diff --git a/.env.example b/.env.example
index 7123f0353b..d4e85d817b 100644
--- a/.env.example
+++ b/.env.example
@@ -373,6 +373,21 @@ RUST_LOG=buzz_relay=debug,buzz_datastore=info,buzz_db=debug,buzz_auth=debug,buzz
 # BUZZ_PRIVACY_POLICY_MARKDOWN="# Privacy Policy\n\nFull policy here."
 # BUZZ_AGE_ATTESTATION_REQUIRED=true
 
+# ── NIP-FI database community source ─────────────────────────────────────────
+# Where NIP-FI communities come from: "env" (BUZZ_NIP_FI_COMMUNITIES, default)
+# or "database" (bindings created by provisioning; needs
+# BUZZ_NIP_FI_PROVISION_BINDING and must not be combined with
+# BUZZ_NIP_FI_COMMUNITIES). See docs/operator-nip-fi-bindings.md.
+# BUZZ_NIP_FI_COMMUNITY_SOURCE=env
+# Most community-issuer rows one snapshot may hold (1..=10000000).
+# BUZZ_NIP_FI_SNAPSHOT_MAX_ROWS=1000000
+# Snapshot load timeout in ms; must be under the 30s refresh interval.
+# BUZZ_NIP_FI_SNAPSHOT_REFRESH_TIMEOUT_MS=10000
+# Hosts whose "not found" is cached for 5s (1..=1000000).
+# BUZZ_NIP_FI_RESOLVER_NEGATIVE_CACHE_MAX=100000
+# Concurrent live lookups; clamped below the database pool size.
+# BUZZ_NIP_FI_RESOLVER_MAX_INFLIGHT=8
+
 # Optional absolute legacy-v1 invite cutoff, UTC RFC3339 whole seconds.
 # Unset preserves natural token expiry; never changes v2 invitations.
 # BUZZ_INVITE_V1_INVALID_AFTER=2026-12-01T00:00:00Z
diff --git a/.github/workflows/_ci-clients.yml b/.github/workflows/_ci-clients.yml
index bb62f49e9b..b6673f74d3 100644
--- a/.github/workflows/_ci-clients.yml
+++ b/.github/workflows/_ci-clients.yml
@@ -135,6 +135,21 @@ jobs:
       - name: Test
         if: matrix.lane == 'test'
         run: cd mobile && flutter test --dart-define=BUZZ_PUSH_GATEWAY_URL=https://push.example --total-shards=3 --shard-index=${{ matrix.shard }}
+      - name: Test configured authentication domains
+        if: matrix.lane == 'checks'
+        run: >-
+          cd mobile && flutter test
+          --dart-define=BUZZ_PUSH_GATEWAY_URL=https://push.example
+          --dart-define=BUZZ_AUTH_DOMAINS=buzz.xyz,builderlab.xyz,builderlabstaging.xyz
+          test/shared/auth/community_entry_requirements_test.dart
+          test/features/invites/invite_join_provider_test.dart
+          test/features/onboarding/onboarding_entry_routes_test.dart
+          test/shared/hosted/hosted_environment_test.dart
+          test/shared/hosted/self_hosted_entry_test.dart
+          test/features/onboarding/hosted_app_gate_environment_test.dart
+          test/features/onboarding/hosted_journeys_test.dart
+          test/features/onboarding/hosted_communities_test.dart
+          test/features/pairing/pairing_hosted_handoff_test.dart
       - name: Test mobile without push configuration
         if: matrix.lane == 'checks'
         run: cd mobile && flutter test test/shared/push/push_unconfigured_build_test.dart
@@ -212,6 +227,7 @@ jobs:
             -configuration Debug -destination "platform=iOS Simulator,id=$device" \
             -parallel-testing-enabled NO \
             -only-testing:RunnerTests/BuzzPushNavigationBridgeTests \
+            -only-testing:RunnerTests/IdentityFilePluginTests \
             CODE_SIGNING_ALLOWED=NO test
       - name: Build complete unsigned iOS release
         if: matrix.lane == 'release'
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 351c7bef6a..be87fa4be4 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -91,6 +91,7 @@ jobs:
               - 'Justfile'
               - 'scripts/test-mobile-gateway-recipes.sh'
               - 'scripts/mobile-release.sh'
+              - 'scripts/mobile-release-source.sh'
               - 'scripts/mobile-worktree-overrides.sh'
               - 'scripts/mobile-worktree-clean.sh'
               - 'scripts/publish-mobile-release-candidate.sh'
diff --git a/.github/workflows/mobile-release-candidate.yml b/.github/workflows/mobile-release-candidate.yml
index e1f1c1c918..131e8aab0b 100644
--- a/.github/workflows/mobile-release-candidate.yml
+++ b/.github/workflows/mobile-release-candidate.yml
@@ -12,8 +12,13 @@ on:
         description: Expected next release-candidate number
         required: true
         type: string
+      source_branch:
+        description: Source branch (main or mobile-vMAJOR.MINOR matching version)
+        required: true
+        default: main
+        type: string
       target_sha:
-        description: Exact current block/buzz main commit
+        description: Pinned commit in the selected source branch history
         required: true
         type: string
 
@@ -65,5 +70,6 @@ jobs:
           GH_TOKEN: ${{ steps.release-tagger.outputs.token }}
           MOBILE_VERSION: ${{ inputs.version }}
           CANDIDATE_NUMBER: ${{ inputs.candidate_number }}
+          SOURCE_BRANCH: ${{ inputs.source_branch }}
           TARGET_SHA: ${{ inputs.target_sha }}
-        run: scripts/publish-mobile-release-candidate.sh "$MOBILE_VERSION" "$CANDIDATE_NUMBER" "$TARGET_SHA"
+        run: scripts/publish-mobile-release-candidate.sh "$MOBILE_VERSION" "$CANDIDATE_NUMBER" "$TARGET_SHA" "$SOURCE_BRANCH"
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index c761fab9c1..2beb40bd5a 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -83,7 +83,7 @@ We review as capacity allows — focused PRs that follow this guide move fastest
 | Rust | 1.88+ | Install via [rustup](https://rustup.rs/) |
 | Node.js | 24+ | Required for desktop app commands and `just ci` |
 | pnpm | 10+ | Required for desktop app commands and `just ci` |
-| Flutter | 3.41+ | Required for mobile app — install via [flutter.dev](https://docs.flutter.dev/get-started/install) |
+| Flutter | 3.47.7+ | Required for mobile app — install via [flutter.dev](https://docs.flutter.dev/get-started/install) |
 | Xcode | 27.0 recommended; 26 supported | Required for iOS builds; see [iOS toolchain setup](mobile/README.md#ios-toolchain) |
 | Docker | 24+ | For Postgres, Redis, MinIO |
 | `just` | latest | Task runner — `cargo install just` |
diff --git a/Cargo.lock b/Cargo.lock
index 94a5ebd139..38ad23b30b 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1424,6 +1424,7 @@ name = "buzz-relay"
 version = "0.2.1"
 dependencies = [
  "anyhow",
+ "arc-swap",
  "async-compression",
  "async-trait",
  "axum",
@@ -1454,6 +1455,7 @@ dependencies = [
  "http-body-util",
  "infer",
  "jsonwebtoken",
+ "lru 0.16.4",
  "metrics",
  "metrics-exporter-prometheus",
  "metrics-util",
@@ -1487,6 +1489,7 @@ dependencies = [
  "tracing",
  "tracing-opentelemetry",
  "tracing-subscriber",
+ "tungstenite 0.29.0",
  "url",
  "uuid",
 ]
@@ -5182,6 +5185,9 @@ name = "lru"
 version = "0.16.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7f66e8d5d03f609abc3a39e6f08e4164ebf1447a732906d39eb9b99b7919ef39"
+dependencies = [
+ "hashbrown 0.16.1",
+]
 
 [[package]]
 name = "lru"
@@ -6227,9 +6233,9 @@ checksum = "27b02d87554356db9e9a873add8782d4ea6e3e58ea071a9adb9a2e8ddb884a8b"
 
 [[package]]
 name = "negentropy"
-version = "0.5.0"
+version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0efe882e02d206d8d279c20eb40e03baf7cb5136a1476dc084a324fbc3ec42d"
+checksum = "a3d66662cb5ca384d4991509755ed5a42dd8e31c4282bf881938e506fc3146ec"
 
 [[package]]
 name = "netdev"
diff --git a/Cargo.toml b/Cargo.toml
index df77ab7cb3..6207d5a8c0 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -124,6 +124,8 @@ zeroize = "1.8"
 # Concurrent data structures
 dashmap = "6"
 moka    = { version = "0.12", features = ["sync"] }
+arc-swap = "1"
+lru     = "0.16"
 
 # Async stream utilities
 futures-util = "0.3"
diff --git a/Justfile b/Justfile
index e3c8e26580..e27e835855 100644
--- a/Justfile
+++ b/Justfile
@@ -522,7 +522,8 @@ test-unit:
         # unit job either. The REQ subscription-lifecycle tests are picked by
         # exact name for the same reason: the rest of handlers::req needs a DB.
         # The third clause adds the NIP-FI HTTP ingress and its router/config
-        # neighbours: nip_fi_http, nip_fi_config, router, api::parse_query_tests,
+        # neighbours: nip_fi_http, nip_fi_config, nip_fi_resolver (snapshot
+        # resolver and its WS/HTTP/audio router tests), router, api::parse_query_tests,
         # the profile search request bounds (api::profiles), and the Git
         # transport off_mode_precedence_tests. All are infra-free
         # and finish in well under a second with no DATABASE_URL, so none wait
@@ -536,7 +537,7 @@ test-unit:
         # are infra-free; config parses env into a struct and never connects.
         # `^config::` is anchored so it does not also select nip_fi_config.
         cargo nextest run -p buzz-relay --lib --bin buzz-relay \
-            -E 'test(/^api::admin::/) + test(/^push_runtime::/) + test(/^operator_listener::tests::/) + test(/^handlers::channel_authz::/) + test(/^handlers::moderation_authz::/) + test(/^handlers::side_effects::tests::/) + test(/^handlers::system_channels::tests::/) + test(/^nip11::tests::/) + test(/^storage_sweep::tests::/) + test(/^nip_fi_core::tests::/) + test(/^nip_fi_http::tests::/) + test(/^nip_fi_config::tests::/) + test(/^readiness::tests::/) + test(/^router::tests::/) + test(/^api::parse_query_tests::/) + test(/^api::profiles::/) + test(/^api::git::transport::off_mode_precedence_tests::/) + test(/^audio::join::tests::/) + test(/^audio::handler::tests::/) + test(/^nip_fi_gate::tests::/) + test(/^nip_fi_session::tests::/) + test(/^nip_fi_shadow::tests::/) + test(/^nip_fi_shadow_session::tests::/) + test(/^startup_steps::tests::/) + test(/^telemetry::tests::/) + test(/^config::tests::/) + test(=state::tests::neither_a_confirmed_inactive_community_nor_a_failed_lookup_admits_the_socket) + test(=state::tests::periodic_revalidation_disconnects_inside_the_fenced_callback) + test(=state::tests::bare_community_disconnect_fails_closed_when_the_fence_is_unavailable) + test(=connection::tests::send_loop_sends_policy_close_when_community_is_archived) + test(=state::tests::community_disconnect_then_nip_fi_keeps_community_deleted_reason) + test(=state::tests::disconnect_community_wins_reason_losing_nip_fi_does_not_enqueue_frame) + test(=handlers::req::tests::timed_out_historical_read_deregisters_before_closed) + test(=handlers::req::tests::superseded_timeout_leaves_replacement_intact) + test(=handlers::req::tests::search_claim_retires_live_and_yields_to_replacement) + test(=handlers::req::tests::concurrent_claims_and_stale_teardowns_keep_the_last_owner) + test(=handlers::req::tests::timeout_closed_is_emitted_before_a_replacement_can_claim) + test(=handlers::req::tests::revoke_then_replacement_keeps_replacement_whole) + test(=handlers::req::tests::claims_after_connection_cleanup_are_refused) + test(=handlers::req::tests::dropped_terminal_frame_cancels_connection) + test(=handlers::req::tests::revoke_dropped_terminal_frame_cancels_connection) + test(=handlers::req::tests::count_fallback_covers_filters_that_can_match_private_deletions) + test(=handlers::req::tests::group_state_t_and_creator_tags_reach_sql_only_for_group_state_kinds) + test(=api::bridge::postgres_tests::bridge_search_mode_extension_accepts_prefix_snake_or_camel_case) + test(=api::bridge::postgres_tests::bridge_search_sort_extension_selects_newest_only_when_named) + (kind(bin) & (test(/^tests::/) + test(/^composition_tests::/) + test(/^env_filter_tests::/)) - test(/^tests::postgres_tests::/))'
+            -E 'test(/^api::admin::/) + test(/^push_runtime::/) + test(/^operator_listener::tests::/) + test(/^handlers::channel_authz::/) + test(/^handlers::moderation_authz::/) + test(/^handlers::side_effects::tests::/) + test(/^handlers::system_channels::tests::/) + test(/^nip11::tests::/) + test(/^storage_sweep::tests::/) + test(/^nip_fi_core::tests::/) + test(/^nip_fi_http::tests::/) + test(/^nip_fi_config::tests::/) + test(/^nip_fi_resolver::tests::/) + test(/^readiness::tests::/) + test(/^router::tests::/) + test(/^api::parse_query_tests::/) + test(/^api::profiles::/) + test(/^api::git::transport::off_mode_precedence_tests::/) + test(/^audio::join::tests::/) + test(/^audio::handler::tests::/) + test(/^nip_fi_gate::tests::/) + test(/^nip_fi_session::tests::/) + test(/^nip_fi_shadow::tests::/) + test(/^nip_fi_shadow_session::tests::/) + test(/^startup_steps::tests::/) + test(/^telemetry::tests::/) + test(/^config::tests::/) + test(=state::tests::neither_a_confirmed_inactive_community_nor_a_failed_lookup_admits_the_socket) + test(=state::tests::periodic_revalidation_disconnects_inside_the_fenced_callback) + test(=state::tests::bare_community_disconnect_fails_closed_when_the_fence_is_unavailable) + test(=connection::tests::send_loop_sends_policy_close_when_community_is_archived) + test(=state::tests::community_disconnect_then_nip_fi_keeps_community_deleted_reason) + test(=state::tests::disconnect_community_wins_reason_losing_nip_fi_does_not_enqueue_frame) + test(=handlers::req::tests::timed_out_historical_read_deregisters_before_closed) + test(=handlers::req::tests::superseded_timeout_leaves_replacement_intact) + test(=handlers::req::tests::search_claim_retires_live_and_yields_to_replacement) + test(=handlers::req::tests::concurrent_claims_and_stale_teardowns_keep_the_last_owner) + test(=handlers::req::tests::timeout_closed_is_emitted_before_a_replacement_can_claim) + test(=handlers::req::tests::revoke_then_replacement_keeps_replacement_whole) + test(=handlers::req::tests::claims_after_connection_cleanup_are_refused) + test(=handlers::req::tests::dropped_terminal_frame_cancels_connection) + test(=handlers::req::tests::revoke_dropped_terminal_frame_cancels_connection) + test(=handlers::req::tests::count_fallback_covers_filters_that_can_match_private_deletions) + test(=handlers::req::tests::group_state_t_and_creator_tags_reach_sql_only_for_group_state_kinds) + test(=api::bridge::postgres_tests::bridge_search_mode_extension_accepts_prefix_snake_or_camel_case) + test(=api::bridge::postgres_tests::bridge_search_sort_extension_selects_newest_only_when_named) + (kind(bin) & (test(/^tests::/) + test(/^composition_tests::/) + test(/^env_filter_tests::/)) - test(/^tests::postgres_tests::/))'
         # Note on audio::join::tests scope: the full suite is infra-free (no DB,
         # no Redis). The infra-free audio/FI regression witnesses — bootstrap
         # ordering barrier, CommitConfirmed arm, pending-close invisibility,
@@ -576,6 +577,17 @@ test-unit:
                 + test(=connection::tests::expiry_notice_queued_on_ctrl_before_cancel)
                 + test(=connection::tests::f3_root_outer_wrapper_delivers_denial_on_bootstrap_cancellation)
                 + test(=connection::tests::f3_root_pre_built_expired_gate_terminates_connection)
+                + test(=connection::terminal_close_delivery_tests::key_pairing_mismatch_closes_with_1008_on_real_socket)
+                + test(=connection::terminal_close_delivery_tests::session_expiry_denial_closes_with_1008_on_real_socket)
+                + test(=connection::terminal_close_delivery_tests::server_holds_socket_for_client_close_reply)
+                + test(=connection::terminal_close_delivery_tests::server_finishes_promptly_when_client_answers_close)
+                + test(=connection::terminal_close_delivery_tests::stalled_cleanup_does_not_hold_socket_open)
+                + test(=connection::terminal_close_delivery_tests::bootstrap_drain_holds_socket_for_client_close_reply)
+                + test(=connection::terminal_close_delivery_tests::stalled_expiry_barrier_does_not_hold_socket_open)
+                + test(=connection::terminal_close_delivery_tests::blocked_frame_handler_does_not_hold_socket_open)
+                + test(=connection::terminal_close_delivery_tests::refused_bootstrap_holds_connection_slot_until_socket_ends)
+                + test(=connection::terminal_close_delivery_tests::stalled_bootstrap_holds_connection_slot)
+                + test(=connection::terminal_close_delivery_tests::peer_wait_replies_to_client_initiated_close)
                 + test(=handlers::auth::tests::b2_pre_cancelled_connection_never_becomes_authenticated)
                 + test(=handlers::auth::tests::fi_ban_check_error_emits_terminal_authorization_unavailable)
                 + test(=handlers::auth::tests::fi_root_authorization_denied_rows_emit_identical_frames)
diff --git a/NOSTR.md b/NOSTR.md
index 62e438d30d..96ccb0edc0 100644
--- a/NOSTR.md
+++ b/NOSTR.md
@@ -152,7 +152,10 @@ out unless they ask for it:
   combine with OR, so `#t:["system", <label>]` does not mean "a system
   channel with this label".
 
-Push and kind:44100/44101 membership notifications skip system channels.
+Push notifications skip system channels. Every kind:44100/44101 membership
+notification carries its channel type as `t`, and a filter without `#t` sees
+only the legacy types, so system channel notices reach only a filter with
+`#t:["system"]` (see NIP-CL).
 
 Events are stored **channel-scoped** so access control applies — private channel member lists are
 only visible to members. Discover groups via historical REQ:
@@ -178,6 +181,11 @@ The relay emits relay-signed notifications when members are added or removed:
 | **44100** | Member added | `p` = target pubkey, `h` = channel UUID | Community-global |
 | **44101** | Member removed | `p` = target pubkey, `h` = channel UUID | Community-global |
 
+Each notice also has `t` = the channel type (`stream`, `forum`, `dm`,
+`workflow`, `system`). A filter with `#t` gets only the types it names. A
+filter without `#t` gets only `stream`, `forum`, `dm` and `workflow`, and so
+does an untagged notice stored before the tag existed (NIP-CL).
+
 Stored community-globally (`channel_id = None` inside the connected community) so agents and clients can subscribe without knowing channel
 UUIDs in advance. Client-submitted kind:44100/44101 events are rejected — only the relay keypair
 may sign these.
diff --git a/RELEASING.md b/RELEASING.md
index 34fc9b49da..6e251a93d9 100644
--- a/RELEASING.md
+++ b/RELEASING.md
@@ -1,7 +1,8 @@
 # Releasing Buzz
 
 Buzz has three independent release lanes. Desktop and relay use release PRs.
-Mobile uses immutable release-candidate tags cut directly from remote `main`:
+Mobile uses immutable release-candidate tags cut from remote `main` by default,
+with an optional stable source branch:
 
 | Lane | Entry point | Artifact |
 |------|-------------|----------|
@@ -38,7 +39,8 @@ scripts/mobile-release.sh candidate 0.5.0
 Desktop uses an immutable generated candidate PR; relay continues using its
 metadata PR. Mobile does not. Each `mobile-vX.Y.Z-rc.N` tag is an immutable
 candidate and the artifact of record.
-There is no mobile release branch, stable mobile tag alias, finalization step,
+Optional stable branches use `mobile-vMAJOR.MINOR`. There is no
+stable mobile tag alias, finalization step,
 or mobile GitHub Release.
 
 ---
@@ -133,11 +135,13 @@ release notes and require operators to upgrade before distributing these clients
 1. **Publish a candidate.** From a clean checkout whose `origin` is the
    canonical `block/buzz` repository, run
    `scripts/mobile-release.sh candidate X.Y.Z`. The script resolves and fetches
-   the exact current `origin/main` commit, derives the next number from exact
+   a snapshot of `origin/main`, derives the next number from exact
    remote tags for that marketing version, and publishes an annotated
    `mobile-vX.Y.Z-rc.N` tag there through the dedicated `buzz-release-bot`
    GitHub App. It never uses the operator's checked-out commit and never moves
-   an existing candidate.
+   an existing candidate. To select a historical commit, add `--commit FULL_SHA`.
+   Both operator and publisher require that commit to be in the selected source
+   branch's history. Later branch advances do not change or invalidate the tag.
 2. **Build the exact tag.** Enter the candidate tag as `mobile_ref` in the
    private Buzz mobile Buildkite pipeline. OSS CI deliberately cannot trigger
    that private pipeline. The tag supplies both source commit and release
@@ -153,10 +157,50 @@ RC tags. For example, iOS can ship `mobile-v0.5.0-rc.2` while Android ships
 There is intentionally no single selected or final candidate for the marketing
 version.
 
-The simplification trades away a separate stabilization line. Unrelated commits
-that reach `main` become part of every later candidate, and there is no retained
-hotfix branch or branch-ancestry history. Add a dedicated hotfix flow later if a
-release actually needs isolation from `main`.
+### Optional stable release branches
+
+For a release that needs isolation from ongoing development, create a branch
+such as `mobile-v0.25` from an explicitly selected, verified source commit.
+Publish candidates from its current remote tip:
+
+```bash
+scripts/mobile-release.sh candidate 0.25.0 --source-branch mobile-v0.25
+```
+
+The branch must match the marketing version's major and minor components:
+`mobile-v0.25` accepts 0.25.x, but rejects 0.26.x and 1.25.x. Without the option,
+the source remains `main`. Both the operator and publisher validate the source;
+a missing branch or a commit outside its history fails rather than falling back
+to `main`. `--commit FULL_SHA` also works with a stable source branch, whose
+review and check protections remain required.
+The GitHub workflow itself continues to run from reviewed `main`. The private
+pipeline still builds only the resulting immutable candidate tag.
+
+For the October 2026 stabilization period, all distributed mobile builds,
+including Company Portal dogfood builds, must come from `mobile-v0.25` until
+after the conference. Do not upload builds from `main` or a later minor version
+that would displace the stable dogfood build. The branch starts from
+`mobile-v0.24.0-rc.2`, the source of uploaded iOS 0.24.0 (7).
+
+General fix PRs must target `main` and land there first. At each fix landing,
+ask the release owner whether to
+backport the merged commit to the stable branch. For each explicitly approved
+fix, cherry-pick with `-x --signoff` onto a backport branch and open a backport-only
+PR targeting the stable branch. Require review and passing checks before merging
+that PR. Preserve the original commit provenance and validate the resulting
+stable source. A correction for a regression introduced by an earlier backport
+may target the stable branch directly; identify the faulty backport and keep the
+correction scoped to that regression. The same review and checks apply.
+Never merge `main` wholesale.
+Remote agents and App Clip are post-conference work. There is no preselected
+fix list and no requirement to create a stable branch for every minor release.
+
+The initial 0.25.0 candidate pins that baseline with `--commit`. The second
+candidate uses an empty commit above that baseline to verify
+that the existing pipeline builds a commit outside `main`. Verify identical
+source trees, absence of that commit from remote `main`, and the exact tag,
+commit, marketing version and build number in the uploaded artifacts. Upload
+and external TestFlight review do not establish production App Store approval.
 
 `mobile/pubspec.yaml` keeps `0.0.0+1` only as a valid, visibly non-release
 fallback for local development and validation builds. Release jobs always
@@ -317,8 +361,15 @@ Mobile candidate publication requires workflow-dispatch access and the existing
 release App because strict tag protection denies direct human creation. The App
 must be installed on `block/buzz`, have Contents write and Metadata read, and
 retain an `always` bypass on the immutable `mobile-v*` tag rules. It does not
-require GitHub Releases permissions, repository Administration permission, or a
-mobile release-branch ruleset. The publisher validates the App token's effective
+require GitHub Releases permissions or repository Administration permission.
+Stable sources additionally require active branch ruleset `19321162` covering
+`refs/heads/mobile-v*`, with no exclusions or bypass actors, deletion and
+force-push prevention, at least one approval, stale-approval dismissal, last-push
+approval, resolved review threads, and strict required `Mobile` and `DCO Check`
+checks. An administrator must configure and audit the empty bypass list; GitHub
+hides that list from non-admin tokens. Both operator and publisher verify the
+public policy and their effective lack of branch bypass on every publication.
+The publisher validates the App token's effective
 `current_user_can_bypass` value rather than reading the ruleset's hidden bypass
 actor list.
 
@@ -343,18 +394,18 @@ Commit or stash your changes before running the release recipe.
 ### New commits land after publishing a mobile candidate
 
 Run `scripts/mobile-release.sh candidate <version>` again after the intended
-fix reaches remote `main`. It publishes a new immutable RC tag at the new exact
+fix reaches the intended remote source branch. Use the same `--source-branch`
+option for a stable release. The command publishes a new immutable RC tag at the new exact
 remote commit. Continue referring to each tested or shipped platform artifact by
 its own exact tag.
 
-### `scripts/mobile-release.sh candidate` fails because `main` moved during publication
+### The source branch advances during candidate publication
 
-The App-backed workflow may already have published the requested immutable RC
-at the prior `main` tip before the operator command detects the race. Do not
-move or delete that tag, and do not treat it as the candidate for current
-`main`. Inspect the run URL from the command output, then rerun
-`scripts/mobile-release.sh candidate <version>` to publish the next RC from the
-new current `main` tip.
+Publication remains pinned to the selected SHA. The publisher verifies that it
+is an ancestor of a resolved source-branch snapshot, then creates and verifies
+an immutable annotated tag for that exact SHA. The operator verifies the tag,
+not the branch's later tip. A newer commit does not require retrying or creating
+another candidate. Missing or unverifiable ancestry still fails closed.
 
 ### A mobile candidate command selects the wrong RC number
 
diff --git a/bin/.flutter-3.41.7.pkg b/bin/.flutter-3.47.7.pkg
similarity index 100%
rename from bin/.flutter-3.41.7.pkg
rename to bin/.flutter-3.47.7.pkg
diff --git a/bin/dart b/bin/dart
index 781b79bc07..28f286c9c6 120000
--- a/bin/dart
+++ b/bin/dart
@@ -1 +1 @@
-.flutter-3.41.7.pkg
\ No newline at end of file
+.flutter-3.47.7.pkg
\ No newline at end of file
diff --git a/bin/flutter b/bin/flutter
index 781b79bc07..28f286c9c6 120000
--- a/bin/flutter
+++ b/bin/flutter
@@ -1 +1 @@
-.flutter-3.41.7.pkg
\ No newline at end of file
+.flutter-3.47.7.pkg
\ No newline at end of file
diff --git a/crates/buzz-auth/src/nip_fi/command.rs b/crates/buzz-auth/src/nip_fi/command.rs
index 83b864498c..4b5da49d48 100644
--- a/crates/buzz-auth/src/nip_fi/command.rs
+++ b/crates/buzz-auth/src/nip_fi/command.rs
@@ -948,7 +948,17 @@ mod tests {
         until_offset_secs: i64,
         overrides: serde_json::Value,
     ) -> String {
-        let now = now_ts();
+        mint_cmd_jwt_at(target, Utc::now(), until_offset_secs, overrides)
+    }
+
+    /// Mint a command JWT using the supplied instant for all time claims.
+    fn mint_cmd_jwt_at(
+        target: &nostr::PublicKey,
+        now: DateTime<Utc>,
+        until_offset_secs: i64,
+        overrides: serde_json::Value,
+    ) -> String {
+        let now = now.timestamp();
         let mut claims = serde_json::json!({
             "iss": ISS,
             "aud": AUD,
@@ -1214,6 +1224,31 @@ mod tests {
         );
     }
 
+    #[test]
+    fn until_at_maximum_assertion_lifetime_is_accepted_and_one_second_more_is_not() {
+        // An issuer's `until` is the expiry of the last assertion it issued, so
+        // a maximum-lifetime assertion minted now (exp = now + max_age) must
+        // fit the ceiling now + skew + max_age, both at issue time and on a
+        // re-send just before that deadline. The test policy is skew 30 s,
+        // maximum assertion age 3600 s.
+        let cv = test_command_verifier();
+        let target = target_key();
+        let now = Utc::now();
+        for until_offset in [3600, 30 + 3600, 1] {
+            let token = mint_cmd_jwt_at(&target, now, until_offset, serde_json::json!({}));
+            assert_eq!(
+                cv.verify_at(&token, METHOD, PATH, &target, now).map(|_| ()),
+                Ok(()),
+                "until = now + {until_offset}s must fit the ceiling"
+            );
+        }
+        let token = mint_cmd_jwt_at(&target, now, 30 + 3600 + 1, serde_json::json!({}));
+        assert_eq!(
+            cv.verify_at(&token, METHOD, PATH, &target, now).map(|_| ()),
+            Err(CommandError::UntilExceedsCeiling),
+        );
+    }
+
     // ── jti is the LAST step ─────────────────────────────────────────────────
 
     #[test]
diff --git a/crates/buzz-auth/src/nip_fi/config.rs b/crates/buzz-auth/src/nip_fi/config.rs
index 26aad88115..99231d82d5 100644
--- a/crates/buzz-auth/src/nip_fi/config.rs
+++ b/crates/buzz-auth/src/nip_fi/config.rs
@@ -368,10 +368,6 @@ pub struct IssuerPolicy {
     /// Accepted `aud` values for S4 command JWTs only. Assertion `aud` comes
     /// from the per-community [`super::CommunityBinding`], never from here.
     command_audiences: Vec<String>,
-    /// Expected `aud` of every community authorizing this issuer — the
-    /// issuer's side of the community allowlist (NIP-FI.md:145). Empty until
-    /// [`IssuerPolicy::authorized_for_communities`] sets it.
-    community_audiences: Vec<String>,
     token_class: TokenClass,
     freshness: FreshnessClass,
     algorithms: Vec<Algorithm>,
@@ -488,7 +484,6 @@ impl IssuerPolicy {
         let mut policy = Self {
             issuer,
             command_audiences: canonical_set(command_audiences),
-            community_audiences: Vec::new(),
             token_class,
             freshness,
             algorithms: canonical_algorithm_set(algorithms),
@@ -503,15 +498,18 @@ impl IssuerPolicy {
         Ok(policy)
     }
 
-    /// Record the expected `aud` of every community that authorizes this
-    /// issuer and re-derive the policy ID over it, so changing the community
-    /// allowlist moves the ID (NIP-FI.md:145). Set-valued: order and
-    /// duplicates do not affect the ID.
-    #[must_use]
-    pub fn authorized_for_communities(mut self, community_audiences: Vec<String>) -> Self {
-        self.community_audiences = canonical_set(community_audiences);
-        self.id = derive_assertion_policy_id(&self);
-        self
+    /// The policy ID an assertion verified for the community expecting
+    /// `community_aud` carries: `H(base policy contract, community aud)`. The
+    /// base contract already commits to the issuer. The verifier mints it
+    /// only after the community's allowlist admitted this issuer, so it moves
+    /// exactly when this community's association or the base policy changes,
+    /// never when an unrelated community is added (NIP-FI.md:145).
+    pub fn id_for_community(&self, community_aud: &str) -> AssertionPolicyId {
+        let mut hasher = Sha256::new();
+        hasher.update(b"buzz:nip-fi:community-assertion-policy:v1\0");
+        hasher.update(self.id.0);
+        hash_field(&mut hasher, community_aud.as_bytes());
+        AssertionPolicyId(hasher.finalize().into())
     }
 
     /// The exact `iss` value this policy is selected by.
@@ -524,11 +522,6 @@ impl IssuerPolicy {
         &self.command_audiences
     }
 
-    /// The expected `aud` of each community authorizing this issuer.
-    pub fn community_audiences(&self) -> &[String] {
-        &self.community_audiences
-    }
-
     /// The single accepted token class.
     pub fn token_class(&self) -> &TokenClass {
         &self.token_class
@@ -668,7 +661,6 @@ fn derive_assertion_policy_id(policy: &IssuerPolicy) -> AssertionPolicyId {
     let IssuerPolicy {
         issuer,
         command_audiences,
-        community_audiences,
         token_class,
         freshness,
         algorithms,
@@ -699,10 +691,6 @@ fn derive_assertion_policy_id(policy: &IssuerPolicy) -> AssertionPolicyId {
     }
     hash_field(&mut hasher, issuer.as_bytes());
     hash_seq(&mut hasher, command_audiences.iter().map(String::as_bytes));
-    hash_seq(
-        &mut hasher,
-        community_audiences.iter().map(String::as_bytes),
-    );
     hash_field(&mut hasher, token_class.discriminant().as_bytes());
     match token_class {
         TokenClass::AccessTokenAtJwt { subject_class } => {
@@ -804,7 +792,7 @@ mod jwks_transport_identity_tests {
 
         assert_eq!(
             hex::encode(policy(contract).id().as_bytes()),
-            "1f904aaaad1c1db3a22ae50bd2d24cdf7181d5d0b8c5006cc1ae9ac1107f9832",
+            "fae0dd479d79306c5eef135594f678a5cdf3a2ee45770e20a7e83395fc76857f",
             "public_https mode omits the mesh transport tag"
         );
     }
@@ -820,7 +808,7 @@ mod jwks_transport_identity_tests {
 
         assert_eq!(
             hex::encode(policy(contract).id().as_bytes()),
-            "33e4cf02148ca494c12ffc49cd0bb223e0e007de4084ac5b406f2742bbb91c0a",
+            "dca3e998388ae75bdea6bb2070c8f28b8d389a8b874de96e7852dd1f71b14bcd",
             "mesh transport is part of policy identity"
         );
     }
diff --git a/crates/buzz-auth/src/nip_fi/verifier.rs b/crates/buzz-auth/src/nip_fi/verifier.rs
index 34bd711c28..750c617324 100644
--- a/crates/buzz-auth/src/nip_fi/verifier.rs
+++ b/crates/buzz-auth/src/nip_fi/verifier.rs
@@ -463,7 +463,7 @@ impl<S: IssuerKeySource> FederatedAssertionVerifier<S> {
             asserted_key,
             capabilities,
             deadlines,
-            policy.id(),
+            policy.id_for_community(community.expected_aud()),
             self.transport_contract_id,
             RevalidationDependencies::new(
                 header.kid,
diff --git a/crates/buzz-auth/src/nip_fi/verifier/tests.rs b/crates/buzz-auth/src/nip_fi/verifier/tests.rs
index bdab25370c..77ce87a154 100644
--- a/crates/buzz-auth/src/nip_fi/verifier/tests.rs
+++ b/crates/buzz-auth/src/nip_fi/verifier/tests.rs
@@ -268,7 +268,10 @@ fn valid_access_token_verifies() {
     // Spec v2: nostr_pubkey is injected by mint() and unconditionally required.
     assert!(assertion.asserted_key().is_some());
     assert!(!assertion.authority_deadlines().is_empty());
-    assert_eq!(assertion.assertion_policy_id(), access_token_policy().id());
+    assert_eq!(
+        assertion.assertion_policy_id(),
+        access_token_policy().id_for_community(AUDIENCE)
+    );
 }
 
 // ---- Token class / typ enforcement, ID-token denial ----------------------
@@ -1943,22 +1946,41 @@ fn aud_array_containing_expected_passes() {
 }
 
 #[test]
-fn assertion_policy_id_covers_community_allowlist() {
-    let base = dedicated_policy(ISSUER);
-    let a = base
-        .clone()
-        .authorized_for_communities(vec![AUDIENCE.to_owned(), COMMUNITY_B_AUD.to_owned()]);
-    let permuted = base.clone().authorized_for_communities(vec![
-        COMMUNITY_B_AUD.to_owned(),
-        AUDIENCE.to_owned(),
-        AUDIENCE.to_owned(),
-    ]);
-    let fewer = base
-        .clone()
-        .authorized_for_communities(vec![AUDIENCE.to_owned()]);
-    assert_ne!(base.id(), a.id());
-    assert_eq!(a.id(), permuted.id());
-    assert_ne!(a.id(), fewer.id());
+fn assertion_policy_id_covers_community_audience_and_issuer() {
+    let policy = dedicated_policy(ISSUER);
+    let other_issuer = dedicated_policy("https://other-issuer.example");
+    let here = policy.id_for_community(AUDIENCE);
+    // Stable for one (base policy, community, issuer) association.
+    assert_eq!(here, policy.clone().id_for_community(AUDIENCE));
+    // A different community `aud` or issuer moves the ID.
+    assert_ne!(here, policy.id_for_community(COMMUNITY_B_AUD));
+    assert_ne!(here, other_issuer.id_for_community(AUDIENCE));
+    // The per-community ID is not the bare base-policy ID.
+    assert_ne!(here, policy.id());
+}
+
+#[test]
+fn verified_assertion_carries_the_per_community_policy_id() {
+    let verifier = verifier_with(dedicated_policy(ISSUER));
+    let token = mint(Some("nip-fi+jwt"), TEST_KID, json!({ "sub": "user-123" }));
+    let assertion = verifier
+        .verify(&token, &community(AUDIENCE, &[ISSUER]))
+        .expect("verifies");
+    // An unrelated community authorizing the same issuer leaves it unchanged.
+    let unchanged = verifier
+        .verify(
+            &token,
+            &community(AUDIENCE, &[ISSUER, "https://unrelated.example"]),
+        )
+        .expect("verifies");
+    assert_eq!(
+        assertion.assertion_policy_id(),
+        dedicated_policy(ISSUER).id_for_community(AUDIENCE)
+    );
+    assert_eq!(
+        assertion.assertion_policy_id(),
+        unchanged.assertion_policy_id()
+    );
 }
 
 #[test]
diff --git a/crates/buzz-core/src/filter.rs b/crates/buzz-core/src/filter.rs
index 32e3a7ad16..43753df94d 100644
--- a/crates/buzz-core/src/filter.rs
+++ b/crates/buzz-core/src/filter.rs
@@ -12,9 +12,9 @@ pub fn filters_match(filters: &[Filter], event: &StoredEvent) -> bool {
 }
 
 /// Result-level read authorization for relay-signed events whose content is
-/// private to a single viewer. Currently gates `KIND_DM_VISIBILITY` and
-/// `KIND_AGENT_TURN_METRIC`: the reader MUST equal the event's `#p` tag
-/// (owner). Returns `true` for every other kind.
+/// private to a single viewer: the kinds in
+/// [`crate::kind::RESULT_GATED_KINDS`]. The reader MUST equal the event's
+/// `#p` tag (owner). Returns `true` for every other kind.
 ///
 /// This guards every delivery surface — WS historical pull (`req.rs`), HTTP
 /// bridge (`bridge.rs`), and live fan-out (`event.rs`) — so a query that
@@ -22,7 +22,7 @@ pub fn filters_match(filters: &[Filter], event: &StoredEvent) -> bool {
 /// a known event id) still cannot read another user's private event.
 pub fn reader_authorized_for_event(event: &nostr::Event, reader_pubkey_hex: &str) -> bool {
     let kind = crate::kind::event_kind_u32(event);
-    if kind != crate::kind::KIND_DM_VISIBILITY && kind != crate::kind::KIND_AGENT_TURN_METRIC {
+    if !crate::kind::RESULT_GATED_KINDS.contains(&kind) {
         return true;
     }
     let p = nostr::SingleLetterTag::lowercase(nostr::Alphabet::P);
@@ -32,7 +32,77 @@ pub fn reader_authorized_for_event(event: &nostr::Event, reader_pubkey_hex: &str
         .any(|t| t.content() == Some(reader_pubkey_hex))
 }
 
+/// The membership notice kinds (44100 added, 44101 removed). Only the relay
+/// signs them, and it tags each one with its channel's type:
+/// `["t", <channel_type>]` (NIP-CL).
+pub const MEMBERSHIP_NOTICE_KINDS: [u32; 2] = [
+    crate::kind::KIND_MEMBER_ADDED_NOTIFICATION,
+    crate::kind::KIND_MEMBER_REMOVED_NOTIFICATION,
+];
+
+/// The tag name that carries a membership notice's channel type.
+pub const NOTICE_CHANNEL_TYPE_TAG: &str = "t";
+
+/// The channel types that clients knew before NIP-CL typed membership
+/// notices. A filter without `#t` sees notices only about these types, and a
+/// notice without a type tag (stored before NIP-CL) counts as all of them.
+///
+/// Frozen. Do not add a type here: a type added later stays hidden from every
+/// client that does not name it in `#t`.
+pub const LEGACY_NOTICE_CHANNEL_TYPES: [&str; 4] = ["stream", "forum", "dm", "workflow"];
+
+/// Whether `event` is a membership notice (kind 44100/44101).
+pub fn is_membership_notice(event: &nostr::Event) -> bool {
+    MEMBERSHIP_NOTICE_KINDS.contains(&crate::kind::event_kind_u32(event))
+}
+
+/// The channel types whose membership notices `filter` may see: its `#t`
+/// values, or [`LEGACY_NOTICE_CHANNEL_TYPES`] when it has no `#t`.
+///
+/// This is the one rule for notice visibility (NIP-CL). [`filters_match`]
+/// applies it, and `EventQuery::notice_channel_types` applies it in SQL.
+pub fn notice_channel_types(filter: &Filter) -> Option<Vec<String>> {
+    filter
+        .generic_tags
+        .get(&nostr::SingleLetterTag::lowercase(nostr::Alphabet::T))
+        .map(|values| values.iter().map(ToString::to_string).collect())
+}
+
+/// Whether a filter whose visible types are `visible` (see
+/// [`notice_channel_types`]) may see membership notice `event`.
+///
+/// A tagged notice matches when one of its types is visible. An untagged
+/// notice is a legacy type, so it matches when a legacy type is visible.
+pub fn notice_visible(visible: Option<&[String]>, event: &nostr::Event) -> bool {
+    let is_visible = |channel_type: &str| match visible {
+        Some(types) => types.iter().any(|t| t == channel_type),
+        None => LEGACY_NOTICE_CHANNEL_TYPES.contains(&channel_type),
+    };
+    let mut tagged = false;
+    for tag in event.tags.iter() {
+        let tag = tag.as_slice();
+        if tag.first().map(String::as_str) != Some(NOTICE_CHANNEL_TYPE_TAG) {
+            continue;
+        }
+        tagged = true;
+        if tag
+            .get(1)
+            .is_some_and(|channel_type| is_visible(channel_type))
+        {
+            return true;
+        }
+    }
+    !tagged && LEGACY_NOTICE_CHANNEL_TYPES.iter().any(|t| is_visible(t))
+}
+
 fn filter_match_one(f: &Filter, ev: &StoredEvent) -> bool {
+    // A membership notice's `#t` is its channel type, matched by the notice
+    // rule above instead of the plain tag match below.
+    let notice = is_membership_notice(&ev.event);
+    if notice && !notice_visible(notice_channel_types(f).as_deref(), &ev.event) {
+        return false;
+    }
+
     if let Some(kinds) = &f.kinds {
         if !kinds.contains(&ev.event.kind) {
             return false;
@@ -67,6 +137,9 @@ fn filter_match_one(f: &Filter, ev: &StoredEvent) -> bool {
 
     for (tag_key, tag_values) in f.generic_tags.iter() {
         let tag_key_str = tag_key.to_string();
+        if notice && tag_key_str == NOTICE_CHANNEL_TYPE_TAG {
+            continue;
+        }
         let has_match = tag_values.iter().any(|filter_val| {
             ev.event
                 .tags
@@ -119,6 +192,88 @@ mod tests {
         StoredEvent::with_received_at(event, Utc::now(), None, true)
     }
 
+    #[test]
+    fn a_notice_matches_only_filters_that_know_its_channel_type() {
+        let relay = Keys::generate();
+        let member = Keys::generate().public_key();
+        let notice = |kind: u32, channel_type: Option<&str>| {
+            let mut tags = vec![
+                Tag::parse(["p", &member.to_hex()]).unwrap(),
+                Tag::parse(["h", "c"]).unwrap(),
+            ];
+            if let Some(channel_type) = channel_type {
+                tags.push(Tag::parse([NOTICE_CHANNEL_TYPE_TAG, channel_type]).unwrap());
+            }
+            let event = EventBuilder::new(Kind::Custom(kind as u16), "")
+                .tags(tags)
+                .sign_with_keys(&relay)
+                .expect("sign");
+            StoredEvent::with_received_at(event, Utc::now(), None, true)
+        };
+        let filter = |json: serde_json::Value| -> Filter { serde_json::from_value(json).unwrap() };
+        let p = member.to_hex();
+        let all = ["stream", "forum", "dm", "workflow", "system"];
+        // (filter, sees untagged, stream, system, a type added later)
+        let cases = [
+            (
+                serde_json::json!({"kinds": [44100, 44101], "#p": [p]}),
+                [true, true, false, false],
+            ),
+            (serde_json::json!({"#p": [p]}), [true, true, false, false]),
+            (serde_json::json!({}), [true, true, false, false]),
+            (
+                serde_json::json!({"#t": ["other"]}),
+                [false, false, false, false],
+            ),
+            (
+                serde_json::json!({"kinds": [44100, 44101], "#p": [p], "#t": all}),
+                [true, true, true, false],
+            ),
+            (
+                serde_json::json!({"#t": ["system"]}),
+                [false, false, true, false],
+            ),
+            (
+                serde_json::json!({"#t": ["dm"]}),
+                [true, false, false, false],
+            ),
+            (
+                serde_json::json!({"#t": ["future"]}),
+                [false, false, false, true],
+            ),
+        ];
+        for kind in MEMBERSHIP_NOTICE_KINDS {
+            let notices = [
+                notice(kind, None),
+                notice(kind, Some("stream")),
+                notice(kind, Some("system")),
+                notice(kind, Some("future")),
+            ];
+            for (json, expected) in &cases {
+                let f = filter(json.clone());
+                for (ev, expected) in notices.iter().zip(expected) {
+                    assert_eq!(
+                        filters_match(std::slice::from_ref(&f), ev),
+                        *expected,
+                        "kind {kind}, filter {json}, notice {:?}",
+                        ev.event.tags
+                    );
+                }
+            }
+        }
+        // Other kinds keep the plain `#t` match.
+        let other = notice(44200, Some("system"));
+        assert!(filters_match(&[filter(serde_json::json!({}))], &other));
+        assert!(filters_match(
+            &[filter(serde_json::json!({"#t": ["system"]}))],
+            &other
+        ));
+        assert!(!filters_match(
+            &[filter(serde_json::json!({"#t": ["stream"]}))],
+            &other
+        ));
+    }
+
     #[test]
     fn kind_author_since_until_tag_matching() {
         let keys = Keys::generate();
diff --git a/crates/buzz-core/src/kind.rs b/crates/buzz-core/src/kind.rs
index e645dea011..e9e2dfa5e7 100644
--- a/crates/buzz-core/src/kind.rs
+++ b/crates/buzz-core/src/kind.rs
@@ -169,9 +169,20 @@ pub fn k_tag_kinds(event: &nostr::Event) -> impl Iterator<Item = u32> + '_ {
 /// `#p` tag to receive the event. This closes the kindless `{ids:[…]}` read
 /// path for events whose existence must not be leaked.
 ///
-/// Used by `filter_can_match_result_gated_kinds` to force the per-event
-/// fallback path in COUNT rather than the fast SQL `count_events()`.
-pub const RESULT_GATED_KINDS: &[u32] = &[KIND_DM_VISIBILITY, KIND_AGENT_TURN_METRIC];
+/// Membership notices (44100/44101) are here because the relay signs them, so
+/// their id is not author-bound, and they name the target, the channel and
+/// the actor. A system channel's notice must not reach anyone but its target.
+///
+/// This is the one list every delivery surface reads: the filter-level `ids`
+/// exemption, `reader_authorized_for_event` (WS/HTTP history, push), live
+/// fan-out (same pod and Redis), and the COUNT fallback
+/// (`filter_can_match_result_gated_kinds`).
+pub const RESULT_GATED_KINDS: &[u32] = &[
+    KIND_DM_VISIBILITY,
+    KIND_AGENT_TURN_METRIC,
+    KIND_MEMBER_ADDED_NOTIFICATION,
+    KIND_MEMBER_REMOVED_NOTIFICATION,
+];
 
 /// Kinds whose stored events have `#p`-bound read access — readable only by
 /// subscribers whose pubkey appears in the event's `#p` tag.
diff --git a/crates/buzz-db/src/lib.rs b/crates/buzz-db/src/lib.rs
index 459ddd48ed..e13b06c81d 100644
--- a/crates/buzz-db/src/lib.rs
+++ b/crates/buzz-db/src/lib.rs
@@ -82,7 +82,7 @@ pub use community::{
 pub use error::{DbError, Result};
 pub use event::{ChannelHeadPrecondition, ChannelHeadWriteStatus};
 pub use event::{EventQuery, DEFAULT_MAX_PAGE_LIMIT};
-pub use nip_fi_binding::{NipFiBindingRecord, NipFiUnbind};
+pub use nip_fi_binding::{NipFiBindingRecord, NipFiUnbind, RowCapExceeded};
 pub use reaction::ReactionEventInsertOutcome;
 pub use reminder::DueReminder;
 pub use usage::UsageMetricsLeader;
diff --git a/crates/buzz-db/src/store/channel.rs b/crates/buzz-db/src/store/channel.rs
index cf8d15094e..e456f46dfb 100644
--- a/crates/buzz-db/src/store/channel.rs
+++ b/crates/buzz-db/src/store/channel.rs
@@ -10,7 +10,7 @@ use uuid::Uuid;
 
 use crate::error::{DbError, Result};
 use crate::Db;
-use buzz_core::CommunityId;
+use buzz_core::{CommunityId, StoredEvent};
 use buzz_datastore_tracing::datastore_span;
 
 // Re-export the canonical enum definitions from buzz-core.
@@ -200,6 +200,143 @@ pub async fn create_channel_with_id(
     ttl_seconds: Option<i32>,
     labels: &[String],
 ) -> Result<(ChannelRecord, bool)> {
+    let mut tx = crate::begin_community_write_transaction(
+        pool,
+        community_id,
+        crate::observability::WriterOperation::EventWrite,
+    )
+    .await?;
+
+    let was_created = insert_channel_rows(
+        &mut tx,
+        channel_id,
+        NewChannel {
+            name,
+            channel_type,
+            visibility,
+            description,
+            created_by,
+            ttl_seconds,
+            labels,
+            members: &[],
+        },
+    )
+    .await?;
+
+    let row = sqlx::query(
+        r#"
+        SELECT id, name, channel_type::text AS channel_type, visibility::text AS visibility,
+               description, canvas,
+               created_by, created_at, updated_at, archived_at, deleted_at,
+               nip29_group_id, topic_required, max_members,
+               topic, topic_set_by, topic_set_at,
+               purpose, purpose_set_by, purpose_set_at,
+               ttl_seconds, ttl_deadline, labels
+        FROM channels WHERE community_id = $1 AND id = $2
+        "#,
+    )
+    .bind(community_id.as_uuid())
+    .bind(channel_id)
+    .fetch_one(tx.conn())
+    .await?;
+
+    let record = row_to_channel_record(row)?;
+    tx.commit().await?;
+    Ok((record, was_created))
+}
+
+/// A channel to create: the fields a kind:9007 sets.
+pub struct NewChannel<'a> {
+    /// Display name, canonicalized before storage.
+    pub name: &'a str,
+    /// Stream, forum, DM, …
+    pub channel_type: ChannelType,
+    /// Open or private.
+    pub visibility: ChannelVisibility,
+    /// The `about` text.
+    pub description: Option<&'a str>,
+    /// The creator's 32-byte pubkey; becomes the owner.
+    pub created_by: &'a [u8],
+    /// Ephemeral channel lifetime.
+    pub ttl_seconds: Option<i32>,
+    /// Labels validated by `buzz_core::channel::parse_channel_labels`.
+    pub labels: &'a [String],
+    /// 32-byte pubkeys added as ordinary members invited by the creator. The
+    /// caller has authorized each addition.
+    pub members: &'a [Vec<u8>],
+}
+
+/// What [`Db::create_channel_with_event`] did.
+#[derive(Debug)]
+pub enum ChannelCreate {
+    /// The channel, its members and the create event committed together.
+    Created(Box<StoredEvent>),
+    /// The UUID was already taken and nothing was written. `resent` is true
+    /// when the stored create that took it is this same event.
+    Exists {
+        /// This exact event is the channel's stored create.
+        resent: bool,
+    },
+}
+
+/// See [`Db::create_channel_with_event`].
+pub(crate) async fn create_channel_with_event(
+    pool: &PgPool,
+    push_enqueue: Option<crate::runtime::push_enqueue::PushEnqueue>,
+    community_id: CommunityId,
+    channel_id: Uuid,
+    channel: NewChannel<'_>,
+    event: &nostr::Event,
+) -> Result<ChannelCreate> {
+    let mut tx = crate::begin_community_event_write_transaction(
+        pool,
+        community_id,
+        crate::observability::WriterOperation::EventWrite,
+    )
+    .await?;
+    tx.set_push_enqueue(push_enqueue);
+
+    if !insert_channel_rows(&mut tx, channel_id, channel).await? {
+        let resent = sqlx::query(
+            "SELECT 1 FROM events WHERE community_id = $1 AND id = $2 AND deleted_at IS NULL LIMIT 1",
+        )
+        .bind(community_id.as_uuid())
+        .bind(event.id.as_bytes().as_slice())
+        .fetch_optional(tx.conn())
+        .await?
+        .is_some();
+        return Ok(ChannelCreate::Exists { resent });
+    }
+
+    // The same writes as `Db::insert_event_with_thread_metadata`.
+    let (stored, inserted) =
+        crate::event::insert_event_with_thread_metadata_tx(&mut tx, event, Some(channel_id), None)
+            .await?;
+    if inserted {
+        crate::insert_mentions_in_transaction(&mut tx, event, Some(channel_id)).await?;
+    }
+    tx.commit().await?;
+    Ok(ChannelCreate::Created(Box::new(stored)))
+}
+
+/// Inserts the channel row, its owner and its initial members on `tx`.
+/// Returns `false`, having written nothing, when `channel_id` already exists.
+async fn insert_channel_rows(
+    tx: &mut crate::AdmittedTx,
+    channel_id: Uuid,
+    channel: NewChannel<'_>,
+) -> Result<bool> {
+    let NewChannel {
+        name,
+        channel_type,
+        visibility,
+        description,
+        created_by,
+        ttl_seconds,
+        labels,
+        members,
+    } = channel;
+    let community_id = tx.community();
     if created_by.len() != 32 {
         return Err(DbError::InvalidData(format!(
             "pubkey must be 32 bytes, got {}",
@@ -218,13 +355,6 @@ pub async fn create_channel_with_id(
         return Err(DbError::InvalidData("channel name is required".into()));
     }
 
-    let mut tx = crate::begin_community_write_transaction(
-        pool,
-        community_id,
-        crate::observability::WriterOperation::EventWrite,
-    )
-    .await?;
-
     let rows_affected = sqlx::query(
         r#"
         INSERT INTO channels (id, community_id, name, channel_type, visibility, description, created_by, ttl_seconds, ttl_deadline, labels)
@@ -266,28 +396,34 @@ pub async fn create_channel_with_id(
         .bind(created_by)
         .execute(tx.conn())
         .await?;
+
+        for member in members
+            .iter()
+            .filter(|member| member.as_slice() != created_by)
+        {
+            if member.len() != 32 {
+                return Err(DbError::InvalidData(format!(
+                    "pubkey must be 32 bytes, got {}",
+                    member.len()
+                )));
+            }
+            sqlx::query(
+                r#"
+                INSERT INTO channel_members (community_id, channel_id, pubkey, role, invited_by)
+                VALUES ($1, $2, $3, 'member', $4)
+                ON CONFLICT (community_id, channel_id, pubkey) DO NOTHING
+                "#,
+            )
+            .bind(community_id.as_uuid())
+            .bind(channel_id)
+            .bind(member)
+            .bind(created_by)
+            .execute(tx.conn())
+            .await?;
+        }
     }
 
-    let row = sqlx::query(
-        r#"
-        SELECT id, name, channel_type::text AS channel_type, visibility::text AS visibility,
-               description, canvas,
-               created_by, created_at, updated_at, archived_at, deleted_at,
-               nip29_group_id, topic_required, max_members,
-               topic, topic_set_by, topic_set_at,
-               purpose, purpose_set_by, purpose_set_at,
-               ttl_seconds, ttl_deadline, labels
-        FROM channels WHERE community_id = $1 AND id = $2
-        "#,
-    )
-    .bind(community_id.as_uuid())
-    .bind(channel_id)
-    .fetch_one(tx.conn())
-    .await?;
-
-    let record = row_to_channel_record(row)?;
-    tx.commit().await?;
-    Ok((record, was_created))
+    Ok(was_created)
 }
 
 /// Fetches a channel record by `(community_id, id)`. Returns `ChannelNotFound` if missing or deleted.
@@ -955,35 +1091,28 @@ impl Db {
         .await
     }
 
-    /// Creates a channel with a client-supplied UUID and an initial label set.
+    /// Creates `channel_id` from its kind:9007 `event`: the channel, its
+    /// owner, its initial members and the event itself commit in one
+    /// transaction, so a channel row always has its create event beside it.
     ///
-    /// The same as [`Db::create_channel_with_id`], plus `labels`, which the
-    /// caller has validated with `buzz_core::channel::parse_channel_labels`.
-    #[allow(clippy::too_many_arguments)]
-    #[datastore_span(name = "create_labeled_channel_with_id", system = "postgresql")]
-    pub async fn create_labeled_channel_with_id(
+    /// A concurrent copy of the same create waits on the first one's channel
+    /// insert, then sees either the committed event (`Exists { resent: true }`)
+    /// or, if the first rolled back, an untaken UUID.
+    #[datastore_span(name = "create_channel_with_event", system = "postgresql")]
+    pub async fn create_channel_with_event(
         &self,
         community_id: CommunityId,
         channel_id: Uuid,
-        name: &str,
-        channel_type: ChannelType,
-        visibility: ChannelVisibility,
-        description: Option<&str>,
-        created_by: &[u8],
-        ttl_seconds: Option<i32>,
-        labels: &[String],
-    ) -> Result<(ChannelRecord, bool)> {
-        create_channel_with_id(
+        channel: NewChannel<'_>,
+        event: &nostr::Event,
+    ) -> Result<ChannelCreate> {
+        create_channel_with_event(
             &self.pool,
+            self.push_enqueue.clone(),
             community_id,
             channel_id,
-            name,
-            channel_type,
-            visibility,
-            description,
-            created_by,
-            ttl_seconds,
-            labels,
+            channel,
+            event,
         )
         .await
     }
@@ -1426,4 +1555,210 @@ mod postgres_tests {
             "reaper should carry the archived row's community id and host"
         );
     }
+
+    fn create_event(creator: &Keys, channel_id: Uuid) -> nostr::Event {
+        nostr::EventBuilder::new(nostr::Kind::Custom(9007), "")
+            .tags([
+                nostr::Tag::parse(["h", &channel_id.to_string()]).expect("h tag"),
+                nostr::Tag::parse(["name", "start"]).expect("name tag"),
+            ])
+            .sign_with_keys(creator)
+            .expect("sign 9007")
+    }
+
+    fn new_channel<'a>(created_by: &'a [u8], members: &'a [Vec<u8>]) -> NewChannel<'a> {
+        NewChannel {
+            name: "start",
+            channel_type: ChannelType::Stream,
+            visibility: ChannelVisibility::Private,
+            description: None,
+            created_by,
+            ttl_seconds: None,
+            labels: &[],
+            members,
+        }
+    }
+
+    /// Holds a create open on its own transaction (channel row and event both
+    /// written, not committed) while the same create runs again beside it.
+    async fn resend_beside_open_create(commit_first: bool) -> ChannelCreate {
+        let pool = setup_pool().await;
+        let community = CommunityId::from_uuid(make_test_community(&pool).await);
+        let creator = Keys::generate();
+        let creator_bytes = creator.public_key().to_bytes().to_vec();
+        let members = vec![random_pubkey()];
+        let channel_id = Uuid::new_v4();
+        let event = create_event(&creator, channel_id);
+
+        let mut first = crate::begin_community_write_transaction(
+            &pool,
+            community,
+            crate::observability::WriterOperation::EventWrite,
+        )
+        .await
+        .expect("begin first create");
+        assert!(insert_channel_rows(
+            &mut first,
+            channel_id,
+            new_channel(&creator_bytes, &members)
+        )
+        .await
+        .expect("first create's rows"));
+        crate::event::insert_event_with_thread_metadata_tx(
+            &mut first,
+            &event,
+            Some(channel_id),
+            None,
+        )
+        .await
+        .expect("first create's event");
+
+        let resend = tokio::spawn({
+            let (pool, event, creator_bytes, members) = (
+                pool.clone(),
+                event.clone(),
+                creator_bytes.clone(),
+                members.clone(),
+            );
+            async move {
+                create_channel_with_event(
+                    &pool,
+                    None,
+                    community,
+                    channel_id,
+                    new_channel(&creator_bytes, &members),
+                    &event,
+                )
+                .await
+            }
+        });
+        tokio::time::sleep(std::time::Duration::from_millis(300)).await;
+        assert!(
+            !resend.is_finished(),
+            "the resend waits for the open create instead of answering early"
+        );
+
+        if commit_first {
+            first.commit().await.expect("commit first create");
+        } else {
+            drop(first);
+        }
+        let outcome = resend.await.expect("resend task").expect("resend outcome");
+        let roster = sqlx::query_scalar::<_, Vec<u8>>(
+            "SELECT pubkey FROM channel_members WHERE community_id = $1 AND channel_id = $2 \
+             AND removed_at IS NULL ORDER BY pubkey",
+        )
+        .bind(community.as_uuid())
+        .bind(channel_id)
+        .fetch_all(&pool)
+        .await
+        .expect("roster");
+        let mut expected = vec![creator_bytes, members[0].clone()];
+        expected.sort();
+        assert_eq!(
+            roster, expected,
+            "the channel has its owner and member once"
+        );
+        outcome
+    }
+
+    #[tokio::test]
+    #[ignore = "requires Postgres"]
+    async fn a_resend_beside_an_open_create_confirms_it_once_committed() {
+        let outcome = resend_beside_open_create(true).await;
+        assert!(
+            matches!(outcome, ChannelCreate::Exists { resent: true }),
+            "{outcome:?}"
+        );
+    }
+
+    #[tokio::test]
+    #[ignore = "requires Postgres"]
+    async fn a_resend_beside_a_failed_create_creates_the_channel() {
+        let outcome = resend_beside_open_create(false).await;
+        assert!(matches!(outcome, ChannelCreate::Created(_)), "{outcome:?}");
+    }
+
+    #[tokio::test]
+    #[ignore = "requires Postgres"]
+    async fn a_create_whose_event_fails_leaves_no_channel() {
+        let pool = setup_pool().await;
+        let community = CommunityId::from_uuid(make_test_community(&pool).await);
+        let creator = Keys::generate();
+        let creator_bytes = creator.public_key().to_bytes().to_vec();
+        let channel_id = Uuid::new_v4();
+        // An ephemeral kind is refused by the event insert, after the rows.
+        let unstorable = nostr::EventBuilder::new(nostr::Kind::Custom(20_000), "")
+            .sign_with_keys(&creator)
+            .expect("sign");
+        let members = [random_pubkey()];
+        create_channel_with_event(
+            &pool,
+            None,
+            community,
+            channel_id,
+            new_channel(&creator_bytes, &members),
+            &unstorable,
+        )
+        .await
+        .expect_err("the event insert fails");
+        assert!(
+            get_channel(&pool, community, channel_id).await.is_err(),
+            "the channel rolls back with its event"
+        );
+        let retry = create_channel_with_event(
+            &pool,
+            None,
+            community,
+            channel_id,
+            new_channel(&creator_bytes, &members),
+            &create_event(&creator, channel_id),
+        )
+        .await
+        .expect("retry");
+        assert!(matches!(retry, ChannelCreate::Created(_)), "{retry:?}");
+    }
+
+    #[tokio::test]
+    #[ignore = "requires Postgres"]
+    async fn another_create_for_a_taken_channel_writes_nothing() {
+        let pool = setup_pool().await;
+        let community = CommunityId::from_uuid(make_test_community(&pool).await);
+        let creator = Keys::generate();
+        let creator_bytes = creator.public_key().to_bytes().to_vec();
+        let channel_id = Uuid::new_v4();
+        let first = create_channel_with_event(
+            &pool,
+            None,
+            community,
+            channel_id,
+            new_channel(&creator_bytes, &[]),
+            &create_event(&creator, channel_id),
+        )
+        .await
+        .expect("first create");
+        assert!(matches!(first, ChannelCreate::Created(_)), "{first:?}");
+
+        let other = Keys::generate();
+        let other_bytes = other.public_key().to_bytes().to_vec();
+        let intruder = random_pubkey();
+        let second = create_channel_with_event(
+            &pool,
+            None,
+            community,
+            channel_id,
+            new_channel(&other_bytes, std::slice::from_ref(&intruder)),
+            &create_event(&other, channel_id),
+        )
+        .await
+        .expect("second create");
+        assert!(
+            matches!(second, ChannelCreate::Exists { resent: false }),
+            "{second:?}"
+        );
+        let members = crate::channel_members::get_members(&pool, community, channel_id)
+            .await
+            .expect("members");
+        assert_eq!(members.len(), 1, "only the first creator is a member");
+    }
 }
diff --git a/crates/buzz-db/src/store/channel_members.rs b/crates/buzz-db/src/store/channel_members.rs
index 4855d32ccc..9e7679e0c3 100644
--- a/crates/buzz-db/src/store/channel_members.rs
+++ b/crates/buzz-db/src/store/channel_members.rs
@@ -1288,8 +1288,29 @@ pub async fn get_readable_system_channel_ids(
         .collect()
 }
 
+/// The type of channel `channel_id`, deleted or not, or `None` when no such
+/// channel exists. Membership notices carry it as their `t` tag (NIP-CL).
+pub async fn channel_type_of(
+    pool: &PgPool,
+    community_id: CommunityId,
+    channel_id: Uuid,
+) -> Result<Option<String>> {
+    let mut connection = crate::observability::acquire_writer(
+        pool,
+        crate::observability::WriterOperation::Authorization,
+    )
+    .await?;
+    Ok(sqlx::query_scalar(
+        "SELECT channel_type::text FROM channels WHERE community_id = $1 AND id = $2",
+    )
+    .bind(community_id.as_uuid())
+    .bind(channel_id)
+    .fetch_optional(&mut *connection)
+    .await?)
+}
+
 /// The IDs in `channel_ids` that name system channels, deleted or not.
-/// Push matching and membership notifications use it to skip them.
+/// Push matching uses it to skip them.
 pub async fn system_channel_ids_among(
     pool: &PgPool,
     community_id: CommunityId,
@@ -1954,6 +1975,17 @@ impl Db {
         get_readable_system_channel_ids(&self.pool, community_id, pubkey).await
     }
 
+    /// The type of channel `channel_id`, deleted or not, or `None` when no
+    /// such channel exists.
+    #[datastore_span(name = "channel_type_of", system = "postgresql")]
+    pub async fn channel_type_of(
+        &self,
+        community_id: CommunityId,
+        channel_id: Uuid,
+    ) -> Result<Option<String>> {
+        channel_type_of(&self.pool, community_id, channel_id).await
+    }
+
     /// The IDs in `channel_ids` that name system channels, deleted or not.
     #[datastore_span(name = "system_channel_ids_among", system = "postgresql")]
     pub async fn system_channel_ids_among(
diff --git a/crates/buzz-db/src/store/community.rs b/crates/buzz-db/src/store/community.rs
index 46d7db6487..71199ffdae 100644
--- a/crates/buzz-db/src/store/community.rs
+++ b/crates/buzz-db/src/store/community.rs
@@ -291,6 +291,40 @@ impl Db {
         .transpose()
     }
 
+    /// Active communities the identity has joined, regardless of role.
+    /// Operator-plane callers must authenticate before exposing this cross-tenant read.
+    #[datastore_span(name = "list_communities_joined_by", system = "postgresql")]
+    pub async fn list_communities_joined_by(&self, pubkey: &str) -> Result<Vec<CommunityRecord>> {
+        let mut connection = crate::observability::acquire_writer(
+            &self.pool,
+            crate::observability::WriterOperation::Authorization,
+        )
+        .await?;
+        let rows = sqlx::query(
+            r#"
+            SELECT c.id, c.host FROM communities c
+            JOIN relay_members rm ON rm.community_id = c.id
+            WHERE rm.pubkey = $1 AND c.archived_at IS NULL
+              AND NOT EXISTS (
+                  SELECT 1 FROM community_deletion_requests request
+                  WHERE request.community_id = c.id AND request.stage <> 'aborted'
+              )
+            ORDER BY c.created_at ASC, c.host ASC
+            "#,
+        )
+        .bind(pubkey.to_ascii_lowercase())
+        .fetch_all(&mut *connection)
+        .await?;
+        rows.into_iter()
+            .map(|row| {
+                Ok(CommunityRecord {
+                    id: CommunityId::from_uuid(row.try_get("id")?),
+                    host: row.try_get("host")?,
+                })
+            })
+            .collect()
+    }
+
     /// Lists communities where `owner_pubkey` currently holds the `owner` role.
     ///
     /// This is an operator-plane helper, not a tenant-scoped data-plane read:
@@ -1587,6 +1621,28 @@ mod postgres_tests {
             crate::relay_members::max_communities_per_owner()
         );
         assert!(owned.can_create);
+
+        // Discovery includes every membership role, while management remains owner-only.
+        let community_d = CommunityId::from_uuid(make_community(&db.pool).await);
+        db.add_relay_member(community_d, owner, "member", None)
+            .await
+            .expect("member D");
+        let joined = db
+            .list_communities_joined_by(&owner.to_uppercase())
+            .await
+            .expect("joined");
+        let ids: Vec<_> = joined.iter().map(|row| row.id).collect();
+        assert_eq!(ids.len(), 3);
+        assert!(ids.contains(&community_a));
+        assert!(ids.contains(&community_c));
+        assert!(ids.contains(&community_d));
+        assert!(!ids.contains(&community_b));
+        sqlx::query("UPDATE communities SET archived_at = NOW() WHERE id = $1")
+            .bind(community_d.as_uuid())
+            .execute(&db.pool)
+            .await
+            .unwrap();
+        assert_eq!(db.list_communities_joined_by(owner).await.unwrap().len(), 2);
     }
 
     #[tokio::test]
diff --git a/crates/buzz-db/src/store/event.rs b/crates/buzz-db/src/store/event.rs
index 209f09e573..da685f6fe6 100644
--- a/crates/buzz-db/src/store/event.rs
+++ b/crates/buzz-db/src/store/event.rs
@@ -125,6 +125,12 @@ pub struct EventQuery {
     /// containment alone would also admit decoys like `["x","shared","true"]`.
     /// `event_visible_to_reader` remains the post-filter.
     pub shared_gated_reader: Option<Vec<u8>>,
+    /// The channel types whose membership notices (44100/44101) the query may
+    /// return: the filter's `#t` values
+    /// ([`buzz_core::filter::notice_channel_types`]). `None` means the legacy
+    /// types only, so a read path that does not set it never returns a notice
+    /// about a type added later, such as a system channel (NIP-CL).
+    pub notice_channel_types: Option<Vec<String>>,
 }
 
 impl EventQuery {
@@ -158,6 +164,7 @@ impl EventQuery {
             channel_ids_include_global: true,
             max_limit: None,
             shared_gated_reader: None,
+            notice_channel_types: None,
         }
     }
 }
@@ -655,6 +662,7 @@ fn build_query_events_sql(q: &EventQuery) -> QueryBuilder<sqlx::Postgres> {
         let table = if q.p_tag_hex.is_some() { "e" } else { "events" };
         qb.push(format!(" AND NOT ({table}.kind = 45010 AND NOT EXISTS (SELECT 1 FROM artifact_heads ah WHERE ah.community_id={table}.community_id AND ah.event_id={table}.id))"));
     }
+    push_notice_visibility(&mut qb, col_prefix, q);
 
     if let Some(ch) = q.channel_id {
         qb.push(format!(" AND {col_prefix}channel_id = "))
@@ -912,6 +920,55 @@ fn push_tag_value_filters(
     }
 }
 
+/// Return only membership notices whose channel type the query may see
+/// (NIP-CL), as [`buzz_core::filter::notice_visible`] does in `filters_match`:
+/// `AND (kind NOT IN (44100, 44101) OR <type tag in visible types>
+/// [OR <no type tag>])`. An untagged notice is a legacy type, so it is kept
+/// only when a legacy type is visible. Pushed before `LIMIT` so hidden rows
+/// cannot take page slots. Skipped when the query's kinds cannot match a
+/// notice.
+fn push_notice_visibility(qb: &mut QueryBuilder<sqlx::Postgres>, col_prefix: &str, q: &EventQuery) {
+    use buzz_core::filter::{
+        LEGACY_NOTICE_CHANNEL_TYPES, MEMBERSHIP_NOTICE_KINDS, NOTICE_CHANNEL_TYPE_TAG,
+    };
+    if let Some(kinds) = q.kinds.as_deref() {
+        if !kinds
+            .iter()
+            .any(|kind| MEMBERSHIP_NOTICE_KINDS.contains(&(*kind as u32)))
+        {
+            return;
+        }
+    }
+    let visible: Vec<String> = match &q.notice_channel_types {
+        Some(types) => types.clone(),
+        None => LEGACY_NOTICE_CHANNEL_TYPES
+            .iter()
+            .map(|t| (*t).to_owned())
+            .collect(),
+    };
+    let untagged_visible = visible
+        .iter()
+        .any(|t| LEGACY_NOTICE_CHANNEL_TYPES.contains(&t.as_str()));
+    let [added, removed] = MEMBERSHIP_NOTICE_KINDS;
+    qb.push(format!(
+        " AND ({col_prefix}kind NOT IN ({added}, {removed}) OR "
+    ));
+    if visible.is_empty() {
+        qb.push("FALSE");
+    } else {
+        push_exact_tag_match(qb, col_prefix, NOTICE_CHANNEL_TYPE_TAG, &visible);
+    }
+    if untagged_visible {
+        qb.push(format!(
+            " OR NOT EXISTS (SELECT 1 FROM jsonb_array_elements({col_prefix}tags) AS tag \
+             WHERE tag->>0 = "
+        ))
+        .push_bind(NOTICE_CHANNEL_TYPE_TAG.to_owned())
+        .push(")");
+    }
+    qb.push(")");
+}
+
 /// Match `#d` on artifact rows before `LIMIT` while leaving other kinds to the
 /// caller's post-filter: `(kind NOT IN (artifact kinds) OR <exact d match>)`.
 fn push_artifact_d_tag_predicate(
@@ -1030,6 +1087,7 @@ pub(crate) async fn count_events_on(conn: &mut sqlx::PgConnection, q: &EventQuer
         let table = if q.p_tag_hex.is_some() { "e" } else { "events" };
         qb.push(format!(" AND NOT ({table}.kind = 45010 AND NOT EXISTS (SELECT 1 FROM artifact_heads ah WHERE ah.community_id={table}.community_id AND ah.event_id={table}.id))"));
     }
+    push_notice_visibility(&mut qb, col_prefix, q);
 
     if let Some(ch) = q.channel_id {
         qb.push(format!(" AND {col_prefix}channel_id = "))
diff --git a/crates/buzz-db/src/store/nip_fi_binding.rs b/crates/buzz-db/src/store/nip_fi_binding.rs
index 3f49f5c875..1e193e2b4c 100644
--- a/crates/buzz-db/src/store/nip_fi_binding.rs
+++ b/crates/buzz-db/src/store/nip_fi_binding.rs
@@ -311,6 +311,86 @@ impl Db {
     }
 }
 
+/// A snapshot load produced more rows than its cap allows.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, thiserror::Error)]
+#[error("row cap of {0} exceeded")]
+pub struct RowCapExceeded(pub usize);
+
+impl Db {
+    /// Read every binding of an active community to an issuer in `registry`,
+    /// on the primary, as `(host, issuer)` rows, one per community-issuer
+    /// pair. It is one `SELECT`, so every row comes from the same statement
+    /// snapshot. The read stops at the `max_rows + 1`st row and fails.
+    #[datastore_span(name = "load_nip_fi_binding_snapshot", system = "postgresql")]
+    pub async fn load_nip_fi_binding_snapshot(
+        &self,
+        registry: &[String],
+        max_rows: usize,
+    ) -> Result<std::result::Result<Vec<(String, String)>, RowCapExceeded>> {
+        use futures_util::StreamExt;
+        let mut connection = crate::observability::acquire_writer(
+            &self.pool,
+            crate::observability::WriterOperation::Authorization,
+        )
+        .await?;
+        let mut stream = sqlx::query_as::<_, (String, String)>(
+            r#"
+            SELECT c.host, b.issuer
+            FROM community_nip_fi_issuers b
+            JOIN communities c ON c.id = b.community_id
+            WHERE b.issuer = ANY($1)
+              AND c.archived_at IS NULL
+              AND c.deletion_state = 'active'
+              AND c.deleted_at IS NULL
+            "#,
+        )
+        .bind(registry)
+        .fetch(&mut *connection);
+        let mut rows = Vec::new();
+        while let Some(row) = stream.next().await {
+            if rows.len() == max_rows {
+                return Ok(Err(RowCapExceeded(max_rows)));
+            }
+            rows.push(row?);
+        }
+        Ok(Ok(rows))
+    }
+
+    /// The registry-filtered issuers bound to the active community at
+    /// `normalized_host`, on the primary. Empty when the host is unknown,
+    /// inactive, or bound only to unregistered issuers. The primary key
+    /// `(community_id, issuer)` bounds the result at `registry.len()` rows.
+    #[datastore_span(name = "lookup_nip_fi_admission_binding", system = "postgresql")]
+    pub async fn lookup_nip_fi_admission_binding(
+        &self,
+        normalized_host: &str,
+        registry: &[String],
+    ) -> Result<Vec<String>> {
+        let mut connection = crate::observability::acquire_writer(
+            &self.pool,
+            crate::observability::WriterOperation::Authorization,
+        )
+        .await?;
+        let issuers = sqlx::query_scalar::<_, String>(
+            r#"
+            SELECT b.issuer
+            FROM community_nip_fi_issuers b
+            JOIN communities c ON c.id = b.community_id
+            WHERE lower(c.host) = lower($1)
+              AND b.issuer = ANY($2)
+              AND c.archived_at IS NULL
+              AND c.deletion_state = 'active'
+              AND c.deleted_at IS NULL
+            "#,
+        )
+        .bind(normalized_host)
+        .bind(registry)
+        .fetch_all(&mut *connection)
+        .await?;
+        Ok(issuers)
+    }
+}
+
 #[cfg(test)]
 mod postgres_tests {
     use super::*;
@@ -643,4 +723,129 @@ mod postgres_tests {
         );
         assert_eq!(bound(&db, &unique_host("missing")).await, None);
     }
+
+    /// Move `host`'s community out of `active` the way the deletion executor
+    /// does: the tombstone trigger admits the state change only under the
+    /// executor's community and fence-generation settings.
+    async fn start_deleting(db: &Db, host: &str) {
+        let mut tx = db.pool.begin().await.expect("begin");
+        let id: Uuid = sqlx::query_scalar("SELECT id FROM communities WHERE host = $1")
+            .bind(host)
+            .fetch_one(&mut *tx)
+            .await
+            .expect("community id");
+        sqlx::query("SELECT set_config('buzz.deletion_executor_community', $1, true), set_config('buzz.deletion_fence_generation', '1', true)")
+            .bind(id.to_string())
+            .execute(&mut *tx)
+            .await
+            .expect("executor settings");
+        sqlx::query("UPDATE communities SET deletion_state = 'quiescing', deletion_fence_generation = 1 WHERE id = $1")
+            .bind(id)
+            .execute(&mut *tx)
+            .await
+            .expect("start deletion");
+        tx.commit().await.expect("commit");
+    }
+
+    async fn snapshot_hosts(db: &Db, registry: &[String]) -> Vec<String> {
+        db.load_nip_fi_binding_snapshot(registry, 100_000)
+            .await
+            .expect("snapshot")
+            .expect("under cap")
+            .into_iter()
+            .map(|(host, _)| host)
+            .collect()
+    }
+
+    async fn admission(db: &Db, host: &str, registry: &[String]) -> Vec<String> {
+        db.lookup_nip_fi_admission_binding(host, registry)
+            .await
+            .expect("admission lookup")
+    }
+
+    // Criterion 14(a): archived and deleting communities drop out of both the
+    // snapshot load and the admission miss lookup; an active control stays.
+    #[tokio::test]
+    #[ignore = "requires Postgres"]
+    async fn snapshot_and_admission_lookup_skip_archived_and_deleting_communities() {
+        let db = setup_db().await;
+        let registry = issuers();
+        let [archived, deleting, control] = ["archived", "deleting", "control"].map(unique_host);
+        for host in [&archived, &deleting, &control] {
+            db.ensure_configured_community_with_nip_fi_issuers(host, &registry)
+                .await
+                .expect("seed");
+            assert!(snapshot_hosts(&db, &registry).await.contains(host));
+            assert_eq!(admission(&db, host, &registry).await, registry);
+        }
+
+        sqlx::query("UPDATE communities SET archived_at = now() WHERE host = $1")
+            .bind(&archived)
+            .execute(&db.pool)
+            .await
+            .expect("archive");
+        start_deleting(&db, &deleting).await;
+
+        let hosts = snapshot_hosts(&db, &registry).await;
+        for gone in [&archived, &deleting] {
+            assert!(!hosts.contains(gone), "{gone} must leave the snapshot");
+            assert!(admission(&db, gone, &registry).await.is_empty(), "{gone}");
+        }
+        assert!(hosts.contains(&control));
+        assert_eq!(admission(&db, &control, &registry).await, registry);
+    }
+
+    // Criterion 17(a)(1): only registered issuers come back, and a host bound
+    // only to unregistered issuers yields zero rows from the real SQL.
+    #[tokio::test]
+    #[ignore = "requires Postgres"]
+    async fn admission_lookup_returns_only_registered_issuers() {
+        let db = setup_db().await;
+        let other = "https://unregistered.example".to_string();
+        let mixed = unique_host("mixed");
+        let foreign = unique_host("foreign");
+        db.ensure_configured_community_with_nip_fi_issuers(
+            &mixed,
+            &[ISS.to_string(), other.clone()],
+        )
+        .await
+        .expect("seed mixed");
+        db.ensure_configured_community_with_nip_fi_issuers(&foreign, std::slice::from_ref(&other))
+            .await
+            .expect("seed foreign");
+
+        assert_eq!(
+            admission(&db, &mixed.to_uppercase(), &issuers()).await,
+            issuers()
+        );
+        assert!(admission(&db, &foreign, &issuers()).await.is_empty());
+        assert!(!snapshot_hosts(&db, &issuers()).await.contains(&foreign));
+    }
+
+    // The load fails at the `max_rows + 1`st row instead of truncating.
+    #[tokio::test]
+    #[ignore = "requires Postgres"]
+    async fn snapshot_load_over_its_row_cap_fails() {
+        let db = setup_db().await;
+        let registry = vec![format!("https://issuer-{}.example", uuid::Uuid::new_v4())];
+        for prefix in ["cap-a", "cap-b"] {
+            db.ensure_configured_community_with_nip_fi_issuers(&unique_host(prefix), &registry)
+                .await
+                .expect("seed");
+        }
+        assert_eq!(
+            db.load_nip_fi_binding_snapshot(&registry, 1)
+                .await
+                .expect("load"),
+            Err(RowCapExceeded(1))
+        );
+        assert_eq!(
+            db.load_nip_fi_binding_snapshot(&registry, 2)
+                .await
+                .expect("load")
+                .expect("at cap")
+                .len(),
+            2
+        );
+    }
 }
diff --git a/crates/buzz-push-gateway/src/apns.rs b/crates/buzz-push-gateway/src/apns.rs
index 8fe125b576..6b65ffcb1d 100644
--- a/crates/buzz-push-gateway/src/apns.rs
+++ b/crates/buzz-push-gateway/src/apns.rs
@@ -239,6 +239,18 @@ mod tests {
         StatusCode::OK
     }
 
+    #[test]
+    fn apns_payload_matches_normative_contract_and_models() {
+        let body = std::str::from_utf8(APNS_RECONNECT_PAYLOAD).unwrap();
+        for contract in [
+            include_str!("../../../docs/nips/NIP-PL.md"),
+            include_str!("../../../docs/formal/nip-pl/delivery.py"),
+            include_str!("../../../docs/formal/nip-pl/fixed_payload.py"),
+        ] {
+            assert!(contract.contains(body), "APNs fixed-body contract drift");
+        }
+    }
+
     #[tokio::test]
     async fn certificate_transport_sends_no_bearer_and_exact_body_for_every_attempt() {
         let requests = Arc::new(Mutex::new(Vec::new()));
@@ -274,6 +286,11 @@ mod tests {
         }
         let captured = requests.lock().unwrap();
         assert_eq!(captured.len(), 2);
+        for request in captured.iter() {
+            let payload: serde_json::Value = serde_json::from_slice(&request.body).unwrap();
+            assert_eq!(payload["aps"]["sound"], "default");
+            assert_eq!(payload["aps"]["mutable-content"], 1);
+        }
         assert!(captured
             .iter()
             .all(|request| request.body.as_slice() == APNS_RECONNECT_PAYLOAD));
diff --git a/crates/buzz-push-gateway/src/model.rs b/crates/buzz-push-gateway/src/model.rs
index 441966bd20..05f97ef3d5 100644
--- a/crates/buzz-push-gateway/src/model.rs
+++ b/crates/buzz-push-gateway/src/model.rs
@@ -13,7 +13,7 @@ pub const MAX_ENROLL_REQUEST_BYTES: usize =
 pub const MAX_GRANT_BYTES: usize = 4096;
 pub const MAX_ENDPOINT_HEX_BYTES: usize = 512;
 pub const APNS_RECONNECT_PAYLOAD: &[u8] =
-    br#"{"aps":{"alert":{"body":"Reconnect to your relay now"},"mutable-content":1}}"#;
+    br#"{"aps":{"alert":{"body":"Reconnect to your relay now"},"sound":"default","mutable-content":1}}"#;
 pub const WIRE_VERSION: u8 = 1;
 
 /// Relay request. It deliberately has no application-payload field:
diff --git a/crates/buzz-relay/Cargo.toml b/crates/buzz-relay/Cargo.toml
index d83c5e4f73..ef0808ef65 100644
--- a/crates/buzz-relay/Cargo.toml
+++ b/crates/buzz-relay/Cargo.toml
@@ -30,6 +30,9 @@ buzz-relay-mesh = { workspace = true }
 async-trait = "0.1"
 postcard = { workspace = true }
 axum = { workspace = true }
+# Axum's WebSocket errors wrap tungstenite's; matching them tells a close
+# handshake already under way apart from a failed terminal-frame write.
+tungstenite = { version = "0.29", default-features = false }
 tokio = { workspace = true }
 # `io` (ReaderStream) is needed to stream git subprocess stdout straight into
 # the HTTP response body — see api::git::transport read-path streaming. The
@@ -78,6 +81,8 @@ rand            = { workspace = true }
 hex             = { workspace = true }
 url             = { workspace = true }
 moka            = { workspace = true }
+arc-swap        = { workspace = true }
+lru             = { workspace = true }
 metrics         = { workspace = true }
 metrics-exporter-prometheus = { workspace = true }
 metrics-util    = { workspace = true }
diff --git a/crates/buzz-relay/src/api/bridge.rs b/crates/buzz-relay/src/api/bridge.rs
index 4c49d36117..ca08ab9e8a 100644
--- a/crates/buzz-relay/src/api/bridge.rs
+++ b/crates/buzz-relay/src/api/bridge.rs
@@ -63,7 +63,8 @@ pub(crate) async fn authenticate_member_post(
             true,
             true,
         ),
-    )?;
+    )
+    .await?;
     let pubkey = *admission.proven_pubkey();
     let (event_id_bytes, signed_created_at) = admission.into_extra();
 
@@ -1004,7 +1005,8 @@ pub async fn submit_event(
     // only available through the returned NipFiAdmission. [FI-TRACE-AUTHORITY-UNIFORM]
     crate::nip_fi_shadow::observe_strict_proof(&state, &headers, "bridge", || {
         verify_bridge_auth_with_options(&headers, "POST", &url, Some(&body), true, true).map(drop)
-    });
+    })
+    .await;
     let admission = admit_nip_fi_http_on_state(&state, &headers, || {
         verify_bridge_auth_with_options(
             &headers,
@@ -1016,7 +1018,8 @@ pub async fn submit_event(
         )
         .map(|auth| auth.proof((auth.event_id_bytes, auth.signed_created_at)))
         .map_err(|e| e.into_response())
-    })?;
+    })
+    .await?;
     let pubkey = *admission.proven_pubkey();
     let (event_id_bytes, signed_created_at) = admission.into_extra();
     let pubkey_hex = pubkey.to_hex();
@@ -1356,7 +1359,8 @@ pub async fn query_events(
     // NIP-FI admission. [FI-TRACE-AUTHORITY-UNIFORM]
     crate::nip_fi_shadow::observe_strict_proof(&state, &headers, "bridge", || {
         verify_bridge_auth_with_options(&headers, "POST", &url, Some(&body), true, true).map(drop)
-    });
+    })
+    .await;
     let admission = admit_nip_fi_http_on_state(&state, &headers, || {
         verify_bridge_auth_with_options(
             &headers,
@@ -1368,7 +1372,8 @@ pub async fn query_events(
         )
         .map(|auth| auth.proof((auth.event_id_bytes, auth.signed_created_at)))
         .map_err(|e| e.into_response())
-    })?;
+    })
+    .await?;
     let pubkey = *admission.proven_pubkey();
     let (event_id_bytes, signed_created_at) = admission.into_extra();
     let pubkey_hex = pubkey.to_hex();
@@ -2031,7 +2036,8 @@ pub async fn count_events(
     // NIP-FI admission. [FI-TRACE-AUTHORITY-UNIFORM]
     crate::nip_fi_shadow::observe_strict_proof(&state, &headers, "bridge", || {
         verify_bridge_auth_with_options(&headers, "POST", &url, Some(&body), true, true).map(drop)
-    });
+    })
+    .await;
     let admission = admit_nip_fi_http_on_state(&state, &headers, || {
         verify_bridge_auth_with_options(
             &headers,
@@ -2043,7 +2049,8 @@ pub async fn count_events(
         )
         .map(|auth| auth.proof((auth.event_id_bytes, auth.signed_created_at)))
         .map_err(|e| e.into_response())
-    })?;
+    })
+    .await?;
     let pubkey = *admission.proven_pubkey();
     let (event_id_bytes, signed_created_at) = admission.into_extra();
     let pubkey_hex = pubkey.to_hex();
@@ -2873,7 +2880,8 @@ async fn authorize_moderation_read(
     // NIP-FI admission. [FI-TRACE-AUTHORITY-UNIFORM]
     crate::nip_fi_shadow::observe_strict_proof(state, headers, "bridge", || {
         verify_bridge_auth(headers, "GET", &url, None, true).map(drop)
-    });
+    })
+    .await;
     let admission = admit_nip_fi_http_on_state(state, headers, || {
         verify_bridge_auth(
             headers,
@@ -2884,7 +2892,8 @@ async fn authorize_moderation_read(
         )
         .map(|auth| auth.proof(auth.event_id_bytes))
         .map_err(|e| e.into_response())
-    })?;
+    })
+    .await?;
     let pubkey = *admission.proven_pubkey();
     let event_id_bytes = admission.into_extra();
 
diff --git a/crates/buzz-relay/src/api/buzz_v1/auth.rs b/crates/buzz-relay/src/api/buzz_v1/auth.rs
index dd65d3dad6..6a3b731f03 100644
--- a/crates/buzz-relay/src/api/buzz_v1/auth.rs
+++ b/crates/buzz-relay/src/api/buzz_v1/auth.rs
@@ -110,6 +110,7 @@ pub(super) async fn authorize(
             body.is_some(),
         ),
     )
+    .await
     .map_err(|response| {
         if state.config.nip_fi.mode.restricts() {
             // Preserve the shared NIP-FI wire contract, not just its status.
diff --git a/crates/buzz-relay/src/api/git/settings.rs b/crates/buzz-relay/src/api/git/settings.rs
index a4f4edeaf8..3602c8a560 100644
--- a/crates/buzz-relay/src/api/git/settings.rs
+++ b/crates/buzz-relay/src/api/git/settings.rs
@@ -193,7 +193,8 @@ async fn authenticate(
             true, // require_auth_token: always required for control-plane
             require_payload,
         ),
-    )?;
+    )
+    .await?;
     let pubkey = *admission.proven_pubkey();
     let (event_id_bytes, signed_created_at) = admission.into_extra();
 
diff --git a/crates/buzz-relay/src/api/git/transport.rs b/crates/buzz-relay/src/api/git/transport.rs
index c3b292d8b4..d1ace7b62d 100644
--- a/crates/buzz-relay/src/api/git/transport.rs
+++ b/crates/buzz-relay/src/api/git/transport.rs
@@ -105,8 +105,8 @@ impl axum::extract::FromRequestParts<Arc<AppState>> for GitAuth {
         if !mode.restricts() {
             if let Err(rejection) = parse_git_auth_header(&parts.headers, method) {
                 // Off returns `rejection` as is; shadow also records the
-                // enforce verdict for the failed proof, still with no DB work.
-                crate::nip_fi_http::observe_failed_proof(state, &parts.headers);
+                // enforce verdict for the failed proof.
+                crate::nip_fi_http::observe_failed_proof(state, &parts.headers).await;
                 return Err(rejection);
             }
         }
@@ -195,7 +195,8 @@ impl axum::extract::FromRequestParts<Arc<AppState>> for GitAuth {
                     (event, signed_auth_created_at),
                 ))
             },
-        )?;
+        )
+        .await?;
 
         let pubkey = *admission.proven_pubkey();
         let (event, signed_auth_created_at) = admission.into_extra();
diff --git a/crates/buzz-relay/src/api/invites.rs b/crates/buzz-relay/src/api/invites.rs
index 3384f6023e..47ba59a7f6 100644
--- a/crates/buzz-relay/src/api/invites.rs
+++ b/crates/buzz-relay/src/api/invites.rs
@@ -288,7 +288,9 @@ async fn mint_invite_checked(
             true, // invites always require NIP-98; no X-Pubkey dev fallback
             true, // POST bodies must be covered by a payload tag
         ),
-    ) {
+    )
+    .await
+    {
         Ok(a) => a,
         Err(resp) => return resp,
     };
diff --git a/crates/buzz-relay/src/api/media.rs b/crates/buzz-relay/src/api/media.rs
index 6864cb15ae..470768e308 100644
--- a/crates/buzz-relay/src/api/media.rs
+++ b/crates/buzz-relay/src/api/media.rs
@@ -338,7 +338,8 @@ pub(crate) async fn upload_blob(
         let strict = BlossomStrictness::Strict;
         buzz_media::auth::verify_blossom_auth_event(&event, Some(&tenant_host), strict)
             .map_err(drop)
-    });
+    })
+    .await;
     let headers_clone = headers.clone();
     let admission = match admit_nip_fi_http_on_state(&state, &headers, move || {
         let auth_event = extract_blossom_auth(&headers_clone).map_err(|e| e.into_response())?;
@@ -348,7 +349,9 @@ pub(crate) async fn upload_blob(
             .map_err(|e| e.into_response())?;
         let pubkey = auth_event.pubkey;
         Ok(Nip98Proof::new(pubkey, auth_event))
-    }) {
+    })
+    .await
+    {
         Ok(a) => a,
         Err(resp) => return resp,
     };
@@ -818,11 +821,14 @@ pub(crate) async fn get_blob(
             BlossomStrictness::Strict,
         )
         .map(drop)
-    });
+    })
+    .await;
     let admission = match admit_nip_fi_http_on_state(&state, &req_headers, move || {
         extract_blossom_read_proof(&headers_clone, &sha256, &tenant_host, strictness)
             .map_err(|e| e.into_response())
-    }) {
+    })
+    .await
+    {
         Ok(a) => a,
         Err(resp) => return Ok(resp),
     };
@@ -1112,11 +1118,14 @@ pub(crate) async fn head_blob(
     crate::nip_fi_shadow::observe_strict_proof(&state, &headers, "blossom", || {
         extract_blossom_read_proof(&headers, &sha256, &tenant_host, BlossomStrictness::Strict)
             .map(drop)
-    });
+    })
+    .await;
     let admission = match admit_nip_fi_http_on_state(&state, &headers, move || {
         extract_blossom_read_proof(&headers_clone, &sha256, &tenant_host, strictness)
             .map_err(|e| e.into_response())
-    }) {
+    })
+    .await
+    {
         Ok(a) => a,
         Err(resp) => return Ok(resp),
     };
diff --git a/crates/buzz-relay/src/api/nip_fi.rs b/crates/buzz-relay/src/api/nip_fi.rs
index b3e4267cf6..39a24bbdc3 100644
--- a/crates/buzz-relay/src/api/nip_fi.rs
+++ b/crates/buzz-relay/src/api/nip_fi.rs
@@ -1930,6 +1930,7 @@ mod route_integration_tests {
             },
         )];
         config.nip_fi = NipFiRelayConfig {
+            source: Default::default(),
             mode: NipFiMode::Enforce,
             registry: registry.clone(),
             jwks_configs: jwks_configs.clone(),
@@ -2511,7 +2512,7 @@ mod route_integration_tests {
     /// for `key`.  `Ok(())` = admitted; `Err` = the denial response.
     // Response<Body> is intentionally large (axum's design); see admit_nip_fi_http.
     #[allow(clippy::result_large_err)]
-    fn http_admit(
+    async fn http_admit(
         state: &crate::state::AppState,
         iss: &str,
         key: &nostr::PublicKey,
@@ -2526,6 +2527,7 @@ mod route_integration_tests {
         crate::nip_fi_http::admit_nip_fi_http_on_state(state, &headers, || {
             Ok(crate::nip_fi_http::Nip98Proof::new(*key, ()))
         })
+        .await
         .map(|_| ())
     }
 
@@ -2551,7 +2553,7 @@ mod route_integration_tests {
         let key = nostr::Keys::generate().public_key();
         let mut state = (*http_enforce_state().await).clone();
         assert!(
-            http_admit(&state, TEST_ISS, &key).is_ok(),
+            http_admit(&state, TEST_ISS, &key).await.is_ok(),
             "control: the assertion is admitted on its own community"
         );
         Arc::make_mut(&mut state.config).nip_fi.communities =
@@ -2559,7 +2561,9 @@ mod route_integration_tests {
                 "https://relay.example",
                 &[TEST_ISS, OTHER_ISS],
             );
-        let resp = http_admit(&state, TEST_ISS, &key).expect_err("A's aud on B's Host");
+        let resp = http_admit(&state, TEST_ISS, &key)
+            .await
+            .expect_err("A's aud on B's Host");
         assert_eq!(resp.status(), StatusCode::FORBIDDEN);
         let body = axum::body::to_bytes(resp.into_body(), usize::MAX)
             .await
@@ -2572,13 +2576,14 @@ mod route_integration_tests {
         let state = http_enforce_state().await;
         let key = nostr::Keys::generate().public_key();
         assert!(
-            http_admit(&state, TEST_ISS, &key).is_ok(),
+            http_admit(&state, TEST_ISS, &key).await.is_ok(),
             "control: (iss-A, k) is admitted before any deny"
         );
 
         deny_via_route(&state, &key, 300).await;
 
         let resp = http_admit(&state, TEST_ISS, &key)
+            .await
             .expect_err("(iss-A, k) must be denied at HTTP ingress after the route denies it");
         assert_fixed_authorization_denied(resp, "(iss-A, k) HTTP denial").await;
     }
@@ -2590,11 +2595,11 @@ mod route_integration_tests {
         deny_via_route(&state, &key, 300).await;
 
         assert!(
-            http_admit(&state, TEST_ISS, &key).is_err(),
+            http_admit(&state, TEST_ISS, &key).await.is_err(),
             "control: (iss-A, k) is denied"
         );
         assert!(
-            http_admit(&state, OTHER_ISS, &key).is_ok(),
+            http_admit(&state, OTHER_ISS, &key).await.is_ok(),
             "a deny for (iss-A, k) must not block (iss-B, k)"
         );
     }
@@ -2624,8 +2629,9 @@ mod route_integration_tests {
             .expect("router response");
         assert_fixed_authorization_denied(ws_resp, "WS admission sees the route's deny").await;
 
-        let http_resp =
-            http_admit(&state, TEST_ISS, &key).expect_err("HTTP admission sees the same deny");
+        let http_resp = http_admit(&state, TEST_ISS, &key)
+            .await
+            .expect_err("HTTP admission sees the same deny");
         assert_fixed_authorization_denied(http_resp, "HTTP admission sees the route's deny").await;
     }
 
@@ -2656,6 +2662,7 @@ mod route_integration_tests {
             crate::nip_fi_http::admit_nip_fi_http_on_state(&state, &HeaderMap::new(), || {
                 Ok(crate::nip_fi_http::Nip98Proof::new(key, 7u8))
             })
+            .await
             .expect("Off mode admits on NIP-98 success regardless of deny entries");
         assert_eq!(admitted.proven_pubkey(), &key);
         assert!(admitted.assertion().is_none());
@@ -2673,6 +2680,7 @@ mod route_integration_tests {
             &HeaderMap::new(),
             || Err(legacy()),
         )
+        .await
         .expect_err("Off mode propagates the NIP-98 failure");
         let expected = legacy();
         assert_eq!(resp.status(), expected.status());
@@ -3548,6 +3556,7 @@ mod route_integration_tests {
                 },
             )];
             config.nip_fi = NipFiRelayConfig {
+                source: Default::default(),
                 mode: NipFiMode::Shadow,
                 registry: registry.clone(),
                 jwks_configs: vec![test_jwks_config()],
@@ -3623,7 +3632,9 @@ mod route_integration_tests {
         /// Run `state`'s production disconnect subscriber and apply what it
         /// hears through the production consumer, like `main.rs`.  Yields
         /// the target of each applied message.
-        fn listen(state: &Arc<AppState>) -> tokio::sync::mpsc::UnboundedReceiver<Vec<u8>> {
+        pub(super) fn listen(
+            state: &Arc<AppState>,
+        ) -> tokio::sync::mpsc::UnboundedReceiver<Vec<u8>> {
             let mut rx = state.pubsub.subscribe_nip_fi_disconnect();
             let channels = disconnect_subscribe_channels(state.config.nip_fi.mode);
             tokio::spawn(Arc::clone(&state.pubsub).run_nip_fi_disconnect_subscriber(channels));
@@ -3641,7 +3652,7 @@ mod route_integration_tests {
         /// Return once a probe that `prober` publishes has been applied via
         /// `seen`: the subscription is live, and anything published earlier
         /// on the probe's channel has been applied.
-        async fn await_probe(
+        pub(super) async fn await_probe(
             seen: &mut tokio::sync::mpsc::UnboundedReceiver<Vec<u8>>,
             prober: &Arc<AppState>,
         ) {
@@ -3661,7 +3672,7 @@ mod route_integration_tests {
         }
 
         /// Return once `seen` has applied a message for `key`.
-        async fn await_target(
+        pub(super) async fn await_target(
             seen: &mut tokio::sync::mpsc::UnboundedReceiver<Vec<u8>>,
             key: &nostr::PublicKey,
         ) {
@@ -3781,4 +3792,484 @@ mod route_integration_tests {
             deny_set_full_leaves_command_retryable(redis_guard()).await;
         }
     }
+
+    /// Plan criterion 10 over real infrastructure: PostgreSQL holds the two
+    /// communities, Redis carries the disconnect between pods, and every
+    /// admission runs the production path end to end.
+    mod postgres_tests {
+        use super::external_infra_redis::{await_probe, await_target, listen};
+        use super::*;
+        use futures_util::{SinkExt, StreamExt};
+        use tokio_tungstenite::tungstenite::{self, client::IntoClientRequest, Message};
+
+        const DENY_BODY: &[u8] = b"authorization denied\n";
+
+        fn redis_url() -> String {
+            std::env::var("BUZZ_TEST_REDIS_URL")
+                .or_else(|_| std::env::var("REDIS_URL"))
+                .unwrap_or_else(|_| "redis://127.0.0.1:6379".into())
+        }
+
+        /// An enforce pod serving `hosts` as two exact communities over the
+        /// shared PostgreSQL and Redis, listening on a real socket and
+        /// running the production disconnect subscriber.
+        struct Pod {
+            state: Arc<AppState>,
+            addr: std::net::SocketAddr,
+            seen: tokio::sync::mpsc::UnboundedReceiver<Vec<u8>>,
+            server: tokio::task::JoinHandle<()>,
+        }
+
+        impl Drop for Pod {
+            fn drop(&mut self) {
+                self.server.abort();
+            }
+        }
+
+        async fn pod(hosts: &[String; 2]) -> Pod {
+            let mut config = crate::config::Config::for_test();
+            config.database_url = crate::test_support::database_url();
+            config.redis_url = redis_url();
+            config.require_relay_membership = false;
+            config.nip_fi.mode = NipFiMode::Enforce;
+            config.nip_fi.registry.insert(test_issuer_policy());
+            let uris = hosts.clone().map(|host| format!("https://{host}"));
+            config.nip_fi.communities = crate::nip_fi_config::NipFiCommunities::for_test_many(
+                &[&uris[0], &uris[1]],
+                &[TEST_ISS],
+            );
+            let mut state = build_test_app_state(1000, config).await;
+            state.nip_fi_command_replay =
+                command_replay_guard(state.redis_pool.clone(), state.config.nip_fi.mode);
+            let key_source = Arc::new(
+                ProductionJwksSource::new(
+                    vec![test_jwks_config()],
+                    buzz_auth::HttpJwksFetcher::new(),
+                )
+                .expect("key source"),
+            );
+            key_source
+                .seed_snapshot_for_test(TEST_ISS, test_jwks())
+                .await;
+            state.nip_fi_verifier = Some(Arc::new(buzz_auth::FederatedAssertionVerifier::new(
+                state.config.nip_fi.registry.clone(),
+                key_source,
+            )));
+            let state = Arc::new(state);
+            let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
+                .await
+                .expect("bind");
+            let addr = listener.local_addr().expect("addr");
+            let app = crate::router::build_router(Arc::clone(&state))
+                .into_make_service_with_connect_info::<std::net::SocketAddr>();
+            let server = tokio::spawn(async move {
+                let _ = axum::serve(listener, app).await;
+            });
+            let seen = listen(&state);
+            Pod {
+                state,
+                addr,
+                seen,
+                server,
+            }
+        }
+
+        /// Both pods, with each subscription confirmed live.
+        async fn pair(hosts: &[String; 2]) -> [Pod; 2] {
+            let mut pods = [pod(hosts).await, pod(hosts).await];
+            for p in &mut pods {
+                await_probe(&mut p.seen, &p.state).await;
+            }
+            pods
+        }
+
+        /// A login assertion for `key` whose audience is `host`'s community.
+        /// Minted once and replayed as the same bytes in every phase.
+        fn retained_assertion(key: &nostr::Keys, host: &str) -> String {
+            use jsonwebtoken::{encode, Algorithm, EncodingKey, Header};
+            let now = chrono::Utc::now().timestamp();
+            let claims = serde_json::json!({
+                "iss": TEST_ISS, "aud": format!("https://{host}"), "sub": "restart-test",
+                "iat": now, "exp": now + 600, "nostr_pubkey": key.public_key().to_hex(),
+            });
+            let mut header = Header::new(Algorithm::ES256);
+            header.typ = Some("nip-fi+jwt".to_owned());
+            header.kid = Some(TEST_KID.to_owned());
+            let signing = EncodingKey::from_ec_pem(TEST_PRIVATE_KEY_PEM.as_bytes()).unwrap();
+            encode(&header, &claims, &signing).unwrap()
+        }
+
+        /// A key and its retained assertion for each community.
+        struct Retained {
+            keys: nostr::Keys,
+            assertions: [(String, String); 2],
+        }
+
+        impl Retained {
+            fn mint(hosts: &[String; 2]) -> Self {
+                let keys = nostr::Keys::generate();
+                let assertions = hosts.clone().map(|host| {
+                    let token = retained_assertion(&keys, &host);
+                    (host, token)
+                });
+                Self { keys, assertions }
+            }
+        }
+
+        /// How one admission ended; allowed cases must reach real admission.
+        #[derive(Debug, PartialEq, Eq, Clone, Copy)]
+        enum Outcome {
+            Admitted,
+            Denied,
+        }
+        use Outcome::{Admitted, Denied};
+
+        /// A root socket past the upgrade, holding its NIP-42 challenge.
+        struct RootSession {
+            socket: tokio_tungstenite::WebSocketStream<
+                tokio_tungstenite::MaybeTlsStream<tokio::net::TcpStream>,
+            >,
+            challenge: String,
+            relay: String,
+        }
+
+        /// Upgrade the root socket at `host` with `token`. A deny at upgrade
+        /// is the 403 deny body; anything else that is not an upgrade fails.
+        async fn open_root(pod: &Pod, host: &str, token: &str) -> Result<RootSession, Outcome> {
+            let mut req = format!("ws://{}/", pod.addr)
+                .into_client_request()
+                .expect("request");
+            req.headers_mut().insert("host", host.parse().unwrap());
+            req.headers_mut().insert(
+                "nostr-federated-identity",
+                format!("Bearer {token}").parse().unwrap(),
+            );
+            let mut socket = match tokio_tungstenite::connect_async(req).await {
+                Ok((socket, _)) => socket,
+                Err(tungstenite::Error::Http(resp)) => {
+                    let body = resp.body().clone().unwrap_or_default();
+                    assert_eq!(
+                        (resp.status().as_u16(), &body[..]),
+                        (403, DENY_BODY),
+                        "root upgrade refused other than by the deny body"
+                    );
+                    return Err(Denied);
+                }
+                Err(e) => panic!("root upgrade failed: {e}"),
+            };
+            let challenge = loop {
+                let frame = tokio::time::timeout(std::time::Duration::from_secs(5), socket.next())
+                    .await
+                    .expect("AUTH challenge in time");
+                if let Some(Ok(Message::Text(text))) = frame {
+                    let json: serde_json::Value = serde_json::from_str(&text).unwrap();
+                    if json[0] == "AUTH" {
+                        break json[1].as_str().unwrap().to_owned();
+                    }
+                } else {
+                    panic!("expected the AUTH challenge, got {frame:?}");
+                }
+            };
+            let relay = format!(
+                "{}://{host}",
+                if pod.state.config.relay_url.starts_with("wss://") {
+                    "wss"
+                } else {
+                    "ws"
+                }
+            );
+            Ok(RootSession {
+                socket,
+                challenge,
+                relay,
+            })
+        }
+
+        impl RootSession {
+            /// Complete NIP-42 as `keys`: `Admitted` on OK true, `Denied` on
+            /// the authorization-denied frame followed by the close.
+            async fn authenticate(mut self, keys: &nostr::Keys) -> Outcome {
+                let auth = nostr::EventBuilder::new(nostr::Kind::Authentication, "")
+                    .tag(nostr::Tag::parse(["relay", &self.relay]).unwrap())
+                    .tag(nostr::Tag::parse(["challenge", &self.challenge]).unwrap())
+                    .sign_with_keys(keys)
+                    .unwrap();
+                let id = auth.id.to_hex();
+                let frame = serde_json::json!(["AUTH", auth]).to_string();
+                self.socket.send(Message::Text(frame.into())).await.unwrap();
+                let denial = buzz_auth::DenialClass::AuthorizationDenied.nostr_text();
+                let mut denied = false;
+                loop {
+                    let frame =
+                        tokio::time::timeout(std::time::Duration::from_secs(5), self.socket.next())
+                            .await
+                            .expect("AUTH outcome in time");
+                    match frame {
+                        Some(Ok(Message::Text(text))) => {
+                            let json: serde_json::Value = serde_json::from_str(&text).unwrap();
+                            if json[0] == "OK" && json[1] == id.as_str() && json[2] == true {
+                                assert!(!denied, "admitted after a denial frame");
+                                return Admitted;
+                            }
+                            denied |= text.contains(denial);
+                        }
+                        Some(Ok(Message::Close(_))) | None | Some(Err(_)) => {
+                            assert!(denied, "root closed without the denial frame");
+                            return Denied;
+                        }
+                        Some(Ok(_)) => {}
+                    }
+                }
+            }
+        }
+
+        /// A full root session: upgrade, then NIP-42.
+        async fn root(pod: &Pod, keys: &nostr::Keys, host: &str, token: &str) -> Outcome {
+            match open_root(pod, host, token).await {
+                Ok(session) => session.authenticate(keys).await,
+                Err(denied) => denied,
+            }
+        }
+
+        /// A signed NIP-98 `POST /query` through the real handler: 200 when
+        /// admitted, the deny body when denied.
+        async fn http(pod: &Pod, keys: &nostr::Keys, host: &str, token: &str) -> Outcome {
+            use base64::Engine as _;
+            use sha2::Digest as _;
+            let body = br#"[{"kinds":[1],"limit":1}]"#;
+            let scheme = if pod.state.config.relay_url.starts_with("wss://") {
+                "https"
+            } else {
+                "http"
+            };
+            let proof = nostr::EventBuilder::new(nostr::Kind::HttpAuth, "")
+                .tags([
+                    nostr::Tag::parse(["u", &format!("{scheme}://{host}/query")]).unwrap(),
+                    nostr::Tag::parse(["method", "POST"]).unwrap(),
+                    // A fresh proof per request: the replay guard is shared.
+                    nostr::Tag::parse(["nonce", &uuid::Uuid::new_v4().to_string()]).unwrap(),
+                    nostr::Tag::parse(["payload", &hex::encode(sha2::Sha256::digest(body))])
+                        .unwrap(),
+                ])
+                .sign_with_keys(keys)
+                .unwrap();
+            let proof = base64::engine::general_purpose::STANDARD
+                .encode(serde_json::to_vec(&proof).unwrap());
+            let request = Request::post("/query")
+                .header(axum::http::header::HOST, host)
+                .header(axum::http::header::CONTENT_TYPE, "application/json")
+                .header(axum::http::header::AUTHORIZATION, format!("Nostr {proof}"))
+                .header(CLIENT_ATTACHED_HEADER, format!("Bearer {token}"))
+                .body(Body::from(&body[..]))
+                .unwrap();
+            let resp = crate::router::build_router(Arc::clone(&pod.state))
+                .oneshot(request)
+                .await
+                .unwrap();
+            let status = resp.status();
+            let body = axum::body::to_bytes(resp.into_body(), 64 * 1024)
+                .await
+                .unwrap();
+            match status {
+                StatusCode::OK => Admitted,
+                StatusCode::FORBIDDEN if &body[..] == DENY_BODY => Denied,
+                other => panic!(
+                    "unexpected HTTP outcome {other}: {}",
+                    String::from_utf8_lossy(&body)
+                ),
+            }
+        }
+
+        /// The audio deny-set check after a real NIP-42 session.
+        async fn audio(pod: &Pod, keys: &nostr::Keys, host: &str, token: &str) -> Outcome {
+            let binding = pod
+                .state
+                .config
+                .nip_fi
+                .communities
+                .resolve(host)
+                .expect("served");
+            let assertion = pod
+                .state
+                .nip_fi_verifier
+                .as_deref()
+                .expect("verifier")
+                .verify_assertion(token, binding)
+                .expect("the retained assertion is still valid");
+            if crate::audio::handler::test_support::deny_set_refuses(
+                Arc::clone(&pod.state),
+                assertion,
+                keys,
+            )
+            .await
+            {
+                Denied
+            } else {
+                Admitted
+            }
+        }
+
+        /// Asserts every retained assertion of K (expected `key`) and the
+        /// control key (always admitted), on both pods and in both
+        /// communities, at root, audio and HTTP.
+        async fn check(pods: &[Pod; 2], [k, control]: [&Retained; 2], key: Outcome, phase: &str) {
+            for (n, pod) in pods.iter().enumerate() {
+                for (who, retained, expected) in [("K", k, key), ("control", control, Admitted)] {
+                    for (host, token) in &retained.assertions {
+                        let keys = &retained.keys;
+                        assert_eq!(
+                            [
+                                root(pod, keys, host, token).await,
+                                audio(pod, keys, host, token).await,
+                                http(pod, keys, host, token).await,
+                            ],
+                            [expected; 3],
+                            "{phase}: {who} at {host} on P{} [root, audio, HTTP]",
+                            n + 1
+                        );
+                    }
+                }
+            }
+        }
+
+        /// Root sessions for every retained assertion on both pods, upgraded
+        /// but not yet authenticated.
+        async fn open_all(pods: &[Pod; 2], retained: &Retained) -> Vec<(String, RootSession)> {
+            let mut sessions = Vec::new();
+            for (n, pod) in pods.iter().enumerate() {
+                for (host, token) in &retained.assertions {
+                    let session = open_root(pod, host, token)
+                        .await
+                        .unwrap_or_else(|_| panic!("{host} on P{} must upgrade", n + 1));
+                    sessions.push((format!("{host} on P{}", n + 1), session));
+                }
+            }
+            sessions
+        }
+
+        /// Sessions K upgraded before a disconnect landed, now finishing
+        /// NIP-42: only the post-registration deny-set check refuses them.
+        /// The control key's open sessions are admitted.
+        async fn authenticate_all(
+            phase: &str,
+            k: (&nostr::Keys, Vec<(String, RootSession)>),
+            control: (&nostr::Keys, Vec<(String, RootSession)>),
+        ) {
+            for (who, (keys, sessions), expected) in
+                [("K", k, Denied), ("control", control, Admitted)]
+            {
+                for (at, session) in sessions {
+                    assert_eq!(
+                        session.authenticate(keys).await,
+                        expected,
+                        "{phase}: {who}'s session upgraded before it, at {at}"
+                    );
+                }
+            }
+        }
+
+        // Plan criterion 10: restart recovery across pods. K and a control
+        // key each hold one assertion per community (two exact host bindings
+        // in PostgreSQL and config), minted before the revocation and replayed
+        // as the same bytes in every phase, on both pods, through a real root
+        // NIP-42 session, the audio deny-set check and a signed NIP-98 request
+        // to a real handler. A disconnect sent to one pod denies K on both. A
+        // root session K upgraded before the disconnect is refused at NIP-42
+        // by the post-registration deny-set check. Restarting both pods
+        // empties their deny maps, so the retained assertions are admitted
+        // again until the issuer re-sends; that is the exposure window,
+        // recorded from restart to restored denial. The control key is
+        // admitted throughout. Mutations: dropping the post-registration
+        // check admits K's pre-upgraded sessions; dropping cross-pod
+        // application leaves K admitted on the other pod.
+        #[tokio::test]
+        #[ignore = "requires Postgres and Redis"]
+        async fn re_sent_disconnect_restores_the_deny_on_every_pod_after_restart() {
+            let tag = uuid::Uuid::new_v4().simple().to_string();
+            let hosts = [
+                format!("restart-a-{tag}.example"),
+                format!("restart-b-{tag}.example"),
+            ];
+            let db = sqlx::PgPool::connect(&crate::test_support::database_url())
+                .await
+                .expect("PostgreSQL must be available");
+            for host in &hosts {
+                sqlx::query("INSERT INTO communities (id, host) VALUES ($1, $2)")
+                    .bind(uuid::Uuid::new_v4())
+                    .bind(host)
+                    .execute(&db)
+                    .await
+                    .expect("seed community");
+            }
+            let k = Retained::mint(&hosts);
+            let control = Retained::mint(&hosts);
+            let minted: Vec<String> = [&k, &control]
+                .iter()
+                .flat_map(|r| r.assertions.iter().map(|(_, t)| t.clone()))
+                .collect();
+            let both = [&k, &control];
+            let key = k.keys.public_key();
+            let until = chrono::Utc::now().timestamp() + 300;
+            let send = |pod: Arc<AppState>| async move {
+                let token = mint_token(&key.to_hex(), 0, serde_json::json!({ "until": until }));
+                let (status, body) = post_command(&pod, &token, &key.to_hex()).await;
+                assert_eq!(status, StatusCode::OK);
+                assert_eq!(&body[..], br#"{"disconnected": true}"#);
+                drain_publishes(&pod).await;
+            };
+
+            let mut pods = pair(&hosts).await;
+            check(&pods, both, Admitted, "before the disconnect").await;
+            let (k_open, control_open) =
+                (open_all(&pods, &k).await, open_all(&pods, &control).await);
+            send(Arc::clone(&pods[0].state)).await;
+            await_target(&mut pods[1].seen, &key).await;
+            authenticate_all(
+                "after the disconnect",
+                (&k.keys, k_open),
+                (&control.keys, control_open),
+            )
+            .await;
+            check(&pods, both, Denied, "after the disconnect").await;
+
+            // Restart: fresh pods over the same database, empty deny maps.
+            drop(pods);
+            let mut pods = pair(&hosts).await;
+            let restarted = std::time::Instant::now();
+            let (first_host, first_token) = &k.assertions[0];
+            assert_eq!(
+                root(&pods[0], &k.keys, first_host, first_token).await,
+                Admitted,
+                "restarted: K's retained assertion completes a root session on P1"
+            );
+            let first_admitted = restarted.elapsed();
+            check(&pods, both, Admitted, "restarted, before the re-send").await;
+
+            let (k_open, control_open) =
+                (open_all(&pods, &k).await, open_all(&pods, &control).await);
+            send(Arc::clone(&pods[1].state)).await;
+            let [p1, p2] = &mut pods;
+            await_target(&mut p1.seen, &key).await;
+            await_target(&mut p2.seen, &key).await;
+            authenticate_all(
+                "after the re-send",
+                (&k.keys, k_open),
+                (&control.keys, control_open),
+            )
+            .await;
+            check(&pods, both, Denied, "after the re-send").await;
+            let restored = restarted.elapsed();
+
+            let replayed: Vec<String> = [&k, &control]
+                .iter()
+                .flat_map(|r| r.assertions.iter().map(|(_, t)| t.clone()))
+                .collect();
+            assert_eq!(replayed, minted, "assertion bytes unchanged");
+            eprintln!(
+                "criterion 10 exposure: first retained root admission {first_admitted:?} after \
+                 restart; denial restored on every pod {restored:?} after restart"
+            );
+            assert!(first_admitted < restored);
+        }
+    }
 }
diff --git a/crates/buzz-relay/src/api/operator.rs b/crates/buzz-relay/src/api/operator.rs
index fff7699c52..92771f1683 100644
--- a/crates/buzz-relay/src/api/operator.rs
+++ b/crates/buzz-relay/src/api/operator.rs
@@ -41,6 +41,12 @@ pub struct ListCommunitiesQuery {
     owner_pubkey: String,
 }
 
+/// Query parameters for joined-community discovery by an authenticated operator.
+#[derive(Debug, Deserialize)]
+pub struct JoinedCommunitiesQuery {
+    member_pubkey: String,
+}
+
 /// Query parameters for `GET /operator/communities/availability`.
 #[derive(Debug, Deserialize)]
 pub struct CommunityAvailabilityQuery {
@@ -688,6 +694,42 @@ pub async fn delete_community(
     ))
 }
 
+/// Return active memberships for an operator-supplied pubkey.
+/// The operator is trusted to select the identity; this route does not bind it to a user session.
+pub async fn list_joined_communities(
+    State(state): State<Arc<AppState>>,
+    headers: HeaderMap,
+    RawQuery(raw_query): RawQuery,
+    Query(query): Query<JoinedCommunitiesQuery>,
+) -> Result<Json<Value>, (StatusCode, Json<Value>)> {
+    authorize_operator_request(
+        &state,
+        &headers,
+        "GET",
+        "/operator/communities/joined",
+        raw_query.as_deref(),
+        None,
+    )
+    .await?;
+    let pubkey = validate_pubkey_hex(&query.member_pubkey).ok_or_else(|| {
+        api_error(
+            StatusCode::BAD_REQUEST,
+            "invalid member_pubkey: expected 64-char hex pubkey",
+        )
+    })?;
+    let communities = state
+        .db
+        .list_communities_joined_by(&pubkey)
+        .await
+        .map_err(|e| internal_error(&format!("list joined communities: {e}")))?;
+    Ok(Json(serde_json::json!({
+        "member_pubkey": pubkey,
+        "communities": communities.into_iter().map(|row| serde_json::json!({
+            "community_id": row.id.to_string(), "host": row.host,
+        })).collect::<Vec<_>>()
+    })))
+}
+
 /// List communities where a pubkey currently holds the `owner` role.
 pub async fn list_owned_communities(
     State(state): State<Arc<AppState>>,
diff --git a/crates/buzz-relay/src/api/workflows.rs b/crates/buzz-relay/src/api/workflows.rs
index 16685f3041..813fe434fc 100644
--- a/crates/buzz-relay/src/api/workflows.rs
+++ b/crates/buzz-relay/src/api/workflows.rs
@@ -79,7 +79,8 @@ async fn authorize_workflow_read(
             require_auth,
             false,
         ),
-    )?;
+    )
+    .await?;
     let pubkey = *admission.proven_pubkey();
     let (event_id_bytes, signed_created_at) = admission.into_extra();
 
diff --git a/crates/buzz-relay/src/audio/handler.rs b/crates/buzz-relay/src/audio/handler.rs
index 8115ed9bbd..3a4d2fcde1 100644
--- a/crates/buzz-relay/src/audio/handler.rs
+++ b/crates/buzz-relay/src/audio/handler.rs
@@ -92,14 +92,14 @@ pub async fn ws_audio_handler(
     req: axum::extract::Request,
 ) -> impl IntoResponse {
     // NIP-FI assertion check at upgrade — before tenant lookup and before the
-    // WebSocket handshake. Running pre-lookup means a denied request pays zero
-    // DB cost and the gate is reachable in tests without a live community.
+    // WebSocket handshake. Running pre-lookup means a denied request skips the tenant
+    // lookup (a resolver miss costs one bounded binding lookup) and the gate is reachable in tests without a live community.
     // [FI-TRACE-TRANSPORT-CLOSED] [NIP-FI.md §Admission pairing sequence]
-    let (nip_fi_assertion, shadow_assertion) = {
+    let (nip_fi_assertion, shadow_assertion, nip_fi_deadline) = {
         use crate::nip_fi_upgrade::check_nip_fi_at_upgrade;
         let mode = state.config.nip_fi.mode;
         let verifier = state.nip_fi_verifier.as_deref();
-        let communities = &state.config.nip_fi.communities;
+        let communities = state.nip_fi_communities();
         match check_nip_fi_at_upgrade(
             crate::nip_fi_session::NipFiWsRoute::Audio,
             &headers,
@@ -107,6 +107,7 @@ pub async fn ws_audio_handler(
             verifier,
             mode,
         )
+        .await
         .into_assertions()
         {
             Ok(assertions) => assertions,
@@ -134,6 +135,16 @@ pub async fn ws_audio_handler(
         }
     };
 
+    // The tenant lookup awaited since the community resolved; a snapshot
+    // that went stale meanwhile accepts no socket.
+    if let Err(class) = nip_fi_deadline.check() {
+        return crate::nip_fi_core::http_denial(class).into_response();
+    }
+    let shadow_assertion = crate::nip_fi_upgrade::observe_deadline(
+        crate::nip_fi_session::NipFiWsRoute::Audio,
+        shadow_assertion,
+    );
+
     let ws = match WebSocketUpgrade::from_request(req, &state).await {
         Ok(ws) => ws,
         Err(e) => return e.into_response(),
@@ -158,11 +169,11 @@ pub async fn ws_audio_handler(
     // so the NIP-FI session partition is rooted at the HTTP handshake, not the
     // post-community-active-check instant. [FI-TRACE-LEASE-BOUND]
     let connection_time = chrono::Utc::now();
-    let shadow = shadow_assertion.map(|a| {
+    let shadow = shadow_assertion.map(|(a, community)| {
         crate::nip_fi_shadow_session::ShadowSession::start(
             &state,
             "audio",
-            &headers,
+            community,
             a,
             connection_time,
         )
@@ -283,6 +294,11 @@ pub(crate) async fn handle_audio_connection(
     let rx_for_run = Arc::clone(&rx_shared);
     let rx_for_drain = Arc::clone(&rx_shared);
 
+    // The drain path parks the read half here so the bounded wait for the
+    // client's Close runs after the registry entry is released.
+    let unread_shared = Arc::new(tokio::sync::Mutex::new(None));
+    let unread_for_drain = Arc::clone(&unread_shared);
+
     run_registered_community_connection(
         &registry,
         Uuid::new_v4(),
@@ -319,37 +335,21 @@ pub(crate) async fn handle_audio_connection(
         },
         move || async move {
             let socket = socket_for_drain.lock().await.take();
-            let mut pre_terminal_ctrl_rx = rx_for_drain.lock().await.take();
+            let queued = rx_for_drain.lock().await.take();
             if let Some(socket) = socket {
-                let (mut ws_send, _ws_recv) = socket.split();
-                if let Some(ref mut rx) = pre_terminal_ctrl_rx {
-                    while let Ok(msg) = rx.try_recv() {
-                        let _ = tokio::time::timeout(
-                            crate::connection::WS_TERMINAL_FLUSH_TIMEOUT,
-                            futures_util::SinkExt::send(&mut ws_send, msg),
-                        )
-                        .await;
-                    }
-                }
                 // A published reason (e.g. an expiry denial) closes with its
                 // own frame, exactly as the writer would.
                 let close = drain_reason.borrow().map(|reason| reason.close_message());
-                if let Some(close) = close {
-                    let _ = tokio::time::timeout(
-                        crate::connection::WS_TERMINAL_FLUSH_TIMEOUT,
-                        futures_util::SinkExt::send(&mut ws_send, close),
-                    )
-                    .await;
-                }
-                let _ = tokio::time::timeout(
-                    crate::connection::WS_TERMINAL_FLUSH_TIMEOUT,
-                    futures_util::SinkExt::close(&mut ws_send),
-                )
-                .await;
+                let ws_recv = crate::connection::drain_refused_socket(socket, queued, close).await;
+                *unread_for_drain.lock().await = Some(ws_recv);
             }
         },
     )
     .await;
+    let unread = unread_shared.lock().await.take();
+    if let Some(ws_recv) = unread {
+        crate::connection::await_client_close(ws_recv).await;
+    }
 }
 
 /// Mid-admission cancellation fence for the audio route: if `$cancel` fired,
@@ -400,6 +400,7 @@ async fn send_challenge_unless_cancelled<S>(
 ) -> bool
 where
     S: futures_util::Sink<WsMessage> + Unpin,
+    S::Error: std::error::Error + 'static,
 {
     tokio::select! {
         biased;
@@ -427,6 +428,10 @@ pub(crate) fn audio_post_auth_register(
     control.set_proven_identity(pubkey_bytes, nip_fi_issuer);
 }
 
+/// Runs the audio session, then holds the read half for the client's Close
+/// reply, bounded by `WS_TERMINAL_FLUSH_TIMEOUT`. An exit whose cleanup
+/// follows its terminal frames hands the socket off first through
+/// [`hand_off_socket`], so that cleanup never holds the socket open.
 #[allow(clippy::too_many_arguments)]
 pub(crate) async fn handle_active_audio_connection(
     socket: WebSocket,
@@ -440,13 +445,102 @@ pub(crate) async fn handle_active_audio_connection(
     // which arms them BEFORE the `is_community_active` bootstrap await.
     // `None` is used by test call sites that bypass the outer wrapper.
     pre_built: Option<PreBuiltNipFiBundle>,
+) {
+    let (ws_send, ws_recv) = socket.split();
+    let mut ws_recv = AudioReadHalf::Held(ws_recv);
+    run_active_audio_connection(
+        ws_send,
+        &mut ws_recv,
+        state,
+        tenant,
+        channel_id,
+        control,
+        nip_fi_assertion,
+        connection_time,
+        pre_built,
+    )
+    .await;
+    // Returning releases the caller's connection permit, so the socket must
+    // have ended first: wait on the read half here, or on the background
+    // close an exit handed it to.
+    match ws_recv {
+        AudioReadHalf::Held(ws_recv) => crate::connection::await_client_close(ws_recv).await,
+        AudioReadHalf::HandedOff(close) => {
+            if let Err(error) = close.await {
+                warn!(channel_id = %channel_id, "audio background close failed: {error}");
+            }
+        }
+    }
+}
+
+/// The audio session's read half, or the background close it was handed to.
+enum AudioReadHalf {
+    Held(futures_util::stream::SplitStream<WebSocket>),
+    HandedOff(tokio::task::JoinHandle<()>),
+}
+
+/// Hands the socket to a task that waits, bounded, for the client's Close
+/// reply and then drops it. Called once the terminal frames are sent and
+/// before cleanup that may block on Postgres, Redis or a remote owner, so
+/// that cleanup never holds the socket open. Pass the write half when the
+/// caller still owns it: either half alone keeps the socket open. The task
+/// handle is kept so the wrapper holds the connection permit until the
+/// socket ends.
+fn hand_off_socket(
+    ws_recv: &mut AudioReadHalf,
+    ws_send: Option<futures_util::stream::SplitSink<WebSocket, WsMessage>>,
+) {
+    if let AudioReadHalf::HandedOff(_) = ws_recv {
+        return;
+    }
+    // The task is spawned before the read half moves out of `ws_recv`, so
+    // `ws_recv` is never left without one of its two states.
+    let (recv_tx, recv_rx) = tokio::sync::oneshot::channel();
+    let close = tokio::spawn(async move {
+        if let Ok(recv) = recv_rx.await {
+            crate::connection::await_client_close(recv).await;
+        }
+        drop(ws_send);
+    });
+    if let AudioReadHalf::Held(recv) = std::mem::replace(ws_recv, AudioReadHalf::HandedOff(close)) {
+        let _ = recv_tx.send(recv);
+    }
+}
+
+/// An admission error frame followed by the Close that ends the socket, so
+/// the client gets a clean close handshake instead of waiting out the
+/// bounded peer wait for a Close that never comes. `code` is
+/// `close_code::POLICY` (1008) for a refusal, `close_code::ERROR` (1011)
+/// for a server-side failure and `close_code::RESTART` (1012) when the relay
+/// is draining and the client should reconnect.
+fn error_exit_frames(error: serde_json::Value, code: u16) -> [WsMessage; 2] {
+    [WsMessage::Text(error.to_string().into()), exit_close(code)]
+}
+
+fn exit_close(code: u16) -> WsMessage {
+    WsMessage::Close(Some(axum::extract::ws::CloseFrame {
+        code,
+        reason: axum::extract::ws::Utf8Bytes::default(),
+    }))
+}
+
+#[allow(clippy::too_many_arguments)]
+async fn run_active_audio_connection(
+    mut ws_send: futures_util::stream::SplitSink<WebSocket, WsMessage>,
+    ws_recv: &mut AudioReadHalf,
+    state: Arc<AppState>,
+    tenant: TenantContext,
+    channel_id: Uuid,
+    control: CommunityConnectionControl,
+    nip_fi_assertion: Option<VerifiedAssertion>,
+    connection_time: chrono::DateTime<chrono::Utc>,
+    pre_built: Option<PreBuiltNipFiBundle>,
 ) {
     let cancel = control.cancellation_token();
     let disconnect_reason = control.disconnect_reason();
     // connection_time is threaded in from the HTTP handler (captured immediately
     // before on_upgrade) so the session partition is rooted at the true upgrade
     // instant, not the post-community-active-check instant. [FI-TRACE-LEASE-BOUND]
-    let (mut ws_send, mut ws_recv) = socket.split();
 
     // P2 / Fix 3: Arm the NIP-FI session gate and expiry task.
     //
@@ -539,6 +633,9 @@ pub(crate) async fn handle_active_audio_connection(
             return;
         },
         result = tokio::time::timeout(AUTH_TIMEOUT, async {
+            let AudioReadHalf::Held(ws_recv) = ws_recv else {
+                return None;
+            };
             while let Some(Ok(msg)) = ws_recv.next().await {
                 if let WsMessage::Text(text) = msg {
                     if text.len() > MAX_TEXT_FRAME_BYTES {
@@ -558,8 +655,17 @@ pub(crate) async fn handle_active_audio_connection(
 
     let auth_msg = match auth_result {
         Ok(Some(a)) => a,
-        _ => {
-            debug!(channel_id = %channel_id, "audio auth timeout or disconnect");
+        Ok(None) => {
+            debug!(channel_id = %channel_id, "audio client disconnected before auth");
+            return;
+        }
+        Err(_) => {
+            debug!(channel_id = %channel_id, "audio auth timeout");
+            crate::connection::send_exit_frames_bounded(
+                &mut ws_send,
+                [exit_close(axum::extract::ws::close_code::POLICY)],
+            )
+            .await;
             return;
         }
     };
@@ -921,15 +1027,14 @@ pub(crate) async fn handle_active_audio_connection(
                 shadow_attempt.refused();
                 crate::connection::send_exit_frames_bounded(
                     &mut ws_send,
-                    [WsMessage::Text(
+                    error_exit_frames(
                         serde_json::json!({
                             "type": "error",
                             "code": "huddle_relay_draining",
                             "message": "relay is draining; reconnect"
-                        })
-                        .to_string()
-                        .into(),
-                    )],
+                        }),
+                        axum::extract::ws::close_code::RESTART,
+                    ),
                 )
                 .await;
                 return;
@@ -982,15 +1087,14 @@ pub(crate) async fn handle_active_audio_connection(
                     );
                     crate::connection::send_exit_frames_bounded(
                         &mut ws_send,
-                        [WsMessage::Text(
+                        error_exit_frames(
                             serde_json::json!({
                                 "type": "error",
                                 "code": "join_rejected",
                                 "message": "huddle join rejected"
-                            })
-                            .to_string()
-                            .into(),
-                        )],
+                            }),
+                            axum::extract::ws::close_code::ERROR,
+                        ),
                     )
                     .await;
                     return;
@@ -1010,15 +1114,14 @@ pub(crate) async fn handle_active_audio_connection(
                 );
                 crate::connection::send_exit_frames_bounded(
                     &mut ws_send,
-                    [WsMessage::Text(
+                    error_exit_frames(
                         serde_json::json!({
                             "type": "error",
                             "code": "huddle_audio_unavailable",
                             "message": "huddle audio unavailable in this deployment"
-                        })
-                        .to_string()
-                        .into(),
-                    )],
+                        }),
+                        axum::extract::ws::close_code::POLICY,
+                    ),
                 )
                 .await;
                 return;
@@ -1041,19 +1144,23 @@ pub(crate) async fn handle_active_audio_connection(
     // get_or_create (the old room was already cleaned up). This DB check
     // catches that case. The room-level ended flag (checked inside add_peer)
     // handles the same-room case.
+    #[cfg(test)]
+    crate::nip_fi_test_hooks::before_room_archive_recheck(tenant.community()).await;
     match state.db.get_channel(tenant.community(), channel_id).await {
         Ok(ch) if ch.archived_at.is_some() => {
             shadow_attempt.refused();
             debug!(channel_id = %channel_id, "channel archived before room join");
             crate::connection::send_exit_frames_bounded(
                 &mut ws_send,
-                [WsMessage::Text(
-                    serde_json::json!({"type":"error","message":"huddle has ended"})
-                        .to_string()
-                        .into(),
-                )],
+                error_exit_frames(
+                    serde_json::json!({"type":"error","message":"huddle has ended"}),
+                    axum::extract::ws::close_code::POLICY,
+                ),
             )
             .await;
+            hand_off_socket(ws_recv, Some(ws_send));
+            #[cfg(test)]
+            crate::nip_fi_test_hooks::before_archived_exit_cleanup(tenant.community()).await;
             // I1 residual: release lease with an awaited call, not a detached task.
             if let Some((lease, directory)) = staged_lease {
                 if let Err(e) = directory.release(&lease).await {
@@ -1068,6 +1175,12 @@ pub(crate) async fn handle_active_audio_connection(
         Err(e) => {
             shadow_attempt.refused();
             warn!(channel_id = %channel_id, "pre-join channel check failed (fail-closed): {e}");
+            crate::connection::send_exit_frames_bounded(
+                &mut ws_send,
+                [exit_close(axum::extract::ws::close_code::ERROR)],
+            )
+            .await;
+            hand_off_socket(ws_recv, Some(ws_send));
             // I1 residual: release lease with an awaited call, not a detached task.
             if let Some((lease, directory)) = staged_lease {
                 if let Err(re) = directory.release(&lease).await {
@@ -1097,7 +1210,7 @@ pub(crate) async fn handle_active_audio_connection(
             current = CURRENT_PROTOCOL_VERSION,
             "audio: client requested unsupported protocol version"
         );
-        crate::connection::send_exit_frames_bounded(&mut ws_send, [WsMessage::Text(
+        crate::connection::send_exit_frames_bounded(&mut ws_send, error_exit_frames(
                 serde_json::json!({
                     "type": "error",
                     "code": "unsupported_version",
@@ -1105,11 +1218,11 @@ pub(crate) async fn handle_active_audio_connection(
                         "huddle audio protocol v{requested_version} not supported; relay max is v{CURRENT_PROTOCOL_VERSION}"
                     ),
                     "current_version": CURRENT_PROTOCOL_VERSION,
-                })
-                .to_string()
-                .into(),
-            )])
+                }),
+                axum::extract::ws::close_code::POLICY,
+            ))
             .await;
+        hand_off_socket(ws_recv, Some(ws_send));
         if let Some((lease, directory)) = staged_lease {
             // I1 residual: release lease with an awaited call, not a detached task.
             if let Err(e) = directory.release(&lease).await {
@@ -1171,11 +1284,13 @@ pub(crate) async fn handle_active_audio_connection(
                 warn!(channel_id = %channel_id, pubkey = %pubkey_hex, "huddle owner rejected registration: {reason:?}");
                 crate::connection::send_exit_frames_bounded(
                     &mut ws_send,
-                    [WsMessage::Text(
-                        remote_rejection_ws_error(&reason).to_string().into(),
-                    )],
+                    error_exit_frames(
+                        remote_rejection_ws_error(&reason),
+                        axum::extract::ws::close_code::POLICY,
+                    ),
                 )
                 .await;
+                hand_off_socket(ws_recv, Some(ws_send));
                 // I3 residual: await expiry task before resource teardown.
                 cancel.cancel();
                 if let Some(t) = _nip_fi_admission_expiry.take() {
@@ -1192,16 +1307,16 @@ pub(crate) async fn handle_active_audio_connection(
                 warn!(channel_id = %channel_id, pubkey = %pubkey_hex, "huddle owner registration failed: {e}");
                 crate::connection::send_exit_frames_bounded(
                     &mut ws_send,
-                    [WsMessage::Text(
+                    error_exit_frames(
                         serde_json::json!({
                             "type": "error", "code": "huddle_owner_unreachable",
                             "message": "could not reach the huddle owner"
-                        })
-                        .to_string()
-                        .into(),
-                    )],
+                        }),
+                        axum::extract::ws::close_code::ERROR,
+                    ),
                 )
                 .await;
+                hand_off_socket(ws_recv, Some(ws_send));
                 // I3 residual: await expiry task before resource teardown.
                 cancel.cancel();
                 if let Some(t) = _nip_fi_admission_expiry.take() {
@@ -1285,7 +1400,8 @@ pub(crate) async fn handle_active_audio_connection(
             Err(crate::audio::room::AdmissionError::Full) => {
                 shadow_attempt.refused();
                 warn!(channel_id = %channel_id, "audio room participant capacity reached");
-                crate::connection::send_exit_frames_bounded(&mut ws_send, [WsMessage::Text(serde_json::json!({"type":"error","code":"room_full","message":"room participant capacity reached"}).to_string().into())]).await;
+                crate::connection::send_exit_frames_bounded(&mut ws_send, error_exit_frames(serde_json::json!({"type":"error","code":"room_full","message":"room participant capacity reached"}), axum::extract::ws::close_code::POLICY)).await;
+                hand_off_socket(ws_recv, Some(ws_send));
                 // IMPORTANT 3: cancel + await expiry task before guard release.
                 cancel.cancel();
                 if let Some(t) = _nip_fi_admission_expiry.take() {
@@ -1297,7 +1413,8 @@ pub(crate) async fn handle_active_audio_connection(
             Err(crate::audio::room::AdmissionError::Ended) => {
                 shadow_attempt.refused();
                 debug!(channel_id = %channel_id, "room ended before admission");
-                crate::connection::send_exit_frames_bounded(&mut ws_send, [WsMessage::Text(serde_json::json!({"type":"error","code":"room_ended","message":"huddle has ended"}).to_string().into())]).await;
+                crate::connection::send_exit_frames_bounded(&mut ws_send, error_exit_frames(serde_json::json!({"type":"error","code":"room_ended","message":"huddle has ended"}), axum::extract::ws::close_code::POLICY)).await;
+                hand_off_socket(ws_recv, Some(ws_send));
                 // IMPORTANT 3: cancel + await expiry task before guard release.
                 cancel.cancel();
                 if let Some(t) = _nip_fi_admission_expiry.take() {
@@ -1309,11 +1426,12 @@ pub(crate) async fn handle_active_audio_connection(
             Err(crate::audio::room::AdmissionError::VersionMismatch { pinned, requested }) => {
                 shadow_attempt.refused();
                 info!(channel_id = %channel_id, pubkey = %pubkey_hex, pinned, requested, "audio: protocol version mismatch — upgrade required");
-                crate::connection::send_exit_frames_bounded(&mut ws_send, [WsMessage::Text(serde_json::json!({
+                crate::connection::send_exit_frames_bounded(&mut ws_send, error_exit_frames(serde_json::json!({
                 "type": "error", "code": "upgrade_required",
                 "message": format!("this huddle is using audio protocol v{pinned}; your client requested v{requested}"),
                 "pinned_version": pinned, "requested_version": requested,
-            }).to_string().into())]).await;
+            }), axum::extract::ws::close_code::POLICY)).await;
+                hand_off_socket(ws_recv, Some(ws_send));
                 // IMPORTANT 3: cancel + await expiry task before guard release.
                 cancel.cancel();
                 if let Some(t) = _nip_fi_admission_expiry.take() {
@@ -1615,6 +1733,7 @@ pub(crate) async fn handle_active_audio_connection(
                         .map_or(WsMessage::Close(None), |reason| reason.close_message());
                     let _ = tokio::time::timeout_at(deadline, ws_send.send(close)).await;
                 }
+                hand_off_socket(ws_recv, Some(ws_send));
                 if let (Some(session), Some(ref mut stream)) = (
                     guard.take_remote_session().as_ref(),
                     guard.take_remote_stream().as_mut(),
@@ -2010,20 +2129,29 @@ pub(crate) async fn handle_active_audio_connection(
         None
     };
 
-    recv_loop(
-        ws_recv,
-        Arc::clone(&room),
-        peer_id,
-        requested_version,
-        ctrl_tx,
-        Arc::clone(&missed_pongs),
-        cancel.clone(),
-        remote_session.as_mut(),
-    )
-    .await;
+    // Every exit that hands the socket off returns, so it is still held here;
+    // if it were not, the session would skip straight to teardown.
+    if let AudioReadHalf::Held(ws_recv) = ws_recv {
+        recv_loop(
+            ws_recv,
+            Arc::clone(&room),
+            peer_id,
+            requested_version,
+            ctrl_tx,
+            Arc::clone(&missed_pongs),
+            cancel.clone(),
+            remote_session.as_mut(),
+        )
+        .await;
+    }
 
     cancel.cancel();
     let _ = send_task.await;
+    // The writer has sent the Close and released the write half. Nothing
+    // below may hold the socket open, including the Postgres and Redis writes.
+    hand_off_socket(ws_recv, None);
+    #[cfg(test)]
+    crate::nip_fi_test_hooks::before_audio_teardown_cleanup(tenant.community()).await;
     let _ = heartbeat_task.await;
     let _ = forward_task.await;
     // The reader task owns the owner control stream; joining it here guarantees
@@ -2215,7 +2343,7 @@ fn remote_rejection_ws_error(reason: &crate::audio::join::RegisterRejection) ->
 /// clarifies at this single call site.
 #[allow(clippy::too_many_arguments)]
 async fn recv_loop(
-    mut ws_recv: futures_util::stream::SplitStream<WebSocket>,
+    ws_recv: &mut futures_util::stream::SplitStream<WebSocket>,
     room: Arc<crate::audio::room::Room>,
     peer_id: Uuid,
     protocol_version: u8,
@@ -2747,6 +2875,7 @@ pub(crate) async fn deny_audio_authorization<S>(
     terminal_rx: &mut mpsc::Receiver<WsMessage>,
 ) where
     S: futures_util::Sink<WsMessage> + Unpin,
+    S::Error: std::error::Error + 'static,
 {
     control.disconnect_nip_fi();
     crate::connection::send_exit_frames_bounded(
@@ -2781,6 +2910,7 @@ async fn exit_authorization_refusal<S>(
     off_mode: serde_json::Value,
 ) where
     S: futures_util::Sink<WsMessage> + Unpin,
+    S::Error: std::error::Error + 'static,
 {
     if nip_fi && class == buzz_auth::DenialClass::AuthorizationDenied {
         deny_audio_authorization(ws_send, control, terminal_rx).await;
@@ -3533,6 +3663,89 @@ async fn emit_participant_event(
     }
 }
 
+/// Drives one audio socket through the production NIP-42 and deny-set path.
+#[cfg(test)]
+pub(crate) mod test_support {
+    use tokio_tungstenite::{connect_async, tungstenite::Message};
+
+    use super::*;
+
+    /// Whether the audio deny-set check refuses a session admitted on
+    /// `assertion` and authenticated by `key`: `true` on the denial frame,
+    /// `false` once the handler passes the check.
+    pub(crate) async fn deny_set_refuses(
+        state: Arc<AppState>,
+        assertion: VerifiedAssertion,
+        key: &nostr::Keys,
+    ) -> bool {
+        let community = buzz_core::tenant::CommunityId::from_uuid(Uuid::new_v4());
+        let tenant = TenantContext::resolved(community, "audio-deny.test".to_owned());
+        let relay_url =
+            crate::api::bridge::nip42_expected_relay_url(&state.config.relay_url, &tenant);
+        let (passed, release) =
+            crate::nip_fi_test_hooks::audio_after_deny_check_passed_hook::arm(community);
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let addr = listener.local_addr().unwrap();
+        let app = axum::Router::new().route(
+            "/",
+            axum::routing::get(move |ws: WebSocketUpgrade| async move {
+                ws.on_upgrade(move |socket| {
+                    handle_active_audio_connection(
+                        socket,
+                        state,
+                        tenant,
+                        Uuid::new_v4(),
+                        CommunityConnectionControl::new(CancellationToken::new()),
+                        Some(assertion),
+                        chrono::Utc::now(),
+                        None,
+                    )
+                })
+            }),
+        );
+        let server = tokio::spawn(async move { axum::serve(listener, app).await });
+
+        let (mut client, _) = connect_async(format!("ws://{addr}/")).await.unwrap();
+        let challenge = match client.next().await {
+            Some(Ok(Message::Text(text))) => {
+                let json: serde_json::Value = serde_json::from_str(&text).unwrap();
+                json["challenge"].as_str().unwrap().to_owned()
+            }
+            other => panic!("expected the AUTH challenge, got {other:?}"),
+        };
+        let auth = nostr::EventBuilder::new(nostr::Kind::Authentication, "")
+            .tag(nostr::Tag::parse(["relay", &relay_url]).unwrap())
+            .tag(nostr::Tag::parse(["challenge", &challenge]).unwrap())
+            .sign_with_keys(key)
+            .unwrap();
+        let auth = serde_json::json!({"type": "auth", "event": auth}).to_string();
+        client.send(Message::Text(auth.into())).await.unwrap();
+
+        let denial = serde_json::json!({
+            "type": "restricted",
+            "message": buzz_auth::DenialClass::AuthorizationDenied.nostr_text(),
+        })
+        .to_string();
+        let refused = tokio::time::timeout(std::time::Duration::from_secs(5), async {
+            tokio::select! {
+                frame = client.next() => match frame {
+                    Some(Ok(Message::Text(text))) if text.as_str() == denial => true,
+                    other => panic!("expected the denial frame, got {other:?}"),
+                },
+                arrived = passed => {
+                    arrived.expect("hook");
+                    false
+                }
+            }
+        })
+        .await
+        .expect("audio session reached neither outcome");
+        release.notify_one();
+        server.abort();
+        refused
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use std::sync::Mutex;
@@ -5206,6 +5419,13 @@ mod tests {
     /// Reads `BUZZ_TEST_DATABASE_URL`; falls back to the local development URL.
     /// Returns `None` if the resolved database is not reachable.
     async fn audio_test_state_real_db() -> Option<std::sync::Arc<crate::state::AppState>> {
+        audio_test_state_real_db_with(|_| {}).await
+    }
+
+    /// `audio_test_state_real_db` with a final `configure` pass over the config.
+    async fn audio_test_state_real_db_with(
+        configure: impl FnOnce(&mut crate::config::Config),
+    ) -> Option<std::sync::Arc<crate::state::AppState>> {
         use std::sync::Arc;
         let db_url = std::env::var("BUZZ_TEST_DATABASE_URL").unwrap_or_else(|_| {
             "postgres://buzz:buzz_dev@localhost:5432/buzz".to_string() // sadscan:disable np.postgres.1 -- local test-only credentials
@@ -5218,6 +5438,7 @@ mod tests {
         config.require_relay_membership = false;
         config.database_url = db_url.clone();
         config.redis_url = "redis://127.0.0.1:1".to_string();
+        configure(&mut config);
         let pool = sqlx::PgPool::connect_lazy(&config.database_url).expect("lazy pg pool");
         let db = buzz_db::Db::from_pool(pool.clone());
         let redis_pool = deadpool_redis::Config::from_url(&config.redis_url)
@@ -5994,7 +6215,7 @@ mod tests {
         crate::nip_fi_shadow_session::ShadowSession::start(
             state,
             "audio",
-            &axum::http::HeaderMap::new(),
+            crate::nip_fi_shadow::BOUND.into(),
             assertion,
             Utc::now(),
         )
@@ -9898,6 +10119,369 @@ mod tests {
             let _ = server.await;
         }
 
+        /// Answers the server's NIP-42 challenge with an audio `auth` message.
+        async fn send_audio_auth(
+            client: &mut tokio_tungstenite::WebSocketStream<
+                tokio_tungstenite::MaybeTlsStream<tokio::net::TcpStream>,
+            >,
+            key: &nostr::Keys,
+            relay_url: &str,
+            protocol_version: u8,
+        ) {
+            let challenge =
+                match tokio::time::timeout(std::time::Duration::from_secs(2), client.next())
+                    .await
+                    .expect("challenge timeout")
+                    .expect("challenge msg")
+                    .expect("challenge ws msg")
+                {
+                    tokio_tungstenite::tungstenite::Message::Text(t) => {
+                        serde_json::from_str::<serde_json::Value>(&t).expect("challenge JSON")
+                            ["challenge"]
+                            .as_str()
+                            .expect("challenge field")
+                            .to_string()
+                    }
+                    other => panic!("expected text challenge; got {other:?}"),
+                };
+            let auth_event = nostr::EventBuilder::new(nostr::Kind::Authentication, "")
+                .tag(nostr::Tag::parse(["relay", relay_url]).unwrap())
+                .tag(nostr::Tag::parse(["challenge", &challenge]).unwrap())
+                .sign_with_keys(key)
+                .unwrap();
+            let auth_msg = serde_json::json!({
+                "type": "auth",
+                "event": auth_event,
+                "parent_channel_id": null,
+                "protocol_version": protocol_version,
+            })
+            .to_string();
+            client
+                .send(tokio_tungstenite::tungstenite::Message::Text(
+                    auth_msg.into(),
+                ))
+                .await
+                .expect("send auth msg");
+        }
+
+        /// After an established session's writer sends its Close, the
+        /// teardown that follows writes to Postgres and Redis, which can stall
+        /// with no deadline. The socket must still end within the bounded wait
+        /// for the client's Close reply. This client never replies and the
+        /// teardown never finishes.
+        ///
+        /// Mutation: move `hand_off_socket(ws_recv, None)` to after the
+        /// teardown → the socket stays open while the teardown is held →
+        /// `time_to_eof` hits its watchdog and panics.
+        #[ignore = "requires Postgres — runs in postgres-ci nextest lane"]
+        #[tokio::test]
+        async fn stalled_teardown_does_not_hold_established_socket_open() {
+            use crate::connection::terminal_close_delivery_tests::time_to_eof;
+            use crate::connection::WS_TERMINAL_FLUSH_TIMEOUT;
+            use buzz_auth::VerifiedAssertion;
+            use chrono::{Duration, Utc};
+            use std::sync::Arc;
+
+            let state = audio_test_state_real_db().await.expect(
+                "PostgreSQL must be available — set BUZZ_TEST_DATABASE_URL or start local postgres",
+            );
+            let pool = state.db.pool().clone();
+            let (tenant, channel_id, key) = seed_audio_fixture(&pool).await;
+            let community = tenant.community();
+            let assertion = VerifiedAssertion::for_test(
+                Some(key.public_key()),
+                vec![Utc::now() + Duration::hours(1)],
+            );
+            let relay_url = format!("ws://{}", tenant.host());
+            let conn_cancel = CancellationToken::new();
+
+            let (fanout_rx, fanout_release) =
+                crate::nip_fi_test_hooks::audio_participant_fanout_hook::arm(community);
+            let (teardown_rx, teardown_release) =
+                crate::nip_fi_test_hooks::audio_teardown_cleanup_hook::arm(community);
+
+            let app = axum::Router::new().route(
+                "/",
+                axum::routing::get({
+                    let conn_cancel = conn_cancel.clone();
+                    move |ws: axum::extract::ws::WebSocketUpgrade| {
+                        let (state, tenant, assertion) =
+                            (Arc::clone(&state), tenant.clone(), assertion.clone());
+                        let control =
+                            crate::state::CommunityConnectionControl::new(conn_cancel.clone());
+                        async move {
+                            ws.on_upgrade(move |socket| {
+                                handle_active_audio_connection(
+                                    socket,
+                                    state,
+                                    tenant,
+                                    channel_id,
+                                    control,
+                                    Some(assertion),
+                                    Utc::now(),
+                                    None,
+                                )
+                            })
+                        }
+                    }
+                }),
+            );
+            let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
+                .await
+                .expect("bind test listener");
+            let addr = listener.local_addr().expect("test listener addr");
+            let server = tokio::spawn(async move { axum::serve(listener, app).await });
+
+            let (mut client, _) = tokio_tungstenite::connect_async(format!("ws://{addr}/"))
+                .await
+                .expect("connect client");
+            send_audio_auth(&mut client, &key, &relay_url, 1).await;
+
+            tokio::time::timeout(std::time::Duration::from_secs(10), fanout_rx)
+                .await
+                .expect("handler must commit the join within 10s")
+                .expect("fanout channel closed");
+            fanout_release.notify_one();
+            tokio::time::sleep(std::time::Duration::from_millis(10)).await;
+
+            // From here the client only reads raw bytes, so it never answers
+            // the server's Close.
+            let tokio_tungstenite::MaybeTlsStream::Plain(socket) = client.get_mut() else {
+                panic!("plain TCP client");
+            };
+            let started = std::time::Instant::now();
+            conn_cancel.cancel();
+            tokio::time::timeout(std::time::Duration::from_secs(5), teardown_rx)
+                .await
+                .expect("teardown must reach the stall point")
+                .expect("teardown hook dropped");
+            // The hook runs just after the hand-off, so the socket must end
+            // within the bounded wait measured from here.
+            let handed_off = std::time::Instant::now();
+            let elapsed = time_to_eof(socket, started).await;
+            assert!(
+                elapsed >= WS_TERMINAL_FLUSH_TIMEOUT,
+                "server must wait for the client's Close reply, ended after {elapsed:?}"
+            );
+            let since_hand_off = handed_off.elapsed();
+            assert!(
+                since_hand_off <= WS_TERMINAL_FLUSH_TIMEOUT + std::time::Duration::from_millis(500),
+                "socket must end within the bounded wait after the hand-off, took {since_hand_off:?}"
+            );
+
+            teardown_release.notify_one();
+            server.abort();
+        }
+
+        /// The archived-channel exit sends its error and Close, then releases
+        /// the huddle lease in Redis, which can stall with no deadline. The
+        /// socket must end within the bounded wait for the client's Close
+        /// reply, not when that cleanup finishes. This client never replies
+        /// and the cleanup never finishes.
+        ///
+        /// Mutation: move that exit's `hand_off_socket` below the lease
+        /// release (or remove it) → the socket stays open while the cleanup
+        /// is held → `time_to_eof` hits its watchdog and panics.
+        #[ignore = "requires Postgres — runs in postgres-ci nextest lane"]
+        #[tokio::test]
+        async fn stalled_archived_exit_cleanup_does_not_hold_socket_open() {
+            use crate::connection::terminal_close_delivery_tests::time_to_eof;
+            use crate::connection::WS_TERMINAL_FLUSH_TIMEOUT;
+            use buzz_auth::VerifiedAssertion;
+            use chrono::{Duration, Utc};
+            use std::sync::Arc;
+
+            let state = audio_test_state_real_db().await.expect(
+                "PostgreSQL must be available — set BUZZ_TEST_DATABASE_URL or start local postgres",
+            );
+            let pool = state.db.pool().clone();
+            let (tenant, channel_id, key) = seed_audio_fixture(&pool).await;
+            let community = tenant.community();
+            let assertion = VerifiedAssertion::for_test(
+                Some(key.public_key()),
+                vec![Utc::now() + Duration::hours(1)],
+            );
+            let relay_url = format!("ws://{}", tenant.host());
+
+            let (recheck_rx, recheck_release) =
+                crate::nip_fi_test_hooks::room_archive_recheck_hook::arm(community);
+            let (cleanup_rx, cleanup_release) =
+                crate::nip_fi_test_hooks::archived_exit_cleanup_hook::arm(community);
+
+            let app = axum::Router::new().route(
+                "/",
+                axum::routing::get(move |ws: axum::extract::ws::WebSocketUpgrade| {
+                    let (state, tenant, assertion) =
+                        (Arc::clone(&state), tenant.clone(), assertion.clone());
+                    let control =
+                        crate::state::CommunityConnectionControl::new(CancellationToken::new());
+                    async move {
+                        ws.on_upgrade(move |socket| {
+                            handle_active_audio_connection(
+                                socket,
+                                state,
+                                tenant,
+                                channel_id,
+                                control,
+                                Some(assertion),
+                                Utc::now(),
+                                None,
+                            )
+                        })
+                    }
+                }),
+            );
+            let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
+                .await
+                .expect("bind test listener");
+            let addr = listener.local_addr().expect("test listener addr");
+            let server = tokio::spawn(async move { axum::serve(listener, app).await });
+
+            let (mut client, _) = tokio_tungstenite::connect_async(format!("ws://{addr}/"))
+                .await
+                .expect("connect client");
+            send_audio_auth(&mut client, &key, &relay_url, 1).await;
+
+            // Admission passed the membership check; archive the channel
+            // before the re-check so the join takes the archived exit.
+            tokio::time::timeout(std::time::Duration::from_secs(10), recheck_rx)
+                .await
+                .expect("admission must reach the archive re-check")
+                .expect("re-check hook dropped");
+            sqlx::query("UPDATE channels SET archived_at = NOW() WHERE id = $1")
+                .bind(channel_id)
+                .execute(&pool)
+                .await
+                .expect("archive channel");
+
+            // From here the client only reads raw bytes, so it never answers
+            // the server's Close.
+            let tokio_tungstenite::MaybeTlsStream::Plain(socket) = client.get_mut() else {
+                panic!("plain TCP client");
+            };
+            let started = std::time::Instant::now();
+            recheck_release.notify_one();
+            tokio::time::timeout(std::time::Duration::from_secs(5), cleanup_rx)
+                .await
+                .expect("the archived exit must reach its cleanup")
+                .expect("cleanup hook dropped");
+            let elapsed = time_to_eof(socket, started).await;
+            assert!(
+                elapsed <= WS_TERMINAL_FLUSH_TIMEOUT + std::time::Duration::from_millis(500),
+                "a stalled exit cleanup must not hold the socket open, ended after {elapsed:?}"
+            );
+
+            cleanup_release.notify_one();
+            server.abort();
+        }
+
+        /// A fast refusal hands the socket to a background close and returns.
+        /// The connection permit must stay held until that socket ends, or a
+        /// client that never answers the Close lets open audio sockets exceed
+        /// `BUZZ_MAX_CONNECTIONS`.
+        ///
+        /// Mutation: stop the wrapper from joining the background close → the
+        /// permit is released while the socket is still open → the
+        /// `available_permits() == 0` assertion fails.
+        #[ignore = "requires Postgres — runs in postgres-ci nextest lane"]
+        #[tokio::test]
+        async fn background_close_holds_connection_permit_until_socket_ends() {
+            use crate::connection::terminal_close_delivery_tests::time_to_eof;
+            use buzz_auth::VerifiedAssertion;
+            use chrono::{Duration, Utc};
+            use std::sync::Arc;
+            use tokio::io::AsyncReadExt as _;
+
+            let state = audio_test_state_real_db().await.expect(
+                "PostgreSQL must be available — set BUZZ_TEST_DATABASE_URL or start local postgres",
+            );
+            let pool = state.db.pool().clone();
+            let (tenant, channel_id, key) = seed_audio_fixture(&pool).await;
+            let assertion = VerifiedAssertion::for_test(
+                Some(key.public_key()),
+                vec![Utc::now() + Duration::hours(1)],
+            );
+            let relay_url = format!("ws://{}", tenant.host());
+            let semaphore = Arc::new(tokio::sync::Semaphore::new(1));
+
+            let app = axum::Router::new().route(
+                "/",
+                axum::routing::get({
+                    let semaphore = Arc::clone(&semaphore);
+                    move |ws: axum::extract::ws::WebSocketUpgrade| {
+                        let (state, tenant, assertion) =
+                            (Arc::clone(&state), tenant.clone(), assertion.clone());
+                        let permit = Arc::clone(&semaphore)
+                            .try_acquire_owned()
+                            .expect("one connection permit");
+                        async move {
+                            ws.on_upgrade(move |socket| {
+                                handle_audio_connection(
+                                    socket,
+                                    state,
+                                    tenant,
+                                    channel_id,
+                                    permit,
+                                    Some(assertion),
+                                    None,
+                                    Utc::now(),
+                                )
+                            })
+                        }
+                    }
+                }),
+            );
+            let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
+                .await
+                .expect("bind test listener");
+            let addr = listener.local_addr().expect("test listener addr");
+            let server = tokio::spawn(async move { axum::serve(listener, app).await });
+
+            let (mut client, _) = tokio_tungstenite::connect_async(format!("ws://{addr}/"))
+                .await
+                .expect("connect client");
+            send_audio_auth(&mut client, &key, &relay_url, u8::MAX).await;
+
+            // From here the client only reads raw bytes, so it never answers
+            // the server's Close.
+            let tokio_tungstenite::MaybeTlsStream::Plain(socket) = client.get_mut() else {
+                panic!("plain TCP client");
+            };
+            let mut received = Vec::new();
+            let mut buf = [0u8; 512];
+            while !received
+                .windows(b"unsupported_version".len())
+                .any(|w| w == b"unsupported_version")
+            {
+                let n =
+                    tokio::time::timeout(std::time::Duration::from_secs(5), socket.read(&mut buf))
+                        .await
+                        .expect("refusal must arrive")
+                        .expect("read");
+                assert_ne!(n, 0, "socket ended before the refusal");
+                received.extend_from_slice(&buf[..n]);
+            }
+            let started = std::time::Instant::now();
+            // The refusal has no staged lease, so its cleanup returns at once.
+            tokio::time::sleep(std::time::Duration::from_millis(300)).await;
+            assert_eq!(
+                semaphore.available_permits(),
+                0,
+                "permit must stay held while the refused socket is open"
+            );
+
+            time_to_eof(socket, started).await;
+            tokio::time::timeout(std::time::Duration::from_secs(1), async {
+                while semaphore.available_permits() == 0 {
+                    tokio::time::sleep(std::time::Duration::from_millis(10)).await;
+                }
+            })
+            .await
+            .expect("permit must be released once the socket ends");
+
+            server.abort();
+        }
+
         // ── F1: generation fencing witness ────────────────────────────────────────
         //
         // `commit_participant_join` must include `generation` in the committed
@@ -13662,6 +14246,39 @@ mod tests {
             assert_eq!(close.reason.as_str(), "access revoked");
         }
 
+        /// A deployment without huddle audio refuses the join with its error
+        /// frame and then a Close 1008, so the client gets a clean handshake
+        /// instead of waiting out the peer wait.
+        /// Mutation: drop the Close from the refusal → no Close frame → RED.
+        #[tokio::test]
+        #[ignore = "requires Postgres — runs in postgres-ci nextest lane"]
+        async fn huddle_audio_unavailable_sends_error_then_policy_close() {
+            let state = audio_test_state_real_db_with(|c| c.huddle_audio_available = false)
+                .await
+                .expect(
+                    "PostgreSQL must be available — set BUZZ_TEST_DATABASE_URL or start local postgres",
+                );
+            let (tenant, channel_id, key) = seed_audio_fixture(state.db.pool()).await;
+            let (mut client, server) =
+                start_audio_auth(&state, tenant, channel_id, &key, None, None).await;
+
+            let error = next_audio_text(&mut client).await;
+            assert!(
+                error.contains("\"huddle_audio_unavailable\""),
+                "expected the unavailable refusal; got {error}"
+            );
+            match tokio::time::timeout(std::time::Duration::from_secs(5), client.next())
+                .await
+                .expect("close must follow the refusal")
+            {
+                Some(Ok(tokio_tungstenite::tungstenite::Message::Close(Some(frame)))) => {
+                    assert_eq!(u16::from(frame.code), 1008)
+                }
+                other => panic!("expected Close 1008 after the refusal; got {other:?}"),
+            }
+            server.abort();
+        }
+
         /// Adds `key` as a member of the audio fixture's channel.
         async fn add_channel_member(
             pool: &sqlx::PgPool,
@@ -14568,4 +15185,99 @@ mod tests {
              future never resolves → test hangs → RED"
         );
     }
+
+    /// Real-socket proof that each audio exit path holds the socket for the
+    /// client's Close reply. The raw client never replies, so a server that
+    /// drops the socket right after its Close ends it before the bounded wait.
+    mod terminal_close_delivery {
+        use super::*;
+        use crate::connection::terminal_close_delivery_tests::{
+            raw_client_after_server_close, time_to_eof,
+        };
+        use crate::connection::WS_TERMINAL_FLUSH_TIMEOUT;
+
+        fn expired_assertion() -> VerifiedAssertion {
+            let deadline = chrono::Utc::now() - chrono::Duration::seconds(1);
+            VerifiedAssertion::for_test(Some(nostr::Keys::generate().public_key()), vec![deadline])
+        }
+
+        fn tenant() -> TenantContext {
+            TenantContext::resolved(
+                buzz_core::tenant::CommunityId::from_uuid(Uuid::nil()),
+                "test.local".to_owned(),
+            )
+        }
+
+        async fn assert_holds_for_close_reply(app: Router) {
+            let listener = TcpListener::bind("127.0.0.1:0").await.expect("bind");
+            let address = listener.local_addr().expect("listener address");
+            tokio::spawn(async move { axum::serve(listener, app).await.expect("serve") });
+
+            let started = std::time::Instant::now();
+            let mut socket = raw_client_after_server_close(address).await;
+            let elapsed = time_to_eof(&mut socket, started).await;
+            assert!(
+                elapsed >= WS_TERMINAL_FLUSH_TIMEOUT,
+                "server must wait for the client's Close reply, ended after {elapsed:?}"
+            );
+        }
+
+        /// Expired session refused during bootstrap: the `on_not_run` drain.
+        #[tokio::test]
+        async fn bootstrap_drain_holds_socket_for_client_close_reply() {
+            let state = audio_test_state().await;
+            let app = Router::new().route(
+                "/",
+                get(move |ws: WebSocketUpgrade| {
+                    let state = Arc::clone(&state);
+                    let permit = Arc::new(tokio::sync::Semaphore::new(1))
+                        .try_acquire_owned()
+                        .expect("permit");
+                    async move {
+                        ws.on_upgrade(move |socket| {
+                            handle_audio_connection(
+                                socket,
+                                state,
+                                tenant(),
+                                Uuid::new_v4(),
+                                permit,
+                                Some(expired_assertion()),
+                                None,
+                                chrono::Utc::now(),
+                            )
+                        })
+                    }
+                }),
+            );
+            assert_holds_for_close_reply(app).await;
+        }
+
+        /// Expired session inside the active handler: an early admission exit.
+        #[tokio::test]
+        async fn active_handler_exit_holds_socket_for_client_close_reply() {
+            let state = audio_test_state().await;
+            let app = Router::new().route(
+                "/",
+                get(move |ws: WebSocketUpgrade| {
+                    let state = Arc::clone(&state);
+                    async move {
+                        ws.on_upgrade(move |socket| {
+                            let cancel = CancellationToken::new();
+                            handle_active_audio_connection(
+                                socket,
+                                state,
+                                tenant(),
+                                Uuid::new_v4(),
+                                CommunityConnectionControl::new(cancel),
+                                Some(expired_assertion()),
+                                chrono::Utc::now(),
+                                None,
+                            )
+                        })
+                    }
+                }),
+            );
+            assert_holds_for_close_reply(app).await;
+        }
+    }
 }
diff --git a/crates/buzz-relay/src/config.rs b/crates/buzz-relay/src/config.rs
index 49be08ede0..c587965b77 100644
--- a/crates/buzz-relay/src/config.rs
+++ b/crates/buzz-relay/src/config.rs
@@ -406,6 +406,11 @@ pub struct Config {
     /// (`BUZZ_NIP_FI_PROVISION_BINDING`). `None` binds nothing at creation.
     /// Parsed whatever the NIP-FI mode, since creation happens in every mode.
     pub nip_fi_provision_binding: Option<buzz_auth::ProvisionBindingPolicy>,
+
+    /// Database resolver bounds (`BUZZ_NIP_FI_RESOLVER_*`,
+    /// `BUZZ_NIP_FI_SNAPSHOT_*`). Validated in every mode, so a bad value
+    /// fails the deploy that sets it, not the later switch to shadow.
+    pub nip_fi_resolver_bounds: crate::nip_fi_resolver::ResolverBounds,
 }
 
 fn parse_bind_addr(raw: &str) -> Result<SocketAddr, ConfigError> {
@@ -1402,6 +1407,18 @@ impl Config {
         };
 
         let nip_fi = crate::nip_fi_config::NipFiRelayConfig::from_env()?;
+        let nip_fi_provision_binding = crate::nip_fi_config::parse_provision_binding()?;
+        let nip_fi_resolver_bounds =
+            crate::nip_fi_resolver::ResolverBounds::from_env(db_pool_size)?;
+        if nip_fi.source == crate::nip_fi_config::CommunitySource::Database
+            && nip_fi_provision_binding.is_none()
+        {
+            return Err(ConfigError::InvalidValue(
+                "BUZZ_NIP_FI_COMMUNITY_SOURCE=database requires BUZZ_NIP_FI_PROVISION_BINDING \
+                 (the suffix and reserved host)"
+                    .into(),
+            ));
+        }
         Ok(Self {
             bind_addr,
             database_url,
@@ -1468,7 +1485,8 @@ impl Config {
             admin,
             web_dir,
             serve_git_web_gui,
-            nip_fi_provision_binding: crate::nip_fi_config::parse_provision_binding()?,
+            nip_fi_provision_binding,
+            nip_fi_resolver_bounds,
             nip_fi,
         })
     }
@@ -1540,6 +1558,83 @@ mod tests {
         (fi, cfg)
     }
 
