6 +15,18 @@
      "downloadedMessage": "The update has already been downloaded. Restart the app when you're ready to finish applying it.",
      "updateSettings": "Update settings",
      "restartNow": "Restart now"
+    },
+    "highMemoryAlert": {
+      "badge": "High memory usage",
+      "thresholdTitle": "The app is using {{usageGb}} GB of RAM",
+      "thresholdMessage": "MetoYou crossed the 2 GB memory threshold. A diagnostics log was saved so you can inspect what was using memory or share it with support.",
+      "manualTitle": "RAM diagnostics exported ({{usageGb}} GB in use)",
+      "manualMessage": "A snapshot of current memory usage was saved. Open the log, reveal it in your file manager, or copy the path to share with support.",
+      "openLog": "Open log file",
+      "showInFolder": "Show in folder",
+      "copyPath": "Copy path",
+      "dismiss": "Dismiss",
+      "dismissAriaLabel": "Dismiss high memory alert"
    }
  },
  "attachment": {
@@ -26,7 +38,8 @@
      "chunksOutOfOrder": "Received media chunks out of order. Retry the download.",
      "writeDownloadFailed": "Could not write media download to disk.",
      "openDownloadFailed": "Could not open completed media download from disk.",
-      "downloadFailed": "Media download failed. Retry the download."
+      "downloadFailed": "Media download failed. Retry the download.",
+      "fileTooLarge": "This file is too large to download in this client. Use the desktop app or ask the sender to share a smaller file."
    }
  },
  "auth": {
@@ -114,7 +127,13 @@
    },
    "errors": {
      "noRecipient": "Direct message conversation has no recipient to call.",
-      "noCurrentUser": "Cannot use calls without a current user."
+      "noCurrentUser": "Cannot use calls without a current user.",
+      "signalingUnavailable": "Not connected to the call server. Check your connection and try again.",
+      "captureUnsupported": "Voice capture is not available on this device.",
+      "microphonePermissionDenied": "Microphone access is blocked. Allow the microphone permission in system settings to join calls.",
+      "microphoneUnavailable": "Could not start the microphone. Close other apps that use it and try again.",
+      "cameraPermissionDenied": "Camera access is blocked. Allow the camera permission in system settings to share video.",
+      "cameraUnavailable": "Could not start the camera. Close other apps that use it and try again."
    }
  },
  "chat": {
@@ -504,6 +523,7 @@
    "notifications": {
      "incomingCallsChannel": "Incoming calls",
      "activeCallsChannel": "Active calls",
+      "messagesChannel": "Messages",
      "answer": "Answer",
      "decline": "Decline",
      "mute": "Mute",
@@ -1496,7 +1516,9 @@
      "title": "App-wide debugging",
      "description": "Capture UI events, navigation activity, console output, and global runtime errors in a live debug console.",
      "processRam": "Process RAM",
-      "ramHint": "Live total working set from Electron app metrics. Updates every 2 seconds.",
+      "exportRamDiagnostics": "Export RAM diagnostics",
+      "exportRamDiagnosticsWorking": "Exporting...",
+      "ramHint": "Live total working set from Electron app metrics. Updates every 2 seconds. Export saves a diagnostics log and opens the high-memory alert dialog.",
      "capturedEvents": "Captured events",
      "lastUpdate": "Last update: {{label}}",
      "noLogsYet": "No logs yet",
@@ -167,6 +167,7 @@
  <app-incoming-call-modal />
  <app-screen-share-source-picker />
  <app-native-context-menu />
+  <app-high-memory-alert-modal />
  <app-debug-console [showLauncher]="false" />
  <app-theme-picker-overlay />
 </div>
@@ -26,6 +26,7 @@ import {
  loadLastViewedChatFromStorage
 } from './infrastructure/persistence';
 import { DesktopAppUpdateService } from './core/services/desktop-app-update.service';
+import { DesktopHighMemoryAlertService } from './core/services/desktop-high-memory-alert.service';
 import { ServerDirectoryFacade } from './domains/server-directory';
 import { NotificationsFacade } from './domains/notifications';
 import { TimeSyncService } from './core/services/time-sync.service';
@@ -53,6 +54,7 @@ import { SettingsModalComponent } from './features/settings/settings-modal/setti
 import { DebugConsoleComponent } from './shared/components/debug-console/debug-console.component';
 import { ScreenShareSourcePickerComponent } from './shared/components/screen-share-source-picker/screen-share-source-picker.component';
 import { NativeContextMenuComponent } from './features/shell/native-context-menu/native-context-menu.component';
+import { HighMemoryAlertModalComponent } from './features/shell/high-memory-alert-modal/high-memory-alert-modal.component';
 import { UsersActions } from './store/users/users.actions';
 import { RoomsActions } from './store/rooms/rooms.actions';
 import { selectCurrentRoom } from './store/rooms/rooms.selectors';
@@ -81,6 +83,7 @@ import { AppI18nService, APP_TRANSLATE_IMPORTS } from './core/i18n';
    DebugConsoleComponent,
    ScreenShareSourcePickerComponent,
    NativeContextMenuComponent,
+    HighMemoryAlertModalComponent,
    PrivateCallComponent,
    ThemeNodeDirective,
    ThemePickerOverlayComponent,
@@ -103,6 +106,7 @@ export class App implements OnInit, OnDestroy {
  currentRoom = this.store.selectSignal(selectCurrentRoom);
  desktopUpdates = inject(DesktopAppUpdateService);
  desktopUpdateState = this.desktopUpdates.state;
+  desktopHighMemoryAlert = inject(DesktopHighMemoryAlertService);
  readonly databaseService = inject(DatabaseService);
  readonly router = inject(Router);
  readonly servers = inject(ServerDirectoryFacade);
@@ -288,6 +292,7 @@ export class App implements OnInit, OnDestroy {
    // - desktop deep-link bridge (only relevant after first paint)
    // - background presence + game activity loops
    void this.desktopUpdates.initialize();
+    void this.desktopHighMemoryAlert.initialize();
    void this.kickOffBackgroundBootstrap();

    // The only thing we genuinely must await before deciding which route
@@ -251,6 +251,14 @@ export interface ElectronPerfDiagEntry {
  payload: Record<string, unknown>;
 }

+export interface ElectronHighMemoryAlertRecord {
+  logFilePath: string;
+  detectedAt: number;
+  peakWorkingSetKb: number;
+  sessionId: string;
+  reason?: 'manual' | 'threshold';
+}
+
 export interface ElectronApi {
  linuxDisplayServer: string;
  minimizeWindow: () => void;
@@ -272,6 +280,11 @@ export interface ElectronApi {
  getAppMetrics: () => Promise<ElectronAppMetricsSnapshot>;
  isPerfDiagEnabled?: () => Promise<boolean>;
  reportPerfDiagSample?: (entry: ElectronPerfDiagEntry) => Promise<boolean>;
+  getPendingHighMemoryAlert?: () => Promise<ElectronHighMemoryAlertRecord | null>;
+  acknowledgeHighMemoryAlert?: () => Promise<boolean>;
+  exportHighMemoryDiagnostics?: () => Promise<ElectronHighMemoryAlertRecord>;
+  onHighMemoryAlertPending?: (listener: (alert: ElectronHighMemoryAlertRecord) => void) => () => void;
+  showLogFileInFolder?: (filePath: string) => Promise<{ shown: boolean; reason?: string }>;
  getAppDataPath: () => Promise<string>;
  openCurrentDataFolder: () => Promise<boolean>;
  exportUserData: () => Promise<ExportUserDataResult>;
@@ -309,6 +322,7 @@ export interface ElectronApi {
  grantPluginReadRoot?: (rootPath: string) => Promise<boolean>;
  writeFile: (filePath: string, data: string) => Promise<boolean>;
  appendFile: (filePath: string, data: string) => Promise<boolean>;
+  appendFileBytes: (filePath: string, data: Uint8Array) => Promise<boolean>;
  saveFileAs: (defaultFileName: string, data: string) => Promise<{ saved: boolean; cancelled: boolean }>;
  saveExistingFileAs?: (sourceFilePath: string, defaultFileName: string) => Promise<{ saved: boolean; cancelled: boolean }>;
  openFilePath?: (filePath: string) => Promise<{ opened: boolean; reason?: string }>;
@@ -6,6 +6,7 @@ import {

 import {
  formatAppRamLabel,
+  formatKilobytesAsGigabytes,
  formatKilobytesAsMegabytes,
  sumWorkingSetKb
 } from './electron-app-metrics.rules';
@@ -38,6 +39,13 @@ describe('sumWorkingSetKb', () => {
  });
 });

+describe('formatKilobytesAsGigabytes', () => {
+  it('formats totals in gigabytes with two decimals', () => {
+    expect(formatKilobytesAsGigabytes(1536 * 1024)).toBe('1.50');
+    expect(formatKilobytesAsGigabytes(2 * 1024 * 1024)).toBe('2.00');
+  });
+});
+
 describe('formatKilobytesAsMegabytes', () => {
  it('rounds large values to whole megabytes', () => {
    expect(formatKilobytesAsMegabytes(412 * 1024)).toBe('412 MB');
@@ -36,6 +36,10 @@ export function formatKilobytesAsMegabytes(kilobytes: number): string {
  return `${megabytes.toFixed(2)} MB`;
 }

+export function formatKilobytesAsGigabytes(kilobytes: number): string {
+  return (kilobytes / (1024 * 1024)).toFixed(2);
+}
+
 export function formatAppRamLabel(snapshot: ElectronAppMetricsSnapshot): string | null {
  const totalKb = sumWorkingSetKb(snapshot.processes);

@@ -4,20 +4,22 @@ import { ElectronBridgeService } from './electron/electron-bridge.service';

@Injectable({ providedIn: 'root' })
 export class PlatformService {
-  readonly isElectron: boolean;
  readonly isCapacitor: boolean;
  readonly isBrowser: boolean;
  private readonly electronBridge = inject(ElectronBridgeService);

  constructor() {
-    this.isElectron = this.electronBridge.isAvailable;
-
+    const isElectron = this.electronBridge.isAvailable;
    const runtime = detectRuntimePlatform({
-      hasElectronApi: this.isElectron,
+      hasElectronApi: isElectron,
      capacitorIsNative: isCapacitorNativeRuntime()
    });

    this.isCapacitor = runtime === 'capacitor';
    this.isBrowser = runtime === 'browser';
  }
+
+  get isElectron(): boolean {
+    return this.electronBridge.isAvailable;
+  }
 }
@@ -0,0 +1,164 @@
+import '@angular/compiler';
+import {
+  beforeEach,
+  describe,
+  expect,
+  it,
+  vi
+} from 'vitest';
+import { DOCUMENT } from '@angular/common';
+import { Injector, runInInjectionContext } from '@angular/core';
+
+import { DesktopHighMemoryAlertService } from './desktop-high-memory-alert.service';
+import { ElectronBridgeService } from '../platform/electron/electron-bridge.service';
+
+describe('DesktopHighMemoryAlertService', () => {
+  let electronBridge: {
+    isAvailable: boolean;
+    getApi: ReturnType<typeof vi.fn>;
+  };
+  let documentStub: Document;
+
+  beforeEach(() => {
+    documentStub = {
+      body: null,
+      createElement: vi.fn(),
+      execCommand: vi.fn(() => true)
+    } as unknown as Document;
+
+    electronBridge = {
+      isAvailable: true,
+      getApi: vi.fn(() => ({
+        getPendingHighMemoryAlert: vi.fn(async () => ({
+          logFilePath: '/tmp/diagnostics/session.ndjson',
+          detectedAt: 1,
+          peakWorkingSetKb: 2_200_000,
+          sessionId: 'session-1'
+        })),
+        onHighMemoryAlertPending: vi.fn(() => () => undefined),
+        exportHighMemoryDiagnostics: vi.fn(async () => ({
+          logFilePath: '/tmp/diagnostics/manual.ndjson',
+          detectedAt: 2,
+          peakWorkingSetKb: 1_800_000,
+          sessionId: 'session-2',
+          reason: 'manual' as const
+        })),
+        acknowledgeHighMemoryAlert: vi.fn(async () => true)
+      }))
+    };
+  });
+
+  function createService(): DesktopHighMemoryAlertService {
+    const injector = Injector.create({
+      providers: [
+        DesktopHighMemoryAlertService,
+        { provide: ElectronBridgeService, useValue: electronBridge },
+        { provide: DOCUMENT, useValue: documentStub }
+      ]
+    });
+
+    return runInInjectionContext(injector, () => injector.get(DesktopHighMemoryAlertService));
+  }
+
+  it('loads a pending alert from disk on initialize', async () => {
+    const service = createService();
+
+    await service.initialize();
+
+    expect(service.pendingAlert()?.logFilePath).toBe('/tmp/diagnostics/session.ndjson');
+    expect(service.peakUsageGb()).toBe('2.10');
+  });
+
+  it('shows the modal when a live high-memory alert event arrives', async () => {
+    let listener: ((alert: {
+      logFilePath: string;
+      detectedAt: number;
+      peakWorkingSetKb: number;
+      sessionId: string;
+    }) => void) | undefined;
+
+    electronBridge.getApi = vi.fn(() => ({
+      getPendingHighMemoryAlert: vi.fn(async () => null),
+      onHighMemoryAlertPending: vi.fn((callback) => {
+        listener = callback;
+        return () => undefined;
+      }),
+      exportHighMemoryDiagnostics: vi.fn(async () => null),
+      acknowledgeHighMemoryAlert: vi.fn(async () => true)
+    }));
+
+    const service = createService();
+
+    await service.initialize();
+
+    listener?.({
+      logFilePath: '/tmp/diagnostics/live.ndjson',
+      detectedAt: 3,
+      peakWorkingSetKb: 2_400_000,
+      sessionId: 'session-3'
+    });
+
+    expect(service.pendingAlert()?.logFilePath).toBe('/tmp/diagnostics/live.ndjson');
+  });
+
+  it('exports diagnostics manually and opens the modal with manual copy', async () => {
+    const service = createService();
+
+    await expect(service.exportDiagnostics()).resolves.toBe(true);
+    expect(service.pendingAlert()?.logFilePath).toBe('/tmp/diagnostics/manual.ndjson');
+    expect(service.pendingAlert()?.reason).toBe('manual');
+    expect(service.titleKey()).toBe('app.highMemoryAlert.manualTitle');
+    expect(service.messageKey()).toBe('app.highMemoryAlert.manualMessage');
+  });
+
+  it('uses threshold copy for live high-memory alerts', async () => {
+    let listener: ((alert: {
+      logFilePath: string;
+      detectedAt: number;
+      peakWorkingSetKb: number;
+      sessionId: string;
+      reason?: 'manual' | 'threshold';
+    }) => void) | undefined;
+
+    electronBridge.getApi = vi.fn(() => ({
+      getPendingHighMemoryAlert: vi.fn(async () => null),
+      onHighMemoryAlertPending: vi.fn((callback) => {
+        listener = callback;
+        return () => undefined;
+      }),
+      exportHighMemoryDiagnostics: vi.fn(async () => null),
+      acknowledgeHighMemoryAlert: vi.fn(async () => true)
+    }));
+
+    const service = createService();
+
+    await service.initialize();
+
+    listener?.({
+      logFilePath: '/tmp/diagnostics/live.ndjson',
+      detectedAt: 3,
+      peakWorkingSetKb: 2_400_000,
+      sessionId: 'session-3',
+      reason: 'threshold'
+    });
+
+    expect(service.titleKey()).toBe('app.highMemoryAlert.thresholdTitle');
+    expect(service.messageKey()).toBe('app.highMemoryAlert.thresholdMessage');
+  });
+
+  it('copies the diagnostics log path to the clipboard', async () => {
+    const writeText = vi.fn(async () => undefined);
+
+    Object.defineProperty(navigator, 'clipboard', {
+      configurable: true,
+      value: { writeText }
+    });
+
+    const service = createService();
+
+    await service.initialize();
+
+    await expect(service.copyLogPath()).resolves.toBe(true);
+    expect(writeText).toHaveBeenCalledWith('/tmp/diagnostics/session.ndjson');
+  });
+});
@@ -0,0 +1,154 @@
+import {
+  Injectable,
+  computed,
+  inject,
+  signal
+} from '@angular/core';
+import { DOCUMENT } from '@angular/common';
+
+import { ElectronBridgeService } from '../platform/electron/electron-bridge.service';
+import type { ElectronHighMemoryAlertRecord } from '../platform/electron/electron-api.models';
+import { formatKilobytesAsGigabytes } from '../platform/electron/electron-app-metrics.rules';
+import {
+  resolveHighMemoryAlertCopyKind,
+  resolveHighMemoryAlertMessageKey,
+  resolveHighMemoryAlertTitleKey
+} from './high-memory-alert-copy.rules';
+
+@Injectable({ providedIn: 'root' })
+export class DesktopHighMemoryAlertService {
+  private readonly electronBridge = inject(ElectronBridgeService);
+  private readonly document = inject(DOCUMENT);
+
+  readonly pendingAlert = signal<ElectronHighMemoryAlertRecord | null>(null);
+
+  readonly peakUsageGb = computed(() => {
+    const alert = this.pendingAlert();
+
+    return alert ? formatKilobytesAsGigabytes(alert.peakWorkingSetKb) : null;
+  });
+
+  readonly titleKey = computed(() => resolveHighMemoryAlertTitleKey(
+    resolveHighMemoryAlertCopyKind(this.pendingAlert())
+  ));
+
+  readonly messageKey = computed(() => resolveHighMemoryAlertMessageKey(
+    resolveHighMemoryAlertCopyKind(this.pendingAlert())
+  ));
+
+  private initialized = false;
+  private removePendingListener: (() => void) | null = null;
+
+  async initialize(): Promise<void> {
+    if (!this.electronBridge.isAvailable || this.initialized) {
+      return;
+    }
+
+    this.initialized = true;
+
+    const api = this.electronBridge.getApi();
+
+    if (!api) {
+      return;
+    }
+
+    this.removePendingListener?.();
+    this.removePendingListener = api.onHighMemoryAlertPending?.((alert) => {
+      this.pendingAlert.set(alert);
+    }) ?? null;
+
+    const alert = await api.getPendingHighMemoryAlert?.();
+
+    if (alert) {
+      this.pendingAlert.set(alert);
+    }
+  }
+
+  async exportDiagnostics(): Promise<boolean> {
+    const api = this.electronBridge.getApi();
+    const alert = await api?.exportHighMemoryDiagnostics?.();
+
+    if (!alert) {
+      return false;
+    }
+
+    this.pendingAlert.set(alert);
+
+    return true;
+  }
+
+  async dismiss(): Promise<void> {
+    const api = this.electronBridge.getApi();
+
+    await api?.acknowledgeHighMemoryAlert?.();
+    this.pendingAlert.set(null);
+  }
+
+  async openLogFile(): Promise<void> {
+    const alert = this.pendingAlert();
+    const api = this.electronBridge.getApi();
+
+    if (!alert?.logFilePath || !api?.openFilePath) {
+      return;
+    }
+
+    await api.openFilePath(alert.logFilePath);
+  }
+
+  async showLogFileInFolder(): Promise<void> {
+    const alert = this.pendingAlert();
+    const api = this.electronBridge.getApi();
+
+    if (!alert?.logFilePath || !api?.showLogFileInFolder) {
+      return;
+    }
+
+    await api.showLogFileInFolder(alert.logFilePath);
+  }
+
+  async copyLogPath(): Promise<boolean> {
+    const alert = this.pendingAlert();
+
+    if (!alert?.logFilePath) {
+      return false;
+    }
+
+    return await this.writeTextToClipboard(alert.logFilePath);
+  }
+
+  private async writeTextToClipboard(value: string): Promise<boolean> {
+    if (navigator.clipboard?.writeText) {
+      try {
+        await navigator.clipboard.writeText(value);
+        return true;
+      } catch {}
+    }
+
+    const body = this.document.body;
+
+    if (!body) {
+      return false;
+    }
+
+    const textarea = this.document.createElement('textarea');
+
+    textarea.value = value;
+    textarea.setAttribute('readonly', 'true');
+    textarea.style.position = 'fixed';
+    textarea.style.opacity = '0';
+    textarea.style.pointerEvents = 'none';
+    body.appendChild(textarea);
+    textarea.focus();
+    textarea.select();
+
+    let copied = false;
+
+    try {
+      copied = this.document.execCommand('copy');
+    } catch {}
+
+    body.removeChild(textarea);
+
+    return copied;
+  }
+}
@@ -0,0 +1,47 @@
+import {
+  describe,
+  expect,
+  it
+} from 'vitest';
+
+import {
+  resolveHighMemoryAlertCopyKind,
+  resolveHighMemoryAlertMessageKey,
+  resolveHighMemoryAlertTitleKey
+} from './high-memory-alert-copy.rules';
+
+describe('high-memory-alert-copy.rules', () => {
+  it('uses threshold copy for live alerts and legacy records without a reason', () => {
+    expect(resolveHighMemoryAlertCopyKind({
+      logFilePath: '/tmp/log.jsonl',
+      detectedAt: 1,
+      peakWorkingSetKb: 2_100_000,
+      sessionId: 'session-1'
+    })).toBe('threshold');
+
+    expect(resolveHighMemoryAlertCopyKind({
+      logFilePath: '/tmp/log.jsonl',
+      detectedAt: 1,
+      peakWorkingSetKb: 2_100_000,
+      sessionId: 'session-1',
+      reason: 'threshold'
+    })).toBe('threshold');
+  });
+
+  it('uses manual copy for exported diagnostics', () => {
+    expect(resolveHighMemoryAlertCopyKind({
+      logFilePath: '/tmp/log.jsonl',
+      detectedAt: 1,
+      peakWorkingSetKb: 1_800_000,
+      sessionId: 'session-2',
+      reason: 'manual'
+    })).toBe('manual');
+  });
+
+  it('maps copy kinds to translation keys', () => {
+    expect(resolveHighMemoryAlertTitleKey('threshold')).toBe('app.highMemoryAlert.thresholdTitle');
+    expect(resolveHighMemoryAlertTitleKey('manual')).toBe('app.highMemoryAlert.manualTitle');
+    expect(resolveHighMemoryAlertMessageKey('threshold')).toBe('app.highMemoryAlert.thresholdMessage');
+    expect(resolveHighMemoryAlertMessageKey('manual')).toBe('app.highMemoryAlert.manualMessage');
+  });
+});
@@ -0,0 +1,21 @@
+import type { ElectronHighMemoryAlertRecord } from '../platform/electron/electron-api.models';
+
+export type HighMemoryAlertCopyKind = 'threshold' | 'manual';
+
+export function resolveHighMemoryAlertCopyKind(
+  alert: ElectronHighMemoryAlertRecord | null | undefined
+): HighMemoryAlertCopyKind {
+  return alert?.reason === 'manual' ? 'manual' : 'threshold';
+}
+
+export function resolveHighMemoryAlertTitleKey(kind: HighMemoryAlertCopyKind): string {
+  return kind === 'manual'
+    ? 'app.highMemoryAlert.manualTitle'
+    : 'app.highMemoryAlert.thresholdTitle';
+}
+
+export function resolveHighMemoryAlertMessageKey(kind: HighMemoryAlertCopyKind): string {
+  return kind === 'manual'
+    ? 'app.highMemoryAlert.manualMessage'
+    : 'app.highMemoryAlert.thresholdMessage';
+}
@@ -29,21 +29,26 @@ infrastructure adapters and UI.

 The larger domains also keep longer design notes in their own folders:

- [attachment/README.md](attachment/README.md)
 - [access-control/README.md](access-control/README.md)
+- [attachment/README.md](attachment/README.md)
 - [authentication/README.md](authentication/README.md)
 - [chat/README.md](chat/README.md)
+- [custom-emoji/README.md](custom-emoji/README.md)
 - [direct-message/README.md](direct-message/README.md)
 - [direct-call/README.md](direct-call/README.md)
 - [experimental-media/README.md](experimental-media/README.md)
+- [game-activity/README.md](game-activity/README.md)
 - [notifications/README.md](notifications/README.md)
 - [plugins/README.md](plugins/README.md)
 - [profile-avatar/README.md](profile-avatar/README.md)
 - [screen-share/README.md](screen-share/README.md)
 - [server-directory/README.md](server-directory/README.md)
+- [theme/README.md](theme/README.md)
 - [voice-connection/README.md](voice-connection/README.md)
 - [voice-session/README.md](voice-session/README.md)

+Cross-context wire contracts live in [`agents-docs/features/`](../../agents-docs/features/) — see [`agents-docs/FEATURES.md`](../../agents-docs/FEATURES.md).
+
 ## Folder convention

 Every domain follows the same internal layout:
@@ -28,7 +28,8 @@ attachment/
 │
 ├── infrastructure/
 │   ├── services/
-│   │   └── attachment-storage.service.ts        Electron filesystem access (save / read / delete)
+│   │   ├── attachment-storage.service.ts        Electron filesystem access (save / read / delete)
+│   │   └── capacitor-attachment-export.service.ts  Capacitor "download": copy/write bytes into public Documents
 │   └── util/
 │       └── attachment-storage.util.ts           sanitizeAttachmentRoomName, resolveAttachmentStorageBucket
 │
@@ -107,12 +108,17 @@ Concurrent triggers (file-announce, message sync, peer connect) can race to requ

 - **Requester:** `requestFromAnyPeer` marks the request pending *synchronously* before any async work, so the manager's `hasPendingRequest` gate closes the double-request race window.
 - **Sender:** `handleFileRequest` / `fulfillRequestWithFile` track active outbound streams per `(messageId, fileId, peerId)` and ignore duplicate requests while a stream is in flight. A fresh `file-request` clears any earlier `file-cancel` marker from that peer.
- **Receiver:** chunk buffers are dense (`Array.from({ length: total })`, never sparse `new Array(total)`); a chunk index that is already buffered is ignored entirely and never counts toward `receivedBytes`; a transfer finalizes only when *every* chunk index is present — byte counters are never a substitute for chunk completeness. Assembly state is released only after the attachment is marked `available`, and chunks arriving for an already-available attachment are dropped.
+- **Receiver:** chunk buffers are dense (`Array.from({ length: total })`, never sparse `new Array(total)`); a chunk index that is already buffered is ignored entirely and never counts toward `receivedBytes`; a transfer finalizes only when *every* chunk index is present — byte counters are never a substitute for chunk completeness. Assembly state is released only after the attachment is marked `available`, and chunks arriving for an already-available attachment are dropped. Files **≤ `MAX_AUTO_SAVE_SIZE_BYTES` (10 MB)** assemble in memory (parallel chunk receive, immediate `file-chunk-ack`) and are persisted after completion via `shouldPersistDownloadedAttachment`. **Oversized** persistable downloads (`> 10 MB`) append directly to disk when the store supports streaming (`canStreamToDisk`) — metadata `filePath` does not force an in-memory fallback. On stores that cannot stream (browser), oversized files the store can still persist (≤ 50 MB) assemble in memory instead. Whether a file can be received at all is decided once, at request time, by `canReceiveAttachment` — `handleFileChunk` must not re-gate on a stricter size cap, or it silently drops chunks the request gate already admitted (the receiver never acks, the sender's ack wait times out, and the download stalls at 0 bytes with no error). Disk-streamed receives decode each chunk once, append bytes through Electron IPC (`append-file-bytes`), and acknowledge the sender with `file-chunk-ack` so only one chunk is in flight at a time (preventing unbounded base64 retention in the renderer). Completed **images** ≤ 10 MB get an immediate `objectUrl` blob; oversized images stay on `savedPath` until inline display hydration runs on demand. Completed **audio/video** immediately resolve a playable URL via `attachmentStorage.getFileUrl(savedPath)` (Electron/Capacitor) or `ensureInlineDisplayObjectUrl` in the browser.
+- **Sender:** after each `file-chunk` the transport awaits the matching `file-chunk-ack` before sending the next chunk, in addition to data-channel bufferedAmount back-pressure.

 ### Failure handling

 If the sender cannot find the file, it replies with `file-not-found`. The transfer service then tries the next connected peer that has announced the same attachment. Either side can send `file-cancel` to abort a transfer in progress.