+    // The three `source=database` startup guards. Mutation: dropping any one
+    // lets that configuration start.
+    #[test]
+    fn database_source_config_guards_refuse_startup() {
+        const VARS: [&str; 6] = [
+            "BUZZ_NIP_FI_COMMUNITY_SOURCE",
+            "BUZZ_NIP_FI_COMMUNITIES",
+            "BUZZ_NIP_FI_ISSUERS",
+            "BUZZ_NIP_FI_PROVISION_BINDING",
+            "BUZZ_NIP_FI_MAX_CONNECTION_LIFETIME_SECS",
+            "BUZZ_NIP_FI_MODE",
+        ];
+        struct Clear;
+        impl Drop for Clear {
+            fn drop(&mut self) {
+                for v in VARS {
+                    std::env::remove_var(v);
+                }
+            }
+        }
+        let _guards = env_guards();
+        let _clear = Clear;
+        let refusal = || match Config::from_env() {
+            Err(ConfigError::InvalidValue(message)) => message,
+            other => panic!("expected a refusal, got {:?}", other.map(|_| ())),
+        };
+
+        std::env::set_var("BUZZ_NIP_FI_COMMUNITY_SOURCE", "ldap");
+        assert!(refusal().contains("must be \"env\" or \"database\""));
+
+        std::env::set_var("BUZZ_NIP_FI_COMMUNITY_SOURCE", "database");
+        std::env::set_var("BUZZ_NIP_FI_COMMUNITIES", "[]");
+        assert!(refusal().contains("BUZZ_NIP_FI_COMMUNITIES is set"));
+
+        std::env::remove_var("BUZZ_NIP_FI_COMMUNITIES");
+        std::env::set_var(
+            "BUZZ_NIP_FI_ISSUERS",
+            serde_json::json!([{
+                "issuer": "https://idp.example.com",
+                "command_audiences": ["https://relay.example.com"],
+                "token_class": "nip-fi+jwt",
+                "algorithms": ["ES256"],
+                "maximum_assertion_age_seconds": 3600,
+                "jwks_uri": "https://idp.example.com/.well-known/jwks.json",
+                "jwks_refresh_interval_seconds": 300,
+                "jwks_hard_deadline_seconds": 86400,
+                "maximum_command_age_seconds": 30,
+                "authorized_principals": ["https://idp.example.com/operator"]
+            }])
+            .to_string(),
+        );
+        std::env::set_var("BUZZ_NIP_FI_MAX_CONNECTION_LIFETIME_SECS", "3600");
+        assert!(refusal().contains("requires BUZZ_NIP_FI_PROVISION_BINDING"));
+
+        std::env::set_var(
+            "BUZZ_NIP_FI_PROVISION_BINDING",
+            r#"{"host_suffix":"communities.example.com","authorized_issuers":["https://idp.example.com"]}"#,
+        );
+        let config = Config::from_env().expect("complete database-source config");
+        assert!(config.nip_fi_provision_binding.is_some());
+    }
+
+    // Mutation: parsing the resolver bounds only when the resolver is built
+    // lets an off-mode deploy carry a value the switch to shadow refuses.
+    #[test]
+    fn resolver_bounds_are_validated_in_off_mode() {
+        let _guards = env_guards();
+        std::env::set_var("BUZZ_NIP_FI_RESOLVER_MAX_INFLIGHT", "0");
+        let result = Config::from_env();
+        std::env::remove_var("BUZZ_NIP_FI_RESOLVER_MAX_INFLIGHT");
+        assert!(
+            matches!(result, Err(ref e) if e.to_string().contains("BUZZ_NIP_FI_RESOLVER_MAX_INFLIGHT")),
+            "{:?}",
+            result.map(|_| ())
+        );
+    }
+
     /// Look up against a fixed set, standing in for process env.
     fn env_of<'a>(set: &'a [(&'a str, &'a str)]) -> impl Fn(&str) -> Option<String> + use<'a> {
         move |name| {
diff --git a/crates/buzz-relay/src/connection.rs b/crates/buzz-relay/src/connection.rs
index b341f9b214..ad58fd032f 100644
--- a/crates/buzz-relay/src/connection.rs
+++ b/crates/buzz-relay/src/connection.rs
@@ -29,8 +29,10 @@ use crate::state::{
 /// Maximum time a new socket may hold a connection slot without completing NIP-42 auth.
 const AUTH_TIMEOUT: Duration = Duration::from_secs(5);
 
-/// Maximum time the writer may spend flushing terminal frames after cancellation.
-/// This stays well inside the process-wide 30-second hard drain.
+/// Bounds each of the two stages of ending a socket: writing its terminal
+/// frames after cancellation, then waiting for the client's Close reply
+/// (`await_client_close`). Both stay well inside the process-wide 30-second
+/// hard drain.
 pub(crate) const WS_TERMINAL_FLUSH_TIMEOUT: Duration = Duration::from_secs(1);
 
 /// Shared mutable subscription map for a single WebSocket connection: sub ID →
@@ -362,6 +364,12 @@ pub(crate) async fn handle_connection(
     nip_fi_shadow: Option<Arc<crate::nip_fi_shadow_session::ShadowSession>>,
     connection_time: chrono::DateTime<chrono::Utc>,
 ) {
+    // Held through bootstrap, the active handler and any refusal drain, so a
+    // socket counts against `BUZZ_MAX_CONNECTIONS` for as long as it is open.
+    let Ok(_permit) = state.conn_semaphore.clone().try_acquire_owned() else {
+        warn!("Connection limit reached, rejecting {addr}");
+        return;
+    };
     let conn_id = Uuid::new_v4();
     let cancel = CancellationToken::new();
 
@@ -417,6 +425,11 @@ pub(crate) async fn handle_connection(
     let rx_for_run = Arc::clone(&rx_shared);
     let rx_for_drain = Arc::clone(&rx_shared);
 
+    // The drain path parks the read half here so the bounded wait for the
+    // client's Close runs after the registry entry is released.
+    let unread_shared = Arc::new(Mutex::new(None));
+    let unread_for_drain = Arc::clone(&unread_shared);
+
     run_registered_community_connection(
         &registry,
         conn_id,
@@ -453,45 +466,22 @@ pub(crate) async fn handle_connection(
             .await
         },
         move || async move {
-            // Drain the pre-terminal channel (NIP-FI denial frame, if any) and
-            // close the socket with a bounded timeout so a queued denial is
-            // delivered even when the active-connection path is never entered.
+            // Deliver a queued denial frame (if any) and the reason's Close
+            // even when the active-connection path is never entered.
             let socket = socket_for_drain.lock().await.take();
-            let mut pre_terminal_ctrl_rx = rx_for_drain.lock().await.take();
+            let queued = rx_for_drain.lock().await.take();
             if let Some(socket) = socket {
-                let (mut ws_send, _ws_recv) = socket.split();
-                // Terminal channel has capacity 1; if the expiry task fired, it holds
-                // exactly one denial frame here. Deliver it before closing.
-                if let Some(ref mut rx) = pre_terminal_ctrl_rx {
-                    while let Ok(msg) = rx.try_recv() {
-                        let _ = tokio::time::timeout(
-                            WS_TERMINAL_FLUSH_TIMEOUT,
-                            futures_util::SinkExt::send(&mut ws_send, msg),
-                        )
-                        .await;
-                    }
-                }
-                // A published reason (e.g. an expiry denial) closes with its
-                // own frame, exactly as the writer would.
                 let close = drain_reason.borrow().map(|reason| reason.close_message());
-                if let Some(close) = close {
-                    let _ = tokio::time::timeout(
-                        WS_TERMINAL_FLUSH_TIMEOUT,
-                        futures_util::SinkExt::send(&mut ws_send, close),
-                    )
-                    .await;
-                }
-                // Close the socket so the client sees a clean close rather than
-                // an abrupt TCP reset.
-                let _ = tokio::time::timeout(
-                    WS_TERMINAL_FLUSH_TIMEOUT,
-                    futures_util::SinkExt::close(&mut ws_send),
-                )
-                .await;
+                let ws_recv = drain_refused_socket(socket, queued, close).await;
+                *unread_for_drain.lock().await = Some(ws_recv);
             }
         },
     )
     .await;
+    let unread = unread_shared.lock().await.take();
+    if let Some(ws_recv) = unread {
+        await_client_close(ws_recv).await;
+    }
 }
 
 // `handle_active_connection` inherits the connection handler's natural parameter
@@ -517,13 +507,6 @@ async fn handle_active_connection(
     // connection_time is threaded in from the HTTP handler (captured immediately
     // before on_upgrade) so the session partition is rooted at the true upgrade
     // instant, not the post-community-active-check instant. [FI-TRACE-LEASE-BOUND]
-    let permit = match state.conn_semaphore.clone().try_acquire_owned() {
-        Ok(p) => p,
-        Err(_) => {
-            warn!("Connection limit reached, rejecting {addr}");
-            return;
-        }
-    };
 
     let challenge = generate_challenge();
 
@@ -551,6 +534,8 @@ async fn handle_active_connection(
 
     let backpressure_count = Arc::new(AtomicU8::new(0));
     let subscriptions = Arc::new(Mutex::new(HashMap::new()));
+    #[cfg(test)]
+    test_seam::hold_subscriptions(&subscriptions).await;
 
     // Compute the NIP-FI session deadline from the assertion.
     //
@@ -729,7 +714,7 @@ async fn handle_active_connection(
         };
         auth_cancel_conn.finish_pending_auth_on_cancel(outcome);
     });
-    recv_loop(
+    let (ws_recv, in_flight) = recv_loop(
         ws_recv,
         Arc::clone(&conn),
         Arc::clone(&state),
@@ -749,30 +734,43 @@ async fn handle_active_connection(
     let authenticated = auth_lifecycle.finish(close_outcome);
 
     let _ = send_task.await;
-    let _ = heartbeat_task.await;
-    let _ = auth_timeout_task.await;
-    if let Some(task) = nip_fi_expiry_task {
-        let _ = task.await;
-    }
-    let _ = auth_cancel_task.await;
 
-    crate::handlers::close::release_connection_subscriptions(&conn, &state).await;
-    state.conn_manager.deregister(conn.conn_id);
-    if let Some(auth_ctx) = authenticated {
-        if !state.conn_manager.has_admitted_connection(
-            conn.tenant.community(),
-            auth_ctx.pubkey.to_bytes().as_slice(),
-        ) {
-            let _ = state
-                .pubsub
-                .clear_presence(&conn.tenant, &auth_ctx.pubkey)
-                .await;
+    // The writer is done, so the server's Close (if any) is sent. Wait on the
+    // peer alongside the remaining joins and cleanup: the expiry barrier and
+    // Redis can block without a deadline, and neither may hold the socket
+    // open past the bounded peer wait.
+    let cleanup = async {
+        // A frame handler interrupted by cancellation was spawned, so it keeps
+        // running (and can release any effect permit the expiry barrier waits
+        // on). Finish it before application cleanup so nothing is half-retired.
+        if let Some(task) = in_flight {
+            if let Err(error) = task.await {
+                warn!(conn_id = %conn.conn_id, "interrupted frame handler failed: {error}");
+            }
         }
-    }
+        let _ = heartbeat_task.await;
+        let _ = auth_timeout_task.await;
+        if let Some(task) = nip_fi_expiry_task {
+            let _ = task.await;
+        }
+        let _ = auth_cancel_task.await;
+        crate::handlers::close::release_connection_subscriptions(&conn, &state).await;
+        state.conn_manager.deregister(conn.conn_id);
+        if let Some(auth_ctx) = authenticated {
+            if !state.conn_manager.has_admitted_connection(
+                conn.tenant.community(),
+                auth_ctx.pubkey.to_bytes().as_slice(),
+            ) {
+                let _ = state
+                    .pubsub
+                    .clear_presence(&conn.tenant, &auth_ctx.pubkey)
+                    .await;
+            }
+        }
+    };
+    tokio::join!(cleanup, await_client_close(ws_recv));
     metrics::gauge!("buzz_ws_connections_active").decrement(1.0);
     info!(conn_id = %conn_id, addr = %addr, "WebSocket connection closed");
-
-    drop(permit);
 }
 
 /// Send WebSocket messages in priority order: control frames before data frames.
@@ -871,31 +869,23 @@ async fn flush_terminal_frames<S>(
     first_ctrl: Option<WsMessage>,
 ) where
     S: Sink<WsMessage> + Unpin,
+    S::Error: std::error::Error + 'static,
 {
     let deadline = tokio::time::Instant::now() + WS_TERMINAL_FLUSH_TIMEOUT;
     // 1. Drain FI terminal channel first — denial frame must precede the close.
     while let Ok(terminal_msg) = terminal_ctrl_rx.try_recv() {
-        if !matches!(
-            tokio::time::timeout_at(deadline, sink.send(terminal_msg)).await,
-            Ok(Ok(()))
-        ) {
+        if !send_terminal_frame(sink, terminal_msg, deadline, "terminal").await {
             return;
         }
     }
     // 2. Drain ordinary control frames (ban reason, etc.).
     if let Some(ctrl_msg) = first_ctrl {
-        if !matches!(
-            tokio::time::timeout_at(deadline, sink.send(ctrl_msg)).await,
-            Ok(Ok(()))
-        ) {
+        if !send_terminal_frame(sink, ctrl_msg, deadline, "control").await {
             return;
         }
     }
     while let Ok(ctrl_msg) = ctrl_rx.try_recv() {
-        if !matches!(
-            tokio::time::timeout_at(deadline, sink.send(ctrl_msg)).await,
-            Ok(Ok(()))
-        ) {
+        if !send_terminal_frame(sink, ctrl_msg, deadline, "control").await {
             return;
         }
     }
@@ -903,7 +893,46 @@ async fn flush_terminal_frames<S>(
     let close = disconnect_reason
         .borrow()
         .map_or(WsMessage::Close(None), |reason| reason.close_message());
-    let _ = tokio::time::timeout_at(deadline, sink.send(close)).await;
+    send_terminal_frame(sink, close, deadline, "close").await;
+}
+
+/// One deadline-bounded terminal write. Failures stay best-effort but are
+/// logged, so an undelivered denial or Close is diagnosable.
+async fn send_terminal_frame<S>(
+    sink: &mut S,
+    frame: WsMessage,
+    deadline: tokio::time::Instant,
+    frame_kind: &'static str,
+) -> bool
+where
+    S: Sink<WsMessage> + Unpin,
+    S::Error: std::error::Error + 'static,
+{
+    match tokio::time::timeout_at(deadline, sink.send(frame)).await {
+        Ok(Ok(())) => true,
+        Ok(Err(error)) => {
+            if !closed_by_peer(&error) {
+                debug!(frame_kind, "terminal frame send failed: {error}");
+            }
+            false
+        }
+        Err(_) => {
+            debug!(frame_kind, "terminal frame send timed out");
+            false
+        }
+    }
+}
+
+/// Whether a write failed only because the close handshake is already under
+/// way, as when the client closed first. Not a delivery failure, so not logged.
+fn closed_by_peer(error: &(dyn std::error::Error + 'static)) -> bool {
+    use tungstenite::error::{Error, ProtocolError};
+    std::iter::successors(Some(error), |error| error.source()).any(|error| {
+        matches!(
+            error.downcast_ref::<Error>(),
+            Some(Error::AlreadyClosed | Error::Protocol(ProtocolError::SendAfterClosing))
+        )
+    })
 }
 
 /// Writes a WebSocket exit path's frames before a writer task owns the socket.
@@ -916,16 +945,55 @@ pub(crate) async fn send_exit_frames_bounded<S>(
     frames: impl IntoIterator<Item = WsMessage>,
 ) where
     S: Sink<WsMessage> + Unpin,
+    S::Error: std::error::Error + 'static,
 {
     let deadline = tokio::time::Instant::now() + WS_TERMINAL_FLUSH_TIMEOUT;
+    send_frames_by(sink, frames, deadline).await;
+}
+
+/// Writes `frames` in order until one fails or `deadline` passes. Returns
+/// whether every frame was written.
+async fn send_frames_by<S>(
+    sink: &mut S,
+    frames: impl IntoIterator<Item = WsMessage>,
+    deadline: tokio::time::Instant,
+) -> bool
+where
+    S: Sink<WsMessage> + Unpin,
+    S::Error: std::error::Error + 'static,
+{
     for frame in frames {
-        if !matches!(
-            tokio::time::timeout_at(deadline, sink.send(frame)).await,
-            Ok(Ok(()))
-        ) {
-            return;
+        if !send_terminal_frame(sink, frame, deadline, "exit").await {
+            return false;
         }
     }
+    true
+}
+
+/// Ends a socket refused before its session handler ran: writes the frames
+/// still `queued` for it, then `close`, then closes the sink, all under one
+/// `WS_TERMINAL_FLUSH_TIMEOUT` deadline. Returns the read half, which the
+/// caller passes to `await_client_close` once it has released anything the
+/// wait must not hold. Shared by the relay and audio routes.
+pub(crate) async fn drain_refused_socket(
+    socket: WebSocket,
+    queued: Option<mpsc::Receiver<WsMessage>>,
+    close: Option<WsMessage>,
+) -> futures_util::stream::SplitStream<WebSocket> {
+    let (mut ws_send, ws_recv) = socket.split();
+    let deadline = tokio::time::Instant::now() + WS_TERMINAL_FLUSH_TIMEOUT;
+    let queued = queued
+        .into_iter()
+        .flat_map(|mut rx| std::iter::from_fn(move || rx.try_recv().ok()));
+    if send_frames_by(&mut ws_send, queued.chain(close), deadline).await {
+        match tokio::time::timeout_at(deadline, ws_send.close()).await {
+            Ok(Ok(())) => {}
+            Ok(Err(error)) if closed_by_peer(&error) => {}
+            Ok(Err(error)) => debug!("refused socket close failed: {error}"),
+            Err(_) => debug!("refused socket close timed out"),
+        }
+    }
+    ws_recv
 }
 
 async fn send_loop_inner<S>(
@@ -938,6 +1006,7 @@ async fn send_loop_inner<S>(
     disconnect_reason: watch::Receiver<Option<CommunityDisconnectReason>>,
 ) where
     S: Sink<WsMessage> + Unpin,
+    S::Error: std::error::Error + 'static,
 {
     loop {
         // Priority: drain all pending control frames before data.
@@ -1102,12 +1171,20 @@ async fn heartbeat_loop(
     }
 }
 
+/// Reads and handles client frames until the connection is cancelled or the
+/// stream ends. Returns the read half, for the bounded wait on the client's
+/// Close, and the handle of a frame handler that cancellation interrupted, if
+/// any: the caller must join that handle before subscription cleanup so the
+/// interrupted handler never leaves a subscription half-retired.
 async fn recv_loop(
     mut ws_recv: futures_util::stream::SplitStream<WebSocket>,
     conn: Arc<ConnectionState>,
     state: Arc<AppState>,
     missed_pongs: Arc<AtomicU8>,
     cancel: CancellationToken,
+) -> (
+    futures_util::stream::SplitStream<WebSocket>,
+    Option<tokio::task::JoinHandle<()>>,
 ) {
     loop {
         tokio::select! {
@@ -1130,7 +1207,10 @@ async fn recv_loop(
                             break;
                         }
                         trace!(len = text.len(), "frame received");
-                        handle_text_message(text.to_string(), Arc::clone(&conn), Arc::clone(&state)).await;
+                        let frame = handle_text_message(text.to_string(), Arc::clone(&conn), Arc::clone(&state));
+                        if let Some(task) = run_frame(frame, &cancel).await {
+                            return (ws_recv, Some(task));
+                        }
                     }
                     Some(Ok(WsMessage::Binary(bytes))) => {
                         let max_frame_bytes = state.config.max_frame_bytes;
@@ -1152,7 +1232,10 @@ async fn recv_loop(
                         // (notably certain Nostr libraries) send text payloads in binary frames.
                         // NIP-01 is text-only, but accepting binary is a common relay extension.
                         if let Ok(text) = String::from_utf8(bytes.to_vec()) {
-                            handle_text_message(text, Arc::clone(&conn), Arc::clone(&state)).await;
+                            let frame = handle_text_message(text, Arc::clone(&conn), Arc::clone(&state));
+                            if let Some(task) = run_frame(frame, &cancel).await {
+                                return (ws_recv, Some(task));
+                            }
                         }
                     }
                     Some(Ok(WsMessage::Pong(_))) => {
@@ -1181,6 +1264,42 @@ async fn recv_loop(
             _ = cancel.cancelled() => break,
         }
     }
+    (ws_recv, None)
+}
+
+/// Runs one frame handler inline, keeping frames serial while the connection
+/// is live. If the connection is cancelled first, the handler is spawned to
+/// finish rather than dropped (dropping could half-retire a subscription), and
+/// its handle is returned so the reader can give back its read half at once.
+async fn run_frame(
+    frame: impl std::future::Future<Output = ()> + Send + 'static,
+    cancel: &CancellationToken,
+) -> Option<tokio::task::JoinHandle<()>> {
+    let mut frame = Box::pin(frame);
+    tokio::select! {
+        biased;
+        () = &mut frame => None,
+        () = cancel.cancelled() => Some(tokio::spawn(frame)),
+    }
+}
+
+/// Holds the read half open until the close handshake finishes and the stream
+/// ends, bounded by `WS_TERMINAL_FLUSH_TIMEOUT`. Dropping TCP before the peer
+/// finishes the close handshake (including in-flight peer frames) can make the
+/// client lose the unread NOTICE and Close and report an abnormal `1006`.
+///
+/// Reading on past the client's Close matters: when the client closed first,
+/// tungstenite only queues our reply Close and writes it on the next read, so
+/// stopping at the client's Close would drop TCP with the reply unsent. Once
+/// the handshake completes, the next read ends the stream at once.
+pub(crate) async fn await_client_close(mut ws_recv: futures_util::stream::SplitStream<WebSocket>) {
+    let drained = tokio::time::timeout(WS_TERMINAL_FLUSH_TIMEOUT, async {
+        while let Some(Ok(_)) = ws_recv.next().await {}
+    })
+    .await;
+    if drained.is_err() {
+        debug!("client did not answer Close before the terminal deadline");
+    }
 }
 
 async fn handle_text_message(text: String, conn: Arc<ConnectionState>, state: Arc<AppState>) {
@@ -1303,6 +1422,28 @@ async fn handle_text_message(text: String, conn: Arc<ConnectionState>, state: Ar
     }
 }
 
+#[cfg(test)]
+pub(crate) mod test_seam {
+    use super::*;
+
+    pub(crate) type Hold =
+        tokio::sync::oneshot::Sender<tokio::sync::OwnedMutexGuard<HashMap<String, u64>>>;
+
+    tokio::task_local! {
+        /// Hands the test this connection's subscription lock, already held,
+        /// before the reader can take it.
+        pub(crate) static SUBSCRIPTIONS_HOLD: StdMutex<Option<Hold>>;
+    }
+
+    pub(super) async fn hold_subscriptions(subscriptions: &ConnectionSubscriptions) {
+        if let Ok(Some(hold)) =
+            SUBSCRIPTIONS_HOLD.try_with(|hold| hold.lock().expect("hold").take())
+        {
+            let _ = hold.send(Arc::clone(subscriptions).lock_owned().await);
+        }
+    }
+}
+
 #[cfg(test)]
 pub(crate) mod tests {
     use super::*;
@@ -3198,3 +3339,665 @@ pub(crate) mod tests {
         let _ = server.await;
     }
 }
+
+/// Close-code delivery of NIP-FI authorization denials over a real WebSocket.
+/// The mock-sink writer tests prove frame order; these prove what a client
+/// actually reads off the wire.
+#[cfg(test)]
+pub(crate) mod terminal_close_delivery_tests {
+    use super::*;
+    use axum::{extract::ws::WebSocketUpgrade, routing::get, Router};
+    use buzz_auth::VerifiedAssertion;
+    use nostr::{EventBuilder, Keys, RelayUrl};
+    use tokio::net::TcpListener;
+    use tokio_tungstenite::tungstenite::{protocol::frame::coding::CloseCode, Message};
+
+    type Client = tokio_tungstenite::WebSocketStream<
+        tokio_tungstenite::MaybeTlsStream<tokio::net::TcpStream>,
+    >;
+
+    /// Serves `handle_active_connection` for one assertion. `prefire_expiry`
+    /// arms an already-expired session gate, as `handle_connection` does.
+    async fn serve(
+        assertion: VerifiedAssertion,
+        prefire_expiry: bool,
+    ) -> (std::net::SocketAddr, RelayUrl, Arc<AppState>, Uuid) {
+        serve_with_seams(assertion, prefire_expiry, Seams::default()).await
+    }
+
+    /// How long after upgrade a session armed with `Seams::effect_hold`
+    /// expires. Long enough that a loaded runner still delivers a frame the
+    /// client sends at once before the deadline.
+    const EFFECT_HOLD_EXPIRY: chrono::Duration = chrono::Duration::seconds(2);
+
+    /// Optional test hooks for `serve_with_seams`.
+    #[derive(Default)]
+    struct Seams {
+        /// Runs the handler inside this pause so the test can stall the
+        /// connection's final subscription cleanup.
+        cleanup_pause: Option<Arc<crate::handlers::close::test_seam::Pause>>,
+        /// The session instead expires `EFFECT_HOLD_EXPIRY` after upgrade, and
+        /// the test receives a session effect permit taken before the
+        /// deadline, so the expiry task stalls at its quiescence barrier.
+        effect_hold: Option<tokio::sync::oneshot::Sender<crate::nip_fi_gate::SessionEffectPermit>>,
+        /// Receives the connection's subscription lock, taken before the
+        /// reader starts, so a frame handler that needs it blocks until the
+        /// test drops it.
+        subscriptions_hold: Option<super::test_seam::Hold>,
+    }
+
+    /// Like `serve`, with the test hooks in `seams`.
+    async fn serve_with_seams(
+        assertion: VerifiedAssertion,
+        prefire_expiry: bool,
+        Seams {
+            cleanup_pause,
+            effect_hold,
+            subscriptions_hold,
+        }: Seams,
+    ) -> (std::net::SocketAddr, RelayUrl, Arc<AppState>, Uuid) {
+        let effect_hold = Arc::new(std::sync::Mutex::new(effect_hold));
+        let subscriptions_hold = Arc::new(std::sync::Mutex::new(subscriptions_hold));
+        let state = crate::state::tests::test_state().await;
+        let served_state = Arc::clone(&state);
+        let conn_id = Uuid::new_v4();
+        let tenant = TenantContext::resolved(
+            buzz_core::tenant::CommunityId::from_uuid(Uuid::nil()),
+            "test.local".to_owned(),
+        );
+        let relay_url =
+            crate::api::bridge::nip42_expected_relay_url(&state.config.relay_url, &tenant)
+                .parse()
+                .expect("expected NIP-42 relay URL");
+        let app = Router::new().route(
+            "/",
+            get(move |ws: WebSocketUpgrade| {
+                let (state, tenant, assertion, cleanup_pause) = (
+                    Arc::clone(&state),
+                    tenant.clone(),
+                    assertion.clone(),
+                    cleanup_pause.clone(),
+                );
+                let effect_hold = effect_hold.lock().expect("effect hold").take();
+                let subscriptions_hold = subscriptions_hold.lock().expect("subs hold").take();
+                async move {
+                    ws.on_upgrade(move |socket| async move {
+                        let cancel = CancellationToken::new();
+                        let control = CommunityConnectionControl::new(cancel.clone());
+                        let offset = if effect_hold.is_some() {
+                            EFFECT_HOLD_EXPIRY
+                        } else {
+                            chrono::Duration::seconds(-1)
+                        };
+                        let pre_built = prefire_expiry.then(|| {
+                            let deadline = chrono::Utc::now() + offset;
+                            let (tx, rx) = mpsc::channel::<WsMessage>(1);
+                            let gate =
+                                crate::nip_fi_gate::SessionAdmissionGate::new(deadline, cancel);
+                            let expiry = crate::nip_fi_session::spawn_nip_fi_expiry_task(
+                                deadline,
+                                Arc::clone(&gate),
+                                control.clone(),
+                                tx.clone(),
+                                crate::nip_fi_session::NipFiWsRoute::Root,
+                            );
+                            (gate, tx, rx, Some(expiry))
+                        });
+                        if let (Some(hold), Some((gate, ..))) = (effect_hold, &pre_built) {
+                            let permit = gate.acquire_effect().await.expect("effect permit");
+                            let _ = hold.send(permit);
+                        }
+                        let handler = handle_active_connection(
+                            socket,
+                            state,
+                            "127.0.0.1:1234".parse().expect("client address"),
+                            tenant,
+                            conn_id,
+                            control,
+                            Some(assertion),
+                            chrono::Utc::now(),
+                            pre_built,
+                        );
+                        let handler = super::test_seam::SUBSCRIPTIONS_HOLD
+                            .scope(std::sync::Mutex::new(subscriptions_hold), handler);
+                        match cleanup_pause {
+                            Some(pause) => {
+                                crate::handlers::close::test_seam::CLEANUP_PAUSE
+                                    .scope(pause, handler)
+                                    .await;
+                            }
+                            None => handler.await,
+                        }
+                    })
+                }
+            }),
+        );
+        let listener = TcpListener::bind("127.0.0.1:0").await.expect("bind");
+        let address = listener.local_addr().expect("listener address");
+        tokio::spawn(async move { axum::serve(listener, app).await.expect("serve") });
+        (address, relay_url, served_state, conn_id)
+    }
+
+    async fn connect(address: std::net::SocketAddr) -> Client {
+        tokio_tungstenite::connect_async(format!("ws://{address}/"))
+            .await
+            .expect("connect")
+            .0
+    }
+
+    fn expired_assertion() -> VerifiedAssertion {
+        let deadline = chrono::Utc::now() - chrono::Duration::seconds(1);
+        VerifiedAssertion::for_test(Some(Keys::generate().public_key()), vec![deadline])
+    }
+
+    /// Reads until the stream ends. Returns the text frames and the close
+    /// frame, or the error that ended the stream without one.
+    async fn read_to_close(client: &mut Client) -> (Vec<String>, Result<(u16, String), String>) {
+        let mut texts = Vec::new();
+        loop {
+            let frame = tokio::time::timeout(std::time::Duration::from_secs(5), client.next())
+                .await
+                .expect("socket must terminate");
+            match frame {
+                Some(Ok(Message::Text(text))) => texts.push(text.to_string()),
+                Some(Ok(Message::Close(Some(close)))) => {
+                    return (texts, Ok((u16::from(close.code), close.reason.to_string())))
+                }
+                Some(Ok(Message::Close(None))) => return (texts, Err("close without code".into())),
+                Some(Ok(_)) => {}
+                Some(Err(error)) => return (texts, Err(error.to_string())),
+                None => return (texts, Err("stream ended without close".into())),
+            }
+        }
+    }
+
+    fn assert_denied_with_1008(texts: &[String], close: Result<(u16, String), String>) {
+        assert!(
+            texts
+                .iter()
+                .any(|t| t.contains("restricted: authorization denied")),
+            "denial NOTICE must arrive, got {texts:?}"
+        );
+        assert_eq!(
+            close,
+            Ok((
+                u16::from(CloseCode::Policy),
+                "authorization denied".to_owned()
+            )),
+            "denial must end with close 1008"
+        );
+    }
+
+    #[tokio::test]
+    async fn key_pairing_mismatch_closes_with_1008_on_real_socket() {
+        let asserted = Keys::generate();
+        let assertion = VerifiedAssertion::for_test(
+            Some(asserted.public_key()),
+            vec![chrono::Utc::now() + chrono::Duration::hours(1)],
+        );
+        let (address, relay_url, _, _) = serve(assertion, false).await;
+        let mut client = connect(address).await;
+
+        let Some(Ok(Message::Text(challenge))) = client.next().await else {
+            panic!("expected AUTH challenge")
+        };
+        let challenge: serde_json::Value =
+            serde_json::from_str(&challenge).expect("challenge json");
+        let auth = EventBuilder::auth(challenge[1].as_str().expect("challenge"), relay_url)
+            .sign_with_keys(&Keys::generate())
+            .expect("sign AUTH");
+        client
+            .send(Message::Text(
+                serde_json::json!(["AUTH", auth]).to_string().into(),
+            ))
+            .await
+            .expect("send AUTH");
+
+        let (texts, close) = read_to_close(&mut client).await;
+        assert_denied_with_1008(&texts, close);
+    }
+
+    #[tokio::test]
+    async fn session_expiry_denial_closes_with_1008_on_real_socket() {
+        let (address, _, _, _) = serve(expired_assertion(), true).await;
+        let mut client = connect(address).await;
+
+        let (texts, close) = read_to_close(&mut client).await;
+        assert_denied_with_1008(&texts, close);
+    }
+
+    /// Upgrades a raw TCP client and reads whole frames (server frames are
+    /// unmasked) through the server's Close, so a 0x88 byte inside a payload
+    /// or length cannot end the wait early.
+    pub(crate) async fn raw_client_after_server_close(
+        address: std::net::SocketAddr,
+    ) -> tokio::net::TcpStream {
+        raw_client_sending_then_after_server_close(address, &[]).await
+    }
+
+    /// Like `raw_client_after_server_close`, but writes `frames` (masked
+    /// client frames) once the upgrade completes.
+    async fn raw_client_sending_then_after_server_close(
+        address: std::net::SocketAddr,
+        frames: &[u8],
+    ) -> tokio::net::TcpStream {
+        use tokio::io::{AsyncReadExt as _, AsyncWriteExt as _};
+
+        let mut socket = tokio::net::TcpStream::connect(address)
+            .await
+            .expect("connect");
+        socket
+            .write_all(
+                b"GET / HTTP/1.1\r\nHost: test.local\r\nUpgrade: websocket\r\n\
+                  Connection: Upgrade\r\nSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\n\
+                  Sec-WebSocket-Version: 13\r\n\r\n",
+            )
+            .await
+            .expect("send upgrade");
+
+        let mut read_exact = async |len: usize| {
+            let mut bytes = vec![0u8; len];
+            tokio::time::timeout(
+                std::time::Duration::from_secs(5),
+                socket.read_exact(&mut bytes),
+            )
+            .await
+            .expect("server frames must arrive")
+            .expect("socket ended before the server sent Close");
+            bytes
+        };
+        let mut response = Vec::new();
+        while !response.ends_with(b"\r\n\r\n") {
+            response.extend(read_exact(1).await);
+        }
+        socket.write_all(frames).await.expect("send frames");
+        let mut read_exact = async |len: usize| {
+            let mut bytes = vec![0u8; len];
+            tokio::time::timeout(
+                std::time::Duration::from_secs(5),
+                socket.read_exact(&mut bytes),
+            )
+            .await
+            .expect("server frames must arrive")
+            .expect("socket ended before the server sent Close");
+            bytes
+        };
+        loop {
+            let header = read_exact(2).await;
+            let payload_len = match header[1] & 0x7f {
+                126 => u64::from(u16::from_be_bytes(read_exact(2).await.try_into().unwrap())),
+                127 => u64::from_be_bytes(read_exact(8).await.try_into().unwrap()),
+                len => u64::from(len),
+            };
+            read_exact(usize::try_from(payload_len).expect("frame length")).await;
+            if header[0] & 0x0f == 0x8 {
+                break;
+            }
+        }
+        socket
+    }
+
+    /// Generous watchdog for a socket the server must end on its own.
+    const EOF_WATCHDOG: Duration = Duration::from_secs(10);
+
+    /// Reads until EOF and returns the time elapsed since `started`.
+    pub(crate) async fn time_to_eof(
+        socket: &mut tokio::net::TcpStream,
+        started: std::time::Instant,
+    ) -> Duration {
+        use tokio::io::AsyncReadExt as _;
+
+        let mut buf = [0u8; 64];
+        tokio::time::timeout(EOF_WATCHDOG, async {
+            while socket.read(&mut buf).await.expect("read") != 0 {}
+        })
+        .await
+        .expect("server must end the socket on its own");
+        started.elapsed()
+    }
+
+    /// Dropping TCP before the peer finishes the close handshake (including
+    /// in-flight peer frames) can make a client lose the NOTICE and Close
+    /// (seen live as `1006`). This raw client never replies: the server must
+    /// hold the socket for its full bounded wait, which starts only after
+    /// connect, so timing from before connect makes the lower bound
+    /// independent of scheduler delay.
+    #[tokio::test]
+    async fn server_holds_socket_for_client_close_reply() {
+        let (address, _, _, _) = serve(expired_assertion(), true).await;
+        let started = std::time::Instant::now();
+        let mut socket = raw_client_after_server_close(address).await;
+
+        let elapsed = time_to_eof(&mut socket, started).await;
+        assert!(
+            elapsed >= WS_TERMINAL_FLUSH_TIMEOUT,
+            "server must wait for the client's Close reply, ended after {elapsed:?}"
+        );
+    }
+
+    /// The client withholds its Close reply until the connection has
+    /// deregistered, so cleanup must not wait on the peer: a server that
+    /// cleans up after the wait, or ignores the reply, needs at
+    /// least `WS_TERMINAL_FLUSH_TIMEOUT` from connect.
+    #[tokio::test]
+    async fn server_finishes_promptly_when_client_answers_close() {
+        use tokio::io::AsyncWriteExt as _;
+
+        let (address, _, state, conn_id) = serve(expired_assertion(), true).await;
+        let started = std::time::Instant::now();
+        let mut socket = raw_client_after_server_close(address).await;
+
+        tokio::time::timeout(EOF_WATCHDOG, async {
+            while state.conn_manager.community_for_conn(conn_id).is_some() {
+                tokio::time::sleep(Duration::from_millis(5)).await;
+            }
+        })
+        .await
+        .expect("connection must deregister before the client replies");
+        // Masked Close, code 1000: payload [0x03, 0xe8] XOR a zero mask.
+        socket
+            .write_all(&[0x88, 0x82, 0, 0, 0, 0, 0x03, 0xe8])
+            .await
+            .expect("send Close reply");
+        let elapsed = time_to_eof(&mut socket, started).await;
+        assert!(
+            elapsed < WS_TERMINAL_FLUSH_TIMEOUT,
+            "server must finish on the client's Close, not the timeout; took {elapsed:?}"
+        );
+    }
+
+    /// Final cleanup can block on Redis with no deadline (the pool has no
+    /// wait timeout). The peer wait runs alongside it, so a stalled cleanup
+    /// still lets the socket end once the bounded wait expires.
+    #[tokio::test]
+    async fn stalled_cleanup_does_not_hold_socket_open() {
+        let pause = Arc::new(crate::handlers::close::test_seam::Pause::default());
+        let (address, _, _, _) = serve_with_seams(
+            expired_assertion(),
+            true,
+            Seams {
+                cleanup_pause: Some(Arc::clone(&pause)),
+                ..Seams::default()
+            },
+        )
+        .await;
+        let started = std::time::Instant::now();
+        let mut socket = raw_client_after_server_close(address).await;
+
+        tokio::time::timeout(EOF_WATCHDOG, pause.reached.notified())
+            .await
+            .expect("cleanup never reached the pause point");
+        let elapsed = time_to_eof(&mut socket, started).await;
+        assert!(elapsed >= WS_TERMINAL_FLUSH_TIMEOUT);
+    }
+
+    /// An established session's expiry task stalls at its quiescence barrier
+    /// while a handler holds an effect permit (e.g. an ephemeral EVENT blocked
+    /// on Redis). The writer has already sent the Close, so the socket must
+    /// still end within the bounded peer wait, not when the permit drops.
+    #[tokio::test]
+    async fn stalled_expiry_barrier_does_not_hold_socket_open() {
+        let (hold_tx, hold_rx) = tokio::sync::oneshot::channel();
+        let assertion = VerifiedAssertion::for_test(
+            Some(Keys::generate().public_key()),
+            vec![chrono::Utc::now() + chrono::Duration::hours(1)],
+        );
+        let (address, _, _, _) = serve_with_seams(
+            assertion,
+            true,
+            Seams {
+                effect_hold: Some(hold_tx),
+                ..Seams::default()
+            },
+        )
+        .await;
+        let mut socket = raw_client_after_server_close(address).await;
+        let _effect = hold_rx
+            .await
+            .expect("effect permit taken before the deadline");
+
+        let elapsed = time_to_eof(&mut socket, std::time::Instant::now()).await;
+        assert!(
+            elapsed < WS_TERMINAL_FLUSH_TIMEOUT + Duration::from_millis(500),
+            "a stalled expiry barrier must not hold the socket open, ended after {elapsed:?}"
+        );
+    }
+
+    /// A Nostr `CLOSE` is handled inline by the reader and can wait on the
+    /// subscription lock indefinitely (e.g. behind a REQ stuck in Redis).
+    /// Once the session expires the reader must give back its read half so
+    /// the socket ends within the bounded peer wait, and the interrupted
+    /// handler must still finish once the lock frees, before cleanup.
+    #[tokio::test]
+    async fn blocked_frame_handler_does_not_hold_socket_open() {
+        let (effect_tx, effect_rx) = tokio::sync::oneshot::channel();
+        let (subs_tx, subs_rx) = tokio::sync::oneshot::channel();
+        let assertion = VerifiedAssertion::for_test(
+            Some(Keys::generate().public_key()),
+            vec![chrono::Utc::now() + chrono::Duration::hours(1)],
+        );
+        let pause = Arc::new(crate::handlers::close::test_seam::Pause::default());
+        let (address, _, state, conn_id) = serve_with_seams(
+            assertion,
+            true,
+            Seams {
+                cleanup_pause: Some(Arc::clone(&pause)),
+                effect_hold: Some(effect_tx),
+                subscriptions_hold: Some(subs_tx),
+            },
+        )
+        .await;
+        // Masked text frame, zero mask: ["CLOSE","s"].
+        let close = br#"["CLOSE","s"]"#;
+        let mut frame = vec![
+            0x81,
+            0x80 | u8::try_from(close.len()).expect("len"),
+            0,
+            0,
+            0,
+            0,
+        ];
+        frame.extend_from_slice(close);
+        let connected = tokio::spawn(async move {
+            raw_client_sending_then_after_server_close(address, &frame).await
+        });
+        drop(effect_rx.await.expect("effect permit"));
+        let mut subscriptions = subs_rx.await.expect("subscription lock");
+        subscriptions.insert("s".to_owned(), 1);
+        let mut socket = connected.await.expect("raw client");
+
+        let elapsed = time_to_eof(&mut socket, std::time::Instant::now()).await;
+        assert!(
+            elapsed < WS_TERMINAL_FLUSH_TIMEOUT + Duration::from_millis(500),
+            "a blocked frame handler must not hold the socket open, ended after {elapsed:?}"
+        );
+        assert!(
+            state.conn_manager.community_for_conn(conn_id).is_some(),
+            "cleanup must wait for the interrupted handler"
+        );
+
+        let lock = Arc::clone(tokio::sync::OwnedMutexGuard::mutex(&subscriptions));
+        assert!(
+            tokio::time::timeout(Duration::from_millis(200), pause.reached.notified())
+                .await
+                .is_err(),
+            "cleanup must not start while the handed-off CLOSE is still blocked"
+        );
+        drop(subscriptions);
+        tokio::time::timeout(EOF_WATCHDOG, pause.reached.notified())
+            .await
+            .expect("cleanup never reached subscription release");
+        assert!(
+            !lock.lock().await.contains_key("s"),
+            "the handed-off CLOSE must finish retiring before cleanup starts"
+        );
+        pause.resume.notify_one();
+        tokio::time::timeout(EOF_WATCHDOG, async {
+            while state.conn_manager.community_for_conn(conn_id).is_some() {
+                tokio::time::sleep(Duration::from_millis(5)).await;
+            }
+        })
+        .await
+        .expect("cleanup must complete once the handler finishes");
+        assert!(
+            lock.lock().await.is_empty(),
+            "the subscription must be retired"
+        );
+    }
+
+    /// When the client closes first, tungstenite only queues our reply Close
+    /// and writes it on a later read. The peer wait must keep reading past
+    /// the client's Close so the reply goes out before TCP is dropped, as on
+    /// an audio exit that hands the socket off without sending a Close.
+    #[tokio::test]
+    async fn peer_wait_replies_to_client_initiated_close() {
+        let app = Router::new().route(
+            "/",
+            get(|ws: WebSocketUpgrade| async move {
+                ws.on_upgrade(|socket| async move {
+                    let (_ws_send, ws_recv) = socket.split();
+                    await_client_close(ws_recv).await;
+                })
+            }),
+        );
+        let listener = TcpListener::bind("127.0.0.1:0").await.expect("bind");
+        let address = listener.local_addr().expect("listener address");
+        tokio::spawn(async move { axum::serve(listener, app).await.expect("serve") });
+        let mut client = connect(address).await;
+
+        client.close(None).await.expect("send Close");
+        let reply = tokio::time::timeout(EOF_WATCHDOG, client.next())
+            .await
+            .expect("server must answer or end the socket");
+        assert!(
+            matches!(reply, Some(Ok(Message::Close(_)))),
+            "client-initiated Close must get its reply Close, got {reply:?}"
+        );
+    }
+
+    /// Serves the real outer `handle_connection` with `state`.
+    fn serve_outer(
+        state: Arc<AppState>,
+        assertion: Option<VerifiedAssertion>,
+    ) -> impl std::future::Future<Output = std::net::SocketAddr> {
+        let tenant = TenantContext::resolved(
+            buzz_core::tenant::CommunityId::from_uuid(Uuid::nil()),
+            "test.local".to_owned(),
+        );
+        let app = Router::new().route(
+            "/",
+            get(move |ws: WebSocketUpgrade| {
+                let (state, tenant, assertion) =
+                    (Arc::clone(&state), tenant.clone(), assertion.clone());
+                async move {
+                    ws.on_upgrade(move |socket| {
+                        handle_connection(
+                            socket,
+                            state,
+                            "127.0.0.1:1234".parse().expect("client address"),
+                            tenant,
+                            assertion,
+                            None,
+                            chrono::Utc::now(),
+                        )
+                    })
+                }
+            }),
+        );
+        async move {
+            let listener = TcpListener::bind("127.0.0.1:0").await.expect("bind");
+            let address = listener.local_addr().expect("listener address");
+            tokio::spawn(async move { axum::serve(listener, app).await.expect("serve") });
+            address
+        }
+    }
+
+    /// Leaves exactly one free slot in the connection budget.
+    async fn one_slot(state: &AppState) -> tokio::sync::OwnedSemaphorePermit {
+        let others = u32::try_from(state.conn_semaphore.available_permits() - 1).expect("permits");
+        Arc::clone(&state.conn_semaphore)
+            .acquire_many_owned(others)
+            .await
+            .expect("reserve other slots")
+    }
+
+    /// A socket refused during bootstrap (here an expired session) gets the
+    /// denial and Close from the `on_not_run` drain. The raw client never
+    /// replies, so the server must hold the socket for its bounded wait
+    /// instead of dropping it with client input possibly unread.
+    #[tokio::test]
+    async fn bootstrap_drain_holds_socket_for_client_close_reply() {
+        let state = crate::state::tests::test_state().await;
+        let address = serve_outer(state, Some(expired_assertion())).await;
+
+        let started = std::time::Instant::now();
+        let mut socket = raw_client_after_server_close(address).await;
+        let elapsed = time_to_eof(&mut socket, started).await;
+        assert!(
+            elapsed >= WS_TERMINAL_FLUSH_TIMEOUT,
+            "bootstrap drain must wait for the client's Close reply, ended after {elapsed:?}"
+        );
+    }
+
+    /// A socket refused during bootstrap keeps its connection slot until the
+    /// socket ends, including the bounded wait for a Close reply that never
+    /// comes, so refusals cannot open sockets beyond `BUZZ_MAX_CONNECTIONS`.
+    #[tokio::test]
+    async fn refused_bootstrap_holds_connection_slot_until_socket_ends() {
+        let state = crate::state::tests::test_state().await;
+        let _others = one_slot(&state).await;
+        let address = serve_outer(Arc::clone(&state), Some(expired_assertion())).await;
+
+        let mut socket = raw_client_after_server_close(address).await;
+        assert_eq!(
+            state.conn_semaphore.available_permits(),
+            0,
+            "the refused socket must hold its slot while open"
+        );
+        time_to_eof(&mut socket, std::time::Instant::now()).await;
+        tokio::time::timeout(Duration::from_secs(1), async {
+            while state.conn_semaphore.available_permits() == 0 {
+                tokio::time::sleep(Duration::from_millis(5)).await;
+            }
+        })
+        .await
+        .expect("the slot must be released once the socket ends");
+    }
+
+    /// The community check runs inside the connection budget: while it
+    /// stalls on the database, the socket already holds its slot even though
+    /// the active handler (which sends the AUTH challenge) has not started.
+    #[tokio::test]
+    async fn stalled_bootstrap_holds_connection_slot() {
+        let fake_database = TcpListener::bind("127.0.0.1:0")
+            .await
+            .expect("bind database");
+        let pool = sqlx::postgres::PgPoolOptions::new()
+            .acquire_timeout(Duration::from_secs(60))
+            .connect_lazy(&format!(
+                "postgres://buzz@{}/buzz",
+                fake_database.local_addr().expect("database address")
+            ))
+            .expect("lazy pool");
+        let state = crate::state::tests::test_state_with_database_pool(pool).await;
+        let _others = one_slot(&state).await;
+        let address = serve_outer(Arc::clone(&state), None).await;
+
+        let mut client = connect(address).await;
+        let _stalled_check = tokio::time::timeout(Duration::from_secs(5), fake_database.accept())
+            .await
+            .expect("the community check must reach the database")
+            .expect("accept database connection");
+        assert_eq!(
+            state.conn_semaphore.available_permits(),
+            0,
+            "a socket in bootstrap must hold its slot"
+        );
+        assert!(
+            tokio::time::timeout(Duration::from_millis(200), client.next())
+                .await
+                .is_err(),
+            "the active handler must not have started"
+        );
+    }
+}
diff --git a/crates/buzz-relay/src/handlers/auth.rs b/crates/buzz-relay/src/handlers/auth.rs
index 8a94a5827d..f0160ed275 100644
--- a/crates/buzz-relay/src/handlers/auth.rs
+++ b/crates/buzz-relay/src/handlers/auth.rs
@@ -376,7 +376,7 @@ pub async fn handle_auth(event: nostr::Event, conn: Arc<ConnectionState>, state:
             }
             // NIP-FI key pairing [FI-INV-05]: immediately after successful
             // verify_auth_event, before community-ban/allowlist/membership gates.
-            // Pre-DB positioning means a denied caller pays zero DB cost and the
+            // Running before those gates means a denied caller skips their DB reads and the
             // production call site is falsifiable without live tenant policy.
             // [FI-TRACE-DENIAL-ORACLE post-establishment]
             if crate::nip_fi_session::enforce_nip_fi_key_pairing(
@@ -1465,11 +1465,10 @@ mod tests {
         let t = crate::connection::tests::test_conn(pending, None);
         let assertion =
             buzz_auth::VerifiedAssertion::for_test(Some(asserted), vec![Utc::now() + lifetime]);
-        let headers = axum::http::HeaderMap::new();
         let session = crate::nip_fi_shadow_session::ShadowSession::start(
             state,
             "ws",
-            &headers,
+            crate::nip_fi_shadow::BOUND.into(),
             assertion,
             Utc::now(),
         );
diff --git a/crates/buzz-relay/src/handlers/close.rs b/crates/buzz-relay/src/handlers/close.rs
index d900bd4241..33b8b6020f 100644
--- a/crates/buzz-relay/src/handlers/close.rs
+++ b/crates/buzz-relay/src/handlers/close.rs
@@ -89,6 +89,8 @@ pub(crate) async fn close_if_owner(
 /// detached REQ task can register after this runs.
 pub(crate) async fn release_connection_subscriptions(conn: &ConnectionState, state: &AppState) {
     debug_assert!(conn.cancel.is_cancelled());
+    #[cfg(test)]
+    test_seam::pause_at(&test_seam::CLEANUP_PAUSE).await;
     let mut subs = conn.subscriptions.lock().await;
     subs.clear();
     for removed in state.sub_registry.remove_connection(conn.conn_id) {
@@ -116,7 +118,8 @@ pub(crate) async fn release_scope_topics(
 /// Test-only pause points, scoped to one task so parallel tests don't
 /// interfere: `PAUSE` inside `close_if_owner` between teardown and the
 /// terminal frame, `RELEASE_PAUSE` inside `retire_locked` between the
-/// registry removal and the topic release.
+/// registry removal and the topic release, `CLEANUP_PAUSE` at the start of
+/// `release_connection_subscriptions`.
 #[cfg(test)]
 pub(crate) mod test_seam {
     use std::sync::Arc;
@@ -131,6 +134,7 @@ pub(crate) mod test_seam {
     tokio::task_local! {
         pub(crate) static PAUSE: Arc<Pause>;
         pub(crate) static RELEASE_PAUSE: Arc<Pause>;
+        pub(crate) static CLEANUP_PAUSE: Arc<Pause>;
     }
 
     pub(super) async fn pause_at(point: &'static tokio::task::LocalKey<Arc<Pause>>) {
diff --git a/crates/buzz-relay/src/handlers/community_provisioning.rs b/crates/buzz-relay/src/handlers/community_provisioning.rs
index b187b223ad..6b258cd084 100644
--- a/crates/buzz-relay/src/handlers/community_provisioning.rs
+++ b/crates/buzz-relay/src/handlers/community_provisioning.rs
@@ -229,6 +229,18 @@ async fn publish_membership_snapshot_if_required(
     }
 }
 
+/// After a committed creation that bound issuers, drop this pod's cached
+/// "not found" for the host so the creator's first login looks it up.
+pub(crate) fn record_binding_creation(
+    resolver: Option<&crate::nip_fi_resolver::DatabaseResolver>,
+    host: &str,
+    issuers: &[String],
+) {
+    if let (Some(resolver), false) = (resolver, issuers.is_empty()) {
+        resolver.record_creation(host);
+    }
+}
+
 /// Validate and execute a relay-operator community provisioning request.
 ///
 /// The caller is an HTTP operator endpoint, not the Nostr event ingest path.
@@ -309,6 +321,11 @@ pub async fn provision_community(
             owner = %owner_hex,
             "community created via operator endpoint"
         );
+        record_binding_creation(
+            state.nip_fi_resolver.as_deref(),
+            &record.host,
+            nip_fi_issuers,
+        );
         publish_membership_snapshot_if_required(state, record.id, &record.host).await;
         return Ok(ProvisionCommunityResponse {
             community_id: record.id.to_string(),
@@ -326,6 +343,13 @@ pub async fn provision_community(
         .ensure_configured_community_with_nip_fi_issuers(&request.host, nip_fi_issuers)
         .await
         .map_err(|e| format!("failed to create community: {e}"))?;
+    if record.created {
+        record_binding_creation(
+            state.nip_fi_resolver.as_deref(),
+            &record.host,
+            nip_fi_issuers,
+        );
+    }
 
     if let Some(owner_hex) = &initial_owner {
         match state
diff --git a/crates/buzz-relay/src/handlers/count.rs b/crates/buzz-relay/src/handlers/count.rs
index 733449d925..6f97271cf4 100644
--- a/crates/buzz-relay/src/handlers/count.rs
+++ b/crates/buzz-relay/src/handlers/count.rs
@@ -154,7 +154,7 @@ pub async fn handle_count(
         // shared-tag check. A fast count over those kinds would include foreign
         // unshared events, leaking the existence of private agent activity.
         let needs_shared_gate_filtering = filter_can_match_shared_gated_kinds(filter);
-        // Determine if this filter can match result-gated kinds (44200, 30622)
+        // Determine if this filter can match result-gated kinds (`RESULT_GATED_KINDS`)
         // that require a per-event owner check. When the fast SQL path would
         // count matching rows without calling reader_authorized_for_event, a
         // non-owner learns the existence of events they are not allowed to see.
diff --git a/crates/buzz-relay/src/handlers/create_with_members_postgres_tests.rs b/crates/buzz-relay/src/handlers/create_with_members_postgres_tests.rs
new file mode 100644
index 0000000000..de8327ddb4
--- /dev/null
+++ b/crates/buzz-relay/src/handlers/create_with_members_postgres_tests.rs
@@ -0,0 +1,251 @@
+//! Postgres-backed tests for starting a channel with its members: a kind:9007
+//! that adds its `p` tags as members, and a creator's retry of it.
+
+use std::sync::Arc;
+
+use buzz_core::TenantContext;
+use buzz_db::event::EventQuery;
+use nostr::{Event, EventBuilder, Keys, Kind, Tag};
+use uuid::Uuid;
+
+use crate::handlers::group_state_postgres_tests::{community, group_state_tags, http_auth, state};
+use crate::handlers::ingest::{ingest_event, IngestError, IngestResult};
+use crate::state::AppState;
+
+fn create_event(creator: &Keys, channel_id: Uuid, members: &[&Keys]) -> Event {
+    let mut tags = vec![
+        Tag::parse(["h", &channel_id.to_string()]).unwrap(),
+        Tag::parse(["name", "start"]).unwrap(),
+        Tag::parse(["visibility", "private"]).unwrap(),
+    ];
+    for member in members {
+        tags.push(Tag::parse(["p", &member.public_key().to_hex()]).unwrap());
+    }
+    EventBuilder::new(Kind::Custom(9007), "")
+        .tags(tags)
+        .sign_with_keys(creator)
+        .expect("sign 9007")
+}
+
+fn message_event(author: &Keys, channel_id: Uuid) -> Event {
+    EventBuilder::new(Kind::Custom(9), "hello")
+        .tags([Tag::parse(["h", &channel_id.to_string()]).unwrap()])
+        .sign_with_keys(author)
+        .expect("sign message")
+}
+
+async fn ingest(
+    state: &Arc<AppState>,
+    tenant: &TenantContext,
+    event: Event,
+    keys: &Keys,
+) -> Result<IngestResult, IngestError> {
+    ingest_event(state, tenant, event, http_auth(keys)).await
+}
+
+async fn roles(
+    state: &AppState,
+    tenant: &TenantContext,
+    channel_id: Uuid,
+) -> Vec<(Vec<u8>, String)> {
+    let mut roles: Vec<_> = state
+        .db
+        .get_members(tenant.community(), channel_id)
+        .await
+        .expect("members")
+        .into_iter()
+        .map(|member| (member.pubkey, member.role))
+        .collect();
+    roles.sort();
+    roles
+}
+
+/// The `p` tags join in the create's transaction, the roster lists them, and
+/// each gets the "joined" notice a kind:9000 would post.
+/// Mutation: drop `members` from the create → no agent membership → RED.
+#[tokio::test]
+#[ignore = "requires Postgres"]
+async fn create_adds_its_p_tags_as_members() {
+    let state = state().await;
+    let tenant = community(&state, "create-members").await;
+    let (creator, agent) = (Keys::generate(), Keys::generate());
+    let channel_id = Uuid::new_v4();
+
+    let result = ingest(
+        &state,
+        &tenant,
+        create_event(&creator, channel_id, &[&agent, &agent]),
+        &creator,
+    )
+    .await
+    .expect("create");
+    assert!(result.accepted, "{}", result.message);
+
+    let mut expected = vec![
+        (
+            creator.public_key().to_bytes().to_vec(),
+            "owner".to_string(),
+        ),
+        (agent.public_key().to_bytes().to_vec(), "member".to_string()),
+    ];
+    expected.sort();
+    assert_eq!(roles(&state, &tenant, channel_id).await, expected);
+
+    let roster = group_state_tags(&state, &tenant, channel_id, 39002).await;
+    assert!(
+        roster
+            .iter()
+            .any(|tag| tag[0] == "p" && tag[1] == agent.public_key().to_hex()),
+        "{roster:?}"
+    );
+
+    let notices = state
+        .db
+        .query_events(&EventQuery {
+            kinds: Some(vec![buzz_core::kind::KIND_SYSTEM_MESSAGE as i32]),
+            channel_id: Some(channel_id),
+            ..EventQuery::for_community(tenant.community())
+        })
+        .await
+        .expect("system messages");
+    let joined = notices
+        .iter()
+        .filter(|stored| {
+            let content: serde_json::Value =
+                serde_json::from_str(&stored.event.content).unwrap_or_default();
+            content["type"] == "member_joined" && content["target"] == agent.public_key().to_hex()
+        })
+        .count();
+    assert_eq!(joined, 1, "one joined notice for the agent");
+
+    // The agent can answer in the chat with no separate add.
+    let reply = ingest(&state, &tenant, message_event(&agent, channel_id), &agent)
+        .await
+        .expect("agent reply");
+    assert!(reply.accepted, "{}", reply.message);
+}
+
+/// An agent whose policy refuses third-party adds keeps the whole create out:
+/// no channel is made. Mutation: skip the policy check → channel exists → RED.
+#[tokio::test]
+#[ignore = "requires Postgres"]
+async fn create_respects_the_members_add_policy() {
+    let state = state().await;
+    let tenant = community(&state, "create-members-policy").await;
+    let (creator, agent) = (Keys::generate(), Keys::generate());
+    let agent_bytes = agent.public_key().to_bytes().to_vec();
+    state
+        .db
+        .ensure_user(tenant.community(), &agent_bytes)
+        .await
+        .expect("agent user");
+    state
+        .db
+        .set_channel_add_policy(tenant.community(), &agent_bytes, "nobody")
+        .await
+        .expect("policy");
+    let channel_id = Uuid::new_v4();
+
+    let result = ingest(
+        &state,
+        &tenant,
+        create_event(&creator, channel_id, &[&agent]),
+        &creator,
+    )
+    .await;
+    match result {
+        Err(IngestError::Rejected(message)) => {
+            assert!(message.starts_with("invalid:"), "{message}")
+        }
+        Err(error) => panic!("expected a rejection, got {error:?}"),
+        Ok(result) => panic!("expected a rejection, got OK {}", result.message),
+    }
+    assert!(state
+        .db
+        .get_channel(tenant.community(), channel_id)
+        .await
+        .is_err());
+}
+
+/// Resending a create whose OK was lost is accepted; a different create for
+/// the same UUID, even from its creator, is refused before its side effects,
+/// so it can neither add nor announce anyone.
+/// Mutations: refuse every existing UUID → resend not accepted → RED; check the
+/// members' policies before recognizing a stored resend → RED; let the
+/// creator's changed create through → stranger announced → RED.
+#[tokio::test]
+#[ignore = "requires Postgres"]
+async fn resending_a_create_confirms_it() {
+    let state = state().await;
+    let tenant = community(&state, "create-retry").await;
+    let (creator, agent, stranger, other) = (
+        Keys::generate(),
+        Keys::generate(),
+        Keys::generate(),
+        Keys::generate(),
+    );
+    let channel_id = Uuid::new_v4();
+    let create = create_event(&creator, channel_id, &[&agent]);
+
+    let first = ingest(&state, &tenant, create.clone(), &creator)
+        .await
+        .expect("create");
+    assert!(first.accepted, "{}", first.message);
+    let before = roles(&state, &tenant, channel_id).await;
+    let resent = ingest(&state, &tenant, create.clone(), &creator)
+        .await
+        .expect("resend");
+    assert!(resent.accepted, "{}", resent.message);
+
+    for (author, members) in [(&creator, vec![&agent, &stranger]), (&other, vec![])] {
+        let changed = ingest(
+            &state,
+            &tenant,
+            create_event(author, channel_id, &members),
+            author,
+        )
+        .await
+        .expect("changed create");
+        assert!(!changed.accepted);
+        assert_eq!(changed.message, "duplicate: channel already exists");
+    }
+
+    // The agent closing its adds after the create doesn't refuse the resend.
+    let agent_bytes = agent.public_key().to_bytes().to_vec();
+    state
+        .db
+        .ensure_user(tenant.community(), &agent_bytes)
+        .await
+        .expect("agent user");
+    state
+        .db
+        .set_channel_add_policy(tenant.community(), &agent_bytes, "nobody")
+        .await
+        .expect("policy");
+    let resent_after_policy = ingest(&state, &tenant, create, &creator)
+        .await
+        .expect("resend after policy change");
+    assert!(
+        resent_after_policy.accepted,
+        "{}",
+        resent_after_policy.message
+    );
+
+    assert_eq!(roles(&state, &tenant, channel_id).await, before);
+    let notices = state
+        .db
+        .query_events(&EventQuery {
+            kinds: Some(vec![buzz_core::kind::KIND_SYSTEM_MESSAGE as i32]),
+            channel_id: Some(channel_id),
+            ..EventQuery::for_community(tenant.community())
+        })
+        .await
+        .expect("system messages");
+    assert!(
+        !notices.iter().any(|stored| stored
+            .event
+            .content
+            .contains(&stranger.public_key().to_hex())),
+        "the refused create announced nobody"
+    );
+}
diff --git a/crates/buzz-relay/src/handlers/event.rs b/crates/buzz-relay/src/handlers/event.rs
index f57c10b150..3222f896b4 100644
--- a/crates/buzz-relay/src/handlers/event.rs
+++ b/crates/buzz-relay/src/handlers/event.rs
@@ -174,14 +174,13 @@ pub async fn filter_fanout_by_access(
         matches
     };
 
-    // Owner-only kinds (kind:30622 DM visibility, kind:44200 agent turn
-    // metrics) reach only the pubkey named in their `p` tag. Same predicate as
-    // the pull paths, applied here so local and Redis delivery share it — a
-    // kindless `ids:[…]` subscription can otherwise match these events.
+    // Owner-only kinds (`RESULT_GATED_KINDS`: DM visibility, agent turn
+    // metrics, membership notices) reach only the pubkey named in their `p`
+    // tag. Same predicate as the pull paths, applied here so local and Redis
+    // delivery share it — a kindless `ids:[…]` subscription can otherwise
+    // match these events.
     let kind = event_kind_u32(&stored_event.event);
-    let matches = if kind == buzz_core::kind::KIND_DM_VISIBILITY
-        || kind == buzz_core::kind::KIND_AGENT_TURN_METRIC
-    {
+    let matches = if buzz_core::kind::RESULT_GATED_KINDS.contains(&kind) {
         matches
             .into_iter()
             .filter(|(conn_id, _)| {
diff --git a/crates/buzz-relay/src/handlers/ingest.rs b/crates/buzz-relay/src/handlers/ingest.rs
index 968b653227..557c755efa 100644
--- a/crates/buzz-relay/src/handlers/ingest.rs
+++ b/crates/buzz-relay/src/handlers/ingest.rs
@@ -2381,6 +2381,18 @@ fn validate_canvas_future_timestamp(event_ts: i64, now: i64) -> Result<(), &'sta
     Ok(())
 }
 
+/// A validated kind:9007 whose channel is created when the event is stored.
+struct ChannelCreateRequest {
+    channel_id: Uuid,
+    name: String,
+    channel_type: buzz_db::channel::ChannelType,
+    visibility: buzz_db::channel::ChannelVisibility,
+    description: Option<String>,
+    ttl_seconds: Option<i32>,
+    labels: Vec<String>,
+    members: Vec<Vec<u8>>,
+}
+
 async fn ingest_event_inner(
     state: &Arc<AppState>,
     tracer: &Arc<dyn buzz_conformance::Tracer>,
@@ -3050,8 +3062,9 @@ async fn ingest_event_inner(
             .map_err(|e| IngestError::Rejected(format!("invalid: {e}")))?;
     }
 
-    // Track pre-created channel UUID for compensation on insert failure.
-    let mut pre_created_channel: Option<Uuid> = None;
+    // A kind:9007 with an `h` tag creates its channel when it is stored, in the
+    // same transaction (see the storage dispatch below).
+    let mut channel_create: Option<ChannelCreateRequest> = None;
 
     if kind_u32 == KIND_NIP29_CREATE_GROUP {
         // Validate name tag is present and non-empty before any DB work.
@@ -3112,50 +3125,24 @@ async fn ingest_event_inner(
             .unwrap_or_default();
 
         if let Some(client_uuid) = channel_id {
-            let name = create_name.unwrap_or_default();
-            let name = buzz_core::channel::canonical_channel_name(&name);
-
-            let description = event.tags.iter().find_map(|t| {
-                if t.kind().to_string() == "about" {
-                    t.content().map(|s| s.to_string())
-                } else {
-                    None
-                }
+            let members = super::side_effects::initial_members(&event)
+                .map_err(|e| IngestError::Rejected(format!("invalid: {e}")))?;
+            channel_create = Some(ChannelCreateRequest {
+                channel_id: client_uuid,
+                name: create_name.unwrap_or_default(),
+                channel_type,
+                visibility,
+                description: event.tags.iter().find_map(|t| {
+                    if t.kind().to_string() == "about" {
+                        t.content().map(|s| s.to_string())
+                    } else {
+                        None
+                    }
+                }),
+                ttl_seconds: super::resolve_ttl(&event, state.config.ephemeral_ttl_override),
+                labels,
+                members,
             });
-
-            let ttl_seconds = super::resolve_ttl(&event, state.config.ephemeral_ttl_override);
-
-            let actor_bytes = event.pubkey.to_bytes().to_vec();
-            let (_, was_created) = state
-                .db
-                .create_labeled_channel_with_id(
-                    tenant.community(),
-                    client_uuid,
-                    name,
-                    channel_type,
-                    visibility,
-                    description.as_deref(),
-                    &actor_bytes,
-                    ttl_seconds,
-                    &labels,
-                )
-                .await
-                .map_err(|e| IngestError::Internal(format!("error: {e}")))?;
-
-            if !was_created {
-                return Ok(IngestResult {
-                    event_id: event_id_hex,
-                    accepted: false,
-                    message: "duplicate: channel already exists".into(),
-                });
-            }
-            pre_created_channel = Some(client_uuid);
-            metrics::counter!(
-                "buzz_channels_created_total",
-                "community" => tenant.host().to_owned(),
-                "type" => channel_type.to_string()
-            )
-            .increment(1);
         }
     }
 
@@ -3406,7 +3393,49 @@ async fn ingest_event_inner(
     };
 
     let workflow_deletion = crate::handlers::side_effects::is_workflow_deletion(&event);
-    let (stored_event, was_inserted) = if workflow_deletion {
+    let (stored_event, was_inserted) = if let Some(create) = channel_create.as_ref() {
+        let creator = event.pubkey.to_bytes();
+        let channel = buzz_db::channel::NewChannel {
+            name: &create.name,
+            channel_type: create.channel_type,
+            visibility: create.visibility,
+            description: create.description.as_deref(),
+            created_by: &creator,
+            ttl_seconds: create.ttl_seconds,
+            labels: &create.labels,
+            members: &create.members,
+        };
+        match state
+            .db
+            .create_channel_with_event(tenant.community(), create.channel_id, channel, &event)
+            .await
+            .map_err(|e| IngestError::Internal(format!("error: {e}")))?
+        {
+            buzz_db::channel::ChannelCreate::Created(stored) => {
+                metrics::counter!(
+                    "buzz_channels_created_total",
+                    "community" => tenant.host().to_owned(),
+                    "type" => create.channel_type.to_string()
+                )
+                .increment(1);
+                (*stored, true)
+            }
+            // Resending a create whose OK was lost confirms it. Anything else
+            // for a taken UUID is refused. Neither writes anything, so the
+            // create's side effects never run again.
+            buzz_db::channel::ChannelCreate::Exists { resent } => {
+                return Ok(IngestResult {
+                    event_id: event_id_hex,
+                    accepted: resent,
+                    message: if resent {
+                        "duplicate:".into()
+                    } else {
+                        "duplicate: channel already exists".into()
+                    },
+                });
+            }
+        }
+    } else if workflow_deletion {
         // A single commit owns public acceptance, domain mutation, and dispatch.
         // Failure rolls everything back; identical concurrent requests cannot
         // divide insertion and repair ownership between two relay workers.
@@ -3486,18 +3515,6 @@ async fn ingest_event_inner(
         {
             Ok(result) => result,
             Err(e) => {
-                // Compensate: if we pre-created a channel for kind:9007,
-                // soft-delete it so no orphaned channel row remains.
-                if let Some(ch_id) = pre_created_channel {
-                    if let Err(re) = state
-                        .db
-                        .soft_delete_channel(tenant.community(), ch_id)
-                        .await
-                    {
-                        warn!(event_id = %event_id_hex, "channel compensation failed: {re}");
-                    }
-                    state.invalidate_channel_deleted(tenant);
-                }
                 return Err(match e {
                     buzz_db::DbError::AuthEventRejected => {
                         IngestError::Rejected("invalid: AUTH events cannot be stored".into())
diff --git a/crates/buzz-relay/src/handlers/mod.rs b/crates/buzz-relay/src/handlers/mod.rs
index 24c368a564..dd4db5e986 100644
--- a/crates/buzz-relay/src/handlers/mod.rs
+++ b/crates/buzz-relay/src/handlers/mod.rs
@@ -12,6 +12,8 @@ pub mod command_executor;
 pub mod community_provisioning;
 /// NIP-45 COUNT handler.
 pub mod count;
+#[cfg(test)]
+mod create_with_members_postgres_tests;
 /// EVENT handler — WS dispatcher → ingest pipeline → fan-out.
 pub mod event;
 #[cfg(test)]
diff --git a/crates/buzz-relay/src/handlers/req.rs b/crates/buzz-relay/src/handlers/req.rs
index 3180f227e3..9c6b5d70a6 100644
--- a/crates/buzz-relay/src/handlers/req.rs
+++ b/crates/buzz-relay/src/handlers/req.rs
@@ -7,9 +7,8 @@ use tracing::{debug, warn};
 
 use buzz_core::filter::filters_match;
 use buzz_core::kind::{
-    is_unshared_gated_event, AUTHOR_ONLY_KINDS, KIND_AGENT_ENGRAM, KIND_AGENT_TURN_METRIC,
-    KIND_DELETION, KIND_DM_VISIBILITY, KIND_HUDDLE_LIVENESS, P_GATED_KINDS, RESULT_GATED_KINDS,
-    SHARED_GATED_KINDS,
+    is_unshared_gated_event, AUTHOR_ONLY_KINDS, KIND_AGENT_ENGRAM, KIND_DELETION,
+    KIND_HUDDLE_LIVENESS, P_GATED_KINDS, RESULT_GATED_KINDS, SHARED_GATED_KINDS,
 };
 use buzz_core::tenant::TenantContext;
 use buzz_db::EventQuery;
@@ -1254,8 +1253,12 @@ fn filter_to_query_params(
         .map(|values| values.iter().map(|v| v.to_string()).collect());
 
     let tag_values = group_state_tag_values(filter);
+    // NIP-CL: a membership notice's `#t` is its channel type. SQL keeps only
+    // the types this filter may see; a filter without `#t` sees legacy types.
+    let notice_channel_types = buzz_core::filter::notice_channel_types(filter);
 
     EventQuery {
+        notice_channel_types,
         channel_id,
         kinds,
         pubkey,
@@ -1656,13 +1659,14 @@ pub(crate) fn p_gated_filters_authorized(filters: &[Filter], authed_pubkey_hex:
         // when `ids` is present. KIND_AGENT_TURN_METRIC events are long-lived
         // and their cleartext envelope (pubkey, agent tag, created_at) leaks
         // turn-activity metadata — knowing an event id is NOT authorization
-        // (NIP-AM §Relay Behavior). Only filters that explicitly name the kind
-        // lose the exemption — a kindless `ids` lookup is unaffected.
+        // (NIP-AM §Relay Behavior). Membership notices are relay-signed and
+        // name the target and channel. All of these are RESULT_GATED_KINDS.
+        // Only filters that explicitly name the kind lose the exemption — a
+        // kindless `ids` lookup is admitted and then gated per result by
+        // `reader_authorized_for_event`.
         let explicitly_no_ids_exemption = filter.kinds.as_ref().is_some_and(|ks| {
-            ks.iter().any(|kind| {
-                let k = kind.as_u16() as u32;
-                k == KIND_DM_VISIBILITY || k == KIND_AGENT_TURN_METRIC
-            })
+            ks.iter()
+                .any(|kind| RESULT_GATED_KINDS.contains(&(kind.as_u16() as u32)))
         });
         if !explicitly_no_ids_exemption && filter.ids.as_ref().is_some_and(|ids| !ids.is_empty()) {
             return true;
@@ -1761,8 +1765,7 @@ pub(crate) fn filter_can_match_shared_gated_kinds(filter: &Filter) -> bool {
 
 /// Returns `true` if the filter CAN match result-gated kinds — meaning it
 /// either has no `kinds` constraint (wildcard) or includes at least one kind
-/// that carries a per-event result-level read gate (currently
-/// `KIND_DM_VISIBILITY` and `KIND_AGENT_TURN_METRIC`).
+/// that carries a per-event result-level read gate (`RESULT_GATED_KINDS`).
 ///
 /// Used by the COUNT handler to force the per-event fallback path instead of
 /// the fast SQL `count_events()`, which cannot enforce the owner-only result
@@ -2952,13 +2955,22 @@ mod tests {
         let owner = Filter::new().kind(dm_vis).custom_tags(p_tag, [authed]);
         assert!(p_gated_filters_authorized(&[owner], authed));
 
-        // The ids exemption still applies to other p-gated kinds (member notifs).
-        let member_notif_ids = Filter::new()
-            .kind(nostr::Kind::Custom(
-                buzz_core::kind::KIND_MEMBER_ADDED_NOTIFICATION as u16,
-            ))
-            .id(nostr::EventId::from_hex(snapshot_id).unwrap());
-        assert!(p_gated_filters_authorized(&[member_notif_ids], authed));
+        // Membership notices are relay-signed too: knowing one's id is not
+        // authorization (a system channel's notice names a hidden channel).
+        for kind in [
+            buzz_core::kind::KIND_MEMBER_ADDED_NOTIFICATION,
+            buzz_core::kind::KIND_MEMBER_REMOVED_NOTIFICATION,
+        ] {
+            let ids_only = Filter::new()
+                .kind(nostr::Kind::Custom(kind as u16))
+                .id(nostr::EventId::from_hex(snapshot_id).unwrap());
+            assert!(!p_gated_filters_authorized(&[ids_only], authed));
+            let own = Filter::new()
+                .kind(nostr::Kind::Custom(kind as u16))
+                .id(nostr::EventId::from_hex(snapshot_id).unwrap())
+                .custom_tags(p_tag, [authed]);
+            assert!(p_gated_filters_authorized(&[own], authed));
+        }
     }
 
     /// NIP-AM: kind 44200 must deny `{kinds:[44200], ids:[...]}` by non-owner.
diff --git a/crates/buzz-relay/src/handlers/side_effects.rs b/crates/buzz-relay/src/handlers/side_effects.rs
index ca4a2304dd..f5b55410d3 100644
--- a/crates/buzz-relay/src/handlers/side_effects.rs
+++ b/crates/buzz-relay/src/handlers/side_effects.rs
@@ -3,7 +3,7 @@
 use std::sync::Arc;
 
 use nostr::{Event, EventBuilder, Kind, Tag};
-use tracing::{info, warn};
+use tracing::{error, info, warn};
 use uuid::Uuid;
 
 use buzz_core::kind::{
@@ -540,8 +540,31 @@ pub async fn validate_admin_event(
     event: &Event,
     state: &Arc<AppState>,
 ) -> anyhow::Result<()> {
-    // CREATE_GROUP doesn't need an existing channel — skip h-tag extraction
+    // CREATE_GROUP doesn't need an existing channel — skip h-tag extraction.
+    // Its initial members get the third-party add check a kind:9000 would.
     if kind == 9007 {
+        let members = initial_members(event)?;
+        // Ingest confirms a resend of a stored create without writing anything,
+        // so a policy changed since then must not refuse it.
+        if members.is_empty()
+            || state
+                .db
+                .get_event_by_id_for_event_write(tenant.community(), event.id.as_bytes())
+                .await?
+                .is_some()
+        {
+            return Ok(());
+        }
+        let actor_bytes = event.pubkey.to_bytes().to_vec();
+        for member in members {
+            if let Some((policy, owner)) = state
+                .db
+                .get_agent_channel_policy(tenant.community(), &member)
+                .await?
+            {
+                channel_authz::decide_channel_add_policy(&policy, owner.as_deref(), &actor_bytes)?;
+            }
+        }
         return Ok(());
     }
 
@@ -1036,8 +1059,12 @@ pub fn emit_live_thread_summary(
 
 /// Emit a relay-signed membership notification event stored globally (channel_id = None).
 ///
-/// kind:44100 = member added, kind:44101 = member removed. System channels
-/// emit none.
+/// kind:44100 = member added, kind:44101 = member removed. Every notice
+/// carries its channel's type as `["t", <channel_type>]` (NIP-CL). This is
+/// the only place that reads the channel type for notices. Every read and live
+/// path shows a notice only to a filter that knows its type
+/// (`buzz_core::filter::notice_visible`), so a client never sees a notice
+/// about a type it does not know, such as a system channel.
 /// The p tag addresses the target pubkey; the h tag carries the channel UUID as metadata.
 /// Stored with channel_id = None so global subscribers receive it via slow-path fan-out.
 pub async fn emit_membership_notification(
@@ -1048,16 +1075,16 @@ pub async fn emit_membership_notification(
     actor_pubkey: &[u8],
     notification_kind: u32,
 ) -> anyhow::Result<()> {
-    // A system channel is left out of clients' channel lists, so it sends no
-    // membership notifications: a client that receives one would show it.
-    if !state
+    // No channel row means no type to tag. Send nothing rather than an
+    // untagged notice, which every client would treat as a legacy type.
+    let Some(channel_type) = state
         .db
-        .system_channel_ids_among(tenant.community(), &[channel_id])
+        .channel_type_of(tenant.community(), channel_id)
         .await?
-        .is_empty()
-    {
+    else {
+        warn!(%channel_id, "membership notice skipped: channel not found");
         return Ok(());
-    }
+    };
     let target_hex = hex::encode(target_pubkey);
     let actor_hex = hex::encode(actor_pubkey);
     let channel_id_str = channel_id.to_string();
@@ -1084,8 +1111,10 @@ pub async fn emit_membership_notification(
     })
     .to_string();
 
+    let type_tag = Tag::parse([buzz_core::filter::NOTICE_CHANNEL_TYPE_TAG, &channel_type])
+        .map_err(|e| anyhow::anyhow!("failed to build channel type tag: {e}"))?;
     let event = EventBuilder::new(Kind::Custom(notification_kind as u16), content)
-        .tags([p_tag, h_tag])
+        .tags([p_tag, h_tag, type_tag])
         .sign_with_keys(&state.relay_keypair)
         .map_err(|e| anyhow::anyhow!("failed to sign membership notification: {e}"))?;
 
@@ -2093,13 +2122,14 @@ async fn handle_create_group(
     // inaccessible, so the counter correctly records a new creation. For the
     // no-h-tag path, ingest never creates the channel, so this is the sole
     // increment.
-    let channel = if let Some(client_uuid) = extract_h_tag_channel(event) {
+    // `members_added`: ingest's create also added the event's `p` tags.
+    let (channel, members_added) = if let Some(client_uuid) = extract_h_tag_channel(event) {
         match state
             .db
             .get_channel_for_event_write(tenant.community(), client_uuid)
             .await
         {
-            Ok(ch) => ch,
+            Ok(ch) => (ch, true),
             Err(_) => {
                 // Channel not found — shouldn't happen (ingest_event pre-created it),
                 // but fall back to creation to stay resilient.
@@ -2122,7 +2152,7 @@ async fn handle_create_group(
                     "type" => channel_type.to_string()
                 )
                 .increment(1);
-                ch
+                (ch, false)
             }
         }
     } else {
@@ -2145,13 +2175,13 @@ async fn handle_create_group(
             "type" => channel_type.to_string()
         )
         .increment(1);
-        ch
+        (ch, false)
     };
 
     // Creator becomes owner — evict any stale negative membership lookup.
     state.invalidate_membership(tenant, channel.id, &actor_bytes);
-    // Open channels appear in everyone's accessible set; private channels only
-    // affect the creator (the sole initial member).
+    // Open channels appear in everyone's accessible set; a private channel only
+    // affects its initial members, whose entries the invalidations here drop.
     if visibility == buzz_db::channel::ChannelVisibility::Open {
         state.invalidate_all_accessible_channels(tenant);
     }
@@ -2185,6 +2215,45 @@ async fn handle_create_group(
         warn!(channel = %channel.id, error = %e, "membership notification emission failed");
     }
 
+    // Ingest added these in the create's transaction; announce them as a
+    // kind:9000 would. A failed announcement for one member must not cost the
+    // rest theirs: a resend writes nothing, so nothing would retry them.
+    let members = if members_added {
+        initial_members(event)?
+    } else {
+        Vec::new()
+    };
+    for member in members {
+        state.invalidate_membership(tenant, channel.id, &member);
+        if let Err(e) = emit_system_message(
+            tenant,
+            state,
+            channel.id,
+            serde_json::json!({
+                "type": "member_joined",
+                "actor": actor_hex,
+                "target": hex::encode(&member),
+            }),
+            chrono::Utc::now(),
+        )
+        .await
+        {
+            error!(channel = %channel.id, error = %e, "member_joined system message failed");
+        }
+        if let Err(e) = emit_membership_notification(
+            tenant,
+            state,
+            channel.id,
+            &member,
+            &actor_bytes,
+            KIND_MEMBER_ADDED_NOTIFICATION,
+        )
+        .await
+        {
+            warn!(channel = %channel.id, error = %e, "membership notification emission failed");
+        }
+    }
+
     info!(channel_id = %channel.id, name = %name, "NIP-29 CREATE_GROUP processed");
     Ok(())
 }
@@ -2653,6 +2722,38 @@ async fn handle_standard_deletion_event(
     Ok(())
 }
 
+/// Most members a kind:9007 may add besides its creator.
+pub(crate) const MAX_INITIAL_MEMBERS: usize = 32;
+
+/// The members a kind:9007 adds besides its creator: its `p` tags, deduplicated.
+/// They need the client-chosen channel UUID (`h`), so a retry of the same
+/// create names the same channel.
+pub(crate) fn initial_members(event: &Event) -> anyhow::Result<Vec<Vec<u8>>> {
+    let creator = event.pubkey.to_bytes();
+    let mut members: Vec<Vec<u8>> = Vec::new();
+    for tag in event
+        .tags
+        .iter()
+        .filter(|tag| tag.kind().to_string() == "p")
+    {
+        let member = tag
+            .content()
+            .and_then(|value| hex::decode(value).ok())
+            .filter(|bytes| bytes.len() == 32)
+            .ok_or_else(|| anyhow::anyhow!("p tag must be a 32-byte hex pubkey"))?;
+        if member != creator && !members.contains(&member) {
+            members.push(member);
+        }
+    }
+    if members.len() > MAX_INITIAL_MEMBERS {
+        anyhow::bail!("a channel may start with at most {MAX_INITIAL_MEMBERS} members");
+    }
+    if !members.is_empty() && extract_h_tag_channel(event).is_none() {
+        anyhow::bail!("initial members need an h tag");
+    }
+    Ok(members)
+}
+
 /// Extract channel UUID from `h` tag (NIP-29 group ID).
 fn extract_h_tag_channel(event: &Event) -> Option<Uuid> {
     for tag in event.tags.iter() {
@@ -3996,6 +4097,57 @@ pub async fn publish_nipia_unarchived(
 mod tests {
     use super::*;
 
+    fn create_with(creator: &nostr::Keys, tags: Vec<Vec<String>>) -> Event {
+        nostr::EventBuilder::new(nostr::Kind::Custom(9007), "")
+            .tags(
+                tags.into_iter()
+                    .map(|tag| nostr::Tag::parse(tag).expect("tag")),
+            )
+            .sign_with_keys(creator)
+            .expect("sign")
+    }
+
+    fn tag(name: &str, value: &str) -> Vec<String> {
+        vec![name.to_string(), value.to_string()]
+    }
+
+    #[test]
+    fn initial_members_dedupes_and_leaves_out_the_creator() {
+        let (creator, agent) = (nostr::Keys::generate(), nostr::Keys::generate());
+        let h = tag("h", &Uuid::new_v4().to_string());
+        let event = create_with(
+            &creator,
+            vec![
+                h,
+                tag("p", &agent.public_key().to_hex()),
+                tag("p", &agent.public_key().to_hex()),
+                tag("p", &creator.public_key().to_hex()),
+            ],
+        );
+        assert_eq!(
+            initial_members(&event).expect("members"),
+            vec![agent.public_key().to_bytes().to_vec()]
+        );
+    }
+
+    #[test]
+    fn initial_members_rejects_bad_pubkeys_too_many_members_and_no_h_tag() {
+        let creator = nostr::Keys::generate();
+        let h = tag("h", &Uuid::new_v4().to_string());
+        let bad = create_with(&creator, vec![h.clone(), tag("p", "not-hex")]);
+        assert!(initial_members(&bad).is_err());
+
+        let mut crowd = vec![h];
+        for _ in 0..=MAX_INITIAL_MEMBERS {
+            crowd.push(tag("p", &nostr::Keys::generate().public_key().to_hex()));
+        }
+        assert!(initial_members(&create_with(&creator, crowd)).is_err());
+
+        let member = nostr::Keys::generate().public_key().to_hex();
+        let headless = create_with(&creator, vec![tag("p", &member)]);
+        assert!(initial_members(&headless).is_err());
+    }
+
     #[test]
     fn nip43_progress_logs_every_interval_inside_the_startup_sweep_only() {
         use Nip43ReconciliationPurpose::{Bootstrap, Maintenance};
diff --git a/crates/buzz-relay/src/handlers/system_channel_postgres_tests.rs b/crates/buzz-relay/src/handlers/system_channel_postgres_tests.rs
index d99ddb748e..a74644e21e 100644
--- a/crates/buzz-relay/src/handlers/system_channel_postgres_tests.rs
+++ b/crates/buzz-relay/src/handlers/system_channel_postgres_tests.rs
@@ -175,7 +175,7 @@ fn bridge_count(body: Option<Value>) -> u64 {
     })
 }
 
-fn sorted(mut ids: Vec<String>) -> Vec<String> {
+fn sorted<T: Ord>(mut ids: Vec<T>) -> Vec<T> {
     ids.sort();
     ids
 }
@@ -428,17 +428,77 @@ async fn named_channels_missing_from_the_cache_are_confirmed_together() {
     assert!(readable_system.is_empty());
 }
 
-/// Adding a member to a system channel sends no kind:44100 notification,
-/// which an existing client would show as a new channel. An ordinary
-/// channel still sends one, so the check is not vacuous.
-/// Mutation: drop the system check in `emit_membership_notification` → RED.
+/// Every membership notice is a stored kind:44100/44101 tagged with its
+/// channel type (`["t","stream"]`, `["t","system"]`). A filter sees a notice
+/// only when it knows the type: a filter without `#t` (every client today)
+/// sees the legacy types, and a filter with `#t` sees the types it names. One
+/// filter can name all types. This holds on every path: live fan-out, REQ
+/// history, COUNT, and the HTTP bridge. An untagged notice stored before the
+/// tag existed counts as a legacy type.
+/// Mutation: drop the type tag in `emit_membership_notification` → RED;
+/// drop the `notice_visible` check in `filters_match` → RED (live and
+/// post-filtered reads show the system notice); drop the untagged clause in
+/// `push_notice_visibility` → RED (the legacy notice disappears).
 #[tokio::test]
 #[ignore = "requires Postgres and Redis"]
-async fn system_channels_send_no_membership_notifications() {
+async fn membership_notices_reach_only_filters_that_know_their_type() {
+    use buzz_core::kind::{KIND_MEMBER_ADDED_NOTIFICATION, KIND_MEMBER_REMOVED_NOTIFICATION};
     let f = fixture().await;
     let owner = Keys::generate();
     let member = Keys::generate();
     let member_hex = member.public_key().to_hex();
+    let kinds = [
+        KIND_MEMBER_ADDED_NOTIFICATION,
+        KIND_MEMBER_REMOVED_NOTIFICATION,
+    ];
+    let old = json!({"kinds": kinds, "#p": [member_hex]});
+    let asks = json!({"kinds": kinds, "#p": [member_hex], "#t": ["system"]});
+    let all = json!({
+        "kinds": kinds,
+        "#p": [member_hex],
+        "#t": ["stream", "forum", "dm", "workflow", "system"],
+    });
+
+    // The member's live global subscriptions: one as clients send today, one
+    // that asks for system notices, and one that names every type. An outsider also holds a subscription
+    // that asks. It is registered directly, as if some filter (for example a
+    // kindless `ids` lookup) had been admitted, so only the fan-out gate can
+    // keep the notices from it.
+    let register = |reader: &Keys, subs: &[(&str, &Value)]| {
+        let conn_id = Uuid::new_v4();
+        let (tx, rx) = tokio::sync::mpsc::channel(32);
+        f.state.conn_manager.register(
+            conn_id,
+            tx,
+            tokio::sync::mpsc::channel(4).0,
+            tokio::sync::mpsc::channel(1).0,
+            None,
+            tokio_util::sync::CancellationToken::new(),
+            f.tenant.community(),
+            Arc::new(std::sync::atomic::AtomicU8::new(0)),
+            Arc::new(tokio::sync::Mutex::new(Default::default())),
+            3,
+            crate::state::CommunityConnectionControl::new(
+                tokio_util::sync::CancellationToken::new(),
+            ),
+        );
+        f.state
+            .conn_manager
+            .set_authenticated_pubkey(conn_id, reader.public_key().to_bytes().to_vec());
+        for (sub, filter) in subs {
+            f.state.sub_registry.register_scoped(
+                f.tenant.community(),
+                conn_id,
+                (*sub).into(),
+                vec![serde_json::from_value((*filter).clone()).expect("filter")],
+                None,
+            );
+        }
+        rx
+    };
+    let mut rx = register(&member, &[("old", &old), ("asks", &asks), ("all", &all)]);
+    let outsider = Keys::generate();
+    let mut outsider_rx = register(&outsider, &[("outsider", &json!({"#t": ["system"]}))]);
 
     let system = create_channel(&f.state, &f.tenant, &owner, &[&["channel_type", "system"]]).await;
     let ordinary = create_channel(&f.state, &f.tenant, &owner, &[]).await;
@@ -452,36 +512,309 @@ async fn system_channels_send_no_membership_notifications() {
         )
         .await;
     }
-    // Notifications are written after the reply; give the task a moment.
-    let mut notified = Vec::new();
-    for _ in 0..50 {
-        notified = f
-            .state
-            .db
-            .query_events(&EventQuery {
-                kinds: Some(vec![buzz_core::kind::KIND_MEMBER_ADDED_NOTIFICATION as i32]),
-                p_tag_hex: Some(member_hex.clone()),
-                ..EventQuery::for_community(f.tenant.community())
-            })
+    publish(
+        &f,
+        &owner,
+        9001,
+        "",
+        &[&["h", &system.to_string()], &["p", &member_hex]],
+    )
+    .await;
+
+    // Notifications are sent after the reply; collect the six frames.
+    let mut live = Vec::new();
+    let mut ids = std::collections::HashMap::new();
+    while live.len() < 6 {
+        let frame = tokio::time::timeout(std::time::Duration::from_secs(5), rx.recv())
             .await
-            .expect("query notifications")
-            .into_iter()
-            .map(|stored| {
-                stored
-                    .event
-                    .tags
-                    .iter()
-                    .find(|tag| tag.as_slice().first().map(String::as_str) == Some("h"))
-                    .and_then(|tag| tag.as_slice().get(1).cloned())
-                    .expect("h tag")
-            })
-            .collect::<Vec<_>>();
-        if !notified.is_empty() {
+            .unwrap_or_else(|_| panic!("notices so far: {live:?}"))
+            .expect("connection open");
+        let axum::extract::ws::Message::Text(text) = frame else {
+            continue;
+        };
+        let message: Value = serde_json::from_str(&text).expect("relay frame");
+        if message[0] != "EVENT" {
+            continue;
+        }
+        let event: nostr::Event = serde_json::from_value(message[2].clone()).expect("event");
+        assert_eq!(
+            event.pubkey,
+            f.state.relay_keypair.public_key(),
+            "relay-signed"
+        );
+        let h = event
+            .tags
+            .iter()
+            .find(|tag| tag.as_slice().first().map(String::as_str) == Some("h"))
+            .and_then(|tag| tag.as_slice().get(1).cloned())
+            .expect("h tag");
+        let channel_type = event
+            .tags
+            .iter()
+            .find(|tag| tag.as_slice().first().map(String::as_str) == Some("t"))
+            .and_then(|tag| tag.as_slice().get(1).cloned());
+        let expected_type = if h == system.to_string() {
+            "system"
+        } else {
+            "stream"
+        };
+        assert_eq!(channel_type.as_deref(), Some(expected_type), "type tag");
+        let kind = u32::from(event.kind.as_u16());
+        ids.insert((kind, h.clone()), event.id.to_hex());
+        live.push((message[1].as_str().expect("sub id").to_owned(), kind, h));
+    }
+    assert!(
+        tokio::time::timeout(std::time::Duration::from_millis(200), rx.recv())
+            .await
+            .is_err(),
+        "no seventh notice"
+    );
+    assert_eq!(
+        sorted(live),
+        sorted(vec![
+            (
+                "asks".into(),
+                KIND_MEMBER_ADDED_NOTIFICATION,
+                system.to_string()
+            ),
+            (
+                "asks".into(),
+                KIND_MEMBER_REMOVED_NOTIFICATION,
+                system.to_string()
+            ),
+            (
+                "old".into(),
+                KIND_MEMBER_ADDED_NOTIFICATION,
+                ordinary.to_string()
+            ),
+            (
+                "all".into(),
+                KIND_MEMBER_ADDED_NOTIFICATION,
+                system.to_string()
+            ),
+            (
+                "all".into(),
+                KIND_MEMBER_REMOVED_NOTIFICATION,
+                system.to_string()
+            ),
+            (
+                "all".into(),
+                KIND_MEMBER_ADDED_NOTIFICATION,
+                ordinary.to_string()
+            ),
+        ])
+    );
+    let ordinary_added = ids[&(KIND_MEMBER_ADDED_NOTIFICATION, ordinary.to_string())].clone();
+    let system_notices = sorted(vec![
+        ids[&(KIND_MEMBER_ADDED_NOTIFICATION, system.to_string())].clone(),
+        ids[&(KIND_MEMBER_REMOVED_NOTIFICATION, system.to_string())].clone(),
+    ]);
+
+    // History: the system notices are stored, and only the asking filter
+    // reads them.
+    assert_eq!(
+        req(&f, &member, old.clone()).await,
+        std::slice::from_ref(&ordinary_added)
+    );
+    assert_eq!(count(&f, &member, old.clone()).await, 1);
+    assert_eq!(
+        bridge_ids(bridge(&f, &member, "/query", json!([old])).await),
+        std::slice::from_ref(&ordinary_added)
+    );
+    assert_eq!(
+        bridge_count(bridge(&f, &member, "/count", json!([old])).await),
+        1
+    );
+    assert_eq!(sorted(req(&f, &member, asks.clone()).await), system_notices);
+    assert_eq!(count(&f, &member, asks.clone()).await, 2);
+    assert_eq!(
+        sorted(bridge_ids(
+            bridge(&f, &member, "/query", json!([asks])).await
+        )),
+        system_notices
+    );
+    // Replay with `since` works for the asking filter.
+    let mut since = asks.clone();
+    since["since"] = json!(0);
+    assert_eq!(sorted(req(&f, &member, since).await), system_notices);
+    // One filter that names every type reads all three notices.
+    let every_notice = {
+        let mut ids = system_notices.clone();
+        ids.push(ordinary_added.clone());
+        sorted(ids)
+    };
+    assert_eq!(sorted(req(&f, &member, all.clone()).await), every_notice);
+    assert_eq!(count(&f, &member, all.clone()).await, 3);
+    assert_eq!(
+        sorted(bridge_ids(
+            bridge(&f, &member, "/query", json!([all])).await
+        )),
+        every_notice
+    );
+
+    // A notice stored before notices had a type tag counts as a legacy type:
+    // filters without `#t`, and filters that name a legacy type, read it.
+    let legacy_channel = Uuid::new_v4().to_string();
+    let legacy = nostr::EventBuilder::new(
+        nostr::Kind::Custom(KIND_MEMBER_ADDED_NOTIFICATION as u16),
+        "",
+    )
+    .tags([
+        nostr::Tag::parse(["p", &member_hex]).unwrap(),
+        nostr::Tag::parse(["h", &legacy_channel]).unwrap(),
+    ])
+    .sign_with_keys(&f.state.relay_keypair)
+    .expect("sign");
+    f.state
+        .db
+        .insert_event(f.tenant.community(), &legacy, None)
+        .await
+        .expect("store legacy notice");
+    let legacy_id = legacy.id.to_hex();
+    let with_legacy = |ids: &[String]| {
+        let mut ids = ids.to_vec();
+        ids.push(legacy_id.clone());
+        sorted(ids)
+    };
+    assert_eq!(
+        sorted(req(&f, &member, old.clone()).await),
+        with_legacy(std::slice::from_ref(&ordinary_added))
+    );
+    assert_eq!(count(&f, &member, old.clone()).await, 2);
+    assert_eq!(
+        sorted(req(&f, &member, all.clone()).await),
+        with_legacy(&every_notice)
+    );
+    assert_eq!(count(&f, &member, all.clone()).await, 4);
+    assert_eq!(sorted(req(&f, &member, asks.clone()).await), system_notices);
+
+    // Knowing a notice's id is not authorization: only its target reads,
+    // counts or receives it, with or without `kinds`.
+    // Mutation: drop 44100/44101 from RESULT_GATED_KINDS → RED.
+    assert!(
+        outsider_rx.try_recv().is_err(),
+        "live fan-out reached a non-target"
+    );
+    let by_id = |with_kinds: bool| {
+        let mut filter = json!({"ids": system_notices, "#t": ["system"]});
+        if with_kinds {
+            filter["kinds"] = json!(kinds);
+        }
+        filter
+    };
+    for with_kinds in [true, false] {
+        let filter = by_id(with_kinds);
+        assert!(
+            req(&f, &outsider, filter.clone()).await.is_empty(),
+            "{filter}"
+        );
+        assert_eq!(count(&f, &outsider, filter.clone()).await, 0, "{filter}");
+        assert!(
+            bridge_ids(bridge(&f, &outsider, "/query", json!([filter])).await).is_empty(),
+            "{filter}"
+        );
+        assert_eq!(
+            bridge_count(bridge(&f, &outsider, "/count", json!([filter])).await),
+            0,
+            "{filter}"
+        );
+    }
+    // The target's own kindless id lookup still works.
+    assert_eq!(sorted(req(&f, &member, by_id(false)).await), system_notices);
+}
+
+/// The database returns only legacy-type notices unless the query names
+/// other types, so a read path that builds its own `EventQuery` and forgets
+/// the rule still hides system notices.
+/// Mutation: drop `push_notice_visibility` → RED.
+#[tokio::test]
+#[ignore = "requires Postgres and Redis"]
+async fn the_database_returns_only_legacy_type_notices_by_default() {
+    use buzz_core::kind::KIND_MEMBER_ADDED_NOTIFICATION;
+    let f = fixture().await;
+    let owner = Keys::generate();
+    let member = Keys::generate();
+    let member_hex = member.public_key().to_hex();
+    let system = create_channel(&f.state, &f.tenant, &owner, &[&["channel_type", "system"]]).await;
+    let ordinary = create_channel(&f.state, &f.tenant, &owner, &[]).await;
+    for channel in [system, ordinary] {
+        publish(
+            &f,
+            &owner,
+            9000,
+            "",
+            &[&["h", &channel.to_string()], &["p", &member_hex]],
+        )
+        .await;
+    }
+    // Kindless, but global only: the notices are the only global events
+    // that mention the member.
+    let base = EventQuery {
+        p_tag_hex: Some(member_hex.clone()),
+        global_only: true,
+        ..EventQuery::for_community(f.tenant.community())
+    };
+    let channels_of = |events: Vec<buzz_core::StoredEvent>| {
+        sorted(
+            events
+                .into_iter()
+                .map(|stored| {
+                    stored
+                        .event
+                        .tags
+                        .iter()
+                        .find(|tag| tag.as_slice().first().map(String::as_str) == Some("h"))
+                        .and_then(|tag| tag.as_slice().get(1).cloned())
+                        .expect("h tag")
+                })
+                .collect(),
+        )
+    };
+    // Notifications are written after the reply; wait for both.
+    let mut all = Vec::new();
+    for _ in 0..50 {
+        all = channels_of(
+            f.state
+                .db
+                .query_events(&EventQuery {
+                    notice_channel_types: Some(vec!["stream".into(), "system".into()]),
+                    ..base.clone()
+                })
+                .await
+                .expect("query"),
+        );
+        if all.len() == 2 {
             break;
         }
         tokio::time::sleep(std::time::Duration::from_millis(20)).await;
     }
-    assert_eq!(sorted(notified), vec![ordinary.to_string()]);
+    assert_eq!(all, sorted(vec![system.to_string(), ordinary.to_string()]));
+
+    for query in [
+        base.clone(),
+        EventQuery {
+            kinds: Some(vec![KIND_MEMBER_ADDED_NOTIFICATION as i32]),
+            ..base.clone()
+        },
+    ] {
+        assert_eq!(
+            channels_of(f.state.db.query_events(&query).await.expect("query")),
+            [ordinary.to_string()]
+        );
+        assert_eq!(f.state.db.count_events(&query).await.expect("count"), 1);
+    }
+    let only_system = EventQuery {
+        notice_channel_types: Some(vec!["system".into()]),
+        ..base.clone()
+    };
+    assert_eq!(
+        channels_of(f.state.db.query_events(&only_system).await.expect("query")),
+        [system.to_string()]
+    );
+    assert_eq!(
+        f.state.db.count_events(&only_system).await.expect("count"),
+        1
+    );
 }
 
 /// A group-state filter with `#t:["system"]` or any `#P` finds the system
diff --git a/crates/buzz-relay/src/lib.rs b/crates/buzz-relay/src/lib.rs
index e0fd61d1f6..17a7cb49e4 100644
--- a/crates/buzz-relay/src/lib.rs
+++ b/crates/buzz-relay/src/lib.rs
@@ -52,6 +52,7 @@ pub mod nip_fi_config;
 /// NIP-FI HTTP ingress enforcement: assertion extraction, verification,
 /// key-pairing check, and deny-map gate for every protected HTTP surface.
 pub(crate) mod nip_fi_http;
+pub mod nip_fi_resolver;
 /// Deployment-global operator-listener mention delivery worker.
 pub mod operator_listener;
 /// NIP-01 client/relay message parsing.
diff --git a/crates/buzz-relay/src/main.rs b/crates/buzz-relay/src/main.rs
index d6a082affa..a154f70757 100644
--- a/crates/buzz-relay/src/main.rs
+++ b/crates/buzz-relay/src/main.rs
@@ -856,6 +856,36 @@ async fn run_relay_main(boot: BootTracker) -> anyhow::Result<()> {
             ));
         }
     }
+    // NIP-FI database community source. The startup load runs before any
+    // listener binds, so the pod can never report ready without a snapshot;
+    // a failed load fails startup and the orchestrator retries.
+    if config.nip_fi.builds_resolver() {
+        let step = StepTimer::start(StartupStep::NipFiSnapshotLoad);
+        // `Config::from_env` refuses the database source without it.
+        let policy = config
+            .nip_fi_provision_binding
+            .clone()
+            .ok_or_else(|| anyhow::anyhow!("NIP-FI: no provisioning binding policy"))?;
+        let registry = config
+            .nip_fi
+            .registry
+            .all_policies()
+            .map(|p| p.issuer().to_owned())
+            .collect();
+        let resolver = Arc::new(buzz_relay::nip_fi_resolver::DatabaseResolver::new(
+            Arc::new(app_state.db.clone()),
+            policy,
+            registry,
+            config.nip_fi_resolver_bounds.clone(),
+        ));
+        resolver
+            .refresh()
+            .await
+            .map_err(|e| anyhow::anyhow!("NIP-FI: startup binding snapshot load failed: {e:?}"))?;
+        step.finish();
+        info!("NIP-FI: binding snapshot loaded");
+        app_state.nip_fi_resolver = Some(resolver);
+    }
     let state = Arc::new(app_state);
     let has_startup_partition_audit = startup_partition_audit.is_some();
     if let Some(audit) = startup_partition_audit {
@@ -912,6 +942,10 @@ async fn run_relay_main(boot: BootTracker) -> anyhow::Result<()> {
     // The refresh task is owned: a `CancellationToken` + `JoinHandle` let the
     // process cancel it cleanly on shutdown instead of leaking the task.
     let jwks_refresh_cancel = CancellationToken::new();
+    // The binding refresh loop stops with the JWKS loop on shutdown.
+    if let Some(resolver) = state.nip_fi_resolver.clone() {
+        tokio::spawn(resolver.run_refresh_loop(jwks_refresh_cancel.child_token()));
+    }
     let jwks_refresh_handle = if let Some(jwks_source) = state.nip_fi_jwks_source.clone() {
         let jwks_configs = state.config.nip_fi.jwks_configs.clone();
         info!(
@@ -2053,23 +2087,31 @@ async fn run_periodic_until_cancelled<Tick, TickFuture>(
 ///    grace, this backstops the whole drain and force-exits the process if
 ///    exceeded. It bounds everything after the grace, not the grace itself.
 ///
-/// A single WebSocket can therefore stay open, from SIGTERM, for up to:
+/// Each socket's teardown after the grace runs in stages, each with its own
+/// budget:
 ///
-/// ```text
-///   5s grace  +  up to 20s jitter  +  up to 5s close-frame ack  =  30s
-///   (fixed)      (MAX_DRAIN_JITTER_MS)  (RESTART_CLOSE_ACK_TIMEOUT)
-/// ```
+/// - up to 20s jitter before the relay sends its restart Close
+///   ([`buzz_relay::config::MAX_DRAIN_JITTER_MS`]);
+/// - up to 5s for the writer to acknowledge sending that Close
+///   (`RESTART_CLOSE_ACK_TIMEOUT` in `state.rs`). If the acknowledgement
+///   times out, the connection is cancelled and its teardown can spend a
+///   separate 1s flushing the terminal frame (`WS_TERMINAL_FLUSH_TIMEOUT` in
+///   `connection.rs`);
+/// - up to 1s waiting for the client's Close reply (the same constant). This
+///   wait starts only once the reader has returned and the writer has joined.
 ///
-/// The 5s grace runs before the 30s hard-drain clock starts, so the jitter
-/// (capped at [`buzz_relay::config::MAX_DRAIN_JITTER_MS`] = 20s) plus the
-/// per-connection close-frame ack wait (`RESTART_CLOSE_ACK_TIMEOUT` = 5s in
-/// `state.rs`) sum to 25s and stay inside the 30s hard drain. Total worst
-/// case from SIGTERM to forced exit is 5s + 30s = 35s. Both fit inside the
-/// chart's `terminationGracePeriodSeconds: 60` (`deploy/charts/buzz/values.yaml`),
-/// which leaves headroom but assumes no `preStop` hook adds further delay.
-/// With jitter off (`BUZZ_DRAIN_JITTER_MS=0`, the default) sockets close
-/// all-at-once right after the grace, so the per-socket delay collapses to
-/// roughly the 5s grace plus the ack wait.
+/// These are stage budgets, not a guaranteed per-socket total: after a
+/// successful acknowledgement nothing cancels the reader, so a silent peer
+/// does not go straight into the peer wait. The 30s hard drain is what bounds
+/// every socket. The configured process shutdown budget, from SIGTERM to
+/// forced exit, is 5s + 30s = 35s, which fits within the chart's
+/// `terminationGracePeriodSeconds: 60` (`deploy/charts/buzz/values.yaml`).
+/// That leaves headroom but assumes no `preStop` hook adds further delay.
+/// With jitter off (`BUZZ_DRAIN_JITTER_MS=0`, the default), `drain_all()`
+/// queues every restart Close right after the grace and cancels the
+/// connections immediately, without waiting for any acknowledgement. The
+/// terminal-flush and peer-wait budgets then apply only to sockets whose
+/// teardown reaches those stages.
 const GRACEFUL_DRAIN_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(30);
 
 async fn serve(
diff --git a/crates/buzz-relay/src/nip_fi_config.rs b/crates/buzz-relay/src/nip_fi_config.rs
index 6dd846533f..f78f52f225 100644
--- a/crates/buzz-relay/src/nip_fi_config.rs
+++ b/crates/buzz-relay/src/nip_fi_config.rs
@@ -32,6 +32,7 @@
 //! backward-compatible until an operator explicitly enables enforcement.
 
 use std::collections::{BTreeMap, BTreeSet};
+use std::sync::Arc;
 use std::time::Duration;
 
 use buzz_auth::nip_fi::provision::canonical_authority;
@@ -179,17 +180,17 @@ pub(super) struct CommunityEnvConfig {
 /// no database access. Empty unless the mode is `enforce`.
 #[derive(Debug, Clone, Default)]
 pub struct NipFiCommunities {
-    by_host: BTreeMap<String, CommunityBinding>,
+    by_host: BTreeMap<String, Arc<CommunityBinding>>,
     /// Test-only: one community served at every Host, for fixtures that
     /// exercise enforce-mode handlers on per-test unique Hosts.
     #[cfg(test)]
-    any_host: Option<CommunityBinding>,
+    any_host: Option<Arc<CommunityBinding>>,
 }
 
 impl NipFiCommunities {
     /// The community served at `raw_host`, matched after the same
     /// normalization the tenant binder applies.
-    pub fn resolve(&self, raw_host: &str) -> Option<&CommunityBinding> {
+    pub fn resolve(&self, raw_host: &str) -> Option<&Arc<CommunityBinding>> {
         #[cfg(test)]
         if let Some(binding) = &self.any_host {
             return Some(binding);
@@ -231,7 +232,7 @@ impl NipFiCommunities {
                 .map_err(|e| format!("community at index {idx}: {e}"))?;
             // One Host per canonical URI, so a unique Host also means a
             // unique `aud`.
-            if by_host.insert(host, binding).is_some() {
+            if by_host.insert(host, Arc::new(binding)).is_some() {
                 return Err(format!(
                     "community at index {idx}: canonical_uri maps to the same \
                      Host as an earlier community"
@@ -245,13 +246,9 @@ impl NipFiCommunities {
         })
     }
 
-    /// Every community `aud` that authorizes `issuer`.
-    fn audiences_authorizing(&self, issuer: &str) -> Vec<String> {
-        self.by_host
-            .values()
-            .filter(|c| c.authorizes(issuer))
-            .map(|c| c.expected_aud().to_owned())
-            .collect()
+    /// Whether any community authorizes `issuer`.
+    fn authorizes_anywhere(&self, issuer: &str) -> bool {
+        self.by_host.values().any(|c| c.authorizes(issuer))
     }
 }
 
@@ -274,6 +271,8 @@ pub fn parse_provision_binding() -> Result<Option<buzz_auth::ProvisionBindingPol
 pub struct NipFiRelayConfig {
     /// The enforcement mode selected by `BUZZ_NIP_FI_MODE`.
     pub mode: NipFiMode,
+    /// Where community bindings come from (`BUZZ_NIP_FI_COMMUNITY_SOURCE`).
+    pub source: CommunitySource,
     /// Validated per-issuer assertion-policy registry.
     pub registry: IssuerRegistry,
     /// Host → community map consulted before every enforce-mode verification.
@@ -296,10 +295,27 @@ impl NipFiRelayConfig {
     /// missing or invalid (fail-closed: no token is accepted until this passes).
     pub fn from_env() -> Result<Self, ConfigError> {
         let mode = parse_mode()?;
+        let source = parse_community_source()?;
+        if source == CommunitySource::Database
+            && !std::env::var("BUZZ_NIP_FI_COMMUNITIES")
+                .unwrap_or_default()
+                .trim()
+                .is_empty()
+        {
+            return Err(ConfigError::InvalidValue(
+                "BUZZ_NIP_FI_COMMUNITY_SOURCE=database but BUZZ_NIP_FI_COMMUNITIES is set; \
+                 database-sourced communities are read from community_nip_fi_issuers"
+                    .to_string(),
+            ));
+        }
 
-        if !mode.evaluates() {
+        // The issuer registry is required whenever admission evaluates, and
+        // with the database source in every mode: provisioning, bootstrap and
+        // the resolver's registry filter all read it.
+        if !mode.evaluates() && source == CommunitySource::Env {
             return Ok(Self {
                 mode,
+                source,
                 registry: IssuerRegistry::new(),
                 communities: NipFiCommunities::default(),
                 jwks_configs: Vec::new(),
@@ -346,18 +362,21 @@ impl NipFiRelayConfig {
         // duplicate that could disagree with the per-issuer value is a config-drift
         // trap — removed in this PR.
 
-        let max_connection_lifetime_secs = parse_u64_bounded(
+        let max_connection_lifetime_secs = match parse_u64_bounded(
             "BUZZ_NIP_FI_MAX_CONNECTION_LIFETIME_SECS",
             1,
             MAX_CONNECTION_LIFETIME_SECS,
-        )?
-        .ok_or_else(|| {
-            mode_requires(
-                mode,
-                "BUZZ_NIP_FI_MAX_CONNECTION_LIFETIME_SECS is not set; \
-                 every enforce deployment must configure a positive finite value",
-            )
-        })?;
+        )? {
+            Some(secs) => secs,
+            None if !mode.evaluates() => 0,
+            None => {
+                return Err(mode_requires(
+                    mode,
+                    "BUZZ_NIP_FI_MAX_CONNECTION_LIFETIME_SECS is not set; \
+                     every enforce deployment must configure a positive finite value",
+                ))
+            }
+        };
 
         let mut policies = Vec::with_capacity(issuer_entries.len());
         let mut jwks_configs = Vec::with_capacity(issuer_entries.len());
@@ -452,30 +471,45 @@ impl NipFiRelayConfig {
             }
         }
 
-        let configured: BTreeSet<&str> = policies.iter().map(IssuerPolicy::issuer).collect();
-        let communities = parse_communities(mode, &configured)?;
-        // Fold each issuer's community allowlist into its policy ID
-        // (NIP-FI.md:145), and reject an issuer no community authorizes
-        // (NIP-FI.md:183).
         let mut registry = IssuerRegistry::new();
-        for (issuer_idx, policy) in policies.into_iter().enumerate() {
-            let audiences = communities.audiences_authorizing(policy.issuer());
-            if audiences.is_empty() {
-                return Err(ConfigError::InvalidValue(format!(
-                    "BUZZ_NIP_FI_ISSUERS: issuer at index {issuer_idx} is not \
-                     authorized by any community in BUZZ_NIP_FI_COMMUNITIES"
-                )));
+        let communities = match source {
+            CommunitySource::Env => {
+                let configured: BTreeSet<&str> =
+                    policies.iter().map(IssuerPolicy::issuer).collect();
+                let communities = parse_communities(mode, &configured)?;
+                // Reject an issuer no community authorizes (NIP-FI.md:183).
+                for (issuer_idx, policy) in policies.iter().enumerate() {
+                    if !communities.authorizes_anywhere(policy.issuer()) {
+                        return Err(ConfigError::InvalidValue(format!(
+                            "BUZZ_NIP_FI_ISSUERS: issuer at index {issuer_idx} is not \
+                             authorized by any community in BUZZ_NIP_FI_COMMUNITIES"
+                        )));
+                    }
+                }
+                communities
             }
-            registry.insert(policy.authorized_for_communities(audiences));
+            // An issuer no community row references grants nothing:
+            // authorization still needs a per-community binding.
+            CommunitySource::Database => NipFiCommunities::default(),
+        };
+        for policy in policies {
+            registry.insert(policy);
         }
 
         // Delegate final validation to buzz-auth startup gate.
-        validate_nip_fi_config(mode, &registry, &jwks_configs).map_err(
+        // The database source validates the registry in every mode, since
+        // creation paths bind against it even while admission is off.
+        let validation_mode = match source {
+            CommunitySource::Database if !mode.evaluates() => NipFiMode::Enforce,
+            _ => mode,
+        };
+        validate_nip_fi_config(validation_mode, &registry, &jwks_configs).map_err(
             |e: NipFiStartupError| ConfigError::InvalidValue(format!("NIP-FI config invalid: {e}")),
         )?;
 
         Ok(Self {
             mode,
+            source,
             registry,
             communities,
             jwks_configs,
@@ -512,6 +546,30 @@ fn parse_communities(
 
 // ── Helpers ───────────────────────────────────────────────────────────────────
 
+/// Where the Host → community bindings come from.
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
+pub enum CommunitySource {
+    /// The static `BUZZ_NIP_FI_COMMUNITIES` map (the default).
+    #[default]
+    Env,
+    /// The `community_nip_fi_issuers` table, via the snapshot resolver.
+    Database,
+}
+
+fn parse_community_source() -> Result<CommunitySource, ConfigError> {
+    match std::env::var("BUZZ_NIP_FI_COMMUNITY_SOURCE")
+        .ok()
+        .as_deref()
+        .map(str::trim)
+    {
+        None | Some("") | Some("env") => Ok(CommunitySource::Env),
+        Some("database") => Ok(CommunitySource::Database),
+        Some(other) => Err(ConfigError::InvalidValue(format!(
+            "BUZZ_NIP_FI_COMMUNITY_SOURCE must be \"env\" or \"database\"; got {other:?}"
+        ))),
+    }
+}
+
 fn parse_mode() -> Result<NipFiMode, ConfigError> {
     match std::env::var("BUZZ_NIP_FI_MODE")
         .ok()
@@ -542,7 +600,11 @@ fn mode_requires(mode: NipFiMode, missing: &str) -> ConfigError {
 
 /// Parse an optional positive `u64` env var bounded to `[min_val, max_val]`.
 /// Returns `None` when the variable is absent or empty.
-fn parse_u64_bounded(name: &str, min_val: u64, max_val: u64) -> Result<Option<u64>, ConfigError> {
+pub(crate) fn parse_u64_bounded(
+    name: &str,
+    min_val: u64,
+    max_val: u64,
+) -> Result<Option<u64>, ConfigError> {
     match std::env::var(name) {
         Err(_) => Ok(None),
         Ok(raw) if raw.trim().is_empty() => Ok(None),
@@ -654,6 +716,13 @@ fn build_issuer(entry: &IssuerEnvConfig) -> Result<(IssuerPolicy, IssuerJwksConf
 // ── Duration helpers ──────────────────────────────────────────────────────────
 
 impl NipFiRelayConfig {
+    /// Whether startup builds the database resolver: only for the `database`
+    /// source in a mode that evaluates evidence. Off and deny-protected never
+    /// resolve a community, so they load no snapshot.
+    pub fn builds_resolver(&self) -> bool {
+        self.source == CommunitySource::Database && self.mode.evaluates()
+    }
+
     /// Returns the configured `max_connection_lifetime` as a `Duration`.
     /// Returns `None` in `Off`/`DenyProtected` mode (sentinel value 0).
     pub fn max_connection_lifetime(&self) -> Option<Duration> {
@@ -674,12 +743,20 @@ impl NipFiRelayConfig {
 impl NipFiCommunities {
     /// One community at `canonical_uri` authorizing `issuers`.
     pub(crate) fn for_test(canonical_uri: &str, issuers: &[&str]) -> Self {
-        let entries = vec![CommunityEnvConfig {
-            canonical_uri: canonical_uri.to_owned(),
-            authorized_issuers: issuers.iter().map(|i| (*i).to_owned()).collect(),
-        }];
+        Self::for_test_many(&[canonical_uri], issuers)
+    }
+
+    /// One community per entry of `canonical_uris`, each authorizing `issuers`.
+    pub(crate) fn for_test_many(canonical_uris: &[&str], issuers: &[&str]) -> Self {
+        let entries = canonical_uris
+            .iter()
+            .map(|uri| CommunityEnvConfig {
+                canonical_uri: (*uri).to_owned(),
+                authorized_issuers: issuers.iter().map(|i| (*i).to_owned()).collect(),
+            })
+            .collect();
         Self::from_entries(entries, &issuers.iter().copied().collect())
-            .expect("valid test community")
+            .expect("valid test communities")
     }
 
     /// One community, expecting `aud` and authorizing `issuers`, served at
@@ -689,7 +766,7 @@ impl NipFiCommunities {
             CommunityBinding::new(aud.to_owned(), issuers.iter().map(|i| (*i).to_owned()))
                 .expect("valid test community");
         Self {
-            any_host: Some(binding),
+            any_host: Some(Arc::new(binding)),
             ..Self::default()
         }
     }
@@ -916,8 +993,6 @@ mod tests {
         for policy in [public_policy, mesh_policy] {
             assert_eq!(policy.command_audiences().len(), 1);
             assert_eq!(policy.command_audiences()[0], "https://relay.test");
-            assert_eq!(policy.community_audiences().len(), 1);
-            assert_eq!(policy.community_audiences()[0], "https://relay.test");
         }
         assert_eq!(cfg.jwks_configs.len(), 2);
         assert_eq!(cfg.jwks_configs[0].contract, public_contract);
@@ -1894,4 +1969,31 @@ mod tests {
             );
         }
     }
+
+    // Mutation: building the resolver for the database source in every mode
+    // loads a snapshot that off and deny-protected never read.
+    #[test]
+    fn only_evaluating_modes_with_the_database_source_build_a_resolver() {
+        let base = {
+            let _guard = super::NIP_FI_ENV_LOCK
+                .lock()
+                .unwrap_or_else(std::sync::PoisonError::into_inner);
+            let _env = EnvGuard::new(NIP_FI_VARS);
+            NipFiRelayConfig::from_env().expect("off config")
+        };
+        for (mode, source, expected) in [
+            (NipFiMode::Off, CommunitySource::Database, false),
+            (NipFiMode::DenyProtected, CommunitySource::Database, false),
+            (NipFiMode::Shadow, CommunitySource::Database, true),
+            (NipFiMode::Enforce, CommunitySource::Database, true),
+            (NipFiMode::Enforce, CommunitySource::Env, false),
+        ] {
+            let config = NipFiRelayConfig {
+                mode,
+                source,
+                ..base.clone()
+            };
+            assert_eq!(config.builds_resolver(), expected, "{mode:?} {source:?}");
+        }
+    }
 }
diff --git a/crates/buzz-relay/src/nip_fi_core.rs b/crates/buzz-relay/src/nip_fi_core.rs
index 86d4e776e0..1b1d887df7 100644
--- a/crates/buzz-relay/src/nip_fi_core.rs
+++ b/crates/buzz-relay/src/nip_fi_core.rs
@@ -47,8 +47,14 @@ impl AssertionRejection {
     }
 }
 
-/// Resolve the community served at the request `Host` — enforce-mode
-/// admission step 1, before any evidence is examined (NIP-FI.md:266-268).
+/// The request `Host`, if present and readable.
+fn request_host(headers: &HeaderMap) -> Option<&str> {
+    headers
+        .get(axum::http::header::HOST)
+        .and_then(|v| v.to_str().ok())
+}
+
+/// Resolve the community served at the request `Host` from a static map.
 ///
 /// An absent, unreadable, or unmapped Host is `authorization_unavailable`.
 /// This makes mapped and unmapped Hosts distinguishable (401/403 vs 503) in
@@ -57,14 +63,100 @@ impl AssertionRejection {
 pub(crate) fn resolve_community<'a>(
     headers: &HeaderMap,
     communities: &'a NipFiCommunities,
-) -> Result<&'a CommunityBinding, DenialClass> {
-    headers
-        .get(axum::http::header::HOST)
-        .and_then(|v| v.to_str().ok())
+) -> Result<&'a std::sync::Arc<CommunityBinding>, DenialClass> {
+    request_host(headers)
         .and_then(|host| communities.resolve(host))
         .ok_or(DenialClass::AuthorizationUnavailable)
 }
 
+/// A community resolved for one enforce admission.
+#[derive(Clone)]
+pub(crate) struct ResolvedCommunity {
+    binding: std::sync::Arc<CommunityBinding>,
+    deadline: AdmissionDeadline,
+}
+
+impl ResolvedCommunity {
+    /// The deadline admission must re-check after its own awaits.
+    pub(crate) fn deadline(&self) -> AdmissionDeadline {
+        self.deadline.clone()
+    }
+
+    /// The shadow `community` label: the configured URI for an `env`
+    /// binding, whose set is bounded by config, else `bound`, since the
+    /// database's host set is unbounded.
+    pub(crate) fn shadow_label(&self) -> metrics::SharedString {
+        if self.deadline.0.is_none() {
+            self.binding.expected_aud().to_owned().into()
+        } else {
+            metrics::SharedString::const_str(crate::nip_fi_shadow::BOUND)
+        }
+    }
+}
+
+impl std::ops::Deref for ResolvedCommunity {
+    type Target = CommunityBinding;
+    fn deref(&self) -> &CommunityBinding {
+        &self.binding
+    }
+}
+
+/// The point past which admitting on a resolved community is
+/// `authorization_unavailable`: the database snapshot's staleness deadline.
+/// A static `env` binding never goes stale.
+#[derive(Clone, Default)]
+pub(crate) struct AdmissionDeadline(Option<crate::nip_fi_resolver::FreshUntil>);
+
+impl AdmissionDeadline {
+    /// Run immediately before admitting.
+    pub(crate) fn check(&self) -> Result<(), DenialClass> {
+        self.0.as_ref().map_or(Ok(()), |fresh| fresh.check())
+    }
+}
+
+/// The relay's community source (`BUZZ_NIP_FI_COMMUNITY_SOURCE`): the
+/// static `env` map, or the database resolver.
+#[derive(Clone, Copy)]
+pub(crate) enum Communities<'a> {
+    Env(&'a NipFiCommunities),
+    Database(&'a std::sync::Arc<crate::nip_fi_resolver::DatabaseResolver>),
+    /// The `database` source with no resolver built: every host is
+    /// `authorization_unavailable`.
+    Unavailable,
+}
+
+impl Communities<'_> {
+    /// Resolve the community at the request `Host` — enforce-mode admission
+    /// step 1, before any evidence is examined (NIP-FI.md:266-268). Called
+    /// once per admission; the returned binding is what verification uses.
+    pub(crate) async fn resolve(
+        self,
+        headers: &HeaderMap,
+    ) -> Result<ResolvedCommunity, DenialClass> {
+        match self {
+            Self::Env(map) => resolve_community(headers, map).map(|b| ResolvedCommunity {
+                binding: std::sync::Arc::clone(b),
+                deadline: AdmissionDeadline::default(),
+            }),
+            Self::Database(resolver) => {
+                let host = request_host(headers).ok_or(DenialClass::AuthorizationUnavailable)?;
+                let (binding, fresh) = resolver.resolve(host).await?;
+                Ok(ResolvedCommunity {
+                    binding,
+                    deadline: AdmissionDeadline(Some(fresh)),
+                })
+            }
+            Self::Unavailable => Err(DenialClass::AuthorizationUnavailable),
+        }
+    }
+}
+
+impl<'a> From<&'a NipFiCommunities> for Communities<'a> {
+    fn from(map: &'a NipFiCommunities) -> Self {
+        Self::Env(map)
+    }
+}
+
 /// Extract and verify the attached assertion for `community`.
 ///
 /// Transport extraction runs before the verifier-presence check, so a
@@ -198,7 +290,7 @@ pub(crate) mod test_support {
 
     /// The binding a fixture community expecting `aud` presents.
     pub(crate) fn binding(aud: &str) -> CommunityBinding {
-        any_host(aud).resolve(TEST_HOST).expect("served").clone()
+        (**any_host(aud).resolve(TEST_HOST).expect("served")).clone()
     }
 
     /// Request headers addressed to [`TEST_HOST`].
@@ -220,10 +312,11 @@ pub(crate) mod tests {
     use std::sync::atomic::{AtomicUsize, Ordering};
 
     fn community() -> CommunityBinding {
-        communities()
-            .resolve(super::test_support::TEST_HOST)
-            .expect("mapped")
-            .clone()
+        CommunityBinding::clone(
+            communities()
+                .resolve(super::test_support::TEST_HOST)
+                .expect("mapped"),
+        )
     }
 
     /// Verifier returning a fixed result and counting calls.
diff --git a/crates/buzz-relay/src/nip_fi_http.rs b/crates/buzz-relay/src/nip_fi_http.rs
index eafb68862b..42993bbea3 100644
--- a/crates/buzz-relay/src/nip_fi_http.rs
+++ b/crates/buzz-relay/src/nip_fi_http.rs
@@ -61,11 +61,40 @@ use chrono::{DateTime, Utc};
 use nostr::PublicKey;
 use std::fmt;
 
-use crate::nip_fi_config::NipFiCommunities;
+use crate::nip_fi_core::ResolvedCommunity;
 use crate::nip_fi_core::{
-    asserted_key_matches, evaluate_attached_assertion, http_denial, resolve_community,
-    AssertionRejection,
+    asserted_key_matches, evaluate_attached_assertion, http_denial, AssertionRejection, Communities,
 };
+use buzz_auth::CommunityBinding;
+
+/// One resolution of the request `Host`, shared by every step of a request.
+pub(crate) type Resolution = Result<ResolvedCommunity, DenialClass>;
+
+tokio::task_local! {
+    /// The community the router guard resolved for this request.
+    static GUARD_COMMUNITY: Resolution;
+}
+
+/// Run `next` with the guard's resolution, so the handler's admission and
+/// every shadow record reuse it instead of resolving the Host again.
+pub(crate) async fn with_resolved_community<F: std::future::Future>(
+    community: Resolution,
+    next: F,
+) -> F::Output {
+    GUARD_COMMUNITY.scope(community, next).await
+}
+
+/// Enforce step 1 for one HTTP admission: the guard's resolution when the
+/// request passed through the guard, else one resolution (guard-exempt routes).
+pub(crate) async fn resolve_for_admission(
+    communities: Communities<'_>,
+    headers: &HeaderMap,
+) -> Resolution {
+    match GUARD_COMMUNITY.try_with(Resolution::clone) {
+        Ok(community) => community,
+        Err(_) => communities.resolve(headers).await,
+    }
+}
 use crate::nip_fi_shadow::Stage;
 
 // ── Deny-map seam ─────────────────────────────────────────────────────────────
@@ -291,10 +320,10 @@ impl<X> NipFiAdmission<X> {
 // would add allocation without architectural benefit. The large Err variant
 // is load-bearing: it IS the HTTP response, returned directly by handlers.
 #[allow(clippy::result_large_err)]
-pub(crate) fn admit_nip_fi_http<D, X, F>(
+pub(crate) async fn admit_nip_fi_http<'a, D, X, F>(
     headers: &HeaderMap,
     extract_nip98: F,
-    communities: &NipFiCommunities,
+    communities: impl Into<Communities<'a>>,
     verifier: Option<&dyn VerifyAssertion>,
     mode: NipFiMode,
     deny_map: &D,
@@ -309,6 +338,7 @@ where
     if mode.denies_unconditionally() {
         return Err(http_denial(DenialClass::AuthorizationUnavailable));
     }
+    let communities = communities.into();
 
     // Off and Shadow: the NIP-98 result passes through unchanged (legacy
     // behavior); shadow only records the enforce verdict.  [FI-INV-15 exemption]
@@ -316,7 +346,7 @@ where
         let proof = extract_nip98();
         if mode.observes_only() {
             let signed = proof.as_ref().ok().filter(|p| p.signed).map(|p| p.pubkey);
-            observe_shadow_verdict(headers, communities, verifier, deny_map, signed);
+            observe_shadow_verdict(headers, communities, verifier, deny_map, signed).await;
         }
         let proof = proof?;
         return Ok(NipFiAdmission {
@@ -326,20 +356,30 @@ where
         });
     }
 
-    let (proof, assertion) =
-        evaluate_enforce_steps(headers, communities, verifier, deny_map, extract_nip98).map_err(
-            |(stage, class)| {
-                let reason = match stage {
-                    Stage::Pairing => Some("nip_fi_http_key_mismatch"),
-                    Stage::DenySet => Some("nip_fi_http_denied_pubkey"),
-                    _ => None,
-                };
-                if let Some(reason) = reason {
-                    metrics::counter!("buzz_auth_failures_total", "reason" => reason).increment(1);
-                }
-                http_denial(class)
-            },
-        )?;
+    let community = resolve_for_admission(communities, headers).await;
+    let (proof, assertion) = evaluate_enforce_steps(
+        headers,
+        community.as_deref(),
+        verifier,
+        deny_map,
+        extract_nip98,
+    )
+    .map_err(|(stage, class)| {
+        let reason = match stage {
+            Stage::Pairing => Some("nip_fi_http_key_mismatch"),
+            Stage::DenySet => Some("nip_fi_http_denied_pubkey"),
+            _ => None,
+        };
+        if let Some(reason) = reason {
+            metrics::counter!("buzz_auth_failures_total", "reason" => reason).increment(1);
+        }
+        http_denial(class)
+    })?;
+    // The handler may have awaited (tenant lookup) since the guard resolved
+    // the community; a snapshot that went stale meanwhile admits nothing.
+    if let Ok(community) = &community {
+        community.deadline().check().map_err(http_denial)?;
+    }
 
     // Step 8: admit.
     Ok(NipFiAdmission {
@@ -351,32 +391,42 @@ where
 
 /// Record the verdict enforce would reach for a request whose NIP-98 step
 /// proved `signed` (`None`: missing, rejected or unsigned).
-fn observe_shadow_verdict<D: HttpDenyMap>(
+async fn observe_shadow_verdict<D: HttpDenyMap>(
     headers: &HeaderMap,
-    communities: &NipFiCommunities,
+    communities: Communities<'_>,
     verifier: Option<&dyn VerifyAssertion>,
     deny_map: &D,
     signed: Option<PublicKey>,
 ) {
-    let verdict = evaluate_enforce_steps(headers, communities, verifier, deny_map, || {
+    let community = resolve_for_admission(communities, headers).await;
+    let verdict = evaluate_enforce_steps(headers, community.as_deref(), verifier, deny_map, || {
         signed.map(|key| Nip98Proof::new(key, ())).ok_or(())
+    })
+    .and_then(|_| match &community {
+        // Enforce's final re-check, after the handler's awaits.
+        Ok(community) => community
+            .deadline()
+            .check()
+            .map_err(|class| (Stage::Deadline, class)),
+        Err(_) => Ok(()),
     });
-    crate::nip_fi_shadow::record("http", headers, communities, verdict.map(drop));
+    crate::nip_fi_shadow::record("http", &community, verdict);
 }
 
 /// Shadow only: record the enforce verdict for a request whose NIP-98 proof
-/// already failed, without any DB work. Off and enforce are untouched.
-pub(crate) fn observe_failed_proof(state: &crate::state::AppState, headers: &HeaderMap) {
+/// already failed. Off and enforce are untouched.
+pub(crate) async fn observe_failed_proof(state: &crate::state::AppState, headers: &HeaderMap) {
     let nip_fi = &state.config.nip_fi;
     if nip_fi.mode.observes_only() {
         let verifier = state.nip_fi_verifier.as_deref();
         observe_shadow_verdict(
             headers,
-            &nip_fi.communities,
+            state.nip_fi_communities(),
             verifier,
             &NoDenyMapConfigured,
             None,
-        );
+        )
+        .await;
     }
 }
 
@@ -384,7 +434,7 @@ pub(crate) fn observe_failed_proof(state: &crate::state::AppState, headers: &Hea
 /// (the shadow `stage` label) and its class.
 fn evaluate_enforce_steps<D, X, E, F>(
     headers: &HeaderMap,
-    communities: &NipFiCommunities,
+    community: Result<&CommunityBinding, &DenialClass>,
     verifier: Option<&dyn VerifyAssertion>,
     deny_map: &D,
     extract_nip98: F,
@@ -397,7 +447,7 @@ where
     // evidence (`Authorization`, NIP-98, assertion) is examined. Explicit
     // here because some admitted routes are exempt from the router guard.
     // [NIP-FI.md:266-268]
-    let community = resolve_community(headers, communities).map_err(|c| (Stage::Community, c))?;
+    let community = community.map_err(|c| (Stage::Community, *c))?;
 
     // Step 2 — cardinality gate: exactly one Authorization field per
     // NIP-FI.md:695-700.
@@ -464,7 +514,7 @@ where
 /// [FI-TRACE-AUTHORITY-UNIFORM]
 // Response<Body> is intentionally large (axum's design); see admit_nip_fi_http.
 #[allow(clippy::result_large_err)]
-pub(crate) fn admit_nip_fi_http_on_state<X, F>(
+pub(crate) async fn admit_nip_fi_http_on_state<X, F>(
     state: &crate::state::AppState,
     headers: &HeaderMap,
     extract_nip98: F,
@@ -474,24 +524,30 @@ where
 {
     let mode = state.config.nip_fi.mode;
     let verifier = state.nip_fi_verifier.as_deref();
-    let communities = &state.config.nip_fi.communities;
+    let communities = state.nip_fi_communities();
     match state.nip_fi_deny_map.as_deref() {
-        Some(deny_map) => admit_nip_fi_http(
-            headers,
-            extract_nip98,
-            communities,
-            verifier,
-            mode,
-            deny_map,
-        ),
-        None => admit_nip_fi_http(
-            headers,
-            extract_nip98,
-            communities,
-            verifier,
-            mode,
-            &NoDenyMapConfigured,
-        ),
+        Some(deny_map) => {
+            admit_nip_fi_http(
+                headers,
+                extract_nip98,
+                communities,
+                verifier,
+                mode,
+                deny_map,
+            )
+            .await
+        }
+        None => {
+            admit_nip_fi_http(
+                headers,
+                extract_nip98,
+                communities,
+                verifier,
+                mode,
+                &NoDenyMapConfigured,
+            )
+            .await
+        }
     }
 }
 
@@ -508,6 +564,7 @@ mod tests {
     use crate::nip_fi_core::tests::ScriptedVerifier;
     use axum::http::StatusCode;
     use buzz_auth::CLIENT_ATTACHED_HEADER;
+    use futures_util::FutureExt as _;
 
     /// Test fixture: a deny map with no entries.
     struct AlwaysAdmitStubDenyMap;
@@ -733,6 +790,8 @@ mod tests {
                 NipFiMode::Enforce,
                 deny_map,
             )
+            .now_or_never()
+            .expect("env resolution never waits")
         };
         let snapshot = |resp: Response<Body>| {
             let status = resp.status();
@@ -779,7 +838,9 @@ mod tests {
             None::<&dyn VerifyAssertion>,
             NipFiMode::Off,
             &AlwaysAdmitStubDenyMap,
-        );
+        )
+        .now_or_never()
+        .expect("env resolution never waits");
         let admission =
             outcome.expect("Off mode MUST not require NIP-FI assertion — OSS default regression");
         assert_eq!(*admission.proven_pubkey(), expected_pubkey);
@@ -802,7 +863,9 @@ mod tests {
             None::<&dyn VerifyAssertion>,
             NipFiMode::Off,
             &AlwaysAdmitStubDenyMap,
-        );
+        )
+        .now_or_never()
+        .expect("env resolution never waits");
         let resp = outcome.unwrap_err();
         assert_eq!(resp.status(), deny_status);
     }
@@ -834,7 +897,9 @@ mod tests {
             None::<&dyn VerifyAssertion>,
             NipFiMode::Enforce,
             &AlwaysAdmitStubDenyMap,
-        );
+        )
+        .now_or_never()
+        .expect("env resolution never waits");
         let resp = outcome.unwrap_err();
         assert_eq!(
             resp.status(),
@@ -860,7 +925,9 @@ mod tests {
             None::<&dyn VerifyAssertion>,
             NipFiMode::Enforce,
             &AlwaysAdmitStubDenyMap,
-        );
+        )
+        .now_or_never()
+        .expect("env resolution never waits");
         let resp = outcome.unwrap_err();
         assert_eq!(
             resp.status(),
@@ -884,7 +951,9 @@ mod tests {
             None::<&dyn VerifyAssertion>,
             NipFiMode::Off,
             &AlwaysAdmitStubDenyMap,
-        );
+        )
+        .now_or_never()
+        .expect("env resolution never waits");
         let resp = outcome.unwrap_err();
         assert_eq!(
             resp.status(),
@@ -922,7 +991,9 @@ mod tests {
             None::<&dyn VerifyAssertion>,
             NipFiMode::Off,
             &AlwaysAdmitStubDenyMap,
-        );
+        )
+        .now_or_never()
+        .expect("env resolution never waits");
         let resp = outcome.unwrap_err();
         assert_eq!(resp.status(), StatusCode::UNAUTHORIZED);
         assert_eq!(
@@ -1014,7 +1085,9 @@ mod tests {
                 Some(&verifier as &dyn VerifyAssertion),
                 NipFiMode::DenyProtected,
                 &AlwaysAdmitStubDenyMap,
-            );
+            )
+            .now_or_never()
+            .expect("env resolution never waits");
             let Err(resp) = outcome else {
                 panic!("{case}: DenyProtected must deny with 503");
             };
@@ -1058,7 +1131,9 @@ mod tests {
             None::<&dyn VerifyAssertion>,
             NipFiMode::Enforce,
             &AlwaysAdmitStubDenyMap,
-        );
+        )
+        .now_or_never()
+        .expect("env resolution never waits");
         // Missing header → MissingEvidence before verifier check.
         match outcome {
             Err(resp) => {
@@ -1090,7 +1165,9 @@ mod tests {
             None::<&dyn VerifyAssertion>,
             NipFiMode::Enforce,
             &AlwaysAdmitStubDenyMap,
-        );
+        )
+        .now_or_never()
+        .expect("env resolution never waits");
         match outcome {
             Err(resp) => {
                 assert_eq!(resp.status(), StatusCode::SERVICE_UNAVAILABLE);
@@ -1150,7 +1227,9 @@ mod tests {
             Some(&verifier as &dyn VerifyAssertion),
             NipFiMode::Enforce,
             &AlwaysAdmitStubDenyMap,
-        );
+        )
+        .now_or_never()
+        .expect("env resolution never waits");
         match outcome {
             Err(resp) => {
                 assert_eq!(
@@ -1226,7 +1305,9 @@ mod tests {
             None::<&dyn VerifyAssertion>,
             NipFiMode::Enforce,
             &AlwaysAdmitStubDenyMap,
-        );
+        )
+        .now_or_never()
+        .expect("env resolution never waits");
         let resp = outcome.unwrap_err();
         assert_eq!(
             resp.status(),
@@ -1276,7 +1357,9 @@ mod tests {
             None::<&dyn VerifyAssertion>,
             NipFiMode::Off,
             &AlwaysAdmitStubDenyMap,
-        );
+        )
+        .now_or_never()
+        .expect("env resolution never waits");
         let admission = match outcome {
             Ok(a) => a,
             Err(resp) => panic!(
@@ -1321,6 +1404,8 @@ mod tests {
             NipFiMode::Enforce,
             &AlwaysAdmitStubDenyMap,
         )
+        .now_or_never()
+        .expect("env resolution never waits")
     }
 