+Peers that finish downloading a file re-announce it and register themselves as mirror hosts. New download requests prefer mirror hosts over the original uploader so the sharer's device is not the only upload source. Repeat `file-announce` events for already-known attachments update the host list and re-queue the guarded auto-download path, allowing a host that returned after `file-not-found` to recover failed inline media without another navigation; pending-request and availability gates prevent duplicate transfers. Outgoing `file-announce` broadcasts are also relayed to sibling devices through `account_sync` (see `infrastructure/realtime/account-sync/account-sync.rules.ts`) so a second client of the same user learns attachment metadata even when it cannot P2P to itself.
+
+After reload, serving and re-announcing wait for persisted attachment metadata to finish hydrating. Hosted files are announced even when the uploader is not currently viewing a room, so reconnecting peers can discover them from dashboard and other non-chat routes. If only an original Electron file-picker path survived, the first request copies that file into app data before streaming it; a request must not receive `file-not-found` merely because it raced startup hydration.
+
 ```mermaid
 sequenceDiagram
    participant R as Receiver
@@ -141,7 +147,11 @@ When the user navigates to a room, the manager watches the route and decides whi

 The decision lives in `shouldAutoRequestWhenWatched()` which calls `isAttachmentMedia()` and checks against `MAX_AUTO_SAVE_SIZE_BYTES`.

-Direct-message routes (`/dm/:conversationId` and `/pm/:conversationId`) are treated as watched attachment containers named `direct-message:<conversationId>`, so image/video metadata announced for the visible conversation is eligible for the same automatic request path as server-room media.
+Direct-message routes (`/dm/:conversationId` and `/pm/:conversationId`) are treated as watched attachment containers named `direct-message:<conversationId>`, so image/video metadata announced for the visible conversation is eligible for the same automatic request path as server-room media. Auto-download work fans out with bounded concurrency (`ATTACHMENT_AUTO_DOWNLOAD_CONCURRENCY`, default 3 files at a time per watched room) so multiple pending files can progress in parallel without removing the per-file chunk-ack memory safety invariant. Stalled partial downloads are reset automatically before the next auto-download pass — but only when chunk progress has been quiet past `ATTACHMENT_STALLED_DOWNLOAD_THRESHOLD_MS` (`attachment-autodownload.rules.ts`). The pending-request marker is deleted on the first received chunk, so "no pending request" alone must never classify an in-flight transfer as stalled; resetting an active transfer cancels it on the sender and the retry deadlocks against the sender's per-peer active-transfer dedupe.
+
+Auto-download triggers must fire from *every* event that can complete the `messageId -> roomId` binding, because `file-announce` (WebRTC data channel) and `chat-message` (signaling websocket) travel on different transports and arrive in either order. When the announce arrives first, the room is still unknown and that pass gives up; the `chat-message` handler (`messages-incoming.handlers.ts`) therefore calls `rememberMessageRoom` and re-queues `queueAutoDownloadsForMessage` for the arriving message.
+
+Incoming and synced attachment metadata is normalized through `attachment-normalize.rules.ts` / `attachment-mime.rules.ts`: generic `application/octet-stream` (or empty) MIME types are inferred from the filename extension so images still group into galleries and small audio/video render as players instead of generic file cards. Display hydration (`needsAttachmentDisplayHydration`) rehydrates blob/file URLs from disk for both inline images and playable media without forcing a fresh peer download when local bytes already exist.

 Browser chat views render audio/video larger than 50 MB with the same generic file interface as other downloads, even after the bytes are available. Attachments with audio/video MIME types that Chromium reports as unsupported also use the generic file interface instead of a broken native player.

@@ -155,6 +165,7 @@ An optional experimental VLC.js adapter can be enabled from General settings. Wh

 - `isUploaderUser(attachment, currentUserId)` — the current user is the uploader (same user, any device).
 - `deviceHasLocalCopy(attachment)` — this device physically holds the bytes (`available` + a blob `objectUrl`, or a non-empty `savedPath`/`filePath`). Synced metadata alone does not count, because P2P/account sync strips local paths.
+- `canHostAttachment(attachment)` — alias of `deviceHasLocalCopy`; any peer with local bytes can serve downloads.
 - `isSharingFromThisDevice(attachment, currentUserId)` — `isUploaderUser && deviceHasLocalCopy`. Only this returns the "Shared from your device" state.

 The chat message item renders "Shared from your device" (and hides the request/download affordance) **only** when `isSharingFromThisDevice` is true. A second device of the same user that merely synced the message metadata is the uploader-user but holds no local copy, so it falls back to the normal recipient flow (request/download) instead of falsely claiming ownership and blocking the file (regression: the old check used `uploaderPeerId === currentUserId` and so claimed ownership on every device of the uploader). The transfer service uses the same rule to decide whether a no-peers failure should read "your original upload is missing" (sharing device) or "no connected peers" (any other device).
@@ -183,7 +194,7 @@ Direct-message attachments use the conversation id instead of the server-room pa

 Room and conversation names are sanitised to remove filesystem-unsafe characters. The bucket is `video`, `audio`, `image`, or `files` depending on the attachment type. The original filename is kept in attachment metadata for display and downloads, but the stored file uses the attachment ID plus the original extension so two uploads with the same visible name do not overwrite each other.

-`AttachmentPersistenceService` handles startup migration from an older localStorage-based format into the database, and restores attachment metadata from the DB on init. On restore, `ensureInlineDisplayObjectUrl` resolves the stored path and, when the active store exposes a directly loadable URL (`providesInlineObjectUrl`, i.e. Capacitor), uses that URL as-is; otherwise it rebuilds a `Blob` from the stored bytes (Electron via chunked reads, browser via whole-file read with the correct MIME). Because the browser store persists bytes to IndexedDB, sent and received files are remembered across reload/restart on every platform.
+`AttachmentPersistenceService` handles startup migration from an older localStorage-based format into the database, and restores attachment metadata from the DB on init. Database hydration merges into attachments already learned or downloaded during startup instead of replacing the runtime map: live `available`, `receivedBytes`, and `objectUrl` state wins, while persisted local paths fill any missing path fields. This prevents late initialization from turning completed downloads back into Retry/spinner/100% states or dropping an announce that arrived during startup. On restore, `ensureInlineDisplayObjectUrl` resolves the stored path and, when the active store exposes a directly loadable URL (`providesInlineObjectUrl`, i.e. Capacitor), uses that URL as-is; otherwise it rebuilds a `Blob` from the stored bytes (Electron via chunked reads, browser via whole-file read with the correct MIME). Because the browser store persists bytes to IndexedDB, sent and received files are remembered across reload/restart on every platform.

 ## Runtime store

@@ -195,3 +206,23 @@ Room and conversation names are sanitised to remove filesystem-unsafe characters
 - **cancellations**: IDs of transfers the user cancelled

 Components read attachment state reactively through the store's signals. The store has no persistence of its own; that responsibility belongs to the persistence service.
+
+### Display blob lifecycle (memory)
+
+Image inline previews on Electron/desktop use renderer `blob:` URLs rebuilt from disk. To cap RAM in media-heavy channels:
+
+- **Room restore** (`restoreLocalAttachmentsForRoom`) resolves `savedPath` for hosting only — it does not hydrate every image blob up front.
+- **Visibility** (`ChatMessageItemComponent` + `IntersectionObserver` on the chat scrollport) hydrates blobs when a message enters view (with `ATTACHMENT_BLOB_VISIBILITY_ROOT_MARGIN`) and revokes them when it leaves, as long as a disk path can rehydrate later (`canRevokeAttachmentDisplayBlob`). The observer targets the rendered message row rather than the potentially boxless Angular component host, so returning to a channel reliably marks visible rows for rehydration. Hydration itself is visibility-gated (`attachment-hydration-visibility.rules.ts`) — off-screen rows never load blobs, and destroyed rows always release theirs.
+- **Bounded hydration:** disk-to-blob display hydration is deduplicated per `(messageId, attachmentId)` and globally limited to two active reads. Leaving/destroying an unpinned message row cancels its queued or active hydration; every IPC chunk and the final object-URL assignment re-check cancellation so stale work from rapid channel switches can never reattach orphaned blobs after teardown.
+- **No byte duplication:** disk-hydrated blobs are never copied into `AttachmentRuntimeStore.originalFiles` (`applyAttachmentBlob`); revocation of a disk-backed blob also drops any stale `originalFiles` entry. `originalFiles` only carries uploads/downloads that have no disk copy yet.
+- **Room switch sweep:** `releaseDisplayBlobsForInactiveRooms` revokes display blobs for messages of all other rooms when navigation lands on a different room.
+- **Pinned overlays** (lightbox / image gallery) call `pinDisplayBlobs` so an open full-screen view is not revoked while its message scrolls off-screen.
+- **Serving** is unaffected: peers still download from `savedPath` / `filePath` (`streamRequestedFile` prefers the disk path); blob URLs are display-only.
+
+While a revoked image waits to rehydrate, chat renders the existing image-grid spinner skeleton (`isAttachmentPendingInlineHydration`).
+
+Chat attachment images keep plain `[src]` bindings because Angular's `NgOptimizedImage` rejects runtime `blob:` URLs (`NG02952`). Inline, grid, and gallery thumbnails use native `loading="lazy"` and `decoding="async"`; fullscreen lightbox images remain eager.
+
+## Cross-context feature docs
+
+- [`agents-docs/features/attachments.md`](../../../../../agents-docs/features/attachments.md)
@@ -75,6 +75,30 @@ export class AttachmentFacade {
    return this.manager.tryRestoreAttachmentFromLocal(...args);
  }

+  pinDisplayBlobs(
+    ...args: Parameters<AttachmentManagerService['pinDisplayBlobs']>
+  ): ReturnType<AttachmentManagerService['pinDisplayBlobs']> {
+    return this.manager.pinDisplayBlobs(...args);
+  }
+
+  unpinDisplayBlobs(
+    ...args: Parameters<AttachmentManagerService['unpinDisplayBlobs']>
+  ): ReturnType<AttachmentManagerService['unpinDisplayBlobs']> {
+    return this.manager.unpinDisplayBlobs(...args);
+  }
+
+  revokeOffscreenDisplayBlobsForMessage(
+    ...args: Parameters<AttachmentManagerService['revokeOffscreenDisplayBlobsForMessage']>
+  ): ReturnType<AttachmentManagerService['revokeOffscreenDisplayBlobsForMessage']> {
+    return this.manager.revokeOffscreenDisplayBlobsForMessage(...args);
+  }
+
+  cancelDisplayHydrationForMessage(
+    ...args: Parameters<AttachmentManagerService['cancelDisplayHydrationForMessage']>
+  ): ReturnType<AttachmentManagerService['cancelDisplayHydrationForMessage']> {
+    return this.manager.cancelDisplayHydrationForMessage(...args);
+  }
+
  requestFile(
    ...args: Parameters<AttachmentManagerService['requestFile']>
  ): ReturnType<AttachmentManagerService['requestFile']> {
@@ -99,6 +123,12 @@ export class AttachmentFacade {
    return this.manager.handleFileChunk(...args);
  }

+  handleFileChunkAck(
+    ...args: Parameters<AttachmentManagerService['handleFileChunkAck']>
+  ): ReturnType<AttachmentManagerService['handleFileChunkAck']> {
+    return this.manager.handleFileChunkAck(...args);
+  }
+
  handleFileRequest(
    ...args: Parameters<AttachmentManagerService['handleFileRequest']>
  ): ReturnType<AttachmentManagerService['handleFileRequest']> {
@@ -111,6 +141,12 @@ export class AttachmentFacade {
    return this.manager.cancelRequest(...args);
  }

+  hasPendingRequest(
+    ...args: Parameters<AttachmentManagerService['hasPendingRequest']>
+  ): ReturnType<AttachmentManagerService['hasPendingRequest']> {
+    return this.manager.hasPendingRequest(...args);
+  }
+
  handleFileCancel(
    ...args: Parameters<AttachmentManagerService['handleFileCancel']>
  ): ReturnType<AttachmentManagerService['handleFileCancel']> {
@@ -0,0 +1,37 @@
+import {
+  beforeEach,
+  describe,
+  expect,
+  it,
+  vi
+} from 'vitest';
+
+import { AttachmentChunkAckService } from './attachment-chunk-ack.service';
+
+describe('AttachmentChunkAckService', () => {
+  let service: AttachmentChunkAckService;
+
+  beforeEach(() => {
+    service = new AttachmentChunkAckService();
+  });
+
+  it('resolves a waiter when the matching chunk ack arrives', async () => {
+    const waitPromise = service.waitForAck('msg-1', 'file-1', 0, 1_000);
+
+    service.resolveAck('msg-1', 'file-1', 0);
+
+    await expect(waitPromise).resolves.toBeUndefined();
+  });
+
+  it('times out when no ack arrives', async () => {
+    vi.useFakeTimers();
+
+    const waitPromise = service.waitForAck('msg-1', 'file-1', 1, 50);
+
+    vi.advanceTimersByTime(51);
+
+    await expect(waitPromise).rejects.toThrow('attachment chunk ack timeout');
+
+    vi.useRealTimers();
+  });
+});
@@ -0,0 +1,47 @@
+import { Injectable } from '@angular/core';
+
+import { buildAttachmentChunkAckKey } from '../../domain/logic/attachment-chunk-ack.rules';
+
+@Injectable({ providedIn: 'root' })
+export class AttachmentChunkAckService {
+  private readonly waiters = new Map<string, () => void>();
+
+  waitForAck(
+    messageId: string,
+    fileId: string,
+    index: number,
+    timeoutMs = 60_000
+  ): Promise<void> {
+    const key = buildAttachmentChunkAckKey(messageId, fileId, index);
+
+    return new Promise((resolve, reject) => {
+      const timer = setTimeout(() => {
+        this.waiters.delete(key);
+        reject(new Error('attachment chunk ack timeout'));
+      }, timeoutMs);
+
+      this.waiters.set(key, () => {
+        clearTimeout(timer);
+        this.waiters.delete(key);
+        resolve();
+      });
+    });
+  }
+
+  resolveAck(messageId: string, fileId: string, index: number): void {
+    this.waiters.get(buildAttachmentChunkAckKey(messageId, fileId, index))?.();
+  }
+
+  cancelPendingForFile(messageId: string, fileId: string): void {
+    const prefix = `${messageId}:${fileId}:`;
+
+    for (const [key, resolve] of this.waiters) {
+      if (!key.startsWith(prefix)) {
+        continue;
+      }
+
+      resolve();
+      this.waiters.delete(key);
+    }
+  }
+}
@@ -0,0 +1,130 @@
+import '@angular/compiler';
+import {
+  beforeEach,
+  describe,
+  expect,
+  it,
+  vi
+} from 'vitest';
+import { DOCUMENT } from '@angular/common';
+import { Injector, runInInjectionContext } from '@angular/core';
+
+const isCapacitorNativeRuntimeMock = vi.fn(() => false);
+
+vi.mock('../../../../infrastructure/mobile/logic/platform-detection.rules', () => ({
+  isCapacitorNativeRuntime: () => isCapacitorNativeRuntimeMock()
+}));
+
+import { AttachmentDownloadService } from './attachment-download.service';
+import { ElectronBridgeService } from '../../../../core/platform/electron/electron-bridge.service';
+import { CapacitorAttachmentExportService } from '../../infrastructure/services/capacitor-attachment-export.service';
+import type { Attachment } from '../../domain/models/attachment.model';
+
+describe('AttachmentDownloadService', () => {
+  let electronBridge: {
+    isAvailable: boolean;
+    getApi: ReturnType<typeof vi.fn>;
+  };
+  let documentStub: Document;
+  let saveExistingFileAs: ReturnType<typeof vi.fn>;
+  let saveFileAs: ReturnType<typeof vi.fn>;
+  let exportToDevice: ReturnType<typeof vi.fn>;
+
+  beforeEach(() => {
+    isCapacitorNativeRuntimeMock.mockReturnValue(false);
+    exportToDevice = vi.fn(async () => true);
+    saveExistingFileAs = vi.fn(async () => ({ saved: true, cancelled: false }));
+    saveFileAs = vi.fn(async () => ({ saved: true, cancelled: false }));
+
+    electronBridge = {
+      isAvailable: true,
+      getApi: vi.fn(() => ({
+        saveExistingFileAs,
+        saveFileAs
+      }))
+    };
+
+    documentStub = {
+      body: {
+        appendChild: vi.fn(),
+        removeChild: vi.fn()
+      },
+      createElement: vi.fn(() => ({
+        click: vi.fn(),
+        remove: vi.fn(),
+        href: '',
+        download: ''
+      }))
+    } as unknown as Document;
+  });
+
+  function createService(): AttachmentDownloadService {
+    const injector = Injector.create({
+      providers: [
+        AttachmentDownloadService,
+        { provide: ElectronBridgeService, useValue: electronBridge },
+        { provide: CapacitorAttachmentExportService, useValue: { exportToDevice } },
+        { provide: DOCUMENT, useValue: documentStub }
+      ]
+    });
+
+    return runInInjectionContext(injector, () => injector.get(AttachmentDownloadService));
+  }
+
+  it('exports a completed disk-only attachment through Electron save dialog', async () => {
+    const service = createService();
+    const attachment: Attachment = {
+      id: 'file-1',
+      messageId: 'message-1',
+      filename: 'large.bin',
+      mime: 'application/octet-stream',
+      size: 5_000_000_000,
+      available: true,