     fn denial_parts(outcome: Result<NipFiAdmission<()>, Response<Body>>) -> (StatusCode, Vec<u8>) {
@@ -1434,7 +1519,9 @@ mod tests {
             Some(&verifier as &dyn VerifyAssertion),
             NipFiMode::Enforce,
             &AlwaysAdmitStubDenyMap,
-        );
+        )
+        .now_or_never()
+        .expect("env resolution never waits");
         let (status, body) = denial_parts(outcome);
         assert_eq!(status, StatusCode::UNAUTHORIZED);
         assert_eq!(body, b"authentication required\n");
@@ -1466,7 +1553,9 @@ mod tests {
                 Some(&verifier as &dyn VerifyAssertion),
                 NipFiMode::Enforce,
                 &AlwaysAdmitStubDenyMap,
-            );
+            )
+            .now_or_never()
+            .expect("env resolution never waits");
             let (status, body) = denial_parts(outcome);
             assert_eq!(status, StatusCode::SERVICE_UNAVAILABLE);
             assert_eq!(body, b"authorization unavailable\n");
@@ -1500,6 +1589,8 @@ mod tests {
                 NipFiMode::Shadow,
                 &AlwaysAdmitStubDenyMap,
             )
+            .now_or_never()
+            .expect("env resolution never waits")
             .expect("shadow admits an unmapped Host");
             assert_eq!(admission.proven_pubkey, key);
             assert!(admission.assertion.is_none());
@@ -1537,6 +1628,8 @@ mod tests {
                 NipFiMode::Shadow,
                 &AlwaysAdmitStubDenyMap,
             )
+            .now_or_never()
+            .expect("env resolution never waits")
         })
         .expect("shadow admits the dev fallback like Off");
         assert_eq!(admission.proven_pubkey, key);
@@ -1567,6 +1660,8 @@ mod tests {
             NipFiMode::Shadow,
             &AlwaysAdmitStubDenyMap,
         )
+        .now_or_never()
+        .expect("env resolution never waits")
         .expect("shadow admits");
         assert!(admission.assertion.is_none());
         assert_eq!(verifier.calls(), 1);
@@ -1578,7 +1673,9 @@ mod tests {
             Some(&verifier as &dyn VerifyAssertion),
             NipFiMode::Shadow,
             &AlwaysAdmitStubDenyMap,
-        );
+        )
+        .now_or_never()
+        .expect("env resolution never waits");
         let Err(resp) = legacy else {
             panic!("NIP-98 failure must propagate")
         };
diff --git a/crates/buzz-relay/src/nip_fi_resolver.rs b/crates/buzz-relay/src/nip_fi_resolver.rs
new file mode 100644
index 0000000000..3c1ffb2b9f
--- /dev/null
+++ b/crates/buzz-relay/src/nip_fi_resolver.rs
@@ -0,0 +1,875 @@
+//! Database-sourced NIP-FI community resolution (`BUZZ_NIP_FI_COMMUNITY_SOURCE=database`).
+//!
+//! Each pod holds a snapshot of every registry-filtered binding of an active
+//! community, loaded at startup and refreshed every 30s, start to start. A
+//! host found in a fresh snapshot (loaded under two minutes ago) is answered
+//! from memory. Any other host, and every host once the snapshot is stale,
+//! goes to a bounded, single-flight database lookup whose positive answer is
+//! used for that admission only and whose "not found" is cached for 5s.
+//!
+//! Every answer carries a [`FreshUntil`] two minutes after the read behind
+//! it started (the snapshot load, or the lookup), re-checked after every
+//! await, so no admission rests on a read older than that.
+//!
+//! A removed binding stops admitting new connections once a later refresh
+//! publishes: within [`REFRESH_INTERVAL`] plus the refresh timeout (40s by
+//! default) while refreshes succeed. While they fail, the last snapshot keeps
+//! answering until it goes stale, so the bound is [`STALE_AFTER`] (two
+//! minutes) from that snapshot's read; after that every host is looked up
+//! live. Open WebSocket sessions are not rechecked when a binding is removed;
+//! they end at their own session deadline.
+//!
+//! `buzz_nip_fi_binding_snapshot_loaded_timestamp_seconds` is written on
+//! every refresh attempt with the start of the last good load (zero before
+//! the first). Alert on `time() - buzz_nip_fi_binding_snapshot_loaded_timestamp_seconds > 120`
+//! together with `absent(buzz_nip_fi_binding_snapshot_loaded_timestamp_seconds)`
+//! for a database-source pod, since a pod that never exports it cannot age.
+//!
+//! The snapshot pointer and the negative cache change under one publication
+//! lock. Publishing a snapshot and recording a creation bump a sequence
+//! number; a "not found" read while the sequence moved is not cached.
+//! Snapshot reads are lock-free.
+
+use std::collections::HashMap;
+use std::num::NonZeroUsize;
+use std::sync::atomic::{AtomicBool, AtomicU64, AtomicUsize, Ordering};
+use std::sync::{Arc, Mutex, PoisonError};
+use std::time::Duration;
+
+use arc_swap::ArcSwapOption;
+use buzz_auth::{CommunityBinding, DenialClass, ProvisionBindingPolicy};
+use buzz_core::tenant::normalize_host;
+use buzz_db::RowCapExceeded;
+use futures_util::future::{BoxFuture, FutureExt, Shared};
+use tokio::sync::Semaphore;
+
+use crate::config::ConfigError;
+
+#[cfg(test)]
+mod tests;
+
+/// Refreshes start this often, measured start to start.
+pub const REFRESH_INTERVAL: Duration = Duration::from_secs(30);
+/// The last good snapshot serves for at most this long after its load.
+pub const STALE_AFTER: Duration = Duration::from_secs(120);
+/// The first retry delay after a failed refresh; it doubles per failure up
+/// to [`REFRESH_INTERVAL`].
+pub const RETRY_FIRST: Duration = Duration::from_secs(2);
+/// How long a "not found" miss is cached.
+pub const NEGATIVE_TTL: Duration = Duration::from_secs(5);
+
+/// Resolver bounds. Every bound fails closed. Only the first four are read
+/// from the environment; the lookup queue limits are fixed.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ResolverBounds {
+    /// `BUZZ_NIP_FI_RESOLVER_NEGATIVE_CACHE_MAX`, at most 1,000,000.
+    pub negative_cache_max: usize,
+    /// `BUZZ_NIP_FI_RESOLVER_MAX_INFLIGHT`, kept below the writer pool size
+    /// so lookups never take every database connection.
+    pub max_inflight: usize,
+    /// `BUZZ_NIP_FI_SNAPSHOT_MAX_ROWS`, at most 10,000,000:
+    /// community-issuer pairs, not communities.
+    pub snapshot_max_rows: usize,
+    /// `BUZZ_NIP_FI_SNAPSHOT_REFRESH_TIMEOUT_MS`, shorter than
+    /// [`REFRESH_INTERVAL`].
+    pub refresh_timeout: Duration,
+    /// Hosts with a lookup in flight.
+    pub max_pending_hosts: usize,
+    /// Callers waiting on those lookups.
+    pub max_waiters: usize,
+    /// How long a lookup waits for an inflight permit.
+    pub permit_wait: Duration,
+    /// How long a lookup's database read may take.
+    pub lookup_timeout: Duration,
+}
+
+impl Default for ResolverBounds {
+    fn default() -> Self {
+        Self {
+            negative_cache_max: 100_000,
+            max_inflight: 8,
+            snapshot_max_rows: 1_000_000,
+            refresh_timeout: Duration::from_secs(10),
+            max_pending_hosts: 1_024,
+            max_waiters: 4_096,
+            permit_wait: Duration::from_millis(50),
+            lookup_timeout: Duration::from_millis(500),
+        }
+    }
+}
+
+impl ResolverBounds {
+    /// Read the tunable bounds from the environment, defaulting unset ones,
+    /// and keep `max_inflight` below `db_pool_size` (at least 1).
+    pub fn from_env(db_pool_size: u32) -> Result<Self, ConfigError> {
+        let d = Self::default();
+        let bounded = |name: &str, max: u64, default: usize| -> Result<usize, ConfigError> {
+            Ok(crate::nip_fi_config::parse_u64_bounded(name, 1, max)?
+                .map_or(default, |v| v as usize))
+        };
+        let below_interval = REFRESH_INTERVAL.as_millis() as u64 - 1;
+        let refresh_timeout = crate::nip_fi_config::parse_u64_bounded(
+            "BUZZ_NIP_FI_SNAPSHOT_REFRESH_TIMEOUT_MS",
+            1,
+            below_interval,
+        )?
+        .map_or(d.refresh_timeout, Duration::from_millis);
+        let max_inflight = bounded(
+            "BUZZ_NIP_FI_RESOLVER_MAX_INFLIGHT",
+            u32::MAX.into(),
+            d.max_inflight,
+        )?
+        .min(db_pool_size.saturating_sub(1).max(1) as usize);
+        Ok(Self {
+            negative_cache_max: bounded(
+                "BUZZ_NIP_FI_RESOLVER_NEGATIVE_CACHE_MAX",
+                1_000_000,
+                d.negative_cache_max,
+            )?,
+            max_inflight,
+            snapshot_max_rows: bounded(
+                "BUZZ_NIP_FI_SNAPSHOT_MAX_ROWS",
+                10_000_000,
+                d.snapshot_max_rows,
+            )?,
+            refresh_timeout,
+            ..d
+        })
+    }
+}
+
+/// A snapshot load's `(host, issuer)` rows, or the cap it exceeded; the
+/// outer error is a failed read.
+pub type SnapshotRows = Result<Result<Vec<(String, String)>, RowCapExceeded>, String>;
+
+/// Where bindings are read from. Implemented by [`buzz_db::Db`]; tests
+/// substitute counting and failing sources.
+pub trait BindingSource: Send + Sync + 'static {
+    /// One consistent registry-filtered read of every active binding, as
+    /// `(host, issuer)` rows; more than `max_rows` fails.
+    fn load<'a>(&'a self, registry: &'a [String], max_rows: usize) -> BoxFuture<'a, SnapshotRows>;
+
+    /// The registry-filtered issuers of the active community at `host`.
+    fn lookup<'a>(
+        &'a self,
+        host: &'a str,
+        registry: &'a [String],
+    ) -> BoxFuture<'a, Result<Vec<String>, String>>;
+}
+
+impl BindingSource for buzz_db::Db {
+    fn load<'a>(&'a self, registry: &'a [String], max_rows: usize) -> BoxFuture<'a, SnapshotRows> {
+        async move {
+            self.load_nip_fi_binding_snapshot(registry, max_rows)
+                .await
+                .map_err(|e| e.to_string())
+        }
+        .boxed()
+    }
+
+    fn lookup<'a>(
+        &'a self,
+        host: &'a str,
+        registry: &'a [String],
+    ) -> BoxFuture<'a, Result<Vec<String>, String>> {
+        async move {
+            self.lookup_nip_fi_admission_binding(host, registry)
+                .await
+                .map_err(|e| e.to_string())
+        }
+        .boxed()
+    }
+}
+
+/// Monotonic time since the resolver started; replaceable in tests.
+pub trait Clock: Send + Sync + 'static {
+    /// Elapsed time on this clock.
+    fn now(&self) -> Duration;
+}
+
+struct TokioClock(tokio::time::Instant);
+
+impl Clock for TokioClock {
+    fn now(&self) -> Duration {
+        self.0.elapsed()
+    }
+}
+
+/// The staleness deadline of the read an admission resolved against: two
+/// minutes after that snapshot load or lookup started. Admission re-checks
+/// it after its own awaits, so a binding resolved just inside the limit
+/// cannot be admitted after it. Holds no map.
+#[derive(Clone)]
+pub struct FreshUntil {
+    clock: Arc<dyn Clock>,
+    deadline: Duration,
+}
+
+impl FreshUntil {
+    /// `authorization_unavailable` once the deadline has passed.
+    pub fn check(&self) -> Result<(), DenialClass> {
+        (self.clock.now() < self.deadline)
+            .then_some(())
+            .ok_or(DenialClass::AuthorizationUnavailable)
+    }
+}
+
+/// One published full load.
+struct Published {
+    map: HashMap<String, Arc<CommunityBinding>>,
+    /// Clock time the load started; the staleness deadline counts from here.
+    loaded_at: Duration,
+}
+
+/// State changed only under the publication lock.
+struct Writable {
+    negative: lru::LruCache<String, Duration>,
+}
+
+/// A lookup's binding, if any, with the clock time its read started.
+type MissOutcome = Result<Option<(Arc<CommunityBinding>, Duration)>, ()>;
+type PendingLookup = Shared<BoxFuture<'static, MissOutcome>>;
+
+/// Why a refresh published nothing.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum LoadFailure {
+    /// The store failed.
+    Store(String),
+    /// More rows than `BUZZ_NIP_FI_SNAPSHOT_MAX_ROWS`.
+    OverCap,
+    /// The whole attempt exceeded `BUZZ_NIP_FI_SNAPSHOT_REFRESH_TIMEOUT_MS`.
+    Timeout,
+    /// Its read started before the published one's (defensive).
+    Superseded,
+    /// An earlier attempt's map build is still running; no new load starts.
+    BuildOutstanding,
+}
+
+impl LoadFailure {
+    fn label(&self) -> &'static str {
+        match self {
+            Self::Store(_) => "store",
+            Self::OverCap => "over_cap",
+            Self::Timeout => "timeout",
+            Self::Superseded => "superseded",
+            Self::BuildOutstanding => "build_outstanding",
+        }
+    }
+}
+
+/// The database-sourced community resolver.
+pub struct DatabaseResolver {
+    source: Arc<dyn BindingSource>,
+    policy: ProvisionBindingPolicy,
+    registry: Vec<String>,
+    bounds: ResolverBounds,
+    clock: Arc<dyn Clock>,
+    published: ArcSwapOption<Published>,
+    publication: Mutex<Writable>,
+    sequence: AtomicU64,
+    pending: Mutex<HashMap<String, PendingLookup>>,
+    waiters: AtomicUsize,
+    permits: Arc<Semaphore>,
+    /// Set while an attempt (its load or its map build) is alive. A build
+    /// abandoned by a timeout keeps it set until the builder thread returns.
+    building: Arc<AtomicBool>,
+    /// Wall-clock seconds of the last successful load's start, as `f64`
+    /// bits; zero before the first.
+    loaded_wall_secs: AtomicU64,
+    /// A uniform draw in `[0, 1)` for refresh jitter; fixed in tests.
+    pub(crate) jitter: fn() -> f64,
+    #[cfg(test)]
+    pub(crate) hooks: Arc<hooks::Hooks>,
+}
+
+impl DatabaseResolver {
+    /// A resolver with no snapshot yet: every admission is unavailable until
+    /// the first [`DatabaseResolver::refresh`] succeeds.
+    pub fn new(
+        source: Arc<dyn BindingSource>,
+        policy: ProvisionBindingPolicy,
+        registry: Vec<String>,
+        bounds: ResolverBounds,
+    ) -> Self {
+        Self::with_clock(
+            source,
+            policy,
+            registry,
+            bounds,
+            Arc::new(TokioClock(tokio::time::Instant::now())),
+        )
+    }
+
+    pub(crate) fn with_clock(
+        source: Arc<dyn BindingSource>,
+        policy: ProvisionBindingPolicy,
+        registry: Vec<String>,
+        bounds: ResolverBounds,
+        clock: Arc<dyn Clock>,
+    ) -> Self {
+        let negative_cap =
+            NonZeroUsize::new(bounds.negative_cache_max).unwrap_or(NonZeroUsize::MIN);
+        Self {
+            source,
+            policy,
+            registry,
+            permits: Arc::new(Semaphore::new(bounds.max_inflight)),
+            bounds,
+            clock,
+            published: ArcSwapOption::empty(),
+            publication: Mutex::new(Writable {
+                negative: lru::LruCache::new(negative_cap),
+            }),
+            sequence: AtomicU64::new(0),
+            pending: Mutex::new(HashMap::new()),
+            waiters: AtomicUsize::new(0),
+            building: Arc::default(),
+            loaded_wall_secs: AtomicU64::new(0),
+            jitter: rand::random::<f64>,
+            #[cfg(test)]
+            hooks: Arc::default(),
+        }
+    }
+
+    /// Resolve the community at `raw_host` for one admission: from a fresh
+    /// snapshot when it lists the host, otherwise from a database lookup,
+    /// each answer judged by its own read's age.
+    pub async fn resolve(
+        self: &Arc<Self>,
+        raw_host: &str,
+    ) -> Result<(Arc<CommunityBinding>, FreshUntil), DenialClass> {
+        const UNAVAILABLE: DenialClass = DenialClass::AuthorizationUnavailable;
+        let host = normalize_host(raw_host);
+        if !self.policy.is_bindable(&host) {
+            return Err(UNAVAILABLE);
+        }
+        if let Some(hit) = self.fresh_snapshot_hit(&host) {
+            return Ok(hit);
+        }
+        if self.negatively_cached(&host) {
+            return Err(UNAVAILABLE);
+        }
+        match self.miss(host).await {
+            Ok(Some((binding, read_started))) => Ok((binding, self.fresh_until(read_started))),
+            Ok(None) | Err(()) => Err(UNAVAILABLE),
+        }
+    }
+
+    /// Record that this pod just committed a binding for `host`: drop its
+    /// cached "not found" and bump the sequence, so a lookup that read
+    /// before the commit cannot cache one, and the creator's first login
+    /// looks it up.
+    pub fn record_creation(&self, host: &str) {
+        let host = normalize_host(host);
+        let mut writable = self.lock();
+        writable.negative.pop(&host);
+        self.bump(&writable);
+    }
+
+    /// Run one full load and publish it. A failure publishes nothing and
+    /// leaves the staleness deadline where it was.
+    pub async fn refresh(&self) -> Result<(), LoadFailure> {
+        let started = self.clock.now();
+        // The attempt's absolute deadline. The timeout below only fires at an
+        // await; the synchronous map build and publication after the read
+        // check this instead, so expired work is never published.
+        let deadline = started + self.bounds.refresh_timeout;
+        let started_wall = std::time::SystemTime::now();
+        let timer = std::time::Instant::now();
+        // Held by the attempt, then by its builder thread: dropping the
+        // attempt on timeout cannot release it while the build still runs.
+        let Some(slot) = BuildSlot::claim(&self.building) else {
+            metrics::counter!("buzz_nip_fi_binding_snapshot_load_failures_total", "reason" => LoadFailure::BuildOutstanding.label())
+                .increment(1);
+            return Err(LoadFailure::BuildOutstanding);
+        };
+        let attempt = async {
+            let load = self
+                .source
+                .load(&self.registry, self.bounds.snapshot_max_rows)
+                .await
+                .map_err(LoadFailure::Store)?
+                .map_err(|_| LoadFailure::OverCap)?;
+            let rows = load.len();
+            // Up to the row cap of grouping and binding construction: run it
+            // off the runtime worker.
+            // Set when this attempt is dropped (timeout or cancel); the
+            // builder checks it, and the deadline, as it goes.
+            let abandoned = Abandoned::default();
+            let stop = {
+                let flag = Arc::clone(&abandoned.0);
+                let clock = Arc::clone(&self.clock);
+                move || flag.load(Ordering::Acquire) || clock.now() >= deadline
+            };
+            #[cfg(test)]
+            let test_hooks = Arc::clone(&self.hooks);
+            let map = tokio::task::spawn_blocking(move || {
+                let _slot = slot;
+                #[cfg(test)]
+                test_hooks.hit_sync(hooks::BUILD_START);
+                build_map(load, stop)
+            })
+            .await
+            .map_err(|e| LoadFailure::Store(format!("map build failed: {e}")))?
+            .ok_or(LoadFailure::Timeout)?;
+            #[cfg(test)]
+            self.hooks.hit(hooks::REFRESH_BEFORE_PUBLISH).await;
+            let replaced = self.publish(map, started, deadline)?;
+            // Freeing up to the row cap of bindings is real work; keep it
+            // off the runtime worker and outside the publication lock.
+            if let Some(old) = replaced {
+                tokio::task::spawn_blocking(move || drop(old));
+            }
+            Ok(rows)
+        };
+        let result = match tokio::time::timeout(self.bounds.refresh_timeout, attempt).await {
+            Ok(result) => result,
+            Err(_) => Err(LoadFailure::Timeout),
+        };
+        metrics::histogram!("buzz_nip_fi_binding_snapshot_load_duration_seconds")
+            .record(timer.elapsed().as_secs_f64());
+        if result.is_ok() {
+            if let Ok(since_epoch) = started_wall.duration_since(std::time::UNIX_EPOCH) {
+                self.loaded_wall_secs
+                    .store(since_epoch.as_secs_f64().to_bits(), Ordering::Relaxed);
+            }
+        }
+        // Rewritten on every attempt, failed ones included, so the series
+        // exists from the first attempt and keeps reporting the last good
+        // load. A timestamp, not an age: `time() - ...` keeps aging at scrape
+        // time even if the refresh task stops; `absent()` catches a pod that
+        // never exports it.
+        let loaded = f64::from_bits(self.loaded_wall_secs.load(Ordering::Relaxed));
+        metrics::gauge!("buzz_nip_fi_binding_snapshot_loaded_timestamp_seconds").set(loaded);
+        metrics::gauge!("buzz_nip_fi_binding_snapshot_max_rows")
+            .set(self.bounds.snapshot_max_rows as f64);
+        match result {
+            Ok(rows) => {
+                metrics::gauge!("buzz_nip_fi_binding_snapshot_rows").set(rows as f64);
+                Ok(())
+            }
+            Err(failure) => {
+                tracing::warn!(
+                    reason = failure.label(),
+                    "NIP-FI binding snapshot load failed"
+                );
+                metrics::counter!("buzz_nip_fi_binding_snapshot_load_failures_total", "reason" => failure.label())
+                    .increment(1);
+                Err(failure)
+            }
+        }
+    }
+
+    /// Refresh every [`REFRESH_INTERVAL`], start to start, never
+    /// overlapping. After a failure the next attempt comes sooner, backing
+    /// off from [`RETRY_FIRST`] and doubling up to the interval; every delay
+    /// is jittered down by up to a tenth so pods do not refresh in lockstep.
+    /// The caller has already done the startup load.
+    pub async fn run_refresh_loop(self: Arc<Self>, cancel: tokio_util::sync::CancellationToken) {
+        let mut failures = 0u32;
+        let mut started = tokio::time::Instant::now();
+        loop {
+            let delay = jittered(next_refresh_delay(failures), (self.jitter)());
+            tokio::select! {
+                () = cancel.cancelled() => return,
+                () = tokio::time::sleep_until(started + delay) => {}
+            }
+            started = tokio::time::Instant::now();
+            failures = match self.refresh().await {
+                Ok(()) => 0,
+                Err(_) => failures.saturating_add(1),
+            };
+        }
+    }
+
+    // ── Internals ───────────────────────────────────────────────────────────
+
+    fn lock(&self) -> std::sync::MutexGuard<'_, Writable> {
+        self.publication
+            .lock()
+            .unwrap_or_else(PoisonError::into_inner)
+    }
+
+    /// Bump the publication sequence; the caller holds the lock.
+    fn bump(&self, _held: &Writable) {
+        self.sequence.fetch_add(1, Ordering::AcqRel);
+    }
+
+    /// The deadline for an answer whose read started at `read_started`.
+    fn fresh_until(&self, read_started: Duration) -> FreshUntil {
+        FreshUntil {
+            clock: Arc::clone(&self.clock),
+            deadline: read_started + STALE_AFTER,
+        }
+    }
+
+    /// `host` in the published snapshot, unless that snapshot is stale (or
+    /// none is loaded): a stale one may still list a removed binding. Clones
+    /// only the selected binding.
+    fn fresh_snapshot_hit(&self, host: &str) -> Option<(Arc<CommunityBinding>, FreshUntil)> {
+        let published = self.published.load();
+        let published = published.as_ref()?;
+        let fresh = self.fresh_until(published.loaded_at);
+        fresh.check().ok()?;
+        Some((Arc::clone(published.map.get(host)?), fresh))
+    }
+
+    fn negatively_cached(&self, host: &str) -> bool {
+        let now = self.clock.now();
+        let mut writable = self.lock();
+        match writable.negative.get(host) {
+            Some(expiry) if *expiry > now => true,
+            Some(_) => {
+                writable.negative.pop(host);
+                false
+            }
+            None => false,
+        }
+    }
+
+    fn publish(
+        &self,
+        map: HashMap<String, Arc<CommunityBinding>>,
+        started: Duration,
+        deadline: Duration,
+    ) -> Result<Option<Arc<Published>>, LoadFailure> {
+        let mut writable = self.lock();
+        if self
+            .published
+            .load()
+            .as_ref()
+            .is_some_and(|published| started < published.loaded_at)
+        {
+            return Err(LoadFailure::Superseded);
+        }
+        #[cfg(test)]
+        self.hooks.hit_sync(hooks::PUBLISH_BEFORE_WRITE);
+        // Checked under the lock, immediately before the first write:
+        // waiting for the lock cannot let an expired attempt publish.
+        if self.clock.now() >= deadline {
+            return Err(LoadFailure::Timeout);
+        }
+        let replaced = self.published.swap(Some(Arc::new(Published {
+            map,
+            loaded_at: started,
+        })));
+        writable.negative.clear();
+        metrics::gauge!("buzz_nip_fi_resolver_negative_cache_size").set(0.0);
+        self.bump(&writable);
+        Ok(replaced)
+    }
+
+    /// The bounded, single-flight lookup. A positive answer is returned to
+    /// its waiters only; a "not found" is cached only if no creation or
+    /// publication happened while it ran.
+    async fn miss(self: &Arc<Self>, host: String) -> MissOutcome {
+        let lookup = {
+            let mut pending = self.pending.lock().unwrap_or_else(PoisonError::into_inner);
+            match pending.get(&host) {
+                Some(lookup) => lookup.clone(),
+                None => {
+                    if pending.len() >= self.bounds.max_pending_hosts {
+                        reject("pending_hosts");
+                        return Err(());
+                    }
+                    let lookup = self.spawn_lookup(host.clone());
+                    pending.insert(host, lookup.clone());
+                    lookup
+                }
+            }
+        };
+        let Some(_waiter) = WaiterSlot::take(&self.waiters, self.bounds.max_waiters) else {
+            reject("waiters");
+            return Err(());
+        };
+        lookup.await
+    }
+
+    /// Run one lookup on its own task, so it completes (and leaves the
+    /// pending map) even if every waiter goes away.
+    fn spawn_lookup(self: &Arc<Self>, host: String) -> PendingLookup {
+        let this = Arc::clone(self);
+        let task = tokio::spawn(async move {
+            // Leaves the pending map even if the lookup panics, so the host
+            // is not stuck behind a dead entry.
+            struct Leave<'a>(&'a DatabaseResolver, &'a str);
+            impl Drop for Leave<'_> {
+                fn drop(&mut self) {
+                    self.0
+                        .pending
+                        .lock()
+                        .unwrap_or_else(PoisonError::into_inner)
+                        .remove(self.1);
+                }
+            }
+            let _leave = Leave(&this, &host);
+            let sequence = this.sequence.load(Ordering::Acquire);
+            let outcome = this.lookup_once(&host).await;
+            if matches!(outcome, Ok(None)) {
+                this.store_negative(&host, sequence);
+            }
+            outcome
+        });
+        async move { task.await.unwrap_or(Err(())) }
+            .boxed()
+            .shared()
+    }
+
+    async fn lookup_once(&self, host: &str) -> MissOutcome {
+        let permit = match tokio::time::timeout(
+            self.bounds.permit_wait,
+            Arc::clone(&self.permits).acquire_owned(),
+        )
+        .await
+        {
+            Ok(Ok(permit)) => permit,
+            _ => {
+                reject("permit");
+                return Err(());
+            }
+        };
+        // Every waiter on this lookup shares this deadline origin.
+        let read_started = self.clock.now();
+        let timer = std::time::Instant::now();
+        let read = tokio::time::timeout(
+            self.bounds.lookup_timeout,
+            self.source.lookup(host, &self.registry),
+        )
+        .await;
+        drop(permit);
+        metrics::histogram!("buzz_nip_fi_resolver_lookup_duration_seconds")
+            .record(timer.elapsed().as_secs_f64());
+        #[cfg(test)]
+        self.hooks.hit(hooks::MISS_AFTER_READ).await;
+        match read {
+            Err(_) => {
+                metrics::counter!("buzz_nip_fi_resolver_lookup_timeouts_total").increment(1);
+                Err(())
+            }
+            Ok(Err(_)) => Err(()),
+            Ok(Ok(issuers)) if issuers.is_empty() => Ok(None),
+            Ok(Ok(issuers)) => Ok(binding_for(host, issuers).map(|b| (b, read_started))),
+        }
+    }
+
+    fn store_negative(&self, host: &str, sequence: u64) {
+        let mut writable = self.lock();
+        if self.sequence.load(Ordering::Acquire) != sequence {
+            return;
+        }
+        let expiry = self.clock.now() + NEGATIVE_TTL;
+        if let Some((evicted, _)) = writable.negative.push(host.to_owned(), expiry) {
+            if evicted != host {
+                metrics::counter!("buzz_nip_fi_resolver_negative_evictions_total").increment(1);
+            }
+        }
+        metrics::gauge!("buzz_nip_fi_resolver_negative_cache_size")
+            .set(writable.negative.len() as f64);
+    }
+
+    #[cfg(test)]
+    pub(crate) fn negative_len(&self) -> usize {
+        self.lock().negative.len()
+    }
+
+    #[cfg(test)]
+    pub(crate) fn pending_len(&self) -> usize {
+        self.pending
+            .lock()
+            .unwrap_or_else(PoisonError::into_inner)
+            .len()
+    }
+
+    #[cfg(test)]
+    pub(crate) fn waiters_now(&self) -> usize {
+        self.waiters.load(Ordering::Acquire)
+    }
+
+    #[cfg(test)]
+    pub(crate) fn inflight_now(&self) -> usize {
+        self.bounds.max_inflight - self.permits.available_permits()
+    }
+}
+
+fn reject(reason: &'static str) {
+    metrics::counter!("buzz_nip_fi_resolver_miss_rejections_total", "reason" => reason)
+        .increment(1);
+}
+
+/// One counted caller waiting on a pending lookup.
+struct WaiterSlot<'a>(&'a AtomicUsize);
+
+impl<'a> WaiterSlot<'a> {
+    fn take(waiters: &'a AtomicUsize, max: usize) -> Option<Self> {
+        waiters
+            .fetch_update(Ordering::AcqRel, Ordering::Acquire, |n| {
+                (n < max).then_some(n + 1)
+            })
+            .ok()
+            .map(|_| Self(waiters))
+    }
+}
+
+impl Drop for WaiterSlot<'_> {
+    fn drop(&mut self) {
+        self.0.fetch_sub(1, Ordering::AcqRel);
+    }
+}
+
+/// The delay before the next refresh after `failures` consecutive failures.
+fn next_refresh_delay(failures: u32) -> Duration {
+    match failures {
+        0 => REFRESH_INTERVAL,
+        n => RETRY_FIRST
+            .saturating_mul(1 << (n - 1).min(16))
+            .min(REFRESH_INTERVAL),
+    }
+}
+
+/// `delay` shortened by up to a tenth, by `unit` in `[0, 1)`.
+fn jittered(delay: Duration, unit: f64) -> Duration {
+    delay.mul_f64(1.0 - unit.clamp(0.0, 1.0) / 10.0)
+}
+
+fn binding_for(host: &str, issuers: Vec<String>) -> Option<Arc<CommunityBinding>> {
+    CommunityBinding::new(format!("https://{host}"), issuers)
+        .ok()
+        .map(Arc::new)
+}
+
+/// Group rows into bindings, or `None` as soon as `stop` reports the
+/// attempt abandoned or expired; checked in both passes.
+fn build_map(
+    rows: Vec<(String, String)>,
+    stop: impl Fn() -> bool,
+) -> Option<HashMap<String, Arc<CommunityBinding>>> {
+    let mut grouped: HashMap<String, Vec<String>> = HashMap::new();
+    for (host, issuer) in rows {
+        if stop() {
+            return None;
+        }
+        grouped
+            .entry(normalize_host(&host))
+            .or_default()
+            .push(issuer);
+    }
+    let mut map = HashMap::with_capacity(grouped.len());
+    for (host, issuers) in grouped {
+        if stop() {
+            return None;
+        }
+        if let Some(binding) = binding_for(&host, issuers) {
+            map.insert(host, binding);
+        }
+    }
+    Some(map)
+}
+
+/// The resolver's single in-flight attempt; released on drop, wherever the
+/// owner (the attempt or its builder thread) ends, including a panic.
+struct BuildSlot(Arc<AtomicBool>);
+
+impl BuildSlot {
+    fn claim(building: &Arc<AtomicBool>) -> Option<Self> {
+        building
+            .compare_exchange(false, true, Ordering::AcqRel, Ordering::Acquire)
+            .ok()
+            .map(|_| Self(Arc::clone(building)))
+    }
+}
+
+impl Drop for BuildSlot {
+    fn drop(&mut self) {
+        self.0.store(false, Ordering::Release);
+    }
+}
+
+/// Raised when the awaiting attempt is dropped, telling its builder to stop.
+#[derive(Default)]
+struct Abandoned(Arc<AtomicBool>);
+
+impl Drop for Abandoned {
+    fn drop(&mut self) {
+        self.0.store(true, Ordering::Release);
+    }
+}
+
+#[cfg(test)]
+pub(crate) mod hooks {
+    //! Per-resolver pause points for ordering tests.
+    use std::collections::HashMap;
+    use std::sync::{Arc, Mutex};
+
+    use tokio::sync::Semaphore;
+
+    pub(crate) const REFRESH_BEFORE_PUBLISH: &str = "refresh.before_publish";
+    pub(crate) const MISS_AFTER_READ: &str = "miss.after_read";
+    /// Synchronous, under the publication lock: see [`Hooks::on_sync`].
+    pub(crate) const PUBLISH_BEFORE_WRITE: &str = "publish.before_write";
+    /// Synchronous, on the builder thread before the map build.
+    pub(crate) const BUILD_START: &str = "build.start";
+
+    /// An armed pause: production signals `reached`, then waits for `release`.
+    pub(crate) struct Gate {
+        reached: Semaphore,
+        release: Semaphore,
+    }
+
+    impl Gate {
+        pub(crate) async fn reached(&self) {
+            self.reached.acquire().await.expect("open").forget();
+        }
+
+        pub(crate) fn release(&self) {
+            self.release.add_permits(1);
+        }
+    }
+
+    #[derive(Default)]
+    pub(crate) struct Hooks(
+        Mutex<HashMap<&'static str, Arc<Gate>>>,
+        Mutex<HashMap<&'static str, SyncAction>>,
+    );
+
+    type SyncAction = Arc<dyn Fn() + Send + Sync>;
+
+    impl Hooks {
+        /// Pause every later hit of `point` until released, once per release.
+        pub(crate) fn arm(&self, point: &'static str) -> Arc<Gate> {
+            let gate = Arc::new(Gate {
+                reached: Semaphore::new(0),
+                release: Semaphore::new(0),
+            });
+            self.0.lock().unwrap().insert(point, Arc::clone(&gate));
+            gate
+        }
+
+        pub(crate) fn disarm(&self, point: &'static str) {
+            self.0.lock().unwrap().remove(point);
+        }
+
+        /// Run `action` at every later hit of the synchronous `point`.
+        pub(crate) fn on_sync(
+            &self,
+            point: &'static str,
+            action: impl Fn() + Send + Sync + 'static,
+        ) {
+            self.1.lock().unwrap().insert(point, Arc::new(action));
+        }
+
+        pub(crate) fn hit_sync(&self, point: &'static str) {
+            let action = self.1.lock().unwrap().get(point).cloned();
+            if let Some(action) = action {
+                action();
+            }
+        }
+
+        pub(crate) async fn hit(&self, point: &'static str) {
+            let gate = self.0.lock().unwrap().get(point).cloned();
+            if let Some(gate) = gate {
+                gate.reached.add_permits(1);
+                gate.release.acquire().await.expect("open").forget();
+            }
+        }
+    }
+}
diff --git a/crates/buzz-relay/src/nip_fi_resolver/tests.rs b/crates/buzz-relay/src/nip_fi_resolver/tests.rs
new file mode 100644
index 0000000000..309ca1c310
--- /dev/null
+++ b/crates/buzz-relay/src/nip_fi_resolver/tests.rs
@@ -0,0 +1,1097 @@
+//! Resolver ordering, staleness, and bounds tests. The store is an in-memory
+//! fake that counts every call; the clock is manual.
+
+use std::sync::atomic::{AtomicU64, AtomicUsize, Ordering};
+use std::sync::{Arc, Mutex};
+use std::time::Duration;
+
+use buzz_auth::{DenialClass, ProvisionBindingPolicy};
+use buzz_db::RowCapExceeded;
+use futures_util::future::{BoxFuture, FutureExt};
+
+use super::hooks::{BUILD_START, MISS_AFTER_READ, PUBLISH_BEFORE_WRITE, REFRESH_BEFORE_PUBLISH};
+use super::*;
+
+const ISS: &str = "https://app.builderlab.xyz/api/goose";
+const UNAVAILABLE: Result<(), DenialClass> = Err(DenialClass::AuthorizationUnavailable);
+
+fn policy() -> ProvisionBindingPolicy {
+    ProvisionBindingPolicy::parse(
+        &serde_json::json!({"host_suffix": "communities.buzz.xyz", "authorized_issuers": [ISS]})
+            .to_string(),
+        &serde_json::json!([
+            {"issuer": ISS, "command_audiences": ["https://communities.buzz.xyz"], "token_class": "nip-fi+jwt"}
+        ])
+        .to_string(),
+    )
+    .expect("valid policy")
+}
+
+fn host(label: &str) -> String {
+    format!("{label}.communities.buzz.xyz")
+}
+
+#[derive(Default)]
+struct ManualClock(AtomicU64);
+
+impl ManualClock {
+    fn set(&self, at: Duration) {
+        self.0.store(at.as_millis() as u64, Ordering::SeqCst);
+    }
+}
+
+impl Clock for ManualClock {
+    fn now(&self) -> Duration {
+        Duration::from_millis(self.0.load(Ordering::SeqCst))
+    }
+}
+
+/// In-memory bindings.
+struct FakeStore {
+    hosts: Mutex<Vec<String>>,
+    fail_loads: std::sync::atomic::AtomicBool,
+    lookup_fails: std::sync::atomic::AtomicBool,
+    lookup_panics: std::sync::atomic::AtomicBool,
+    loads: AtomicUsize,
+    /// Rows the last load pulled from its stream.
+    rows_pulled: AtomicUsize,
+    lookups: Mutex<Vec<String>>,
+    lookup_delay: Mutex<Duration>,
+    load_delay: Mutex<Duration>,
+}
+
+impl FakeStore {
+    fn new(hosts: &[&str]) -> Arc<Self> {
+        Arc::new(Self {
+            hosts: Mutex::new(hosts.iter().map(|l| host(l)).collect()),
+            fail_loads: false.into(),
+            lookup_fails: false.into(),
+            lookup_panics: false.into(),
+            loads: AtomicUsize::new(0),
+            rows_pulled: AtomicUsize::new(0),
+            lookups: Mutex::new(Vec::new()),
+            lookup_delay: Mutex::new(Duration::ZERO),
+            load_delay: Mutex::new(Duration::ZERO),
+        })
+    }
+    fn add(&self, label: &str) {
+        self.hosts.lock().unwrap().push(host(label));
+    }
+    fn remove(&self, label: &str) {
+        self.hosts.lock().unwrap().retain(|h| h != &host(label));
+    }
+    fn lookups_for(&self, label: &str) -> usize {
+        let h = host(label);
+        self.lookups
+            .lock()
+            .unwrap()
+            .iter()
+            .filter(|l| **l == h)
+            .count()
+    }
+    fn total_lookups(&self) -> usize {
+        self.lookups.lock().unwrap().len()
+    }
+}
+
+impl BindingSource for FakeStore {
+    fn load<'a>(&'a self, _registry: &'a [String], max_rows: usize) -> BoxFuture<'a, SnapshotRows> {
+        async move {
+            self.loads.fetch_add(1, Ordering::SeqCst);
+            // A consistent read: rows as of the read's start, however long
+            // it then takes.
+            let hosts = self.hosts.lock().unwrap().clone();
+            let delay = *self.load_delay.lock().unwrap();
+            if !delay.is_zero() {
+                tokio::time::sleep(delay).await;
+            }
+            if self.fail_loads.load(Ordering::SeqCst) {
+                return Err("load failed".into());
+            }
+            // Pulled one row at a time and capped as the real store does.
+            self.rows_pulled.store(0, Ordering::SeqCst);
+            let mut rows = Vec::new();
+            for host in hosts {
+                self.rows_pulled.fetch_add(1, Ordering::SeqCst);
+                if rows.len() == max_rows {
+                    return Ok(Err(RowCapExceeded(max_rows)));
+                }
+                rows.push((host, ISS.to_owned()));
+            }
+            Ok(Ok(rows))
+        }
+        .boxed()
+    }
+
+    fn lookup<'a>(
+        &'a self,
+        host: &'a str,
+        _registry: &'a [String],
+    ) -> BoxFuture<'a, Result<Vec<String>, String>> {
+        async move {
+            self.lookups.lock().unwrap().push(host.to_owned());
+            let delay = *self.lookup_delay.lock().unwrap();
+            if !delay.is_zero() {
+                tokio::time::sleep(delay).await;
+            }
+            assert!(
+                !self.lookup_panics.load(Ordering::SeqCst),
+                "lookup panicked"
+            );
+            if self.lookup_fails.load(Ordering::SeqCst) {
+                return Err("pool closed".into());
+            }
+            let found = self.hosts.lock().unwrap().iter().any(|h| h == host);
+            Ok(if found {
+                vec![ISS.to_owned()]
+            } else {
+                Vec::new()
+            })
+        }
+        .boxed()
+    }
+}
+
+struct Fixture {
+    store: Arc<FakeStore>,
+    clock: Arc<ManualClock>,
+    resolver: Arc<DatabaseResolver>,
+}
+
+fn fixture_with(hosts: &[&str], bounds: ResolverBounds) -> Fixture {
+    let store = FakeStore::new(hosts);
+    let clock = Arc::new(ManualClock::default());
+    let resolver = Arc::new(DatabaseResolver::with_clock(
+        Arc::clone(&store) as Arc<dyn BindingSource>,
+        policy(),
+        vec![ISS.to_owned()],
+        bounds,
+        Arc::clone(&clock) as Arc<dyn Clock>,
+    ));
+    Fixture {
+        store,
+        clock,
+        resolver,
+    }
+}
+
+fn fixture(hosts: &[&str]) -> Fixture {
+    fixture_with(hosts, ResolverBounds::default())
+}
+
+impl Fixture {
+    async fn resolve(&self, label: &str) -> Result<(), DenialClass> {
+        self.resolver.resolve(&host(label)).await.map(|_| ())
+    }
+}
+
+fn secs(s: f64) -> Duration {
+    Duration::from_secs_f64(s)
+}
+
+// A lookup that panics still leaves the pending map, so the next admission
+// for that host runs a fresh lookup. Mutation: removing the entry only on the
+// normal path leaves the host denied by the dead lookup forever.
+#[tokio::test]
+async fn panicked_lookup_does_not_strand_the_host() {
+    let f = fixture(&["a"]);
+    f.store.lookup_panics.store(true, Ordering::SeqCst);
+    assert!(f.resolve("a").await.is_err());
+    f.store.lookup_panics.store(false, Ordering::SeqCst);
+    assert_eq!(f.resolve("a").await, Ok(()));
+    assert_eq!(f.store.lookups_for("a"), 2);
+}
+
+// ── Before the first load, and once the snapshot is stale ──────────────────
+
+// With no snapshot loaded, admissions go to the live lookup; a failed or
+// over-cap load publishes nothing.
+#[tokio::test]
+async fn unloaded_resolver_uses_live_lookups_and_failed_or_over_cap_load_keeps_it_unloaded() {
+    let f = fixture_with(
+        &["a", "b"],
+        ResolverBounds {
+            snapshot_max_rows: 1,
+            ..ResolverBounds::default()
+        },
+    );
+    assert_eq!(f.resolve("a").await, Ok(()));
+    assert_eq!(f.resolve("unknown").await, UNAVAILABLE);
+    assert_eq!(f.resolver.refresh().await, Err(LoadFailure::OverCap));
+    f.store.fail_loads.store(true, Ordering::SeqCst);
+    assert!(matches!(
+        f.resolver.refresh().await,
+        Err(LoadFailure::Store(_))
+    ));
+    assert!(f.resolver.published.load().is_none());
+    assert_eq!(f.resolve("b").await, Ok(()));
+    assert_eq!(f.store.lookups_for("a"), 1);
+    assert_eq!(f.store.lookups_for("b"), 1);
+}
+
+// While refreshes fail, the last snapshot answers for two minutes after its
+// load started; after that every host goes to the live lookup, which sees a
+// removal at once and fails closed when the database does. Mutation: serving
+// a stale snapshot admits "gone"; denying once stale refuses "a".
+#[tokio::test]
+async fn stale_snapshot_is_skipped_for_live_lookups() {
+    let f = fixture(&["a", "gone"]);
+    f.resolver.refresh().await.unwrap();
+    f.store.fail_loads.store(true, Ordering::SeqCst);
+    f.store.remove("gone");
+
+    f.clock.set(secs(60.0));
+    assert!(f.resolver.refresh().await.is_err());
+    f.clock.set(secs(119.0));
+    assert_eq!(f.resolve("a").await, Ok(()));
+    assert_eq!(
+        f.resolve("gone").await,
+        Ok(()),
+        "fresh snapshot still lists it"
+    );
+    assert_eq!(
+        f.store.total_lookups(),
+        0,
+        "fresh snapshot hosts never look up"
+    );
+
+    f.clock.set(secs(121.0));
+    assert_eq!(f.resolve("a").await, Ok(()));
+    assert_eq!(f.resolve("gone").await, UNAVAILABLE);
+    assert_eq!(f.store.lookups_for("a"), 1);
+    assert_eq!(f.store.lookups_for("gone"), 1);
+    assert_eq!(f.resolver.negative_len(), 1, "the not-found is cached");
+    f.store.lookup_fails.store(true, Ordering::SeqCst);
+    assert_eq!(f.resolve("a").await, UNAVAILABLE, "database down");
+
+    f.store.fail_loads.store(false, Ordering::SeqCst);
+    f.resolver.refresh().await.unwrap();
+    assert_eq!(f.resolve("a").await, Ok(()));
+    assert_eq!(f.store.lookups_for("a"), 2, "fresh snapshot again");
+}
+
+// A lookup answer is judged by its own read, not the snapshot's: the
+// snapshot going stale while the lookup runs still admits, and the answer
+// expires two minutes after its read started. Mutation: re-checking the
+// snapshot's deadline after the await denies; dating the answer from the
+// snapshot load expires it at once.
+#[tokio::test]
+async fn lookup_answer_carries_its_own_deadline_past_a_stale_snapshot() {
+    let f = fixture(&["a"]);
+    f.resolver.refresh().await.unwrap();
+    f.store.add("late");
+    f.clock.set(secs(119.9));
+    let gate = f.resolver.hooks.arm(MISS_AFTER_READ);
+    let pending = tokio::spawn({
+        let resolver = Arc::clone(&f.resolver);
+        async move { resolver.resolve(&host("late")).await }
+    });
+    gate.reached().await;
+    f.clock.set(secs(120.1));
+    gate.release();
+    let (_, fresh) = pending.await.unwrap().expect("admitted");
+    assert_eq!(fresh.check(), Ok(()));
+    f.clock.set(secs(239.8));
+    assert_eq!(fresh.check(), Ok(()));
+    f.clock.set(secs(239.9));
+    assert_eq!(fresh.check(), UNAVAILABLE, "read started at 119.9s");
+}
+
+#[tokio::test]
+async fn timed_out_refresh_publishes_nothing_and_keeps_the_deadline() {
+    let f = fixture_with(
+        &["a"],
+        ResolverBounds {
+            refresh_timeout: Duration::from_millis(20),
+            ..ResolverBounds::default()
+        },
+    );
+    f.resolver.refresh().await.unwrap();
+    f.store.remove("a");
+    f.store.add("b");
+    *f.store.load_delay.lock().unwrap() = Duration::from_millis(200);
+    f.clock.set(secs(100.0));
+    assert_eq!(f.resolver.refresh().await, Err(LoadFailure::Timeout));
+    // Retained snapshot unchanged: "a" still resolves without a lookup.
+    assert_eq!(f.resolve("a").await, Ok(()));
+    assert_eq!(f.store.lookups_for("a"), 0);
+    f.clock.set(secs(121.0));
+    assert_eq!(
+        f.resolve("a").await,
+        UNAVAILABLE,
+        "the live lookup sees the removal"
+    );
+}
+
+// Criterion 3 (publication bound): a deadline that passes during the
+// synchronous build/publish tail fails the attempt. The manual clock moves
+// while tokio time does not, so only the attempt deadline can catch it.
+#[tokio::test]
+async fn refresh_whose_deadline_passes_before_publication_publishes_nothing() {
+    let f = fixture(&["a"]);
+    f.resolver.refresh().await.unwrap();
+    f.store.remove("a");
+    f.clock.set(secs(30.0));
+    let gate = f.resolver.hooks.arm(REFRESH_BEFORE_PUBLISH);
+    let refresh = tokio::spawn({
+        let resolver = Arc::clone(&f.resolver);
+        async move { resolver.refresh().await }
+    });
+    gate.reached().await;
+    f.clock.set(secs(40.0));
+    gate.release();
+    assert_eq!(refresh.await.unwrap(), Err(LoadFailure::Timeout));
+    assert_eq!(f.resolve("a").await, Ok(()), "old map retained");
+    f.clock.set(secs(120.0));
+    assert_eq!(f.resolve("a").await, UNAVAILABLE, "old deadline retained");
+    assert_eq!(f.store.lookups_for("a"), 1);
+}
+
+// The deadline is rechecked under the publication lock, immediately before
+// the first write: an attempt that crosses it while waiting publishes
+// nothing. Mutation: checking before taking the lock (or not at all)
+// publishes the late snapshot.
+#[tokio::test]
+async fn refresh_crossing_its_deadline_while_preparing_publishes_nothing() {
+    let f = fixture(&["a"]);
+    f.resolver.refresh().await.unwrap();
+    f.store.remove("a");
+    f.clock.set(secs(30.0));
+    let clock = Arc::clone(&f.clock);
+    f.resolver
+        .hooks
+        .on_sync(PUBLISH_BEFORE_WRITE, move || clock.set(secs(40.0)));
+    assert_eq!(f.resolver.refresh().await, Err(LoadFailure::Timeout));
+    assert_eq!(f.resolve("a").await, Ok(()), "old map retained");
+    assert_eq!(f.store.lookups_for("a"), 0);
+    f.clock.set(secs(120.0));
+    assert_eq!(f.resolve("a").await, UNAVAILABLE, "old deadline retained");
+    assert_eq!(f.store.lookups_for("a"), 1);
+}
+
+// A map build abandoned by a timeout keeps running on its blocking thread;
+// until it returns, no new load starts, so at most one cap-sized build is
+// ever outstanding. Once released it stops cooperatively, publishes nothing,
+// and the next tick loads normally. Mutation: releasing the slot with the
+// attempt (or not holding one) starts a second build while the first lives.
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn timed_out_build_blocks_new_loads_until_it_returns_and_publishes_nothing() {
+    let f = fixture_with(
+        &["a"],
+        ResolverBounds {
+            refresh_timeout: Duration::from_millis(50),
+            ..ResolverBounds::default()
+        },
+    );
+    f.resolver.refresh().await.unwrap();
+    f.store.remove("a");
+    f.store.add("b");
+
+    let outstanding = Arc::new(AtomicUsize::new(0));
+    let peak = Arc::new(AtomicUsize::new(0));
+    let started = Arc::new(AtomicUsize::new(0));
+    let release = Arc::new((Mutex::new(false), std::sync::Condvar::new()));
+    f.resolver.hooks.on_sync(BUILD_START, {
+        let (outstanding, peak, started, release) = (
+            Arc::clone(&outstanding),
+            Arc::clone(&peak),
+            Arc::clone(&started),
+            Arc::clone(&release),
+        );
+        move || {
+            started.fetch_add(1, Ordering::SeqCst);
+            let now = outstanding.fetch_add(1, Ordering::SeqCst) + 1;
+            peak.fetch_max(now, Ordering::SeqCst);
+            let (open, signal) = &*release;
+            // Bounded, so a regression fails the test instead of hanging it.
+            let _ = signal
+                .wait_timeout_while(open.lock().unwrap(), Duration::from_secs(5), |open| !*open)
+                .unwrap();
+            outstanding.fetch_sub(1, Ordering::SeqCst);
+        }
+    });
+
+    assert_eq!(f.resolver.refresh().await, Err(LoadFailure::Timeout));
+    let loads = f.store.loads.load(Ordering::SeqCst);
+    for _ in 0..3 {
+        assert_eq!(
+            f.resolver.refresh().await,
+            Err(LoadFailure::BuildOutstanding)
+        );
+    }
+    assert_eq!(f.store.loads.load(Ordering::SeqCst), loads, "no new load");
+    assert_eq!(started.load(Ordering::SeqCst), 1);
+
+    let (open, signal) = &*release;
+    *open.lock().unwrap() = true;
+    signal.notify_all();
+    for _ in 0..200 {
+        if !f.resolver.building.load(Ordering::SeqCst) {
+            break;
+        }
+        tokio::time::sleep(Duration::from_millis(5)).await;
+    }
+    assert!(
+        !f.resolver.building.load(Ordering::SeqCst),
+        "build released"
+    );
+    assert_eq!(f.resolve("a").await, Ok(()), "nothing published late");
+    assert_eq!(f.store.lookups_for("a"), 0);
+
+    f.resolver.refresh().await.unwrap();
+    assert_eq!(peak.load(Ordering::SeqCst), 1, "one build at a time");
+    assert_eq!(started.load(Ordering::SeqCst), 2);
+    assert_eq!(f.resolve("b").await, Ok(()));
+    assert_eq!(f.store.lookups_for("b"), 0, "new snapshot published");
+}
+
+#[test]
+fn build_map_stops_in_either_pass_once_told_to() {
+    let rows = vec![(host("a"), ISS.to_owned()), (host("b"), ISS.to_owned())];
+    assert!(build_map(rows.clone(), || true).is_none(), "grouping pass");
+    let checks = AtomicUsize::new(0);
+    let stop_in_second_pass = || checks.fetch_add(1, Ordering::SeqCst) >= rows.len();
+    assert!(
+        build_map(rows.clone(), stop_in_second_pass).is_none(),
+        "binding pass"
+    );
+    assert_eq!(build_map(rows, || false).map(|m| m.len()), Some(2));
+}
+
+// The load stops at cap + 1 rows; a loaded snapshot survives an over-cap
+// refresh unchanged.
+#[tokio::test]
+async fn over_cap_refresh_stops_streaming_and_keeps_the_loaded_snapshot() {
+    let f = fixture_with(
+        &["a", "b"],
+        ResolverBounds {
+            snapshot_max_rows: 2,
+            ..ResolverBounds::default()
+        },
+    );
+    f.resolver.refresh().await.unwrap();
+    for label in ["c", "d", "e", "f"] {
+        f.store.add(label);
+    }
+    f.store.remove("b");
+    f.clock.set(secs(60.0));
+    assert_eq!(f.resolver.refresh().await, Err(LoadFailure::OverCap));
+    assert_eq!(f.store.rows_pulled.load(Ordering::SeqCst), 3, "cap + 1");
+    assert_eq!(f.resolve("b").await, Ok(()), "old map retained");
+    assert_eq!(f.store.lookups_for("b"), 0);
+    f.clock.set(secs(120.0));
+    assert_eq!(f.resolve("b").await, UNAVAILABLE, "old deadline retained");
+}
+
+#[tokio::test]
+async fn failed_miss_lookup_denies_and_stores_no_negative_entry() {
+    let f = fixture(&["a"]);
+    f.resolver.refresh().await.unwrap();
+    f.store.lookup_fails.store(true, Ordering::SeqCst);
+    assert_eq!(f.resolve("x").await, UNAVAILABLE);
+    assert_eq!(f.resolver.negative_len(), 0);
+}
+
+// ── Criterion 14: refresh removes bindings; 40s removal bound ───────────────
+
+#[tokio::test]
+async fn refresh_removes_unbound_communities_and_held_positive_miss_is_not_stored() {
+    let f = fixture(&["a", "b", "control"]);
+    f.resolver.refresh().await.unwrap();
+    f.store.remove("a");
+    f.store.remove("b");
+    assert_eq!(f.resolve("a").await, Ok(()), "before refresh");
+    f.resolver.refresh().await.unwrap();
+    assert_eq!(f.resolve("a").await, UNAVAILABLE);
+    assert_eq!(f.resolve("b").await, UNAVAILABLE);
+    assert_eq!(f.resolve("control").await, Ok(()));
+
+    // (c) A miss reads "h" active and is held; "h" is removed and a refresh
+    // publishes; the held answer is returned once and never stored.
+    f.store.add("h");
+    let gate = f.resolver.hooks.arm(MISS_AFTER_READ);
+    let pending = tokio::spawn({
+        let resolver = Arc::clone(&f.resolver);
+        async move { resolver.resolve(&host("h")).await.map(|_| ()) }
+    });
+    gate.reached().await;
+    f.resolver.hooks.disarm(MISS_AFTER_READ);
+    f.store.remove("h");
+    f.resolver.refresh().await.unwrap();
+    gate.release();
+    assert_eq!(pending.await.unwrap(), Ok(()));
+    assert_eq!(f.resolve("h").await, UNAVAILABLE);
+}
+
+#[tokio::test(start_paused = true)]
+async fn unbinding_after_a_snapshot_is_enforced_within_forty_seconds() {
+    // The production scheduler on the tokio clock: refresh at +30s, its
+    // read held for just under the 10s limit, published before +40s.
+    let store = FakeStore::new(&["a", "gone"]);
+    let mut resolver = DatabaseResolver::new(
+        Arc::clone(&store) as Arc<dyn BindingSource>,
+        policy(),
+        vec![ISS.to_owned()],
+        ResolverBounds::default(),
+    );
+    // No jitter: the worst case, a tick a full interval after the last.
+    resolver.jitter = || 0.0;
+    let resolver = Arc::new(resolver);
+    let resolve = |label: &str| {
+        let resolver = Arc::clone(&resolver);
+        let host = host(label);
+        async move { resolver.resolve(&host).await.map(drop) }
+    };
+    resolver.refresh().await.unwrap();
+    store.remove("gone");
+    *store.load_delay.lock().unwrap() = Duration::from_millis(9_900);
+    let cancel = tokio_util::sync::CancellationToken::new();
+    let refresh_loop = tokio::spawn(Arc::clone(&resolver).run_refresh_loop(cancel.clone()));
+    tokio::task::yield_now().await; // the loop arms its schedule at t=0
+
+    // Step the paused clock so the loop wakes on its +30s tick, and let its
+    // load start and sleep on the 9.9s read.
+    tokio::time::advance(REFRESH_INTERVAL).await;
+    while store.loads.load(Ordering::SeqCst) < 2 {
+        tokio::task::yield_now().await;
+    }
+    tokio::time::advance(Duration::from_millis(9_800)).await;
+    assert_eq!(
+        resolve("gone").await,
+        Ok(()),
+        "before the refresh publishes"
+    );
+    // +39.9s: the held read returns. The map build runs on a real blocking
+    // thread the paused clock cannot see, so wait for the publication itself
+    // (bounded in real time); the paused clock stays at +39.9s meanwhile.
+    tokio::time::advance(Duration::from_millis(100)).await;
+    let waited = std::time::Instant::now();
+    while resolver
+        .published
+        .load()
+        .as_ref()
+        .is_none_or(|published| published.loaded_at < REFRESH_INTERVAL)
+    {
+        assert!(
+            waited.elapsed() < Duration::from_secs(30),
+            "never published"
+        );
+        tokio::task::yield_now().await;
+    }
+    assert!(resolver.clock.now() < Duration::from_secs(40));
+    assert_eq!(resolve("gone").await, UNAVAILABLE, "removed by +40s");
+    assert_eq!(resolve("a").await, Ok(()));
+    cancel.cancel();
+    refresh_loop.await.unwrap();
+}
+
+// Mutation: retrying a failure only on the next full interval, never
+// backing off, or jittering a delay up instead of down.
+#[test]
+fn refresh_delay_backs_off_after_failures_and_jitters_down() {
+    let delays: Vec<u64> = (0..7).map(|n| next_refresh_delay(n).as_secs()).collect();
+    assert_eq!(delays, [30, 2, 4, 8, 16, 30, 30]);
+    assert_eq!(next_refresh_delay(u32::MAX), REFRESH_INTERVAL);
+    assert_eq!(jittered(REFRESH_INTERVAL, 0.0), REFRESH_INTERVAL);
+    assert_eq!(jittered(REFRESH_INTERVAL, 0.5), secs(28.5));
+    assert!(jittered(REFRESH_INTERVAL, 0.999_999) > secs(27.0));
+}
+
+// The loop refreshes every REFRESH_INTERVAL and retries a failure after
+// RETRY_FIRST. Mutation: a different interval, or no retry before the next
+// interval, changes the load count at each step.
+#[tokio::test(start_paused = true)]
+async fn refresh_loop_runs_every_interval_and_retries_failures_sooner() {
+    let store = FakeStore::new(&["a"]);
+    let mut resolver = DatabaseResolver::new(
+        Arc::clone(&store) as Arc<dyn BindingSource>,
+        policy(),
+        vec![ISS.to_owned()],
+        ResolverBounds::default(),
+    );
+    resolver.jitter = || 0.0;
+    let resolver = Arc::new(resolver);
+    let cancel = tokio_util::sync::CancellationToken::new();
+    let refresh_loop = tokio::spawn(Arc::clone(&resolver).run_refresh_loop(cancel.clone()));
+    let loads_after = |step: Duration| {
+        let store = Arc::clone(&store);
+        async move {
+            tokio::time::advance(step).await;
+            for _ in 0..100 {
+                tokio::task::yield_now().await;
+            }
+            store.loads.load(Ordering::SeqCst)
+        }
+    };
+    tokio::task::yield_now().await;
+    assert_eq!(loads_after(REFRESH_INTERVAL - secs(0.1)).await, 0);
+    store.fail_loads.store(true, Ordering::SeqCst);
+    assert_eq!(
+        loads_after(secs(0.1)).await,
+        1,
+        "first tick at the interval"
+    );
+    assert_eq!(loads_after(RETRY_FIRST).await, 2, "failure retried sooner");
+    store.fail_loads.store(false, Ordering::SeqCst);
+    assert_eq!(loads_after(RETRY_FIRST * 2).await, 3, "backed off, then ok");
+    // The successful load's map build runs on a real blocking thread the
+    // paused clock cannot see. Wait for its publication (bounded in real
+    // time) before moving the clock, or the next advance passes the
+    // refresh's timeout and fails it.
+    let succeeded_at = REFRESH_INTERVAL + RETRY_FIRST * 3;
+    let waited = std::time::Instant::now();
+    while resolver
+        .published
+        .load()
+        .as_ref()
+        .is_none_or(|published| published.loaded_at < succeeded_at)
+    {
+        assert!(
+            waited.elapsed() < Duration::from_secs(30),
+            "never published"
+        );
+        tokio::task::yield_now().await;
+    }
+    assert_eq!(loads_after(REFRESH_INTERVAL - secs(0.1)).await, 3);
+    assert_eq!(loads_after(secs(0.1)).await, 4, "back on the interval");
+    cancel.cancel();
+    refresh_loop.await.unwrap();
+}
+
+// Two slow successful refreshes in a row, the binding removed just after the
+// first one's read began: the second refresh starts one interval after the
+// first start, so the removal is published within the documented 40s.
+// Mutation: timing the interval from when a refresh finishes starts the
+// second one at +69.9s and publishes the removal at +79.8s.
+#[tokio::test(start_paused = true)]
+async fn removal_during_a_slow_refresh_is_published_within_forty_seconds() {
+    let store = FakeStore::new(&["a", "gone"]);
+    *store.load_delay.lock().unwrap() = Duration::from_millis(9_900);
+    let mut resolver = DatabaseResolver::new(
+        Arc::clone(&store) as Arc<dyn BindingSource>,
+        policy(),
+        vec![ISS.to_owned()],
+        ResolverBounds::default(),
+    );
+    resolver.jitter = || 0.0;
+    let resolver = Arc::new(resolver);
+    let cancel = tokio_util::sync::CancellationToken::new();
+    let refresh_loop = tokio::spawn(Arc::clone(&resolver).run_refresh_loop(cancel.clone()));
+    tokio::task::yield_now().await; // the loop arms its schedule at t=0
+    let started = tokio::time::Instant::now();
+    let published_after = |at: Duration| {
+        let resolver = Arc::clone(&resolver);
+        async move {
+            // The map build runs on a blocking thread the paused clock
+            // cannot see; wait for it in bounded real time.
+            let waited = std::time::Instant::now();
+            while resolver
+                .published
+                .load()
+                .as_ref()
+                .is_none_or(|published| published.loaded_at < at)
+            {
+                assert!(
+                    waited.elapsed() < Duration::from_secs(30),
+                    "never published"
+                );
+                tokio::task::yield_now().await;
+            }
+        }
+    };
+    let resolve = |label: &str| {
+        let resolver = Arc::clone(&resolver);
+        let host = host(label);
+        async move { resolver.resolve(&host).await.map(drop) }
+    };
+
+    // +30s: the first refresh reads, still seeing "gone"; it is removed now.
+    tokio::time::advance(REFRESH_INTERVAL).await;
+    while store.loads.load(Ordering::SeqCst) < 1 {
+        tokio::task::yield_now().await;
+    }
+    store.remove("gone");
+    let removed = started.elapsed();
+    tokio::time::advance(Duration::from_millis(9_900)).await;
+    published_after(REFRESH_INTERVAL).await;
+    assert_eq!(
+        resolve("gone").await,
+        Ok(()),
+        "first snapshot predates removal"
+    );
+
+    // The second refresh starts at +60s and publishes at +69.9s.
+    tokio::time::sleep_until(started + REFRESH_INTERVAL * 2 + Duration::from_millis(9_900)).await;
+    published_after(REFRESH_INTERVAL * 2).await;
+    assert!(resolver.clock.now() - removed < Duration::from_secs(40));
+    assert_eq!(resolve("gone").await, UNAVAILABLE, "removed within 40s");
+    assert_eq!(resolve("a").await, Ok(()));
+    cancel.cancel();
+    refresh_loop.await.unwrap();
+}
+
+// The freshness timestamp is written on every attempt and keeps the last
+// good load through failures. Mutation: setting it only on success leaves
+// the series absent after a failed first attempt.
+#[tokio::test]
+async fn freshness_gauge_is_written_on_every_attempt() {
+    const GAUGE: &str = "buzz_nip_fi_binding_snapshot_loaded_timestamp_seconds";
+    let gauge = |recorder: &metrics_util::debugging::DebuggingRecorder| {
+        recorder
+            .snapshotter()
+            .snapshot()
+            .into_vec()
+            .into_iter()
+            .find(|(key, ..)| key.key().name() == GAUGE)
+            .map(|(.., value)| match value {
+                metrics_util::debugging::DebugValue::Gauge(v) => v.into_inner(),
+                _ => unreachable!(),
+            })
+    };
+    let f = fixture(&["a"]);
+    let recorder = metrics_util::debugging::DebuggingRecorder::new();
+    let _guard = metrics::set_default_local_recorder(&recorder);
+    f.store.fail_loads.store(true, Ordering::SeqCst);
+    assert!(f.resolver.refresh().await.is_err());
+    assert_eq!(
+        gauge(&recorder),
+        Some(0.0),
+        "written by a failed first attempt"
+    );
+    f.store.fail_loads.store(false, Ordering::SeqCst);
+    f.resolver.refresh().await.unwrap();
+    let loaded = gauge(&recorder).unwrap();
+    assert!(loaded > 0.0);
+    f.store.fail_loads.store(true, Ordering::SeqCst);
+    assert!(f.resolver.refresh().await.is_err());
+    assert_eq!(gauge(&recorder), Some(loaded), "kept through a failure");
+}
+
+// ── Creation and the negative cache ────────────────────────────────────────
+
+// A creation on this pod drops the host's cached "not found" (whatever case
+// the host arrives in), so the creator's first login looks it up. Mutation:
+// not popping the entry denies until the 5s TTL lapses.
+#[tokio::test]
+async fn record_creation_clears_the_hosts_cached_not_found() {
+    let f = fixture(&["a"]);
+    f.resolver.refresh().await.unwrap();
+    assert_eq!(f.resolve("h").await, UNAVAILABLE);
+    f.store.add("h");
+    assert_eq!(f.resolve("h").await, UNAVAILABLE, "cached not-found");
+    assert_eq!(f.store.lookups_for("h"), 1);
+    f.resolver.record_creation(&host("H"));
+    assert_eq!(f.resolver.negative_len(), 0);
+    assert_eq!(f.resolve("h").await, Ok(()));
+    assert_eq!(f.store.lookups_for("h"), 2);
+}
+
+// Only a creation or a publication moves the sequence: two unknown hosts
+// looked up at once are both cached. Mutation: bumping on a negative store
+// leaves the second one uncached.
+#[tokio::test]
+async fn concurrent_not_found_lookups_are_all_cached() {
+    let f = fixture(&["a"]);
+    f.resolver.refresh().await.unwrap();
+    let gate = f.resolver.hooks.arm(MISS_AFTER_READ);
+    let pending: Vec<_> = ["x", "y"]
+        .into_iter()
+        .map(|label| {
+            let resolver = Arc::clone(&f.resolver);
+            tokio::spawn(async move { resolver.resolve(&host(label)).await.map(drop) })
+        })
+        .collect();
+    gate.reached().await;
+    gate.reached().await;
+    gate.release();
+    gate.release();
+    for task in pending {
+        assert_eq!(task.await.unwrap(), UNAVAILABLE);
+    }
+    assert_eq!(f.resolver.negative_len(), 2);
+}
+
+#[tokio::test]
+async fn negative_lookup_racing_a_creation_or_swap_stores_nothing() {
+    // (d), and criterion 7(f).
+    for swap in [false, true] {
+        let f = fixture(&["a"]);
+        f.resolver.refresh().await.unwrap();
+        let gate = f.resolver.hooks.arm(MISS_AFTER_READ);
+        let pending = tokio::spawn({
+            let resolver = Arc::clone(&f.resolver);
+            async move { resolver.resolve(&host("h")).await.map(|_| ()) }
+        });
+        gate.reached().await;
+        f.resolver.hooks.disarm(MISS_AFTER_READ);
+        f.store.add("h");
+        if swap {
+            f.resolver.refresh().await.unwrap();
+        } else {
+            f.resolver.record_creation(&host("h"));
+        }
+        gate.release();
+        assert_eq!(pending.await.unwrap(), UNAVAILABLE, "answered as read");
+        assert_eq!(f.resolver.negative_len(), 0, "swap={swap}");
+        assert_eq!(f.resolve("h").await, Ok(()), "swap={swap}");
+    }
+}
+
+// The provisioning handler drops the cached "not found" only for a creation
+// that bound issuers. Mutation: skipping the resolver call in the handler, or
+// calling it for an unbound creation, fails one of the two halves.
+#[tokio::test]
+async fn provisioning_a_bound_community_clears_its_cached_not_found() {
+    use crate::handlers::community_provisioning::record_binding_creation;
+    let f = fixture(&["a"]);
+    f.resolver.refresh().await.unwrap();
+    assert_eq!(f.resolve("h").await, UNAVAILABLE);
+    f.store.add("h");
+    record_binding_creation(Some(&f.resolver), &host("h"), &[]);
+    assert_eq!(
+        f.resolve("h").await,
+        UNAVAILABLE,
+        "unbound creation keeps it"
+    );
+    record_binding_creation(Some(&f.resolver), &host("h"), &[ISS.to_owned()]);
+    assert_eq!(f.resolve("h").await, Ok(()));
+    assert_eq!(f.store.lookups_for("h"), 2);
+}
+
+// One lookup admits at most `max_waiters` admissions; the next is rejected
+// rather than queued. Mutation: ignoring the cap lets the third wait.
+#[tokio::test(start_paused = true)]
+async fn waiters_beyond_the_cap_are_rejected() {
+    let f = fixture_with(
+        &["a"],
+        ResolverBounds {
+            max_waiters: 2,
+            ..ResolverBounds::default()
+        },
+    );
+    *f.store.lookup_delay.lock().unwrap() = secs(0.5);
+    let waiters: Vec<_> = (0..2)
+        .map(|_| {
+            let resolver = Arc::clone(&f.resolver);
+            tokio::spawn(async move { resolver.resolve(&host("a")).await.map(drop) })
+        })
+        .collect();
+    tokio::time::sleep(secs(0.1)).await;
+    assert_eq!(f.resolver.waiters_now(), 2);
+    assert_eq!(f.resolve("a").await, UNAVAILABLE);
+    for w in waiters {
+        assert_eq!(w.await.unwrap(), Ok(()));
+    }
+    assert_eq!(f.store.lookups_for("a"), 1);
+}
+
+// ── Criterion 9: miss-path bounds under a flood ─────────────────────────────
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn flood_of_unknown_hosts_respects_every_cap_and_spares_snapshot_hosts() {
+    let bounds = ResolverBounds {
+        max_inflight: 4,
+        max_pending_hosts: 8,
+        max_waiters: 16,
+        negative_cache_max: 32,
+        permit_wait: Duration::from_millis(5),
+        lookup_timeout: Duration::from_millis(500),
+        ..ResolverBounds::default()
+    };
+    let f = fixture_with(&["a", "b"], bounds.clone());
+    f.resolver.refresh().await.unwrap();
+    *f.store.lookup_delay.lock().unwrap() = Duration::from_millis(20);
+
+    let peak = Arc::new(Mutex::new((0usize, 0usize, 0usize, 0usize)));
+    let stop = Arc::new(std::sync::atomic::AtomicBool::new(false));
+    let monitor = tokio::spawn({
+        let (resolver, peak, stop) = (
+            Arc::clone(&f.resolver),
+            Arc::clone(&peak),
+            Arc::clone(&stop),
+        );
+        async move {
+            while !stop.load(Ordering::SeqCst) {
+                {
+                    let mut p = peak.lock().unwrap();
+                    p.0 = p.0.max(resolver.inflight_now());
+                    p.1 = p.1.max(resolver.pending_len());
+                    p.2 = p.2.max(resolver.waiters_now());
+                    p.3 = p.3.max(resolver.negative_len());
+                }
+                tokio::task::yield_now().await;
+            }
+        }
+    });
+    let flood: Vec<_> = (0..400)
+        .map(|i| {
+            let resolver = Arc::clone(&f.resolver);
+            tokio::spawn(async move { resolver.resolve(&host(&format!("rand{i}"))).await.is_err() })
+        })
+        .collect();
+    for _ in 0..50 {
+        assert_eq!(f.resolve("a").await, Ok(()));
+        assert_eq!(f.resolve("b").await, Ok(()));
+    }
+    for task in flood {
+        assert!(task.await.unwrap(), "every made-up host is denied");
+    }
+    stop.store(true, Ordering::SeqCst);
+    monitor.await.unwrap();
+    let p = *peak.lock().unwrap();
+    assert!(p.0 <= bounds.max_inflight, "inflight {}", p.0);
+    assert!(p.1 <= bounds.max_pending_hosts, "pending {}", p.1);
+    assert!(p.2 <= bounds.max_waiters, "waiters {}", p.2);
+    assert!(p.3 <= bounds.negative_cache_max, "negative {}", p.3);
+    assert_eq!(f.store.lookups_for("a") + f.store.lookups_for("b"), 0);
+}
+
+// ── Criterion 17: map lifetime ──────────────────────────────────────────────
+
+#[tokio::test]
+async fn old_snapshot_maps_are_dropped_while_admissions_keep_their_bindings() {
+    let f = fixture(&["a"]);
+    f.resolver.refresh().await.unwrap();
+    let mut held = Vec::new();
+    let mut weak_maps = Vec::new();
+    for _ in 0..10 {
+        held.push(f.resolver.resolve(&host("a")).await.unwrap());
+        weak_maps.push(Arc::downgrade(
+            f.resolver.published.load_full().as_ref().unwrap(),
+        ));
+        f.resolver.refresh().await.unwrap();
+    }
+    // Replaced maps are freed on a blocking thread; wait for it (bounded).
+    let waited = std::time::Instant::now();
+    while weak_maps.iter().any(|w| w.strong_count() > 0) {
+        assert!(
+            waited.elapsed() < Duration::from_secs(30),
+            "only the published map is alive"
+        );
+        tokio::task::yield_now().await;
+    }
+    assert!(held
+        .iter()
+        .all(|b| b.0.expected_aud() == "https://a.communities.buzz.xyz"));
+}
+
+// ── Pre-filter ──────────────────────────────────────────────────────────────
+
+#[tokio::test]
+async fn non_suffix_reserved_and_multi_label_hosts_never_reach_the_store() {
+    let f = fixture(&["a"]);
+    f.resolver.refresh().await.unwrap();
+    for raw in [
+        "communities.buzz.xyz",
+        "a.b.communities.buzz.xyz",
+        "evil.example",
+        "a.communities.buzz.xyz:8443",
+    ] {
+        assert!(f.resolver.resolve(raw).await.is_err(), "{raw}");
+    }
+    assert_eq!(f.store.total_lookups(), 0);
+}
+
+/// Unset or blank variables take the defaults, a set value overrides only
+/// its own bound, out-of-range or non-numeric values fail startup, and
+/// `max_inflight` stays below the writer pool. Mutation: dropping the clamp
+/// lets pool 4 run 8 lookups at once.
+#[test]
+fn resolver_bounds_from_env_defaults_overrides_clamps_and_rejects() {
+    const VARS: [&str; 4] = [
+        "BUZZ_NIP_FI_RESOLVER_NEGATIVE_CACHE_MAX",
+        "BUZZ_NIP_FI_RESOLVER_MAX_INFLIGHT",
+        "BUZZ_NIP_FI_SNAPSHOT_MAX_ROWS",
+        "BUZZ_NIP_FI_SNAPSHOT_REFRESH_TIMEOUT_MS",
+    ];
+    struct Clear;
+    impl Drop for Clear {
+        fn drop(&mut self) {
+            for v in VARS {
+                std::env::remove_var(v);
+            }
+        }
+    }
+    let _lock = crate::nip_fi_config::NIP_FI_ENV_LOCK
+        .lock()
+        .unwrap_or_else(std::sync::PoisonError::into_inner);
+    let _clear = Clear;
+    for v in VARS {
+        std::env::remove_var(v);
+    }
+
+    assert_eq!(
+        ResolverBounds::from_env(50).unwrap(),
+        ResolverBounds::default()
+    );
+    assert_eq!(ResolverBounds::from_env(4).unwrap().max_inflight, 3);
+    assert_eq!(ResolverBounds::from_env(1).unwrap().max_inflight, 1);
+
+    std::env::set_var("BUZZ_NIP_FI_SNAPSHOT_MAX_ROWS", "250");
+    std::env::set_var("BUZZ_NIP_FI_SNAPSHOT_REFRESH_TIMEOUT_MS", "29999");
+    std::env::set_var("BUZZ_NIP_FI_RESOLVER_MAX_INFLIGHT", " ");
+    let bounds = ResolverBounds::from_env(50).unwrap();
+    assert_eq!(bounds.snapshot_max_rows, 250);
+    assert_eq!(bounds.refresh_timeout, Duration::from_millis(29_999));
+    assert_eq!(bounds.max_inflight, ResolverBounds::default().max_inflight);
+    std::env::set_var("BUZZ_NIP_FI_RESOLVER_MAX_INFLIGHT", "40");
+    assert_eq!(ResolverBounds::from_env(50).unwrap().max_inflight, 40);
+    assert_eq!(ResolverBounds::from_env(10).unwrap().max_inflight, 9);
+
+    for (var, bad) in [
+        ("BUZZ_NIP_FI_SNAPSHOT_REFRESH_TIMEOUT_MS", "30000"),
+        ("BUZZ_NIP_FI_RESOLVER_MAX_INFLIGHT", "0"),
+        ("BUZZ_NIP_FI_SNAPSHOT_MAX_ROWS", "lots"),
+        ("BUZZ_NIP_FI_SNAPSHOT_MAX_ROWS", "10000001"),
+        ("BUZZ_NIP_FI_RESOLVER_NEGATIVE_CACHE_MAX", "1000001"),
+    ] {
+        let prior = std::env::var(var).ok();
+        std::env::set_var(var, bad);
+        assert!(
+            ResolverBounds::from_env(50).is_err(),
+            "{var}={bad} must fail startup"
+        );
+        match prior {
+            Some(p) => std::env::set_var(var, p),
+            None => std::env::remove_var(var),
+        }
+    }
+}
+
+mod router_tests;
+
+// A database-source community is labelled `bound` in shadow, never by its
+// host, whose set is unbounded. Mutation: labelling every resolved community
+// by its URI, as the `env` source is, names the host.
+#[tokio::test]
+async fn database_source_shadow_label_never_names_the_host() {
+    let f = fixture(&["a"]);
+    let mut headers = axum::http::HeaderMap::new();
+    headers.insert(axum::http::header::HOST, host("a").parse().unwrap());
+    let community = crate::nip_fi_core::Communities::Database(&f.resolver)
+        .resolve(&headers)
+        .await
+        .expect("bound");
+    assert_eq!(
+        community.shadow_label(),
+        metrics::SharedString::from("bound")
+    );
+}
+
+// Every step of one request reuses the router guard's resolution, a failed
+// one included, so shadow resolves the Host once. Mutation: reusing only a
+// successful resolution sends the denied host back to the live lookup.
+#[tokio::test]
+async fn admission_reuses_the_guards_resolution_without_a_lookup() {
+    let f = fixture(&["a"]);
+    let mut headers = axum::http::HeaderMap::new();
+    headers.insert(axum::http::header::HOST, host("a").parse().unwrap());
+    let communities = crate::nip_fi_core::Communities::Database(&f.resolver);
+    let denied = Err(DenialClass::AuthorizationUnavailable);
+    let reused = crate::nip_fi_http::with_resolved_community(denied, async {
+        crate::nip_fi_http::resolve_for_admission(communities, &headers).await
+    })
+    .await;
+    assert_eq!(reused.map(|_| ()), UNAVAILABLE);
+    assert_eq!(f.store.lookups_for("a"), 0);
+}
diff --git a/crates/buzz-relay/src/nip_fi_resolver/tests/router_tests.rs b/crates/buzz-relay/src/nip_fi_resolver/tests/router_tests.rs
new file mode 100644
index 0000000000..ab00467cf4
--- /dev/null
+++ b/crates/buzz-relay/src/nip_fi_resolver/tests/router_tests.rs
@@ -0,0 +1,817 @@
+//! Database-resolver admission through the real router (plan criteria 1, 2,
+//! 3, 4, 5, 6f, 7e, 8). Root and audio upgrades and the protected-HTTP guard all
+//! run against a resolver over an in-memory store that counts lookups; the
+//! assertion verifier is the production one with a seeded key snapshot.
+//! The relay database is unreachable, so a request that clears NIP-FI ends
+//! at the next step: the upgrades' tenant lookup or the route's extractor.
+
+use std::collections::HashMap;
+
+use axum::body::Body;
+use axum::http::{Request, StatusCode};
+use buzz_auth::{
+    FederatedAssertionVerifier, FreshnessClass, HttpJwksFetcher, IssuerJwksConfig, IssuerPolicy,
+    IssuerRegistry, JwksSourceContract, NipFiMode, ProductionJwksSource, TokenClass,
+};
+use tower::ServiceExt;
+
+use super::*;
+use crate::state::AppState;
+
+/// A second registered issuer. Never seeded with keys, so any verification
+/// that reaches its key source is `authorization unavailable`.
+const ISS_B: &str = "https://issuer-b.example";
+const KID: &str = "resolver-router-test-key";
+// Same public ES256 fixture as the router and command tests.
+const PRIVATE_KEY_PEM: &str =
+    "-----BEGIN PRIVATE KEY-----\nMIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgcnxDM4EiirH9dHUE\nWZc759TX4s5PAn8kO5ovXSnGxCWhRANCAARFb6ZnsfkqOOXyEhj3KBQphGKF4vTa\nzhebbavbZ1ZoklqkF1cGg+jTO7rONAVEzXvXUWtV6CdDV+rybiVmFP2w\n-----END PRIVATE KEY-----\n"; // sadscan:disable np.pem.1 kingfisher.privkey.2 -- public ES256 test fixture
+
+const UNAVAILABLE_BODY: &[u8] = b"authorization unavailable\n";
+const REJECTED_BODY: &[u8] = b"evidence rejected\n";
+
+/// Host → bound issuers, counting every per-host lookup.
+#[derive(Default)]
+struct Bindings {
+    rows: Mutex<HashMap<String, Vec<String>>>,
+    lookups: Mutex<Vec<String>>,
+    lookup_fails: std::sync::atomic::AtomicBool,
+}
+
+impl Bindings {
+    fn bind(&self, label: &str, issuers: &[&str]) {
+        let issuers = issuers.iter().map(|i| (*i).to_owned()).collect();
+        self.rows.lock().unwrap().insert(host(label), issuers);
+    }
+    fn unbind(&self, label: &str) {
+        self.rows.lock().unwrap().remove(&host(label));
+    }
+    fn lookups_for(&self, raw_host: &str) -> usize {
+        let lookups = self.lookups.lock().unwrap();
+        lookups.iter().filter(|h| *h == raw_host).count()
+    }
+}
+
+impl BindingSource for Bindings {
+    fn load<'a>(
+        &'a self,
+        _registry: &'a [String],
+        _max_rows: usize,
+    ) -> BoxFuture<'a, Result<Result<Vec<(String, String)>, RowCapExceeded>, String>> {
+        async move {
+            let rows =
+                self.rows
+                    .lock()
+                    .unwrap()
+                    .iter()
+                    .fold(Vec::new(), |mut acc, (h, issuers)| {
+                        acc.extend(issuers.iter().map(|i| (h.clone(), i.clone())));
+                        acc
+                    });
+            Ok(Ok(rows))
+        }
+        .boxed()
+    }
+
+    fn lookup<'a>(
+        &'a self,
+        host: &'a str,
+        _registry: &'a [String],
+    ) -> BoxFuture<'a, Result<Vec<String>, String>> {
+        async move {
+            self.lookups.lock().unwrap().push(host.to_owned());
+            if self.lookup_fails.load(Ordering::SeqCst) {
+                return Err("pool closed".into());
+            }
+            Ok(self
+                .rows
+                .lock()
+                .unwrap()
+                .get(host)
+                .cloned()
+                .unwrap_or_default())
+        }
+        .boxed()
+    }
+}
+
+fn jwks_contract(issuer: &str) -> JwksSourceContract {
+    JwksSourceContract::new(format!("{issuer}/.well-known/jwks.json"), 300, 86_400)
+        .expect("valid JWKS contract")
+}
+
+fn issuer_policy(issuer: &str) -> IssuerPolicy {
+    IssuerPolicy::new(
+        issuer.to_owned(),
+        vec!["https://communities.buzz.xyz".to_owned()],
+        TokenClass::DedicatedNipFi,
+        FreshnessClass::OfflineJwt,
+        vec![jsonwebtoken::Algorithm::ES256],
+        30,
+        3600,
+        None,
+        jwks_contract(issuer),
+    )
+    .expect("valid issuer policy")
+}
+
+/// A valid assertion from `iss` for `https://<raw_host>`, signed by the
+/// fixture key.
+fn mint(iss: &str, raw_host: &str) -> String {
+    mint_for(iss, raw_host, &nostr::Keys::generate().public_key())
+}
+
+/// [`mint`] asserting `key`.
+fn mint_for(iss: &str, raw_host: &str, key: &nostr::PublicKey) -> String {
+    use jsonwebtoken::{encode, Algorithm, EncodingKey, Header};
+    let now = chrono::Utc::now().timestamp();
+    let claims = serde_json::json!({
+        "iss": iss,
+        "aud": format!("https://{raw_host}"),
+        "sub": "resolver-router-test",
+        "iat": now,
+        "exp": now + 600,
+        "nostr_pubkey": key.to_hex(),
+    });
+    let mut header = Header::new(Algorithm::ES256);
+    header.typ = Some("nip-fi+jwt".to_owned());
+    header.kid = Some(KID.to_owned());
+    let key = EncodingKey::from_ec_pem(PRIVATE_KEY_PEM.as_bytes()).expect("test EC key");
+    encode(&header, &claims, &key).expect("sign assertion")
+}
+
+/// One relay pod: router state with the database resolver installed.
+struct Pod {
+    resolver: Arc<DatabaseResolver>,
+    state: Arc<AppState>,
+}
+
+async fn pod(store: &Arc<Bindings>, clock: &Arc<ManualClock>, mode: NipFiMode) -> Pod {
+    let base =
+        crate::state::tests::test_state_with_database_url("postgres://127.0.0.1:1/none").await;
+    pod_on(base, store, clock, mode).await
+}
+
+/// [`pod`] over a caller-built base state (its tenant store).
+async fn pod_on(
+    base: Arc<AppState>,
+    store: &Arc<Bindings>,
+    clock: &Arc<ManualClock>,
+    mode: NipFiMode,
+) -> Pod {
+    let resolver = Arc::new(DatabaseResolver::with_clock(
+        Arc::clone(store) as Arc<dyn BindingSource>,
+        policy(),
+        vec![ISS.to_owned(), ISS_B.to_owned()],
+        ResolverBounds::default(),
+        Arc::clone(clock) as Arc<dyn Clock>,
+    ));
+    resolver.refresh().await.expect("startup load");
+
+    let mut state = (*base).clone();
+    let config = Arc::make_mut(&mut state.config);
+    config.nip_fi.mode = mode;
+    config.nip_fi.source = crate::nip_fi_config::CommunitySource::Database;
+    config.nip_fi.registry = {
+        let mut registry = IssuerRegistry::new();
+        registry.insert(issuer_policy(ISS));
+        registry.insert(issuer_policy(ISS_B));
+        registry
+    };
+    let key_source = Arc::new(
+        ProductionJwksSource::new(
+            [ISS, ISS_B]
+                .map(|issuer| IssuerJwksConfig {
+                    issuer: issuer.to_owned(),
+                    contract: jwks_contract(issuer),
+                })
+                .into(),
+            HttpJwksFetcher::new(),
+        )
+        .expect("key source"),
+    );
+    let jwk: jsonwebtoken::jwk::Jwk = serde_json::from_value(serde_json::json!({
+        "kty": "EC", "crv": "P-256", "alg": "ES256", "use": "sig", "kid": KID,
+        "x": "RW-mZ7H5Kjjl8hIY9ygUKYRiheL02s4Xm22r22dWaJI",
+        "y": "WqQXVwaD6NM7us40BUTNe9dRa1XoJ0NX6vJuJWYU_bA",
+    }))
+    .expect("test JWK");
+    key_source
+        .seed_snapshot_for_test(ISS, jsonwebtoken::jwk::JwkSet { keys: vec![jwk] })
+        .await;
+    state.nip_fi_verifier = Some(Arc::new(FederatedAssertionVerifier::new(
+        state.config.nip_fi.registry.clone(),
+        Arc::clone(&key_source),
+    )));
+    state.nip_fi_jwks_source = Some(key_source);
+    state.nip_fi_resolver = Some(Arc::clone(&resolver));
+    Pod {
+        resolver,
+        state: Arc::new(state),
+    }
+}
+
+/// The three NIP-FI admission sites: root upgrade, audio upgrade, protected
+/// HTTP (the router guard).
+fn sites() -> [String; 3] {
+    [
+        "/".to_owned(),
+        format!("/huddle/{}/audio", uuid::Uuid::new_v4()),
+        "/workflows/wf/runs".to_owned(),
+    ]
+}
+
+impl Pod {
+    async fn send(&self, path: &str, raw_host: &str, token: Option<&str>) -> (StatusCode, Vec<u8>) {
+        self.send_signed(path, raw_host, token, None).await
+    }
+
+    /// [`Pod::send`] with an optional `Authorization` (NIP-98) header.
+    async fn send_signed(
+        &self,
+        path: &str,
+        raw_host: &str,
+        token: Option<&str>,
+        authorization: Option<String>,
+    ) -> (StatusCode, Vec<u8>) {
+        let mut builder = Request::get(path)
+            .header(axum::http::header::HOST, raw_host)
+            .header("Upgrade", "websocket")
+            .header("Connection", "Upgrade")
+            .header("Sec-WebSocket-Version", "13")
+            .header("Sec-WebSocket-Key", "dGhlIHNhbXBsZSBub25jZQ==");
+        if let Some(token) = token {
+            builder = builder.header("Nostr-Federated-Identity", format!("Bearer {token}"));
+        }
+        if let Some(authorization) = authorization {
+            builder = builder.header(axum::http::header::AUTHORIZATION, authorization);
+        }
+        let response = crate::router::build_router(Arc::clone(&self.state))
+            .oneshot(builder.body(Body::empty()).expect("request"))
+            .await
+            .expect("router response");
+        let status = response.status();
+        let body = axum::body::to_bytes(response.into_body(), 64 * 1024)
+            .await
+            .expect("body");
+        (status, body.to_vec())
+    }
+
+    /// Every site's outcome for a token from `iss` presented at `label`.
+    async fn every_site(&self, iss: &str, label: &str) -> Vec<(StatusCode, Vec<u8>)> {
+        let token = mint(iss, &host(label));
+        let mut outcomes = Vec::new();
+        for path in sites() {
+            outcomes.push(self.send(&path, &host(label), Some(&token)).await);
+        }
+        outcomes
+    }
+}
+
+fn unavailable() -> (StatusCode, Vec<u8>) {
+    (StatusCode::SERVICE_UNAVAILABLE, UNAVAILABLE_BODY.to_vec())
+}
+
+fn rejected() -> (StatusCode, Vec<u8>) {
+    (StatusCode::FORBIDDEN, REJECTED_BODY.to_vec())
+}
+
+/// The request cleared NIP-FI admission and was answered by the next step:
+/// the upgrades' tenant lookup (no reachable database) or the protected
+/// route's path extractor (`wf` is not a UUID).
+fn cleared_nip_fi(outcomes: &[(StatusCode, Vec<u8>)]) -> bool {
+    outcomes.iter().all(|(status, body)| match *status {
+        StatusCode::NOT_FOUND => body == b"relay: no community is configured for this host",
+        StatusCode::BAD_REQUEST => body.starts_with(b"Invalid URL: Cannot parse `workflow_id`"),
+        _ => false,
+    })
+}
+
+fn setup() -> (Arc<Bindings>, Arc<ManualClock>) {
+    (
+        Arc::new(Bindings::default()),
+        Arc::new(ManualClock::default()),
+    )
+}
+
+// ── Criterion 1: one resolution per admission, no suffix fallback ───────────
+
+#[tokio::test]
+async fn each_admission_resolves_its_host_exactly_once() {
+    let (store, clock) = setup();
+    let p = pod(&store, &clock, NipFiMode::Enforce).await;
+    // Bound after the startup load: every admission takes the miss lookup,
+    // and a found binding is never cached, so lookups count resolutions.
+    store.bind("fresh", &[ISS]);
+    let token = mint(ISS, &host("fresh"));
+    for (n, path) in sites().iter().enumerate() {
+        let outcome = p.send(path, &host("fresh"), Some(&token)).await;
+        assert!(
+            cleared_nip_fi(std::slice::from_ref(&outcome)),
+            "{path}: {outcome:?}"
+        );
+        assert_eq!(store.lookups_for(&host("fresh")), n + 1, "{path}");
+    }
+}
+
+#[tokio::test]
+async fn one_label_suffix_host_with_no_rows_is_unavailable_at_every_site() {
+    let (store, clock) = setup();
+    let p = pod(&store, &clock, NipFiMode::Enforce).await;
+    assert_eq!(p.every_site(ISS, "nobody").await, vec![unavailable(); 3]);
+}
+
+// ── Criterion 2: an issuer the community does not list never reaches keys ───
+
+#[tokio::test]
+async fn unlisted_issuer_is_rejected_before_its_key_source() {
+    let (store, clock) = setup();
+    store.bind("only-a", &[ISS]);
+    store.bind("lists-b", &[ISS_B]);
+    let p = pod(&store, &clock, NipFiMode::Enforce).await;
+    // Issuer B has no key snapshot. Where B is listed, verification reaches
+    // that key source and is unavailable; where it is not, the allowlist
+    // rejects the same kind of token first, so the missing keys never show.
+    assert_eq!(p.every_site(ISS_B, "lists-b").await, vec![unavailable(); 3]);
+    assert_eq!(p.every_site(ISS_B, "only-a").await, vec![rejected(); 3]);
+    assert!(cleared_nip_fi(&p.every_site(ISS, "only-a").await));
+}
+
+// ── Criterion 3: removing the community's issuer revokes its tokens ─────────
+
+#[tokio::test]
+async fn removing_the_issuer_denies_a_previously_valid_token() {
+    let (store, clock) = setup();
+    store.bind("shared", &[ISS, ISS_B]);
+    let p = pod(&store, &clock, NipFiMode::Enforce).await;
+    assert!(cleared_nip_fi(&p.every_site(ISS, "shared").await));
+
+    store.bind("shared", &[ISS_B]);
+    p.resolver.refresh().await.expect("refresh");
+    assert_eq!(p.every_site(ISS, "shared").await, vec![rejected(); 3]);
+}
+
+// ── Criterion 4: full admission per request; failed miss stores nothing ─────
+
+#[tokio::test]
+async fn second_request_after_unbind_and_refresh_is_denied() {
+    let (store, clock) = setup();
+    store.bind("gone", &[ISS]);
+    let p = pod(&store, &clock, NipFiMode::Enforce).await;
+    let token = mint(ISS, &host("gone"));
+    let path = "/workflows/wf/runs";
+    assert!(cleared_nip_fi(&[p
+        .send(path, &host("gone"), Some(&token))
+        .await]));
+
+    store.unbind("gone");
+    p.resolver.refresh().await.expect("refresh");
+    assert_eq!(
+        p.send(path, &host("gone"), Some(&token)).await,
+        unavailable()
+    );
+}
+
+#[tokio::test]
+async fn closed_pool_miss_is_unavailable_everywhere_and_caches_nothing() {
+    let (store, clock) = setup();
+    let p = pod(&store, &clock, NipFiMode::Enforce).await;
+    store.bind("late", &[ISS]);
+    store.lookup_fails.store(true, Ordering::SeqCst);
+    assert_eq!(p.every_site(ISS, "late").await, vec![unavailable(); 3]);
+    assert_eq!(store.lookups_for(&host("late")), 3, "no negative entry");
+    assert!(!p.resolver.negatively_cached(&host("late")));
+
+    store.lookup_fails.store(false, Ordering::SeqCst);
+    assert!(cleared_nip_fi(&p.every_site(ISS, "late").await));
+}
+
+// ── Criterion 6(f): the reserved command-audience host never admits ─────────
+
+#[tokio::test]
+async fn reserved_apex_is_unavailable_without_a_lookup() {
+    let (store, clock) = setup();
+    store
+        .rows
+        .lock()
+        .unwrap()
+        .insert("communities.buzz.xyz".to_owned(), vec![ISS.to_owned()]);
+    let p = pod(&store, &clock, NipFiMode::Enforce).await;
+    let token = mint(ISS, "communities.buzz.xyz");
+    for path in sites() {
+        let outcome = p.send(&path, "communities.buzz.xyz", Some(&token)).await;
+        assert_eq!(outcome, unavailable(), "{path}");
+    }
+    assert_eq!(store.lookups_for("communities.buzz.xyz"), 0);
+}
+
+// ── Criterion 7(e): negative cache per pod; creating pod admits at once ─────
+
+#[tokio::test]
+async fn creation_admits_on_its_pod_now_and_elsewhere_after_negative_ttl() {
+    let (store, clock) = setup();
+    let p1 = pod(&store, &clock, NipFiMode::Enforce).await;
+    let p2 = pod(&store, &clock, NipFiMode::Enforce).await;
+    let path = "/workflows/wf/runs";
+    let token = mint(ISS, &host("newco"));
+    let h = host("newco");
+    for p in [&p1, &p2] {
+        assert_eq!(p.send(path, &h, Some(&token)).await, unavailable());
+    }
+    assert_eq!(store.lookups_for(&h), 2);
+
+    // Created through P1, after both published their snapshots.
+    store.bind("newco", &[ISS]);
+    p1.resolver.record_creation(&h);
+    assert!(cleared_nip_fi(&[p1.send(path, &h, Some(&token)).await]));
+    assert_eq!(p2.send(path, &h, Some(&token)).await, unavailable());
+    assert_eq!(store.lookups_for(&h), 3, "P1 looks up, P2 from cache");
+
+    clock.set(secs(5.1));
+    assert!(cleared_nip_fi(&[p2.send(path, &h, Some(&token)).await]));
+    assert_eq!(store.lookups_for(&h), 4);
+}
+
+// ── Criterion 8: mode off never resolves or gates ───────────────────────────
+
+#[tokio::test]
+async fn off_mode_with_database_source_neither_gates_nor_resolves() {
+    let (store, clock) = setup();
+    store.bind("quiet", &[ISS]);
+    let p = pod(&store, &clock, NipFiMode::Off).await;
+    for path in sites() {
+        let outcome = p.send(&path, &host("quiet"), None).await;
+        assert!(
+            cleared_nip_fi(std::slice::from_ref(&outcome)),
+            "{path}: {outcome:?}"
+        );
+    }
+    assert!(store.lookups.lock().unwrap().is_empty());
+}
+
+// Shadow resolves as enforce does: a community bound after the startup load
+// is found by the live lookup, so shadow records no `community` would-deny.
+// Mutation: resolving shadow from memory only takes no lookup and records a
+// `community`-stage denial at every site.
+#[tokio::test]
+async fn shadow_resolves_through_the_database_lookup_like_enforce() {
+    let (store, clock) = setup();
+    let p = pod(&store, &clock, NipFiMode::Shadow).await;
+    store.bind("late", &[ISS]);
+    let token = mint(ISS, &host("late"));
+    let recorder = metrics_util::debugging::DebuggingRecorder::new();
+    {
+        let _guard = metrics::set_default_local_recorder(&recorder);
+        for path in sites() {
+            let outcome = p.send(&path, &host("late"), Some(&token)).await;
+            assert!(
+                cleared_nip_fi(std::slice::from_ref(&outcome)),
+                "{path}: {outcome:?}"
+            );
+        }
+    }
+    assert_eq!(store.lookups_for(&host("late")), sites().len());
+    let community_denials = recorder
+        .snapshotter()
+        .snapshot()
+        .into_vec()
+        .into_iter()
+        .filter(|(key, ..)| {
+            let key = key.key();
+            key.name() == "buzz_nip_fi_shadow_total"
+                && key
+                    .labels()
+                    .any(|l| l.key() == "stage" && l.value() == "community")
+        })
+        .count();
+    assert_eq!(community_denials, 0);
+}
+
+// ── Criterion 5: a disconnect covers communities created after it ──────────
+
+#[tokio::test]
+#[allow(clippy::result_large_err)] // the NIP-98 closure returns the production `Response` error type
+async fn key_disconnected_before_its_community_exists_is_denied_there() {
+    let recorder = metrics_util::debugging::DebuggingRecorder::new();
+    let snapshotter = recorder.snapshotter();
+    let _metrics = metrics::set_default_local_recorder(&recorder);
+
+    let (store, clock) = setup();
+    let p = pod(&store, &clock, NipFiMode::Enforce).await;
+    let mut state = (*p.state).clone();
+    let deny_map = Arc::new(buzz_auth::NipFiDenyMap::new(
+        16,
+        vec![buzz_auth::IssuerCapacity {
+            issuer: ISS.to_owned(),
+            capacity: 16,
+        }],
+    ));
+    state.nip_fi_deny_map = Some(Arc::clone(&deny_map));
+    let p = Pod {
+        resolver: p.resolver,
+        state: Arc::new(state),
+    };
+
+    // Disconnect K while H does not exist anywhere.
+    let (k_keys, control_keys) = (nostr::Keys::generate(), nostr::Keys::generate());
+    let (k, control) = (k_keys.public_key(), control_keys.public_key());
+    let now = chrono::Utc::now();
+    let merged = deny_map.merge_cross_pod_deny(ISS, &k, now + chrono::Duration::hours(1), now);
+    assert!(matches!(merged, buzz_auth::CrossPodMergeResult::Merged));
+    let h = host("after");
+    assert_eq!(
+        p.send("/", &h, Some(&mint_for(ISS, &h, &k))).await,
+        unavailable()
+    );
+
+    // Provision H through this pod.
+    store.bind("after", &[ISS]);
+    p.resolver.record_creation(&h);
+
+    let denied = (StatusCode::FORBIDDEN, b"authorization denied\n".to_vec());
+    assert_eq!(p.send("/", &h, Some(&mint_for(ISS, &h, &k))).await, denied);
+    assert!(cleared_nip_fi(&[p
+        .send("/", &h, Some(&mint_for(ISS, &h, &control)))
+        .await]));
+
+    // Audio resolves H at upgrade and denies after NIP-42, at its deny-set
+    // check, on an assertion verified against H's resolved binding.
+    let audio = format!("/huddle/{}/audio", uuid::Uuid::new_v4());
+    let (binding, _) = p.resolver.resolve(&h).await.expect("H resolves");
+    let verifier = p.state.nip_fi_verifier.as_deref().expect("verifier");
+    for (keys, refused) in [(&k_keys, true), (&control_keys, false)] {
+        let token = mint_for(ISS, &h, &keys.public_key());
+        assert!(cleared_nip_fi(&[p.send(&audio, &h, Some(&token)).await]));
+        let assertion = verifier.verify_assertion(&token, &binding).expect("valid");
+        let outcome = crate::audio::handler::test_support::deny_set_refuses(
+            Arc::clone(&p.state),
+            assertion,
+            keys,
+        )
+        .await;
+        assert_eq!(outcome, refused, "audio deny-set check");
+    }
+
+    let http_admit = |key: nostr::PublicKey| {
+        let state = Arc::clone(&p.state);
+        let h = h.clone();
+        async move {
+            let mut headers = axum::http::HeaderMap::new();
+            headers.insert(axum::http::header::HOST, h.parse().unwrap());
+            headers.insert(
+                "Nostr-Federated-Identity",
+                format!("Bearer {}", mint_for(ISS, &h, &key))
+                    .parse()
+                    .unwrap(),
+            );
+            crate::nip_fi_http::admit_nip_fi_http_on_state(&state, &headers, || {
+                Ok(crate::nip_fi_http::Nip98Proof::new(key, ()))
+            })
+            .await
+            .map(drop)
+        }
+    };
+    let resp = http_admit(k)
+        .await
+        .expect_err("K is denied at HTTP admission");
+    let status = resp.status();
+    let body = axum::body::to_bytes(resp.into_body(), 4096).await.unwrap();
+    assert_eq!((status, body.to_vec()), denied);
+    assert!(http_admit(control).await.is_ok(), "control key is admitted");
+
+    let http_denials: u64 = snapshotter
+        .snapshot()
+        .into_vec()
+        .into_iter()
+        .filter(|(key, ..)| {
+            key.key().name() == "buzz_auth_failures_total"
+                && key
+                    .key()
+                    .labels()
+                    .any(|l| l.value() == "nip_fi_http_denied_pubkey")
+        })
+        .map(|(.., value)| match value {
+            metrics_util::debugging::DebugValue::Counter(n) => n,
+            _ => 0,
+        })
+        .sum();
+    assert_eq!(http_denials, 1);
+}
+
+// ── Reachable handlers over a real tenant store ─────────────────────────────
+
+/// Requests reach their handlers: the tenant store is real PostgreSQL with a
+/// row for each test host, and protected HTTP uses a valid workflow path with
+/// a NIP-98 proof, so the handler itself calls `admit_nip_fi_http_on_state`.
+/// The first tenant-store connection a request takes can move the resolver
+/// clock, which places a deadline crossing inside the tenant-lookup await.
+mod postgres_tests {
+    use super::*;
+
+    /// Pod over a one-connection pool whose next acquire, once armed, moves
+    /// the clock to the armed time.
+    struct TenantPod {
+        pod: Pod,
+        clock: Arc<ManualClock>,
+        advance_on_acquire: Arc<Mutex<Option<Duration>>>,
+        label: String,
+    }
+
+    async fn tenant_pod(
+        store: &Arc<Bindings>,
+        clock: &Arc<ManualClock>,
+        mode: NipFiMode,
+    ) -> TenantPod {
+        let label = format!("t{}", uuid::Uuid::new_v4().simple());
+        let advance_on_acquire = Arc::new(Mutex::new(None::<Duration>));
+        let (hook, hook_clock) = (Arc::clone(&advance_on_acquire), Arc::clone(clock));
+        let pool = sqlx::postgres::PgPoolOptions::new()
+            .max_connections(1)
+            .before_acquire(move |_, _| {
+                if let Some(at) = hook.lock().unwrap().take() {
+                    hook_clock.set(at);
+                }
+                Box::pin(async { Ok(true) })
+            })
+            .connect(&crate::test_support::database_url())
+            .await
+            .expect("PostgreSQL must be available");
+        // Seeding leaves the pool's only connection idle, so every request
+        // acquire reuses it and runs the hook.
+        sqlx::query("INSERT INTO communities (id, host) VALUES ($1, $2)")
+            .bind(uuid::Uuid::new_v4())
+            .bind(host(&label))
+            .execute(&pool)
+            .await
+            .expect("seed community");
+        store.bind(&label, &[ISS]);
+        let base = crate::state::tests::test_state_with_database_pool(pool).await;
+        let pod = pod_on(base, store, clock, mode).await;
+        TenantPod {
+            pod,
+            clock: Arc::clone(clock),
+            advance_on_acquire,
+            label,
+        }
+    }
+
+    fn nip98(keys: &nostr::Keys, url: &str) -> String {
+        use base64::Engine as _;
+        let event = nostr::EventBuilder::new(nostr::Kind::HttpAuth, "")
+            .tags([
+                nostr::Tag::parse(["u", url]).unwrap(),
+                nostr::Tag::parse(["method", "GET"]).unwrap(),
+            ])
+            .sign_with_keys(keys)
+            .unwrap();
+        format!(
+            "Nostr {}",
+            base64::engine::general_purpose::STANDARD.encode(serde_json::to_vec(&event).unwrap())
+        )
+    }
+
+    impl TenantPod {
+        /// Each admission site's outcome for one fresh key: root and audio
+        /// upgrades, then the workflow-runs handler with a matching proof.
+        /// With `crossing = Some((start, at))` every request resolves at
+        /// `start` and its tenant lookup moves the clock to `at`.
+        async fn every_site(
+            &self,
+            crossing: Option<(Duration, Duration)>,
+        ) -> Vec<(StatusCode, Vec<u8>)> {
+            let raw_host = host(&self.label);
+            let keys = nostr::Keys::generate();
+            let token = mint_for(ISS, &raw_host, &keys.public_key());
+            let scheme = if self.pod.state.config.relay_url.starts_with("wss://") {
+                "https"
+            } else {
+                "http"
+            };
+            let workflow = format!("/workflows/{}/runs", uuid::Uuid::new_v4());
+            let requests = [
+                ("/".to_owned(), None),
+                (format!("/huddle/{}/audio", uuid::Uuid::new_v4()), None),
+                (
+                    workflow.clone(),
+                    Some(nip98(&keys, &format!("{scheme}://{raw_host}{workflow}"))),
+                ),
+            ];
+            let mut outcomes = Vec::new();
+            for (path, proof) in requests {
+                if let Some((start, at)) = crossing {
+                    self.clock.set(start);
+                    *self.advance_on_acquire.lock().unwrap() = Some(at);
+                }
+                outcomes.push(
+                    self.pod
+                        .send_signed(&path, &raw_host, Some(&token), proof)
+                        .await,
+                );
+            }
+            outcomes
+        }
+    }
+
+    /// Every site cleared NIP-FI and its handler went on past tenant
+    /// binding: a oneshot request cannot upgrade, so root falls back to its
+    /// NIP-11 document and audio refuses the upgrade, and the workflow handler
+    /// passed admission to its rate limiter, whose Redis is unreachable.
+    fn reached_handlers(outcomes: &[(StatusCode, Vec<u8>)]) -> bool {
+        let body = |o: &(StatusCode, Vec<u8>)| String::from_utf8_lossy(&o.1).into_owned();
+        match outcomes {
+            [root, audio, http] => {
+                root.0 == StatusCode::OK
+                    && body(root).contains("\"federated_identity\"")
+                    && audio.0 == StatusCode::UPGRADE_REQUIRED
+                    && http.0 == StatusCode::SERVICE_UNAVAILABLE
+                    && body(http).contains("shared admission unavailable")
+            }
+            _ => false,
+        }
+    }
+
+    #[tokio::test]
+    #[ignore = "requires Postgres"]
+    async fn every_reachable_handler_resolves_its_host_exactly_once() {
+        let (store, clock) = setup();
+        let p = tenant_pod(&store, &clock, NipFiMode::Enforce).await;
+        // Absent from the published map, so every resolution is a counted miss.
+        let raw_host = host(&p.label);
+        store.unbind(&p.label);
+        p.pod.resolver.refresh().await.expect("refresh");
+        store.bind(&p.label, &[ISS]);
+
+        let outcomes = p.every_site(None).await;
+        assert!(reached_handlers(&outcomes), "{outcomes:?}");
+        assert_eq!(store.lookups_for(&raw_host), 3, "one lookup per admission");
+    }
+
+    #[tokio::test]
+    #[ignore = "requires Postgres"]
+    async fn snapshot_going_stale_during_the_tenant_lookup_admits_nowhere() {
+        let (store, clock) = setup();
+        let p = tenant_pod(&store, &clock, NipFiMode::Enforce).await;
+        let inside = (secs(119.0), secs(119.9));
+        assert!(
+            reached_handlers(&p.every_site(Some(inside)).await),
+            "control"
+        );
+
+        // Startup loaded at 0 s: fresh at resolution, stale at admission.
+        let crossing = (secs(119.9), secs(120.1));
+        assert_eq!(p.every_site(Some(crossing)).await, vec![unavailable(); 3]);
+    }
+
+    /// Each `buzz_nip_fi_shadow_total` series recorded while `run` ran, as
+    /// sorted `route/stage/outcome` labels.
+    async fn shadow_records<F: std::future::Future>(run: F) -> (F::Output, Vec<String>) {
+        let recorder = metrics_util::debugging::DebuggingRecorder::new();
+        let output = {
+            let _guard = metrics::set_default_local_recorder(&recorder);
+            run.await
+        };
+        let mut records: Vec<String> = recorder
+            .snapshotter()
+            .snapshot()
+            .into_vec()
+            .into_iter()
+            .filter(|(key, ..)| key.key().name() == "buzz_nip_fi_shadow_total")
+            .map(|(key, ..)| {
+                let label = |name: &str| {
+                    let label = key.key().labels().find(|l| l.key() == name);
+                    label.map(|l| l.value().to_owned()).unwrap_or_default()
+                };
+                format!("{}/{}/{}", label("route"), label("stage"), label("outcome"))
+            })
+            .collect();
+        records.sort();
+        (output, records)
+    }
+
+    // Shadow re-checks the binding's deadline where enforce does, after the
+    // tenant lookup, and records enforce's refusal without changing any
+    // response. Mutation: dropping the upgrade's observed deadline, or
+    // resolving HTTP afresh instead of reusing the guard's binding, records
+    // no `deadline` would-deny at that site.
+    #[tokio::test]
+    #[ignore = "requires Postgres"]
+    async fn shadow_records_a_snapshot_going_stale_during_the_tenant_lookup() {
+        let (store, clock) = setup();
+        let p = tenant_pod(&store, &clock, NipFiMode::Shadow).await;
+        let inside = (secs(119.0), secs(119.9));
+        let (outcomes, records) = shadow_records(p.every_site(Some(inside))).await;
+        assert!(reached_handlers(&outcomes), "control: {outcomes:?}");
+        assert_eq!(records, ["http/admit/admit"], "control");
+
+        let crossing = (secs(119.9), secs(120.1));
+        let (outcomes, records) = shadow_records(p.every_site(Some(crossing))).await;
+        assert!(reached_handlers(&outcomes), "{outcomes:?}");
+        assert_eq!(
+            records,
+            [
+                "audio/deadline/unavailable",
+                "http/deadline/unavailable",
+                "ws/deadline/unavailable"
+            ]
+        );
+    }
+}
diff --git a/crates/buzz-relay/src/nip_fi_shadow.rs b/crates/buzz-relay/src/nip_fi_shadow.rs
index 5f78fb5d7f..7a924f1161 100644
--- a/crates/buzz-relay/src/nip_fi_shadow.rs
+++ b/crates/buzz-relay/src/nip_fi_shadow.rs
@@ -1,15 +1,18 @@
 //! Shadow-mode recording of what enforce would have decided. The verdict
-//! never reaches admission, a connection, or a response. Labels are bounded:
-//! the community is its configured URI or `unmapped`, never the raw `Host`,
-//! and no token, claim, or issuer is logged. The one key logged is the NIP-98
-//! proof key, in the debug line of the key-pairing step shadow shares with
+//! never reaches admission, a connection, or a response. Shadow resolves the
+//! community exactly as enforce does, database lookup and freshness included,
+//! and once per HTTP request. Labels are bounded and never the raw `Host`: the
+//! community label is the configured URI for the `env` source (a set bounded
+//! by config), `bound` for the `database` source, and `unmapped` when the
+//! community did not resolve. No token, claim, or issuer is logged. The one
+//! key logged is the NIP-98 proof key, in the debug line of the key-pairing step shadow shares with
 //! enforce. [FI-TRACE-PRIVACY-NONPUBLIC]
 //!
 //! # Metrics
 //!
 //! | Series | Labels | One increment per |
 //! |---|---|---|
-//! | `buzz_nip_fi_shadow_total` | `route` (`http`, `ws`, `audio`), `stage`, `outcome`, `community` | NIP-FI decision enforce would make: one per HTTP request that reaches admission, one per WebSocket upgrade enforce would refuse, and one per observed session: at the AUTH where enforce would admit or deny it, or `deadline` when its deadline passes first |
+//! | `buzz_nip_fi_shadow_total` | `route` (`http`, `ws`, `audio`), `stage`, `outcome`, `community` | NIP-FI decision enforce would make: one per HTTP request that reaches admission, one per WebSocket upgrade enforce would refuse, and one per observed session: at the AUTH where enforce would admit or deny it, or `deadline` when its deadline passes first. A request or upgrade whose community binding goes stale before enforce's final re-check also records `deadline` |
 //! | `buzz_nip_fi_shadow_strict_proof_total` | `route` (`bridge`, `blossom`), `outcome` (`pass`, `rejected`), `community` | strict NIP-98 side check on a route whose proof is stricter in enforce (payload tag, Blossom proof); not every request runs one |
 //! | `buzz_nip_fi_shadow_session_end_total` | `route` (`ws`, `audio`), `reason` (`expired`, `revoked`), `community` | admitted shadow session enforce would have ended; a session never admitted records none |
 //! | `buzz_nip_fi_shadow_disconnect_total` | `route` (`admin`, `cross_pod`), `outcome` | disconnect-path event that moves a real disconnect counter in enforce: an accepted admin command, a capacity rejection, a subscriber lag, or a cross-pod capacity or poison failsafe. An admin command refused for its header, body, proof, replay, or a dependency error records nothing |
@@ -24,7 +27,9 @@
 use axum::http::HeaderMap;
 use buzz_auth::DenialClass;
 
-use crate::nip_fi_config::NipFiCommunities;
+use metrics::SharedString;
+
+use crate::nip_fi_http::Resolution;
 
 /// Which enforce step would have denied, and with which class.
 pub(crate) type WouldDeny = (Stage, DenialClass);
@@ -55,18 +60,30 @@ impl Stage {
     }
 }
 
-/// Record one would-be enforce verdict for a request at `route`.
-pub(crate) fn record(
-    route: &'static str,
-    headers: &HeaderMap,
-    communities: &NipFiCommunities,
-    verdict: Result<(), WouldDeny>,
-) {
-    record_for(route, community_label(headers, communities), verdict);
+/// The `community` label of a `database`-source community that resolved.
+pub(crate) const BOUND: &str = "bound";
+/// The `community` label of a verdict whose community did not resolve.
+const UNMAPPED: &str = "unmapped";
+
+/// The `community` label of `community`.
+pub(crate) fn label(community: &Resolution) -> SharedString {
+    community
+        .as_ref()
+        .map_or(SharedString::const_str(UNMAPPED), |c| c.shadow_label())
+}
+
+/// Record one would-be enforce verdict for a request at `route` whose Host
+/// resolved to `community`.
+pub(crate) fn record(route: &'static str, community: &Resolution, verdict: Result<(), WouldDeny>) {
+    record_for(route, label(community), verdict);
 }
 
 /// [`record`] for a caller that resolved its community label earlier.
-pub(crate) fn record_for(route: &'static str, community: String, verdict: Result<(), WouldDeny>) {
+pub(crate) fn record_for(
+    route: &'static str,
+    community: SharedString,
+    verdict: Result<(), WouldDeny>,
+) {
     let (stage, outcome) = match verdict {
         Ok(()) => ("admit", "admit"),
         Err((stage, class)) => (stage.label(), class_label(class)),
@@ -74,11 +91,10 @@ pub(crate) fn record_for(route: &'static str, community: String, verdict: Result
     emit(route, community, stage, outcome);
 }
 
-/// The bounded community label for `headers`: its configured URI or `unmapped`.
-pub(crate) fn community_label(headers: &HeaderMap, communities: &NipFiCommunities) -> String {
-    crate::nip_fi_core::resolve_community(headers, communities)
-        .map_or("unmapped", |binding| binding.expected_aud())
-        .to_owned()
+/// The request's community, from the router guard's resolution when there is
+/// one.
+async fn resolution(state: &crate::state::AppState, headers: &HeaderMap) -> Resolution {
+    crate::nip_fi_http::resolve_for_admission(state.nip_fi_communities(), headers).await
 }
 
 tokio::task_local! {
@@ -90,14 +106,13 @@ tokio::task_local! {
 /// verdict.  Enforce never lets a guard-denied request reach a handler, so
 /// none of that request's handler-side records are emitted.
 pub(crate) async fn observe_guard<F: std::future::Future>(
-    state: &crate::state::AppState,
-    headers: &HeaderMap,
+    community: SharedString,
     verdict: Result<(), WouldDeny>,
     run: F,
 ) -> F::Output {
     let denied = verdict.is_err();
     if denied {
-        record("http", headers, &state.config.nip_fi.communities, verdict);
+        record_for("http", community, verdict);
     }
     GUARD_DENIED.scope(denied, run).await
 }
@@ -107,7 +122,7 @@ fn guard_denied() -> Option<bool> {
     GUARD_DENIED.try_with(|denied| *denied).ok()
 }
 
-fn emit(route: &'static str, community: String, stage: &'static str, outcome: &'static str) {
+fn emit(route: &'static str, community: SharedString, stage: &'static str, outcome: &'static str) {
     if guard_denied() == Some(true) {
         return;
     }
@@ -121,7 +136,7 @@ fn emit(route: &'static str, community: String, stage: &'static str, outcome: &'
     .increment(1);
     // The counter is the record; only a would-deny earns a (debug) line.
     if stage != "admit" {
-        tracing::debug!(route, stage, outcome, community, "nip-fi shadow would-deny");
+        tracing::debug!(route, stage, outcome, %community, "nip-fi shadow would-deny");
     }
 }
 
@@ -136,7 +151,7 @@ const fn class_label(class: DenialClass) -> &'static str {
 
 /// In shadow mode only, record whether `strict` (a pure check) would reject,
 /// on its own counter: a pass is one proof, not an admission verdict.
-pub(crate) fn observe_strict_proof<E>(
+pub(crate) async fn observe_strict_proof<E>(
     state: &crate::state::AppState,
     headers: &HeaderMap,
     route: &'static str,
@@ -145,11 +160,12 @@ pub(crate) fn observe_strict_proof<E>(
     let nip_fi = &state.config.nip_fi;
     if nip_fi.mode.observes_only() && guard_denied() != Some(true) {
         let outcome = strict().map_or(class_label(DenialClass::EvidenceRejected), |()| "pass");
+        let community = label(&resolution(state, headers).await);
         metrics::counter!(
             "buzz_nip_fi_shadow_strict_proof_total",
             "route" => route,
             "outcome" => outcome,
-            "community" => community_label(headers, &nip_fi.communities)
+            "community" => community
         )
         .increment(1);
     }
@@ -170,7 +186,7 @@ pub(crate) async fn bind_tenant(
         .await
         .ok();
     if tenant.is_none() {
-        observe_unbound(state, headers);
+        observe_unbound(state, headers).await;
     }
     tenant
 }
@@ -179,15 +195,16 @@ pub(crate) async fn bind_tenant(
 /// Host bound no tenant: `community` when the Host maps to no configured
 /// community; an admit when enforce's guard passed it, since the handler's
 /// own rejection is no NIP-FI denial; nothing outside a guarded route.
-fn observe_unbound(state: &crate::state::AppState, headers: &HeaderMap) {
+async fn observe_unbound(state: &crate::state::AppState, headers: &HeaderMap) {
     let nip_fi = &state.config.nip_fi;
     if nip_fi.mode.observes_only() {
-        let verdict = match crate::nip_fi_core::resolve_community(headers, &nip_fi.communities) {
-            Err(class) => Err((Stage::Community, class)),
+        let community = resolution(state, headers).await;
+        let verdict = match &community {
+            Err(class) => Err((Stage::Community, *class)),
             Ok(_) if guard_denied() == Some(false) => Ok(()),
             Ok(_) => return,
         };
-        record("http", headers, &nip_fi.communities, verdict);
+        record("http", &community, verdict);
     }
 }
 
@@ -241,15 +258,19 @@ mod tests {
         headers
     }
 
-    // Mutation: labelling by the raw Host leaks `attacker.example`.
-    #[test]
-    fn community_label_is_configured_uri_or_unmapped() {
+    // Mutation: labelling by the raw Host leaks `attacker.example`; labelling
+    // an `env` community `bound` drops its per-community series.
+    #[tokio::test(flavor = "current_thread")]
+    async fn env_label_is_configured_uri_or_unmapped() {
+        let map = communities();
         let recorder = DebuggingRecorder::new();
-        metrics::with_local_recorder(&recorder, || {
-            for host in [Some(TEST_HOST), Some("attacker.example"), None] {
-                super::record("http", &with_host(host), &communities(), Ok(()));
-            }
-        });
+        let _guard = metrics::set_default_local_recorder(&recorder);
+        for host in [Some(TEST_HOST), Some("attacker.example"), None] {
+            let community = crate::nip_fi_core::Communities::from(&map)
+                .resolve(&with_host(host))
+                .await;
+            super::record("http", &community, Ok(()));
+        }
         let labels: Vec<String> = shadow_counts(&recorder)
             .into_iter()
             .map(|(c, _, _)| c)
@@ -311,7 +332,8 @@ mod tests {
             state.config = Arc::new(config);
             state.nip98_replay = guard.clone();
             let recorder = DebuggingRecorder::new();
-            metrics::with_local_recorder(&recorder, || {
+            {
+                let _guard = metrics::set_default_local_recorder(&recorder);
                 super::observe_strict_proof(&state, &headers, "bridge", || {
                     crate::api::bridge::verify_bridge_auth_with_options(
                         &headers,
@@ -322,8 +344,9 @@ mod tests {
                         true,
                     )
                     .map(drop)
-                });
-            });
+                })
+                .await;
+            }
             let counts = counts_of(&recorder, STRICT);
             assert_eq!(counts.len(), expected, "{mode:?}");
             assert!(
@@ -336,13 +359,15 @@ mod tests {
                 // Both outcomes stay on the proof counter, never an admit
                 // that could be summed with whole-request verdicts.
                 let recorder = DebuggingRecorder::new();
-                metrics::with_local_recorder(&recorder, || {
-                    super::observe_strict_proof(&state, &headers, "bridge", || Ok::<_, ()>(()));
-                    super::observe_strict_proof(&state, &headers, "bridge", || Err(()));
-                });
+                {
+                    let _guard = metrics::set_default_local_recorder(&recorder);
+                    super::observe_strict_proof(&state, &headers, "bridge", || Ok::<_, ()>(()))
+                        .await;
+                    super::observe_strict_proof(&state, &headers, "bridge", || Err(())).await;
+                }
                 let label = |outcome: &str| {
                     (
-                        "https://relay.example".to_owned(),
+                        TEST_COMMUNITY_URI.to_owned(),
                         "-".to_owned(),
                         outcome.to_owned(),
                     )
diff --git a/crates/buzz-relay/src/nip_fi_shadow_session.rs b/crates/buzz-relay/src/nip_fi_shadow_session.rs
index e841737f82..b6fb243882 100644
--- a/crates/buzz-relay/src/nip_fi_shadow_session.rs
+++ b/crates/buzz-relay/src/nip_fi_shadow_session.rs
@@ -14,7 +14,6 @@ use std::collections::HashMap;
 use std::sync::atomic::{AtomicU64, Ordering};
 use std::sync::{Arc, Mutex, OnceLock, PoisonError, Weak};
 
-use axum::http::HeaderMap;
 use buzz_auth::{DenialClass, VerifiedAssertion};
 use nostr::PublicKey;
 use tokio_util::sync::CancellationToken;
@@ -69,10 +68,12 @@ impl ShadowSessions {
     }
 }
 
+/// A shadow session exists only for an assertion verified against a resolved
+/// community, whose label all its records carry.
 pub(crate) struct ShadowSession {
     id: u64,
     route: &'static str,
-    community: String,
+    community: metrics::SharedString,
     assertion: VerifiedAssertion,
     phase: Mutex<Phase>,
     /// The socket's cancellation, read only to stop recording.
@@ -87,7 +88,7 @@ impl ShadowSession {
     pub(crate) fn start(
         state: &AppState,
         route: &'static str,
-        headers: &HeaderMap,
+        community: metrics::SharedString,
         assertion: VerifiedAssertion,
         connection_time: chrono::DateTime<chrono::Utc>,
     ) -> Arc<Self> {
@@ -101,7 +102,7 @@ impl ShadowSession {
         let session = Arc::new(Self {
             id: sessions.next_id.fetch_add(1, Ordering::Relaxed),
             route,
-            community: crate::nip_fi_shadow::community_label(headers, &nip_fi.communities),
+            community,
             assertion,
             phase: Mutex::new(Phase::Pending { revoked: false }),
             cancel: OnceLock::new(),
@@ -263,13 +264,13 @@ impl Drop for ShadowSession {
 /// returns `true` when enforce would have refused the upgrade here.
 pub(crate) fn upgrade_denied(
     state: &AppState,
-    headers: &HeaderMap,
+    community: &metrics::SharedString,
     assertion: &VerifiedAssertion,
 ) -> bool {
     let denied = deny_listed(state, assertion);
     if denied {
         let verdict = Err((Stage::DenySet, DenialClass::AuthorizationDenied));
-        crate::nip_fi_shadow::record("ws", headers, &state.config.nip_fi.communities, verdict);
+        crate::nip_fi_shadow::record_for("ws", community.clone(), verdict);
     }
     denied
 }
@@ -383,7 +384,13 @@ pub(crate) mod tests {
         lifetime: Duration,
     ) -> Arc<ShadowSession> {
         let assertion = VerifiedAssertion::for_test(key, vec![Utc::now() + lifetime]);
-        ShadowSession::start(state, "ws", &HeaderMap::new(), assertion, Utc::now())
+        ShadowSession::start(
+            state,
+            "ws",
+            crate::nip_fi_shadow::BOUND.into(),
+            assertion,
+            Utc::now(),
+        )
     }
 
     fn auth(session: &Arc<ShadowSession>, state: &AppState, pubkey: PublicKey) {
@@ -629,8 +636,16 @@ pub(crate) mod tests {
                 VerifiedAssertion::for_test(Some(key), vec![Utc::now() + Duration::hours(1)]);
             let clean =
                 VerifiedAssertion::for_test(Some(Keys::generate().public_key()), vec![Utc::now()]);
-            assert!(upgrade_denied(&state, &HeaderMap::new(), &listed));
-            assert!(!upgrade_denied(&state, &HeaderMap::new(), &clean));
+            assert!(upgrade_denied(
+                &state,
+                &crate::nip_fi_shadow::BOUND.into(),
+                &listed
+            ));
+            assert!(!upgrade_denied(
+                &state,
+                &crate::nip_fi_shadow::BOUND.into(),
+                &clean
+            ));
         });
         assert_eq!(records, ["deny_set/denied"]);
     }
diff --git a/crates/buzz-relay/src/nip_fi_test_hooks.rs b/crates/buzz-relay/src/nip_fi_test_hooks.rs
index 55d8e5b0e8..1769164ef7 100644
--- a/crates/buzz-relay/src/nip_fi_test_hooks.rs
+++ b/crates/buzz-relay/src/nip_fi_test_hooks.rs
@@ -210,6 +210,19 @@ make_hook!(audio_refusal_frames_hook, before_audio_refusal_frames);
 make_hook!(join_refusal_rollback_hook, before_join_refusal_rollback);
 make_hook!(audio_participant_fanout_hook, after_participant_fanout);
 make_hook!(audio_add_peer_hook, after_add_peer);
+// `before_audio_teardown_cleanup`: fires in `run_active_audio_connection` once
+// the writer has sent its Close and the socket is handed off, before the
+// teardown that writes to Postgres and Redis. Holding it stands in for a
+// stalled cleanup that must not hold the socket open.
+make_hook!(audio_teardown_cleanup_hook, before_audio_teardown_cleanup);
+// `before_room_archive_recheck`: fires in `run_active_audio_connection` after the
+// membership check, just before the archive re-check, so a test can archive
+// the channel between the two and drive the archived-channel exit.
+make_hook!(room_archive_recheck_hook, before_room_archive_recheck);
+// `before_archived_exit_cleanup`: fires on the archived-channel exit once the
+// socket is handed off, before the lease release. Holding it stands in for a
+// stalled Redis release that must not hold the socket open.
+make_hook!(archived_exit_cleanup_hook, before_archived_exit_cleanup);
 // `before_lease_permit`: fires in `handle_active_audio_connection` immediately
 // before the effect permit that covers join-owner resolution. Cancelling here
 // proves the resolver (and its lease CAS) never runs without a permit.
diff --git a/crates/buzz-relay/src/nip_fi_upgrade.rs b/crates/buzz-relay/src/nip_fi_upgrade.rs
index 7edabfa99c..5c5e864469 100644
--- a/crates/buzz-relay/src/nip_fi_upgrade.rs
+++ b/crates/buzz-relay/src/nip_fi_upgrade.rs
@@ -15,34 +15,67 @@ use axum::body::Body;
 use axum::http::{HeaderMap, Response};
 use buzz_auth::{DenialClass, NipFiMode, VerifiedAssertion, VerifyAssertion};
 
-use crate::nip_fi_config::NipFiCommunities;
 use crate::nip_fi_core::{
-    evaluate_attached_assertion, http_denial, resolve_community, AssertionRejection,
+    evaluate_attached_assertion, http_denial, AdmissionDeadline, AssertionRejection, Communities,
+    ResolvedCommunity,
 };
 
 /// Outcome of NIP-FI assertion validation at upgrade time.
 pub(crate) enum NipFiUpgradeOutcome {
-    /// Assertion validated successfully. Carry the result into the connection.
-    Admitted(VerifiedAssertion),
+    /// Assertion validated successfully. Carry the result into the connection,
+    /// with the deadline the upgrade re-checks after its tenant lookup.
+    Admitted(VerifiedAssertion, AdmissionDeadline),
     /// Off, or Shadow without a passing assertion — none is required.
     NotRequired,
-    /// Shadow: the assertion passed and is only observed from here on.
-    Observed(VerifiedAssertion),
+    /// Shadow: the assertion passed and is only observed from here on, with
+    /// its community, whose deadline enforce would re-check after the tenant
+    /// lookup.
+    Observed(VerifiedAssertion, ResolvedCommunity),
     /// Enforcement active but assertion absent/rejected — return the HTTP
     /// denial response.
     Denied(Response<Body>),
 }
 
-/// The enforced and the shadow-observed assertion slots of an admitted upgrade.
-pub(crate) type UpgradeAssertions = (Option<VerifiedAssertion>, Option<VerifiedAssertion>);
+/// The enforced and the shadow-observed assertion slots of an admitted upgrade,
+/// and the deadline to re-check immediately before accepting the socket. The
+/// observed assertion carries its own community, for [`observe_deadline`].
+pub(crate) type UpgradeAssertions = (
+    Option<VerifiedAssertion>,
+    Option<(VerifiedAssertion, ResolvedCommunity)>,
+    AdmissionDeadline,
+);
+
+/// Shadow's re-check at the point enforce re-checks its deadline: a binding
+/// that went stale during the tenant lookup records enforce's refusal and
+/// stops observing the session. The socket itself is still accepted. A
+/// session still observed keeps its community label.
+pub(crate) fn observe_deadline(
+    route: crate::nip_fi_session::NipFiWsRoute,
+    observed: Option<(VerifiedAssertion, ResolvedCommunity)>,
+) -> Option<(VerifiedAssertion, metrics::SharedString)> {
+    let (assertion, community) = observed?;
+    let label = community.shadow_label();
+    match community.deadline().check() {
+        Ok(()) => Some((assertion, label)),
+        Err(class) => {
+            let verdict = Err((crate::nip_fi_shadow::Stage::Deadline, class));
+            crate::nip_fi_shadow::record_for(route.shadow_label(), label, verdict);
+            None
+        }
+    }
+}
 
 impl NipFiUpgradeOutcome {
     /// The enforced and the shadow-observed assertion, or the denial response.
     pub(crate) fn into_assertions(self) -> Result<UpgradeAssertions, Box<Response<Body>>> {
         match self {
-            Self::NotRequired => Ok((None, None)),
-            Self::Admitted(assertion) => Ok((Some(assertion), None)),
-            Self::Observed(assertion) => Ok((None, Some(assertion))),
+            Self::NotRequired => Ok((None, None, AdmissionDeadline::default())),
+            Self::Admitted(assertion, deadline) => Ok((Some(assertion), None, deadline)),
+            Self::Observed(assertion, community) => Ok((
+                None,
+                Some((assertion, community)),
+                AdmissionDeadline::default(),
+            )),
             Self::Denied(response) => Err(Box::new(response)),
         }
     }
@@ -61,32 +94,37 @@ impl NipFiUpgradeOutcome {
 /// be valid but authorization is temporarily unavailable — so "authorization
 /// denied" would be false. "authorization unavailable, retry after repair" is
 /// the accurate and correct signal. [FI-TRACE-DENIAL-ORACLE]
-pub(crate) fn check_nip_fi_at_upgrade(
+pub(crate) async fn check_nip_fi_at_upgrade<'a>(
     route: crate::nip_fi_session::NipFiWsRoute,
     headers: &HeaderMap,
-    communities: &NipFiCommunities,
+    communities: impl Into<Communities<'a>>,
     verifier: Option<&dyn VerifyAssertion>,
     mode: NipFiMode,
 ) -> NipFiUpgradeOutcome {
+    let communities = communities.into();
     if !mode.restricts() {
         // Shadow records an upgrade would-deny; a passing assertion is
         // observed until AUTH, where its admission verdict is recorded.
         if mode.observes_only() {
-            let verdict = resolve_community(headers, communities)
-                .map_err(|class| (crate::nip_fi_shadow::Stage::Community, class))
-                .and_then(|community| {
-                    evaluate_attached_assertion(headers, community, verifier).map_err(|rejection| {
+            let community = communities.resolve(headers).await;
+            let verdict = match &community {
+                Err(class) => Err((crate::nip_fi_shadow::Stage::Community, *class)),
+                Ok(binding) => {
+                    evaluate_attached_assertion(headers, binding, verifier).map_err(|rejection| {
                         (
                             crate::nip_fi_shadow::Stage::Assertion,
                             rejection.denial_class(),
                         )
                     })
-                });
-            match verdict {
-                Ok(assertion) => return NipFiUpgradeOutcome::Observed(assertion),
-                Err(deny) => {
-                    let route = route.shadow_label();
-                    crate::nip_fi_shadow::record(route, headers, communities, Err(deny));
+                }
+            };
+            match (verdict, community) {
+                (Ok(assertion), Ok(community)) => {
+                    return NipFiUpgradeOutcome::Observed(assertion, community)
+                }
+                (verdict, community) => {
+                    let verdict = verdict.map(drop);
+                    crate::nip_fi_shadow::record(route.shadow_label(), &community, verdict);
                 }
             }
         }
@@ -98,12 +136,12 @@ pub(crate) fn check_nip_fi_at_upgrade(
     }
 
     // Enforce mode: resolve the Host's community, then validate the assertion.
-    let community = match resolve_community(headers, communities) {
+    let community = match communities.resolve(headers).await {
         Ok(community) => community,
         Err(class) => return NipFiUpgradeOutcome::Denied(http_denial(class)),
     };
-    match evaluate_attached_assertion(headers, community, verifier) {
-        Ok(assertion) => NipFiUpgradeOutcome::Admitted(assertion),
+    match evaluate_attached_assertion(headers, &community, verifier) {
+        Ok(assertion) => NipFiUpgradeOutcome::Admitted(assertion, community.deadline()),
         Err(rejection) => {
             if let AssertionRejection::Verifier(err) = rejection {
                 tracing::debug!(code = err.code(), "nip-fi assertion denied at upgrade");
@@ -116,6 +154,7 @@ pub(crate) fn check_nip_fi_at_upgrade(
 #[cfg(test)]
 mod tests {
     use super::*;
+    use futures_util::FutureExt as _;
 
     const ROOT: crate::nip_fi_session::NipFiWsRoute = crate::nip_fi_session::NipFiWsRoute::Root;
     use crate::nip_fi_core::extract_bearer_token;
@@ -393,7 +432,9 @@ mod tests {
             &communities(),
             None,
             buzz_auth::NipFiMode::Enforce,
-        );
+        )
+        .now_or_never()
+        .expect("env resolution never waits");
         match outcome {
             NipFiUpgradeOutcome::Denied(resp) => {
                 assert_eq!(resp.status(), axum::http::StatusCode::SERVICE_UNAVAILABLE);
@@ -413,7 +454,9 @@ mod tests {
             &communities(),
             None,
             buzz_auth::NipFiMode::Enforce,
-        );
+        )
+        .now_or_never()
+        .expect("env resolution never waits");
         // Missing header → MissingEvidence; but None verifier fires first.
         // Correct behavior: extract_bearer_token is called before verifier check,
         // so missing header → 401 (MissingEvidence) before reaching the None verifier path.
@@ -443,7 +486,9 @@ mod tests {
             &communities(),
             None,
             buzz_auth::NipFiMode::Off,
-        );
+        )
+        .now_or_never()
+        .expect("env resolution never waits");
         assert!(
             matches!(outcome, NipFiUpgradeOutcome::NotRequired),
             "Off mode must not require assertion — OSS default must not regress"
@@ -471,7 +516,9 @@ mod tests {
             &communities(),
             None,
             buzz_auth::NipFiMode::DenyProtected,
-        );
+        )
+        .now_or_never()
+        .expect("env resolution never waits");
         match outcome {
             NipFiUpgradeOutcome::Denied(resp) => {
                 assert_eq!(
@@ -519,13 +566,17 @@ mod tests {
         ];
         for (err, status, body) in rows {
             let verifier = ScriptedVerifier::new(Err(err));
-            let (got_status, got_body) = denied_parts(check_nip_fi_at_upgrade(
-                ROOT,
-                &headers_with("Bearer a.b.c"),
-                &communities(),
-                Some(&verifier),
-                NipFiMode::Enforce,
-            ));
+            let (got_status, got_body) = denied_parts(
+                check_nip_fi_at_upgrade(
+                    ROOT,
+                    &headers_with("Bearer a.b.c"),
+                    &communities(),
+                    Some(&verifier),
+                    NipFiMode::Enforce,
+                )
+                .now_or_never()
+                .expect("env resolution never waits"),
+            );
             assert_eq!(got_status, status, "{err:?}");
             assert_eq!(got_body, body, "{err:?}");
         }
@@ -535,13 +586,17 @@ mod tests {
     // Mutation: checking the verifier first turns this 403 into 503.
     #[test]
     fn characterize_upgrade_transport_precedes_verifier_presence() {
-        let (status, body) = denied_parts(check_nip_fi_at_upgrade(
-            ROOT,
-            &headers_with("junk"),
-            &communities(),
-            None,
-            NipFiMode::Enforce,
-        ));
+        let (status, body) = denied_parts(
+            check_nip_fi_at_upgrade(
+                ROOT,
+                &headers_with("junk"),
+                &communities(),
+                None,
+                NipFiMode::Enforce,
+            )
+            .now_or_never()
+            .expect("env resolution never waits"),
+        );
         assert_eq!(status, StatusCode::FORBIDDEN);
         assert_eq!(body, b"evidence rejected\n");
     }
@@ -558,8 +613,11 @@ mod tests {
             &communities(),
             Some(&verifier),
             NipFiMode::Enforce,
-        ) {
-            NipFiUpgradeOutcome::Admitted(assertion) => {
+        )
+        .now_or_never()
+        .expect("env resolution never waits")
+        {
+            NipFiUpgradeOutcome::Admitted(assertion, _) => {
                 assert_eq!(assertion.asserted_key(), None);
             }
             _ => panic!("claimless assertion must be admitted at upgrade"),
@@ -581,16 +639,22 @@ mod tests {
                 &communities(),
                 Some(&verifier),
                 NipFiMode::Off
-            ),
+            )
+            .now_or_never()
+            .expect("env resolution never waits"),
             NipFiUpgradeOutcome::NotRequired
         ));
-        let (status, _) = denied_parts(check_nip_fi_at_upgrade(
-            ROOT,
-            &headers,
-            &communities(),
-            Some(&verifier),
-            NipFiMode::DenyProtected,
-        ));
+        let (status, _) = denied_parts(
+            check_nip_fi_at_upgrade(
+                ROOT,
+                &headers,
+                &communities(),
+                Some(&verifier),
+                NipFiMode::DenyProtected,
+            )
+            .now_or_never()
+            .expect("env resolution never waits"),
+        );
         assert_eq!(status, StatusCode::SERVICE_UNAVAILABLE);
         assert_eq!(verifier.calls(), 0);
     }
@@ -611,18 +675,22 @@ mod tests {
                 Some(&verifier),
                 NipFiMode::Shadow,
             )
+            .now_or_never()
+            .expect("env resolution never waits")
         };
-        let Ok((None, Some(_))) = check().into_assertions() else {
+        let Ok((None, Some(_), _)) = check().into_assertions() else {
             panic!("a passing shadow assertion is observed, never enforced");
         };
         assert_eq!(verifier.calls(), 1, "shadow must evaluate the assertion");
-        let Ok((None, None)) = check_nip_fi_at_upgrade(
+        let Ok((None, None, _)) = check_nip_fi_at_upgrade(
             ROOT,
             &host_headers(),
             &communities(),
             Some(&verifier),
             NipFiMode::Shadow,
         )
+        .now_or_never()
+        .expect("env resolution never waits")
         .into_assertions() else {
             panic!("a missing shadow assertion admits as Off");
         };
@@ -647,7 +715,9 @@ mod tests {
                         &communities(),
                         verifier,
                         NipFiMode::Shadow,
-                    );
+                    )
+                    .now_or_never()
+                    .expect("env resolution never waits");
                     assert!(matches!(outcome, NipFiUpgradeOutcome::NotRequired));
                 }
             }
diff --git a/crates/buzz-relay/src/router.rs b/crates/buzz-relay/src/router.rs
index e7194c8f72..49ed25223d 100644
--- a/crates/buzz-relay/src/router.rs
+++ b/crates/buzz-relay/src/router.rs
@@ -189,17 +189,24 @@ async fn nip_fi_assertion_guard(
         return http_denial(buzz_auth::DenialClass::AuthorizationUnavailable);
     }
 
-    let verdict = nip_fi_guard_steps(&state, request.headers());
+    // Shadow resolves exactly as enforce does; enforce hands the binding to
+    // the handler's admission, so a request costs one resolution.
+    let community = state.nip_fi_communities().resolve(request.headers()).await;
+    let verdict = nip_fi_guard_steps(&state, request.headers(), community.as_deref());
     // Shadow: transparent, but the guard's verdict is recorded in enforce's
     // order, ahead of any handler step.
+    // The resolved binding rides along so the handler's observed admission
+    // rechecks the same deadline enforce does.
     if mode.observes_only() {
-        let headers = request.headers().clone();
-        return crate::nip_fi_shadow::observe_guard(&state, &headers, verdict, next.run(request))
-            .await;
+        let label = crate::nip_fi_shadow::label(&community);
+        let run = crate::nip_fi_http::with_resolved_community(community, next.run(request));
+        return crate::nip_fi_shadow::observe_guard(label, verdict, run).await;
     }
-    match verdict {
-        Ok(()) => next.run(request).await,
-        Err((_, class)) => http_denial(class),
+    match (verdict, community) {
+        (Ok(()), Ok(community)) => {
+            crate::nip_fi_http::with_resolved_community(Ok(community), next.run(request)).await
+        }
+        (Err((_, class)), _) | (Ok(()), Err(class)) => http_denial(class),
     }
 }
 
@@ -213,10 +220,9 @@ async fn nip_fi_assertion_guard(
 fn nip_fi_guard_steps(
     state: &AppState,
     headers: &axum::http::HeaderMap,
+    community: Result<&buzz_auth::CommunityBinding, &buzz_auth::DenialClass>,
 ) -> Result<(), crate::nip_fi_shadow::WouldDeny> {
-    let community =
-        crate::nip_fi_core::resolve_community(headers, &state.config.nip_fi.communities)
-            .map_err(|class| (crate::nip_fi_shadow::Stage::Community, class))?;
+    let community = community.map_err(|class| (crate::nip_fi_shadow::Stage::Community, *class))?;
     crate::nip_fi_core::evaluate_attached_assertion(
         headers,
         community,
@@ -343,6 +349,10 @@ pub fn build_router(state: Arc<AppState>) -> Router {
             "/operator/communities",
             get(api::operator::list_owned_communities).post(api::operator::provision_community),
         )
+        .route(
+            "/operator/communities/joined",
+            get(api::operator::list_joined_communities),
+        )
         .route(
             "/operator/listener/pubkeys",
             post(api::operator::register_listener_pubkeys)
@@ -631,15 +641,16 @@ async fn nip11_or_ws_handler(
     // accepts is also gated — no hand-rolled predicate can diverge from the
     // extractor's accepted shapes when `http2` is eventually enabled.
     //
-    // Zero DB cost invariant: the active HTTP/1.1 fire-point runs before
-    // `bind_community`, so denied h1 upgrades pay zero DB cost
+    // No-tenant-lookup invariant: the active HTTP/1.1 fire-point runs before
+    // `bind_community`, so denied h1 upgrades skip the tenant lookup (a
+    // resolver cache miss still costs one bounded binding lookup)
     // [FI-TRACE-TRANSPORT-CLOSED], and tests that assert 401/503 are not
     // pre-empted by a 404 from an unseeded DB. The `Ok(ws)` backstop runs after
     // `bind_community`; it is unreachable until `http2` is enabled.
     //
     // Keying on the header pair (not on `Accept`) means an HTML Accept header
     // on a real WS upgrade is still gated correctly.
-    let (upgrade_checked, nip_fi_assertion, shadow_assertion) = {
+    let (upgrade_checked, nip_fi_assertion, shadow_assertion, nip_fi_deadline) = {
         let is_h1_ws_upgrade = headers
             .get(axum::http::header::UPGRADE)
             .and_then(|v| v.to_str().ok())
@@ -666,18 +677,19 @@ async fn nip11_or_ws_handler(
             use crate::nip_fi_upgrade::check_nip_fi_at_upgrade;
             let mode = state.config.nip_fi.mode;
             let verifier = state.nip_fi_verifier.as_deref();
-            let communities = &state.config.nip_fi.communities;
+            let communities = state.nip_fi_communities();
             match check_nip_fi_at_upgrade(Root, &headers, communities, verifier, mode)
+                .await
                 .into_assertions()
             {
-                Ok((assertion, shadow)) => (true, assertion, shadow),
+                Ok((assertion, shadow, deadline)) => (true, assertion, shadow, deadline),
                 Err(resp) => return (*resp).into_response(),
             }
         } else {
             // Not a WS upgrade shape — a NIP-11 request or a plain browser GET.
             // The `Ok(ws)` arm below backstops any extractor-accepted shape this
             // predicate misses. [F3-H2-GATE]
-            (false, None, None)
+            (false, None, None, Default::default())
         }
     };
 
@@ -689,7 +701,7 @@ async fn nip11_or_ws_handler(
     // That normative sequence runs in handlers/auth.rs after set_authenticated_pubkey.
     //
     // This pre-upgrade check provides a cheap bounce for keys already in the deny
-    // map before the connection is upgraded — pays zero DB cost and rejects before
+    // map before the connection is upgraded — needs no DB read and rejects before
     // tungstenite hands the socket to the application. It is NOT race-free against
     // a concurrent disconnect (the session isn't registered yet), which is why the
     // normative post-registration check in auth.rs is the correctness gate.
@@ -707,8 +719,9 @@ async fn nip11_or_ws_handler(
             }
         }
     }
-    let shadow_assertion = shadow_assertion
-        .filter(|a| !crate::nip_fi_shadow_session::upgrade_denied(&state, &headers, a));
+    let shadow_assertion = shadow_assertion.filter(|(a, c)| {
+        !crate::nip_fi_shadow_session::upgrade_denied(&state, &c.shadow_label(), a)
+    });
 
     // Row zero: bind the connection to its community from the request host
     // BEFORE the WebSocket upgrade, so no frame is ever read on an unbound
@@ -719,7 +732,7 @@ async fn nip11_or_ws_handler(
     // `icon` simply absent), so the doc cannot leak which hosts are mapped.
     //
     // The NIP-FI upgrade gate runs above (before bind_community) so denied
-    // upgrades pay zero DB cost; the `Ok(ws)` backstop runs below.
+    // upgrades skip the tenant lookup; the `Ok(ws)` backstop runs below.
     let tenant = match crate::tenant::bind_community(&state.db, raw_host).await {
         Ok(ctx) => ctx,
         Err(_) => {
@@ -733,6 +746,15 @@ async fn nip11_or_ws_handler(
                 .into_response();
         }
     };
+    // The tenant lookup awaited since the community resolved; a snapshot
+    // that went stale meanwhile accepts no socket.
+    if let Err(class) = nip_fi_deadline.check() {
+        return http_denial(class).into_response();
+    }
+    let shadow_assertion = crate::nip_fi_upgrade::observe_deadline(
+        crate::nip_fi_session::NipFiWsRoute::Root,
+        shadow_assertion,
+    );
 
     let max_frame_bytes = state.config.max_frame_bytes;
 
@@ -754,11 +776,15 @@ async fn nip11_or_ws_handler(
                 use crate::nip_fi_upgrade::check_nip_fi_at_upgrade;
                 let mode = state.config.nip_fi.mode;
                 let verifier = state.nip_fi_verifier.as_deref();
-                let communities = &state.config.nip_fi.communities;
+                let communities = state.nip_fi_communities();
+                // Resolved after every await of this upgrade: nothing to re-check.
                 match check_nip_fi_at_upgrade(Root, &headers, communities, verifier, mode)
+                    .await
                     .into_assertions()
                 {
-                    Ok(assertions) => assertions,
+                    Ok((assertion, shadow, _deadline)) => {
+                        (assertion, shadow.map(|(a, c)| (a, c.shadow_label())))
+                    }
                     Err(resp) => return (*resp).into_response(),
                 }
             } else {
@@ -779,11 +805,11 @@ async fn nip11_or_ws_handler(
             // handshake, not the post-community-active-check instant.
             // [FI-TRACE-LEASE-BOUND]
             let connection_time = chrono::Utc::now();
-            let shadow = shadow_assertion.map(|a| {
+            let shadow = shadow_assertion.map(|(a, community)| {
                 crate::nip_fi_shadow_session::ShadowSession::start(
                     &state,
                     "ws",
-                    &headers,
+                    community,
                     a,
                     connection_time,
                 )
@@ -2144,6 +2170,7 @@ mod tests {
         // Enforce that is the startup-race condition that must return 503 for
         // a token-carrying request.
         config.nip_fi = NipFiRelayConfig {
+            source: Default::default(),
             mode,
             registry: IssuerRegistry::new(),
             jwks_configs: vec![],
@@ -2349,7 +2376,7 @@ mod tests {
     // (gate denial codes), which holds regardless of host resolution state.
     //
     // Fix 6: corrected the DB-free comment (bind_community is reached by plain
-    // GETs; only WS-upgrade requests pay zero DB cost via the pre-gate path).
+    // GETs; only WS-upgrade requests skip the tenant lookup via the pre-gate path).
     //
     // Mutation evidence:
     //   A) Move the NIP-FI gate to fire on plain GETs too → response becomes
@@ -3926,6 +3953,7 @@ mod tests {
         };
 
         config.nip_fi = NipFiRelayConfig {
+            source: Default::default(),
             mode: NipFiMode::Enforce,
             registry: {
                 let mut r = IssuerRegistry::new();
diff --git a/crates/buzz-relay/src/startup_steps.rs b/crates/buzz-relay/src/startup_steps.rs
index 3980b6b86a..189731fd6b 100644
--- a/crates/buzz-relay/src/startup_steps.rs
+++ b/crates/buzz-relay/src/startup_steps.rs
@@ -61,6 +61,8 @@ pub enum StartupStep {
     SearchConnect,
     /// Warm NIP-FI JWKS snapshots (only when NIP-FI is configured).
     NipFiJwksWarm,
+    /// Load the first NIP-FI binding snapshot (only for the `database` source).
+    NipFiSnapshotLoad,
     /// Start the inter-relay mesh (no-op when the mesh is off).
     MeshBoot,
     /// Run the git object-store conformance probe (when enabled).
@@ -79,7 +81,7 @@ pub enum StartupStep {
 
 impl StartupStep {
     /// The complete `phase` label vocabulary.
-    pub const ALL: [Self; 18] = [
+    pub const ALL: [Self; 19] = [
         Self::DbConnect,
         Self::DbMigrate,
         Self::PartitionEnsure,
@@ -91,6 +93,7 @@ impl StartupStep {
         Self::RedisConnect,
         Self::SearchConnect,
         Self::NipFiJwksWarm,
+        Self::NipFiSnapshotLoad,
         Self::MeshBoot,
         Self::GitConformanceProbe,
         Self::ChannelRosterFence,
@@ -114,6 +117,7 @@ impl StartupStep {
             Self::RedisConnect => "redis_connect",
             Self::SearchConnect => "search_connect",
             Self::NipFiJwksWarm => "nip_fi_jwks_warm",
+            Self::NipFiSnapshotLoad => "nip_fi_snapshot_load",
             Self::MeshBoot => "mesh_boot",
             Self::GitConformanceProbe => "git_conformance_probe",
             Self::ChannelRosterFence => "channel_roster_fence",
diff --git a/crates/buzz-relay/src/state.rs b/crates/buzz-relay/src/state.rs
index 29cce6de5f..5201e211e6 100644
--- a/crates/buzz-relay/src/state.rs
+++ b/crates/buzz-relay/src/state.rs
@@ -1379,6 +1379,10 @@ pub struct AppState {
     /// 4) and HTTP admission (`nip_fi_http`): one `Arc`, never a second map.
     pub nip_fi_deny_map: Option<Arc<buzz_auth::NipFiDenyMap>>,
 
+    /// The database community resolver (`BUZZ_NIP_FI_COMMUNITY_SOURCE=database`),
+    /// installed by `main.rs`; `None` resolves from `config.nip_fi.communities`.
+    pub nip_fi_resolver: Option<Arc<crate::nip_fi_resolver::DatabaseResolver>>,
+
     /// Command JWT verifier for the NIP-FI admin disconnect endpoint.
     ///
     /// `None` when mode is `Off` (no command API is reachable).  When
@@ -1399,6 +1403,17 @@ pub struct AppState {
 }
 
 impl AppState {
+    /// The NIP-FI community source admission resolves against.
+    pub(crate) fn nip_fi_communities(&self) -> crate::nip_fi_core::Communities<'_> {
+        use crate::nip_fi_config::CommunitySource;
+        use crate::nip_fi_core::Communities;
+        match (self.config.nip_fi.source, &self.nip_fi_resolver) {
+            (CommunitySource::Env, _) => Communities::Env(&self.config.nip_fi.communities),
+            (CommunitySource::Database, Some(resolver)) => Communities::Database(resolver),
+            (CommunitySource::Database, None) => Communities::Unavailable,
+        }
+    }
+
     /// Constructs `AppState` from its component services.
     ///
     /// Returns `(state, audit_shutdown)`. The caller should call
@@ -1600,6 +1615,7 @@ impl AppState {
             // `main.rs` after startup validation.  `None` is safe before that
             // call: the endpoint returns 503 when the verifier is absent.
             nip_fi_deny_map: None,
+            nip_fi_resolver: None,
             nip_fi_command_verifier: None,
             nip_fi_command_replay,
             nip_fi_publish_tasks: tokio_util::task::TaskTracker::new(),
diff --git a/crates/buzz-relay/tests/boot_lifecycle.rs b/crates/buzz-relay/tests/boot_lifecycle.rs
index ad6f20f17b..0a63a83be8 100644
--- a/crates/buzz-relay/tests/boot_lifecycle.rs
+++ b/crates/buzz-relay/tests/boot_lifecycle.rs
@@ -692,7 +692,10 @@ mod postgres_tests {
     /// passes. Unlike `run_relay`, a relay that keeps serving is a result to
     /// assert on rather than a panic, which is the whole point here.
     fn run_until_exit(environment: &[(&str, &str)], timeout: Duration) -> (bool, Output) {
-        let mut process = RelayProcess::spawn(environment);
+        wait_for_exit(RelayProcess::spawn(environment), timeout)
+    }
+
+    fn wait_for_exit(mut process: RelayProcess, timeout: Duration) -> (bool, Output) {
         let deadline = Instant::now() + timeout;
         while Instant::now() < deadline {
             if process.try_wait().is_some() {
@@ -882,4 +885,187 @@ mod postgres_tests {
             "the sampler must be owned by a relay that finished booting: {logs}"
         );
     }
+
+    const NIP_FI_ISSUERS: &str = r#"[{
+        "issuer": "https://idp.example.com",
+        "command_audiences": ["https://relay.example.com"],
+        "token_class": "nip-fi+jwt",
+        "algorithms": ["ES256"],
+        "maximum_assertion_age_seconds": 3600,
+        "jwks_uri": "https://idp.example.com/.well-known/jwks.json",
+        "jwks_refresh_interval_seconds": 300,
+        "jwks_hard_deadline_seconds": 86400,
+        "maximum_command_age_seconds": 30,
+        "authorized_principals": ["https://idp.example.com/operator"]
+    }]"#;
+    /// A suffix that never covers the relay's own host, so deployment
+    /// bootstrap writes no binding and the startup load is the first reader
+    /// of `community_nip_fi_issuers`.
+    const NIP_FI_PROVISION_BINDING: &str = r#"{"host_suffix":"communities.example.com","authorized_issuers":["https://idp.example.com"]}"#;
+
+    /// Boots the relay with the database community source; `extra` adds or
+    /// overrides variables. Returns the health port alongside the process.
+    fn spawn_database_source(extra: &[(&str, &str)]) -> (RelayProcess, u16) {
+        let database_url = std::env::var("DATABASE_URL")
+            .expect("postgres lane provides DATABASE_URL for each test process");
+        let redis_url = std::env::var("REDIS_URL")
+            .expect("the postgres lane runs alongside Redis and exports REDIS_URL");
+        let metrics_port = reserve_closed_port().to_string();
+        let health_port = reserve_closed_port();
+        let health_port_value = health_port.to_string();
+        let bind_addr = format!("127.0.0.1:{}", reserve_closed_port());
+        let mut environment = vec![
+            ("BUZZ_RELAY_PRIVATE_KEY", VALID_RELAY_PRIVATE_KEY),
+            ("BUZZ_METRICS_PORT", metrics_port.as_str()),
+            ("BUZZ_HEALTH_PORT", health_port_value.as_str()),
+            ("BUZZ_BIND_ADDR", bind_addr.as_str()),
+            ("DATABASE_URL", database_url.as_str()),
+            ("REDIS_URL", redis_url.as_str()),
+            ("BUZZ_GIT_CONFORMANCE_PROBE", "false"),
+            // Shadow: off builds no resolver, so it loads no snapshot.
+            ("BUZZ_NIP_FI_MODE", "shadow"),
+            ("BUZZ_NIP_FI_COMMUNITY_SOURCE", "database"),
+            ("BUZZ_NIP_FI_ISSUERS", NIP_FI_ISSUERS),
+            ("BUZZ_NIP_FI_PROVISION_BINDING", NIP_FI_PROVISION_BINDING),
+            ("BUZZ_NIP_FI_MAX_CONNECTION_LIFETIME_SECS", "3600"),
+        ];
+        environment.extend_from_slice(extra);
+        (RelayProcess::spawn(&environment), health_port)
+    }
+
+    /// Binds `count` active communities under the provision suffix to the
+    /// registered issuer, on the test's own database.
+    fn seed_bindings(count: u32) {
+        use sqlx::Connection as _;
+        let database_url = std::env::var("DATABASE_URL").expect("DATABASE_URL");
+        let runtime = tokio::runtime::Runtime::new().expect("tokio runtime");
+        runtime.block_on(async {
+            let mut connection = sqlx::PgConnection::connect(&database_url)
+                .await
+                .expect("connect to the test database");
+            // One statement per thousand rows: each insert takes a write-fence
+            // advisory lock per community, held to the end of its transaction.
+            for start in (1..=count).step_by(1000) {
+                sqlx::query(
+                    "WITH c AS (
+                         INSERT INTO communities (id, host)
+                         SELECT gen_random_uuid(), 'c' || n || '.communities.example.com'
+                         FROM generate_series($1, $2) AS n
+                         RETURNING id
+                     )
+                     INSERT INTO community_nip_fi_issuers (community_id, issuer)
+                     SELECT id, 'https://idp.example.com' FROM c",
+                )
+                .bind(i64::from(start))
+                .bind(i64::from(count.min(start + 999)))
+                .execute(&mut connection)
+                .await
+                .expect("seed NIP-FI bindings");
+            }
+        });
+    }
+
+    fn assert_failed_before_listeners(
+        exited: bool,
+        output: &Output,
+        health_port: u16,
+        failure: &str,
+    ) {
+        let logs = format!(
+            "{}{}",
+            String::from_utf8_lossy(&output.stdout),
+            String::from_utf8_lossy(&output.stderr)
+        );
+        assert!(
+            exited && !output.status.success(),
+            "a failed startup binding load must be startup-fatal: {logs}"
+        );
+        assert!(
+            logs.contains(&format!("startup binding snapshot load failed: {failure}")),
+            "the failure must name the snapshot load and why it failed: {logs}"
+        );
+        assert!(
+            !logs.contains("Health probe listener started"),
+            "no listener may bind before the snapshot loads: {logs}"
+        );
+        assert!(
+            TcpListener::bind(("0.0.0.0", health_port)).is_ok(),
+            "the health port must never have been bound"
+        );
+    }
+
+    /// The database source must never let a pod serve without a snapshot: a
+    /// load that fails exits non-zero before any listener binds, so the
+    /// orchestrator restarts the pod instead of routing to it. Two bindings
+    /// over a one-row cap make the load itself fail after every earlier
+    /// startup step has read the same table successfully.
+    #[test]
+    #[ignore = "requires PostgreSQL"]
+    fn database_source_failed_snapshot_stops_boot_before_listeners_bind() {
+        seed_bindings(2);
+        let (process, health_port) =
+            spawn_database_source(&[("BUZZ_NIP_FI_SNAPSHOT_MAX_ROWS", "1")]);
+        let (exited, output) = wait_for_exit(process, CHILD_TIMEOUT);
+        assert_failed_before_listeners(exited, &output, health_port, "OverCap");
+    }
+
+    /// A load that cannot finish in time must hit the refresh timeout and fail
+    /// the same way, rather than leaving the pod waiting unbound. A
+    /// millisecond budget cannot cover a scan of this many rows.
+    #[test]
+    #[ignore = "requires PostgreSQL"]
+    fn database_source_slow_snapshot_times_out_before_listeners_bind() {
+        seed_bindings(20_000);
+        let (process, health_port) =
+            spawn_database_source(&[("BUZZ_NIP_FI_SNAPSHOT_REFRESH_TIMEOUT_MS", "1")]);
+        let (exited, output) = wait_for_exit(process, CHILD_TIMEOUT);
+        assert_failed_before_listeners(exited, &output, health_port, "Timeout");
+    }
+
+    /// With a loadable snapshot the same configuration boots and readiness
+    /// turns ready, so the two failure tests above fail for the load alone. One
+    /// seeded binding proves the snapshot reads rows, not just an empty table.
+    #[test]
+    #[ignore = "requires PostgreSQL"]
+    fn database_source_snapshot_load_lets_readiness_turn_ready() {
+        seed_bindings(1);
+        let (mut process, health_port) = spawn_database_source(&[]);
+        let deadline = Instant::now() + CHILD_TIMEOUT;
+        let ready = loop {
+            assert!(
+                process.try_wait().is_none(),
+                "relay exited: {}",
+                String::from_utf8_lossy(&process.terminate().stdout)
+            );
+            let response = TcpStream::connect(("127.0.0.1", health_port))
+                .and_then(|mut stream| {
+                    stream.set_read_timeout(Some(Duration::from_secs(1)))?;
+                    stream.write_all(
+                        b"GET /_readiness HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n",
+                    )?;
+                    let mut response = String::new();
+                    stream.read_to_string(&mut response)?;
+                    Ok(response)
+                })
+                .unwrap_or_default();
+            if response.starts_with("HTTP/1.1 200") || Instant::now() >= deadline {
+                break response;
+            }
+            thread::sleep(Duration::from_millis(50));
+        };
+        let output = process.terminate();
+        let logs = format!(
+            "{}{}",
+            String::from_utf8_lossy(&output.stdout),
+            String::from_utf8_lossy(&output.stderr)
+        );
+        assert!(
+            ready.starts_with("HTTP/1.1 200"),
+            "readiness never turned ready: {ready}: {logs}"
+        );
+        assert!(
+            logs.contains("NIP-FI: binding snapshot loaded"),
+            "readiness must follow the snapshot load: {logs}"
+        );
+    }
 }
diff --git a/deny.toml b/deny.toml
index 00b4f66ae4..6ef1126096 100644
--- a/deny.toml
+++ b/deny.toml
@@ -26,6 +26,23 @@ ignore = [
     # Keep the exact NetEQ pin and the wrapper ban below together. Re-audit or
     # remove this exception when NetEQ removes/updates the unused dependency.
     { id = "RUSTSEC-2026-0293", reason = "unused dependency of audited, exactly pinned neteq 0.8.3; no Rust references to ringbuf; other consumers forbidden by bans.deny" },
+    # zip 8.6.0 < 9: extraction keeps setuid/setgid bits (0367), creates
+    # symlinks that escape the destination (0368) and applies permissions through
+    # symlinks (0369). Only path: buzz-mesh-smoke → mesh-llm v0.76.2 →
+    # mesh-llm-host-runtime / mesh-llm-plugin-manager / mesh-llm-system → zip 8.
+    # mesh-llm's zip readers copy entries manually and never call
+    # ZipArchive::extract; recheck if that changes. Remove on the mesh-llm bump
+    # that ships Mesh-LLM/mesh-llm#2471.
+    { id = "RUSTSEC-2026-0367", reason = "zip 8.6.0 via buzz-mesh-smoke → mesh-llm v0.76.2; manual entry copy, never extracts; fix in unreleased mesh-llm#2471" },
+    { id = "RUSTSEC-2026-0368", reason = "zip 8.6.0 via buzz-mesh-smoke → mesh-llm v0.76.2; manual entry copy, never extracts; fix in unreleased mesh-llm#2471" },
+    { id = "RUSTSEC-2026-0369", reason = "zip 8.6.0 via buzz-mesh-smoke → mesh-llm v0.76.2; manual entry copy, never extracts; fix in unreleased mesh-llm#2471" },
+    # zbus 5 D-Bus crates (zvariant, zbus_names, zvariant_derive) — unmaintained,
+    # not vulnerable. Only path: buzz-mesh-smoke → mesh-llm → keyring 4 →
+    # zbus-secret-service-keyring-store / secret-service 5 → zbus 5.
+    # Remove when mesh-llm's keyring stack moves off zbus 5.
+    { id = "RUSTSEC-2026-0370", reason = "zvariant via buzz-mesh-smoke → mesh-llm → keyring 4 → secret-service 5 → zbus 5; unmaintained, not vulnerable" },
+    { id = "RUSTSEC-2026-0371", reason = "zbus_names via buzz-mesh-smoke → mesh-llm → keyring 4 → secret-service 5 → zbus 5; unmaintained, not vulnerable" },
+    { id = "RUSTSEC-2026-0372", reason = "zvariant_derive via buzz-mesh-smoke → mesh-llm → keyring 4 → secret-service 5 → zbus 5; unmaintained, not vulnerable" },
 ]
 
 [licenses]
diff --git a/deploy/charts/buzz/README.md b/deploy/charts/buzz/README.md
index 5704a7622b..f2ef677c9e 100644
--- a/deploy/charts/buzz/README.md
+++ b/deploy/charts/buzz/README.md
@@ -195,6 +195,15 @@ gating the probe on them removed the whole deployment from the load balancer at
 once and left a reconnect burst with nowhere to land. There is no separate
 "starting" state — the health listener does not bind until the database,
 migrations, Redis, and pub/sub are up, so a process that can answer has booted.
+With `BUZZ_NIP_FI_COMMUNITY_SOURCE=database` and a mode other than `off`, the
+first NIP-FI binding snapshot also loads before any listener binds (startup
+phase `nip_fi_snapshot_load`); a failed load exits the process, so a pod never
+reports ready without one. Later refresh failures do not affect readiness —
+watch `buzz_nip_fi_binding_snapshot_loaded_timestamp_seconds` instead. The
+source's env vars (`BUZZ_NIP_FI_COMMUNITY_SOURCE`,
+`BUZZ_NIP_FI_SNAPSHOT_MAX_ROWS`, `BUZZ_NIP_FI_SNAPSHOT_REFRESH_TIMEOUT_MS`,
+`BUZZ_NIP_FI_RESOLVER_NEGATIVE_CACHE_MAX`, `BUZZ_NIP_FI_RESOLVER_MAX_INFLIGHT`)
+and alerts are in `docs/operator-nip-fi-bindings.md`.
 
 Shared-dependency health moved to **`/_status`** on the same private health
 listener, under a `dependencies` object carrying the `postgres`, `redis`,
diff --git a/desktop/src-tauri/Cargo.lock b/desktop/src-tauri/Cargo.lock
index 2b622d7c6c..4a21a6fa58 100644
--- a/desktop/src-tauri/Cargo.lock
+++ b/desktop/src-tauri/Cargo.lock
@@ -916,7 +916,7 @@ dependencies = [
  "arrayvec",
  "cc",
  "cfg-if 1.0.4",
- "constant_time_eq",
+ "constant_time_eq 0.4.2",
  "cpufeatures 0.3.0",
 ]
 
@@ -1208,7 +1208,7 @@ dependencies = [
  "window-vibrancy",
  "windows-sys 0.61.2",
  "zeroize",
- "zip 8.6.0",
+ "zip 9.0.5",
 ]
 
 [[package]]
@@ -1809,6 +1809,15 @@ version = "0.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3d52eff69cd5e647efe296129160853a42795992097e8af39800e1060caeea9b"
 
+[[package]]
+name = "constant_time_eq"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9eb6feb175df65d0a3ccd3e73484e940d0ac664e8034f0519fd49a93db3071d9"
+dependencies = [
+ "rustversion",
+]
+
 [[package]]
 name = "convert_case"
 version = "0.10.0"
@@ -5095,9 +5104,9 @@ dependencies = [
 
 [[package]]
 name = "lzma-rust2"
-version = "0.16.5"
+version = "0.22.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca93e534d1142d1d0dcca6d25fe302508a5dfb40b302802904577725ea0b695b"
+checksum = "7277c9742229dc25243236d578b6471a798c554512c6f6a04365ec2e87c2a3bb"
 dependencies = [
  "sha2 0.11.0",
 ]
@@ -7869,9 +7878,9 @@ checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
 
 [[package]]
 name = "ppmd-rust"
-version = "1.4.0"
+version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "efca4c95a19a79d1c98f791f10aebd5c1363b473244630bb7dbde1dc98455a24"
+checksum = "196a7c80b9a7652aba7cc070827516c2abe4ccdf53d128e1944003cf5726cff1"
 
 [[package]]
 name = "ppv-lite86"
@@ -14015,10 +14024,24 @@ name = "zip"
 version = "8.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2d04a6b5381502aa6087c94c669499eb1602eb9c5e8198e534de571f7154809b"
+dependencies = [
+ "crc32fast",
+ "flate2",
+ "indexmap 2.14.0",
+ "memchr",
+ "typed-path",
+ "zopfli",
+]
+
+[[package]]
+name = "zip"
+version = "9.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e04976da629d3b04204ba8105b396a193af8ad2583b2c79bfb3ab8af580a11e"
 dependencies = [
  "aes 0.9.1",
  "bzip2 0.6.1",
- "constant_time_eq",
+ "constant_time_eq 0.6.1",
  "crc32fast",
  "deflate64",
  "flate2",
@@ -14027,6 +14050,7 @@ dependencies = [
  "indexmap 2.14.0",
  "lzma-rust2",
  "memchr",
+ "nix 0.31.3",
  "pbkdf2 0.13.0",
  "ppmd-rust",
  "sha1 0.11.0",
@@ -14063,27 +14087,27 @@ dependencies = [
 
 [[package]]
 name = "zstd"
-version = "0.13.3"
+version = "0.14.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e91ee311a569c327171651566e07972200e76fcfe2242a4fa446149a3881c08a"
+checksum = "db3ae9bf90af6e40197bef767eeefc46ad6397420fe873830bd85e5fbbfb3c70"
 dependencies = [
  "zstd-safe",
 ]
 
 [[package]]
 name = "zstd-safe"
-version = "7.2.4"
+version = "8.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f49c4d5f0abb602a93fb8736af2a4f4dd9512e36f7f570d66e65ff867ed3b9d"
+checksum = "ded520f16b29e1a9b771c722221b2b0a0398c2316d9bb3c42b458a5414d7434b"
 dependencies = [
  "zstd-sys",
 ]
 
 [[package]]
 name = "zstd-sys"
-version = "2.0.16+zstd.1.5.7"
+version = "2.1.2+zstd.1.5.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91e19ebc2adc8f83e43039e79776e3fda8ca919132d68a1fed6a5faca2683748"
+checksum = "481ada9c543b2323cbb7bbdbb5249177fbf0188ed959ed2c15e4b22421c84ed3"
 dependencies = [
  "cc",
  "pkg-config",
diff --git a/desktop/src-tauri/Cargo.toml b/desktop/src-tauri/Cargo.toml
index fdff759d0f..41f3d4d4ac 100644
--- a/desktop/src-tauri/Cargo.toml
+++ b/desktop/src-tauri/Cargo.toml
@@ -139,7 +139,7 @@ png = "0.18"
 # target-gated inside arboard; at runtime X11 sessions still fall back to X11.
 arboard = { version = "3", features = ["wayland-data-control"] }
 image = { version = "0.25", default-features = false, features = ["jpeg", "png", "webp", "gif"] }
-zip = "8"
+zip = "9"
 flate2 = "1"
 sherpa-onnx = "1.12"
 regex = "1"
diff --git a/desktop/src-tauri/src/commands/agent_discovery/managed_node.rs b/desktop/src-tauri/src/commands/agent_discovery/managed_node.rs
index fbfb068c0e..fdb2999a48 100644
--- a/desktop/src-tauri/src/commands/agent_discovery/managed_node.rs
+++ b/desktop/src-tauri/src/commands/agent_discovery/managed_node.rs
@@ -472,7 +472,8 @@ fn validate_managed_node_zip_entries(
     for i in 0..archive.len() {
         let name = archive
             .name_for_index(i)
-            .ok_or_else(|| format!("Node.js zip entry {i}: missing name"))?;
+            .ok_or_else(|| format!("Node.js zip entry {i}: missing name"))?
+            .map_err(|e| format!("Node.js zip entry {i}: invalid name: {e}"))?;
 
         // Absolute-path checks (platform-neutral).
         if name.starts_with('/') || name.starts_with('\\') {
@@ -509,7 +510,7 @@ fn extract_managed_node_zip(
             None => {
                 return Err(format!(
                     "Node.js zip contains unsafe path: {}",
-                    entry.name()
+                    String::from_utf8_lossy(entry.name_raw())
                 ))
             }
         };
diff --git a/desktop/src/features/messages/ui/MessageTimeline.tsx b/desktop/src/features/messages/ui/MessageTimeline.tsx
index b293be252a..cecb291883 100644
--- a/desktop/src/features/messages/ui/MessageTimeline.tsx
+++ b/desktop/src/features/messages/ui/MessageTimeline.tsx
@@ -432,6 +432,21 @@ const MessageTimelineBase = React.forwardRef<
     },
     [onVirtualizerAtBottomStateChange, queueSemanticBottom],
   );
+  const hasPendingLiveRows = bufferedTimeline.pendingCount > 0;
+  React.useEffect(() => {
+    // With nothing buffered, the freeze is a model no-op, so the synthetic
+    // bottom report the suppression waits for never arrives. Disarm it, and
+    // release if the reader already came back, so a single scroll back to
+    // the floor (scrollbar jump, End key) does not strand the tail frozen.
+    if (isSemanticallyAtBottom || hasPendingLiveRows) return;
+    suppressNextSemanticBottomRef.current = false;
+    if (isAtBottom) queueSemanticBottom(true);
+  }, [
+    hasPendingLiveRows,
+    isAtBottom,
+    isSemanticallyAtBottom,
+    queueSemanticBottom,
+  ]);
 
   const timelineIntroSurface = showTimelineError
     ? null
diff --git a/desktop/tests/e2e/virtualization.spec.ts b/desktop/tests/e2e/virtualization.spec.ts
index adc23fdb84..463096ce7b 100644
--- a/desktop/tests/e2e/virtualization.spec.ts
+++ b/desktop/tests/e2e/virtualization.spec.ts
@@ -926,3 +926,52 @@ test("live tail arrivals stay buffered while reading and release on jump", async
   await page.getByTestId("message-scroll-to-latest").click();
   await expect(page.getByText("buffered live tail sentinel")).toBeVisible();
 });
+
+test("a single scroll back to the bottom releases the live tail", async ({
+  page,
+}) => {
+  await installMockBridge(page);
+  await page.goto("/");
+  await page.waitForFunction(
+    () => typeof window.__BUZZ_E2E_EMIT_MOCK_MESSAGE__ === "function",
+  );
+  await page.evaluate(() => {
+    for (let index = 0; index < 20; index += 1) {
+      window.__BUZZ_E2E_EMIT_MOCK_MESSAGE__?.({
+        channelName: "general",
+        content: `single-return seed ${index}\nsecond line ${index}`,
+        createdAt: 1_700_000_000 + index,
+      });
+    }
+  });
+  await page.getByTestId("channel-general").click();
+  const timeline = page.getByTestId("message-timeline");
+  await expect(timeline).toContainText("single-return seed 19");
+  const distanceFromBottom = () =>
+    timeline.evaluate(
+      (element) =>
+        element.scrollHeight - element.clientHeight - element.scrollTop,
+    );
+  await expect.poll(distanceFromBottom).toBeLessThanOrEqual(1);
+
+  // Leave the bottom, then come back in one native scroll event, as a
+  // scrollbar jump, End key, or Playwright's scroll-into-view retry does.
+  await timeline.evaluate((element) => {
+    element.scrollTop -= 150;
+  });
+  await expect(page.getByTestId("message-scroll-to-latest")).toBeVisible();
+  await timeline.evaluate((element) => {
+    element.scrollTop = element.scrollHeight;
+  });
+  await expect(page.getByTestId("message-scroll-to-latest")).toHaveCount(0);
+
+  await page.evaluate(() => {
+    window.__BUZZ_E2E_EMIT_MOCK_MESSAGE__?.({
+      channelName: "general",
+      content: "single-return live sentinel",
+      createdAt: 1_800_000_000,
+    });
+  });
+  await expect(page.getByText("single-return live sentinel")).toBeVisible();
+  await expect(page.getByTestId("message-scroll-to-latest")).toHaveCount(0);
+});
diff --git a/docs/admin/README.md b/docs/admin/README.md
index 12fb236e5a..2ffe30f1be 100644
--- a/docs/admin/README.md
+++ b/docs/admin/README.md
@@ -48,6 +48,13 @@ RELAY_OPERATOR_PUBKEYS=<64-char hex pubkey>[,<64-char hex pubkey>...]
   with a `WARN` and provisioning requests fail closed at request time until the
   origin is set — the admin console is unaffected.
 
+`GET /operator/communities/joined?member_pubkey=<64-char hex pubkey>` returns
+active memberships for an operator-selected identity, excluding archived and
+deleting communities. Like the provisioning routes, it requires the configured
+operator origin and an allowlisted NIP-98 signature over the full request URL.
+The relay authenticates the operator, not a Builderlab end-user session; the
+operator is responsible for choosing the appropriate member pubkey.
+
 #### Auto-discovery via NIP-11
 
 When `BUZZ_ADMIN_HOST` is set, the relay advertises the admin API origin in its
diff --git a/docs/formal/nip-pl/delivery.py b/docs/formal/nip-pl/delivery.py
index 2c8c5ac350..39a1ca9d34 100644
--- a/docs/formal/nip-pl/delivery.py
+++ b/docs/formal/nip-pl/delivery.py
@@ -7,7 +7,7 @@ transient release, revocation ordering, custody, and the constant APNs body.
 """
 from itertools import permutations, product
 
-FIXED_BODY = b'{"aps":{"alert":{"body":"Reconnect to your relay now"},"mutable-content":1}}'
+FIXED_BODY = b'{"aps":{"alert":{"body":"Reconnect to your relay now"},"sound":"default","mutable-content":1}}'
 
 class Gateway:
     def __init__(self):
diff --git a/docs/formal/nip-pl/fixed_payload.py b/docs/formal/nip-pl/fixed_payload.py
index e69af9c434..5b424cd21f 100644
--- a/docs/formal/nip-pl/fixed_payload.py
+++ b/docs/formal/nip-pl/fixed_payload.py
@@ -5,7 +5,7 @@ caller-controlled or capability-derived category; none is an argument to body().
 """
 from itertools import product
 
-C = b'{"aps":{"alert":{"body":"Reconnect to your relay now"},"mutable-content":1}}'
+C = b'{"aps":{"alert":{"body":"Reconnect to your relay now"},"sound":"default","mutable-content":1}}'
 DOMAINS = [
     (b"request-a", b"request-b"),        # exact signed body
     (b"auth-a", b"auth-b"),              # NIP-98 event/header
diff --git a/docs/nips/NIP-CL.md b/docs/nips/NIP-CL.md
index 662e88fa94..b7c415a73d 100644
--- a/docs/nips/NIP-CL.md
+++ b/docs/nips/NIP-CL.md
@@ -186,9 +186,52 @@ a system channel stays an ordinary NIP-29 group.
 The relay decides this for each filter. A filter that names a system channel
 does not add it to another filter in the same request.
 
-The relay MUST NOT send push notifications or kind:44100/44101 membership
-notifications for system channels. A client that received one would show the
-channel.
+The relay MUST NOT send push notifications for system channels.
+
+### Membership notices carry the channel type
+
+Every kind:44100 (added) and kind:44101 (removed) notice has one more tag,
+`["t", <channel_type>]`, for example `["t", "stream"]` or `["t", "system"]`.
+The relay sets it from the channel type when it sends the notice. A channel's
+type does not change. The relay stores the notice like any other 44100/44101.
+
+A client sees a notice only if it knows the notice's channel type. Old
+clients do not know types added later, such as `system`, and would show the
+channel from such a notice. So the relay MUST apply this rule:
+
+- **A filter with `#t`** matches a notice only when the notice's type is one
+  of the `#t` values.
+- **A filter without `#t`** matches a notice only when its type is one of the
+  **legacy types**: `stream`, `forum`, `dm`, `workflow`. This list is fixed.
+  A type added later is never on it, so old clients never see its notices.
+- **A notice without a `t` tag** was stored before this rule. Every such
+  notice is about a legacy type, so the relay treats it as all of them: it
+  matches a filter without `#t`, and a filter whose `#t` has a legacy type.
+  On these two kinds, this replaces the plain NIP-01 `#t` match.
+
+The rule applies on every path: REQ history, live delivery, COUNT, and any
+relay-specific query API. Existing clients do not send `#t` on these kinds,
+so they see no change.
+
+A client that knows every current type sends one filter:
+
+```json
+{"kinds": [44100, 44101], "#p": ["<me>"], "#t": ["stream", "forum", "dm", "workflow", "system"]}
+```
+
+When Buzz adds a type, a client adds its value to `#t` when it supports that
+type.
+
+The `#p` rule for 44100/44101 still applies: it must be the reader's own
+pubkey. An `ids` filter does not lift it: the relay returns, counts or
+delivers a 44100/44101 only to the pubkey in its `p` tag, even to a reader
+who knows the event id.
+
+Because the notices are stored, a client that reconnects can set `since` to
+the newest notice it has seen. One subscription then returns the notices it
+missed and the new ones, so no change falls between a read and a
+subscription. A notice is a hint: the channel's group-state events decide
+membership.
 
 ### Asking for system channels
 
diff --git a/docs/nips/NIP-PL.md b/docs/nips/NIP-PL.md
index 1ee9ed2f16..38ee0eca4c 100644
--- a/docs/nips/NIP-PL.md
+++ b/docs/nips/NIP-PL.md
@@ -224,7 +224,7 @@ Common invariant, all transports: the application payload is a transport-owned r
 
 ### APNs
 
-The APNs application body is the exact UTF-8 byte constant `{"aps":{"alert":{"body":"Reconnect to your relay now"},"mutable-content":1}}`. It has no custom member, event identifier, unread count, or relay-supplied byte. The constant mutable-content flag lets the Buzz Notification Service Extension compute a local badge and, when separately authorized data is available, replace the generic text; the gateway does not carry that data. The gateway MUST send that exact body for every accepted APNs attempt; it MUST NOT serialize any relay request, endpoint grant, provider response, or generic JSON value into the body. `apns-topic`, environment, credentials, push type `alert`, and priority `10` come only from gateway configuration. `apns-id` is a canonical UUID and `apns-expiration` is bounded by the endpoint capability and a gateway-local ceiling.
+The APNs application body is the exact UTF-8 byte constant `{"aps":{"alert":{"body":"Reconnect to your relay now"},"sound":"default","mutable-content":1}}`. It has no custom member, event identifier, unread count, or relay-supplied byte. The constant sound requests the system default alert sound, subject to notification authorization and user sound, Focus, and haptics settings. It does not select critical alerts or guarantee vibration. Sound is present even when the Notification Service Extension does not run. The constant mutable-content flag lets the Buzz Notification Service Extension compute a local badge and, when separately authorized data is available, replace the generic text; the gateway does not carry that data. The gateway MUST send that exact body for every accepted APNs attempt; it MUST NOT serialize any relay request, endpoint grant, provider response, or generic JSON value into the body. `apns-topic`, environment, credentials, push type `alert`, and priority `10` come only from gateway configuration. `apns-id` is a canonical UUID and `apns-expiration` is bounded by the endpoint capability and a gateway-local ceiling.
 
 ### FCM
 
diff --git a/docs/operator-nip-fi-bindings.md b/docs/operator-nip-fi-bindings.md
index f5c77be0a0..f63c73e755 100644
--- a/docs/operator-nip-fi-bindings.md
+++ b/docs/operator-nip-fi-bindings.md
@@ -36,6 +36,29 @@ binds nothing.
 relay's environment: `BUZZ_NIP_FI_PROVISION_BINDING`, `BUZZ_NIP_FI_ISSUERS`,
 `BUZZ_NIP_FI_COMMUNITIES`, and `DATABASE_URL`.
 
+### Database community source
+
+`BUZZ_NIP_FI_COMMUNITY_SOURCE=database` resolves communities from these
+bindings instead of `BUZZ_NIP_FI_COMMUNITIES`. The relay refuses to start if
+`BUZZ_NIP_FI_PROVISION_BINDING` is unset or `BUZZ_NIP_FI_COMMUNITIES` is set.
+In `off` mode no snapshot is loaded.
+
+| Variable | Default | Bound |
+|----------|---------|-------|
+| `BUZZ_NIP_FI_COMMUNITY_SOURCE` | `env` | `env` or `database` |
+| `BUZZ_NIP_FI_SNAPSHOT_MAX_ROWS` | 1,000,000 | 1 to 10,000,000 community-issuer rows; a larger load fails |
+| `BUZZ_NIP_FI_SNAPSHOT_REFRESH_TIMEOUT_MS` | 10,000 | under the 30s refresh interval |
+| `BUZZ_NIP_FI_RESOLVER_NEGATIVE_CACHE_MAX` | 100,000 | 1 to 1,000,000 hosts |
+| `BUZZ_NIP_FI_RESOLVER_MAX_INFLIGHT` | 8 | at least 1, clamped below the database pool size |
+
+Each pod loads a snapshot before it binds any listener, and refreshes it
+every 30s. A removed binding stops admitting new connections within 30s plus
+the configured refresh timeout (40s by default) while refreshes succeed, and within two minutes of the last good load while they
+fail. Open WebSocket sessions are not rechecked when a binding is removed;
+they end at their own session deadline. Alert on
+`time() - buzz_nip_fi_binding_snapshot_loaded_timestamp_seconds > 120` and on
+`absent(buzz_nip_fi_binding_snapshot_loaded_timestamp_seconds)`.
+
 ## Commands
 
 ```sh
@@ -95,3 +118,98 @@ contract:
    it exits 0.
 3. Do not turn on the database binding source in enforce mode while any
    bindable community is unbound: an unbound community fails closed.
+
+## Database source runbook
+
+`BUZZ_NIP_FI_COMMUNITY_SOURCE=database` reads communities from these bindings
+instead of `BUZZ_NIP_FI_COMMUNITIES`. Move one mode at a time, and only move
+forward when the step's go signals hold.
+
+### Off
+
+Set `BUZZ_NIP_FI_COMMUNITY_SOURCE=database` with `BUZZ_NIP_FI_MODE=off`. No
+snapshot loads in `off`, but every `BUZZ_NIP_FI_RESOLVER_*` and
+`BUZZ_NIP_FI_SNAPSHOT_*` value is validated, so a bad one fails this deploy.
+
+- Go: the rollout completes, and `buzz-admin nip-fi backfill` exits 0.
+- No-go: a pod fails config validation. Fix the named variable.
+
+### Shadow
+
+Set `BUZZ_NIP_FI_MODE=shadow`. Each pod now loads the snapshot before any
+listener binds, refreshes it every 30 s, and records what enforce would decide
+without refusing anything. Shadow labels database-source records
+`community="bound"` or `"unmapped"`, never a host.
+
+- Go, held for at least a day of normal traffic:
+  - `time() - buzz_nip_fi_binding_snapshot_loaded_timestamp_seconds` stays
+    under 60 on every pod.
+  - `buzz_nip_fi_binding_snapshot_load_failures_total` is flat.
+  - `buzz_nip_fi_binding_snapshot_rows / buzz_nip_fi_binding_snapshot_max_rows`
+    is under 0.5.
+  - `buzz_nip_fi_resolver_miss_rejections_total` is flat.
+  - The non-`admit` share of `buzz_nip_fi_shadow_total` is only what you expect
+    to deny; `community="unmapped"` comes only from hosts you do not serve.
+- No-go: any of these fails. Return to `off` and investigate.
+
+### Enforce
+
+Set `BUZZ_NIP_FI_MODE=enforce`. Watch the same signals, plus the rate of 503
+responses on login.
+
+- Go: the shadow signals keep holding, and 503s stay at their shadow baseline.
+- No-go: logins return 503 or are refused unexpectedly. Set `mode=off` (below).
+
+### Alerts
+
+- Stale snapshot: `time() - buzz_nip_fi_binding_snapshot_loaded_timestamp_seconds > 120`,
+  together with `absent(buzz_nip_fi_binding_snapshot_loaded_timestamp_seconds)`
+  for a database-source pod.
+- Near the row cap: `buzz_nip_fi_binding_snapshot_rows / buzz_nip_fi_binding_snapshot_max_rows > 0.8`.
+  `buzz_nip_fi_binding_snapshot_rows` is the size of the last good load.
+- Over the cap or too slow: any increase of
+  `buzz_nip_fi_binding_snapshot_load_failures_total{reason=~"over_cap|timeout"}`.
+- Live lookups shed: any increase of `buzz_nip_fi_resolver_miss_rejections_total`.
+
+### When the snapshot is too big or too slow
+
+A load fails when the snapshot has more rows than
+`BUZZ_NIP_FI_SNAPSHOT_MAX_ROWS` or takes longer than
+`BUZZ_NIP_FI_SNAPSHOT_REFRESH_TIMEOUT_MS`. Both get worse as communities are
+added, so they usually arrive during normal growth, not at a deploy.
+
+- New pods: the startup load fails and the process exits, so new pods
+  crash-loop and a rollout stalls. Boot already fails when the database is
+  unreachable; what this source adds is that snapshot size and load time can
+  also fail it.
+- Running pods: their refreshes fail but the last good snapshot keeps
+  answering. Once it is 120 s old it is stale, and every login's host goes to
+  a live lookup. Live lookups share `BUZZ_NIP_FI_RESOLVER_MAX_INFLIGHT` slots
+  (8 by default). Concurrent logins for the same host share one lookup, and a
+  login waits up to 50 ms for a free slot; how many are shed depends on login
+  load across distinct hosts and on lookup latency. In enforce, a shed login
+  gets 503 (`authorization_unavailable`); in shadow it
+  is only recorded as a would-deny.
+
+Ways out, in order:
+
+1. Raise `BUZZ_NIP_FI_SNAPSHOT_MAX_ROWS` (up to 10,000,000) or
+   `BUZZ_NIP_FI_SNAPSHOT_REFRESH_TIMEOUT_MS` (under 30,000), whichever the
+   failure `reason` names, and roll out.
+2. If that cannot land quickly, set `BUZZ_NIP_FI_MODE=off`. `off` loads no
+   snapshot, so pods boot and admit as they did before NIP-FI.
+
+## Assertion policy ID change
+
+This release changes every verified assertion's policy ID once, on purpose.
+The base ID (`derive_assertion_policy_id` in `crates/buzz-auth/src/nip_fi/config.rs`)
+no longer hashes the configured community audiences. The ID carried on a
+verified assertion is now `IssuerPolicy::id_for_community`: a hash of that base
+and the one community audience the request resolved to. The issuer is still
+committed through the base.
+
+Policy IDs from earlier releases therefore do not match. Inside the relay the ID
+is only carried on the verified assertion and never compared with a stored ID, so
+admission is unaffected. Anything outside the relay that recorded old policy IDs,
+such as dashboards, log queries or allow-lists, should expect new values after
+the upgrade.
diff --git a/mobile/README.md b/mobile/README.md
index c2e7e6f4aa..af91cf591f 100644
--- a/mobile/README.md
+++ b/mobile/README.md
@@ -5,6 +5,36 @@ Flutter mobile client for Buzz.
 See [VISION_MOBILE.md](../VISION_MOBILE.md) for intended behavior and
 architecture.
 
+## Optional Builderlab login
+
+`BUZZ_AUTH_DOMAINS` is a comma-separated build-time environment setting, passed
+with Flutter's `--dart-define` (shell environment variables alone are not read):
+
+```bash
+flutter run --dart-define=BUZZ_AUTH_DOMAINS=communities.buzz.xyz,communities.public.builderlabstaging.xyz
+```
+
+Unset or empty means **Builderlab features are disabled**: no account login,
+community creation, backup/recovery UI, reconnect prompts, or background account
+restoration. QR/code pairing, community links and invites use Nostr-only entry.
+Saved account keys and sessions are retained for a later enabled build.
+
+A nonempty list enables Builderlab features and requires account setup only for
+matching domains. Those features need their backend endpoints. Normal relay key
+authentication remains in place. `BUZZ_BUILDERLAB_URL` selects the backend; setting
+it alone does not enable Builderlab features.
+
+Entries match the domain itself and its subdomains, case-insensitively. Use DNS
+names, not URLs or wildcards. The list does not add trusted account servers:
+configured domains outside the supported Builderlab realm cannot use hosted
+setup. `BUZZ_BUILDERLAB_URL` still selects the trusted account environment.
+
+## Hosted relay authentication
+
+`--dart-define=BUZZ_HOSTED_RELAY_AUTH=true` enables Builderlab relay assertions
+and reconnect sign-in **only for `BUZZ_AUTH_DOMAINS` matches**. It defaults off: configure backend assertion issuance
+before enabling mobile authentication, and enable relay enforcement last.
+
 ## Setup
 
 Use the Flutter SDK pinned by the repository. Activate Hermit from the repo
diff --git a/mobile/analysis_options.yaml b/mobile/analysis_options.yaml
index 37b3985d79..dfe6827218 100644
--- a/mobile/analysis_options.yaml
+++ b/mobile/analysis_options.yaml
@@ -4,6 +4,8 @@ analyzer:
   plugins:
     - custom_lint
   errors:
+    # riverpod_lint 3.1 uses custom_lint, which still requires legacy plugins.
+    analysis_options_deprecated_plugins: ignore
     invalid_use_of_visible_for_overriding_member: ignore
   exclude:
     - build/**
diff --git a/mobile/android/app/src/main/AndroidManifest.xml b/mobile/android/app/src/main/AndroidManifest.xml
index 9121acbc15..ff71d174f7 100644
--- a/mobile/android/app/src/main/AndroidManifest.xml
+++ b/mobile/android/app/src/main/AndroidManifest.xml
@@ -18,7 +18,10 @@
     <application
         android:label="@string/app_name"
         android:name="${applicationName}"
-        android:icon="@mipmap/ic_launcher">
+        android:icon="@mipmap/ic_launcher"
+        android:fullBackupContent="@xml/backup_rules"
+        android:dataExtractionRules="@xml/data_extraction_rules"
+        tools:targetApi="31">
         <activity
             android:name=".MainActivity"
             android:exported="true"
@@ -47,6 +50,13 @@
                 <category android:name="android.intent.category.BROWSABLE"/>
                 <data android:scheme="buzz"/>
             </intent-filter>
+            <!-- Auth callbacks have an independent Dart consumer and PKCE state. -->
+            <intent-filter>
+                <action android:name="android.intent.action.VIEW"/>
+                <category android:name="android.intent.category.DEFAULT"/>
+                <category android:name="android.intent.category.BROWSABLE"/>
+                <data android:scheme="xyz.block.buzz.mobile"/>
+            </intent-filter>
             <!-- Disable Flutter's built-in deeplink handler; app_links owns
                  incoming URLs so they can be routed with app state in Dart. -->
             <meta-data
diff --git a/mobile/android/app/src/main/kotlin/xyz/block/buzz/mobile/HostedHpkeBackup.kt b/mobile/android/app/src/main/kotlin/xyz/block/buzz/mobile/HostedHpkeBackup.kt
new file mode 100644
index 0000000000..6c4b40248c
--- /dev/null
+++ b/mobile/android/app/src/main/kotlin/xyz/block/buzz/mobile/HostedHpkeBackup.kt
@@ -0,0 +1,136 @@
+package xyz.block.buzz.mobile
+
+import java.math.BigInteger
+import java.security.AlgorithmParameters
+import java.security.KeyFactory
+import java.security.KeyPair
+import java.security.KeyPairGenerator
+import java.security.interfaces.ECPublicKey
+import java.security.spec.ECGenParameterSpec
+import java.security.spec.ECParameterSpec
+import java.security.spec.ECPoint
+import java.security.spec.ECPublicKeySpec
+import javax.crypto.Cipher
+import javax.crypto.KeyAgreement
+import javax.crypto.Mac
+import javax.crypto.spec.GCMParameterSpec
+import javax.crypto.spec.SecretKeySpec
+
+/** RFC 9180 base mode, DHKEM(P-256, HKDF-SHA256), HKDF-SHA256, AES-256-GCM.
+ * Enrollment and AAD must come from the authenticated hosted coordinator.
+ * Only JCA platform primitives are used; this is a single-message sender.
+ */
+internal object HostedHpkeBackup {
+    private val kemSuite = "KEM".toByteArray() + byteArrayOf(0, 16)
+    private val suite = "HPKE".toByteArray() + byteArrayOf(0, 16, 0, 1, 0, 2)
+    private val version = "HPKE-v1".toByteArray()
+    private val info = "buzz/nsec-backup/v1".toByteArray()
+    private val curve: ECParameterSpec
+        get() = AlgorithmParameters.getInstance("EC").apply {
+            init(ECGenParameterSpec("secp256r1"))
+        }.getParameterSpec(ECParameterSpec::class.java)
+
+    fun seal(recipient: ByteArray, plaintext: ByteArray, aad: ByteArray): Map<String, ByteArray> {
+        require(plaintext.size == 32 && aad.isNotEmpty())
+        val ephemeral = KeyPairGenerator.getInstance("EC").apply {
+            initialize(ECGenParameterSpec("secp256r1"))
+        }.generateKeyPair()
+        return sealBase(recipient, plaintext, aad, info, ephemeral)
+    }
+
+    // Internal seam for the RFC known-answer vector. The channel only calls seal,
+    // which fixes the protocol info and always generates a fresh ephemeral key.
+    internal fun sealBase(
+        recipient: ByteArray,
+        plaintext: ByteArray,
+        aad: ByteArray,
+        info: ByteArray,
+        ephemeral: KeyPair,
+    ): Map<String, ByteArray> {
+        val publicKey = decodePublicKey(recipient)
+        val enc = encodePublicKey(ephemeral.public as ECPublicKey)
+        val dh = KeyAgreement.getInstance("ECDH").run {
+            init(ephemeral.private)
+            doPhase(publicKey, true)
+            generateSecret()
+        }
+        var shared = ByteArray(0)
+        var secret = ByteArray(0)
+        var key = ByteArray(0)
+        try {
+            val eae = extract(kemSuite, ByteArray(0), "eae_prk", dh)
+            try {
+                shared = expand(kemSuite, eae, "shared_secret", enc + recipient, 32)
+            } finally {
+                eae.fill(0)
+            }
+            val context = byteArrayOf(0) +
+                extract(suite, ByteArray(0), "psk_id_hash", ByteArray(0)) +
+                extract(suite, ByteArray(0), "info_hash", info)
+            secret = extract(suite, shared, "secret", ByteArray(0))
+            key = expand(suite, secret, "key", context, 32)
+            val nonce = expand(suite, secret, "base_nonce", context, 12)
+            // Sequence number is zero: the first and only seal in this context.
+            val ciphertext = Cipher.getInstance("AES/GCM/NoPadding").run {
+                init(Cipher.ENCRYPT_MODE, SecretKeySpec(key, "AES"), GCMParameterSpec(128, nonce))
+                updateAAD(aad)
+                doFinal(plaintext)
+            }
+            return mapOf("enc" to enc, "ciphertext" to ciphertext)
+        } finally {
+            dh.fill(0)
+            shared.fill(0)
+            secret.fill(0)
+            key.fill(0)
+        }
+    }
+
+    internal fun decodePublicKey(encoded: ByteArray): ECPublicKey {
+        require(encoded.size == 65 && encoded[0] == 4.toByte())
+        val parameters = curve
+        val x = BigInteger(1, encoded.copyOfRange(1, 33))
+        val y = BigInteger(1, encoded.copyOfRange(33, 65))
+        val p = (parameters.curve.field as java.security.spec.ECFieldFp).p
+        // Validate the SEC1 point ourselves: provider validation differs by API.
+        require(x < p && y < p)
+        require(y.multiply(y).mod(p) ==
+            x.multiply(x).multiply(x).add(parameters.curve.a.multiply(x))
+                .add(parameters.curve.b).mod(p))
+        return KeyFactory.getInstance("EC").generatePublic(
+            ECPublicKeySpec(ECPoint(x, y), parameters),
+        ) as ECPublicKey
+    }
+
+    private fun encodePublicKey(key: ECPublicKey): ByteArray {
+        fun coordinate(value: BigInteger): ByteArray {
+            val bytes = value.toByteArray()
+            return ByteArray(32).also {
+                val length = minOf(bytes.size, 32)
+                bytes.copyInto(it, 32 - length, bytes.size - length)
+            }
+        }
+        return byteArrayOf(4) + coordinate(key.w.affineX) + coordinate(key.w.affineY)
+    }
+
+    private fun hmac(key: ByteArray, data: ByteArray): ByteArray =
+        Mac.getInstance("HmacSHA256").run {
+            init(SecretKeySpec(if (key.isEmpty()) ByteArray(32) else key, "HmacSHA256"))
+            doFinal(data)
+        }
+
+    private fun extract(suite: ByteArray, salt: ByteArray, label: String, input: ByteArray): ByteArray {
+        val labeledInput = version + suite + label.toByteArray() + input
+        return try { hmac(salt, labeledInput) } finally { labeledInput.fill(0) }
+    }
+
+    private fun expand(
+        suite: ByteArray, prk: ByteArray, label: String, context: ByteArray, length: Int,
+    ): ByteArray {
+        // Every output in this fixed suite is at most one SHA-256 block.
+        require(length in 1..32)
+        val labeledInfo = byteArrayOf(0, length.toByte()) + version + suite +
+            label.toByteArray() + context
+        val block = hmac(prk, labeledInfo + byteArrayOf(1))
+        return try { block.copyOf(length) } finally { block.fill(0) }
+    }
+}
diff --git a/mobile/android/app/src/main/kotlin/xyz/block/buzz/mobile/HostedHpkePlugin.kt b/mobile/android/app/src/main/kotlin/xyz/block/buzz/mobile/HostedHpkePlugin.kt
new file mode 100644
index 0000000000..ab7fc3d84f
--- /dev/null
+++ b/mobile/android/app/src/main/kotlin/xyz/block/buzz/mobile/HostedHpkePlugin.kt
@@ -0,0 +1,37 @@
+package xyz.block.buzz.mobile
+
+import io.flutter.plugin.common.BinaryMessenger
+import io.flutter.plugin.common.MethodCall
+import io.flutter.plugin.common.MethodChannel
+
+/** Native sealing bridge; never returns plaintext or provider error details. */
+internal class HostedHpkePlugin(messenger: BinaryMessenger) : MethodChannel.MethodCallHandler {
+    private val channel = MethodChannel(
+        messenger, "buzz/hosted_hpke", io.flutter.plugin.common.StandardMethodCodec.INSTANCE,
+        messenger.makeBackgroundTaskQueue(),
+    ).apply { setMethodCallHandler(this@HostedHpkePlugin) }
+
+    override fun onMethodCall(call: MethodCall, result: MethodChannel.Result) {
+        if (call.method != "seal") {
+            result.notImplemented()
+            return
+        }
+        val arguments = call.arguments as? Map<*, *>
+        val plaintext = arguments?.get("plaintext") as? ByteArray
+        try {
+            val recipient = arguments?.get("recipient") as? ByteArray
+            val aad = arguments?.get("aad") as? ByteArray
+            if (recipient == null || plaintext == null || aad == null) {
+                result.error("invalid_input", null, null)
+                return
+            }
+            result.success(HostedHpkeBackup.seal(recipient, plaintext, aad))
+        } catch (_: Exception) {
+            result.error("backup_unavailable", null, null)
+        } finally {
+            plaintext?.fill(0)
+        }
+    }
+
+    fun dispose() { channel.setMethodCallHandler(null) }
+}
diff --git a/mobile/android/app/src/main/kotlin/xyz/block/buzz/mobile/IdentityFilePlugin.kt b/mobile/android/app/src/main/kotlin/xyz/block/buzz/mobile/IdentityFilePlugin.kt
new file mode 100644
index 0000000000..6ac3004851
--- /dev/null
+++ b/mobile/android/app/src/main/kotlin/xyz/block/buzz/mobile/IdentityFilePlugin.kt
@@ -0,0 +1,122 @@
+package xyz.block.buzz.mobile
+
+import android.app.Activity
+import android.content.Intent
+import android.net.Uri
+import io.flutter.plugin.common.BinaryMessenger
+import io.flutter.plugin.common.MethodCall
+import io.flutter.plugin.common.MethodChannel
+import java.util.concurrent.Executors
+
+/** Transfers identity files directly through the document picker, never cache. */
+internal class IdentityFilePlugin(
+    private val activity: Activity,
+    messenger: BinaryMessenger,
+) : MethodChannel.MethodCallHandler {
+    private val channel = MethodChannel(messenger, "buzz/identity_file")
+        .apply { setMethodCallHandler(this@IdentityFilePlugin) }
+    private val worker = Executors.newSingleThreadExecutor()
+    private class Request(val result: MethodChannel.Result, val importing: Boolean, var bytes: ByteArray?) {
+        val failure get() = if (importing) "import_failed" else "export_failed"
+    }
+    private var pending: Request? = null
+
+    override fun onMethodCall(call: MethodCall, result: MethodChannel.Result) {
+        if (call.method != "export" && call.method != "import") {
+            result.notImplemented()
+            return
+        }
+        if (pending != null) {
+            result.error(if (call.method == "import") "import_busy" else "export_busy", null, null)
+            return
+        }
+        val importing = call.method == "import"
+        val args = call.arguments as? Map<*, *>
+        val text = args?.get("text") as? String
+        val name = args?.get("name") as? String
+        if (!importing && (text == null || text.length !in 1..1024 || name == null ||
+            !name.matches(Regex("[A-Za-z0-9._-]{1,80}")))) {
+            result.error("invalid_input", null, null)
+            return
+        }
+        pending = Request(result, importing, if (importing) null else text!!.toByteArray(Charsets.UTF_8))
+        try {
+            activity.startActivityForResult(Intent(
+                if (importing) Intent.ACTION_OPEN_DOCUMENT else Intent.ACTION_CREATE_DOCUMENT,
+            ).apply {
+                addCategory(Intent.CATEGORY_OPENABLE)
+                // Exported .nsec files may be classified as application/octet-stream.
+                type = if (importing) "*/*" else "text/plain"
+                if (!importing) putExtra(Intent.EXTRA_TITLE, name)
+            }, REQUEST_CODE)
+        } catch (_: Exception) {
+            finishFailure()
+        }
+    }
+
+    fun onActivityResult(requestCode: Int, resultCode: Int, data: Intent?): Boolean {
+        if (requestCode != REQUEST_CODE) return false
+        val request = pending ?: return true
+        if (resultCode != Activity.RESULT_OK) {
+            clear()
+            request.result.success(if (request.importing) null else false)
+            return true
+        }
+        val uri: Uri = data?.data ?: run {
+            finishFailure()
+            return true
+        }
+        // Keep pending set until completion, preventing overlapping transfers.
+        val content = request.bytes
+        request.bytes = null
+        worker.execute {
+            var value: Any? = null
+            val successful = try {
+                if (request.importing) {
+                    val input = activity.contentResolver.openInputStream(uri)
+                        ?: throw IllegalStateException("Document unavailable")
+                    value = IdentityFileReader.read(input)
+                } else {
+                    requireNotNull(content)
+                    activity.contentResolver.openOutputStream(uri, "wt")?.use { it.write(content) }
+                        ?: throw IllegalStateException("Document unavailable")
+                    value = true
+                }
+                true
+            } catch (_: Exception) {
+                false
+            } finally {
+                content?.fill(0)
+            }
+            activity.runOnUiThread {
+                if (pending === request) {
+                    clear()
+                    if (successful) request.result.success(value)
+                    else request.result.error(request.failure, null, null)
+                }
+            }
+        }
+        return true
+    }
+
+    private fun clear() {
+        pending?.bytes?.fill(0)
+        pending = null
+    }
+
+    private fun finishFailure() {
+        val request = pending
+        clear()
+        request?.result?.error(request.failure, null, null)
+    }
+
+    fun dispose() {
+        channel.setMethodCallHandler(null)
+        finishFailure()
+        worker.shutdown()
+    }
+
+    companion object {
+        private const val REQUEST_CODE = 4627
+    }
+}
diff --git a/mobile/android/app/src/main/kotlin/xyz/block/buzz/mobile/IdentityFileReader.kt b/mobile/android/app/src/main/kotlin/xyz/block/buzz/mobile/IdentityFileReader.kt
new file mode 100644
index 0000000000..fb080e8657
--- /dev/null
+++ b/mobile/android/app/src/main/kotlin/xyz/block/buzz/mobile/IdentityFileReader.kt
@@ -0,0 +1,35 @@
+package xyz.block.buzz.mobile
+
+import java.io.InputStream
+import java.nio.ByteBuffer
+import java.nio.charset.CodingErrorAction
+
+/** Reads at most one KiB plus a sentinel byte, without a plaintext cache file. */
+internal object IdentityFileReader {
+    fun read(input: InputStream): String = input.use {
+        val buffer = ByteArray(1025)
+        try {
+            var length = 0
+            while (length < buffer.size) {
+                val count = input.read(buffer, length, buffer.size - length)
+                if (count < 0) break
+                if (count == 0) {
+                    // Defensive progress for providers that return zero for a
+                    // nonempty read; this still never reads past the sentinel.
+                    val byte = input.read()
+                    if (byte < 0) break
+                    buffer[length++] = byte.toByte()
+                } else {
+                    length += count
+                }
+            }
+            require(length <= 1024) { "Identity document exceeds size limit" }
+            Charsets.UTF_8.newDecoder()
+                .onMalformedInput(CodingErrorAction.REPORT)
+                .onUnmappableCharacter(CodingErrorAction.REPORT)
+                .decode(ByteBuffer.wrap(buffer, 0, length)).toString()
+        } finally {
+            buffer.fill(0)
+        }
+    }
+}
diff --git a/mobile/android/app/src/main/kotlin/xyz/block/buzz/mobile/MainActivity.kt b/mobile/android/app/src/main/kotlin/xyz/block/buzz/mobile/MainActivity.kt
index 8425affdb3..72a7da67d0 100644
--- a/mobile/android/app/src/main/kotlin/xyz/block/buzz/mobile/MainActivity.kt
+++ b/mobile/android/app/src/main/kotlin/xyz/block/buzz/mobile/MainActivity.kt
@@ -1,6 +1,7 @@
 package xyz.block.buzz.mobile
 
 
+import android.content.Intent
 import android.graphics.Bitmap
 import android.graphics.BitmapFactory
 import android.graphics.Canvas
@@ -131,9 +132,13 @@ class MainActivity : FlutterFragmentActivity() {
     private val ageSignalRequest = AgeSignalRequest()
     private var huddleMediaPlugin: HuddleMediaPlugin? = null
     private var hapticsPlugin: HapticsPlugin? = null
+    private var hostedHpkePlugin: HostedHpkePlugin? = null
+    private var identityFilePlugin: IdentityFilePlugin? = null
 
     override fun configureFlutterEngine(flutterEngine: FlutterEngine) {
         super.configureFlutterEngine(flutterEngine)
+        hostedHpkePlugin = HostedHpkePlugin(flutterEngine.dartExecutor.binaryMessenger)
+        identityFilePlugin = IdentityFilePlugin(this, flutterEngine.dartExecutor.binaryMessenger)
         hapticsPlugin = HapticsPlugin(this, flutterEngine.dartExecutor.binaryMessenger)
 
         huddleMediaPlugin = HuddleMediaPlugin(
@@ -194,6 +199,11 @@ class MainActivity : FlutterFragmentActivity() {
         }
     }
 
+    override fun onActivityResult(requestCode: Int, resultCode: Int, data: Intent?) {
+        super.onActivityResult(requestCode, resultCode, data)
+        identityFilePlugin?.onActivityResult(requestCode, resultCode, data)
+    }
+
     override fun onRequestPermissionsResult(
         requestCode: Int,
         permissions: Array<out String>,
@@ -204,6 +214,10 @@ class MainActivity : FlutterFragmentActivity() {
     }
 
     override fun onDestroy() {
+        identityFilePlugin?.dispose()
+        identityFilePlugin = null
+        hostedHpkePlugin?.dispose()
+        hostedHpkePlugin = null
         hapticsPlugin?.dispose()
         hapticsPlugin = null
         ageSignalRequest.retire()
diff --git a/mobile/android/app/src/main/res/xml/backup_rules.xml b/mobile/android/app/src/main/res/xml/backup_rules.xml
new file mode 100644
index 0000000000..72ecad2572
--- /dev/null
+++ b/mobile/android/app/src/main/res/xml/backup_rules.xml
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Android 11 and lower. Same exclusions as data_extraction_rules.xml. -->
+<full-backup-content>
+    <exclude domain="sharedpref" path="FlutterSecureStorage.xml"/>
+    <exclude domain="sharedpref" path="FlutterSecureKeyStorage.xml"/>
+    <exclude domain="sharedpref" path="FlutterSecureStorageConfiguration.xml"/>
+</full-backup-content>
diff --git a/mobile/android/app/src/main/res/xml/data_extraction_rules.xml b/mobile/android/app/src/main/res/xml/data_extraction_rules.xml
new file mode 100644
index 0000000000..8d14fc46fc
--- /dev/null
+++ b/mobile/android/app/src/main/res/xml/data_extraction_rules.xml
@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Android 12+. flutter_secure_storage data is encrypted with Android Keystore
+     keys that never leave the device, so a restored copy can't be decrypted
+     and would leave an unreadable identity behind. Other app data still
+     backs up and transfers as before. -->
+<data-extraction-rules>
+    <cloud-backup>
+        <exclude domain="sharedpref" path="FlutterSecureStorage.xml"/>
+        <exclude domain="sharedpref" path="FlutterSecureKeyStorage.xml"/>
+        <exclude domain="sharedpref" path="FlutterSecureStorageConfiguration.xml"/>
+    </cloud-backup>
+    <device-transfer>
+        <exclude domain="sharedpref" path="FlutterSecureStorage.xml"/>
+        <exclude domain="sharedpref" path="FlutterSecureKeyStorage.xml"/>
+        <exclude domain="sharedpref" path="FlutterSecureStorageConfiguration.xml"/>
+    </device-transfer>
+</data-extraction-rules>
diff --git a/mobile/android/app/src/test/kotlin/xyz/block/buzz/mobile/HostedHpkeBackupTest.kt b/mobile/android/app/src/test/kotlin/xyz/block/buzz/mobile/HostedHpkeBackupTest.kt
new file mode 100644
index 0000000000..cd63297a03
--- /dev/null
+++ b/mobile/android/app/src/test/kotlin/xyz/block/buzz/mobile/HostedHpkeBackupTest.kt
@@ -0,0 +1,59 @@
+package xyz.block.buzz.mobile
+
+import java.math.BigInteger
+import java.security.KeyFactory
+import java.security.KeyPair
+import java.security.spec.ECPrivateKeySpec
+import kotlin.test.Test
+import kotlin.test.assertContentEquals
+import kotlin.test.assertEquals
+import kotlin.test.assertFailsWith
+import kotlin.test.assertFalse
+
+class HostedHpkeBackupTest {
+    // RFC 9180 reference vectors: cfrg/draft-irtf-cfrg-hpke/test-vectors.json,
+    // mode=0, kem_id=16, kdf_id=1, aead_id=2, sequence number zero.
+    @Test fun `RFC 9180 base mode known answer`() {
+        val publicKey = HostedHpkeBackup.decodePublicKey(hex(
+            "04c06b4f6bebc7bb495cb797ab753f911aff80aefb86fd8b6fcc35525f3ab5f03e0b" +
+                "21bd31a86c6048af3cb2d98e0d3bf01da5cc4c39ff5370d331a4f1f7d5a4e0",
+        ))
+        val privateKey = KeyFactory.getInstance("EC").generatePrivate(ECPrivateKeySpec(
+            BigInteger("90345e3a1d116c1dd39ae76d95ab858c142223a63e44f8f85318cfa91a84858e", 16),
+            publicKey.params,
+        ))
+        val recipient = hex(
+            "04abc7e49a4c6b3566d77d0304addc6ed0e98512ffccf505e6a8e3eb25c685136f8" +
+                "53148544876de76c0f2ef99cdc3a05ccf5ded7860c7c021238f9e2073d2356c",
+        )
+        val result = HostedHpkeBackup.sealBase(
+            recipient, hex("4265617574792069732074727574682c20747275746820626561757479"),
+            hex("436f756e742d30"), hex("4f6465206f6e2061204772656369616e2055726e"),
+            KeyPair(publicKey, privateKey),
+        )
+        assertContentEquals(hex(
+            "58c61a45059d0c5704560e9d88b564a8b63f1364b8d1fcb3c4c6ddc1d291742465e902cd216f8908da49f8f96f",
+        ), result["ciphertext"])
+    }
+
+    @Test fun `backup sender validates input and generates fresh encapsulation`() {
+        val first = HostedHpkeBackup.seal(recipient, ByteArray(32) { 0x42 }, byteArrayOf(1))
+        val second = HostedHpkeBackup.seal(recipient, ByteArray(32) { 0x42 }, byteArrayOf(1))
+        assertEquals(65, first.getValue("enc").size)
+        assertEquals(48, first.getValue("ciphertext").size)
+        assertFalse(first.getValue("enc").contentEquals(second.getValue("enc")))
+        for (bad in listOf(ByteArray(65), recipient.copyOf(33), recipient.copyOf().apply { this[64] = 0 })) {
+            assertFailsWith<IllegalArgumentException> { HostedHpkeBackup.seal(bad, ByteArray(32), byteArrayOf(1)) }
+        }
+        assertFailsWith<IllegalArgumentException> { HostedHpkeBackup.seal(recipient, ByteArray(31), byteArrayOf(1)) }
+        assertFailsWith<IllegalArgumentException> { HostedHpkeBackup.seal(recipient, ByteArray(32), ByteArray(0)) }
+    }
+
+    companion object {
+        fun hex(value: String) = value.chunked(2).map { it.toInt(16).toByte() }.toByteArray()
+        val recipient = hex(
+            "04c5b6519400186a8e10abbdc05d3e450c8612e5dba06927091527110324acfb0371" +
+                "d98d662395d872fae967fe75ef24db20a7c2c1af19c34422d94f629b1b1dad",
+        )
+    }
+}
diff --git a/mobile/android/app/src/test/kotlin/xyz/block/buzz/mobile/HostedHpkePluginTest.kt b/mobile/android/app/src/test/kotlin/xyz/block/buzz/mobile/HostedHpkePluginTest.kt
new file mode 100644
index 0000000000..b28a8c0499
--- /dev/null
+++ b/mobile/android/app/src/test/kotlin/xyz/block/buzz/mobile/HostedHpkePluginTest.kt
@@ -0,0 +1,94 @@
+package xyz.block.buzz.mobile
+
+import io.flutter.plugin.common.BinaryMessenger
+import io.flutter.plugin.common.MethodChannel
+import io.flutter.plugin.common.MethodCall
+import io.flutter.plugin.common.StandardMethodCodec
+import java.nio.ByteBuffer
+import kotlin.test.Test
+import kotlin.test.assertContentEquals
+import kotlin.test.assertEquals
+import kotlin.test.assertNotNull
+import kotlin.test.assertNull
+
+class HostedHpkePluginTest {
+    @Test fun `registered channel seals and clears native plaintext`() {
+        val messenger = Messenger()
+        val plugin = HostedHpkePlugin(messenger)
+        assertEquals("buzz/hosted_hpke", messenger.channel)
+        assertNotNull(messenger.queue)
+        val secret = ByteArray(32) { 0x42 }
+        val reply = Reply()
+        plugin.onMethodCall(MethodCall("seal", mapOf(
+            "recipient" to HostedHpkeBackupTest.recipient, "plaintext" to secret, "aad" to byteArrayOf(1),
+        )), reply)
+        assertNull(reply.code)
+        val envelope = reply.value as Map<*, *>
+        assertEquals(65, (envelope["enc"] as ByteArray).size)
+        assertEquals(48, (envelope["ciphertext"] as ByteArray).size)
+        assertContentEquals(ByteArray(32), secret)
+        // Traverse the actual registered codec handler for a successful seal.
+        val encoded = StandardMethodCodec.INSTANCE.encodeMethodCall(MethodCall("seal", mapOf(
+            "recipient" to HostedHpkeBackupTest.recipient,
+            "plaintext" to ByteArray(32) { 0x42 }, "aad" to byteArrayOf(1),
+        )))
+        encoded.flip()
+        var dispatched = false
+        messenger.handler!!.onMessage(encoded) {
+            it!!.flip()
+            val sealed = StandardMethodCodec.INSTANCE.decodeEnvelope(it) as Map<*, *>
+            assertEquals(48, (sealed["ciphertext"] as ByteArray).size)
+            dispatched = true
+        }
+        assertEquals(true, dispatched)
+        val call = StandardMethodCodec.INSTANCE.encodeMethodCall(MethodCall("unknown", null))
+        call.flip()
+        messenger.handler!!.onMessage(call) { assertNull(it) }
+        plugin.dispose()
+        assertNull(messenger.handler)
+    }
+
+    @Test fun `invalid input is redacted and plaintext cleared on failure`() {
+        val plugin = HostedHpkePlugin(Messenger())
+        for (recipient in listOf(null, ByteArray(65))) {
+            val secret = ByteArray(32) { 0x42 }
+            val reply = Reply()
+            plugin.onMethodCall(MethodCall("seal", mapOf(
+                "recipient" to recipient, "plaintext" to secret, "aad" to byteArrayOf(1),
+            )), reply)
+            assertEquals(if (recipient == null) "invalid_input" else "backup_unavailable", reply.code)
+            assertNull(reply.value)
+            assertContentEquals(ByteArray(32), secret)
+        }
+    }
+
+    private class Reply : MethodChannel.Result {
+        var value: Any? = null
+        var code: String? = null
+        override fun success(result: Any?) { value = result }
+        override fun error(errorCode: String, errorMessage: String?, errorDetails: Any?) {
+            code = errorCode
+            assertNull(errorMessage)
+            assertNull(errorDetails)
+        }
+        override fun notImplemented() { error("Unexpected missing method") }
+    }
+
+    private class Messenger : BinaryMessenger {
+        var channel: String? = null
+        var handler: BinaryMessenger.BinaryMessageHandler? = null
+        var queue: BinaryMessenger.TaskQueue? = null
+        override fun makeBackgroundTaskQueue(options: BinaryMessenger.TaskQueueOptions) =
+            object : BinaryMessenger.TaskQueue {}
+        override fun send(channel: String, message: ByteBuffer?) = Unit
+        override fun send(channel: String, message: ByteBuffer?, callback: BinaryMessenger.BinaryReply?) = Unit
+        override fun setMessageHandler(channel: String, handler: BinaryMessenger.BinaryMessageHandler?) {
+            this.channel = channel
+            this.handler = handler
+        }
+        override fun setMessageHandler(channel: String, handler: BinaryMessenger.BinaryMessageHandler?, taskQueue: BinaryMessenger.TaskQueue?) {
+            this.queue = taskQueue
+            setMessageHandler(channel, handler)
+        }
+    }
+}
diff --git a/mobile/android/app/src/test/kotlin/xyz/block/buzz/mobile/IdentityFileReaderTest.kt b/mobile/android/app/src/test/kotlin/xyz/block/buzz/mobile/IdentityFileReaderTest.kt
new file mode 100644
index 0000000000..97ccedef8b
--- /dev/null
+++ b/mobile/android/app/src/test/kotlin/xyz/block/buzz/mobile/IdentityFileReaderTest.kt
@@ -0,0 +1,74 @@
+package xyz.block.buzz.mobile
+
+import java.io.ByteArrayInputStream
+import java.io.IOException
+import java.io.InputStream
+import java.nio.charset.CharacterCodingException
+import kotlin.test.Test
+import kotlin.test.assertEquals
+import kotlin.test.assertFailsWith
+import kotlin.test.assertTrue
+
+class IdentityFileReaderTest {
+    @Test fun `reads exact limit and closes document`() {
+        val input = CountingInput(ByteArray(1024) { 'a'.code.toByte() })
+        assertEquals("a".repeat(1024), IdentityFileReader.read(input))
+        assertEquals(1024, input.consumed)
+        assertTrue(input.closed)
+    }
+
+    @Test fun `oversized document reads only sentinel and closes`() {
+        for (size in listOf(1025, 1000000)) {
+            val input = CountingInput(ByteArray(size) { 'a'.code.toByte() })
+            assertFailsWith<IllegalArgumentException> { IdentityFileReader.read(input) }
+            assertEquals(1025, input.consumed)
+            assertTrue(input.closed)
+        }
+    }
+
+    @Test fun `short provider reads do not truncate document`() {
+        val input = CountingInput("nsec-test\n".toByteArray(), chunk = 1)
+        assertEquals("nsec-test\n", IdentityFileReader.read(input))
+        assertTrue(input.closed)
+    }
+
+    @Test fun `zero-length provider reads still make bounded progress`() {
+        var consumed = 0
+        var closed = false
+        var supplied: ByteArray? = null
+        val input = object : InputStream() {
+            override fun read(buffer: ByteArray, offset: Int, length: Int): Int {
+                supplied = buffer
+                return 0
+            }
+            override fun read(): Int { consumed++; return 'a'.code }
+            override fun close() { closed = true }
+        }
+        assertFailsWith<IllegalArgumentException> { IdentityFileReader.read(input) }
+        assertEquals(1025, consumed)
+        assertTrue(closed)
+        assertTrue(supplied!!.all { it == 0.toByte() })
+    }
+
+    @Test fun `invalid UTF8 and read failures reject and close`() {
+        val malformed = CountingInput(byteArrayOf(0xc3.toByte(), 0x28))
+        assertFailsWith<CharacterCodingException> { IdentityFileReader.read(malformed) }
+        assertTrue(malformed.closed)
+        var closed = false
+        val failing = object : InputStream() {
+            override fun read(): Int = throw IOException("provider detail must not escape channel")
+            override fun close() { closed = true }
+        }
+        assertFailsWith<IOException> { IdentityFileReader.read(failing) }
+        assertTrue(closed)
+    }
+
+    private class CountingInput(bytes: ByteArray, private val chunk: Int = Int.MAX_VALUE) :
+        ByteArrayInputStream(bytes) {
+        var consumed = 0
+        var closed = false
+        override fun read(buffer: ByteArray, offset: Int, length: Int): Int =
+            super.read(buffer, offset, minOf(length, chunk)).also { if (it > 0) consumed += it }
+        override fun close() { closed = true; super.close() }
+    }
+}
diff --git a/mobile/ios/NotificationService/NotificationService.swift b/mobile/ios/NotificationService/NotificationService.swift
index 0fffa19540..c10bb0f3fd 100644
--- a/mobile/ios/NotificationService/NotificationService.swift
+++ b/mobile/ios/NotificationService/NotificationService.swift
@@ -101,11 +101,13 @@ final class NotificationService: UNNotificationServiceExtension {
   ) {
     resolvedScope = nil
     handoff = BuzzNotificationHandoff(handler: contentHandler)
-    restrictedFallbackContent = Self.restrictedFallback(from: request.content)
     guard let content = request.content.mutableCopy() as? UNMutableNotificationContent else {
       finish(request.content)
       return
     }
+    // Workaround until https://github.com/block/buzz/pull/8431 lands.
+    if content.sound == nil { content.sound = .default }
+    restrictedFallbackContent = Self.restrictedFallback(from: content)
     bestAttemptContent = content
     var cleanUserInfo = content.userInfo
     cleanUserInfo.removeValue(forKey: BuzzPushNavigationTarget.userInfoKey)
diff --git a/mobile/ios/Podfile.lock b/mobile/ios/Podfile.lock
index 0384f7355d..310628f0e6 100644
--- a/mobile/ios/Podfile.lock
+++ b/mobile/ios/Podfile.lock
@@ -197,7 +197,7 @@ SPEC CHECKSUMS:
   camera_avfoundation: 968a9a5323c79a99c166ad9d7866bfd2047b5a9b
   connectivity_plus: cb623214f4e1f6ef8fe7403d580fdad517d2f7dd
   file_selector_ios: ec57ec07954363dd730b642e765e58f199bb621a
-  Flutter: cabc95a1d2626b1b06e7179b784ebcf0c0cde467
+  Flutter: 71a624a5bc0c04062bf19101d501e466baf2fb47
   flutter_secure_storage_darwin: acdb3f316ed05a3e68f856e0353b133eec373a23
   google_mlkit_commons: b4dfe2f6ae4cbf24010dc6640a28984d01343c86
   google_mlkit_selfie_segmentation: 7fc41b3ef8ba238abf8dc76724da50e44de8aaf0
diff --git a/mobile/ios/Runner.xcodeproj/project.pbxproj b/mobile/ios/Runner.xcodeproj/project.pbxproj
index 5da4c943b3..142fe15921 100644
--- a/mobile/ios/Runner.xcodeproj/project.pbxproj
+++ b/mobile/ios/Runner.xcodeproj/project.pbxproj
@@ -7,6 +7,8 @@
 	objects = {
 
 /* Begin PBXBuildFile section */
+		BBAA00000000000000000011 /* IdentityFilePlugin.swift in Sources */ = {isa = PBXBuildFile; fileRef = BBAA00000000000000000012 /* IdentityFilePlugin.swift */; };
+		BBAA00000000000000000001 /* HostedHpkeBackup.swift in Sources */ = {isa = PBXBuildFile; fileRef = BBAA00000000000000000002 /* HostedHpkeBackup.swift */; };
 		DAAB00000000000000000001 /* NativeTabler.swift in Sources */ = {isa = PBXBuildFile; fileRef = DAAB00000000000000000002; };
 		4A71C0192F40D00100A17E02 /* MeAvatarLoader.swift in Sources */ = {isa = PBXBuildFile; fileRef = 4A71C01A2F40D00100A17E02 /* MeAvatarLoader.swift */; };
 		C0AF00000000000000000001 /* NativeConfirmationDialog.swift in Sources */ = {isa = PBXBuildFile; fileRef = C0AF00000000000000000002 /* NativeConfirmationDialog.swift */; };
@@ -58,6 +60,7 @@
 		AB1200012F40400100A17E01 /* NativeMessageMenu.swift in Sources */ = {isa = PBXBuildFile; fileRef = AB1200112F40400100A17E01 /* NativeMessageMenu.swift */; };
 		AB1200022F40400100A17E01 /* NativeReactionDetails.swift in Sources */ = {isa = PBXBuildFile; fileRef = AB1200122F40400100A17E01 /* NativeReactionDetails.swift */; };
 		AB1200032F40400100A17E01 /* NativeMessageImageLoaderTests.swift in Sources */ = {isa = PBXBuildFile; fileRef = AB1200132F40400100A17E01 /* NativeMessageImageLoaderTests.swift */; };
+		AB1200032F40400100A17E09 /* IdentityFilePluginTests.swift in Sources */ = {isa = PBXBuildFile; fileRef = AB1200132F40400100A17E09 /* IdentityFilePluginTests.swift */; };
 /* End PBXBuildFile section */
 
 /* Begin PBXContainerItemProxy section */
@@ -95,6 +98,8 @@
 /* End PBXCopyFilesBuildPhase section */
 
 /* Begin PBXFileReference section */
+		BBAA00000000000000000012 /* IdentityFilePlugin.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = IdentityFilePlugin.swift; sourceTree = "<group>"; };
+		BBAA00000000000000000002 /* HostedHpkeBackup.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = HostedHpkeBackup.swift; sourceTree = "<group>"; };
 		DAAB00000000000000000002 /* NativeTabler.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = NativeTabler.swift; sourceTree = "<group>"; };
 		4A71C01A2F40D00100A17E02 /* MeAvatarLoader.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = MeAvatarLoader.swift; sourceTree = "<group>"; };
 		C0AF00000000000000000002 /* NativeConfirmationDialog.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = NativeConfirmationDialog.swift; sourceTree = "<group>"; };
@@ -161,6 +166,7 @@
 		AB1200112F40400100A17E01 /* NativeMessageMenu.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = NativeMessageMenu.swift; sourceTree = "<group>"; };
 		AB1200122F40400100A17E01 /* NativeReactionDetails.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = NativeReactionDetails.swift; sourceTree = "<group>"; };
 		AB1200132F40400100A17E01 /* NativeMessageImageLoaderTests.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = NativeMessageImageLoaderTests.swift; sourceTree = "<group>"; };
+		AB1200132F40400100A17E09 /* IdentityFilePluginTests.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = IdentityFilePluginTests.swift; sourceTree = "<group>"; };
 /* End PBXFileReference section */
 
 /* Begin PBXFrameworksBuildPhase section */
@@ -197,6 +203,7 @@
 			children = (
 				331C807B294A618700263BE5 /* RunnerTests.swift */,
 				AB1200132F40400100A17E01 /* NativeMessageImageLoaderTests.swift */,
+				AB1200132F40400100A17E09 /* IdentityFilePluginTests.swift */,
 				BZZ0000000000000000002C /* BuzzCommunicationNotificationTests.swift */,
 				331C80A0294A618700263BE5 /* Fixtures */,
 			);
@@ -274,6 +281,8 @@
 				AB1200112F40400100A17E01 /* NativeMessageMenu.swift */,
 				AB1200122F40400100A17E01 /* NativeReactionDetails.swift */,
 				74858FAE1ED2DC5600515810 /* AppDelegate.swift */,
+				BBAA00000000000000000002 /* HostedHpkeBackup.swift */,
+				BBAA00000000000000000012 /* IdentityFilePlugin.swift */,
 				BZZ00000000000000000024 /* PushNativeState.swift */,
 				BZZ00000000000000000027 /* PushEndpointGrantStore.swift */,
 				BZZ0000000000000000002A /* PushSnapshotBridge.swift */,
@@ -601,6 +610,7 @@
 			files = (
 				331C808B294A63AB00263BE5 /* RunnerTests.swift in Sources */,
 				AB1200032F40400100A17E01 /* NativeMessageImageLoaderTests.swift in Sources */,
+				AB1200032F40400100A17E09 /* IdentityFilePluginTests.swift in Sources */,
 				BZZ0000000000000000002B /* BuzzCommunicationNotificationTests.swift in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
@@ -613,6 +623,8 @@
 				AB1200012F40400100A17E01 /* NativeMessageMenu.swift in Sources */,
 				AB1200022F40400100A17E01 /* NativeReactionDetails.swift in Sources */,
 				74858FAF1ED2DC5600515810 /* AppDelegate.swift in Sources */,
+				BBAA00000000000000000001 /* HostedHpkeBackup.swift in Sources */,
+				BBAA00000000000000000011 /* IdentityFilePlugin.swift in Sources */,
 				BZZ00000000000000000023 /* PushNativeState.swift in Sources */,
 				BZZ00000000000000000026 /* PushEndpointGrantStore.swift in Sources */,
 				BZZ00000000000000000029 /* PushSnapshotBridge.swift in Sources */,
diff --git a/mobile/ios/Runner/AppDelegate.swift b/mobile/ios/Runner/AppDelegate.swift
index fb88d746b0..67ec31d951 100644
--- a/mobile/ios/Runner/AppDelegate.swift
+++ b/mobile/ios/Runner/AppDelegate.swift
@@ -1,3 +1,4 @@
+import AuthenticationServices
 import AVFoundation
 import BuzzPushKit
 import DeclaredAgeRange
@@ -45,6 +46,9 @@ import os.log
   private var nativeConfirmationDialogCoordinator: NativeConfirmationDialogCoordinator?
   private var nativeProfileTextEditorCoordinator: NativeProfileTextEditorCoordinator?
   private var nativeMessageActionSurfaceSupportChannel: FlutterMethodChannel?
+  private var identityFilePlugin: IdentityFilePlugin?
+  private var hostedHpkeChannel: FlutterMethodChannel?
+  private var browserAuthBridge: BuzzBrowserAuthBridge?
   private var huddleMediaPlugin: HuddleMediaPlugin?
 
   override func application(
@@ -64,6 +68,27 @@ import os.log
     }
 
     let messenger = engineBridge.applicationRegistrar.messenger()
+    identityFilePlugin = IdentityFilePlugin(messenger: messenger)
+    browserAuthBridge = BuzzBrowserAuthBridge(messenger: messenger)
+    hostedHpkeChannel = FlutterMethodChannel(name: "buzz/hosted_hpke", binaryMessenger: messenger)
+    hostedHpkeChannel?.setMethodCallHandler { call, result in
+      guard call.method == "seal" else { result(FlutterMethodNotImplemented); return }
+      guard #available(iOS 17.0, *) else {
+        result(FlutterError(code: "unsupported", message: "Backup requires iOS 17 or later", details: nil)); return
+      }
+      guard let args = call.arguments as? [String: Any],
+        let recipient = args["recipient"] as? FlutterStandardTypedData,
+        let plaintext = args["plaintext"] as? FlutterStandardTypedData,
+        let aad = args["aad"] as? FlutterStandardTypedData else {
+        result(FlutterError(code: "invalid_input", message: nil, details: nil)); return
+      }
+      do {
+        let sealed = try HostedHpkeBackup.seal(recipient: recipient.data, plaintext: plaintext.data, aad: aad.data)
+        result(["enc": FlutterStandardTypedData(bytes: sealed.enc), "ciphertext": FlutterStandardTypedData(bytes: sealed.ciphertext)])
+      } catch {
+        result(FlutterError(code: "backup_unavailable", message: nil, details: nil))
+      }
+    }
     huddleMediaPlugin = HuddleMediaPlugin(messenger: messenger)
     if let registrar = engineBridge.pluginRegistry.registrar(forPlugin: "BuzzIosNavigationBar") {
       registrar.register(IosNavigationBarFactory(messenger: messenger, parent: registrar.viewController), withId: "buzz/ios_navigation_bar")
@@ -1087,3 +1112,66 @@ extension BuzzPushNavigationTarget {
     return arguments
   }
 }
+
+
+/// Keeps the authentication callback scoped to the system browser session.
+private final class BuzzBrowserAuthBridge: NSObject, ASWebAuthenticationPresentationContextProviding {
+  private let channel: FlutterMethodChannel
+  private var session: ASWebAuthenticationSession?
+  private var pending: FlutterResult?
+  private var attemptID: UUID?
+
+  init(messenger: FlutterBinaryMessenger) {
+    channel = FlutterMethodChannel(name: "buzz/browser_auth", binaryMessenger: messenger)
+    super.init()
+    channel.setMethodCallHandler { [weak self] call, result in
+      guard let self else { return }
+      if call.method == "cancel" {
+        self.session?.cancel()
+        self.finish(nil, code: "cancelled")
+        result(nil)
+        return
+      }
+      guard call.method == "start" else { result(FlutterMethodNotImplemented); return }
+      guard self.session == nil,
+        let args = call.arguments as? [String: String],
+        let raw = args["url"], let url = URL(string: raw),
+        url.scheme == "https",
+        ["app.builderlab.xyz", "app.builderlabstaging.xyz"].contains(url.host ?? ""),
+        url.path == "/api/goose/v1/auth/login", url.user == nil, url.password == nil,
+        url.port == nil, url.fragment == nil
+      else { result(FlutterError(code: "unavailable", message: nil, details: nil)); return }
+      self.pending = result
+      let attemptID = UUID()
+      self.attemptID = attemptID
+      let session = ASWebAuthenticationSession(url: url, callbackURLScheme: "xyz.block.buzz.mobile") { [weak self] callback, error in
+        DispatchQueue.main.async {
+          guard self?.attemptID == attemptID else { return }
+          let cancelled = (error as? ASWebAuthenticationSessionError)?.code == .canceledLogin
+          self?.finish(callback?.absoluteString, code: cancelled ? "cancelled" : "unavailable")
+        }
+      }
+      session.presentationContextProvider = self
+      session.prefersEphemeralWebBrowserSession = false
+      #if DEBUG
+      session.prefersEphemeralWebBrowserSession = args["ephemeral"] == "true"
+      #endif
+      self.session = session
+      if !session.start() { self.finish(nil, code: "unavailable") }
+    }
+  }
+
+  private func finish(_ callback: String?, code: String) {
+    let result = pending
+    attemptID = nil
+    pending = nil
+    session = nil
+    if let callback { result?(callback) }
+    else { result?(FlutterError(code: code, message: nil, details: nil)) }
+  }
+
+  func presentationAnchor(for session: ASWebAuthenticationSession) -> ASPresentationAnchor {
+    UIApplication.shared.connectedScenes.compactMap { $0 as? UIWindowScene }
+      .flatMap { $0.windows }.first(where: { $0.isKeyWindow }) ?? ASPresentationAnchor()
+  }
+}
diff --git a/mobile/ios/Runner/HostedHpkeBackup.swift b/mobile/ios/Runner/HostedHpkeBackup.swift
new file mode 100644
index 0000000000..0b742eae1d
--- /dev/null
+++ b/mobile/ios/Runner/HostedHpkeBackup.swift
@@ -0,0 +1,26 @@
+import CryptoKit
+import Foundation
+
+/// RFC 9180 base-mode sealing only. Enrollment, key ownership, durable envelope
+/// storage and upload are enforced by the hosted coordinator, never by a link.
+/// The caller must pass AAD built from the authenticated enrollment contract.
+@available(iOS 17.0, macOS 14.0, *)
+enum HostedHpkeBackup {
+  enum Failure: Error { case invalidInput }
+
+  static func seal(recipient: Data, plaintext: Data, aad: Data) throws -> (enc: Data, ciphertext: Data) {
+    guard recipient.count == 65, recipient.first == 4,
+      plaintext.count == 32, !aad.isEmpty
+    else { throw Failure.invalidInput }
+    let publicKey = try P256.KeyAgreement.PublicKey(x963Representation: recipient)
+    var sender = try HPKE.Sender(
+      recipientKey: publicKey,
+      ciphersuite: .P256_SHA256_AES_GCM_256,
+      info: Data("buzz/nsec-backup/v1".utf8)
+    )
+    let ciphertext = try sender.seal(plaintext, authenticating: aad)
+    guard sender.encapsulatedKey.count == 65, ciphertext.count == 48
+    else { throw Failure.invalidInput }
+    return (sender.encapsulatedKey, ciphertext)
+  }
+}
diff --git a/mobile/ios/Runner/IdentityFilePlugin.swift b/mobile/ios/Runner/IdentityFilePlugin.swift
new file mode 100644
index 0000000000..d909ea7061
--- /dev/null
+++ b/mobile/ios/Runner/IdentityFilePlugin.swift
@@ -0,0 +1,187 @@
+import Flutter
+import UIKit
+import UniformTypeIdentifiers
+
+/// Reads the user-selected document in place; never imports a plaintext copy
+/// into Buzz's sandbox. The security-scoped grant lasts only for the read.
+final class IdentityFilePlugin: NSObject, UIDocumentPickerDelegate,
+  UIAdaptivePresentationControllerDelegate
+{
+  private let channel: FlutterMethodChannel
+  private var pending: FlutterResult?
+  private var requestID: UUID?
+  private weak var activePicker: UIDocumentPickerViewController?
+
+  init(messenger: FlutterBinaryMessenger) {
+    channel = FlutterMethodChannel(name: "buzz/identity_file", binaryMessenger: messenger)
+    super.init()
+    Self.removeInterruptedExports()
+    channel.setMethodCallHandler { [weak self] call, result in
+      guard let self else {
+        result(FlutterError(code: "import_failed", message: nil, details: nil))
+        return
+      }
+      if call.method == "prepareExport" {
+        self.prepareExport(call.arguments, result: result)
+        return
+      }
+      guard call.method == "import" else {
+        result(FlutterMethodNotImplemented)
+        return
+      }
+      self.pick(result: result)
+    }
+  }
+
+  /// Write the share source with complete protection from its first byte.
+  /// Dart owns normal cleanup; startup handles a process killed during sharing.
+  private func prepareExport(_ arguments: Any?, result: FlutterResult) {
+    guard let arguments = arguments as? [String: Any],
+      let text = arguments["text"] as? String,
+      !text.isEmpty, text.utf8.count <= 1024,
+      let root = FileManager.default.urls(for: .cachesDirectory, in: .userDomainMask).first
+    else {
+      result(FlutterError(code: "export_failed", message: nil, details: nil))
+      return
+    }
+    let directory = root.appendingPathComponent("buzz-identity-\(UUID().uuidString)")
+    do {
+      try FileManager.default.createDirectory(at: directory, withIntermediateDirectories: false)
+      let file = directory.appendingPathComponent("buzz-identity.nsec")
+      try Data(text.utf8).write(to: file, options: [.atomic, .completeFileProtection])
+      result(file.path)
+    } catch {
+      try? FileManager.default.removeItem(at: directory)
+      result(FlutterError(code: "export_failed", message: nil, details: nil))
+    }
+  }
+
+  /// A terminated share never reaches Dart's finally. Retire its sandbox copy
+  /// on the next launch; active shares cannot exist while this engine starts.
+  private static func removeInterruptedExports() {
+    let manager = FileManager.default
+    // path_provider_foundation resolves getTemporaryDirectory to Caches.
+    let roots = manager.urls(for: .cachesDirectory, in: .userDomainMask)
+      + [manager.temporaryDirectory]
+    for root in roots {
+      do {
+        let entries = try manager.contentsOfDirectory(
+          at: root,
+          includingPropertiesForKeys: nil,
+          options: [.skipsHiddenFiles]
+        )
+        for entry in entries where entry.lastPathComponent.hasPrefix("buzz-identity-") {
+          try manager.removeItem(at: entry)
+        }
+      } catch {
+        // No path or key material in diagnostics. Retry on the next launch.
+        NSLog("Buzz could not clean up an interrupted identity export")
+      }
+    }
+  }
+
+  private func pick(result: @escaping FlutterResult) {
+    guard pending == nil else {
+      result(FlutterError(code: "import_busy", message: nil, details: nil))
+      return
+    }
+    // The implicit Flutter engine can initialize before a view controller is
+    // attached. Resolve the live scene at the user action, never cache the
+    // registrar's possibly-nil launch-time view controller.
+    let root = UIApplication.shared.connectedScenes
+      .compactMap { $0 as? UIWindowScene }
+      .filter { $0.activationState == .foregroundActive }
+      .flatMap(\.windows)
+      .first(where: \.isKeyWindow)?.rootViewController
+    guard var top = root else {
+      result(FlutterError(code: "import_failed", message: nil, details: nil))
+      return
+    }
+    while true {
+      if let presented = top.presentedViewController { top = presented }
+      else if let navigation = top as? UINavigationController,
+        let visible = navigation.visibleViewController { top = visible }
+      else if let tabs = top as? UITabBarController,
+        let selected = tabs.selectedViewController { top = selected }
+      else { break }
+    }
+    guard !top.isBeingDismissed, top.viewIfLoaded?.window != nil else {
+      result(FlutterError(code: "import_failed", message: nil, details: nil))
+      return
+    }
+    let picker = UIDocumentPickerViewController(forOpeningContentTypes: [.item], asCopy: false)
+    picker.allowsMultipleSelection = false
+    picker.delegate = self
+    pending = result
+    requestID = UUID()
+    activePicker = picker
+    top.present(picker, animated: true)
+    picker.presentationController?.delegate = self
+  }
+
+  func documentPicker(_ controller: UIDocumentPickerViewController, didPickDocumentsAt urls: [URL]) {
+    guard controller === activePicker else { return }
+    guard let url = urls.first, urls.count == 1 else {
+      finish(FlutterError(code: "import_failed", message: nil, details: nil))
+      return
+    }
+    guard let requestID else { return }
+    DispatchQueue.global(qos: .userInitiated).async { [weak self] in
+      let scoped = url.startAccessingSecurityScopedResource()
+      defer { if scoped { url.stopAccessingSecurityScopedResource() } }
+      var coordinationError: NSError?
+      var text: String?
+      NSFileCoordinator().coordinate(readingItemAt: url, options: [], error: &coordinationError) { accessible in
+        text = Self.readBounded(accessible)
+      }
+      let value: Any? = coordinationError == nil && text != nil
+        ? text : FlutterError(code: "import_failed", message: nil, details: nil)
+      DispatchQueue.main.async {
+        guard self?.requestID == requestID else { return }
+        self?.finish(value)
+      }
+    }
+  }
+
+  /// Reads at most 1025 bytes, including the one-byte oversize sentinel.
+  private static func readBounded(_ url: URL) -> String? {
+    guard let stream = InputStream(url: url) else { return nil }
+    stream.open()
+    var bytes = [UInt8](repeating: 0, count: 1025)
+    defer {
+      stream.close()
+      bytes.withUnsafeMutableBytes { $0.initializeMemory(as: UInt8.self, repeating: 0) }
+    }
+    var count = 0
+    while count < bytes.count {
+      let remaining = bytes.count - count
+      let read = bytes.withUnsafeMutableBufferPointer { buffer in
+        guard let base = buffer.baseAddress else { return -1 }
+        return stream.read(base.advanced(by: count), maxLength: remaining)
+      }
+      if read < 0 { return nil }
+      if read == 0 { break }
+      count += read
+    }
+    guard count > 0, count <= 1024 else { return nil }
+    return String(bytes: bytes.prefix(count), encoding: .utf8)
+  }
+
+  func documentPickerWasCancelled(_ controller: UIDocumentPickerViewController) {
+    guard controller === activePicker else { return }
+    finish(nil)
+  }
+
+  func presentationControllerDidDismiss(_ presentationController: UIPresentationController) {
+    guard presentationController.presentedViewController === activePicker else { return }
+    finish(nil)
+  }
+
+  private func finish(_ value: Any?) {
+    let result = pending
+    pending = nil
+    requestID = nil
+    activePicker = nil
+    result?(value)
+  }
+}
diff --git a/mobile/ios/Runner/IosNavigationBar.swift b/mobile/ios/Runner/IosNavigationBar.swift
index 24692e38a3..a425a1cae3 100644
--- a/mobile/ios/Runner/IosNavigationBar.swift
+++ b/mobile/ios/Runner/IosNavigationBar.swift
@@ -606,7 +606,7 @@ private final class IosNavigationBarView: NSObject, FlutterPlatformView {
   private func makeAction(_ data: [String: Any]) -> UIAction {
     let id = data["id"] as? String ?? ""
     let enabled = data["enabled"] as? Bool == true
-    let symbol = (data["symbol"] as? String).flatMap { NativeTabler.image($0) }
+    let symbol = (data["symbol"] as? String).flatMap { NativeTabler.image($0, size: 24) }
     return UIAction(title: data["label"] as? String ?? "", image: symbol,
                     attributes: enabled ? [] : [.disabled],
                     state: data["selected"] as? Bool == true ? .on : .off) { [weak self] _ in
@@ -615,14 +615,20 @@ private final class IosNavigationBarView: NSObject, FlutterPlatformView {
   }
 
   private func makeControlGroup(_ actions: [[String: Any]]) -> UIBarButtonItem {
-    if actions.count == 1, actions[0]["plain"] as? Bool == true {
-      return makeItem(actions[0])
+    if actions.count == 1 {
+      let item = makeItem(actions[0])
+      // Let UIKit retain its navigation typography and sizing for text actions
+      // such as Edit/Done, rather than inheriting UIButton's default styling.
+      if actions[0]["plain"] as? Bool == true || (item.image == nil && item.customView == nil) {
+        return item
+      }
     }
     let surface = UIVisualEffectView()
     if #available(iOS 26.0, *) {
       let glass = UIGlassEffect(style: .regular)
       glass.isInteractive = true
       surface.effect = glass
+      surface.cornerConfiguration = .capsule()
     } else {
       surface.backgroundColor = controlBackground
     }
@@ -647,6 +653,16 @@ private final class IosNavigationBarView: NSObject, FlutterPlatformView {
         if let action = item.primaryAction { button.addAction(action, for: .touchUpInside) }
         button.menu = item.menu
         button.showsMenuAsPrimaryAction = item.menu != nil
+        if item.menu != nil {
+          // UIKit lifts the button itself for its menu transition, not the
+          // enclosing glass. Give that return target the same rounded shape.
+          if #available(iOS 26.0, *) {
+            button.cornerConfiguration = .capsule()
+          }
+          button.layer.cornerRadius = 22
+          button.layer.cornerCurve = .circular
+          button.clipsToBounds = true
+        }
         button.isEnabled = item.isEnabled
         button.accessibilityLabel = item.accessibilityLabel
         button.accessibilityValue = item.accessibilityValue
diff --git a/mobile/ios/Runner/JumpToLatestGlassButton.swift b/mobile/ios/Runner/JumpToLatestGlassButton.swift
index 44e7fc8b85..170763c184 100644
--- a/mobile/ios/Runner/JumpToLatestGlassButton.swift
+++ b/mobile/ios/Runner/JumpToLatestGlassButton.swift
@@ -452,7 +452,7 @@ final class NavigationGlassButtonPlatformView: NSObject, FlutterPlatformView {
       )
       let pointSize: CGFloat = icon == "shutter"
         ? controlSize * Self.shutterIconRatio
-        : 17
+        : 24
       buttonImage = NativeTabler.image(buttonIconName, size: pointSize)
     }
     updateDisplayedContent()
diff --git a/mobile/ios/Runner/NativeReactionDetails.swift b/mobile/ios/Runner/NativeReactionDetails.swift
index 2580c77093..637da5fffe 100644
--- a/mobile/ios/Runner/NativeReactionDetails.swift
+++ b/mobile/ios/Runner/NativeReactionDetails.swift
@@ -72,7 +72,7 @@ final class NativeReactionDetailsViewController: UIViewController, UITableViewDa
       configuration.baseBackgroundColor = .secondarySystemBackground
     }
     configuration.cornerStyle = .capsule
-    configuration.image = NativeTabler.image("xmark", size: 17)
+    configuration.image = NativeTabler.image("xmark", size: 24)
     configuration.baseForegroundColor = foregroundColor
     close.configuration = configuration
     close.tintColor = foregroundColor
diff --git a/mobile/ios/Runner/NativeTabler.swift b/mobile/ios/Runner/NativeTabler.swift
index cdffe39a80..e4b9c51160 100644
--- a/mobile/ios/Runner/NativeTabler.swift
+++ b/mobile/ios/Runner/NativeTabler.swift
@@ -16,10 +16,6 @@ enum NativeTabler {
   }()
 
   static func image(_ symbol: String, size: CGFloat = 20) -> UIImage? {
-    // Back and Close deliberately retain native navigation artwork.
-    if ["chevron.backward", "chevron.left", "xmark", "xmark.circle.fill"].contains(symbol) {
-      return UIImage(systemName: symbol, withConfiguration: UIImage.SymbolConfiguration(pointSize: size, weight: .semibold))
-    }
     guard let code = glyphs[symbol], let scalar = UnicodeScalar(code),
       let name = fontName, let font = UIFont(name: name, size: size) else {
       assertionFailure("Missing Tabler icon: \(symbol)")
diff --git a/mobile/ios/RunnerTests/IdentityFilePluginTests.swift b/mobile/ios/RunnerTests/IdentityFilePluginTests.swift
new file mode 100644
index 0000000000..b2a10df7a2
--- /dev/null
+++ b/mobile/ios/RunnerTests/IdentityFilePluginTests.swift
@@ -0,0 +1,182 @@
+import Flutter
+import UIKit
+import XCTest
+@testable import Buzz
+
+/// Actual UIKit picker presentation and method-channel dispatch, followed by
+/// synthetic document-provider delegate callbacks. Never persists an identity.
+final class IdentityFilePluginTests: XCTestCase {
+  @MainActor
+  private func makeWindow() throws -> (UIWindow, UIViewController) {
+    let scene = try XCTUnwrap(UIApplication.shared.connectedScenes
+      .compactMap { $0 as? UIWindowScene }
+      .first { $0.activationState == .foregroundActive })
+    let parent = UIViewController()
+    let window = UIWindow(windowScene: scene)
+    window.rootViewController = parent
+    window.makeKeyAndVisible()
+    parent.loadViewIfNeeded()
+    return (window, parent)
+  }
+
+  @MainActor
+  private func picker(in parent: UIViewController) async throws -> UIDocumentPickerViewController {
+    let presented = XCTNSPredicateExpectation(predicate: NSPredicate { _, _ in
+      parent.presentedViewController is UIDocumentPickerViewController
+    }, object: nil)
+    await fulfillment(of: [presented], timeout: 5)
+    return try XCTUnwrap(parent.presentedViewController as? UIDocumentPickerViewController)
+  }
+
+  @MainActor
+  private func settle(_ controller: UIViewController) async {
+    if let transition = controller.transitionCoordinator {
+      await withCheckedContinuation { continuation in
+        transition.animate(alongsideTransition: nil) { _ in continuation.resume() }
+      }
+    }
+  }
+
+  @MainActor
+  private func dismiss(_ parent: UIViewController) async {
+    await withCheckedContinuation { continuation in
+      parent.dismiss(animated: false) { continuation.resume() }
+    }
+  }
+
+  @MainActor
+  func testPickerResolvesPresenterAtRequestAndCancelsExactlyOnce() async throws {
+    let messenger = IdentityFileTestMessenger()
+    // A previous process died with a share open. Startup must remove only its
+    // export directory, while preserving unrelated temporary documents.
+    let manager = FileManager.default
+    // Matches path_provider_foundation 2.6.0 getTemporaryPath().
+    let exportRoot = try XCTUnwrap(manager.urls(for: .cachesDirectory, in: .userDomainMask).first)
+    // Exercise the production method-channel writer, not a lookalike fixture.
+    let exporter = IdentityFilePlugin(messenger: messenger)
+    var exportedPath: String?
+    messenger.invoke("prepareExport", arguments: ["text": "synthetic-export-not-a-key\n"]) {
+      exportedPath = $0 as? String
+    }
+    let exported = URL(fileURLWithPath: try XCTUnwrap(exportedPath))
+    let interrupted = exported.deletingLastPathComponent()
+    XCTAssertEqual(interrupted.deletingLastPathComponent().standardizedFileURL, exportRoot.standardizedFileURL)
+    XCTAssertEqual(try String(contentsOf: exported, encoding: .utf8), "synthetic-export-not-a-key\n")
+    #if !targetEnvironment(simulator)
+    // Simulator does not implement iOS Data Protection attributes.
+    let attributes = try manager.attributesOfItem(atPath: exported.path)
+    XCTAssertEqual(attributes[.protectionKey] as? FileProtectionType, .complete)
+    #endif
+    withExtendedLifetime(exporter) {}
+    let unrelated = exportRoot.appendingPathComponent("unrelated-\(UUID().uuidString)")
+    try Data("keep".utf8).write(to: unrelated)
+    defer {
+      try? manager.removeItem(at: interrupted)
+      try? manager.removeItem(at: unrelated)
+    }
+    // Initialize before this window exists: registrar startup timing must not
+    // permanently prevent later user-triggered presentation.
+    let plugin = IdentityFilePlugin(messenger: messenger)
+    XCTAssertFalse(manager.fileExists(atPath: interrupted.path))
+    XCTAssertTrue(manager.fileExists(atPath: unrelated.path))
+    let (window, parent) = try makeWindow()
+    defer { window.isHidden = true }
+    var responses = 0
+    messenger.invokeImport { value in
+      responses += 1
+      XCTAssertNil(value)
+    }
+    let picker = try await picker(in: parent)
+    await settle(picker)
+    XCTAssertFalse(picker.allowsMultipleSelection)
+    XCTAssertEqual(responses, 0)
+    var busy: FlutterError?
+    messenger.invokeImport { busy = $0 as? FlutterError }
+    XCTAssertEqual(busy?.code, "import_busy")
+    XCTAssertNil(busy?.details)
+    let attachment = XCTAttachment(image: UIGraphicsImageRenderer(bounds: window.bounds).image { _ in
+      window.drawHierarchy(in: window.bounds, afterScreenUpdates: true)
+    })
+    attachment.name = "Identity document picker presented"
+    attachment.lifetime = .keepAlways
+    add(attachment)
+    plugin.documentPickerWasCancelled(picker)
+    plugin.documentPickerWasCancelled(picker)
+    XCTAssertEqual(responses, 1)
+    await dismiss(parent)
+    messenger.invokeImport { value in
+      responses += 1
+      XCTAssertNil(value)
+    }
+    let next = try await self.picker(in: parent)
+    await settle(next)
+    // Late callbacks from the previous picker must not finish the new request.
+    plugin.documentPickerWasCancelled(picker)
+    XCTAssertEqual(responses, 1)
+    plugin.documentPicker(picker, didPickDocumentsAt: [])
+    XCTAssertEqual(responses, 1)
+    plugin.documentPickerWasCancelled(next)
+    XCTAssertEqual(responses, 2)
+    await dismiss(parent)
+  }
+
+  @MainActor
+  func testSyntheticDocumentsReadInPlaceAndRejectInvalidOrOversize() async throws {
+    let messenger = IdentityFileTestMessenger()
+    let plugin = IdentityFilePlugin(messenger: messenger)
+    let (window, parent) = try makeWindow()
+    defer { window.isHidden = true }
+    let directory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    try FileManager.default.createDirectory(at: directory, withIntermediateDirectories: true)
+    defer { try? FileManager.default.removeItem(at: directory) }
+    let cases: [(Data, String?)] = [
+      (Data("synthetic-nsec-file-not-an-identity\n".utf8), "synthetic-nsec-file-not-an-identity\n"),
+      (Data(repeating: 97, count: 1024), String(repeating: "a", count: 1024)),
+      (Data(repeating: 97, count: 1025), nil),
+      (Data([0xc3, 0x28]), nil),
+      (Data(), nil),
+    ]
+    for (index, entry) in cases.enumerated() {
+      let url = directory.appendingPathComponent("fixture-\(index).nsec")
+      try entry.0.write(to: url)
+      let completed = expectation(description: "file result \(index)")
+      messenger.invokeImport { value in
+        if let expected = entry.1 { XCTAssertEqual(value as? String, expected) }
+        else {
+          let error = value as? FlutterError
+          XCTAssertEqual(error?.code, "import_failed")
+          XCTAssertNil(error?.message)
+          XCTAssertNil(error?.details)
+        }
+        completed.fulfill()
+      }
+      let picker = try await picker(in: parent)
+      await settle(picker)
+      // A synthetic delegate URL, not a claim that Files/iCloud selected it.
+      plugin.documentPicker(picker, didPickDocumentsAt: [url])
+      await fulfillment(of: [completed], timeout: 5)
+      XCTAssertEqual(try Data(contentsOf: url), entry.0, "Original document must remain untouched")
+      await dismiss(parent)
+    }
+  }
+}
+
+private final class IdentityFileTestMessenger: NSObject, FlutterBinaryMessenger {
+  private var handler: FlutterBinaryMessageHandler?
+  func send(onChannel channel: String, message: Data?) {}
+  func send(onChannel channel: String, message: Data?, binaryReply callback: FlutterBinaryReply?) { callback?(nil) }
+  func setMessageHandlerOnChannel(_ channel: String, binaryMessageHandler handler: FlutterBinaryMessageHandler?) -> FlutterBinaryMessengerConnection {
+    self.handler = handler
+    return 1
+  }
+  func cleanUpConnection(_ connection: FlutterBinaryMessengerConnection) { handler = nil }
+  func invokeImport(reply: @escaping (Any?) -> Void) {
+    invoke("import", arguments: nil, reply: reply)
+  }
+  func invoke(_ method: String, arguments: Any?, reply: @escaping (Any?) -> Void) {
+    let codec = FlutterStandardMethodCodec.sharedInstance()
+    handler?(codec.encode(FlutterMethodCall(methodName: method, arguments: arguments))) { data in
+      reply(data.flatMap { codec.decodeEnvelope($0) })
+    }
+  }
+}
diff --git a/mobile/lib/app.dart b/mobile/lib/app.dart
index 75d6dfd9d4..497d6937cc 100644
--- a/mobile/lib/app.dart
+++ b/mobile/lib/app.dart
@@ -1,4 +1,6 @@
 import 'dart:async';
+import 'hosted_app_gate.dart';
+import 'onboarding_app_entry.dart';
 import 'shared/widgets/ios_navigation_metrics.dart';
 import 'shared/community/paired_community_landing.dart';
 import 'shared/community/community_loading_surface.dart';
@@ -28,7 +30,6 @@ import 'features/pairing/pairing_page.dart';
 import 'features/pairing/pairing_provider.dart';
 import 'features/channels/agent_activity/observer_subscription.dart';
 import 'features/channels/channel_detail_page.dart';
-import 'features/channels/deep_link_dispatcher.dart';
 import 'shared/widgets/app_route_observer.dart';
 import 'features/profile/user_status_cache_provider.dart';
 import 'features/profile/settings_profile_header.dart';
@@ -330,16 +331,20 @@ class App extends HookConsumerWidget {
     if (ageSignalState != AgeSignalState.restricted &&
         authState.value?.status == AuthStatus.authenticated) {
       ref.watch(relaySessionProvider);
-      ref.watch(observerRelayProvider);
+      // Listen, not watch: these publish often, and an App rebuild rebuilds
+      // every route, including an open chat.
+      ref.listen(observerRelayProvider, (_, _) {});
       ref.watch(appLifecycleProvider);
-      ref.watch(userStatusCacheProvider);
+      ref.listen(userStatusCacheProvider, (_, _) {});
       if (ref.watch(activeCommunityProvider).value?.pushNotificationsEnabled ==
               true &&
           ref.watch(currentRelayPushDescriptorProvider).value != null) {
         ref.watch(pushSubscriptionSyncProvider);
       }
       hasUnreadInbox = ref.watch(_unreadInboxItemCountProvider) > 0;
-      hasUnreadSolo = ref.watch(meUnreadChannelIdsProvider).isNotEmpty;
+      hasUnreadSolo = ref.watch(
+        meUnreadChannelIdsProvider.select((ids) => ids.isNotEmpty),
+      );
     }
 
     // Start listening for buzz:// links immediately (even pre-auth) so a
@@ -414,7 +419,8 @@ class App extends HookConsumerWidget {
         loading: () => const _SplashScreen(),
         error: (_, _) => const PairingPage(),
         data: (state) => switch (state.status) {
-          AuthStatus.authenticated => DeepLinkDispatcher(
+          AuthStatus.authenticated => HostedAppGate(
+            authenticated: true,
             child: HomePage(
               mePageBuilder: (_, action) => MePage(newChatAction: action),
               settingsPageBuilder: _buildSettingsPage,
@@ -424,9 +430,9 @@ class App extends HookConsumerWidget {
               hasUnreadSolo: hasUnreadSolo,
             ),
           ),
-          _ => const DeepLinkDispatcher(
-            dispatchMessageLinks: false,
-            child: PairingPage(),
+          _ => const HostedAppGate(
+            authenticated: false,
+            child: OnboardingAppEntry(),
           ),
         },
       ),
diff --git a/mobile/lib/features/activity/activity_page.dart b/mobile/lib/features/activity/activity_page.dart
index 03aba66863..13382da620 100644
--- a/mobile/lib/features/activity/activity_page.dart
+++ b/mobile/lib/features/activity/activity_page.dart
@@ -437,7 +437,7 @@ class ActivityPage extends HookConsumerWidget {
         nativeActions: [
           IosNavigationAction(
             label: 'Filter inbox',
-            symbol: 'line.3.horizontal.decrease',
+            icon: BuzzIcons.filter2,
             children: [
               for (final entry in _filterLabels.entries)
                 IosNavigationAction(
diff --git a/mobile/lib/features/channels/channel_detail_page.dart b/mobile/lib/features/channels/channel_detail_page.dart
index b7e4251c7f..be320dc0c5 100644
--- a/mobile/lib/features/channels/channel_detail_page.dart
+++ b/mobile/lib/features/channels/channel_detail_page.dart
@@ -1,3 +1,4 @@
+import 'message_swipe_reply.dart';
 import 'agent_reply_handoff.dart';
 import 'huddle_timeline.dart';
 import '../../shared/widgets/modal_presentation.dart';
@@ -10,7 +11,7 @@ import 'dart:ui' show ImageFilter, lerpDouble;
 
 import 'package:flutter/foundation.dart';
 import 'package:flutter/material.dart';
-import 'package:flutter/rendering.dart' show ScrollDirection;
+import 'package:flutter/rendering.dart' show ScrollCacheExtent, ScrollDirection;
 import 'package:flutter/services.dart';
 import 'package:flutter_hooks/flutter_hooks.dart';
 import 'package:hooks_riverpod/hooks_riverpod.dart';
@@ -57,6 +58,7 @@ import 'channel_messages_provider.dart';
 import 'channel_typing_provider.dart';
 import 'channel_typing_indicator.dart';
 import 'inline_agent_typing.dart';
+import 'channel_ids_by_name_provider.dart';
 import 'channels_provider.dart';
 import 'unread_badge/observed_unread_event.dart';
 import 'compose_bar.dart';
@@ -138,7 +140,7 @@ Future<bool> _preloadMembers(
     final members = await ref.read(channelMembersProvider(channelId).future);
     await notifier.preload(members.map((member) => member.pubkey).toList());
     if (refreshDmParticipants) {
-      return notifier.refresh(participantPubkeys);
+      return await notifier.refresh(participantPubkeys);
     }
     return true;
   } catch (_) {
@@ -306,7 +308,14 @@ class _ResolvedChannelDetailPage extends HookConsumerWidget {
     );
     final mePlacement = personalChat ? ref.watch(meGroupsProvider) : null;
     final detailsAsync = ref.watch(channelDetailsProvider(channel.id));
-    final channelsAsync = ref.watch(channelsProvider);
+    // Only this channel's entry: the list republishes on every live event.
+    final listedChannel = ref.watch(
+      channelsProvider.select(
+        (channels) => channels.value
+            ?.where((candidate) => candidate.id == channel.id)
+            .firstOrNull,
+      ),
+    );
     final huddleLifecycle =
         ref.watch(huddleLifecycleProvider(channel.id)).value ?? const [];
     final sessionStatus = ref.watch(relaySessionProvider).status;
@@ -364,16 +373,7 @@ class _ResolvedChannelDetailPage extends HookConsumerWidget {
               e.pubkey.toLowerCase() != currentPubkey.toLowerCase(),
         )
         .toList();
-    final baseChannel =
-        channelsAsync
-            .whenData(
-              (channels) => channels.firstWhere(
-                (candidate) => candidate.id == channel.id,
-                orElse: () => channel,
-              ),
-            )
-            .value ??
-        channel;
+    final baseChannel = listedChannel ?? channel;
     final resolvedChannel =
         detailsAsync.whenData(baseChannel.mergeDetails).value ?? baseChannel;
     final participantCount = resolvedChannel.participantPubkeys
diff --git a/mobile/lib/features/channels/channel_detail_page/activity_members_sheet.dart b/mobile/lib/features/channels/channel_detail_page/activity_members_sheet.dart
index 69a38f128b..05eb305ee8 100644
--- a/mobile/lib/features/channels/channel_detail_page/activity_members_sheet.dart
+++ b/mobile/lib/features/channels/channel_detail_page/activity_members_sheet.dart
@@ -28,7 +28,7 @@ class _ActivityMembersSheet extends ConsumerWidget {
             child: ListView.separated(
               key: const ValueKey('activity-members-list'),
               shrinkWrap: true,
-              cacheExtent: 0,
+              scrollCacheExtent: const ScrollCacheExtent.pixels(0),
               padding: const EdgeInsets.symmetric(horizontal: Grid.xs),
               itemCount: pubkeys.length,
               separatorBuilder: (context, index) => Divider(
diff --git a/mobile/lib/features/channels/channel_detail_page/banners.dart b/mobile/lib/features/channels/channel_detail_page/banners.dart
index d1fdf3f37f..ff0bb0e2df 100644
--- a/mobile/lib/features/channels/channel_detail_page/banners.dart
+++ b/mobile/lib/features/channels/channel_detail_page/banners.dart
@@ -66,7 +66,7 @@ class _MessageTimelineSkeleton extends StatelessWidget {
   @override
   Widget build(BuildContext context) {
     return ListView.builder(
-      cacheExtent: 0,
+      scrollCacheExtent: const ScrollCacheExtent.pixels(0),
       reverse: true,
       physics: const NeverScrollableScrollPhysics(),
       padding: EdgeInsets.fromLTRB(
@@ -177,7 +177,7 @@ class _ForumConnectionSkeleton extends StatelessWidget {
         child: IgnorePointer(
           child: ExcludeFocus(
             child: ListView.builder(
-              cacheExtent: 0,
+              scrollCacheExtent: const ScrollCacheExtent.pixels(0),
               padding: EdgeInsets.zero,
               physics: const NeverScrollableScrollPhysics(),
               itemBuilder: (_, _) => Padding(
diff --git a/mobile/lib/features/channels/channel_detail_page/message_bubble.dart b/mobile/lib/features/channels/channel_detail_page/message_bubble.dart
index d846f455e5..13d525ef2d 100644
--- a/mobile/lib/features/channels/channel_detail_page/message_bubble.dart
+++ b/mobile/lib/features/channels/channel_detail_page/message_bubble.dart
@@ -5,6 +5,8 @@ class _MessageBubble extends HookConsumerWidget {
   final bool showAuthor;
   final bool typingHandoff;
   final bool showAvatar;
+  final bool startsDay;
+  final bool endsDay;
   final bool hasReplies;
   final Widget? replyFooter;
   final Map<String, String> channelNames;
@@ -21,6 +23,8 @@ class _MessageBubble extends HookConsumerWidget {
     required this.showAuthor,
     this.typingHandoff = false,
     this.showAvatar = true,
+    this.startsDay = false,
+    this.endsDay = false,
     required this.hasReplies,
     this.replyFooter,
     required this.channelNames,
@@ -36,6 +40,7 @@ class _MessageBubble extends HookConsumerWidget {
   @override
   Widget build(BuildContext context, WidgetRef ref) {
     final messageSnapshotKey = useMemoized(GlobalKey.new, const []);
+    final swipeContentKey = useMemoized(GlobalKey.new, const []);
     final mediaOffset = useMessageMediaOffset(message.content, message.tags);
     final hasLocalReplies = ref.watch(
       threadLocalRepliesProvider(
@@ -52,6 +57,7 @@ class _MessageBubble extends HookConsumerWidget {
     );
     // Watch only this user's profile to avoid rebuilding on unrelated cache changes.
     final pk = message.pubkey.toLowerCase();
+    final ownMessage = currentPubkey?.toLowerCase() == pk;
     final profile =
         ref.watch(userCacheProvider.select((cache) => cache[pk])) ??
         ref.read(userCacheProvider.notifier).get(pk);
@@ -127,13 +133,13 @@ class _MessageBubble extends HookConsumerWidget {
       );
     }
 
-    return NotificationListener<MessageGalleryScrollNotification>(
+    final content = NotificationListener<MessageGalleryScrollNotification>(
       onNotification: (notification) {
         mediaOffset.value = notification.offset;
         return true;
       },
       child: Padding(
-        padding: EdgeInsets.only(top: showAuthor ? Grid.xs : 0),
+        padding: EdgeInsets.only(top: showAuthor && !startsDay ? Grid.xs : 0),
         child: Material(
           color: Colors.transparent,
           borderRadius: BorderRadius.circular(Radii.md),
@@ -165,46 +171,60 @@ class _MessageBubble extends HookConsumerWidget {
                   ),
             child: Padding(
               padding: EdgeInsets.only(
-                bottom: showAvatar ? Grid.quarter : Grid.quarter / 2,
+                bottom: endsDay
+                    ? 0
+                    : (showAvatar ? Grid.quarter : Grid.quarter / 2),
               ),
               child: MessageFooterLayout(
                 animateSize: true,
                 overlap: message.reactions.isNotEmpty ? Grid.xs : 0,
                 footer: message.reactions.isNotEmpty || replyFooter != null
-                    ? Padding(
-                        padding: const EdgeInsets.only(
-                          left:
-                              messageAvatarSize +
-                              messageAvatarContentGap +
-                              Grid.xxs,
-                        ),
-                        child: Column(
-                          mainAxisSize: MainAxisSize.min,
-                          crossAxisAlignment: CrossAxisAlignment.start,
-                          children: [
-                            if (message.reactions.isNotEmpty)
-                              ReactionRow(
-                                combined: true,
-                                messageId: message.id,
-                                channelId: currentChannelId,
-                                reactions: message.reactions,
-                                onToggle: (emoji) =>
-                                    toggleReaction(ref, message, emoji),
-                                showAddButton: isMember && !isArchived,
-                                onAddReaction: () => showAddReactionPicker(
-                                  context: context,
-                                  ref: ref,
-                                  message: message,
+                    ? Align(
+                        alignment: ownMessage
+                            ? Alignment.centerRight
+                            : Alignment.centerLeft,
+                        child: Padding(
+                          padding: EdgeInsets.only(
+                            right: ownMessage ? Grid.xxs : 0,
+                            left: ownMessage
+                                ? 0
+                                : messageAvatarSize +
+                                      messageAvatarContentGap +
+                                      Grid.xxs,
+                          ),
+                          child: Column(
+                            mainAxisSize: MainAxisSize.min,
+                            crossAxisAlignment: ownMessage
+                                ? CrossAxisAlignment.end
+                                : CrossAxisAlignment.start,
+                            children: [
+                              if (message.reactions.isNotEmpty)
+                                ReactionRow(
+                                  combined: true,
+                                  messageId: message.id,
+                                  channelId: currentChannelId,
+                                  reactions: message.reactions,
+                                  onToggle: (emoji) =>
+                                      toggleReaction(ref, message, emoji),
+                                  showAddButton: isMember && !isArchived,
+                                  onAddReaction: () => showAddReactionPicker(
+                                    context: context,
+                                    ref: ref,
+                                    message: message,
+                                  ),
                                 ),
-                              ),
-                            if (replyFooter != null)
-                              Padding(
-                                padding: const EdgeInsets.only(
-                                  bottom: Grid.xxs,
+                              if (replyFooter != null)
+                                Padding(
+                                  padding: const EdgeInsets.only(
+                                    bottom: Grid.xxs,
+                                  ),
+                                  child: Directionality(
+                                    textDirection: Directionality.of(context),
+                                    child: replyFooter!,
+                                  ),
                                 ),
-                                child: replyFooter,
-                              ),
-                          ],
+                            ],
+                          ),
                         ),
                       )
                     : const SizedBox.shrink(),
@@ -214,29 +234,41 @@ class _MessageBubble extends HookConsumerWidget {
                     clipBehavior: Clip.none,
                     children: [
                       Row(
+                        textDirection: ownMessage
+                            ? TextDirection.rtl
+                            : TextDirection.ltr,
                         crossAxisAlignment: CrossAxisAlignment.end,
                         children: [
-                          const SizedBox(width: messageAvatarSize),
-                          const SizedBox(width: messageAvatarContentGap),
+                          if (!ownMessage)
+                            const SizedBox(width: messageAvatarSize),
+                          if (!ownMessage)
+                            const SizedBox(width: messageAvatarContentGap),
                           Expanded(
                             child: Padding(
                               padding: EdgeInsets.only(
-                                top: showAuthor ? Grid.half : 0,
+                                top: showAuthor && !startsDay ? Grid.half : 0,
                               ),
                               child: Column(
-                                crossAxisAlignment: CrossAxisAlignment.start,
+                                crossAxisAlignment: ownMessage
+                                    ? CrossAxisAlignment.end
+                                    : CrossAxisAlignment.start,
                                 children: [
                                   if (showAuthor)
                                     Padding(
-                                      padding: const EdgeInsets.only(
+                                      padding: EdgeInsets.only(
                                         bottom: Grid.quarter,
-                                        left: Grid.xs,
+                                        left: ownMessage ? 0 : Grid.xs,
+                                        right: ownMessage ? Grid.xs : 0,
                                       ),
                                       child: Row(
                                         children: [
                                           Expanded(
                                             child: MessageAuthorMeta(
                                               showTimestamp: true,
+                                              reversed: false,
+                                              alignment: ownMessage
+                                                  ? MainAxisAlignment.end
+                                                  : MainAxisAlignment.start,
                                               nameStyle:
                                                   messageUsernameTextStyle
                                                       .copyWith(
@@ -311,6 +343,7 @@ class _MessageBubble extends HookConsumerWidget {
                                     ),
                                     animate: typingHandoff,
                                     child: MessageContent(
+                                      key: swipeContentKey,
                                       content: message.content,
                                       bubble: true,
                                       hasReactions:
@@ -318,8 +351,8 @@ class _MessageBubble extends HookConsumerWidget {
                                           replyFooter != null,
                                       bubbleEnd: showAvatar,
                                       bubbleStart: showAuthor,
-                                      ownMessage:
-                                          currentPubkey?.toLowerCase() == pk,
+                                      ownMessage: ownMessage,
+                                      trimTrailingSpacing: endsDay,
                                       mentionNames: resolvedMentionNames,
                                       mentionLabels: mentionLabels,
                                       agentMentionPubkeys: agentMentionPubkeys,
@@ -392,9 +425,10 @@ class _MessageBubble extends HookConsumerWidget {
                           ),
                         ],
                       ),
-                      if (showAvatar)
+                      if (showAvatar && !ownMessage)
                         Positioned(
-                          left: 0,
+                          left: ownMessage ? null : 0,
+                          right: ownMessage ? 0 : null,
                           bottom: 0,
                           child: MessageMediaAvatar(
                             offset: mediaOffset,
@@ -436,6 +470,16 @@ class _MessageBubble extends HookConsumerWidget {
         ),
       ),
     );
+    return MessageSwipeReply(
+      contentKey: swipeContentKey,
+      message: message,
+      allMessages: allMessages,
+      channelId: currentChannelId,
+      currentPubkey: currentPubkey,
+      isMember: isMember,
+      isArchived: isArchived,
+      child: content,
+    );
   }
 }
 
diff --git a/mobile/lib/features/channels/channel_detail_page/message_list.dart b/mobile/lib/features/channels/channel_detail_page/message_list.dart
index adc60fd5d1..35e903da52 100644
--- a/mobile/lib/features/channels/channel_detail_page/message_list.dart
+++ b/mobile/lib/features/channels/channel_detail_page/message_list.dart
@@ -91,6 +91,10 @@ class _MessageList extends HookConsumerWidget {
     final oldestUnreadMessageId = useState<String?>(null);
     final unreadBoundaryLoadFailed = useState(false);
     final unreadBoundaryFetchCount = useRef(0);
+    // Reaching the oldest page publishes no messages, so nothing else
+    // rebuilds this list to re-run the unread effect below. A count, not a
+    // flag: a reconnect can reset the notifier and reach the oldest page again.
+    final unreadBoundaryReachedOldestCount = useState(0);
     final hasUnreadDeepLink =
         initialMessageId != null || initialThreadRootId != null;
     final dayTimestampByReversedIndex = <int, int>{};
@@ -172,7 +176,10 @@ class _MessageList extends HookConsumerWidget {
           unawaited(
             Future<void>(() async {
               final loaded = await notifier.fetchOlder();
-              if (!cancelled && !loaded && !notifier.reachedOldest) {
+              if (cancelled || loaded) return;
+              if (notifier.reachedOldest) {
+                unreadBoundaryReachedOldestCount.value += 1;
+              } else {
                 unreadBoundaryLoadFailed.value = true;
               }
             }),
@@ -810,14 +817,7 @@ class _MessageList extends HookConsumerWidget {
     }
     if (entries.isEmpty) return const _EmptyMessages();
 
-    // Build channel names map once for all message bubbles.
-    final channelsAsync = ref.watch(channelsProvider);
-    final channelNamesMap = <String, String>{};
-    channelsAsync.whenData((channels) {
-      for (final ch in channels) {
-        channelNamesMap[ch.name.toLowerCase()] = ch.id;
-      }
-    });
+    final channelNamesMap = ref.watch(channelIdsByNameProvider);
 
     return Stack(
       children: [
@@ -963,6 +963,13 @@ class _MessageList extends HookConsumerWidget {
                         if (message.isSystem)
                           _SystemMessageRow(
                             message: message,
+                            startsDay: showDayDivider,
+                            endsDay:
+                                nextMessage != null &&
+                                !isSameDay(
+                                  message.createdAt,
+                                  nextMessage.createdAt,
+                                ),
                             groupedMessages: entryGroup.length > 1
                                 ? entryGroup
                                       .map((entry) => entry.message)
@@ -977,6 +984,13 @@ class _MessageList extends HookConsumerWidget {
                         else ...[
                           _MessageBubble(
                             message: message,
+                            startsDay: showDayDivider,
+                            endsDay:
+                                nextMessage != null &&
+                                !isSameDay(
+                                  message.createdAt,
+                                  nextMessage.createdAt,
+                                ),
                             showAuthor:
                                 showAuthor ||
                                 isRecentAgentReplyHandoff(
diff --git a/mobile/lib/features/channels/channel_detail_page/system_rows.dart b/mobile/lib/features/channels/channel_detail_page/system_rows.dart
index 1f5db4ee18..76d2321ac1 100644
--- a/mobile/lib/features/channels/channel_detail_page/system_rows.dart
+++ b/mobile/lib/features/channels/channel_detail_page/system_rows.dart
@@ -8,6 +8,8 @@ class _SystemMessageRow extends HookConsumerWidget {
   final List<TimelineMessage>? allMessages;
   final bool isMember;
   final bool isArchived;
+  final bool startsDay;
+  final bool endsDay;
 
   const _SystemMessageRow({
     required this.message,
@@ -17,6 +19,8 @@ class _SystemMessageRow extends HookConsumerWidget {
     this.allMessages,
     this.isMember = false,
     this.isArchived = false,
+    this.startsDay = false,
+    this.endsDay = false,
   });
 
   @override
@@ -136,37 +140,43 @@ class _SystemMessageRow extends HookConsumerWidget {
         systemEvent.type == SystemEventType.huddleStarted &&
         systemEvent.ephemeralChannelId != null;
     final actor = (systemEvent.actorPubkey ?? message.pubkey).toLowerCase();
+    final ownActor = currentPubkey?.toLowerCase() == actor;
+    final ownHuddle =
+        ownActor &&
+        (isHuddle || systemEvent.type == SystemEventType.huddleEnded);
     Widget withActor(Widget content) {
       if (!isHuddle) return content;
       return Row(
         key: ValueKey('huddle-activity-${message.id}'),
+        textDirection: ownHuddle ? TextDirection.rtl : TextDirection.ltr,
         crossAxisAlignment: CrossAxisAlignment.end,
         children: [
-          Semantics(
-            container: true,
-            label: 'Open ${resolveLabel(actor)} profile',
-            button: true,
-            excludeSemantics: true,
-            onTap: () => showUserProfileSheet(
-              context,
-              actor,
-              names: channelIdentityNamesProvider(channelId),
-            ),
-            child: GestureDetector(
-              excludeFromSemantics: true,
+          if (!ownHuddle)
+            Semantics(
+              container: true,
+              label: 'Open ${resolveLabel(actor)} profile',
+              button: true,
+              excludeSemantics: true,
               onTap: () => showUserProfileSheet(
                 context,
                 actor,
                 names: channelIdentityNamesProvider(channelId),
               ),
-              child: _UserAvatar(
-                profile: userCache[actor],
-                pubkey: actor,
-                isAgent: userCache[actor]?.ownerPubkey != null,
+              child: GestureDetector(
+                excludeFromSemantics: true,
+                onTap: () => showUserProfileSheet(
+                  context,
+                  actor,
+                  names: channelIdentityNamesProvider(channelId),
+                ),
+                child: _UserAvatar(
+                  profile: userCache[actor],
+                  pubkey: actor,
+                  isAgent: userCache[actor]?.ownerPubkey != null,
+                ),
               ),
             ),
-          ),
-          const SizedBox(width: messageAvatarContentGap),
+          if (!ownHuddle) const SizedBox(width: messageAvatarContentGap),
           Expanded(child: content),
         ],
       );
@@ -183,9 +193,14 @@ class _SystemMessageRow extends HookConsumerWidget {
         borderRadius: BorderRadius.circular(Radii.md),
         highlightColor: context.colors.primary.withValues(alpha: 0.1),
         child: Padding(
-          padding: const EdgeInsets.symmetric(vertical: Grid.xxs),
+          padding: EdgeInsets.only(
+            top: startsDay ? 0 : Grid.xxs,
+            bottom: endsDay ? 0 : Grid.xxs,
+          ),
           child: Column(
-            crossAxisAlignment: isHuddle
+            crossAxisAlignment: ownHuddle
+                ? CrossAxisAlignment.end
+                : isHuddle
                 ? CrossAxisAlignment.start
                 : CrossAxisAlignment.center,
             children: [
@@ -193,19 +208,17 @@ class _SystemMessageRow extends HookConsumerWidget {
                 RepaintBoundary(
                   key: spotlightKey,
                   child: Align(
-                    alignment: isHuddle
+                    alignment: ownHuddle
+                        ? Alignment.centerRight
+                        : isHuddle
                         ? Alignment.centerLeft
                         : Alignment.center,
-                    child: Container(
+                    child: Padding(
                       key: ValueKey('activity-card-${message.id}'),
                       padding: const EdgeInsets.symmetric(
                         horizontal: Grid.twelve,
                         vertical: Grid.xxs,
                       ),
-                      decoration: BoxDecoration(
-                        color: context.colors.onSurface.withValues(alpha: 0.06),
-                        borderRadius: BorderRadius.circular(Radii.container),
-                      ),
                       child: IntrinsicWidth(
                         child: groupedMembership != null
                             ? _MembershipSystemMessageContent(
@@ -248,25 +261,32 @@ class _SystemMessageRow extends HookConsumerWidget {
                   overlap: reactions.isNotEmpty ? Grid.xs : 0,
                   footer: reactions.isEmpty
                       ? const SizedBox.shrink()
-                      : Padding(
-                          padding: const EdgeInsets.only(
-                            left:
-                                messageAvatarSize +
-                                messageAvatarContentGap +
-                                Grid.xxs,
-                          ),
-                          child: ReactionRow(
-                            combined: true,
-                            messageId: message.id,
-                            channelId: channelId,
-                            reactions: reactions,
-                            onToggle: (emoji) =>
-                                toggleReaction(ref, message, emoji),
-                            showAddButton: isMember && !isArchived,
-                            onAddReaction: () => showAddReactionPicker(
-                              context: context,
-                              ref: ref,
-                              message: message,
+                      : Align(
+                          alignment: ownHuddle
+                              ? Alignment.centerRight
+                              : Alignment.centerLeft,
+                          child: Padding(
+                            padding: EdgeInsets.only(
+                              left: ownHuddle
+                                  ? 0
+                                  : messageAvatarSize +
+                                        messageAvatarContentGap +
+                                        Grid.xxs,
+                              right: ownHuddle ? Grid.xxs : 0,
+                            ),
+                            child: ReactionRow(
+                              combined: true,
+                              messageId: message.id,
+                              channelId: channelId,
+                              reactions: reactions,
+                              onToggle: (emoji) =>
+                                  toggleReaction(ref, message, emoji),
+                              showAddButton: isMember && !isArchived,
+                              onAddReaction: () => showAddReactionPicker(
+                                context: context,
+                                ref: ref,
+                                message: message,
+                              ),
                             ),
                           ),
                         ),
@@ -613,6 +633,7 @@ class _ThreadSummaryRow extends ConsumerWidget {
   Widget build(BuildContext context, WidgetRef ref) {
     return ReplySummaryLink(
       key: ValueKey('thread-summary-${message.id}'),
+      mirrored: currentPubkey?.toLowerCase() == message.pubkey.toLowerCase(),
       summary: summary,
       hasReactions: message.reactions.isNotEmpty,
       onTap: () {
diff --git a/mobile/lib/features/channels/channel_ids_by_name_provider.dart b/mobile/lib/features/channels/channel_ids_by_name_provider.dart
new file mode 100644
index 0000000000..6370a762be
--- /dev/null
+++ b/mobile/lib/features/channels/channel_ids_by_name_provider.dart
@@ -0,0 +1,27 @@
+import 'package:flutter/foundation.dart';
+import 'package:hooks_riverpod/hooks_riverpod.dart';
+
+import 'channels_provider.dart';
+
+/// Lowercased channel name to channel id, for `#channel` links.
+///
+/// `channelsProvider` publishes a new list on every live event, so watching it
+/// rebuilds every message row. This notifies only when a name or id changes.
+final channelIdsByNameProvider =
+    NotifierProvider<ChannelIdsByName, Map<String, String>>(
+      ChannelIdsByName.new,
+    );
+
+class ChannelIdsByName extends Notifier<Map<String, String>> {
+  @override
+  Map<String, String> build() => Map.unmodifiable({
+    for (final channel in ref.watch(channelsProvider).value ?? const [])
+      channel.name.toLowerCase(): channel.id,
+  });
+
+  @override
+  bool updateShouldNotify(
+    Map<String, String> previous,
+    Map<String, String> next,
+  ) => !mapEquals(previous, next);
+}
diff --git a/mobile/lib/features/channels/channels_page.dart b/mobile/lib/features/channels/channels_page.dart
index ff26cc9d13..08c5376c63 100644
--- a/mobile/lib/features/channels/channels_page.dart
+++ b/mobile/lib/features/channels/channels_page.dart
@@ -9,6 +9,7 @@ import 'dart:ui';
 
 import 'package:flutter/foundation.dart';
 import 'package:flutter/material.dart';
+import 'package:flutter/rendering.dart' show ScrollCacheExtent;
 import 'package:flutter/services.dart';
 import 'package:flutter_hooks/flutter_hooks.dart';
 import 'package:flutter/physics.dart';
@@ -43,7 +44,7 @@ import '../profile/profile_provider.dart';
 import '../profile/presence_cache_provider.dart';
 import '../../shared/identity_names/identity_names_provider.dart';
 import '../../shared/profile/user_cache_provider.dart';
-import '../pairing/pairing_page.dart';
+import '../../onboarding_app_entry.dart';
 import '../pairing/pairing_provider.dart';
 import 'channel.dart';
 import 'channel_actions_sheet.dart';
@@ -349,7 +350,7 @@ class ChannelsPage extends HookConsumerWidget {
             opaque: false,
             transitionDuration: Duration.zero,
             reverseTransitionDuration: Duration.zero,
-            pageBuilder: (_, _, _) => _CommunitySwitcherPage(
+            pageBuilder: (_, _, _) => CommunitySwitcherPage(
               arrivingCommunity: arrivingCommunity,
               destination: measureCommunityAvatar(),
               prepareLanding: prepareCommunityLanding,
@@ -380,7 +381,7 @@ class ChannelsPage extends HookConsumerWidget {
       late final _CommunitySwitcherRoute route;
       route = _CommunitySwitcherRoute(
         onTransitionProgress: onSettingsTransitionProgress,
-        builder: (_) => _CommunitySwitcherPage(
+        builder: (_) => CommunitySwitcherPage(
           destination: destination,
           prepareLanding: prepareCommunityLanding,
           onFlightChanged: (flying) {
@@ -395,6 +396,25 @@ class ChannelsPage extends HookConsumerWidget {
       });
     }
 
+    final showImportedCommunities = ref.watch(communityGridLandingProvider);
+    useEffect(() {
+      if (!showImportedCommunities) return null;
+      var cancelled = false;
+      Future<void> revealImportedCommunities() async {
+        // Let the hosted sheet and pushed Add route finish dismissing first.
+        do {
+          await WidgetsBinding.instance.endOfFrame;
+          if (cancelled || !context.mounted) return;
+        } while (ModalRoute.of(context)?.isCurrent == false);
+        if (!ref.read(communityGridLandingProvider)) return;
+        ref.read(communityGridLandingProvider.notifier).clear();
+        openCommunityGrid();
+      }
+
+      unawaited(revealImportedCommunities());
+      return () => cancelled = true;
+    }, [showImportedCommunities]);
+
     void openCommunitySwitcher() {
       // Freeze the menu shape for this presentation. If a cold permission
       // lookup is still pending, the next opening uses its resolved result.
diff --git a/mobile/lib/features/channels/channels_page/badges.dart b/mobile/lib/features/channels/channels_page/badges.dart
index 15c081045e..c2641a433d 100644
--- a/mobile/lib/features/channels/channels_page/badges.dart
+++ b/mobile/lib/features/channels/channels_page/badges.dart
@@ -12,11 +12,16 @@ class _EphemeralBadge extends StatelessWidget {
 
     return Tooltip(
       message: display.tooltipLabel,
-      child: Icon(
-        BuzzIcons.clockFading,
-        key: Key('channel-ephemeral-${channel.id}'),
-        size: 16,
-        color: context.colors.onSurfaceVariant,
+      child: SizedBox(
+        width: _kChannelIconSize,
+        child: Center(
+          child: Icon(
+            BuzzIcons.clockFading,
+            key: Key('channel-ephemeral-${channel.id}'),
+            size: 16,
+            color: context.colors.onSurfaceVariant,
+          ),
+        ),
       ),
     );
   }
diff --git a/mobile/lib/features/channels/channels_page/channel_tile.dart b/mobile/lib/features/channels/channels_page/channel_tile.dart
index 7903b07fb2..553df6abaf 100644
--- a/mobile/lib/features/channels/channels_page/channel_tile.dart
+++ b/mobile/lib/features/channels/channels_page/channel_tile.dart
@@ -86,10 +86,15 @@ class _ChannelTile extends ConsumerWidget {
             ],
             if (isMuted) ...[
               const SizedBox(width: Grid.xxs),
-              Icon(
-                BuzzIcons.bellOff,
-                size: 12,
-                color: context.colors.onSurface.withValues(alpha: 0.4),
+              SizedBox(
+                width: _kChannelIconSize,
+                child: Center(
+                  child: Icon(
+                    BuzzIcons.bellOff,
+                    size: 12,
+                    color: context.colors.onSurface.withValues(alpha: 0.4),
+                  ),
+                ),
               ),
             ],
             if (!channel.isMember && !channel.isDm)
diff --git a/mobile/lib/features/channels/channels_page/community_switcher.dart b/mobile/lib/features/channels/channels_page/community_switcher.dart
index bd295d1480..8a258e7521 100644
--- a/mobile/lib/features/channels/channels_page/community_switcher.dart
+++ b/mobile/lib/features/channels/channels_page/community_switcher.dart
@@ -62,8 +62,10 @@ class _CommunityFlight {
   final String? previousCommunityId;
 }
 
-class _CommunitySwitcherPage extends HookConsumerWidget {
-  const _CommunitySwitcherPage({
+/// Shared community management surface for app entry and switching.
+class CommunitySwitcherPage extends HookConsumerWidget {
+  const CommunitySwitcherPage({
+    super.key,
     required this.destination,
     this.arrivingCommunity,
     required this.prepareLanding,
@@ -247,7 +249,7 @@ class _CommunitySwitcherPage extends HookConsumerWidget {
       unawaited(
         navigator.push(
           MaterialPageRoute<void>(
-            builder: (_) => const PairingPage(addingCommunity: true),
+            builder: (_) => const OnboardingAppEntry(addingCommunity: true),
           ),
         ),
       );
diff --git a/mobile/lib/features/channels/channels_page/sections.dart b/mobile/lib/features/channels/channels_page/sections.dart
index 2a1bd87e3d..0987bb27a2 100644
--- a/mobile/lib/features/channels/channels_page/sections.dart
+++ b/mobile/lib/features/channels/channels_page/sections.dart
@@ -138,10 +138,9 @@ class _CustomSectionHeader extends StatelessWidget {
               ),
             ),
             Builder(
-              builder: (buttonContext) => IconButton(
+              builder: (buttonContext) => _SectionOptionsButton(
                 key: ValueKey('section-menu-${section.id}'),
                 tooltip: '${section.name} options',
-                visualDensity: VisualDensity.compact,
                 icon: Icon(
                   BuzzIcons.ellipsisVertical,
                   size: _kChannelIconSize,
@@ -209,7 +208,6 @@ class _CustomSectionHeader extends StatelessWidget {
                 },
               ),
             ),
-            const SizedBox(width: Grid.quarter),
           ],
         ),
       ),
@@ -495,10 +493,9 @@ class _SectionHeader extends StatelessWidget {
             ),
             if (sortMode case final mode?) ...[
               Builder(
-                builder: (buttonContext) => IconButton(
+                builder: (buttonContext) => _SectionOptionsButton(
                   key: ValueKey('sort-menu-$label'),
                   tooltip: '$label options',
-                  visualDensity: VisualDensity.compact,
                   icon: Icon(
                     BuzzIcons.ellipsisVertical,
                     size: _kChannelIconSize,
@@ -509,15 +506,6 @@ class _SectionHeader extends StatelessWidget {
                       context: buttonContext,
                       width: 216,
                       alignment: AnchoredPopoverAlignment.end,
-                      color: context.colors.surface,
-                      elevation: 4,
-                      shadowColor: context.colors.shadow.withValues(
-                        alpha: 0.18,
-                      ),
-                      shape: RoundedRectangleBorder(
-                        borderRadius: BorderRadius.circular(Radii.md),
-                        side: BorderSide(color: context.colors.outline),
-                      ),
                       surfaceKey: ValueKey('sort-popover-$label'),
                       items: _sortMenuItems(mode, showDivider: false),
                     );
@@ -529,7 +517,6 @@ class _SectionHeader extends StatelessWidget {
                   },
                 ),
               ),
-              const SizedBox(width: Grid.quarter),
             ],
           ],
         ),
@@ -587,3 +574,35 @@ class _SectionChevron extends StatelessWidget {
     );
   }
 }
+
+class _SectionOptionsButton extends StatelessWidget {
+  const _SectionOptionsButton({
+    super.key,
+    required this.tooltip,
+    required this.icon,
+    required this.onPressed,
+  });
+
+  final String tooltip;
+  final Widget icon;
+  final VoidCallback onPressed;
+
+  @override
+  Widget build(BuildContext context) => Semantics(
+    button: true,
+    label: tooltip,
+    onTap: onPressed,
+    excludeSemantics: true,
+    child: Tooltip(
+      message: tooltip,
+      child: SizedBox.square(
+        dimension: 40,
+        child: InkWell(
+          onTap: onPressed,
+          borderRadius: BorderRadius.circular(Radii.full),
+          child: Align(alignment: Alignment.centerRight, child: icon),
+        ),
+      ),
+    ),
+  );
+}
diff --git a/mobile/lib/features/channels/channels_page/sheets.dart b/mobile/lib/features/channels/channels_page/sheets.dart
index dcfa15d2eb..0072958c5b 100644
--- a/mobile/lib/features/channels/channels_page/sheets.dart
+++ b/mobile/lib/features/channels/channels_page/sheets.dart
@@ -292,10 +292,10 @@ class _CreateChannelRadioGroup<T> extends StatelessWidget {
       children: [
         _CreateChannelFieldLabel(label: label),
         const SizedBox(height: Grid.xxs),
-        DecoratedBox(
-          decoration: BoxDecoration(
-            color: context.colors.surface,
-            border: Border.all(color: context.colors.outlineVariant),
+        Material(
+          color: context.colors.surface,
+          shape: RoundedRectangleBorder(
+            side: BorderSide(color: context.colors.outlineVariant),
             borderRadius: BorderRadius.circular(Radii.container),
           ),
           child: RadioGroup<T>(
diff --git a/mobile/lib/features/channels/channels_page/skeleton.dart b/mobile/lib/features/channels/channels_page/skeleton.dart
index 132d57886a..0f8d305aa7 100644
--- a/mobile/lib/features/channels/channels_page/skeleton.dart
+++ b/mobile/lib/features/channels/channels_page/skeleton.dart
@@ -34,7 +34,7 @@ class _ChannelsSkeleton extends StatelessWidget {
     if (widths.isEmpty) widths.addAll(fallbackWidths);
 
     return ListView.builder(
-      cacheExtent: 0,
+      scrollCacheExtent: const ScrollCacheExtent.pixels(0),
       physics: const NeverScrollableScrollPhysics(),
       padding: EdgeInsets.fromLTRB(
         Grid.gutter,
diff --git a/mobile/lib/features/channels/channels_provider.dart b/mobile/lib/features/channels/channels_provider.dart
index ddfbc77ba9..a7ac5dad44 100644
--- a/mobile/lib/features/channels/channels_provider.dart
+++ b/mobile/lib/features/channels/channels_provider.dart
@@ -231,16 +231,54 @@ class ChannelsNotifier extends AsyncNotifier<List<Channel>> {
         .toSet();
     _cacheMemberSnapshots(memberships, replaceAll: true);
 
-    // Step 2: pull metadata for joined channels. A user with no memberships
-    // must still continue to directory discovery below.
-    final memberMetas = memberChannelIds.isEmpty
-        ? const <NostrEvent>[]
-        : await _fenced(
-            fence,
-            session.fetchHistory(
-              NostrFilters.channelMetadata(memberChannelIds.toList()),
+    // Step 2: everything below the membership list depends only on it, so
+    // send those reads together instead of one round trip after another. A
+    // user with no memberships must still continue to directory discovery.
+    final memberChannelIdList = memberChannelIds.toList();
+    final memberMetasRequest = memberChannelIds.isEmpty
+        ? Future.value(const <NostrEvent>[])
+        : session.fetchHistory(
+            NostrFilters.channelMetadata(memberChannelIdList),
+          );
+    final hiddenDmIdsRequest = _fetchHiddenDmIds(session, myPk);
+    // The authoritative membership snapshots are needed to filter Huddle
+    // backing channels. The relay-signed kind:39000 metadata identifies the
+    // relay, not the channel creator; the owner role in kind:39002 is the
+    // canonical creator identity used to reject forged Huddle links.
+    final memberEventsRequest = memberChannelIds.isEmpty
+        ? Future.value(const <NostrEvent>[])
+        : session.fetchHistory(
+            NostrFilter(
+              kinds: const [39002],
+              tags: {'#d': memberChannelIdList},
+              limit: memberChannelIdList.length,
             ),
           );
+    final huddleStartsRequest = _fetchHuddleStarts(
+      session,
+      memberChannelIdList,
+    );
+    final (
+      memberMetas,
+      hiddenDmIds,
+      memberEvents,
+      huddleStarts,
+    ) = await _fenced(fence, () async {
+      // Future.wait handles every request's failure and rethrows the first
+      // one unchanged, as soon as it happens.
+      await Future.wait(eagerError: true, [
+        memberMetasRequest,
+        hiddenDmIdsRequest,
+        memberEventsRequest,
+        huddleStartsRequest,
+      ]);
+      return (
+        await memberMetasRequest,
+        await hiddenDmIdsRequest,
+        await memberEventsRequest,
+        await huddleStartsRequest,
+      );
+    }());
 
     // Step 3: fetch the open-channel directory. The relay filters this global
     // kind:39000 query by the caller's access, but the client still rejects
@@ -278,31 +316,9 @@ class ChannelsNotifier extends AsyncNotifier<List<Channel>> {
       myPk,
     );
 
-    final hiddenDmIds = await _fenced(fence, _fetchHiddenDmIds(session, myPk));
+    // Name resolution may return without a fenced read; check before writing.
+    fence.ensureCurrent();
     _hiddenDmIds = Set.unmodifiable(hiddenDmIds);
-    // Fetch the authoritative membership snapshots before filtering Huddle
-    // backing channels. The relay-signed kind:39000 metadata identifies the
-    // relay, not the channel creator; the owner role in kind:39002 is the
-    // canonical creator identity used to reject forged Huddle links.
-    final memberCountChannelIds = memberChannelIds.toList();
-    final memberEvents = memberCountChannelIds.isEmpty
-        ? const <NostrEvent>[]
-        : await _fenced(
-            fence,
-            session.fetchHistory(
-              NostrFilter(
-                kinds: const [39002],
-                tags: {'#d': memberCountChannelIds},
-                limit: memberCountChannelIds.length,
-              ),
-            ),
-          );
-    final huddleStarts = memberCountChannelIds.isEmpty
-        ? const <NostrEvent>[]
-        : await _fenced(
-            fence,
-            _fetchHuddleStarts(session, memberCountChannelIds),
-          );
     final huddleBackingIds = huddleBackingChannelIds(
       huddleStarts,
       memberEvents,
diff --git a/mobile/lib/features/channels/compose_bar/camera_preview.dart b/mobile/lib/features/channels/compose_bar/camera_preview.dart
index 12e80e53ee..85ed7ed943 100644
--- a/mobile/lib/features/channels/compose_bar/camera_preview.dart
+++ b/mobile/lib/features/channels/compose_bar/camera_preview.dart
@@ -309,7 +309,7 @@ class _CameraCloseButton extends StatelessWidget {
           ),
           foregroundColor: Colors.white,
         ),
-        icon: Icon(BuzzIcons.arrowLeft, size: emphasized ? 24 : 18),
+        icon: Icon(BuzzIcons.arrowLeft, size: 24),
       ),
     );
   }
diff --git a/mobile/lib/features/channels/compose_bar/layout.dart b/mobile/lib/features/channels/compose_bar/layout.dart
index b51dad01b9..9017bc4ce1 100644
--- a/mobile/lib/features/channels/compose_bar/layout.dart
+++ b/mobile/lib/features/channels/compose_bar/layout.dart
@@ -263,7 +263,7 @@ class _ComposeBarLayout extends HookWidget {
           opacity: animation,
           child: SizeTransition(
             sizeFactor: animation,
-            axisAlignment: 1,
+            alignment: Alignment.bottomCenter,
             child: child,
           ),
         ),
diff --git a/mobile/lib/features/channels/compose_bar/photo_gallery_picker.dart b/mobile/lib/features/channels/compose_bar/photo_gallery_picker.dart
index 60ddbf588f..65139a9d1a 100644
--- a/mobile/lib/features/channels/compose_bar/photo_gallery_picker.dart
+++ b/mobile/lib/features/channels/compose_bar/photo_gallery_picker.dart
@@ -179,7 +179,7 @@ class _RecentPhotoGalleryPicker extends HookConsumerWidget {
                         : () => _runComposerAction(onBack),
                     tooltip: 'Back to attachment options',
                     visualDensity: VisualDensity.compact,
-                    icon: const Icon(BuzzIcons.arrowLeft, size: 20),
+                    icon: const Icon(BuzzIcons.arrowLeft, size: 24),
                   ),
                 const SizedBox(width: Grid.quarter),
                 Expanded(
diff --git a/mobile/lib/features/channels/day_divider.dart b/mobile/lib/features/channels/day_divider.dart
index 24f5bb798e..ab51482c66 100644
--- a/mobile/lib/features/channels/day_divider.dart
+++ b/mobile/lib/features/channels/day_divider.dart
@@ -28,11 +28,49 @@ class DayDivider extends StatelessWidget {
             : const Duration(milliseconds: 120),
         curve: Curves.easeOutCubic,
         opacity: isSticky ? 0 : 1,
-        child: Text(
-          label,
-          style: context.textTheme.labelSmall?.copyWith(
-            color: context.colors.onSurfaceVariant.withValues(alpha: 0.72),
-            fontWeight: FontWeight.w500,
+        child: LayoutBuilder(
+          builder: (context, constraints) => Row(
+            children: [
+              Expanded(
+                child: Divider(
+                  color: context.colors.outlineVariant,
+                  thickness: 0.5,
+                ),
+              ),
+              const SizedBox(width: Grid.xs),
+              ConstrainedBox(
+                constraints: BoxConstraints(
+                  maxWidth: (constraints.maxWidth - Grid.xs * 2) * 0.6,
+                ),
+                child: Row(
+                  mainAxisSize: MainAxisSize.min,
+                  children: [
+                    if (dayTimestamp != null) ...[
+                      _CalendarDateTile(timestamp: dayTimestamp!),
+                      const SizedBox(width: Grid.xxs),
+                    ],
+                    Flexible(
+                      child: Text(
+                        label,
+                        style: context.textTheme.labelSmall?.copyWith(
+                          color: context.colors.onSurfaceVariant.withValues(
+                            alpha: 0.72,
+                          ),
+                          fontWeight: FontWeight.w500,
+                        ),
+                      ),
+                    ),
+                  ],
+                ),
+              ),
+              const SizedBox(width: Grid.xs),
+              Expanded(
+                child: Divider(
+                  color: context.colors.outlineVariant,
+                  thickness: 0.5,
+                ),
+              ),
+            ],
           ),
         ),
       ),
@@ -44,7 +82,7 @@ class DayDivider extends StatelessWidget {
     final activeTimestamp = stickyDayTimestamp;
     final timestamp = dayTimestamp;
     return Padding(
-      padding: const EdgeInsets.symmetric(vertical: Grid.xxs + Grid.quarter),
+      padding: const EdgeInsets.symmetric(vertical: Grid.gutter),
       child: Center(
         child: activeTimestamp == null || timestamp == null
             ? _buildOpacity(context, isSticky: false)
@@ -59,3 +97,50 @@ class DayDivider extends StatelessWidget {
     );
   }
 }
+
+/// Decorative desktop calendar artwork; the adjacent label owns semantics.
+class _CalendarDateTile extends StatelessWidget {
+  const _CalendarDateTile({required this.timestamp});
+
+  final int timestamp;
+
+  @override
+  Widget build(BuildContext context) {
+    final day = DateTime.fromMillisecondsSinceEpoch(timestamp * 1000).day;
+    return ExcludeSemantics(
+      child: Container(
+        key: ValueKey('day-calendar-$timestamp'),
+        width: Grid.gutter,
+        height: Grid.gutter,
+        clipBehavior: Clip.antiAlias,
+        decoration: BoxDecoration(
+          color: Colors.white,
+          borderRadius: BorderRadius.circular(Radii.sm),
+          border: Border.all(color: context.colors.outlineVariant, width: 0.5),
+        ),
+        child: Column(
+          children: [
+            const SizedBox(
+              height: Grid.gutter * 7 / 24,
+              width: double.infinity,
+              child: ColoredBox(color: Color(0xFFFF0000)),
+            ),
+            Expanded(
+              child: Center(
+                child: Text(
+                  '$day',
+                  textScaler: TextScaler.noScaling,
+                  style: const TextStyle(
+                    color: Color(0xFF111111),
+                    fontSize: Grid.gutter / 2,
+                    height: 1,
+                  ),
+                ),
+              ),
+            ),
+          ],
+        ),
+      ),
+    );
+  }
+}
diff --git a/mobile/lib/features/channels/deep_link_dispatcher.dart b/mobile/lib/features/channels/deep_link_dispatcher.dart
index 9d3c0fdc8a..177163ebbd 100644
--- a/mobile/lib/features/channels/deep_link_dispatcher.dart
+++ b/mobile/lib/features/channels/deep_link_dispatcher.dart
@@ -26,11 +26,16 @@ class DeepLinkDispatcher extends ConsumerStatefulWidget {
   final DeepLinkDestinationBuilder? destinationBuilder;
   final bool dispatchMessageLinks;
 
+  /// App composition handles account onboarding without feature imports here.
+  /// Return true only after the destination has retained the link durably.
+  final Future<bool> Function(BuildContext, BuzzDeepLink)? onboardingHandler;
+
   const DeepLinkDispatcher({
     super.key,
     required this.child,
     this.destinationBuilder,
     this.dispatchMessageLinks = true,
+    this.onboardingHandler,
   });
 
   @override
@@ -39,6 +44,7 @@ class DeepLinkDispatcher extends ConsumerStatefulWidget {
 
 class _DeepLinkDispatcherState extends ConsumerState<DeepLinkDispatcher> {
   bool _preparingInvite = false;
+  bool _handlingOnboarding = false;
 
   @override
   void initState() {
@@ -65,7 +71,14 @@ class _DeepLinkDispatcherState extends ConsumerState<DeepLinkDispatcher> {
   }
 
   void _maybeDispatch(BuzzDeepLink? link) {
-    if (link == null || _preparingInvite) return;
+    if (link == null || _preparingInvite || _handlingOnboarding) return;
+    if (widget.onboardingHandler != null &&
+        (link is InviteDeepLink ||
+            link is NostrBindDeepLink ||
+            link is AddCommunityDeepLink)) {
+      unawaited(_dispatchOnboarding(link));
+      return;
+    }
     if (link is InviteDeepLink) {
       _maybeDispatchInvite(link);
       return;
@@ -82,6 +95,46 @@ class _DeepLinkDispatcherState extends ConsumerState<DeepLinkDispatcher> {
     _dispatchNavigableLink(link);
   }
 
+  Future<void> _dispatchOnboarding(BuzzDeepLink link) async {
+    _handlingOnboarding = true;
+    var consumed = false;
+    try {
+      final handled = await widget.onboardingHandler!(context, link);
+      if (!mounted) return;
+      if (handled) {
+        if (ref.read(pendingDeepLinkProvider) == link) {
+          ref.read(pendingDeepLinkProvider.notifier).consume();
+          consumed = true;
+        }
+      } else if (link is InviteDeepLink) {
+        _maybeDispatchInvite(link);
+      } else if (ref.read(pendingDeepLinkProvider) == link) {
+        // No fallback owns this link. It must not block later entry attempts.
+        ref.read(pendingDeepLinkProvider.notifier).consume();
+        consumed = true;
+      }
+    } catch (_) {
+      if (mounted) {
+        if (ref.read(pendingDeepLinkProvider) == link) {
+          ref.read(pendingDeepLinkProvider.notifier).consume();
+          consumed = true;
+        }
+        ScaffoldMessenger.maybeOf(context)?.showSnackBar(
+          const SnackBar(
+            content: Text(
+              'Could not open setup. Re-open the link to try again.',
+            ),
+          ),
+        );
+      }
+    } finally {
+      _handlingOnboarding = false;
+      if (mounted && (consumed || ref.read(pendingDeepLinkProvider) != link)) {
+        _maybeDispatch(ref.read(pendingDeepLinkProvider));
+      }
+    }
+  }
+
   Future<void> _dispatchNotificationLink(MessageDeepLink link) async {
     final preparation = await ref
         .read(pendingDeepLinkProvider.notifier)
diff --git a/mobile/lib/features/channels/media_viewer_page/image_controls.dart b/mobile/lib/features/channels/media_viewer_page/image_controls.dart
index 571f6bbcd5..c4e8102efa 100644
--- a/mobile/lib/features/channels/media_viewer_page/image_controls.dart
+++ b/mobile/lib/features/channels/media_viewer_page/image_controls.dart
@@ -102,7 +102,7 @@ class _MediaViewerCircleButton extends StatelessWidget {
               child: IconButton(
                 onPressed: onPressed,
                 tooltip: tooltip,
-                icon: Icon(icon, color: Colors.white, size: 20),
+                icon: Icon(icon, color: Colors.white, size: 24),
               ),
             ),
     );
diff --git a/mobile/lib/features/channels/message_content.dart b/mobile/lib/features/channels/message_content.dart
index 6e7e0d019e..a813a104e0 100644
--- a/mobile/lib/features/channels/message_content.dart
+++ b/mobile/lib/features/channels/message_content.dart
@@ -30,7 +30,7 @@ import '../../shared/custom_emoji/custom_emoji_provider.dart';
 import '../../shared/custom_emoji/custom_emoji_render.dart';
 import '../../shared/emoji/emoji_data_provider.dart';
 import '../../shared/emoji/emoji_only.dart';
-import 'channels_provider.dart';
+import 'channel_ids_by_name_provider.dart';
 import 'local_send_bubble_surface.dart';
 import 'media_viewer_page.dart';
 import 'message_content/link_normalizer.dart';
@@ -101,6 +101,9 @@ class MessageContent extends HookConsumerWidget {
   /// Distinguishes messages authored by the signed-in identity.
   final bool ownMessage;
 
+  /// Lets an adjacent day divider own spacing after the final text segment.
+  final bool trimTrailingSpacing;
+
   /// Marks the final message in a sender run for rounded corners and dots.
   final bool bubbleEnd;
 
@@ -171,6 +174,7 @@ class MessageContent extends HookConsumerWidget {
     required this.content,
     this.bubble = false,
     this.ownMessage = false,
+    this.trimTrailingSpacing = false,
     this.bubbleEnd = true,
     this.bubbleStart = true,
     this.hasReactions = false,
@@ -220,11 +224,7 @@ class MessageContent extends HookConsumerWidget {
     };
     final resolvedChannelNames = channelNames.isNotEmpty
         ? channelNames
-        : <String, String>{
-            for (final channel
-                in ref.watch(channelsProvider).asData?.value ?? const [])
-              channel.name.toLowerCase(): channel.id,
-          };
+        : ref.watch(channelIdsByNameProvider);
     final channelHandler = useRef(onChannelTap)..value = onChannelTap;
     final resolvedChannelTap = useMemoized(
       () => (String channelId) {
@@ -395,7 +395,9 @@ class MessageContent extends HookConsumerWidget {
         : const <({String text, bool attachment})>[];
     final markdown = bubble
         ? Column(
-            crossAxisAlignment: CrossAxisAlignment.start,
+            crossAxisAlignment: ownMessage
+                ? CrossAxisAlignment.end
+                : CrossAxisAlignment.start,
             mainAxisSize: MainAxisSize.min,
             children: [
               for (final (index, segment) in segments.indexed)
@@ -413,7 +415,14 @@ class MessageContent extends HookConsumerWidget {
                 else
                   Padding(
                     key: ValueKey('message-text-bubble-$index'),
-                    padding: const EdgeInsets.only(bottom: Grid.quarter),
+                    padding: EdgeInsets.only(
+                      bottom:
+                          trimTrailingSpacing &&
+                              trailingGallery == null &&
+                              index == segments.length - 1
+                          ? 0
+                          : Grid.quarter,
+                    ),
                     child: LocalSendBubbleSurface(
                       color: ownMessage
                           ? chatColors.outgoing
@@ -479,7 +488,9 @@ class MessageContent extends HookConsumerWidget {
     if (trailingGallery == null) return markdown;
 
     return Column(
-      crossAxisAlignment: CrossAxisAlignment.start,
+      crossAxisAlignment: ownMessage
+          ? CrossAxisAlignment.end
+          : CrossAxisAlignment.start,
       mainAxisSize: MainAxisSize.min,
       children: [
         if (trailingGallery.content.trim().isNotEmpty) markdown,
@@ -493,6 +504,7 @@ class MessageContent extends HookConsumerWidget {
               trailingGallery.items.map((item) => item.url).join('\u0000'),
             ),
             items: trailingGallery.items,
+            mirrored: ownMessage,
             leadingOverflow: mediaCarouselLeadingOverflow,
             trailingOverflow: mediaCarouselTrailingOverflow,
             onReply: onMediaReply,
diff --git a/mobile/lib/features/channels/message_content/media_carousel.dart b/mobile/lib/features/channels/message_content/media_carousel.dart
index 3225689484..2006e2c520 100644
--- a/mobile/lib/features/channels/message_content/media_carousel.dart
+++ b/mobile/lib/features/channels/message_content/media_carousel.dart
@@ -11,21 +11,24 @@ class _MessageGalleryPrecache extends HookWidget {
 
   @override
   Widget build(BuildContext context) {
+    final prefetch = useMemoized(_GalleryPrecache.new, const []);
+    useEffect(() => prefetch.dispose, [prefetch]);
     final providerSignature = Object.hashAll(providers);
     useEffect(() {
       var cancelled = false;
       WidgetsBinding.instance.addPostFrameCallback((_) {
-        if (cancelled || !context.mounted) {
-          return;
-        }
-        for (var index = focusedIndex - 2; index <= focusedIndex + 2; index++) {
-          if (index < 0 || index >= providers.length) {
-            continue;
-          }
-          unawaited(
-            precacheImage(providers[index], context, onError: (_, _) {}),
-          );
-        }
+        if (cancelled || !context.mounted) return;
+        // Prepare a five-photo strip immediately, then keep four ahead and two
+        // behind the current page. Two workers bound speculative network work.
+        final indices = [
+          for (var i = focusedIndex; i <= focusedIndex + 4; i++) i,
+          focusedIndex - 1,
+          focusedIndex - 2,
+        ];
+        prefetch.update(context, [
+          for (final i in indices)
+            if (i >= 0 && i < providers.length) providers[i],
+        ]);
       });
       return () => cancelled = true;
     }, [focusedIndex, providerSignature]);
@@ -33,8 +36,50 @@ class _MessageGalleryPrecache extends HookWidget {
   }
 }
 
+class _GalleryPrecache {
+  BuildContext? _context;
+  List<ImageProvider<Object>> _window = [];
+  final _ready = <ImageProvider<Object>>{};
+  final _loading = <ImageProvider<Object>>{};
+
+  void update(BuildContext context, List<ImageProvider<Object>> window) {
+    _context = context;
+    _window = window;
+    _ready.removeWhere((provider) => !window.contains(provider));
+    _drain();
+  }
+
+  void _drain() {
+    final context = _context;
+    if (context == null || !context.mounted) return;
+    for (final provider in _window) {
+      if (_loading.length >= 2) break;
+      if (_ready.contains(provider) || _loading.contains(provider)) continue;
+      _loading.add(provider);
+      unawaited(_load(context, provider));
+    }
+  }
+
+  Future<void> _load(
+    BuildContext context,
+    ImageProvider<Object> provider,
+  ) async {
+    await precacheImage(provider, context, onError: (_, _) {});
+    _loading.remove(provider);
+    if (_window.contains(provider)) _ready.add(provider);
+    _drain();
+  }
+
+  void dispose() {
+    _context = null;
+    _window = [];
+    _ready.clear();
+  }
+}
+
 class _MessageImageCarousel extends HookConsumerWidget {
   final List<MessageGalleryItem> items;
+  final bool mirrored;
   final double leadingOverflow;
   final double trailingOverflow;
   final VoidCallback? onReply;
@@ -43,6 +88,7 @@ class _MessageImageCarousel extends HookConsumerWidget {
   const _MessageImageCarousel({
     super.key,
     required this.items,
+    required this.mirrored,
     required this.leadingOverflow,
     required this.trailingOverflow,
     required this.onReply,
@@ -51,6 +97,7 @@ class _MessageImageCarousel extends HookConsumerWidget {
 
   @override
   Widget build(BuildContext context, WidgetRef ref) {
+    final viewerContext = context;
     final itemSignature = items.map((item) => item.url).join('\u0000');
     final heroTags = useMemoized(
       () => [for (var index = 0; index < items.length; index++) Object()],
@@ -62,211 +109,223 @@ class _MessageImageCarousel extends HookConsumerWidget {
 
     return MessageGalleryFrame(
       count: items.length,
-      child: LayoutBuilder(
-        builder: (context, constraints) {
-          final contentWidth = constraints.hasBoundedWidth
-              ? constraints.maxWidth
-              : messageMediaMaxWidth(context);
-          final carouselWidth =
-              contentWidth + leadingOverflow + trailingOverflow;
-          final leadingExtent = leadingOverflow;
-          final isLeftToRight = Directionality.of(context) == TextDirection.ltr;
-          final itemTrailingPaddings = [
-            for (var index = 0; index < items.length; index++)
-              index == items.length - 1 ? Grid.gutter : Grid.half,
-          ];
-          final previewDecodeWidths = [
-            for (var index = 0; index < items.length; index++)
-              math.max(1.0, carouselWidth * 0.9 - itemTrailingPaddings[index]),
-          ];
-          final devicePixelRatio = MediaQuery.devicePixelRatioOf(context);
-          final previewProviders = [
-            for (var index = 0; index < items.length; index++)
-              ResizeImage.resizeIfNeeded(
-                (previewDecodeWidths[index] * devicePixelRatio).ceil(),
-                null,
-                MediaImageProvider(
-                  url: items[index].url,
-                  auth: mediaAuth,
-                  client: mediaClient,
+      mirrored: mirrored,
+      child: Directionality(
+        textDirection: mirrored ? TextDirection.rtl : TextDirection.ltr,
+        child: LayoutBuilder(
+          builder: (context, constraints) {
+            final contentWidth = constraints.hasBoundedWidth
+                ? constraints.maxWidth
+                : messageMediaMaxWidth(context);
+            final carouselWidth =
+                contentWidth + leadingOverflow + trailingOverflow;
+            // Directionality mirrors both the starting edge and trailing overflow.
+            final leadingExtent = leadingOverflow;
+            final isLeftToRight =
+                Directionality.of(context) == TextDirection.ltr;
+            final itemTrailingPaddings = [
+              for (var index = 0; index < items.length; index++)
+                index == items.length - 1 ? Grid.gutter : Grid.half,
+            ];
+            final previewDecodeWidths = [
+              for (var index = 0; index < items.length; index++)
+                math.max(
+                  1.0,
+                  carouselWidth * 0.9 - itemTrailingPaddings[index],
                 ),
-              ),
-          ];
-          final viewerItems = [
-            for (var index = 0; index < items.length; index++)
-              MediaViewerImage(
-                url: items[index].url,
-                heroTag: heroTags[index],
-                semanticLabel: items[index].semanticLabel,
-                previewDecodeWidth: previewDecodeWidths[index],
-                aspectRatio: items[index].aspectRatio,
-                preloadProvider: previewProviders[index],
-              ),
-          ];
-          final nativeGutter = math.max(
-            0.0,
-            MediaQuery.sizeOf(context).width - carouselWidth,
-          );
-          final carousel = SizedBox(
-            key: const ValueKey('message-media-carousel'),
-            width: carouselWidth,
-            height: messageMediaCarouselHeight,
-            child: !kIsWeb && defaultTargetPlatform == TargetPlatform.iOS
-                ? OverflowBox(
-                    minWidth: carouselWidth + 2 * nativeGutter,
-                    maxWidth: carouselWidth + 2 * nativeGutter,
-                    child: IosMediaCarousel(
-                      key: ValueKey((itemSignature, mediaAuth)),
-                      providers: previewProviders,
-                      labels: [for (final item in items) item.semanticLabel],
+            ];
+            final devicePixelRatio = MediaQuery.devicePixelRatioOf(context);
+            final previewProviders = [
+              for (var index = 0; index < items.length; index++)
+                ResizeImage.resizeIfNeeded(
+                  (previewDecodeWidths[index] * devicePixelRatio).ceil(),
+                  null,
+                  MediaImageProvider(
+                    url: items[index].url,
+                    auth: mediaAuth,
+                    client: mediaClient,
+                  ),
+                ),
+            ];
+            final viewerItems = [
+              for (var index = 0; index < items.length; index++)
+                MediaViewerImage(
+                  url: items[index].url,
+                  heroTag: heroTags[index],
+                  semanticLabel: items[index].semanticLabel,
+                  previewDecodeWidth: previewDecodeWidths[index],
+                  aspectRatio: items[index].aspectRatio,
+                  preloadProvider: previewProviders[index],
+                ),
+            ];
+            final nativeGutter = math.max(
+              0.0,
+              MediaQuery.sizeOf(context).width - carouselWidth,
+            );
+            final carousel = SizedBox(
+              key: const ValueKey('message-media-carousel'),
+              width: carouselWidth,
+              height: messageMediaCarouselHeight,
+              child: !kIsWeb && defaultTargetPlatform == TargetPlatform.iOS
+                  ? OverflowBox(
+                      minWidth: carouselWidth + 2 * nativeGutter,
+                      maxWidth: carouselWidth + 2 * nativeGutter,
+                      child: IosMediaCarousel(
+                        key: ValueKey((itemSignature, mediaAuth)),
+                        providers: previewProviders,
+                        labels: [for (final item in items) item.semanticLabel],
+                        width: carouselWidth,
+                        gutter: nativeGutter,
+                        gap: Grid.half,
+                        trailingPadding: Grid.gutter,
+                        radius:
+                            (MessageAttachmentCorners.of(context) ??
+                                    BorderRadius.circular(Radii.md))
+                                .topLeft
+                                .x,
+                        onScroll: (offset) => MessageGalleryScrollNotification(
+                          offset,
+                        ).dispatch(context),
+                        onPageChanged: (index) {
+                          if (index != currentIndex.value) {
+                            unawaited(HapticFeedback.selectionClick());
+                          }
+                          currentIndex.value = index;
+                        },
+                        onOpen: (index) => openImageViewer(
+                          viewerContext,
+                          imageUrl: items[index].url,
+                          heroTag: heroTags[index],
+                          semanticLabel: items[index].semanticLabel,
+                          previewDecodeWidth: previewDecodeWidths[index],
+                          aspectRatio: items[index].aspectRatio,
+                          galleryItems: viewerItems,
+                          initialIndex: index,
+                          onReply: onReply,
+                          onMore: onMore,
+                        ),
+                      ),
+                    )
+                  : _MessageCarouselViewport(
                       width: carouselWidth,
-                      gutter: nativeGutter,
-                      gap: Grid.half,
-                      trailingPadding: Grid.gutter,
-                      radius:
-                          (MessageAttachmentCorners.of(context) ??
-                                  BorderRadius.circular(Radii.md))
-                              .topLeft
-                              .x,
-                      onScroll: (offset) => MessageGalleryScrollNotification(
-                        offset,
-                      ).dispatch(context),
+                      currentIndex: currentIndex.value,
+                      itemCount: items.length,
                       onPageChanged: (index) {
                         if (index != currentIndex.value) {
                           unawaited(HapticFeedback.selectionClick());
                         }
                         currentIndex.value = index;
                       },
-                      onOpen: (index) => openImageViewer(
-                        context,
-                        imageUrl: items[index].url,
-                        heroTag: heroTags[index],
-                        semanticLabel: items[index].semanticLabel,
-                        previewDecodeWidth: previewDecodeWidths[index],
-                        aspectRatio: items[index].aspectRatio,
-                        galleryItems: viewerItems,
-                        initialIndex: index,
-                        onReply: onReply,
-                        onMore: onMore,
-                      ),
-                    ),
-                  )
-                : _MessageCarouselViewport(
-                    width: carouselWidth,
-                    currentIndex: currentIndex.value,
-                    itemCount: items.length,
-                    onPageChanged: (index) {
-                      if (index != currentIndex.value) {
-                        unawaited(HapticFeedback.selectionClick());
-                      }
-                      currentIndex.value = index;
-                    },
-                    itemBuilder: (context, index) {
-                      final item = items[index];
-                      return Padding(
-                        key: ValueKey(
-                          'message-media-carousel-page:${item.url}',
-                        ),
-                        padding: EdgeInsetsDirectional.only(
-                          end: itemTrailingPaddings[index],
-                        ),
-                        child: Semantics(
-                          button: true,
-                          excludeSemantics: true,
-                          label: 'Open ${item.semanticLabel}',
-                          child: GestureDetector(
-                            key: ValueKey(
-                              'message-media-carousel-item:${item.url}',
-                            ),
-                            onTap: () => openImageViewer(
-                              context,
-                              imageUrl: item.url,
-                              heroTag: heroTags[index],
-                              semanticLabel: item.semanticLabel,
-                              previewDecodeWidth: previewDecodeWidths[index],
-                              aspectRatio: item.aspectRatio,
-                              galleryItems: viewerItems,
-                              initialIndex: index,
-                              onReply: onReply,
-                              onMore: onMore,
-                            ),
-                            child: Container(
-                              clipBehavior: Clip.antiAlias,
-                              decoration: BoxDecoration(
-                                color: context.colors.surfaceContainerHighest,
-                                borderRadius:
-                                    MessageAttachmentCorners.of(context) ??
-                                    BorderRadius.circular(Radii.md),
-                                border: Border.all(
-                                  color: context.colors.outlineVariant,
-                                ),
+                      itemBuilder: (context, index) {
+                        final item = items[index];
+                        return Padding(
+                          key: ValueKey(
+                            'message-media-carousel-page:${item.url}',
+                          ),
+                          padding: EdgeInsetsDirectional.only(
+                            end: itemTrailingPaddings[index],
+                          ),
+                          child: Semantics(
+                            button: true,
+                            excludeSemantics: true,
+                            label: 'Open ${item.semanticLabel}',
+                            child: GestureDetector(
+                              key: ValueKey(
+                                'message-media-carousel-item:${item.url}',
                               ),
-                              child: MediaViewerHero(
-                                tag: heroTags[index],
-                                child: ClipRRect(
+                              onTap: () => openImageViewer(
+                                viewerContext,
+                                imageUrl: item.url,
+                                heroTag: heroTags[index],
+                                semanticLabel: item.semanticLabel,
+                                previewDecodeWidth: previewDecodeWidths[index],
+                                aspectRatio: item.aspectRatio,
+                                galleryItems: viewerItems,
+                                initialIndex: index,
+                                onReply: onReply,
+                                onMore: onMore,
+                              ),
+                              child: Container(
+                                clipBehavior: Clip.antiAlias,
+                                decoration: BoxDecoration(
+                                  color: context.colors.surfaceContainerHighest,
                                   borderRadius:
                                       MessageAttachmentCorners.of(context) ??
                                       BorderRadius.circular(Radii.md),
-                                  child: MediaImage(
-                                    url: item.url,
-                                    decodeWidth: previewDecodeWidths[index],
-                                    fit: BoxFit.cover,
-                                    semanticLabel: item.semanticLabel,
-                                    frameBuilder:
-                                        (context, child, frame, synchronous) =>
-                                            frame != null || synchronous
-                                            ? child
-                                            : const MediaLoadingPlaceholder(
-                                                label: 'Loading image',
-                                              ),
-                                    errorBuilder: (_, _, _) =>
-                                        const _MediaPreviewFallback(
-                                          icon: BuzzIcons.imageOff,
-                                          label: 'Image unavailable',
-                                        ),
+                                  border: Border.all(
+                                    color: context.colors.outlineVariant,
+                                  ),
+                                ),
+                                child: MediaViewerHero(
+                                  tag: heroTags[index],
+                                  child: ClipRRect(
+                                    borderRadius:
+                                        MessageAttachmentCorners.of(context) ??
+                                        BorderRadius.circular(Radii.md),
+                                    child: MediaImage(
+                                      url: item.url,
+                                      decodeWidth: previewDecodeWidths[index],
+                                      fit: BoxFit.cover,
+                                      semanticLabel: item.semanticLabel,
+                                      frameBuilder:
+                                          (
+                                            context,
+                                            child,
+                                            frame,
+                                            synchronous,
+                                          ) => frame != null || synchronous
+                                          ? child
+                                          : const MediaLoadingPlaceholder(
+                                              label: 'Loading image',
+                                            ),
+                                      errorBuilder: (_, _, _) =>
+                                          const _MediaPreviewFallback(
+                                            icon: BuzzIcons.imageOff,
+                                            label: 'Image unavailable',
+                                          ),
+                                    ),
                                   ),
                                 ),
                               ),
                             ),
                           ),
-                        ),
-                      );
-                    },
-                  ),
-          );
+                        );
+                      },
+                    ),
+            );
 
-          final carouselSurface = Stack(
-            clipBehavior: Clip.none,
-            children: [
-              carousel,
-              if (kIsWeb || defaultTargetPlatform != TargetPlatform.iOS)
+            final carouselSurface = Stack(
+              clipBehavior: Clip.none,
+              children: [
+                carousel,
                 _MessageGalleryPrecache(
                   providers: previewProviders,
                   focusedIndex: currentIndex.value,
                 ),
-            ],
-          );
+              ],
+            );
 
-          if (leadingExtent <= 0 && trailingOverflow <= 0) {
-            return carouselSurface;
-          }
-          return SizedBox(
-            width: contentWidth,
-            height: messageMediaCarouselHeight,
-            child: OverflowBox(
-              alignment: AlignmentDirectional.centerStart,
-              minWidth: carouselWidth,
-              maxWidth: carouselWidth,
-              child: Transform.translate(
-                offset: Offset(
-                  isLeftToRight ? -leadingExtent : leadingExtent,
-                  0,
+            if (leadingExtent <= 0 && trailingOverflow <= 0) {
+              return carouselSurface;
+            }
+            return SizedBox(
+              width: contentWidth,
+              height: messageMediaCarouselHeight,
+              child: OverflowBox(
+                alignment: AlignmentDirectional.centerStart,
+                minWidth: carouselWidth,
+                maxWidth: carouselWidth,
+                child: Transform.translate(
+                  offset: Offset(
+                    isLeftToRight ? -leadingExtent : leadingExtent,
+                    0,
+                  ),
+                  child: carouselSurface,
                 ),
-                child: carouselSurface,
               ),
-            ),
-          );
-        },
+            );
+          },
+        ),
       ),
     );
   }
diff --git a/mobile/lib/features/channels/message_gallery_frame.dart b/mobile/lib/features/channels/message_gallery_frame.dart
index 6c3b3627a8..e66e4664a5 100644
--- a/mobile/lib/features/channels/message_gallery_frame.dart
+++ b/mobile/lib/features/channels/message_gallery_frame.dart
@@ -11,11 +11,13 @@ class MessageGalleryFrame extends StatelessWidget {
   final int count;
   final Widget child;
   final bool loading;
+  final bool mirrored;
 
   const MessageGalleryFrame({
     required this.count,
     required this.child,
     this.loading = false,
+    this.mirrored = false,
     super.key,
   });
 
@@ -36,11 +38,16 @@ class MessageGalleryFrame extends StatelessWidget {
     return Padding(
       padding: const EdgeInsets.only(top: Grid.half),
       child: Column(
-        crossAxisAlignment: CrossAxisAlignment.start,
+        crossAxisAlignment: mirrored
+            ? CrossAxisAlignment.end
+            : CrossAxisAlignment.start,
         mainAxisSize: MainAxisSize.min,
         children: [
           Padding(
-            padding: const EdgeInsetsDirectional.only(start: Grid.xs),
+            padding: EdgeInsets.only(
+              left: mirrored ? 0 : Grid.xs,
+              right: mirrored ? Grid.xs : 0,
+            ),
             child: loading
                 ? ExcludeSemantics(
                     child: Stack(
diff --git a/mobile/lib/features/channels/message_swipe_reply.dart b/mobile/lib/features/channels/message_swipe_reply.dart
new file mode 100644
index 0000000000..e4448dfbe1
--- /dev/null
+++ b/mobile/lib/features/channels/message_swipe_reply.dart
@@ -0,0 +1,234 @@
+import 'dart:async';
+import 'dart:math' show sin, pi;
+
+import 'package:flutter/material.dart';
+import 'package:flutter/services.dart';
+import 'package:flutter_hooks/flutter_hooks.dart';
+import 'package:hooks_riverpod/hooks_riverpod.dart';
+
+import '../../shared/theme/buzz_icons.dart';
+import '../../shared/theme/theme.dart';
+import 'thread_detail_page.dart';
+import 'timeline_message.dart';
+
+/// Reveals the existing reply action as a message is dragged to the right.
+class MessageSwipeReply extends HookConsumerWidget {
+  final TimelineMessage message;
+  final List<TimelineMessage>? allMessages;
+  final String channelId;
+  final String? currentPubkey;
+  final bool isMember;
+  final bool isArchived;
+  final Widget child;
+
+  /// The visible content, excluding author metadata and reply/reaction footers.
+  final GlobalKey contentKey;
+
+  const MessageSwipeReply({
+    super.key,
+    required this.message,
+    required this.allMessages,
+    required this.channelId,
+    required this.currentPubkey,
+    required this.isMember,
+    required this.isArchived,
+    required this.child,
+    required this.contentKey,
+  });
+
+  @override
+  Widget build(BuildContext context, WidgetRef ref) {
+    final offset = useAnimationController(upperBound: double.infinity);
+    final pulse = useAnimationController(
+      duration: const Duration(milliseconds: 180),
+    );
+    final dragDistance = useRef(0.0);
+    final layoutKey = useMemoized(GlobalKey.new);
+    final contentCenter = useState<double?>(null);
+    final didHaptic = useRef(false);
+    final cancelled = useRef(false);
+    final reducedMotion = MediaQuery.disableAnimationsOf(context);
+    final messages = allMessages;
+    if (messages == null || message.isSystem) return child;
+
+    void reset() {
+      pulse.stop();
+      pulse.value = 0;
+      if (reducedMotion) {
+        offset.value = 0;
+      } else {
+        unawaited(
+          offset.animateWith(
+            ScrollSpringSimulation(
+              const SpringDescription(mass: 1, stiffness: 500, damping: 36),
+              offset.value,
+              0,
+              0,
+            ),
+          ),
+        );
+      }
+    }
+
+    // Flutter ends an accepted drag on PointerCancel too. Preserve the raw
+    // cancellation signal so an interrupted gesture cannot open a reply.
+    return Listener(
+      onPointerCancel: (_) => cancelled.value = true,
+      child: GestureDetector(
+        behavior: HitTestBehavior.translucent,
+        excludeFromSemantics: true,
+        onHorizontalDragStart: (_) {
+          final contentBox = contentKey.currentContext?.findRenderObject();
+          final layoutBox = layoutKey.currentContext?.findRenderObject();
+          if (contentBox is RenderBox && layoutBox is RenderBox) {
+            contentCenter.value = layoutBox
+                .globalToLocal(
+                  contentBox.localToGlobal(contentBox.size.center(Offset.zero)),
+                )
+                .dy;
+          }
+          offset.stop();
+          pulse.stop();
+          pulse.value = 0;
+          offset.value = 0;
+          dragDistance.value = 0;
+          didHaptic.value = false;
+          cancelled.value = false;
+        },
+        onHorizontalDragUpdate: (details) {
+          dragDistance.value = (dragDistance.value + details.delta.dx).clamp(
+            0.0,
+            double.infinity,
+          );
+          // Keep pulling beyond readiness, with increasing rubber-band resistance.
+          final excess = dragDistance.value - 72;
+          offset.value = excess <= 0
+              ? dragDistance.value
+              : 72 + 40 * excess / (excess + 80);
+          if (offset.value >= 72 && !didHaptic.value) {
+            didHaptic.value = true;
+            unawaited(HapticFeedback.mediumImpact());
+            if (!reducedMotion) unawaited(pulse.forward(from: 0));
+          }
+          if (offset.value < 72) {
+            didHaptic.value = false;
+            pulse.stop();
+            pulse.value = 0;
+          }
+        },
+        onHorizontalDragCancel: reset,
+        onHorizontalDragEnd: (_) {
+          final reply = !cancelled.value && offset.value >= 72;
+          reset();
+          if (!reply) return;
+          Navigator.of(context).push(
+            MaterialPageRoute<void>(
+              builder: (_) => ThreadDetailPage(
+                threadHead: message,
+                allMessages: messages,
+                channelId: channelId,
+                currentPubkey: currentPubkey,
+                isMember: isMember,
+                isArchived: isArchived,
+              ),
+            ),
+          );
+        },
+        child: AnimatedBuilder(
+          animation: Listenable.merge([offset, pulse]),
+          child: child,
+          builder: (context, child) {
+            final progress = (offset.value / 72).clamp(0.0, 1.0);
+            final accent = context.appColors.accent;
+            final filledForeground =
+                ThemeData.estimateBrightnessForColor(accent) == Brightness.dark
+                ? Colors.white
+                : Colors.black;
+            return Stack(
+              key: layoutKey,
+              clipBehavior: Clip.none,
+              alignment: Alignment.centerLeft,
+              children: [
+                if (progress > 0)
+                  Positioned(
+                    left: 0,
+                    top: contentCenter.value ?? 0,
+                    width: Grid.lg,
+                    child: FractionalTranslation(
+                      translation: const Offset(0, -0.5),
+                      child: ExcludeSemantics(
+                        child: Opacity(
+                          opacity: progress,
+                          child: Transform.scale(
+                            scale: reducedMotion
+                                ? 1
+                                : (0.5 + 0.5 * progress) *
+                                      (1 + 0.12 * sin(pi * pulse.value)),
+                            alignment: Alignment.center,
+                            child: SizedBox(
+                              key: const ValueKey('swipe-reply-feedback'),
+                              width: Grid.lg,
+                              child: Column(
+                                mainAxisSize: MainAxisSize.min,
+                                children: [
+                                  SizedBox.square(
+                                    dimension: Grid.lg,
+                                    child: DecoratedBox(
+                                      key: const ValueKey('swipe-reply-circle'),
+                                      decoration: BoxDecoration(
+                                        shape: BoxShape.circle,
+                                        color: progress == 1
+                                            ? accent
+                                            : Colors.transparent,
+                                      ),
+                                      child: Stack(
+                                        fit: StackFit.expand,
+                                        children: [
+                                          CircularProgressIndicator(
+                                            value: progress,
+                                            strokeWidth: 2,
+                                            strokeAlign: -1,
+                                            color: accent,
+                                            backgroundColor: Colors.transparent,
+                                          ),
+                                          Icon(
+                                            BuzzIcons.messageSquareReply,
+                                            size: 22,
+                                            color: progress == 1
+                                                ? filledForeground
+                                                : context.colors.primary,
+                                          ),
+                                        ],
+                                      ),
+                                    ),
+                                  ),
+                                  const SizedBox(height: Grid.quarter),
+                                  Text(
+                                    'Reply',
+                                    textAlign: TextAlign.center,
+                                    style: context.textTheme.labelSmall
+                                        ?.copyWith(
+                                          color:
+                                              context.colors.onSurfaceVariant,
+                                        ),
+                                  ),
+                                ],
+                              ),
+                            ),
+                          ),
+                        ),
+                      ),
+                    ),
+                  ),
+                Transform.translate(
+                  offset: Offset(offset.value, 0),
+                  child: child,
+                ),
+              ],
+            );
+          },
+        ),
+      ),
+    );
+  }
+}
diff --git a/mobile/lib/features/channels/reply_summary_link.dart b/mobile/lib/features/channels/reply_summary_link.dart
index c3cb376827..55c3d34498 100644
--- a/mobile/lib/features/channels/reply_summary_link.dart
+++ b/mobile/lib/features/channels/reply_summary_link.dart
@@ -13,12 +13,16 @@ class ReplySummaryLink extends ConsumerWidget {
     required this.summary,
     required this.onTap,
     this.hasReactions = false,
+    this.mirrored = false,
   });
 
   final ThreadSummary summary;
   final VoidCallback onTap;
   final bool hasReactions;
 
+  /// Places the connector on the outgoing edge without reversing its contents.
+  final bool mirrored;
+
   @override
   Widget build(BuildContext context, WidgetRef ref) {
     final participants = summary.participantPubkeys.take(3).toList();
@@ -28,7 +32,10 @@ class ReplySummaryLink extends ConsumerWidget {
         : '${summary.replyCount}${summary.isLowerBound ? '+' : ''} ${summary.replyCount == 1 ? 'reply' : 'replies'}';
     final connectorTop = hasReactions ? -Grid.half : Grid.half;
     return Padding(
-      padding: const EdgeInsetsDirectional.only(start: Grid.xxs),
+      padding: EdgeInsets.only(
+        left: mirrored ? 0 : Grid.xxs,
+        right: mirrored ? Grid.xxs : 0,
+      ),
       child: Stack(
         clipBehavior: Clip.none,
         children: [
@@ -38,14 +45,17 @@ class ReplySummaryLink extends ConsumerWidget {
               child: CustomPaint(
                 painter: _ReplyConnector(
                   context.colors.outlineVariant,
-                  Directionality.of(context),
+                  mirrored ? TextDirection.rtl : TextDirection.ltr,
                   connectorTop,
                 ),
               ),
             ),
           ),
           Padding(
-            padding: const EdgeInsetsDirectional.only(start: Grid.twelve),
+            padding: EdgeInsets.only(
+              left: mirrored ? 0 : Grid.twelve,
+              right: mirrored ? Grid.twelve : 0,
+            ),
             child: Semantics(
               button: true,
               label: 'View thread: $label',
diff --git a/mobile/lib/features/channels/thread_detail_page.dart b/mobile/lib/features/channels/thread_detail_page.dart
index 0541f97229..d0c6de7e7b 100644
--- a/mobile/lib/features/channels/thread_detail_page.dart
+++ b/mobile/lib/features/channels/thread_detail_page.dart
@@ -1,3 +1,4 @@
+import 'message_swipe_reply.dart';
 import '../../shared/widgets/ios_scroll_to_top.dart';
 import 'message_footer_layout.dart';
 import 'reply_summary_link.dart';
@@ -35,6 +36,7 @@ import 'channel_messages_provider.dart';
 import 'channel_typing_provider.dart';
 import 'channel_typing_indicator.dart';
 import 'thread_replies_provider.dart';
+import 'channel_ids_by_name_provider.dart';
 import 'channels_provider.dart';
 import 'compose_bar.dart';
 import 'composer_dock_size_reporter.dart';
@@ -898,17 +900,14 @@ class ThreadDetailPage extends HookConsumerWidget {
       return null;
     }, [settledImeBottomInset.value]);
 
-    // Channel names for message content rendering.
-    final channelsAsync = ref.watch(channelsProvider);
-    final channel = channelsAsync.value
-        ?.where((candidate) => candidate.id == channelId)
-        .firstOrNull;
-    final channelNamesMap = <String, String>{};
-    channelsAsync.whenData((channels) {
-      for (final ch in channels) {
-        channelNamesMap[ch.name.toLowerCase()] = ch.id;
-      }
-    });
+    final channel = ref.watch(
+      channelsProvider.select(
+        (channels) => channels.value
+            ?.where((candidate) => candidate.id == channelId)
+            .firstOrNull,
+      ),
+    );
+    final channelNamesMap = ref.watch(channelIdsByNameProvider);
 
     return FrostedScaffold(
       foreground: threadViewportVisible
diff --git a/mobile/lib/features/channels/thread_detail_page/message_list.dart b/mobile/lib/features/channels/thread_detail_page/message_list.dart
index d4894bfe29..cfd7572b5d 100644
--- a/mobile/lib/features/channels/thread_detail_page/message_list.dart
+++ b/mobile/lib/features/channels/thread_detail_page/message_list.dart
@@ -97,6 +97,7 @@ class _ThreadMessageList extends HookWidget {
           ),
           _ThreadMessage(
             message: head,
+            startsDay: true,
             channelNames: channelNames,
             channelId: channelId,
             currentPubkey: currentPubkey,
@@ -300,6 +301,13 @@ class _ThreadMessageList extends HookWidget {
                                     ),
                                   _ThreadMessage(
                                     message: reply,
+                                    startsDay: showDayDivider,
+                                    endsDay:
+                                        nextReply != null &&
+                                        !isSameDay(
+                                          reply.createdAt,
+                                          nextReply.createdAt,
+                                        ),
                                     channelNames: channelNames,
                                     channelId: channelId,
                                     currentPubkey: currentPubkey,
diff --git a/mobile/lib/features/channels/thread_detail_page/nested_thread_summary_row.dart b/mobile/lib/features/channels/thread_detail_page/nested_thread_summary_row.dart
index 6adf6e1ab6..fc79a822d0 100644
--- a/mobile/lib/features/channels/thread_detail_page/nested_thread_summary_row.dart
+++ b/mobile/lib/features/channels/thread_detail_page/nested_thread_summary_row.dart
@@ -23,29 +23,41 @@ class _NestedThreadSummaryRow extends ConsumerWidget {
 
   @override
   Widget build(BuildContext context, WidgetRef ref) {
-    return Padding(
-      padding: const EdgeInsets.only(
-        left: messageAvatarSize + messageAvatarContentGap + Grid.xxs,