+      savedPath: '/appdata/server/room/files/large.bin'
+    };
+
+    await expect(service.downloadToUserLocation(attachment)).resolves.toBe(true);
+
+    expect(saveExistingFileAs).toHaveBeenCalledWith('/appdata/server/room/files/large.bin', 'large.bin');
+    expect(saveFileAs).not.toHaveBeenCalled();
+  });
+
+  it('delegates to the Capacitor export service on a native mobile shell', async () => {
+    isCapacitorNativeRuntimeMock.mockReturnValue(true);
+    electronBridge.getApi = vi.fn(() => null);
+
+    const service = createService();
+    const attachment: Attachment = {
+      id: 'file-3',
+      messageId: 'message-3',
+      filename: 'photo.png',
+      mime: 'image/png',
+      size: 2048,
+      available: true,
+      savedPath: 'metoyou/server/room/files/photo.png'
+    };
+
+    await expect(service.downloadToUserLocation(attachment)).resolves.toBe(true);
+
+    expect(exportToDevice).toHaveBeenCalledWith(attachment);
+    expect(saveExistingFileAs).not.toHaveBeenCalled();
+    expect(saveFileAs).not.toHaveBeenCalled();
+  });
+
+  it('does nothing when the attachment is not downloadable yet', async () => {
+    const service = createService();
+    const attachment: Attachment = {
+      id: 'file-2',
+      messageId: 'message-2',
+      filename: 'large.bin',
+      mime: 'application/octet-stream',
+      size: 5_000_000_000,
+      available: true
+    };
+
+    await expect(service.downloadToUserLocation(attachment)).resolves.toBe(false);
+
+    expect(saveExistingFileAs).not.toHaveBeenCalled();
+    expect(saveFileAs).not.toHaveBeenCalled();
+  });
+});
@@ -0,0 +1,104 @@
+import { DOCUMENT } from '@angular/common';
+import { Injectable, inject } from '@angular/core';
+
+import { ElectronBridgeService } from '../../../../core/platform/electron/electron-bridge.service';
+import { isCapacitorNativeRuntime } from '../../../../infrastructure/mobile/logic/platform-detection.rules';
+import { canDownloadAttachment, resolveAttachmentDiskPath } from '../../domain/logic/attachment-download.rules';
+import type { Attachment } from '../../domain/models/attachment.model';
+import { CapacitorAttachmentExportService } from '../../infrastructure/services/capacitor-attachment-export.service';
+
+@Injectable({ providedIn: 'root' })
+export class AttachmentDownloadService {
+  private readonly electronBridge = inject(ElectronBridgeService);
+  private readonly capacitorExport = inject(CapacitorAttachmentExportService);
+  private readonly document = inject(DOCUMENT);
+
+  async downloadToUserLocation(attachment: Attachment): Promise<boolean> {
+    if (!canDownloadAttachment(attachment)) {
+      return false;
+    }
+
+    if (isCapacitorNativeRuntime()) {
+      return this.capacitorExport.exportToDevice(attachment);
+    }
+
+    const electronApi = this.electronBridge.getApi();
+    const diskPath = resolveAttachmentDiskPath(attachment);
+
+    if (electronApi) {
+      if (diskPath && electronApi.saveExistingFileAs) {
+        try {
+          const result = await electronApi.saveExistingFileAs(diskPath, attachment.filename);
+
+          if (result.saved || result.cancelled) {
+            return true;
+          }
+        } catch {
+          /* fall back to blob/browser download */
+        }
+      }
+
+      const blob = await this.getAttachmentBlob(attachment);
+
+      if (blob) {
+        try {
+          const result = await electronApi.saveFileAs(attachment.filename, await this.blobToBase64(blob));
+
+          if (result.saved || result.cancelled) {
+            return true;
+          }
+        } catch {
+          /* fall back to browser download */
+        }
+      }
+    }
+
+    if (!attachment.objectUrl) {
+      return false;
+    }
+
+    const link = this.document.createElement('a');
+
+    link.href = attachment.objectUrl;
+    link.download = attachment.filename;
+    this.document.body?.appendChild(link);
+    link.click();
+    link.remove();
+
+    return true;
+  }
+
+  private async getAttachmentBlob(attachment: Attachment): Promise<Blob | null> {
+    if (!attachment.objectUrl || attachment.objectUrl.startsWith('file:')) {
+      return null;
+    }
+
+    try {
+      const response = await fetch(attachment.objectUrl);
+
+      return await response.blob();
+    } catch {
+      return null;
+    }
+  }
+
+  private blobToBase64(blob: Blob): Promise<string> {
+    return new Promise((resolve, reject) => {
+      const reader = new FileReader();
+
+      reader.onload = () => {
+        if (typeof reader.result !== 'string') {
+          reject(new Error('Failed to encode attachment'));
+          return;
+        }
+
+        const [, base64 = ''] = reader.result.split(',', 2);
+
+        resolve(base64);
+      };
+
+      reader.onerror = () => reject(reader.error ?? new Error('Failed to read attachment'));
+      reader.readAsDataURL(blob);
+    });
+  }
+}
@@ -0,0 +1,48 @@
+import '@angular/compiler';
+import { vi } from 'vitest';
+
+import { buildAttachmentDisplayPinKey } from '../../domain/logic/attachment-blob-eviction.rules';
+import type { Attachment } from '../../domain/models/attachment.model';
+import { AttachmentManagerService } from './attachment-manager.service';
+
+describe('AttachmentManagerService display hydration lifecycle', () => {
+  it('cancels and revokes unpinned attachments while preserving pinned fullscreen media', () => {
+    const unpinned: Attachment = {
+      id: 'att-1',
+      messageId: 'msg-1',
+      filename: 'photo.png',
+      size: 3,
+      mime: 'image/png',
+      isImage: true,
+      available: true,
+      savedPath: '/appdata/photo.png',
+      objectUrl: 'blob:http://localhost/photo'
+    };
+    const pinned: Attachment = {
+      ...unpinned,
+      id: 'att-2',
+      objectUrl: 'blob:http://localhost/pinned'
+    };
+    const persistence = {
+      cancelDisplayHydration: vi.fn(),
+      revokeAttachmentDisplayBlob: vi.fn(() => true)
+    };
+    const runtimeStore = {
+      getAttachmentsForMessage: vi.fn(() => [unpinned, pinned]),
+      touch: vi.fn()
+    };
+    const manager = Object.create(AttachmentManagerService.prototype) as AttachmentManagerService;
+
+    Reflect.set(manager, 'persistence', persistence);
+    Reflect.set(manager, 'runtimeStore', runtimeStore);
+    Reflect.set(manager, 'pinnedDisplayBlobKeys', new Set([buildAttachmentDisplayPinKey('msg-1', 'att-2')]));
+
+    manager.revokeOffscreenDisplayBlobsForMessage('msg-1');
+
+    expect(persistence.cancelDisplayHydration).toHaveBeenCalledTimes(1);
+    expect(persistence.cancelDisplayHydration).toHaveBeenCalledWith(unpinned);
+    expect(persistence.revokeAttachmentDisplayBlob).toHaveBeenCalledTimes(1);
+    expect(persistence.revokeAttachmentDisplayBlob).toHaveBeenCalledWith(unpinned);
+    expect(runtimeStore.touch).toHaveBeenCalledTimes(1);
+  });
+});
@@ -4,19 +4,31 @@ import {
  inject
 } from '@angular/core';
 import { NavigationEnd, Router } from '@angular/router';
+import { Store } from '@ngrx/store';
+import { take } from 'rxjs';
 import { RealtimeSessionFacade } from '../../../../core/realtime';
+import { selectCurrentUserId } from '../../../../store/users/users.selectors';
 import { DatabaseService } from '../../../../infrastructure/persistence';
 import { yieldToAttachmentHydrationLoop } from '../../domain/logic/attachment-blob.rules';
+import {
+  buildAttachmentDisplayPinKey,
+  collectMessageIdsForInactiveRoomBlobRelease,
+  isAttachmentDisplayPinned,
+  shouldRevokeDisplayBlobForAttachment
+} from '../../domain/logic/attachment-blob-eviction.rules';
 import {
  getWatchedAttachmentRoomIdFromUrl,
  isDirectMessageAttachmentRoomId,
  shouldAutoRequestWhenWatched
 } from '../../domain/logic/attachment.logic';
+import { ATTACHMENT_AUTO_DOWNLOAD_CONCURRENCY, runTasksWithBoundedConcurrency } from '../../domain/logic/attachment-autodownload-concurrency.rules';
+import { shouldResetStalledAttachmentDownload } from '../../domain/logic/attachment-autodownload.rules';
 import type { Attachment, AttachmentMeta } from '../../domain/models/attachment.model';
 import type {
  FileAnnouncePayload,
  FileCancelPayload,
  FileChunkPayload,
+  FileChunkAckPayload,
  FileNotFoundPayload,
  FileRequestPayload
 } from '../../domain/models/attachment-transfer.model';
@@ -32,6 +44,7 @@ export class AttachmentManagerService {

  private readonly webrtc = inject(RealtimeSessionFacade);
  private readonly router = inject(Router);
+  private readonly store = inject(Store);
  private readonly database = inject(DatabaseService);
  private readonly runtimeStore = inject(AttachmentRuntimeStore);
  private readonly persistence = inject(AttachmentPersistenceService);
@@ -40,15 +53,20 @@ export class AttachmentManagerService {
  private watchedRoomId: string | null = this.extractWatchedRoomId(this.router.url);
  private isDatabaseInitialised = false;
  private autoDownloadRequestsByRoom = new Map<string, Promise<void>>();
+  private pinnedDisplayBlobKeys = new Set<string>();

  constructor() {
    effect(() => {
      if (this.database.isReady() && !this.isDatabaseInitialised) {
        this.isDatabaseInitialised = true;
-        void this.persistence.initFromDatabase().then(() => {
+        void this.persistence.initFromDatabase().then(async () => {
          if (this.watchedRoomId) {
-            void this.restoreLocalAttachmentsForRoom(this.watchedRoomId);
+            await this.restoreLocalAttachmentsForRoom(this.watchedRoomId);
          }
+
+          // Announce regardless of the current route - a reloaded uploader
+          // sitting on the dashboard still hosts its persisted files.
+          await this.announceHostedAttachments();
        });
      }
    });
@@ -58,8 +76,14 @@ export class AttachmentManagerService {
        return;
      }

+      const previousRoomId = this.watchedRoomId;
+
      this.watchedRoomId = this.extractWatchedRoomId(event.urlAfterRedirects || event.url);

+      if (this.watchedRoomId !== previousRoomId) {
+        this.releaseDisplayBlobsForInactiveRooms(this.watchedRoomId);
+      }
+
      if (this.watchedRoomId) {
        void this.restoreLocalAttachmentsForRoom(this.watchedRoomId);
        void this.requestAutoDownloadsForRoom(this.watchedRoomId);
@@ -68,9 +92,19 @@ export class AttachmentManagerService {

    this.webrtc.onPeerConnected.subscribe(() => {
      if (this.watchedRoomId) {
-        void this.restoreLocalAttachmentsForRoom(this.watchedRoomId);
-        void this.requestAutoDownloadsForRoom(this.watchedRoomId);
+        const watchedRoomId = this.watchedRoomId;
+
+        void this.restoreLocalAttachmentsForRoom(watchedRoomId).then(async () => {
+          await this.announceHostedAttachments();
+        });
+
+        void this.requestAutoDownloadsForRoom(watchedRoomId);
+        return;
      }
+
+      // No room open (e.g. reloaded onto the dashboard) - still announce
+      // persisted files so peers relearn this device hosts them.
+      void this.announceHostedAttachments();
    });
  }

@@ -142,6 +176,10 @@ export class AttachmentManagerService {
    return this.transfer.requestImageFromAnyPeer(messageId, attachment);
  }

+  hasPendingRequest(messageId: string, attachmentId: string): boolean {
+    return this.transfer.hasPendingRequest(messageId, attachmentId);
+  }
+
  async tryRestoreAttachmentFromLocal(attachment: Attachment): Promise<boolean> {
    const restored = await this.persistence.tryRestoreAttachmentFromLocal(attachment);

@@ -152,6 +190,76 @@ export class AttachmentManagerService {
    return restored;
  }

+  pinDisplayBlobs(attachments: readonly Pick<Attachment, 'id' | 'messageId'>[]): void {
+    for (const attachment of attachments) {
+      if (!attachment.messageId || !attachment.id) {
+        continue;
+      }
+
+      this.pinnedDisplayBlobKeys.add(buildAttachmentDisplayPinKey(attachment.messageId, attachment.id));
+    }
+  }
+
+  unpinDisplayBlobs(attachments: readonly Pick<Attachment, 'id' | 'messageId'>[]): void {
+    for (const attachment of attachments) {
+      if (!attachment.messageId || !attachment.id) {
+        continue;
+      }
+
+      this.pinnedDisplayBlobKeys.delete(buildAttachmentDisplayPinKey(attachment.messageId, attachment.id));
+    }
+  }
+
+  revokeOffscreenDisplayBlobsForMessage(messageId: string): void {
+    if (!messageId) {
+      return;
+    }
+
+    this.cancelDisplayHydrationForMessage(messageId);
+
+    let hasChanges = false;
+
+    for (const attachment of this.runtimeStore.getAttachmentsForMessage(messageId)) {
+      if (!shouldRevokeDisplayBlobForAttachment(messageId, attachment, this.pinnedDisplayBlobKeys)) {
+        continue;
+      }
+
+      if (this.persistence.revokeAttachmentDisplayBlob(attachment)) {
+        hasChanges = true;
+      }
+    }
+
+    if (hasChanges) {
+      this.runtimeStore.touch();
+    }
+  }
+
+  cancelDisplayHydrationForMessage(messageId: string): void {
+    if (!messageId) {
+      return;
+    }
+
+    for (const attachment of this.runtimeStore.getAttachmentsForMessage(messageId)) {
+      if (isAttachmentDisplayPinned(messageId, attachment.id, this.pinnedDisplayBlobKeys)) {
+        continue;
+      }
+
+      this.persistence.cancelDisplayHydration(attachment);
+    }
+  }
+
+  releaseDisplayBlobsForInactiveRooms(activeRoomId: string | null): void {
+    const messageIds = collectMessageIdsForInactiveRoomBlobRelease(
+      Array.from(this.runtimeStore.getAttachmentEntries(), ([messageId]) => messageId),
+      (messageId) => this.runtimeStore.getMessageRoomId(messageId) ?? null,
+      activeRoomId
+    );
+
+    for (const messageId of messageIds) {
+      this.revokeOffscreenDisplayBlobsForMessage(messageId);
+    }
+  }
+
  requestFile(messageId: string, attachment: Attachment): Promise<void> {
    return this.transfer.requestFile(messageId, attachment);
  }
@@ -168,6 +276,8 @@ export class AttachmentManagerService {
    this.transfer.handleFileAnnounce(payload);

    if (payload.messageId && payload.file?.id) {
+      // Re-announces are recovery signals too: a host may have come back after
+      // an earlier file-not-found, so re-run the guarded auto-download path.
      this.queueAutoDownloadsForMessage(payload.messageId, payload.file.id);
    }
  }
@@ -176,6 +286,10 @@ export class AttachmentManagerService {
    this.transfer.handleFileChunk(payload);
  }

+  handleFileChunkAck(payload: FileChunkAckPayload): void {
+    this.transfer.handleFileChunkAck(payload);
+  }
+
  async handleFileRequest(payload: FileRequestPayload): Promise<void> {
    await this.transfer.handleFileRequest(payload);
  }
@@ -210,7 +324,7 @@ export class AttachmentManagerService {

    for (const messageId of messageIds) {
      for (const attachment of this.runtimeStore.getAttachmentsForMessage(messageId)) {
-        if (await this.persistence.tryRestoreAttachmentFromLocal(attachment)) {
+        if (await this.persistence.tryRestoreAttachmentHostOnly(attachment)) {
          hasChanges = true;
          await yieldToAttachmentHydrationLoop();
        }
@@ -259,33 +373,40 @@ export class AttachmentManagerService {

    await this.restoreLocalAttachmentsForRoom(roomId);

-    if (isDirectMessageAttachmentRoomId(roomId)) {
-      await this.requestAutoDownloadsForRuntimeRoom(roomId);
-      return;
-    }
+    let messageIds: string[];

-    if (this.database.isReady()) {
+    if (isDirectMessageAttachmentRoomId(roomId)) {
+      messageIds = await this.collectMessageIdsForAttachmentsInRoom(roomId);
+    } else if (this.database.isReady()) {
      const messages = await this.database.getMessages(roomId, 500, 0);

      for (const message of messages) {
        this.runtimeStore.rememberMessageRoom(message.id, message.roomId);
-        await this.requestAutoDownloadsForMessage(message.id);
      }

-      return;
+      messageIds = messages.map((message) => message.id);
+    } else {
+      messageIds = await this.collectMessageIdsForAttachmentsInRoom(roomId);
    }

-    await this.requestAutoDownloadsForRuntimeRoom(roomId);
+    await runTasksWithBoundedConcurrency(
+      messageIds.map((messageId) => () => this.requestAutoDownloadsForMessage(messageId)),
+      ATTACHMENT_AUTO_DOWNLOAD_CONCURRENCY
+    );
  }

-  private async requestAutoDownloadsForRuntimeRoom(roomId: string): Promise<void> {
+  private async collectMessageIdsForAttachmentsInRoom(roomId: string): Promise<string[]> {
+    const messageIds: string[] = [];
+
    for (const [messageId] of this.runtimeStore.getAttachmentEntries()) {
      const attachmentRoomId = await this.persistence.resolveMessageRoomId(messageId);

      if (attachmentRoomId === roomId) {
-        await this.requestAutoDownloadsForMessage(messageId);
+        messageIds.push(messageId);
      }
    }
+
+    return messageIds;
  }

  private async requestAutoDownloadsForMessage(messageId: string, attachmentId?: string): Promise<void> {
@@ -310,8 +431,15 @@ export class AttachmentManagerService {
      if (attachment.available)
        continue;

-      if ((attachment.receivedBytes ?? 0) > 0)
+      if (shouldResetStalledAttachmentDownload(
+        attachment,
+        this.transfer.hasPendingRequest(messageId, attachment.id),
+        Date.now()
+      )) {
+        this.transfer.cancelRequest(messageId, attachment);
+      } else if ((attachment.receivedBytes ?? 0) > 0) {
        continue;
+      }

      if (this.transfer.hasPendingRequest(messageId, attachment.id))
        continue;
@@ -324,6 +452,15 @@ export class AttachmentManagerService {
    return getWatchedAttachmentRoomIdFromUrl(url);
  }

+  private async announceHostedAttachments(): Promise<void> {
+    const currentUserId = await new Promise<string | null>((resolve) => {
+      this.store.select(selectCurrentUserId).pipe(take(1))
+        .subscribe((userId) => resolve(userId));
+    });
+
+    await this.transfer.reannounceHostedAttachments(currentUserId);
+  }
+
  private isRoomWatched(roomId: string | null | undefined): boolean {
    return !!roomId && roomId === this.watchedRoomId;
  }