-        bottom: Grid.xxs,
-      ),
-      child: ReplySummaryLink(
-        key: ValueKey('nested-thread-summary-${replyMessage.id}'),
-        summary: summary,
-        hasReactions: replyMessage.reactions.isNotEmpty,
-        onTap: () {
-          Navigator.of(context).push(
-            MaterialPageRoute<void>(
-              builder: (_) => ThreadDetailPage(
-                threadHead: replyMessage,
-                allMessages: allMessages,
-                channelId: channelId,
-                currentPubkey: currentPubkey,
-                isMember: isMember,
-                isArchived: isArchived,
-              ),
-            ),
-          );
-        },
+    final ownMessage =
+        currentPubkey?.toLowerCase() == replyMessage.pubkey.toLowerCase();
+    return Align(
+      alignment: ownMessage ? Alignment.centerRight : Alignment.centerLeft,
+      child: Directionality(
+        textDirection: Directionality.of(context),
+        child: Padding(
+          padding: EdgeInsets.only(
+            left: ownMessage
+                ? 0
+                : messageAvatarSize + messageAvatarContentGap + Grid.xxs,
+            right: ownMessage ? Grid.xxs : 0,
+            bottom: Grid.xxs,
+          ),
+          child: ReplySummaryLink(
+            key: ValueKey('nested-thread-summary-${replyMessage.id}'),
+            summary: summary,
+            mirrored: ownMessage,
+            hasReactions: replyMessage.reactions.isNotEmpty,
+            onTap: () {
+              Navigator.of(context).push(
+                MaterialPageRoute<void>(
+                  builder: (_) => ThreadDetailPage(
+                    threadHead: replyMessage,
+                    allMessages: allMessages,
+                    channelId: channelId,
+                    currentPubkey: currentPubkey,
+                    isMember: isMember,
+                    isArchived: isArchived,
+                  ),
+                ),
+              );
+            },
+          ),
+        ),
       ),
     );
   }
diff --git a/mobile/lib/features/channels/thread_detail_page/thread_message.dart b/mobile/lib/features/channels/thread_detail_page/thread_message.dart
index aa4f6e1d71..89bf0ef415 100644
--- a/mobile/lib/features/channels/thread_detail_page/thread_message.dart
+++ b/mobile/lib/features/channels/thread_detail_page/thread_message.dart
@@ -7,6 +7,8 @@ class _ThreadMessage extends HookConsumerWidget {
   final String? currentPubkey;
   final bool showAuthor;
   final bool showAvatar;
+  final bool startsDay;
+  final bool endsDay;
   final bool isHighlighted;
   final List<TimelineMessage>? allMessages;
   final bool isMember;
@@ -25,6 +27,8 @@ class _ThreadMessage extends HookConsumerWidget {
     required this.currentPubkey,
     required this.showAuthor,
     this.showAvatar = true,
+    this.startsDay = false,
+    this.endsDay = false,
     this.isHighlighted = false,
     this.allMessages,
     this.isMember = false,
@@ -37,8 +41,10 @@ class _ThreadMessage extends HookConsumerWidget {
   @override
   Widget build(BuildContext context, WidgetRef ref) {
     final messageSnapshotKey = useMemoized(GlobalKey.new, const []);
+    final swipeContentKey = useMemoized(GlobalKey.new, const []);
     final mediaOffset = useMessageMediaOffset(message.content, message.tags);
     final pk = message.pubkey.toLowerCase();
+    final ownMessage = currentPubkey?.toLowerCase() == pk;
     final profile =
         ref.watch(userCacheProvider.select((cache) => cache[pk])) ??
         ref.read(userCacheProvider.notifier).get(pk);
@@ -128,13 +134,13 @@ class _ThreadMessage extends HookConsumerWidget {
             alpha: _landingHighlightOpacity * highlightProgress,
           );
 
-    return NotificationListener<MessageGalleryScrollNotification>(
+    final content = NotificationListener<MessageGalleryScrollNotification>(
       onNotification: (notification) {
         mediaOffset.value = notification.offset;
         return true;
       },
       child: Padding(
-        padding: EdgeInsets.only(top: showAuthor ? Grid.xs : 0),
+        padding: EdgeInsets.only(top: showAuthor && !startsDay ? Grid.xs : 0),
         child: DecoratedBox(
           key: ValueKey('thread-message-${message.id}'),
           decoration: BoxDecoration(
@@ -156,31 +162,40 @@ class _ThreadMessage extends HookConsumerWidget {
               snapshotKey: messageSnapshotKey,
               child: Padding(
                 padding: EdgeInsets.only(
-                  bottom: showAvatar ? Grid.quarter : Grid.quarter / 2,
+                  bottom: endsDay
+                      ? 0
+                      : (showAvatar ? Grid.quarter : Grid.quarter / 2),
                 ),
                 child: MessageFooterLayout(
                   animateSize: true,
                   overlap: message.reactions.isNotEmpty ? Grid.xs : 0,
                   footer: (isThreadHead || message.reactions.isNotEmpty)
-                      ? Padding(
-                          padding: const EdgeInsets.only(
-                            left:
-                                messageAvatarSize +
-                                messageAvatarContentGap +
-                                Grid.xxs,
-                          ),
-                          child: ReactionRow(
-                            combined: true,
-                            messageId: message.id,
-                            channelId: channelId,
-                            reactions: message.reactions,
-                            onToggle: (emoji) =>
-                                toggleReaction(ref, message, emoji),
-                            showAddButton: isMember && !isArchived,
-                            onAddReaction: () => showAddReactionPicker(
-                              context: context,
-                              ref: ref,
-                              message: message,
+                      ? Align(
+                          alignment: ownMessage
+                              ? Alignment.centerRight
+                              : Alignment.centerLeft,
+                          child: Padding(
+                            padding: EdgeInsets.only(
+                              right: ownMessage ? Grid.xxs : 0,
+                              left: ownMessage
+                                  ? 0
+                                  : messageAvatarSize +
+                                        messageAvatarContentGap +
+                                        Grid.xxs,
+                            ),
+                            child: ReactionRow(
+                              combined: true,
+                              messageId: message.id,
+                              channelId: channelId,
+                              reactions: message.reactions,
+                              onToggle: (emoji) =>
+                                  toggleReaction(ref, message, emoji),
+                              showAddButton: isMember && !isArchived,
+                              onAddReaction: () => showAddReactionPicker(
+                                context: context,
+                                ref: ref,
+                                message: message,
+                              ),
                             ),
                           ),
                         )
@@ -191,29 +206,41 @@ class _ThreadMessage extends HookConsumerWidget {
                       clipBehavior: Clip.none,
                       children: [
                         Row(
+                          textDirection: ownMessage
+                              ? TextDirection.rtl
+                              : TextDirection.ltr,
                           crossAxisAlignment: CrossAxisAlignment.end,
                           children: [
-                            const SizedBox(width: messageAvatarSize),
-                            const SizedBox(width: messageAvatarContentGap),
+                            if (!ownMessage)
+                              const SizedBox(width: messageAvatarSize),
+                            if (!ownMessage)
+                              const SizedBox(width: messageAvatarContentGap),
                             Expanded(
                               child: Padding(
                                 padding: EdgeInsets.only(
-                                  top: showAuthor ? Grid.half : 0,
+                                  top: showAuthor && !startsDay ? Grid.half : 0,
                                 ),
                                 child: Column(
-                                  crossAxisAlignment: CrossAxisAlignment.start,
+                                  crossAxisAlignment: ownMessage
+                                      ? CrossAxisAlignment.end
+                                      : CrossAxisAlignment.start,
                                   children: [
                                     if (showAuthor)
                                       Padding(
-                                        padding: const EdgeInsets.only(
+                                        padding: EdgeInsets.only(
                                           bottom: Grid.quarter,
-                                          left: Grid.xs,
+                                          left: ownMessage ? 0 : Grid.xs,
+                                          right: ownMessage ? Grid.xs : 0,
                                         ),
                                         child: Row(
                                           children: [
                                             Expanded(
                                               child: MessageAuthorMeta(
                                                 showTimestamp: true,
+                                                reversed: false,
+                                                alignment: ownMessage
+                                                    ? MainAxisAlignment.end
+                                                    : MainAxisAlignment.start,
                                                 nameStyle:
                                                     messageUsernameTextStyle
                                                         .copyWith(
@@ -284,14 +311,15 @@ class _ThreadMessage extends HookConsumerWidget {
                                         ),
                                       ),
                                     MessageContent(
+                                      key: swipeContentKey,
                                       content: message.content,
                                       bubble: true,
                                       hasReactions:
                                           message.reactions.isNotEmpty,
                                       bubbleEnd: showAvatar,
                                       bubbleStart: showAuthor,
-                                      ownMessage:
-                                          currentPubkey?.toLowerCase() == pk,
+                                      ownMessage: ownMessage,
+                                      trimTrailingSpacing: endsDay,
                                       mentionNames: resolvedMentionNames,
                                       mentionLabels: mentionLabels,
                                       agentMentionPubkeys: agentMentionPubkeys,
@@ -362,9 +390,10 @@ class _ThreadMessage extends HookConsumerWidget {
                             ),
                           ],
                         ),
-                        if (showAvatar)
+                        if (showAvatar && !ownMessage)
                           Positioned(
-                            left: 0,
+                            left: ownMessage ? null : 0,
+                            right: ownMessage ? 0 : null,
                             bottom: 0,
                             child: MessageMediaAvatar(
                               offset: mediaOffset,
@@ -407,5 +436,15 @@ class _ThreadMessage extends HookConsumerWidget {
         ),
       ),
     );
+    return MessageSwipeReply(
+      contentKey: swipeContentKey,
+      message: message,
+      allMessages: allMessages,
+      channelId: channelId,
+      currentPubkey: currentPubkey,
+      isMember: isMember,
+      isArchived: isArchived,
+      child: content,
+    );
   }
 }
diff --git a/mobile/lib/features/invites/invite_create_provider.dart b/mobile/lib/features/invites/invite_create_provider.dart
index 88c06f847b..1e0ba6aa2f 100644
--- a/mobile/lib/features/invites/invite_create_provider.dart
+++ b/mobile/lib/features/invites/invite_create_provider.dart
@@ -7,6 +7,7 @@ import 'package:hooks_riverpod/hooks_riverpod.dart';
 import 'package:nostr/nostr.dart' as nostr;
 import 'package:share_plus/share_plus.dart';
 
+import '../../shared/hosted/hosted_relay_auth.dart';
 import '../../shared/community/community_membership_provider.dart';
 import '../../shared/utils/string_utils.dart';
 import '../../shared/relay/relay.dart';
@@ -277,7 +278,7 @@ class RelayCommunityInviteActions implements CommunityInviteActions {
 
 /// Supplies the HTTP client used to mint community invite links.
 final communityInviteHttpClientProvider = Provider<http.Client>((ref) {
-  final client = http.Client();
+  final client = ref.watch(hostedHttpClientFactoryProvider)();
   ref.onDispose(client.close);
   return client;
 });
diff --git a/mobile/lib/features/invites/invite_join_provider.dart b/mobile/lib/features/invites/invite_join_provider.dart
index a665dded1b..b7a6a7731d 100644
--- a/mobile/lib/features/invites/invite_join_provider.dart
+++ b/mobile/lib/features/invites/invite_join_provider.dart
@@ -4,6 +4,8 @@ import 'package:http/http.dart' as http;
 import 'package:hooks_riverpod/hooks_riverpod.dart';
 import 'package:nostr/nostr.dart' as nostr;
 
+import '../../shared/hosted/hosted_relay_auth.dart';
+import '../../shared/hosted/community_entry_requirements.dart';
 import '../../shared/auth/auth.dart';
 import '../../shared/deeplink/deep_link.dart';
 import '../../shared/relay/relay_provider.dart';
@@ -11,7 +13,7 @@ import '../../shared/relay/relay_session.dart';
 import '../../shared/relay/relay_validation.dart';
 
 final inviteJoinHttpClientProvider = Provider<http.Client>((ref) {
-  final client = http.Client();
+  final client = ref.watch(hostedHttpClientFactoryProvider)();
   ref.onDispose(client.close);
   return client;
 });
@@ -171,6 +173,7 @@ class InviteJoinNotifier extends Notifier<InviteJoinState> {
       requiresFreshInvite: false,
     );
     try {
+      CommunityEntryRequirements.requireSelfHosted(invite.relayUrl);
       final communities = await ref.read(communityListProvider.future);
       final existing = _existingCommunity(communities, invite.relayUrl);
       if (existing != null) {
diff --git a/mobile/lib/features/onboarding/hosted_community_selection.dart b/mobile/lib/features/onboarding/hosted_community_selection.dart
new file mode 100644
index 0000000000..6917d925cd
--- /dev/null
+++ b/mobile/lib/features/onboarding/hosted_community_selection.dart
@@ -0,0 +1,41 @@
+import 'package:flutter/material.dart';
+import 'package:flutter_hooks/flutter_hooks.dart';
+import 'package:hooks_riverpod/hooks_riverpod.dart';
+
+import '../../shared/hosted/hosted_flow.dart';
+import '../../shared/theme/grid.dart';
+
+/// Public community choices only; identity material remains in secure storage.
+class HostedCommunitySelection extends HookConsumerWidget {
+  const HostedCommunitySelection({super.key, required this.flow});
+  final HostedFlow flow;
+
+  @override
+  Widget build(BuildContext context, WidgetRef ref) {
+    useListenable(flow);
+    return Material(
+      type: MaterialType.transparency,
+      child: Column(
+        crossAxisAlignment: CrossAxisAlignment.stretch,
+        children: [
+          for (final community in flow.communities)
+            CheckboxListTile(
+              key: ValueKey(community.relayUrl),
+              title: Text(community.name),
+              subtitle: Text(Uri.parse(community.relayUrl).host),
+              value: flow.selectedRelays.contains(community.relayUrl),
+              onChanged: (value) =>
+                  flow.selectCommunity(community.relayUrl, value ?? false),
+            ),
+          const SizedBox(height: Grid.sm),
+          FilledButton(
+            onPressed: flow.selectedRelays.isEmpty
+                ? null
+                : flow.addSelectedCommunities,
+            child: const Text('Continue'),
+          ),
+        ],
+      ),
+    );
+  }
+}
diff --git a/mobile/lib/features/onboarding/hosted_connect_page.dart b/mobile/lib/features/onboarding/hosted_connect_page.dart
new file mode 100644
index 0000000000..d0494e3eb8
--- /dev/null
+++ b/mobile/lib/features/onboarding/hosted_connect_page.dart
@@ -0,0 +1,65 @@
+import 'package:flutter/material.dart';
+import 'package:flutter_hooks/flutter_hooks.dart';
+import 'package:hooks_riverpod/hooks_riverpod.dart';
+
+import '../../shared/hosted/hosted_flow.dart';
+import '../../shared/widgets/modal_presentation.dart';
+import 'hosted_connect_sheet.dart';
+
+/// Presents setup with the same modal chrome as the app's other sheets.
+class HostedConnectPage extends HookConsumerWidget {
+  const HostedConnectPage({
+    super.key,
+    required this.flow,
+    required this.onClose,
+  });
+  final HostedFlow flow;
+  final VoidCallback onClose;
+
+  @override
+  Widget build(BuildContext context, WidgetRef ref) {
+    useEffect(() {
+      var active = true;
+      ModalRoute<dynamic>? sheetRoute;
+      WidgetsBinding.instance.addPostFrameCallback((_) async {
+        if (!active || !context.mounted) return;
+        while (active &&
+            context.mounted &&
+            flow.stage != HostedFlowStage.complete &&
+            flow.stage != HostedFlowStage.idle) {
+          if (!context.mounted) return;
+          await showBuzzModalBottomSheet<void>(
+            context: context,
+            title: 'Connect to Builderlab',
+            useRootNavigator: true,
+            isScrollControlled: true,
+            useSafeArea: true,
+            builder: (sheetContext) {
+              sheetRoute = ModalRoute.of(sheetContext);
+              return HostedConnectSheet(flow: flow);
+            },
+          );
+          if (!active || !context.mounted) return;
+          if (flow.stage != HostedFlowStage.profile) {
+            onClose();
+            return;
+          }
+          // Dismissing an optional profile is a skip. Re-present the continuing
+          // batch so a later error or choice never ends up behind a closed sheet.
+          flow.finishProfile();
+          await WidgetsBinding.instance.endOfFrame;
+        }
+      });
+      return () {
+        active = false;
+        final route = sheetRoute;
+        WidgetsBinding.instance.addPostFrameCallback((_) {
+          if (route != null && route.isActive) {
+            route.navigator?.removeRoute(route);
+          }
+        });
+      };
+    }, [flow]);
+    return const SizedBox.shrink();
+  }
+}
diff --git a/mobile/lib/features/onboarding/hosted_connect_sheet.dart b/mobile/lib/features/onboarding/hosted_connect_sheet.dart
new file mode 100644
index 0000000000..9e0f1bb965
--- /dev/null
+++ b/mobile/lib/features/onboarding/hosted_connect_sheet.dart
@@ -0,0 +1,135 @@
+import 'package:flutter/material.dart';
+import 'package:flutter_hooks/flutter_hooks.dart';
+import 'package:hooks_riverpod/hooks_riverpod.dart';
+
+import '../../shared/hosted/hosted_flow.dart';
+import '../../shared/hosted/hosted_flow_problem_message.dart';
+import '../../shared/utils/string_utils.dart';
+import '../../shared/theme/grid.dart';
+import '../../shared/theme/theme_extensions.dart';
+import 'hosted_community_selection.dart';
+import 'hosted_join_policy_view.dart';
+import 'hosted_profile_setup.dart';
+
+/// Presents the app-scoped real flow without retaining credentials or keys.
+class HostedConnectSheet extends HookConsumerWidget {
+  const HostedConnectSheet({super.key, required this.flow});
+  final HostedFlow flow;
+
+  @override
+  Widget build(BuildContext context, WidgetRef ref) {
+    useListenable(flow);
+    final working = flow.stage == HostedFlowStage.working;
+    final message = switch (flow.stage) {
+      HostedFlowStage.idle => 'Continue connecting your account.',
+      HostedFlowStage.working =>
+        flow.addingCommunityName == null
+            ? 'Securing your account and finding communities…'
+            : 'Adding ${flow.addingCommunityName}…',
+      HostedFlowStage.chooseCommunities => 'Choose your communities',
+      HostedFlowStage.communityConflict =>
+        '${flow.addingCommunityName} is already saved with a different identity. '
+            'Keep that identity and skip this addition, or return to your choices?',
+      HostedFlowStage.chooseIdentity =>
+        flow.identityChoices.where((choice) => choice.fromCloud).length > 1
+            ? 'Choose a backed-up identity to connect to Builderlab. Your other backups and saved community keys will be kept. This app cannot change the selected Builderlab identity later.'
+            : flow.identityChoices.any((choice) => choice.fromCloud)
+            ? 'Use your Builderlab identity on this device? It differs from your saved community identities. Those keys and your cloud backups will be kept. This app cannot change the selected Builderlab identity later.'
+            : 'Choose the identity to connect to Builderlab. It will be bound to your account and backed up. Existing keys will be kept. This app cannot change the selected Builderlab identity later.',
+      HostedFlowStage.profile =>
+        'What should people in this community call you? You can add a photo in Settings.',
+      HostedFlowStage.acceptPolicy =>
+        'Review this community’s terms and privacy policy before joining.',
+      HostedFlowStage.signIn => 'Complete sign-in in your browser.',
+      HostedFlowStage.browserReturned =>
+        'Continue setup in your browser. Open your community in Buzz when it is ready.',
+      HostedFlowStage.complete => 'Your community is ready.',
+      HostedFlowStage.blocked => hostedFlowProblemMessage(flow.problem),
+    };
+    return Padding(
+      padding: const EdgeInsets.fromLTRB(
+        Grid.gutter,
+        Grid.sm,
+        Grid.gutter,
+        Grid.lg,
+      ),
+      child: SingleChildScrollView(
+        child: Column(
+          mainAxisSize: MainAxisSize.min,
+          crossAxisAlignment: CrossAxisAlignment.stretch,
+          children: [
+            Text(message, style: context.textTheme.bodyLarge),
+            const SizedBox(height: Grid.sm),
+            for (final choice in flow.identityChoices)
+              Padding(
+                padding: const EdgeInsets.only(bottom: Grid.sm),
+                child: OutlinedButton(
+                  onPressed: () => flow.chooseIdentity(choice.pubkey),
+                  child: Padding(
+                    padding: const EdgeInsets.all(Grid.sm),
+                    child: Column(
+                      children: [
+                        Text(choice.label),
+                        Text(fullNpub(choice.pubkey) ?? choice.pubkey),
+                      ],
+                    ),
+                  ),
+                ),
+              ),
+            if (flow.stage == HostedFlowStage.profile &&
+                flow.saveProfile != null)
+              HostedProfileSetup(
+                save: flow.saveProfile!,
+                skip: flow.finishProfile,
+              ),
+            if (flow.stage == HostedFlowStage.acceptPolicy &&
+                flow.joinPolicy != null)
+              HostedJoinPolicyView(
+                key: ValueKey(flow.joinPolicy!.version),
+                policy: flow.joinPolicy!,
+                onAccept: flow.acceptJoinPolicy,
+              ),
+            if (flow.stage == HostedFlowStage.chooseCommunities)
+              HostedCommunitySelection(flow: flow),
+            if (flow.stage == HostedFlowStage.communityConflict)
+              FilledButton(
+                onPressed: flow.skipConflictingCommunity,
+                child: const Text('Keep saved identity and skip'),
+              ),
+            if (flow.canChangeCommunities)
+              OutlinedButton(
+                onPressed: flow.backToCommunityChoices,
+                child: const Text('Back to choices'),
+              ),
+            if ((flow.stage == HostedFlowStage.blocked ||
+                    flow.stage == HostedFlowStage.communityConflict) &&
+                flow.addedCommunityCount > 0)
+              Text(
+                '${flow.addedCommunityCount} '
+                '${flow.addedCommunityCount == 1 ? "community" : "communities"} added and kept.'
+                '${flow.canRetry && flow.stage == HostedFlowStage.blocked ? " Retry continues the remaining additions." : ""}',
+              ),
+            if (working) const Center(child: CircularProgressIndicator()),
+            if (!working &&
+                flow.stage != HostedFlowStage.profile &&
+                flow.stage != HostedFlowStage.acceptPolicy &&
+                flow.stage != HostedFlowStage.chooseIdentity &&
+                flow.stage != HostedFlowStage.chooseCommunities &&
+                flow.stage != HostedFlowStage.communityConflict &&
+                flow.stage != HostedFlowStage.complete &&
+                flow.stage != HostedFlowStage.browserReturned &&
+                flow.canRetry)
+              FilledButton(
+                onPressed: flow.retry,
+                child: Text(
+                  flow.stage == HostedFlowStage.signIn
+                      ? 'Start login again'
+                      : 'Try again',
+                ),
+              ),
+          ],
+        ),
+      ),
+    );
+  }
+}
diff --git a/mobile/lib/features/onboarding/hosted_join_policy_view.dart b/mobile/lib/features/onboarding/hosted_join_policy_view.dart
new file mode 100644
index 0000000000..8900e49ae0
--- /dev/null
+++ b/mobile/lib/features/onboarding/hosted_join_policy_view.dart
@@ -0,0 +1,61 @@
+import 'package:flutter/material.dart';
+import 'package:flutter_hooks/flutter_hooks.dart';
+import '../../shared/hosted/hosted_join_policy.dart';
+import '../../shared/theme/grid.dart';
+
+/// Consent is explicit and scoped to the policy version shown on this screen.
+class HostedJoinPolicyView extends HookWidget {
+  const HostedJoinPolicyView({
+    super.key,
+    required this.policy,
+    required this.onAccept,
+  });
+  final HostedJoinPolicy policy;
+  final VoidCallback onAccept;
+
+  @override
+  Widget build(BuildContext context) {
+    final ageConfirmed = useState(false);
+    return Material(
+      type: MaterialType.transparency,
+      child: Column(
+        crossAxisAlignment: CrossAxisAlignment.stretch,
+        children: [
+          if (policy.terms != null)
+            ExpansionTile(
+              title: const Text('Terms of service'),
+              children: [
+                Padding(
+                  padding: const EdgeInsets.all(Grid.sm),
+                  child: SelectableText(policy.terms!),
+                ),
+              ],
+            ),
+          if (policy.privacy != null)
+            ExpansionTile(
+              title: const Text('Privacy policy'),
+              children: [
+                Padding(
+                  padding: const EdgeInsets.all(Grid.sm),
+                  child: SelectableText(policy.privacy!),
+                ),
+              ],
+            ),
+          if (policy.ageRequired)
+            CheckboxListTile(
+              value: ageConfirmed.value,
+              onChanged: (value) => ageConfirmed.value = value ?? false,
+              title: const Text('I am 18 or older'),
+            ),
+          const SizedBox(height: Grid.sm),
+          FilledButton(
+            onPressed: !policy.ageRequired || ageConfirmed.value
+                ? onAccept
+                : null,
+            child: const Text('Accept and join'),
+          ),
+        ],
+      ),
+    );
+  }
+}
diff --git a/mobile/lib/features/onboarding/hosted_profile_setup.dart b/mobile/lib/features/onboarding/hosted_profile_setup.dart
new file mode 100644
index 0000000000..307a7e281d
--- /dev/null
+++ b/mobile/lib/features/onboarding/hosted_profile_setup.dart
@@ -0,0 +1,55 @@
+import 'package:flutter/material.dart';
+import 'package:flutter_hooks/flutter_hooks.dart';
+import 'package:hooks_riverpod/hooks_riverpod.dart';
+import '../../shared/theme/grid.dart';
+
+/// Reuses the account flow's scoped profile writer; skipping publishes nothing.
+class HostedProfileSetup extends HookConsumerWidget {
+  const HostedProfileSetup({super.key, required this.save, required this.skip});
+  final Future<void> Function(String) save;
+  final VoidCallback skip;
+
+  @override
+  Widget build(BuildContext context, WidgetRef ref) {
+    final name = useTextEditingController();
+    useListenable(name);
+    final busy = useState(false);
+    final error = useState(false);
+    return Column(
+      crossAxisAlignment: CrossAxisAlignment.stretch,
+      children: [
+        TextField(
+          controller: name,
+          maxLength: 100,
+          enabled: !busy.value,
+          textCapitalization: TextCapitalization.words,
+          decoration: const InputDecoration(labelText: 'Display name'),
+        ),
+        if (error.value)
+          const Text('We could not save your name. Try again or skip for now.'),
+        const SizedBox(height: Grid.sm),
+        FilledButton(
+          onPressed: busy.value || name.text.trim().isEmpty
+              ? null
+              : () async {
+                  if (name.text.trim().isEmpty) return;
+                  busy.value = true;
+                  error.value = false;
+                  try {
+                    await save(name.text.trim());
+                  } catch (_) {
+                    if (context.mounted) error.value = true;
+                  } finally {
+                    if (context.mounted) busy.value = false;
+                  }
+                },
+          child: Text(busy.value ? 'Saving…' : 'Continue'),
+        ),
+        TextButton(
+          onPressed: busy.value ? null : skip,
+          child: const Text('Skip for now'),
+        ),
+      ],
+    );
+  }
+}
diff --git a/mobile/lib/features/onboarding/hosted_reconnect_banner.dart b/mobile/lib/features/onboarding/hosted_reconnect_banner.dart
new file mode 100644
index 0000000000..9ce55baf70
--- /dev/null
+++ b/mobile/lib/features/onboarding/hosted_reconnect_banner.dart
@@ -0,0 +1,79 @@
+import 'dart:async';
+import 'package:flutter/material.dart';
+import 'package:flutter_hooks/flutter_hooks.dart';
+import 'package:hooks_riverpod/hooks_riverpod.dart';
+
+import '../../shared/hosted/builderlab_account.dart';
+import '../../shared/hosted/hosted_flow.dart';
+import '../../shared/hosted/hosted_relay_auth.dart';
+import '../../shared/relay/relay_provider.dart';
+import '../../shared/relay/relay_session.dart';
+import '../../shared/theme/grid.dart';
+import '../../shared/theme/app_theme.dart';
+
+/// Leaves cached content and community switching available while disconnected.
+class HostedReconnectBanner extends HookConsumerWidget {
+  const HostedReconnectBanner({super.key, required this.flow});
+  final HostedFlow flow;
+
+  @override
+  Widget build(BuildContext context, WidgetRef ref) {
+    final auth = ref.watch(hostedRelayAuthProvider);
+    useListenable(auth);
+    final config = ref.watch(relayConfigProvider);
+    if (auth.failedRelay != config.baseUrl ||
+        auth.failedPubkey != pubkeyFromNsec(config.nsec) ||
+        auth.failure == null) {
+      return const SizedBox.shrink();
+    }
+    final signIn = auth.failure == AccountFailure.signedOut;
+    final changeAccount = auth.failure == AccountFailure.denied;
+    return Positioned(
+      left: Grid.sm,
+      right: Grid.sm,
+      bottom: 0,
+      child: SafeArea(
+        child: Material(
+          elevation: 4,
+          borderRadius: BorderRadius.circular(Radii.lg),
+          child: Padding(
+            padding: const EdgeInsets.all(Grid.sm),
+            child: Column(
+              mainAxisSize: MainAxisSize.min,
+              children: [
+                Text(
+                  signIn
+                      ? 'Sign in to Builderlab to reconnect'
+                      : auth.failure == AccountFailure.denied
+                      ? 'This account cannot reconnect to this community with its saved key.'
+                      : 'Could not reconnect to Builderlab.',
+                ),
+                if (changeAccount)
+                  TextButton(
+                    onPressed: () => unawaited(
+                      ref.read(relaySessionProvider.notifier).reconnect(),
+                    ),
+                    child: const Text('Retry'),
+                  ),
+                TextButton(
+                  onPressed: () => unawaited(
+                    signIn || changeAccount
+                        ? flow.reconnectAccount(changeAccount: changeAccount)
+                        : ref.read(relaySessionProvider.notifier).reconnect(),
+                  ),
+                  child: Text(
+                    changeAccount
+                        ? 'Use a different account'
+                        : signIn
+                        ? 'Sign in'
+                        : 'Retry',
+                  ),
+                ),
+              ],
+            ),
+          ),
+        ),
+      ),
+    );
+  }
+}
diff --git a/mobile/lib/features/onboarding/self_hosted_entry_sheet.dart b/mobile/lib/features/onboarding/self_hosted_entry_sheet.dart
new file mode 100644
index 0000000000..8e92841a49
--- /dev/null
+++ b/mobile/lib/features/onboarding/self_hosted_entry_sheet.dart
@@ -0,0 +1,166 @@
+import 'package:flutter/material.dart';
+import 'package:flutter_hooks/flutter_hooks.dart';
+import 'package:hooks_riverpod/hooks_riverpod.dart';
+
+import '../../shared/auth/auth.dart';
+import '../../shared/hosted/device_identity_source.dart';
+import '../../shared/hosted/self_hosted_entry.dart';
+import '../../shared/identity_transfer/nsec_import_sheet.dart';
+import '../../shared/theme/theme.dart';
+import '../../shared/utils/string_utils.dart';
+import '../../shared/widgets/modal_presentation.dart';
+
+/// Local preparation seam; the production service validates and retains keys.
+final selfHostedEntryProvider = Provider<SelfHostedEntry>(
+  (ref) => SelfHostedEntry(),
+);
+
+/// Uses an explicit identity choice without involving a hosted account.
+Future<bool> showSelfHostedEntry(
+  BuildContext context, {
+  required String relay,
+  required String name,
+}) async =>
+    await showBuzzModalBottomSheet<bool>(
+      context: context,
+      title: 'Join community',
+      isScrollControlled: true,
+      useRootNavigator: true,
+      useSafeArea: true,
+      builder: (_) => SelfHostedEntrySheet(relay: relay, name: name),
+    ) ??
+    false;
+
+class SelfHostedEntrySheet extends HookConsumerWidget {
+  const SelfHostedEntrySheet({
+    super.key,
+    required this.relay,
+    required this.name,
+  });
+  final String relay;
+  final String name;
+
+  @override
+  Widget build(BuildContext context, WidgetRef ref) {
+    final service = ref.watch(selfHostedEntryProvider);
+    final choices = useFuture(useMemoized(service.choices));
+    final busy = useState(false);
+    final error = useState<String?>(null);
+    bool mounted() => context.mounted;
+    Future<void> connect({
+      String? pubkey,
+      String? nsec,
+      bool create = false,
+      bool close = true,
+    }) async {
+      if (busy.value) return;
+      busy.value = true;
+      error.value = null;
+      final storage = ref.read(communityStorageProvider);
+      try {
+        final community = await service.prepare(
+          relay: relay,
+          name: name,
+          savedPubkey: pubkey,
+          nsec: nsec,
+          create: create,
+          isCurrent: mounted,
+        );
+        if (!mounted()) return;
+        await ref
+            .read(authProvider.notifier)
+            .authenticateWithCommunity(community, shouldContinue: mounted);
+        // Admission can return early after cancellation. Check the durable
+        // record before retiring the only retry copy of a generated key.
+        final saved = await storage.loadAll();
+        if (saved.any(
+          (item) => item.id == community.id && item.nsec == community.nsec,
+        )) {
+          await service.complete(community);
+        }
+        if (close && context.mounted) Navigator.of(context).pop(true);
+      } catch (_) {
+        if (mounted()) {
+          error.value =
+              'Could not join. Check this community accepts your identity, then try again. Your saved keys have been kept.';
+        }
+        rethrow;
+      } finally {
+        if (mounted()) busy.value = false;
+      }
+    }
+
+    Future<void> select({String? pubkey, bool create = false}) async {
+      try {
+        await connect(pubkey: pubkey, create: create);
+      } catch (_) {}
+    }
+
+    final saved = choices.data?.choices ?? const <DeviceIdentityChoice>[];
+    return Padding(
+      padding: const EdgeInsets.all(Grid.gutter),
+      child: SingleChildScrollView(
+        child: Column(
+          mainAxisSize: MainAxisSize.min,
+          crossAxisAlignment: CrossAxisAlignment.stretch,
+          children: [
+            Text(Uri.parse(relay).host, style: context.textTheme.titleMedium),
+            const SizedBox(height: Grid.sm),
+            const Text(
+              'Choose the identity to use in this community. Your key stays on this device.',
+            ),
+            const SizedBox(height: Grid.sm),
+            if (choices.hasError || choices.data?.complete == false)
+              const Text(
+                'Some saved identities could not be read. You can use an available identity or import a key.',
+              ),
+            for (final identity in saved)
+              OutlinedButton(
+                onPressed: busy.value
+                    ? null
+                    : () => select(pubkey: identity.pubkey),
+                child: Column(
+                  children: [
+                    Text(identity.label),
+                    Text(fullNpub(identity.pubkey) ?? identity.pubkey),
+                  ],
+                ),
+              ),
+            if (choices.connectionState == ConnectionState.done) ...[
+              OutlinedButton(
+                onPressed: busy.value
+                    ? null
+                    : () async {
+                        final imported = await showNsecImportSheet(
+                          context,
+                          onImport: (nsec) => connect(nsec: nsec, close: false),
+                        );
+                        if (imported && context.mounted) {
+                          Navigator.of(context).pop(true);
+                        }
+                      },
+                child: const Text('Import a Nostr key'),
+              ),
+              if (saved.isEmpty && choices.data?.complete == true)
+                FilledButton(
+                  onPressed: busy.value ? null : () => select(create: true),
+                  child: const Text('Create an identity and join'),
+                ),
+              if (saved.isEmpty && choices.data?.complete == true)
+                const Text(
+                  'Export a backup in Settings after joining. This device will hold your only copy until you back it up.',
+                ),
+            ],
+            if (busy.value)
+              const Padding(
+                padding: EdgeInsets.all(Grid.sm),
+                child: Text('Joining…'),
+              ),
+            if (error.value != null)
+              Text(error.value!, style: TextStyle(color: context.colors.error)),
+          ],
+        ),
+      ),
+    );
+  }
+}
diff --git a/mobile/lib/features/pairing/pairing_page.dart b/mobile/lib/features/pairing/pairing_page.dart
index 88e7157ec9..acf0e1d791 100644
--- a/mobile/lib/features/pairing/pairing_page.dart
+++ b/mobile/lib/features/pairing/pairing_page.dart
@@ -1,4 +1,9 @@
 import 'dart:async';
+import '../../shared/hosted/hosted_flow_provider.dart';
+import '../../shared/hosted/hosted_flow.dart';
+import '../../shared/hosted/hosted_community_creation.dart';
+import '../../shared/hosted/hosted_environment.dart';
+import '../../shared/hosted/hosted_flow_problem_message.dart';
 import 'dart:math' show sqrt2;
 import 'dart:ui' show ImageFilter;
 
@@ -12,6 +17,9 @@ import 'package:buzz/shared/theme/buzz_icons.dart';
 
 import '../../shared/security/sensitive_action_authorizer.dart';
 import '../../shared/error_haptic.dart';
+import '../../shared/deeplink/deep_link.dart';
+import '../../shared/deeplink/community_link_input.dart';
+import '../../shared/deeplink/pending_deep_link_provider.dart';
 import '../../shared/community/community.dart';
 import '../../shared/community/community_loading_surface.dart';
 import '../../shared/theme/theme.dart';
@@ -25,6 +33,7 @@ part 'pairing_page/onboarding_background.dart';
 part 'pairing_page/onboarding_colors.dart';
 part 'pairing_page/onboarding_glass_button.dart';
 part 'pairing_page/pairing_welcome_view.dart';
+part 'pairing_page/community_link_form.dart';
 part 'pairing_page/sas_verification_view.dart';
 part 'pairing_page/pairing_code_entry.dart';
 part 'pairing_page/pairing_error_shake.dart';
@@ -34,11 +43,37 @@ class PairingPage extends HookConsumerWidget {
   /// (user is already authenticated with at least one community).
   final bool addingCommunity;
   final bool identityRecoveryOnly;
+  final VoidCallback? onAlreadyUseBuzz;
+  final VoidCallback? onWelcomeBack;
+  final bool connectionLanding;
+  final bool existingUser;
+  final bool enteringCommunityLink;
+  final bool creatingCommunity;
+  final ValueChanged<String>? onSubmitCommunity;
+  final VoidCallback? onCommunityLink;
+  final VoidCallback? onCreateCommunity;
+  final VoidCallback? onBuilderlab;
+  final String? accountStatus;
+  final Widget? setupContent;
+  final String builderlabLabel;
 
   const PairingPage({
     super.key,
     this.addingCommunity = false,
     this.identityRecoveryOnly = false,
+    this.onAlreadyUseBuzz,
+    this.onWelcomeBack,
+    this.connectionLanding = false,
+    this.existingUser = false,
+    this.enteringCommunityLink = false,
+    this.creatingCommunity = false,
+    this.onSubmitCommunity,
+    this.onCommunityLink,
+    this.onCreateCommunity,
+    this.onBuilderlab,
+    this.accountStatus,
+    this.setupContent,
+    this.builderlabLabel = 'Connect to Builderlab',
   });
 
   @override
@@ -71,6 +106,14 @@ class PairingPage extends HookConsumerWidget {
 
     Future<void> handleScannerResult(String? code) async {
       if (code != null && context.mounted) {
+        if (connectionLanding && !existingUser) {
+          final uri = Uri.tryParse(code.trim());
+          final link = uri == null ? null : parseBuzzDeepLink(uri);
+          if (link is InviteDeepLink || link is AddCommunityDeepLink) {
+            ref.read(pendingDeepLinkProvider.notifier).open(uri!);
+            return;
+          }
+        }
         if (identityRecoveryOnly &&
             Uri.tryParse(code)?.queryParameters['mode'] != 'recover') {
           ScaffoldMessenger.of(context).showSnackBar(
@@ -222,6 +265,23 @@ class PairingPage extends HookConsumerWidget {
                 appBar: pairingAppBar,
                 body: SafeArea(
                   child: _PairingWelcomeView(
+                    onAlreadyUseBuzz: onAlreadyUseBuzz,
+                    onWelcomeBack: onWelcomeBack,
+                    connectionLanding: connectionLanding,
+                    existingUser: existingUser,
+                    enteringCommunityLink: enteringCommunityLink,
+                    creatingCommunity: creatingCommunity,
+                    onSubmitCommunity: onSubmitCommunity,
+                    onCommunityLink: onCommunityLink,
+                    onCreateCommunity: onCreateCommunity,
+                    onOpenCommunity: (uri) {
+                      FocusManager.instance.primaryFocus?.unfocus();
+                      ref.read(pendingDeepLinkProvider.notifier).open(uri);
+                    },
+                    onBuilderlab: onBuilderlab,
+                    accountStatus: accountStatus,
+                    setupContent: setupContent,
+                    builderlabLabel: builderlabLabel,
                     codeController: codeController,
                     isBusy: isBusy,
                     pairingCodeExpanded: pairingCodeExpanded.value,
diff --git a/mobile/lib/features/pairing/pairing_page/community_link_form.dart b/mobile/lib/features/pairing/pairing_page/community_link_form.dart
new file mode 100644
index 0000000000..39f0fd5171
--- /dev/null
+++ b/mobile/lib/features/pairing/pairing_page/community_link_form.dart
@@ -0,0 +1,125 @@
+part of '../pairing_page.dart';
+
+class _CommunityLinkForm extends HookConsumerWidget {
+  const _CommunityLinkForm({
+    required this.onOpen,
+    required this.onBack,
+    this.onCreate,
+  });
+
+  final ValueChanged<String>? onCreate;
+
+  final ValueChanged<Uri> onOpen;
+  final VoidCallback? onBack;
+
+  @override
+  Widget build(BuildContext context, WidgetRef ref) {
+    final controller = useTextEditingController();
+    final error = useState<String?>(null);
+
+    final flow = HostedEnvironment.enabled
+        ? ref.watch(hostedFlowProvider)
+        : null;
+    useListenable(flow);
+    final ownsFlow = ref.watch(hostedInlineEntryProvider);
+    final busy =
+        flow != null &&
+        ownsFlow &&
+        !flow.accountOnly &&
+        (flow.stage == HostedFlowStage.working ||
+            flow.stage == HostedFlowStage.signIn);
+    final failed =
+        flow != null && ownsFlow && !flow.accountOnly && flow.problem != null;
+
+    void submit() {
+      if (busy || (failed && !flow.canRetry)) return;
+      final create = onCreate;
+      if (create != null) {
+        final name = controller.text.trim().toLowerCase();
+        if (!HostedCreateCommunity.validName(name)) {
+          error.value =
+              'Use letters, numbers and single hyphens (up to 63 characters).';
+          return;
+        }
+        error.value = null;
+        FocusManager.instance.primaryFocus?.unfocus();
+        create(name);
+        return;
+      }
+      final link = parseCommunityLinkInput(controller.text);
+      if (link == null) {
+        error.value = 'Enter a valid community address or invite link.';
+        return;
+      }
+      error.value = null;
+      ref.read(hostedInlineEntryProvider.notifier).setActive(true);
+      onOpen(link);
+    }
+
+    return Column(
+      mainAxisSize: MainAxisSize.min,
+      children: [
+        TextField(
+          key: Key(
+            onCreate != null
+                ? 'community-create-input'
+                : 'community-link-input',
+          ),
+          controller: controller,
+          enabled: !busy,
+          keyboardType: TextInputType.url,
+          textInputAction: TextInputAction.go,
+          autocorrect: false,
+          enableSuggestions: false,
+          style: context.textTheme.bodyMedium?.copyWith(
+            color: context._onboardingInk,
+          ),
+          cursorColor: context._onboardingInk,
+          decoration: InputDecoration(
+            labelText: onCreate != null
+                ? 'Community address'
+                : 'Community link or address',
+            helperText: onCreate != null
+                ? '.${HostedEnvironment.communitySuffix}'
+                : null,
+            helperStyle: TextStyle(color: context._onboardingMutedInk),
+            labelStyle: TextStyle(color: context._onboardingInk),
+            hintText: onCreate != null
+                ? 'my-community'
+                : 'community.example.com',
+            hintStyle: TextStyle(color: context._onboardingMutedInk),
+            errorText:
+                error.value ??
+                (failed ? hostedFlowProblemMessage(flow.problem) : null),
+            filled: true,
+            fillColor: context._onboardingInputSurface,
+            enabledBorder: context._inputBorder,
+            focusedBorder: context._inputBorder.copyWith(
+              borderSide: BorderSide(color: context._onboardingInk),
+            ),
+          ),
+          onChanged: (_) {
+            error.value = null;
+            if (failed) unawaited(flow.leave());
+          },
+          onSubmitted: (_) => submit(),
+        ),
+        const SizedBox(height: Grid.xs),
+        FilledButton(
+          style: context._onboardingGlassButtonStyle,
+          onPressed: busy || (failed && !flow.canRetry) ? null : submit,
+          child: Text(busy ? 'Connecting…' : 'Continue'),
+        ),
+        const SizedBox(height: Grid.xxs),
+        TextButton(
+          style: context._onboardingGhostButtonStyle,
+          onPressed: () {
+            unawaited(flow?.leave());
+            onBack?.call();
+          },
+          child: const Text('Back'),
+        ),
+      ],
+    );
+  }
+}
diff --git a/mobile/lib/features/pairing/pairing_page/pairing_welcome_view.dart b/mobile/lib/features/pairing/pairing_page/pairing_welcome_view.dart
index c404e3582d..9369855aa5 100644
--- a/mobile/lib/features/pairing/pairing_page/pairing_welcome_view.dart
+++ b/mobile/lib/features/pairing/pairing_page/pairing_welcome_view.dart
@@ -8,6 +8,20 @@ class _PairingWelcomeView extends StatelessWidget {
   final VoidCallback onScan;
   final VoidCallback onTogglePairingCode;
   final VoidCallback onConnect;
+  final VoidCallback? onAlreadyUseBuzz;
+  final VoidCallback? onWelcomeBack;
+  final bool connectionLanding;
+  final bool existingUser;
+  final bool enteringCommunityLink;
+  final bool creatingCommunity;
+  final ValueChanged<String>? onSubmitCommunity;
+  final VoidCallback? onCommunityLink;
+  final VoidCallback? onCreateCommunity;
+  final VoidCallback? onBuilderlab;
+  final String? accountStatus;
+  final Widget? setupContent;
+  final String builderlabLabel;
+  final ValueChanged<Uri> onOpenCommunity;
 
   const _PairingWelcomeView({
     required this.codeController,
@@ -17,6 +31,20 @@ class _PairingWelcomeView extends StatelessWidget {
     required this.onScan,
     required this.onTogglePairingCode,
     required this.onConnect,
+    required this.onOpenCommunity,
+    this.onAlreadyUseBuzz,
+    this.onWelcomeBack,
+    this.connectionLanding = false,
+    this.existingUser = false,
+    this.enteringCommunityLink = false,
+    this.creatingCommunity = false,
+    this.onSubmitCommunity,
+    this.onCommunityLink,
+    this.onCreateCommunity,
+    this.onBuilderlab,
+    this.accountStatus,
+    this.setupContent,
+    this.builderlabLabel = 'Connect to Builderlab',
   });
 
   @override
@@ -26,6 +54,221 @@ class _PairingWelcomeView extends StatelessWidget {
         ? Duration.zero
         : const Duration(milliseconds: 220);
 
+    final selectedPage = creatingCommunity
+        ? 4
+        : enteringCommunityLink
+        ? 3
+        : existingUser
+        ? 2
+        : 1;
+    Widget actions(int page) => page == 3 || page == 4
+        ? _CommunityLinkForm(
+            onOpen: onOpenCommunity,
+            onBack: onWelcomeBack,
+            onCreate: page == 4 ? onSubmitCommunity : null,
+          )
+        : Column(
+            children: [
+              if (page == 1 && accountStatus != null) ...[
+                Text(
+                  accountStatus!,
+                  textAlign: TextAlign.center,
+                  style: context.textTheme.bodyMedium?.copyWith(
+                    color: context._onboardingMutedInk,
+                  ),
+                ),
+                const SizedBox(height: Grid.xs),
+              ],
+              if (page == 2) ...[
+                Text(
+                  connectionLanding
+                      ? 'Paste the pairing code from your desktop app.'
+                      : 'Scan the QR code from your desktop app\nor paste a pairing code to connect.',
+                  textAlign: TextAlign.center,
+                  style: context.textTheme.bodyMedium?.copyWith(
+                    color: context._onboardingMutedInk,
+                  ),
+                ),
+                const SizedBox(height: Grid.xs),
+              ],
+              if (page == 1) ...[
+                if (HostedEnvironment.enabled) ...[
+                  FilledButton(
+                    style: context._onboardingGlassButtonStyle,
+                    onPressed: onBuilderlab,
+                    child: Text(builderlabLabel),
+                  ),
+                  const SizedBox(height: Grid.xxs),
+                ],
+                FilledButton(
+                  style: context._onboardingGlassButtonStyle,
+                  onPressed: onCommunityLink,
+                  child: const Text('Enter a community link'),
+                ),
+                if (HostedEnvironment.enabled && onCreateCommunity != null) ...[
+                  const SizedBox(height: Grid.xxs),
+                  FilledButton(
+                    style: context._onboardingGlassButtonStyle,
+                    onPressed: isBusy ? null : onCreateCommunity,
+                    child: const Text('Create a community'),
+                  ),
+                ],
+                const SizedBox(height: Grid.xxs),
+                FilledButton(
+                  style: context._onboardingGlassButtonStyle,
+                  onPressed: isBusy ? null : onScan,
+                  child: const Text('Scan a QR code'),
+                ),
+                const SizedBox(height: Grid.xxs),
+                TextButton(
+                  style: context._onboardingGhostButtonStyle,
+                  onPressed: isBusy ? null : onAlreadyUseBuzz,
+                  child: const Text('Use pairing code'),
+                ),
+              ] else ...[
+                if (!connectionLanding) ...[
+                  FilledButton(
+                    style: context._onboardingGlassButtonStyle,
+                    onPressed: isBusy ? null : onScan,
+                    child: isBusy && !pairingCodeExpanded
+                        ? SizedBox(
+                            width: 20,
+                            height: 20,
+                            child: BuzzLoadingIndicator(
+                              size: 20,
+                              color: context._onboardingInk,
+                              semanticLabel: 'Opening scanner',
+                            ),
+                          )
+                        : const Text('Scan a QR code'),
+                  ),
+                  const SizedBox(height: Grid.xxs),
+                  TextButton(
+                    style: context._onboardingGhostButtonStyle,
+                    onPressed: isBusy ? null : onTogglePairingCode,
+                    child: Text(
+                      pairingCodeExpanded
+                          ? 'Hide pairing code'
+                          : 'Use pairing code',
+                    ),
+                  ),
+                ],
+                AnimatedSwitcher(
+                  duration: revealDuration,
+                  switchInCurve: Curves.easeOutCubic,
+                  switchOutCurve: Curves.easeInCubic,
+                  transitionBuilder: (child, animation) {
+                    return SizeTransition(
+                      sizeFactor: animation,
+                      alignment: Alignment.topCenter,
+                      child: FadeTransition(opacity: animation, child: child),
+                    );
+                  },
+                  child: (connectionLanding || pairingCodeExpanded)
+                      ? Column(
+                          key: const ValueKey('pairing-code-fields'),
+                          children: [
+                            const SizedBox(height: Grid.twelve),
+                            TextField(
+                              controller: codeController,
+                              style: context.textTheme.bodyMedium?.copyWith(
+                                color: context._onboardingInk,
+                              ),
+                              cursorColor: context._onboardingInk,
+                              decoration: InputDecoration(
+                                filled: true,
+                                fillColor: context._onboardingInputSurface,
+                                hintText: 'nostrpair://... or buzz://...',
+                                hintStyle: context.textTheme.bodyMedium
+                                    ?.copyWith(
+                                      color: context._onboardingMutedInk,
+                                    ),
+                                prefixIcon: Icon(
+                                  BuzzIcons.link,
+                                  color: context._onboardingInk,
+                                ),
+                                enabledBorder: context._inputBorder,
+                                disabledBorder: context._inputBorder,
+                                focusedBorder: context._inputBorder.copyWith(
+                                  borderSide: BorderSide(
+                                    color: context._onboardingInk,
+                                  ),
+                                ),
+                                isDense: true,
+                              ),
+                              autocorrect: false,
+                              enableSuggestions: false,
+                              enabled: !isBusy,
+                              contextMenuBuilder: (context, editableTextState) {
+                                return AdaptiveTextSelectionToolbar.editableText(
+                                  editableTextState: editableTextState,
+                                );
+                              },
+                            ),
+                            const SizedBox(height: Grid.twelve),
+                            SizedBox(
+                              width: double.infinity,
+                              child: FilledButton(
+                                style: context._onboardingGlassButtonStyle,
+                                onPressed: isBusy ? null : onConnect,
+                                child: isBusy
+                                    ? SizedBox(
+                                        width: 20,
+                                        height: 20,
+                                        child: BuzzLoadingIndicator(
+                                          size: 20,
+                                          color: context._onboardingInk,
+                                          semanticLabel: 'Connecting',
+                                        ),
+                                      )
+                                    : const Text('Connect'),
+                              ),
+                            ),
+                          ],
+                        )
+                      : const SizedBox(
+                          key: ValueKey('pairing-code-fields-hidden'),
+                        ),
+                ),
+              ],
+              if (page == 2 && onWelcomeBack != null)
+                TextButton(
+                  style: context._onboardingGhostButtonStyle,
+                  onPressed: onWelcomeBack,
+                  child: const Text('Back'),
+                ),
+              if ((!connectionLanding || page == selectedPage) &&
+                  errorMessage != null) ...[
+                const SizedBox(height: Grid.twelve),
+                Container(
+                  padding: const EdgeInsets.all(Grid.twelve),
+                  decoration: BoxDecoration(
+                    color: context.colors.errorContainer,
+                    borderRadius: BorderRadius.circular(Radii.md),
+                  ),
+                  child: Row(
+                    children: [
+                      Icon(
+                        BuzzIcons.triangleAlert,
+                        size: 16,
+                        color: context.colors.onErrorContainer,
+                      ),
+                      const SizedBox(width: Grid.xxs),
+                      Expanded(
+                        child: Text(
+                          errorMessage!,
+                          style: context.textTheme.bodySmall?.copyWith(
+                            color: context.colors.onErrorContainer,
+                          ),
+                        ),
+                      ),
+                    ],
+                  ),
+                ),
+              ],
+            ],
+          );
+
     return Padding(
       padding: const EdgeInsets.symmetric(
         horizontal: Grid.gutter,
@@ -70,165 +313,48 @@ class _PairingWelcomeView extends StatelessWidget {
                   ),
                 ),
                 const SizedBox(height: Grid.md),
-                Text(
-                  'Scan the QR code from your desktop app\nor paste a pairing code to connect.',
-                  textAlign: TextAlign.center,
-                  style: context.textTheme.bodyMedium?.copyWith(
-                    color: context._onboardingMutedInk,
-                  ),
-                ),
-                const SizedBox(height: Grid.xs),
                 ConstrainedBox(
                   constraints: const BoxConstraints(maxWidth: 440),
                   child: SizedBox(
                     width: double.infinity,
-                    child: Column(
-                      children: [
-                        FilledButton(
-                          style: context._onboardingGlassButtonStyle,
-                          onPressed: isBusy ? null : onScan,
-                          child: isBusy && !pairingCodeExpanded
-                              ? SizedBox(
-                                  width: 20,
-                                  height: 20,
-                                  child: BuzzLoadingIndicator(
-                                    size: 20,
-                                    color: context._onboardingInk,
-                                    semanticLabel: 'Opening scanner',
-                                  ),
-                                )
-                              : const Text('Scan a QR code'),
-                        ),
-                        const SizedBox(height: Grid.xxs),
-                        TextButton(
-                          style: context._onboardingGhostButtonStyle,
-                          onPressed: isBusy ? null : onTogglePairingCode,
-                          child: Text(
-                            pairingCodeExpanded
-                                ? 'Hide pairing code'
-                                : 'Use pairing code',
-                          ),
-                        ),
-                        AnimatedSwitcher(
-                          duration: revealDuration,
-                          switchInCurve: Curves.easeOutCubic,
-                          switchOutCurve: Curves.easeInCubic,
-                          transitionBuilder: (child, animation) {
-                            return SizeTransition(
-                              sizeFactor: animation,
-                              axisAlignment: -1,
-                              child: FadeTransition(
-                                opacity: animation,
-                                child: child,
-                              ),
-                            );
-                          },
-                          child: pairingCodeExpanded
-                              ? Column(
-                                  key: const ValueKey('pairing-code-fields'),
-                                  children: [
-                                    const SizedBox(height: Grid.twelve),
-                                    TextField(
-                                      controller: codeController,
-                                      style: context.textTheme.bodyMedium
-                                          ?.copyWith(
-                                            color: context._onboardingInk,
-                                          ),
-                                      cursorColor: context._onboardingInk,
-                                      decoration: InputDecoration(
-                                        filled: true,
-                                        fillColor:
-                                            context._onboardingInputSurface,
-                                        hintText:
-                                            'nostrpair://... or buzz://...',
-                                        hintStyle: context.textTheme.bodyMedium
-                                            ?.copyWith(
-                                              color:
-                                                  context._onboardingMutedInk,
-                                            ),
-                                        prefixIcon: Icon(
-                                          BuzzIcons.link,
-                                          color: context._onboardingInk,
-                                        ),
-                                        enabledBorder: context._inputBorder,
-                                        disabledBorder: context._inputBorder,
-                                        focusedBorder: context._inputBorder
-                                            .copyWith(
-                                              borderSide: BorderSide(
-                                                color: context._onboardingInk,
-                                              ),
-                                            ),
-                                        isDense: true,
-                                      ),
-                                      autocorrect: false,
-                                      enableSuggestions: false,
-                                      enabled: !isBusy,
-                                      contextMenuBuilder:
-                                          (context, editableTextState) {
-                                            return AdaptiveTextSelectionToolbar.editableText(
-                                              editableTextState:
-                                                  editableTextState,
-                                            );
-                                          },
-                                    ),
-                                    const SizedBox(height: Grid.twelve),
-                                    SizedBox(
-                                      width: double.infinity,
-                                      child: FilledButton(
-                                        style:
-                                            context._onboardingGlassButtonStyle,
-                                        onPressed: isBusy ? null : onConnect,
-                                        child: isBusy
-                                            ? SizedBox(
-                                                width: 20,
-                                                height: 20,
-                                                child: BuzzLoadingIndicator(
-                                                  size: 20,
-                                                  color: context._onboardingInk,
-                                                  semanticLabel: 'Connecting',
-                                                ),
-                                              )
-                                            : const Text('Connect'),
-                                      ),
-                                    ),
-                                  ],
-                                )
-                              : const SizedBox(
-                                  key: ValueKey('pairing-code-fields-hidden'),
-                                ),
-                        ),
-                        if (errorMessage != null) ...[
-                          const SizedBox(height: Grid.twelve),
-                          Container(
-                            padding: const EdgeInsets.all(Grid.twelve),
-                            decoration: BoxDecoration(
-                              color: context.colors.errorContainer,
-                              borderRadius: BorderRadius.circular(Radii.md),
-                            ),
-                            child: Row(
+                    child: setupContent != null
+                        ? setupContent!
+                        : !connectionLanding
+                        ? actions(2)
+                        : ClipRect(
+                            child: Stack(
+                              alignment: Alignment.bottomCenter,
                               children: [
-                                Icon(
-                                  BuzzIcons.triangleAlert,
-                                  size: 16,
-                                  color: context.colors.onErrorContainer,
-                                ),
-                                const SizedBox(width: Grid.xxs),
-                                Expanded(
-                                  child: Text(
-                                    errorMessage!,
-                                    style: context.textTheme.bodySmall
-                                        ?.copyWith(
-                                          color:
-                                              context.colors.onErrorContainer,
+                                for (var page = 1; page < 5; page++)
+                                  ExcludeFocus(
+                                    excluding: page != selectedPage,
+                                    child: ExcludeSemantics(
+                                      excluding: page != selectedPage,
+                                      child: IgnorePointer(
+                                        ignoring: page != selectedPage,
+                                        child: AnimatedSlide(
+                                          key: ValueKey('welcome-panel-$page'),
+                                          offset: Offset(
+                                            page == selectedPage
+                                                ? 0
+                                                : page == 1
+                                                ? -1
+                                                : 1,
+                                            0,
+                                          ),
+                                          duration: revealDuration,
+                                          curve: Curves.easeInOutCubic,
+                                          child: SizedBox(
+                                            width: double.infinity,
+                                            child: actions(page),
+                                          ),
                                         ),
+                                      ),
+                                    ),
                                   ),
-                                ),
                               ],
                             ),
                           ),
-                        ],
-                      ],
-                    ),
                   ),
                 ),
               ],
diff --git a/mobile/lib/features/pairing/pairing_provider.dart b/mobile/lib/features/pairing/pairing_provider.dart
index 510158344b..c426c85494 100644
--- a/mobile/lib/features/pairing/pairing_provider.dart
+++ b/mobile/lib/features/pairing/pairing_provider.dart
@@ -8,6 +8,8 @@ import 'package:http/http.dart' as http;
 import 'package:nostr/nostr.dart' as nostr;
 
 import '../../shared/auth/auth.dart';
+import '../../shared/hosted/hosted_flow_provider.dart';
+import '../../shared/hosted/hosted_environment.dart';
 import '../../shared/community/paired_community_landing.dart';
 import '../../shared/crypto/ecdh.dart';
 import '../../shared/crypto/nip44.dart';
@@ -737,19 +739,6 @@ class PairingNotifier extends Notifier<PairingState> {
       _validateRelayUrl(relayUrl);
       state = state.copyWith(destinationRelayUrl: relayUrl);
 
-      // Validate credentials against the relay via NIP-42 WS handshake.
-      final credentialValidator = _credentialValidator ?? _validateCredentials;
-      await credentialValidator(relayUrl: relayUrl, nsec: nsec);
-      if (pairingGeneration != _pairingGeneration ||
-          state.status != PairingStatus.storing ||
-          _sendIdentityToSource) {
-        return;
-      }
-
-      // Send complete only after credentials are validated.
-      _sendComplete(true);
-
-      // Store as community and switch to it.
       final community = Community.create(
         name: Community.nameFromUrl(relayUrl),
         relayUrl: relayUrl,
@@ -759,15 +748,31 @@ class PairingNotifier extends Notifier<PairingState> {
             ? SensitiveActionPolicy.enabled
             : SensitiveActionPolicy.disabledByUser,
       );
-      await ref
-          .read(authProvider.notifier)
-          .authenticateWithCommunity(community);
-      if (pairingGeneration != _pairingGeneration ||
-          state.status != PairingStatus.storing ||
-          _sendIdentityToSource) {
+      bool current() =>
+          pairingGeneration == _pairingGeneration &&
+          state.status == PairingStatus.storing &&
+          !_sendIdentityToSource;
+      if (HostedEnvironment.requiresAuth(Uri.parse(relayUrl).host)) {
+        final flow = ref.read(hostedFlowProvider);
+        await flow.stagePairedCommunity(community, isCurrent: current);
+        if (!current()) return;
+        // NIP-AB complete acknowledges durable transfer, not hosted admission.
+        _sendComplete(true);
+        _cleanup();
+        state = const PairingState();
+        unawaited(flow.retry());
         return;
       }
+      final credentialValidator = _credentialValidator ?? _validateCredentials;
+      await credentialValidator(relayUrl: relayUrl, nsec: nsec);
+      if (!current()) return;
+      await ref
+          .read(authProvider.notifier)
+          .authenticateWithCommunity(community, shouldContinue: current);
+      if (!current()) return;
 
+      // A validated transfer is not successful admission until storage succeeds.
+      _sendComplete(true);
       _cleanup();
       state = state.copyWith(status: PairingStatus.success);
       ref.read(pairedCommunityLandingProvider.notifier).request(community);
@@ -864,13 +869,27 @@ class PairingNotifier extends Notifier<PairingState> {
 
     try {
       final community = _parseLegacyInput(rawInput);
+      if (HostedEnvironment.requiresAuth(Uri.parse(community.relayUrl).host)) {
+        final flow = ref.read(hostedFlowProvider);
+        await flow.stagePairedCommunity(
+          community,
+          isCurrent: () => generation == _pairingGeneration,
+        );
+        if (generation != _pairingGeneration) return;
+        state = const PairingState();
+        unawaited(flow.retry());
+        return;
+      }
       final validator = _credentialValidator ?? _validateCredentials;
       await validator(relayUrl: community.relayUrl, nsec: community.nsec);
 
       if (generation != _pairingGeneration) return;
       await ref
           .read(authProvider.notifier)
-          .authenticateWithCommunity(community);
+          .authenticateWithCommunity(
+            community,
+            shouldContinue: () => generation == _pairingGeneration,
+          );
       if (generation != _pairingGeneration) return;
       state = PairingState(
         status: PairingStatus.success,
diff --git a/mobile/lib/features/profile/ios_presence_menu.dart b/mobile/lib/features/profile/ios_presence_menu.dart
index 0b2816e22e..2212bb70e4 100644
--- a/mobile/lib/features/profile/ios_presence_menu.dart
+++ b/mobile/lib/features/profile/ios_presence_menu.dart
@@ -26,6 +26,37 @@ class IosPresenceMenu extends StatefulWidget {
 
 class _IosPresenceMenuState extends State<IosPresenceMenu> {
   MethodChannel? _channel;
+  ModalRoute<Object?>? _route;
+  bool _routeSettled = false;
+  bool _nativeVisible = false;
+
+  // iOS composites Flutter content painted after a platform view outside
+  // every native view rect into the background, beneath earlier overlays.
+  // While Home's native bars still show through a route transition, that
+  // hides the Settings rows below this pill, so the native view mounts only
+  // once its route has settled and a drawn stand-in covers the transitions.
+  static bool _isSettled(ModalRoute<Object?>? route) =>
+      (route?.animation?.isCompleted ?? true) &&
+      (route?.secondaryAnimation?.isDismissed ?? true);
+
+  void _syncRouteSettled([AnimationStatus? _]) {
+    final settled = _isSettled(_route);
+    if (settled == _routeSettled) return;
+    if (!settled) {
+      _channel?.setMethodCallHandler(null);
+      _channel = null;
+      _nativeVisible = false;
+    }
+    setState(() => _routeSettled = settled);
+  }
+
+  void _listenToRoute(ModalRoute<Object?>? route) {
+    _route?.animation?.removeStatusListener(_syncRouteSettled);
+    _route?.secondaryAnimation?.removeStatusListener(_syncRouteSettled);
+    _route = route;
+    route?.animation?.addStatusListener(_syncRouteSettled);
+    route?.secondaryAnimation?.addStatusListener(_syncRouteSettled);
+  }
 
   Map<String, Object> _configuration(BuildContext context) => {
     'presence': widget.presence,
@@ -36,6 +67,19 @@ class _IosPresenceMenuState extends State<IosPresenceMenu> {
     'fontSize': MediaQuery.textScalerOf(context).scale(15),
   };
 
+  @override
+  void didChangeDependencies() {
+    super.didChangeDependencies();
+    final route = ModalRoute.of(context);
+    if (route != null && identical(route, _route)) return;
+    _listenToRoute(route);
+    // A newly pushed route can still report a completed animation while it
+    // first builds, so decide once that frame has been laid out.
+    WidgetsBinding.instance.addPostFrameCallback((_) {
+      if (mounted) _syncRouteSettled();
+    });
+  }
+
   @override
   void didUpdateWidget(covariant IosPresenceMenu oldWidget) {
     super.didUpdateWidget(oldWidget);
@@ -44,6 +88,7 @@ class _IosPresenceMenuState extends State<IosPresenceMenu> {
 
   @override
   void dispose() {
+    _listenToRoute(null);
     _channel?.setMethodCallHandler(null);
     super.dispose();
   }
@@ -65,27 +110,65 @@ class _IosPresenceMenuState extends State<IosPresenceMenu> {
       key: const ValueKey('settings-presence-target'),
       width: width,
       height: height,
-      child: UiKitView(
-        key: const ValueKey('settings-presence-menu'),
-        viewType: 'buzz/presence_menu',
-        creationParams: _configuration(context),
-        creationParamsCodec: const StandardMessageCodec(),
-        onPlatformViewCreated: (id) {
-          final channel = MethodChannel('buzz/presence_menu/$id');
-          _channel = channel;
-          channel.setMethodCallHandler((call) async {
-            if (!mounted || call.method != 'selected') return;
-            final value = call.arguments;
-            if (value is String &&
-                const ['online', 'away', 'offline'].contains(value)) {
-              widget.onSelected(value);
-            }
-          });
-          unawaited(
-            channel.invokeMethod<void>('update', _configuration(context)),
-          );
-        },
+      child: Stack(
+        fit: StackFit.expand,
+        children: [
+          if (!_nativeVisible) _standIn(fontSize),
+          if (_routeSettled) _nativeMenu(context),
+        ],
       ),
     );
   }
+
+  /// Draws the native pill's capsule and title while the native view is
+  /// absent, so route transitions and view creation do not blink the pill.
+  Widget _standIn(double fontSize) => Semantics(
+    label: 'Availability',
+    value: widget.label,
+    excludeSemantics: true,
+    child: Padding(
+      padding: const EdgeInsets.symmetric(vertical: 7),
+      child: DecoratedBox(
+        decoration: ShapeDecoration(
+          color: widget.background,
+          shape: const StadiumBorder(),
+        ),
+        child: Center(
+          child: Text(
+            widget.label,
+            maxLines: 1,
+            textScaler: TextScaler.noScaling,
+            style: TextStyle(
+              fontFamily: 'CupertinoSystemText',
+              fontSize: fontSize,
+              fontWeight: FontWeight.w500,
+              color: widget.foreground,
+            ),
+          ),
+        ),
+      ),
+    ),
+  );
+
+  Widget _nativeMenu(BuildContext context) => UiKitView(
+    key: const ValueKey('settings-presence-menu'),
+    viewType: 'buzz/presence_menu',
+    creationParams: _configuration(context),
+    creationParamsCodec: const StandardMessageCodec(),
+    onPlatformViewCreated: (id) {
+      if (!mounted || !_routeSettled) return;
+      final channel = MethodChannel('buzz/presence_menu/$id');
+      _channel = channel;
+      setState(() => _nativeVisible = true);
+      channel.setMethodCallHandler((call) async {
+        if (!mounted || call.method != 'selected') return;
+        final value = call.arguments;
+        if (value is String &&
+            const ['online', 'away', 'offline'].contains(value)) {
+          widget.onSelected(value);
+        }
+      });
+      unawaited(channel.invokeMethod<void>('update', _configuration(context)));
+    },
+  );
 }
diff --git a/mobile/lib/features/profile/profile_text_edit_sheet.dart b/mobile/lib/features/profile/profile_text_edit_sheet.dart
index a0e9dce3c4..9cbb89d286 100644
--- a/mobile/lib/features/profile/profile_text_edit_sheet.dart
+++ b/mobile/lib/features/profile/profile_text_edit_sheet.dart
@@ -96,7 +96,7 @@ class ProfileTextEditSheet extends HookWidget {
                   borderRadius: BorderRadius.circular(Radii.dialog),
                 ),
               ),
-              icon: const Icon(BuzzIcons.x, size: 22),
+              icon: const Icon(BuzzIcons.x, size: 24),
             ),
           );
 
diff --git a/mobile/lib/features/search/search_page.dart b/mobile/lib/features/search/search_page.dart
index 69397c477f..fe5b5a74d9 100644
--- a/mobile/lib/features/search/search_page.dart
+++ b/mobile/lib/features/search/search_page.dart
@@ -328,41 +328,49 @@ class _SearchBody extends ConsumerWidget {
       );
     }
 
-    return ListView(
+    return CustomScrollView(
       key: const Key('search-results-list'),
-      padding: EdgeInsets.only(
-        bottom:
-            Grid.xl +
-            MediaQuery.paddingOf(context).bottom +
-            MediaQuery.viewInsetsOf(context).bottom,
-      ),
-      children: [
-        if (showChannels && state.channelResults.isNotEmpty)
-          _ChannelsSection(
-            channels: state.channelResults,
-            onResultSelected: recordResultSelection,
+      slivers: [
+        SliverPadding(
+          padding: EdgeInsets.only(
+            bottom:
+                Grid.xl +
+                MediaQuery.paddingOf(context).bottom +
+                MediaQuery.viewInsetsOf(context).bottom,
           ),
-        if (showPeople && state.userResults.isNotEmpty)
-          _PeopleSection(
-            users: state.userResults,
-            onResultSelected: recordResultSelection,
-          ),
-        if (showMessages && state.messageResults.isNotEmpty)
-          _MessagesSection(
-            hits: state.messageResults,
-            currentPubkey: currentPubkey,
-            onResultSelected: recordResultSelection,
-          ),
-        if (state.isLoading)
-          const Padding(
-            padding: EdgeInsets.all(Grid.sm),
-            child: Center(
-              child: BuzzLoadingIndicator(
-                size: 36,
-                semanticLabel: 'Loading more search results',
-              ),
-            ),
+          sliver: SliverMainAxisGroup(
+            slivers: [
+              if (showChannels && state.channelResults.isNotEmpty)
+                _ChannelsSection(
+                  channels: state.channelResults,
+                  onResultSelected: recordResultSelection,
+                ),
+              if (showPeople && state.userResults.isNotEmpty)
+                _PeopleSection(
+                  users: state.userResults,
+                  onResultSelected: recordResultSelection,
+                ),
+              if (showMessages && state.messageResults.isNotEmpty)
+                _MessagesSection(
+                  hits: state.messageResults,
+                  currentPubkey: currentPubkey,
+                  onResultSelected: recordResultSelection,
+                ),
+              if (state.isLoading)
+                const SliverToBoxAdapter(
+                  child: Padding(
+                    padding: EdgeInsets.all(Grid.sm),
+                    child: Center(
+                      child: BuzzLoadingIndicator(
+                        size: 36,
+                        semanticLabel: 'Loading more search results',
+                      ),
+                    ),
+                  ),
+                ),
+            ],
           ),
+        ),
       ],
     );
   }
@@ -472,57 +480,57 @@ class _ChannelsSection extends ConsumerWidget {
   });
   @override
   Widget build(BuildContext context, WidgetRef ref) {
-    return Column(
-      crossAxisAlignment: CrossAxisAlignment.start,
-      children: [
-        _SectionLabel(label: 'Channels'),
-        for (final channel in channels)
-          ListTile(
-            key: ValueKey('search-channel-row-${channel.id}'),
-            contentPadding: const EdgeInsets.symmetric(horizontal: Grid.gutter),
-            leading: Icon(
-              channelIcon(channel),
-              key: ValueKey('search-channel-leading-${channel.id}'),
-              size: 20,
-            ),
-            title: Text(
-              channel.name,
-              key: ValueKey('search-channel-title-${channel.id}'),
-              style: contentListTitleTextStyle,
-            ),
-            subtitle: channel.isMember
-                ? Text(
-                    '${channel.memberCount} member${channel.memberCount == 1 ? '' : 's'}',
-                    style: contentListBodyTextStyle.copyWith(
-                      color: context.colors.onSurfaceVariant,
-                    ),
-                  )
-                : null,
-            trailing: !channel.isMember && !channel.isDm
-                ? Container(
-                    padding: const EdgeInsets.symmetric(
-                      horizontal: Grid.half + 2,
-                      vertical: 3,
-                    ),
-                    decoration: BoxDecoration(
-                      color: context.colors.primary.withValues(alpha: 0.1),
-                      borderRadius: BorderRadius.circular(Radii.sm),
-                    ),
-                    child: Text(
-                      'Open',
-                      style: context.textTheme.labelSmall?.copyWith(
-                        color: context.colors.primary,
-                        fontWeight: FontWeight.w600,
-                      ),
-                    ),
-                  )
-                : null,
-            onTap: () {
-              onResultSelected();
-              _openSearchChannel(context, channel);
-            },
+    return SliverList.builder(
+      itemCount: channels.length + 1,
+      itemBuilder: (context, index) {
+        if (index == 0) return const _SectionLabel(label: 'Channels');
+        final channel = channels[index - 1];
+        return ListTile(
+          key: ValueKey('search-channel-row-${channel.id}'),
+          contentPadding: const EdgeInsets.symmetric(horizontal: Grid.gutter),
+          leading: Icon(
+            channelIcon(channel),
+            key: ValueKey('search-channel-leading-${channel.id}'),
+            size: 20,
           ),
-      ],
+          title: Text(
+            channel.name,
+            key: ValueKey('search-channel-title-${channel.id}'),
+            style: contentListTitleTextStyle,
+          ),
+          subtitle: channel.isMember
+              ? Text(
+                  '${channel.memberCount} member${channel.memberCount == 1 ? '' : 's'}',
+                  style: contentListBodyTextStyle.copyWith(
+                    color: context.colors.onSurfaceVariant,
+                  ),
+                )
+              : null,
+          trailing: !channel.isMember && !channel.isDm
+              ? Container(
+                  padding: const EdgeInsets.symmetric(
+                    horizontal: Grid.half + 2,
+                    vertical: 3,
+                  ),
+                  decoration: BoxDecoration(
+                    color: context.colors.primary.withValues(alpha: 0.1),
+                    borderRadius: BorderRadius.circular(Radii.sm),
+                  ),
+                  child: Text(
+                    'Open',
+                    style: context.textTheme.labelSmall?.copyWith(
+                      color: context.colors.primary,
+                      fontWeight: FontWeight.w600,
+                    ),
+                  ),
+                )
+              : null,
+          onTap: () {
+            onResultSelected();
+            _openSearchChannel(context, channel);
+          },
+        );
+      },
     );
   }
 }
@@ -545,46 +553,46 @@ class _PeopleSection extends ConsumerWidget {
       },
       fallbackNames: {for (final user in users) user.pubkey: user.label},
     );
-    return Column(
-      crossAxisAlignment: CrossAxisAlignment.start,
-      children: [
-        _SectionLabel(label: 'People'),
-        for (final user in users)
-          ListTile(
-            key: ValueKey('search-person-row-${user.pubkey}'),
-            contentPadding: const EdgeInsets.symmetric(horizontal: Grid.gutter),
-            leading: AvatarImage(
-              key: ValueKey('search-person-leading-${user.pubkey}'),
-              imageUrl: user.avatarUrl,
-              radius: 20,
-              fallback: Text(user.initial),
-              isAgent: user.isAgent,
-            ),
-            title: Text(
-              names.labelFor(user.pubkey),
-              key: ValueKey('search-person-title-${user.pubkey}'),
-              style: contentListTitleTextStyle,
-            ),
-            subtitle: Text(
-              user.secondaryLabel,
-              style: contentListBodyTextStyle.copyWith(
-                color: context.colors.onSurfaceVariant,
-              ),
-            ),
-            onTap: () async {
-              onResultSelected();
-              final channel = await ref
-                  .read(channelActionsProvider)
-                  .openDm(pubkeys: [user.pubkey]);
-              if (!context.mounted) return;
-              await Navigator.of(context).push(
-                MaterialPageRoute<void>(
-                  builder: (_) => ChannelDetailPage(channel: channel),
-                ),
-              );
-            },
+    return SliverList.builder(
+      itemCount: users.length + 1,
+      itemBuilder: (context, index) {
+        if (index == 0) return const _SectionLabel(label: 'People');
+        final user = users[index - 1];
+        return ListTile(
+          key: ValueKey('search-person-row-${user.pubkey}'),
+          contentPadding: const EdgeInsets.symmetric(horizontal: Grid.gutter),
+          leading: AvatarImage(
+            key: ValueKey('search-person-leading-${user.pubkey}'),
+            imageUrl: user.avatarUrl,
+            radius: 20,
+            fallback: Text(user.initial),
+            isAgent: user.isAgent,
           ),
-      ],
+          title: Text(
+            names.labelFor(user.pubkey),
+            key: ValueKey('search-person-title-${user.pubkey}'),
+            style: contentListTitleTextStyle,
+          ),
+          subtitle: Text(
+            user.secondaryLabel,
+            style: contentListBodyTextStyle.copyWith(
+              color: context.colors.onSurfaceVariant,
+            ),
+          ),
+          onTap: () async {
+            onResultSelected();
+            final channel = await ref
+                .read(channelActionsProvider)
+                .openDm(pubkeys: [user.pubkey]);
+            if (!context.mounted) return;
+            await Navigator.of(context).push(
+              MaterialPageRoute<void>(
+                builder: (_) => ChannelDetailPage(channel: channel),
+              ),
+            );
+          },
+        );
+      },
     );
   }
 }
@@ -616,20 +624,20 @@ class _MessagesSection extends HookConsumerWidget {
       return null;
     }, [preloadPubkeysKey]);
 
-    return Column(
-      crossAxisAlignment: CrossAxisAlignment.start,
-      children: [
-        _SectionLabel(label: 'Messages'),
-        for (final hit in hits)
-          _MessageTile(
-            hit: hit,
-            authorProfile: profiles[hit.pubkey.toLowerCase()],
-            userCache: profiles,
-            channel: channels.where((c) => c.id == hit.channelId).firstOrNull,
-            currentPubkey: currentPubkey,
-            onResultSelected: onResultSelected,
-          ),
-      ],
+    return SliverList.builder(
+      itemCount: hits.length + 1,
+      itemBuilder: (context, index) {
+        if (index == 0) return const _SectionLabel(label: 'Messages');
+        final hit = hits[index - 1];
+        return _MessageTile(
+          hit: hit,
+          authorProfile: profiles[hit.pubkey.toLowerCase()],
+          userCache: profiles,
+          channel: channels.where((c) => c.id == hit.channelId).firstOrNull,
+          currentPubkey: currentPubkey,
+          onResultSelected: onResultSelected,
+        );
+      },
     );
   }
 }
diff --git a/mobile/lib/features/search/search_page/message_tile.dart b/mobile/lib/features/search/search_page/message_tile.dart
index ca2fcf5ba6..e902096b4d 100644
--- a/mobile/lib/features/search/search_page/message_tile.dart
+++ b/mobile/lib/features/search/search_page/message_tile.dart
@@ -1,5 +1,16 @@
 part of '../search_page.dart';
 
+// Two-line search snippets must not parse an entire document. Long messages
+// use literal text so cutting a code fence or link cannot create a new embed.
+const _richSearchPreviewLimit = 512;
+
+String _literalSearchPreview(String content) {
+  var end = _richSearchPreviewLimit;
+  final last = content.codeUnitAt(end - 1);
+  if (last >= 0xD800 && last <= 0xDBFF) end--;
+  return '${content.substring(0, end)}…';
+}
+
 class _MessageTile extends ConsumerWidget {
   final SearchHit hit;
   final UserProfile? authorProfile;
@@ -19,7 +30,9 @@ class _MessageTile extends ConsumerWidget {
 
   @override
   Widget build(BuildContext context, WidgetRef ref) {
-    final mentionedPubkeys = mentionedPubkeysFromTags(hit.tags);
+    final mentionedPubkeys = hit.content.length > _richSearchPreviewLimit
+        ? <String>{}
+        : mentionedPubkeysFromTags(hit.tags);
     // A hit is labelled within its channel, as it would be there.
     final hitChannelId = channel?.id ?? hit.channelId;
     final labelPubkeys = {hit.pubkey.toLowerCase(), ...mentionedPubkeys};
@@ -40,28 +53,6 @@ class _MessageTile extends ConsumerWidget {
     final channelName = hit.channelName?.trim().replaceFirst(RegExp(r'^#'), '');
     final hasChannelName = channelName != null && channelName.isNotEmpty;
     final isDm = channel?.isDm ?? false;
-    final profileMentionNames = {
-      for (final pubkey in mentionedPubkeysFromTags(hit.tags))
-        if (userCache[pubkey]?.displayName?.trim().isNotEmpty == true)
-          pubkey: userCache[pubkey]!.displayName!.trim(),
-    };
-    final mentionPubkeys = mentionedPubkeysFromTags(hit.tags);
-    final knownAgentPubkeys = channel == null
-        ? ref.watch(knownAgentPubkeysProvider)
-        : ref.watch(agentMentionPubkeysProvider(channel!.id));
-    final agentMentionPubkeys = agentPubkeysWithProfileOwners(
-      knownAgentPubkeys: knownAgentPubkeys,
-      profileOwnedAgentPubkeys: [
-        for (final profile in userCache.values)
-          if (profile.ownerPubkey != null) profile.pubkey,
-      ],
-    );
-    final mentionNames = mentionNamesWithDirectoryLabels(
-      mentionPubkeys: mentionPubkeys,
-      profileMentionNames: profileMentionNames,
-      directoryDisplayNames: ref.watch(agentDirectoryDisplayNamesProvider),
-      agentMentionPubkeys: agentMentionPubkeys,
-    );
 
     return ListTile(
       key: ValueKey('search-message-row-${hit.eventId}'),
@@ -130,18 +121,7 @@ class _MessageTile extends ConsumerWidget {
             ],
           ),
           const SizedBox(height: Grid.half),
-          MessageContent(
-            key: ValueKey('search-message-body-${hit.eventId}'),
-            content: hit.content,
-            mentionNames: mentionNames,
-            mentionLabels: labels,
-            agentMentionPubkeys: agentMentionPubkeys,
-            tags: hit.tags,
-            maxLines: 2,
-            baseStyle: activityPreviewTextStyle.copyWith(
-              color: context.colors.onSurface,
-            ),
-          ),
+          _buildPreview(context, ref, labels),
         ],
       ),
       onTap: () {
@@ -151,6 +131,59 @@ class _MessageTile extends ConsumerWidget {
     );
   }
 
+  Widget _buildPreview(
+    BuildContext context,
+    WidgetRef ref,
+    Map<String, String> labels,
+  ) {
+    if (hit.content.length > _richSearchPreviewLimit) {
+      return Text(
+        _literalSearchPreview(hit.content),
+        key: ValueKey('search-message-body-${hit.eventId}'),
+        maxLines: 2,
+        overflow: TextOverflow.ellipsis,
+        style: activityPreviewTextStyle.copyWith(
+          color: context.colors.onSurface,
+        ),
+      );
+    }
+    final profileMentionNames = {
+      for (final pubkey in mentionedPubkeysFromTags(hit.tags))
+        if (userCache[pubkey]?.displayName?.trim().isNotEmpty == true)
+          pubkey: userCache[pubkey]!.displayName!.trim(),
+    };
+    final mentionPubkeys = mentionedPubkeysFromTags(hit.tags);
+    final knownAgentPubkeys = channel == null
+        ? ref.watch(knownAgentPubkeysProvider)
+        : ref.watch(agentMentionPubkeysProvider(channel!.id));
+    final agentMentionPubkeys = agentPubkeysWithProfileOwners(
+      knownAgentPubkeys: knownAgentPubkeys,
+      profileOwnedAgentPubkeys: [
+        for (final profile in userCache.values)
+          if (profile.ownerPubkey != null) profile.pubkey,
+      ],
+    );
+    final mentionNames = mentionNamesWithDirectoryLabels(
+      mentionPubkeys: mentionPubkeys,
+      profileMentionNames: profileMentionNames,
+      directoryDisplayNames: ref.watch(agentDirectoryDisplayNamesProvider),
+      agentMentionPubkeys: agentMentionPubkeys,
+    );
+
+    return MessageContent(
+      key: ValueKey('search-message-body-${hit.eventId}'),
+      content: hit.content,
+      mentionNames: mentionNames,
+      mentionLabels: labels,
+      agentMentionPubkeys: agentMentionPubkeys,
+      tags: hit.tags,
+      maxLines: 2,
+      baseStyle: activityPreviewTextStyle.copyWith(
+        color: context.colors.onSurface,
+      ),
+    );
+  }
+
   void _navigateToHit(
     BuildContext context,
     WidgetRef ref,
diff --git a/mobile/lib/features/settings/settings_page.dart b/mobile/lib/features/settings/settings_page.dart
index 4d9199be74..bbf6ea4a97 100644
--- a/mobile/lib/features/settings/settings_page.dart
+++ b/mobile/lib/features/settings/settings_page.dart
@@ -10,6 +10,7 @@ import 'package:nostr/nostr.dart' as nostr;
 import 'package:package_info_plus/package_info_plus.dart';
 
 import '../../shared/auth/auth.dart';
+import '../../shared/identity_transfer/nsec_export_sheet.dart';
 import '../../shared/clipboard_utils.dart';
 import '../../shared/success_haptic.dart';
 import '../../shared/push/push_relay_capability_provider.dart';
diff --git a/mobile/lib/features/settings/settings_page/connection_section.dart b/mobile/lib/features/settings/settings_page/connection_section.dart
index b45860012d..b02ecd2cd6 100644
--- a/mobile/lib/features/settings/settings_page/connection_section.dart
+++ b/mobile/lib/features/settings/settings_page/connection_section.dart
@@ -19,6 +19,23 @@ class _ConnectionSection extends ConsumerWidget {
     return AppListCard(
       verticalPadding: Grid.twelve,
       children: [
+        AppListRow(
+          title: 'Export private key',
+          subtitle: 'Save an nsec backup of this community identity',
+          trailing: const _RowChevron(),
+          onTap: () => showNsecExportSheet(
+            context,
+            community: community,
+            isCurrent: () {
+              if (!context.mounted) return false;
+              final current = ref.read(authProvider).value?.community;
+              return current?.id == community.id &&
+                  current?.nsec == community.nsec &&
+                  current?.sensitiveActionPolicy ==
+                      community.sensitiveActionPolicy;
+            },
+          ),
+        ),
         AppListRow(
           title: 'Send identity to desktop',
           subtitle: 'Scan a recovery code shown by Buzz Desktop',
diff --git a/mobile/lib/features/settings/theme_picker_page/theme_preview_sheet.dart b/mobile/lib/features/settings/theme_picker_page/theme_preview_sheet.dart
index cd7e6bd8ce..0dfe750849 100644
--- a/mobile/lib/features/settings/theme_picker_page/theme_preview_sheet.dart
+++ b/mobile/lib/features/settings/theme_picker_page/theme_preview_sheet.dart
@@ -305,7 +305,7 @@ class _ThemePreviewCloseButton extends StatelessWidget {
             borderRadius: BorderRadius.circular(Radii.dialog),
           ),
         ),
-        icon: const Icon(BuzzIcons.x, size: 22),
+        icon: const Icon(BuzzIcons.x, size: 24),
       ),
     );
   }
diff --git a/mobile/lib/hosted_app_gate.dart b/mobile/lib/hosted_app_gate.dart
new file mode 100644
index 0000000000..27833b2955
--- /dev/null
+++ b/mobile/lib/hosted_app_gate.dart
@@ -0,0 +1,188 @@
+import 'dart:async';
+
+import 'package:flutter/material.dart';
+import 'package:flutter_hooks/flutter_hooks.dart';
+import 'package:hooks_riverpod/hooks_riverpod.dart';
+
+import 'features/channels/deep_link_dispatcher.dart';
+import 'features/onboarding/hosted_connect_page.dart';
+import 'features/onboarding/self_hosted_entry_sheet.dart';
+import 'shared/auth/auth.dart';
+import 'shared/theme/grid.dart';
+import 'shared/deeplink/deep_link.dart';
+import 'shared/hosted/hosted_community_connection.dart';
+import 'shared/hosted/hosted_flow.dart';
+import 'shared/hosted/hosted_environment.dart';
+import 'features/onboarding/hosted_reconnect_banner.dart';
+
+import 'shared/hosted/hosted_flow_provider.dart';
+
+/// Composition seam shared by signed-in and signed-out application states.
+class HostedAppGate extends HookConsumerWidget {
+  const HostedAppGate({
+    super.key,
+    required this.child,
+    required this.authenticated,
+  });
+  final Widget child;
+  final bool authenticated;
+
+  @override
+  Widget build(BuildContext context, WidgetRef ref) {
+    final flow = HostedEnvironment.enabled
+        ? ref.watch(hostedFlowProvider)
+        : null;
+    useListenable(flow);
+    useEffect(() {
+      if (flow == null) return null;
+      void onFlowChanged() {
+        if (flow.stage == HostedFlowStage.complete) {
+          ref.read(hostedInlineEntryProvider.notifier).setActive(false);
+        }
+      }
+
+      flow.addListener(onFlowChanged);
+      unawaited(flow.initialize());
+      return () => flow.removeListener(onFlowChanged);
+    }, [flow]);
+    final inlineEntry = ref.watch(hostedInlineEntryProvider);
+    final visible =
+        flow != null &&
+        flow.stage != HostedFlowStage.idle &&
+        flow.stage != HostedFlowStage.complete;
+    // Native browser authentication presents its own alert over the current
+    // screen. Keep that screen in place while checking the session/opening it.
+    final openingSignIn =
+        flow != null &&
+        (flow.stage == HostedFlowStage.signIn ||
+            (flow.accountOnly &&
+                flow.stage == HostedFlowStage.working &&
+                flow.account.account == null));
+    final inlineAccountStatus =
+        flow != null &&
+        (!authenticated || inlineEntry) &&
+        flow.accountOnly &&
+        (flow.stage == HostedFlowStage.working ||
+            (flow.stage == HostedFlowStage.blocked &&
+                !flow.canChangeCommunities));
+    return DeepLinkDispatcher(
+      dispatchMessageLinks: authenticated && !visible,
+      onboardingHandler: (routeContext, link) async {
+        final relay = link.relayUrl;
+        if (relay != null) {
+          final host = Uri.parse(relay).host.toLowerCase();
+          final requiresAuth = HostedEnvironment.requiresAuth(host);
+          if (link is InviteDeepLink && !requiresAuth) return false;
+          final communities = await ref
+              .read(communityStorageProvider)
+              .loadAll();
+          final existing = communities
+              .where(
+                (item) => relayIdentity(item.relayUrl) == relayIdentity(relay),
+              )
+              .firstOrNull;
+          if (existing != null &&
+              !(existing.starterSetupIncomplete && requiresAuth)) {
+            await ref
+                .read(communityListProvider.notifier)
+                .switchCommunity(existing.id);
+            if (context.mounted) {
+              ref.read(communityEntryCompletionProvider.notifier).complete();
+            }
+            return true;
+          }
+          if (!requiresAuth && link is AddCommunityDeepLink) {
+            if (routeContext.mounted) {
+              final joined = await showSelfHostedEntry(
+                routeContext,
+                relay: link.relayUrl,
+                name: link.name,
+              );
+              if (joined && context.mounted) {
+                ref.read(communityEntryCompletionProvider.notifier).complete();
+              }
+            }
+            return true;
+          }
+          if (requiresAuth &&
+              !HostedEnvironment.supportsRelay(Uri.parse(relay))) {
+            if (routeContext.mounted) {
+              await showDialog<void>(
+                context: routeContext,
+                builder: (context) => AlertDialog(
+                  title: const Text('Community setup unavailable'),
+                  content: const Text(
+                    'This community needs a different or unsupported Builderlab environment. Use an app build configured for this community.',
+                  ),
+                  actions: [
+                    TextButton(
+                      onPressed: () => Navigator.pop(context),
+                      child: const Text('Close'),
+                    ),
+                  ],
+                ),
+              );
+            }
+            return true;
+          }
+        }
+        if (flow == null) return false;
+        await flow.start(link);
+        return true;
+      },
+      child: Stack(
+        fit: StackFit.expand,
+        children: [
+          child,
+          if (flow != null) ...[
+            if (authenticated && !visible) HostedReconnectBanner(flow: flow),
+            if (flow.stage == HostedFlowStage.signIn &&
+                authenticated &&
+                !inlineEntry)
+              Positioned(
+                left: Grid.sm,
+                right: Grid.sm,
+                bottom: 0,
+                child: SafeArea(
+                  child: Material(
+                    color: Colors.transparent,
+                    child: Wrap(
+                      alignment: WrapAlignment.center,
+                      children: [
+                        TextButton(
+                          onPressed: flow.retry,
+                          child: const Text('Start login again'),
+                        ),
+                        TextButton(
+                          onPressed: flow.leave,
+                          child: Text(
+                            flow.reconnecting
+                                ? 'Cancel sign-in'
+                                : 'Leave setup',
+                          ),
+                        ),
+                      ],
+                    ),
+                  ),
+                ),
+              ),
+            if (visible &&
+                !openingSignIn &&
+                !inlineAccountStatus &&
+                (!inlineEntry ||
+                    (flow.accountOnly &&
+                        flow.stage == HostedFlowStage.profile) ||
+                    flow.stage == HostedFlowStage.chooseIdentity ||
+                    flow.stage == HostedFlowStage.chooseCommunities ||
+                    flow.stage == HostedFlowStage.communityConflict ||
+                    flow.canChangeCommunities))
+              HostedConnectPage(
+                flow: flow,
+                onClose: () => unawaited(flow.leave()),
+              ),
+          ],
+        ],
+      ),
+    );
+  }
+}
diff --git a/mobile/lib/onboarding_app_entry.dart b/mobile/lib/onboarding_app_entry.dart
new file mode 100644
index 0000000000..dbf3e3541d
--- /dev/null
+++ b/mobile/lib/onboarding_app_entry.dart
@@ -0,0 +1,167 @@
+import 'dart:async';
+import 'package:flutter/material.dart';
+import 'package:flutter_hooks/flutter_hooks.dart';
+import 'package:hooks_riverpod/hooks_riverpod.dart';
+
+import 'features/pairing/pairing_page.dart';
+import 'features/onboarding/hosted_connect_sheet.dart';
+import 'features/pairing/pairing_provider.dart';
+import 'shared/hosted/hosted_flow_provider.dart';
+import 'shared/hosted/hosted_flow.dart';
+import 'shared/hosted/hosted_environment.dart';
+import 'shared/hosted/hosted_community_creation.dart';
+import 'shared/hosted/hosted_flow_problem_message.dart';
+
+/// Navigation over the existing branded welcome surface.
+class OnboardingAppEntry extends HookConsumerWidget {
+  const OnboardingAppEntry({super.key, this.addingCommunity = false});
+  final bool addingCommunity;
+
+  @override
+  Widget build(BuildContext context, WidgetRef ref) {
+    final existingUser = useState(false);
+    final creating = useState(false);
+    final enteringCommunityLink = useState(false);
+    final flow = HostedEnvironment.enabled
+        ? ref.watch(hostedFlowProvider)
+        : null;
+    useListenable(flow);
+    useEffect(() {
+      if (flow == null) return null;
+      Future<void> restore() async {
+        await flow.initialize();
+        if (context.mounted) await flow.signInAccount(openBrowser: false);
+      }
+
+      unawaited(restore());
+      return null;
+    }, [flow]);
+    void finishEntry() {
+      if (!addingCommunity) return;
+      WidgetsBinding.instance.addPostFrameCallback((_) {
+        if (!context.mounted) return;
+        final route = ModalRoute.of(context);
+        if (route != null && route.isActive) {
+          route.navigator?.removeRoute(route);
+        }
+      });
+    }
+
+    ref.listen(communityEntryCompletionProvider, (_, _) => finishEntry());
+    useEffect(() {
+      final presentation = ref.read(hostedInlineEntryProvider.notifier);
+      WidgetsBinding.instance.addPostFrameCallback((_) {
+        if (context.mounted) presentation.setActive(true);
+      });
+      void completed() {
+        if (flow?.stage == HostedFlowStage.complete) finishEntry();
+      }
+
+      flow?.addListener(completed);
+      return () {
+        flow?.removeListener(completed);
+        scheduleMicrotask(() {
+          presentation.setActive(false);
+          if (addingCommunity &&
+              flow != null &&
+              flow.stage != HostedFlowStage.complete) {
+            unawaited(flow.leave());
+          }
+        });
+      };
+    }, [flow]);
+    final inlineSetup =
+        flow != null &&
+        !flow.accountOnly &&
+        flow.stage != HostedFlowStage.signIn &&
+        !(flow.stage == HostedFlowStage.working &&
+            flow.account.account == null) &&
+        flow.stage != HostedFlowStage.idle &&
+        flow.stage != HostedFlowStage.complete &&
+        flow.stage != HostedFlowStage.chooseIdentity &&
+        flow.stage != HostedFlowStage.chooseCommunities &&
+        flow.stage != HostedFlowStage.communityConflict &&
+        !flow.canChangeCommunities;
+    final signingIn = flow?.stage == HostedFlowStage.signIn;
+    final busy =
+        flow != null &&
+        flow.accountOnly &&
+        (flow.stage == HostedFlowStage.working ||
+            flow.stage == HostedFlowStage.signIn);
+    final connected = flow?.account.account != null;
+    final problem = flow != null && flow.accountOnly ? flow.problem : null;
+    final status = flow == null
+        ? null
+        : problem != null
+        ? hostedFlowProblemMessage(problem)
+        : busy
+        ? 'Connecting to Builderlab…'
+        : flow.noCommunitiesToAdd
+        ? 'No communities available to add. Scan a QR code or use an invite link.'
+        : connected
+        ? 'Connected to Builderlab.'
+        : null;
+    void back() {
+      unawaited(flow?.leave());
+      existingUser.value = false;
+      creating.value = false;
+      enteringCommunityLink.value = false;
+      FocusManager.instance.primaryFocus?.unfocus();
+      ref.read(pairingProvider.notifier).reset();
+    }
+
+    return PopScope(
+      canPop:
+          !existingUser.value &&
+          !enteringCommunityLink.value &&
+          !creating.value &&
+          !inlineSetup,
+      onPopInvokedWithResult: (didPop, _) {
+        if (!didPop) back();
+      },
+      child: PairingPage(
+        connectionLanding: true,
+        addingCommunity: addingCommunity,
+        existingUser: existingUser.value,
+        enteringCommunityLink: enteringCommunityLink.value,
+        creatingCommunity: creating.value,
+        onSubmitCommunity: flow == null
+            ? null
+            : (name) {
+                creating.value = false;
+                unawaited(flow.start(HostedCreateCommunity(name)));
+              },
+        onCommunityLink: () => enteringCommunityLink.value = true,
+        onCreateCommunity: flow == null || busy
+            ? null
+            : () => creating.value = true,
+        onBuilderlab: flow == null
+            ? null
+            : signingIn
+            ? () => unawaited(flow.leave())
+            : busy
+            ? null
+            : () => unawaited(flow.signInAccount()),
+        accountStatus: status,
+        setupContent: flow != null && inlineSetup
+            ? Column(
+                mainAxisSize: MainAxisSize.min,
+                children: [
+                  HostedConnectSheet(flow: flow),
+                  TextButton(onPressed: back, child: const Text('Leave setup')),
+                ],
+              )
+            : null,
+        builderlabLabel: signingIn
+            ? 'Cancel sign-in'
+            : busy
+            ? 'Connecting…'
+            : connected
+            ? 'Continue with Builderlab'
+            : 'Connect to Builderlab',
+        onWelcomeBack: back,
+        onAlreadyUseBuzz: () => existingUser.value = true,
+      ),
+    );
+  }
+}
diff --git a/mobile/lib/shared/auth/auth_provider.dart b/mobile/lib/shared/auth/auth_provider.dart
index 9dc17e1e74..d82e856bcc 100644
--- a/mobile/lib/shared/auth/auth_provider.dart
+++ b/mobile/lib/shared/auth/auth_provider.dart
@@ -1,8 +1,10 @@
+import '../hosted/hosted_relay_auth.dart';
 import 'package:hooks_riverpod/hooks_riverpod.dart';
 import 'package:nostr/nostr.dart' as nostr;
 
 import '../community/community.dart';
 import '../community/community_provider.dart';
+import '../hosted/community_entry_requirements.dart';
 
 enum AuthStatus { unknown, unauthenticated, authenticated }
 
@@ -56,21 +58,34 @@ class AuthNotifier extends AsyncNotifier<AuthState> {
   /// Authenticate with a community. Saves it and switches to it.
   /// Writes to storage directly to avoid circular dependency with community
   /// providers.
-  Future<void> authenticateWithCommunity(Community community) {
+  Future<void> authenticateWithCommunity(
+    Community community, {
+    bool Function()? shouldContinue,
+    bool activate = true,
+  }) {
     return ref.read(communityTransitionProvider).runExclusive(() async {
-      await ref.read(communityTransitionProvider).run();
+      if (shouldContinue != null && !shouldContinue()) return;
+      await CommunityEntryRequirements.verify(
+        community,
+        ref.read(builderlabAccountProvider),
+      );
+      if (shouldContinue != null && !shouldContinue()) return;
+      if (activate) await ref.read(communityTransitionProvider).run();
+      if (shouldContinue != null && !shouldContinue()) return;
       final storage = ref.read(communityStorageProvider);
       await storage.save(community);
-      await storage.saveActiveId(community.id);
+      if (activate) await storage.saveActiveId(community.id);
       await syncStoredCommunitySnapshot(ref);
 
       // Invalidate community providers so other consumers pick up the new data.
       ref.invalidate(communityListProvider);
       ref.invalidate(activeCommunityProvider);
 
-      state = AsyncData(
-        AuthState(status: AuthStatus.authenticated, community: community),
-      );
+      if (activate) {
+        state = AsyncData(
+          AuthState(status: AuthStatus.authenticated, community: community),
+        );
+      }
     });
   }
 
diff --git a/mobile/lib/shared/community/community.dart b/mobile/lib/shared/community/community.dart
index 86db62bb62..96c2b5f7a2 100644
--- a/mobile/lib/shared/community/community.dart
+++ b/mobile/lib/shared/community/community.dart
@@ -19,6 +19,10 @@ String _newPushLeaseInstallationId() {
 enum SensitiveActionPolicy { enabled, disabledByUser }
 
 class Community {
+  static const _defaultPushNotificationsEnabled = true;
+
+  static const _pushNotificationsEnabledKey = 'pushNotificationsEnabledV2';
+
   final String id;
   final String name;
   final String relayUrl;
@@ -45,7 +49,7 @@ class Community {
     this.pubkey,
     this.nsec,
     this.sensitiveActionPolicy = SensitiveActionPolicy.disabledByUser,
-    this.pushNotificationsEnabled = false,
+    this.pushNotificationsEnabled = _defaultPushNotificationsEnabled,
     this.pushSubscriptionState = const BuzzPushLeaseSubscriptionState.desired(),
     this.pushLeaseInstallationId,
     this.starterSetupIncomplete = false,
@@ -113,7 +117,7 @@ class Community {
     if (pubkey != null) 'pubkey': pubkey,
     if (nsec != null) 'nsec': nsec,
     'sensitiveActionPolicy': sensitiveActionPolicy.name,
-    'pushNotificationsEnabled': pushNotificationsEnabled,
+    _pushNotificationsEnabledKey: pushNotificationsEnabled,
     'pushSubscriptionState': pushSubscriptionState.toJson(),
     if (pushLeaseInstallationId != null)
       'pushLeaseInstallationId': pushLeaseInstallationId,
@@ -130,7 +134,8 @@ class Community {
       );
     }
     final pushNotificationsEnabled =
-        json['pushNotificationsEnabled'] as bool? ?? false;
+        json[_pushNotificationsEnabledKey] as bool? ??
+        _defaultPushNotificationsEnabled;
     var pushSubscriptionState = json['pushSubscriptionState'] == null
         ? const BuzzPushLeaseSubscriptionState.desired()
         : BuzzPushLeaseSubscriptionState.fromJson(
diff --git a/mobile/lib/shared/community/community_provider.dart b/mobile/lib/shared/community/community_provider.dart
index d16084c3ee..535bc95d48 100644
--- a/mobile/lib/shared/community/community_provider.dart
+++ b/mobile/lib/shared/community/community_provider.dart
@@ -1,3 +1,4 @@
+import '../hosted/hosted_relay_auth.dart';
 import 'dart:async';
 import 'dart:developer' as developer;
 import 'dart:math';
@@ -6,6 +7,7 @@ import 'package:hooks_riverpod/hooks_riverpod.dart';
 import 'package:nostr/nostr.dart' as nostr;
 
 import '../auth/auth_provider.dart';
+import '../hosted/community_entry_requirements.dart';
 import '../push/dev_push_lease.dart';
 import '../push/push_bridge.dart';
 import '../push/push_lease_revocation_outbox.dart';
@@ -253,6 +255,10 @@ class CommunityListNotifier extends AsyncNotifier<List<Community>> {
   /// Add a community. If one with the same relay URL already exists, update
   /// its credentials instead. Returns the effective community ID.
   Future<String> addCommunity(Community community) async {
+    await CommunityEntryRequirements.verify(
+      community,
+      ref.read(builderlabAccountProvider),
+    );
     final storage = ref.read(communityStorageProvider);
     final current = state.value ?? [];
 
diff --git a/mobile/lib/shared/community/community_storage.dart b/mobile/lib/shared/community/community_storage.dart
index cf846c8a82..9ced276b0b 100644
--- a/mobile/lib/shared/community/community_storage.dart
+++ b/mobile/lib/shared/community/community_storage.dart
@@ -2,6 +2,8 @@ import 'dart:convert';
 
 import 'package:flutter_secure_storage/flutter_secure_storage.dart';
 
+import '../storage/secure_storage.dart';
+
 import 'community.dart';
 
 class CommunityStorage {
@@ -19,7 +21,7 @@ class CommunityStorage {
   final FlutterSecureStorage _secure;
 
   CommunityStorage({FlutterSecureStorage? secure})
-    : _secure = secure ?? const FlutterSecureStorage();
+    : _secure = secure ?? communitySecureStorage;
 
   /// Load all communities. On first call, migrates legacy single-community
   /// credentials if present.
diff --git a/mobile/lib/shared/community/paired_community_landing.dart b/mobile/lib/shared/community/paired_community_landing.dart
index 0acd6b99a9..776f06770e 100644
--- a/mobile/lib/shared/community/paired_community_landing.dart
+++ b/mobile/lib/shared/community/paired_community_landing.dart
@@ -2,6 +2,18 @@ import 'package:hooks_riverpod/hooks_riverpod.dart';
 
 import 'community.dart';
 
+/// Opens the existing community grid after a hosted account import completes.
+final communityGridLandingProvider =
+    NotifierProvider<CommunityGridLanding, bool>(CommunityGridLanding.new);
+
+class CommunityGridLanding extends Notifier<bool> {
+  @override
+  bool build() => false;
+
+  void request() => state = true;
+  void clear() => state = false;
+}
+
 /// A one-shot request to reveal an imported community through its avatar.
 final pairedCommunityLandingProvider =
     NotifierProvider<PairedCommunityLanding, Community?>(
diff --git a/mobile/lib/shared/deeplink/community_link_input.dart b/mobile/lib/shared/deeplink/community_link_input.dart
new file mode 100644
index 0000000000..3aa6edce75
--- /dev/null
+++ b/mobile/lib/shared/deeplink/community_link_input.dart
@@ -0,0 +1,36 @@
+import 'deep_link.dart';
+
+/// Converts user-entered community addresses or invites to validated app links.
+/// Other deep-link actions are deliberately excluded from this input.
+Uri? parseCommunityLinkInput(String input) {
+  final raw = input.trim();
+  if (raw.isEmpty || raw.length > 8192 || RegExp(r'\s').hasMatch(raw)) {
+    return null;
+  }
+  try {
+    final uri = Uri.parse(raw.contains('://') ? raw : 'https://$raw');
+    if (parseInviteDeepLink(uri) != null ||
+        parseAddCommunityDeepLink(uri) != null) {
+      return uri;
+    }
+    if (!{'https', 'wss'}.contains(uri.scheme) ||
+        uri.host.isEmpty ||
+        uri.userInfo.isNotEmpty ||
+        uri.hasQuery ||
+        uri.hasFragment ||
+        (uri.path.isNotEmpty && uri.path != '/')) {
+      return null;
+    }
+    final link = Uri(
+      scheme: 'buzz',
+      host: 'add-community',
+      queryParameters: {
+        'relay': uri.replace(scheme: 'wss', path: '').toString(),
+        'name': uri.host,
+      },
+    );
+    return parseAddCommunityDeepLink(link) == null ? null : link;
+  } on FormatException {
+    return null;
+  }
+}
diff --git a/mobile/lib/shared/deeplink/deep_link.dart b/mobile/lib/shared/deeplink/deep_link.dart
index c58acefd21..14c38489c6 100644
--- a/mobile/lib/shared/deeplink/deep_link.dart
+++ b/mobile/lib/shared/deeplink/deep_link.dart
@@ -8,10 +8,14 @@
 library;
 
 import '../relay/relay_validation.dart';
+import '../hosted/hosted_environment.dart';
 
 /// A parsed deep link supported by the app.
 sealed class BuzzDeepLink {
   const BuzzDeepLink();
+
+  /// Community addressed by entry links; other actions have no relay target.
+  String? get relayUrl => null;
 }
 
 /// A parsed relay invite link.
@@ -21,6 +25,7 @@ sealed class BuzzDeepLink {
 /// handoff from the web landing page.
 class InviteDeepLink extends BuzzDeepLink {
   /// Relay URL normalized to the websocket scheme used by the app.
+  @override
   final String relayUrl;
 
   /// Invite code from the link.
@@ -292,6 +297,8 @@ InviteDeepLink? parseInviteDeepLink(Uri uri) {
 
 /// Parse any supported Buzz deep link.
 BuzzDeepLink? parseBuzzDeepLink(Uri uri) =>
+    parseNostrBindDeepLink(uri) ??
+    parseAddCommunityDeepLink(uri) ??
     parseInviteDeepLink(uri) ??
     parseChannelDeepLink(uri) ??
     parseMessageDeepLink(uri);
@@ -352,3 +359,104 @@ EntityDeepLink? parseEntityDeepLink(Uri uri) {
     eventId: eventId?.toLowerCase(),
   );
 }
+
+/// Web signup's challenge. Values are untrusted until authenticated verification.
+class NostrBindDeepLink extends BuzzDeepLink {
+  final Map<String, String> fields;
+  NostrBindDeepLink._(Map<String, String> fields)
+    : fields = Map.unmodifiable(fields);
+  String get challengeId => fields['challenge_id']!;
+  String get nonce => fields['nonce']!;
+  DateTime get expiresAt => DateTime.parse(fields['expires_at']!);
+  @override
+  String toString() => 'NostrBindDeepLink(redacted)';
+}
+
+class AddCommunityDeepLink extends BuzzDeepLink {
+  @override
+  final String relayUrl;
+  final String name;
+  const AddCommunityDeepLink({required this.relayUrl, required this.name});
+}
+
+bool _webHandoffShape(Uri uri, String host, Set<String> allowed) =>
+    uri.scheme == 'buzz' &&
+    uri.host == host &&
+    uri.path.isEmpty &&
+    !uri.hasFragment &&
+    !uri.hasPort &&
+    uri.userInfo.isEmpty &&
+    uri.toString().length <= 8192 &&
+    uri.queryParametersAll.keys.every(allowed.contains) &&
+    uri.queryParametersAll.values.every((values) => values.length == 1);
+
+NostrBindDeepLink? parseNostrBindDeepLink(Uri uri) {
+  const fields = {
+    'challenge_id',
+    'nonce',
+    'verification_code',
+    'audience',
+    'action',
+    'protocol',
+    'version',
+    'origin',
+    'expires_at',
+    'return',
+    'callback_url',
+  };
+  if (!_webHandoffShape(uri, 'nostr-bind', fields) ||
+      !fields.every(uri.queryParameters.containsKey)) {
+    return null;
+  }
+  final p = uri.queryParameters;
+  if (!RegExp(
+        r'^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$',
+      ).hasMatch(p['challenge_id']!) ||
+      !RegExp(r'^[A-Za-z0-9_-]{43}$').hasMatch(p['nonce']!) ||
+      !RegExp(r'^[0-9]{6}$').hasMatch(p['verification_code']!) ||
+      p['audience'] != 'buzz:nostr-identity' ||
+      p['action'] != 'bind_nostr_identity' ||
+      p['protocol'] != 'buzz-nostr-identity' ||
+      p['version'] != '1' ||
+      p['origin'] != HostedEnvironment.origin.toString() ||
+      p['return'] != 'browser_fragment_v1' ||
+      p['callback_url'] !=
+          HostedEnvironment.origin.resolve('/buzz').toString() ||
+      !RegExp(r'(Z|[+-][0-9]{2}:[0-9]{2})$').hasMatch(p['expires_at']!) ||
+      DateTime.tryParse(p['expires_at']!) == null) {
+    return null;
+  }
+  return NostrBindDeepLink._(p);
+}
+
+AddCommunityDeepLink? parseAddCommunityDeepLink(Uri uri) {
+  if (!_webHandoffShape(uri, 'add-community', {'relay', 'name'})) return null;
+  final relay = Uri.tryParse(uri.queryParameters['relay'] ?? '');
+  final name = uri.queryParameters['name'];
+  if (relay == null ||
+      relay.scheme != 'wss' ||
+      relay.host.isEmpty ||
+      relay.host.endsWith('.') ||
+      relay.userInfo.isNotEmpty ||
+      relay.hasQuery ||
+      relay.hasFragment ||
+      (relay.path.isNotEmpty && relay.path != '/') ||
+      name == null ||
+      name.trim().isEmpty ||
+      name.length > 200) {
+    return null;
+  }
+  try {
+    validateInviteRelayUri(relay);
+  } on FormatException {
+    return null;
+  }
+  return AddCommunityDeepLink(
+    relayUrl: Uri(
+      scheme: 'wss',
+      host: relay.host,
+      port: relay.hasPort ? relay.port : null,
+    ).toString(),
+    name: name,
+  );
+}
diff --git a/mobile/lib/shared/deeplink/pending_deep_link_provider.dart b/mobile/lib/shared/deeplink/pending_deep_link_provider.dart
index 70f1a6a3b6..dec263753c 100644
--- a/mobile/lib/shared/deeplink/pending_deep_link_provider.dart
+++ b/mobile/lib/shared/deeplink/pending_deep_link_provider.dart
@@ -53,7 +53,8 @@ class PendingDeepLinkNotifier extends Notifier<BuzzDeepLink?> {
   void open(Uri uri) {
     final link = parseBuzzDeepLink(uri);
     if (link == null) {
-      debugPrint('deep-link: ignoring unsupported link: $uri');
+      // Unknown links may contain OAuth codes or invite credentials.
+      debugPrint('deep-link: ignoring unsupported link');
       return;
     }
     _enqueue(link);
diff --git a/mobile/lib/shared/emoji/emoji_only.dart b/mobile/lib/shared/emoji/emoji_only.dart
index e6994f0b9b..60637e0a36 100644
--- a/mobile/lib/shared/emoji/emoji_only.dart
+++ b/mobile/lib/shared/emoji/emoji_only.dart
@@ -25,6 +25,8 @@ const double kEmojiOnlyCustomEmojiSize = kEmojiOnlyFontSize * 1.45;
 /// digit-based sequences don't match — those are covered by the dataset's own
 /// native set instead, exactly as desktop does it.
 final RegExp _pictographic = RegExp(
+  // The Dart VM supports this Unicode property; the analyzer parser does not.
+  // ignore: valid_regexps
   r'\p{Extended_Pictographic}',
   unicode: true,
 );
@@ -44,35 +46,35 @@ bool isEmojiOnlyMessage(
   final trimmed = content.trim();
   if (trimmed.isEmpty) return false;
 
-  final shortcodes = {
-    for (final emoji in customEmoji) emoji.shortcode.toLowerCase(),
-  };
+  Set<String>? shortcodes;
   var sawEmoji = false;
 
   // Grapheme clusters, so a ZWJ family or a flag pair is one unit. Desktop
   // hand-rolls this scan; Dart's `characters` already segments correctly.
   final iterator = trimmed.characters.iterator;
-  final clusters = <String>[];
   while (iterator.moveNext()) {
-    clusters.add(iterator.current);
-  }
+    final cluster = iterator.current;
 
-  var index = 0;
-  while (index < clusters.length) {
-    final cluster = clusters[index];
-
-    if (cluster.trim().isEmpty) {
-      index += 1;
-      continue;
-    }
+    if (cluster.trim().isEmpty) continue;
 
     if (cluster == ':') {
-      final end = clusters.indexOf(':', index + 1);
-      if (end <= index + 1) return false;
-      final shortcode = clusters.sublist(index + 1, end).join().toLowerCase();
-      if (!shortcodes.contains(shortcode)) return false;
+      final shortcode = StringBuffer();
+      var closed = false;
+      while (iterator.moveNext()) {
+        if (iterator.current == ':') {
+          closed = true;
+          break;
+        }
+        shortcode.write(iterator.current);
+      }
+      if (!closed || shortcode.isEmpty) return false;
+      shortcodes ??= {
+        for (final emoji in customEmoji) emoji.shortcode.toLowerCase(),
+      };
+      if (!shortcodes.contains(shortcode.toString().toLowerCase())) {
+        return false;
+      }
       sawEmoji = true;
-      index = end + 1;
       continue;
     }
 
@@ -80,7 +82,6 @@ bool isEmojiOnlyMessage(
       return false;
     }
     sawEmoji = true;
-    index += 1;
   }
 
   return sawEmoji;
diff --git a/mobile/lib/shared/hosted/account_identity_store.dart b/mobile/lib/shared/hosted/account_identity_store.dart
new file mode 100644
index 0000000000..76e8f39b91
--- /dev/null
+++ b/mobile/lib/shared/hosted/account_identity_store.dart
@@ -0,0 +1,359 @@
+import '../storage/serial_queue.dart';
+import 'dart:async';
+import 'dart:convert';
+
+import 'package:flutter_secure_storage/flutter_secure_storage.dart';
+
+import 'package:nostr/nostr.dart' as nostr;
+
+import '../storage/secure_storage.dart';
+
+import 'hosted_environment.dart';
+
+/// Safe failures: never include a secret or the storage/plugin exception.
+enum AccountIdentityFailure {
+  unreadable,
+  invalidKey,
+  occupied,
+  absent,
+  mismatch,
+}
+
+/// Evidence from a successful backup/recovery, not merely an attempted upload.
+class BackupReceipt {
+  BackupReceipt({
+    required this.backend,
+    required this.subject,
+    required this.pubkey,
+    required this.backupId,
+  }) {
+    final uri = Uri.tryParse(backend);
+    if (uri == null ||
+        uri.scheme != 'https' ||
+        uri.host.isEmpty ||
+        uri.origin != backend ||
+        subject.isEmpty ||
+        backupId.isEmpty ||
+        !RegExp(r'^[0-9a-f]{64}$').hasMatch(pubkey)) {
+      throw AccountIdentityFailure.mismatch;
+    }
+  }
+
+  final String backend;
+  final String subject;
+  final String pubkey;
+  final String backupId;
+
+  Map<String, String> _json() => {
+    'backend': backend,
+    'subject': subject,
+    'pubkey': pubkey,
+    'backup_id': backupId,
+  };
+
+  static BackupReceipt _decode(dynamic value) => BackupReceipt(
+    backend: value['backend'] as String,
+    subject: value['subject'] as String,
+    pubkey: value['pubkey'] as String,
+    backupId: value['backup_id'] as String,
+  );
+}
+
+/// Public facts only. Signing material never enters observable UI state.
+class AccountIdentitySnapshot {
+  const AccountIdentitySnapshot(this.pubkey, this.backup);
+  final String pubkey;
+  final BackupReceipt? backup;
+
+  bool hasBackupFor({required String backend, required String subject}) =>
+      // Retired walkthrough receipts must never authorize real admission.
+      !(backup?.backupId.startsWith('debug-simulated-backup:') ?? false) &&
+      backup?.backend == backend &&
+      backup?.subject == subject &&
+      backup?.pubkey == pubkey;
+}
+
+/// Create-only AccountKey slots per backend and authenticated subject. Exact-key retries
+/// are idempotent; they never discard or replace an existing backup receipt. Does not choose or mutate legacy
+/// community identities. Migration must explicitly resolve a candidate first.
+///
+/// Key and recovered receipt share one secure record, so restart cannot observe
+/// a saved recovered key without its receipt. All instances serialize within the
+/// app isolate. Native extensions/other isolates must not write this slot:
+/// FlutterSecureStorage does not provide a cross-process compare-and-set.
+class AccountIdentityStore {
+  AccountIdentityStore({FlutterSecureStorage? storage, String? subject})
+    : _storage = storage ?? accountSecureStorage,
+      _subject = subject,
+      _pairingPubkey = null;
+
+  AccountIdentityStore._paired(this._storage, this._pairingPubkey)
+    : _subject = null;
+
+  final String? _subject;
+  final String? _pairingPubkey;
+
+  /// Retain a transferred key before account login without occupying any
+  /// account slot or replacing a previous pending transfer.
+  AccountIdentityStore forPairing(String pubkey) {
+    if (!RegExp(r'^[0-9a-f]{64}$').hasMatch(pubkey)) {
+      throw AccountIdentityFailure.invalidKey;
+    }
+    return AccountIdentityStore._paired(_storage, pubkey);
+  }
+
+  /// Pin an operation to its authenticated account, never a mutable session.
+  AccountIdentityStore forSubject(String subject) {
+    if (subject.isEmpty) throw AccountIdentityFailure.mismatch;
+    return AccountIdentityStore(storage: _storage, subject: subject);
+  }
+
+  String get _key => _pairingPubkey != null
+      ? '${storageKey}_pairing_$_pairingPubkey'
+      : _subject == null
+      ? storageKey
+      : '${storageKey}_subject_${base64Url.encode(utf8.encode(_subject))}';
+
+  static final storageKey =
+      'buzz_account_identity_${HostedEnvironment.origin.host.replaceAll('.', '_')}_v1';
+  static final _queue = SerialQueue();
+  final FlutterSecureStorage _storage;
+
+  Future<T> _serialized<T>(Future<T> Function() operation) {
+    final result = _queue.run(() => operation());
+    return result;
+  }
+
+  Future<AccountIdentitySnapshot?> read() => _serialized(() async {
+    final record = await _read();
+    return record?.snapshot;
+  });
+
+  Future<AccountIdentitySnapshot> create(
+    String nsec, {
+    BackupReceipt? recoveredBackup,
+    void Function()? checkCurrent,
+  }) => _serialized(() async {
+    checkCurrent?.call();
+    // Read before parsing/generating any candidate: corrupt != absent.
+    final existing = await _read();
+    final keys = _keys(nsec);
+    if (existing != null) {
+      if (existing.pubkey != keys.public) throw AccountIdentityFailure.occupied;
+      if (recoveredBackup == null) return existing.snapshot;
+      if (existing.backup != null) {
+        if (jsonEncode(existing.backup!._json()) !=
+            jsonEncode(recoveredBackup._json())) {
+          throw AccountIdentityFailure.mismatch;
+        }
+        return existing.snapshot;
+      }
+    }
+    if (recoveredBackup != null && recoveredBackup.pubkey != keys.public) {
+      throw AccountIdentityFailure.mismatch;
+    }
+    checkCurrent?.call();
+    final record = _Record(nsec, keys.public, recoveredBackup);
+    await _write(record);
+    return record.snapshot;
+  });
+
+  /// Authorization runs under the identity writer lock and must not reenter it.
+  /// A completed but unacknowledged write is reused on retry, never regenerated.
+  Future<AccountIdentitySnapshot?> generateIfAbsent({
+    required Future<bool> Function() authorize,
+  }) => _serialized(() async {
+    final existing = await _read();
+    if (existing != null) return existing.snapshot;
+    if (!await authorize()) return null;
+    final keys = nostr.Keys.generate();
+    final record = _Record(keys.nsec, keys.public, null);
+    await _write(record);
+    return record.snapshot;
+  });
+
+  Future<AccountIdentitySnapshot> confirmBackup(BackupReceipt receipt) =>
+      _serialized(() async {
+        final record = await _read();
+        if (record == null) throw AccountIdentityFailure.absent;
+        if (record.pubkey != receipt.pubkey) {
+          throw AccountIdentityFailure.mismatch;
+        }
+        final updated = _Record(record.nsec, record.pubkey, receipt);
+        await _write(updated);
+        return updated.snapshot;
+      });
+
+  static bool _isIdentityKey(String key) =>
+      key == storageKey ||
+      key.startsWith('${storageKey}_subject_') ||
+      key.startsWith('${storageKey}_pairing_');
+
+  AccountIdentityStore _atKey(String key) => key == storageKey
+      ? AccountIdentityStore(storage: _storage)
+      : key.startsWith('${storageKey}_pairing_')
+      ? forPairing(key.substring('${storageKey}_pairing_'.length))
+      : forSubject(
+          utf8.decode(
+            base64Url.decode(key.substring('${storageKey}_subject_'.length)),
+          ),
+        );
+
+  // Android readAll decrypts unrelated entries too. An unrelated broken entry
+  // must not prevent reading the legacy/current slot or an explicitly named key.
+  Future<Set<String>> _identityKeys({String? pubkey}) async {
+    try {
+      return (await _storage.readAll()).keys.where(_isIdentityKey).toSet();
+    } catch (_) {
+      // A partial inventory cannot establish absence or authorize generation.
+      if (pubkey == null) throw AccountIdentityFailure.unreadable;
+      return {storageKey, _key, forPairing(pubkey)._key};
+    }
+  }
+
+  /// Saved account keys offered for explicit reuse, including pre-scope keys.
+  Future<List<AccountIdentitySnapshot>> identities() => _serialized(() async {
+    final keys = await _identityKeys();
+    final identities = <String, AccountIdentitySnapshot>{};
+    for (final key in keys) {
+      final record = await _atKey(key)._read();
+      if (record != null) identities[record.pubkey] = record.snapshot;
+    }
+    return identities.values.toList();
+  });
+
+  /// Copy a chosen saved account key without deleting its original owner.
+  Future<AccountIdentitySnapshot> adoptSaved(
+    String pubkey, {
+    required void Function() checkCurrent,
+  }) async => create(await _savedNsec(pubkey), checkCurrent: checkCurrent);
+
+  /// Supplies only the explicitly selected saved key to an admission service.
+  Future<T> withSavedIdentity<T>(
+    String pubkey,
+    Future<T> Function(String nsec) operation,
+  ) async => operation(await _savedNsec(pubkey));
+
+  Future<String> _savedNsec(String pubkey) => _serialized(() async {
+    try {
+      final keys = await _identityKeys(pubkey: pubkey);
+      for (final key in keys) {
+        final record = await _atKey(key)._read();
+        if (record?.pubkey == pubkey) return record!.nsec;
+      }
+    } catch (_) {
+      throw AccountIdentityFailure.unreadable;
+    }
+    throw AccountIdentityFailure.absent;
+  });
+
+  /// Service-only signing/export boundary. Do not return keys from this closure
+  /// to a provider/widget. Avoid reentering this store inside the callback.
+  Future<T> withKeys<T>(Future<T> Function(nostr.Keys keys) operation) =>
+      _serialized(() async {
+        final record = await _read();
+        if (record == null) throw AccountIdentityFailure.absent;
+        return operation(_keys(record.nsec));
+      });
+
+  Future<_Record?> _read() async {
+    try {
+      final raw = await _storage.read(key: _key);
+      // Preserve the old record. Only a receipt for this exact account can
+      // authorize its automatic migration; other keys remain explicit choices.
+      if (raw == null && _subject != null) {
+        final legacy = await AccountIdentityStore(storage: _storage)._read();
+        if (legacy?.backup?.subject == _subject &&
+            legacy?.backup?.backend == HostedEnvironment.origin.origin) {
+          await _write(legacy!);
+          return legacy;
+        }
+      }
+      if (raw == null) return null;
+      final value = jsonDecode(raw) as Map<String, dynamic>;
+      if (value['version'] != 1) throw AccountIdentityFailure.unreadable;
+      final nsec = value['nsec'] as String;
+      final pubkey = _keys(nsec).public;
+      if (value['pubkey'] != pubkey ||
+          (_pairingPubkey != null && _pairingPubkey != pubkey)) {
+        throw AccountIdentityFailure.unreadable;
+      }
+      final receipt = value['backup'] == null
+          ? null
+          : BackupReceipt._decode(value['backup']);
+      if (receipt != null &&
+          (receipt.pubkey != pubkey ||
+              (_subject != null && receipt.subject != _subject))) {
+        throw AccountIdentityFailure.unreadable;
+      }
+      return _Record(nsec, pubkey, receipt);
+    } catch (_) {
+      throw AccountIdentityFailure.unreadable;
+    }
+  }
+
+  Future<void> _write(_Record record) async {
+    if ((_pairingPubkey != null && record.pubkey != _pairingPubkey) ||
+        (_subject != null &&
+            record.backup != null &&
+            record.backup!.subject != _subject)) {
+      throw AccountIdentityFailure.mismatch;
+    }
+    final raw = jsonEncode({
+      'version': 1,
+      'nsec': record.nsec,
+      'pubkey': record.pubkey,
+      'backup': record.backup?._json(),
+    });
+    try {
+      await _storage.write(key: _key, value: raw);
+      if (await _storage.read(key: _key) != raw) {
+        throw AccountIdentityFailure.unreadable;
+      }
+    } catch (_) {
+      // A write may have completed: caller must reread, never replace/recreate.
+      throw AccountIdentityFailure.unreadable;
+    }
+  }
+
+  /// Validate a candidate without exposing signing material to the UI.
+  static String publicKeyForNsec(String nsec) => _keys(nsec).public;
+
+  /// Rejects invalid secp256k1 scalars before constructing a signing key.
+  static nostr.Keys keysForHex(String hex) {
+    if (!RegExp(r'^[0-9a-fA-F]{64}$').hasMatch(hex)) {
+      throw AccountIdentityFailure.invalidKey;
+    }
+    final scalar = BigInt.parse(hex, radix: 16);
+    final order = BigInt.parse(
+      'fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141',
+      radix: 16,
+    );
+    if (scalar <= BigInt.zero || scalar >= order) {
+      throw AccountIdentityFailure.invalidKey;
+    }
+    return nostr.Keys(hex);
+  }
+
+  static nostr.Keys _keys(String nsec) {
+    try {
+      final decoded = nostr.Nip19.decode(payload: nsec);
+      if (decoded.prefix != nostr.Nip19Prefix.nsec ||
+          !RegExp(r'^[0-9a-fA-F]{64}$').hasMatch(decoded.data)) {
+        throw AccountIdentityFailure.invalidKey;
+      }
+      return keysForHex(decoded.data);
+    } catch (_) {
+      throw AccountIdentityFailure.invalidKey;
+    }
+  }
+}
+
+class _Record {
+  const _Record(this.nsec, this.pubkey, this.backup);
+  final String nsec;
+  final String pubkey;
+  final BackupReceipt? backup;
+  AccountIdentitySnapshot get snapshot =>
+      AccountIdentitySnapshot(pubkey, backup);
+}
diff --git a/mobile/lib/shared/hosted/bounded_http_response.dart b/mobile/lib/shared/hosted/bounded_http_response.dart
new file mode 100644
index 0000000000..36ec840709
--- /dev/null
+++ b/mobile/lib/shared/hosted/bounded_http_response.dart
@@ -0,0 +1,50 @@
+import 'dart:async';
+
+import 'package:http/http.dart' as http;
+
+/// One deadline covers headers and the bounded body. Abort only this request,
+/// leaving the shared client usable for sign-out and subsequent attempts.
+Future<http.Response> boundedHttpResponse(
+  http.Client client,
+  http.Request source,
+) async {
+  final abort = Completer<void>();
+  final request =
+      http.AbortableRequest(
+          source.method,
+          source.url,
+          abortTrigger: abort.future,
+        )
+        ..followRedirects = false
+        ..headers.addAll(source.headers)
+        ..bodyBytes = source.bodyBytes;
+  StreamIterator<List<int>>? body;
+  Future<http.Response> read() async {
+    final response = await client.send(request);
+    final iterator = body = StreamIterator(response.stream);
+    if (abort.isCompleted) {
+      await iterator.cancel();
+      throw http.RequestAbortedException();
+    }
+    final bytes = <int>[];
+    while (await iterator.moveNext()) {
+      if (bytes.length + iterator.current.length > 65536) {
+        throw const FormatException('Response too large');
+      }
+      bytes.addAll(iterator.current);
+    }
+    return http.Response.bytes(
+      bytes,
+      response.statusCode,
+      headers: response.headers,
+    );
+  }
+
+  try {
+    return await read().timeout(const Duration(seconds: 30));
+  } finally {
+    abort.complete();
+    // Do not let transport cleanup hold the account's serial queue hostage.
+    unawaited(body?.cancel());
+  }
+}
diff --git a/mobile/lib/shared/hosted/browser_auth.dart b/mobile/lib/shared/hosted/browser_auth.dart
new file mode 100644
index 0000000000..7e0c7cb896
--- /dev/null
+++ b/mobile/lib/shared/hosted/browser_auth.dart
@@ -0,0 +1,287 @@
+import '../storage/serial_queue.dart';
+import 'dart:async';
+import 'dart:convert';
+import 'dart:math';
+
+import 'package:app_links/app_links.dart';
+import 'package:crypto/crypto.dart';
+import 'package:flutter/foundation.dart';
+import 'package:flutter/services.dart';
+import 'package:flutter_secure_storage/flutter_secure_storage.dart';
+
+import 'package:url_launcher/url_launcher.dart';
+
+import '../storage/secure_storage.dart';
+
+import 'hosted_environment.dart';
+
+/// Safe to show as a generic retry prompt. Never carries a URL or server text.
+enum BrowserAuthFailure { restartLogin, cancelled, unavailable, storage }
+
+class BrowserAuthCode {
+  const BrowserAuthCode(this.code, this.verifier, this.intent);
+  final String code;
+  final String verifier;
+  final Map<String, String> intent;
+}
+
+/// One app-scoped owner. Subscribe to [codes] and [failures] before [initialize].
+/// Callbacks bypass the community deep-link FIFO. A consumed code is never
+/// replayed automatically: exchange failure requires a fresh browser login.
+class BrowserAuth {
+  BrowserAuth({
+    FlutterSecureStorage? storage,
+    Future<String?> Function(Uri)? openBrowser,
+    DateTime Function()? now,
+  }) : _storage = storage ?? accountSecureStorage,
+       _openBrowser = openBrowser ?? _openPlatformBrowser,
+       _now = now ?? DateTime.now;
+
+  static const callback = 'xyz.block.buzz.mobile:/auth/callback';
+  static final _attemptKey =
+      'buzz_browser_auth_attempt_v1_${HostedEnvironment.origin.host}';
+  static final _intentKey =
+      'buzz_browser_auth_intent_v1_${HostedEnvironment.origin.host}';
+  static const _channel = MethodChannel('buzz/browser_auth');
+  final FlutterSecureStorage _storage;
+  final Future<String?> Function(Uri) _openBrowser;
+  final DateTime Function() _now;
+  final _codes = StreamController<BrowserAuthCode>.broadcast();
+  final _failures = StreamController<BrowserAuthFailure>.broadcast();
+  Stream<BrowserAuthCode> get codes => _codes.stream;
+  Stream<BrowserAuthFailure> get failures => _failures.stream;
+  StreamSubscription<Uri>? _links;
+  final _queue = SerialQueue();
+  bool _disposed = false;
+  bool _initialized = false;
+  int _generation = 0;
+  String? _activeState;
+  String? _consumedCallbackHash;
+
+  Future<T> _serial<T>(Future<T> Function() task) {
+    final result = _queue.run(() {
+      if (_disposed) throw BrowserAuthFailure.cancelled;
+      return task();
+    });
+    return result;
+  }
+
+  Future<void> initialize() async {
+    if (_initialized || _disposed) return;
+    _initialized = true;
+    final links = AppLinks();
+    _links = links.uriLinkStream.listen((uri) {
+      if (uri.scheme == 'xyz.block.buzz.mobile') {
+        unawaited(receive(uri).catchError((Object _) {}));
+      }
+    }, onError: (Object _) => _fail(BrowserAuthFailure.unavailable));
+    try {
+      final initial = await links.getInitialLink();
+      if (initial != null && initial.scheme == 'xyz.block.buzz.mobile') {
+        await receive(initial);
+      }
+    } catch (_) {
+      _fail(BrowserAuthFailure.unavailable);
+    }
+  }
+
+  /// Intent is opaque to authentication; callers validate its relay/challenge
+  /// before acting. Retained separately so missing state never loses navigation.
+  Future<Map<String, String>?> retainedIntent() => _serial(() async {
+    try {
+      final raw = await _storage.read(key: _intentKey);
+      if (raw == null) return null;
+      return Map<String, String>.from(jsonDecode(raw) as Map);
+    } catch (_) {
+      throw BrowserAuthFailure.storage;
+    }
+  });
+
+  /// Persist setup intent before remote work or acknowledging key transfer.
+  Future<void> retainIntent(Map<String, String> intent) => _serial(() async {
+    final raw = jsonEncode(intent);
+    if (raw.length > 16384) throw BrowserAuthFailure.storage;
+    await _storage.write(key: _intentKey, value: raw);
+    if (await _storage.read(key: _intentKey) != raw) {
+      throw BrowserAuthFailure.storage;
+    }
+  });
+
+  Future<void> start(Map<String, String> intent) async {
+    final generation = ++_generation;
+    final uri = await _serial(() async {
+      if (jsonEncode(intent).length > 16384) throw BrowserAuthFailure.storage;
+      final random = Random.secure();
+      String secret() => base64UrlEncode(
+        List.generate(32, (_) => random.nextInt(256)),
+      ).replaceAll('=', '');
+      final verifier = secret();
+      final state = secret();
+      _activeState = state;
+      final record = jsonEncode({
+        'verifier': verifier,
+        'state': state,
+        'created': _now().toUtc().millisecondsSinceEpoch,
+        'intent': intent,
+      });
+      try {
+        await _storage.write(key: _intentKey, value: jsonEncode(intent));
+        await _storage.write(key: _attemptKey, value: record);
+        if (await _storage.read(key: _attemptKey) != record) {
+          throw BrowserAuthFailure.storage;
+        }
+      } catch (_) {
+        throw BrowserAuthFailure.storage;
+      }
+      return HostedEnvironment.origin.replace(
+        path: '/api/goose/v1/auth/login',
+        queryParameters: {
+          'type': 'cli',
+          'product': 'buzz',
+          'returnTo': callback,
+          'state': state,
+          'code_challenge': base64UrlEncode(
+            sha256.convert(ascii.encode(verifier)).bytes,
+          ).replaceAll('=', ''),
+          'code_challenge_method': 'S256',
+        },
+      );
+    });
+    if (_disposed || generation != _generation) return;
+    try {
+      final result = await _openBrowser(uri);
+      if (!_disposed && generation == _generation && result != null) {
+        await receive(Uri.parse(result));
+      }
+    } on PlatformException catch (error) {
+      if (generation == _generation) {
+        _fail(
+          error.code == 'cancelled'
+              ? BrowserAuthFailure.cancelled
+              : BrowserAuthFailure.unavailable,
+        );
+      }
+    } catch (_) {
+      if (generation == _generation) _fail(BrowserAuthFailure.unavailable);
+    }
+  }
+
+  Future<void> receive(Uri uri) {
+    final generation = _generation;
+    return _serial(() async {
+      if (generation != _generation) return;
+      void fail(BrowserAuthFailure failure) {
+        if (generation == _generation) _fail(failure);
+      }
+
+      // Reject noncanonical destination and duplicate query fields before reading
+      // secrets. Neither invalid state nor malformed callbacks mutate the session.
+      final callbackHash = sha256
+          .convert(utf8.encode(uri.toString()))
+          .toString();
+      if (callbackHash == _consumedCallbackHash) return;
+      final query = uri.queryParametersAll;
+      if (uri.toString().split('?').first != callback ||
+          uri.hasFragment ||
+          query.values.any((v) => v.length != 1) ||
+          query.keys.any((k) => k != 'state' && k != 'code' && k != 'error')) {
+        if (_activeState == null) fail(BrowserAuthFailure.restartLogin);
+        return;
+      }
+      try {
+        final saved = await _storage.read(key: _attemptKey);
+        if (saved == null) {
+          fail(BrowserAuthFailure.restartLogin);
+          return;
+        }
+        final record = jsonDecode(saved) as Map<String, dynamic>;
+        final expectedState = record['state'];
+        if (expectedState is! String ||
+            !RegExp(r'^[A-Za-z0-9_-]{43}$').hasMatch(expectedState)) {
+          throw BrowserAuthFailure.storage;
+        }
+        final age =
+            _now().toUtc().millisecondsSinceEpoch - (record['created'] as int);
+        if (age < 0 || age > const Duration(minutes: 10).inMilliseconds) {
+          fail(BrowserAuthFailure.restartLogin);
+          return;
+        }
+        if (query['state']?.single != expectedState) {
+          if (_activeState != expectedState) {
+            fail(BrowserAuthFailure.restartLogin);
+          }
+          return;
+        }
+        if (generation != _generation) return;
+        final code = query['code']?.single;
+        if (query.containsKey('error') ||
+            code == null ||
+            code.isEmpty ||
+            code.length > 4096) {
+          fail(BrowserAuthFailure.restartLogin);
+          return;
+        }
+        final verifier = record['verifier'] as String;
+        if (!RegExp(r'^[A-Za-z0-9_-]{43}$').hasMatch(verifier)) {
+          throw BrowserAuthFailure.storage;
+        }
+        final intent = Map<String, String>.from(record['intent'] as Map);
+        await _storage.delete(key: _attemptKey);
+        if (await _storage.read(key: _attemptKey) != null) {
+          throw BrowserAuthFailure.storage;
+        }
+        _activeState = null;
+        _consumedCallbackHash = callbackHash;
+        if (!_disposed && generation == _generation) {
+          _codes.add(BrowserAuthCode(code, verifier, Map.unmodifiable(intent)));
+        }
+      } catch (_) {
+        fail(BrowserAuthFailure.storage);
+      }
+    });
+  }
+
+  Future<void> cancel() async {
+    ++_generation;
+    _activeState = null;
+    if (defaultTargetPlatform == TargetPlatform.iOS) {
+      try {
+        await _channel.invokeMethod<void>('cancel');
+      } catch (_) {
+        /* No session may be active. */
+      }
+    }
+    await _serial(() => _storage.delete(key: _attemptKey));
+  }
+
+  /// Call only after completing or explicitly abandoning the retained intent.
+  Future<void> clearIntent() => _serial(() => _storage.delete(key: _intentKey));
+
+  void _fail(BrowserAuthFailure failure) {
+    if (!_disposed) _failures.add(failure);
+  }
+
+  Future<void> dispose() async {
+    _disposed = true;
+    ++_generation;
+    await _links?.cancel();
+    await _codes.close();
+    await _failures.close();
+  }
+
+  static Future<String?> _openPlatformBrowser(Uri uri) async {
+    if (defaultTargetPlatform == TargetPlatform.iOS) {
+      return _channel.invokeMethod<String>('start', {
+        'url': uri.toString(),
+        if (kDebugMode &&
+            const bool.fromEnvironment('BUZZ_DEBUG_PRIVATE_LOGIN'))
+          'ephemeral': 'true',
+      });
+    }
+    if (defaultTargetPlatform == TargetPlatform.android &&
+        await launchUrl(uri, mode: LaunchMode.inAppBrowserView)) {
+      return null;
+    }
+    throw BrowserAuthFailure.unavailable;
+  }
+}
diff --git a/mobile/lib/shared/hosted/builderlab_account.dart b/mobile/lib/shared/hosted/builderlab_account.dart
new file mode 100644
index 0000000000..b97604fec5
--- /dev/null
+++ b/mobile/lib/shared/hosted/builderlab_account.dart
@@ -0,0 +1,353 @@
+import '../storage/serial_queue.dart';
+import 'dart:async';
+import 'dart:convert';
+
+import 'package:flutter/foundation.dart';
+import 'package:flutter_secure_storage/flutter_secure_storage.dart';
+
+import 'package:http/http.dart' as http;
+
+import '../storage/secure_storage.dart';
+
+import 'hosted_environment.dart';
+import 'bounded_http_response.dart';
+import '../relay/relay_session.dart';
+import 'account_identity_store.dart';
+
+/// Errors contain no response bodies, credentials, or recovered private keys.
+/// Only [AccountFailure.signedOut] means "no session"; every other failure
+/// leaves the account state unknown.
+enum AccountFailure {
+  signedOut,
+  denied,
+  accountSetupRequired,
+  unavailable,
+  invalidResponse,
+  storage,
+
+  /// Login completed for a different account than the stored session.
+  differentAccount,
+
+  /// The server definitively refused this request (400/404/409/422); sending
+  /// it again unchanged cannot succeed.
+  rejected,
+}
+
+class BuilderlabAccount {
+  const BuilderlabAccount({
+    required this.subject,
+    required this.expiresAt,
+    this.needsAccountSetup = false,
+  });
+  final bool needsAccountSetup;
+  final String subject;
+  final DateTime expiresAt;
+}
+
+/// Builderlab's CLI and NIP-FA adapter use the same server-side CLI credential.
+/// This client uses the native header, never a browser cookie. Browser handoff
+/// is deliberately a separate boundary: an app link is not an account session.
+///
+/// One session per device, scoped to its account subject. A login for another
+/// subject is refused until the caller clears the session and every fact it
+/// holds for the previous subject.
+class BuilderlabAccountClient {
+  BuilderlabAccountClient({
+    http.Client? httpClient,
+    FlutterSecureStorage? storage,
+  }) : _http = httpClient ?? http.Client(),
+       _storage = storage ?? defaultStorage;
+
+  /// Device-only: the session never syncs or restores onto another device.
+  @visibleForTesting
+  static const defaultStorage = accountSecureStorage;
+
+  static final origin = HostedEnvironment.origin;
+  static const _prefix = '/api/goose';
+
+  /// Sessions are scoped per origin so staging never reads production state.
+  static final _storageKey =
+      'buzz_hosted_session_${origin.host.replaceAll('.', '_')}_v1';
+  final http.Client _http;
+  final FlutterSecureStorage _storage;
+  String? _credential;
+  BuilderlabAccount? _account;
+  final _queue = SerialQueue();
+  bool _disposed = false;
+
+  BuilderlabAccount? get account => _account;
+
+  /// Runs operations one at a time in call order, so a callback exchange that
+  /// arrives during startup restore waits instead of failing.
+  Future<T> _serial<T>(Future<T> Function() operation) {
+    final result = _queue.run(() {
+      if (_disposed) throw AccountFailure.unavailable;
+      return operation();
+    });
+    return result;
+  }
+
+  Future<BuilderlabAccount?> restore() => _serial(() async {
+    final record = await _readRecord();
+    if (record == null) return null;
+    try {
+      final verified = await _verify(record.credential);
+      if (verified.subject != record.subject) {
+        throw AccountFailure.invalidResponse;
+      }
+      return _adopt(record.credential, verified);
+    } on AccountFailure catch (failure) {
+      if (failure == AccountFailure.signedOut) {
+        await _clear();
+        return null;
+      }
+      rethrow;
+    }
+  });
+
+  /// Receives a one-use code only from a validated browser callback. PKCE is
+  /// verified by Builderlab; state and callback origin are checked by the caller.
+  Future<BuilderlabAccount> exchange({
+    required String code,
+    required String verifier,
+  }) => _serial(() async {
+    if (code.isEmpty ||
+        !RegExp(r'^[A-Za-z0-9._~-]{43,128}$').hasMatch(verifier)) {
+      throw AccountFailure.invalidResponse;
+    }
+    final stored = await _readRecord();
+    final result = await _request(
+      '/v1/auth/login/exchange',
+      body: {'code': code, 'code_verifier': verifier},
+    );
+    final credential = result['session_credential'];
+    if (credential is! String ||
+        credential.isEmpty ||
+        credential.length > 512) {
+      throw AccountFailure.invalidResponse;
+    }
+    final verified = await _verify(credential);
+    if (DateTime.tryParse(
+          result['expires_at'] is String ? result['expires_at'] as String : '',
+        ) !=
+        verified.expiresAt) {
+      throw AccountFailure.invalidResponse;
+    }
+    if (stored != null && stored.subject != verified.subject) {
+      throw AccountFailure.differentAccount;
+    }
+    if (_disposed) throw AccountFailure.unavailable;
+    final record = jsonEncode({
+      'origin': origin.toString(),
+      'credential': credential,
+      'subject': verified.subject,
+      'expires_at': verified.expiresAt.toIso8601String(),
+    });
+    try {
+      await _storage.write(key: _storageKey, value: record);
+      if (await _storage.read(key: _storageKey) != record) {
+        throw AccountFailure.storage;
+      }
+    } catch (_) {
+      throw AccountFailure.storage;
+    }
+    return _adopt(credential, verified);
+  });
+
+  /// An unreadable record is a storage failure, never an absent session: its
+  /// subject is unknown, so only an explicit [clearLocalSession] may drop it.
+  Future<({String credential, String subject})?> _readRecord() async {
+    final String? saved;
+    try {
+      saved = await _storage.read(key: _storageKey);
+    } catch (_) {
+      throw AccountFailure.storage;
+    }
+    if (saved == null) return null;
+    try {
+      final value = jsonDecode(saved);
+      if (value is Map<String, dynamic> &&
+          value['origin'] == origin.toString() &&
+          value['credential'] is String &&
+          value['subject'] is String) {
+        return (
+          credential: value['credential'] as String,
+          subject: value['subject'] as String,
+        );
+      }
+    } on FormatException {
+      // Falls through to the storage failure below.
+    }
+    throw AccountFailure.storage;
+  }
+
+  BuilderlabAccount _adopt(String credential, BuilderlabAccount verified) {
+    if (_disposed) throw AccountFailure.unavailable;
+    _credential = credential;
+    return _account = verified;
+  }
+
+  Future<BuilderlabAccount> _verify(String credential) async {
+    final result = await _request('/v1/auth/me', credential: credential);
+    final subject = result['subject'];
+    final expiry = result['expires_at'];
+    final parsed = expiry is String ? DateTime.tryParse(expiry) : null;
+    if (subject is! String || subject.isEmpty || parsed == null) {
+      throw AccountFailure.invalidResponse;
+    }
+    if (!parsed.isAfter(DateTime.now().toUtc())) throw AccountFailure.signedOut;
+    final standing = result['account_standing'];
+    final needsSetup =
+        standing is Map &&
+        (standing['details_status'] == 'ACCOUNT_DETAILS_STATUS_MISSING' ||
+            standing['screening_status'] ==
+                'ACCOUNT_SCREENING_STATUS_NOT_SCREENED');
+    return BuilderlabAccount(
+      subject: subject,
+      expiresAt: parsed,
+      needsAccountSetup: needsSetup,
+    );
+  }
+
+  /// Public identity metadata only. Private-key recovery belongs to the identity
+  /// storage owner, which must derive and verify the key before any persistence.
+  Future<Map<String, dynamic>> currentIdentity() =>
+      post('/v1/buzz/nostr-identities/current', {});
+
+  /// Authenticated JSON POST to a Buzz account route on the fixed origin. The
+  /// credential never leaves this client. A 401 clears the stored session only
+  /// when the session check also rejects it; otherwise it is [AccountFailure.denied].
+  Future<Map<String, dynamic>> post(String path, Map<String, dynamic> body) =>
+      _post(path, body);
+
+  Future<Map<String, dynamic>> _post(
+    String path,
+    Map<String, dynamic> body, {
+    String? signingKey,
+    String? expectedSubject,
+  }) {
+    if (!RegExp(r'^/v1/buzz(/[a-z0-9_-]+)+$').hasMatch(path)) {
+      throw ArgumentError.value(path, 'path', 'not a /v1/buzz/ route');
+    }
+    return _serial(() async {
+      final credential = _credential;
+      if (credential == null) throw AccountFailure.signedOut;
+      if (expectedSubject != null && _account?.subject != expectedSubject) {
+        throw AccountFailure.denied;
+      }
+      try {
+        return await _request(
+          path,
+          credential: credential,
+          body: body,
+          signingKey: signingKey,
+        );
+      } on AccountFailure catch (failure) {
+        if (failure == AccountFailure.denied &&
+            _account?.needsAccountSetup == true) {
+          throw AccountFailure.accountSetupRequired;
+        }
+        if (failure != AccountFailure.signedOut) rethrow;
+      }
+      // Routes also answer 401 for authorization failures, so only a rejected
+      // session check ends the session.
+      try {
+        await _verify(credential);
+      } on AccountFailure catch (failure) {
+        if (failure == AccountFailure.signedOut) await _clear();
+        rethrow;
+      }
+      throw AccountFailure.denied;
+    });
+  }
+
+  /// Proves the saved key. The issuer may establish its first account binding;
+  /// conflicting or retired bindings are refused atomically by the backend.
+  Future<Map<String, dynamic>> relayAssertion(
+    String relay,
+    String nsec, {
+    required String expectedSubject,
+  }) => _post(
+    '/v1/buzz/identity/assertions',
+    {
+      'relay_url': relay,
+      'nostr_pubkey': AccountIdentityStore.publicKeyForNsec(nsec),
+    },
+    signingKey: nsec,
+    expectedSubject: expectedSubject,
+  );
+
+  Future<void> clearLocalSession() => _serial(_clear);
+  Future<void> _clear() async {
+    _credential = null;
+    _account = null;
+    try {
+      await _storage.delete(key: _storageKey);
+    } catch (_) {
+      throw AccountFailure.storage;
+    }
+  }
+
+  Future<Map<String, dynamic>> _request(
+    String path, {
+    String? credential,
+    Map<String, dynamic>? body,
+    String? signingKey,
+  }) async {
+    try {
+      final request =
+          http.Request(
+              body == null ? 'GET' : 'POST',
+              origin.replace(path: '$_prefix$path'),
+            )
+            ..followRedirects = false
+            ..headers['Accept'] = 'application/json';
+      if (credential != null) {
+        request.headers['X-BB-Session-Credential'] = credential;
+      }
+      if (body != null) {
+        request.headers['Content-Type'] = 'application/json';
+        request.headers['Origin'] = origin.toString();
+        request.body = jsonEncode(body);
+        if (signingKey != null) {
+          request.headers['Authorization'] = buildNip98AuthHeader(
+            method: 'POST',
+            url: request.url.toString(),
+            bodyBytes: request.bodyBytes,
+            nsec: signingKey,
+          );
+        }
+      }
+      final response = await boundedHttpResponse(_http, request);
+      if (kDebugMode && response.statusCode >= 400) {
+        debugPrint(
+          'Builderlab ${origin.host} ${request.method} $path: HTTP ${response.statusCode} contentType=${response.headers['content-type']?.split(';').first}',
+        );
+      }
+      if (response.statusCode == 401) throw AccountFailure.signedOut;
+      if (response.statusCode == 403) throw AccountFailure.denied;
+      if (const {400, 404, 409, 422}.contains(response.statusCode)) {
+        throw AccountFailure.rejected;
+      }
+      if (response.statusCode < 200 || response.statusCode >= 300) {
+        throw AccountFailure.unavailable;
+      }
+      final value = jsonDecode(utf8.decode(response.bodyBytes));
+      if (value is! Map<String, dynamic>) throw AccountFailure.invalidResponse;
+      return value;
+    } on AccountFailure {
+      rethrow;
+    } on FormatException {
+      throw AccountFailure.invalidResponse;
+    } catch (_) {
+      throw AccountFailure.unavailable;
+    }
+  }
+
+  void dispose() {
+    _disposed = true;
+    _credential = null;
+    _account = null;
+    _http.close();
+  }
+}
diff --git a/mobile/lib/shared/hosted/community_entry_requirements.dart b/mobile/lib/shared/hosted/community_entry_requirements.dart
new file mode 100644
index 0000000000..cdac4b3033
--- /dev/null
+++ b/mobile/lib/shared/hosted/community_entry_requirements.dart
@@ -0,0 +1,68 @@
+import '../community/community.dart';
+import 'account_identity_store.dart';
+import 'builderlab_account.dart';
+import 'hosted_environment.dart';
+
+/// The same hosted requirements apply to every new community, regardless of
+/// whether its credentials came from an invite, key import, or verified pairing.
+abstract final class CommunityEntryRequirements {
+  /// Nostr-only entry cannot bypass a configured account requirement.
+  static void requireSelfHosted(String relayUrl) {
+    if (HostedEnvironment.requiresAuth(Uri.parse(relayUrl).host)) {
+      throw StateError(
+        'This community requires Builderlab sign-in and identity '
+        'backup. Open its link through community setup.',
+      );
+    }
+  }
+
+  static Future<void> verify(
+    Community community,
+    BuilderlabAccountClient account,
+  ) async {
+    final uri = Uri.parse(community.relayUrl);
+    if (!HostedEnvironment.requiresAuth(uri.host)) return;
+    if (!HostedEnvironment.supportsRelay(uri)) throw AccountFailure.denied;
+    {
+      final session = account.account ?? await account.restore();
+      if (session == null) throw AccountFailure.signedOut;
+      final nsec = community.nsec;
+      if (nsec == null) throw AccountIdentityFailure.absent;
+      final pubkey = AccountIdentityStore.publicKeyForNsec(nsec);
+      if (community.pubkey != pubkey) throw AccountIdentityFailure.mismatch;
+      await verifyHostedIdentity(
+        account: account,
+        store: AccountIdentityStore(),
+        subject: session.subject,
+        pubkey: pubkey,
+      );
+    }
+  }
+
+  static Future<void> verifyHostedIdentity({
+    required BuilderlabAccountClient account,
+    required AccountIdentityStore store,
+    required String subject,
+    required String pubkey,
+  }) async {
+    if (account.account?.subject != subject) {
+      throw AccountFailure.differentAccount;
+    }
+    final snapshot = await store.forSubject(subject).read();
+    if (snapshot?.pubkey != pubkey ||
+        !snapshot!.hasBackupFor(
+          backend: HostedEnvironment.origin.origin,
+          subject: subject,
+        )) {
+      throw AccountFailure.denied;
+    }
+    final binding = await account.currentIdentity();
+    if (account.account?.subject != subject) {
+      throw AccountFailure.differentAccount;
+    }
+    final identity = binding['identity'];
+    if (identity is! Map || identity['pubkey_hex'] != pubkey) {
+      throw AccountFailure.denied;
+    }
+  }
+}
diff --git a/mobile/lib/shared/hosted/device_identity_source.dart b/mobile/lib/shared/hosted/device_identity_source.dart
new file mode 100644
index 0000000000..aef15e53a0
--- /dev/null
+++ b/mobile/lib/shared/hosted/device_identity_source.dart
@@ -0,0 +1,94 @@
+import 'dart:convert';
+
+import 'package:flutter_secure_storage/flutter_secure_storage.dart';
+
+import '../storage/secure_storage.dart';
+
+import 'account_identity_store.dart';
+
+/// Public identity choices; never contains private signing material.
+class DeviceIdentityChoice {
+  const DeviceIdentityChoice(this.pubkey, this.label, {this.fromCloud = false});
+  final String pubkey;
+  final String label;
+  final bool fromCloud;
+}
+
+/// Read-only inventory, including legacy records hidden by a newer community list.
+/// Do not call CommunityStorage.loadAll here: it migrates and deletes records.
+class DeviceIdentitySource {
+  DeviceIdentitySource({FlutterSecureStorage? storage})
+    : _storage = storage ?? communitySecureStorage;
+  final FlutterSecureStorage _storage;
+
+  Future<List<DeviceIdentityChoice>> choices() async => [
+    for (final entry in (await _read()).entries)
+      DeviceIdentityChoice(entry.key, entry.value.label),
+  ];
+
+  /// Reread and validate the chosen key immediately before create-only adoption.
+  Future<AccountIdentitySnapshot> adopt(
+    String pubkey,
+    AccountIdentityStore store, {
+    required void Function() checkCurrent,
+  }) async {
+    final candidate = (await _read())[pubkey];
+    if (candidate == null) throw AccountIdentityFailure.absent;
+    checkCurrent();
+    return store.create(candidate.nsec, checkCurrent: checkCurrent);
+  }
+
+  /// Supplies a freshly validated saved identity only to an admission service.
+  Future<T> withIdentity<T>(
+    String pubkey,
+    Future<T> Function(String nsec) operation,
+  ) async {
+    final candidate = (await _read())[pubkey];
+    if (candidate == null) throw AccountIdentityFailure.absent;
+    return operation(candidate.nsec);
+  }
+
+  Future<Map<String, ({String nsec, String label})>> _read() async {
+    try {
+      final result = <String, ({String nsec, String label})>{};
+      final labels = <String, Set<String>>{};
+      void add(dynamic nsec, dynamic advertised, String label) {
+        if (nsec == null) {
+          // Token-only legacy communities legitimately have no private key.
+          return;
+        }
+        if (nsec is! String) throw AccountIdentityFailure.unreadable;
+        final pubkey = AccountIdentityStore.publicKeyForNsec(nsec);
+        if (advertised != null && advertised != pubkey) {
+          throw AccountIdentityFailure.unreadable;
+        }
+        final names = labels.putIfAbsent(pubkey, () => <String>{})..add(label);
+        result[pubkey] = (nsec: nsec, label: names.join(', '));
+      }
+
+      for (final key in ['buzz_communities', 'buzz_workspaces']) {
+        final raw = await _storage.read(key: key);
+        if (raw == null) continue;
+        final records = jsonDecode(raw) as List;
+        for (final record in records) {
+          final value = record as Map<String, dynamic>;
+          add(
+            value['nsec'],
+            value['pubkey'],
+            (value['name'] as String?)?.trim().isNotEmpty == true
+                ? (value['name'] as String).trim()
+                : 'Saved community',
+          );
+        }
+      }
+      add(
+        await _storage.read(key: 'buzz_nsec'),
+        await _storage.read(key: 'buzz_pubkey'),
+        'Previous device identity',
+      );
+      return result;
+    } catch (_) {
+      throw AccountIdentityFailure.unreadable;
+    }
+  }
+}
diff --git a/mobile/lib/shared/hosted/hosted_admission.dart b/mobile/lib/shared/hosted/hosted_admission.dart
new file mode 100644
index 0000000000..fa7e75a591
--- /dev/null
+++ b/mobile/lib/shared/hosted/hosted_admission.dart
@@ -0,0 +1,170 @@
+import 'dart:convert';
+
+import 'package:http/http.dart' as http;
+
+import '../community/community.dart';
+import '../deeplink/deep_link.dart';
+import '../relay/relay_session.dart';
+import '../relay/relay_socket.dart';
+import 'account_identity_store.dart';
+import 'builderlab_account.dart';
+import 'community_entry_requirements.dart';
+import 'hosted_environment.dart';
+import 'hosted_communities.dart';
+import 'hosted_join_policy.dart';
+import 'hosted_relay_auth.dart';
+import '../relay/relay_provider.dart';
+
+/// Builds a community only after scoped backup evidence and current binding.
+/// The caller persists it through the existing community transition owner.
+class HostedAdmission {
+  HostedAdmission({
+    required this.account,
+    required this.store,
+    http.Client? client,
+    required this.relayAuth,
+    Future<bool> Function(HostedJoinPolicy)? confirmPolicy,
+    Future<void> Function(Community)? probe,
+  }) : _confirmPolicy = confirmPolicy ?? ((_) async => false),
+       _http = client ?? http.Client(),
+       _probe = probe;
+  final HostedRelayAuth relayAuth;
+  final BuilderlabAccountClient account;
+  final AccountIdentityStore store;
+  final http.Client _http;
+  final Future<bool> Function(HostedJoinPolicy) _confirmPolicy;
+  final Future<void> Function(Community)? _probe;
+
+  Future<Community> prepare(
+    BuzzDeepLink link,
+    String subject,
+    String pubkey, {
+    bool Function()? isCurrent,
+  }) async {
+    void checkCurrent() {
+      if (isCurrent != null && !isCurrent()) throw AccountFailure.unavailable;
+      if (account.account?.subject != subject) {