@@ -12,6 +12,7 @@ import {
  signal
 } from '@angular/core';
 import { Store } from '@ngrx/store';
+import { of } from 'rxjs';

 import { DatabaseService } from '../../../../infrastructure/persistence';
 import { AttachmentStorageService } from '../../infrastructure/services/attachment-storage.service';
@@ -51,6 +52,7 @@ describe('AttachmentPersistenceService', () => {
          savedPath: '/appdata/photo.png'
        }
      ])),
+      getAttachmentsForMessage: vi.fn(() => Promise.resolve([])),
      getMessageById: vi.fn(() => Promise.resolve(null)),
      saveAttachment: vi.fn(() => Promise.resolve()),
      deleteAttachmentsForMessage: vi.fn(() => Promise.resolve())
@@ -64,6 +66,9 @@ describe('AttachmentPersistenceService', () => {
      getFileSize: vi.fn(() => Promise.resolve(3)),
      getFileUrl: vi.fn(() => Promise.resolve(null)),
      canReadFileChunks: vi.fn(() => true),
+      canCopyFiles: vi.fn(() => true),
+      createWritableFile: vi.fn(async () => '/appdata/server/room/files/setup.exe'),
+      copyFile: vi.fn(async () => true),
      providesInlineObjectUrl: vi.fn(() => false)
    };
  });
@@ -75,7 +80,7 @@ describe('AttachmentPersistenceService', () => {
        AttachmentRuntimeStore,
        { provide: DatabaseService, useValue: database },
        { provide: AttachmentStorageService, useValue: attachmentStorage },
-        { provide: Store, useValue: { select: () => ({ pipe: () => ({ subscribe: () => {} }) }) } }
+        { provide: Store, useValue: { select: () => of('room-1') } }
      ]
    });

@@ -93,8 +98,70 @@ describe('AttachmentPersistenceService', () => {
    expect(attachmentStorage.getFileSize).not.toHaveBeenCalled();
  });

+  it('preserves a completed runtime download when database hydration finishes later', async () => {
+    const injector = Injector.create({
+      providers: [
+        AttachmentPersistenceService,
+        AttachmentRuntimeStore,
+        { provide: DatabaseService, useValue: database },
+        { provide: AttachmentStorageService, useValue: attachmentStorage },
+        { provide: Store, useValue: { select: () => of('room-1') } }
+      ]
+    });
+    const service = runInInjectionContext(injector, () => injector.get(AttachmentPersistenceService));
+    const runtimeStore = injector.get(AttachmentRuntimeStore);
+    const completedDownload = {
+      id: 'att-1',
+      messageId: 'msg-1',
+      filename: 'photo.png',
+      size: 1_500_000,
+      mime: 'image/png',
+      isImage: true,
+      available: true,
+      objectUrl: 'blob:http://localhost/completed',
+      receivedBytes: 1_500_000
+    };
+    const announcedDuringStartup = {
+      id: 'att-live',
+      messageId: 'msg-live',
+      filename: 'new-photo.png',
+      size: 512,
+      mime: 'image/png',
+      isImage: true,
+      available: false,
+      receivedBytes: 0
+    };
+
+    runtimeStore.setAttachmentsForMessage('msg-1', [completedDownload]);
+    runtimeStore.setAttachmentsForMessage('msg-live', [announcedDuringStartup]);
+
+    await service.initFromDatabase();
+
+    const restored = runtimeStore.getAttachmentsForMessage('msg-1')[0];
+
+    expect(restored).toBe(completedDownload);
+    expect(restored).toMatchObject({
+      available: true,
+      objectUrl: 'blob:http://localhost/completed',
+      receivedBytes: 1_500_000,
+      savedPath: '/appdata/photo.png'
+    });
+
+    expect(runtimeStore.getAttachmentsForMessage('msg-live')[0]).toBe(announcedDuringStartup);
+  });
+
  it('hydrates blob URLs on demand for a single attachment', async () => {
-    const service = createService();
+    const injector = Injector.create({
+      providers: [
+        AttachmentPersistenceService,
+        AttachmentRuntimeStore,
+        { provide: DatabaseService, useValue: database },
+        { provide: AttachmentStorageService, useValue: attachmentStorage },
+        { provide: Store, useValue: { select: () => of('room-1') } }
+      ]
+    });
+    const service = runInInjectionContext(injector, () => injector.get(AttachmentPersistenceService));
+    const runtimeStore = injector.get(AttachmentRuntimeStore);

    await service.initFromDatabase();

@@ -108,15 +175,184 @@ describe('AttachmentPersistenceService', () => {
      savedPath: '/appdata/photo.png',
      available: false
    };
+    const versionBefore = runtimeStore.updated();

    await expect(service.ensureInlineDisplayObjectUrl(attachment)).resolves.toBe(true);
    expect(attachment.available).toBe(true);
    expect(attachment.objectUrl).toMatch(/^blob:/);
+    expect(runtimeStore.updated()).toBeGreaterThan(versionBefore);
    expect(attachmentStorage.getFileSize).toHaveBeenCalledWith('/appdata/photo.png');
    expect(attachmentStorage.readFileChunk).toHaveBeenCalled();
    expect(attachmentStorage.readFile).not.toHaveBeenCalled();
  });

+  it('deduplicates concurrent display hydration for the same attachment', async () => {
+    attachmentStorage.canReadFileChunks.mockReturnValue(false);
+
+    const service = createService();
+    const attachment = {
+      id: 'att-1',
+      messageId: 'msg-1',
+      filename: 'photo.png',
+      size: 3,
+      mime: 'image/png',
+      isImage: true,
+      savedPath: '/appdata/photo.png',
+      available: false
+    };
+    const [first, second] = await Promise.all([service.ensureInlineDisplayObjectUrl(attachment), service.ensureInlineDisplayObjectUrl(attachment)]);
+
+    expect(first).toBe(true);
+    expect(second).toBe(true);
+    expect(attachmentStorage.readFile).toHaveBeenCalledTimes(1);
+  });
+
+  it('limits concurrent display hydration to two attachments', async () => {
+    attachmentStorage.canReadFileChunks.mockReturnValue(false);
+
+    const pendingReads: ((base64: string) => void)[] = [];
+
+    attachmentStorage.readFile.mockImplementation(() => new Promise<string>((resolve) => {
+      pendingReads.push(resolve);
+    }));
+
+    const service = createService();
+    const attachments = Array.from({ length: 3 }, (_, index) => ({
+      id: `att-${index + 1}`,
+      messageId: `msg-${index + 1}`,
+      filename: `photo-${index + 1}.png`,
+      size: 3,
+      mime: 'image/png',
+      isImage: true,
+      savedPath: `/appdata/photo-${index + 1}.png`,
+      available: false
+    }));
+    const hydrations = attachments.map((attachment) => service.ensureInlineDisplayObjectUrl(attachment));
+
+    await vi.waitFor(() => expect(attachmentStorage.readFile).toHaveBeenCalledTimes(2));
+    expect(pendingReads).toHaveLength(2);
+
+    pendingReads.shift()?.('QUJD');
+
+    await vi.waitFor(() => expect(attachmentStorage.readFile).toHaveBeenCalledTimes(3));
+
+    for (const resolve of pendingReads) {
+      resolve('QUJD');
+    }
+
+    await expect(Promise.all(hydrations)).resolves.toEqual([
+      true,
+      true,
+      true
+    ]);
+  });
+
+  it('cancels an in-flight hydration before it can attach a stale blob URL', async () => {
+    let finishChunkRead!: (base64: string) => void;
+
+    attachmentStorage.getFileSize.mockResolvedValue(3);
+    attachmentStorage.readFileChunk.mockImplementation(() => new Promise<string>((resolve) => {
+      finishChunkRead = resolve;
+    }));
+
+    const service = createService();
+    const attachment = {
+      id: 'att-1',
+      messageId: 'msg-1',
+      filename: 'photo.png',
+      size: 3,
+      mime: 'image/png',
+      isImage: true,
+      savedPath: '/appdata/photo.png',
+      available: false
+    };
+    const createObjectUrlSpy = vi.spyOn(URL, 'createObjectURL');
+    const hydration = service.ensureInlineDisplayObjectUrl(attachment);
+
+    await vi.waitFor(() => expect(attachmentStorage.readFileChunk).toHaveBeenCalledTimes(1));
+    service.cancelDisplayHydration(attachment);
+    finishChunkRead('QUJD');
+
+    await expect(hydration).resolves.toBe(false);
+    expect(attachment.objectUrl).toBeUndefined();
+    expect(createObjectUrlSpy).not.toHaveBeenCalled();
+
+    createObjectUrlSpy.mockRestore();
+  });
+
+  it('allows a newer hydration to supersede cancelled stale work', async () => {
+    attachmentStorage.canReadFileChunks.mockReturnValue(false);
+
+    let finishStaleRead!: (base64: string) => void;
+    let readCount = 0;
+
+    attachmentStorage.readFile.mockImplementation(() => {
+      readCount++;
+
+      if (readCount === 1) {
+        return new Promise<string>((resolve) => {
+          finishStaleRead = resolve;
+        });
+      }
+
+      return Promise.resolve('REVG');
+    });
+
+    const service = createService();
+    const attachment = {
+      id: 'att-1',
+      messageId: 'msg-1',
+      filename: 'photo.png',
+      size: 3,
+      mime: 'image/png',
+      isImage: true,
+      savedPath: '/appdata/photo.png',
+      available: false
+    };
+    const staleHydration = service.ensureInlineDisplayObjectUrl(attachment);
+
+    await vi.waitFor(() => expect(attachmentStorage.readFile).toHaveBeenCalledTimes(1));
+    service.cancelDisplayHydration(attachment);
+
+    const currentHydration = service.ensureInlineDisplayObjectUrl(attachment);
+
+    await expect(currentHydration).resolves.toBe(true);
+    finishStaleRead('QUJD');
+
+    await expect(staleHydration).resolves.toBe(false);
+    expect(attachmentStorage.readFile).toHaveBeenCalledTimes(2);
+    expect(attachment.objectUrl).toMatch(/^blob:/);
+  });
+
+  it('does not duplicate disk-hydrated bytes into the original-file cache', async () => {
+    const injector = Injector.create({
+      providers: [
+        AttachmentPersistenceService,
+        AttachmentRuntimeStore,
+        { provide: DatabaseService, useValue: database },
+        { provide: AttachmentStorageService, useValue: attachmentStorage },
+        { provide: Store, useValue: { select: () => of('room-1') } }
+      ]
+    });
+    const service = runInInjectionContext(injector, () => injector.get(AttachmentPersistenceService));
+    const runtimeStore = injector.get(AttachmentRuntimeStore);
+    const attachment = {
+      id: 'att-1',
+      messageId: 'msg-1',
+      filename: 'photo.png',
+      size: 3,
+      mime: 'image/png',
+      isImage: true,
+      savedPath: '/appdata/photo.png',
+      available: false
+    };
+
+    await expect(service.ensureInlineDisplayObjectUrl(attachment)).resolves.toBe(true);
+
+    expect(attachment.objectUrl).toMatch(/^blob:/);
+    expect(runtimeStore.getOriginalFile('msg-1:att-1')).toBeUndefined();
+  });
+
  it('restores a blob from a whole-file read when the store cannot read chunks (browser store)', async () => {
    attachmentStorage.canReadFileChunks.mockReturnValue(false);

@@ -169,4 +405,154 @@ describe('AttachmentPersistenceService', () => {
    expect(attachmentStorage.readFile).not.toHaveBeenCalled();
    expect(attachmentStorage.readFileChunk).not.toHaveBeenCalled();
  });
+
+  it('copies an external upload path into app data and hydrates generic files without loading a blob', async () => {
+    attachmentStorage.resolveExistingPath
+      .mockResolvedValueOnce(null)
+      .mockResolvedValue('/appdata/server/room/files/setup.exe');
+
+    const service = createService();
+    const attachment = {
+      id: 'att-setup',
+      messageId: 'msg-1',
+      filename: 'setup.exe',
+      size: 628 * 1024 * 1024,
+      mime: 'application/octet-stream',
+      isImage: false,
+      filePath: '/home/ludde/Downloads/setup.exe',
+      available: false
+    };
+
+    await expect(service.ensurePersistedUploadHost(attachment)).resolves.toBe(true);
+
+    expect(attachment.savedPath).toBe('/appdata/server/room/files/setup.exe');
+    expect(attachment.available).toBe(true);
+    expect(attachment.objectUrl).toBeUndefined();
+    expect(attachmentStorage.copyFile).toHaveBeenCalledWith(
+      '/home/ludde/Downloads/setup.exe',
+      '/appdata/server/room/files/setup.exe'
+    );
+
+    expect(attachmentStorage.readFile).not.toHaveBeenCalled();
+    expect(attachmentStorage.readFileChunk).not.toHaveBeenCalled();
+    expect(database.saveAttachment).toHaveBeenCalled();
+  });
+
+  it('restores host metadata without hydrating media blobs when display hydration is disabled', async () => {
+    const service = createService();
+    const attachment = {
+      id: 'att-1',
+      messageId: 'msg-1',
+      filename: 'photo.png',
+      size: 3,
+      mime: 'image/png',
+      isImage: true,
+      savedPath: '/appdata/photo.png',
+      available: false
+    };
+
+    await expect(service.tryRestoreAttachmentHostOnly(attachment)).resolves.toBe(true);
+
+    expect(attachment.savedPath).toBe('/appdata/photo.png');
+    expect(attachment.objectUrl).toBeUndefined();
+    expect(attachment.available).toBe(false);
+    expect(attachmentStorage.readFileChunk).not.toHaveBeenCalled();
+    expect(attachmentStorage.readFile).not.toHaveBeenCalled();
+  });
+
+  it('revokes display blobs while keeping disk paths for later rehydration', () => {
+    const service = createService();
+    const attachment = {
+      id: 'att-1',
+      messageId: 'msg-1',
+      filename: 'photo.png',
+      size: 3,
+      mime: 'image/png',
+      isImage: true,
+      savedPath: '/appdata/photo.png',
+      available: true,
+      objectUrl: 'blob:http://localhost/abc',
+      receivedBytes: 3,
+      speedBps: 512,
+      startedAtMs: 100,
+      lastUpdateMs: 200
+    };
+    const revokeSpy = vi.spyOn(URL, 'revokeObjectURL').mockImplementation(() => undefined);
+
+    expect(service.revokeAttachmentDisplayBlob(attachment)).toBe(true);
+    expect(attachment.objectUrl).toBeUndefined();
+    expect(attachment.savedPath).toBe('/appdata/photo.png');
+    expect(attachment).toMatchObject({
+      receivedBytes: 0,
+      speedBps: 0,
+      startedAtMs: undefined,
+      lastUpdateMs: undefined
+    });
+
+    expect(revokeSpy).toHaveBeenCalledWith('blob:http://localhost/abc');
+
+    revokeSpy.mockRestore();
+  });
+
+  it('releases the cached original file when revoking a disk-backed display blob', () => {
+    const injector = Injector.create({
+      providers: [
+        AttachmentPersistenceService,
+        AttachmentRuntimeStore,
+        { provide: DatabaseService, useValue: database },
+        { provide: AttachmentStorageService, useValue: attachmentStorage },
+        { provide: Store, useValue: { select: () => of('room-1') } }
+      ]
+    });
+    const service = runInInjectionContext(injector, () => injector.get(AttachmentPersistenceService));
+    const runtimeStore = injector.get(AttachmentRuntimeStore);
+    const attachment = {
+      id: 'att-1',
+      messageId: 'msg-1',
+      filename: 'photo.png',
+      size: 3,
+      mime: 'image/png',
+      isImage: true,
+      savedPath: '/appdata/photo.png',
+      available: true,
+      objectUrl: 'blob:http://localhost/abc'
+    };
+    const revokeSpy = vi.spyOn(URL, 'revokeObjectURL').mockImplementation(() => undefined);
+
+    runtimeStore.setOriginalFile('msg-1:att-1', new File(['abc'], 'photo.png', { type: 'image/png' }));
+
+    expect(service.revokeAttachmentDisplayBlob(attachment)).toBe(true);
+    expect(runtimeStore.getOriginalFile('msg-1:att-1')).toBeUndefined();
+
+    revokeSpy.mockRestore();
+  });
+
+  it('keeps the cached original file when the attachment is not persisted to disk yet', () => {
+    const injector = Injector.create({
+      providers: [
+        AttachmentPersistenceService,
+        AttachmentRuntimeStore,
+        { provide: DatabaseService, useValue: database },
+        { provide: AttachmentStorageService, useValue: attachmentStorage },
+        { provide: Store, useValue: { select: () => of('room-1') } }
+      ]
+    });
+    const service = runInInjectionContext(injector, () => injector.get(AttachmentPersistenceService));
+    const runtimeStore = injector.get(AttachmentRuntimeStore);
+    const attachment = {
+      id: 'att-2',
+      messageId: 'msg-1',
+      filename: 'clip.mp4',
+      size: 3,
+      mime: 'video/mp4',
+      isImage: false,
+      available: true,
+      objectUrl: 'blob:http://localhost/def'
+    };
+
+    runtimeStore.setOriginalFile('msg-1:att-2', new File(['abc'], 'clip.mp4', { type: 'video/mp4' }));
+
+    expect(service.revokeAttachmentDisplayBlob(attachment)).toBe(false);
+    expect(runtimeStore.getOriginalFile('msg-1:att-2')).toBeDefined();
+  });
 });
@@ -11,13 +11,25 @@ import {
  decodeBase64ToUint8Array,
  yieldToAttachmentHydrationLoop
 } from '../../domain/logic/attachment-blob.rules';
+import { canRevokeAttachmentDisplayBlob } from '../../domain/logic/attachment-blob-eviction.rules';
 import { isBlobObjectUrl, needsBlobObjectUrlForInlineDisplay } from '../../domain/logic/attachment-display-url.rules';
 import { mergeAttachmentLocalPaths } from '../../domain/logic/attachment-persistence.rules';
+import { isAttachmentMedia } from '../../domain/logic/attachment.logic';
 import { AttachmentRuntimeStore } from './attachment-runtime.store';

+const MAX_CONCURRENT_DISPLAY_HYDRATIONS = 2;
+
+interface DisplayHydrationTask {
+  cancelled: boolean;
+  promise: Promise<boolean>;
+}
+
@Injectable({ providedIn: 'root' })
 export class AttachmentPersistenceService {
  private initPromise: Promise<void> | null = null;
+  private activeDisplayHydrations = 0;
+  private readonly displayHydrationQueue: (() => void)[] = [];
+  private readonly displayHydrations = new Map<string, DisplayHydrationTask>();

  private readonly runtimeStore = inject(AttachmentRuntimeStore);
  private readonly ngrxStore = inject(Store);
@@ -31,6 +43,8 @@ export class AttachmentPersistenceService {
    const savedPathsToDelete = new Set<string>();

    for (const attachment of attachments) {
+      this.cancelDisplayHydration(attachment);
+
      if (attachment.objectUrl) {
        try {
          URL.revokeObjectURL(attachment.objectUrl);
@@ -118,7 +132,7 @@ export class AttachmentPersistenceService {
  }

  async tryRestoreAttachmentFromLocal(attachment: Attachment): Promise<boolean> {
-    const restored = await this.ensureInlineDisplayObjectUrl(attachment);
+    const restored = await this.ensurePersistedUploadHost(attachment, { hydrateMediaForDisplay: true });

    if (restored) {
      attachment.requestError = undefined;
@@ -127,19 +141,155 @@ export class AttachmentPersistenceService {
    return restored;
  }

-  async ensureInlineDisplayObjectUrl(attachment: Attachment): Promise<boolean> {
+  async tryRestoreAttachmentHostOnly(attachment: Attachment): Promise<boolean> {
+    return this.ensurePersistedUploadHost(attachment, { hydrateMediaForDisplay: false });
+  }
+
+  cancelDisplayHydration(attachment: Pick<Attachment, 'id' | 'messageId'>): void {
+    const hydrationKey = this.buildDisplayHydrationKey(attachment);
+    const task = this.displayHydrations.get(hydrationKey);
+
+    if (!task) {
+      return;
+    }
+
+    task.cancelled = true;
+
+    if (this.displayHydrations.get(hydrationKey) === task) {
+      this.displayHydrations.delete(hydrationKey);
+    }
+  }
+
+  revokeAttachmentDisplayBlob(attachment: Attachment): boolean {
+    this.cancelDisplayHydration(attachment);
+
+    if (!canRevokeAttachmentDisplayBlob(attachment)) {
+      return false;
+    }
+
+    this.revokeAttachmentObjectUrl(attachment);
+    attachment.objectUrl = undefined;
+    attachment.receivedBytes = 0;
+    attachment.speedBps = 0;
+    attachment.startedAtMs = undefined;
+    attachment.lastUpdateMs = undefined;
+
+    // Once the bytes live on disk, the cached File duplicate is redundant:
+    // peer requests are served from the disk path and re-display rehydrates
+    // from disk, so keeping it would double the attachment's memory cost.
+    if (attachment.savedPath?.trim()) {
+      this.runtimeStore.deleteOriginalFile(`${attachment.messageId}:${attachment.id}`);
+    }
+
+    return true;
+  }
+
+  async ensurePersistedUploadHost(
+    attachment: Attachment,
+    options: { hydrateMediaForDisplay?: boolean } = {}
+  ): Promise<boolean> {
+    const hydrateMediaForDisplay = options.hydrateMediaForDisplay !== false;
+    const existingPath = await this.attachmentStorage.resolveExistingPath(attachment);
+
+    if (existingPath) {
+      return this.hydrateAttachmentFromStoredPath(attachment, existingPath, hydrateMediaForDisplay);
+    }
+
+    if (!attachment.filePath?.trim() || !this.attachmentStorage.canCopyFiles()) {
+      return false;
+    }
+
+    const savedPath = await this.persistUploadCopyFromSourcePath(attachment, attachment.filePath);
+
+    if (!savedPath) {
+      attachment.filePath = undefined;
+      void this.persistAttachmentMeta(attachment);
+      return false;
+    }
+
+    return this.hydrateAttachmentFromStoredPath(attachment, savedPath, hydrateMediaForDisplay);
+  }
+
+  private async hydrateAttachmentFromStoredPath(
+    attachment: Attachment,
+    diskPath: string,
+    hydrateMediaForDisplay = true
+  ): Promise<boolean> {
+    attachment.savedPath = diskPath;
+
+    if (isAttachmentMedia(attachment)) {
+      if (!hydrateMediaForDisplay) {
+        void this.persistAttachmentMeta(attachment);
+        return true;
+      }
+
+      return this.ensureInlineDisplayObjectUrl(attachment);
+    }
+
+    attachment.available = true;
+    void this.persistAttachmentMeta(attachment);
+
+    return true;
+  }
+
+  ensureInlineDisplayObjectUrl(attachment: Attachment): Promise<boolean> {
    if (!needsBlobObjectUrlForInlineDisplay(attachment.objectUrl)) {
-      return true;
+      return Promise.resolve(true);
+    }
+
+    const hydrationKey = this.buildDisplayHydrationKey(attachment);
+    const existingTask = this.displayHydrations.get(hydrationKey);
+
+    if (existingTask) {
+      return existingTask.promise;
+    }
+
+    const task: DisplayHydrationTask = {
+      cancelled: false,
+      promise: Promise.resolve(false)
+    };
+
+    this.displayHydrations.set(hydrationKey, task);
+
+    const scheduled = this.scheduleDisplayHydration(
+      task,
+      () => this.runInlineDisplayHydration(attachment, hydrationKey, task)
+    );
+
+    task.promise = scheduled.finally(() => {
+      if (this.displayHydrations.get(hydrationKey) === task) {
+        this.displayHydrations.delete(hydrationKey);
+      }
+    });
+
+    return task.promise;
+  }
+
+  private async runInlineDisplayHydration(
+    attachment: Attachment,
+    hydrationKey: string,
+    task: DisplayHydrationTask
+  ): Promise<boolean> {
+    if (!this.isDisplayHydrationCurrent(hydrationKey, task)) {
+      return false;
    }

    let diskPath = await this.attachmentStorage.resolveExistingPath(attachment);

+    if (!this.isDisplayHydrationCurrent(hydrationKey, task)) {
+      return false;
+    }
+
    if (!diskPath) {
      const roomName = await this.resolveStorageContainerName(attachment);

+      if (!this.isDisplayHydrationCurrent(hydrationKey, task)) {
+        return false;
+      }
+
      diskPath = await this.attachmentStorage.resolveCanonicalStoredPath(attachment, roomName);

-      if (diskPath) {
+      if (diskPath && this.isDisplayHydrationCurrent(hydrationKey, task)) {
        attachment.savedPath = diskPath;
        void this.persistAttachmentMeta(attachment);
      }
@@ -152,17 +302,27 @@ export class AttachmentPersistenceService {
    if (this.attachmentStorage.providesInlineObjectUrl()) {
      const nativeUrl = await this.attachmentStorage.getFileUrl(diskPath);

-      if (nativeUrl) {
+      if (nativeUrl && this.isDisplayHydrationCurrent(hydrationKey, task)) {
        this.revokeAttachmentObjectUrl(attachment);
        attachment.objectUrl = nativeUrl;
        attachment.available = true;
+        this.runtimeStore.touch();
        return true;
      }
    }

+    if (!this.isDisplayHydrationCurrent(hydrationKey, task)) {
+      return false;
+    }
+
    this.revokeAttachmentObjectUrl(attachment);

-    const restored = await this.restoreAttachmentBlobFromDiskPath(attachment, diskPath);
+    const restored = await this.restoreAttachmentBlobFromDiskPath(
+      attachment,
+      diskPath,
+      hydrationKey,
+      task
+    );

    return restored;
  }
@@ -229,14 +389,29 @@ export class AttachmentPersistenceService {
  private async loadFromDatabase(): Promise<void> {
    try {
      const allRecords: AttachmentMeta[] = await this.database.getAllAttachments();
-      const grouped = new Map<string, Attachment[]>();
+      const grouped = new Map<string, Attachment[]>(
+        Array.from(
+          this.runtimeStore.getAttachmentEntries(),
+          ([messageId, attachments]) => [messageId, [...attachments]]
+        )
+      );

      for (const record of allRecords) {
-        const attachment: Attachment = { ...record,
-          available: false };
        const bucket = grouped.get(record.messageId) ?? [];
+        const runtimeAttachment = bucket.find((attachment) => attachment.id === record.id);
+
+        if (runtimeAttachment) {
+          const localPaths = mergeAttachmentLocalPaths(runtimeAttachment, record);
+
+          runtimeAttachment.filePath = localPaths.filePath ?? undefined;
+          runtimeAttachment.savedPath = localPaths.savedPath ?? undefined;
+        } else {
+          const attachment: Attachment = { ...record,
+            available: false };
+
+          bucket.push(attachment);
+        }

-        bucket.push(attachment);
        grouped.set(record.messageId, bucket);
      }

@@ -277,11 +452,16 @@ export class AttachmentPersistenceService {
    await this.migrateFromLocalStorage();
  }

-  private async restoreAttachmentBlobFromDiskPath(attachment: Attachment, diskPath: string): Promise<boolean> {
+  private async restoreAttachmentBlobFromDiskPath(
+    attachment: Attachment,
+    diskPath: string,
+    hydrationKey: string,
+    task: DisplayHydrationTask
+  ): Promise<boolean> {
    if (this.attachmentStorage.canReadFileChunks()) {
      const fileSize = await this.attachmentStorage.getFileSize(diskPath);

-      if (!fileSize || fileSize < 1) {
+      if (!fileSize || fileSize < 1 || !this.isDisplayHydrationCurrent(hydrationKey, task)) {
        return false;
      }

@@ -291,7 +471,7 @@ export class AttachmentPersistenceService {
        const end = Math.min(start + ATTACHMENT_BLOB_READ_CHUNK_SIZE_BYTES, fileSize);
        const chunkBase64 = await this.attachmentStorage.readFileChunk(diskPath, start, end);

-        if (!chunkBase64) {
+        if (!chunkBase64 || !this.isDisplayHydrationCurrent(hydrationKey, task)) {
          return false;
        }

@@ -302,18 +482,26 @@ export class AttachmentPersistenceService {
        }
      }

+      if (!this.isDisplayHydrationCurrent(hydrationKey, task)) {
+        return false;
+      }
+
      this.applyAttachmentBlob(attachment, new Blob(blobParts as BlobPart[], { type: attachment.mime }));
      return true;
    }

    const base64 = await this.attachmentStorage.readFile(diskPath);

-    if (!base64) {
+    if (!base64 || !this.isDisplayHydrationCurrent(hydrationKey, task)) {
      return false;
    }

    const bytes = decodeBase64ToUint8Array(base64);

+    if (!this.isDisplayHydrationCurrent(hydrationKey, task)) {
+      return false;
+    }
+
    this.applyAttachmentBlob(
      attachment,
      new Blob([bytes.buffer as ArrayBuffer], { type: attachment.mime })
@@ -322,14 +510,59 @@ export class AttachmentPersistenceService {
    return true;
  }

+  private scheduleDisplayHydration(
+    task: DisplayHydrationTask,
+    hydrate: () => Promise<boolean>
+  ): Promise<boolean> {
+    return new Promise<boolean>((resolve, reject) => {
+      this.displayHydrationQueue.push(() => {
+        if (task.cancelled) {
+          resolve(false);
+          this.drainDisplayHydrationQueue();
+          return;
+        }
+
+        this.activeDisplayHydrations++;
+
+        void hydrate()
+          .then(resolve, reject)
+          .finally(() => {
+            this.activeDisplayHydrations--;
+            this.drainDisplayHydrationQueue();
+          });
+      });
+
+      this.drainDisplayHydrationQueue();
+    });
+  }
+
+  private drainDisplayHydrationQueue(): void {
+    while (
+      this.activeDisplayHydrations < MAX_CONCURRENT_DISPLAY_HYDRATIONS &&
+      this.displayHydrationQueue.length > 0
+    ) {
+      this.displayHydrationQueue.shift()?.();
+    }
+  }
+
+  private isDisplayHydrationCurrent(
+    hydrationKey: string,
+    task: DisplayHydrationTask
+  ): boolean {
+    return !task.cancelled && this.displayHydrations.get(hydrationKey) === task;
+  }
+
+  private buildDisplayHydrationKey(attachment: Pick<Attachment, 'id' | 'messageId'>): string {
+    return `${attachment.messageId}:${attachment.id}`;
+  }
+
+  // The blob always comes from a disk path here, so peers are served from
+  // disk and no original-file copy is cached; caching one would keep a second
+  // full copy of the bytes alive for the whole session.
  private applyAttachmentBlob(attachment: Attachment, blob: Blob): void {
    attachment.objectUrl = URL.createObjectURL(blob);
    attachment.available = true;
-
-    this.runtimeStore.setOriginalFile(
-      `${attachment.messageId}:${attachment.id}`,
-      new File([blob], attachment.filename, { type: attachment.mime })
-    );
+    this.runtimeStore.touch();
  }

  private revokeAttachmentObjectUrl(attachment: Attachment): void {
@@ -12,6 +12,7 @@ export class AttachmentRuntimeStore {
  private pendingRequests = new Map<string, Set<string>>();
  private chunkBuffers = new Map<string, (ArrayBuffer | undefined)[]>();
  private chunkCounts = new Map<string, number>();
+  private announcedHostsByAttachment = new Map<string, Set<string>>();

  touch(): void {
    this.updated.set(this.updated() + 1);
@@ -66,6 +67,25 @@ export class AttachmentRuntimeStore {
    return this.originalFiles.get(key);
  }

+  deleteOriginalFile(key: string): void {
+    this.originalFiles.delete(key);
+  }
+
+  addAnnouncedHost(requestKey: string, peerId: string): void {
+    const hosts = this.announcedHostsByAttachment.get(requestKey) ?? new Set<string>();
+
+    hosts.add(peerId);
+    this.announcedHostsByAttachment.set(requestKey, hosts);
+  }
+
+  getAnnouncedHosts(requestKey: string): Set<string> {
+    return this.announcedHostsByAttachment.get(requestKey) ?? new Set();
+  }
+
+  deleteAnnouncedHosts(requestKey: string): void {
+    this.announcedHostsByAttachment.delete(requestKey);
+  }
+
  findOriginalFileByFileId(fileId: string): File | null {
    for (const [key, file] of this.originalFiles) {
      if (key.endsWith(`:${fileId}`)) {
@@ -160,5 +180,11 @@ export class AttachmentRuntimeStore {
        this.cancelledTransfers.delete(key);
      }
    }
+
+    for (const key of Array.from(this.announcedHostsByAttachment.keys())) {
+      if (key.startsWith(scopedPrefix)) {
+        this.announcedHostsByAttachment.delete(key);
+      }
+    }
  }
 }
@@ -8,11 +8,13 @@ import {
  decodeBase64,
  iterateBlobChunks
 } from '../../../../shared-kernel';
+import { AttachmentChunkAckService } from './attachment-chunk-ack.service';

@Injectable({ providedIn: 'root' })
 export class AttachmentTransferTransportService {
  private readonly webrtc = inject(RealtimeSessionFacade);
  private readonly attachmentStorage = inject(AttachmentStorageService);
+  private readonly chunkAcks = inject(AttachmentChunkAckService);

  decodeBase64(base64: string): Uint8Array {
    return decodeBase64(base64);
@@ -39,6 +41,7 @@ export class AttachmentTransferTransportService {
      };

      await this.webrtc.sendToPeerBuffered(targetPeerId, fileChunkEvent);
+      await this.chunkAcks.waitForAck(messageId, fileId, chunk.index);
    }
  }

@@ -84,6 +87,7 @@ export class AttachmentTransferTransportService {
      };

      await this.webrtc.sendToPeerBuffered(targetPeerId, fileChunkEvent);
+      await this.chunkAcks.waitForAck(messageId, fileId, chunkIndex);
    }
  }

@@ -122,6 +126,7 @@ export class AttachmentTransferTransportService {
      };

      await this.webrtc.sendToPeerBuffered(targetPeerId, fileChunkEvent);
+      await this.chunkAcks.waitForAck(messageId, fileId, chunkIndex);
    }
  }
 }
@@ -21,6 +21,7 @@ import { AttachmentPersistenceService } from './attachment-persistence.service';
 import { AttachmentRuntimeStore } from './attachment-runtime.store';
 import { AttachmentTransferService } from './attachment-transfer.service';
 import { AttachmentTransferTransportService } from './attachment-transfer-transport.service';
+import { AttachmentChunkAckService } from './attachment-chunk-ack.service';

 const MESSAGE_ID = 'msg-1';
 const FILE_ID = 'file-1';
@@ -41,6 +42,7 @@ describe('AttachmentTransferService', () => {
    resolveCurrentRoomName: ReturnType<typeof vi.fn>;
    resolveStorageContainerName: ReturnType<typeof vi.fn>;
    ensureInlineDisplayObjectUrl: ReturnType<typeof vi.fn>;
+    ensurePersistedUploadHost: ReturnType<typeof vi.fn>;
  };
  let attachmentStorage: {
    canWriteFiles: ReturnType<typeof vi.fn>;
@@ -51,7 +53,9 @@ describe('AttachmentTransferService', () => {
    getFileUrl: ReturnType<typeof vi.fn>;
    resolveExistingPath: ReturnType<typeof vi.fn>;
    resolveLegacyImagePath: ReturnType<typeof vi.fn>;
+    getFileSize: ReturnType<typeof vi.fn>;
    appendBase64: ReturnType<typeof vi.fn>;
+    appendBytes: ReturnType<typeof vi.fn>;
    createWritableFile: ReturnType<typeof vi.fn>;
    deleteFile: ReturnType<typeof vi.fn>;
  };
@@ -60,6 +64,11 @@ describe('AttachmentTransferService', () => {
    streamFileToPeer: ReturnType<typeof vi.fn>;
    streamFileFromDiskToPeer: ReturnType<typeof vi.fn>;
  };
+  let chunkAcks: {
+    resolveAck: ReturnType<typeof vi.fn>;
+    waitForAck: ReturnType<typeof vi.fn>;
+    cancelPendingForFile: ReturnType<typeof vi.fn>;
+  };
  let webrtc: {
    getConnectedPeers: ReturnType<typeof vi.fn>;
    broadcastMessage: ReturnType<typeof vi.fn>;
@@ -75,7 +84,8 @@ describe('AttachmentTransferService', () => {
      persistUploadCopyFromSourcePath: vi.fn(async () => null),
      resolveCurrentRoomName: vi.fn(async () => null),
      resolveStorageContainerName: vi.fn(async () => 'room'),
-      ensureInlineDisplayObjectUrl: vi.fn(async () => true)
+      ensureInlineDisplayObjectUrl: vi.fn(async () => true),
+      ensurePersistedUploadHost: vi.fn(async () => false)
    };

    attachmentStorage = {
@@ -87,7 +97,9 @@ describe('AttachmentTransferService', () => {
      getFileUrl: vi.fn(async () => null),
      resolveExistingPath: vi.fn(async () => null),
      resolveLegacyImagePath: vi.fn(async () => null),
+      getFileSize: vi.fn(async () => null),
      appendBase64: vi.fn(async () => true),
+      appendBytes: vi.fn(async () => true),
      createWritableFile: vi.fn(async () => '/appdata/server/room/files/file-1'),
      deleteFile: vi.fn(async () => true)
    };
@@ -98,6 +110,12 @@ describe('AttachmentTransferService', () => {
      streamFileFromDiskToPeer: vi.fn(async () => undefined)
    };

+    chunkAcks = {
+      resolveAck: vi.fn(),
+      waitForAck: vi.fn(async () => undefined),
+      cancelPendingForFile: vi.fn()
+    };
+
    webrtc = {
      getConnectedPeers: vi.fn(() => [PEER_ID]),
      broadcastMessage: vi.fn(),
@@ -115,7 +133,8 @@ describe('AttachmentTransferService', () => {
        { provide: AppI18nService, useValue: { instant: (key: string) => key } },
        { provide: AttachmentStorageService, useValue: attachmentStorage },
        { provide: AttachmentPersistenceService, useValue: persistence },
-        { provide: AttachmentTransferTransportService, useValue: transport }
+        { provide: AttachmentTransferTransportService, useValue: transport },
+        { provide: AttachmentChunkAckService, useValue: chunkAcks }
      ]
    });
    const service = runInInjectionContext(injector, () => injector.get(AttachmentTransferService));
@@ -294,17 +313,13 @@ describe('AttachmentTransferService', () => {
  });

  it('streams a requested file only once while the same request is already in flight', async () => {
+    attachmentStorage.resolveExistingPath.mockResolvedValue(null);
+
    const service = createService();

    registerIncomingAttachment(9);