+        throw AccountFailure.differentAccount;
+      }
+    }
+
+    final store = this.store.forSubject(subject);
+    checkCurrent();
+    final relay = link.relayUrl ?? (throw AccountFailure.invalidResponse);
+    final uri = Uri.parse(relay);
+    if (uri.scheme != 'wss' ||
+        uri.userInfo.isNotEmpty ||
+        uri.hasQuery ||
+        uri.hasFragment ||
+        (uri.path.isNotEmpty && uri.path != '/') ||
+        !HostedEnvironment.supportsRelay(uri) ||
+        (uri.hasPort && uri.port != 443)) {
+      throw AccountFailure.denied;
+    }
+    if (account.account?.subject != subject) {
+      throw AccountFailure.differentAccount;
+    }
+    await CommunityEntryRequirements.verifyHostedIdentity(
+      account: account,
+      store: store,
+      subject: subject,
+      pubkey: pubkey,
+    );
+    checkCurrent();
+    if (link is InviteDeepLink) {
+      try {
+        final receipt = await freshJoinPolicyReceipt(
+          client: _http,
+          origin: uri,
+          code: link.code,
+          confirm: _confirmPolicy,
+          checkCurrent: checkCurrent,
+        );
+        final body = jsonEncode({
+          'code': link.code,
+          'policy_receipt': ?receipt,
+        });
+        final url = uri.replace(scheme: 'https', path: '/api/invites/claim');
+        final headers = await store.withKeys(
+          (keys) async => {
+            ...await relayAuth.headers(
+              RelayConfig(baseUrl: relay, nsec: keys.nsec),
+            ),
+            'Authorization': buildNip98AuthHeader(
+              method: 'POST',
+              url: url.toString(),
+              bodyBytes: utf8.encode(body),
+              nsec: keys.nsec,
+            ),
+            'Content-Type': 'application/json',
+          },
+        );
+        checkCurrent();
+        final request = http.Request('POST', url)
+          ..followRedirects = false
+          ..headers.addAll(headers)
+          ..body = body;
+        await readJoinResponse(_http, request);
+        checkCurrent();
+      } on HostedInviteFailure catch (failure) {
+        if (failure == HostedInviteFailure.policyRequired) rethrow;
+        checkCurrent();
+        // A lost claim response may outlive its code. AUTH alone also admits
+        // non-members on open relays; reconcile explicit membership first.
+        final List<AddCommunityDeepLink> joined;
+        try {
+          joined = await loadHostedCommunities(account);
+        } on AccountFailure catch (discoveryFailure) {
+          if (discoveryFailure == AccountFailure.rejected ||
+              discoveryFailure == AccountFailure.invalidResponse) {
+            throw failure;
+          }
+          rethrow;
+        }
+        checkCurrent();
+        if (!joined.any(
+          (entry) => Uri.parse(entry.relayUrl).host == uri.host,
+        )) {
+          rethrow;
+        }
+      }
+    }
+    if (account.account?.subject != subject) {
+      throw AccountFailure.differentAccount;
+    }
+    final community = await store.withKeys((keys) async {
+      if (keys.public != pubkey) throw AccountIdentityFailure.mismatch;
+      return Community.create(
+        name: link is AddCommunityDeepLink ? link.name : uri.host,
+        relayUrl: relay,
+        pubkey: pubkey,
+        nsec: keys.nsec,
+      );
+    });
+    checkCurrent();
+    await (_probe ?? _authenticateRelay)(community);
+    checkCurrent();
+    return community;
+  }
+
+  Future<void> _authenticateRelay(Community community) async {
+    final socket = RelaySocket(
+      wsUrl: community.relayUrl,
+      nsec: community.nsec,
+      onMessage: (_) {},
+      onConnected: () {},
+      onDisconnected: (_) {},
+    );
+    try {
+      socket.headers = await relayAuth.headers(
+        RelayConfig(baseUrl: community.relayUrl, nsec: community.nsec),
+      );
+      await socket.connect().timeout(const Duration(seconds: 30));
+      if (socket.state != SocketState.connected) throw AccountFailure.denied;
+    } finally {
+      socket.dispose();
+    }
+  }
+
+  void dispose() => _http.close();
+}
diff --git a/mobile/lib/shared/hosted/hosted_backup_service.dart b/mobile/lib/shared/hosted/hosted_backup_service.dart
new file mode 100644
index 0000000000..29fc41b528
--- /dev/null
+++ b/mobile/lib/shared/hosted/hosted_backup_service.dart
@@ -0,0 +1,170 @@
+import '../storage/serial_queue.dart';
+import 'dart:async';
+import 'dart:convert';
+
+import 'package:crypto/crypto.dart';
+import 'package:flutter_secure_storage/flutter_secure_storage.dart';
+
+import '../storage/secure_storage.dart';
+
+import 'account_identity_store.dart';
+import 'builderlab_account.dart';
+import 'hosted_environment.dart';
+import 'hpke_backup.dart';
+
+enum HostedBackupFailure {
+  identityMismatch,
+  storage,
+  invalidResponse,
+  rejected,
+  unavailable,
+}
+
+/// A pending ciphertext is durable before its first upload. Uncertain uploads
+/// replay that same envelope; only confirmed storage produces an admission receipt.
+class HostedBackupService {
+  HostedBackupService(
+    this.account,
+    this.identity, {
+    HpkeBackup? hpke,
+    FlutterSecureStorage? storage,
+  }) : _hpke = hpke ?? HpkeBackup(),
+       _storage = storage ?? accountSecureStorage;
+
+  final BuilderlabAccountClient account;
+  final AccountIdentityStore identity;
+  final HpkeBackup _hpke;
+  final FlutterSecureStorage _storage;
+  static final _queue = SerialQueue();
+  static String pendingKey(String subject, String pubkey) =>
+      'buzz_backup_pending_v2_${sha256.convert(utf8.encode(jsonEncode([HostedEnvironment.origin.origin, subject, pubkey])))}';
+
+  Future<void> backup({bool Function()? isCurrent}) {
+    final result = _queue.run(() => _backup(isCurrent: isCurrent));
+    return result;
+  }
+
+  Future<void> _backup({
+    bool reenrolled = false,
+    bool Function()? isCurrent,
+  }) async {
+    void checkCurrent() {
+      if (isCurrent != null && !isCurrent()) throw AccountFailure.unavailable;
+    }
+
+    checkCurrent();
+    final subject = account.account?.subject;
+    final local = await identity.read();
+    if (subject == null || local == null) {
+      throw HostedBackupFailure.identityMismatch;
+    }
+    final backend = HostedEnvironment.origin.origin;
+    final key = pendingKey(subject, local.pubkey);
+    if (local.hasBackupFor(backend: backend, subject: subject)) return;
+    void checkAccount() {
+      if (account.account?.subject != subject) {
+        throw HostedBackupFailure.identityMismatch;
+      }
+    }
+
+    Map<String, dynamic>? envelope;
+    try {
+      final raw = await _storage.read(key: key);
+      if (raw != null) {
+        final record = jsonDecode(raw) as Map<String, dynamic>;
+        if (record['backend'] != backend ||
+            record['subject'] != subject ||
+            record['pubkey'] != local.pubkey) {
+          throw HostedBackupFailure.identityMismatch;
+        }
+        envelope = Map<String, dynamic>.from(record['envelope'] as Map);
+        HpkeBackup.associatedData(envelope);
+        if (envelope['nostr_pubkey'] != local.pubkey) {
+          throw HostedBackupFailure.identityMismatch;
+        }
+      }
+    } on HostedBackupFailure {
+      rethrow;
+    } catch (_) {
+      throw HostedBackupFailure.storage;
+    }
+    checkAccount();
+    checkCurrent();
+    if (envelope == null) {
+      final Map<String, dynamic> enrollment;
+      try {
+        enrollment = await account.post('/v1/buzz/nsec-backups/enrollment', {});
+      } on AccountFailure catch (failure) {
+        if (failure == AccountFailure.rejected) {
+          throw HostedBackupFailure.unavailable;
+        }
+        rethrow;
+      }
+      checkAccount();
+      if (enrollment['nostr_pubkey'] != local.pubkey) {
+        throw HostedBackupFailure.identityMismatch;
+      }
+      envelope = await identity.withKeys(
+        (keys) => _hpke.seal(enrollment: enrollment, secretHex: keys.secret),
+      );
+      checkAccount();
+      final raw = jsonEncode({
+        'backend': backend,
+        'subject': subject,
+        'pubkey': local.pubkey,
+        'envelope': envelope,
+      });
+      try {
+        await _storage.write(key: key, value: raw);
+        if (await _storage.read(key: key) != raw) {
+          throw HostedBackupFailure.storage;
+        }
+      } catch (_) {
+        throw HostedBackupFailure.storage;
+      }
+    }
+    checkAccount();
+    checkCurrent();
+    final pending = envelope!;
+    final Map<String, dynamic> result;
+    try {
+      result = await account.post('/v1/buzz/nsec-backups', pending);
+    } on AccountFailure catch (failure) {
+      if (failure != AccountFailure.rejected) rethrow;
+      checkAccount();
+      checkCurrent();
+      // Only a definitive rejection permits replacing the pending envelope.
+      // A timeout/5xx/unknown response always preserves it for exact replay.
+      if (reenrolled) throw HostedBackupFailure.rejected;
+      try {
+        await _storage.delete(key: key);
+        if (await _storage.read(key: key) != null) {
+          throw HostedBackupFailure.storage;
+        }
+      } catch (_) {
+        throw HostedBackupFailure.storage;
+      }
+      return _backup(reenrolled: true, isCurrent: isCurrent);
+    }
+    checkAccount();
+    if (result['stored'] != true ||
+        result['backup_id'] != pending['backup_id']) {
+      throw HostedBackupFailure.invalidResponse;
+    }
+    await identity.confirmBackup(
+      BackupReceipt(
+        backend: backend,
+        subject: subject,
+        pubkey: local.pubkey,
+        backupId: pending['backup_id'] as String,
+      ),
+    );
+    // Receipt is authoritative after this point; a failed cleanup cannot cause
+    // another enrollment/upload on restart.
+    try {
+      await _storage.delete(key: key);
+    } catch (_) {
+      /* Retry is unnecessary once the receipt is durable. */
+    }
+  }
+}
diff --git a/mobile/lib/shared/hosted/hosted_communities.dart b/mobile/lib/shared/hosted/hosted_communities.dart
new file mode 100644
index 0000000000..daa9c257a4
--- /dev/null
+++ b/mobile/lib/shared/hosted/hosted_communities.dart
@@ -0,0 +1,51 @@
+import '../deeplink/deep_link.dart';
+import 'builderlab_account.dart';
+import 'hosted_environment.dart';
+
+/// Validated, active communities joined by the signed-in Builderlab identity.
+/// Discovery never grants admission; each target still goes through HostedAdmission.
+Future<List<AddCommunityDeepLink>> loadHostedCommunities(
+  BuilderlabAccountClient account,
+) async {
+  final response = await account.post('/v1/buzz/communities/joined', {});
+  final rows = response['communities'];
+  if (response['error'] != null || rows is! List) {
+    throw AccountFailure.invalidResponse;
+  }
+  final communities = <String, AddCommunityDeepLink>{};
+  for (final row in rows) {
+    if (row is! Map<String, dynamic>) throw AccountFailure.invalidResponse;
+    final archived = row['archived_at'];
+    if (archived != null) {
+      if (archived is! String || archived.isEmpty) {
+        throw AccountFailure.invalidResponse;
+      }
+      continue;
+    }
+    final host = row['normalized_host'];
+    final name = row['name'];
+    if (host is! String || name is! String || name.trim().isEmpty) {
+      throw AccountFailure.invalidResponse;
+    }
+    final relay = Uri.tryParse(host.contains('://') ? host : 'wss://$host');
+    if (relay == null ||
+        relay.scheme != 'wss' ||
+        !RegExp(r'^[a-z0-9]+(?:[.-][a-z0-9]+)*$').hasMatch(relay.host) ||
+        relay.userInfo.isNotEmpty ||
+        relay.hasQuery ||
+        relay.hasFragment ||
+        (relay.path.isNotEmpty && relay.path != '/') ||
+        (relay.hasPort && relay.port != 443)) {
+      throw AccountFailure.invalidResponse;
+    }
+    // A hosted listing can contain communities this build cannot enter.
+    // Never redirect the account session or discard otherwise usable entries.
+    if (!HostedEnvironment.supportsRelay(relay)) continue;
+    final canonical = Uri(scheme: 'wss', host: relay.host);
+    communities.putIfAbsent(
+      canonical.host,
+      () => AddCommunityDeepLink(relayUrl: canonical.toString(), name: name),
+    );
+  }
+  return List.unmodifiable(communities.values);
+}
diff --git a/mobile/lib/shared/hosted/hosted_community_connection.dart b/mobile/lib/shared/hosted/hosted_community_connection.dart
new file mode 100644
index 0000000000..e61fdf793b
--- /dev/null
+++ b/mobile/lib/shared/hosted/hosted_community_connection.dart
@@ -0,0 +1,65 @@
+import '../community/community.dart';
+import '../community/community_storage.dart';
+import '../deeplink/deep_link.dart';
+import 'builderlab_account.dart';
+import 'hosted_admission.dart';
+
+/// A saved community uses another identity. Only explicit skip/leave is safe.
+class SavedCommunityIdentityConflict implements Exception {
+  const SavedCommunityIdentityConflict();
+}
+
+/// Canonical community identity shared by discovery and deep-link entry.
+({bool secure, String host, int port}) relayIdentity(String value) {
+  final uri = Uri.parse(value);
+  final secure = uri.scheme == 'wss' || uri.scheme == 'https';
+  return (
+    secure: secure,
+    host: uri.host.toLowerCase(),
+    port: uri.hasPort ? uri.port : (secure ? 443 : 80),
+  );
+}
+
+/// Reuses existing records and their ids before the normal admission/persistence
+/// boundary. A different existing key is never replaced.
+Future<void> connectHostedCommunity({
+  required BuzzDeepLink link,
+  required String subject,
+  required String pubkey,
+  required bool Function() isCurrent,
+  required CommunityStorage storage,
+  required HostedAdmission admission,
+  required Future<void> Function(Community, bool Function()) persist,
+  required Future<void> Function(Community, bool Function())
+  recoverStarterChannels,
+}) async {
+  final relay = link.relayUrl ?? (throw AccountFailure.invalidResponse);
+  final communities = await storage.loadAll();
+  final existing = communities
+      .where((item) => relayIdentity(item.relayUrl) == relayIdentity(relay))
+      .firstOrNull;
+  if (existing != null && existing.pubkey != pubkey) {
+    throw const SavedCommunityIdentityConflict();
+  }
+  if (!isCurrent()) return;
+  // Saved membership survives a partially completed invite setup. Revalidate
+  // identity and probe the relay, but never reclaim its consumed invite.
+  final admissionLink = existing != null && link is InviteDeepLink
+      ? AddCommunityDeepLink(relayUrl: relay, name: existing.name)
+      : link;
+  final prepared = await admission.prepare(
+    admissionLink,
+    subject,
+    pubkey,
+    isCurrent: isCurrent,
+  );
+  final community = existing == null
+      ? prepared.copyWith(starterSetupIncomplete: link is InviteDeepLink)
+      : existing.copyWith(nsec: prepared.nsec);
+  if (!isCurrent()) return;
+  await persist(community, isCurrent);
+  if (!isCurrent()) return;
+  if (community.starterSetupIncomplete) {
+    await recoverStarterChannels(community, isCurrent);
+  }
+}
diff --git a/mobile/lib/shared/hosted/hosted_community_creation.dart b/mobile/lib/shared/hosted/hosted_community_creation.dart
new file mode 100644
index 0000000000..3c64ce7092
--- /dev/null
+++ b/mobile/lib/shared/hosted/hosted_community_creation.dart
@@ -0,0 +1,62 @@
+import '../deeplink/deep_link.dart';
+import 'builderlab_account.dart';
+import 'hosted_environment.dart';
+
+enum HostedCreationFailure { rejected }
+
+/// Internal setup intent; no external deep link can request provisioning.
+class HostedCreateCommunity extends AddCommunityDeepLink {
+  HostedCreateCommunity(String name)
+    : super(
+        name: name,
+        relayUrl: 'wss://$name.${HostedEnvironment.communitySuffix}',
+      ) {
+    if (!validName(name)) throw ArgumentError.value(name, 'name');
+  }
+
+  static bool validName(String name) =>
+      name.length <= 63 && RegExp(r'^[a-z0-9]+(?:-[a-z0-9]+)*$').hasMatch(name);
+
+  /// The server reconciles the same owner/name on replay, including a lost
+  /// response. Keep the name stable and validate ownership before admission.
+  Future<AddCommunityDeepLink> provision(
+    BuilderlabAccountClient account,
+    String pubkey,
+    bool Function() isCurrent,
+  ) async {
+    final subject = account.account?.subject;
+    void check() {
+      if (!isCurrent() ||
+          subject == null ||
+          account.account?.subject != subject) {
+        throw AccountFailure.unavailable;
+      }
+    }
+
+    check();
+    final Map<String, dynamic> response;
+    try {
+      response = await account.post('/v1/buzz/communities', {'name': name});
+    } on AccountFailure catch (failure) {
+      check();
+      if (failure == AccountFailure.rejected) {
+        throw HostedCreationFailure.rejected;
+      }
+      rethrow;
+    }
+    check();
+    if (response['error'] != null) throw AccountFailure.invalidResponse;
+    return _validate(response['community'], pubkey);
+  }
+
+  AddCommunityDeepLink _validate(dynamic row, String pubkey) {
+    if (row is! Map<String, dynamic> ||
+        row['normalized_host'] != Uri.parse(relayUrl).host ||
+        row['owner_pubkey'] != pubkey ||
+        row['name'] != name) {
+      throw AccountFailure.invalidResponse;
+    }
+    if (row['archived_at'] != null) throw HostedCreationFailure.rejected;
+    return AddCommunityDeepLink(relayUrl: relayUrl, name: name);
+  }
+}
diff --git a/mobile/lib/shared/hosted/hosted_environment.dart b/mobile/lib/shared/hosted/hosted_environment.dart
new file mode 100644
index 0000000000..a3ca701e53
--- /dev/null
+++ b/mobile/lib/shared/hosted/hosted_environment.dart
@@ -0,0 +1,83 @@
+/// Trusted build configuration, never supplied by a deep link or relay.
+abstract final class HostedEnvironment {
+  /// Account UI and startup work are opt-in, independently of the backend URL.
+  static bool get enabled => authDomains.isNotEmpty;
+
+  static final Uri origin = _origin();
+  static const _communityAccounts = {
+    'communities.buzz.xyz': 'https://app.builderlab.xyz',
+    'communities.public.builderlabstaging.xyz':
+        'https://app.builderlabstaging.xyz',
+  };
+
+  /// Creation and admission use the same trusted build-specific host mapping.
+  static String get communitySuffix => _communityAccounts.entries
+      .singleWhere((entry) => Uri.parse(entry.value) == origin)
+      .key;
+
+  /// Comma-separated DNS domains requiring Builderlab authentication.
+  /// Empty builds keep Nostr-only entry available, including hosted QR pairing.
+  static final List<String> authDomains = List.unmodifiable(
+    const String.fromEnvironment('BUZZ_AUTH_DOMAINS')
+        .split(',')
+        .map(
+          (domain) =>
+              domain.trim().toLowerCase().replaceFirst(RegExp(r'\.+$'), ''),
+        )
+        .where((domain) => domain.isNotEmpty)
+        .map((domain) {
+          if (!RegExp(
+            r'^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)*$',
+          ).hasMatch(domain)) {
+            throw StateError(
+              'BUZZ_AUTH_DOMAINS must contain DNS names, not URLs or wildcards',
+            );
+          }
+          return domain;
+        }),
+  );
+
+  /// Matches a configured domain and its subdomains, never a string suffix.
+  static bool requiresAuth(String host) {
+    final normalized = host.toLowerCase().replaceFirst(RegExp(r'\.+$'), '');
+    return authDomains.any(
+      (domain) => normalized == domain || normalized.endsWith('.$domain'),
+    );
+  }
+
+  /// Explicit community-to-account mapping. Never infer an account endpoint
+  /// from arbitrary relay metadata or send this build's session across realms.
+  static Uri? accountOriginFor(Uri relay) {
+    if (!['wss', 'https'].contains(relay.scheme) ||
+        relay.userInfo.isNotEmpty ||
+        relay.hasQuery ||
+        relay.hasFragment ||
+        (relay.path.isNotEmpty && relay.path != '/') ||
+        (relay.hasPort && relay.port != 443)) {
+      return null;
+    }
+    final host = relay.host.toLowerCase();
+    for (final entry in _communityAccounts.entries) {
+      if (host.endsWith('.${entry.key}')) return Uri.parse(entry.value);
+    }
+    return null;
+  }
+
+  /// Whether this build can use its account session for this relay.
+  static bool supportsRelay(Uri relay) => accountOriginFor(relay) == origin;
+
+  static Uri _origin() {
+    const configured = String.fromEnvironment(
+      'BUZZ_BUILDERLAB_URL',
+      defaultValue: 'https://app.builderlab.xyz',
+    );
+    final uri = Uri.parse(configured);
+    if (!{
+      'https://app.builderlab.xyz',
+      'https://app.builderlabstaging.xyz',
+    }.contains(configured)) {
+      throw StateError('Unsupported hosted account environment');
+    }
+    return uri;
+  }
+}
diff --git a/mobile/lib/shared/hosted/hosted_flow.dart b/mobile/lib/shared/hosted/hosted_flow.dart
new file mode 100644
index 0000000000..e57affb470
--- /dev/null
+++ b/mobile/lib/shared/hosted/hosted_flow.dart
@@ -0,0 +1,852 @@
+import '../storage/serial_queue.dart';
+import 'dart:async';
+
+import 'package:flutter/foundation.dart';
+import 'package:url_launcher/url_launcher.dart';
+
+import '../deeplink/deep_link.dart';
+import '../community/community.dart';
+import 'account_identity_store.dart';
+import 'device_identity_source.dart';
+import 'browser_auth.dart';
+import 'builderlab_account.dart';
+import 'hosted_identity_service.dart';
+import 'hosted_backup_service.dart';
+import 'hpke_backup.dart';
+import 'hosted_environment.dart';
+import 'hosted_communities.dart';
+import 'hosted_community_creation.dart';
+import 'hosted_community_connection.dart';
+import 'web_connect_binding.dart';
+import 'hosted_join_policy.dart';
+
+enum HostedFlowStage {
+  idle,
+  working,
+  signIn,
+  chooseIdentity,
+  chooseCommunities,
+  communityConflict,
+  acceptPolicy,
+  profile,
+  blocked,
+  browserReturned,
+  complete,
+}
+
+enum HostedFlowProblem {
+  retry,
+  denied,
+  accountSetupRequired,
+  differentAccount,
+  identityUnreadable,
+  backupUnavailable,
+  invalidResponse,
+  requestRejected,
+  identityMismatch,
+  identityUnavailable,
+  backupRequired,
+  bindingRequired,
+  unsupportedEnvironment,
+  invitePolicyRequired,
+  inviteExpired,
+  inviteExhausted,
+  inviteInvalid,
+  communityCreationRejected,
+}
+
+/// Resolves only after relay admission is proven and local persistence completes.
+/// Implementations must check [isCurrent] immediately before durable mutations.
+typedef HostedCommunityAdmission =
+    Future<void> Function(
+      BuzzDeepLink target,
+      String subject,
+      String pubkey,
+      bool Function() isCurrent,
+    );
+
+/// App-scoped owner: callback subscriptions must outlive any individual page.
+/// Only public progress reaches widgets; pending auth secrets remain in BrowserAuth.
+class HostedFlow extends ChangeNotifier {
+  HostedFlow({
+    required this.account,
+    required this.browser,
+    required this.store,
+    required this.identity,
+    required this.enterCommunity,
+    Future<bool> Function(Uri)? openWeb,
+  }) : _openWeb =
+           openWeb ??
+           ((uri) => launchUrl(uri, mode: LaunchMode.externalApplication));
+  final BuilderlabAccountClient account;
+  final BrowserAuth browser;
+  final AccountIdentityStore store;
+  final HostedIdentityService identity;
+  final HostedCommunityAdmission enterCommunity;
+  bool get canRetry =>
+      problem == null ||
+      problem == HostedFlowProblem.retry ||
+      problem == HostedFlowProblem.invitePolicyRequired;
+  final Future<bool> Function(Uri) _openWeb;
+  HostedFlowStage stage = HostedFlowStage.idle;
+  HostedFlowProblem? problem;
+  List<DeviceIdentityChoice> identityChoices = const [];
+  BuzzDeepLink? _target;
+  bool accountOnly = false;
+  String? _pairedPubkey;
+  SensitiveActionPolicy? pairedSensitiveActionPolicy;
+  List<AddCommunityDeepLink> communities = const [];
+  Set<String> selectedRelays = const {};
+  final Set<String> _addedRelays = {};
+  bool _addingCommunities = false;
+  String? _batchSubject;
+  String? _conflictingRelay;
+  bool get canChangeCommunities =>
+      accountOnly &&
+      account.account?.subject == _batchSubject &&
+      (stage == HostedFlowStage.blocked ||
+          stage == HostedFlowStage.communityConflict) &&
+      communities.isNotEmpty;
+  String? addingCommunityName;
+  int get addedCommunityCount => _addedRelays.length;
+  final _queue = SerialQueue();
+  StreamSubscription<BrowserAuthCode>? _codes;
+  StreamSubscription<BrowserAuthFailure>? _failures;
+  bool _disposed = false;
+  int _generation = 0;
+
+  int _nextGeneration() {
+    _cancelPolicy();
+    _cancelProfile();
+    return ++_generation;
+  }
+
+  Completer<void>? _profileCompletion;
+  Future<void> Function(String)? saveProfile;
+
+  Future<void> requestProfile(Future<void> Function(String) save) async {
+    if (_disposed) return;
+    final completion = Completer<void>();
+    _profileCompletion = completion;
+    saveProfile = (name) async {
+      if (!identical(_profileCompletion, completion) ||
+          completion.isCompleted) {
+        throw AccountFailure.unavailable;
+      }
+      await save(name);
+      if (identical(_profileCompletion, completion)) finishProfile();
+    };
+    _set(HostedFlowStage.profile);
+    await completion.future;
+    if (identical(_profileCompletion, completion)) {
+      _profileCompletion = null;
+      saveProfile = null;
+      _set(HostedFlowStage.working);
+    }
+  }
+
+  void finishProfile() {
+    final completion = _profileCompletion;
+    if (completion != null && !completion.isCompleted) completion.complete();
+  }
+
+  void _cancelProfile() {
+    final completion = _profileCompletion;
+    _profileCompletion = null;
+    saveProfile = null;
+    if (completion != null && !completion.isCompleted) completion.complete();
+  }
+
+  HostedJoinPolicy? joinPolicy;
+  Completer<bool>? _policyConsent;
+
+  Future<bool> confirmJoinPolicy(HostedJoinPolicy policy) async {
+    if (_disposed) return false;
+    joinPolicy = policy;
+    final consent = Completer<bool>();
+    _policyConsent = consent;
+    _set(HostedFlowStage.acceptPolicy);
+    final accepted = await consent.future;
+    if (identical(_policyConsent, consent)) {
+      _policyConsent = null;
+      joinPolicy = null;
+      if (accepted) _set(HostedFlowStage.working);
+    }
+    return accepted;
+  }
+
+  void acceptJoinPolicy() {
+    final consent = _policyConsent;
+    if (consent != null && !consent.isCompleted) consent.complete(true);
+  }
+
+  void _cancelPolicy() {
+    final consent = _policyConsent;
+    _policyConsent = null;
+    joinPolicy = null;
+    if (consent != null && !consent.isCompleted) consent.complete(false);
+  }
+
+  bool reconnecting = false;
+
+  Future<void>? _initialization;
+  Future<void> initialize() => _initialization ??= _initialize();
+
+  Future<void> _initialize() async {
+    if (_codes != null) return;
+    _codes = browser.codes.listen((code) {
+      final generation = _generation;
+      _enqueue(() async {
+        reconnecting = code.intent['type'] == 'reconnect';
+        accountOnly = reconnecting || code.intent['type'] == 'account';
+        if (accountOnly) {
+          _target = null;
+        } else {
+          _restorePairing(code.intent);
+          _target = _decode(code.intent);
+          if (_target == null) throw BrowserAuthFailure.restartLogin;
+        }
+        _set(HostedFlowStage.working);
+        await account.exchange(code: code.code, verifier: code.verifier);
+        if (_disposed || generation != _generation) return;
+        if (reconnecting) {
+          await browser.clearIntent();
+          if (_disposed || generation != _generation) return;
+          _set(HostedFlowStage.complete);
+          reconnecting = false;
+        } else {
+          await _continue(generation);
+        }
+      });
+    });
+    _failures = browser.failures.listen((failure) {
+      if (_disposed) return;
+      if (!accountOnly && _target == null) {
+        if (_generation == 0) {
+          _set(HostedFlowStage.blocked, HostedFlowProblem.retry);
+        }
+        return;
+      }
+      if (stage != HostedFlowStage.signIn) return;
+      if (failure == BrowserAuthFailure.cancelled) {
+        unawaited(leave());
+      } else {
+        _set(HostedFlowStage.blocked, HostedFlowProblem.retry);
+      }
+    });
+    await _enqueue(() async {
+      final generation = _generation;
+      await browser.initialize();
+      if (_disposed || generation != _generation) return;
+      if (_target == null) {
+        final retained = await browser.retainedIntent();
+        if (_disposed || generation != _generation) return;
+        if (retained != null && _target == null) {
+          if (retained['type'] == 'reconnect') {
+            reconnecting = true;
+            accountOnly = true;
+            _set(HostedFlowStage.idle);
+          } else if (retained['type'] == 'account') {
+            accountOnly = true;
+            _set(HostedFlowStage.idle);
+          } else {
+            _restorePairing(retained);
+            _target = _decode(retained);
+          }
+          if (_target != null && stage == HostedFlowStage.idle) {
+            _set(HostedFlowStage.signIn);
+          }
+        }
+      }
+    });
+  }
+
+  /// Reauthenticate an existing community without enrollment, backup or discovery.
+  Future<void> reconnectAccount({bool changeAccount = false}) async {
+    await initialize();
+    final generation = _nextGeneration();
+    reconnecting = true;
+    accountOnly = true;
+    _target = null;
+    _set(HostedFlowStage.signIn);
+    await _enqueue(() async {
+      if (_disposed || generation != _generation) return;
+      if (changeAccount) await account.clearLocalSession();
+      if (_disposed || generation != _generation) return;
+      await browser.start({'type': 'reconnect'});
+    });
+  }
+
+  /// Explicit Connect completes identity setup and discovers joined communities.
+  /// Passive startup restore only checks the saved session.
+  Future<void> signInAccount({bool openBrowser = true}) {
+    if (_target != null ||
+        stage == HostedFlowStage.working ||
+        stage == HostedFlowStage.signIn) {
+      return Future.value();
+    }
+    final generation = openBrowser ? _nextGeneration() : _generation;
+    if (openBrowser) {
+      reconnecting = false;
+      accountOnly = true;
+      _clearCommunityBatch();
+      _set(HostedFlowStage.working);
+    }
+    return _enqueue(() async {
+      if (!openBrowser) {
+        if (_target != null || stage != HostedFlowStage.idle) return;
+      }
+      final restored = await account.restore();
+      if (_disposed || generation != _generation) return;
+      if (!openBrowser) {
+        // Mounting the welcome page must not create/bind/back up a key.
+        _set(HostedFlowStage.idle);
+      } else if (restored != null) {
+        await _continue(generation);
+      } else {
+        _set(HostedFlowStage.signIn);
+        await browser.start({'type': 'account'});
+      }
+    });
+  }
+
+  /// Securely retain the transferred identity before NIP-AB completion. Hosted
+  /// admission still waits for account, binding and backup in the normal flow.
+  Future<void> stagePairedCommunity(
+    Community community, {
+    required bool Function() isCurrent,
+  }) async {
+    final uri = Uri.parse(community.relayUrl);
+    if (!HostedEnvironment.supportsRelay(uri)) throw AccountFailure.denied;
+    final nsec = community.nsec;
+    if (nsec == null) throw AccountIdentityFailure.absent;
+    final pubkey = AccountIdentityStore.publicKeyForNsec(nsec);
+    if (community.pubkey != null && community.pubkey != pubkey) {
+      throw AccountIdentityFailure.mismatch;
+    }
+    final device = await DeviceIdentitySource().choices();
+    if (device.isNotEmpty && !device.any((item) => item.pubkey == pubkey)) {
+      throw AccountIdentityFailure.mismatch;
+    }
+    final generation = _nextGeneration();
+    void check() {
+      if (!isCurrent() || generation != _generation || _disposed) {
+        throw AccountFailure.unavailable;
+      }
+    }
+
+    check();
+    await store.forPairing(pubkey).create(nsec, checkCurrent: check);
+    check();
+    final relay = uri.replace(scheme: 'wss').toString();
+    final target = AddCommunityDeepLink(relayUrl: relay, name: community.name);
+    _pairedPubkey = pubkey;
+    pairedSensitiveActionPolicy = community.sensitiveActionPolicy;
+    await browser.retainIntent(_intent(target));
+    check();
+    _target = target;
+    accountOnly = false;
+    _set(HostedFlowStage.signIn);
+  }
+
+  void _restorePairing(Map<String, String> intent) {
+    _pairedPubkey = intent['paired_pubkey'];
+    pairedSensitiveActionPolicy = intent['paired_protection'] == 'enabled'
+        ? SensitiveActionPolicy.enabled
+        : null;
+  }
+
+  Map<String, String> _intent(BuzzDeepLink target) => {
+    ..._encode(target),
+    'paired_pubkey': ?_pairedPubkey,
+    if (pairedSensitiveActionPolicy == SensitiveActionPolicy.enabled)
+      'paired_protection': 'enabled',
+  };
+
+  Future<void> start(BuzzDeepLink target, {bool resumePairing = false}) {
+    if (!resumePairing) {
+      _pairedPubkey = null;
+      pairedSensitiveActionPolicy = null;
+    }
+    if (target is! NostrBindDeepLink &&
+        target is! AddCommunityDeepLink &&
+        target is! InviteDeepLink) {
+      throw ArgumentError('Unsupported hosted target');
+    }
+    final generation = _nextGeneration();
+    reconnecting = false;
+    accountOnly = false;
+    _clearCommunityBatch();
+    _target = target;
+    _set(HostedFlowStage.working);
+    return _enqueue(() async {
+      if (generation != _generation) return;
+      if (!_acceptTarget(target)) return;
+      // Login may already be complete. Retain the destination before any
+      // remote work so restart can reconcile using the same saved identity.
+      await browser.retainIntent(_intent(target));
+      if (_disposed || generation != _generation) return;
+      await _resume(generation, _intent(target));
+    });
+  }
+
+  Future<void> _resume(int generation, Map<String, String> intent) async {
+    final restored = await account.restore();
+    if (_disposed || generation != _generation) return;
+    if (restored == null) {
+      _set(HostedFlowStage.signIn);
+      await browser.start(intent);
+    } else {
+      await _continue(generation);
+    }
+  }
+
+  Future<void> retry() async {
+    if (reconnecting) return reconnectAccount();
+    final target = _target;
+    if (target == null && !accountOnly) return;
+    final generation = _nextGeneration();
+    try {
+      await browser.cancel();
+      if (_disposed || generation != _generation) return;
+      if (target != null) {
+        await start(target, resumePairing: _pairedPubkey != null);
+      } else {
+        _set(HostedFlowStage.working);
+        await _enqueue(() => _resume(generation, {'type': 'account'}));
+      }
+    } catch (_) {
+      if (!_disposed && generation == _generation) {
+        _set(HostedFlowStage.blocked, HostedFlowProblem.retry);
+      }
+    }
+  }
+
+  /// Resume only an offered public identity; reread local and cloud facts first.
+  Future<void> chooseIdentity(String pubkey) {
+    if ((_target == null && !accountOnly) ||
+        stage != HostedFlowStage.chooseIdentity ||
+        !identityChoices.any((item) => item.pubkey == pubkey)) {
+      return Future.value();
+    }
+    final generation = _nextGeneration();
+    _set(HostedFlowStage.working);
+    return _enqueue(() => _continue(generation, selectedPubkey: pubkey));
+  }
+
+  Future<void> _continue(int generation, {String? selectedPubkey}) async {
+    final target = _target;
+    final session = account.account;
+    if ((target == null && !accountOnly) || session == null) {
+      throw AccountFailure.signedOut;
+    }
+    final store = this.store.forSubject(session.subject);
+    if (target != null && !_acceptTarget(target)) return;
+    if (target == null && _batchSubject != session.subject) {
+      _clearCommunityBatch();
+      _batchSubject = session.subject;
+    }
+    var resolved = await identity.resolve(
+      isCurrent: _isCurrent(generation),
+      selectedPubkey: selectedPubkey ?? _pairedPubkey,
+    );
+    if (_pairedPubkey != null && resolved.pubkey != _pairedPubkey) {
+      _set(HostedFlowStage.blocked, HostedFlowProblem.identityMismatch);
+      return;
+    }
+    if (target is! NostrBindDeepLink) {
+      for (var step = 0; step < 2; step++) {
+        if (_disposed || generation != _generation) return;
+        if (resolved.state == HostedIdentityState.needsBinding &&
+            resolved.pubkey != null) {
+          final response = await account.post(
+            '/v1/buzz/nostr-identities/challenge',
+            {'origin': HostedEnvironment.origin.toString()},
+          );
+          if (_disposed || generation != _generation) return;
+          final fields = <String, String>{
+            'audience': 'buzz:nostr-identity',
+            'action': 'bind_nostr_identity',
+            'protocol': 'buzz-nostr-identity',
+            'version': '1',
+            'return': 'browser_fragment_v1',
+            'callback_url': HostedEnvironment.origin
+                .resolve('/buzz')
+                .toString(),
+          };
+          for (final key in [
+            'challenge_id',
+            'nonce',
+            'verification_code',
+            'origin',
+            'expires_at',
+          ]) {
+            final value = response[key];
+            if (value is! String) throw AccountFailure.invalidResponse;
+            fields[key] = value;
+          }
+          final request = parseNostrBindDeepLink(
+            Uri(scheme: 'buzz', host: 'nostr-bind', queryParameters: fields),
+          );
+          if (response['error'] != null || request == null) {
+            throw AccountFailure.invalidResponse;
+          }
+          await WebConnectBindingService().complete(
+            request: request,
+            subject: session.subject,
+            expectedPubkey: resolved.pubkey!,
+            withKeys: store.withKeys,
+            verify: _verifyBinding,
+            isCurrent: _isCurrent(generation),
+          );
+        } else if (resolved.state == HostedIdentityState.needsBackup) {
+          await HostedBackupService(
+            account,
+            store,
+          ).backup(isCurrent: _isCurrent(generation));
+        } else {
+          break;
+        }
+        if (_disposed || generation != _generation) return;
+        resolved = await identity.resolve(isCurrent: _isCurrent(generation));
+      }
+    }
+    if (generation != _generation || _disposed) return;
+    if (resolved.state == HostedIdentityState.needsSelection) {
+      identityChoices = List.unmodifiable(resolved.choices);
+      _set(HostedFlowStage.chooseIdentity);
+      return;
+    }
+    final pubkey = resolved.pubkey;
+    if (target is NostrBindDeepLink &&
+        pubkey != null &&
+        {
+          HostedIdentityState.ready,
+          HostedIdentityState.needsBinding,
+          HostedIdentityState.needsBackup,
+        }.contains(resolved.state)) {
+      final returnTo = await WebConnectBindingService().complete(
+        request: target,
+        subject: session.subject,
+        expectedPubkey: pubkey,
+        withKeys: store.withKeys,
+        verify: _verifyBinding,
+        isCurrent: _isCurrent(generation),
+      );
+      if (generation != _generation || _disposed) return;
+      if (!await _openWeb(returnTo)) throw BrowserAuthFailure.unavailable;
+      await browser.clearIntent();
+      _set(HostedFlowStage.browserReturned);
+      return;
+    }
+    if (resolved.state != HostedIdentityState.ready || pubkey == null) {
+      final failure = switch (resolved.state) {
+        HostedIdentityState.needsBackup => HostedFlowProblem.backupRequired,
+        HostedIdentityState.needsBinding => HostedFlowProblem.bindingRequired,
+        HostedIdentityState.mismatch => HostedFlowProblem.identityMismatch,
+        _ => HostedFlowProblem.identityUnavailable,
+      };
+      _set(HostedFlowStage.blocked, failure);
+      return;
+    }
+    if (target == null) {
+      await _continueCommunities(generation, session.subject, pubkey);
+      return;
+    }
+    final destination = target is HostedCreateCommunity
+        ? await target.provision(account, pubkey, _isCurrent(generation))
+        : target;
+    if (_disposed || generation != _generation) return;
+    await enterCommunity(
+      destination,
+      session.subject,
+      pubkey,
+      _isCurrent(generation),
+    );
+    if (generation != _generation || _disposed) return;
+    await browser.clearIntent();
+    _set(HostedFlowStage.complete);
+  }
+
+  void selectCommunity(String relay, bool selected) {
+    if (stage != HostedFlowStage.chooseCommunities ||
+        !communities.any((item) => item.relayUrl == relay)) {
+      return;
+    }
+    selectedRelays = Set.unmodifiable({
+      ...selectedRelays.where((item) => item != relay),
+      if (selected) relay,
+    });
+    notifyListeners();
+  }
+
+  Future<void> addSelectedCommunities() {
+    if (!accountOnly ||
+        stage != HostedFlowStage.chooseCommunities ||
+        selectedRelays.isEmpty) {
+      return Future.value();
+    }
+    _addingCommunities = true;
+    final generation = _nextGeneration();
+    _set(HostedFlowStage.working);
+    return _enqueue(() => _continue(generation));
+  }
+
+  /// Keep completed additions and let the user omit a failing target.
+  void backToCommunityChoices() {
+    if (!canChangeCommunities) return;
+    _nextGeneration();
+    communities = List.unmodifiable(
+      communities.where((item) => !_addedRelays.contains(item.relayUrl)),
+    );
+    selectedRelays = Set.unmodifiable(selectedRelays.difference(_addedRelays));
+    _conflictingRelay = null;
+    addingCommunityName = null;
+    _set(HostedFlowStage.chooseCommunities);
+  }
+
+  Future<void> skipConflictingCommunity() {
+    final relay = _conflictingRelay;
+    if (stage != HostedFlowStage.communityConflict || relay == null) {
+      return Future.value();
+    }
+    selectedRelays = Set.unmodifiable(
+      selectedRelays.where((item) => item != relay),
+    );
+    _conflictingRelay = null;
+    final generation = _nextGeneration();
+    _set(HostedFlowStage.working);
+    return _enqueue(() => _continue(generation));
+  }
+
+  Future<void> _continueCommunities(
+    int generation,
+    String subject,
+    String pubkey,
+  ) async {
+    bool current() =>
+        !_disposed &&
+        generation == _generation &&
+        account.account?.subject == subject;
+    if (!_addingCommunities) {
+      final listed = await loadHostedCommunities(account);
+      if (!current()) return;
+      communities = listed;
+      selectedRelays = Set.unmodifiable(listed.map((item) => item.relayUrl));
+      if (listed.isEmpty) {
+        await leave(noCommunities: true);
+        return;
+      }
+      // Direct account entry imports every joined community. The existing
+      // switcher handles choosing which community to enter after admission.
+      _addingCommunities = true;
+    }
+    for (final community in communities) {
+      if (!current()) return;
+      if (!selectedRelays.contains(community.relayUrl) ||
+          _addedRelays.contains(community.relayUrl)) {
+        continue;
+      }
+      addingCommunityName = community.name;
+      notifyListeners();
+      try {
+        await enterCommunity(community, subject, pubkey, current);
+      } on SavedCommunityIdentityConflict {
+        if (!current()) return;
+        _conflictingRelay = community.relayUrl;
+        _set(HostedFlowStage.communityConflict);
+        return;
+      }
+      if (!current()) return;
+      _addedRelays.add(community.relayUrl);
+    }
+    if (!current()) return;
+    addingCommunityName = null;
+    if (_addedRelays.isEmpty) {
+      communities = List.unmodifiable(
+        communities.where((item) => selectedRelays.contains(item.relayUrl)),
+      );
+      await leave(noCommunities: true);
+      return;
+    }
+    await browser.clearIntent();
+    if (current()) _set(HostedFlowStage.complete);
+  }
+
+  bool _acceptTarget(BuzzDeepLink target) {
+    final relay = target.relayUrl;
+    if (relay != null && !HostedEnvironment.supportsRelay(Uri.parse(relay))) {
+      _set(HostedFlowStage.blocked, HostedFlowProblem.unsupportedEnvironment);
+      return false;
+    }
+    return true;
+  }
+
+  Future<String> _verifyBinding({
+    required String subject,
+    required String challengeId,
+    required String nonce,
+    required String signedPayload,
+  }) async {
+    if (account.account?.subject != subject) {
+      throw AccountFailure.differentAccount;
+    }
+    final response = await account.post('/v1/buzz/nostr-identities/verify', {
+      'challenge_id': challengeId,
+      'nonce': nonce,
+      'signed_payload': signedPayload,
+    });
+    if (account.account?.subject != subject) {
+      throw AccountFailure.differentAccount;
+    }
+    final bound = response['identity'];
+    if (response['error'] != null ||
+        bound is! Map ||
+        bound['pubkey_hex'] is! String) {
+      throw AccountFailure.invalidResponse;
+    }
+    return bound['pubkey_hex'] as String;
+  }
+
+  bool Function() _isCurrent(int generation) =>
+      () => !_disposed && generation == _generation;
+
+  Future<void> _enqueue(Future<void> Function() operation) {
+    final generation = _generation;
+    final result = _queue.run(() async {
+      if (_disposed || generation != _generation) return;
+      try {
+        await operation();
+      } catch (error) {
+        if (!_disposed && generation == _generation) {
+          _set(HostedFlowStage.blocked, _problemFor(error));
+        }
+      }
+    });
+    return result;
+  }
+
+  static HostedFlowProblem _problemFor(Object error) => switch (error) {
+    HostedCreationFailure.rejected =>
+      HostedFlowProblem.communityCreationRejected,
+    HostedInviteFailure.policyRequired =>
+      HostedFlowProblem.invitePolicyRequired,
+    HostedInviteFailure.expired => HostedFlowProblem.inviteExpired,
+    HostedInviteFailure.exhausted => HostedFlowProblem.inviteExhausted,
+    HostedInviteFailure.invalid => HostedFlowProblem.inviteInvalid,
+    AccountFailure.denied => HostedFlowProblem.denied,
+    AccountFailure.accountSetupRequired =>
+      HostedFlowProblem.accountSetupRequired,
+    AccountFailure.rejected ||
+    HostedBackupFailure.rejected => HostedFlowProblem.requestRejected,
+    HostedBackupFailure.unavailable => HostedFlowProblem.backupUnavailable,
+    AccountFailure.differentAccount => HostedFlowProblem.differentAccount,
+    AccountIdentityFailure.unreadable ||
+    AccountIdentityFailure.invalidKey ||
+    AccountFailure.storage ||
+    HostedBackupFailure.storage => HostedFlowProblem.identityUnreadable,
+    SavedCommunityIdentityConflict() ||
+    AccountIdentityFailure.mismatch ||
+    AccountIdentityFailure.occupied ||
+    HostedBackupFailure.identityMismatch ||
+    HpkeBackupFailure.identityMismatch => HostedFlowProblem.identityMismatch,
+    HpkeBackupFailure.unavailable => HostedFlowProblem.backupUnavailable,
+    AccountFailure.invalidResponse ||
+    HostedBackupFailure.invalidResponse ||
+    HpkeBackupFailure.invalidEnrollment => HostedFlowProblem.invalidResponse,
+    _ => HostedFlowProblem.retry,
+  };
+
+  void _set(HostedFlowStage next, [HostedFlowProblem? failure]) {
+    if (_disposed) return;
+    if (next != HostedFlowStage.chooseIdentity) identityChoices = const [];
+    stage = next;
+    problem = failure;
+    notifyListeners();
+  }
+
+  bool noCommunitiesToAdd = false;
+
+  void _clearCommunityBatch() {
+    noCommunitiesToAdd = false;
+    communities = const [];
+    selectedRelays = const {};
+    _addedRelays.clear();
+    _batchSubject = null;
+    _conflictingRelay = null;
+    _addingCommunities = false;
+    addingCommunityName = null;
+  }
+
+  Future<void> leave({bool noCommunities = false}) async {
+    _nextGeneration();
+    final generation = _generation;
+    _target = null;
+    _pairedPubkey = null;
+    pairedSensitiveActionPolicy = null;
+    reconnecting = false;
+    accountOnly = false;
+    _clearCommunityBatch();
+    noCommunitiesToAdd = noCommunities;
+    try {
+      await browser.cancel();
+      if (_disposed || generation != _generation) return;
+      await browser.clearIntent();
+      if (generation == _generation) _set(HostedFlowStage.idle);
+    } catch (_) {
+      if (generation == _generation) {
+        _set(HostedFlowStage.blocked, HostedFlowProblem.retry);
+      }
+    }
+  }
+
+  static Map<String, String> _encode(BuzzDeepLink target) {
+    if (target is HostedCreateCommunity) {
+      return {'type': 'create', 'name': target.name};
+    }
+    if (target is NostrBindDeepLink) return {'type': 'bind', ...target.fields};
+    if (target is AddCommunityDeepLink) {
+      return {'type': 'add', 'relay': target.relayUrl, 'name': target.name};
+    }
+    final invite = target as InviteDeepLink;
+    return {
+      'type': 'invite',
+      'relay': invite.relayUrl,
+      'code': invite.code,
+      if (invite.policyReceipt != null) 'policy_receipt': invite.policyReceipt!,
+    };
+  }
+
+  static BuzzDeepLink? _decode(Map<String, String> intent) {
+    if (intent['type'] == 'create') {
+      final name = intent['name'];
+      return name != null && HostedCreateCommunity.validName(name)
+          ? HostedCreateCommunity(name)
+          : null;
+    }
+    final fields = Map<String, String>.of(intent)
+      ..remove('type')
+      ..remove('paired_pubkey')
+      ..remove('paired_protection');
+    final host = switch (intent['type']) {
+      'bind' => 'nostr-bind',
+      'add' => 'add-community',
+      'invite' => 'join',
+      _ => '',
+    };
+    return parseBuzzDeepLink(
+      Uri(scheme: 'buzz', host: host, queryParameters: fields),
+    );
+  }
+
+  @override
+  void dispose() {
+    _disposed = true;
+    _cancelPolicy();
+    _cancelProfile();
+    _nextGeneration();
+    unawaited(_codes?.cancel());
+    unawaited(_failures?.cancel());
+    super.dispose();
+  }
+}
diff --git a/mobile/lib/shared/hosted/hosted_flow_problem_message.dart b/mobile/lib/shared/hosted/hosted_flow_problem_message.dart
new file mode 100644
index 0000000000..957804c940
--- /dev/null
+++ b/mobile/lib/shared/hosted/hosted_flow_problem_message.dart
@@ -0,0 +1,40 @@
+import 'hosted_flow.dart';
+
+String hostedFlowProblemMessage(
+  HostedFlowProblem? problem,
+) => switch (problem) {
+  HostedFlowProblem.communityCreationRejected =>
+    'This community could not be created. Leave setup to choose another address, or check your hosted community limit in Builderlab.',
+  HostedFlowProblem.unsupportedEnvironment =>
+    'This community needs a different or unsupported Builderlab environment. Use an app build configured for this community.',
+  HostedFlowProblem.accountSetupRequired =>
+    'This account is not eligible for Buzz yet.',
+  HostedFlowProblem.invitePolicyRequired =>
+    'The community policy needs to be accepted again. Try again to review it.',
+  HostedFlowProblem.inviteExpired =>
+    'This invite has expired. Ask for a new invite link.',
+  HostedFlowProblem.inviteExhausted =>
+    'This invite has no uses left. Ask for a new invite link.',
+  HostedFlowProblem.inviteInvalid =>
+    'This invite is not valid. Ask for a new invite link.',
+  HostedFlowProblem.denied => 'This account does not have access.',
+  HostedFlowProblem.differentAccount =>
+    'Your browser signed in to a different account. Sign in to your original account on the web, then reopen setup. Your saved account and keys have been kept.',
+  HostedFlowProblem.identityUnreadable =>
+    'Your saved identity could not be read safely. Leave setup and recover access to this device’s secure storage before continuing.',
+  HostedFlowProblem.backupUnavailable =>
+    'Secure backup is not supported on this device yet. Your identity has been kept; joining requires a confirmed backup.',
+  HostedFlowProblem.requestRejected =>
+    'The account service could not accept this setup request. Your saved account and identity have been kept.',
+  HostedFlowProblem.invalidResponse =>
+    'The account service returned a response this app cannot safely use. Setup has stopped.',
+  HostedFlowProblem.identityMismatch =>
+    'This account uses a different identity. Your saved identity has been kept.',
+  HostedFlowProblem.backupRequired =>
+    'Your identity needs a confirmed cloud backup before joining. Your saved key has been kept.',
+  HostedFlowProblem.bindingRequired =>
+    'Connect your identity from the account setup page first.',
+  HostedFlowProblem.identityUnavailable =>
+    'We could not safely recover an identity for this account. Your saved keys have been kept.',
+  _ => 'We could not finish connecting. You can try again.',
+};
diff --git a/mobile/lib/shared/hosted/hosted_flow_provider.dart b/mobile/lib/shared/hosted/hosted_flow_provider.dart
new file mode 100644
index 0000000000..d39411ca2e
--- /dev/null
+++ b/mobile/lib/shared/hosted/hosted_flow_provider.dart
@@ -0,0 +1,213 @@
+import 'dart:async';
+import 'package:hooks_riverpod/hooks_riverpod.dart';
+import '../../features/invites/invite_join_provider.dart';
+import '../../features/profile/profile_provider.dart';
+import '../relay/relay_provider.dart';
+import '../relay/relay_session.dart';
+import '../auth/auth.dart';
+import '../community/paired_community_landing.dart';
+import '../deeplink/deep_link.dart';
+import 'account_identity_store.dart';
+import 'browser_auth.dart';
+import 'builderlab_account.dart';
+import 'hosted_admission.dart';
+import 'hosted_community_connection.dart';
+import 'hosted_flow.dart';
+import 'hosted_identity_service.dart';
+import 'hosted_relay_auth.dart';
+
+// Set by a community-entry surface while it owns setup presentation.
+final hostedInlineEntryProvider = NotifierProvider<HostedInlineEntry, bool>(
+  HostedInlineEntry.new,
+);
+
+class HostedInlineEntry extends Notifier<bool> {
+  @override
+  bool build() => false;
+
+  void setActive(bool active) {
+    if (ref.mounted) state = active;
+  }
+}
+
+/// Signals a completed local admission to the currently mounted Add route.
+final communityEntryCompletionProvider =
+    NotifierProvider<CommunityEntryCompletion, int>(
+      CommunityEntryCompletion.new,
+    );
+
+class CommunityEntryCompletion extends Notifier<int> {
+  @override
+  int build() => 0;
+
+  void complete() {
+    if (ref.mounted) state++;
+  }
+}
+
+final hostedFlowProvider = Provider<HostedFlow>((ref) => createHostedFlow(ref));
+
+/// Shared orchestration with injectable browser and relay network boundaries.
+HostedFlow createHostedFlow(
+  Ref ref, {
+  BrowserAuth? browserAuth,
+  Future<void> Function(Community)? probe,
+}) {
+  final account = ref.read(builderlabAccountProvider);
+  final browser = browserAuth ?? BrowserAuth();
+  final store = AccountIdentityStore();
+  late final HostedFlow flow;
+  final admission = HostedAdmission(
+    relayAuth: ref.read(hostedRelayAuthProvider),
+    account: account,
+    store: store,
+    confirmPolicy: (policy) => flow.confirmJoinPolicy(policy),
+    probe: probe,
+  );
+  flow = HostedFlow(
+    account: account,
+    browser: browser,
+    store: store,
+    identity: HostedIdentityService(account: account, store: store),
+    enterCommunity: (link, subject, pubkey, isCurrent) async {
+      await connectHostedCommunity(
+        link: link,
+        subject: subject,
+        pubkey: pubkey,
+        isCurrent: () => isCurrent() && account.account?.subject == subject,
+        storage: ref.read(communityStorageProvider),
+        admission: admission,
+        persist: (community, current) => ref
+            .read(authProvider.notifier)
+            .authenticateWithCommunity(
+              flow.pairedSensitiveActionPolicy == null
+                  ? community
+                  : community.copyWith(
+                      sensitiveActionPolicy: flow.pairedSensitiveActionPolicy,
+                    ),
+              shouldContinue: current,
+              activate:
+                  community.starterSetupIncomplete ||
+                  flow.addedCommunityCount == 0,
+            ),
+        recoverStarterChannels: (community, current) =>
+            finishHostedStarterSetup(ref, community, current),
+      );
+      if (flow.addedCommunityCount == 0 && isCurrent()) {
+        await offerHostedProfile(
+          ref,
+          flow,
+          link,
+          pubkey,
+          () => isCurrent() && account.account?.subject == subject,
+        );
+      }
+    },
+  );
+  void onCompleted() {
+    if (flow.reconnecting && flow.stage == HostedFlowStage.complete) {
+      unawaited(ref.read(relaySessionProvider.notifier).reconnect());
+    } else if (flow.accountOnly && flow.stage == HostedFlowStage.complete) {
+      ref.read(communityGridLandingProvider.notifier).request();
+    }
+  }
+
+  flow.addListener(onCompleted);
+  ref.onDispose(() {
+    flow.removeListener(onCompleted);
+    flow.dispose();
+    browser.dispose();
+    admission.dispose();
+  });
+  return flow;
+}
+
+/// Optional and scoped to the first activated community. A failed read is not
+/// proof that no profile exists; leave it to Settings in that case.
+Future<void> offerHostedProfile(
+  Ref ref,
+  HostedFlow flow,
+  BuzzDeepLink link,
+  String pubkey,
+  bool Function() isCurrent,
+) async {
+  final relay = link.relayUrl;
+  if (relay == null || !ref.mounted || !isCurrent()) return;
+  final active = await ref.read(activeCommunityProvider.future);
+  bool current() {
+    if (!ref.mounted || !isCurrent()) return false;
+    final now = ref.read(activeCommunityProvider).asData?.value;
+    return now != null &&
+        now.id == active?.id &&
+        now.pubkey == pubkey &&
+        relayIdentity(now.relayUrl) == relayIdentity(relay);
+  }
+
+  if (!current()) return;
+  // Keep the provider hydrated throughout the optional sheet.
+  final subscription = ref.listen(profileProvider, (_, _) {});
+  try {
+    try {
+      final profile = await ref.read(profileProvider.future);
+      if (profile != null || !current()) return;
+    } catch (_) {
+      return;
+    }
+    await flow.requestProfile((name) async {
+      if (!current()) throw AccountFailure.unavailable;
+      await ref.read(profileProvider.notifier).updateDisplayName(name);
+    });
+  } finally {
+    subscription.close();
+  }
+}
+
+/// Completes the existing scoped invite recovery only after activation. The
+/// pending flag remains durable on failure, cancellation or a community switch.
+Future<void> finishHostedStarterSetup(
+  Ref ref,
+  Community community,
+  bool Function() isCurrent,
+) async {
+  void checkCurrent() {
+    if (!ref.mounted || !isCurrent()) throw AccountFailure.unavailable;
+  }
+
+  bool matches(Community? candidate) =>
+      candidate?.id == community.id &&
+      candidate?.relayUrl == community.relayUrl &&
+      candidate?.pubkey == community.pubkey &&
+      candidate?.nsec == community.nsec;
+
+  checkCurrent();
+  final active = await ref.read(activeCommunityProvider.future);
+  checkCurrent();
+  if (!matches(active)) throw AccountFailure.unavailable;
+  final config = RelayConfig(baseUrl: community.relayUrl, nsec: community.nsec);
+  await ref
+      .read(inviteJoinRecoveryProvider)(
+        InviteJoinRecoveryScope(
+          relayHttpOrigin: config.baseUrl,
+          nsec: config.nsec,
+        ),
+      )
+      .ensureStarterChannels();
+  checkCurrent();
+  await ref.read(communityTransitionProvider).runExclusive(() async {
+    checkCurrent();
+    final storage = ref.read(communityStorageProvider);
+    final saved = (await storage.loadAll())
+        .where((item) => item.id == community.id)
+        .firstOrNull;
+    final activeId = await storage.loadActiveId();
+    checkCurrent();
+    if (!matches(saved) || activeId != community.id) {
+      throw AccountFailure.unavailable;
+    }
+    await storage.save(saved!.copyWith(starterSetupIncomplete: false));
+    await syncStoredCommunitySnapshot(ref);
+    ref.invalidate(communityListProvider);
+    ref.invalidate(activeCommunityProvider);
+    ref.invalidate(authProvider);
+  });
+}
diff --git a/mobile/lib/shared/hosted/hosted_identity_service.dart b/mobile/lib/shared/hosted/hosted_identity_service.dart
new file mode 100644
index 0000000000..3c7ae73cd4
--- /dev/null
+++ b/mobile/lib/shared/hosted/hosted_identity_service.dart
@@ -0,0 +1,323 @@
+import 'dart:convert';
+
+import 'package:nostr/nostr.dart' as nostr;
+
+import 'account_identity_store.dart';
+import 'builderlab_account.dart';
+import 'device_identity_source.dart';
+
+enum HostedIdentityState {
+  ready,
+  needsSelection,
+  needsBinding,
+  needsBackup,
+  mismatch,
+  recoveryBlocked,
+  needsAuthoritativeAbsence,
+}
+
+class HostedIdentityResult {
+  const HostedIdentityResult(
+    this.state, {
+    this.pubkey,
+    this.choices = const [],
+  });
+  final HostedIdentityState state;
+  final String? pubkey;
+  final List<DeviceIdentityChoice> choices;
+}
+
+/// Resolves identity safely. Generation requires a separately verified
+/// complete absence contract and explicit legacy-key reconciliation; neither a
+/// failed recovery nor an unbound account proves there is no prior identity.
+class HostedIdentityService {
+  HostedIdentityService({
+    required this.account,
+    required this.store,
+    DeviceIdentitySource? deviceIdentities,
+  }) : deviceIdentities = deviceIdentities ?? DeviceIdentitySource();
+
+  final DeviceIdentitySource deviceIdentities;
+  final BuilderlabAccountClient account;
+  final AccountIdentityStore store;
+
+  Future<HostedIdentityResult> resolve({
+    bool Function()? isCurrent,
+    String? selectedPubkey,
+  }) => _resolve(isCurrent, selectedPubkey);
+
+  Future<HostedIdentityResult> _resolve(
+    bool Function()? isCurrent,
+    String? selectedPubkey,
+  ) async {
+    void checkCurrent() {
+      if (isCurrent != null && !isCurrent()) throw AccountFailure.unavailable;
+    }
+
+    checkCurrent();
+    final subject = account.account?.subject;
+    if (subject == null) throw AccountFailure.signedOut;
+    final store = this.store.forSubject(subject);
+    final local = await store.read();
+    final response = await account.currentIdentity();
+    _sameAccount(subject);
+    if (response['error'] != null) throw AccountFailure.invalidResponse;
+    final identity = response['identity'];
+    final String? bound;
+    if (identity == null) {
+      bound = null; // The current API omits the optional unbound identity.
+    } else if (identity is Map<String, dynamic>) {
+      bound = _pubkey(identity['pubkey_hex']);
+    } else {
+      throw AccountFailure.invalidResponse;
+    }
+    if (local != null && bound != null) return _result(local, bound, subject);
+
+    final status = await account.post('/v1/buzz/nsec-backups/status', {});
+    _sameAccount(subject);
+    checkCurrent();
+    final listed = status['backup_nostr_pubkeys'];
+    if (status['error'] != null || listed is! List) {
+      throw AccountFailure.invalidResponse;
+    }
+    final statusBound = status['current_nostr_pubkey'] == null
+        ? null
+        : _pubkey(status['current_nostr_pubkey']);
+    final statusKeys = listed.map(_pubkey).toSet();
+    if (statusBound != bound) throw AccountFailure.invalidResponse;
+    if (local != null) {
+      // A previously chosen recovery key may still await binding after a
+      // restart. Its account-scoped receipt and current backup listing preserve
+      // that choice even when the account also retains older identities.
+      final confirmedSelection =
+          statusKeys.contains(local.pubkey) &&
+          local.hasBackupFor(
+            backend: BuilderlabAccountClient.origin.origin,
+            subject: subject,
+          );
+      if (statusKeys.any((key) => key != local.pubkey) && !confirmedSelection) {
+        return const HostedIdentityResult(HostedIdentityState.mismatch);
+      }
+      return _result(local, bound, subject);
+    }
+    final device = await deviceIdentities.choices();
+    final savedAccounts = await store.identities();
+    final choices = [
+      ...device,
+      for (final saved in savedAccounts)
+        if (!device.any((item) => item.pubkey == saved.pubkey))
+          DeviceIdentityChoice(saved.pubkey, 'Saved identity'),
+    ];
+    _sameAccount(subject);
+    checkCurrent();
+    // The authoritative bound key already on this device needs no remote
+    // decryption, even when the account retains backups of older identities.
+    final matchingDevice =
+        bound != null && choices.any((item) => item.pubkey == bound);
+    if ((statusKeys.isEmpty && bound == null) || matchingDevice) {
+      final eligible = choices
+          .where((item) => bound == null || item.pubkey == bound)
+          .toList();
+      if (eligible.isNotEmpty) {
+        final chosen =
+            selectedPubkey ??
+            (bound != null && eligible.length == 1
+                ? eligible.single.pubkey
+                : null);
+        if (!eligible.any((item) => item.pubkey == chosen)) {
+          return HostedIdentityResult(
+            HostedIdentityState.needsSelection,
+            choices: eligible,
+          );
+        }
+        void checkSelection() {
+          _sameAccount(subject);
+          checkCurrent();
+        }
+
+        final saved = device.any((item) => item.pubkey == chosen)
+            ? await deviceIdentities.adopt(
+                chosen!,
+                store,
+                checkCurrent: checkSelection,
+              )
+            : await store.adoptSaved(chosen!, checkCurrent: checkSelection);
+        return _result(saved, bound, subject);
+      }
+    }
+    if (statusBound == null && statusKeys.isEmpty) {
+      final generated = await store.generateIfAbsent(
+        authorize: () async {
+          _sameAccount(subject);
+          checkCurrent();
+          final reconciled = (await deviceIdentities.choices()).isEmpty;
+          _sameAccount(subject);
+          checkCurrent();
+          return reconciled;
+        },
+      );
+      _sameAccount(subject);
+      checkCurrent();
+      return generated == null
+          ? const HostedIdentityResult(
+              HostedIdentityState.needsAuthoritativeAbsence,
+            )
+          : _result(generated, bound, subject);
+    }
+
+    final recovered = await account.post('/v1/buzz/nsec-backups/recovery', {});
+    _sameAccount(subject);
+    final backups = recovered['backups'];
+    final failed = recovered['failed_backup_ids'];
+    if (recovered['error'] != null ||
+        backups is! List ||
+        failed is! List ||
+        failed.any((id) => id is! String)) {
+      throw AccountFailure.invalidResponse;
+    }
+    if (failed.isNotEmpty) {
+      return const HostedIdentityResult(HostedIdentityState.recoveryBlocked);
+    }
+    if (backups.isEmpty) {
+      return HostedIdentityResult(
+        bound == null
+            ? HostedIdentityState.needsAuthoritativeAbsence
+            : HostedIdentityState.recoveryBlocked,
+      );
+    }
+    // Validate the entire result before storing anything. Never trust its
+    // advertised pubkey without deriving it from the actual secret.
+    final candidates = <String, ({nostr.Keys keys, String backupId})>{};
+    try {
+      for (final backup in backups) {
+        if (backup is! Map<String, dynamic>) throw const FormatException();
+        final secret = backup['secret_key'];
+        final backupId = backup['backup_id'];
+        if (secret is! String ||
+            !RegExp(r'^[A-Za-z0-9_-]{43}$').hasMatch(secret) ||
+            backupId is! String ||
+            backupId.isEmpty) {
+          throw const FormatException();
+        }
+        final bytes = base64Url.decode(base64Url.normalize(secret));
+        if (bytes.length != 32) throw const FormatException();
+        final hex = bytes
+            .map((b) => b.toRadixString(16).padLeft(2, '0'))
+            .join();
+        final keys = AccountIdentityStore.keysForHex(hex);
+        if (keys.public != _pubkey(backup['nostr_pubkey'])) {
+          throw const FormatException();
+        }
+        candidates.putIfAbsent(
+          keys.public,
+          () => (keys: keys, backupId: backupId),
+        );
+      }
+    } catch (_) {
+      throw AccountFailure.invalidResponse;
+    }
+    if (bound == null &&
+        (statusKeys.length != candidates.length ||
+            !statusKeys.every(candidates.containsKey))) {
+      return const HostedIdentityResult(HostedIdentityState.recoveryBlocked);
+    }
+    // An account binding is authoritative even when older backups contain
+    // other keys. Without a binding, distinct keys require an explicit choice;
+    // never let response ordering choose the user's identity.
+    final chosen =
+        bound ??
+        selectedPubkey ??
+        (candidates.length == 1 ? candidates.keys.single : null);
+    final candidate = candidates[chosen];
+    if (candidate == null) {
+      if (bound != null) {
+        return const HostedIdentityResult(HostedIdentityState.mismatch);
+      }
+      return HostedIdentityResult(
+        HostedIdentityState.needsSelection,
+        choices: [
+          for (final pubkey in candidates.keys)
+            DeviceIdentityChoice(
+              pubkey,
+              'Use Builderlab identity',
+              fromCloud: true,
+            ),
+        ],
+      );
+    }
+    if (device.isNotEmpty &&
+        !device.any((item) => item.pubkey == candidate.keys.public) &&
+        selectedPubkey != candidate.keys.public) {
+      return HostedIdentityResult(
+        HostedIdentityState.needsSelection,
+        choices: [
+          DeviceIdentityChoice(
+            candidate.keys.public,
+            'Use Builderlab identity',
+            fromCloud: true,
+          ),
+        ],
+      );
+    }
+    _sameAccount(subject);
+    checkCurrent();
+    final saved = await store.create(
+      candidate.keys.nsec,
+      checkCurrent: () {
+        _sameAccount(subject);
+        checkCurrent();
+      },
+      recoveredBackup: BackupReceipt(
+        backend: BuilderlabAccountClient.origin.origin,
+        subject: subject,
+        pubkey: candidate.keys.public,
+        backupId: candidate.backupId,
+      ),
+    );
+    _sameAccount(subject);
+    checkCurrent();
+    return _result(saved, bound, subject);
+  }
+
+  HostedIdentityResult _result(
+    AccountIdentitySnapshot local,
+    String? bound,
+    String subject,
+  ) {
+    _sameAccount(subject);
+    if (bound != null && bound != local.pubkey) {
+      return HostedIdentityResult(
+        HostedIdentityState.mismatch,
+        pubkey: local.pubkey,
+      );
+    }
+    if (bound == null) {
+      return HostedIdentityResult(
+        HostedIdentityState.needsBinding,
+        pubkey: local.pubkey,
+      );
+    }
+    return HostedIdentityResult(
+      local.hasBackupFor(
+            backend: BuilderlabAccountClient.origin.origin,
+            subject: subject,
+          )
+          ? HostedIdentityState.ready
+          : HostedIdentityState.needsBackup,
+      pubkey: local.pubkey,
+    );
+  }
+
+  void _sameAccount(String subject) {
+    if (account.account?.subject != subject) {
+      throw AccountFailure.differentAccount;
+    }
+  }
+
+  static String _pubkey(dynamic value) {
+    if (value is! String || !RegExp(r'^[a-fA-F0-9]{64}$').hasMatch(value)) {
+      throw AccountFailure.invalidResponse;
+    }
+    return value.toLowerCase();
+  }
+}
diff --git a/mobile/lib/shared/hosted/hosted_join_policy.dart b/mobile/lib/shared/hosted/hosted_join_policy.dart
new file mode 100644
index 0000000000..d91ac8dfde
--- /dev/null
+++ b/mobile/lib/shared/hosted/hosted_join_policy.dart
@@ -0,0 +1,109 @@
+import 'dart:convert';
+import 'package:http/http.dart' as http;
+import 'builderlab_account.dart';
+import 'bounded_http_response.dart';
+
+/// Public policy text bound to the exact version the user accepts.
+class HostedJoinPolicy {
+  const HostedJoinPolicy({
+    required this.version,
+    required this.ageRequired,
+    this.terms,
+    this.privacy,
+  });
+  final String version;
+  final bool ageRequired;
+  final String? terms;
+  final String? privacy;
+}
+
+enum HostedInviteFailure { policyRequired, expired, exhausted, invalid }
+
+/// Reads only a bounded JSON document, never follows redirects or logs bodies.
+Future<Map<String, dynamic>> readJoinResponse(
+  http.Client client,
+  http.Request request,
+) async {
+  final http.Response response;
+  final Map<String, dynamic> data;
+  try {
+    response = await boundedHttpResponse(client, request);
+    if (response.statusCode == 429 ||
+        (response.statusCode >= 500 && response.statusCode < 600)) {
+      throw AccountFailure.unavailable;
+    }
+    data = jsonDecode(utf8.decode(response.bodyBytes)) as Map<String, dynamic>;
+  } on FormatException {
+    throw AccountFailure.invalidResponse;
+  } on TypeError {
+    throw AccountFailure.invalidResponse;
+  }
+  if (response.statusCode < 200 || response.statusCode >= 300) {
+    throw switch (data['error']) {
+      'join_policy_required' ||
+      'join_policy_not_accepted' => HostedInviteFailure.policyRequired,
+      'invite_expired' => HostedInviteFailure.expired,
+      'invite_exhausted' => HostedInviteFailure.exhausted,
+      'invite_invalid' => HostedInviteFailure.invalid,
+      _ => AccountFailure.denied,
+    };
+  }
+  return data;
+}
+
+Future<String?> freshJoinPolicyReceipt({
+  required http.Client client,
+  required Uri origin,
+  required String code,
+  required Future<bool> Function(HostedJoinPolicy) confirm,
+  required void Function() checkCurrent,
+}) async {
+  Future<Map<String, dynamic>> send(
+    String method,
+    String path, [
+    Map<String, dynamic>? body,
+  ]) async {
+    checkCurrent();
+    final request = http.Request(
+      method,
+      origin.replace(scheme: 'https', path: path),
+    )..followRedirects = false;
+    if (body != null) {
+      request.headers['Content-Type'] = 'application/json';
+      request.body = jsonEncode(body);
+    }
+    final data = await readJoinResponse(client, request);
+    checkCurrent();
+    return data;
+  }
+
+  final data = await send('GET', '/api/join-policy');
+  final raw = data['policy'];
+  if (raw == null) return null;
+  if (raw is! Map ||
+      raw['version'] is! String ||
+      (raw['version'] as String).isEmpty ||
+      raw['age_attestation_required'] is! bool ||
+      (raw['terms_markdown'] != null && raw['terms_markdown'] is! String) ||
+      (raw['privacy_markdown'] != null && raw['privacy_markdown'] is! String)) {
+    throw AccountFailure.invalidResponse;
+  }
+  final policy = HostedJoinPolicy(
+    version: raw['version'] as String,
+    ageRequired: raw['age_attestation_required'] as bool,
+    terms: raw['terms_markdown'] as String?,
+    privacy: raw['privacy_markdown'] as String?,
+  );
+  if (!await confirm(policy)) throw HostedInviteFailure.policyRequired;
+  checkCurrent();
+  final accepted = await send('POST', '/api/invites/accept-policy', {
+    'code': code,
+    'policy_version': policy.version,
+    'age_confirmed': policy.ageRequired,
+  });
+  final receipt = accepted['receipt'];
+  if (receipt is! String || receipt.isEmpty || receipt.length > 8192) {
+    throw AccountFailure.invalidResponse;
+  }
+  return receipt;
+}
diff --git a/mobile/lib/shared/hosted/hosted_relay_auth.dart b/mobile/lib/shared/hosted/hosted_relay_auth.dart
new file mode 100644
index 0000000000..dee75c032d
--- /dev/null
+++ b/mobile/lib/shared/hosted/hosted_relay_auth.dart
@@ -0,0 +1,245 @@
+import 'dart:async';
+
+import 'package:flutter/foundation.dart';
+import 'package:hooks_riverpod/hooks_riverpod.dart';
+import 'package:http/http.dart' as http;
+
+import '../relay/relay_provider.dart';
+import 'builderlab_account.dart';
+import 'account_identity_store.dart';
+import 'hosted_environment.dart';
+
+final builderlabAccountProvider = Provider<BuilderlabAccountClient>((ref) {
+  final account = BuilderlabAccountClient();
+  ref.onDispose(account.dispose);
+  return account;
+});
+
+final hostedRelayAuthProvider = Provider<HostedRelayAuth>((ref) {
+  final auth = HostedRelayAuth(ref.watch(builderlabAccountProvider));
+  ref.onDispose(auth.dispose);
+  return auth;
+});
+
+/// Each transport owns its client lifetime; configuration and auth are shared.
+final hostedHttpClientFactoryProvider = Provider<http.Client Function()>((ref) {
+  final auth = ref.watch(hostedRelayAuthProvider);
+  final config = ref.watch(relayConfigProvider);
+  return () => HostedRelayHttpClient(auth, config);
+});
+
+/// One account session, with a short-lived assertion for the current relay/key.
+/// Enable alongside backend issuance; legacy and self-hosted builds stay usable.
+class HostedRelayAuth extends ChangeNotifier {
+  HostedRelayAuth(
+    this.account, {
+    this.enabled = const bool.fromEnvironment('BUZZ_HOSTED_RELAY_AUTH'),
+    DateTime Function()? now,
+  }) : _now = now ?? DateTime.now;
+
+  final BuilderlabAccountClient account;
+  final bool enabled;
+  final DateTime Function() _now;
+  ({
+    String relay,
+    String pubkey,
+    String token,
+    DateTime expiry,
+    BuilderlabAccount account,
+  })?
+  _cached;
+  Future<void>? _pending;
+  bool _disposed = false;
+  String? failedRelay;
+  String? failedPubkey;
+  AccountFailure? failure;
+
+  bool protects(RelayConfig config) =>
+      enabled &&
+      HostedEnvironment.requiresAuth(Uri.parse(config.baseUrl).host) &&
+      HostedEnvironment.supportsRelay(Uri.parse(config.baseUrl));
+
+  Future<Map<String, String>> headers(RelayConfig config) async {
+    if (!protects(config)) return const {};
+    final relay = Uri.parse(config.wsUrl).replace(path: '').toString();
+    final pubkey = pubkeyFromNsec(config.nsec);
+    if (pubkey == null) throw AccountFailure.denied;
+    while (!_disposed) {
+      final cached = _cached;
+      if (cached != null &&
+          cached.relay == relay &&
+          cached.pubkey == pubkey &&
+          identical(cached.account, account.account) &&
+          cached.expiry.isAfter(_now())) {
+        return {'Nostr-Federated-Identity': 'Bearer ${cached.token}'};
+      }
+      final pending = _pending;
+      if (pending != null) {
+        // Different communities share account restoration, never assertions.
+        try {
+          await pending;
+        } on AccountFailure {
+          if (failedRelay == config.baseUrl && failedPubkey == pubkey) rethrow;
+        }
+        continue;
+      }
+      final operation = _issue(config, relay, pubkey);
+      _pending = operation;
+      try {
+        await operation;
+      } finally {
+        _pending = null;
+      }
+    }
+    throw AccountFailure.unavailable;
+  }
+
+  Future<void> _issue(RelayConfig config, String relay, String pubkey) async {
+    try {
+      if (account.account == null && await account.restore() == null) {
+        throw AccountFailure.signedOut;
+      }
+      final session = account.account!;
+      // Issuance can create a binding. Reconnect must not silently give a
+      // different, unbound account this community's saved identity.
+      final current = await account.currentIdentity();
+      if (!identical(session, account.account)) throw AccountFailure.denied;
+      final identity = current['identity'];
+      if (current['error'] != null) throw AccountFailure.invalidResponse;
+      if (identity == null) {
+        final AccountIdentitySnapshot? saved;
+        try {
+          saved = await AccountIdentityStore()
+              .forSubject(session.subject)
+              .read();
+        } on AccountIdentityFailure {
+          throw AccountFailure.storage;
+        }
+        if (saved?.pubkey != pubkey ||
+            !saved!.hasBackupFor(
+              backend: BuilderlabAccountClient.origin.origin,
+              subject: session.subject,
+            )) {
+          throw AccountFailure.denied;
+        }
+      } else if (identity is! Map || identity['pubkey_hex'] != pubkey) {
+        throw AccountFailure.denied;
+      }
+      final value = await account.relayAssertion(
+        relay,
+        config.nsec!,
+        expectedSubject: session.subject,
+      );
+      final token = value['assertion'];
+      final expiry = value['expires_at'];
+      if (token is! String ||
+          token.isEmpty ||
+          token.length > 16384 ||
+          token.contains(RegExp(r'[\r\n]')) ||
+          value['nostr_pubkey'] != pubkey ||
+          expiry is! int) {
+        throw AccountFailure.invalidResponse;
+      }
+      final now = _now().millisecondsSinceEpoch ~/ 1000;
+      if (expiry <= now || expiry > now + 300) {
+        throw AccountFailure.invalidResponse;
+      }
+      final expires = DateTime.fromMillisecondsSinceEpoch(
+        expiry * 1000,
+        isUtc: true,
+      );
+      if (_disposed) throw AccountFailure.unavailable;
+      if (!identical(session, account.account)) {
+        return;
+      }
+      _cached = (
+        relay: relay,
+        pubkey: pubkey,
+        token: token,
+        expiry: expires.subtract(
+          Duration(seconds: (expiry - now) > 60 ? 30 : (expiry - now) ~/ 2),
+        ),
+        account: session,
+      );
+      // Issuance alone cannot prove admission after a relay refusal.
+      if (failure != AccountFailure.denied) connected(config);
+    } on AccountFailure catch (error) {
+      if (!_disposed) {
+        failedRelay = config.baseUrl;
+        failedPubkey = pubkey;
+        failure = error;
+        notifyListeners();
+      }
+      rethrow;
+    }
+  }
+
+  /// Clear a scoped failure only after this community actually reconnects.
+  void connected(RelayConfig config) {
+    if (_disposed || (failedRelay != null && failedRelay != config.baseUrl)) {
+      return;
+    }
+    failure = null;
+    failedRelay = null;
+    failedPubkey = null;
+    notifyListeners();
+  }
+
+  void rejected(
+    RelayConfig config,
+    String? usedToken, {
+    bool terminal = false,
+  }) {
+    if (!protects(config) || usedToken == null) return;
+    if ('Bearer ${_cached?.token}' == usedToken) _cached = null;
+    if (terminal && !_disposed) {
+      failedRelay = config.baseUrl;
+      failedPubkey = pubkeyFromNsec(config.nsec);
+      failure = AccountFailure.denied;
+      notifyListeners();
+    }
+  }
+
+  @override
+  void dispose() {
+    _disposed = true;
+    _cached = null;
+    super.dispose();
+  }
+}
+
+/// Captures the signing context with the request. Never follows redirects with
+/// credentials or replays a failed write automatically.
+class HostedRelayHttpClient extends http.BaseClient {
+  HostedRelayHttpClient(
+    this.auth,
+    this.config, {
+    http.Client? inner,
+    this.canSend,
+  }) : _inner = inner ?? http.Client();
+  final HostedRelayAuth auth;
+  final RelayConfig config;
+  final http.Client _inner;
+  final bool Function()? canSend;
+
+  @override
+  Future<http.StreamedResponse> send(http.BaseRequest request) async {
+    final origin = Uri.parse(config.baseUrl);
+    final scoped = request.url.origin == origin.origin && auth.protects(config);
+    if (scoped) {
+      request.followRedirects = false;
+      request.headers.addAll(await auth.headers(config));
+    }
+    if (canSend != null && !canSend!()) {
+      throw StateError('Relay request expired');
+    }
+    final response = await _inner.send(request);
+    if (scoped && (response.statusCode == 401 || response.statusCode == 403)) {
+      auth.rejected(config, request.headers['Nostr-Federated-Identity']);
+    }
+    return response;
+  }
+
+  @override
+  void close() => _inner.close();
+}
diff --git a/mobile/lib/shared/hosted/hpke_backup.dart b/mobile/lib/shared/hosted/hpke_backup.dart
new file mode 100644
index 0000000000..5122160b66
--- /dev/null
+++ b/mobile/lib/shared/hosted/hpke_backup.dart
@@ -0,0 +1,139 @@
+import 'dart:convert';
+import 'dart:typed_data';
+
+import 'package:flutter/services.dart';
+import 'package:nostr/nostr.dart' as nostr;
+
+/// Never include input, plaintext, or native exception details in this error.
+enum HpkeBackupFailure { invalidEnrollment, identityMismatch, unavailable }
+
+/// Seal only enrollment obtained from the fixed-origin authenticated account
+/// client. Never pass recipient material from a relay, deep link or QR payload.
+/// Persist the returned envelope BEFORE upload; retry its exact backup_id and
+/// ciphertext instead of enrolling/sealing again after uncertain responses.
+class HpkeBackup {
+  static const _channel = MethodChannel('buzz/hosted_hpke');
+
+  Future<Map<String, dynamic>> seal({
+    required Map<String, dynamic> enrollment,
+    required String secretHex,
+  }) async {
+    try {
+      final pubkey = nostr.Keys(secretHex).public;
+      if (enrollment['nostr_pubkey'] != pubkey) {
+        throw HpkeBackupFailure.identityMismatch;
+      }
+      final aad = associatedData(enrollment);
+      final recipient = _decode(enrollment['recipient_public_key'] as String);
+      if (recipient.length != 65 || recipient.first != 4) {
+        throw HpkeBackupFailure.invalidEnrollment;
+      }
+      final plaintext = _hex(secretHex, 32);
+      final Map<dynamic, dynamic>? sealed;
+      try {
+        sealed = await _channel.invokeMapMethod<dynamic, dynamic>('seal', {
+          'recipient': recipient,
+          'plaintext': plaintext,
+          'aad': aad,
+        });
+      } finally {
+        plaintext.fillRange(0, plaintext.length, 0);
+      }
+      final enc = sealed?['enc'];
+      final ciphertext = sealed?['ciphertext'];
+      if (enc is! Uint8List ||
+          enc.length != 65 ||
+          enc.first != 4 ||
+          ciphertext is! Uint8List ||
+          ciphertext.length != 48) {
+        throw HpkeBackupFailure.unavailable;
+      }
+      return {
+        for (final field in [
+          'version',
+          'suite',
+          'recipient_key_id',
+          'service_namespace',
+          'owner_id',
+          'backup_id',
+          'nostr_pubkey',
+        ])
+          field: enrollment[field],
+        'enc': _encode(enc),
+        'ciphertext': _encode(ciphertext),
+      };
+    } on HpkeBackupFailure {
+      rethrow;
+    } on PlatformException {
+      throw HpkeBackupFailure.unavailable;
+    } on MissingPluginException {
+      throw HpkeBackupFailure.unavailable;
+    } catch (_) {
+      throw HpkeBackupFailure.invalidEnrollment;
+    }
+  }
+
+  /// Exact v1 wire framing shared with desktop and the recovery service.
+  static Uint8List associatedData(Map<String, dynamic> enrollment) {
+    try {
+      final suite = enrollment['suite'] as Map;
+      if (enrollment['version'] != 1 ||
+          suite['kem_id'] != 16 ||
+          suite['kdf_id'] != 1 ||
+          suite['aead_id'] != 2) {
+        throw HpkeBackupFailure.invalidEnrollment;
+      }
+      final bytes = BytesBuilder(copy: false)
+        ..add(utf8.encode('buzz/nsec-backup/aad/v1'))
+        ..add([1, 0, 16, 0, 1, 0, 2]);
+      for (final field in [
+        'recipient_key_id',
+        'service_namespace',
+        'owner_id',
+      ]) {
+        final value = enrollment[field] as String;
+        final encoded = utf8.encode(value);
+        if (encoded.isEmpty ||
+            encoded.length > 255 ||
+            value.runes.any((r) => r < 32 || (r >= 127 && r <= 159))) {
+          throw HpkeBackupFailure.invalidEnrollment;
+        }
+        bytes.add([0, encoded.length]);
+        bytes.add(encoded);
+      }
+      final id = enrollment['backup_id'] as String;
+      if (!RegExp(
+        r'^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$',
+      ).hasMatch(id)) {
+        throw HpkeBackupFailure.invalidEnrollment;
+      }
+      bytes.add(_hex(id.replaceAll('-', ''), 16));
+      bytes.add(_hex(enrollment['nostr_pubkey'] as String, 32));
+      return bytes.toBytes();
+    } on HpkeBackupFailure {
+      rethrow;
+    } catch (_) {
+      throw HpkeBackupFailure.invalidEnrollment;
+    }
+  }
+
+  static Uint8List _hex(String value, int length) {
+    if (value.length != length * 2 || !RegExp(r'^[0-9a-f]+$').hasMatch(value)) {
+      throw HpkeBackupFailure.invalidEnrollment;
+    }
+    return Uint8List.fromList(
+      List.generate(
+        length,
+        (i) => int.parse(value.substring(i * 2, i * 2 + 2), radix: 16),
+      ),
+    );
+  }
+
+  static String _encode(List<int> bytes) =>
+      base64UrlEncode(bytes).replaceAll('=', '');
+  static Uint8List _decode(String value) {
+    final decoded = base64Url.decode(base64Url.normalize(value));
+    if (_encode(decoded) != value) throw HpkeBackupFailure.invalidEnrollment;
+    return decoded;
+  }
+}
diff --git a/mobile/lib/shared/hosted/self_hosted_entry.dart b/mobile/lib/shared/hosted/self_hosted_entry.dart
new file mode 100644
index 0000000000..9113991ed2
--- /dev/null
+++ b/mobile/lib/shared/hosted/self_hosted_entry.dart
@@ -0,0 +1,177 @@
+import '../storage/serial_queue.dart';
+import 'dart:convert';
+
+import 'package:flutter_secure_storage/flutter_secure_storage.dart';
+import 'package:nostr/nostr.dart' as nostr;
+
+import '../community/community.dart';
+import '../relay/relay_socket.dart';
+import '../storage/secure_storage.dart';
+import 'account_identity_store.dart';
+import 'community_entry_requirements.dart';
+import 'device_identity_source.dart';
+
+/// A self-hosted attempt keeps its key before any network operation. Retrying
+/// after a refused connection or process death never rotates that identity.
+class SelfHostedEntry {
+  SelfHostedEntry({
+    FlutterSecureStorage? storage,
+    DeviceIdentitySource? identities,
+    AccountIdentityStore? accountStore,
+    Future<void> Function(Community)? probe,
+  }) : _storage = storage ?? communitySecureStorage,
+       identities = identities ?? DeviceIdentitySource(),
+       _accountStore = accountStore ?? AccountIdentityStore(),
+       _probe = probe ?? probeRelay;
+
+  final FlutterSecureStorage _storage;
+  final DeviceIdentitySource identities;
+  final AccountIdentityStore _accountStore;
+  final Future<void> Function(Community) _probe;
+  static final _queue = SerialQueue();
+
+  /// Saved keys available for explicit reuse, including a hosted account that
+  /// has not joined any community yet. This performs no account network calls.
+  Future<({List<DeviceIdentityChoice> choices, bool complete})>
+  choices() async {
+    var complete = true;
+    var device = <DeviceIdentityChoice>[];
+    var accounts = <AccountIdentitySnapshot>[];
+    try {
+      device = await identities.choices();
+    } on AccountIdentityFailure {
+      complete = false;
+    }
+    try {
+      accounts = await _accountStore.identities();
+    } on AccountIdentityFailure {
+      complete = false;
+    }
+    return (
+      choices: [
+        ...device,
+        for (final account in accounts)
+          if (!device.any((item) => item.pubkey == account.pubkey))
+            DeviceIdentityChoice(account.pubkey, 'Saved identity'),
+      ],
+      complete: complete,
+    );
+  }
+
+  Future<Community> prepare({
+    required String relay,
+    required String name,
+    String? nsec,
+    String? savedPubkey,
+    bool create = false,
+    required bool Function() isCurrent,
+  }) {
+    final result = _queue.run(() async {
+      CommunityEntryRequirements.requireSelfHosted(relay);
+      final uri = Uri.parse(relay);
+      if (uri.scheme != 'wss' ||
+          uri.host.isEmpty ||
+          uri.userInfo.isNotEmpty ||
+          uri.hasQuery ||
+          uri.hasFragment ||
+          (uri.path.isNotEmpty && uri.path != '/')) {
+        throw const FormatException('Invalid community address');
+      }
+      void check() {
+        if (!isCurrent()) throw StateError('Setup cancelled');
+      }
+
+      check();
+      final key = _pendingKey(relay);
+      final retained = await _storage.read(key: key);
+      String? candidate = nsec;
+      if (savedPubkey != null) {
+        // Selection is explicit: resolve the exact key without requiring a
+        // complete inventory of unrelated account slots.
+        try {
+          candidate = await identities.withIdentity(
+            savedPubkey,
+            (nsec) async => nsec,
+          );
+        } on AccountIdentityFailure {
+          candidate = await _accountStore.withSavedIdentity(
+            savedPubkey,
+            (nsec) async => nsec,
+          );
+        }
+      }
+      if (retained != null) {
+        final retainedPubkey = AccountIdentityStore.publicKeyForNsec(retained);
+        if (candidate != null &&
+            AccountIdentityStore.publicKeyForNsec(candidate) !=
+                retainedPubkey) {
+          // An explicit replacement may follow a refused or uncertain probe.
+          // Preserve the previous key before changing the relay's retry slot.
+          await _accountStore.forPairing(retainedPubkey).create(retained);
+          check();
+        }
+        candidate ??= retained;
+      }
+      if (candidate == null) {
+        if (!create) throw AccountIdentityFailure.absent;
+        final inventory = await choices();
+        if (!inventory.complete) throw AccountIdentityFailure.unreadable;
+        if (inventory.choices.isNotEmpty) {
+          throw AccountIdentityFailure.absent;
+        }
+        candidate = nostr.Keys.generate().nsec;
+      }
+      final pubkey = AccountIdentityStore.publicKeyForNsec(candidate);
+      check();
+      if (retained != candidate) {
+        await _storage.write(key: key, value: candidate);
+        if (await _storage.read(key: key) != candidate) {
+          throw AccountIdentityFailure.unreadable;
+        }
+      }
+      check();
+      final community = Community.create(
+        name: name,
+        relayUrl: relay,
+        pubkey: pubkey,
+        nsec: candidate,
+      );
+      await _probe(community);
+      check();
+      return community;
+    });
+    return result;
+  }
+
+  static String _pendingKey(String relay) =>
+      'buzz_pending_self_hosted_${base64Url.encode(utf8.encode(relay))}';
+
+  /// Retire this exact pending key only after its community is durably saved.
+  Future<void> complete(Community community) => _queue.run(() async {
+    final key = _pendingKey(community.relayUrl);
+    if (await _storage.read(key: key) != community.nsec) return;
+    await _storage.delete(key: key);
+    if (await _storage.read(key: key) != null) {
+      throw AccountIdentityFailure.unreadable;
+    }
+  });
+
+  /// Authentication must succeed before a new community becomes active.
+  static Future<void> probeRelay(Community community) async {
+    final socket = RelaySocket(
+      wsUrl: community.relayUrl,
+      nsec: community.nsec,
+      onMessage: (_) {},
+      onConnected: () {},
+      onDisconnected: (_) {},
+    );
+    try {
+      await socket.connect().timeout(const Duration(seconds: 20));
+      if (socket.state != SocketState.connected) {
+        throw StateError('Community refused entry');
+      }
+    } finally {
+      socket.dispose();
+    }
+  }
+}
diff --git a/mobile/lib/shared/hosted/web_connect_binding.dart b/mobile/lib/shared/hosted/web_connect_binding.dart
new file mode 100644
index 0000000000..ae28d5e6bd
--- /dev/null
+++ b/mobile/lib/shared/hosted/web_connect_binding.dart
@@ -0,0 +1,93 @@
+import 'dart:convert';
+
+import 'package:nostr/nostr.dart' as nostr;
+
+import '../deeplink/deep_link.dart';
+import 'hosted_environment.dart';
+
+/// The owner supplies keys only inside this callback, after authenticating and
+/// resolving identity. Neither this service nor its result retains a secret.
+typedef WithWebConnectKeys =
+    Future<T> Function<T>(Future<T> Function(nostr.Keys keys) operation);
+
+typedef VerifyWebConnectBinding =
+    Future<String> Function({
+      required String subject,
+      required String challengeId,
+      required String nonce,
+      required String signedPayload,
+    });
+
+/// Binds a web challenge using the authenticated account's verification API.
+/// The API must consume it for [subject] and return the verified bound pubkey.
+/// A signature is never returned to a browser: shape checks alone cannot prove
+/// that an incoming challenge belongs to the account signed into the app.
+class WebConnectBindingService {
+  final DateTime Function() now;
+  WebConnectBindingService({DateTime Function()? now})
+    : now = now ?? DateTime.now;
+
+  Future<Uri> complete({
+    required NostrBindDeepLink request,
+    required String subject,
+    required String expectedPubkey,
+    required WithWebConnectKeys withKeys,
+    required VerifyWebConnectBinding verify,
+    bool Function()? isCurrent,
+  }) async {
+    void checkCurrent() {
+      if (isCurrent != null && !isCurrent()) {
+        throw const FormatException('Binding attempt cancelled');
+      }
+    }
+
+    checkCurrent();
+    if (subject.isEmpty || !request.expiresAt.isAfter(now())) {
+      throw const FormatException('Binding request expired or unauthenticated');
+    }
+    final signed = await withKeys<({String payload, String pubkey})>((
+      keys,
+    ) async {
+      if (keys.public.toLowerCase() != expectedPubkey.toLowerCase()) {
+        throw const FormatException('Identity does not match');
+      }
+      final event = nostr.Event.from(
+        kind: 24243,
+        content: '',
+        tags: [
+          for (final field in const [
+            'challenge_id',
+            'nonce',
+            'verification_code',
+            'audience',
+            'action',
+            'protocol',
+            'version',
+            'origin',
+            'expires_at',
+          ])
+            [field, request.fields[field]!],
+        ],
+        secretKey: keys.secret,
+        verify: false,
+      );
+      // Encode through the library's canonical event representation.
+      final payload = event.toJson();
+      if (jsonDecode(payload) is! Map) {
+        throw const FormatException('Invalid signed event');
+      }
+      return (payload: payload, pubkey: keys.public);
+    });
+    checkCurrent();
+    final boundPubkey = await verify(
+      subject: subject,
+      challengeId: request.challengeId,
+      nonce: request.nonce,
+      signedPayload: signed.payload,
+    );
+    if (boundPubkey.toLowerCase() != signed.pubkey.toLowerCase()) {
+      throw const FormatException('Verified identity does not match');
+    }
+    return HostedEnvironment.origin.resolve('/buzz');
+  }
+}
diff --git a/mobile/lib/shared/huddle/huddle_session.dart b/mobile/lib/shared/huddle/huddle_session.dart
index e08d28c5d1..7ce06b81d2 100644
--- a/mobile/lib/shared/huddle/huddle_session.dart
+++ b/mobile/lib/shared/huddle/huddle_session.dart
@@ -6,6 +6,8 @@ import 'package:hooks_riverpod/hooks_riverpod.dart';
 
 import '../../features/age_gate/age_signal_provider.dart';
 import 'huddle_auth.dart';
+import '../hosted/hosted_relay_auth.dart';
+import '../relay/relay_provider.dart';
 import 'huddle_media.dart';
 import 'huddle_transport.dart';
 import 'huddle_wire.dart';
@@ -152,10 +154,15 @@ final huddleMediaFactoryProvider = Provider<HuddleMediaFactory>(
   (_) => MethodChannelHuddleMedia.new,
 );
 
-final huddleTransportFactoryProvider = Provider<HuddleTransportFactory>(
-  (_) =>
-      (parameters) => HuddleTransport(parameters: parameters),
-);
+final huddleTransportFactoryProvider = Provider<HuddleTransportFactory>((ref) {
+  final auth = ref.watch(hostedRelayAuthProvider);
+  return (parameters) => HuddleTransport(
+    parameters: parameters,
+    headers: () => auth.headers(
+      RelayConfig(baseUrl: parameters.relayWebSocketUrl, nsec: parameters.nsec),
+    ),
+  );
+});
 
 final huddleReconnectDelaysProvider = Provider<List<Duration>>(
   (_) => const [
diff --git a/mobile/lib/shared/huddle/huddle_transport.dart b/mobile/lib/shared/huddle/huddle_transport.dart
index 87ed660d04..bfa835c132 100644
--- a/mobile/lib/shared/huddle/huddle_transport.dart
+++ b/mobile/lib/shared/huddle/huddle_transport.dart
@@ -6,14 +6,12 @@ import 'package:flutter/foundation.dart';
 import 'package:web_socket_channel/io.dart';
 import 'package:web_socket_channel/web_socket_channel.dart';
 
+import '../relay/relay_websocket.dart';
 import 'huddle_auth.dart';
 import 'huddle_wire.dart';
 
 typedef HuddleWebSocketFactory = WebSocketChannel Function(Uri uri);
 
-WebSocketChannel _openHuddleWebSocket(Uri uri) =>
-    IOWebSocketChannel.connect(uri, pingInterval: const Duration(seconds: 30));
-
 enum HuddleTransportPhase {
   idle,
   connecting,
@@ -138,7 +136,8 @@ final class HuddleTransport implements HuddleTransportClient {
   final HuddleConnectionParameters parameters;
   final Duration connectTimeout;
   final Duration handshakeTimeout;
-  final HuddleWebSocketFactory _channelFactory;
+  final HuddleWebSocketFactory? _channelFactory;
+  final Future<Map<String, String>> Function()? headers;
 
   final StreamController<HuddleTransportState> _stateController =
       StreamController.broadcast(sync: true);
@@ -167,7 +166,8 @@ final class HuddleTransport implements HuddleTransportClient {
     required this.parameters,
     this.connectTimeout = const Duration(seconds: 8),
     this.handshakeTimeout = const Duration(seconds: 5),
-    HuddleWebSocketFactory channelFactory = _openHuddleWebSocket,
+    HuddleWebSocketFactory? channelFactory,
+    this.headers,
   }) : _channelFactory = channelFactory;
 
   @override
@@ -229,9 +229,22 @@ final class HuddleTransport implements HuddleTransportClient {
     );
 
     try {
-      final channel = _channelFactory(parameters.audioWebSocketUri);
+      final deadline = Stopwatch()..start();
+      final authentication =
+          await headers?.call().timeout(connectTimeout) ??
+          const <String, String>{};
+      if (!_isCurrent(generation)) return;
+      final channel =
+          _channelFactory?.call(parameters.audioWebSocketUri) ??
+          IOWebSocketChannel(
+            openRelayWebSocket(
+              parameters.audioWebSocketUri,
+              headers: authentication,
+              pingInterval: const Duration(seconds: 30),
+            ),
+          );
       _channel = channel;
-      await channel.ready.timeout(connectTimeout);
+      await channel.ready.timeout(connectTimeout - deadline.elapsed);
       if (!_isCurrent(generation)) {
         throw const HuddleTransportError(
           code: HuddleTransportErrorCode.cancelled,
diff --git a/mobile/lib/shared/identity_transfer/nsec_export_sheet.dart b/mobile/lib/shared/identity_transfer/nsec_export_sheet.dart
new file mode 100644
index 0000000000..392392a5a9
--- /dev/null
+++ b/mobile/lib/shared/identity_transfer/nsec_export_sheet.dart
@@ -0,0 +1,137 @@
+import 'dart:async';
+
+import 'package:flutter/material.dart';
+import 'package:flutter_hooks/flutter_hooks.dart';
+import 'package:hooks_riverpod/hooks_riverpod.dart';
+
+import '../community/community.dart';
+import '../security/sensitive_action_authorizer.dart';
+import '../theme/theme.dart';
+import '../utils/string_utils.dart';
+import '../widgets/modal_presentation.dart';
+import 'nsec_transfer.dart';
+
+/// Presents explicit plaintext-export consent before device authentication.
+Future<void> showNsecExportSheet(
+  BuildContext context, {
+  required Community community,
+  required bool Function() isCurrent,
+}) => showBuzzModalBottomSheet<void>(
+  context: context,
+  title: 'Export private key',
+  isScrollControlled: true,
+  builder: (_) => NsecExportSheet(community: community, isCurrent: isCurrent),
+);
+
+/// Public preview and device-authorized export of the selected community key.
+class NsecExportSheet extends HookConsumerWidget {
+  const NsecExportSheet({
+    super.key,
+    required this.community,
+    required this.isCurrent,
+  });
+
+  final Community community;
+  final bool Function() isCurrent;
+
+  @override
+  Widget build(BuildContext context, WidgetRef ref) {
+    final busy = useState(false);
+    final error = useState<String?>(null);
+    return SafeArea(
+      child: SingleChildScrollView(
+        padding: const EdgeInsets.all(Grid.gutter),
+        child: Column(
+          mainAxisSize: MainAxisSize.min,
+          crossAxisAlignment: CrossAxisAlignment.stretch,
+          children: [
+            Text('Identity for ${community.name}'),
+            const SizedBox(height: Grid.xs),
+            SelectableText(
+              fullNpub(community.pubkey ?? '') ?? 'Identity unavailable',
+            ),
+            const SizedBox(height: Grid.sm),
+            const Text(
+              'This file contains your unencrypted private key (nsec). Anyone with it can act as you. Save it somewhere private. Apps you share it with may keep a copy.',
+            ),
+            const SizedBox(height: Grid.sm),
+            if (error.value != null)
+              Text(error.value!, style: TextStyle(color: context.colors.error)),
+            FilledButton(
+              onPressed: busy.value
+                  ? null
+                  : () async {
+                      busy.value = true;
+                      error.value = null;
+                      final session = ref.read(
+                        sensitiveActionAuthorizationSessionProvider,
+                      );
+                      final box = context.findRenderObject() as RenderBox;
+                      final origin = box.localToGlobal(Offset.zero) & box.size;
+                      try {
+                        final exported = await NsecTransfer.exportCommunity(
+                          community: community,
+                          authorize: (biometricOnly) =>
+                              session.authorize(biometricOnly: biometricOnly),
+                          isCurrent: () => context.mounted && isCurrent(),
+                          share: (nsec) async {
+                            // Native authentication can finish before its app-resume
+                            // frame. Do not hand secrets to a background share UI.
+                            final resumed = await _waitForResumedFrame();
+                            if (!resumed ||
+                                !context.mounted ||
+                                !isCurrent() ||
+                                WidgetsBinding.instance.lifecycleState !=
+                                    AppLifecycleState.resumed) {
+                              throw StateError('Export interrupted');
+                            }
+                            return NsecTransfer.shareFile(nsec, origin);
+                          },
+                        );
+                        if (!context.mounted) return;
+                        if (exported) {
+                          Navigator.of(context).pop();
+                        } else {
+                          error.value =
+                              'Export cancelled. Unlock your device and try again.';
+                        }
+                      } catch (_) {
+                        if (context.mounted) {
+                          error.value =
+                              'Could not export this identity. Try again.';
+                        }
+                      } finally {
+                        if (context.mounted) busy.value = false;
+                      }
+                    },
+              child: Text(
+                busy.value ? 'Authorizing…' : 'Save or share private key',
+              ),
+            ),
+          ],
+        ),
+      ),
+    );
+  }
+}
+
+Future<bool> _waitForResumedFrame() async {
+  final binding = WidgetsBinding.instance;
+  if (binding.lifecycleState != AppLifecycleState.resumed) {
+    final resumed = Completer<void>();
+    final listener = AppLifecycleListener(
+      onResume: () {
+        if (!resumed.isCompleted) resumed.complete();
+      },
+    );
+    try {
+      await resumed.future.timeout(const Duration(seconds: 5));
+    } on TimeoutException {
+      return false;
+    } finally {
+      listener.dispose();
+    }
+  }
+  await binding.endOfFrame;
+  return true;
+}
diff --git a/mobile/lib/shared/identity_transfer/nsec_import_sheet.dart b/mobile/lib/shared/identity_transfer/nsec_import_sheet.dart
new file mode 100644
index 0000000000..b5302b448f
--- /dev/null
+++ b/mobile/lib/shared/identity_transfer/nsec_import_sheet.dart
@@ -0,0 +1,145 @@
+import 'package:flutter/material.dart';
+import 'package:flutter_hooks/flutter_hooks.dart';
+
+import '../hosted/account_identity_store.dart';
+import '../theme/theme.dart';
+import '../utils/string_utils.dart';
+import '../widgets/modal_presentation.dart';
+import 'nsec_transfer.dart';
+
+/// Lets the user inspect the public identity before explicitly importing it.
+/// [onImport] is the secure persistence boundary, not an observable UI store.
+Future<bool> showNsecImportSheet(
+  BuildContext context, {
+  required Future<void> Function(String nsec) onImport,
+}) async =>
+    await showBuzzModalBottomSheet<bool>(
+      context: context,
+      title: 'Import identity',
+      isScrollControlled: true,
+      builder: (_) => NsecImportSheet(onImport: onImport),
+    ) ??
+    false;
+
+/// Transient secret input; only public preview and safe errors are displayed.
+class NsecImportSheet extends HookWidget {
+  const NsecImportSheet({super.key, required this.onImport, this.pickFile});
+
+  final Future<void> Function(String nsec) onImport;
+  final Future<String?> Function()? pickFile;
+
+  @override
+  Widget build(BuildContext context) {
+    final input = useTextEditingController();
+    final publicKey = useState<String?>(null);
+    final error = useState<String?>(null);
+    final busy = useState(false);
+
+    Future<void> chooseFile() async {
+      busy.value = true;
+      error.value = null;
+      try {
+        final text = await (pickFile ?? NsecTransfer.pickFile)();
+        if (!context.mounted || text == null) return;
+        final preview = NsecTransfer.preview(text);
+        input.text = text.trim();
+        publicKey.value = preview;
+      } catch (_) {
+        if (context.mounted) {
+          error.value = 'Choose a text file containing one valid nsec.';
+        }
+      } finally {
+        if (context.mounted) busy.value = false;
+      }
+    }
+
+    Future<void> submit() async {
+      error.value = null;
+      try {
+        final preview = NsecTransfer.preview(input.text);
+        if (publicKey.value != preview) {
+          publicKey.value = preview;
+          return;
+        }
+        busy.value = true;
+        await onImport(input.text.trim());
+        if (!context.mounted) return;
+        input.clear();
+        Navigator.of(context).pop(true);
+      } catch (failure) {
+        if (!context.mounted) return;
+        error.value = switch (failure) {
+          AccountIdentityFailure.occupied || AccountIdentityFailure.mismatch =>
+            'This device already has a different identity. It has not been replaced.',
+          AccountIdentityFailure.invalidKey =>
+            'Enter a valid nsec private key.',
+          _ =>
+            'Could not finish importing this identity. Try again with the same key.',
+        };
+      } finally {
+        if (context.mounted) busy.value = false;
+      }
+    }
+
+    return SafeArea(
+      child: SingleChildScrollView(
+        padding: EdgeInsets.fromLTRB(
+          Grid.gutter,
+          Grid.xs,
+          Grid.gutter,
+          Grid.gutter + MediaQuery.viewInsetsOf(context).bottom,
+        ),
+        child: Column(
+          mainAxisSize: MainAxisSize.min,
+          crossAxisAlignment: CrossAxisAlignment.stretch,
+          children: [
+            const Text(
+              'Your nsec is your private key. Only import a key you trust. It is never copied to the clipboard.',
+            ),
+            const SizedBox(height: Grid.sm),
+            TextField(
+              controller: input,
+              maxLength: 1024,
+              enabled: !busy.value,
+              obscureText: true,
+              autocorrect: false,
+              enableSuggestions: false,
+              enableIMEPersonalizedLearning: false,
+              decoration: const InputDecoration(
+                labelText: 'Private key (nsec)',
+              ),
+              onChanged: (_) {
+                publicKey.value = null;
+                error.value = null;
+              },
+            ),
+            TextButton(
+              onPressed: busy.value ? null : chooseFile,
+              child: const Text('Choose nsec file'),
+            ),
+            if (publicKey.value != null) ...[
+              const Text(
+                'Confirm this is the public identity you want to use:',
+              ),
+              const SizedBox(height: Grid.xs),
+              SelectableText(fullNpub(publicKey.value!)!),
+              const SizedBox(height: Grid.sm),
+            ],
+            if (error.value != null)
+              Text(error.value!, style: TextStyle(color: context.colors.error)),
+            FilledButton(
+              onPressed: busy.value ? null : submit,
+              child: Text(
+                busy.value
+                    ? 'Importing…'
+                    : publicKey.value == null
+                    ? 'Preview identity'
+                    : 'Import this identity',
+              ),
+            ),
+          ],
+        ),
+      ),
+    );
+  }
+}
diff --git a/mobile/lib/shared/identity_transfer/nsec_transfer.dart b/mobile/lib/shared/identity_transfer/nsec_transfer.dart
new file mode 100644
index 0000000000..2e1930b16f
--- /dev/null
+++ b/mobile/lib/shared/identity_transfer/nsec_transfer.dart
@@ -0,0 +1,88 @@
+import 'dart:io';
+
+import 'package:flutter/foundation.dart';
+import 'package:flutter/services.dart';
+import 'package:path_provider/path_provider.dart';
+import 'package:share_plus/share_plus.dart';
+
+import '../hosted/account_identity_store.dart';
+import '../community/community.dart';
+import '../security/sensitive_action_authorizer.dart';
+
+/// Manual transfer boundaries. Exceptions contain no key material.
+abstract final class NsecTransfer {
+  /// Validates a pasted nsec and returns only its public identity.
+  static String preview(String text) {
+    if (text.length > 1024) throw AccountIdentityFailure.invalidKey;
+    return AccountIdentityStore.publicKeyForNsec(text.trim());
+  }
+
+  /// Reads a single small UTF-8 nsec file. Cancellation returns null.
+  static Future<String?> pickFile() async {
+    final text = await const MethodChannel(
+      'buzz/identity_file',
+    ).invokeMethod<String>('import');
+    if (text == null) return null;
+    preview(text);
+    return text.trim();
+  }
+
+  /// Authorizes the selected community identity immediately before export.
+  static Future<bool> exportCommunity({
+    required Community community,
+    required Future<DeviceAuthResult> Function(bool biometricOnly) authorize,
+    required bool Function() isCurrent,
+    required Future<bool> Function(String nsec) share,
+  }) async {
+    final nsec = community.nsec;
+    if (nsec == null || preview(nsec) != community.pubkey) {
+      throw AccountIdentityFailure.mismatch;
+    }
+    final result = await authorize(
+      community.sensitiveActionPolicy == SensitiveActionPolicy.enabled,
+    );
+    if (result != DeviceAuthResult.success || !isCurrent()) return false;
+    return share(nsec);
+  }
+
+  /// Shares a plaintext backup, removing our temporary file on completion.
+  /// The OS share target owns any copy the user chooses to save or send.
+  static Future<bool> shareFile(String nsec, Rect origin) async {
+    preview(nsec);
+    if (defaultTargetPlatform == TargetPlatform.android) {
+      return await const MethodChannel('buzz/identity_file').invokeMethod<bool>(
+            'export',
+            {'text': '${nsec.trim()}\n', 'name': 'buzz-identity.nsec'},
+          ) ??
+          false;
+    }
+    // iOS must apply protection when the secret is first written, not after it.
+    final File file;
+    if (defaultTargetPlatform == TargetPlatform.iOS) {
+      final path = await const MethodChannel(
+        'buzz/identity_file',
+      ).invokeMethod<String>('prepareExport', {'text': '${nsec.trim()}\n'});
+      if (path == null) throw PlatformException(code: 'export_failed');
+      file = File(path);
+    } else {
+      final directory = await (await getTemporaryDirectory()).createTemp(
+        'buzz-identity-',
+      );
+      file = File('${directory.path}/buzz-identity.nsec');
+    }
+    try {
+      if (defaultTargetPlatform != TargetPlatform.iOS) {
+        await file.writeAsString('${nsec.trim()}\n', flush: true);
+      }
+      final result = await SharePlus.instance.share(
+        ShareParams(
+          files: [XFile(file.path, mimeType: 'text/plain')],
+          sharePositionOrigin: origin,
+        ),
+      );
+      return result.status == ShareResultStatus.success;
+    } finally {
+      await file.parent.delete(recursive: true);
+    }
+  }
+}
diff --git a/mobile/lib/shared/push/push_lease_revocation_outbox.dart b/mobile/lib/shared/push/push_lease_revocation_outbox.dart
index 4dcff817be..ba15f58421 100644
--- a/mobile/lib/shared/push/push_lease_revocation_outbox.dart
+++ b/mobile/lib/shared/push/push_lease_revocation_outbox.dart
@@ -4,9 +4,12 @@ import 'dart:math';
 
 import 'package:flutter/foundation.dart';
 import 'package:flutter_secure_storage/flutter_secure_storage.dart';
+
 import 'package:hooks_riverpod/hooks_riverpod.dart';
 import 'package:nostr/nostr.dart' as nostr;
 
+import '../storage/secure_storage.dart';
+
 import '../community/community.dart';
 import '../relay/signed_event_relay.dart';
 import 'dev_push_lease.dart';
@@ -166,7 +169,7 @@ class BuzzPushLeaseRevocationStorage {
   final FlutterSecureStorage _secure;
 
   BuzzPushLeaseRevocationStorage({FlutterSecureStorage? secure})
-    : _secure = secure ?? const FlutterSecureStorage();
+    : _secure = secure ?? communitySecureStorage;
 
   Future<List<BuzzPushLeaseRevocationRecord>> loadAll() async {
     final raw = await _secure.read(key: _key);
diff --git a/mobile/lib/shared/relay/media_auth.dart b/mobile/lib/shared/relay/media_auth.dart
index 8611ce5b56..cc423a99c6 100644
--- a/mobile/lib/shared/relay/media_auth.dart
+++ b/mobile/lib/shared/relay/media_auth.dart
@@ -31,6 +31,7 @@ const _mediaGetAuthRefreshMarginSeconds = 60;
 class MediaGetAuthService {
   final String _baseUrl;
   final String? _nsec;
+  final String? _pubkey;
   final DateTime Function() _now;
 
   Map<String, String>? _cachedHeaders;
@@ -39,9 +40,11 @@ class MediaGetAuthService {
   MediaGetAuthService({
     required String baseUrl,
     required String? nsec,
+    String? pubkey,
     DateTime Function()? now,
   }) : _baseUrl = baseUrl,
        _nsec = nsec,
+       _pubkey = pubkey,
        _now = now ?? DateTime.now;
 
   bool isRelayMediaUrl(String url) {
@@ -122,6 +125,8 @@ class MediaGetAuthService {
       content: 'Get buzz-media',
       tags: tags,
       secretKey: privkeyHex,
+      // Deriving the pubkey costs about a third of a signature, per image.
+      pubkey: _pubkey,
       verify: false,
     );
   }
@@ -129,7 +134,11 @@ class MediaGetAuthService {
 
 final mediaGetAuthServiceProvider = Provider<MediaGetAuthService>((ref) {
   final config = ref.watch(relayConfigProvider);
-  return MediaGetAuthService(baseUrl: config.baseUrl, nsec: config.nsec);
+  return MediaGetAuthService(
+    baseUrl: config.baseUrl,
+    nsec: config.nsec,
+    pubkey: ref.watch(myPubkeyProvider),
+  );
 });
 
 Map<String, String> mediaGetHeadersFor(WidgetRef ref, String url) {
diff --git a/mobile/lib/shared/relay/media_image.dart b/mobile/lib/shared/relay/media_image.dart
index 4b5aa5ccb8..857fbcd663 100644
--- a/mobile/lib/shared/relay/media_image.dart
+++ b/mobile/lib/shared/relay/media_image.dart
@@ -6,13 +6,14 @@ import 'package:flutter/material.dart';
 import 'package:hooks_riverpod/hooks_riverpod.dart';
 import 'package:http/http.dart' as http;
 
+import '../hosted/hosted_relay_auth.dart';
 import 'media_auth.dart';
 
 /// Shared, keep-alive HTTP client for media fetches. One client per container
 /// so TLS connections are reused across images instead of re-handshaking per
 /// fetch. Override in tests to stub the network.
 final mediaHttpClientProvider = Provider<http.Client>((ref) {
-  final client = http.Client();
+  final client = ref.watch(hostedHttpClientFactoryProvider)();
   ref.onDispose(client.close);
   return client;
 });
@@ -132,7 +133,7 @@ class MediaImageProvider extends ImageProvider<MediaImageProvider> {
       }
       onBytesLoaded?.call(bytes);
       final buffer = await ui.ImmutableBuffer.fromUint8List(bytes);
-      return decode(buffer);
+      return await decode(buffer);
     } catch (_) {
       // Match NetworkImage: make sure an errored key is not retained in the
       // cache. The cooldown map (not the cache) throttles retries.
diff --git a/mobile/lib/shared/relay/media_upload.dart b/mobile/lib/shared/relay/media_upload.dart
index 21f5de4df2..f94b476172 100644
--- a/mobile/lib/shared/relay/media_upload.dart
+++ b/mobile/lib/shared/relay/media_upload.dart
@@ -16,6 +16,7 @@ import 'animated_image_sanitizer.dart';
 import 'media_auth.dart';
 import 'mp4_fast_start.dart';
 import 'relay_provider.dart';
+import '../hosted/hosted_relay_auth.dart';
 
 part 'media_upload/platform_bindings.dart';
 part 'media_upload/helpers.dart';
diff --git a/mobile/lib/shared/relay/media_upload/platform_bindings.dart b/mobile/lib/shared/relay/media_upload/platform_bindings.dart
index 527871f11f..2f8d0c7ad1 100644
--- a/mobile/lib/shared/relay/media_upload/platform_bindings.dart
+++ b/mobile/lib/shared/relay/media_upload/platform_bindings.dart
@@ -13,8 +13,11 @@ Future<bool> requiresLegacyMediaStoragePermission() async {
 
 final mediaUploadServiceProvider = Provider<MediaUploadService>((ref) {
   final config = ref.watch(relayConfigProvider);
+  final client = ref.watch(hostedHttpClientFactoryProvider)();
+  ref.onDispose(client.close);
   final picker = ImagePicker();
   final service = MediaUploadService(
+    httpClient: client,
     baseUrl: config.baseUrl,
     nsec: config.nsec,
     pickGalleryImage: () => picker.pickImage(
diff --git a/mobile/lib/shared/relay/relay_http_query_client.dart b/mobile/lib/shared/relay/relay_http_query_client.dart
index 615b28f64c..71f9bc1fd9 100644
--- a/mobile/lib/shared/relay/relay_http_query_client.dart
+++ b/mobile/lib/shared/relay/relay_http_query_client.dart
@@ -20,14 +20,23 @@ class RelayHttpQueryClient {
     required Map<String, String> headers,
     required List<int> body,
     required Duration timeout,
+    http.Client Function(http.Client, bool Function())? decorate,
   }) async {
     final generation = _injectedClient == null
         ? (_currentGeneration ??= _createGeneration())
         : null;
     generation?.acquire();
+    var active = true;
     try {
-      return await (_injectedClient ?? generation!.client)
-          .post(url, headers: headers, body: body)
+      final request = http.Request('POST', url)
+        ..followRedirects = false
+        ..headers.addAll(headers)
+        ..bodyBytes = body;
+      final transport = _injectedClient ?? generation!.client;
+      final client = decorate?.call(transport, () => active) ?? transport;
+      return await client
+          .send(request)
+          .then(http.Response.fromStream)
           .timeout(timeout);
     } on TimeoutException {
       if (identical(_currentGeneration, generation)) {
@@ -36,6 +45,7 @@ class RelayHttpQueryClient {
       generation?.retire();
       rethrow;
     } finally {
+      active = false;
       generation?.release();
     }
   }
diff --git a/mobile/lib/shared/relay/relay_provider.dart b/mobile/lib/shared/relay/relay_provider.dart
index 7e3f0d00a2..c60f57bb29 100644
--- a/mobile/lib/shared/relay/relay_provider.dart
+++ b/mobile/lib/shared/relay/relay_provider.dart
@@ -1,6 +1,7 @@
 import 'package:hooks_riverpod/hooks_riverpod.dart';
 import 'package:nostr/nostr.dart' as nostr;
 
+import '../hosted/hosted_relay_auth.dart';
 import '../community/community_provider.dart';
 import 'relay_client.dart';
 
@@ -131,7 +132,10 @@ final myPubkeyProvider = Provider<String?>((ref) {
 /// through the relay WebSocket session.
 final relayClientProvider = Provider<RelayClient>((ref) {
   final config = ref.watch(relayConfigProvider);
-  final client = RelayClient(baseUrl: config.baseUrl);
+  final client = RelayClient(
+    baseUrl: config.baseUrl,
+    httpClient: ref.watch(hostedHttpClientFactoryProvider)(),
+  );
   ref.onDispose(client.dispose);
   return client;
 });
diff --git a/mobile/lib/shared/relay/relay_session.dart b/mobile/lib/shared/relay/relay_session.dart
index 70b175fad7..3173afc85f 100644
--- a/mobile/lib/shared/relay/relay_session.dart
+++ b/mobile/lib/shared/relay/relay_session.dart
@@ -12,6 +12,8 @@ import 'package:hooks_riverpod/hooks_riverpod.dart';
 
 import '../../features/age_gate/age_signal_provider.dart';
 import '../auth/auth.dart';
+import '../hosted/hosted_relay_auth.dart';
+import '../hosted/builderlab_account.dart';
 import 'nostr_filters.dart';
 import 'nostr_models.dart';
 import 'relay_client.dart';
@@ -243,11 +245,19 @@ class RelaySessionNotifier extends Notifier<SessionState> {
           url: url,
           bodyBytes: bodyBytes,
           nsec: config.nsec,
+          pubkey: ref.read(myPubkeyProvider),
         ),
         'Content-Type': 'application/json',
       },
       body: bodyBytes,
       timeout: timeout,
+      decorate: (client, active) => HostedRelayHttpClient(
+        ref.read(hostedRelayAuthProvider),
+        config,
+        inner: client,
+        canSend: () =>
+            active() && !_disposed && generation == _contextGeneration,
+      ),
     );
     if (_disposed || _ageRestricted || generation != _contextGeneration) {
       throw StateError('Relay query belongs to a retired session');
@@ -549,7 +559,7 @@ class RelaySessionNotifier extends Notifier<SessionState> {
     _connect(config);
   }
 
-  Future<void> _connect(RelayConfig config) async {
+  Future<void> _connect(RelayConfig config, {bool renewed = false}) async {
     if (_disposed || _ageRestricted) return;
 
     final generation = ++_connectionGeneration;
@@ -561,23 +571,48 @@ class RelaySessionNotifier extends Notifier<SessionState> {
     );
 
     _socket?.dispose();
-    final socket = _socketFactory(
+    late final RelaySocket socket;
+    socket = _socketFactory(
       wsUrl: config.wsUrl,
       nsec: config.nsec,
       onMessage: (message) {
         if (generation == _connectionGeneration) _handleMessage(message);
       },
       onConnected: () => _handleConnected(generation),
-      onDisconnected: (error) => _handleDisconnected(generation, error),
+      onDisconnected: (error) {
+        if (_disposed || generation != _connectionGeneration) return;
+        final auth = ref.read(hostedRelayAuthProvider);
+        if (auth.protects(config) && relayUpgradeRefused(error)) {
+          auth.rejected(
+            config,
+            socket.headers['Nostr-Federated-Identity'],
+            terminal: renewed,
+          );
+          if (!renewed) {
+            unawaited(_connect(config, renewed: true));
+            return;
+          }
+          error = AccountFailure.denied;
+        }
+        _handleDisconnected(generation, error);
+      },
     );
     _socket = socket;
 
-    await socket.connect();
+    try {
+      final auth = ref.read(hostedRelayAuthProvider);
+      if (auth.protects(config)) socket.headers = await auth.headers(config);
+      if (_disposed || generation != _connectionGeneration) return;
+      await socket.connect();
+    } on AccountFailure catch (error) {
+      _handleDisconnected(generation, error);
+    }
   }
 
   Future<void> _handleConnected(int generation) async {
     if (_disposed || generation != _connectionGeneration) return;
     _socketConnected = true;
+    ref.read(hostedRelayAuthProvider).connected(ref.read(relayConfigProvider));
     _hasConnectedOnce = true;
     _reconnectDelayMs = _baseReconnectDelayMs;
     state = const SessionState(status: SessionStatus.connected);
@@ -593,7 +628,8 @@ class RelaySessionNotifier extends Notifier<SessionState> {
     _eventBuffer.clear();
     _flushTimer?.cancel();
     _flushTimer = null;
-    if (error is RelayAuthRejectedException) {
+    if (error is RelayAuthRejectedException ||
+        (error is AccountFailure && error != AccountFailure.unavailable)) {
       _reconnectTimer?.cancel();
       state = const SessionState(status: SessionStatus.disconnected);
       return;
diff --git a/mobile/lib/shared/relay/relay_session_auth.dart b/mobile/lib/shared/relay/relay_session_auth.dart
index 9c6c79ae02..a198fc0151 100644
--- a/mobile/lib/shared/relay/relay_session_auth.dart
+++ b/mobile/lib/shared/relay/relay_session_auth.dart
@@ -1,10 +1,13 @@
 part of 'relay_session.dart';
 
+/// Pass the signer's hex [pubkey] when it is already known: deriving it from
+/// the key costs about a third of a signature, on the UI isolate.
 String buildNip98AuthHeader({
   required String method,
   required String url,
   required List<int> bodyBytes,
   required String? nsec,
+  String? pubkey,
 }) {
   if (nsec == null || nsec.isEmpty) {
     throw Exception('Cannot query relay: no signing key available');
@@ -27,6 +30,7 @@ String buildNip98AuthHeader({
       ['nonce', const Uuid().v4()],
     ],
     secretKey: privkeyHex,
+    pubkey: pubkey,
     verify: false,
   );
   return 'Nostr ${base64.encode(utf8.encode(event.toJson()))}';
diff --git a/mobile/lib/shared/relay/relay_socket.dart b/mobile/lib/shared/relay/relay_socket.dart
index 5b23279e81..858f17e8e1 100644
--- a/mobile/lib/shared/relay/relay_socket.dart
+++ b/mobile/lib/shared/relay/relay_socket.dart
@@ -1,3 +1,4 @@
+import 'dart:io';
 import 'dart:async';
 import 'dart:convert';
 
@@ -7,6 +8,7 @@ import 'package:web_socket_channel/io.dart';
 import 'package:web_socket_channel/web_socket_channel.dart';
 
 import 'nostr_models.dart';
+import 'relay_websocket.dart';
 
 /// Low-level websocket connection with NIP-42 authentication.
 ///
@@ -52,6 +54,9 @@ class RelaySocket {
 
   SocketState get state => _state;
 
+  /// Scoped assertion supplied by the connection owner before connecting.
+  Map<String, String> headers = const {};
+
   RelaySocket({
     required String wsUrl,
     required String? nsec,
@@ -70,9 +75,12 @@ class RelaySocket {
     _state = SocketState.connecting;
 
     try {
-      _channel = IOWebSocketChannel.connect(
-        Uri.parse(_wsUrl),
-        pingInterval: debugPingInterval,
+      _channel = IOWebSocketChannel(
+        openRelayWebSocket(
+          Uri.parse(_wsUrl),
+          headers: headers,
+          pingInterval: debugPingInterval,
+        ),
       );
       await _channel!.ready;
     } catch (e) {
@@ -259,3 +267,10 @@ class RelaySocket {
     _onMessage(data);
   }
 }
+
+/// HTTP upgrade failures retain their status through WebSocketChannel.
+bool relayUpgradeRefused(Object? error) {
+  if (error is WebSocketChannelException) error = error.inner;
+  return error is WebSocketException &&
+      (error.httpStatusCode == 401 || error.httpStatusCode == 403);
+}
diff --git a/mobile/lib/shared/relay/relay_websocket.dart b/mobile/lib/shared/relay/relay_websocket.dart
new file mode 100644
index 0000000000..a91f19129a
--- /dev/null
+++ b/mobile/lib/shared/relay/relay_websocket.dart
@@ -0,0 +1,53 @@
+import 'dart:async';
+import 'dart:io';
+
+/// WebSocket's default HTTP client follows redirects, including custom headers.
+/// Keep key-bound assertions at their original origin and bound upgrade time.
+Future<WebSocket> openRelayWebSocket(
+  Uri uri, {
+  required Map<String, String> headers,
+  required Duration pingInterval,
+}) async {
+  if (headers.isEmpty) {
+    return WebSocket.connect(
+      uri.toString(),
+    ).then((socket) => socket..pingInterval = pingInterval);
+  }
+  final client = _UpgradeClient();
+  try {
+    return await WebSocket.connect(
+          uri.toString(),
+          headers: headers,
+          customClient: client,
+        )
+        .then((socket) => socket..pingInterval = pingInterval)
+        .timeout(
+          const Duration(seconds: 10),
+          onTimeout: () {
+            client.close(force: true);
+            throw TimeoutException('Relay connection timed out');
+          },
+        );
+  } finally {
+    client.close();
+  }
+}
+
+/// WebSocket.connect uses only openUrl on its supplied HTTP client. Keep this
+/// adapter limited to upgrades instead of exposing a second general transport.
+class _UpgradeClient implements HttpClient {
+  final _inner = HttpClient();
+
+  @override
+  Future<HttpClientRequest> openUrl(String method, Uri url) async {
+    final request = await _inner.openUrl(method, url);
+    request.followRedirects = false;
+    return request;
+  }
+
+  @override
+  void close({bool force = false}) => _inner.close(force: force);
+
+  @override
+  dynamic noSuchMethod(Invocation invocation) => super.noSuchMethod(invocation);
+}
diff --git a/mobile/lib/shared/security/sensitive_action_authorizer.dart b/mobile/lib/shared/security/sensitive_action_authorizer.dart
index b229f63330..b9f92ccf4a 100644
--- a/mobile/lib/shared/security/sensitive_action_authorizer.dart
+++ b/mobile/lib/shared/security/sensitive_action_authorizer.dart
@@ -25,7 +25,7 @@ class LocalSensitiveActionAuthorizer implements SensitiveActionAuthorizer {
   Future<DeviceAuthResult> authorizeIdentityAction({
     required bool biometricOnly,
   }) => _authorize(
-    localizedReason: 'Confirm sending your Buzz identity to desktop',
+    localizedReason: 'Confirm exporting your Buzz identity',
     biometricOnly: biometricOnly,
   );
 
@@ -44,7 +44,7 @@ class LocalSensitiveActionAuthorizer implements SensitiveActionAuthorizer {
       final availableBiometrics = await _authentication
           .getAvailableBiometrics();
       if (availableBiometrics.isEmpty) return DeviceAuthResult.unavailable;
-      return _authorize(
+      return await _authorize(
         localizedReason: 'Enable biometrics for secure actions',
         biometricOnly: true,
       );
diff --git a/mobile/lib/shared/storage/secure_storage.dart b/mobile/lib/shared/storage/secure_storage.dart
new file mode 100644
index 0000000000..6d8f72b380
--- /dev/null
+++ b/mobile/lib/shared/storage/secure_storage.dart
@@ -0,0 +1,18 @@
+import 'package:flutter_secure_storage/flutter_secure_storage.dart';
+
+/// Android caches the first configuration per namespace. Every production
+/// client must use these options: a failed read must never delete a key.
+const secureStorageAndroidOptions = AndroidOptions(resetOnError: false);
+
+/// Preserve the existing community-storage namespace and iOS accessibility.
+const communitySecureStorage = FlutterSecureStorage(
+  aOptions: secureStorageAndroidOptions,
+);
+
+/// Account credentials and identities remain device-only on iOS.
+const accountSecureStorage = FlutterSecureStorage(
+  aOptions: secureStorageAndroidOptions,
+  iOptions: IOSOptions(
+    accessibility: KeychainAccessibility.first_unlock_this_device,
+  ),
+);
diff --git a/mobile/lib/shared/storage/serial_queue.dart b/mobile/lib/shared/storage/serial_queue.dart
new file mode 100644
index 0000000000..270b9f5d23
--- /dev/null
+++ b/mobile/lib/shared/storage/serial_queue.dart
@@ -0,0 +1,10 @@
+/// Serializes operations without letting a failed operation poison later work.
+class SerialQueue {
+  Future<void> _tail = Future<void>.value();
+
+  Future<T> run<T>(Future<T> Function() operation) {
+    final result = _tail.then((_) => operation());
+    _tail = result.then<void>((_) {}, onError: (Object _, StackTrace _) {});
+    return result;
+  }
+}
diff --git a/mobile/lib/shared/theme/buzz_icons.dart b/mobile/lib/shared/theme/buzz_icons.dart
index c7b3140889..9ced63f285 100644
--- a/mobile/lib/shared/theme/buzz_icons.dart
+++ b/mobile/lib/shared/theme/buzz_icons.dart
@@ -5,6 +5,9 @@ import 'package:flutter/widgets.dart';
 /// Semantic names preserve existing call sites; artwork matches buzz-app.
 /// Native iOS controls share Tabler artwork except Back and Close navigation.
 abstract final class BuzzIcons {
+  /// Tabler `filter-2`. Referenced from Dart so release icon pruning retains it.
+  static const filter2 = IconData(0x1014b, fontFamily: 'BuzzTabler');
+
   static const cornerUpLeft = IconData(0xeb77, fontFamily: 'BuzzTabler');
   static const droplet = IconData(0xea97, fontFamily: 'BuzzTabler');
 
diff --git a/mobile/lib/shared/theme/community_theme_sync.dart b/mobile/lib/shared/theme/community_theme_sync.dart
index fdbe5ae3a2..03a109a059 100644
--- a/mobile/lib/shared/theme/community_theme_sync.dart
+++ b/mobile/lib/shared/theme/community_theme_sync.dart
@@ -131,15 +131,13 @@ class CommunityThemeSyncManager {
     if (_disposed) return false;
     final epoch = ++_subscriptionEpoch;
     try {
-      final unsubscribe = await relaySession.subscribe(
-        _themeFilter(limit: 0),
-        (event) {
-          if (_disposed || epoch != _subscriptionEpoch) return;
-          final remote = _decode(event);
-          if (remote != null) _accept(remote);
-        },
-        onClosed: (message) => _handleSubscriptionClosed(epoch, message),
-      );
+      final unsubscribe = await relaySession.subscribe(_themeFilter(limit: 0), (
+        event,
+      ) {
+        if (_disposed || epoch != _subscriptionEpoch) return;
+        final remote = _decode(event);
+        if (remote != null) _accept(remote);
+      }, onClosed: (message) => _handleSubscriptionClosed(epoch, message));
       if (_disposed || epoch != _subscriptionEpoch) {
         unsubscribe();
         return false;
diff --git a/mobile/lib/shared/widgets/buzz_sheet_header.dart b/mobile/lib/shared/widgets/buzz_sheet_header.dart
index e51f6973cd..14353bcd33 100644
--- a/mobile/lib/shared/widgets/buzz_sheet_header.dart
+++ b/mobile/lib/shared/widgets/buzz_sheet_header.dart
@@ -107,7 +107,7 @@ class _SheetCloseButton extends StatelessWidget {
             borderRadius: BorderRadius.circular(Radii.dialog),
           ),
         ),
-        icon: const Icon(BuzzIcons.x, size: 22),
+        icon: const Icon(BuzzIcons.x, size: 24),
       ),
     );
   }
diff --git a/mobile/lib/shared/widgets/ios_glass_navigation_button.dart b/mobile/lib/shared/widgets/ios_glass_navigation_button.dart
index 0c64993478..2a5b93a333 100644
--- a/mobile/lib/shared/widgets/ios_glass_navigation_button.dart
+++ b/mobile/lib/shared/widgets/ios_glass_navigation_button.dart
@@ -258,7 +258,7 @@ class IosGlassNavigationButton extends HookWidget {
                             },
                             size: icon == IosGlassNavigationIcon.shutter
                                 ? controlSize * 0.72
-                                : 22,
+                                : 24,
                             color: icon == IosGlassNavigationIcon.colorSwatch
                                 ? swatchColor
                                 : effectiveForeground,
diff --git a/mobile/lib/shared/widgets/message_author_meta.dart b/mobile/lib/shared/widgets/message_author_meta.dart
index 2de13ad5b5..402c0d1f40 100644
--- a/mobile/lib/shared/widgets/message_author_meta.dart
+++ b/mobile/lib/shared/widgets/message_author_meta.dart
@@ -43,6 +43,12 @@ class MessageAuthorMeta extends StatelessWidget {
   /// Base text style for [timestamp], with [metadataColor] applied.
   final TextStyle timestampStyle;
 
+  /// Mirrors metadata order without changing text reading direction.
+  final bool reversed;
+
+  /// Positions the metadata within the available message width.
+  final MainAxisAlignment alignment;
+
   /// Creates an inline author row with optional username and tap handling.
   const MessageAuthorMeta({
     super.key,
@@ -51,6 +57,8 @@ class MessageAuthorMeta extends StatelessWidget {
     required this.nameColor,
     required this.metadataColor,
     this.username,
+    this.alignment = MainAxisAlignment.start,
+    this.reversed = false,
     this.showTimestamp = true,
     this.onAuthorTap,
     this.displayNameKey,
@@ -91,37 +99,39 @@ class MessageAuthorMeta extends StatelessWidget {
             ? constraints.maxWidth / (showUsername ? 3 : 2)
             : double.infinity;
 
-        return Row(
-          crossAxisAlignment: CrossAxisAlignment.center,
-          children: [
-            Flexible(child: authorName),
-            if (showUsername) ...[
-              const SizedBox(width: Grid.half),
-              ConstrainedBox(
-                constraints: BoxConstraints(maxWidth: metadataMaxWidth),
-                child: Text(
-                  normalizedUsername,
-                  key: usernameKey,
-                  maxLines: 1,
-                  overflow: TextOverflow.ellipsis,
-                  style: resolvedMetadataStyle,
-                ),
+        final children = <Widget>[
+          Flexible(child: authorName),
+          if (showUsername) ...[
+            const SizedBox(width: Grid.half),
+            ConstrainedBox(
+              constraints: BoxConstraints(maxWidth: metadataMaxWidth),
+              child: Text(
+                normalizedUsername,
+                key: usernameKey,
+                maxLines: 1,
+                overflow: TextOverflow.ellipsis,
+                style: resolvedMetadataStyle,
               ),
-            ],
-            if (showTimestamp) ...[
-              const SizedBox(width: Grid.xxs),
-              ConstrainedBox(
-                constraints: BoxConstraints(maxWidth: metadataMaxWidth),
-                child: Text(
-                  timestamp,
-                  key: timestampKey,
-                  maxLines: 1,
-                  overflow: TextOverflow.ellipsis,
-                  style: resolvedTimestampStyle,
-                ),
-              ),
-            ],
+            ),
           ],
+          if (showTimestamp) ...[
+            const SizedBox(width: Grid.xxs),
+            ConstrainedBox(
+              constraints: BoxConstraints(maxWidth: metadataMaxWidth),
+              child: Text(
+                timestamp,
+                key: timestampKey,
+                maxLines: 1,
+                overflow: TextOverflow.ellipsis,
+                style: resolvedTimestampStyle,
+              ),
+            ),
+          ],
+        ];
+        return Row(
+          mainAxisAlignment: alignment,
+          crossAxisAlignment: CrossAxisAlignment.center,
+          children: reversed ? children.reversed.toList() : children,
         );
       },
     );
diff --git a/mobile/pubspec.lock b/mobile/pubspec.lock
index 12f1c7966d..2bfd5e1656 100644
--- a/mobile/pubspec.lock
+++ b/mobile/pubspec.lock
@@ -290,7 +290,7 @@ packages:
     source: hosted
     version: "0.3.5+2"
   crypto:
-    dependency: "direct dev"
+    dependency: "direct main"
     description:
       name: crypto
       sha256: c8ea0233063ba03258fbcf2ca4d6dadfefe14f02fab57702265467a19f27fadf
@@ -825,7 +825,7 @@ packages:
     source: hosted
     version: "0.4.16"
   leak_tracker:
-    dependency: transitive
+    dependency: "direct dev"
     description:
       name: leak_tracker
       sha256: "33e2e26bdd85a0112ec15400c8cbffea70d0f9c3407491f672a2fad47915e2de"
@@ -908,10 +908,10 @@ packages:
     dependency: transitive
     description:
       name: matcher
-      sha256: dc0b7dc7651697ea4ff3e69ef44b0407ea32c487a39fff6a4004fa585e901861
+      sha256: "31bd099b47c10cd1aeb55146a2d46ce0277630ecef3f7dae54ad7873f36696cd"
       url: "https://pub.dev"
     source: hosted
-    version: "0.12.19"
+    version: "0.12.20"
   material_color_utilities:
     dependency: transitive
     description:
@@ -924,10 +924,10 @@ packages:
     dependency: transitive
     description:
       name: meta
-      sha256: "23f08335362185a5ea2ad3a4e597f1375e78bce8a040df5c600c8d3552ef2394"
+      sha256: "307249ce4ff29d58a18e97f6345f539382eb9c9c29ecda628900f31de0443dd9"
       url: "https://pub.dev"
     source: hosted
-    version: "1.17.0"
+    version: "1.19.0"
   mime:
     dependency: transitive
     description:
@@ -1481,26 +1481,26 @@ packages:
     dependency: transitive
     description:
       name: test
-      sha256: "280d6d890011ca966ad08df7e8a4ddfab0fb3aa49f96ed6de56e3521347a9ae7"
+      sha256: ca578dc12bb8b2f40b67b7d3bd2fac4f31c01a6ff7130a14e2597b919934507f
       url: "https://pub.dev"
     source: hosted
-    version: "1.30.0"
+    version: "1.31.1"
   test_api:
     dependency: transitive
     description:
       name: test_api
-      sha256: "8161c84903fd860b26bfdefb7963b3f0b68fee7adea0f59ef805ecca346f0c7a"
+      sha256: "2a122cbe059f8b610d3a5415f42e255b6c17b1f21eee1d960f31080237fb4f11"
       url: "https://pub.dev"
     source: hosted
-    version: "0.7.10"
+    version: "0.7.12"
   test_core:
     dependency: transitive
     description:
       name: test_core
-      sha256: "0381bd1585d1a924763c308100f2138205252fb90c9d4eeaf28489ee65ccde51"
+      sha256: d2e98ec12998368dc59ddd47ab709f2cd55acd6b66dc7db764455a44082f4bc5
       url: "https://pub.dev"
     source: hosted
-    version: "0.6.16"
+    version: "0.6.18"
   tuple:
     dependency: transitive
     description:
@@ -1617,10 +1617,10 @@ packages:
     dependency: transitive
     description:
       name: vector_math
-      sha256: d530bd74fea330e6e364cda7a85019c434070188383e1cd8d9777ee586914c5b
+      sha256: "92b9910f66ed1057fd4da7b040ae7c74cafacf885bdc81be496928d5049b032d"
       url: "https://pub.dev"
     source: hosted
-    version: "2.2.0"
+    version: "2.4.3"
   video_player:
     dependency: "direct main"
     description:
@@ -1751,4 +1751,4 @@ packages:
     version: "2.2.4"
 sdks:
   dart: ">=3.11.4 <4.0.0"
-  flutter: ">=3.38.4"
+  flutter: ">=3.47.7"
diff --git a/mobile/pubspec.yaml b/mobile/pubspec.yaml
index f96ee6a2bd..133a0fcf4e 100644
--- a/mobile/pubspec.yaml
+++ b/mobile/pubspec.yaml
@@ -5,6 +5,7 @@ version: 0.0.0+1
 
 environment:
   sdk: ^3.11.4
+  flutter: ">=3.47.7"
 
 dependencies:
   flutter:
@@ -17,6 +18,7 @@ dependencies:
   hooks_riverpod: ^3.0.3
   flutter_hooks: ^0.21.3
   http: ^1.4.0
+  crypto: ^3.0.7
   flutter_secure_storage: ^10.0.0
   flutter_svg: ^2.2.4
   mobile_scanner: ^7.0.0
@@ -49,13 +51,13 @@ dependencies:
   local_auth: ^3.0.2
 
 dev_dependencies:
+  leak_tracker: ^11.0.2
   shared_preferences_platform_interface: ^2.4.2
   flutter_test:
     sdk: flutter
   flutter_lints: ^6.0.0
   fake_async: ^1.3.3
   camera_platform_interface: ^2.13.1
-  crypto: ^3.0.7
   custom_lint: ^0.8.0
   riverpod_lint: ^3.1.0
   mocktail: ^1.0.4
@@ -65,6 +67,8 @@ dev_dependencies:
   video_player_platform_interface: ^6.6.0
 
 flutter:
+  config:
+    enable-swift-package-manager: false
   uses-material-design: true
   shaders:
     - shaders/onboarding_wordmark.frag
diff --git a/mobile/test/features/age_gate/age_gate_app_test.dart b/mobile/test/features/age_gate/age_gate_app_test.dart
index 5a378fe656..6e0076573c 100644
--- a/mobile/test/features/age_gate/age_gate_app_test.dart
+++ b/mobile/test/features/age_gate/age_gate_app_test.dart
@@ -513,7 +513,12 @@ class _RecordingPairAuthNotifier extends _UnauthenticatedAuthNotifier {
   int imports = 0;
 
   @override
-  Future<void> authenticateWithCommunity(Community community) async {
+  Future<void> authenticateWithCommunity(
+    Community community, {
+    bool Function()? shouldContinue,
+    bool activate = true,
+  }) async {
+    if (shouldContinue != null && !shouldContinue()) return;
     imports += 1;
   }
 }
diff --git a/mobile/test/features/channels/channel_detail_page_test.dart b/mobile/test/features/channels/channel_detail_page_test.dart
index 4f212b3952..1f9ca1e029 100644
--- a/mobile/test/features/channels/channel_detail_page_test.dart
+++ b/mobile/test/features/channels/channel_detail_page_test.dart
@@ -97,6 +97,7 @@ part 'channel_detail_page_test/loading_review_tests.dart';
 part 'channel_detail_page_test/presence_tests.dart';
 part 'channel_detail_page_test/action_row_tests.dart';
 part 'channel_detail_page_test/bubble_tests.dart';
+part 'channel_detail_page_test/swipe_reply_tests.dart';
 part 'channel_detail_page_test/review_avatar_tests.dart';
 
 const _channelId = '11111111-2222-4333-8444-555555555555';
@@ -566,6 +567,7 @@ void main() {
   presenceTests();
   actionRowTests();
   bubbleLayoutTests();
+  swipeReplyTests();
   reviewAvatarTests();
   setUp(() async {
     SharedPreferences.setMockInitialValues({});
@@ -3637,6 +3639,55 @@ void main() {
       );
     });
 
+    testWidgets('activity in another channel does not rebuild the open chat', (
+      tester,
+    ) async {
+      final otherChannel = Channel(
+        id: _otherChannelId,
+        name: 'random',
+        channelType: 'stream',
+        visibility: 'open',
+        description: '',
+        createdBy: 'abc123',
+        createdAt: DateTime(2025),
+        memberCount: 5,
+        isMember: true,
+      );
+      final channelsNotifier = _FakeChannelsNotifier([
+        _testChannel,
+        otherChannel,
+      ]);
+      await tester.pumpWidget(
+        _buildTestable(
+          messages: [
+            for (var i = 0; i < 5; i++)
+              _textMsg(
+                id: 'msg$i',
+                pubkey: 'alice',
+                content: 'Message $i, see #random',
+                createdAt: 1000 + i,
+              ),
+          ],
+          channelsNotifier: channelsNotifier,
+        ),
+      );
+      await tester.pumpAndSettle();
+      expect(find.byType(MessageContent), findsWidgets);
+
+      final rebuilt = <Widget>[];
+      debugOnRebuildDirtyWidget = (element, _) => rebuilt.add(element.widget);
+      addTearDown(() => debugOnRebuildDirtyWidget = null);
+
+      // A live event elsewhere republishes the whole list.
+      channelsNotifier.setChannels([
+        _testChannel,
+        otherChannel.copyWith(lastMessageAt: DateTime.utc(2026)),
+      ]);
+      await tester.pumpAndSettle();
+
+      expect(rebuilt.whereType<MessageContent>(), isEmpty);
+    });
+
     testWidgets('clears the composer inset when membership is revoked', (
       tester,
     ) async {
@@ -4548,12 +4599,22 @@ void main() {
     });
 
     for (final gesture in ['status bar', 'scroll']) {
-      testWidgets(
-        'Me history uses selected provider for $gesture',
-        (tester) async {
-          final notifier = _FakeMessagesNotifier(
+      testWidgets('Me history uses selected provider for $gesture', (
+        tester,
+      ) async {
+        final notifier = _FakeMessagesNotifier(
+          [
+            for (var i = 50; i < 250; i++)
+              _textMsg(
+                id: 'msg$i',
+                pubkey: 'alice',
+                content: 'Message $i',
+                createdAt: 1000 + i,
+              ),
+          ],
+          olderPages: [
             [
-              for (var i = 50; i < 250; i++)
+              for (var i = 0; i < 50; i++)
                 _textMsg(
                   id: 'msg$i',
                   pubkey: 'alice',
@@ -4561,64 +4622,52 @@ void main() {
                   createdAt: 1000 + i,
                 ),
             ],
-            olderPages: [
-              [
-                for (var i = 0; i < 50; i++)
-                  _textMsg(
-                    id: 'msg$i',
-                    pubkey: 'alice',
-                    content: 'Message $i',
-                    createdAt: 1000 + i,
-                  ),
-              ],
-            ],
-          );
-          await tester.pumpWidget(
-            _buildTestable(
-              messages: const [],
-              messagesNotifier: notifier,
-              personalChat: true,
-              disableAnimations: true,
+          ],
+        );
+        await tester.pumpWidget(
+          _buildTestable(
+            messages: const [],
+            messagesNotifier: notifier,
+            personalChat: true,
+            disableAnimations: true,
+          ),
+        );
+        await tester.pumpAndSettle();
+        if (gesture == 'status bar') {
+          await tester.binding.defaultBinaryMessenger.handlePlatformMessage(
+            'flutter/status_bar',
+            const JSONMethodCodec().encodeMethodCall(
+              const MethodCall('handleScrollToTop'),
             ),
+            (_) {},
           );
           await tester.pumpAndSettle();
-          if (gesture == 'status bar') {
-            await tester.binding.defaultBinaryMessenger.handlePlatformMessage(
-              'flutter/status_bar',
-              const JSONMethodCodec().encodeMethodCall(
-                const MethodCall('handleScrollToTop'),
-              ),
-              (_) {},
-            );
-            await tester.pumpAndSettle();
-          } else {
-            final list = tester.widget<ScrollablePositionedList>(
-              find.byType(ScrollablePositionedList),
-            );
-            list.itemScrollController!.jumpTo(index: 195);
-            await tester.pumpAndSettle();
-            await tester.drag(
-              find.byType(ScrollablePositionedList),
-              const Offset(0, 350),
-            );
-            await tester.pumpAndSettle();
-          }
-          expect(notifier.fetchOlderCalls, greaterThan(0));
-          if (gesture == 'status bar') {
-            expect(findRichText('Message 0'), findsOneWidget);
-          } else {
-            // Scroll pagination extends the visible provider, even if the user
-            // has not scrolled through every newly loaded row yet.
-            expect(
-              ProviderScope.containerOf(
-                tester.element(find.byType(ChannelDetailPage)),
-              ).read(meMessagesProvider(_channelId)).requireValue.first.id,
-              'msg0',
-            );
-          }
-        },
-        variant: TargetPlatformVariant.only(TargetPlatform.iOS),
-      );
+        } else {
+          final list = tester.widget<ScrollablePositionedList>(
+            find.byType(ScrollablePositionedList),
+          );
+          list.itemScrollController!.jumpTo(index: 195);
+          await tester.pumpAndSettle();
+          await tester.drag(
+            find.byType(ScrollablePositionedList),
+            const Offset(0, 350),
+          );
+          await tester.pumpAndSettle();
+        }
+        expect(notifier.fetchOlderCalls, greaterThan(0));
+        if (gesture == 'status bar') {
+          expect(findRichText('Message 0'), findsOneWidget);
+        } else {
+          // Scroll pagination extends the visible provider, even if the user
+          // has not scrolled through every newly loaded row yet.
+          expect(
+            ProviderScope.containerOf(
+              tester.element(find.byType(ChannelDetailPage)),
+            ).read(meMessagesProvider(_channelId)).requireValue.first.id,
+            'msg0',
+          );
+        }
+      }, variant: TargetPlatformVariant.only(TargetPlatform.iOS));
     }
 
     for (final personal in [false, true]) {
@@ -4978,6 +5027,80 @@ void main() {
       expect(findRichText('Reachable unread'), findsOneWidget);
     });
 
+    testWidgets(
+      'settles the unread jump each time history silently reaches its oldest page',
+      (tester) async {
+        final readMessage = _textMsg(
+          id: 'read',
+          pubkey: 'alice',
+          content: 'Already read',
+          createdAt: 1010,
+        );
+        final messagesNotifier = _SilentOldestMessagesNotifier([readMessage]);
+        final channelsNotifier = _FakeChannelsNotifier(
+          [_testChannel],
+          observedUnread: {
+            _channelId: [
+              for (final (id, createdAt) in [
+                ('never-loaded', 1021),
+                ('reachable-unread', 1022),
+              ])
+                makeObservedUnreadEvent(
+                  id: id,
+                  createdAt: createdAt,
+                  rootId: null,
+                  highPriority: false,
+                  channelType: 'stream',
+                  isThreadedReply: false,
+                ),
+            ],
+          },
+        );
+        final readState = _SynchronousReadStateNotifier(
+          const ReadStateState(
+            isReady: true,
+            pubkey: 'self',
+            contexts: {_channelId: 1020},
+            version: 0,
+          ),
+        );
+        final unreadButton = find.byKey(
+          const ValueKey('channel-jump-to-oldest-unread'),
+        );
+
+        await tester.pumpWidget(
+          _buildTestable(
+            messages: const [],
+            messagesNotifier: messagesNotifier,
+            channelsNotifier: channelsNotifier,
+            readStateNotifier: readState,
+            users: const {
+              'alice': UserProfile(pubkey: 'alice', displayName: 'Alice'),
+            },
+          ),
+        );
+        await _settleThenFinishFetch(tester);
+        // The first fetch reached the oldest page with no unread row loaded.
+        expect(messagesNotifier.fetchOlderCalls, 1);
+        expect(unreadButton, findsNothing);
+
+        // A reconnect forgets the oldest page and reloads the window, now
+        // with an unread row; the next fetch reaches the oldest page again.
+        messagesNotifier.reconnect([
+          readMessage,
+          _textMsg(
+            id: 'reachable-unread',
+            pubkey: 'alice',
+            content: 'Reachable unread',
+            createdAt: 1022,
+          ),
+        ]);
+        await _settleThenFinishFetch(tester);
+        expect(messagesNotifier.fetchOlderCalls, 2);
+        expect(unreadButton, findsOneWidget);
+      },
+    );
+
     testWidgets('pages past a loaded forced unread for an older target', (
       tester,
     ) async {
@@ -5679,7 +5802,7 @@ void main() {
     for (final platform in [TargetPlatform.iOS, TargetPlatform.android]) {
       for (final multiline in [false, true]) {
         testWidgets(
-          'group avatar stays fixed throughout a local send: $platform, multiline=$multiline',
+          'outgoing group stays avatar-free throughout a local send: $platform, multiline=$multiline',
           (tester) async {
             final previousPlatform = debugDefaultTargetPlatformOverride;
             debugDefaultTargetPlatformOverride = platform;
@@ -5710,7 +5833,7 @@ void main() {
                 of: find.byKey(ValueKey('message-row-$id')),
                 matching: find.byType(AvatarImage),
               );
-              final before = tester.getRect(avatar('first'));
+              expect(avatar('first'), findsNothing);
               final container = ProviderScope.containerOf(
                 tester.element(find.byType(ChannelDetailPage)),
               );
@@ -5730,19 +5853,19 @@ void main() {
               ]);
               for (var frame = 0; frame < 32; frame++) {
                 await tester.pump(const Duration(milliseconds: 16));
-                final visibleAvatar = avatar('second').evaluate().isNotEmpty
-                    ? avatar('second')
-                    : avatar('first');
-                expect(visibleAvatar, findsOneWidget);
-                final current = tester.getRect(visibleAvatar);
                 expect(
-                  current.top,
-                  closeTo(before.top, 1),
-                  reason: 'avatar frame $frame',
+                  avatar('first'),
+                  findsNothing,
+                  reason: 'first avatar frame $frame',
+                );
+                expect(
+                  avatar('second'),
+                  findsNothing,
+                  reason: 'second avatar frame $frame',
                 );
               }
               await tester.pumpAndSettle();
-              expect(avatar('second'), findsOneWidget);
+              expect(avatar('second'), findsNothing);
             } finally {
               debugDefaultTargetPlatformOverride = previousPlatform;
             }
@@ -6508,6 +6631,51 @@ void main() {
       },
     );
 
+    testWidgets('own ended huddle reclaims avatar space and aligns reactions', (
+      tester,
+    ) async {
+      await tester.pumpWidget(
+        _buildTestable(
+          signingPubkey: 'alice',
+          messages: [
+            _huddleMsg(id: 'own-huddle', kind: EventKind.huddleStarted),
+            _huddleMsg(
+              id: 'own-ending',
+              kind: EventKind.huddleEnded,
+              createdAt: 1500,
+            ),
+            _reaction(id: 'own-huddle-reaction', targetId: 'own-huddle'),
+          ],
+        ),
+      );
+      await tester.pumpAndSettle();
+      final card = tester.getRect(
+        find.byKey(const ValueKey('huddle-card-own-huddle')),
+      );
+      expect(
+        find.descendant(
+          of: find.byKey(const ValueKey('huddle-activity-own-huddle')),
+          matching: find.byType(AvatarImage),
+        ),
+        findsNothing,
+      );
+      expect(find.text('Huddle ended'), findsOneWidget);
+      expect(
+        card.right,
+        closeTo(
+          tester
+              .getRect(find.byKey(const ValueKey('huddle-activity-own-huddle')))
+              .right,
+          0.01,
+        ),
+      );
+      final tray = tester.getRect(
+        find.byKey(const ValueKey('combined-reaction-tray')),
+      );
+      expect(tray.right, lessThan(card.right));
+      expect(tray.right, greaterThan(card.center.dx));
+    });
+
     testWidgets('renders a compact huddle activity row', (tester) async {
       await tester.pumpWidget(
         _buildTestable(
@@ -16728,6 +16896,39 @@ class _FakeMessagesNotifier extends ChannelMessagesNotifier {
   }
 }
 
+/// Lets the rows settle while an older fetch is in flight, then lets it finish,
+/// so nothing but the fetch's own completion can rebuild the list afterwards.
+Future<void> _settleThenFinishFetch(WidgetTester tester) async {
+  await tester.pumpAndSettle();
+  await tester.pump(_SilentOldestMessagesNotifier.fetchDelay);
+  await tester.pumpAndSettle();
+}
+
+/// Each older fetch takes a while, then finds the oldest page without
+/// publishing anything, like a window whose cursor has run out.
+class _SilentOldestMessagesNotifier extends _FakeMessagesNotifier {
+  _SilentOldestMessagesNotifier(super.messages);
+
+  static const fetchDelay = Duration(seconds: 5);
+  bool _reachedOldest = false;
+
+  @override
+  bool get reachedOldest => _reachedOldest;
+
+  @override
+  Future<bool> fetchOlder() async {
+    fetchOlderCalls += 1;
+    await Future<void>.delayed(fetchDelay);
+    _reachedOldest = true;
+    return false;
+  }
+
+  void reconnect(List<NostrEvent> messages) {
+    _reachedOldest = false;
+    setMessages(messages);
+  }
+}
+
 /// Counts loads; each settles after mount, like the real network load.
 class _RetryCountingMessagesNotifier extends ChannelMessagesNotifier {
   _RetryCountingMessagesNotifier(this.nextResult) : super(_channelId);
diff --git a/mobile/test/features/channels/channel_detail_page_test/bubble_tests.dart b/mobile/test/features/channels/channel_detail_page_test/bubble_tests.dart
index 454cb733f5..6741a0ce95 100644
--- a/mobile/test/features/channels/channel_detail_page_test/bubble_tests.dart
+++ b/mobile/test/features/channels/channel_detail_page_test/bubble_tests.dart
@@ -1,6 +1,222 @@
 part of '../channel_detail_page_test.dart';
 
 void bubbleLayoutTests() {
+  for (final author in ['self', 'alice']) {
+    testWidgets('date divider owns equal space around $author messages', (
+      tester,
+    ) async {
+      tester.view.physicalSize = const Size(390, 1100);
+      tester.view.devicePixelRatio = 1;
+      addTearDown(tester.view.reset);
+      await tester.pumpWidget(
+        _buildTestable(
+          signingPubkey: 'self',
+          messages: [
+            _textMsg(
+              id: 'before-day',
+              pubkey: author,
+              content: 'Before',
+              createdAt: 1000,
+            ),
+            _textMsg(
+              id: 'after-day',
+              pubkey: author,
+              content: 'After',
+              createdAt: 87400,
+            ),
+          ],
+        ),
+      );
+      await tester.pumpAndSettle();
+      final before = tester.getRect(
+        find
+            .descendant(
+              of: find.byKey(const ValueKey('message-row-before-day')),
+              matching: find.byType(LocalSendBubbleSurface),
+            )
+            .first,
+      );
+      final divider = tester.getRect(
+        find.byKey(const ValueKey('channel-day-divider-opacity-87400')),
+      );
+      final after = tester.getRect(
+        find.byKey(const ValueKey('message-author-after-day')),
+      );
+      expect(
+        divider.top - before.bottom,
+        closeTo(after.top - divider.bottom, 1),
+      );
+      expect(divider.top - before.bottom, closeTo(Grid.gutter, 1));
+      expect(tester.takeException(), isNull);
+    });
+  }
+
+  for (final personalChat in [false, true]) {
+    for (final scale in [1.0, 2.0]) {
+      testWidgets(
+        'viewer bubbles align right: personal=$personalChat scale=$scale',
+        (tester) async {
+          tester.view.physicalSize = const Size(390, 1100);
+          tester.view.devicePixelRatio = 1;
+          addTearDown(tester.view.resetPhysicalSize);
+          addTearDown(tester.view.resetDevicePixelRatio);
+          await tester.pumpWidget(
+            _buildTestable(
+              signingPubkey: 'self',
+              personalChat: personalChat,
+              textScaler: TextScaler.linear(scale),
+              users: const {
+                'self': UserProfile(pubkey: 'self', displayName: 'Me'),
+                'alice': UserProfile(pubkey: 'alice', displayName: 'Alice'),
+              },
+              messages: [
+                _textMsg(
+                  id: 'incoming',
+                  pubkey: 'alice',
+                  content: 'Hello',
+                  createdAt: 1000,
+                ),
+                _textMsg(
+                  id: 'outgoing',
+                  pubkey: 'self',
+                  content: 'Hi',
+                  createdAt: 1001,
+                ),
+                _reaction(
+                  id: 'reaction-in',
+                  targetId: 'incoming',
+                  pubkey: 'self',
+                ),
+                _reaction(
+                  id: 'reaction-out',
+                  targetId: 'outgoing',
+                  pubkey: 'alice',
+                ),
+              ],
+            ),
+          );
+          await tester.pumpAndSettle();
+          Rect bounds(String id, Finder child) => tester.getRect(
+            find
+                .descendant(
+                  of: find.byKey(ValueKey('message-row-$id')),
+                  matching: child,
+                )
+                .first,
+          );
+          final incoming = bounds(
+            'incoming',
+            find.byType(LocalSendBubbleSurface),
+          );
+          final outgoing = bounds(
+            'outgoing',
+            find.byType(LocalSendBubbleSurface),
+          );
+          expect(outgoing.center.dx, greaterThan(incoming.center.dx));
+          expect(
+            bounds(
+              'outgoing',
+              find.byKey(const ValueKey('message-author-outgoing')),
+            ).right,
+            lessThan(
+              bounds(
+                'outgoing',
+                find.byKey(const ValueKey('message-timestamp-outgoing')),
+              ).left,
+            ),
+          );
+          expect(
+            bounds(
+              'incoming',
+              find.byKey(const ValueKey('message-author-incoming')),
+            ).right,
+            lessThan(
+              bounds(
+                'incoming',
+                find.byKey(const ValueKey('message-timestamp-incoming')),
+              ).left,
+            ),
+          );
+
+          expect(outgoing.right, greaterThan(300));
+          expect(incoming.left, lessThan(90));
+          final incomingAvatar = bounds(
+            'incoming',
+            find.byType(MessageMediaAvatar),
+          );
+          expect(incomingAvatar.right, lessThan(incoming.left));
+          expect(
+            find.descendant(
+              of: find.byKey(const ValueKey('message-row-outgoing')),
+              matching: find.byType(MessageMediaAvatar),
+            ),
+            findsNothing,
+          );
+          expect(
+            outgoing.right,
+            closeTo(
+              tester
+                  .getRect(find.byKey(const ValueKey('message-row-outgoing')))
+                  .right,
+              0.01,
+            ),
+          );
+          final incomingReaction = bounds(
+            'incoming',
+            find.byKey(const ValueKey('combined-reaction-tray')),
+          );
+          final outgoingReaction = bounds(
+            'outgoing',
+            find.byKey(const ValueKey('combined-reaction-tray')),
+          );
+          expect(
+            outgoingReaction.center.dx,
+            greaterThan(incomingReaction.center.dx),
+          );
+          expect(tester.takeException(), isNull);
+        },
+      );
+    }
+  }
+
+  testWidgets('thread replies reclaim the outgoing avatar gutter', (
+    tester,
+  ) async {
+    final root = _textMsg(id: threadIdRoot, pubkey: 'alice', content: 'Root');
+    final reply = _textMsg(
+      id: threadIdR1,
+      pubkey: 'self',
+      content: 'My reply',
+      createdAt: 1100,
+      extraTags: const [
+        ['e', threadIdRoot, '', 'reply'],
+      ],
+    );
+    await tester.pumpWidget(
+      _buildTestable(
+        signingPubkey: 'self',
+        messages: [root, reply],
+        threadReplies: {
+          threadIdRoot: [reply],
+        },
+        initialThreadRootId: threadIdRoot,
+      ),
+    );
+    await tester.pumpAndSettle();
+    final row = find.byKey(const ValueKey('thread-message-row-$threadIdR1'));
+    final bubble = tester.getRect(
+      find
+          .descendant(of: row, matching: find.byType(LocalSendBubbleSurface))
+          .first,
+    );
+    expect(
+      find.descendant(of: row, matching: find.byType(MessageMediaAvatar)),
+      findsNothing,
+    );
+    expect(bubble.right, closeTo(tester.getRect(row).right, 0.01));
+    expect(tester.takeException(), isNull);
+  });
+
   testWidgets('large activity members build and fetch only visible rows', (
     tester,
   ) async {
@@ -60,58 +276,56 @@ void bubbleLayoutTests() {
     expect(tester.takeException(), isNull);
   });
 
-  testWidgets(
-    'status bar pagination is capped and later taps continue',
-    (tester) async {
-      final notifier = _FakeMessagesNotifier(
-        [
-          for (var index = 0; index < 30; index++)
+  testWidgets('status bar pagination is capped and later taps continue', (
+    tester,
+  ) async {
+    final notifier = _FakeMessagesNotifier(
+      [
+        for (var index = 0; index < 30; index++)
+          _textMsg(
+            id: 'recent-$index',
+            pubkey: 'alice',
+            content: 'Recent $index',
+            createdAt: 3000 + index,
+          ),
+      ],
+      olderPages: [
+        for (var index = 1; index <= 10; index++)
+          [
             _textMsg(
-              id: 'recent-$index',
+              id: 'page-$index',
               pubkey: 'alice',
-              content: 'Recent $index',
-              createdAt: 3000 + index,
+              content: 'Older page $index',
+              createdAt: 3000 - index * 100,
             ),
-        ],
-        olderPages: [
-          for (var index = 1; index <= 10; index++)
-            [
-              _textMsg(
-                id: 'page-$index',
-                pubkey: 'alice',
-                content: 'Older page $index',
-                createdAt: 3000 - index * 100,
-              ),
-            ],
-        ],
-      );
-      await tester.pumpWidget(
-        _buildTestable(messages: const [], messagesNotifier: notifier),
+          ],
+      ],
+    );
+    await tester.pumpWidget(
+      _buildTestable(messages: const [], messagesNotifier: notifier),
+    );
+    await tester.pumpAndSettle();
+    expect(notifier.fetchOlderCalls, 0);
+    for (final expected in [3, 6, 9, 10]) {
+      await tester.binding.defaultBinaryMessenger.handlePlatformMessage(
+        'flutter/status_bar',
+        const JSONMethodCodec().encodeMethodCall(
+          const MethodCall('handleScrollToTop'),
+        ),
+        (_) {},
       );
       await tester.pumpAndSettle();
-      expect(notifier.fetchOlderCalls, 0);
-      for (final expected in [3, 6, 9, 10]) {
-        await tester.binding.defaultBinaryMessenger.handlePlatformMessage(
-          'flutter/status_bar',
-          const JSONMethodCodec().encodeMethodCall(
-            const MethodCall('handleScrollToTop'),
-          ),
-          (_) {},
-        );
-        await tester.pumpAndSettle();
-        expect(notifier.fetchOlderCalls, expected);
-        expect(find.text('Older page $expected').hitTestable(), findsOneWidget);
-        await tester.pumpAndSettle();
-        expect(
-          notifier.fetchOlderCalls,
-          expected,
-          reason: 'landing must not bypass the gesture cap',
-        );
-      }
-      expect(notifier.reachedOldest, isTrue);
-    },
-    variant: TargetPlatformVariant.only(TargetPlatform.iOS),
-  );
+      expect(notifier.fetchOlderCalls, expected);
+      expect(find.text('Older page $expected').hitTestable(), findsOneWidget);
+      await tester.pumpAndSettle();
+      expect(
+        notifier.fetchOlderCalls,
+        expected,
+        reason: 'landing must not bypass the gesture cap',
+      );
+    }
+    expect(notifier.reachedOldest, isTrue);
+  }, variant: TargetPlatformVariant.only(TargetPlatform.iOS));
 
   testWidgets(
     'grouped removal quick reactions remove reactions on later events',
@@ -426,68 +640,66 @@ void bubbleLayoutTests() {
   );
 
   for (final thread in [false, true]) {
-    testWidgets(
-      'status bar tap reaches oldest content, thread=$thread',
-      (tester) async {
-        final events = [
+    testWidgets('status bar tap reaches oldest content, thread=$thread', (
+      tester,
+    ) async {
+      final events = [
+        _textMsg(
+          id: threadIdTopDashRoot,
+          pubkey: 'bob',
+          content: 'Oldest content',
+          createdAt: 900,
+        ),
+        for (var index = 0; index < 60; index++)
           _textMsg(
-            id: threadIdTopDashRoot,
-            pubkey: 'bob',
-            content: 'Oldest content',
-            createdAt: 900,
+            id: 'top-$index',
+            pubkey: 'alice',
+            content: 'Message $index',
+            createdAt: 1000 + index,
+            extraTags: thread
+                ? const [
+                    ['e', threadIdTopDashRoot, '', 'reply'],
+                  ]
+                : const [],
           ),
-          for (var index = 0; index < 60; index++)
-            _textMsg(
-              id: 'top-$index',
-              pubkey: 'alice',
-              content: 'Message $index',
-              createdAt: 1000 + index,
-              extraTags: thread
-                  ? const [
-                      ['e', threadIdTopDashRoot, '', 'reply'],
-                    ]
-                  : const [],
-            ),
-        ];
-        final messages = formatTimeline(events);
-        await tester.pumpWidget(
-          _buildTestable(
-            messages: events,
-            home: thread
-                ? ThreadDetailPage(
-                    threadHead: messages.firstWhere(
-                      (m) => m.id == threadIdTopDashRoot,
-                    ),
-                    allMessages: messages,
-                    channelId: _channelId,
-                    currentPubkey: 'me',
-                    isMember: true,
-                    isArchived: false,
-                  )
-                : null,
-          ),
-        );
-        await tester.pumpAndSettle();
-        final list = tester.widget<ScrollablePositionedList>(
-          find.byKey(
-            ValueKey(thread ? 'thread-message-list' : 'channel-message-list'),
-          ),
-        );
-        list.itemScrollController!.jumpTo(index: thread ? 55 : 0);
-        await tester.pumpAndSettle();
-        expect(find.text('Oldest content').hitTestable(), findsNothing);
-        await tester.binding.defaultBinaryMessenger.handlePlatformMessage(
-          'flutter/status_bar',
-          const JSONMethodCodec().encodeMethodCall(
-            const MethodCall('handleScrollToTop'),
-          ),
-          (_) {},
-        );
-        await tester.pumpAndSettle();
-        expect(find.text('Oldest content').hitTestable(), findsOneWidget);
-      },
-      variant: TargetPlatformVariant.only(TargetPlatform.iOS),
-    );
+      ];
+      final messages = formatTimeline(events);
+      await tester.pumpWidget(
+        _buildTestable(
+          messages: events,
+          home: thread
+              ? ThreadDetailPage(
+                  threadHead: messages.firstWhere(
+                    (m) => m.id == threadIdTopDashRoot,
+                  ),
+                  allMessages: messages,
+                  channelId: _channelId,
+                  currentPubkey: 'me',
+                  isMember: true,
+                  isArchived: false,
+                )
+              : null,
+        ),
+      );
+      await tester.pumpAndSettle();
+      final list = tester.widget<ScrollablePositionedList>(
+        find.byKey(
+          ValueKey(thread ? 'thread-message-list' : 'channel-message-list'),
+        ),
+      );
+      list.itemScrollController!.jumpTo(index: thread ? 55 : 0);
+      await tester.pumpAndSettle();
+      expect(find.text('Oldest content').hitTestable(), findsNothing);
+      await tester.binding.defaultBinaryMessenger.handlePlatformMessage(