    runtimeStore.setOriginalFile(`${MESSAGE_ID}:${FILE_ID}`, new File([new Uint8Array(9)], 'photo.png', { type: 'image/png' }));

-    let releaseStream: () => void = () => undefined;
-
-    transport.streamFileToPeer.mockImplementation(() => new Promise<void>((resolve) => {
-      releaseStream = resolve;
-    }));
-
    const firstRequest = service.handleFileRequest({
      messageId: MESSAGE_ID,
      fileId: FILE_ID,
@@ -316,7 +331,6 @@ describe('AttachmentTransferService', () => {
      fromPeerId: PEER_ID
    });

-    releaseStream();
    await Promise.all([firstRequest, duplicateRequest]);

    expect(transport.streamFileToPeer).toHaveBeenCalledTimes(1);
@@ -364,11 +378,60 @@ describe('AttachmentTransferService', () => {
    return attachment;
  }

-  it('streams playable media to disk when the store supports streaming', async () => {
+  function registerIncomingGenericFile(size: number): Attachment {
+    const attachment: Attachment = {
+      id: FILE_ID,
+      messageId: MESSAGE_ID,
+      filename: 'archive.zip',
+      size,
+      mime: 'application/zip',
+      isImage: false,
+      uploaderPeerId: PEER_ID,
+      available: false,
+      receivedBytes: 0
+    };
+
+    runtimeStore.setAttachmentsForMessage(MESSAGE_ID, [attachment]);
+    return attachment;
+  }
+
+  it('assembles small images in memory even when the store supports disk streaming', async () => {
    attachmentStorage.canStreamToDisk.mockReturnValue(true);

    const service = createService();
-    const attachment = registerIncomingVideo(3);
+    const attachment = registerIncomingAttachment(9);
+
+    service.handleFileChunk(chunkPayload(0, 3, [
+      1,
+      2,
+      3
+    ]));
+
+    service.handleFileChunk(chunkPayload(1, 3, [
+      4,
+      5,
+      6
+    ]));
+
+    service.handleFileChunk(chunkPayload(2, 3, [
+      7,
+      8,
+      9
+    ]));
+
+    await vi.waitFor(() => expect(attachment.available).toBe(true));
+
+    expect(attachmentStorage.createWritableFile).not.toHaveBeenCalled();
+    expect(attachmentStorage.appendBytes).not.toHaveBeenCalled();
+    expect(persistence.saveFileToDisk).toHaveBeenCalledTimes(1);
+    expect(attachment.objectUrl).toMatch(/^blob:/);
+  });
+
+  it('streams oversized playable media to disk when the store supports streaming', async () => {
+    attachmentStorage.canStreamToDisk.mockReturnValue(true);
+
+    const service = createService();
+    const attachment = registerIncomingVideo(12 * 1024 * 1024);

    service.handleFileChunk(chunkPayload(0, 1, [
      1,
@@ -379,7 +442,15 @@ describe('AttachmentTransferService', () => {
    await vi.waitFor(() => expect(attachment.available).toBe(true));

    expect(attachmentStorage.createWritableFile).toHaveBeenCalled();
-    expect(attachmentStorage.appendBase64).toHaveBeenCalled();
+    expect(attachmentStorage.appendBytes).toHaveBeenCalled();
+    expect(attachmentStorage.appendBase64).not.toHaveBeenCalled();
+    expect(webrtc.sendToPeer).toHaveBeenCalledWith(PEER_ID, {
+      type: 'file-chunk-ack',
+      messageId: MESSAGE_ID,
+      fileId: FILE_ID,
+      index: 0
+    });
+
    expect(persistence.saveFileToDisk).not.toHaveBeenCalled();
  });

@@ -401,6 +472,18 @@ describe('AttachmentTransferService', () => {
    expect(persistence.saveFileToDisk).toHaveBeenCalledTimes(1);
  });

+  it('resolves chunk ack waiters from inbound ack events', () => {
+    const service = createService();
+
+    service.handleFileChunkAck({
+      messageId: MESSAGE_ID,
+      fileId: FILE_ID,
+      index: 2
+    });
+
+    expect(chunkAcks.resolveAck).toHaveBeenCalledWith(MESSAGE_ID, FILE_ID, 2);
+  });
+
  it('marks a request as pending synchronously so concurrent auto-download triggers cannot double-request', () => {
    const service = createService();
    const attachment = registerIncomingAttachment(9);
@@ -409,4 +492,645 @@ describe('AttachmentTransferService', () => {

    expect(service.hasPendingRequest(MESSAGE_ID, FILE_ID)).toBe(true);
  });
+
+  it('streams oversized generic files to disk when the store supports streaming', async () => {
+    attachmentStorage.canStreamToDisk.mockReturnValue(true);
+    attachmentStorage.canPersistSize.mockImplementation((bytes: number) => bytes <= 256 * 1024 * 1024);
+
+    const service = createService();
+    const attachment = registerIncomingGenericFile(12 * 1024 * 1024);
+
+    service.handleFileChunk(chunkPayload(0, 1, [
+      1,
+      2,
+      3
+    ]));
+
+    await vi.waitFor(() => expect(attachment.available).toBe(true));
+
+    expect(attachmentStorage.createWritableFile).toHaveBeenCalled();
+    expect(attachmentStorage.appendBytes).toHaveBeenCalled();
+    expect(attachmentStorage.appendBase64).not.toHaveBeenCalled();
+    expect(webrtc.sendToPeer).toHaveBeenCalledWith(PEER_ID, {
+      type: 'file-chunk-ack',
+      messageId: MESSAGE_ID,
+      fileId: FILE_ID,
+      index: 0
+    });
+
+    expect(persistence.ensureInlineDisplayObjectUrl).not.toHaveBeenCalled();
+    expect(persistence.saveFileToDisk).not.toHaveBeenCalled();
+    expect(attachment.objectUrl).toBeUndefined();
+  });
+
+  it('streams large downloads to disk even when attachment metadata still carries a source filePath', async () => {
+    attachmentStorage.canStreamToDisk.mockReturnValue(true);
+    attachmentStorage.canPersistSize.mockReturnValue(true);
+
+    const service = createService();
+    const attachment = registerIncomingGenericFile(12 * 1024 * 1024);
+
+    attachment.filePath = '/home/ludde/archive.zip';
+
+    service.handleFileChunk(chunkPayload(0, 1, [
+      1,
+      2,
+      3
+    ]));
+
+    await vi.waitFor(() => expect(attachment.available).toBe(true));
+
+    expect(attachmentStorage.appendBytes).toHaveBeenCalled();
+    expect(attachmentStorage.appendBase64).not.toHaveBeenCalled();
+    expect(webrtc.sendToPeer).toHaveBeenCalledWith(PEER_ID, {
+      type: 'file-chunk-ack',
+      messageId: MESSAGE_ID,
+      fileId: FILE_ID,
+      index: 0
+    });
+
+    expect(persistence.saveFileToDisk).not.toHaveBeenCalled();
+    expect(runtimeStore.getChunkBuffer(`${MESSAGE_ID}:${FILE_ID}`)).toBeUndefined();
+  });
+
+  it('does not hydrate image blobs after a disk-streamed oversized download completes', async () => {
+    attachmentStorage.canStreamToDisk.mockReturnValue(true);
+
+    const service = createService();
+    const attachment = registerIncomingAttachment(12 * 1024 * 1024);
+
+    service.handleFileChunk(chunkPayload(0, 1, [
+      1,
+      2,
+      3
+    ]));
+
+    await vi.waitFor(() => expect(attachment.available).toBe(true));
+
+    expect(attachment.savedPath).toBeTruthy();
+    expect(attachment.objectUrl).toBeUndefined();
+    expect(attachmentStorage.getFileUrl).not.toHaveBeenCalled();
+    expect(persistence.ensureInlineDisplayObjectUrl).not.toHaveBeenCalled();
+  });
+
+  it('hydrates playable media with a native file url after disk-streamed oversized download completes', async () => {
+    attachmentStorage.canStreamToDisk.mockReturnValue(true);
+    attachmentStorage.getFileUrl.mockResolvedValue('file:///appdata/server/room/files/clip.mp4');
+
+    const service = createService();
+    const attachment = registerIncomingVideo(12 * 1024 * 1024);
+
+    service.handleFileChunk(chunkPayload(0, 1, [
+      1,
+      2,
+      3
+    ]));
+
+    await vi.waitFor(() => expect(attachment.objectUrl).toBe('file:///appdata/server/room/files/clip.mp4'));
+
+    expect(attachment.available).toBe(true);
+    expect(attachment.savedPath).toBeTruthy();
+    expect(attachmentStorage.getFileUrl).toHaveBeenCalledWith(attachment.savedPath);
+    expect(persistence.ensureInlineDisplayObjectUrl).not.toHaveBeenCalled();
+  });
+
+  it('falls back to inline blob hydration for oversized playable media when no native file url exists', async () => {
+    attachmentStorage.canStreamToDisk.mockReturnValue(true);
+    attachmentStorage.getFileUrl.mockResolvedValue(null);
+    persistence.ensureInlineDisplayObjectUrl.mockImplementation(async (entry) => {
+      entry.objectUrl = 'blob:http://localhost/clip';
+      entry.available = true;
+      return true;
+    });
+
+    const service = createService();
+    const attachment = registerIncomingVideo(12 * 1024 * 1024);
+
+    service.handleFileChunk(chunkPayload(0, 1, [
+      1,
+      2,
+      3
+    ]));
+
+    await vi.waitFor(() => expect(persistence.ensureInlineDisplayObjectUrl).toHaveBeenCalled());
+
+    expect(attachment.objectUrl).toBe('blob:http://localhost/clip');
+    expect(attachment.available).toBe(true);
+  });
+
+  it('rejects oversized browser downloads before requesting peers', async () => {
+    attachmentStorage.canStreamToDisk.mockReturnValue(false);
+    attachmentStorage.canPersistSize.mockImplementation((bytes: number) => bytes <= 50 * 1024 * 1024);
+
+    const service = createService();
+    const attachment = registerIncomingGenericFile(200 * 1024 * 1024);
+
+    await service.requestFromAnyPeer(MESSAGE_ID, attachment);
+
+    expect(attachment.requestError).toBe('attachment.errors.fileTooLarge');
+    expect(webrtc.sendToPeer).not.toHaveBeenCalled();
+  });
+
+  it('assembles generic files above the auto-save cap in memory when the store cannot stream but can persist them', async () => {
+    // Browser receiver: no disk streaming, persistable up to 50 MB. The request
+    // gate admits a 20 MB file for in-memory receive, so the chunk handler must
+    // accept its chunks instead of dropping them with a file-too-large error.
+    attachmentStorage.canStreamToDisk.mockReturnValue(false);
+    attachmentStorage.canPersistSize.mockImplementation((bytes: number) => bytes <= 50 * 1024 * 1024);
+
+    const service = createService();
+    const attachment = registerIncomingGenericFile(20 * 1024 * 1024);
+
+    service.handleFileChunk(chunkPayload(0, 2, [
+      1,
+      2,
+      3
+    ]));
+
+    expect(attachment.requestError).toBeUndefined();
+    expect(attachment.receivedBytes).toBe(3);
+
+    service.handleFileChunk(chunkPayload(1, 2, [
+      4,
+      5,
+      6
+    ]));
+
+    await vi.waitFor(() => expect(attachment.available).toBe(true));
+
+    expect(attachment.objectUrl).toMatch(/^blob:/);
+  });
+
+  it('assembles browser-sized generic files in memory when streaming is unavailable', async () => {
+    attachmentStorage.canStreamToDisk.mockReturnValue(false);
+    attachmentStorage.canPersistSize.mockImplementation((bytes: number) => bytes <= 50 * 1024 * 1024);
+
+    const service = createService();
+    const attachment = registerIncomingGenericFile(3);
+
+    service.handleFileChunk(chunkPayload(0, 1, [
+      1,
+      2,
+      3
+    ]));
+
+    await vi.waitFor(() => expect(attachment.available).toBe(true));
+
+    expect(attachmentStorage.appendBase64).not.toHaveBeenCalled();
+    expect(persistence.saveFileToDisk).toHaveBeenCalledTimes(1);
+  });
+
+  it('copies oversized generic uploads with a source path into app data when publishing', async () => {
+    attachmentStorage.canCopyFiles.mockReturnValue(true);
+    attachmentStorage.canPersistSize.mockReturnValue(true);
+    persistence.persistUploadCopyFromSourcePath.mockImplementation(async (attachment) => {
+      attachment.savedPath = '/appdata/server/room/files/setup.exe';
+      return attachment.savedPath;
+    });
+
+    const service = createService();
+    const file = new File([new Uint8Array(11 * 1024 * 1024)], 'setup.exe', { type: 'application/octet-stream' });
+
+    Object.defineProperty(file, 'path', { value: '/home/ludde/setup.exe' });
+
+    await service.publishAttachments(MESSAGE_ID, [file], PEER_ID);
+
+    expect(persistence.persistUploadCopyFromSourcePath).toHaveBeenCalled();
+  });
+
+  it('falls back to the in-memory upload when the resolved disk path is empty', async () => {
+    attachmentStorage.resolveExistingPath.mockResolvedValue('/appdata/server/room/files/photo.png');
+    attachmentStorage.getFileSize.mockResolvedValue(0);
+
+    const service = createService();
+    const attachment = registerIncomingAttachment(9);
+
+    attachment.available = true;
+    attachment.savedPath = '/appdata/server/room/files/photo.png';
+    runtimeStore.setOriginalFile(`${MESSAGE_ID}:${FILE_ID}`, new File([new Uint8Array(9)], 'photo.png', { type: 'image/png' }));
+
+    await service.handleFileRequest({
+      messageId: MESSAGE_ID,
+      fileId: FILE_ID,
+      fromPeerId: 'peer-2'
+    });
+
+    expect(transport.streamFileFromDiskToPeer).not.toHaveBeenCalled();
+    expect(transport.streamFileToPeer).toHaveBeenCalledTimes(1);
+  });
+
+  it('streams a restored oversized generic file from app data when the in-memory upload is gone', async () => {
+    attachmentStorage.resolveExistingPath.mockResolvedValue('/appdata/server/room/files/setup.exe');
+    attachmentStorage.getFileSize.mockResolvedValue(12 * 1024 * 1024);
+
+    const service = createService();
+    const attachment = registerIncomingGenericFile(12 * 1024 * 1024);
+
+    attachment.savedPath = '/appdata/server/room/files/setup.exe';
+
+    await service.handleFileRequest({
+      messageId: MESSAGE_ID,
+      fileId: FILE_ID,
+      fromPeerId: 'peer-2'
+    });
+
+    expect(transport.streamFileFromDiskToPeer).toHaveBeenCalledWith(
+      'peer-2',
+      MESSAGE_ID,
+      FILE_ID,
+      '/appdata/server/room/files/setup.exe',
+      expect.any(Function)
+    );
+  });
+
+  it('hydrates persisted metadata before serving a file request after reload', async () => {
+    // Reload race: the peer's file-request arrives before initFromDatabase has
+    // filled the runtime store. Serving must wait for hydration instead of
+    // replying file-not-found for a file that is on disk.
+    attachmentStorage.resolveExistingPath.mockResolvedValue('/appdata/server/room/files/setup.exe');
+    attachmentStorage.getFileSize.mockResolvedValue(12 * 1024 * 1024);
+    persistence.whenReady.mockImplementation(async () => {
+      const attachment = registerIncomingGenericFile(12 * 1024 * 1024);
+
+      attachment.savedPath = '/appdata/server/room/files/setup.exe';
+    });
+
+    const service = createService();
+
+    await service.handleFileRequest({
+      messageId: MESSAGE_ID,
+      fileId: FILE_ID,
+      fromPeerId: 'peer-2'
+    });
+
+    expect(transport.streamFileFromDiskToPeer).toHaveBeenCalledWith(
+      'peer-2',
+      MESSAGE_ID,
+      FILE_ID,
+      '/appdata/server/room/files/setup.exe',
+      expect.any(Function)
+    );
+
+    expect(webrtc.sendToPeer).not.toHaveBeenCalledWith('peer-2', expect.objectContaining({ type: 'file-not-found' }));
+  });
+
+  it('copies an external upload into app data when serving a request after reload', async () => {
+    // savedPath missing (publish copy failed or pre-fix upload) but the original
+    // file-picker path survived - the serve path must persist it on demand
+    // instead of replying file-not-found.
+    attachmentStorage.resolveExistingPath
+      .mockResolvedValueOnce(null)
+      .mockResolvedValue('/appdata/server/room/files/setup.exe');
+
+    attachmentStorage.getFileSize.mockResolvedValue(628 * 1024 * 1024);
+    persistence.ensurePersistedUploadHost.mockImplementation(async (attachment: Attachment) => {
+      attachment.savedPath = '/appdata/server/room/files/setup.exe';
+      return true;
+    });
+
+    const service = createService();
+    const attachment = registerIncomingGenericFile(628 * 1024 * 1024);
+
+    attachment.filePath = '/home/nim/Downloads/setup.exe';
+
+    await service.handleFileRequest({
+      messageId: MESSAGE_ID,
+      fileId: FILE_ID,
+      fromPeerId: 'peer-2'
+    });
+
+    expect(persistence.ensurePersistedUploadHost).toHaveBeenCalledWith(attachment, { hydrateMediaForDisplay: false });
+    expect(transport.streamFileFromDiskToPeer).toHaveBeenCalledWith(
+      'peer-2',
+      MESSAGE_ID,
+      FILE_ID,
+      '/appdata/server/room/files/setup.exe',
+      expect.any(Function)
+    );
+
+    expect(webrtc.sendToPeer).not.toHaveBeenCalledWith('peer-2', expect.objectContaining({ type: 'file-not-found' }));
+  });
+
+  it('hydrates persisted metadata before re-announcing hosted attachments', async () => {
+    attachmentStorage.resolveExistingPath.mockResolvedValue('/appdata/server/room/files/setup.exe');
+    persistence.whenReady.mockImplementation(async () => {
+      const attachment = registerIncomingGenericFile(12 * 1024 * 1024);
+
+      attachment.savedPath = '/appdata/server/room/files/setup.exe';
+    });
+
+    const service = createService();
+
+    await service.reannounceHostedAttachments(PEER_ID);
+
+    expect(webrtc.broadcastMessage).toHaveBeenCalledWith(expect.objectContaining({
+      type: 'file-announce',
+      messageId: MESSAGE_ID,
+      file: expect.objectContaining({ id: FILE_ID })
+    }));
+  });
+
+  it('re-announces hosted attachments that can still be served from disk', async () => {
+    attachmentStorage.resolveExistingPath.mockResolvedValue('/appdata/server/room/files/setup.exe');
+
+    const service = createService();
+    const attachment = registerIncomingGenericFile(12 * 1024 * 1024);
+
+    attachment.uploaderPeerId = PEER_ID;
+    attachment.savedPath = '/appdata/server/room/files/setup.exe';
+    attachment.available = true;
+
+    await service.reannounceHostedAttachments(PEER_ID);
+
+    expect(webrtc.broadcastMessage).toHaveBeenCalledWith(expect.objectContaining({
+      type: 'file-announce',
+      messageId: MESSAGE_ID,
+      file: expect.objectContaining({ id: FILE_ID })
+    }));
+  });
+
+  it('requests a mirror host before the original uploader when both announced the file', async () => {
+    const uploaderPeer = 'uploader-peer';
+    const mirrorPeer = 'mirror-peer';
+
+    webrtc.getConnectedPeers.mockReturnValue([uploaderPeer, mirrorPeer]);
+
+    const service = createService();
+    const attachment = registerIncomingAttachment(3_000);
+
+    attachment.uploaderPeerId = uploaderPeer;
+    runtimeStore.addAnnouncedHost(`${MESSAGE_ID}:${FILE_ID}`, uploaderPeer);