+        'flutter/status_bar',
+        const JSONMethodCodec().encodeMethodCall(
+          const MethodCall('handleScrollToTop'),
+        ),
+        (_) {},
+      );
+      await tester.pumpAndSettle();
+      expect(find.text('Oldest content').hitTestable(), findsOneWidget);
+    }, variant: TargetPlatformVariant.only(TargetPlatform.iOS));
   }
 
   testWidgets('newest short message keeps the same group gap', (tester) async {
diff --git a/mobile/test/features/channels/channel_detail_page_test/swipe_reply_tests.dart b/mobile/test/features/channels/channel_detail_page_test/swipe_reply_tests.dart
new file mode 100644
index 0000000000..c5d9e08d70
--- /dev/null
+++ b/mobile/test/features/channels/channel_detail_page_test/swipe_reply_tests.dart
@@ -0,0 +1,226 @@
+part of '../channel_detail_page_test.dart';
+
+void swipeReplyTests() {
+  for (final thread in [false, true]) {
+    testWidgets('right drag opens existing reply destination, thread=$thread', (
+      tester,
+    ) async {
+      final events = [
+        _textMsg(
+          id: threadIdRoot,
+          pubkey: 'alice',
+          content: 'Swipe this message\nA second line\nAnd a third line',
+        ),
+      ];
+      final messages = formatTimeline(events);
+      await tester.pumpWidget(
+        _buildTestable(
+          messages: events,
+          home: thread
+              ? ThreadDetailPage(
+                  threadHead: messages.first,
+                  allMessages: messages,
+                  channelId: _channelId,
+                  currentPubkey: 'me',
+                  isMember: true,
+                  isArchived: false,
+                )
+              : null,
+        ),
+      );
+      await tester.pumpAndSettle();
+      final row = find.byKey(
+        ValueKey(
+          '${thread ? 'thread-message-row' : 'message-row'}-$threadIdRoot',
+        ),
+      );
+      final initial = tester.getTopLeft(row);
+      final haptics = <MethodCall>[];
+      tester.binding.defaultBinaryMessenger.setMockMethodCallHandler(
+        SystemChannels.platform,
+        (call) async {
+          if (call.method == 'HapticFeedback.vibrate') haptics.add(call);
+          return null;
+        },
+      );
+      addTearDown(
+        () => tester.binding.defaultBinaryMessenger.setMockMethodCallHandler(
+          SystemChannels.platform,
+          null,
+        ),
+      );
+      final gesture = await tester.startGesture(tester.getCenter(row));
+      await gesture.moveBy(const Offset(25, 0));
+      await gesture.moveBy(const Offset(40, 0));
+      await tester.pump();
+      expect(tester.getTopLeft(row).dx, greaterThan(initial.dx));
+      expect(haptics, isEmpty);
+      final partialCircle = tester.widget<DecoratedBox>(
+        find.byKey(const ValueKey('swipe-reply-circle')),
+      );
+      expect(
+        (partialCircle.decoration as BoxDecoration).color,
+        Colors.transparent,
+      );
+      final ring = tester.widget<CircularProgressIndicator>(
+        find.descendant(
+          of: find.byKey(const ValueKey('swipe-reply-circle')),
+          matching: find.byType(CircularProgressIndicator),
+        ),
+      );
+      expect(ring.strokeWidth, 2);
+      expect(ring.value, inExclusiveRange(0, 1));
+      await gesture.moveBy(const Offset(45, 0));
+      await tester.pump();
+      expect(haptics, hasLength(1));
+      await gesture.moveBy(const Offset(10, 0));
+      await tester.pump();
+      expect(haptics, hasLength(1));
+      final armedPosition = tester.getTopLeft(row);
+      await gesture.moveBy(const Offset(160, 0));
+      await tester.pump();
+      final resistedPosition = tester.getTopLeft(row);
+      expect(resistedPosition.dx, greaterThan(armedPosition.dx));
+      expect(resistedPosition.dx, lessThan(armedPosition.dx + 40));
+      final circle = find.byKey(const ValueKey('swipe-reply-circle'));
+      expect(tester.getRect(circle).left, initial.dx);
+      final fill =
+          tester.widget<DecoratedBox>(circle).decoration as BoxDecoration;
+      expect(fill.color, tester.element(circle).appColors.accent);
+      expect(find.text('Reply'), findsOneWidget);
+      final centerBeforePulse = tester.getCenter(
+        find.byKey(const ValueKey('swipe-reply-feedback')),
+      );
+      await tester.pump(const Duration(milliseconds: 60));
+      expect(
+        tester.getCenter(find.byKey(const ValueKey('swipe-reply-feedback'))),
+        centerBeforePulse,
+      );
+      expect(tester.getRect(circle).width, greaterThan(Grid.lg));
+      await tester.pump(const Duration(milliseconds: 180));
+      expect(tester.getRect(circle).width, Grid.lg);
+      expect(haptics, hasLength(1));
+      final feedback = find.byKey(const ValueKey('swipe-reply-feedback'));
+      final content = find.descendant(
+        of: row,
+        matching: find.byType(MessageContent),
+      );
+      expect(tester.getCenter(feedback).dy, tester.getCenter(content).dy);
+      expect(
+        tester.getCenter(find.text('Reply')).dx,
+        tester.getCenter(circle).dx,
+      );
+      expect(
+        tester.widget<Text>(find.text('Reply')).style?.color,
+        tester.element(circle).colors.onSurfaceVariant,
+      );
+      // Retreat below readiness without returning to rest, then cross again.
+      await gesture.moveBy(const Offset(-210, 0));
+      await tester.pump();
+      expect(tester.getTopLeft(row).dx, greaterThan(initial.dx));
+      await gesture.moveBy(const Offset(45, 0));
+      await tester.pump();
+      expect(haptics, hasLength(2));
+      await tester.pump(const Duration(milliseconds: 60));
+      expect(tester.getRect(circle).width, greaterThan(Grid.lg));
+      await tester.pump(const Duration(milliseconds: 180));
+      expect(tester.getRect(circle).width, Grid.lg);
+      await gesture.up();
+      await tester.pumpAndSettle();
+      expect(find.byType(ThreadDetailPage), findsOneWidget);
+      expect(
+        tester
+            .widget<ThreadDetailPage>(find.byType(ThreadDetailPage))
+            .threadHead
+            .id,
+        threadIdRoot,
+      );
+      // A thread message must push a reply route too, rather than doing nothing.
+      expect(
+        Navigator.of(tester.element(find.byType(ThreadDetailPage))).canPop(),
+        isTrue,
+      );
+    });
+  }
+
+  for (final movement in [
+    const Offset(45, 0),
+    const Offset(-100, 0),
+    const Offset(0, -100),
+  ]) {
+    testWidgets('non-reply drag $movement does not navigate', (tester) async {
+      await tester.pumpWidget(
+        _buildTestable(
+          messages: [
+            _textMsg(
+              id: 'swipe-cancel',
+              pubkey: 'alice',
+              content: 'Keep reading',
+            ),
+          ],
+        ),
+      );
+      await tester.pumpAndSettle();
+      final row = find.byKey(const ValueKey('message-row-swipe-cancel'));
+      await tester.drag(row, movement);
+      await tester.pumpAndSettle();
+      expect(find.byType(ThreadDetailPage), findsNothing);
+    });
+  }
+
+  for (final reducedMotion in [false, true]) {
+    testWidgets('cancelled drag resets feedback, reduced=$reducedMotion', (
+      tester,
+    ) async {
+      await tester.pumpWidget(
+        _buildTestable(
+          disableAnimations: reducedMotion,
+          messages: [
+            _textMsg(id: 'cancel', pubkey: 'alice', content: 'Cancel drag'),
+          ],
+        ),
+      );
+      await tester.pumpAndSettle();
+      final row = find.byKey(const ValueKey('message-row-cancel'));
+      final origin = tester.getTopLeft(row);
+      final gesture = await tester.startGesture(tester.getCenter(row));
+      await gesture.moveBy(const Offset(25, 0));
+      await gesture.moveBy(const Offset(90, 0));
+      await tester.pump();
+      final icon = find.byIcon(BuzzIcons.messageSquareReply);
+      expect(
+        tester
+            .widget<Opacity>(
+              find.ancestor(of: icon, matching: find.byType(Opacity)).first,
+            )
+            .opacity,
+        1,
+      );
+      await gesture.cancel();
+      await tester.pumpAndSettle();
+      expect(tester.getTopLeft(row), origin);
+      expect(find.byType(ThreadDetailPage), findsNothing);
+    });
+  }
+
+  testWidgets('crossing threshold then retreating cancels reply', (
+    tester,
+  ) async {
+    await tester.pumpWidget(
+      _buildTestable(
+        messages: [
+          _textMsg(id: 'retreat', pubkey: 'alice', content: 'Keep reading'),
+        ],
+      ),
+    );
+    await tester.pumpAndSettle();
+    final row = find.byKey(const ValueKey('message-row-retreat'));
+    final gesture = await tester.startGesture(tester.getCenter(row));
+    await gesture.moveBy(const Offset(25, 0));
+    await gesture.moveBy(const Offset(90, 0));
+    await gesture.moveBy(const Offset(-70, 0));
+    await gesture.up();
+    await tester.pumpAndSettle();
+    expect(find.byType(ThreadDetailPage), findsNothing);
+  });
+}
diff --git a/mobile/test/features/channels/channels_page_test.dart b/mobile/test/features/channels/channels_page_test.dart
index 902ecad2e1..fcd67f123c 100644
--- a/mobile/test/features/channels/channels_page_test.dart
+++ b/mobile/test/features/channels/channels_page_test.dart
@@ -248,6 +248,98 @@ void main() {
     await tester.pumpWidget(const SizedBox());
   });
 
+  for (final label in ['Channels options', 'Design options']) {
+    testWidgets('$label exposes a labeled button and tap action', (
+      tester,
+    ) async {
+      final semantics = tester.ensureSemantics();
+      try {
+        await tester.pumpWidget(
+          buildTestable(
+            overrides: [
+              channelsProvider.overrideWith(() => _FakeNotifier(testChannels)),
+              channelSectionsProvider.overrideWith(
+                () => _FakeChannelSectionsNotifier(
+                  const ChannelSectionStore(
+                    sections: [
+                      ChannelSection(
+                        id: 'section-1',
+                        name: 'Design',
+                        icon: '🎨',
+                        order: 0,
+                      ),
+                    ],
+                  ),
+                ),
+              ),
+            ],
+          ),
+        );
+        await tester.pumpAndSettle();
+        final control = find.bySemanticsLabel(label);
+        expect(control, findsOneWidget);
+        final node = tester.getSemantics(control);
+        expect(node.flagsCollection.isButton, isTrue);
+        expect(
+          node.getSemanticsData().hasAction(ui.SemanticsAction.tap),
+          isTrue,
+        );
+        node.owner!.performAction(node.id, ui.SemanticsAction.tap);
+        await tester.pumpAndSettle();
+        expect(
+          find.byKey(
+            ValueKey(
+              label == 'Channels options'
+                  ? 'sort-popover-Channels'
+                  : 'section-popover-section-1',
+            ),
+          ),
+          findsOneWidget,
+        );
+      } finally {
+        semantics.dispose();
+      }
+    });
+  }
+
+  testWidgets('section ellipsis aligns with temporary channel icon', (
+    tester,
+  ) async {
+    final temporary = Channel(
+      id: 'temporary',
+      name: 'temporary',
+      channelType: 'stream',
+      visibility: 'open',
+      description: '',
+      createdBy: 'abc',
+      createdAt: DateTime(2025),
+      memberCount: 1,
+      isMember: true,
+      ttlSeconds: 3600,
+    );
+    await tester.pumpWidget(
+      buildTestable(
+        overrides: [
+          channelsProvider.overrideWith(() => _FakeNotifier([temporary])),
+        ],
+      ),
+    );
+    await tester.pumpAndSettle();
+    final ellipsis = find.descendant(
+      of: find.byTooltip('Channels options'),
+      matching: find.byIcon(BuzzIcons.ellipsisVertical),
+    );
+    expect(
+      tester.getCenter(ellipsis).dx,
+      closeTo(
+        tester
+            .getCenter(find.byKey(const Key('channel-ephemeral-temporary')))
+            .dx,
+        0.01,
+      ),
+    );
+  });
+
   testWidgets('shows grouped channel list when data loads', (tester) async {
     // Valid fixture keys whose npub encodings were verified against the
     // NIP-19 codec independently of the code under test.
@@ -325,6 +417,17 @@ void main() {
       findsOneWidget,
     );
 
+    expect(
+      tester
+          .getTopRight(
+            find.descendant(
+              of: find.byTooltip('Channels options'),
+              matching: find.byIcon(BuzzIcons.ellipsisVertical),
+            ),
+          )
+          .dx,
+      closeTo(tester.getTopRight(find.byTooltip('Channels options')).dx, 0.01),
+    );
     await tester.tap(find.byTooltip('Channels options'));
     await tester.pumpAndSettle();
     expect(find.text('Sort: Recent'), findsOneWidget);
@@ -986,6 +1089,20 @@ void main() {
         AppTheme.light().colorScheme.onSurface.withValues(alpha: 0.07),
       );
     }
+    expect(
+      tester
+          .getTopRight(
+            find.descendant(
+              of: find.byKey(const Key('section-menu-section-1')),
+              matching: find.byIcon(BuzzIcons.ellipsisVertical),
+            ),
+          )
+          .dx,
+      closeTo(
+        tester.getTopRight(find.byKey(const Key('section-menu-section-1'))).dx,
+        0.01,
+      ),
+    );
     await tester.tap(find.byKey(const Key('section-menu-section-1')));
     await tester.pumpAndSettle();
 
diff --git a/mobile/test/features/channels/channels_provider_test.dart b/mobile/test/features/channels/channels_provider_test.dart
index 943e9a3cde..e873306d57 100644
--- a/mobile/test/features/channels/channels_provider_test.dart
+++ b/mobile/test/features/channels/channels_provider_test.dart
@@ -619,7 +619,7 @@ void main() {
   );
 
   test(
-    'community switch after directory success discards a late failure',
+    'community switch during a directory refresh discards a late failure',
     () async {
       final session = _FakeRelaySession(
         memberships: const [],
@@ -630,8 +630,8 @@ void main() {
 
       expect(await container.read(channelsProvider.future), isEmpty);
 
-      // The directory query succeeds, then the refresh parks on the member-count
-      // query and fails there after the switch. A retired failure must not
+      // The directory refresh parks on the member-count query and fails there
+      // after the switch. A retired failure must not
       // overwrite the new scope's list or push it into an error state.
       session.memberships = [_membership(_channelA, myPk)];
       session.pauseNextMemberCountQuery();
@@ -671,7 +671,7 @@ void main() {
   );
 
   test(
-    'identity switch after directory success discards the late refresh',
+    'identity switch during a directory refresh discards the late refresh',
     () async {
       final session = _FakeRelaySession(
         memberships: const [],
@@ -682,7 +682,7 @@ void main() {
 
       expect(await container.read(channelsProvider.future), isEmpty);
 
-      // Directory success, then the refresh parks on the hidden-DM query while
+      // The directory refresh parks on the hidden-DM query while
       // the signing identity changes and the new identity finishes its rebuild.
       session.pauseNextHiddenDmQuery();
       final staleRefresh = container
@@ -710,7 +710,7 @@ void main() {
   );
 
   test(
-    'identity switch after directory success discards a late failure',
+    'identity switch during a directory refresh discards a late failure',
     () async {
       final session = _FakeRelaySession(
         memberships: const [],
@@ -746,6 +746,46 @@ void main() {
     },
   );
 
+  test('reads after the membership list share one round trip', () async {
+    final session = _FakeRelaySession(
+      memberships: [_membership(_channelA, myPk)],
+      metadata: [_meta(id: _channelA, name: 'joined-a')],
+    );
+    final container = _buildContainer(session: session);
+    addTearDown(container.dispose);
+
+    // Park all four reads. Any of them waiting on another would leave that one
+    // unsent.
+    final metadataGate = session.metadataGate = Completer<void>();
+    session.pauseNextHiddenDmQuery();
+    session.pauseNextMemberCountQuery();
+    session.pauseNextHuddleStartQuery();
+    final load = container.read(channelsProvider.future);
+    await _settle();
+
+    // The membership list's own kind:39002 read has no `#d` tag.
+    final sentKinds = {
+      for (final filter in session.historyFilters)
+        if (!filter.kinds.contains(39002) || filter.tags['#d'] != null)
+          ...filter.kinds,
+    };
+    expect(
+      sentKinds,
+      containsAll([
+        39000,
+        39002,
+        EventKind.dmVisibility,
+        EventKind.huddleStarted,
+      ]),
+    );
+
+    metadataGate.complete();
+    session.resumePausedHiddenDmQuery();
+    session.resumePausedMemberCountQuery();
+    session.resumePausedHuddleStartQuery();
+    expect((await load).map((channel) => channel.id), [_channelA]);
+  });
+
   test('a newer ordinary refresh owns the installed membership list', () async {
     final session = _FakeRelaySession(
       memberships: [_membership(_channelA, myPk)],
@@ -2666,6 +2706,9 @@ class _FakeRelaySession extends RelaySessionNotifier {
   int metadataPageRequestCount = 0;
 
   final List<NostrFilter> historyFilters = [];
+
+  /// While set, member metadata reads wait for it to complete.
+  Completer<void>? metadataGate;
   final List<List<NostrFilter>> queryBatches = [];
   Object? messageBatchError;
   Object? latestBatchError;
@@ -2950,6 +2993,7 @@ class _FakeRelaySession extends RelaySessionNotifier {
       if (ids == null) {
         throw StateError('Directory queries must use the HTTP query bridge');
       }
+      await metadataGate?.future;
       // Member metadata query — return only matching `d` tags.
       return metadata.where((e) => ids.contains(e.getTagValue('d'))).toList();
     }
diff --git a/mobile/test/features/channels/day_divider_test.dart b/mobile/test/features/channels/day_divider_test.dart
index 23b3905268..240f88ee3e 100644
--- a/mobile/test/features/channels/day_divider_test.dart
+++ b/mobile/test/features/channels/day_divider_test.dart
@@ -4,6 +4,75 @@ import 'package:flutter/material.dart';
 import 'package:flutter_test/flutter_test.dart';
 
 void main() {
+  for (final dark in [false, true]) {
+    testWidgets('inline calendar shows local day before label, dark=$dark', (
+      tester,
+    ) async {
+      final date = DateTime(2026, 10, 18, 12);
+      final timestamp = date.millisecondsSinceEpoch ~/ 1000;
+      await tester.pumpWidget(
+        MaterialApp(
+          theme: dark ? AppTheme.dark() : AppTheme.light(),
+          home: Scaffold(
+            body: MediaQuery(
+              data: const MediaQueryData(textScaler: TextScaler.linear(2)),
+              child: SizedBox(
+                width: 320,
+                child: DayDivider(
+                  label: 'October 18, 2026',
+                  dayTimestamp: timestamp,
+                ),
+              ),
+            ),
+          ),
+        ),
+      );
+      final tile = find.byKey(ValueKey('day-calendar-$timestamp'));
+      expect(
+        find.descendant(of: tile, matching: find.text('18')),
+        findsOneWidget,
+      );
+      expect(
+        tester.getRect(tile).right,
+        lessThan(tester.getRect(find.text('October 18, 2026')).left),
+      );
+      expect(find.byType(Divider), findsNWidgets(2));
+      expect(tester.takeException(), isNull);
+    });
+  }
+
+  for (final label in ['Today', 'October 18, 2026']) {
+    testWidgets('date group centered with full-width rules: $label', (
+      tester,
+    ) async {
+      await tester.pumpWidget(
+        MaterialApp(
+          theme: AppTheme.light(),
+          home: Scaffold(
+            body: SizedBox(
+              width: 390,
+              child: Padding(
+                padding: const EdgeInsets.symmetric(horizontal: Grid.gutter),
+                child: DayDivider(label: label, dayTimestamp: 1000),
+              ),
+            ),
+          ),
+        ),
+      );
+      final left = tester.getRect(find.byType(Divider).first);
+      final right = tester.getRect(find.byType(Divider).last);
+      final icon = tester.getRect(
+        find.byKey(const ValueKey('day-calendar-1000')),
+      );
+      final text = tester.getRect(find.text(label));
+      expect(left.left, closeTo(Grid.gutter, 0.01));
+      expect(right.right, closeTo(390 - Grid.gutter, 0.01));
+      expect(left.width, closeTo(right.width, 0.01));
+      expect((icon.left + text.right) / 2, closeTo(195, 0.01));
+      expect(tester.takeException(), isNull);
+    });
+  }
+
   testWidgets('fades the in-flow date while that day is sticky', (
     tester,
   ) async {
diff --git a/mobile/test/features/channels/deep_link_dispatcher_test.dart b/mobile/test/features/channels/deep_link_dispatcher_test.dart
index 6a581b24a6..72c9abda5e 100644
--- a/mobile/test/features/channels/deep_link_dispatcher_test.dart
+++ b/mobile/test/features/channels/deep_link_dispatcher_test.dart
@@ -15,6 +15,64 @@ import 'package:hooks_riverpod/hooks_riverpod.dart';
 import '../../shared/community/community_storage_test.dart';
 
 void main() {
+  for (final outcome in ['handled', 'declined', 'failed']) {
+    testWidgets('hosted handler drains queued links after $outcome setup', (
+      tester,
+    ) async {
+      final BuzzDeepLink first = outcome == 'declined'
+          ? const AddCommunityDeepLink(
+              relayUrl: 'wss://one.communities.buzz.xyz',
+              name: 'One',
+            )
+          : const InviteDeepLink(
+              relayUrl: 'wss://one.communities.buzz.xyz',
+              code: 'same',
+            );
+      final duplicate = outcome == 'declined'
+          ? first
+          : InviteDeepLink(
+              relayUrl: 'wss://one.communities.buzz.xyz',
+              code: 'same',
+            );
+      const second = InviteDeepLink(
+        relayUrl: 'wss://two.communities.buzz.xyz',
+        code: 'invite',
+      );
+      final pending = _QueuedPendingDeepLinkNotifier([
+        first,
+        duplicate,
+        second,
+      ]);
+      final handled = <BuzzDeepLink>[];
+      await tester.pumpWidget(
+        ProviderScope(
+          overrides: [
+            pendingDeepLinkProvider.overrideWith(() => pending),
+            inviteKeyGeneratorProvider.overrideWithValue(
+              () => throw StateError('must not generate'),
+            ),
+          ],
+          child: MaterialApp(
+            home: DeepLinkDispatcher(
+              dispatchMessageLinks: false,
+              onboardingHandler: (_, link) async {
+                handled.add(link);
+                if (link == first) {
+                  if (outcome == 'declined') return false;
+                  if (outcome == 'failed') throw StateError('setup failed');
+                }
+                return true;
+              },
+              child: const Scaffold(body: SizedBox()),
+            ),
+          ),
+        ),
+      );
+      await tester.pumpAndSettle();
+      expect(handled, [first, duplicate, second]);
+      expect(pending.consumeCalls, 3);
+    });
+  }
   testWidgets('queues deep links in arrival order until acknowledged', (
     tester,
   ) async {
diff --git a/mobile/test/features/channels/message_carousel_preview_cases.dart b/mobile/test/features/channels/message_carousel_preview_cases.dart
new file mode 100644
index 0000000000..9ab476de19
--- /dev/null
+++ b/mobile/test/features/channels/message_carousel_preview_cases.dart
@@ -0,0 +1,172 @@
+part of 'message_content_test.dart';
+
+void carouselPreviewTests() {
+  testWidgets(
+    'iOS prepares five thumbnails before scrolling with two preload requests',
+    (tester) async {
+      final started = <String>[];
+
+      final responses = <String, Completer<http.Response>>{};
+      final urls = List.generate(
+        10,
+        (i) => 'https://example.com/preload-$i.png',
+      );
+      final messenger = tester.binding.defaultBinaryMessenger;
+      const connectivity = MethodChannel(
+        'dev.fluttercommunity.plus/connectivity_status',
+      );
+      messenger.setMockMethodCallHandler(connectivity, (_) async => null);
+      addTearDown(() => messenger.setMockMethodCallHandler(connectivity, null));
+      final channels = <MethodChannel>[];
+      messenger.setMockMethodCallHandler(SystemChannels.platform_views, (
+        call,
+      ) async {
+        if (call.method == 'create') {
+          final id = (call.arguments as Map)['id'];
+          final channel = MethodChannel('buzz/ios_media_carousel/$id');
+          channels.add(channel);
+          messenger.setMockMethodCallHandler(channel, (_) async => null);
+        }
+        return null;
+      });
+      final client = MockClient((request) {
+        final url = request.url.toString();
+        started.add(url);
+        final response = responses[url] = Completer<http.Response>();
+
+        return response.future;
+      });
+      Future<void> waitForCount(int count) async {
+        for (
+          var attempt = 0;
+          attempt < 100 && started.length < count;
+          attempt++
+        ) {
+          await tester.pump();
+          await tester.runAsync(
+            () => Future<void>.delayed(const Duration(milliseconds: 10)),
+          );
+        }
+        expect(started.length, count);
+      }
+
+      final png = base64Decode(
+        'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAwMCAO+aL1sAAAAASUVORK5CYII=',
+      );
+      void release(String url) {
+        final response = responses[url]!;
+        if (!response.isCompleted) {
+          response.complete(http.Response.bytes(png, 200));
+        }
+      }
+
+      addTearDown(() async {
+        for (final response in responses.values) {
+          if (!response.isCompleted) response.complete(http.Response('', 404));
+        }
+        messenger.setMockMethodCallHandler(SystemChannels.platform_views, null);
+        for (final channel in channels) {
+          messenger.setMockMethodCallHandler(channel, null);
+        }
+
+        client.close();
+      });
+      await tester.pumpWidget(
+        _testable(
+          MessageContent(
+            content: urls.map((url) => '![image]($url)').join('\n'),
+          ),
+          overrides: [
+            mediaGetAuthServiceProvider.overrideWithValue(
+              MediaGetAuthService(baseUrl: 'https://example.com', nsec: null),
+            ),
+            mediaHttpClientProvider.overrideWithValue(client),
+          ],
+        ),
+      );
+      await tester.pump();
+      {
+        await waitForCount(2);
+        expect(started, hasLength(2));
+        for (var i = 0; i < 3; i++) {
+          release(started[i]);
+          await waitForCount(i + 3);
+          expect(started, hasLength(i + 3));
+        }
+        release(started[3]);
+        release(started[4]);
+      }
+      await tester.pumpAndSettle();
+      expect(started.toSet(), urls.take(5).toSet());
+      // No native subscribeImage or page callback was sent by this harness.
+      await tester.pumpWidget(const SizedBox());
+      expect(tester.takeException(), isNull);
+    },
+    variant: TargetPlatformVariant.only(TargetPlatform.iOS),
+  );
+
+  testWidgets('outgoing gallery starts at the right and mirrors its spacing', (
+    tester,
+  ) async {
+    final messenger = tester.binding.defaultBinaryMessenger;
+    final channels = <MethodChannel>[];
+    final configs = <Map<Object?, Object?>>[];
+    messenger.setMockMethodCallHandler(SystemChannels.platform_views, (
+      call,
+    ) async {
+      if (call.method == 'create') {
+        final id = (call.arguments as Map)['id'];
+        final channel = MethodChannel('buzz/ios_media_carousel/$id');
+        channels.add(channel);
+        messenger.setMockMethodCallHandler(channel, (call) async {
+          if (call.method == 'configure') {
+            configs.add(Map<Object?, Object?>.from(call.arguments as Map));
+          }
+          return null;
+        });
+      }
+      return null;
+    });
+    addTearDown(() {
+      messenger.setMockMethodCallHandler(SystemChannels.platform_views, null);
+      for (final channel in channels) {
+        messenger.setMockMethodCallHandler(channel, null);
+      }
+    });
+    final counts = <Rect>[];
+    final widths = <double>[];
+    for (final own in [false, true]) {
+      await tester.pumpWidget(
+        _testable(
+          Padding(
+            padding: const EdgeInsets.symmetric(horizontal: 50),
+            child: MessageContent(
+              key: ValueKey(own),
+              ownMessage: own,
+              bubble: true,
+              mediaCarouselTrailingOverflow: Grid.gutter,
+              content:
+                  '![one](https://example.com/mirror-one.png)\n![two](https://example.com/mirror-two.png)',
+            ),
+          ),
+        ),
+      );
+      await tester.pumpAndSettle();
+      counts.add(
+        tester.getRect(
+          find.byKey(const ValueKey('message-media-carousel-count')),
+        ),
+      );
+      widths.add(
+        tester
+            .getSize(find.byKey(const ValueKey('message-media-carousel')))
+            .width,
+      );
+      expect(configs.last['rtl'], own);
+    }
+    expect(widths[0], widths[1]);
+    expect(counts[0].left, closeTo(800 - counts[1].right, 0.1));
+    await tester.pumpWidget(const SizedBox());
+    expect(tester.takeException(), isNull);
+  }, variant: TargetPlatformVariant.only(TargetPlatform.iOS));
+}
diff --git a/mobile/test/features/channels/message_content_test.dart b/mobile/test/features/channels/message_content_test.dart
index 6f28932c16..3715f8cf97 100644
--- a/mobile/test/features/channels/message_content_test.dart
+++ b/mobile/test/features/channels/message_content_test.dart
@@ -37,6 +37,7 @@ import 'package:buzz/shared/theme/theme.dart';
 import 'package:buzz/shared/widgets/buzz_loading_indicator.dart';
 
 part 'message_content_bubble_cases.dart';
+part 'message_carousel_preview_cases.dart';
 
 Widget _testable(
   Widget child, {
@@ -379,6 +380,7 @@ class _TestChannelsNotifier extends ChannelsNotifier {
 }
 
 void main() {
+  carouselPreviewTests();
   bubbleContentTests();
   test('wide voice-note waveforms distribute bars across their full width', () {
     const width = 320.0;
diff --git a/mobile/test/features/invites/invite_join_provider_test.dart b/mobile/test/features/invites/invite_join_provider_test.dart
index 83f7dc70c9..cd350b673e 100644
--- a/mobile/test/features/invites/invite_join_provider_test.dart
+++ b/mobile/test/features/invites/invite_join_provider_test.dart
@@ -1,3 +1,4 @@
+import 'package:buzz/shared/hosted/hosted_environment.dart';
 import 'dart:async';
 import 'dart:convert';
 
@@ -17,6 +18,47 @@ import 'package:buzz/shared/deeplink/deep_link.dart';
 import '../../shared/community/community_storage_test.dart';
 
 void main() {
+  test(
+    'legacy invite entry refuses staging before key generation or claim',
+    () async {
+      final storage = CommunityStorage(secure: FakeSecureStorage());
+      var generated = 0;
+      var requests = 0;
+      final container = ProviderContainer(
+        overrides: [
+          communityStorageProvider.overrideWithValue(storage),
+          inviteKeyGeneratorProvider.overrideWithValue(() {
+            generated++;
+            return nostr.Keys.generate();
+          }),
+          inviteJoinHttpClientProvider.overrideWithValue(
+            http_testing.MockClient((_) async {
+              requests++;
+              return http.Response('{}', 500);
+            }),
+          ),
+        ],
+      );
+      addTearDown(container.dispose);
+      await container.read(communityListProvider.future);
+      final notifier = container.read(inviteJoinProvider.notifier);
+      await notifier.prepare(
+        const InviteDeepLink(
+          relayUrl: 'wss://team.communities.public.builderlabstaging.xyz',
+          code: 'fixture',
+        ),
+      );
+      await notifier.confirmJoin();
+      expect(container.read(inviteJoinProvider).status, InviteJoinStatus.error);
+      expect(generated, 0);
+      expect(requests, 0);
+      expect(await storage.loadAll(), isEmpty);
+    },
+    skip: !HostedEnvironment.requiresAuth(
+      'team.communities.public.builderlabstaging.xyz',
+    ),
+  );
+
   for (final existingRelayUrl in [
     'wss://relay.example.com',
     'https://relay.example.com',
@@ -749,7 +791,12 @@ class _RecordingAuthNotifier extends AuthNotifier {
       const AuthState(status: AuthStatus.unauthenticated);
 
   @override
-  Future<void> authenticateWithCommunity(Community community) async {
+  Future<void> authenticateWithCommunity(
+    Community community, {
+    bool Function()? shouldContinue,
+    bool activate = true,
+  }) async {
+    if (shouldContinue != null && !shouldContinue()) return;
     final storage = ref.read(communityStorageProvider);
     await storage.save(community);
     await storage.saveActiveId(community.id);
diff --git a/mobile/test/features/onboarding/community_link_input_test.dart b/mobile/test/features/onboarding/community_link_input_test.dart
new file mode 100644
index 0000000000..12d8c1f2df
--- /dev/null
+++ b/mobile/test/features/onboarding/community_link_input_test.dart
@@ -0,0 +1,45 @@
+import 'package:buzz/shared/deeplink/community_link_input.dart';
+import 'package:buzz/shared/deeplink/deep_link.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+void main() {
+  test('normalizes addresses through the existing community parser', () {
+    for (final value in [
+      ' team.communities.buzz.xyz ',
+      'https://team.communities.buzz.xyz/',
+      'wss://team.communities.buzz.xyz',
+    ]) {
+      final uri = parseCommunityLinkInput(value)!;
+      final link = parseBuzzDeepLink(uri) as AddCommunityDeepLink;
+      expect(link.relayUrl, 'wss://team.communities.buzz.xyz');
+    }
+  });
+
+  test('preserves the invite and its destination', () {
+    final uri = parseCommunityLinkInput(
+      'https://community.example.com/invite/abc123',
+    )!;
+    final link = parseBuzzDeepLink(uri) as InviteDeepLink;
+    expect(link.code, 'abc123');
+    expect(link.relayUrl, 'wss://community.example.com');
+  });
+
+  test('rejects unrelated actions and unsafe or incomplete addresses', () {
+    for (final value in [
+      '',
+      'not a link',
+      'http://community.example.com',
+      'https://user:secret@community.example.com',
+      'https://community.example.com/other',
+      'https://community.example.com/invite/',
+      'https://community.example.com#secret',
+      'https://community.example.com?token=secret',
+      'https://127.0.0.1',
+      'https://community.example.com.',
+      'buzz://channel/580ca78b-9dae-46f3-8854-bd671853ba32',
+      'nostrpair://example',
+    ]) {
+      expect(parseCommunityLinkInput(value), isNull, reason: value);
+    }
+  });
+}
diff --git a/mobile/test/features/onboarding/hosted_app_gate_environment_test.dart b/mobile/test/features/onboarding/hosted_app_gate_environment_test.dart
new file mode 100644
index 0000000000..e12848af4b
--- /dev/null
+++ b/mobile/test/features/onboarding/hosted_app_gate_environment_test.dart
@@ -0,0 +1,150 @@
+import 'package:buzz/features/channels/deep_link_dispatcher.dart';
+import 'package:buzz/features/onboarding/self_hosted_entry_sheet.dart';
+import 'package:buzz/hosted_app_gate.dart';
+import 'package:buzz/shared/hosted/hosted_flow_provider.dart';
+import 'package:buzz/shared/deeplink/deep_link.dart';
+import 'package:buzz/shared/deeplink/pending_deep_link_provider.dart';
+import 'package:buzz/shared/hosted/account_identity_store.dart';
+import 'package:buzz/shared/hosted/browser_auth.dart';
+import 'package:buzz/shared/hosted/builderlab_account.dart';
+import 'package:buzz/shared/hosted/hosted_environment.dart';
+import 'package:buzz/shared/hosted/hosted_flow.dart';
+import 'package:buzz/shared/hosted/hosted_identity_service.dart';
+import 'package:flutter/material.dart';
+import 'package:flutter_secure_storage/flutter_secure_storage.dart';
+import 'package:flutter_test/flutter_test.dart';
+import 'package:hooks_riverpod/hooks_riverpod.dart';
+
+class _Flow extends HostedFlow {
+  _Flow(BuilderlabAccountClient account, AccountIdentityStore store)
+    : super(
+        account: account,
+        store: store,
+        browser: BrowserAuth(),
+        identity: HostedIdentityService(account: account, store: store),
+        enterCommunity: (_, _, _, _) async {},
+      );
+  BuzzDeepLink? started;
+  @override
+  Future<void> initialize() async {}
+  @override
+  Future<void> start(BuzzDeepLink target, {bool resumePairing = false}) async {
+    started = target;
+  }
+}
+
+void main() {
+  testWidgets('app dispatch keeps staging invites out of legacy generation', (
+    tester,
+  ) async {
+    FlutterSecureStorage.setMockInitialValues({});
+    PendingDeepLinkNotifier.debugUriStreamOverride = const Stream<Uri>.empty();
+    final account = BuilderlabAccountClient();
+    final flow = _Flow(account, AccountIdentityStore());
+    addTearDown(() async {
+      PendingDeepLinkNotifier.debugUriStreamOverride = null;
+      flow.dispose();
+      await flow.browser.dispose();
+      account.dispose();
+    });
+    await tester.pumpWidget(
+      ProviderScope(
+        overrides: [hostedFlowProvider.overrideWithValue(flow)],
+        child: const MaterialApp(
+          home: HostedAppGate(
+            authenticated: false,
+            child: Scaffold(body: Text('entry')),
+          ),
+        ),
+      ),
+    );
+    await tester.pump();
+    final dispatcher = tester.widget<DeepLinkDispatcher>(
+      find.byType(DeepLinkDispatcher),
+    );
+    final context = tester.element(find.byType(DeepLinkDispatcher));
+    const staging = InviteDeepLink(
+      relayUrl: 'wss://team.communities.public.builderlabstaging.xyz',
+      code: 'fixture',
+    );
+    final pending = dispatcher.onboardingHandler!(context, staging);
+    await tester.pumpAndSettle();
+    if (!HostedEnvironment.requiresAuth(Uri.parse(staging.relayUrl).host)) {
+      expect(await pending, isFalse);
+      expect(flow.started, isNull);
+      if (!HostedEnvironment.enabled) {
+        final container = ProviderScope.containerOf(context);
+        final queue = container.read(pendingDeepLinkProvider.notifier);
+        final bind = Uri(
+          scheme: 'buzz',
+          host: 'nostr-bind',
+          queryParameters: {
+            'challenge_id': '12345678-1234-1234-1234-123456789012',
+            'nonce': 'a' * 43,
+            'verification_code': '123456',
+            'audience': 'buzz:nostr-identity',
+            'action': 'bind_nostr_identity',
+            'protocol': 'buzz-nostr-identity',
+            'version': '1',
+            'origin': HostedEnvironment.origin.toString(),
+            'expires_at': '2099-01-01T00:00:00Z',
+            'return': 'browser_fragment_v1',
+            'callback_url': HostedEnvironment.origin
+                .resolve('/buzz')
+                .toString(),
+          },
+        );
+        expect(parseBuzzDeepLink(bind), isA<NostrBindDeepLink>());
+        queue.open(bind);
+        queue.open(
+          Uri.parse(
+            'buzz://add-community?relay=wss%3A%2F%2Fcommunity.example.org&name=Community',
+          ),
+        );
+        await tester.pumpAndSettle();
+        expect(find.byType(SelfHostedEntrySheet), findsOneWidget);
+        expect(
+          container.read(pendingDeepLinkProvider),
+          isA<AddCommunityDeepLink>(),
+        );
+        Navigator.of(tester.element(find.byType(SelfHostedEntrySheet))).pop();
+        await tester.pumpAndSettle();
+        expect(container.read(pendingDeepLinkProvider), isNull);
+        expect(flow.started, isNull);
+      }
+      return;
+    }
+    if (HostedEnvironment.origin.host == 'app.builderlabstaging.xyz') {
+      expect(await pending, isTrue);
+      expect(flow.started, staging);
+    } else {
+      expect(find.text('Community setup unavailable'), findsOneWidget);
+      await tester.tap(find.text('Close'));
+      await tester.pumpAndSettle();
+      expect(await pending, isTrue);
+      expect(flow.started, isNull);
+    }
+    final dotted = dispatcher.onboardingHandler!(
+      context,
+      const InviteDeepLink(
+        relayUrl: 'wss://team.communities.public.builderlabstaging.xyz.',
+        code: 'fixture',
+      ),
+    );
+    await tester.pumpAndSettle();
+    expect(find.text('Community setup unavailable'), findsOneWidget);
+    await tester.tap(find.text('Close'));
+    await tester.pumpAndSettle();
+    expect(await dotted, isTrue);
+    expect(
+      await dispatcher.onboardingHandler!(
+        context,
+        const InviteDeepLink(
+          relayUrl: 'wss://community.example.org',
+          code: 'fixture',
+        ),
+      ),
+      isFalse,
+    );
+  });
+}
diff --git a/mobile/test/features/onboarding/hosted_communities_test.dart b/mobile/test/features/onboarding/hosted_communities_test.dart
new file mode 100644
index 0000000000..35f87c8f16
--- /dev/null
+++ b/mobile/test/features/onboarding/hosted_communities_test.dart
@@ -0,0 +1,95 @@
+import 'package:buzz/shared/hosted/hosted_environment.dart';
+import 'package:buzz/features/onboarding/hosted_connect_page.dart';
+import 'package:buzz/hosted_app_gate.dart';
+import 'package:buzz/shared/hosted/hosted_flow_provider.dart';
+import 'package:buzz/onboarding_app_entry.dart';
+import 'package:buzz/shared/deeplink/pending_deep_link_provider.dart';
+import 'package:buzz/shared/hosted/hosted_flow.dart';
+import 'package:buzz/shared/hosted/builderlab_account.dart';
+import 'package:buzz/shared/hosted/hosted_community_connection.dart';
+import 'package:flutter/material.dart';
+import 'package:flutter_secure_storage/flutter_secure_storage.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+import '../../helpers/hosted_communities_fixture.dart';
+import '../../helpers/widget_helpers.dart';
+
+void main() {
+  testWidgets(
+    'cancel sign-in and resolve batch conflicts without replacing saved identities',
+    (tester) async {
+      await tester.binding.setSurfaceSize(const Size(440, 956));
+      addTearDown(() => tester.binding.setSurfaceSize(null));
+      // Keep the process-wide secure-store queue in one widget-test zone.
+      {
+        FlutterSecureStorage.setMockInitialValues({});
+        PendingDeepLinkNotifier.debugUriStreamOverride =
+            const Stream<Uri>.empty();
+        final f = HostedCommunitiesFixture();
+        await f.initialize(widget: true);
+        f.rows = [f.row('one'), f.row('two')];
+        addTearDown(() async {
+          PendingDeepLinkNotifier.debugUriStreamOverride = null;
+          await f.dispose();
+        });
+        await tester.pumpWidget(
+          WidgetHelpers.testable(
+            disableAnimations: true,
+            child: const HostedAppGate(
+              authenticated: false,
+              child: OnboardingAppEntry(),
+            ),
+            overrides: [hostedFlowProvider.overrideWithValue(f.flow)],
+          ),
+        );
+        await tester.pumpAndSettle();
+        f.expired = true;
+        await tester.tap(find.text('Continue with Builderlab'));
+        await tester.pump();
+        await tester.pumpAndSettle();
+        expect(f.flow.stage, HostedFlowStage.signIn);
+        expect(f.browser.startedIntent, {'type': 'account'});
+        expect(find.byType(HostedConnectPage), findsNothing);
+        expect(find.text('Cancel sign-in').hitTestable(), findsOneWidget);
+        expect(find.text('Enter a community link'), findsOneWidget);
+        f.expired = false;
+        await tester.tap(find.text('Cancel sign-in').hitTestable());
+        await tester.pumpAndSettle();
+        expect(f.flow.stage, HostedFlowStage.idle);
+        await tester.pumpAndSettle();
+        expect(find.text('Continue with Builderlab'), findsOneWidget);
+        expect(find.byType(HostedConnectPage), findsNothing);
+        await tester.tap(find.text('Continue with Builderlab'));
+        await tester.pumpAndSettle();
+        expect(find.byType(CheckboxListTile), findsNothing);
+        expect(f.admitted, ['one', 'two']);
+        expect(find.byType(HostedConnectPage), findsNothing);
+        f.admitted.clear();
+        f.beforeAdmission = (name) async {
+          if (name == 'two') throw const SavedCommunityIdentityConflict();
+        };
+        await tester.tap(find.text('Continue with Builderlab'));
+        await tester.pumpAndSettle();
+        expect(find.text('Keep saved identity and skip'), findsOneWidget);
+        expect(find.text('1 community added and kept.'), findsOneWidget);
+        await tester.tap(find.text('Keep saved identity and skip'));
+        await tester.pumpAndSettle();
+        expect(f.admitted, ['one']);
+        expect(find.byType(HostedConnectPage), findsNothing);
+        f.admitted.clear();
+        f.beforeAdmission = (name) async {
+          if (name == 'two') throw AccountFailure.rejected;
+        };
+        await tester.tap(find.text('Continue with Builderlab'));
+        await tester.pumpAndSettle();
+        expect(find.text('1 community added and kept.'), findsOneWidget);
+        expect(find.text('Try again').hitTestable(), findsNothing);
+        await tester.tap(find.text('Back to choices'));
+        await tester.pumpAndSettle();
+        expect(find.byType(CheckboxListTile), findsOneWidget);
+        expect(find.text('two'), findsOneWidget);
+      }
+    },
+    skip: HostedEnvironment.authDomains.isEmpty,
+  );
+}
diff --git a/mobile/test/features/onboarding/hosted_journeys_test.dart b/mobile/test/features/onboarding/hosted_journeys_test.dart
new file mode 100644
index 0000000000..c65c2c84dc
--- /dev/null
+++ b/mobile/test/features/onboarding/hosted_journeys_test.dart
@@ -0,0 +1,783 @@
+import 'package:buzz/shared/hosted/hosted_environment.dart';
+import 'package:buzz/features/pairing/pairing_provider.dart';
+import 'package:buzz/shared/deeplink/pending_deep_link_provider.dart';
+import 'dart:async';
+import 'dart:convert';
+
+import 'package:buzz/features/onboarding/hosted_profile_setup.dart';
+import 'package:buzz/onboarding_app_entry.dart';
+import 'package:buzz/shared/auth/auth.dart';
+import 'package:buzz/shared/hosted/builderlab_account.dart';
+import 'package:buzz/shared/hosted/account_identity_store.dart';
+import 'package:flutter_secure_storage/flutter_secure_storage.dart';
+import 'package:buzz/shared/hosted/hosted_relay_auth.dart';
+import 'package:buzz/shared/relay/relay_session.dart';
+import 'package:buzz/shared/relay/relay_provider.dart';
+import 'package:buzz/shared/relay/media_image.dart';
+import 'package:buzz/shared/utils/string_utils.dart';
+import 'package:flutter/material.dart';
+import 'package:flutter_test/flutter_test.dart';
+import 'package:http/http.dart' as http;
+
+import '../../helpers/hosted_journey_fixture.dart';
+
+void main() {
+  void journey(
+    String name,
+    Future<void> Function(WidgetTester, HostedJourneyFixture) run, {
+    bool requiresAuthDomain = false,
+    bool requiresBuilderlab = true,
+  }) {
+    testWidgets(
+      name,
+      (tester) async {
+        final fixture = HostedJourneyFixture();
+        // Keep asynchronous storage/HTTP owners in one real zone across tests;
+        // their serialized tails otherwise outlive the widget fake clock. The
+        // fixture pumps bounded frames with event-loop yields, not pumpAndSettle.
+        await tester.runAsync(
+          () => http.runWithClient(() async {
+            try {
+              await run(tester, fixture);
+            } finally {
+              await fixture.dispose(tester);
+            }
+          }, fixture.client),
+        );
+      },
+      skip:
+          (requiresBuilderlab && HostedEnvironment.authDomains.isEmpty) ||
+          (requiresAuthDomain &&
+              !HostedEnvironment.requiresAuth('one.communities.buzz.xyz')),
+    );
+  }
+
+  journey(
+    'QR credentials enter without an account when domain is not required',
+    (tester, f) async {
+      if (HostedEnvironment.requiresAuth('paired.communities.buzz.xyz')) return;
+      // Seed a previous account session: an opt-out build must not restore it.
+      await f.initialize(localIdentity: false);
+      f.requests.clear();
+      await f.mount(
+        tester,
+        pairingValidator: ({required relayUrl, required nsec}) async {},
+      );
+      if (HostedEnvironment.authDomains.isEmpty) {
+        expect(f.activeFlow, isNull);
+        expect(f.requests, isEmpty);
+        expect(find.text('Connect to Builderlab'), findsNothing);
+        expect(find.text('Continue with Builderlab'), findsNothing);
+        expect(find.text('Create a community'), findsNothing);
+        expect(find.text('Enter a community link'), findsOneWidget);
+        expect(find.text('Scan a QR code'), findsOneWidget);
+        expect(find.text('Use pairing code'), findsOneWidget);
+        await f.tap(tester, 'Enter a community link');
+        expect(
+          find.byKey(const Key('community-link-input')).hitTestable(),
+          findsOneWidget,
+        );
+        expect(f.activeFlow, isNull);
+        await f.tap(tester, 'Back');
+        expect(f.requests, isEmpty);
+      }
+      final notifier = f.container.read(pairingProvider.notifier);
+      await notifier.pair(
+        base64Url.encode(
+          utf8.encode(
+            jsonEncode({
+              'relayUrl': 'https://paired.communities.buzz.xyz',
+              'nsec': f.keys.nsec,
+              'pubkey': f.keys.public,
+            }),
+          ),
+        ),
+      );
+      await f.settle(tester);
+      final saved = (await f.storage.loadAll()).single;
+      expect(saved.nsec, f.keys.nsec);
+      expect(saved.pubkey, f.keys.public);
+      expect(f.sent('/exchange'), isEmpty);
+      expect(f.sent('/current'), isEmpty);
+      expect(f.sent('/nsec-backups/status'), isEmpty);
+      expect(find.text('Sign in to Builderlab to reconnect'), findsNothing);
+    },
+    requiresBuilderlab: false,
+  );
+
+  journey(
+    'saved community signs in again without changing identity or onboarding',
+    (tester, f) async {
+      f.relayAuthEnabled = true;
+      await f.initialize(signedIn: false);
+      final community = Community.create(
+        name: 'One',
+        relayUrl: 'wss://one.communities.buzz.xyz',
+        pubkey: f.keys.public,
+        nsec: f.keys.nsec,
+      );
+      await f.storage.save(community);
+      await f.storage.saveActiveId(community.id);
+      await f.mount(tester, openEntry: false);
+      // The real signed-in app watches its session; the fixture's home is inert.
+      final sessionSubscription = f.container.listen(
+        relaySessionProvider,
+        (_, _) {},
+      );
+      addTearDown(sessionSubscription.close);
+      final session = f.container.read(relaySessionProvider.notifier);
+      await f.settle(tester);
+      if (!HostedEnvironment.requiresAuth(Uri.parse(community.relayUrl).host)) {
+        expect(find.text('Sign in to Builderlab to reconnect'), findsNothing);
+        expect(f.socketHeaders, isNotEmpty);
+        expect(f.socketHeaders, everyElement(isEmpty));
+        expect(f.sent('/assertions'), isEmpty);
+        expect(f.container.read(relayConfigProvider).nsec, community.nsec);
+        return;
+      }
+      expect(find.text('Sign in to Builderlab to reconnect'), findsOneWidget);
+      expect(f.socketHeaders, isEmpty);
+
+      final browser = Completer<void>();
+      f.beforeBrowserReturn = () => browser.future;
+      await f.tap(tester, 'Sign in');
+      await f.tap(tester, 'Cancel sign-in');
+      browser.complete();
+      await f.settle(tester);
+      expect(find.text('Sign in to Builderlab to reconnect'), findsOneWidget);
+      expect(f.socketHeaders, isEmpty);
+
+      f.beforeBrowserReturn = null;
+      await f.tap(tester, 'Sign in');
+      await f.settle(tester);
+      expect(f.socketHeaders, isNotEmpty);
+      expect(find.text('Sign in to Builderlab to reconnect'), findsNothing);
+      await session.queryRelay(const []);
+      expect(f.sent('/query'), hasLength(1));
+      final proofRequest = f.sent('/identity/assertions').single;
+      expect(
+        proofRequest.headers['X-BB-Session-Credential'],
+        'synthetic-session',
+      );
+      final proof =
+          jsonDecode(
+                utf8.decode(
+                  base64Decode(
+                    proofRequest.headers['Authorization']!.substring(6),
+                  ),
+                ),
+              )
+              as Map;
+      expect(proof['pubkey'], f.keys.public);
+      expect(
+        proof['tags'],
+        contains(equals(['u', proofRequest.url.toString()])),
+      );
+
+      // Production media transport attaches only to its captured community,
+      // refuses redirects, and renews an expired assertion without browser UI.
+      final media = f.container.read(mediaHttpClientProvider);
+      for (final origin in [
+        'https://one.communities.buzz.xyz',
+        'https://outside.example',
+      ]) {
+        await media.get(Uri.parse('$origin/auth-transport'));
+        final request = f.requests.last;
+        expect(
+          request.headers['Nostr-Federated-Identity'],
+          origin.contains('communities.buzz.xyz')
+              ? 'Bearer synthetic-assertion'
+              : isNull,
+        );
+        if (origin.contains('communities.buzz.xyz')) {
+          expect(request.followRedirects, isFalse);
+        }
+      }
+      final logins = f.browserStarts;
+      final issued = f.sent('/identity/assertions').length;
+      f.assertionNow = f.assertionNow.add(const Duration(minutes: 6));
+      await session.queryRelay(const []);
+      expect(f.sent('/identity/assertions'), hasLength(issued + 1));
+      expect(f.browserStarts, logins);
+
+      f.expiredSession = true;
+      f.assertionNow = f.assertionNow.add(const Duration(minutes: 6));
+      await expectLater(
+        session.queryRelay(const []),
+        throwsA(AccountFailure.signedOut),
+      );
+      await f.settle(tester);
+      expect(find.text('Sign in to Builderlab to reconnect'), findsOneWidget);
+      final beforeWrongAccount = f.sent('/identity/assertions').length;
+      f.bound = f.secondKeys.public;
+      f.subject = 'wrong-owner';
+      await f.tap(tester, 'Sign in');
+      await f.settle(tester);
+      expect(
+        find.text(
+          'This account cannot reconnect to this community with its saved key.',
+        ),
+        findsOneWidget,
+      );
+      expect(f.sent('/identity/assertions'), hasLength(beforeWrongAccount));
+      // An empty different account cannot claim the saved key through reconnect.
+      f.bound = null;
+      await f.tap(tester, 'Use a different account');
+      await f.settle(tester);
+      expect(
+        find.text(
+          'This account cannot reconnect to this community with its saved key.',
+        ),
+        findsOneWidget,
+      );
+      expect(f.sent('/identity/assertions'), hasLength(beforeWrongAccount));
+      expect(f.bound, isNull);
+      expect(await f.store.read(), isNull);
+      expect((await f.storage.loadAll()).single.nsec, community.nsec);
+      f.subject = 'journey-owner';
+      f.bound = f.keys.public;
+      await f.tap(tester, 'Use a different account');
+      await f.settle(tester);
+      expect(
+        f.container.read(builderlabAccountProvider).account!.subject,
+        'journey-owner',
+      );
+      expect(find.text('Use a different account'), findsNothing);
+      expect((await f.storage.loadAll()).single.nsec, community.nsec);
+      // A legacy account can link the existing saved key on first issuance.
+      f.bound = null;
+      f.assertionNow = f.assertionNow.add(const Duration(minutes: 6));
+      await session.reconnect();
+      await f.settle(tester);
+      expect(f.bound, f.keys.public);
+      expect(
+        find.text(
+          'This account cannot reconnect to this community with its saved key.',
+        ),
+        findsNothing,
+      );
+      expect((await f.storage.loadAll()).single.nsec, community.nsec);
+      expect(await f.storage.loadActiveId(), community.id);
+      expect((await f.store.read())!.pubkey, f.keys.public);
+      for (final path in ['/status', '/enrollment', '/communities/joined']) {
+        expect(
+          f.sent(path),
+          isEmpty,
+          reason: 'Reconnect must not run onboarding',
+        );
+      }
+      // The issuer can succeed while the relay refuses the upgrade. One
+      // renewal is allowed, then stop; a user retry can recover later.
+      f.refuseUpgrade = true;
+      final attempts = f.socketHeaders.length;
+      await session.reconnect();
+      await f.settle(tester);
+      expect(f.socketHeaders.length, attempts + 2);
+      expect(
+        f.container.read(relaySessionProvider).status,
+        SessionStatus.disconnected,
+      );
+      expect(find.text('Use a different account'), findsOneWidget);
+      f.refuseUpgrade = false;
+      await session.reconnect();
+      await f.settle(tester);
+
+      // A timed-out query cannot dispatch later when a slow issuer completes.
+      final stalled = Completer<void>();
+      f.beforeAssertionReturn = () => stalled.future;
+      f.assertionNow = f.assertionNow.add(const Duration(minutes: 6));
+      final queries = f.sent('/query').length;
+      await expectLater(
+        session.queryRelay(const [], timeout: const Duration(milliseconds: 20)),
+        throwsA(isA<TimeoutException>()),
+      );
+      stalled.complete();
+      await f.settle(tester);
+      expect(f.sent('/query'), hasLength(queries));
+      f.beforeAssertionReturn = null;
+      expect(f.container.read(relayConfigProvider).nsec, community.nsec);
+    },
+    requiresBuilderlab: false,
+  );
+
+  journey(
+    'fresh account signs in, backs up, accepts invite and retries starters before home',
+    (tester, f) async {
+      await f.initialize(
+        localIdentity: false,
+        cloudChoice: true,
+        signedIn: false,
+      );
+      f.starterFailures = 2;
+      final browserReturn = Completer<void>();
+      f.beforeBrowserReturn = () => browserReturn.future;
+      final enrollmentReached = Completer<void>();
+      final enrollmentReturn = Completer<void>();
+      f.beforeEnrollmentReturn = () {
+        enrollmentReached.complete();
+        return enrollmentReturn.future;
+      };
+      await f.mount(tester);
+      await f.link(tester, 'one');
+      try {
+        expect(
+          find.text('Enter a community link').hitTestable(),
+          findsOneWidget,
+        );
+        expect(find.text('Scan a QR code').hitTestable(), findsOneWidget);
+        expect(find.text('Start login again'), findsNothing);
+        expect(find.text('Complete sign-in in your browser.'), findsNothing);
+      } finally {
+        browserReturn.complete();
+      }
+      await enrollmentReached.future.timeout(const Duration(seconds: 5));
+      await tester.pump();
+      try {
+        await tester.tap(find.text('Leave setup').hitTestable());
+        await tester.pump();
+      } finally {
+        enrollmentReturn.complete();
+      }
+      await f.settle(tester);
+      expect(f.sent('/nsec-backups'), isEmpty);
+      final retainedKey = (await f.store.read())!.pubkey;
+      f.beforeEnrollmentReturn = null;
+      // A dispatched upload can succeed after cancellation. Its receipt must
+      // still be durable; resuming must not replay an acknowledged backup.
+      f.beforeUploadReturn = () => f.flow.leave();
+      await f.link(tester, 'one');
+      expect((await f.store.read())!.backup, isNotNull);
+      f.beforeUploadReturn = null;
+      await f.link(tester, 'one');
+      expect((await f.store.read())!.pubkey, retainedKey);
+      expect(f.browserStarts, 1);
+      final generated = (await f.store.read())!;
+      expect(generated.pubkey, f.bound);
+      expect(generated.backup, isNotNull);
+      expect(f.sent('/verify'), hasLength(1));
+      expect(f.sent('/nsec-backups'), hasLength(1));
+      final accept = find.widgetWithText(FilledButton, 'Accept and join');
+      expect(tester.widget<FilledButton>(accept).onPressed, isNull);
+      expect(f.sent('/claim'), isEmpty);
+      expect(await f.storage.loadAll(), isEmpty);
+      await f.tap(tester, 'Terms of service');
+      expect(find.text('Be kind to this community.'), findsOneWidget);
+      await tester.tap(find.byType(CheckboxListTile));
+      await f.settle(tester);
+      await f.tap(tester, 'Accept and join');
+      expect(find.text('Try again').hitTestable(), findsOneWidget);
+      final pending = (await f.storage.loadAll()).single;
+      expect(pending.starterSetupIncomplete, isTrue);
+      expect(pending.pubkey, generated.pubkey);
+      expect(f.sent('/claim'), hasLength(1));
+      expect(
+        jsonDecode(f.sent('/claim').single.body)['policy_receipt'],
+        'synthetic-policy-receipt',
+      );
+      expect(
+        jsonDecode(f.sent('/accept-policy').single.body)['age_confirmed'],
+        isTrue,
+      );
+      // Reopen the saved invite after its claim was consumed. Starter recovery
+      // must retain the durable marker and must not claim it again.
+      await f.link(tester, 'one');
+      expect((await f.storage.loadAll()).single.starterSetupIncomplete, isTrue);
+      expect(find.text('Try again').hitTestable(), findsOneWidget);
+      await f.tap(tester, 'Try again');
+      expect(find.byType(HostedProfileSetup), findsOneWidget);
+      expect(f.sent('/claim'), hasLength(1));
+      expect(f.recoveryScopes, hasLength(3));
+      expect(
+        f.recoveryScopes.every((scope) => scope.nsec == pending.nsec),
+        isTrue,
+      );
+      await tester.enterText(
+        find.byType(TextField).hitTestable(),
+        'Journey Person',
+      );
+      await f.tap(tester, 'Continue');
+      expect(f.profileWrites, ['Journey Person']);
+      final saved = (await f.storage.loadAll()).single;
+      expect(saved.id, pending.id);
+      expect(saved.starterSetupIncomplete, isFalse);
+      expect(await f.storage.loadActiveId(), saved.id);
+      expect(find.byType(OnboardingAppEntry), findsNothing);
+      expect(find.text('Community home').hitTestable(), findsOneWidget);
+    },
+    requiresAuthDomain: true,
+  );
+
+  for (final boundAccount in [false, true]) {
+    journey(
+      'switch accounts preserves both keys and requires unbound reuse consent ($boundAccount)',
+      (tester, f) async {
+        await f.initialize();
+        final original = f.store;
+        await f.mount(tester);
+        await f.container.read(builderlabAccountProvider).clearLocalSession();
+        f.subject = 'new-owner';
+        f.bound = boundAccount ? f.secondKeys.public : null;
+        if (boundAccount) f.cloudKeys.add(f.secondKeys);
+        await f.tap(tester, 'Continue with Builderlab');
+        if (!boundAccount) {
+          expect(find.text('Saved identity'), findsOneWidget);
+          expect(f.sent('/verify'), isEmpty);
+          expect(f.sent('/nsec-backups'), isEmpty);
+          expect(await f.store.read(), isNull);
+          await f.tap(tester, fullNpub(f.keys.public)!);
+        }
+        final saved = (await f.store.read())!;
+        expect(
+          saved.pubkey,
+          boundAccount ? f.secondKeys.public : f.keys.public,
+        );
+        expect(saved.backup!.subject, 'new-owner');
+        expect((await original.read())!.pubkey, f.keys.public);
+        expect((await original.read())!.backup!.subject, 'journey-owner');
+      },
+    );
+  }
+
+  journey(
+    'choose second cloud identity, dismiss profile, retry remaining batch without losing keys',
+    (tester, f) async {
+      await f.initialize(localIdentity: false, cloudChoice: true);
+      f.cloudKeys.addAll([f.keys, f.secondKeys]);
+      f.rejectList = true;
+      f.secondRelayFailures = 1;
+      final legacy = Community.create(
+        name: 'Saved local',
+        relayUrl: 'wss://saved.example',
+        pubkey: f.keys.public,
+        nsec: f.keys.nsec,
+      );
+      await f.storage.save(legacy);
+      await f.storage.saveActiveId(legacy.id);
+      await f.mount(tester);
+      await f.tap(tester, 'Continue with Builderlab');
+      expect(find.text('Use Builderlab identity'), findsNWidgets(2));
+      await f.tap(tester, fullNpub(f.secondKeys.public)!);
+      expect((await f.store.read())!.pubkey, f.secondKeys.public);
+      expect(
+        find.text('We could not finish connecting. You can try again.'),
+        findsOneWidget,
+      );
+      expect(
+        find.text(
+          'No communities available to add. Scan a QR code or use an invite link.',
+        ),
+        findsNothing,
+      );
+      f.rejectList = false;
+      await f.tap(tester, 'Continue with Builderlab');
+      expect(
+        find.text(
+          'No communities available to add. Scan a QR code or use an invite link.',
+        ),
+        findsOneWidget,
+      );
+      expect(find.text('Scan a QR code'), findsOneWidget);
+      expect(find.text('Use pairing code'), findsOneWidget);
+      f.rows.addAll([f.row('one'), f.row('two')]);
+      await f.tap(tester, 'Continue with Builderlab');
+      // Joined communities are added automatically after choosing the identity.
+      expect(find.byType(CheckboxListTile).hitTestable(), findsNothing);
+      expect(find.byType(HostedProfileSetup), findsOneWidget);
+      final firstSaved = (await f.storage.loadAll()).firstWhere(
+        (c) => c.name == 'one',
+      );
+      Navigator.of(
+        tester.element(find.byType(HostedProfileSetup)),
+        rootNavigator: true,
+      ).pop();
+      await f.settle(tester);
+      expect(f.profileWrites, isEmpty);
+      expect(find.text('Try again').hitTestable(), findsOneWidget);
+      expect(
+        (await f.storage.loadAll()).map((c) => c.id),
+        containsAll([legacy.id, firstSaved.id]),
+      );
+      await f.tap(tester, 'Try again');
+      final saved = await f.storage.loadAll();
+      expect(saved, hasLength(3));
+      expect(saved.singleWhere((c) => c.id == legacy.id).nsec, f.keys.nsec);
+      expect(
+        saved
+            .where((c) => c.id != legacy.id)
+            .every((c) => c.nsec == f.secondKeys.nsec),
+        isTrue,
+      );
+      expect(saved.singleWhere((c) => c.name == 'one').id, firstSaved.id);
+      expect(await f.storage.loadActiveId(), firstSaved.id);
+      expect(f.probes.where((c) => c.name == 'one'), hasLength(1));
+      expect(f.probes.where((c) => c.name == 'two'), hasLength(2));
+      expect(find.byType(OnboardingAppEntry), findsNothing);
+    },
+  );
+
+  for (final unreadableProfile in [false, true]) {
+    journey(
+      'new device recovers and preserves existing/unreadable profile ($unreadableProfile)',
+      (tester, f) async {
+        await f.initialize(localIdentity: false);
+        f.cloudKeys.addAll([f.secondKeys, f.keys]);
+        f.rows.add(f.row('one'));
+        f.offerProfile = false;
+        f.profileUnavailable = unreadableProfile;
+        await f.mount(tester);
+        await f.tap(tester, 'Continue with Builderlab');
+        // One discovered community is admitted automatically.
+        expect(f.profileWrites, isEmpty);
+        expect(find.byType(HostedProfileSetup), findsNothing);
+        final saved = (await f.storage.loadAll()).single;
+        expect(saved.nsec, f.keys.nsec);
+        expect(saved.pubkey, f.keys.public);
+        expect((await f.store.read())!.pubkey, f.keys.public);
+        expect(f.sent('/recovery'), hasLength(1));
+        expect(f.sent('/challenge'), isEmpty);
+        expect(await f.storage.loadActiveId(), saved.id);
+        expect(find.byType(OnboardingAppEntry), findsNothing);
+      },
+    );
+  }
+
+  journey(
+    'self-hosted link explicitly reuses saved account key and persists admission',
+    (tester, f) async {
+      await f.initialize();
+      f.requests.clear();
+      await f.mount(tester);
+      await f.tap(tester, 'Enter a community link');
+      await tester.enterText(
+        find.byKey(const Key('community-link-input')).hitTestable(),
+        'my-community.example',
+      );
+      await f.tap(tester, 'Continue');
+      await f.tap(tester, 'Saved identity');
+      final saved = (await f.storage.loadAll()).single;
+      expect(saved.relayUrl, 'wss://my-community.example');
+      expect(saved.nsec, f.keys.nsec);
+      expect(await f.storage.loadActiveId(), saved.id);
+      expect(f.probes, hasLength(1));
+      expect(f.sent('/claim'), isEmpty);
+      expect(
+        (await const FlutterSecureStorage().readAll()).keys.where(
+          (key) => key.startsWith('buzz_pending_self_hosted_'),
+        ),
+        isEmpty,
+      );
+      // Reopening an interrupted self-hosted invite follows legacy recovery.
+      await f.storage.save(saved.copyWith(starterSetupIncomplete: true));
+      f.container.invalidate(communityListProvider);
+      f.container
+          .read(pendingDeepLinkProvider.notifier)
+          .open(
+            Uri(
+              scheme: 'buzz',
+              host: 'join',
+              queryParameters: {
+                'relay': saved.relayUrl,
+                'code': 'consumed-invite',
+              },
+            ),
+          );
+      await f.settle(tester);
+      expect(f.recoveryScopes, hasLength(1));
+      expect(
+        (await f.storage.loadAll()).single.starterSetupIncomplete,
+        isFalse,
+      );
+      expect(f.sent('/claim'), isEmpty);
+
+      expect(find.byType(OnboardingAppEntry), findsNothing);
+      await f.container
+          .read(communityListProvider.notifier)
+          .removeCommunity(saved.id);
+      await AccountIdentityStore(
+        subject: 'other-owner',
+      ).create(f.secondKeys.nsec);
+      await f.restart(tester);
+      await f.tap(tester, 'Community home');
+      await f.tap(tester, 'Enter a community link');
+      await tester.enterText(
+        find.byKey(const Key('community-link-input')).hitTestable(),
+        'my-community.example',
+      );
+      await f.tap(tester, 'Continue');
+      // A refused key must not pin the URL against an explicit allowed choice.
+      f.refusedSelfHostedPubkey = f.keys.public;
+      await f.tap(tester, fullNpub(f.keys.public)!);
+      expect(await f.storage.loadAll(), isEmpty);
+      expect(find.textContaining('Could not join.'), findsOneWidget);
+      await f.tap(tester, fullNpub(f.secondKeys.public)!);
+      expect((await f.storage.loadAll()).single.nsec, f.secondKeys.nsec);
+      expect(
+        (await AccountIdentityStore().forPairing(f.keys.public).read())!.pubkey,
+        f.keys.public,
+      );
+      if (HostedEnvironment.authDomains.isEmpty) {
+        expect(f.requests, isEmpty);
+      }
+    },
+    requiresBuilderlab: false,
+  );
+
+  journey(
+    'signed-in invite survives restart and leaving consent abandons only setup',
+    (tester, f) async {
+      await f.initialize();
+      await f.mount(tester);
+      await f.link(tester, 'one');
+      expect(find.text('Accept and join').hitTestable(), findsOneWidget);
+      await f.restart(tester);
+      await f.tap(tester, 'Start login again');
+      expect(find.text('Accept and join').hitTestable(), findsOneWidget);
+      expect(f.browserStarts, 0);
+      expect(
+        f.sent('/api/join-policy').last.url.host,
+        'one.communities.buzz.xyz',
+      );
+      Navigator.of(
+        tester.element(find.text('Accept and join')),
+        rootNavigator: true,
+      ).pop();
+      await f.settle(tester);
+      await f.restart(tester);
+      expect(find.text('Start login again'), findsNothing);
+      expect(find.text('Community home').hitTestable(), findsOneWidget);
+      expect(f.sent('/accept-policy'), isEmpty);
+      expect(f.sent('/claim'), isEmpty);
+      expect(f.probes, isEmpty);
+      expect(await f.storage.loadAll(), isEmpty);
+      expect(await f.storage.loadActiveId(), isNull);
+      expect((await f.store.read())!.pubkey, f.keys.public);
+
+      // An open relay's successful AUTH must not convert a failed invitation
+      // into a completed claim for a non-member.
+      f.offerProfile = false;
+      f.inviteExpired = true;
+      f.missingList = true;
+      await f.link(tester, 'one');
+      await tester.tap(find.byType(CheckboxListTile));
+      await f.settle(tester);
+      await f.tap(tester, 'Accept and join');
+      expect(await f.storage.loadAll(), isEmpty);
+      expect(f.probes, isEmpty);
+
+      expect(
+        find.text('This invite has expired. Ask for a new invite link.'),
+        findsOneWidget,
+      );
+      f.missingList = false;
+      await f.link(tester, 'one');
+      await tester.tap(find.byType(CheckboxListTile));
+      await f.settle(tester);
+      await f.tap(tester, 'Accept and join');
+      expect(await f.storage.loadAll(), isEmpty);
+      expect(f.probes, isEmpty);
+
+      // The server admits this identity but its reply is lost. The retained
+      // intent resumes after restart even once the code has expired.
+      f.inviteExpired = false;
+      f.missingList = false;
+      f.loseClaimResponse = true;
+      await f.link(tester, 'one');
+      await tester.tap(find.byType(CheckboxListTile));
+      await f.settle(tester);
+      await f.tap(tester, 'Accept and join');
+      expect(await f.storage.loadAll(), isEmpty);
+      expect(f.rows, hasLength(1));
+      f.inviteExpired = true;
+      f.rejectList = true;
+      await f.restart(tester);
+      await f.tap(tester, 'Start login again');
+      await tester.tap(find.byType(CheckboxListTile));
+      await f.settle(tester);
+      await f.tap(tester, 'Accept and join');
+      expect(await f.storage.loadAll(), isEmpty);
+      expect(f.probes, isEmpty);
+      f.rejectList = false;
+      await f.tap(tester, 'Try again');
+      await tester.tap(find.byType(CheckboxListTile));
+      await f.settle(tester);
+      await f.tap(tester, 'Accept and join');
+      final saved = (await f.storage.loadAll()).single;
+      expect(saved.relayUrl, 'wss://one.communities.buzz.xyz');
+      expect(saved.pubkey, f.keys.public);
+      expect(await f.storage.loadActiveId(), saved.id);
+      expect(find.text('Community home').hitTestable(), findsOneWidget);
+    },
+    requiresAuthDomain: true,
+  );
+
+  journey(
+    'create survives a lost response and restart, then joins the same owned community',
+    (tester, f) async {
+      await f.initialize();
+      f.loseCreateResponse = true;
+      await f.mount(tester);
+      await f.tap(tester, 'Create a community');
+      await tester.enterText(find.byType(TextField).hitTestable(), 'new-home');
+      await f.tap(tester, 'Continue');
+      expect(find.text('Try again').hitTestable(), findsOneWidget);
+      expect(f.owned, hasLength(1));
+      expect(await f.storage.loadAll(), isEmpty);
+      await f.restart(tester);
+      await f.tap(tester, 'Start login again');
+      expect(find.byType(HostedProfileSetup), findsOneWidget);
+      await tester.enterText(find.byType(TextField).hitTestable(), 'Creator');
+      await f.tap(tester, 'Continue');
+      final saved = (await f.storage.loadAll()).single;
+      expect(saved.relayUrl, 'wss://new-home.communities.buzz.xyz');
+      expect(saved.nsec, f.keys.nsec);
+      expect(await f.storage.loadActiveId(), saved.id);
+      expect(f.sent('/v1/buzz/communities'), hasLength(2));
+      expect(f.owned, hasLength(1));
+      expect(f.sent('/status'), isEmpty);
+      expect(f.browserStarts, 0);
+      expect(f.profileWrites, ['Creator']);
+      expect(find.text('Community home').hitTestable(), findsOneWidget);
+    },
+  );
+
+  journey(
+    'second invitation replaces pending consent and only joins the newer community',
+    (tester, f) async {
+      await f.initialize();
+      f.offerProfile = false;
+      // The first dispatched attempt ends; retry owns the pending consent.
+      // A new incoming link must now invalidate that consent, not wait on it.
+      f.policyResponses.addAll([
+        http.Response('<html>Unavailable</html>', 502),
+        http.Response('', 503),
+        http.Response('{"error":"proxy_busy"}', 503),
+        http.Response('', 429),
+      ]);
+      await f.mount(tester);
+      await f.link(tester, 'one');
+      while (f.policyResponses.isNotEmpty) {
+        expect(find.text('Try again').hitTestable(), findsOneWidget);
+        expect(await f.storage.loadAll(), isEmpty);
+        await f.tap(tester, 'Try again');
+      }
+      await f.tap(tester, 'Try again');
+      expect(find.text('Accept and join').hitTestable(), findsOneWidget);
+      await f.link(tester, 'two');
+      await tester.tap(find.byType(CheckboxListTile));
+      await f.settle(tester);
+      await f.tap(tester, 'Accept and join');
+      final saved = (await f.storage.loadAll()).single;
+      expect(saved.relayUrl, 'wss://two.communities.buzz.xyz');
+      expect(saved.starterSetupIncomplete, isFalse);
+      expect(f.sent('/claim'), hasLength(1));
+      expect(f.sent('/claim').single.url.host, 'two.communities.buzz.xyz');
+      expect(f.sent('/accept-policy'), hasLength(1));
+      expect(
+        f.sent('/accept-policy').single.url.host,
+        'two.communities.buzz.xyz',
+      );
+      expect(find.byType(OnboardingAppEntry), findsNothing);
+    },
+    requiresAuthDomain: true,
+  );
+}
diff --git a/mobile/test/features/onboarding/onboarding_entry_routes_test.dart b/mobile/test/features/onboarding/onboarding_entry_routes_test.dart
new file mode 100644
index 0000000000..dcf2b90f50
--- /dev/null
+++ b/mobile/test/features/onboarding/onboarding_entry_routes_test.dart
@@ -0,0 +1,359 @@
+import 'package:buzz/shared/hosted/hosted_environment.dart';
+import 'dart:async';
+import 'dart:convert';
+
+import 'package:buzz/features/channels/channel.dart';
+import 'package:buzz/features/channels/channels_provider.dart';
+import 'package:buzz/features/onboarding/hosted_connect_page.dart';
+import 'package:buzz/features/onboarding/self_hosted_entry_sheet.dart';
+import 'package:buzz/hosted_app_gate.dart';
+import 'package:buzz/shared/hosted/hosted_flow_provider.dart';
+import 'package:buzz/onboarding_app_entry.dart';
+import 'package:buzz/shared/auth/auth.dart';
+import 'package:buzz/shared/deeplink/pending_deep_link_provider.dart';
+import 'package:buzz/shared/hosted/builderlab_account.dart';
+import 'package:buzz/shared/hosted/hosted_flow.dart';
+import 'package:buzz/shared/hosted/hosted_community_connection.dart';
+import 'package:buzz/shared/hosted/self_hosted_entry.dart';
+import 'package:buzz/shared/hosted/account_identity_store.dart';
+import 'package:buzz/shared/widgets/buzz_sheet_header.dart';
+import 'package:flutter/material.dart';
+import 'package:flutter_secure_storage/flutter_secure_storage.dart';
+import 'package:flutter_test/flutter_test.dart';
+import 'package:hooks_riverpod/hooks_riverpod.dart';
+
+import '../../helpers/hosted_communities_fixture.dart';
+import '../../helpers/widget_helpers.dart';
+
+class _NoChannels extends ChannelsNotifier {
+  @override
+  Future<List<Channel>> build() async => [];
+}
+
+void main() {
+  testWidgets('pushed Add route owns paired progress and self-hosted completion', (
+    tester,
+  ) async {
+    await tester.binding.setSurfaceSize(const Size(440, 956));
+    addTearDown(() => tester.binding.setSurfaceSize(null));
+    FlutterSecureStorage.setMockInitialValues({});
+    PendingDeepLinkNotifier.debugUriStreamOverride = const Stream<Uri>.empty();
+    final f = HostedCommunitiesFixture();
+    await f.initialize(widget: true);
+    addTearDown(() async {
+      PendingDeepLinkNotifier.debugUriStreamOverride = null;
+      await f.dispose();
+    });
+    var probes = 0;
+    final inventoryStorage = _EnumerationStorage();
+    await tester.pumpWidget(
+      WidgetHelpers.testable(
+        disableAnimations: true,
+        overrides: [
+          hostedFlowProvider.overrideWithValue(f.flow),
+          channelsProvider.overrideWith(_NoChannels.new),
+          selfHostedEntryProvider.overrideWithValue(
+            SelfHostedEntry(
+              accountStore: AccountIdentityStore(storage: inventoryStorage),
+              probe: (_) async {
+                probes++;
+              },
+            ),
+          ),
+        ],
+        child: HostedAppGate(
+          authenticated: true,
+          child: Builder(
+            builder: (context) => Center(
+              child: FilledButton(
+                onPressed: () => Navigator.of(context).push(
+                  MaterialPageRoute<void>(
+                    builder: (_) =>
+                        const OnboardingAppEntry(addingCommunity: true),
+                  ),
+                ),
+                child: const Text('Add community'),
+              ),
+            ),
+          ),
+        ),
+      ),
+    );
+    await tester.pumpAndSettle();
+    final container = ProviderScope.containerOf(
+      tester.element(find.byType(HostedAppGate)),
+    );
+    await container.read(authProvider.future);
+
+    Future<void> openEntry() async {
+      await tester.tap(find.text('Add community'));
+      await tester.pumpAndSettle();
+      expect(find.byType(OnboardingAppEntry), findsOneWidget);
+    }
+
+    Future<void> pair() async {
+      await tester.tap(find.text('Use pairing code').hitTestable());
+      await tester.pumpAndSettle();
+      await tester.enterText(
+        find.byType(TextField).hitTestable(),
+        base64Url.encode(
+          utf8.encode(
+            jsonEncode({
+              'relayUrl': 'https://paired.communities.buzz.xyz',
+              'nsec': f.keys.nsec,
+              'pubkey': f.keys.public,
+            }),
+          ),
+        ),
+      );
+      await tester.tap(find.text('Connect').hitTestable());
+      await tester.pump();
+      await tester.pump(const Duration(milliseconds: 100));
+    }
+
+    if (HostedEnvironment.authDomains.isNotEmpty) {
+      // A root-navigator choice modal must remain actionable above pushed Add.
+      f.rows = [f.row('one'), f.row('two')];
+      f.beforeAdmission = (name) async {
+        if (name == 'two') throw const SavedCommunityIdentityConflict();
+      };
+      await openEntry();
+      await tester.tap(find.text('Continue with Builderlab').hitTestable());
+      await tester.pumpAndSettle();
+      expect(f.admitted, ['one']);
+      expect(f.flow.stage, HostedFlowStage.communityConflict);
+      expect(
+        find.text('Keep saved identity and skip').hitTestable(),
+        findsOneWidget,
+      );
+      expect(find.text('Back to choices').hitTestable(), findsOneWidget);
+      await tester.tap(find.text('Back to choices').hitTestable());
+      await tester.pumpAndSettle();
+      expect(find.byType(CheckboxListTile).hitTestable(), findsOneWidget);
+      expect(find.text('two').hitTestable(), findsOneWidget);
+      f.beforeAdmission = null;
+      await tester.tap(find.text('Continue').hitTestable());
+      await tester.pumpAndSettle();
+      expect(f.admitted, ['one', 'two']);
+      expect(find.byType(OnboardingAppEntry), findsNothing);
+      expect(find.text('Add community').hitTestable(), findsOneWidget);
+      f.admitted.clear();
+      f.rows = [];
+      await f.flow.leave();
+    }
+    if (HostedEnvironment.requiresAuth('paired.communities.buzz.xyz')) {
+      await openEntry();
+      final admission = Completer<void>();
+      f.beforeAdmission = (_) => admission.future;
+      await pair();
+      expect(f.flow.accountOnly, isFalse);
+      expect(f.flow.stage, HostedFlowStage.working);
+      expect(find.text('Leave setup').hitTestable(), findsOneWidget);
+      expect(
+        find.byType(CircularProgressIndicator).hitTestable(),
+        findsOneWidget,
+      );
+      expect(find.byType(BuzzSheetHeader), findsNothing);
+      expect(find.byType(HostedConnectPage), findsNothing);
+      admission.completeError(AccountFailure.unavailable);
+      await tester.pumpAndSettle();
+      expect(f.flow.stage, HostedFlowStage.blocked);
+      expect(
+        find
+            .text('We could not finish connecting. You can try again.')
+            .hitTestable(),
+        findsOneWidget,
+      );
+      expect(find.text('Try again').hitTestable(), findsOneWidget);
+      expect(find.text('Leave setup').hitTestable(), findsOneWidget);
+      expect(find.byType(BuzzSheetHeader), findsNothing);
+      f.beforeAdmission = null;
+      await tester.tap(find.text('Try again').hitTestable());
+      await tester.pumpAndSettle();
+      expect(f.admitted, ['paired']);
+      expect(find.byType(OnboardingAppEntry), findsNothing);
+      expect(find.text('Add community').hitTestable(), findsOneWidget);
+
+      // Cancelling a paired sign-in keeps the Add route usable and clears intent.
+      await f.flow.leave();
+      await openEntry();
+      f.expired = true;
+      await pair();
+      await tester.pumpAndSettle();
+      expect(f.flow.stage, HostedFlowStage.signIn);
+      // Native browser owns sign-in presentation; the welcome/form stays behind it.
+      expect(find.byType(HostedConnectPage), findsNothing);
+      await f.flow.leave();
+      await tester.pumpAndSettle();
+      expect(f.flow.stage, HostedFlowStage.idle);
+      await tester.tap(find.text('Back').hitTestable());
+      await tester.pumpAndSettle();
+      expect(find.text('Enter a community link').hitTestable(), findsOneWidget);
+      expect(container.read(hostedInlineEntryProvider), isTrue);
+      f.expired = false;
+    } else {
+      await openEntry();
+    }
+
+    // Drive the real deep-link dispatcher, sheet, service and auth persistence.
+    await tester.tap(find.text('Enter a community link').hitTestable());
+    await tester.pumpAndSettle();
+    await tester.enterText(
+      find.byKey(const Key('community-link-input')).hitTestable(),
+      'new-community.example',
+    );
+    await tester.tap(find.text('Continue').hitTestable());
+    await tester.pumpAndSettle();
+    expect(find.byType(SelfHostedEntrySheet), findsOneWidget);
+    expect(find.text('Saved identity').hitTestable(), findsOneWidget);
+    expect(find.text('Import a Nostr key').hitTestable(), findsOneWidget);
+    Navigator.of(tester.element(find.byType(SelfHostedEntrySheet))).pop();
+    await tester.pumpAndSettle();
+    // A failed bulk read must keep explicit import available, but not offer
+    // generation on the strength of a falsely empty inventory.
+    inventoryStorage.failEnumeration = true;
+    await tester.tap(find.text('Continue').hitTestable());
+    await tester.pumpAndSettle();
+    expect(find.text('Import a Nostr key').hitTestable(), findsOneWidget);
+    expect(find.text('Create an identity and join'), findsNothing);
+    Navigator.of(tester.element(find.byType(SelfHostedEntrySheet))).pop();
+    await tester.pumpAndSettle();
+    await const FlutterSecureStorage().write(
+      key: 'buzz_nsec',
+      value: f.keys.nsec,
+    );
+    await tester.tap(find.text('Continue').hitTestable());
+    await tester.pumpAndSettle();
+    expect(find.text('Import a Nostr key').hitTestable(), findsOneWidget);
+    await tester.tap(find.text('Previous device identity').hitTestable());
+    await tester.pumpAndSettle();
+    expect(probes, 1);
+    expect(find.byType(SelfHostedEntrySheet), findsNothing);
+    expect(find.byType(OnboardingAppEntry), findsNothing);
+    expect(find.text('Add community').hitTestable(), findsOneWidget);
+    final saved = await container.read(communityStorageProvider).loadAll();
+    expect(saved.single.relayUrl, 'wss://new-community.example');
+    expect(saved.single.pubkey, f.keys.public);
+    expect(
+      await container.read(communityStorageProvider).loadActiveId(),
+      saved.single.id,
+    );
+
+    // Reopening an already saved URL switches to it and also closes Add.
+    await openEntry();
+    await tester.tap(find.text('Enter a community link').hitTestable());
+    await tester.pumpAndSettle();
+    await tester.enterText(
+      find.byKey(const Key('community-link-input')).hitTestable(),
+      'new-community.example',
+    );
+    await tester.tap(find.text('Continue').hitTestable());
+    await tester.pumpAndSettle();
+    expect(find.byType(OnboardingAppEntry), findsNothing);
+    expect(find.text('Add community').hitTestable(), findsOneWidget);
+    expect(probes, 1);
+    expect(
+      await container.read(communityStorageProvider).loadActiveId(),
+      saved.single.id,
+    );
+
+    // Popping Add releases ownership; a later invite uses the app-level UI.
+    await openEntry();
+    await tester.tap(find.text('Enter a community link').hitTestable());
+    await tester.pumpAndSettle();
+    await tester.tap(find.text('Back').hitTestable());
+    await tester.pumpAndSettle();
+    expect(container.read(hostedInlineEntryProvider), isTrue);
+    await tester.pageBack();
+    await tester.pumpAndSettle();
+    expect(find.byType(OnboardingAppEntry), findsNothing);
+    expect(container.read(hostedInlineEntryProvider), isFalse);
+    if (HostedEnvironment.requiresAuth('invited.communities.buzz.xyz')) {
+      f.expired = true;
+      container
+          .read(pendingDeepLinkProvider.notifier)
+          .open(
+            Uri(
+              scheme: 'buzz',
+              host: 'join',
+              queryParameters: {
+                'relay': 'wss://invited.communities.buzz.xyz',
+                'code': 'invite',
+              },
+            ),
+          );
+      await tester.pumpAndSettle();
+      expect(f.flow.stage, HostedFlowStage.signIn);
+      expect(find.text('Start login again').hitTestable(), findsOneWidget);
+      expect(find.text('Leave setup').hitTestable(), findsOneWidget);
+      await tester.tap(find.text('Leave setup').hitTestable());
+      await tester.pumpAndSettle();
+      f.expired = false;
+    }
+
+    // Disposing the entire scope while an entry owns presentation is safe.
+    await openEntry();
+    await tester.pumpWidget(const SizedBox.shrink());
+    await tester.pump();
+    expect(tester.takeException(), isNull);
+
+    if (HostedEnvironment.authDomains.isEmpty) return;
+
+    // A new coordinator restores the paired target and presents its waiting
+    // state on the entry route, without depending on accountOnly discovery.
+    await f.flow.stagePairedCommunity(
+      Community.create(
+        name: 'Restored',
+        relayUrl: 'wss://restored.communities.buzz.xyz',
+        pubkey: f.keys.public,
+        nsec: f.keys.nsec,
+      ),
+      isCurrent: () => true,
+    );
+    final restartedBrowser = DiscoveryBrowser();
+    final restarted = HostedFlow(
+      account: f.account,
+      browser: restartedBrowser,
+      store: f.store,
+      identity: f.flow.identity,
+      enterCommunity: (link, subject, pubkey, current) async {},
+    );
+    addTearDown(() async {
+      restarted.dispose();
+      await restartedBrowser.dispose();
+    });
+    await tester.pumpWidget(
+      WidgetHelpers.testable(
+        disableAnimations: true,
+        overrides: [hostedFlowProvider.overrideWithValue(restarted)],
+        child: const HostedAppGate(
+          authenticated: false,
+          child: OnboardingAppEntry(),
+        ),
+      ),
+    );
+    await tester.pumpAndSettle();
+    expect(restarted.stage, HostedFlowStage.signIn);
+    expect(find.text('Cancel sign-in').hitTestable(), findsOneWidget);
+    expect(find.byType(BuzzSheetHeader), findsNothing);
+    await tester.pumpWidget(const SizedBox.shrink());
+    await tester.pump();
+    expect(tester.takeException(), isNull);
+  });
+}
+
+class _EnumerationStorage extends FlutterSecureStorage {
+  bool failEnumeration = false;
+  @override
+  Future<Map<String, String>> readAll({
+    AppleOptions? iOptions,
+    AndroidOptions? aOptions,
+    LinuxOptions? lOptions,
+    WebOptions? webOptions,
+    AppleOptions? mOptions,
+    WindowsOptions? wOptions,
+  }) async {
+    if (failEnumeration) throw StateError('unrelated entry cannot decrypt');
+    return super.readAll();
+  }
+}
diff --git a/mobile/test/features/pairing/pairing_hosted_handoff_test.dart b/mobile/test/features/pairing/pairing_hosted_handoff_test.dart
new file mode 100644
index 0000000000..474b6d5ad7
--- /dev/null
+++ b/mobile/test/features/pairing/pairing_hosted_handoff_test.dart
@@ -0,0 +1,145 @@
+import 'package:buzz/shared/hosted/hosted_environment.dart';
+import 'dart:async';
+import 'dart:convert';
+import 'package:buzz/features/pairing/pairing_provider.dart';
+import 'package:buzz/shared/hosted/hosted_flow_provider.dart';
+import 'package:buzz/shared/community/community.dart';
+import 'package:buzz/shared/hosted/hosted_flow.dart';
+import 'package:flutter_secure_storage/flutter_secure_storage.dart';
+import 'package:flutter_test/flutter_test.dart';
+import 'package:hooks_riverpod/hooks_riverpod.dart';
+import 'package:nostr/nostr.dart' as nostr;
+import '../../helpers/hosted_communities_fixture.dart';
+
+void main() {
+  TestWidgetsFlutterBinding.ensureInitialized();
+  setUp(() => FlutterSecureStorage.setMockInitialValues({}));
+  for (final backup in [true, false]) {
+    test(
+      'hosted pairing requires backup=$backup through real coordinator',
+      () async {
+        if (!HostedEnvironment.requiresAuth('paired.communities.buzz.xyz')) {
+          return;
+        }
+        final f = HostedCommunitiesFixture();
+        await f.initialize(backup: backup);
+        addTearDown(f.dispose);
+        var legacyProbes = 0;
+        final notifier = PairingNotifier(
+          credentialValidator: ({required relayUrl, required nsec}) async {
+            legacyProbes++;
+          },
+        );
+        final container = ProviderContainer(
+          overrides: [
+            hostedFlowProvider.overrideWithValue(f.flow),
+            pairingProvider.overrideWith(() => notifier),
+          ],
+        );
+        addTearDown(container.dispose);
+        final settled = Completer<void>();
+        f.flow.addListener(() {
+          if ((f.flow.stage == HostedFlowStage.complete ||
+                  f.flow.stage == HostedFlowStage.blocked) &&
+              !settled.isCompleted) {
+            settled.complete();
+          }
+        });
+        await container.read(pairingProvider.notifier).pair(_payload(f.keys));
+        await settled.future.timeout(const Duration(seconds: 2));
+        expect(legacyProbes, 0);
+        expect(f.admitted, backup ? ['paired'] : isEmpty);
+        expect((await f.store.read())?.pubkey, f.keys.public);
+      },
+    );
+  }
+  test(
+    'verified paired destination survives restart with identity constraint',
+    () async {
+      final f = HostedCommunitiesFixture();
+      await f.initialize();
+      addTearDown(f.dispose);
+      await f.flow.stagePairedCommunity(
+        Community.create(
+          name: 'Paired',
+          relayUrl: 'https://paired.communities.buzz.xyz',
+          pubkey: f.keys.public,
+          nsec: f.keys.nsec,
+          sensitiveActionPolicy: SensitiveActionPolicy.enabled,
+        ),
+        isCurrent: () => true,
+      );
+      final browser = DiscoveryBrowser();
+      final admitted = <String>[];
+      final resumed = HostedFlow(
+        account: f.account,
+        browser: browser,
+        store: f.store,
+        identity: f.flow.identity,
+        enterCommunity: (link, subject, pubkey, current) async {
+          if (current()) admitted.add(pubkey);
+        },
+      );
+      addTearDown(() async {
+        resumed.dispose();
+        await browser.dispose();
+      });
+      await resumed.initialize();
+      expect(resumed.stage, HostedFlowStage.signIn);
+      expect(
+        resumed.pairedSensitiveActionPolicy,
+        SensitiveActionPolicy.enabled,
+      );
+      await resumed.retry();
+      expect(admitted, [f.keys.public]);
+      expect(resumed.stage, HostedFlowStage.complete);
+    },
+  );
+
+  test(
+    'hosted pairing retains transfer but blocks conflicting account admission',
+    () async {
+      if (!HostedEnvironment.requiresAuth('paired.communities.buzz.xyz')) {
+        return;
+      }
+      final f = HostedCommunitiesFixture();
+      await f.initialize();
+      addTearDown(f.dispose);
+      final container = ProviderContainer(
+        overrides: [hostedFlowProvider.overrideWithValue(f.flow)],
+      );
+      addTearDown(container.dispose);
+      final transferred = nostr.Keys('2'.padLeft(64, '0'));
+      final settled = Completer<void>();
+      f.flow.addListener(() {
+        if ((f.flow.stage == HostedFlowStage.blocked ||
+                f.flow.stage == HostedFlowStage.complete) &&
+            !settled.isCompleted) {
+          settled.complete();
+        }
+      });
+      await container
+          .read(pairingProvider.notifier)
+          .pair(_payload(transferred));
+      await settled.future.timeout(const Duration(seconds: 2));
+      expect(f.flow.stage, HostedFlowStage.blocked);
+      expect(f.flow.problem, HostedFlowProblem.identityMismatch);
+      expect(
+        (await f.store.forPairing(transferred.public).read())?.pubkey,
+        transferred.public,
+      );
+      expect((await f.store.read())?.pubkey, f.keys.public);
+      expect(f.admitted, isEmpty);
+    },
+  );
+}
+
+String _payload(nostr.Keys keys) => base64Url.encode(
+  utf8.encode(
+    jsonEncode({
+      'relayUrl': 'https://paired.communities.buzz.xyz',
+      'nsec': keys.nsec,
+      'pubkey': keys.public,
+    }),
+  ),
+);
diff --git a/mobile/test/features/pairing/pairing_provider_test.dart b/mobile/test/features/pairing/pairing_provider_test.dart
index d08ca5387d..bbece7916d 100644
--- a/mobile/test/features/pairing/pairing_provider_test.dart
+++ b/mobile/test/features/pairing/pairing_provider_test.dart
@@ -528,6 +528,37 @@ void main() {
         },
       );
 
+      test('admission rejection never reports a successful transfer', () async {
+        importAuth.authentication = Completer<void>();
+        importAuth.entered = Completer<void>();
+        final finished = Completer<void>();
+        container.listen(pairingProvider, (_, next) {
+          if (next.status == PairingStatus.error && !finished.isCompleted) {
+            finished.complete();
+          }
+        });
+        await beginImport(protected: false);
+        validation.complete();
+        await importAuth.entered!.future;
+        expect(
+          socket
+              .decryptedPublishedMessages(sourceSecret)
+              .where((message) => message['type'] == 'complete'),
+          isEmpty,
+        );
+        importAuth.authentication!.completeError(
+          StateError('Admission refused'),
+        );
+        await finished.future;
+        final completions = socket
+            .decryptedPublishedMessages(sourceSecret)
+            .where((message) => message['type'] == 'complete')
+            .toList();
+        expect(completions, hasLength(1));
+        expect(completions.single['success'], isFalse);
+        expect(container.read(pairedCommunityLandingProvider), isNull);
+      });
+
       test('unchecked protection persists on a successful import', () async {
         await beginImport(protected: false);
 
@@ -638,6 +669,10 @@ void main() {
         await Future<void>.delayed(Duration.zero);
 
         expect(container.read(pairingProvider).status, PairingStatus.idle);
+        expect(
+          container.read(authProvider).value!.status,
+          AuthStatus.unauthenticated,
+        );
         expect(socket.isConnected, isFalse);
       });
 
@@ -1233,6 +1268,7 @@ class FakeAuthNotifier extends AsyncNotifier<AuthState>
     implements AuthNotifier {
   Community? lastCommunity;
   Completer<void>? authentication;
+  Completer<void>? entered;
   bool signedOut = false;
 
   @override
@@ -1246,9 +1282,16 @@ class FakeAuthNotifier extends AsyncNotifier<AuthState>
   }
 
   @override
-  Future<void> authenticateWithCommunity(Community community) async {
+  Future<void> authenticateWithCommunity(
+    Community community, {
+    bool Function()? shouldContinue,
+    bool activate = true,
+  }) async {
+    if (shouldContinue != null && !shouldContinue()) return;
     lastCommunity = community;
+    entered?.complete();
     await authentication?.future;
+    if (shouldContinue != null && !shouldContinue()) return;
     state = AsyncData(
       AuthState(status: AuthStatus.authenticated, community: community),
     );
diff --git a/mobile/test/features/search/search_page_lazy_test.dart b/mobile/test/features/search/search_page_lazy_test.dart
new file mode 100644
index 0000000000..56f88b7466
--- /dev/null
+++ b/mobile/test/features/search/search_page_lazy_test.dart
@@ -0,0 +1,257 @@
+import 'package:buzz/features/channels/channel.dart';
+import 'package:buzz/features/channels/channel_management_provider.dart';
+import 'package:buzz/features/channels/channels_provider.dart';
+import 'package:buzz/features/channels/message_content.dart';
+import 'package:buzz/features/profile/profile_provider.dart';
+import 'package:buzz/features/search/recent_searches_provider.dart';
+import 'package:buzz/features/search/search_page.dart';
+import 'package:buzz/features/search/search_provider.dart';
+import 'package:buzz/shared/mentions/agent_identity_provider.dart';
+import 'package:buzz/shared/profile/user_cache_provider.dart';
+import 'package:buzz/shared/profile/user_profile.dart';
+import 'package:flutter/material.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+import '../../helpers/widget_helpers.dart';
+
+void main() {
+  testWidgets(
+    'message results build only near the viewport and remain scrollable',
+    (tester) async {
+      tester.view.physicalSize = const Size(390, 600);
+      tester.view.devicePixelRatio = 1;
+      addTearDown(tester.view.reset);
+      final state = SearchState(
+        query: 'result',
+        messageResults: [
+          for (var index = 0; index < 20; index++)
+            SearchHit(
+              eventId: 'message-$index',
+              content: 'Result **$index** with a preview',
+              kind: 9,
+              pubkey: 'author-pubkey',
+              createdAt: 1,
+              score: 1,
+            ),
+        ],
+      );
+      await tester.pumpWidget(
+        WidgetHelpers.testable(
+          overrides: [
+            searchProvider.overrideWith(() => _FakeSearchNotifier(state)),
+            recentSearchesProvider.overrideWith(
+              () => _FakeRecentSearchesNotifier(const []),
+            ),
+            profileProvider.overrideWith(() => _FakeProfileNotifier()),
+            channelsProvider.overrideWith(() => _FakeChannelsNotifier()),
+            userCacheProvider.overrideWith(
+              () => _FakeUserCacheNotifier(
+                const UserProfile(pubkey: 'author-pubkey'),
+              ),
+            ),
+            knownAgentPubkeysProvider.overrideWith((ref) => const {}),
+            agentDirectoryDisplayNamesProvider.overrideWith((ref) => const {}),
+          ],
+          child: const SearchPage(),
+        ),
+      );
+      await tester.pumpAndSettle();
+      expect(find.byType(MessageContent).evaluate().length, lessThan(10));
+      final last = find.byKey(const ValueKey('search-message-row-message-19'));
+      expect(last, findsNothing);
+      await tester.scrollUntilVisible(
+        last,
+        400,
+        scrollable: find.descendant(
+          of: find.byKey(const Key('search-results-list')),
+          matching: find.byType(Scrollable),
+        ),
+      );
+      await tester.pumpAndSettle();
+      expect(last.hitTestable(), findsOneWidget);
+      expect(find.byType(MessageContent).evaluate().length, lessThan(10));
+      expect(tester.takeException(), isNull);
+    },
+  );
+
+  testWidgets(
+    'long message previews bound text without parsing partial markdown',
+    (tester) async {
+      tester.view.physicalSize = const Size(390, 600);
+      tester.view.devicePixelRatio = 1;
+      addTearDown(tester.view.reset);
+      final state = SearchState(
+        query: 'result',
+        messageResults: [
+          SearchHit(
+            eventId: 'long',
+            content:
+                '${'x' * 511}😀${'**[long](https://example.com)**' * 4000}',
+            kind: 9,
+            pubkey: 'author-pubkey',
+            createdAt: 1,
+            score: 1,
+          ),
+        ],
+      );
+      await tester.pumpWidget(
+        WidgetHelpers.testable(
+          overrides: [
+            searchProvider.overrideWith(() => _FakeSearchNotifier(state)),
+            recentSearchesProvider.overrideWith(
+              () => _FakeRecentSearchesNotifier(const []),
+            ),
+            profileProvider.overrideWith(() => _FakeProfileNotifier()),
+            channelsProvider.overrideWith(() => _FakeChannelsNotifier()),
+            userCacheProvider.overrideWith(
+              () => _FakeUserCacheNotifier(
+                const UserProfile(pubkey: 'author-pubkey'),
+              ),
+            ),
+            knownAgentPubkeysProvider.overrideWith((ref) => const {}),
+            agentDirectoryDisplayNamesProvider.overrideWith((ref) => const {}),
+          ],
+          child: const SearchPage(),
+        ),
+      );
+      await tester.pumpAndSettle();
+      expect(find.byType(MessageContent), findsNothing);
+      final preview = tester.widget<Text>(
+        find.byKey(const ValueKey('search-message-body-long')),
+      );
+      expect(preview.data, '${'x' * 511}…');
+      expect(preview.maxLines, 2);
+      expect(preview.overflow, TextOverflow.ellipsis);
+      expect(tester.takeException(), isNull);
+    },
+  );
+
+  for (final category in ['Channels', 'People']) {
+    testWidgets('$category results are lazy and reachable after filtering', (
+      tester,
+    ) async {
+      tester.view.physicalSize = const Size(390, 600);
+      tester.view.devicePixelRatio = 1;
+      addTearDown(tester.view.reset);
+      final state = SearchState(
+        query: 'result',
+        channelResults: [
+          for (var index = 0; index < 30; index++)
+            Channel(
+              id: 'channel-$index',
+              name: 'Result $index',
+              channelType: 'stream',
+              visibility: 'open',
+              description: '',
+              createdBy: 'test',
+              createdAt: DateTime(2025),
+              memberCount: 1,
+            ),
+        ],
+        userResults: [
+          for (var index = 0; index < 30; index++)
+            DirectoryUser(
+              pubkey: 'person-$index',
+              displayName: 'Person $index',
+            ),
+        ],
+      );
+      await tester.pumpWidget(
+        WidgetHelpers.testable(
+          overrides: [
+            searchProvider.overrideWith(() => _FakeSearchNotifier(state)),
+            recentSearchesProvider.overrideWith(
+              () => _FakeRecentSearchesNotifier(const []),
+            ),
+            profileProvider.overrideWith(() => _FakeProfileNotifier()),
+            channelsProvider.overrideWith(() => _FakeChannelsNotifier()),
+          ],
+          child: const SearchPage(),
+        ),
+      );
+      await tester.pumpAndSettle();
+      await tester.tap(find.text(category).first);
+      await tester.pumpAndSettle();
+      final key = category == 'Channels'
+          ? 'search-channel-row-channel-29'
+          : 'search-person-row-person-29';
+      final last = find.byKey(ValueKey(key));
+      expect(last, findsNothing);
+      await tester.scrollUntilVisible(
+        last,
+        400,
+        scrollable: find.descendant(
+          of: find.byKey(const Key('search-results-list')),
+          matching: find.byType(Scrollable),
+        ),
+      );
+      await tester.pumpAndSettle();
+      expect(last.hitTestable(), findsOneWidget);
+      expect(tester.takeException(), isNull);
+    });
+  }
+}
+
+class _FakeSearchNotifier extends SearchNotifier {
+  _FakeSearchNotifier(this.initialState);
+
+  final SearchState initialState;
+
+  @override
+  SearchState build() => initialState;
+
+  @override
+  void search(String query) {
+    state = SearchState(query: query.trim());
+  }
+
+  @override
+  void clear() {
+    state = const SearchState.initial();
+  }
+}
+
+class _FakeRecentSearchesNotifier extends RecentSearchesNotifier {
+  _FakeRecentSearchesNotifier(this.initialSearches);
+
+  final List<String> initialSearches;
+  List<String> get searches => state;
+
+  @override
+  List<String> build() => initialSearches;
+
+  @override
+  void record(String query) {
+    final trimmed = query.trim();
+    if (trimmed.isEmpty) return;
+    state = [
+      trimmed,
+      ...state.where((item) => item.toLowerCase() != trimmed.toLowerCase()),
+    ];
+  }
+
+  @override
+  void clear() {
+    state = const [];
+  }
+}
+
+class _FakeProfileNotifier extends ProfileNotifier {
+  @override
+  Future<UserProfile?> build() async =>
+      const UserProfile(pubkey: 'test', displayName: 'Test');
+}
+
+class _FakeChannelsNotifier extends ChannelsNotifier {
+  @override
+  Future<List<Channel>> build() async => const [];
+}
+
+class _FakeUserCacheNotifier extends UserCacheNotifier {
+  _FakeUserCacheNotifier(this.profile);
+
+  final UserProfile profile;
+
+  @override
+  Map<String, UserProfile> build() => {profile.pubkey: profile};
+}
diff --git a/mobile/test/features/search/search_page_test.dart b/mobile/test/features/search/search_page_test.dart
index 5c8de7380a..9810165914 100644
--- a/mobile/test/features/search/search_page_test.dart
+++ b/mobile/test/features/search/search_page_test.dart
@@ -444,10 +444,13 @@ void main() {
     );
     await tester.pumpAndSettle();
 
-    final results = tester.widget<ListView>(
-      find.byKey(const Key('search-results-list')),
+    final resultsPadding = tester.widget<SliverPadding>(
+      find.descendant(
+        of: find.byKey(const Key('search-results-list')),
+        matching: find.byType(SliverPadding),
+      ),
     );
-    final padding = results.padding! as EdgeInsets;
+    final padding = resultsPadding.padding as EdgeInsets;
 
     expect(padding.bottom, Grid.xl + footerClearance + keyboardInset);
   });
diff --git a/mobile/test/features/settings/connection_section_test.dart b/mobile/test/features/settings/connection_section_test.dart
index b94bcfc465..4d0f518efd 100644
--- a/mobile/test/features/settings/connection_section_test.dart
+++ b/mobile/test/features/settings/connection_section_test.dart
@@ -16,122 +16,118 @@ import 'package:shared_preferences/shared_preferences.dart';
 import '../../helpers/widget_helpers.dart';
 
 void main() {
-  testWidgets(
-    'shows a compact copyable identity row',
-    (tester) async {
-      var successFeedback = false;
+  testWidgets('shows a compact copyable identity row', (tester) async {
+    var successFeedback = false;
+    tester.binding.defaultBinaryMessenger.setMockMethodCallHandler(
+      const MethodChannel('buzz/haptics'),
+      (call) async {
+        expect(call.method, 'success');
+        successFeedback = true;
+        return null;
+      },
+    );
+    addTearDown(() {
       tester.binding.defaultBinaryMessenger.setMockMethodCallHandler(
         const MethodChannel('buzz/haptics'),
-        (call) async {
-          expect(call.method, 'success');
-          successFeedback = true;
+        null,
+      );
+    });
+    MethodCall? clipboardCall;
+    TestDefaultBinaryMessengerBinding.instance.defaultBinaryMessenger
+        .setMockMethodCallHandler(SystemChannels.platform, (call) async {
+          if (call.method == 'Clipboard.setData') clipboardCall = call;
           return null;
-        },
-      );
-      addTearDown(() {
-        tester.binding.defaultBinaryMessenger.setMockMethodCallHandler(
-          const MethodChannel('buzz/haptics'),
-          null,
-        );
-      });
-      MethodCall? clipboardCall;
-      TestDefaultBinaryMessengerBinding.instance.defaultBinaryMessenger
-          .setMockMethodCallHandler(SystemChannels.platform, (call) async {
-            if (call.method == 'Clipboard.setData') clipboardCall = call;
-            return null;
-          });
-      addTearDown(
-        () => TestDefaultBinaryMessengerBinding.instance.defaultBinaryMessenger
-            .setMockMethodCallHandler(SystemChannels.platform, null),
-      );
-      SharedPreferences.setMockInitialValues({});
-      final prefs = await SharedPreferences.getInstance();
+        });
+    addTearDown(
+      () => TestDefaultBinaryMessengerBinding.instance.defaultBinaryMessenger
+          .setMockMethodCallHandler(SystemChannels.platform, null),
+    );
+    SharedPreferences.setMockInitialValues({});
+    final prefs = await SharedPreferences.getInstance();
 
-      await tester.pumpWidget(
-        WidgetHelpers.testable(
-          overrides: [
-            relayConfigProvider.overrideWith(_RelayConfigNotifier.new),
-            authProvider.overrideWith(_AuthNotifier.new),
-            pairingProvider.overrideWith(
-              () => _PairingNotifier(Future<bool>.value(true)),
-            ),
-            savedPrefsProvider.overrideWithValue(prefs),
-          ],
-          child: SettingsPage(
-            profileHeader: const SizedBox.shrink(),
-            identityRecoveryPageBuilder: (_) => const SizedBox.shrink(),
+    await tester.pumpWidget(
+      WidgetHelpers.testable(
+        overrides: [
+          relayConfigProvider.overrideWith(_RelayConfigNotifier.new),
+          authProvider.overrideWith(_AuthNotifier.new),
+          pairingProvider.overrideWith(
+            () => _PairingNotifier(Future<bool>.value(true)),
           ),
+          savedPrefsProvider.overrideWithValue(prefs),
+        ],
+        child: SettingsPage(
+          profileHeader: const SizedBox.shrink(),
+          identityRecoveryPageBuilder: (_) => const SizedBox.shrink(),
         ),
-      );
-      await tester.pump();
-      await tester.ensureVisible(find.text('Copy public key (npub)'));
-      await tester.pumpAndSettle();
+      ),
+    );
+    await tester.pump();
+    await tester.ensureVisible(find.text('Copy public key (npub)'));
+    await tester.pumpAndSettle();
 
-      final expectedPubkey = nostr.Keys(
-        '1111111111111111111111111111111111111111111111111111111111111111',
-      ).public;
-      // Keys('1'×64).public ↔ this npub — the NIP-19 canonical vector for the
-      // identity row, hardcoded so the codec itself stays under test.
-      const expectedNpub =
-          'npub1fu64hh9hes90w2808n8tjc2ajp5yhddjef0ctx4s7zmsgp6cwx4qgy4eg9';
-      final statusCard = find.byKey(const ValueKey('status-identity-options'));
-      expect(
-        find.descendant(of: statusCard, matching: find.text('Set status')),
-        findsOneWidget,
-      );
-      expect(
-        find.descendant(
-          of: statusCard,
-          matching: find.text('Copy public key (npub)'),
+    final expectedPubkey = nostr.Keys(
+      '1111111111111111111111111111111111111111111111111111111111111111',
+    ).public;
+    // Keys('1'×64).public ↔ this npub — the NIP-19 canonical vector for the
+    // identity row, hardcoded so the codec itself stays under test.
+    const expectedNpub =
+        'npub1fu64hh9hes90w2808n8tjc2ajp5yhddjef0ctx4s7zmsgp6cwx4qgy4eg9';
+    final statusCard = find.byKey(const ValueKey('status-identity-options'));
+    expect(
+      find.descendant(of: statusCard, matching: find.text('Set status')),
+      findsOneWidget,
+    );
+    expect(
+      find.descendant(
+        of: statusCard,
+        matching: find.text('Copy public key (npub)'),
+      ),
+      findsOneWidget,
+    );
+    expect(
+      tester.getTopLeft(find.text('Copy public key (npub)')).dy,
+      lessThan(tester.getTopLeft(find.text('Display name')).dy),
+    );
+    expect(find.text('Connection'), findsNothing);
+    final sendCard = find.ancestor(
+      of: find.text('Send identity to desktop'),
+      matching: find.byType(AppListCard),
+    );
+    expect(
+      find.descendant(
+        of: sendCard,
+        matching: find.text('Copy public key (npub)'),
+      ),
+      findsNothing,
+    );
+    expect(find.text('Connected to'), findsNothing);
+    expect(find.text('https://relay.test'), findsNothing);
+    // Neither the raw hex key nor the full npub is rendered visually — the
+    // full npub is exposed through a11y and the clipboard only.
+    expect(find.text(expectedPubkey), findsNothing);
+    expect(find.text(expectedNpub), findsNothing);
+    // The identity row's a11y value carries the full npub (not raw hex).
+    expect(
+      find.ancestor(
+        of: find.text('Copy public key (npub)'),
+        matching: find.byWidgetPredicate(
+          (widget) =>
+              widget is Semantics && widget.properties.value == expectedNpub,
         ),
-        findsOneWidget,
-      );
-      expect(
-        tester.getTopLeft(find.text('Copy public key (npub)')).dy,
-        lessThan(tester.getTopLeft(find.text('Display name')).dy),
-      );
-      expect(find.text('Connection'), findsNothing);
-      final sendCard = find.ancestor(
-        of: find.text('Send identity to desktop'),
-        matching: find.byType(AppListCard),
-      );
-      expect(
-        find.descendant(
-          of: sendCard,
-          matching: find.text('Copy public key (npub)'),
-        ),
-        findsNothing,
-      );
-      expect(find.text('Connected to'), findsNothing);
-      expect(find.text('https://relay.test'), findsNothing);
-      // Neither the raw hex key nor the full npub is rendered visually — the
-      // full npub is exposed through a11y and the clipboard only.
-      expect(find.text(expectedPubkey), findsNothing);
-      expect(find.text(expectedNpub), findsNothing);
-      // The identity row's a11y value carries the full npub (not raw hex).
-      expect(
-        find.ancestor(
-          of: find.text('Copy public key (npub)'),
-          matching: find.byWidgetPredicate(
-            (widget) =>
-                widget is Semantics && widget.properties.value == expectedNpub,
-          ),
-        ),
-        findsOneWidget,
-      );
-      final copy = tester.getRect(find.byIcon(BuzzIcons.copy));
-      final chevron = tester.getRect(find.byIcon(BuzzIcons.chevronRight).first);
-      expect(copy.center.dx, closeTo(chevron.center.dx, 0.5));
+      ),
+      findsOneWidget,
+    );
+    final copy = tester.getRect(find.byIcon(BuzzIcons.copy));
+    final chevron = tester.getRect(find.byIcon(BuzzIcons.chevronRight).first);
+    expect(copy.center.dx, closeTo(chevron.center.dx, 0.5));
 
-      await tester.tap(find.text('Copy public key (npub)'));
-      await tester.pump();
-      expect(successFeedback, isTrue);
-      expect(clipboardCall?.method, 'Clipboard.setData');
-      expect(clipboardCall?.arguments, {'text': expectedNpub});
-      expect(find.text('Public key (npub) copied'), findsOneWidget);
-    },
-    variant: TargetPlatformVariant.only(TargetPlatform.iOS),
-  );
+    await tester.tap(find.text('Copy public key (npub)'));
+    await tester.pump();
+    expect(successFeedback, isTrue);
+    expect(clipboardCall?.method, 'Clipboard.setData');
+    expect(clipboardCall?.arguments, {'text': expectedNpub});
+    expect(find.text('Public key (npub) copied'), findsOneWidget);
+  }, variant: TargetPlatformVariant.only(TargetPlatform.iOS));
 
   testWidgets('waits for a resumed frame before navigating after auth', (
     tester,
diff --git a/mobile/test/features/settings/notification_toggle_test.dart b/mobile/test/features/settings/notification_toggle_test.dart
index 19c80e2522..84f78e536f 100644
--- a/mobile/test/features/settings/notification_toggle_test.dart
+++ b/mobile/test/features/settings/notification_toggle_test.dart
@@ -37,7 +37,13 @@ void main() {
       ..addFont(rootBundle.load('assets/fonts/InterVariable.ttf'));
     await fonts.load();
   });
-  for (final outcome in ['accepted', 'failed', 'pending', 'scaled']) {
+  for (final outcome in [
+    'accepted',
+    'failed',
+    'pending',
+    'scaled',
+    'unset preference',
+  ]) {
     testWidgets('off then on remains usable with $outcome cleanup', (
       tester,
     ) async {
@@ -61,7 +67,8 @@ void main() {
       );
       SharedPreferences.setMockInitialValues({});
       final prefs = await SharedPreferences.getInstance();
-      final storage = CommunityStorage(secure: FakeSecureStorage());
+      final secure = FakeSecureStorage();
+      final storage = CommunityStorage(secure: secure);
       final subscriptions = [
         BuzzPushSubscription(
           filter: BuzzPushFilter(kinds: const [9], pTags: ['a' * 64]),
@@ -110,7 +117,13 @@ void main() {
               desired: subscriptions,
             ).withAccepted(subscriptions: subscriptions, generation: 7),
           );
-      await storage.save(community);
+      if (outcome == 'unset preference') {
+        final saved = community.toJson()..remove('pushNotificationsEnabledV2');
+        saved['pushNotificationsEnabled'] = false;
+        secure['buzz_communities'] = jsonEncode([saved]);
+      } else {
+        await storage.save(community);
+      }
       await storage.saveActiveId(community.id);
 
       final cleanup = Completer<void>();
@@ -236,6 +249,15 @@ void main() {
         reason: 'failed cleanup must not defeat the retry backoff',
       );
       expect(discoveries, 2);
+      session.setStatus(SessionStatus.disconnected);
+      await tester.pumpAndSettle();
+      session.setStatus(SessionStatus.connected);
+      await tester.pumpAndSettle();
+      expect(
+        session.leases.where((lease) => lease['active'] == true),
+        hasLength(1),
+      );
+      expect(discoveries, 3);
       expect(snapshots.last.single.pushNotificationsEnabled, isFalse);
       final offSwitch = tester.widget<Switch>(find.byType(Switch));
       expect(offSwitch.value, isFalse);
@@ -273,7 +295,7 @@ void main() {
         isTrue,
         reason: 'a delayed old tombstone cannot supersede the new active lease',
       );
-      expect(discoveries, 3);
+      expect(discoveries, 4);
       // A real reconnect must still discover capability again.
       (container.read(relaySessionProvider.notifier) as _Connected).setStatus(
         SessionStatus.disconnected,
@@ -284,7 +306,7 @@ void main() {
         SessionStatus.connected,
       );
       await tester.pumpAndSettle();
-      expect(discoveries, 4);
+      expect(discoveries, 5);
       expect(tester.widget<Switch>(find.byType(Switch)).onChanged, isNotNull);
       expect(tester.takeException(), isNull);
       await tester.pumpWidget(const SizedBox.shrink());
diff --git a/mobile/test/features/settings/settings_overlay_test.dart b/mobile/test/features/settings/settings_overlay_test.dart
index 2605292197..86a93e6ffe 100644
--- a/mobile/test/features/settings/settings_overlay_test.dart
+++ b/mobile/test/features/settings/settings_overlay_test.dart
@@ -138,6 +138,21 @@ void main() {
         appBar.nativeActions!
             .singleWhere((action) => action.label == 'Settings')
             .onPressed!();
+        // Mid-transition, Home's native bars still composite beneath Settings;
+        // the presence pill must stay drawn by Flutter until the route settles.
+        await tester.pump();
+        await tester.pump(const Duration(milliseconds: 100));
+        expect(
+          find.byKey(const ValueKey('settings-presence-menu')),
+          findsNothing,
+        );
+        expect(
+          find.descendant(
+            of: find.byKey(const ValueKey('settings-presence-target')),
+            matching: find.text('Offline'),
+          ),
+          findsOneWidget,
+        );
       } else {
         await tester.tap(find.byType(ProfileAvatar));
       }
diff --git a/mobile/test/helpers/hosted_communities_fixture.dart b/mobile/test/helpers/hosted_communities_fixture.dart
new file mode 100644
index 0000000000..fb7e4ae027
--- /dev/null
+++ b/mobile/test/helpers/hosted_communities_fixture.dart
@@ -0,0 +1,171 @@
+import 'dart:convert';
+import 'dart:async';
+
+import 'package:buzz/shared/deeplink/deep_link.dart';
+import 'package:buzz/shared/hosted/account_identity_store.dart';
+import 'package:buzz/shared/hosted/browser_auth.dart';
+import 'package:buzz/shared/hosted/builderlab_account.dart';
+import 'package:buzz/shared/hosted/hosted_flow.dart';
+import 'package:buzz/shared/hosted/hosted_identity_service.dart';
+import 'package:http/http.dart' as http;
+import 'package:http/testing.dart';
+import 'package:nostr/nostr.dart' as nostr;
+
+class DiscoveryBrowser extends BrowserAuth {
+  final callbacks = StreamController<BrowserAuthCode>.broadcast();
+  Map<String, String>? startedIntent;
+  @override
+  Future<void> start(Map<String, String> intent) async {
+    startedIntent = intent;
+  }
+
+  @override
+  Stream<BrowserAuthCode> get codes => callbacks.stream;
+  @override
+  Future<void> dispose() async {
+    await callbacks.close();
+    await super.dispose();
+  }
+
+  @override
+  Future<void> initialize() async {}
+  @override
+  Future<void> clearIntent() async {}
+  @override
+  Future<void> cancel() async {}
+}
+
+class WidgetDiscoveryAccount extends BuilderlabAccountClient {
+  WidgetDiscoveryAccount(this.fixture);
+  final HostedCommunitiesFixture fixture;
+  @override
+  BuilderlabAccount? get account => fixture.expired
+      ? null
+      : BuilderlabAccount(
+          subject: fixture.subject,
+          expiresAt: DateTime.now().add(const Duration(hours: 1)),
+        );
+  @override
+  Future<BuilderlabAccount?> restore() async => account;
+  @override
+  Future<Map<String, dynamic>> post(
+    String path,
+    Map<String, dynamic> body,
+  ) async {
+    if (path.endsWith('/current')) {
+      if (fixture.rejectCurrent) throw AccountFailure.denied;
+      return {
+        'identity': {'pubkey_hex': fixture.bound},
+      };
+    }
+    if (path.endsWith('/communities/joined')) {
+      return {'communities': fixture.rows};
+    }
+    throw AccountFailure.unavailable;
+  }
+}
+
+class HostedCommunitiesFixture {
+  final keys = nostr.Keys('1'.padLeft(64, '0'));
+  AccountIdentityStore get store => AccountIdentityStore(subject: subject);
+  final browser = DiscoveryBrowser();
+  late BuilderlabAccountClient account;
+  late final HostedFlow flow;
+  final admitted = <String>[];
+  final requests = <String>[];
+  List<Map<String, dynamic>> rows = [];
+  String? bound;
+  bool rejectList = false;
+  bool rejectCurrent = false;
+  bool expired = false;
+  String subject = 'owner';
+  Future<void> Function(String)? beforeAdmission;
+  Future<void> Function()? beforeList;
+  Uri? opened;
+
+  Map<String, dynamic> row(String name, {bool archived = false}) => {
+    'id': name,
+    'name': name,
+    'normalized_host': '$name.communities.buzz.xyz',
+    if (archived) 'archived_at': '2026-10-01T00:00:00Z',
+  };
+
+  Future<void> initialize({bool backup = true, bool widget = false}) async {
+    bound = keys.public;
+    final expiry = DateTime.now()
+        .toUtc()
+        .add(const Duration(hours: 1))
+        .toIso8601String();
+    account = BuilderlabAccountClient(
+      httpClient: MockClient((request) async {
+        final path = request.url.path;
+        requests.add(path);
+        if (path.endsWith('/exchange')) {
+          return http.Response(
+            jsonEncode({'session_credential': 'fixture', 'expires_at': expiry}),
+            200,
+          );
+        }
+        if (path.endsWith('/me')) {
+          if (expired) return http.Response('{}', 401);
+          return http.Response(
+            jsonEncode({'subject': subject, 'expires_at': expiry}),
+            200,
+          );
+        }
+        if (path.endsWith('/current')) {
+          return http.Response(
+            jsonEncode({
+              'identity': {'pubkey_hex': bound},
+            }),
+            200,
+          );
+        }
+        if (path.endsWith('/communities/joined')) {
+          await beforeList?.call();
+          if (rejectList) return http.Response('{}', 503);
+          return http.Response(jsonEncode({'communities': rows}), 200);
+        }
+        return http.Response('{}', 503);
+      }),
+    );
+    if (widget) {
+      account.dispose();
+      account = WidgetDiscoveryAccount(this);
+    } else {
+      await account.exchange(code: 'code', verifier: 'a' * 43);
+    }
+    await store.create(keys.nsec);
+    if (backup) {
+      await store.confirmBackup(
+        BackupReceipt(
+          backend: BuilderlabAccountClient.origin.toString(),
+          subject: 'owner',
+          pubkey: keys.public,
+          backupId: 'fixture-backup',
+        ),
+      );
+    }
+    flow = HostedFlow(
+      account: account,
+      browser: browser,
+      store: store,
+      identity: HostedIdentityService(account: account, store: store),
+      openWeb: (uri) async {
+        opened = uri;
+        return true;
+      },
+      enterCommunity: (link, subject, pubkey, current) async {
+        final target = link as AddCommunityDeepLink;
+        await beforeAdmission?.call(target.name);
+        if (current()) admitted.add(target.name);
+      },
+    );
+  }
+
+  Future<void> dispose() async {
+    flow.dispose();
+    await browser.dispose();
+    account.dispose();
+  }
+}
diff --git a/mobile/test/helpers/hosted_journey_fixture.dart b/mobile/test/helpers/hosted_journey_fixture.dart
new file mode 100644
index 0000000000..b2ca016fb8
--- /dev/null
+++ b/mobile/test/helpers/hosted_journey_fixture.dart
@@ -0,0 +1,538 @@
+import 'package:buzz/shared/hosted/hosted_environment.dart';
+import 'package:buzz/features/pairing/pairing_provider.dart';
+import 'dart:io';
+import 'dart:convert';
+import 'package:flutter/services.dart';
+
+import 'package:buzz/features/channels/channel.dart';
+import 'package:buzz/features/channels/channels_provider.dart';
+import 'package:buzz/features/invites/invite_join_provider.dart';
+import 'package:buzz/features/onboarding/self_hosted_entry_sheet.dart';
+import 'package:buzz/features/profile/profile_provider.dart';
+import 'package:buzz/hosted_app_gate.dart';
+import 'package:buzz/shared/hosted/hosted_flow_provider.dart';
+import 'package:buzz/onboarding_app_entry.dart';
+import 'package:buzz/shared/auth/auth.dart';
+import 'package:buzz/shared/deeplink/pending_deep_link_provider.dart';
+import 'package:buzz/shared/hosted/account_identity_store.dart';
+import 'package:buzz/shared/hosted/browser_auth.dart';
+import 'package:buzz/shared/hosted/builderlab_account.dart';
+import 'package:buzz/shared/hosted/hosted_flow.dart';
+import 'package:buzz/shared/hosted/hosted_relay_auth.dart';
+import 'package:buzz/shared/relay/relay_session.dart';
+import 'package:buzz/shared/relay/relay_socket.dart';
+import 'package:buzz/shared/hosted/self_hosted_entry.dart';
+import 'package:buzz/shared/profile/user_profile.dart';
+import 'package:flutter/material.dart';
+import 'package:flutter_secure_storage/flutter_secure_storage.dart';
+import 'package:flutter_test/flutter_test.dart';
+import 'package:hooks_riverpod/hooks_riverpod.dart';
+import 'package:http/http.dart' as http;
+import 'package:http/testing.dart';
+import 'package:nostr/nostr.dart' as nostr;
+
+import 'widget_helpers.dart';
+
+/// Synthetic REST/relay boundaries with the production flow factory, account,
+/// identity, admission, auth and storage. No admission/persistence is simulated.
+class HostedJourneyFixture {
+  final keys = nostr.Keys('1'.padLeft(64, '0'));
+  final secondKeys = nostr.Keys('2'.padLeft(64, '0'));
+  AccountIdentityStore get store => AccountIdentityStore(subject: subject);
+  final storage = CommunityStorage();
+  final requests = <http.Request>[];
+  Future<void> Function()? beforeBrowserReturn;
+  Future<void> Function()? beforeEnrollmentReturn;
+  Future<void> Function()? beforeUploadReturn;
+  final probes = <Community>[];
+  String? refusedSelfHostedPubkey;
+  final profileWrites = <String>[];
+  final recoveryScopes = <InviteJoinRecoveryScope>[];
+  final rows = <Map<String, dynamic>>[];
+  final cloudKeys = <nostr.Keys>[];
+  HostedFlow? activeFlow;
+  HostedFlow get flow => activeFlow!;
+  late ProviderContainer container;
+  String? bound;
+  int starterFailures = 0;
+  final policyResponses = <http.Response>[];
+  int browserStarts = 0;
+  int secondRelayFailures = 0;
+  DateTime assertionNow = DateTime.now();
+  bool relayAuthEnabled = false;
+  bool expiredSession = false;
+  bool denyAssertion = false;
+  bool refuseUpgrade = false;
+  String subject = 'journey-owner';
+  Future<void> Function()? beforeAssertionReturn;
+  final socketHeaders = <Map<String, String>>[];
+  bool offerProfile = true;
+  bool profileUnavailable = false;
+  bool rejectList = false;
+  bool missingList = false;
+  bool loseCreateResponse = false;
+  bool loseClaimResponse = false;
+  bool inviteExpired = false;
+  final owned = <Map<String, dynamic>>[];
+  final expiry = DateTime.now()
+      .toUtc()
+      .add(const Duration(minutes: 5))
+      .toIso8601String();
+
+  Map<String, dynamic> row(String name) => {
+    'id': name,
+    'name': name,
+    'normalized_host': '$name.communities.buzz.xyz',
+  };
+
+  Future<void> initialize({
+    bool localIdentity = true,
+    bool cloudChoice = false,
+    bool signedIn = true,
+  }) async {
+    FlutterSecureStorage.setMockInitialValues({});
+    PendingDeepLinkNotifier.debugUriStreamOverride = const Stream<Uri>.empty();
+    bound = cloudChoice ? null : keys.public;
+    if (localIdentity) {
+      await store.create(keys.nsec);
+      await store.confirmBackup(
+        BackupReceipt(
+          backend: BuilderlabAccountClient.origin.origin,
+          subject: 'journey-owner',
+          pubkey: keys.public,
+          backupId: 'backup-1',
+        ),
+      );
+    }
+    // A real exchange writes the credential used by both the flow and the
+    // independent account verifier constructed during durable admission.
+    if (!signedIn) return;
+    final account = BuilderlabAccountClient();
+    await account.exchange(code: 'synthetic-code', verifier: 'v' * 43);
+    account.dispose();
+  }
+
+  http.Client client() => MockClient((request) async {
+    requests.add(request);
+    final path = request.url.path;
+    Object result;
+    if (path.endsWith('/exchange')) {
+      expiredSession = false;
+      result = {
+        'session_credential': 'synthetic-session',
+        'expires_at': expiry,
+      };
+    } else if (path.endsWith('/me')) {
+      if (expiredSession) return http.Response('{}', 401);
+      result = {'subject': subject, 'expires_at': expiry};
+    } else if (path.endsWith('/identity/assertions')) {
+      await beforeAssertionReturn?.call();
+      if (expiredSession) return http.Response('{}', 401);
+      if (denyAssertion) return http.Response('{}', 403);
+      final body = jsonDecode(request.body) as Map;
+      if (bound != null && body['nostr_pubkey'] != bound) {
+        return http.Response('{}', 403);
+      }
+      bound ??= body['nostr_pubkey'] as String;
+      result = {
+        'assertion': 'synthetic-assertion',
+        'nostr_pubkey': bound,
+        'expires_at':
+            assertionNow
+                .add(const Duration(minutes: 5))
+                .millisecondsSinceEpoch ~/
+            1000,
+      };
+    } else if (path == '/auth-transport') {
+      return http.Response(
+        '',
+        302,
+        headers: {'location': 'https://outside.example'},
+      );
+    } else if (path == '/query' || path == '/profiles/search') {
+      if (relayAuthEnabled &&
+          HostedEnvironment.requiresAuth(request.url.host)) {
+        expect(
+          request.headers['Nostr-Federated-Identity'],
+          'Bearer synthetic-assertion',
+        );
+        expect(request.headers.containsKey('X-BB-Session-Credential'), isFalse);
+      }
+      result = <Object>[];
+    } else if (path.endsWith('/current')) {
+      if (expiredSession) return http.Response('{}', 401);
+      result = {
+        'identity': bound == null ? null : {'pubkey_hex': bound},
+      };
+    } else if (path.endsWith('/status')) {
+      result = {
+        'current_nostr_pubkey': bound,
+        'backup_nostr_pubkeys': cloudKeys.map((k) => k.public).toList(),
+      };
+    } else if (path.endsWith('/recovery')) {
+      result = {
+        'backups': [
+          for (final k in cloudKeys)
+            {
+              'backup_id': 'backup-${k.public}',
+              'nostr_pubkey': k.public,
+              'secret_key': base64Url
+                  .encode([
+                    for (var i = 0; i < 64; i += 2)
+                      int.parse(k.secret.substring(i, i + 2), radix: 16),
+                  ])
+                  .replaceAll('=', ''),
+            },
+        ],
+        'failed_backup_ids': <String>[],
+      };
+    } else if (path.endsWith('/challenge')) {
+      result = {
+        'challenge_id': '12345678-1234-1234-1234-123456789abc',
+        'nonce': 'a' * 43,
+        'verification_code': '123456',
+        'origin': BuilderlabAccountClient.origin.toString(),
+        'expires_at': expiry,
+      };
+    } else if (path.endsWith('/verify')) {
+      final event =
+          jsonDecode(jsonDecode(request.body)['signed_payload'] as String)
+              as Map;
+      bound = event['pubkey'] as String;
+      result = {
+        'identity': {'pubkey_hex': bound},
+      };
+    } else if (path.endsWith('/enrollment')) {
+      await beforeEnrollmentReturn?.call();
+      result = {
+        'version': 1,
+        'suite': {'kem_id': 16, 'kdf_id': 1, 'aead_id': 2},
+        'recipient_key_id': 'test-key',
+        'service_namespace': 'buzz',
+        'owner_id': 'journey-owner',
+        'backup_id': '12345678-1234-1234-1234-123456789abc',
+        'nostr_pubkey': bound,
+        'recipient_public_key': base64Url
+            .encode([4, ...List.filled(64, 1)])
+            .replaceAll('=', ''),
+      };
+    } else if (path.endsWith('/nsec-backups')) {
+      await beforeUploadReturn?.call();
+      result = {
+        'stored': true,
+        'backup_id': jsonDecode(request.body)['backup_id'],
+      };
+    } else if (path.endsWith('/v1/buzz/communities')) {
+      final name = jsonDecode(request.body)['name'] as String;
+      final created =
+          owned
+              .where(
+                (row) => row['name'] == name && row['owner_pubkey'] == bound,
+              )
+              .firstOrNull ??
+          {...row(name), 'owner_pubkey': bound};
+      if (!owned.contains(created)) owned.add(created);
+      if (loseCreateResponse) {
+        loseCreateResponse = false;
+        throw AccountFailure.unavailable;
+      }
+      result = {'community': created};
+    } else if (path.endsWith('/communities/joined')) {
+      if (rejectList) return http.Response('{}', 503);
+      if (missingList) return http.Response('{}', 404);
+      result = {'communities': rows};
+    } else if (path == '/api/join-policy') {
+      if (policyResponses.isNotEmpty) return policyResponses.removeAt(0);
+      result = {
+        'policy': {
+          'version': request.url.host,
+          'age_attestation_required': true,
+          'terms_markdown': 'Be kind to this community.',
+          'privacy_markdown': 'Your public profile is public.',
+        },
+      };
+    } else if (path == '/api/invites/accept-policy') {
+      if (inviteExpired) {
+        return http.Response(jsonEncode({'error': 'invite_expired'}), 410);
+      }
+      result = {'receipt': 'synthetic-policy-receipt'};
+    } else if (path == '/api/invites/claim') {
+      if (loseClaimResponse) {
+        loseClaimResponse = false;
+        rows.add(row(request.url.host.split('.').first));
+        throw AccountFailure.unavailable;
+      }
+      result = {'host': request.url.host};
+    } else {
+      throw StateError('Unexpected journey request: ${request.method} $path');
+    }
+    return http.Response(
+      jsonEncode(result),
+      200,
+      headers: {'content-type': 'application/json'},
+    );
+  });
+
+  HostedFlow createFlow(Ref ref) => activeFlow = createHostedFlow(
+    ref,
+    browserAuth: _Browser(() async {
+      browserStarts++;
+      await beforeBrowserReturn?.call();
+    }),
+    probe: (community) async {
+      probes.add(community);
+      if (Uri.parse(community.relayUrl).host.startsWith('two.') &&
+          secondRelayFailures-- > 0) {
+        throw AccountFailure.unavailable;
+      }
+    },
+  );
+
+  Future<void> mount(
+    WidgetTester tester, {
+    bool openEntry = true,
+    PairingCredentialValidator? pairingValidator,
+  }) async {
+    await tester.binding.setSurfaceSize(const Size(440, 1100));
+    tester.binding.defaultBinaryMessenger.setMockMethodCallHandler(
+      const MethodChannel('buzz/hosted_hpke'),
+      (_) async => {
+        'enc': Uint8List.fromList([4, ...List.filled(64, 2)]),
+        'ciphertext': Uint8List(48),
+      },
+    );
+    await tester.pumpWidget(
+      WidgetHelpers.testable(
+        disableAnimations: true,
+        overrides: [
+          hostedFlowProvider.overrideWith(createFlow),
+          if (pairingValidator != null)
+            pairingProvider.overrideWith(
+              () => PairingNotifier(credentialValidator: pairingValidator),
+            ),
+          if (relayAuthEnabled) ...[
+            hostedRelayAuthProvider.overrideWith((ref) {
+              final auth = HostedRelayAuth(
+                ref.watch(builderlabAccountProvider),
+                enabled: true,
+                now: () => assertionNow,
+              );
+              ref.onDispose(auth.dispose);
+              return auth;
+            }),
+            relaySessionProvider.overrideWith(
+              () => RelaySessionNotifier(
+                socketFactory:
+                    ({
+                      required wsUrl,
+                      required nsec,
+                      required onMessage,
+                      required onConnected,
+                      required onDisconnected,
+                    }) => _RelaySocket(
+                      this,
+                      wsUrl: wsUrl,
+                      nsec: nsec,
+                      onMessage: onMessage,
+                      onConnected: onConnected,
+                      onDisconnected: onDisconnected,
+                    ),
+              ),
+            ),
+          ],
+          communitySnapshotWriterProvider.overrideWithValue((_) async {}),
+          channelsProvider.overrideWith(_NoChannels.new),
+          profileProvider.overrideWith(() => _Profile(this)),
+          inviteJoinRecoveryProvider.overrideWithValue(
+            (scope) => _Recovery(this, scope),
+          ),
+          selfHostedEntryProvider.overrideWithValue(
+            SelfHostedEntry(
+              probe: (community) async {
+                probes.add(community);
+                if (community.pubkey == refusedSelfHostedPubkey) {
+                  throw StateError('Community refused entry');
+                }
+              },
+            ),
+          ),
+        ],
+        child: HostedAppGate(
+          authenticated: true,
+          child: Builder(
+            builder: (context) => Center(
+              child: FilledButton(
+                onPressed: () => Navigator.of(context).push(
+                  MaterialPageRoute<void>(
+                    builder: (_) =>
+                        const OnboardingAppEntry(addingCommunity: true),
+                  ),
+                ),
+                child: const Text('Community home'),
+              ),
+            ),
+          ),
+        ),
+      ),
+    );
+    await settle(tester);
+    container = ProviderScope.containerOf(
+      tester.element(find.byType(HostedAppGate)),
+    );
+    await container.read(authProvider.future);
+    if (openEntry) {
+      await tap(tester, 'Community home');
+      expect(find.byType(OnboardingAppEntry), findsOneWidget);
+    }
+  }
+
+  /// Recreate app owners while retaining secure storage and remote fixtures.
+  Future<void> restart(WidgetTester tester) async {
+    await tester.pumpWidget(const SizedBox.shrink());
+    await tester.pump();
+    await Future<void>.delayed(Duration.zero);
+    await tester.pump();
+    await mount(tester, openEntry: false);
+  }
+
+  // HTTP response streams use real event-loop turns. Yield between frames so
+  // spinner animation cannot exhaust the fake clock before those turns run.
+  Future<void> settle(WidgetTester tester) async {
+    for (var i = 0; i < 60; i++) {
+      await Future<void>.delayed(Duration.zero);
+      await tester.pump(const Duration(milliseconds: 50));
+      if (i >= 15 && activeFlow?.stage != HostedFlowStage.working) return;
+    }
+    throw StateError(
+      'Journey did not settle: ${flow.stage} / ${flow.problem}; requests: ${requests.map((r) => r.url.path).join(',')}',
+    );
+  }
+
+  Future<void> tap(WidgetTester tester, String label) async {
+    await tester.pump();
+    await tester.tap(find.text(label).hitTestable());
+    await settle(tester);
+  }
+
+  Future<void> link(
+    WidgetTester tester,
+    String name, {
+    bool invite = true,
+  }) async {
+    container
+        .read(pendingDeepLinkProvider.notifier)
+        .open(
+          Uri(
+            scheme: 'buzz',
+            host: invite ? 'join' : 'add',
+            queryParameters: {
+              'relay': 'wss://$name.communities.buzz.xyz',
+              if (invite) 'code': 'invite-$name',
+              if (!invite) 'name': name,
+            },
+          ),
+        );
+    await settle(tester);
+  }
+
+  List<http.Request> sent(String path) =>
+      requests.where((r) => r.url.path.endsWith(path)).toList();
+
+  Future<void> dispose(WidgetTester tester) async {
+    await tester.pumpWidget(const SizedBox.shrink());
+    await tester.pump();
+    await Future<void>.delayed(Duration.zero);
+    await tester.pump();
+    PendingDeepLinkNotifier.debugUriStreamOverride = null;
+    tester.binding.defaultBinaryMessenger.setMockMethodCallHandler(
+      const MethodChannel('buzz/hosted_hpke'),
+      null,
+    );
+    await tester.binding.setSurfaceSize(null);
+  }
+}
+
+class _NoChannels extends ChannelsNotifier {
+  @override
+  Future<List<Channel>> build() async => [];
+}
+
+// Replace relay metadata transport, not the production profile-offer logic.
+class _Profile extends ProfileNotifier {
+  _Profile(this.fixture);
+  final HostedJourneyFixture fixture;
+  @override
+  Future<UserProfile?> build() async {
+    if (fixture.profileUnavailable) throw StateError('relay unavailable');
+    return fixture.offerProfile ? null : UserProfile(pubkey: fixture.bound!);
+  }
+
+  @override
+  Future<void> updateDisplayName(String name) async {
+    fixture.profileWrites.add(name);
+  }
+}
+
+// This boundary proves pending-flag/retry ownership, not relay memberships.
+class _Recovery implements InviteJoinRecovery {
+  _Recovery(this.fixture, this.scope);
+  final HostedJourneyFixture fixture;
+  final InviteJoinRecoveryScope scope;
+  @override
+  Future<String?> ensureStarterChannels() async {
+    fixture.recoveryScopes.add(scope);
+    if (fixture.starterFailures-- > 0) throw AccountFailure.unavailable;
+    return 'general';
+  }
+}
+
+class _Browser extends BrowserAuth {
+  _Browser(Future<void> Function() onStart)
+    : super(
+        openBrowser: (uri) async {
+          await onStart();
+          return Uri.parse(BrowserAuth.callback)
+              .replace(
+                queryParameters: {
+                  'state': uri.queryParameters['state']!,
+                  'code': 'synthetic-code',
+                },
+              )
+              .toString();
+        },
+      );
+  @override
+  Future<void> initialize() async {}
+}
+
+class _RelaySocket extends RelaySocket {
+  _RelaySocket(
+    this.fixture, {
+    required super.wsUrl,
+    required super.nsec,
+    required super.onMessage,
+    required super.onConnected,
+    required super.onDisconnected,
+  }) : url = wsUrl,
+       _connected = onConnected,
+       _disconnected = onDisconnected;
+  final HostedJourneyFixture fixture;
+  final String url;
+  final void Function() _connected;
+  final void Function(Object?) _disconnected;
+  @override
+  Future<void> connect() async {
+    fixture.socketHeaders.add(Map.of(headers));
+    expect(
+      headers['Nostr-Federated-Identity'],
+      HostedEnvironment.requiresAuth(Uri.parse(url).host)
+          ? 'Bearer synthetic-assertion'
+          : isNull,
+    );
+    if (fixture.refuseUpgrade) {
+      _disconnected(const WebSocketException('refused', 403));
+    } else {
+      _connected();
+    }
+  }
+}
diff --git a/mobile/test/shared/auth/auth_provider_test.dart b/mobile/test/shared/auth/auth_provider_test.dart
index 9dcced5f33..b4379fe251 100644
--- a/mobile/test/shared/auth/auth_provider_test.dart
+++ b/mobile/test/shared/auth/auth_provider_test.dart
@@ -54,6 +54,45 @@ void main() {
     );
   });
 
+  test(
+    'background batch addition preserves the first active community',
+    () async {
+      final storage = CommunityStorage(secure: FakeSecureStorage());
+      final first = Community.create(
+        name: 'First',
+        relayUrl: 'wss://first.example',
+        nsec: nostr.Keys('1'.padLeft(64, '0')).nsec,
+      );
+      final second = Community.create(
+        name: 'Second',
+        relayUrl: 'wss://second.example',
+        nsec: nostr.Keys('1'.padLeft(64, '0')).nsec,
+      );
+      final container = ProviderContainer(
+        overrides: [communityStorageProvider.overrideWithValue(storage)],
+      );
+      addTearDown(container.dispose);
+      await container.read(authProvider.future);
+      await container
+          .read(authProvider.notifier)
+          .authenticateWithCommunity(first);
+      var transitions = 0;
+      container.read(communityTransitionProvider).register(() async {
+        transitions++;
+      });
+      await container
+          .read(authProvider.notifier)
+          .authenticateWithCommunity(second, activate: false);
+      expect(await storage.loadActiveId(), first.id);
+      expect(container.read(authProvider).value?.community?.id, first.id);
+      expect((await storage.loadAll()).map((item) => item.id), [
+        first.id,
+        second.id,
+      ]);
+      expect(transitions, 0);
+    },
+  );
+
   test('waits for transition teardown before removing credentials', () async {
     final storage = CommunityStorage(secure: FakeSecureStorage());
     final community = Community.create(
diff --git a/mobile/test/shared/auth/community_entry_requirements_test.dart b/mobile/test/shared/auth/community_entry_requirements_test.dart
new file mode 100644
index 0000000000..339142bf80
--- /dev/null
+++ b/mobile/test/shared/auth/community_entry_requirements_test.dart
@@ -0,0 +1,74 @@
+import 'package:buzz/shared/hosted/hosted_environment.dart';
+import 'package:buzz/shared/auth/auth_provider.dart';
+import 'package:buzz/shared/community/community.dart';
+import 'package:buzz/shared/community/community_provider.dart';
+import 'package:buzz/shared/community/community_storage.dart';
+import 'package:buzz/shared/hosted/builderlab_account.dart';
+import 'package:flutter_secure_storage/flutter_secure_storage.dart';
+import 'package:flutter_test/flutter_test.dart';
+import 'package:hooks_riverpod/hooks_riverpod.dart';
+import 'package:nostr/nostr.dart' as nostr;
+
+import '../community/community_storage_test.dart';
+
+void main() {
+  TestWidgetsFlutterBinding.ensureInitialized();
+  for (final useAuth in [true, false]) {
+    for (final host in [
+      'team.communities.buzz.xyz',
+      'team.communities.public.builderlabstaging.xyz',
+      'team.communities.public.builderlabstaging.xyz.',
+    ]) {
+      test(
+        'accountless entry follows domain policy through '
+        '${useAuth ? "authentication" : "community addition"}: $host',
+        () async {
+          FlutterSecureStorage.setMockInitialValues({});
+          final storage = CommunityStorage(secure: FakeSecureStorage());
+          final container = ProviderContainer(
+            overrides: [communityStorageProvider.overrideWithValue(storage)],
+          );
+          addTearDown(container.dispose);
+          await container.read(authProvider.future);
+          await container.read(communityListProvider.future);
+          var transitions = 0;
+          container.read(communityTransitionProvider).register(() async {
+            transitions++;
+          });
+          final keys = nostr.Keys.generate();
+          final community = Community.create(
+            name: 'Hosted',
+            relayUrl: 'wss://$host',
+            pubkey: keys.public,
+            nsec: keys.nsec,
+          );
+          final pending = useAuth
+              ? container
+                    .read(authProvider.notifier)
+                    .authenticateWithCommunity(community)
+              : container
+                    .read(communityListProvider.notifier)
+                    .addCommunity(community);
+          if (!HostedEnvironment.requiresAuth(host)) {
+            await pending;
+            expect((await storage.loadAll()).single.nsec, keys.nsec);
+            expect(
+              await storage.loadActiveId(),
+              useAuth ? community.id : isNull,
+            );
+            expect(transitions, useAuth ? 1 : 0);
+            return;
+          }
+          await expectLater(pending, throwsA(isA<AccountFailure>()));
+          expect(await storage.loadAll(), isEmpty);
+          expect(await storage.loadActiveId(), isNull);
+          expect(transitions, 0);
+          expect(
+            container.read(authProvider).value!.status,
+            AuthStatus.unauthenticated,
+          );
+        },
+      );
+    }
+  }
+}
diff --git a/mobile/test/shared/community/community_provider_test.dart b/mobile/test/shared/community/community_provider_test.dart
index fa977786f2..d79d1620f6 100644
--- a/mobile/test/shared/community/community_provider_test.dart
+++ b/mobile/test/shared/community/community_provider_test.dart
@@ -122,7 +122,7 @@ void main() {
     });
 
     test(
-      'push notifications default off and opt-in survives restart',
+      'push notifications default on and opt-out survives restart',
       () async {
         container = createContainer();
         await container.read(communityListProvider.future);
@@ -137,12 +137,12 @@ void main() {
           (await container.read(
             communityListProvider.future,
           )).single.pushNotificationsEnabled,
-          isFalse,
+          isTrue,
         );
 
         await container
             .read(communityListProvider.notifier)
-            .setPushNotificationsEnabled(community.id, true);
+            .setPushNotificationsEnabled(community.id, false);
         container.dispose();
         container = createContainer();
 
@@ -150,7 +150,7 @@ void main() {
           (await container.read(
             communityListProvider.future,
           )).single.pushNotificationsEnabled,
-          isTrue,
+          isFalse,
         );
       },
     );
diff --git a/mobile/test/shared/community/community_storage_test.dart b/mobile/test/shared/community/community_storage_test.dart
index 93874aef25..be9c404dbf 100644
--- a/mobile/test/shared/community/community_storage_test.dart
+++ b/mobile/test/shared/community/community_storage_test.dart
@@ -127,6 +127,33 @@ void main() {
       );
     });
 
+    test('push choices persist independently across storage reloads', () async {
+      final first = Community.create(
+        name: 'First',
+        relayUrl: 'https://first.example',
+        pubkey: 'a' * 64,
+      );
+      final second = Community.create(
+        name: 'Second',
+        relayUrl: 'https://second.example',
+        pubkey: 'b' * 64,
+      );
+      await storage.saveAll([first, second]);
+      await storage.save(first.copyWith(pushNotificationsEnabled: false));
+
+      final reloaded = CommunityStorage(secure: fakeSecure);
+      final communities = await reloaded.loadAll();
+      expect(communities.map((c) => c.pushNotificationsEnabled), [false, true]);
+      expect(communities.map((c) => c.pubkey), [first.pubkey, second.pubkey]);
+      await reloaded.save(communities.last.copyWith(name: 'Renamed'));
+      expect(
+        (await CommunityStorage(
+          secure: fakeSecure,
+        ).loadAll()).map((c) => c.pushNotificationsEnabled),
+        [false, true],
+      );
+    });
+
     test('round-trips desired push subscription state', () async {
       final pubkey = 'a' * 64;
       final subscriptions = buildDesiredBuzzPushSubscriptions(
diff --git a/mobile/test/shared/community/community_test.dart b/mobile/test/shared/community/community_test.dart
index 0d229d2366..93c9881849 100644
--- a/mobile/test/shared/community/community_test.dart
+++ b/mobile/test/shared/community/community_test.dart
@@ -16,6 +16,8 @@ void main() {
     );
     expect(community.starterSetupIncomplete, isFalse);
     expect(community.pushLeaseInstallationId, isNull);
+    expect(community.pushNotificationsEnabled, isTrue);
+    expect(community.pushSubscriptionState.pendingTombstoneGeneration, isNull);
   });
 
   test('new community gets a unique canonical push lease address id', () {
@@ -25,6 +27,8 @@ void main() {
       relayUrl: 'https://relay.test',
     );
 
+    expect(first.pushNotificationsEnabled, isTrue);
+    expect(Community.fromJson(first.toJson()).pushNotificationsEnabled, isTrue);
     expect(first.pushLeaseInstallationId, matches(RegExp(r'^[0-9a-f]{32}$')));
     expect(
       second.pushLeaseInstallationId,
@@ -49,6 +53,45 @@ void main() {
     expect(roundTrip.pushLeaseInstallationId, 'a' * 32);
   });
 
+  for (final enabled in [true, false]) {
+    test('saved push preference $enabled survives loading and copying', () {
+      final community = Community.fromJson({
+        'id': 'one',
+        'name': 'Buzz',
+        'relayUrl': 'https://relay.test',
+        'pushNotificationsEnabledV2': enabled,
+        'pushNotificationsEnabled': !enabled,
+        'addedAt': '2026-08-05T00:00:00.000Z',
+      });
+      expect(community.pushNotificationsEnabled, enabled);
+      expect(
+        community.copyWith(name: 'Renamed').pushNotificationsEnabled,
+        enabled,
+      );
+      expect(
+        Community.fromJson(community.toJson()).pushNotificationsEnabled,
+        enabled,
+      );
+      expect(
+        community.pushSubscriptionState.pendingTombstoneGeneration,
+        isNull,
+      );
+    });
+  }
+
+  test('previous preference values are intentionally not preserved', () {
+    for (final previous in [false, true]) {
+      final saved = Community.create(
+        name: 'Team',
+        relayUrl: 'https://relay.test',
+      ).toJson()..remove('pushNotificationsEnabledV2');
+      saved['pushNotificationsEnabled'] = previous;
+      final community = Community.fromJson(saved);
+      expect(community.pushNotificationsEnabled, isTrue);
+      expect(community.toJson(), isNot(contains('pushNotificationsEnabled')));
+    }
+  });
+
   test('malformed stored push lease address id is rejected', () {
     expect(
       () => Community.fromJson({
diff --git a/mobile/test/shared/deeplink/pending_deep_link_provider_test.dart b/mobile/test/shared/deeplink/pending_deep_link_provider_test.dart
index b13f42df6d..476887acc4 100644
--- a/mobile/test/shared/deeplink/pending_deep_link_provider_test.dart
+++ b/mobile/test/shared/deeplink/pending_deep_link_provider_test.dart
@@ -2,6 +2,7 @@ import 'package:buzz/shared/deeplink/deep_link.dart';
 import 'package:buzz/shared/deeplink/pending_deep_link_provider.dart';
 import 'package:buzz/shared/push/push_bridge.dart';
 import 'package:flutter_test/flutter_test.dart';
+import 'package:flutter/foundation.dart';
 import 'package:hooks_riverpod/hooks_riverpod.dart';
 
 void main() {
@@ -15,6 +16,22 @@ void main() {
     pendingPushNotificationLink.value = null;
   });
 
+  test('unsupported callback does not log its code or state', () {
+    final messages = <String?>[];
+    final previous = debugPrint;
+    debugPrint = (message, {wrapWidth}) => messages.add(message);
+    addTearDown(() => debugPrint = previous);
+    final container = ProviderContainer();
+    addTearDown(container.dispose);
+    container
+        .read(pendingDeepLinkProvider.notifier)
+        .open(Uri.parse('buzz://auth?code=secret-code&state=secret-state'));
+    expect(container.read(pendingDeepLinkProvider), isNull);
+    expect(messages.join(), isNot(contains('secret-code')));
+    expect(messages.join(), isNot(contains('secret-state')));
+    expect(messages, isNotEmpty);
+  });
+
   test('parks and consumes a native notification message link', () async {
     final container = ProviderContainer();
     addTearDown(container.dispose);
diff --git a/mobile/test/shared/emoji/emoji_only_test.dart b/mobile/test/shared/emoji/emoji_only_test.dart
index 261b7d7cf1..10b7703db1 100644
--- a/mobile/test/shared/emoji/emoji_only_test.dart
+++ b/mobile/test/shared/emoji/emoji_only_test.dart
@@ -1,3 +1,5 @@
+import 'dart:collection';
+
 import 'package:buzz/shared/custom_emoji/custom_emoji.dart';
 import 'package:buzz/shared/emoji/emoji_only.dart';
 import 'package:flutter_test/flutter_test.dart';
@@ -55,6 +57,34 @@ void main() {
       expect(emojiOnly('hi :buzz:', customEmoji: _customEmoji), isFalse);
     });
 
+    test('scans consecutive shortcodes without skipping following text', () {
+      expect(emojiOnly(':BUZZ::buzz:', customEmoji: _customEmoji), isTrue);
+      expect(emojiOnly('😀:buzz:😀', customEmoji: _customEmoji), isTrue);
+      expect(
+        emojiOnly(':buzz:ordinary text', customEmoji: _customEmoji),
+        isFalse,
+      );
+      expect(
+        emojiOnly(':buzz::unfinished', customEmoji: _customEmoji),
+        isFalse,
+      );
+      expect(emojiOnly(':buzz:::', customEmoji: _customEmoji), isFalse);
+    });
+
+    test('does not inspect the community palette without a shortcode', () {
+      final palette = _CountingEmojiList();
+      expect(
+        emojiOnly('Ordinary message text. ' * 500, customEmoji: palette),
+        isFalse,
+      );
+      expect(emojiOnly('😀 👋', customEmoji: palette), isTrue);
+      expect(emojiOnly('text :buzz:', customEmoji: palette), isFalse);
+      expect(emojiOnly(':unfinished', customEmoji: palette), isFalse);
+      expect(palette.reads, 0);
+      expect(emojiOnly(':buzz::BUZZ:', customEmoji: palette), isTrue);
+      expect(palette.reads, palette.length);
+    });
+
     test('an unknown shortcode is just text', () {
       // Desktop behaves the same: without the palette it renders literally, so
       // it must not be scaled up as if it were a glyph.
@@ -79,3 +109,26 @@ void main() {
     });
   });
 }
+
+class _CountingEmojiList extends ListBase<CustomEmoji> {
+  int reads = 0;
+
+  @override
+  int get length => 2580;
+
+  @override
+  set length(int value) => throw UnsupportedError('read-only fixture');
+
+  @override
+  CustomEmoji operator [](int index) {
+    reads += 1;
+    return CustomEmoji(
+      shortcode: index == 0 ? 'buzz' : 'unused_$index',
+      url: 'https://example.test/emoji.png',
+    );
+  }
+
+  @override
+  void operator []=(int index, CustomEmoji value) =>
+      throw UnsupportedError('read-only fixture');
+}
diff --git a/mobile/test/shared/hosted/account_identity_store_test.dart b/mobile/test/shared/hosted/account_identity_store_test.dart
new file mode 100644
index 0000000000..4cb8748924
--- /dev/null
+++ b/mobile/test/shared/hosted/account_identity_store_test.dart
@@ -0,0 +1,269 @@
+import 'dart:async';
+import 'package:flutter_secure_storage/flutter_secure_storage.dart';
+import 'package:flutter_test/flutter_test.dart';
+import 'package:nostr/nostr.dart' as nostr;
+import 'package:buzz/shared/hosted/account_identity_store.dart';
+
+void main() {
+  TestWidgetsFlutterBinding.ensureInitialized();
+  final key = nostr.Keys(
+    '0000000000000000000000000000000000000000000000000000000000000001',
+  );
+  setUp(() => FlutterSecureStorage.setMockInitialValues({}));
+
+  for (final simulated in [false, true]) {
+    test(
+      'recovery retains scoped receipt; simulated=$simulated cannot authorize',
+      () async {
+        final receipt = BackupReceipt(
+          backend: 'https://app.builderlab.xyz',
+          subject: 'account-a',
+          pubkey: key.public,
+          backupId: simulated ? 'debug-simulated-backup:old' : 'backup-1',
+        );
+        final store = AccountIdentityStore();
+        expect(await store.read(), isNull);
+        await store.create(key.nsec, recoveredBackup: receipt);
+        final restored = (await AccountIdentityStore().read())!;
+        expect(
+          restored.hasBackupFor(
+            backend: receipt.backend,
+            subject: receipt.subject,
+          ),
+          !simulated,
+        );
+        expect(
+          restored.hasBackupFor(backend: receipt.backend, subject: 'account-b'),
+          isFalse,
+        );
+        expect(await store.withKeys((keys) async => keys.public), key.public);
+        expect((await store.create(key.nsec)).pubkey, key.public);
+        // Existing receipt migrates only to its owner; another account has
+        // an independent create-only slot and cannot replace the first key.
+        final owner = store.forSubject('account-a');
+        final otherAccount = store.forSubject('account-b');
+        expect((await owner.read())!.pubkey, key.public);
+        expect(await otherAccount.read(), isNull);
+        final otherKey = nostr.Keys('2'.padLeft(64, '0'));
+        await otherAccount.create(otherKey.nsec);
+        expect((await owner.read())!.pubkey, key.public);
+        expect((await store.read())!.pubkey, key.public);
+        expect((await otherAccount.read())!.pubkey, otherKey.public);
+        await store.forPairing(key.public).create(key.nsec);
+        await store.forPairing(otherKey.public).create(otherKey.nsec);
+        expect((await store.identities()).map((item) => item.pubkey).toSet(), {
+          key.public,
+          otherKey.public,
+        });
+      },
+    );
+  }
+
+  test(
+    'unrelated enumeration failure preserves known-slot access and errors',
+    () async {
+      final storage = EnumerationFailureStorage();
+      final legacy = AccountIdentityStore(storage: storage);
+      await legacy.create(key.nsec);
+      final scoped = legacy.forSubject('b');
+      final other = nostr.Keys('2'.padLeft(64, '0'));
+      await scoped.create(other.nsec);
+      await expectLater(
+        scoped.identities(),
+        throwsA(AccountIdentityFailure.unreadable),
+      );
+      expect((await scoped.read())!.pubkey, other.public);
+      expect(
+        await scoped.withSavedIdentity(key.public, (value) async => value),
+        key.nsec,
+      );
+      await storage.write(
+        key: AccountIdentityStore.storageKey,
+        value: 'broken',
+      );
+      await expectLater(
+        scoped.identities(),
+        throwsA(AccountIdentityFailure.unreadable),
+      );
+    },
+  );
+
+  test(
+    'unreadable storage never allows creation or touches legacy keys',
+    () async {
+      FlutterSecureStorage.setMockInitialValues({
+        AccountIdentityStore.storageKey: 'broken',
+        'buzz_communities': 'legacy',
+      });
+      final store = AccountIdentityStore();
+      await expectLater(
+        store.read(),
+        throwsA(AccountIdentityFailure.unreadable),
+      );
+      await expectLater(
+        store.create(key.nsec),
+        throwsA(AccountIdentityFailure.unreadable),
+      );
+      expect(
+        await const FlutterSecureStorage().read(key: 'buzz_communities'),
+        'legacy',
+      );
+    },
+  );
+
+  test('invalid candidate and wrong-key receipt never write', () async {
+    final store = AccountIdentityStore();
+    await expectLater(
+      store.create('not-a-key'),
+      throwsA(AccountIdentityFailure.invalidKey),
+    );
+    final other = nostr.Keys(
+      '0000000000000000000000000000000000000000000000000000000000000002',
+    );
+    await expectLater(
+      store.create(
+        key.nsec,
+        recoveredBackup: BackupReceipt(
+          backend: 'https://app.builderlab.xyz',
+          subject: 'a',
+          pubkey: other.public,
+          backupId: 'b',
+        ),
+      ),
+      throwsA(AccountIdentityFailure.mismatch),
+    );
+    expect(await store.read(), isNull);
+    await store.create(key.nsec);
+    await expectLater(
+      store.confirmBackup(
+        BackupReceipt(
+          backend: 'https://app.builderlab.xyz',
+          subject: 'a',
+          pubkey: other.public,
+          backupId: 'b',
+        ),
+      ),
+      throwsA(AccountIdentityFailure.mismatch),
+    );
+    expect((await store.read())!.backup, isNull);
+  });
+
+  for (final generate in [false, true]) {
+    test(
+      'uncertain ${generate ? "generated" : "recovered"} write retries exact identity once',
+      () async {
+        final storage = UncertainStorage();
+        final store = AccountIdentityStore(storage: storage);
+        var authorizations = 0;
+        final receipt = BackupReceipt(
+          backend: 'https://app.builderlab.xyz',
+          subject: 'a',
+          pubkey: key.public,
+          backupId: 'one',
+        );
+        Future<AccountIdentitySnapshot?> write() => generate
+            ? store.generateIfAbsent(
+                authorize: () async {
+                  authorizations++;
+                  return true;
+                },
+              )
+            : store.create(key.nsec, recoveredBackup: receipt);
+        await expectLater(write(), throwsA(AccountIdentityFailure.unreadable));
+        final persisted = (await store.read())!;
+        final retried = (await write())!;
+        expect(retried.pubkey, persisted.pubkey);
+        expect(authorizations, generate ? 1 : 0);
+        if (!generate) {
+          expect(retried.backup?.backupId, 'one');
+          final other = nostr.Keys('2'.padLeft(64, '0'));
+          await expectLater(
+            store.create(other.nsec),
+            throwsA(AccountIdentityFailure.occupied),
+          );
+          await expectLater(
+            store.create(
+              key.nsec,
+              recoveredBackup: BackupReceipt(
+                backend: receipt.backend,
+                subject: 'b',
+                pubkey: key.public,
+                backupId: 'two',
+              ),
+            ),
+            throwsA(AccountIdentityFailure.mismatch),
+          );
+        }
+        expect(storage.writes, 1);
+      },
+    );
+  }
+
+  test(
+    'late durable write blocks second instance create until settled',
+    () async {
+      final storage = DelayedStorage();
+      final first = AccountIdentityStore(storage: storage).create(key.nsec);
+      await storage.started.future;
+      final second = AccountIdentityStore(storage: storage).create(key.nsec);
+      final retried = second;
+      storage.release.complete();
+      await first;
+      await retried;
+      expect(storage.writes, 1);
+    },
+  );
+}
+
+class DelayedStorage extends FlutterSecureStorage {
+  final started = Completer<void>();
+  final release = Completer<void>();
+  int writes = 0;
+  @override
+  Future<void> write({
+    required String key,
+    required String? value,
+    AppleOptions? iOptions,
+    AndroidOptions? aOptions,
+    LinuxOptions? lOptions,
+    WebOptions? webOptions,
+    AppleOptions? mOptions,
+    WindowsOptions? wOptions,
+  }) async {
+    writes++;
+    started.complete();
+    await release.future;
+    return super.write(key: key, value: value);
+  }
+}
+
+class UncertainStorage extends FlutterSecureStorage {
+  int writes = 0;
+  @override
+  Future<void> write({
+    required String key,
+    required String? value,
+    AppleOptions? iOptions,
+    AndroidOptions? aOptions,
+    LinuxOptions? lOptions,
+    WebOptions? webOptions,
+    AppleOptions? mOptions,
+    WindowsOptions? wOptions,
+  }) async {
+    writes++;
+    await super.write(key: key, value: value);
+    throw StateError('plugin response lost');
+  }
+}
+
+class EnumerationFailureStorage extends FlutterSecureStorage {
+  @override
+  Future<Map<String, String>> readAll({
+    AppleOptions? iOptions,
+    AndroidOptions? aOptions,
+    LinuxOptions? lOptions,
+    WebOptions? webOptions,
+    AppleOptions? mOptions,
+    WindowsOptions? wOptions,
+  }) async => throw StateError('unrelated entry cannot decrypt');
+}
diff --git a/mobile/test/shared/hosted/browser_auth_test.dart b/mobile/test/shared/hosted/browser_auth_test.dart
new file mode 100644
index 0000000000..96c971972d
--- /dev/null
+++ b/mobile/test/shared/hosted/browser_auth_test.dart
@@ -0,0 +1,160 @@
+import 'dart:convert';
+
+import 'package:buzz/shared/hosted/browser_auth.dart';
+import 'package:buzz/shared/hosted/hosted_environment.dart';
+import 'package:crypto/crypto.dart';
+import 'package:flutter_secure_storage/flutter_secure_storage.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+void main() {
+  TestWidgetsFlutterBinding.ensureInitialized();
+  setUp(() => FlutterSecureStorage.setMockInitialValues({}));
+
+  test('cold-start callback restores PKCE and intent, consumes once', () async {
+    late Uri login;
+    final first = BrowserAuth(
+      openBrowser: (uri) async {
+        login = uri;
+        return null;
+      },
+    );
+    await first.start({
+      'relay': 'wss://example.communities.buzz.xyz',
+      'code': 'invite',
+    });
+    await first.dispose();
+    final restored = BrowserAuth();
+    final codes = <BrowserAuthCode>[];
+    final failures = <BrowserAuthFailure>[];
+    restored.codes.listen(codes.add);
+    restored.failures.listen(failures.add);
+    final callback = Uri.parse(BrowserAuth.callback).replace(
+      queryParameters: {
+        'state': login.queryParameters['state']!,
+        'code': 'exchange-code',
+      },
+    );
+    await restored.receive(callback);
+    await restored.receive(callback);
+    await Future<void>.delayed(Duration.zero);
+    expect(codes, hasLength(1));
+    expect(failures, isEmpty);
+    expect(codes.single.intent['code'], 'invite');
+    expect(
+      login.queryParameters['code_challenge'],
+      base64UrlEncode(
+        sha256.convert(ascii.encode(codes.single.verifier)).bytes,
+      ).replaceAll('=', ''),
+    );
+    expect(login.queryParameters['code_challenge_method'], 'S256');
+    expect(login.origin, HostedEnvironment.origin.origin);
+    final stored = await const FlutterSecureStorage().readAll();
+    expect(stored.keys, everyElement(contains(HostedEnvironment.origin.host)));
+    expect(login.queryParameters['returnTo'], BrowserAuth.callback);
+    expect(await restored.retainedIntent(), codes.single.intent);
+    await restored.dispose();
+  });
+
+  test(
+    'invalid state and destination never consume the valid pending login',
+    () async {
+      late Uri login;
+      final auth = BrowserAuth(
+        openBrowser: (uri) async {
+          login = uri;
+          return null;
+        },
+      );
+      final codes = <BrowserAuthCode>[];
+      final failures = <BrowserAuthFailure>[];
+      auth.codes.listen(codes.add);
+      auth.failures.listen(failures.add);
+      await auth.start({'relay': 'wss://example.communities.buzz.xyz'});
+      final state = login.queryParameters['state']!;
+      for (final invalid in [
+        '${BrowserAuth.callback}?code=x',
+        '${BrowserAuth.callback}?state=wrong&code=x',
+        '${BrowserAuth.callback}?state=$state&state=$state&code=x',
+        'xyz.block.buzz.mobile://auth/callback?state=$state&code=x',
+        '${BrowserAuth.callback}/?state=$state&code=x',
+        '${BrowserAuth.callback}?state=$state&code=x#fragment',
+      ]) {
+        await auth.receive(Uri.parse(invalid));
+      }
+      await Future<void>.delayed(Duration.zero);
+      expect(codes, isEmpty);
+      expect(failures, everyElement(BrowserAuthFailure.restartLogin));
+      expect(failures, isEmpty);
+      expect(await auth.retainedIntent(), isNotNull);
+      await auth.receive(
+        Uri.parse('${BrowserAuth.callback}?state=$state&code=good'),
+      );
+      await Future<void>.delayed(Duration.zero);
+      expect(codes.single.code, 'good');
+      await auth.dispose();
+    },
+  );
+
+  test('expiry and cancel preserve destination but prevent exchange', () async {
+    var now = DateTime.utc(2026);
+    late Uri login;
+    final auth = BrowserAuth(
+      now: () => now,
+      openBrowser: (uri) async {
+        login = uri;
+        return null;
+      },
+    );
+    final codes = <BrowserAuthCode>[];
+    auth.codes.listen(codes.add);
+    await auth.start({'relay': 'wss://example.communities.buzz.xyz'});
+    now = now.add(const Duration(minutes: 11));
+    await auth.receive(
+      Uri.parse(
+        '${BrowserAuth.callback}?state=${login.queryParameters['state']}&code=x',
+      ),
+    );
+    await auth.cancel();
+    now = now.subtract(const Duration(minutes: 11));
+    await auth.receive(
+      Uri.parse(
+        '${BrowserAuth.callback}?state=${login.queryParameters['state']}&code=x',
+      ),
+    );
+    await Future<void>.delayed(Duration.zero);
+    expect(codes, isEmpty);
+    expect(await auth.retainedIntent(), isNotNull);
+    await auth.dispose();
+  });
+  test('old callback cannot fail a newer pending login', () async {
+    final logins = <Uri>[];
+    final auth = BrowserAuth(
+      openBrowser: (uri) async {
+        logins.add(uri);
+        return null;
+      },
+    );
+    final failures = <BrowserAuthFailure>[];
+    final codes = <BrowserAuthCode>[];
+    auth.failures.listen(failures.add);
+    auth.codes.listen(codes.add);
+    await auth.start({'target': 'old'});
+    await auth.start({'target': 'new'});
+    await auth.receive(
+      Uri.parse(
+        '${BrowserAuth.callback}?state=${logins.first.queryParameters['state']}&code=old',