+    runtimeStore.addAnnouncedHost(`${MESSAGE_ID}:${FILE_ID}`, mirrorPeer);
+
+    await service.requestFromAnyPeer(MESSAGE_ID, attachment);
+
+    expect(webrtc.sendToPeer).toHaveBeenCalledWith(mirrorPeer, expect.objectContaining({
+      type: 'file-request',
+      messageId: MESSAGE_ID,
+      fileId: FILE_ID
+    }));
+  });
+
+  it('records announced hosts from incoming file-announce payloads', () => {
+    const service = createService();
+
+    service.handleFileAnnounce({
+      messageId: MESSAGE_ID,
+      fromPeerId: 'mirror-peer',
+      file: {
+        id: FILE_ID,
+        filename: 'photo.png',
+        size: 3,
+        mime: 'image/png',
+        isImage: true,
+        uploaderPeerId: 'uploader-peer'
+      }
+    });
+
+    expect(runtimeStore.getAnnouncedHosts(`${MESSAGE_ID}:${FILE_ID}`).has('mirror-peer')).toBe(true);
+  });
+
+  it('does not register duplicate attachment metadata on repeat file-announce', () => {
+    const service = createService();
+    const announce = {
+      messageId: MESSAGE_ID,
+      fromPeerId: 'uploader-peer',
+      file: {
+        id: FILE_ID,
+        filename: 'photo.png',
+        size: 3,
+        mime: 'image/png',
+        isImage: true,
+        uploaderPeerId: 'uploader-peer'
+      }
+    };
+
+    expect(service.handleFileAnnounce(announce)).toBe(true);
+    expect(service.handleFileAnnounce(announce)).toBe(false);
+    expect(runtimeStore.getAttachmentsForMessage(MESSAGE_ID)).toHaveLength(1);
+  });
+
+  it('prefers streaming from disk over an in-memory original file when both exist', async () => {
+    attachmentStorage.resolveExistingPath.mockResolvedValue('/appdata/server/room/files/setup.exe');
+    attachmentStorage.getFileSize.mockResolvedValue(12 * 1024 * 1024);
+
+    const service = createService();
+    const attachment = registerIncomingGenericFile(12 * 1024 * 1024);
+
+    attachment.savedPath = '/appdata/server/room/files/setup.exe';
+    runtimeStore.setOriginalFile(`${MESSAGE_ID}:${FILE_ID}`, new File(['x'], 'setup.exe'));
+
+    await service.handleFileRequest({
+      messageId: MESSAGE_ID,
+      fileId: FILE_ID,
+      fromPeerId: 'peer-2'
+    });
+
+    expect(transport.streamFileFromDiskToPeer).toHaveBeenCalled();
+    expect(transport.streamFileToPeer).not.toHaveBeenCalled();
+  });
+
+  it('releases the in-memory upload copy after persisting a large generic file to disk', async () => {
+    attachmentStorage.canCopyFiles.mockReturnValue(true);
+    attachmentStorage.canPersistSize.mockReturnValue(true);
+    persistence.persistUploadCopyFromSourcePath.mockImplementation(async (attachment) => {
+      attachment.savedPath = '/appdata/server/room/files/setup.exe';
+      return attachment.savedPath;
+    });
+
+    const service = createService();
+    const file = new File([new Uint8Array(11 * 1024 * 1024)], 'setup.exe', { type: 'application/octet-stream' });
+
+    Object.defineProperty(file, 'path', { value: '/home/ludde/setup.exe' });
+
+    await service.publishAttachments(MESSAGE_ID, [file], PEER_ID);
+
+    const attachment = runtimeStore.getAttachmentsForMessage(MESSAGE_ID)[0];
+
+    expect(runtimeStore.getOriginalFile(`${MESSAGE_ID}:${attachment.id}`)).toBeUndefined();
+    expect(attachment.objectUrl).toBeUndefined();
+    expect(attachment.available).toBe(true);
+    expect(attachment.savedPath).toBe('/appdata/server/room/files/setup.exe');
+  });
+
+  it('sends file-cancel to pending request peers instead of only the uploader', async () => {
+    const mirrorPeer = 'mirror-peer';
+
+    webrtc.getConnectedPeers.mockReturnValue([mirrorPeer]);
+    webrtc.sendToPeer.mockClear();
+
+    const service = createService();
+    const attachment = registerIncomingAttachment(3_000);
+
+    attachment.uploaderPeerId = 'uploader-peer';
+    runtimeStore.addAnnouncedHost(`${MESSAGE_ID}:${FILE_ID}`, mirrorPeer);
+    runtimeStore.addAnnouncedHost(`${MESSAGE_ID}:${FILE_ID}`, attachment.uploaderPeerId);
+
+    await service.requestFromAnyPeer(MESSAGE_ID, attachment);
+
+    expect(webrtc.sendToPeer).toHaveBeenCalledWith(mirrorPeer, expect.objectContaining({
+      type: 'file-request'
+    }));
+
+    attachment.receivedBytes = 512;
+    service.cancelRequest(MESSAGE_ID, attachment);
+
+    expect(webrtc.sendToPeer).toHaveBeenCalledWith(mirrorPeer, {
+      type: 'file-cancel',
+      messageId: MESSAGE_ID,
+      fileId: FILE_ID
+    });
+
+    expect(attachment.receivedBytes).toBe(0);
+    expect(attachment.available).toBe(false);
+    expect(service.hasPendingRequest(MESSAGE_ID, FILE_ID)).toBe(false);
+  });
+
+  it('notifies attachment views when an outbound request starts', async () => {
+    const service = createService();
+    const attachment = registerIncomingAttachment(3_000);
+    const versionBeforeRequest = runtimeStore.updated();
+
+    await service.requestFromAnyPeer(MESSAGE_ID, attachment);
+
+    expect(runtimeStore.updated()).toBeGreaterThan(versionBeforeRequest);
+    expect(service.hasPendingRequest(MESSAGE_ID, FILE_ID)).toBe(true);
+    expect(webrtc.sendToPeer).toHaveBeenCalledWith(PEER_ID, expect.objectContaining({
+      type: 'file-request'
+    }));
+  });
+
+  it('surfaces a retry error when an async request race exhausts every peer', async () => {
+    let finishLocalRestore!: (restored: boolean) => void;
+
+    persistence.tryRestoreAttachmentFromLocal.mockImplementation(() => new Promise<boolean>((resolve) => {
+      finishLocalRestore = resolve;
+    }));
+
+    const service = createService();
+    const attachment = registerIncomingAttachment(3_000);
+    const request = service.requestFromAnyPeer(MESSAGE_ID, attachment);
+
+    service.handleFileNotFound({
+      messageId: MESSAGE_ID,
+      fileId: FILE_ID
+    });
+
+    finishLocalRestore(false);
+    await request;
+
+    expect(service.hasPendingRequest(MESSAGE_ID, FILE_ID)).toBe(false);
+    expect(attachment.requestError).toBe('attachment.errors.fileNotFound');
+  });
+
+  it('normalizes generic octet-stream announces into image metadata for gallery grouping', () => {
+    const service = createService();
+
+    expect(service.handleFileAnnounce({
+      messageId: MESSAGE_ID,
+      fromPeerId: PEER_ID,
+      file: {
+        id: FILE_ID,
+        filename: 'grid.png',
+        size: 512,
+        mime: 'application/octet-stream',
+        isImage: false,
+        uploaderPeerId: PEER_ID
+      }
+    })).toBe(true);
+
+    const attachment = runtimeStore.getAttachmentsForMessage(MESSAGE_ID)[0];
+
+    expect(attachment.mime).toBe('image/png');
+    expect(attachment.isImage).toBe(true);
+  });
+
+  it('hydrates playable media from disk without re-requesting when display url is missing', async () => {
+    persistence.tryRestoreAttachmentFromLocal.mockImplementation(async (attachment) => {
+      attachment.objectUrl = 'file:///appdata/song.mp3';
+      attachment.available = true;
+      return true;
+    });
+
+    const service = createService();
+    const attachment: Attachment = {
+      id: FILE_ID,
+      messageId: MESSAGE_ID,
+      filename: 'song.mp3',
+      size: 1024,
+      mime: 'audio/mpeg',
+      isImage: false,
+      uploaderPeerId: PEER_ID,
+      available: true,
+      savedPath: '/appdata/song.mp3',
+      receivedBytes: 0
+    };
+
+    runtimeStore.setAttachmentsForMessage(MESSAGE_ID, [attachment]);
+
+    await service.requestFromAnyPeer(MESSAGE_ID, attachment);
+
+    expect(persistence.tryRestoreAttachmentFromLocal).toHaveBeenCalled();
+    expect(webrtc.sendToPeer).not.toHaveBeenCalled();
+    expect(attachment.objectUrl).toBe('file:///appdata/song.mp3');
+  });
+
+  it('hydrates small in-memory audio downloads with a native file url when available', async () => {
+    attachmentStorage.getFileUrl.mockResolvedValue('file:///appdata/song.mp3');
+    persistence.saveFileToDisk.mockImplementation(async (attachment) => {
+      attachment.savedPath = '/appdata/song.mp3';
+      return attachment.savedPath;
+    });
+
+    const service = createService();
+    const attachment: Attachment = {
+      id: FILE_ID,
+      messageId: MESSAGE_ID,
+      filename: 'song.mp3',
+      size: 1024,
+      mime: 'audio/mpeg',
+      isImage: false,
+      uploaderPeerId: PEER_ID,
+      available: false,
+      receivedBytes: 0
+    };
+
+    runtimeStore.setAttachmentsForMessage(MESSAGE_ID, [attachment]);
+
+    service.handleFileChunk(chunkPayload(0, 1, [
+      1,
+      2,
+      3
+    ]));
+
+    await vi.waitFor(() => expect(attachment.objectUrl).toBe('file:///appdata/song.mp3'));
+
+    expect(attachment.available).toBe(true);
+    expect(attachment.savedPath).toBe('/appdata/song.mp3');
+  });
+
+  it('does not cancel hydrating gallery retries before attempting local restore', async () => {
+    persistence.tryRestoreAttachmentFromLocal.mockResolvedValue(true);
+
+    const service = createService();
+    const attachment: Attachment = {
+      id: FILE_ID,
+      messageId: MESSAGE_ID,
+      filename: 'grid.png',
+      size: 512,
+      mime: 'image/png',
+      isImage: true,
+      uploaderPeerId: PEER_ID,
+      available: false,
+      savedPath: '/appdata/grid.png',
+      receivedBytes: 0
+    };
+
+    runtimeStore.setAttachmentsForMessage(MESSAGE_ID, [attachment]);
+
+    await service.requestImageFromAnyPeer(MESSAGE_ID, attachment);
+
+    expect(persistence.tryRestoreAttachmentFromLocal).toHaveBeenCalled();
+    expect(webrtc.sendToPeer).not.toHaveBeenCalledWith(expect.anything(), expect.objectContaining({ type: 'file-cancel' }));
+  });
 });
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
myxelium	20d7f22fd2	fix: Bug - Images and files in chat doesn't load	2026-07-14 11:27:19 +02:00
myxeliumandCursor	41ebaf2407	fix: Restore chat attachments after reload Wait for persisted attachment metadata before serving or advertising files so reconnecting peers can load images and downloads reliably. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-07-14 10:29:37 +02:00
myxeliumandCursor	d3d22846e7	fix: Bug - User login status showing as both logged in and logged out Stop treating transient auth_required as home-session expiry, keep auth scope consistent across login redirect and server-rail joins, and leave /login when the in-memory user is still authenticated. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-07-14 01:54:01 +02:00
myxelium	59dfd2de85	perf: performance improvements 1	2026-07-14 01:34:33 +02:00
myxelium	edc4d935d8	chore: Fix app	2026-07-14 00:41:05 +02:00
myxeliumandCursor	3e090933fd	fix: Bug - User receiving direct call doesn't get notified (identity aliases) Match incoming direct-call events against every local identity alias - home id, entity id, peer id, and each provisioned signal-server actor id - instead of only oderId\|\|id. A caller who met the callee through a room on the caller's signal server addresses the ring by the callee's provisioned actor id, so the old admission check silently dropped it: the caller went "In Voice" while the callee saw no modal, no ring audio, and no rail entry. Incoming self aliases are normalized onto the canonical local id (normalizeDirectCallPayloadSelfAliases) so they never appear as a phantom third participant, and remoteParticipantIds / the DM-header peer lookup skip all self aliases. Adds a DM-header call ring e2e including the cross-signal topology (callee homed on a secondary signal server) that fails on the old code. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-07-13 20:18:37 +02:00
myxeliumandCursor	590e487250	fix: Bug - Sending files between users doesn't really work (chunk-time size re-gate) Remove the leftover MAX_AUTO_SAVE_SIZE_BYTES guard from handleFileChunk's in-memory path. The request gate (canReceiveAttachment) already admits 10-50 MB generic files for in-memory receive on stores without disk streaming (browser), but the chunk handler silently dropped every chunk of such files: no ack was sent, the sender's waitForAck timed out, and the receiver's GUI never changed. Receive admission is now decided once, at request time. Adds a two-browser regression e2e that sends an 11 MB generic file and asserts Request -> progress -> Download. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-07-13 18:48:30 +02:00
myxeliumandCursor	497033aff0	fix: Bug - Sending files and attachment issues (cross-transport auto-download race) Re-queue attachment auto-downloads when the chat message arrives, since file-announce (WebRTC) can beat chat-message (websocket) and the announce-time pass gives up on an unknown room. Gate stalled-download resets on chunk-progress staleness so an active transfer is never cancelled mid-stream, which deadlocked the retry against the sender's active-transfer dedupe. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-07-12 21:26:59 +02:00
myxeliumandCursor	0078c320a5	fix: Bug - Sending files and attachment issues Normalize attachment MIME types from filenames, hydrate playable media and gallery tiles from disk without redundant peer requests, reset stalled partial downloads, and improve gallery retry/hydration UX across chat and DMs. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-06-14 13:30:13 +02:00
myxeliumandCursor	b13f71d2d3	fix: Bug - Sending files and attachment issues (gallery load and speed) Route small images through in-memory receive instead of serialized disk chunk-acks, and improve gallery hydration for local copies and pending downloads so thumbnails display without minutes-long progress stalls. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-06-14 13:19:12 +02:00
myxeliumandCursor	fa45052432	fix: Bug - Sending files and attachment issues Hydrate playable media after disk receive, relay file-announce to sibling devices via account_sync, bind DM attachments to pre-allocated message ids, and improve gallery retry/cancel UX with bounded parallel auto-downloads. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-06-14 13:05:23 +02:00
myxeliumandCursor	bb0ac930ad	Improve attachment memory safety, downloads, and high-memory alert UX. Queue Release Build / prepare (push) Successful in 20s Details Deploy Web Apps / deploy (push) Successful in 9m2s Details Queue Release Build / build-windows (push) Successful in 28m8s Details Queue Release Build / build-linux (push) Successful in 47m26s Details Queue Release Build / build-android (push) Successful in 19m52s Details Queue Release Build / finalize (push) Successful in 4m42s Details Stream large receives to disk with chunk acks to cap renderer RAM, evict off-screen display blobs, and route exports through a disk-aware download service. Fix the high-memory dialog (backdrop dismiss, copy, log actions), allow diagnostics paths in the path jail, and restore persisted image hydration after reload. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-06-14 00:25:22 +02:00
myxeliumandCursor	f0d79aa627	fix: Bug - Files lose host on reload Persist large uploads under app data on publish and restore, and re-announce hosted attachments after reload so peers can download again. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-06-13 22:04:41 +02:00
myxeliumandCursor	95259e8943	fix: Bug - Sending files between users doesn't really work Stream oversized generic attachments to disk instead of silently dropping chunks, avoid loading completed file downloads into renderer memory, and surface a clear error when the browser client cannot receive a file. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-06-13 21:50:21 +02:00
myxeliumandCursor	924d4bbb1d	fix: Bug - In direct voice call the status is displayed as offline Resolve direct-call participant join state and DM peer status across user identity aliases so call UI no longer shows participants as disconnected when they are in the call. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-06-13 21:31:03 +02:00
myxeliumandCursor	baa350e90a	fix: Bug - Users doesn't receive dm messages Match direct messages against every local identity alias (home id and provisioned signal-server actor ids) so recipients accept traffic addressed to their per-server presence id instead of silently dropping it. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-06-13 20:59:57 +02:00
myxeliumandCursor	b2a2d9d770	fix: Bug - Users appear as both online and offline Align chat message sender ids with per-server presence identities so profile cards opened from message authors resolve the same live user state as the members panel. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-06-13 20:55:13 +02:00
myxeliumandCursor	c3c2f01cc6	fix: Bug - User automatically leaves voice after short period of time Queue Release Build / prepare (push) Successful in 22s Details Deploy Web Apps / deploy (push) Successful in 7m32s Details Queue Release Build / build-linux (push) Successful in 44m56s Details Queue Release Build / build-android (push) Successful in 18m52s Details Queue Release Build / finalize (push) Successful in 21s Details Queue Release Build / build-windows (push) Successful in 27m41s Details Ignore stale P2P self-disconnect voice-state echoes while this client actively owns voice, refresh noise-reduction input on re-join, and repair dual-signal E2E harness expectations. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-06-12 04:04:31 +02:00
myxelium	dac5cb42a5	perf: diagnoistics improvements	2026-06-12 01:22:01 +02:00
myxeliumandCursor	29032b5a36	fix: Bug - Voice states doesn't get cleared for all users on leave Broadcast a cleared voice_state when voice-active sockets drop and reset mute/deafen flags on disconnect or reconnect so stale session state cannot leak to other clients. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-06-12 01:00:01 +02:00
myxeliumandCursor	e75b4a38ed	fix: Bug - Same user logged in on multiple clients acts like 2 different users Collapse home and signal-server actor aliases into one canonical room member so multi-device sessions no longer duplicate the local user in the members panel. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-06-12 00:52:59 +02:00