+      ),
+    );
+    await Future<void>.delayed(Duration.zero);
+    expect(failures, isEmpty);
+    expect(codes, isEmpty);
+    await auth.receive(
+      Uri.parse(
+        '${BrowserAuth.callback}?state=${logins.last.queryParameters['state']}&code=new',
+      ),
+    );
+    await Future<void>.delayed(Duration.zero);
+    expect(codes.single.intent['target'], 'new');
+    await auth.dispose();
+  });
+}
diff --git a/mobile/test/shared/hosted/builderlab_account_test.dart b/mobile/test/shared/hosted/builderlab_account_test.dart
new file mode 100644
index 0000000000..de557706b7
--- /dev/null
+++ b/mobile/test/shared/hosted/builderlab_account_test.dart
@@ -0,0 +1,307 @@
+import 'dart:async';
+import 'hosted_http_fixture.dart';
+import 'dart:convert';
+
+import 'package:buzz/shared/hosted/builderlab_account.dart';
+import 'package:flutter_secure_storage/flutter_secure_storage.dart';
+import 'package:flutter_test/flutter_test.dart';
+import 'package:http/http.dart' as http;
+import 'package:http/testing.dart';
+
+void main() {
+  TestWidgetsFlutterBinding.ensureInitialized();
+  final expiry = DateTime.now()
+      .toUtc()
+      .add(const Duration(days: 1))
+      .toIso8601String();
+  final verifier = List.filled(43, 'a').join();
+  setUp(() => FlutterSecureStorage.setMockInitialValues({}));
+
+  test(
+    'real client exchanges PKCE code, verifies, persists and restores session',
+    () async {
+      final requests = <http.Request>[];
+      final transport = MockClient((request) async {
+        requests.add(request);
+        expect(request.url.origin, 'https://app.builderlab.xyz');
+        expect(request.followRedirects, isFalse);
+        expect(request.headers.containsKey('cookie'), isFalse);
+        if (request.url.path.endsWith('/exchange')) {
+          expect(jsonDecode(request.body), {
+            'code': 'one-use',
+            'code_verifier': verifier,
+          });
+          expect(
+            request.headers.containsKey('X-BB-Session-Credential'),
+            isFalse,
+          );
+          return http.Response(
+            jsonEncode({'session_credential': 'secret', 'expires_at': expiry}),
+            200,
+          );
+        }
+        expect(request.headers['X-BB-Session-Credential'], 'secret');
+        return http.Response(
+          jsonEncode({'subject': 'account-1', 'expires_at': expiry}),
+          200,
+        );
+      });
+      final client = BuilderlabAccountClient(httpClient: transport);
+      expect(
+        (await client.exchange(code: 'one-use', verifier: verifier)).subject,
+        'account-1',
+      );
+      final restored = BuilderlabAccountClient(httpClient: transport);
+      expect((await restored.restore())!.subject, 'account-1');
+      expect(requests.length, 3);
+      await restored.clearLocalSession();
+      expect(
+        await BuilderlabAccountClient(httpClient: transport).restore(),
+        isNull,
+      );
+    },
+  );
+
+  testWidgets('total deadline releases account queue despite trickling body', (
+    tester,
+  ) async {
+    final transport = TrickleClient(
+      (request) => http.Response(
+        jsonEncode(
+          request.url.path.endsWith('/exchange')
+              ? {'session_credential': 'secret', 'expires_at': expiry}
+              : {'subject': 'account-1', 'expires_at': expiry},
+        ),
+        200,
+      ),
+    );
+    final client = BuilderlabAccountClient(httpClient: transport);
+    addTearDown(client.dispose);
+    Object? failure;
+    var cleared = false;
+    unawaited(
+      client
+          .exchange(code: 'code', verifier: verifier)
+          .then<void>(
+            (_) => fail('trickling response must not complete'),
+            onError: (Object error) => failure = error,
+          ),
+    );
+    unawaited(client.clearLocalSession().then((_) => cleared = true));
+    await tester.pump();
+    await tester.pump(const Duration(seconds: 20));
+    await tester.pump(const Duration(seconds: 5));
+    expect(failure, isNull);
+    expect(cleared, isFalse);
+    await tester.pump(const Duration(seconds: 5));
+    expect(failure, AccountFailure.unavailable);
+    expect(transport.aborted, isTrue);
+    expect(transport.cancelled, isTrue);
+    expect(cleared, isTrue);
+    transport.slow = false;
+    final retry = client.exchange(code: 'retry', verifier: verifier);
+    await tester.pump();
+    expect((await retry).subject, 'account-1');
+  });
+
+  test('invalid verification cannot persist an exchanged credential', () async {
+    final transport = MockClient(
+      (request) async => http.Response(
+        jsonEncode(
+          request.url.path.endsWith('/exchange')
+              ? {'session_credential': 'secret', 'expires_at': expiry}
+              : {'expires_at': expiry},
+        ),
+        200,
+      ),
+    );
+    final client = BuilderlabAccountClient(httpClient: transport);
+    await expectLater(
+      client.exchange(code: 'code', verifier: verifier),
+      throwsA(AccountFailure.invalidResponse),
+    );
+    expect(await client.restore(), isNull);
+  });
+
+  test('redirect and denial are not accepted as login success', () async {
+    for (final status in [302, 403]) {
+      final client = BuilderlabAccountClient(
+        httpClient: MockClient(
+          (_) async => http.Response('sensitive response', status),
+        ),
+      );
+      await expectLater(
+        client.exchange(code: 'code', verifier: verifier),
+        throwsA(
+          status == 403 ? AccountFailure.denied : AccountFailure.unavailable,
+        ),
+      );
+      expect(await client.restore(), isNull);
+    }
+  });
+  const storageKey = 'buzz_hosted_session_app_builderlab_xyz_v1';
+  String record(String subject, String credential) => jsonEncode({
+    'origin': 'https://app.builderlab.xyz',
+    'credential': credential,
+    'subject': subject,
+    'expires_at': expiry,
+  });
+  Future<String?> stored() =>
+      const FlutterSecureStorage().read(key: storageKey);
+
+  test('session storage is device-only on iOS', () {
+    expect(
+      BuilderlabAccountClient.defaultStorage.iOptions.accessibility,
+      KeychainAccessibility.first_unlock_this_device,
+    );
+  });
+
+  test('callback exchange waits for an in-flight startup restore', () async {
+    FlutterSecureStorage.setMockInitialValues({
+      storageKey: record('account-1', 'old'),
+    });
+    final restoreVerified = Completer<void>();
+    final client = BuilderlabAccountClient(
+      httpClient: MockClient((request) async {
+        if (request.url.path.endsWith('/exchange')) {
+          return http.Response(
+            jsonEncode({'session_credential': 'new', 'expires_at': expiry}),
+            200,
+          );
+        }
+        if (request.headers['X-BB-Session-Credential'] == 'old') {
+          await restoreVerified.future;
+        }
+        return http.Response(
+          jsonEncode({'subject': 'account-1', 'expires_at': expiry}),
+          200,
+        );
+      }),
+    );
+    final restoring = client.restore();
+    final exchanging = client.exchange(code: 'code', verifier: verifier);
+    restoreVerified.complete();
+    expect((await restoring)!.subject, 'account-1');
+    expect((await exchanging).subject, 'account-1');
+    expect(jsonDecode((await stored())!)['credential'], 'new');
+  });
+
+  test('login for another account keeps the existing session', () async {
+    FlutterSecureStorage.setMockInitialValues({
+      storageKey: record('account-1', 'old'),
+    });
+    final client = BuilderlabAccountClient(
+      httpClient: MockClient(
+        (request) async => http.Response(
+          jsonEncode(
+            request.url.path.endsWith('/exchange')
+                ? {'session_credential': 'new', 'expires_at': expiry}
+                : {'subject': 'account-2', 'expires_at': expiry},
+          ),
+          200,
+        ),
+      ),
+    );
+    await expectLater(
+      client.exchange(code: 'code', verifier: verifier),
+      throwsA(AccountFailure.differentAccount),
+    );
+    expect(client.account, isNull);
+    expect(await stored(), record('account-1', 'old'));
+  });
+
+  test('only a rejected credential clears a stored session', () async {
+    for (final (status, failure) in [
+      (401, null),
+      (500, AccountFailure.unavailable),
+      (403, AccountFailure.denied),
+    ]) {
+      FlutterSecureStorage.setMockInitialValues({
+        storageKey: record('account-1', 'old'),
+      });
+      final client = BuilderlabAccountClient(
+        httpClient: MockClient((_) async => http.Response('{}', status)),
+      );
+      if (failure == null) {
+        expect(await client.restore(), isNull);
+        expect(await stored(), isNull);
+      } else {
+        await expectLater(client.restore(), throwsA(failure));
+        expect(await stored(), record('account-1', 'old'));
+      }
+    }
+  });
+
+  test(
+    'unreadable record is a storage failure, not an absent session',
+    () async {
+      FlutterSecureStorage.setMockInitialValues({storageKey: 'not json'});
+      final client = BuilderlabAccountClient(
+        httpClient: MockClient((_) async => fail('no request expected')),
+      );
+      await expectLater(client.restore(), throwsA(AccountFailure.storage));
+      await expectLater(
+        client.exchange(code: 'code', verifier: verifier),
+        throwsA(AccountFailure.storage),
+      );
+      await client.clearLocalSession();
+      expect(await client.restore(), isNull);
+    },
+  );
+
+  test('rejected identity read clears the session', () async {
+    var sessionRevoked = false;
+    final client = BuilderlabAccountClient(
+      httpClient: MockClient((request) async {
+        if (request.url.path.endsWith('/current')) {
+          return http.Response('{}', 401);
+        }
+        if (request.url.path.endsWith('/me') &&
+            request.headers['X-BB-Session-Credential'] == 'secret' &&
+            sessionRevoked) {
+          return http.Response('{}', 401);
+        }
+        return http.Response(
+          jsonEncode(
+            request.url.path.endsWith('/exchange')
+                ? {'session_credential': 'secret', 'expires_at': expiry}
+                : {'subject': 'account-1', 'expires_at': expiry},
+          ),
+          200,
+        );
+      }),
+    );
+    await client.exchange(code: 'code', verifier: verifier);
+    // A route-level 401 with a valid session is an authorization failure.
+    await expectLater(client.currentIdentity(), throwsA(AccountFailure.denied));
+    expect(client.account, isNotNull);
+    expect(await stored(), isNotNull);
+    sessionRevoked = true;
+    await expectLater(
+      client.currentIdentity(),
+      throwsA(AccountFailure.signedOut),
+    );
+    expect(client.account, isNull);
+    expect(await stored(), isNull);
+  });
+
+  test('authenticated post accepts only Buzz account routes', () async {
+    final client = BuilderlabAccountClient(
+      httpClient: MockClient((_) async => fail('no request expected')),
+    );
+    for (final path in [
+      '/v1/auth/me',
+      '/v1/buzz',
+      '/v1/buzz/../auth/me',
+      '/v1/buzz/nsec-backups?x=1',
+      'https://evil.example/v1/buzz/nsec-backups',
+      '//evil.example/v1/buzz/nsec-backups',
+    ]) {
+      expect(() => client.post(path, {}), throwsArgumentError, reason: path);
+    }
+    await expectLater(
+      client.post('/v1/buzz/nsec-backups/enrollment', {}),
+      throwsA(AccountFailure.signedOut),
+    );
+  });
+}
diff --git a/mobile/test/shared/hosted/device_identity_reconciliation_test.dart b/mobile/test/shared/hosted/device_identity_reconciliation_test.dart
new file mode 100644
index 0000000000..7c5d578078
--- /dev/null
+++ b/mobile/test/shared/hosted/device_identity_reconciliation_test.dart
@@ -0,0 +1,274 @@
+import 'dart:convert';
+
+import 'package:buzz/shared/hosted/account_identity_store.dart';
+import 'package:buzz/shared/hosted/builderlab_account.dart';
+import 'package:buzz/shared/hosted/device_identity_source.dart';
+import 'package:buzz/shared/hosted/hosted_identity_service.dart';
+import 'package:flutter_secure_storage/flutter_secure_storage.dart';
+import 'package:flutter_test/flutter_test.dart';
+import 'package:nostr/nostr.dart' as nostr;
+
+class InventoryAccount extends BuilderlabAccountClient {
+  String? bound;
+  List<String> backups = [];
+  Map<String, dynamic> recovery = {};
+  final calls = <String>[];
+  @override
+  BuilderlabAccount get account =>
+      BuilderlabAccount(subject: 'fixture', expiresAt: DateTime.utc(2100));
+  @override
+  Future<BuilderlabAccount?> restore() async => account;
+  @override
+  Future<Map<String, dynamic>> currentIdentity() async => {
+    if (bound != null) 'identity': {'pubkey_hex': bound},
+  };
+  @override
+  Future<Map<String, dynamic>> post(
+    String path,
+    Map<String, dynamic> body,
+  ) async {
+    calls.add(path);
+    if (path.endsWith('/status')) {
+      return {'current_nostr_pubkey': bound, 'backup_nostr_pubkeys': backups};
+    }
+    if (path.endsWith('/recovery')) return recovery;
+    throw AccountFailure.denied;
+  }
+}
+
+void main() {
+  TestWidgetsFlutterBinding.ensureInitialized();
+  final first = nostr.Keys('1'.padLeft(64, '0'));
+  final second = nostr.Keys('2'.padLeft(64, '0'));
+  const secure = FlutterSecureStorage();
+  late InventoryAccount account;
+  late AccountIdentityStore store;
+  late HostedIdentityService service;
+  Map<String, dynamic> record(nostr.Keys key, String name) => {
+    'nsec': key.nsec,
+    'pubkey': key.public,
+    'name': name,
+  };
+  setUp(() {
+    FlutterSecureStorage.setMockInitialValues({});
+    account = InventoryAccount();
+    store = AccountIdentityStore(subject: 'fixture');
+    service = HostedIdentityService(
+      account: account,
+      store: store,
+      deviceIdentities: DeviceIdentitySource(),
+    );
+  });
+  tearDown(() => account.dispose());
+
+  for (final scenario in [
+    (
+      name: 'unbound',
+      bound: false,
+      backups: <String>[],
+      state: HostedIdentityState.needsBinding,
+    ),
+    (
+      name: 'bound with matching backup',
+      bound: true,
+      backups: [first.public],
+      state: HostedIdentityState.needsBackup,
+    ),
+    (
+      name: 'bound with other backup',
+      bound: true,
+      backups: [first.public, second.public],
+      state: HostedIdentityState.needsBackup,
+    ),
+  ]) {
+    test('device key reconciliation: ${scenario.name}', () async {
+      final raw = jsonEncode([record(first, 'Old community')]);
+      await secure.write(key: 'buzz_workspaces', value: raw);
+      account.bound = scenario.bound ? first.public : null;
+      account.backups = scenario.backups;
+      if (!scenario.bound) {
+        expect(
+          (await service.resolve()).state,
+          HostedIdentityState.needsSelection,
+        );
+        expect(await store.read(), isNull);
+      }
+      final result = await service.resolve(selectedPubkey: first.public);
+      expect(result.state, scenario.state);
+      expect(result.pubkey, first.public);
+      expect((await store.read())?.pubkey, first.public);
+      expect(await secure.read(key: 'buzz_workspaces'), raw);
+      expect(await secure.read(key: 'buzz_communities'), isNull);
+      expect(account.calls.every((path) => path.endsWith('/status')), isTrue);
+    });
+  }
+
+  test(
+    'multiple current and hidden legacy keys require choice; no writes before choice',
+    () async {
+      await secure.write(
+        key: 'buzz_communities',
+        value: jsonEncode([record(first, 'Current')]),
+      );
+      await secure.write(key: 'buzz_nsec', value: second.nsec);
+      final before = await secure.readAll();
+      final pending = await service.resolve();
+      expect(pending.state, HostedIdentityState.needsSelection);
+      expect(pending.choices.map((item) => item.pubkey), [
+        first.public,
+        second.public,
+      ]);
+      expect(await secure.readAll(), before);
+      final selected = await service.resolve(selectedPubkey: second.public);
+      expect(selected.pubkey, second.public);
+      for (final entry in before.entries) {
+        expect(await secure.read(key: entry.key), entry.value);
+      }
+      expect(account.calls.every((path) => path.endsWith('/status')), isTrue);
+      expect(
+        (await service.resolve(selectedPubkey: first.public)).pubkey,
+        second.public,
+      );
+    },
+  );
+
+  test('duplicate device identities offer one explicit reuse choice', () async {
+    FlutterSecureStorage.setMockInitialValues({
+      'buzz_nsec': first.nsec,
+      'buzz_communities': jsonEncode([record(first, 'Same identity')]),
+    });
+    expect((await service.resolve()).choices.map((item) => item.pubkey), [
+      first.public,
+    ]);
+    expect(
+      (await service.resolve(selectedPubkey: first.public)).pubkey,
+      first.public,
+    );
+  });
+
+  test(
+    'corrupt, incomplete and mismatched legacy records never authorize generation',
+    () async {
+      for (final data in [
+        {'buzz_workspaces': '{broken'},
+        {'buzz_nsec': ''},
+        {
+          'buzz_communities': jsonEncode([
+            {'nsec': first.nsec, 'pubkey': second.public},
+          ]),
+        },
+      ]) {
+        FlutterSecureStorage.setMockInitialValues(data);
+        await expectLater(
+          service.resolve(),
+          throwsA(AccountIdentityFailure.unreadable),
+        );
+        expect(await secure.readAll(), data);
+      }
+      // Another account's scoped key must remain a choice, even when an
+      // unrelated Android entry prevents bulk enumeration. Never mint a key
+      // from that incomplete inventory; retry after storage recovers.
+      FlutterSecureStorage.setMockInitialValues({});
+      final storage = _InventoryStorage();
+      store = AccountIdentityStore(storage: storage, subject: 'fixture');
+      await store.forSubject('other-account').create(first.nsec);
+      service = HostedIdentityService(account: account, store: store);
+      final before = await secure.readAll();
+      expect(
+        (await service.resolve()).state,
+        HostedIdentityState.needsSelection,
+      );
+      storage.failEnumeration = true;
+      await expectLater(
+        service.resolve(),
+        throwsA(AccountIdentityFailure.unreadable),
+      );
+      expect(await secure.readAll(), before);
+      expect(await store.read(), isNull);
+      storage.failEnumeration = false;
+      expect((await service.resolve()).choices.single.pubkey, first.public);
+      expect(
+        (await service.resolve(selectedPubkey: first.public)).pubkey,
+        first.public,
+      );
+      expect(
+        (await store.forSubject('other-account').read())!.pubkey,
+        first.public,
+      );
+    },
+  );
+
+  test(
+    'token-only legacy records do not prevent recovering the same cloud identity',
+    () async {
+      final raw = jsonEncode([
+        {'pubkey': first.public, 'name': 'Token-only community'},
+      ]);
+      await secure.write(key: 'buzz_communities', value: raw);
+      await secure.write(key: 'buzz_pubkey', value: first.public);
+      account.bound = first.public;
+      account.backups = [first.public];
+      account.recovery = {
+        'backups': [
+          {
+            'backup_id': 'fixture-backup',
+            'nostr_pubkey': first.public,
+            'secret_key': base64UrlEncode([
+              ...List.filled(31, 0),
+              1,
+            ]).replaceAll('=', ''),
+          },
+        ],
+        'failed_backup_ids': [],
+      };
+      final result = await service.resolve();
+      expect(result.state, HostedIdentityState.ready);
+      expect(result.pubkey, first.public);
+      expect(account.calls, [
+        '/v1/buzz/nsec-backups/status',
+        '/v1/buzz/nsec-backups/recovery',
+      ]);
+      expect(await secure.read(key: 'buzz_communities'), raw);
+      expect(await secure.read(key: 'buzz_pubkey'), first.public);
+    },
+  );
+
+  test(
+    'inventory labels are deduplicated and empty names get a fallback',
+    () async {
+      final raw = jsonEncode([record(first, 'Team'), record(second, '  ')]);
+      await secure.write(key: 'buzz_communities', value: raw);
+      await secure.write(key: 'buzz_workspaces', value: raw);
+      final choices = await DeviceIdentitySource().choices();
+      expect(choices.map((choice) => choice.label), [
+        'Team',
+        'Saved community',
+      ]);
+    },
+  );
+
+  test('cancelled resolution cannot adopt or generate', () async {
+    await secure.write(key: 'buzz_nsec', value: first.nsec);
+    await expectLater(
+      service.resolve(isCurrent: () => false),
+      throwsA(AccountFailure.unavailable),
+    );
+    expect(await store.read(), isNull);
+  });
+}
+
+class _InventoryStorage extends FlutterSecureStorage {
+  bool failEnumeration = false;
+  @override
+  Future<Map<String, String>> readAll({
+    AppleOptions? iOptions,
+    AndroidOptions? aOptions,
+    LinuxOptions? lOptions,
+    WebOptions? webOptions,
+    AppleOptions? mOptions,
+    WindowsOptions? wOptions,
+  }) async {
+    if (failEnumeration) throw StateError('unrelated entry cannot decrypt');
+    return super.readAll();
+  }
+}
diff --git a/mobile/test/shared/hosted/hosted_admission_test.dart b/mobile/test/shared/hosted/hosted_admission_test.dart
new file mode 100644
index 0000000000..ca5dfa1d1f
--- /dev/null
+++ b/mobile/test/shared/hosted/hosted_admission_test.dart
@@ -0,0 +1,276 @@
+import 'package:buzz/shared/hosted/hosted_relay_auth.dart';
+import 'dart:async';
+import 'hosted_http_fixture.dart';
+import 'package:buzz/shared/hosted/hosted_join_policy.dart';
+import 'dart:convert';
+
+import 'package:buzz/shared/deeplink/deep_link.dart';
+import 'package:buzz/shared/hosted/account_identity_store.dart';
+import 'package:buzz/shared/hosted/builderlab_account.dart';
+import 'package:buzz/shared/hosted/hosted_admission.dart';
+import 'package:flutter_secure_storage/flutter_secure_storage.dart';
+import 'package:flutter_test/flutter_test.dart';
+import 'package:http/http.dart' as http;
+import 'package:http/testing.dart';
+import 'package:nostr/nostr.dart' as nostr;
+
+void main() {
+  TestWidgetsFlutterBinding.ensureInitialized();
+  final keys = nostr.Keys(
+    '0000000000000000000000000000000000000000000000000000000000000001',
+  );
+  const invite = InviteDeepLink(
+    relayUrl: 'wss://example.communities.buzz.xyz',
+    code: 'invite',
+    policyReceipt: 'policy',
+  );
+  late _Account account;
+  late AccountIdentityStore store;
+  late List<http.Request> claims;
+  late HostedAdmission admission;
+  setUp(() {
+    FlutterSecureStorage.setMockInitialValues({});
+    account = _Account(keys.public);
+    store = AccountIdentityStore(subject: 'owner');
+    claims = [];
+    admission = HostedAdmission(
+      account: account,
+      relayAuth: HostedRelayAuth(account, enabled: false),
+      store: store,
+      probe: (_) async {},
+      client: MockClient((request) async {
+        if (request.method == 'POST') claims.add(request);
+        return http.Response('{}', 200);
+      }),
+    );
+  });
+  tearDown(() {
+    admission.dispose();
+    account.dispose();
+  });
+  Future<void> backup() async => store.confirmBackup(
+    BackupReceipt(
+      backend: BuilderlabAccountClient.origin.origin,
+      subject: 'owner',
+      pubkey: keys.public,
+      backupId: 'backup',
+    ),
+  );
+
+  test('no claim without scoped backup or current matching binding', () async {
+    await store.create(keys.nsec);
+    await expectLater(
+      admission.prepare(invite, 'owner', keys.public),
+      throwsA(AccountFailure.denied),
+    );
+    expect(account.bindingReads, 0);
+    expect(claims, isEmpty);
+    await backup();
+    account.bound = 'a' * 64;
+    await expectLater(
+      admission.prepare(invite, 'owner', keys.public),
+      throwsA(AccountFailure.denied),
+    );
+    expect(account.bindingReads, 1);
+    expect(claims, isEmpty);
+  });
+
+  test('claim signature and returned identity use resolved key', () async {
+    await store.create(keys.nsec);
+    await backup();
+    final community = await admission.prepare(invite, 'owner', keys.public);
+    expect(claims, hasLength(1));
+    final request = claims.single;
+    final auth = request.headers['Authorization']!;
+    expect(auth.startsWith('Nostr '), isTrue);
+    final event = nostr.Event.fromJson(
+      utf8.decode(base64.decode(auth.substring(6))),
+      verify: true,
+    );
+    expect(event.pubkey, keys.public);
+    expect(event.kind, 27235);
+    expect(
+      event.tags.map((tag) => tag.toList()).toList(),
+      contains(
+        equals(['u', 'https://example.communities.buzz.xyz/api/invites/claim']),
+      ),
+    );
+    expect(
+      event.tags.map((tag) => tag.toList()).toList(),
+      contains(equals(['method', 'POST'])),
+    );
+    expect(jsonDecode(request.body), {'code': 'invite'});
+    expect(community.pubkey, keys.public);
+    expect(community.nsec, keys.nsec);
+    expect(request.followRedirects, isFalse);
+  });
+
+  // Wire limits stay focused; consent/claim ordering is covered by the journey.
+  for (final (name, response, status, failure) in [
+    ('redirect', '{}', 302, AccountFailure.denied),
+    ('oversized policy', ' ' * 65537, 200, AccountFailure.invalidResponse),
+    ('invalid JSON', 'not JSON', 200, AccountFailure.invalidResponse),
+    ('wrong shape', '[]', 200, AccountFailure.invalidResponse),
+  ]) {
+    test('$name cannot reach a claim', () async {
+      await store.create(keys.nsec);
+      await backup();
+      admission.dispose();
+      admission = HostedAdmission(
+        account: account,
+        relayAuth: HostedRelayAuth(account, enabled: false),
+        store: store,
+        probe: (_) async {},
+        client: MockClient((request) async {
+          expect(request.method, 'GET');
+          expect(request.followRedirects, isFalse);
+          expect(
+            request.headers.containsKey('X-BB-Session-Credential'),
+            isFalse,
+          );
+          return http.Response(response, status);
+        }),
+      );
+      await expectLater(
+        admission.prepare(invite, 'owner', keys.public),
+        throwsA(failure),
+      );
+    });
+  }
+
+  testWidgets('total policy deadline cancels body and permits policy retry', (
+    tester,
+  ) async {
+    final transport = TrickleClient((_) => http.Response('{}', 200));
+    Future<String?> policy() => freshJoinPolicyReceipt(
+      client: transport,
+      origin: Uri.parse(invite.relayUrl),
+      code: invite.code,
+      confirm: (_) async =>
+          fail('incomplete policy must never request consent'),
+      checkCurrent: () {},
+    );
+    Object? failure;
+    unawaited(
+      policy().then<void>(
+        (_) => fail('trickling policy must not complete'),
+        onError: (Object error) {
+          failure = error;
+        },
+      ),
+    );
+    await tester.pump();
+    await tester.pump(const Duration(seconds: 20));
+    await tester.pump(const Duration(seconds: 5));
+    expect(failure, isNull);
+    await tester.pump(const Duration(seconds: 5));
+    expect(failure, isA<TimeoutException>());
+    expect(transport.aborted, isTrue);
+    expect(transport.cancelled, isTrue);
+    transport.slow = false;
+    final retry = policy();
+    await tester.pump();
+    expect(await retry, isNull);
+  });
+
+  test('cancellation during binding prevents external claim', () async {
+    await store.create(keys.nsec);
+    await backup();
+    var current = true;
+    account.onBinding = () => current = false;
+    await expectLater(
+      admission.prepare(invite, 'owner', keys.public, isCurrent: () => current),
+      throwsA(AccountFailure.unavailable),
+    );
+    expect(claims, isEmpty);
+  });
+
+  test('cancelled or rejected relay probe never returns community', () async {
+    await store.create(keys.nsec);
+    await backup();
+    final pending = Completer<void>();
+    final started = Completer<void>();
+    var current = true;
+    final delayed = HostedAdmission(
+      account: account,
+      relayAuth: HostedRelayAuth(account, enabled: false),
+      store: store,
+      probe: (_) {
+        started.complete();
+        return pending.future;
+      },
+    );
+    const link = AddCommunityDeepLink(
+      relayUrl: 'wss://example.communities.buzz.xyz',
+      name: 'Wes',
+    );
+    final result = delayed.prepare(
+      link,
+      'owner',
+      keys.public,
+      isCurrent: () => current,
+    );
+    final expectation = expectLater(
+      result,
+      throwsA(AccountFailure.unavailable),
+    );
+    await started.future;
+    current = false;
+    pending.complete();
+    await expectation;
+    delayed.dispose();
+    final rejected = HostedAdmission(
+      account: account,
+      relayAuth: HostedRelayAuth(account, enabled: false),
+      store: store,
+      probe: (_) async {
+        throw AccountFailure.denied;
+      },
+    );
+    await expectLater(
+      rejected.prepare(link, 'owner', keys.public),
+      throwsA(AccountFailure.denied),
+    );
+    rejected.dispose();
+    expect(claims, isEmpty);
+  });
+
+  test('different account and untrusted host cannot claim', () async {
+    await store.create(keys.nsec);
+    await backup();
+    await expectLater(
+      admission.prepare(invite, 'other', keys.public),
+      throwsA(AccountFailure.differentAccount),
+    );
+    await expectLater(
+      admission.prepare(
+        const InviteDeepLink(
+          relayUrl: 'wss://communities.buzz.xyz.attacker.test',
+          code: 'i',
+        ),
+        'owner',
+        keys.public,
+      ),
+      throwsA(AccountFailure.denied),
+    );
+    expect(claims, isEmpty);
+  });
+}
+
+class _Account extends BuilderlabAccountClient {
+  _Account(this.bound);
+  String bound;
+  int bindingReads = 0;
+  void Function()? onBinding;
+  @override
+  BuilderlabAccount get account =>
+      BuilderlabAccount(subject: 'owner', expiresAt: DateTime.utc(2100));
+  @override
+  Future<Map<String, dynamic>> currentIdentity() async {
+    bindingReads++;
+    onBinding?.call();
+    return {
+      'identity': {'pubkey_hex': bound},
+    };
+  }
+}
diff --git a/mobile/test/shared/hosted/hosted_backup_service_test.dart b/mobile/test/shared/hosted/hosted_backup_service_test.dart
new file mode 100644
index 0000000000..eeb3123096
--- /dev/null
+++ b/mobile/test/shared/hosted/hosted_backup_service_test.dart
@@ -0,0 +1,178 @@
+import 'dart:convert';
+import 'dart:io';
+import 'package:buzz/shared/hosted/account_identity_store.dart';
+import 'package:buzz/shared/hosted/builderlab_account.dart';
+import 'package:buzz/shared/hosted/hosted_backup_service.dart';
+import 'package:buzz/shared/hosted/hpke_backup.dart';
+import 'package:flutter_secure_storage/flutter_secure_storage.dart';
+import 'package:flutter_test/flutter_test.dart';
+import 'package:nostr/nostr.dart' as nostr;
+
+class FakeAccount extends BuilderlabAccountClient {
+  FakeAccount(this.envelope);
+  final Map<String, dynamic> envelope;
+  int enrollments = 0;
+  final uploads = <String>[];
+  bool fail = true;
+  bool reject = false;
+  bool rejectEnrollment = false;
+  String subject = 'subject';
+  @override
+  BuilderlabAccount get account =>
+      BuilderlabAccount(subject: subject, expiresAt: DateTime(2100));
+  @override
+  Future<Map<String, dynamic>> post(
+    String path,
+    Map<String, dynamic> body,
+  ) async {
+    if (path.endsWith('/enrollment')) {
+      enrollments++;
+      if (rejectEnrollment) throw AccountFailure.rejected;
+      return envelope;
+    }
+    uploads.add(jsonEncode(body));
+    expect(
+      await const FlutterSecureStorage().read(
+        key: HostedBackupService.pendingKey(
+          subject,
+          envelope['nostr_pubkey'] as String,
+        ),
+      ),
+      isNotNull,
+    );
+    if (reject) throw AccountFailure.rejected;
+    if (fail) throw AccountFailure.unavailable;
+    return {'stored': true, 'backup_id': envelope['backup_id']};
+  }
+}
+
+class FakeHpke extends HpkeBackup {
+  FakeHpke(this.envelope);
+  final Map<String, dynamic> envelope;
+  int calls = 0;
+  @override
+  Future<Map<String, dynamic>> seal({
+    required Map<String, dynamic> enrollment,
+    required String secretHex,
+  }) async {
+    calls++;
+    return envelope;
+  }
+}
+
+void main() {
+  TestWidgetsFlutterBinding.ensureInitialized();
+  late Map<String, dynamic> envelope;
+  setUp(() {
+    FlutterSecureStorage.setMockInitialValues({});
+    final fixture =
+        jsonDecode(
+              File(
+                '../desktop/src-tauri/src/testdata/hpke_nsec_backup_v1.json',
+              ).readAsStringSync(),
+            )
+            as Map<String, dynamic>;
+    envelope = Map<String, dynamic>.from(fixture['envelope'] as Map);
+  });
+  test(
+    'uncertain upload replays persisted envelope after restart and receipt prevents further upload',
+    () async {
+      final identity = AccountIdentityStore();
+      await identity.create(nostr.Keys('42' * 32).nsec);
+      final account = FakeAccount(envelope);
+      final hpke = FakeHpke(envelope);
+      await expectLater(
+        HostedBackupService(account, identity, hpke: hpke).backup(),
+        throwsA(AccountFailure.unavailable),
+      );
+      expect((await identity.read())!.backup, isNull);
+      account.fail = false;
+      await HostedBackupService(
+        account,
+        AccountIdentityStore(),
+        hpke: hpke,
+      ).backup();
+      expect(account.enrollments, 1);
+      expect(hpke.calls, 1);
+      expect(account.uploads, hasLength(2));
+      expect(account.uploads.first, account.uploads.last);
+      expect((await identity.read())!.backup!.backupId, envelope['backup_id']);
+      await HostedBackupService(account, identity, hpke: hpke).backup();
+      expect(account.uploads, hasLength(2));
+    },
+  );
+  test('unreadable pending ciphertext blocks enrollment and upload', () async {
+    final identity = AccountIdentityStore();
+    await identity.create(nostr.Keys('42' * 32).nsec);
+    await const FlutterSecureStorage().write(
+      key: HostedBackupService.pendingKey(
+        'subject',
+        envelope['nostr_pubkey'] as String,
+      ),
+      value: 'invalid',
+    );
+    final account = FakeAccount(envelope);
+    await expectLater(
+      HostedBackupService(account, identity).backup(),
+      throwsA(HostedBackupFailure.storage),
+    );
+    expect(account.enrollments, 0);
+    expect(account.uploads, isEmpty);
+  });
+  test(
+    'definitive rejection permits only one re-enrollment per attempt',
+    () async {
+      final identity = AccountIdentityStore();
+      await identity.create(nostr.Keys('42' * 32).nsec);
+      final account = FakeAccount(envelope)..reject = true;
+      await expectLater(
+        HostedBackupService(
+          account,
+          identity,
+          hpke: FakeHpke(envelope),
+        ).backup(),
+        throwsA(HostedBackupFailure.rejected),
+      );
+      expect(account.enrollments, 2);
+      expect(account.uploads, hasLength(2));
+      expect((await identity.read())!.backup, isNull);
+    },
+  );
+  test('enrollment rejection is terminal without upload', () async {
+    final identity = AccountIdentityStore();
+    await identity.create(nostr.Keys('42' * 32).nsec);
+    final account = FakeAccount(envelope)..rejectEnrollment = true;
+    await expectLater(
+      HostedBackupService(account, identity).backup(),
+      throwsA(HostedBackupFailure.unavailable),
+    );
+    expect(account.enrollments, 1);
+    expect(account.uploads, isEmpty);
+  });
+  test(
+    'another subject pending envelope neither blocks nor gets replaced',
+    () async {
+      final identity = AccountIdentityStore();
+      await identity.create(nostr.Keys('42' * 32).nsec);
+      final oldKey = HostedBackupService.pendingKey(
+        'other',
+        envelope['nostr_pubkey'] as String,
+      );
+      await const FlutterSecureStorage().write(
+        key: oldKey,
+        value: 'old pending',
+      );
+      final account = FakeAccount(envelope)..fail = false;
+      await HostedBackupService(
+        account,
+        identity,
+        hpke: FakeHpke(envelope),
+      ).backup();
+      expect(
+        await const FlutterSecureStorage().read(key: oldKey),
+        'old pending',
+      );
+      expect(account.enrollments, 1);
+    },
+  );
+}
diff --git a/mobile/test/shared/hosted/hosted_communities_flow_test.dart b/mobile/test/shared/hosted/hosted_communities_flow_test.dart
new file mode 100644
index 0000000000..1fa6d43125
--- /dev/null
+++ b/mobile/test/shared/hosted/hosted_communities_flow_test.dart
@@ -0,0 +1,91 @@
+import 'dart:async';
+
+import 'package:buzz/shared/hosted/builderlab_account.dart';
+import 'package:buzz/shared/hosted/browser_auth.dart';
+import 'package:buzz/shared/hosted/account_identity_store.dart';
+import 'package:buzz/shared/hosted/hosted_flow.dart';
+import 'package:flutter_secure_storage/flutter_secure_storage.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+import '../../helpers/hosted_communities_fixture.dart';
+
+void main() {
+  TestWidgetsFlutterBinding.ensureInitialized();
+  setUp(() => FlutterSecureStorage.setMockInitialValues({}));
+
+  Future<HostedCommunitiesFixture> fixture({bool backup = true}) async {
+    final result = HostedCommunitiesFixture();
+    await result.initialize(backup: backup);
+    addTearDown(result.dispose);
+    return result;
+  }
+
+  for (final failure in ['binding', 'backup']) {
+    test(
+      '$failure proof failure blocks discovery and preserves saved identity',
+      () async {
+        final f = await fixture(backup: failure != 'backup');
+        if (failure == 'binding') f.bound = '2' * 64;
+        final before = await const FlutterSecureStorage().readAll();
+        await f.flow.signInAccount();
+        expect(f.flow.stage, HostedFlowStage.blocked);
+        if (failure == 'binding') {
+          expect(f.flow.problem, HostedFlowProblem.identityMismatch);
+        }
+        expect(
+          f.requests.any((path) => path.endsWith('/communities/joined')),
+          isFalse,
+        );
+        expect(await const FlutterSecureStorage().readAll(), before);
+        expect(f.admitted, isEmpty);
+      },
+    );
+  }
+
+  test('malformed list targets cannot authorize admission', () async {
+    final f = await fixture();
+    f.rows = [
+      {...f.row('one'), 'normalized_host': 'wss://user@evil.example/path'},
+    ];
+    await f.flow.signInAccount();
+    expect(f.flow.problem, HostedFlowProblem.invalidResponse);
+    expect(f.admitted, isEmpty);
+  });
+  test('expired A batch is discarded after browser login as B', () async {
+    final f = await fixture();
+    await f.flow.initialize();
+    f.rows = [f.row('a-one'), f.row('a-two')];
+    f.beforeAdmission = (name) async {
+      if (name == 'a-two') throw AccountFailure.unavailable;
+    };
+    await f.flow.signInAccount();
+    expect(f.admitted, ['a-one']);
+    f.expired = true;
+    await f.flow.retry();
+    expect(f.flow.stage, HostedFlowStage.signIn);
+    expect(f.browser.startedIntent, {'type': 'account'});
+    f.expired = false;
+    f.subject = 'other-owner';
+    f.rows = [f.row('b-one')];
+    await f.store.create(f.keys.nsec);
+    await f.store.confirmBackup(
+      BackupReceipt(
+        backend: BuilderlabAccountClient.origin.toString(),
+        subject: f.subject,
+        pubkey: f.keys.public,
+        backupId: 'other-backup',
+      ),
+    );
+    final completed = Completer<void>();
+    f.flow.addListener(() {
+      if (f.flow.stage == HostedFlowStage.complete && !completed.isCompleted) {
+        completed.complete();
+      }
+    });
+    f.browser.callbacks.add(
+      BrowserAuthCode('other-code', 'a' * 43, {'type': 'account'}),
+    );
+    await completed.future.timeout(const Duration(seconds: 2));
+    expect(f.admitted, ['a-one', 'b-one']);
+  });
+}
diff --git a/mobile/test/shared/hosted/hosted_community_connection_test.dart b/mobile/test/shared/hosted/hosted_community_connection_test.dart
new file mode 100644
index 0000000000..1f487c034c
--- /dev/null
+++ b/mobile/test/shared/hosted/hosted_community_connection_test.dart
@@ -0,0 +1,87 @@
+import 'package:buzz/shared/hosted/hosted_relay_auth.dart';
+import 'package:buzz/shared/community/community.dart';
+import 'package:buzz/shared/community/community_storage.dart';
+import 'package:buzz/shared/deeplink/deep_link.dart';
+import 'package:buzz/shared/hosted/hosted_admission.dart';
+import 'package:buzz/shared/hosted/hosted_community_connection.dart';
+import 'package:flutter_secure_storage/flutter_secure_storage.dart';
+import 'package:flutter_test/flutter_test.dart';
+import 'package:nostr/nostr.dart' as nostr;
+
+import '../../helpers/hosted_communities_fixture.dart';
+
+void main() {
+  TestWidgetsFlutterBinding.ensureInitialized();
+  setUp(() => FlutterSecureStorage.setMockInitialValues({}));
+
+  for (final conflicting in [false, true]) {
+    test(
+      'real admission preserves saved :443 record (conflict=$conflicting)',
+      () async {
+        final f = HostedCommunitiesFixture();
+        await f.initialize();
+        addTearDown(f.dispose);
+        final storage = CommunityStorage();
+        final savedKeys = conflicting
+            ? nostr.Keys('2'.padLeft(64, '0'))
+            : f.keys;
+        final existing = Community.create(
+          name: 'Saved name',
+          relayUrl: 'wss://one.communities.buzz.xyz:443/',
+          pubkey: savedKeys.public,
+          nsec: savedKeys.nsec,
+        );
+        await storage.save(existing);
+        final unrelated = Community.create(
+          name: 'Other',
+          relayUrl: 'wss://other.example',
+          pubkey: savedKeys.public,
+          nsec: savedKeys.nsec,
+        );
+        await storage.save(unrelated);
+        var probes = 0;
+        final admission = HostedAdmission(
+          account: f.account,
+          relayAuth: HostedRelayAuth(f.account, enabled: false),
+          store: f.store,
+          probe: (_) async {
+            probes++;
+          },
+        );
+        addTearDown(admission.dispose);
+        final operation = connectHostedCommunity(
+          link: const AddCommunityDeepLink(
+            relayUrl: 'wss://one.communities.buzz.xyz',
+            name: 'one',
+          ),
+          subject: 'owner',
+          pubkey: f.keys.public,
+          isCurrent: () => true,
+          storage: storage,
+          admission: admission,
+          recoverStarterChannels: (_, _) async =>
+              fail('Saved non-invite community needs no starter repair'),
+          persist: (community, current) async {
+            if (current()) await storage.save(community);
+          },
+        );
+        if (conflicting) {
+          await expectLater(
+            operation,
+            throwsA(isA<SavedCommunityIdentityConflict>()),
+          );
+          expect(probes, 0);
+        } else {
+          await operation;
+          expect(probes, 1);
+        }
+        final after = await storage.loadAll();
+        expect(after.length, 2);
+        expect(after.first.id, existing.id);
+        expect(after.first.name, existing.name);
+        expect(after.first.nsec, savedKeys.nsec);
+        expect(after.last.toJson(), unrelated.toJson());
+      },
+    );
+  }
+}
diff --git a/mobile/test/shared/hosted/hosted_environment_flow_test.dart b/mobile/test/shared/hosted/hosted_environment_flow_test.dart
new file mode 100644
index 0000000000..1b40094eda
--- /dev/null
+++ b/mobile/test/shared/hosted/hosted_environment_flow_test.dart
@@ -0,0 +1,124 @@
+import 'package:buzz/shared/hosted/hosted_relay_auth.dart';
+import 'package:buzz/shared/deeplink/deep_link.dart';
+import 'package:buzz/shared/hosted/account_identity_store.dart';
+import 'package:buzz/shared/hosted/browser_auth.dart';
+import 'package:buzz/shared/hosted/builderlab_account.dart';
+import 'package:buzz/shared/hosted/hosted_admission.dart';
+import 'package:buzz/shared/hosted/hosted_environment.dart';
+import 'package:buzz/shared/hosted/hosted_flow.dart';
+import 'package:buzz/shared/hosted/hosted_identity_service.dart';
+import 'package:flutter_secure_storage/flutter_secure_storage.dart';
+import 'package:flutter_test/flutter_test.dart';
+import 'package:http/http.dart' as http;
+import 'package:http/testing.dart';
+import 'package:nostr/nostr.dart' as nostr;
+
+class _Account extends BuilderlabAccountClient {
+  _Account(this.pubkey);
+  final String pubkey;
+  var reads = 0;
+  @override
+  BuilderlabAccount get account =>
+      BuilderlabAccount(subject: 'owner', expiresAt: DateTime.utc(2100));
+  @override
+  Future<BuilderlabAccount?> restore() async {
+    reads++;
+    return account;
+  }
+
+  @override
+  Future<Map<String, dynamic>> currentIdentity() async {
+    reads++;
+    return {
+      'identity': {'pubkey_hex': pubkey},
+    };
+  }
+}
+
+void main() {
+  TestWidgetsFlutterBinding.ensureInitialized();
+  setUp(() => FlutterSecureStorage.setMockInitialValues({}));
+  test(
+    'real flow and admission use only the configured community realm',
+    () async {
+      final staging =
+          HostedEnvironment.origin.host == 'app.builderlabstaging.xyz';
+      final matching = staging
+          ? 'team.communities.public.builderlabstaging.xyz'
+          : 'team.communities.buzz.xyz';
+      final opposite = staging
+          ? 'team.communities.buzz.xyz'
+          : 'team.communities.public.builderlabstaging.xyz';
+      final keys = nostr.Keys('1'.padLeft(64, '0'));
+      final account = _Account(keys.public);
+      final store = AccountIdentityStore(subject: 'owner');
+      await store.create(keys.nsec);
+      await store.confirmBackup(
+        BackupReceipt(
+          backend: HostedEnvironment.origin.origin,
+          subject: 'owner',
+          pubkey: keys.public,
+          backupId: 'receipt',
+        ),
+      );
+      final requests = <http.Request>[];
+      final admission = HostedAdmission(
+        account: account,
+        relayAuth: HostedRelayAuth(account, enabled: false),
+        store: store,
+        probe: (_) async {},
+        client: MockClient((request) async {
+          requests.add(request);
+          return http.Response('{}', 200);
+        }),
+      );
+      final browser = BrowserAuth(
+        openBrowser: (_) async => fail('Saved account must not open browser'),
+      );
+      var entered = 0;
+      final flow = HostedFlow(
+        account: account,
+        browser: browser,
+        store: store,
+        identity: HostedIdentityService(account: account, store: store),
+        enterCommunity: (link, subject, pubkey, isCurrent) async {
+          await admission.prepare(link, subject, pubkey, isCurrent: isCurrent);
+          entered++;
+        },
+      );
+      addTearDown(() async {
+        flow.dispose();
+        await browser.dispose();
+        account.dispose();
+        admission.dispose();
+      });
+      await flow.start(
+        InviteDeepLink(relayUrl: 'wss://$opposite', code: 'test'),
+      );
+      expect(flow.problem, HostedFlowProblem.unsupportedEnvironment);
+      expect(account.reads, 0);
+      expect(requests, isEmpty);
+      // Admission independently enforces the boundary, even without the UI/flow.
+      await expectLater(
+        admission.prepare(
+          InviteDeepLink(relayUrl: 'wss://$opposite', code: 'test'),
+          'owner',
+          keys.public,
+        ),
+        throwsA(AccountFailure.denied),
+      );
+      expect(account.reads, 0);
+      await flow.start(
+        InviteDeepLink(relayUrl: 'wss://$matching', code: 'test'),
+      );
+      expect(flow.stage, HostedFlowStage.complete);
+      expect(entered, 1);
+      expect(requests.map((request) => request.url.host), [matching, matching]);
+      expect(requests.map((request) => request.method), ['GET', 'POST']);
+      expect(requests.map((request) => request.url.path), [
+        '/api/join-policy',
+        '/api/invites/claim',
+      ]);
+    },
+  );
+}
diff --git a/mobile/test/shared/hosted/hosted_environment_test.dart b/mobile/test/shared/hosted/hosted_environment_test.dart
new file mode 100644
index 0000000000..8afc89f813
--- /dev/null
+++ b/mobile/test/shared/hosted/hosted_environment_test.dart
@@ -0,0 +1,61 @@
+import 'package:buzz/shared/hosted/hosted_environment.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+void main() {
+  test('community realms map only to their trusted account origin', () {
+    expect(
+      HostedEnvironment.accountOriginFor(
+        Uri.parse('wss://team.communities.buzz.xyz'),
+      ),
+      Uri.parse('https://app.builderlab.xyz'),
+    );
+    expect(
+      HostedEnvironment.accountOriginFor(
+        Uri.parse('wss://team.communities.public.builderlabstaging.xyz'),
+      ),
+      Uri.parse('https://app.builderlabstaging.xyz'),
+    );
+    for (final value in [
+      'wss://team.communities.public.builderlabstaging.xyz.attacker.test',
+      'wss://communities.public.builderlabstaging.xyz',
+      'wss://team.communities.public.builderlabstaging.xyz.',
+      'wss://team.communities.public.builderlabstaging.xyz:8443',
+      'ws://team.communities.public.builderlabstaging.xyz',
+      'wss://user@team.communities.public.builderlabstaging.xyz',
+      'wss://team.communities.public.builderlabstaging.xyz/path',
+      'wss://team.communities.public.builderlabstaging.xyz?account=other',
+      'wss://team.communities.public.builderlabstaging.xyz#fragment',
+      'wss://team.builderlabstaging.xyz',
+    ]) {
+      expect(
+        HostedEnvironment.accountOriginFor(Uri.parse(value)),
+        isNull,
+        reason: value,
+      );
+    }
+  });
+
+  test('authentication follows only configured DNS domain boundaries', () {
+    expect(HostedEnvironment.enabled, HostedEnvironment.authDomains.isNotEmpty);
+    for (final domain in HostedEnvironment.authDomains) {
+      for (final host in [
+        domain,
+        'team.$domain',
+        'TEAM.${domain.toUpperCase()}.',
+      ]) {
+        expect(HostedEnvironment.requiresAuth(host), isTrue, reason: host);
+      }
+      expect(HostedEnvironment.requiresAuth('$domain.attacker.test'), isFalse);
+      expect(HostedEnvironment.requiresAuth('not$domain'), isFalse);
+    }
+    if (HostedEnvironment.authDomains.isEmpty) {
+      for (final host in [
+        'buzz.xyz',
+        'team.communities.buzz.xyz',
+        'team.communities.public.builderlabstaging.xyz',
+      ]) {
+        expect(HostedEnvironment.requiresAuth(host), isFalse);
+      }
+    }
+  });
+}
diff --git a/mobile/test/shared/hosted/hosted_http_fixture.dart b/mobile/test/shared/hosted/hosted_http_fixture.dart
new file mode 100644
index 0000000000..e3f6eef012
--- /dev/null
+++ b/mobile/test/shared/hosted/hosted_http_fixture.dart
@@ -0,0 +1,38 @@
+import 'dart:async';
+
+import 'package:http/http.dart' as http;
+
+/// A transport that keeps every idle interval short but exceeds total duration.
+/// It deliberately ignores abort so the caller must also cancel its reader.
+class TrickleClient extends http.BaseClient {
+  TrickleClient(this.respond);
+  final http.Response Function(http.BaseRequest) respond;
+  bool slow = true;
+  bool aborted = false;
+  bool cancelled = false;
+
+  @override
+  Future<http.StreamedResponse> send(http.BaseRequest request) async {
+    await request.finalize().drain<void>();
+    if (!slow) {
+      final response = respond(request);
+      return http.StreamedResponse(
+        Stream.value(response.bodyBytes),
+        response.statusCode,
+      );
+    }
+    if (request is http.Abortable) {
+      unawaited(request.abortTrigger?.then((_) => aborted = true));
+    }
+    await Future<void>.delayed(const Duration(seconds: 20));
+    Timer? timer;
+    final stream = StreamController<List<int>>(
+      onCancel: () {
+        cancelled = true;
+        timer?.cancel();
+      },
+    );
+    timer = Timer.periodic(const Duration(seconds: 5), (_) => stream.add([32]));
+    return http.StreamedResponse(stream.stream, 200);
+  }
+}
diff --git a/mobile/test/shared/hosted/hosted_invite_starter_recovery_test.dart b/mobile/test/shared/hosted/hosted_invite_starter_recovery_test.dart
new file mode 100644
index 0000000000..7091a263ca
--- /dev/null
+++ b/mobile/test/shared/hosted/hosted_invite_starter_recovery_test.dart
@@ -0,0 +1,197 @@
+import 'package:buzz/shared/hosted/hosted_relay_auth.dart';
+import 'package:buzz/features/invites/invite_join_provider.dart';
+import 'package:buzz/shared/hosted/hosted_flow_provider.dart';
+import 'package:buzz/shared/auth/auth.dart';
+import 'package:buzz/shared/deeplink/deep_link.dart';
+import 'package:buzz/shared/hosted/builderlab_account.dart';
+import 'package:buzz/shared/hosted/hosted_admission.dart';
+import 'package:buzz/shared/hosted/hosted_community_connection.dart';
+import 'package:flutter_secure_storage/flutter_secure_storage.dart';
+import 'package:flutter_test/flutter_test.dart';
+import 'package:hooks_riverpod/hooks_riverpod.dart';
+import 'package:http/http.dart' as http;
+import 'package:http/testing.dart';
+import 'package:nostr/nostr.dart' as nostr;
+
+import '../../helpers/hosted_communities_fixture.dart';
+
+final _finishProvider = Provider(
+  (ref) =>
+      (Community community, bool Function() current) =>
+          finishHostedStarterSetup(ref, community, current),
+);
+
+class _Recovery implements InviteJoinRecovery {
+  _Recovery(this.run);
+  final Future<void> Function() run;
+  @override
+  Future<String?> ensureStarterChannels() async {
+    await run();
+    return 'welcome-everyone';
+  }
+}
+
+void main() {
+  TestWidgetsFlutterBinding.ensureInitialized();
+  const invite = InviteDeepLink(
+    relayUrl: 'wss://invited.communities.buzz.xyz',
+    code: 'single-use',
+  );
+  late HostedCommunitiesFixture f;
+  late CommunityStorage storage;
+  late HostedAdmission admission;
+  late ProviderContainer container;
+  late Community unrelated;
+  late List<InviteJoinRecoveryScope> scopes;
+  late List<Community> probed;
+  late Future<void> Function() recover;
+  var claims = 0;
+  var current = true;
+
+  setUp(() async {
+    FlutterSecureStorage.setMockInitialValues({});
+    f = HostedCommunitiesFixture();
+    await f.initialize();
+    storage = CommunityStorage();
+    unrelated = Community.create(
+      name: 'Other',
+      relayUrl: 'wss://other.example',
+      pubkey: f.keys.public,
+      nsec: f.keys.nsec,
+    );
+    await storage.save(unrelated);
+    await storage.saveActiveId(unrelated.id);
+    claims = 0;
+    current = true;
+    scopes = [];
+    probed = [];
+    recover = () async {};
+    admission = HostedAdmission(
+      account: f.account,
+      relayAuth: HostedRelayAuth(f.account, enabled: false),
+      store: f.store,
+      probe: (community) async {
+        probed.add(community);
+      },
+      client: MockClient((request) async {
+        if (request.method == 'GET' && request.url.path == '/api/join-policy') {
+          return http.Response('{}', 200);
+        }
+        expect(request.method, 'POST');
+        expect(request.url.path, '/api/invites/claim');
+        claims++;
+        return http.Response('{}', claims == 1 ? 200 : 410);
+      }),
+    );
+    container = ProviderContainer(
+      overrides: [
+        communityStorageProvider.overrideWithValue(storage),
+        inviteJoinRecoveryProvider.overrideWithValue((scope) {
+          scopes.add(scope);
+          return _Recovery(() => recover());
+        }),
+      ],
+    );
+  });
+  tearDown(() async {
+    container.dispose();
+    admission.dispose();
+    await f.dispose();
+  });
+
+  Future<Community> savedInvite() async => (await storage.loadAll())
+      .singleWhere((community) => community.relayUrl == invite.relayUrl);
+
+  Future<void> connect() => connectHostedCommunity(
+    link: invite,
+    subject: 'owner',
+    pubkey: f.keys.public,
+    isCurrent: () => current,
+    storage: storage,
+    admission: admission,
+    persist: (community, isCurrent) =>
+        container.read(communityTransitionProvider).runExclusive(() async {
+          if (!isCurrent()) return;
+          await storage.save(community);
+          await storage.saveActiveId(community.id);
+          container.invalidate(communityListProvider);
+          container.invalidate(activeCommunityProvider);
+        }),
+    recoverStarterChannels: container.read(_finishProvider),
+  );
+
+  test(
+    'pending retry still rejects a changed account binding before probe or recovery',
+    () async {
+      recover = () async {
+        throw StateError('Starter membership refused');
+      };
+      await expectLater(connect(), throwsStateError);
+      f.bound = nostr.Keys('2'.padLeft(64, '0')).public;
+      await expectLater(connect(), throwsA(AccountFailure.denied));
+      expect((await savedInvite()).starterSetupIncomplete, isTrue);
+      expect(claims, 1);
+      expect(probed, hasLength(1));
+      expect(scopes, hasLength(1));
+    },
+  );
+
+  test('cancellation during recovery keeps durable pending flag', () async {
+    recover = () async {
+      current = false;
+    };
+    await expectLater(connect(), throwsA(AccountFailure.unavailable));
+    expect((await savedInvite()).starterSetupIncomplete, isTrue);
+    expect(claims, 1);
+  });
+
+  test(
+    'switching active community during recovery cannot clear pending flag',
+    () async {
+      recover = () => storage.saveActiveId(unrelated.id);
+      await expectLater(connect(), throwsA(AccountFailure.unavailable));
+      expect((await savedInvite()).starterSetupIncomplete, isTrue);
+      expect(await storage.loadActiveId(), unrelated.id);
+    },
+  );
+
+  test(
+    'clearing pending flag preserves newer saved community metadata',
+    () async {
+      recover = () =>
+          container.read(communityTransitionProvider).runExclusive(() async {
+            await storage.save(
+              (await savedInvite()).copyWith(name: 'Renamed while joining'),
+            );
+          });
+      await connect();
+      final saved = await savedInvite();
+      expect(saved.starterSetupIncomplete, isFalse);
+      expect(saved.name, 'Renamed while joining');
+      expect((await storage.loadAll()).first.toJson(), unrelated.toJson());
+    },
+  );
+
+  test(
+    'saved invite with another key is never reclaimed or overwritten',
+    () async {
+      final other = nostr.Keys('2'.padLeft(64, '0'));
+      final saved = Community.create(
+        name: 'Existing',
+        relayUrl: invite.relayUrl,
+        nsec: other.nsec,
+        pubkey: other.public,
+        starterSetupIncomplete: true,
+      );
+      await storage.save(saved);
+      await expectLater(
+        connect(),
+        throwsA(isA<SavedCommunityIdentityConflict>()),
+      );
+      expect(claims, 0);
+      expect(probed, isEmpty);
+      expect(scopes, isEmpty);
+      expect((await savedInvite()).toJson(), saved.toJson());
+    },
+  );
+}
diff --git a/mobile/test/shared/hosted/hosted_multi_backup_recovery_test.dart b/mobile/test/shared/hosted/hosted_multi_backup_recovery_test.dart
new file mode 100644
index 0000000000..954ad03be1
--- /dev/null
+++ b/mobile/test/shared/hosted/hosted_multi_backup_recovery_test.dart
@@ -0,0 +1,421 @@
+import 'dart:convert';
+
+import 'package:buzz/shared/hosted/account_identity_store.dart';
+import 'package:buzz/shared/hosted/builderlab_account.dart';
+import 'package:buzz/shared/hosted/device_identity_source.dart';
+import 'package:buzz/shared/hosted/hosted_identity_service.dart';
+import 'package:flutter_secure_storage/flutter_secure_storage.dart';
+import 'package:flutter_test/flutter_test.dart';
+import 'package:http/http.dart' as http;
+import 'package:http/testing.dart';
+import 'package:nostr/nostr.dart' as nostr;
+
+void main() {
+  TestWidgetsFlutterBinding.ensureInitialized();
+  // Public test vectors only; no user signing material.
+  final keys = [for (var i = 1; i <= 3; i++) nostr.Keys('$i'.padLeft(64, '0'))];
+  Map<String, dynamic> backup(int index, {String? id}) => {
+    'backup_id': id ?? 'backup-$index',
+    'nostr_pubkey': keys[index].public,
+    'secret_key': base64Url
+        .encode([...List.filled(31, 0), index + 1])
+        .replaceAll('=', ''),
+  };
+
+  late String? bound;
+  late Map<String, dynamic> recovery;
+  late List<String>? listedKeys;
+  var statusCode = 200;
+  late AccountIdentityStore store;
+  late String communityJson;
+  late int recoveryCalls;
+  late int recoveryStatus;
+  Future<void> Function()? duringRecovery;
+
+  setUp(() {
+    statusCode = 200;
+    bound = null;
+    listedKeys = [keys[0].public, keys[1].public];
+    recovery = {
+      'backups': [backup(0), backup(1)],
+      'failed_backup_ids': [],
+    };
+    communityJson = jsonEncode([
+      {'name': 'Existing', 'nsec': keys[2].nsec, 'pubkey': keys[2].public},
+    ]);
+    FlutterSecureStorage.setMockInitialValues({
+      'buzz_communities': communityJson,
+    });
+    store = AccountIdentityStore(subject: 'a');
+    recoveryCalls = 0;
+    recoveryStatus = 200;
+    duringRecovery = null;
+  });
+
+  Future<HostedIdentityService> service({
+    bool includeDevice = false,
+    Future<List<DeviceIdentityChoice>> Function()? inventory,
+  }) async {
+    final expiry = DateTime.now()
+        .toUtc()
+        .add(const Duration(hours: 1))
+        .toIso8601String();
+    final account = BuilderlabAccountClient(
+      httpClient: MockClient((request) async {
+        final path = request.url.path;
+        if (path.endsWith('/exchange')) {
+          return http.Response(
+            jsonEncode({'session_credential': 'token', 'expires_at': expiry}),
+            200,
+          );
+        }
+        if (path.endsWith('/me')) {
+          return http.Response(
+            jsonEncode({'subject': 'a', 'expires_at': expiry}),
+            200,
+          );
+        }
+        if (path.endsWith('/current')) {
+          return http.Response(
+            jsonEncode({
+              if (bound != null) 'identity': {'pubkey_hex': bound},
+            }),
+            200,
+          );
+        }
+        if (path.endsWith('/status')) {
+          return http.Response(
+            jsonEncode({
+              'current_nostr_pubkey': bound,
+              'backup_nostr_pubkeys': ?listedKeys,
+            }),
+            statusCode,
+          );
+        }
+        if (path.endsWith('/recovery')) {
+          recoveryCalls++;
+          await duringRecovery?.call();
+          return http.Response(jsonEncode(recovery), recoveryStatus);
+        }
+        return http.Response('{}', 404);
+      }),
+    );
+    await account.exchange(code: 'code', verifier: 'a' * 43);
+    return HostedIdentityService(
+      account: account,
+      store: store,
+      deviceIdentities: includeDevice
+          ? DeviceIdentitySource()
+          : _Inventory(inventory ?? () async => []),
+    );
+  }
+
+  Future<void> expectCommunityPreserved() async {
+    expect(
+      await const FlutterSecureStorage().read(key: 'buzz_communities'),
+      communityJson,
+    );
+  }
+
+  test(
+    'bound identity selects matching backup, persists receipt and resumes',
+    () async {
+      bound = keys[1].public;
+      final resolver = await service();
+      final result = await resolver.resolve(selectedPubkey: keys[0].public);
+      expect(result.state, HostedIdentityState.ready);
+      expect(result.pubkey, keys[1].public);
+      final saved = (await store.read())!;
+      expect(saved.backup!.backupId, 'backup-1');
+      expect(
+        saved.hasBackupFor(
+          backend: BuilderlabAccountClient.origin.origin,
+          subject: 'a',
+        ),
+        isTrue,
+      );
+      expect((await resolver.resolve()).pubkey, keys[1].public);
+      expect(recoveryCalls, 1);
+      await expectCommunityPreserved();
+    },
+  );
+
+  test(
+    'unbound distinct keys expose public choices and persist only selection',
+    () async {
+      final resolver = await service(includeDevice: true);
+      final pending = await resolver.resolve();
+      expect(pending.state, HostedIdentityState.needsSelection);
+      expect(pending.choices.map((choice) => choice.pubkey), [
+        keys[0].public,
+        keys[1].public,
+      ]);
+      expect(pending.choices.every((choice) => choice.fromCloud), isTrue);
+      expect(await store.read(), isNull);
+      final chosen = await resolver.resolve(selectedPubkey: keys[1].public);
+      expect(chosen.state, HostedIdentityState.needsBinding);
+      expect(chosen.pubkey, keys[1].public);
+      expect((await store.read())!.backup!.backupId, 'backup-1');
+      await expectCommunityPreserved();
+    },
+  );
+
+  test(
+    'selected unbound recovery resumes binding after restart without choosing again',
+    () async {
+      final first = await service();
+      final selected = await first.resolve(selectedPubkey: keys[1].public);
+      expect(selected.state, HostedIdentityState.needsBinding);
+      final receipt = (await store.read())!.backup!;
+      final restarted = await service();
+      final resumed = await restarted.resolve();
+      expect(resumed.state, HostedIdentityState.needsBinding);
+      expect(resumed.pubkey, keys[1].public);
+      expect((await store.read())!.backup!.backupId, receipt.backupId);
+      expect(recoveryCalls, 1);
+      await expectCommunityPreserved();
+    },
+  );
+
+  test(
+    'local key without a current-account receipt cannot bypass distinct backup conflict',
+    () async {
+      await store.create(keys[1].nsec);
+      final resolver = await service();
+      expect((await resolver.resolve()).state, HostedIdentityState.mismatch);
+      await expectLater(
+        store.confirmBackup(
+          BackupReceipt(
+            backend: BuilderlabAccountClient.origin.origin,
+            subject: 'another-account',
+            pubkey: keys[1].public,
+            backupId: 'other-account-backup',
+          ),
+        ),
+        throwsA(AccountIdentityFailure.mismatch),
+      );
+      expect((await resolver.resolve()).state, HostedIdentityState.mismatch);
+      expect(recoveryCalls, 0);
+      expect((await store.read())!.pubkey, keys[1].public);
+    },
+  );
+
+  test(
+    'receipt does not bypass conflict when selected key is no longer listed',
+    () async {
+      final resolver = await service();
+      await resolver.resolve(selectedPubkey: keys[1].public);
+      listedKeys = [keys[0].public];
+      expect((await resolver.resolve()).state, HostedIdentityState.mismatch);
+      expect((await store.read())!.pubkey, keys[1].public);
+      expect(recoveryCalls, 1);
+    },
+  );
+
+  test(
+    'unknown or removed selection asks again without selecting another key',
+    () async {
+      final resolver = await service();
+      expect(
+        (await resolver.resolve(selectedPubkey: keys[2].public)).state,
+        HostedIdentityState.needsSelection,
+      );
+      recovery['backups'] = [backup(0)];
+      listedKeys = [keys[0].public];
+      expect(
+        (await resolver.resolve(selectedPubkey: keys[1].public)).state,
+        HostedIdentityState.needsSelection,
+      );
+      expect(await store.read(), isNull);
+    },
+  );
+
+  test(
+    'duplicate backups of one key do not create an ambiguous choice',
+    () async {
+      recovery['backups'] = [backup(0), backup(0, id: 'duplicate')];
+      listedKeys = [keys[0].public];
+      final result = await (await service()).resolve();
+      expect(result.state, HostedIdentityState.needsBinding);
+      expect(result.pubkey, keys[0].public);
+    },
+  );
+
+  test('missing bound backup never accepts a different selected key', () async {
+    bound = keys[2].public;
+    expect(
+      (await (await service()).resolve(selectedPubkey: keys[0].public)).state,
+      HostedIdentityState.mismatch,
+    );
+    expect(await store.read(), isNull);
+  });
+
+  test('different device key still requires explicit cloud adoption', () async {
+    bound = keys[1].public;
+    final resolver = await service(includeDevice: true);
+    final pending = await resolver.resolve();
+    expect(pending.state, HostedIdentityState.needsSelection);
+    expect(pending.choices.single.pubkey, keys[1].public);
+    expect(
+      (await resolver.resolve(selectedPubkey: keys[2].public)).state,
+      HostedIdentityState.needsSelection,
+    );
+    expect(await store.read(), isNull);
+    expect(
+      (await resolver.resolve(selectedPubkey: keys[1].public)).state,
+      HostedIdentityState.ready,
+    );
+    await expectCommunityPreserved();
+  });
+
+  for (final scenario in [
+    'partial',
+    'omitted',
+    'unexpected',
+    'malformed',
+    'mismatched',
+    'refused',
+    'empty',
+  ]) {
+    test('recovery $scenario never writes or generates', () async {
+      bound = keys[0].public;
+      switch (scenario) {
+        case 'partial':
+          recovery['failed_backup_ids'] = ['unreadable'];
+        case 'omitted':
+          bound = null;
+          recovery['backups'] = [backup(0)];
+        case 'unexpected':
+          bound = null;
+          listedKeys = [keys[0].public];
+        case 'malformed':
+          (recovery['backups'] as List)[1]['secret_key'] = 'invalid';
+        case 'mismatched':
+          (recovery['backups'] as List)[1]['nostr_pubkey'] = keys[2].public;
+        case 'refused':
+          recoveryStatus = 403;
+        case 'empty':
+          bound = null;
+          recovery['backups'] = [];
+      }
+      final resolver = await service();
+      if (['partial', 'omitted', 'unexpected', 'empty'].contains(scenario)) {
+        expect(
+          (await resolver.resolve()).state,
+          scenario == 'empty'
+              ? HostedIdentityState.needsAuthoritativeAbsence
+              : HostedIdentityState.recoveryBlocked,
+        );
+      } else {
+        await expectLater(
+          resolver.resolve(),
+          throwsA(
+            scenario == 'refused'
+                ? isA<AccountFailure>()
+                : AccountFailure.invalidResponse,
+          ),
+        );
+      }
+      expect(await store.read(), isNull);
+      await expectCommunityPreserved();
+    });
+  }
+
+  test(
+    'occupied account slot is never replaced by a recovered choice',
+    () async {
+      final resolver = await service();
+      duringRecovery = () async {
+        await store.create(keys[2].nsec);
+      };
+      await expectLater(
+        resolver.resolve(selectedPubkey: keys[1].public),
+        throwsA(AccountIdentityFailure.occupied),
+      );
+      expect((await store.read())!.pubkey, keys[2].public);
+      await expectCommunityPreserved();
+    },
+  );
+
+  test('cancelled recovery cannot persist the selected identity', () async {
+    var current = true;
+    final resolver = await service();
+    duringRecovery = () async {
+      current = false;
+    };
+    await expectLater(
+      resolver.resolve(
+        selectedPubkey: keys[1].public,
+        isCurrent: () => current,
+      ),
+      throwsA(AccountFailure.unavailable),
+    );
+    expect(await store.read(), isNull);
+  });
+  test(
+    'saved identity skips recovery and conflicting binding never replaces it',
+    () async {
+      bound = keys[0].public;
+      listedKeys = [keys[0].public];
+      await store.create(keys[0].nsec);
+      final resolver = await service();
+      expect((await resolver.resolve()).state, HostedIdentityState.needsBackup);
+      bound = keys[1].public;
+      expect((await resolver.resolve()).state, HostedIdentityState.mismatch);
+      expect(recoveryCalls, 0);
+      expect((await store.read())!.pubkey, keys[0].public);
+    },
+  );
+
+  test(
+    'authoritative absence rechecks inventory before generating once',
+    () async {
+      listedKeys = [];
+      var reads = 0;
+      final blocked = await service(
+        inventory: () async => ++reads == 1
+            ? []
+            : [DeviceIdentityChoice(keys[2].public, 'Newly saved')],
+      );
+      expect(
+        (await blocked.resolve()).state,
+        HostedIdentityState.needsAuthoritativeAbsence,
+      );
+      expect(await store.read(), isNull);
+      final resolver = await service();
+      final first = await resolver.resolve();
+      expect(first.state, HostedIdentityState.needsBinding);
+      expect((await resolver.resolve()).pubkey, first.pubkey);
+      expect(recoveryCalls, 0);
+    },
+  );
+
+  for (final scenario in ['403', '404', '500', 'missing', 'cancelled']) {
+    test('unproven absence ($scenario) cannot generate', () async {
+      var current = true;
+      listedKeys = scenario == 'missing' ? null : [];
+      statusCode = int.tryParse(scenario) ?? 200;
+      final resolver = await service(
+        inventory: () async {
+          current = false;
+          return [];
+        },
+      );
+      await expectLater(
+        resolver.resolve(isCurrent: () => current),
+        throwsA(isA<AccountFailure>()),
+      );
+      expect(await store.read(), isNull);
+      expect(recoveryCalls, 0);
+      await expectCommunityPreserved();
+    });
+  }
+}
+
+// Substitute the external device inventory, not generation authorization.
+class _Inventory extends DeviceIdentitySource {
+  _Inventory(this.read);
+  final Future<List<DeviceIdentityChoice>> Function() read;
+  @override
+  Future<List<DeviceIdentityChoice>> choices() => read();
+}
diff --git a/mobile/test/shared/hosted/hosted_profile_offer_test.dart b/mobile/test/shared/hosted/hosted_profile_offer_test.dart
new file mode 100644
index 0000000000..2603735490
--- /dev/null
+++ b/mobile/test/shared/hosted/hosted_profile_offer_test.dart
@@ -0,0 +1,179 @@
+import 'dart:async';
+
+import 'package:buzz/features/profile/profile_provider.dart';
+import 'package:buzz/shared/hosted/hosted_flow_provider.dart';
+import 'package:buzz/shared/auth/auth.dart';
+import 'package:buzz/shared/deeplink/deep_link.dart';
+import 'package:buzz/shared/hosted/builderlab_account.dart';
+import 'package:buzz/shared/hosted/hosted_flow.dart';
+import 'package:buzz/shared/profile/user_profile.dart';
+import 'package:flutter_secure_storage/flutter_secure_storage.dart';
+import 'package:flutter_test/flutter_test.dart';
+import 'package:hooks_riverpod/hooks_riverpod.dart';
+
+import '../../helpers/hosted_communities_fixture.dart';
+
+final _offerProvider = Provider(
+  (ref) =>
+      (
+        HostedFlow flow,
+        BuzzDeepLink link,
+        String pubkey,
+        bool Function() current,
+      ) => offerHostedProfile(ref, flow, link, pubkey, current),
+);
+
+class _Profile extends ProfileNotifier {
+  _Profile(this.load, this.writes);
+  final Future<UserProfile?> Function() load;
+  final List<String> writes;
+  @override
+  Future<UserProfile?> build() => load();
+  @override
+  Future<void> updateDisplayName(String name) async => writes.add(name);
+}
+
+void main() {
+  TestWidgetsFlutterBinding.ensureInitialized();
+  late HostedCommunitiesFixture f;
+  late CommunityStorage storage;
+  late ProviderContainer container;
+  late Community community;
+  late Future<UserProfile?> Function() load;
+  late List<String> writes;
+  var current = true;
+  var reads = 0;
+  const link = AddCommunityDeepLink(
+    relayUrl: 'wss://joined.communities.buzz.xyz',
+    name: 'Joined',
+  );
+
+  setUp(() async {
+    FlutterSecureStorage.setMockInitialValues({});
+    f = HostedCommunitiesFixture();
+    await f.initialize();
+    storage = CommunityStorage();
+    community = Community.create(
+      name: 'Joined',
+      relayUrl: link.relayUrl,
+      pubkey: f.keys.public,
+      nsec: f.keys.nsec,
+    );
+    await storage.save(community);
+    await storage.saveActiveId(community.id);
+    writes = [];
+    reads = 0;
+    current = true;
+    load = () async => null;
+    container = ProviderContainer(
+      overrides: [
+        communityStorageProvider.overrideWithValue(storage),
+        profileProvider.overrideWith(
+          () => _Profile(() {
+            reads++;
+            return load();
+          }, writes),
+        ),
+      ],
+    );
+  });
+  tearDown(() async {
+    container.dispose();
+    await f.dispose();
+  });
+
+  Future<void> offer() => container.read(_offerProvider)(
+    f.flow,
+    link,
+    f.keys.public,
+    () => current,
+  );
+  Future<void> prompted() async {
+    for (var i = 0; i < 50 && f.flow.stage != HostedFlowStage.profile; i++) {
+      await Future<void>.delayed(Duration.zero);
+    }
+    expect(f.flow.stage, HostedFlowStage.profile);
+  }
+
+  test('account cancellation while loading prevents prompt', () async {
+    final loading = Completer<UserProfile?>();
+    load = () => loading.future;
+    final pending = offer();
+    while (reads == 0) {
+      await Future<void>.delayed(Duration.zero);
+    }
+    current = false;
+    loading.complete(null);
+    await pending;
+    expect(f.flow.stage, HostedFlowStage.idle);
+    expect(writes, isEmpty);
+  });
+
+  test('changed active community blocks a pending save', () async {
+    final pending = offer();
+    await prompted();
+    final other = Community.create(
+      name: 'Other',
+      relayUrl: 'wss://other.example',
+      pubkey: f.keys.public,
+      nsec: f.keys.nsec,
+    );
+    await storage.save(other);
+    await storage.saveActiveId(other.id);
+    container.invalidate(communityListProvider);
+    container.invalidate(activeCommunityProvider);
+    expect(
+      (await container.read(activeCommunityProvider.future))?.id,
+      other.id,
+    );
+    await expectLater(
+      f.flow.saveProfile!('Wrong scope'),
+      throwsA(AccountFailure.unavailable),
+    );
+    expect(writes, isEmpty);
+    f.flow.finishProfile();
+    await pending;
+  });
+
+  test(
+    'new target releases pending profile and rejects retained save',
+    () async {
+      final pending = f.flow.requestProfile((name) async => writes.add(name));
+      final save = f.flow.saveProfile!;
+      // Unsupported environment finishes locally without browser or network IO.
+      final next = f.flow.start(
+        const AddCommunityDeepLink(
+          relayUrl: 'wss://other.example',
+          name: 'Other',
+        ),
+      );
+      await pending.timeout(const Duration(seconds: 2));
+      await next;
+      await expectLater(
+        save('Stale prompt'),
+        throwsA(AccountFailure.unavailable),
+      );
+      expect(writes, isEmpty);
+      expect(f.flow.stage, isNot(HostedFlowStage.profile));
+    },
+  );
+
+  for (final cancelAdmission in [false, true]) {
+    test(
+      'leave rejects captured save (cancel admission: $cancelAdmission)',
+      () async {
+        final pending = offer();
+        await prompted();
+        final save = f.flow.saveProfile!;
+        if (cancelAdmission) current = false;
+        await f.flow.leave();
+        await pending;
+        await expectLater(
+          save('After leave'),
+          throwsA(AccountFailure.unavailable),
+        );
+        expect(writes, isEmpty);
+      },
+    );
+  }
+}
diff --git a/mobile/test/shared/hosted/hpke_backup_test.dart b/mobile/test/shared/hosted/hpke_backup_test.dart
new file mode 100644
index 0000000000..b45acb2534
--- /dev/null
+++ b/mobile/test/shared/hosted/hpke_backup_test.dart
@@ -0,0 +1,98 @@
+import 'dart:convert';
+import 'dart:io';
+
+import 'package:buzz/shared/hosted/hpke_backup.dart';
+import 'package:flutter/services.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+void main() {
+  TestWidgetsFlutterBinding.ensureInitialized();
+  final fixture =
+      jsonDecode(
+            File(
+              '../desktop/src-tauri/src/testdata/hpke_nsec_backup_v1.json',
+            ).readAsStringSync(),
+          )
+          as Map<String, dynamic>;
+  final enrollment = Map<String, dynamic>.from(fixture['envelope'] as Map)
+    ..remove('enc')
+    ..remove('ciphertext');
+  Uint8List hex(String value) => Uint8List.fromList(
+    List.generate(
+      value.length ~/ 2,
+      (i) => int.parse(value.substring(i * 2, i * 2 + 2), radix: 16),
+    ),
+  );
+  enrollment['recipient_public_key'] = base64UrlEncode(
+    hex(fixture['recipient_public_key_sec1_hex'] as String),
+  ).replaceAll('=', '');
+
+  test('v1 AAD exactly matches desktop/server interop fixture', () {
+    expect(
+      HpkeBackup.associatedData(enrollment),
+      hex(fixture['aad_hex'] as String),
+    );
+    for (final invalid in [
+      {...enrollment, 'version': 2},
+      {...enrollment, 'owner_id': 'owner\n'},
+      {
+        ...enrollment,
+        'backup_id': (enrollment['backup_id'] as String).toUpperCase(),
+      },
+    ]) {
+      expect(
+        () => HpkeBackup.associatedData(invalid),
+        throwsA(HpkeBackupFailure.invalidEnrollment),
+      );
+    }
+  });
+
+  test(
+    'seal binds derived identity and passes exact primitives to native',
+    () async {
+      var calls = 0;
+      const channel = MethodChannel('buzz/hosted_hpke');
+      TestDefaultBinaryMessengerBinding.instance.defaultBinaryMessenger
+          .setMockMethodCallHandler(channel, (call) async {
+            calls++;
+            expect(call.method, 'seal');
+            final args = call.arguments as Map;
+            expect(args['aad'], hex(fixture['aad_hex'] as String));
+            expect(
+              args['plaintext'],
+              hex(fixture['nostr_secret_key_hex'] as String),
+            );
+            expect(
+              args['recipient'],
+              hex(fixture['recipient_public_key_sec1_hex'] as String),
+            );
+            final envelope = fixture['envelope'] as Map;
+            return {
+              'enc': base64Url.decode(
+                base64Url.normalize(envelope['enc'] as String),
+              ),
+              'ciphertext': base64Url.decode(
+                base64Url.normalize(envelope['ciphertext'] as String),
+              ),
+            };
+          });
+      addTearDown(
+        () => TestDefaultBinaryMessengerBinding.instance.defaultBinaryMessenger
+            .setMockMethodCallHandler(channel, null),
+      );
+      final result = await HpkeBackup().seal(
+        enrollment: enrollment,
+        secretHex: fixture['nostr_secret_key_hex'] as String,
+      );
+      expect(result, fixture['envelope']);
+      await expectLater(
+        HpkeBackup().seal(
+          enrollment: {...enrollment, 'nostr_pubkey': '0' * 64},
+          secretHex: fixture['nostr_secret_key_hex'] as String,
+        ),
+        throwsA(HpkeBackupFailure.identityMismatch),
+      );
+      expect(calls, 1);
+    },
+  );
+}
diff --git a/mobile/test/shared/hosted/identity_choice_lifecycle_test.dart b/mobile/test/shared/hosted/identity_choice_lifecycle_test.dart
new file mode 100644
index 0000000000..7e4da370f8
--- /dev/null
+++ b/mobile/test/shared/hosted/identity_choice_lifecycle_test.dart
@@ -0,0 +1,107 @@
+import 'dart:async';
+import 'dart:convert';
+
+import 'package:buzz/shared/deeplink/deep_link.dart';
+import 'package:buzz/shared/hosted/account_identity_store.dart';
+import 'package:buzz/shared/hosted/browser_auth.dart';
+import 'package:buzz/shared/hosted/device_identity_source.dart';
+import 'package:buzz/shared/hosted/hosted_flow.dart';
+import 'package:buzz/shared/hosted/hosted_identity_service.dart';
+import 'package:flutter_secure_storage/flutter_secure_storage.dart';
+import 'package:flutter_test/flutter_test.dart';
+import 'package:nostr/nostr.dart' as nostr;
+
+import 'device_identity_reconciliation_test.dart' show InventoryAccount;
+
+class _Browser extends BrowserAuth {
+  Completer<void>? cancelling;
+  int cleared = 0;
+  @override
+  Future<void> cancel() async => cancelling?.future;
+  @override
+  Future<void> clearIntent() async {
+    cleared++;
+  }
+}
+
+void main() {
+  TestWidgetsFlutterBinding.ensureInitialized();
+  final first = nostr.Keys('1'.padLeft(64, '0'));
+  final second = nostr.Keys('2'.padLeft(64, '0'));
+  late InventoryAccount account;
+  late AccountIdentityStore store;
+  late _Browser browser;
+  late HostedFlow flow;
+  const target = AddCommunityDeepLink(
+    relayUrl: 'wss://team.communities.buzz.xyz',
+    name: 'Team',
+  );
+  setUp(() {
+    FlutterSecureStorage.setMockInitialValues({
+      'buzz_communities': jsonEncode([
+        {'name': 'First', 'pubkey': first.public, 'nsec': first.nsec},
+        {'name': 'Second', 'pubkey': second.public, 'nsec': second.nsec},
+      ]),
+    });
+    account = InventoryAccount();
+    store = AccountIdentityStore(subject: 'fixture');
+    browser = _Browser();
+    flow = HostedFlow(
+      account: account,
+      browser: browser,
+      store: store,
+      identity: HostedIdentityService(
+        account: account,
+        store: store,
+        deviceIdentities: DeviceIdentitySource(),
+      ),
+      enterCommunity: (_, _, _, _) async => fail('Must not bypass binding'),
+    );
+  });
+  tearDown(() async {
+    flow.dispose();
+    await browser.dispose();
+    account.dispose();
+  });
+
+  test(
+    'unoffered choices cannot restart resolution or perform any remote work',
+    () async {
+      await flow.start(target);
+      final calls = List.of(account.calls);
+      final choices = List.of(flow.identityChoices);
+      await flow.chooseIdentity('0' * 64);
+      expect(flow.stage, HostedFlowStage.chooseIdentity);
+      expect(account.calls, calls);
+      expect(flow.identityChoices, choices);
+      expect(await store.read(), isNull);
+    },
+  );
+
+  test(
+    'choices are retired on selection and on leaving; late tap cannot cancel leave',
+    () async {
+      await flow.start(target);
+      browser.cancelling = Completer<void>();
+      final calls = List.of(account.calls);
+      final leaving = flow.leave();
+      await flow.chooseIdentity(first.public);
+      expect(account.calls, calls);
+      expect(await store.read(), isNull);
+      browser.cancelling!.complete();
+      await leaving;
+      expect(browser.cleared, 1);
+      expect(flow.stage, HostedFlowStage.idle);
+      expect(flow.identityChoices, isEmpty);
+      await flow.start(target);
+      final choosing = flow.chooseIdentity(second.public);
+      expect(flow.identityChoices, isEmpty);
+      await choosing;
+      expect(flow.problem, HostedFlowProblem.denied);
+      final completedCalls = List.of(account.calls);
+      await flow.chooseIdentity(first.public);
+      expect(account.calls, completedCalls);
+      expect((await store.read())!.pubkey, second.public);
+    },
+  );
+}
diff --git a/mobile/test/shared/hosted/self_hosted_entry_test.dart b/mobile/test/shared/hosted/self_hosted_entry_test.dart
new file mode 100644
index 0000000000..6e4c9039bb
--- /dev/null
+++ b/mobile/test/shared/hosted/self_hosted_entry_test.dart
@@ -0,0 +1,327 @@
+import 'package:buzz/shared/hosted/hosted_environment.dart';
+import 'dart:convert';
+
+import 'package:buzz/shared/community/community.dart';
+import 'package:buzz/shared/hosted/account_identity_store.dart';
+import 'package:buzz/shared/hosted/device_identity_source.dart';
+import 'package:buzz/shared/hosted/self_hosted_entry.dart';
+import 'package:flutter_secure_storage/flutter_secure_storage.dart';
+import 'package:flutter_test/flutter_test.dart';
+import 'package:nostr/nostr.dart' as nostr;
+
+void main() {
+  TestWidgetsFlutterBinding.ensureInitialized();
+  const relay = 'wss://community.example';
+  // Public test vectors, never real user signing material.
+  final key = nostr.Keys('1'.padLeft(64, '0'));
+  final other = nostr.Keys('2'.padLeft(64, '0'));
+  late _Storage storage;
+  late List<Community> probes;
+  late SelfHostedEntry entry;
+  var current = true;
+  var refuseProbe = false;
+
+  SelfHostedEntry makeEntry() => SelfHostedEntry(
+    storage: storage,
+    identities: DeviceIdentitySource(storage: storage),
+    accountStore: AccountIdentityStore(storage: storage),
+    probe: (community) async {
+      // The durable key must already exist before any network operation.
+      expect(storage.data.values, contains(community.nsec));
+      probes.add(community);
+      if (refuseProbe) throw StateError('Connection refused');
+    },
+  );
+
+  setUp(() {
+    storage = _Storage();
+    probes = [];
+    current = true;
+    refuseProbe = false;
+    entry = makeEntry();
+  });
+
+  Future<Community> prepare({
+    String address = relay,
+    String? nsec,
+    String? savedPubkey,
+    bool create = false,
+  }) => entry.prepare(
+    relay: address,
+    name: 'Community',
+    nsec: nsec,
+    savedPubkey: savedPubkey,
+    create: create,
+    isCurrent: () => current,
+  );
+
+  void expectUntouched() {
+    expect(storage.writes, 0);
+    expect(probes, isEmpty);
+  }
+
+  test(
+    'reserved hosted domains refuse imported and generated identities',
+    () async {
+      for (final address in [
+        'wss://team.communities.buzz.xyz',
+        'wss://team.communities.public.builderlabstaging.xyz',
+        'wss://BUILDERLAB.XYZ.',
+      ]) {
+        if (!HostedEnvironment.requiresAuth(Uri.parse(address).host)) continue;
+        await expectLater(
+          prepare(address: address, nsec: key.nsec),
+          throwsStateError,
+        );
+        await expectLater(
+          prepare(address: address, create: true),
+          throwsStateError,
+        );
+      }
+      expectUntouched();
+      expect(storage.data, isEmpty);
+    },
+  );
+
+  test('invalid addresses and invalid nsec never persist or probe', () async {
+    for (final address in [
+      'ws://community.example',
+      'wss://user@community.example',
+      'wss://community.example/path',
+      'wss://community.example?token=value',
+      'wss://community.example#fragment',
+    ]) {
+      await expectLater(
+        prepare(address: address, nsec: key.nsec),
+        throwsFormatException,
+      );
+    }
+    for (final nsec in ['invalid', key.public, key.npub]) {
+      await expectLater(
+        prepare(nsec: nsec),
+        throwsA(AccountIdentityFailure.invalidKey),
+      );
+    }
+    expectUntouched();
+    expect(storage.data, isEmpty);
+  });
+
+  test(
+    'failed probe retains generated key across a new service and retry',
+    () async {
+      refuseProbe = true;
+      await expectLater(prepare(create: true), throwsStateError);
+      expect(storage.writes, 1);
+      final persisted = Map<String, String>.of(storage.data);
+      final first = probes.single;
+      expect(first.pubkey, AccountIdentityStore.publicKeyForNsec(first.nsec!));
+      refuseProbe = false;
+      entry = makeEntry();
+      final retried = await prepare(create: true);
+      expect(retried.pubkey, first.pubkey);
+      expect(retried.nsec, first.nsec);
+      expect(storage.data, persisted);
+      expect(storage.writes, 1);
+      expect(probes, hasLength(2));
+    },
+  );
+
+  for (final brokenEnumeration in [false, true]) {
+    for (final source in ['legacy', 'community', 'account']) {
+      test(
+        '$source identity with broken enumeration=$brokenEnumeration forbids generation; explicit reuse preserves saved keys',
+        () async {
+          if (source == 'account') {
+            await AccountIdentityStore(storage: storage).create(key.nsec);
+          } else if (source == 'legacy') {
+            storage.data['buzz_nsec'] = key.nsec;
+          } else {
+            storage.data['buzz_communities'] = jsonEncode([
+              {'name': 'Saved', 'nsec': key.nsec, 'pubkey': key.public},
+            ]);
+            storage.data['buzz_nsec'] = other.nsec;
+          }
+          storage.failEnumeration = brokenEnumeration;
+          final before = Map<String, String>.of(storage.data);
+          final writesBefore = storage.writes;
+          final inventory = await entry.choices();
+          expect(inventory.complete, !brokenEnumeration);
+          if (!brokenEnumeration || source != 'account') {
+            expect(
+              inventory.choices.map((choice) => choice.pubkey),
+              contains(key.public),
+            );
+          }
+          await expectLater(
+            prepare(create: true),
+            throwsA(
+              brokenEnumeration
+                  ? AccountIdentityFailure.unreadable
+                  : AccountIdentityFailure.absent,
+            ),
+          );
+          expect(storage.writes, writesBefore);
+          expect(probes, isEmpty);
+          expect(storage.data, before);
+          final community = await prepare(savedPubkey: key.public);
+          expect(community.nsec, key.nsec);
+          expect(community.pubkey, key.public);
+          expect(community.relayUrl, relay);
+          for (final saved in before.entries) {
+            expect(storage.data[saved.key], saved.value);
+          }
+          expect(probes, [community]);
+        },
+      );
+    }
+  }
+
+  test(
+    'account and community choices deduplicate the same saved identity',
+    () async {
+      await AccountIdentityStore(storage: storage).create(key.nsec);
+      storage.data['buzz_nsec'] = key.nsec;
+      expect((await entry.choices()).choices.map((choice) => choice.pubkey), [
+        key.public,
+      ]);
+    },
+  );
+
+  test('unreadable account key never permits new generation', () async {
+    storage.data[AccountIdentityStore.storageKey] = 'broken';
+    await expectLater(
+      prepare(create: true),
+      throwsA(AccountIdentityFailure.unreadable),
+    );
+    expectUntouched();
+  });
+
+  test(
+    'explicit replacement preserves refused key and retries the chosen key',
+    () async {
+      refuseProbe = true;
+      await expectLater(prepare(nsec: key.nsec), throwsStateError);
+      refuseProbe = false;
+      final joined = await prepare(nsec: other.nsec);
+      expect(joined.pubkey, other.public);
+      final retained = AccountIdentityStore(
+        storage: storage,
+      ).forPairing(key.public);
+      expect(await retained.withKeys((keys) async => keys.public), key.public);
+      expect((await prepare(create: true)).pubkey, other.public);
+      expect(probes, hasLength(3));
+    },
+  );
+
+  test(
+    'missing explicit saved identity never falls back to generation',
+    () async {
+      await expectLater(
+        prepare(savedPubkey: key.public, create: true),
+        throwsA(AccountIdentityFailure.absent),
+      );
+      expectUntouched();
+    },
+  );
+
+  for (final boundary in ['before', 'read', 'write']) {
+    test(
+      'cancellation at $boundary fences probe and preserves any durable key',
+      () async {
+        if (boundary == 'before') current = false;
+        if (boundary == 'read') storage.onRead = () => current = false;
+        if (boundary == 'write') storage.onWrite = () => current = false;
+        await expectLater(prepare(nsec: key.nsec), throwsStateError);
+        expect(probes, isEmpty);
+        expect(storage.writes, boundary == 'write' ? 1 : 0);
+        if (boundary == 'before') expect(storage.reads, 0);
+        if (boundary == 'write') {
+          expect(storage.data.values, contains(key.nsec));
+          current = true;
+          storage.onWrite = null;
+          expect((await prepare()).pubkey, key.public);
+          expect(storage.writes, 1);
+        } else {
+          expect(storage.data, isEmpty);
+        }
+      },
+    );
+  }
+
+  test('unconfirmed durable write cannot reach the relay probe', () async {
+    storage.dropWrites = true;
+    await expectLater(
+      prepare(nsec: key.nsec),
+      throwsA(AccountIdentityFailure.unreadable),
+    );
+    expect(probes, isEmpty);
+    expect(storage.data, isEmpty);
+  });
+}
+
+class _Storage extends Fake implements FlutterSecureStorage {
+  final data = <String, String>{};
+  int writes = 0;
+  int reads = 0;
+  bool dropWrites = false;
+  bool failEnumeration = false;
+  void Function()? onRead;
+  void Function()? onWrite;
+
+  @override
+  Future<Map<String, String>> readAll({
+    AppleOptions? iOptions,
+    AndroidOptions? aOptions,
+    LinuxOptions? lOptions,
+    WebOptions? webOptions,
+    AppleOptions? mOptions,
+    WindowsOptions? wOptions,
+  }) async {
+    if (failEnumeration) throw StateError('unrelated entry cannot decrypt');
+    return Map.of(data);
+  }
+
+  @override
+  Future<void> delete({
+    required String key,
+    AppleOptions? iOptions,
+    AndroidOptions? aOptions,
+    LinuxOptions? lOptions,
+    WebOptions? webOptions,
+    AppleOptions? mOptions,
+    WindowsOptions? wOptions,
+  }) async {
+    data.remove(key);
+  }
+
+  @override
+  Future<String?> read({
+    required String key,
+    AppleOptions? iOptions,
+    AndroidOptions? aOptions,
+    LinuxOptions? lOptions,
+    WebOptions? webOptions,
+    AppleOptions? mOptions,
+    WindowsOptions? wOptions,
+  }) async {
+    reads++;
+    onRead?.call();
+    return data[key];
+  }
+
+  @override
+  Future<void> write({
+    required String key,
+    required String? value,
+    AppleOptions? iOptions,
+    AndroidOptions? aOptions,
+    LinuxOptions? lOptions,
+    WebOptions? webOptions,
+    AppleOptions? mOptions,
+    WindowsOptions? wOptions,
+  }) async {
+    writes++;
+    if (!dropWrites && value != null) data[key] = value;
+    onWrite?.call();
+  }
+}
diff --git a/mobile/test/shared/hosted/web_connect_binding_test.dart b/mobile/test/shared/hosted/web_connect_binding_test.dart
new file mode 100644
index 0000000000..8235496f5f
--- /dev/null
+++ b/mobile/test/shared/hosted/web_connect_binding_test.dart
@@ -0,0 +1,205 @@
+import 'dart:convert';
+import 'package:flutter_secure_storage/flutter_secure_storage.dart';
+import 'package:buzz/shared/hosted/account_identity_store.dart';
+import 'package:flutter_test/flutter_test.dart';
+import 'package:nostr/nostr.dart' as nostr;
+import 'package:buzz/shared/deeplink/deep_link.dart';
+import 'package:buzz/shared/hosted/web_connect_binding.dart';
+import 'package:buzz/shared/hosted/hosted_environment.dart';
+
+void main() {
+  final fields = {
+    'challenge_id': '12345678-1234-1234-1234-123456789012',
+    'nonce': 'a' * 43,
+    'verification_code': '123456',
+    'audience': 'buzz:nostr-identity',
+    'action': 'bind_nostr_identity',
+    'protocol': 'buzz-nostr-identity',
+    'version': '1',
+    'origin': HostedEnvironment.origin.toString(),
+    'expires_at': '2099-01-01T00:00:00Z',
+    'return': 'browser_fragment_v1',
+    'callback_url': HostedEnvironment.origin.resolve('/buzz').toString(),
+  };
+  Uri link(Map<String, String> values) =>
+      Uri(scheme: 'buzz', host: 'nostr-bind', queryParameters: values);
+  final keys = nostr.Keys('1'.padLeft(64, '0'));
+  Future<T> withKeys<T>(Future<T> Function(nostr.Keys) operation) =>
+      operation(keys);
+
+  test('production parser recognizes web links and rejects ambiguous trust', () {
+    expect(parseBuzzDeepLink(link(fields)), isA<NostrBindDeepLink>());
+    final otherOrigin = HostedEnvironment.origin.host == 'app.builderlab.xyz'
+        ? 'https://app.builderlabstaging.xyz'
+        : 'https://app.builderlab.xyz';
+    expect(
+      parseBuzzDeepLink(
+        link({
+          ...fields,
+          'origin': otherOrigin,
+          'callback_url': '$otherOrigin/buzz',
+        }),
+      ),
+      isNull,
+    );
+    for (final entry in {
+      'origin': 'https://attacker.example',
+      'callback_url': 'https://app.builderlab.xyz/buzz?redirect=evil',
+      'nonce': 'short',
+      'verification_code': '12345',
+      'version': '2',
+      'expires_at': '2099-01-01T00:00:00',
+    }.entries) {
+      expect(
+        parseBuzzDeepLink(link({...fields, entry.key: entry.value})),
+        isNull,
+      );
+    }
+    expect(
+      parseBuzzDeepLink(Uri.parse('${link(fields)}&nonce=duplicate')),
+      isNull,
+    );
+    expect(parseBuzzDeepLink(link({...fields, 'extra': 'value'})), isNull);
+    expect(
+      parseBuzzDeepLink(
+        Uri.parse(
+          'buzz://add-community?relay=wss%3A%2F%2Fexample.communities.buzz.xyz&name=Example',
+        ),
+      ),
+      isA<AddCommunityDeepLink>(),
+    );
+    expect(
+      parseBuzzDeepLink(
+        Uri.parse(
+          'buzz://add-community?relay=wss%3A%2F%2Fexample.com%2Fpath&name=Example',
+        ),
+      ),
+      isNull,
+    );
+    expect(
+      parseBuzzDeepLink(
+        Uri.parse(
+          'buzz://add-community?relay=wss%3A%2F%2Fexample.com&name=Example&name=Other',
+        ),
+      ),
+      isNull,
+    );
+  });
+
+  test(
+    'signs desktop-compatible event and verifies account before browser return',
+    () async {
+      var verified = false;
+      final result = await WebConnectBindingService().complete(
+        request: parseNostrBindDeepLink(link(fields))!,
+        subject: 'account',
+        expectedPubkey: keys.public,
+        withKeys: withKeys,
+        verify:
+            ({
+              required subject,
+              required challengeId,
+              required nonce,
+              required signedPayload,
+            }) async {
+              expect(subject, 'account');
+              expect(challengeId, fields['challenge_id']);
+              final event = jsonDecode(signedPayload) as Map;
+              expect(event['kind'], 24243);
+              expect(event['content'], '');
+              expect(event['pubkey'], keys.public);
+              expect(
+                event['tags'],
+                contains(equals(['verification_code', '123456'])),
+              );
+              verified = true;
+              return keys.public;
+            },
+      );
+      expect(verified, isTrue);
+      expect(result, HostedEnvironment.origin.resolve('/buzz'));
+      expect(result.hasFragment, isFalse);
+    },
+  );
+
+  test(
+    'unverified or mismatched identity cannot produce browser return',
+    () async {
+      for (final mismatch in [false, true]) {
+        await expectLater(
+          WebConnectBindingService().complete(
+            request: parseNostrBindDeepLink(link(fields))!,
+            subject: 'account',
+            expectedPubkey: keys.public,
+            withKeys: withKeys,
+            verify:
+                ({
+                  required subject,
+                  required challengeId,
+                  required nonce,
+                  required signedPayload,
+                }) async {
+                  if (!mismatch) {
+                    throw StateError('account does not own challenge');
+                  }
+                  return '0' * 64;
+                },
+          ),
+          throwsA(anything),
+        );
+      }
+    },
+  );
+
+  test('verification runs outside the identity store signing lock', () async {
+    TestWidgetsFlutterBinding.ensureInitialized();
+    FlutterSecureStorage.setMockInitialValues({});
+    final store = AccountIdentityStore();
+    await store.create(keys.nsec);
+    await WebConnectBindingService()
+        .complete(
+          request: parseNostrBindDeepLink(link(fields))!,
+          subject: 'account',
+          expectedPubkey: keys.public,
+          withKeys: store.withKeys,
+          verify:
+              ({
+                required subject,
+                required challengeId,
+                required nonce,
+                required signedPayload,
+              }) async {
+                return (await store.read())!.pubkey;
+              },
+        )
+        .timeout(const Duration(seconds: 2));
+  });
+
+  test('expiry and local mismatch stop before verification', () async {
+    var calls = 0;
+    for (final expired in [false, true]) {
+      await expectLater(
+        WebConnectBindingService(
+          now: () => expired ? DateTime.utc(2100) : DateTime.utc(2026),
+        ).complete(
+          request: parseNostrBindDeepLink(link(fields))!,
+          subject: 'account',
+          expectedPubkey: expired ? keys.public : '0' * 64,
+          withKeys: withKeys,
+          verify:
+              ({
+                required subject,
+                required challengeId,
+                required nonce,
+                required signedPayload,
+              }) async {
+                calls++;
+                return keys.public;
+              },
+        ),
+        throwsFormatException,
+      );
+    }
+    expect(calls, 0);
+  });
+}
diff --git a/mobile/test/shared/huddle/huddle_transport_test.dart b/mobile/test/shared/huddle/huddle_transport_test.dart
index 808a5eeebb..b98941d7a5 100644
--- a/mobile/test/shared/huddle/huddle_transport_test.dart
+++ b/mobile/test/shared/huddle/huddle_transport_test.dart
@@ -45,6 +45,23 @@ void main() {
     expect(transport.state.phase, HuddleTransportPhase.connected);
     expect(transport.state.localPeerIndex, 3);
     expect(transport.state.peers.keys, containsAll([1, 3]));
+
+    final stalled = Completer<Map<String, String>>();
+    var opened = false;
+    final waiting = HuddleTransport(
+      parameters: transport.parameters,
+      headers: () => stalled.future,
+      channelFactory: (_) {
+        opened = true;
+        return _ControlledWebSocketChannel();
+      },
+      connectTimeout: const Duration(milliseconds: 20),
+    );
+    addTearDown(waiting.dispose);
+    await expectLater(waiting.connect(), throwsA(isA<HuddleTransportError>()));
+    stalled.complete({});
+    await Future<void>.delayed(Duration.zero);
+    expect(opened, isFalse);
   });
 
   test(
diff --git a/mobile/test/shared/identity_transfer/nsec_import_sheet_test.dart b/mobile/test/shared/identity_transfer/nsec_import_sheet_test.dart
new file mode 100644
index 0000000000..5e87ef648a
--- /dev/null
+++ b/mobile/test/shared/identity_transfer/nsec_import_sheet_test.dart
@@ -0,0 +1,72 @@
+import 'package:buzz/shared/hosted/account_identity_store.dart';
+import 'package:buzz/shared/identity_transfer/nsec_import_sheet.dart';
+import 'package:buzz/shared/utils/string_utils.dart';
+import 'package:flutter/material.dart';
+import 'package:flutter_test/flutter_test.dart';
+import 'package:nostr/nostr.dart' as nostr;
+
+void main() {
+  final keys = nostr.Keys('1'.padLeft(64, '0'));
+
+  testWidgets(
+    'paste requires public preview then confirmation before secure save',
+    (tester) async {
+      String? imported;
+      await tester.pumpWidget(
+        MaterialApp(
+          home: Scaffold(
+            body: NsecImportSheet(
+              onImport: (nsec) async {
+                imported = nsec;
+              },
+            ),
+          ),
+        ),
+      );
+      await tester.enterText(find.byType(TextField), keys.nsec);
+      await tester.tap(find.text('Preview identity'));
+      await tester.pumpAndSettle();
+      expect(find.text(fullNpub(keys.public)!), findsOneWidget);
+      expect(imported, isNull);
+      await tester.tap(find.text('Import this identity'));
+      await tester.pumpAndSettle();
+      expect(imported, keys.nsec);
+      await tester.pump();
+    },
+  );
+
+  testWidgets('file import previews and occupied identity stays unchanged', (
+    tester,
+  ) async {
+    var attempts = 0;
+    await tester.pumpWidget(
+      MaterialApp(
+        home: Scaffold(
+          body: NsecImportSheet(
+            pickFile: () async => keys.nsec,
+            onImport: (nsec) async {
+              attempts++;
+              throw AccountIdentityFailure.occupied;
+            },
+          ),
+        ),
+      ),
+    );
+    await tester.tap(find.text('Choose nsec file'));
+    await tester.pumpAndSettle();
+    expect(find.text(fullNpub(keys.public)!), findsOneWidget);
+    await tester.tap(find.text('Import this identity'));
+    await tester.pumpAndSettle();
+    expect(
+      find.textContaining('already has a different identity'),
+      findsOneWidget,
+    );
+    expect(attempts, 1);
+    await tester.enterText(find.byType(TextField), 'not a key');
+    await tester.pump();
+    expect(find.text('Import this identity'), findsNothing);
+    await tester.tap(find.text('Preview identity'));
+    await tester.pump();
+    expect(find.text('Enter a valid nsec private key.'), findsOneWidget);
+  });
+}
diff --git a/mobile/test/shared/identity_transfer/nsec_transfer_test.dart b/mobile/test/shared/identity_transfer/nsec_transfer_test.dart
new file mode 100644
index 0000000000..3c1e114586
--- /dev/null
+++ b/mobile/test/shared/identity_transfer/nsec_transfer_test.dart
@@ -0,0 +1,163 @@
+import 'dart:io';
+
+import 'package:buzz/shared/community/community.dart';
+import 'package:buzz/shared/hosted/account_identity_store.dart';
+import 'package:buzz/shared/identity_transfer/nsec_transfer.dart';
+import 'package:buzz/shared/security/sensitive_action_authorizer.dart';
+import 'package:flutter_test/flutter_test.dart';
+import 'package:flutter/foundation.dart';
+import 'package:flutter/services.dart';
+import 'package:nostr/nostr.dart' as nostr;
+
+void main() {
+  TestWidgetsFlutterBinding.ensureInitialized();
+  final keys = nostr.Keys('1'.padLeft(64, '0'));
+  final other = nostr.Keys('2'.padLeft(64, '0'));
+
+  for (final platform in [TargetPlatform.android, TargetPlatform.iOS]) {
+    test(
+      'native $platform import validates text and preserves cancellation/error',
+      () async {
+        debugDefaultTargetPlatformOverride = platform;
+        const channel = MethodChannel('buzz/identity_file');
+        final messenger =
+            TestDefaultBinaryMessengerBinding.instance.defaultBinaryMessenger;
+        addTearDown(() {
+          debugDefaultTargetPlatformOverride = null;
+          messenger.setMockMethodCallHandler(channel, null);
+        });
+        String? response = '${keys.nsec}\n';
+        var failRead = false;
+        messenger.setMockMethodCallHandler(channel, (call) async {
+          expect(call.method, 'import');
+          expect(call.arguments, isNull);
+          if (failRead) throw PlatformException(code: 'import_failed');
+          return response;
+        });
+        expect(await NsecTransfer.pickFile(), keys.nsec);
+        response = null;
+        expect(await NsecTransfer.pickFile(), isNull);
+        response = keys.public;
+        await expectLater(
+          NsecTransfer.pickFile(),
+          throwsA(AccountIdentityFailure.invalidKey),
+        );
+        response = 'x' * 1025;
+        await expectLater(
+          NsecTransfer.pickFile(),
+          throwsA(AccountIdentityFailure.invalidKey),
+        );
+        failRead = true;
+        await expectLater(
+          NsecTransfer.pickFile(),
+          throwsA(isA<PlatformException>()),
+        );
+      },
+    );
+  }
+
+  test('paste parsing rejects wrong key type, invalid scalar and checksum', () {
+    expect(NsecTransfer.preview('  ${keys.nsec}\n'), keys.public);
+    for (final value in [
+      keys.public,
+      'nsec1bad',
+      nostr.Nip19.encode(prefix: nostr.Nip19Prefix.nsec, data: '0' * 64),
+    ]) {
+      expect(
+        () => NsecTransfer.preview(value),
+        throwsA(AccountIdentityFailure.invalidKey),
+      );
+    }
+  });
+
+  test(
+    'export respects biometric policy, auth denial and selected identity',
+    () async {
+      final community = Community.create(
+        name: 'Test',
+        relayUrl: 'wss://test.invalid',
+        nsec: keys.nsec,
+        pubkey: keys.public,
+        sensitiveActionPolicy: SensitiveActionPolicy.enabled,
+      );
+      var shares = 0;
+      var current = true;
+      var result = DeviceAuthResult.cancelled;
+      Future<bool> export() => NsecTransfer.exportCommunity(
+        community: community,
+        authorize: (biometricOnly) async {
+          expect(biometricOnly, isTrue);
+          return result;
+        },
+        isCurrent: () => current,
+        share: (nsec) async {
+          expect(nsec, keys.nsec);
+          shares++;
+          return true;
+        },
+      );
+      expect(await export(), isFalse);
+      result = DeviceAuthResult.success;
+      current = false;
+      expect(await export(), isFalse);
+      expect(shares, 0);
+      current = true;
+      expect(await export(), isTrue);
+      expect(shares, 1);
+      await expectLater(
+        NsecTransfer.exportCommunity(
+          community: community.copyWith(nsec: other.nsec),
+          authorize: (_) async =>
+              fail('must not authorize a mismatched identity'),
+          isCurrent: () => true,
+          share: (_) async => fail('must not share a mismatched identity'),
+        ),
+        throwsA(AccountIdentityFailure.mismatch),
+      );
+
+      // Continue through the real share coordinator; only native boundaries
+      // are synthetic here. Native tests assert the file's protection class.
+      debugDefaultTargetPlatformOverride = TargetPlatform.iOS;
+      const channel = MethodChannel('buzz/identity_file');
+      const shareChannel = MethodChannel('dev.fluttercommunity.plus/share');
+      final messenger =
+          TestDefaultBinaryMessengerBinding.instance.defaultBinaryMessenger;
+      final root = await Directory.systemTemp.createTemp('nsec-export-test-');
+      addTearDown(() async {
+        debugDefaultTargetPlatformOverride = null;
+        messenger.setMockMethodCallHandler(channel, null);
+        messenger.setMockMethodCallHandler(shareChannel, null);
+        await root.delete(recursive: true);
+      });
+      File? prepared;
+      var failPrepare = false;
+      var failShare = false;
+      messenger.setMockMethodCallHandler(channel, (call) async {
+        expect(call.method, 'prepareExport');
+        expect(call.arguments, {'text': '${keys.nsec}\n'});
+        if (failPrepare) throw PlatformException(code: 'export_failed');
+        final directory = await root.createTemp('buzz-identity-');
+        prepared = File('${directory.path}/buzz-identity.nsec');
+        await prepared!.writeAsString('${keys.nsec}\n');
+        return prepared!.path;
+      });
+      messenger.setMockMethodCallHandler(shareChannel, (call) async {
+        expect(call.method, 'share');
+        expect(call.arguments['paths'], [prepared!.path]);
+        expect(await prepared!.readAsString(), '${keys.nsec}\n');
+        if (failShare) throw PlatformException(code: 'share_failed');
+        return 'com.apple.UIKit.activity.SaveToFiles';
+      });
+      Future<bool> shareFile() =>
+          NsecTransfer.shareFile(keys.nsec, const Rect.fromLTWH(0, 0, 10, 10));
+      expect(await shareFile(), isTrue);
+      expect(await prepared!.parent.exists(), isFalse);
+      failShare = true;
+      await expectLater(shareFile(), throwsA(isA<PlatformException>()));
+      expect(await prepared!.parent.exists(), isFalse);
+      failPrepare = true;
+      prepared = null; // Any accidental share after prepare fails is an error.
+      await expectLater(shareFile(), throwsA(isA<PlatformException>()));
+    },
+  );
+}
diff --git a/mobile/test/shared/push/push_bootstrap_test.dart b/mobile/test/shared/push/push_bootstrap_test.dart
index 6770ad546e..2fd37bfbbe 100644
--- a/mobile/test/shared/push/push_bootstrap_test.dart
+++ b/mobile/test/shared/push/push_bootstrap_test.dart
@@ -26,6 +26,33 @@ void main() {
     expect(registrations, 1);
   });
 
+  testWidgets('new community starts registration once capability arrives', (
+    tester,
+  ) async {
+    final community = Community.create(
+      name: 'Team',
+      relayUrl: 'wss://relay.example',
+    );
+    var registrations = 0;
+    Widget bootstrap(BuzzPushLeaseDescriptor? descriptor) =>
+        BuzzPushRegistrationBootstrap(
+          shouldRegister: buzzPushLifecycleEnabled(
+            community: community,
+            descriptor: descriptor,
+          ),
+          attemptKey: '${community.id}|${community.relayUrl}',
+          startRegistration: () async => registrations += 1,
+          child: const SizedBox(),
+        );
+    await tester.pumpWidget(bootstrap(null));
+    expect(registrations, 0);
+    final descriptor = _descriptor(keyId: 'relay-v1', pubkey: _hex('b'));
+    await tester.pumpWidget(bootstrap(descriptor));
+    expect(registrations, 1);
+    await tester.pumpWidget(bootstrap(descriptor));
+    expect(registrations, 1);
+  });
+
   test(
     'superseded lease acceptance is a retryable publication failure',
     () async {
@@ -141,12 +168,12 @@ void main() {
     );
   });
 
-  test('relay capability alone does not activate push without opt-in', () {
-    final disabled = Community.create(
+  test('default push requires relay capability and respects opt-out', () {
+    final enabled = Community.create(
       name: 'Team',
       relayUrl: 'wss://relay.example',
     );
-    final enabled = disabled.copyWith(pushNotificationsEnabled: true);
+    final disabled = enabled.copyWith(pushNotificationsEnabled: false);
 
     expect(
       buzzPushLifecycleEnabled(
diff --git a/mobile/test/shared/push/push_unconfigured_build_test.dart b/mobile/test/shared/push/push_unconfigured_build_test.dart
index c5cf8161ad..3c54d3fcb4 100644
--- a/mobile/test/shared/push/push_unconfigured_build_test.dart
+++ b/mobile/test/shared/push/push_unconfigured_build_test.dart
@@ -73,43 +73,56 @@ void main() {
       expect(calls, isEmpty);
     });
 
-    testWidgets('Settings hides notifications without push capability', (
-      tester,
-    ) async {
-      debugDefaultTargetPlatformOverride = TargetPlatform.iOS;
-      addTearDown(() => debugDefaultTargetPlatformOverride = null);
-      SharedPreferences.setMockInitialValues({});
-      final prefs = await SharedPreferences.getInstance();
-      await tester.pumpWidget(
-        ProviderScope(
-          overrides: [
-            savedPrefsProvider.overrideWithValue(prefs),
-            activeCommunityProvider.overrideWith(
-              (ref) async => Community.create(
-                name: 'Team',
-                relayUrl: 'wss://relay.example',
+    for (final enabled in [true, false]) {
+      testWidgets(
+        'Settings preserves preference $enabled without push capability',
+        (tester) async {
+          debugDefaultTargetPlatformOverride = TargetPlatform.iOS;
+          addTearDown(() => debugDefaultTargetPlatformOverride = null);
+          SharedPreferences.setMockInitialValues({});
+          final prefs = await SharedPreferences.getInstance();
+          await tester.pumpWidget(
+            ProviderScope(
+              overrides: [
+                savedPrefsProvider.overrideWithValue(prefs),
+                activeCommunityProvider.overrideWith(
+                  (ref) async => Community.create(
+                    name: 'Team',
+                    relayUrl: 'wss://relay.example',
+                  ).copyWith(pushNotificationsEnabled: enabled),
+                ),
+                buzzPushAuthorizationStatusReaderProvider.overrideWithValue(
+                  () async => throw StateError(
+                    'must not query notification permission',
+                  ),
+                ),
+              ],
+              child: MaterialApp(
+                theme: AppTheme.light(),
+                home: SettingsPage(
+                  profileHeader: const SizedBox.shrink(),
+                  identityRecoveryPageBuilder: (_) => const SizedBox.shrink(),
+                ),
               ),
             ),
-            buzzPushAuthorizationStatusReaderProvider.overrideWithValue(
-              () async =>
-                  throw StateError('must not query notification permission'),
-            ),
-          ],
-          child: MaterialApp(
-            theme: AppTheme.light(),
-            home: SettingsPage(
-              profileHeader: const SizedBox.shrink(),
-              identityRecoveryPageBuilder: (_) => const SizedBox.shrink(),
-            ),
-          ),
-        ),
+          );
+          await tester.pumpAndSettle();
+          expect(
+            find.text('Notifications'),
+            enabled ? findsOneWidget : findsNothing,
+          );
+          expect(find.text('Push notifications'), findsNothing);
+          if (enabled) {
+            final toggle = tester.widget<Switch>(find.byType(Switch));
+            expect(toggle.value, isTrue);
+            expect(toggle.onChanged, isNotNull);
+          } else {
+            expect(find.byType(Switch), findsNothing);
+          }
+          expect(tester.takeException(), isNull);
+          debugDefaultTargetPlatformOverride = null;
+        },
       );
-      await tester.pumpAndSettle();
-      expect(find.text('Notifications'), findsNothing);
-      expect(find.text('Push notifications'), findsNothing);
-      expect(find.byType(Switch), findsNothing);
-      expect(tester.takeException(), isNull);
-      debugDefaultTargetPlatformOverride = null;
-    });
+    }
   }, skip: Env.pushGatewayConfigured);
 }
diff --git a/mobile/test/shared/relay/relay_socket_liveness_test.dart b/mobile/test/shared/relay/relay_socket_liveness_test.dart
index 835ebc2b61..e3802f39b7 100644
--- a/mobile/test/shared/relay/relay_socket_liveness_test.dart
+++ b/mobile/test/shared/relay/relay_socket_liveness_test.dart
@@ -84,28 +84,94 @@ void main() {
     await server.close();
   });
 
-  test('keeps an idle but healthy peer connected', () async {
-    final server = await HttpServer.bind(InternetAddress.loopbackIPv4, 0);
-    server.transform(WebSocketTransformer()).listen((ws) {
-      // A healthy relay answers pings without sending application data.
-      ws.listen((_) {}, onError: (_) {}, onDone: () {});
-    });
+  test(
+    'scoped headers stay at the upgrade origin and healthy peers stay connected',
+    () async {
+      final server = await HttpServer.bind(InternetAddress.loopbackIPv4, 0);
+      final paths = <String>[];
+      // A different port prevents a closed upgrade connection from masking a
+      // redirect attempt through connection-pool reuse.
+      final sink = await HttpServer.bind(InternetAddress.loopbackIPv4, 0);
+      sink.listen((request) async {
+        paths.add('sink');
+        expect(
+          request.headers.value('Nostr-Federated-Identity'),
+          'Bearer synthetic',
+        );
+        request.response.statusCode = 403;
+        await request.response.close();
+      });
+      server.listen((request) async {
+        paths.add(request.uri.path);
+        expect(
+          request.headers.value('Nostr-Federated-Identity'),
+          'Bearer synthetic',
+        );
+        if (request.uri.path == '/denied') {
+          request.response.statusCode = 403;
+          await request.response.close();
+          return;
+        }
+        if (request.uri.path == '/redirect') {
+          request.response.statusCode = 302;
+          request.response.headers.set(
+            'Location',
+            'http://127.0.0.1:${sink.port}/sink',
+          );
+          await request.response.close();
+          return;
+        }
+        final ws = await WebSocketTransformer.upgrade(request);
+        ws.listen((_) {}, onError: (_) {}, onDone: () {});
+      });
 
-    var tornDown = false;
-    final socket = RelaySocket(
-      wsUrl: 'ws://127.0.0.1:${server.port}',
-      nsec: null,
-      onMessage: (_) {},
-      onConnected: () {},
-      onDisconnected: (_) => tornDown = true,
-    );
-    unawaited(socket.connect());
+      var tornDown = false;
+      final socket = RelaySocket(
+        wsUrl: 'ws://127.0.0.1:${server.port}',
+        nsec: null,
+        onMessage: (_) {},
+        onConnected: () {},
+        onDisconnected: (_) => tornDown = true,
+      );
+      socket.headers = {'Nostr-Federated-Identity': 'Bearer synthetic'};
+      unawaited(socket.connect());
 
-    await Future<void>.delayed(testPingInterval * 4);
+      await Future<void>.delayed(testPingInterval * 4);
 
-    expect(tornDown, isFalse);
+      expect(tornDown, isFalse);
 
-    await socket.disconnect();
-    await server.close(force: true);
-  });
+      await socket.disconnect();
+      final refused = Completer<void>();
+      final redirect = RelaySocket(
+        wsUrl: 'ws://127.0.0.1:${server.port}/redirect',
+        nsec: null,
+        onMessage: (_) {},
+        onConnected: () {},
+        onDisconnected: (_) {
+          if (!refused.isCompleted) refused.complete();
+        },
+      );
+      redirect.headers = {'Nostr-Federated-Identity': 'Bearer synthetic'};
+      await redirect.connect();
+      await refused.future;
+      expect(paths, ['/', '/redirect']);
+      redirect.dispose();
+      final denial = Completer<Object?>();
+      final denied = RelaySocket(
+        wsUrl: 'ws://127.0.0.1:${server.port}/denied',
+        nsec: null,
+        onMessage: (_) {},
+        onConnected: () {},
+        onDisconnected: (error) {
+          if (!denial.isCompleted) denial.complete(error);
+        },
+      );
+      denied.headers = {'Nostr-Federated-Identity': 'Bearer synthetic'};
+      await denied.connect();
+      expect(relayUpgradeRefused(await denial.future), isTrue);
+      denied.dispose();
+      await server.close(force: true);
+      await sink.close(force: true);
+    },
+  );
 }
diff --git a/mobile/test/shared/security/sensitive_action_authorizer_test.dart b/mobile/test/shared/security/sensitive_action_authorizer_test.dart
index 940b9f12ea..a4a2f3290b 100644
--- a/mobile/test/shared/security/sensitive_action_authorizer_test.dart
+++ b/mobile/test/shared/security/sensitive_action_authorizer_test.dart
@@ -35,7 +35,7 @@ void main() {
     expect(result, DeviceAuthResult.success);
     verify(
       () => authentication.authenticate(
-        localizedReason: 'Confirm sending your Buzz identity to desktop',
+        localizedReason: 'Confirm exporting your Buzz identity',
         authMessages: any(named: 'authMessages'),
         biometricOnly: false,
         sensitiveTransaction: true,
diff --git a/mobile/test/shared/theme/tabler_icon_render_test.dart b/mobile/test/shared/theme/tabler_icon_render_test.dart
index ffb50cc3ef..8765269e9b 100644
--- a/mobile/test/shared/theme/tabler_icon_render_test.dart
+++ b/mobile/test/shared/theme/tabler_icon_render_test.dart
@@ -45,6 +45,10 @@ void main() {
                   child: Column(
                     mainAxisSize: MainAxisSize.min,
                     children: [
+                      const ListTile(
+                        leading: Icon(BuzzIcons.filter2),
+                        title: Text('Filter inbox'),
+                      ),
                       const ListTile(
                         leading: Icon(BuzzIcons.archive),
                         title: Text('Archive'),
diff --git a/mobile/test/shared/widgets/ios_media_carousel_test.dart b/mobile/test/shared/widgets/ios_media_carousel_test.dart
index 6e5a2fdabb..9990c0c3b9 100644
--- a/mobile/test/shared/widgets/ios_media_carousel_test.dart
+++ b/mobile/test/shared/widgets/ios_media_carousel_test.dart
@@ -80,74 +80,70 @@ void main() {
     );
   }
 
-  testWidgets(
-    'native callbacks and disposal release subscribed images',
-    (tester) async {
-      final provider = _TestImage();
-      final harness = await _mount(tester, [provider]);
-      await harness.send('open', 0);
-      await harness.send('open', 2);
-      await harness.send('page', 0);
-      await harness.send('scroll', 21.5);
-      expect(harness.opened, [0]);
-      expect(harness.pages, [0]);
-      expect(harness.offsets, [21.5]);
-      await harness.send('subscribeImage', {'id': 'a', 'index': 0});
-      expect(provider.completer.listeners, hasLength(1));
-      await tester.pumpWidget(const SizedBox());
-      expect(provider.completer.listeners, isEmpty);
-    },
-    variant: TargetPlatformVariant.only(TargetPlatform.iOS),
-  );
+  testWidgets('native callbacks and disposal release subscribed images', (
+    tester,
+  ) async {
+    final provider = _TestImage();
+    final harness = await _mount(tester, [provider]);
+    await harness.send('open', 0);
+    await harness.send('open', 2);
+    await harness.send('page', 0);
+    await harness.send('scroll', 21.5);
+    expect(harness.opened, [0]);
+    expect(harness.pages, [0]);
+    expect(harness.offsets, [21.5]);
+    await harness.send('subscribeImage', {'id': 'a', 'index': 0});
+    expect(provider.completer.listeners, hasLength(1));
+    await tester.pumpWidget(const SizedBox());
+    expect(provider.completer.listeners, isEmpty);
+  }, variant: TargetPlatformVariant.only(TargetPlatform.iOS));
 
-  testWidgets(
-    'multi-image native gallery forwards continuing animation frames',
-    (tester) async {
-      final animated = _TestImage();
-      final still = _TestImage();
-      final harness = await _mount(tester, [animated, still]);
-      await harness.send('subscribeImage', {'id': 'animated', 'index': 0});
-      await harness.send('subscribeImage', {'id': 'still', 'index': 1});
-      final decoded = await tester.runAsync(() async {
-        // Two 1x1 GIF frames with different palette indices: red, then blue.
-        final codec = await ui.instantiateImageCodec(
-          base64Decode(
-            'R0lGODlhAQABAIAAAP8AAAAA/yH5BAAKAAAALAAAAAABAAEAAAICRAEAIfkEAAoAAAAsAAAAAAEAAQAAAgJMAQA7',
-          ),
-        );
-        try {
-          expect(codec.frameCount, 2);
-          return [
-            (await codec.getNextFrame()).image,
-            (await codec.getNextFrame()).image,
-          ];
-        } finally {
-          codec.dispose();
-        }
-      });
-      await tester.runAsync(() async {
-        animated.completer.emit(decoded![0]);
-        await harness.waitForFrames(1);
-        animated.completer.emit(decoded[1]);
-        await harness.waitForFrames(2);
-      });
-      expect(harness.frames.map((f) => f['id']), ['animated', 'animated']);
-      expect(
-        harness.frames[0]['bytes'],
-        isNot(orderedEquals(harness.frames[1]['bytes'] as Uint8List)),
+  testWidgets('multi-image native gallery forwards continuing animation frames', (
+    tester,
+  ) async {
+    final animated = _TestImage();
+    final still = _TestImage();
+    final harness = await _mount(tester, [animated, still]);
+    await harness.send('subscribeImage', {'id': 'animated', 'index': 0});
+    await harness.send('subscribeImage', {'id': 'still', 'index': 1});
+    final decoded = await tester.runAsync(() async {
+      // Two 1x1 GIF frames with different palette indices: red, then blue.
+      final codec = await ui.instantiateImageCodec(
+        base64Decode(
+          'R0lGODlhAQABAIAAAP8AAAAA/yH5BAAKAAAALAAAAAABAAEAAAICRAEAIfkEAAoAAAAsAAAAAAEAAQAAAgJMAQA7',
+        ),
       );
-      await harness.send('cancelImage', 'animated');
-      expect(animated.completer.listeners, isEmpty);
-      final count = harness.frames.length;
-      final green = await tester.runAsync(() => _frame(Colors.green));
-      animated.completer.emit(green!);
-      await tester.pump();
-      expect(harness.frames, hasLength(count));
-      await tester.pumpWidget(const SizedBox());
-      expect(still.completer.listeners, isEmpty);
-    },
-    variant: TargetPlatformVariant.only(TargetPlatform.iOS),
-  );
+      try {
+        expect(codec.frameCount, 2);
+        return [
+          (await codec.getNextFrame()).image,
+          (await codec.getNextFrame()).image,
+        ];
+      } finally {
+        codec.dispose();
+      }
+    });
+    await tester.runAsync(() async {
+      animated.completer.emit(decoded![0]);
+      await harness.waitForFrames(1);
+      animated.completer.emit(decoded[1]);
+      await harness.waitForFrames(2);
+    });
+    expect(harness.frames.map((f) => f['id']), ['animated', 'animated']);
+    expect(
+      harness.frames[0]['bytes'],
+      isNot(orderedEquals(harness.frames[1]['bytes'] as Uint8List)),
+    );
+    await harness.send('cancelImage', 'animated');
+    expect(animated.completer.listeners, isEmpty);
+    final count = harness.frames.length;
+    final green = await tester.runAsync(() => _frame(Colors.green));
+    animated.completer.emit(green!);
+    await tester.pump();
+    expect(harness.frames, hasLength(count));
+    await tester.pumpWidget(const SizedBox());
+    expect(still.completer.listeners, isEmpty);
+  }, variant: TargetPlatformVariant.only(TargetPlatform.iOS));
 
   testWidgets(
     'rapid reuse bounds unresolved loads and drops cancelled queued requests',
diff --git a/mobile/test/shared/widgets/ios_scroll_to_top_test.dart b/mobile/test/shared/widgets/ios_scroll_to_top_test.dart
index 52c141deb2..413c5139af 100644
--- a/mobile/test/shared/widgets/ios_scroll_to_top_test.dart
+++ b/mobile/test/shared/widgets/ios_scroll_to_top_test.dart
@@ -50,115 +50,107 @@ void main() {
     );
   }
 
-  testWidgets(
-    'status tap does not scroll a page under a modal',
-    (tester) async {
-      final controller = ScrollController();
-      addTearDown(controller.dispose);
-      late BuildContext pageContext;
-      await tester.pumpWidget(
-        _testApp(
-          home: FrostedScaffold(
-            appBar: const FrostedAppBar(title: Text('Test')),
-            body: Builder(
-              builder: (context) {
-                pageContext = context;
-                return ListView.builder(
-                  controller: controller,
-                  itemCount: 100,
-                  itemBuilder: (_, index) =>
-                      SizedBox(height: 60, child: Text('Row $index')),
-                );
-              },
-            ),
+  testWidgets('status tap does not scroll a page under a modal', (
+    tester,
+  ) async {
+    final controller = ScrollController();
+    addTearDown(controller.dispose);
+    late BuildContext pageContext;
+    await tester.pumpWidget(
+      _testApp(
+        home: FrostedScaffold(
+          appBar: const FrostedAppBar(title: Text('Test')),
+          body: Builder(
+            builder: (context) {
+              pageContext = context;
+              return ListView.builder(
+                controller: controller,
+                itemCount: 100,
+                itemBuilder: (_, index) =>
+                    SizedBox(height: 60, child: Text('Row $index')),
+              );
+            },
           ),
         ),
-      );
-      await tester.pumpAndSettle();
-      controller.jumpTo(900);
-      await tester.pumpAndSettle();
-      showModalBottomSheet<void>(
-        context: pageContext,
-        builder: (_) => const SizedBox(height: 200),
-      );
-      await tester.pumpAndSettle();
-      await tapStatusBar(tester);
-      expect(controller.offset, 900);
-    },
-    variant: TargetPlatformVariant.only(TargetPlatform.iOS),
-  );
-  testWidgets(
-    'status tap expands a pinned title and returns its list to top',
-    (tester) async {
-      await tester.pumpWidget(
-        _testApp(
-          home: FrostedScaffold(
-            nativePinnedBody: true,
-            appBar: const FrostedAppBar(
-              title: Text('Title'),
-              nativeLargeTitle: true,
-            ),
-            body: ListView.builder(
-              itemCount: 100,
-              itemBuilder: (_, index) =>
-                  SizedBox(height: 60, child: Text('Pinned $index')),
-            ),
+      ),
+    );
+    await tester.pumpAndSettle();
+    controller.jumpTo(900);
+    await tester.pumpAndSettle();
+    showModalBottomSheet<void>(
+      context: pageContext,
+      builder: (_) => const SizedBox(height: 200),
+    );
+    await tester.pumpAndSettle();
+    await tapStatusBar(tester);
+    expect(controller.offset, 900);
+  }, variant: TargetPlatformVariant.only(TargetPlatform.iOS));
+  testWidgets('status tap expands a pinned title and returns its list to top', (
+    tester,
+  ) async {
+    await tester.pumpWidget(
+      _testApp(
+        home: FrostedScaffold(
+          nativePinnedBody: true,
+          appBar: const FrostedAppBar(
+            title: Text('Title'),
+            nativeLargeTitle: true,
+          ),
+          body: ListView.builder(
+            itemCount: 100,
+            itemBuilder: (_, index) =>
+                SizedBox(height: 60, child: Text('Pinned $index')),
           ),
         ),
-      );
-      await tester.pumpAndSettle();
-      await tester.drag(find.byType(ListView), const Offset(0, -900));
-      await tester.pumpAndSettle();
-      final nested = tester.state<NestedScrollViewState>(
-        find.byType(NestedScrollView),
-      );
-      expect(nested.innerController.offset, greaterThan(0));
-      await tapStatusBar(tester);
-      expect(nested.innerController.offset, 0);
-      expect(nested.outerController.offset, 0);
-    },
-    variant: TargetPlatformVariant.only(TargetPlatform.iOS),
-  );
+      ),
+    );
+    await tester.pumpAndSettle();
+    await tester.drag(find.byType(ListView), const Offset(0, -900));
+    await tester.pumpAndSettle();
+    final nested = tester.state<NestedScrollViewState>(
+      find.byType(NestedScrollView),
+    );
+    expect(nested.innerController.offset, greaterThan(0));
+    await tapStatusBar(tester);
+    expect(nested.innerController.offset, 0);
+    expect(nested.outerController.offset, 0);
+  }, variant: TargetPlatformVariant.only(TargetPlatform.iOS));
 
-  testWidgets(
-    'status tap leaves an inactive tab alone',
-    (tester) async {
-      final controllers = [ScrollController(), ScrollController()];
-      addTearDown(() {
-        for (final controller in controllers) {
-          controller.dispose();
-        }
-      });
-      await tester.pumpWidget(
-        _testApp(
-          home: IndexedStack(
-            index: 1,
-            children: [
-              for (var index = 0; index < 2; index++)
-                FrostedScaffold(
-                  appBar: const FrostedAppBar(title: Text('Tab')),
-                  body: ListView.builder(
-                    controller: controllers[index],
-                    itemCount: 100,
-                    itemBuilder: (_, row) =>
-                        SizedBox(height: 60, child: Text('Row $row')),
-                  ),
-                ),
-            ],
-          ),
-        ),
-      );
-      await tester.pumpAndSettle();
+  testWidgets('status tap leaves an inactive tab alone', (tester) async {
+    final controllers = [ScrollController(), ScrollController()];
+    addTearDown(() {
       for (final controller in controllers) {
-        controller.jumpTo(900);
+        controller.dispose();
       }
-      await tester.pumpAndSettle();
-      await tapStatusBar(tester);
-      expect(controllers[0].offset, 900);
-      expect(controllers[1].offset, 0);
-    },
-    variant: TargetPlatformVariant.only(TargetPlatform.iOS),
-  );
+    });
+    await tester.pumpWidget(
+      _testApp(
+        home: IndexedStack(
+          index: 1,
+          children: [
+            for (var index = 0; index < 2; index++)
+              FrostedScaffold(
+                appBar: const FrostedAppBar(title: Text('Tab')),
+                body: ListView.builder(
+                  controller: controllers[index],
+                  itemCount: 100,
+                  itemBuilder: (_, row) =>
+                      SizedBox(height: 60, child: Text('Row $row')),
+                ),
+              ),
+          ],
+        ),
+      ),
+    );
+    await tester.pumpAndSettle();
+    for (final controller in controllers) {
+      controller.jumpTo(900);
+    }
+    await tester.pumpAndSettle();
+    await tapStatusBar(tester);
+    expect(controllers[0].offset, 900);
+    expect(controllers[1].offset, 0);
+  }, variant: TargetPlatformVariant.only(TargetPlatform.iOS));
 }
 
 Widget _testApp({Widget? home, TransitionBuilder? builder}) => ProviderScope(
diff --git a/mobile/test/shared/widgets/overlay_portal_retention_test.dart b/mobile/test/shared/widgets/overlay_portal_retention_test.dart
new file mode 100644
index 0000000000..990121ec23
--- /dev/null
+++ b/mobile/test/shared/widgets/overlay_portal_retention_test.dart
@@ -0,0 +1,53 @@
+import 'package:flutter/material.dart';
+import 'package:flutter_test/flutter_test.dart';
+import 'package:leak_tracker/leak_tracker.dart';
+
+void main() {
+  testWidgets('disposed composer-style overlay portals are collectible', (
+    tester,
+  ) async {
+    final semantics = tester.ensureSemantics();
+    try {
+      // Keep the application's semantics owner alive while each route leaves.
+      // Disposing the entire app would hide retention in its traversal maps.
+      final retired = <WeakReference<State<StatefulWidget>>>[];
+      for (var visit = 0; visit < 3; visit++) {
+        retired.add(await _visitOverlay(tester));
+      }
+
+      await tester.runAsync(() => forceGC(fullGcCycles: 3));
+      expect(
+        retired.where((reference) => reference.target != null),
+        isEmpty,
+        reason:
+            'A closed route must not survive through semantics traversal keys',
+      );
+    } finally {
+      semantics.dispose();
+    }
+  });
+}
+
+Future<WeakReference<State<StatefulWidget>>> _visitOverlay(
+  WidgetTester tester,
+) async {
+  final controller = OverlayPortalController()..show();
+  await tester.pumpWidget(
+    MaterialApp(
+      home: OverlayPortal.overlayChildLayoutBuilder(
+        controller: controller,
+        overlayChildBuilder: (_, _) => const Positioned(
+          left: 0,
+          top: 0,
+          child: Text('Composer suggestions'),
+        ),
+        child: const Text('Composer'),
+      ),
+    ),
+  );
+  await tester.pumpAndSettle();
+  final retired = WeakReference(tester.state(find.byType(OverlayPortal)));
+  await tester.pumpWidget(const MaterialApp(home: SizedBox()));
+  await tester.pumpAndSettle();
+  return retired;
+}
diff --git a/mobile/test/shared/widgets/page_indicator_test.dart b/mobile/test/shared/widgets/page_indicator_test.dart
index f0e42f3c20..254ff8af9a 100644
--- a/mobile/test/shared/widgets/page_indicator_test.dart
+++ b/mobile/test/shared/widgets/page_indicator_test.dart
@@ -8,50 +8,48 @@ import 'package:flutter_test/flutter_test.dart';
 import '../../helpers/widget_helpers.dart';
 
 void main() {
-  testWidgets(
-    'iOS receives initial and updated layout direction',
-    (tester) async {
-      final updates = <Map<Object?, Object?>>[];
-      const channel = MethodChannel('buzz/theme_pagination_glass/54321');
-      tester.binding.defaultBinaryMessenger.setMockMethodCallHandler(channel, (
-        call,
-      ) async {
-        if (call.method == 'setState') {
-          updates.add(call.arguments as Map<Object?, Object?>);
-        }
-        return null;
-      });
-      addTearDown(
-        () => tester.binding.defaultBinaryMessenger.setMockMethodCallHandler(
-          channel,
-          null,
-        ),
-      );
-      Future<void> pump(TextDirection direction) => tester.pumpWidget(
-        WidgetHelpers.testable(
-          child: Directionality(
-            textDirection: direction,
-            child: PageIndicator(
-              semanticLabel: 'Photo',
-              count: 20,
-              selected: 10,
-              animateChanges: false,
-              onSelected: (_) {},
-            ),
+  testWidgets('iOS receives initial and updated layout direction', (
+    tester,
+  ) async {
+    final updates = <Map<Object?, Object?>>[];
+    const channel = MethodChannel('buzz/theme_pagination_glass/54321');
+    tester.binding.defaultBinaryMessenger.setMockMethodCallHandler(channel, (
+      call,
+    ) async {
+      if (call.method == 'setState') {
+        updates.add(call.arguments as Map<Object?, Object?>);
+      }
+      return null;
+    });
+    addTearDown(
+      () => tester.binding.defaultBinaryMessenger.setMockMethodCallHandler(
+        channel,
+        null,
+      ),
+    );
+    Future<void> pump(TextDirection direction) => tester.pumpWidget(
+      WidgetHelpers.testable(
+        child: Directionality(
+          textDirection: direction,
+          child: PageIndicator(
+            semanticLabel: 'Photo',
+            count: 20,
+            selected: 10,
+            animateChanges: false,
+            onSelected: (_) {},
           ),
         ),
-      );
-      await pump(TextDirection.rtl);
-      final native = tester.widget<UiKitView>(find.byType(UiKitView));
-      expect((native.creationParams as Map)['isRTL'], isTrue);
-      native.onPlatformViewCreated!(54321);
-      await tester.pump();
-      expect(updates.last['isRTL'], isTrue);
-      await pump(TextDirection.ltr);
-      expect(updates.last['isRTL'], isFalse);
-    },
-    variant: TargetPlatformVariant.only(TargetPlatform.iOS),
-  );
+      ),
+    );
+    await pump(TextDirection.rtl);
+    final native = tester.widget<UiKitView>(find.byType(UiKitView));
+    expect((native.creationParams as Map)['isRTL'], isTrue);
+    native.onPlatformViewCreated!(54321);
+    await tester.pump();
+    expect(updates.last['isRTL'], isTrue);
+    await pump(TextDirection.ltr);
+    expect(updates.last['isRTL'], isFalse);
+  }, variant: TargetPlatformVariant.only(TargetPlatform.iOS));
 
   testWidgets(
     'pagination has a single platform semantics owner',
diff --git a/scripts/ci-selection.test.mjs b/scripts/ci-selection.test.mjs
index ccad2f604c..4fb7508293 100644
--- a/scripts/ci-selection.test.mjs
+++ b/scripts/ci-selection.test.mjs
@@ -217,6 +217,11 @@ const scenarios = [
     ["mobile"],
   ],
   ["mobile lockfile", ["mobile/pubspec.lock"], ["mobile"]],
+  [
+    "mobile release source helper",
+    ["scripts/mobile-release-source.sh"],
+    ["mobile"],
+  ],
   ["mobile release script", ["scripts/mobile-release.sh"], ["mobile"]],
   [
     "mobile gateway recipe tests",
diff --git a/scripts/mobile-release-source.sh b/scripts/mobile-release-source.sh
new file mode 100644
index 0000000000..bc3321132a
--- /dev/null
+++ b/scripts/mobile-release-source.sh
@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+
+# Validate an explicitly selected stable branch against the marketing version.
+# main remains the default for releases without a stabilization branch.
+require_mobile_release_source() {
+  local version="$1" branch="$2"
+  if [[ "$branch" == main ]]; then
+    return 0
+  fi
+  if [[ "$branch" != "mobile-v${version%.*}" ]]; then
+    echo "Source branch must be main or mobile-v${version%.*} for version $version" >&2
+    return 1
+  fi
+}
+
+# The repository administrator must configure this ruleset without bypass actors.
+# GitHub hides that list from non-admin tokens; check the caller's effective
+# bypass plus every public policy field on each publication.
+require_mobile_release_branch_ruleset() {
+  local branch="$1" valid
+  [[ "$branch" != main ]] || return 0
+  valid="$(gh api repos/block/buzz/rulesets/19321162 --jq '
+    .target == "branch" and .enforcement == "active"
+    and .current_user_can_bypass == "never"
+    and (.conditions.ref_name.include | index("refs/heads/mobile-v*") != null)
+    and (.conditions.ref_name.exclude == [])
+    and ((has("bypass_actors") | not) or .bypass_actors == [])
+    and any(.rules[]; .type == "deletion")
+    and any(.rules[]; .type == "non_fast_forward")
+    and any(.rules[]; .type == "pull_request"
+      and .parameters.required_approving_review_count >= 1
+      and .parameters.dismiss_stale_reviews_on_push == true
+      and .parameters.require_last_push_approval == true
+      and .parameters.required_review_thread_resolution == true)
+    and any(.rules[]; .type == "required_status_checks"
+      and .parameters.strict_required_status_checks_policy == true
+      and ([.parameters.required_status_checks[].context] | index("Mobile") != null)
+      and ([.parameters.required_status_checks[].context] | index("DCO Check") != null))
+  ')" || { echo "Could not verify mobile stable-branch protection" >&2; return 1; }
+  [[ "$valid" == true ]] || {
+    echo "Mobile stable-branch ruleset 19321162 must enforce review and checks on mobile-v* without bypass" >&2
+    return 1
+  }
+}
+
+# Compare immutable SHAs, not a mutable branch name. The selected branch may
+# advance after this snapshot without changing the authorized candidate source.
+require_mobile_release_commit_ancestor() {
+  local target_sha="$1" source_sha="$2" merge_base
+  merge_base="$(gh api "repos/block/buzz/compare/$target_sha...$source_sha" --jq .merge_base_commit.sha)" || {
+    echo "Could not verify candidate source ancestry" >&2
+    return 1
+  }
+  [[ "$merge_base" == "$target_sha" ]] || {
+    echo "Candidate commit $target_sha is not in selected source history at $source_sha" >&2
+    return 1
+  }
+}
diff --git a/scripts/mobile-release.sh b/scripts/mobile-release.sh
index 5702281700..724c8337a5 100755
--- a/scripts/mobile-release.sh
+++ b/scripts/mobile-release.sh
@@ -4,10 +4,10 @@ set -euo pipefail
 usage() {
   cat >&2 <<'USAGE'
 usage:
-  scripts/mobile-release.sh candidate X.Y.Z
+  scripts/mobile-release.sh candidate X.Y.Z [--source-branch mobile-vX.Y] [--commit FULL_SHA]
 
 candidate  Publish the next immutable mobile-vX.Y.Z-rc.N candidate tag at the
-           exact current commit of block/buzz's remote main branch.
+           selected commit in source history (defaults to the current source tip).
 USAGE
   exit 2
 }
@@ -19,6 +19,8 @@ fail() {
 
 # shellcheck source=scripts/release-rulesets.sh
 source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/release-rulesets.sh"
+# shellcheck source=scripts/mobile-release-source.sh
+source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/mobile-release-source.sh"
 
 require_gh_minimum_version() {
   local minimum="2.87.0" version
@@ -91,33 +93,56 @@ remote_tag_commit_sha() {
   printf '%s' "$commit"
 }
 
-remote_main_commit_sha() {
-  local ref="refs/heads/main" line advertised_oid fetched_oid commit
-  line="$(git ls-remote --refs origin "$ref")" || return 1
-  [[ -n "$line" && "$line" != *$'\n'* ]] || return 1
-  advertised_oid="${line%%$'\t'*}"
-  git fetch -q --no-tags origin "$ref"
-  fetched_oid="$(git rev-parse --verify FETCH_HEAD)"
-  [[ "$fetched_oid" == "$advertised_oid" ]] || \
-    fail "origin/main moved while it was being resolved"
+remote_source_commit_sha() {
+  local ref="refs/heads/$MOBILE_RELEASE_SOURCE_BRANCH" fetched_oid commit
+  # Fetch a single snapshot. A later branch advance does not invalidate it.
+  git fetch -q --no-tags origin "$ref" || return 1
+  fetched_oid="$(git rev-parse --verify FETCH_HEAD)" || return 1
   commit="$(git rev-parse --verify 'FETCH_HEAD^{commit}')" || return 1
-  [[ "$commit" == "$advertised_oid" ]] || \
-    fail "origin/main did not resolve directly to a commit"
+  [[ "$commit" == "$fetched_oid" ]] || \
+    fail "origin/$MOBILE_RELEASE_SOURCE_BRANCH did not resolve directly to a commit"
   printf '%s' "$commit"
 }
 
 command="${1:-}"
 case "$command" in
   candidate)
-    [[ "$#" -eq 2 ]] || usage
+    [[ "$#" -ge 2 ]] || usage
     version="$2"
+    shift 2
+    MOBILE_RELEASE_SOURCE_BRANCH=main
+    requested_sha=""
+    source_option_seen=false
+    commit_option_seen=false
+    while [[ "$#" -gt 0 ]]; do
+      [[ "$#" -ge 2 ]] || usage
+      case "$1" in
+        --source-branch)
+          [[ "$source_option_seen" == false ]] || usage
+          source_option_seen=true
+          MOBILE_RELEASE_SOURCE_BRANCH="$2"
+          ;;
+        --commit)
+          [[ "$commit_option_seen" == false ]] || usage
+          commit_option_seen=true
+          requested_sha="$2"
+          [[ "$requested_sha" =~ ^[0-9a-f]{40}$ ]] || fail "--commit requires a full commit SHA"
+          ;;
+        *) usage ;;
+      esac
+      shift 2
+    done
     require_clean_semver "$version"
+    require_mobile_release_source "$version" "$MOBILE_RELEASE_SOURCE_BRANCH" || exit 1
     require_clean_tree
     require_canonical_repository || exit 1
     require_gh_minimum_version
+    require_mobile_release_branch_ruleset "$MOBILE_RELEASE_SOURCE_BRANCH" || exit 1
 
     local_head_sha="$(git rev-parse --verify 'HEAD^{commit}')" || fail "HEAD is not a commit"
-    main_sha="$(remote_main_commit_sha)" || fail "origin/main does not exist"
+    source_tip="$(remote_source_commit_sha)" || fail "origin/$MOBILE_RELEASE_SOURCE_BRANCH does not exist"
+    source_sha="${requested_sha:-$source_tip}"
+    require_mobile_release_commit_ancestor "$source_sha" "$source_tip" || exit 1
     next=1
     if ! remote_tags="$(git ls-remote --refs --tags origin "refs/tags/mobile-v${version}-rc.*")"; then
       fail "could not list existing candidates for $version"
@@ -135,7 +160,8 @@ case "$command" in
       --ref main \
       -f "version=$version" \
       -f "candidate_number=$next" \
-      -f "target_sha=$main_sha" 2>&1)"; then
+      -f "source_branch=$MOBILE_RELEASE_SOURCE_BRANCH" \
+      -f "target_sha=$source_sha" 2>&1)"; then
       :
     else
       if [[ "$dispatch_output" == *"does not have 'workflow_dispatch' trigger"* ]]; then
@@ -151,18 +177,15 @@ case "$command" in
     gh run watch "$run_id" --repo block/buzz --exit-status --compact || \
       fail "App-backed publication failed: $run_url"
 
-    current_main_sha="$(remote_main_commit_sha)" || fail "origin/main does not exist after publication"
-    [[ "$current_main_sha" == "$main_sha" ]] || \
-      fail "origin/main moved from requested commit $main_sha to $current_main_sha during publication"
     published_sha="$(remote_tag_commit_sha "refs/tags/$tag")" || \
       fail "publication completed without exact annotated candidate tag $tag"
-    [[ "$published_sha" == "$main_sha" ]] || \
-      fail "$tag resolved to $published_sha instead of requested commit $main_sha"
-    if [[ "$local_head_sha" != "$main_sha" ]]; then
-      echo "Note: local HEAD is $local_head_sha; candidate source is current origin/main $main_sha." >&2
+    [[ "$published_sha" == "$source_sha" ]] || \
+      fail "$tag resolved to $published_sha instead of requested commit $source_sha"
+    if [[ "$local_head_sha" != "$source_sha" ]]; then
+      echo "Note: local HEAD is $local_head_sha; candidate source is pinned from origin/$MOBILE_RELEASE_SOURCE_BRANCH $source_sha." >&2
     fi
-    printf 'Published %s at origin/main commit %s through buzz-release-bot. Use this exact tag in Release Mobile.\n' \
-      "$tag" "$main_sha"
+    printf 'Published %s at pinned origin/%s commit %s through buzz-release-bot. Use this exact tag in Release Mobile.\n' \
+      "$tag" "$MOBILE_RELEASE_SOURCE_BRANCH" "$source_sha"
     ;;
 
   *) usage ;;
diff --git a/scripts/publish-mobile-release-candidate.sh b/scripts/publish-mobile-release-candidate.sh
index 6b0ee65b21..5119611c67 100755
--- a/scripts/publish-mobile-release-candidate.sh
+++ b/scripts/publish-mobile-release-candidate.sh
@@ -8,11 +8,14 @@ fail() {
 
 # shellcheck source=scripts/release-rulesets.sh
 source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/release-rulesets.sh"
+# shellcheck source=scripts/mobile-release-source.sh
+source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/mobile-release-source.sh"
 
-[[ "$#" -eq 3 ]] || fail "usage: $0 X.Y.Z N COMMIT_SHA"
+[[ "$#" -eq 4 ]] || fail "usage: $0 X.Y.Z N COMMIT_SHA SOURCE_BRANCH"
 version="$1"
 candidate_number="$2"
 target_sha="$3"
+MOBILE_RELEASE_SOURCE_BRANCH="$4"
 repo="${GITHUB_REPOSITORY:-}"
 
 [[ "$repo" == "block/buzz" ]] || fail "candidate publishing is restricted to block/buzz"
@@ -21,17 +24,19 @@ repo="${GITHUB_REPOSITORY:-}"
 [[ "$candidate_number" =~ ^[1-9][0-9]*$ ]] || \
   fail "'$candidate_number' is not a candidate number (expected N >= 1)"
 [[ "$target_sha" =~ ^[0-9a-f]{40}$ ]] || fail "'$target_sha' is not a full commit SHA"
+require_mobile_release_source "$version" "$MOBILE_RELEASE_SOURCE_BRANCH" || exit 1
 command -v gh >/dev/null 2>&1 || fail "gh is required"
 require_release_tag_ruleset || exit 1
+require_mobile_release_branch_ruleset "$MOBILE_RELEASE_SOURCE_BRANCH" || exit 1
 
-main_sha="$(gh api "repos/$repo/git/ref/heads/main" --jq .object.sha)" || \
-  fail "could not resolve $repo main"
-[[ "$main_sha" == "$target_sha" ]] || \
-  fail "$repo main moved from requested commit $target_sha to $main_sha"
+source_sha="$(gh api "repos/$repo/git/ref/heads/$MOBILE_RELEASE_SOURCE_BRANCH" --jq .object.sha)" || \
+  fail "could not resolve $repo $MOBILE_RELEASE_SOURCE_BRANCH"
+[[ "$source_sha" =~ ^[0-9a-f]{40}$ ]] || fail "GitHub returned an invalid source commit SHA"
 commit_sha="$(gh api "repos/$repo/commits/$target_sha" --jq .sha)" || \
   fail "$target_sha is not a commit in $repo"
 [[ "$commit_sha" == "$target_sha" ]] || \
   fail "GitHub resolved requested commit $target_sha as $commit_sha"
+require_mobile_release_commit_ancestor "$target_sha" "$source_sha" || exit 1
 
 refs="$(
   gh api --paginate "repos/$repo/git/matching-refs/tags/mobile-v${version}-rc." --jq '.[].ref'
diff --git a/scripts/run-tests.sh b/scripts/run-tests.sh
index 8cac14540b..4a8c597abc 100755
--- a/scripts/run-tests.sh
+++ b/scripts/run-tests.sh
@@ -248,6 +248,9 @@ run_unit_tests() {
   run_test_step "buzz-relay NIP-FI config tests" \
     cargo test -p buzz-relay --lib nip_fi_config:: -- --nocapture
 
+  run_test_step "buzz-relay NIP-FI resolver tests" \
+    cargo test -p buzz-relay --lib nip_fi_resolver:: -- --nocapture
+
   # Infra-free REQ subscription-lifecycle tests, by exact name: the rest of
   # handlers::req needs a database.
   run_test_step "buzz-relay REQ subscription lifecycle tests" \
@@ -340,6 +343,17 @@ run_unit_tests() {
     connection::tests::expiry_notice_queued_on_ctrl_before_cancel
     connection::tests::f3_root_outer_wrapper_delivers_denial_on_bootstrap_cancellation
     connection::tests::f3_root_pre_built_expired_gate_terminates_connection
+    connection::terminal_close_delivery_tests::key_pairing_mismatch_closes_with_1008_on_real_socket
+    connection::terminal_close_delivery_tests::session_expiry_denial_closes_with_1008_on_real_socket
+    connection::terminal_close_delivery_tests::server_holds_socket_for_client_close_reply
+    connection::terminal_close_delivery_tests::server_finishes_promptly_when_client_answers_close
+    connection::terminal_close_delivery_tests::stalled_cleanup_does_not_hold_socket_open
+    connection::terminal_close_delivery_tests::bootstrap_drain_holds_socket_for_client_close_reply
+    connection::terminal_close_delivery_tests::stalled_expiry_barrier_does_not_hold_socket_open
+    connection::terminal_close_delivery_tests::blocked_frame_handler_does_not_hold_socket_open
+    connection::terminal_close_delivery_tests::refused_bootstrap_holds_connection_slot_until_socket_ends
+    connection::terminal_close_delivery_tests::stalled_bootstrap_holds_connection_slot
+    connection::terminal_close_delivery_tests::peer_wait_replies_to_client_initiated_close
     handlers::auth::tests::b2_pre_cancelled_connection_never_becomes_authenticated
     handlers::auth::tests::fi_ban_check_error_emits_terminal_authorization_unavailable
     handlers::auth::tests::fi_root_authorization_denied_rows_emit_identical_frames
diff --git a/scripts/test-mobile-release-candidate-publisher.sh b/scripts/test-mobile-release-candidate-publisher.sh
index 92cfc69d84..dbfda358b5 100755
--- a/scripts/test-mobile-release-candidate-publisher.sh
+++ b/scripts/test-mobile-release-candidate-publisher.sh
@@ -17,6 +17,11 @@ record() {
 }
 
 case "${1:-}:${2:-}" in
+  api:repos/block/buzz/rulesets/19321162)
+    [[ "${GH_BRANCH_POLICY_FAIL:-}" != 1 ]] || exit 1
+    policy='{"target":"branch","enforcement":"active","current_user_can_bypass":"never","conditions":{"ref_name":{"include":["refs/heads/mobile-v*"],"exclude":[]}},"bypass_actors":[],"rules":[{"type":"deletion"},{"type":"non_fast_forward"},{"type":"pull_request","parameters":{"required_approving_review_count":1,"dismiss_stale_reviews_on_push":true,"require_last_push_approval":true,"required_review_thread_resolution":true}},{"type":"required_status_checks","parameters":{"strict_required_status_checks_policy":true,"required_status_checks":[{"context":"Mobile"},{"context":"DCO Check"}]}}]}'
+    printf '%s\n' "${GH_BRANCH_POLICY:-$policy}" | jq -r "$4"
+    ;;
   api:repos/block/buzz/rulesets/14378754)
     case "$*" in
       *'.enforcement'*) printf '%s\n' "${GH_TAG_RULESET_STATE:-active}" ;;
@@ -28,7 +33,24 @@ case "${1:-}:${2:-}" in
     esac
     ;;
   api:repos/block/buzz/git/ref/heads/main) printf '%s\n' "$GH_TARGET_SHA" ;;
-  api:repos/block/buzz/commits/*) printf '%s\n' "$GH_TARGET_SHA" ;;
+  api:repos/block/buzz/git/ref/heads/mobile-v1.2) printf '%s\n' "$GH_STABLE_SHA" ;;
+  api:repos/block/buzz/git/ref/heads/*) printf '%s\n' "$GH_MISMATCH_SHA" ;;
+  api:repos/block/buzz/compare/*)
+    [[ "${GH_COMPARE_FAIL:-}" != 1 ]] || exit 1
+    pair="${2##*/}"
+    base="${pair%%...*}"; tip="${pair##*...}"
+    if [[ -n "${GH_EXPECT_COMPARE:-}" ]]; then
+      [[ "$pair" == "$GH_EXPECT_COMPARE" ]] || exit 1
+    fi
+    if [[ -n "${GH_COMPARE_BASE_SHA:-}" ]]; then
+      printf '%s\n' "$GH_COMPARE_BASE_SHA"
+    elif [[ "$base" == "$tip" ]]; then
+      printf '%s\n' "$base"
+    else
+      printf '%s\n' 9999999999999999999999999999999999999999
+    fi
+    ;;
+  api:repos/block/buzz/commits/*) printf '%s\n' "${2##*/}" ;;
   api:--paginate)
     [[ "$3" == "repos/block/buzz/git/matching-refs/tags/mobile-v1.2.3-rc." ]]
     printf '%s' "${GH_EXISTING_REFS:-}"
@@ -72,9 +94,11 @@ export PATH="$bin:$PATH"
 export GH_CALLS="$tmp/calls"
 export GITHUB_REPOSITORY=block/buzz
 export GH_TARGET_SHA=1111111111111111111111111111111111111111
+export GH_STABLE_SHA=4444444444444444444444444444444444444444
+export GH_MISMATCH_SHA=5555555555555555555555555555555555555555
 export GH_TAG_OBJECT_SHA=2222222222222222222222222222222222222222
 
-"$publisher" 1.2.3 1 "$GH_TARGET_SHA"
+"$publisher" 1.2.3 1 "$GH_TARGET_SHA" main
 grep -Fq -- '-f tag=mobile-v1.2.3-rc.1' "$GH_CALLS"
 grep -Fq -- '-f message=Buzz Mobile 1.2.3 release candidate 1' "$GH_CALLS"
 grep -Fq -- "-f object=$GH_TARGET_SHA" "$GH_CALLS"
@@ -82,76 +106,161 @@ grep -Fq -- '-f type=commit' "$GH_CALLS"
 grep -Fq -- '-f ref=refs/tags/mobile-v1.2.3-rc.1' "$GH_CALLS"
 grep -Fq -- "-f sha=$GH_TAG_OBJECT_SHA" "$GH_CALLS"
 
-if GH_CURRENT_USER_CAN_BYPASS=never "$publisher" 1.2.3 1 "$GH_TARGET_SHA" >/dev/null 2>&1; then
+if GH_CURRENT_USER_CAN_BYPASS=never "$publisher" 1.2.3 1 "$GH_TARGET_SHA" main >/dev/null 2>&1; then
   echo "publisher accepted an App token without an always bypass" >&2
   exit 1
 fi
-if GH_CURRENT_USER_CAN_BYPASS='' "$publisher" 1.2.3 1 "$GH_TARGET_SHA" >/dev/null 2>&1; then
+if GH_CURRENT_USER_CAN_BYPASS='' "$publisher" 1.2.3 1 "$GH_TARGET_SHA" main >/dev/null 2>&1; then
   echo "publisher accepted a ruleset response without an effective bypass" >&2
   exit 1
 fi
-if GH_TAG_RULESET_STATE=disabled "$publisher" 1.2.3 1 "$GH_TARGET_SHA" >/dev/null 2>&1; then
+if GH_TAG_RULESET_STATE=disabled "$publisher" 1.2.3 1 "$GH_TARGET_SHA" main >/dev/null 2>&1; then
   echo "publisher accepted disabled tag protection" >&2
   exit 1
 fi
-if GH_TAG_RULE_TYPES=creation "$publisher" 1.2.3 1 "$GH_TARGET_SHA" >/dev/null 2>&1; then
+if GH_TAG_RULE_TYPES=creation "$publisher" 1.2.3 1 "$GH_TARGET_SHA" main >/dev/null 2>&1; then
   echo "publisher accepted incomplete tag protection" >&2
   exit 1
 fi
-if GH_TAG_INCLUDES=refs/tags/v\* "$publisher" 1.2.3 1 "$GH_TARGET_SHA" >/dev/null 2>&1; then
+if GH_TAG_INCLUDES=refs/tags/v\* "$publisher" 1.2.3 1 "$GH_TARGET_SHA" main >/dev/null 2>&1; then
   echo "publisher accepted a tag ruleset that excludes mobile candidates" >&2
   exit 1
 fi
-if GH_TAG_EXCLUDES=refs/tags/mobile-v0.0.0 "$publisher" 1.2.3 1 "$GH_TARGET_SHA" >/dev/null 2>&1; then
+if GH_TAG_EXCLUDES=refs/tags/mobile-v0.0.0 "$publisher" 1.2.3 1 "$GH_TARGET_SHA" main >/dev/null 2>&1; then
   echo "publisher accepted tag ruleset exclusions" >&2
   exit 1
 fi
 if GH_TARGET_SHA=3333333333333333333333333333333333333333 \
-    "$publisher" 1.2.3 1 1111111111111111111111111111111111111111 >/dev/null 2>&1; then
-  echo "publisher accepted a moved main branch" >&2
+    GH_ANNOTATED_TARGET_SHA=1111111111111111111111111111111111111111 \
+    "$publisher" 1.2.3 1 1111111111111111111111111111111111111111 main >/dev/null 2>&1; then
+  echo "publisher accepted a commit outside main history" >&2
   exit 1
 fi
 if GH_EXISTING_REFS=$'refs/tags/mobile-v1.2.3-rc.1\n' \
-    "$publisher" 1.2.3 1 "$GH_TARGET_SHA" >/dev/null 2>&1; then
+    "$publisher" 1.2.3 1 "$GH_TARGET_SHA" main >/dev/null 2>&1; then
   echo "publisher accepted a stale candidate number" >&2
   exit 1
 fi
-if GH_PUBLISHED_REF_TYPE=commit "$publisher" 1.2.3 1 "$GH_TARGET_SHA" >/dev/null 2>&1; then
+if GH_PUBLISHED_REF_TYPE=commit "$publisher" 1.2.3 1 "$GH_TARGET_SHA" main >/dev/null 2>&1; then
   echo "publisher accepted a lightweight published tag" >&2
   exit 1
 fi
 if GH_PUBLISHED_REF_SHA=3333333333333333333333333333333333333333 \
-    "$publisher" 1.2.3 1 "$GH_TARGET_SHA" >/dev/null 2>&1; then
+    "$publisher" 1.2.3 1 "$GH_TARGET_SHA" main >/dev/null 2>&1; then
   echo "publisher accepted the wrong annotated tag object" >&2
   exit 1
 fi
-if GH_ANNOTATED_TARGET_TYPE=tag "$publisher" 1.2.3 1 "$GH_TARGET_SHA" >/dev/null 2>&1; then
+if GH_ANNOTATED_TARGET_TYPE=tag "$publisher" 1.2.3 1 "$GH_TARGET_SHA" main >/dev/null 2>&1; then
   echo "publisher accepted a nested annotated tag" >&2
   exit 1
 fi
 if GH_ANNOTATED_TARGET_SHA=3333333333333333333333333333333333333333 \
-    "$publisher" 1.2.3 1 "$GH_TARGET_SHA" >/dev/null 2>&1; then
+    "$publisher" 1.2.3 1 "$GH_TARGET_SHA" main >/dev/null 2>&1; then
   echo "publisher accepted an annotated tag on the wrong commit" >&2
   exit 1
 fi
-if "$publisher" 01.2.3 1 "$GH_TARGET_SHA" >/dev/null 2>&1; then
+if "$publisher" 01.2.3 1 "$GH_TARGET_SHA" main >/dev/null 2>&1; then
   echo "publisher accepted a marketing version with a leading zero" >&2
   exit 1
 fi
-if "$publisher" 1.2.3 01 "$GH_TARGET_SHA" >/dev/null 2>&1; then
+if "$publisher" 1.2.3 01 "$GH_TARGET_SHA" main >/dev/null 2>&1; then
   echo "publisher accepted a candidate number with a leading zero" >&2
   exit 1
 fi
 if GH_EXISTING_REFS=$'refs/tags/mobile-v1.2.3-rc.1\nrefs/tags/mobile-v1.2.3-rc.7\nrefs/tags/mobile-v1.2.3-rc.08\nrefs/tags/mobile-v1.2.4-rc.99\n' \
-    "$publisher" 1.2.3 8 "$GH_TARGET_SHA" >/dev/null; then
+    "$publisher" 1.2.3 8 "$GH_TARGET_SHA" main >/dev/null; then
   :
 else
   echo "publisher did not sequence from the highest exact candidate" >&2
   exit 1
 fi
-if GITHUB_REPOSITORY=attacker/buzz "$publisher" 1.2.3 1 "$GH_TARGET_SHA" >/dev/null 2>&1; then
+if GITHUB_REPOSITORY=attacker/buzz "$publisher" 1.2.3 1 "$GH_TARGET_SHA" main >/dev/null 2>&1; then
   echo "publisher accepted the wrong repository" >&2
   exit 1
 fi
 
+GH_ANNOTATED_TARGET_SHA="$GH_STABLE_SHA" "$publisher" 1.2.3 1 "$GH_STABLE_SHA" mobile-v1.2
+# Old commits are accepted only when the immutable compare proves ancestry.
+old_sha=6666666666666666666666666666666666666666
+for source in main mobile-v1.2; do
+  tip="$GH_TARGET_SHA"
+  [[ "$source" != mobile-v1.2 ]] || tip="$GH_STABLE_SHA"
+  GH_COMPARE_BASE_SHA="$old_sha" GH_EXPECT_COMPARE="$old_sha...$tip" GH_ANNOTATED_TARGET_SHA="$old_sha" \
+    "$publisher" 1.2.3 1 "$old_sha" "$source"
+  before_calls="$(wc -l < "$GH_CALLS")"
+  for mode in unrelated unavailable; do
+    if GH_COMPARE_FAIL="$([[ "$mode" == unavailable ]] && echo 1 || echo 0)" \
+      GH_COMPARE_BASE_SHA="$GH_MISMATCH_SHA" GH_ANNOTATED_TARGET_SHA="$old_sha" \
+      "$publisher" 1.2.3 1 "$old_sha" "$source" >/dev/null 2>&1; then
+      echo "publisher accepted $mode ancestry for $source" >&2
+      exit 1
+    fi
+  done
+  [[ "$(wc -l < "$GH_CALLS")" == "$before_calls" ]]
+done
+
+for source in mobile-v1.3 mobile-v2.2 mobile-v01.2 arbitrary ''; do
+  if GH_ANNOTATED_TARGET_SHA="$GH_MISMATCH_SHA" "$publisher" 1.2.3 1 "$GH_MISMATCH_SHA" "$source" >/dev/null 2>&1; then
+    echo "publisher accepted mismatched source '$source'" >&2
+    exit 1
+  fi
+done
+# Mutate actual policy JSON so these tests exercise the production jq predicate.
+python3 - "$publisher" <<'PYPOLICY'
+import copy, json, os, subprocess, sys
+policy = {'target': 'branch', 'enforcement': 'active', 'current_user_can_bypass': 'never', 'conditions': {'ref_name': {'include': ['refs/heads/mobile-v*'], 'exclude': []}}, 'bypass_actors': [], 'rules': [{'type': 'deletion'}, {'type': 'non_fast_forward'}, {'type': 'pull_request', 'parameters': {'required_approving_review_count': 1, 'dismiss_stale_reviews_on_push': True, 'require_last_push_approval': True, 'required_review_thread_resolution': True}}, {'type': 'required_status_checks', 'parameters': {'strict_required_status_checks_policy': True, 'required_status_checks': [{'context': 'Mobile'}, {'context': 'DCO Check'}]}}]}
+mutations = {
+    "disabled": lambda p: p.update(enforcement="disabled"),
+    "wrong target": lambda p: p.update(target="tag"),
+    "wrong scope": lambda p: p["conditions"]["ref_name"].update(include=["refs/heads/mobile-release/*"]),
+    "excluded branch": lambda p: p["conditions"]["ref_name"].update(exclude=["refs/heads/mobile-v1.2"]),
+    "caller bypass": lambda p: p.update(current_user_can_bypass="always"),
+    "other bypass": lambda p: p.update(bypass_actors=[{"actor_id":1}]),
+    "no deletion guard": lambda p: p["rules"].pop(0),
+    "no force guard": lambda p: p["rules"].pop(1),
+    "no review": lambda p: p["rules"].pop(2),
+    "no checks": lambda p: p["rules"].pop(3),
+    "no approvals": lambda p: p["rules"][2]["parameters"].update(required_approving_review_count=0),
+    "stale approvals": lambda p: p["rules"][2]["parameters"].update(dismiss_stale_reviews_on_push=False),
+    "self approval": lambda p: p["rules"][2]["parameters"].update(require_last_push_approval=False),
+    "open threads": lambda p: p["rules"][2]["parameters"].update(required_review_thread_resolution=False),
+    "non-strict checks": lambda p: p["rules"][3]["parameters"].update(strict_required_status_checks_policy=False),
+    "missing mobile": lambda p: p["rules"][3]["parameters"]["required_status_checks"].pop(0),
+    "missing DCO": lambda p: p["rules"][3]["parameters"]["required_status_checks"].pop(1),
+}
+for name, mutate in mutations.items():
+    value = copy.deepcopy(policy)
+    mutate(value)
+    env = dict(os.environ, GH_BRANCH_POLICY=json.dumps(value), GH_ANNOTATED_TARGET_SHA=os.environ["GH_STABLE_SHA"])
+    before = open(env["GH_CALLS"]).read()
+    result = subprocess.run([sys.argv[1], "1.2.3", "1", env["GH_STABLE_SHA"], "mobile-v1.2"], env=env, capture_output=True, text=True)
+    assert result.returncode != 0 and "must enforce review" in result.stderr, (name, result.stderr)
+    assert open(env["GH_CALLS"]).read() == before, name
+PYPOLICY
+if GH_BRANCH_POLICY_FAIL=1 "$publisher" 1.2.3 1 "$GH_STABLE_SHA" mobile-v1.2 >/dev/null 2>&1; then
+  echo "publisher accepted unavailable branch policy" >&2
+  exit 1
+fi
+
+# Exercise the checked-in workflow command with its actual source input binding.
+python3 - "$repo_root/.github/workflows/mobile-release-candidate.yml" "$tmp" <<'PYWORKFLOW'
+import os
+from pathlib import Path
+import re
+import subprocess
+import sys
+workflow = Path(sys.argv[1]).read_text()
+step = workflow.split("      - name: Publish annotated candidate tag\n", 1)[1]
+assert re.search(r"^          SOURCE_BRANCH: \$\{\{ inputs\.source_branch \}\}$", step, re.M), "source input is not bound to SOURCE_BRANCH"
+command = re.search(r"^        run: (.+)$", step, re.M).group(1)
+root = Path(sys.argv[2]) / "workflow"
+(root / "scripts").mkdir(parents=True)
+stub = root / "scripts/publish-mobile-release-candidate.sh"
+stub.write_text('#!/usr/bin/env bash\nprintf "%s\\n" "$@"\n')
+stub.chmod(0o755)
+env = dict(os.environ, MOBILE_VERSION="1.2.3", CANDIDATE_NUMBER="1", TARGET_SHA="4" * 40, SOURCE_BRANCH="mobile-v1.2")
+actual = subprocess.check_output(["bash", "-eu", "-c", command], cwd=root, env=env, text=True).splitlines()
+assert actual == ["1.2.3", "1", "4" * 40, "mobile-v1.2"], actual
+PYWORKFLOW
+
 echo "mobile release candidate publisher contract passed"
diff --git a/scripts/test-mobile-release-contract.sh b/scripts/test-mobile-release-contract.sh
index 531590a585..395060e4bd 100755
--- a/scripts/test-mobile-release-contract.sh
+++ b/scripts/test-mobile-release-contract.sh
@@ -17,6 +17,11 @@ cat > "$bin/gh" <<'GH'
 set -euo pipefail
 case "${1:-}:${2:-}" in
   --version:*) printf 'gh version %s (test)\n' "${GH_VERSION:-2.94.0}" ;;
+  api:repos/block/buzz/rulesets/19321162)
+    [[ "${GH_BRANCH_POLICY_FAIL:-}" != 1 ]] || exit 1
+    policy='{"target":"branch","enforcement":"active","current_user_can_bypass":"never","conditions":{"ref_name":{"include":["refs/heads/mobile-v*"],"exclude":[]}},"bypass_actors":[],"rules":[{"type":"deletion"},{"type":"non_fast_forward"},{"type":"pull_request","parameters":{"required_approving_review_count":1,"dismiss_stale_reviews_on_push":true,"require_last_push_approval":true,"required_review_thread_resolution":true}},{"type":"required_status_checks","parameters":{"strict_required_status_checks_policy":true,"required_status_checks":[{"context":"Mobile"},{"context":"DCO Check"}]}}]}'
+    printf '%s\n' "${GH_BRANCH_POLICY:-$policy}" | jq -r "$4"
+    ;;
   api:repos/block/buzz/rulesets/14378754)
     case "$*" in
       *'.enforcement'*) printf '%s\n' "${GH_TAG_RULESET_STATE:-active}" ;;
@@ -27,7 +32,13 @@ case "${1:-}:${2:-}" in
       *) exit 2 ;;
     esac
     ;;
+  api:repos/block/buzz/compare/*)
+    [[ "${GH_COMPARE_FAIL:-}" != 1 ]] || exit 1
+    pair="${2##*/}"
+    git --git-dir="$GH_REMOTE" merge-base "${pair%%...*}" "${pair##*...}"
+    ;;
   workflow:run)
+    printf '%s\n' attempted >> "$GH_WORKFLOW_ATTEMPTS"
     if [[ "${GH_WORKFLOW_DISPATCH_FAIL:-}" == "1" ]]; then
       printf '%s\n' "${GH_WORKFLOW_DISPATCH_ERROR:-dispatch failed}" >&2
       exit 1
@@ -42,15 +53,18 @@ case "${1:-}:${2:-}" in
     version=""
     number=""
     sha=""
+    source_branch=""
     while [[ "$#" -gt 0 ]]; do
       case "$1" in
         version=*) version="${1#version=}" ;;
         candidate_number=*) number="${1#candidate_number=}" ;;
+        source_branch=*) source_branch="${1#source_branch=}" ;;
         target_sha=*) sha="${1#target_sha=}" ;;
       esac
       shift
     done
-    [[ -n "$version" && -n "$number" && -n "$sha" ]]
+    [[ -n "$version" && -n "$number" && -n "$sha" && -n "$source_branch" ]] || exit 1
+    git --git-dir="$GH_REMOTE" merge-base --is-ancestor "$sha" "refs/heads/$source_branch" || exit 1
     printf '%s\t%s\t%s\n' "$version" "$number" "$sha" >> "$GH_WORKFLOW_CAPTURE"
     if [[ "${GH_WORKFLOW_NO_URL:-}" == "1" ]]; then
       exit 0
@@ -85,7 +99,9 @@ chmod +x "$bin/gh"
 
 export PATH="$bin:$PATH"
 export GH_WORKFLOW_CAPTURE="$tmp/workflow-dispatches"
+export GH_WORKFLOW_ATTEMPTS="$tmp/workflow-attempts"
 export GH_WORKTREE="$work"
+export GH_REMOTE="$remote"
 
 run_release() {
   local repo="$1"
@@ -106,7 +122,7 @@ fail() {
 assert_no_removed_mobile_release_behavior() {
   local status
 
-  grep -Eq 'gh[[:space:]]+release|mobile-release/|finalize' "$@" && \
+  grep -Eq 'gh[[:space:]]+release|finalize' "$@" && \
     fail "removed branch/finalization/GitHub Release behavior remains"
   status="$?"
   [[ "$status" -eq 1 ]] || \
@@ -141,7 +157,7 @@ if git -C "$operator" cat-file -e "$remote_main_sha^{commit}" 2>/dev/null; then
   fail "stale-clone fixture already contains the remote-only commit"
 fi
 run_release "$operator" candidate 1.2.3 > "$tmp/stale-output" 2> "$tmp/stale-error"
-grep -Fq "Note: local HEAD is $(git -C "$operator" rev-parse HEAD); candidate source is current origin/main $remote_main_sha." \
+grep -Fq "Note: local HEAD is $(git -C "$operator" rev-parse HEAD); candidate source is pinned from origin/main $remote_main_sha." \
   "$tmp/stale-error"
 cat "$tmp/stale-output"
 [[ "$(git --git-dir="$remote" rev-parse 'refs/tags/mobile-v1.2.3-rc.1^{commit}')" == \
@@ -149,6 +165,37 @@ cat "$tmp/stale-output"
 [[ "$(git --git-dir="$remote" cat-file -t refs/tags/mobile-v1.2.3-rc.1)" == tag ]]
 grep -Fq $'1.2.3\t1\t' "$GH_WORKFLOW_CAPTURE"
 
+# A stable branch may diverge from main, including an empty release-only commit.
+git -C "$work" switch -q -c mobile-v1.2
+git -C "$work" commit -q --allow-empty -m stable-only
+git -C "$work" push -q origin mobile-v1.2
+stable_sha="$(git -C "$work" rev-parse HEAD)"
+git -C "$work" switch -q main
+if GH_BRANCH_POLICY_FAIL=1 run_release "$operator" candidate 1.2.4 --source-branch mobile-v1.2 > "$tmp/policy-error" 2>&1; then
+  fail "operator accepted unavailable stable-branch policy"
+fi
+grep -Fq 'Could not verify mobile stable-branch protection' "$tmp/policy-error"
+if GH_BRANCH_POLICY='{}' run_release "$operator" candidate 1.2.4 --source-branch mobile-v1.2 > "$tmp/policy-error" 2>&1; then
+  fail "operator accepted missing stable-branch policy"
+fi
+run_release "$operator" candidate 1.2.4 --source-branch mobile-v1.2
+[[ "$(git --git-dir="$remote" rev-parse 'refs/tags/mobile-v1.2.4-rc.1^{commit}')" == "$stable_sha" ]]
+# Existing mismatched refs must be rejected by the guard, not missing-ref errors.
+for source in mobile-v1.3 mobile-v2.2 mobile-v01.2 arbitrary; do
+  git -C "$work" switch -q -c "$source"
+  git -C "$work" commit -q --allow-empty -m "$source"
+  git -C "$work" push -q origin "$source"
+done
+git -C "$work" switch -q main
+for source in mobile-v1.3 mobile-v2.2 mobile-v01.2 arbitrary ''; do
+  if run_release "$operator" candidate 1.2.4 --source-branch "$source" >/dev/null 2>&1; then
+    fail "accepted mismatched source '$source'"
+  fi
+done
+if run_release "$operator" candidate 8.8.0 --source-branch mobile-v8.8 >/dev/null 2>&1; then
+  fail "missing stable branch fell back to main"
+fi
+
 # Existing remote identities remain unchanged. Later candidates sequence
 # monotonically and target the then-current remote main commit.
 rc1_tag_oid="$(git --git-dir="$remote" rev-parse refs/tags/mobile-v1.2.3-rc.1)"
@@ -222,19 +269,40 @@ if GH_TAG_VERIFY_LIGHTWEIGHT=1 run_release "$operator" candidate 9.9.2 >/dev/nul
 fi
 [[ "$(git --git-dir="$remote" cat-file -t refs/tags/mobile-v9.9.2-rc.1)" == commit ]]
 
-# The publisher and operator both reject a main-tip race. The immutable tag may
-# already exist at the prior tip, but the operator must not report it as a
-# current-main candidate.
+# Advancing main during publication must not invalidate the pinned tag.
 pre_race_main_sha="$(git --git-dir="$remote" rev-parse refs/heads/main)"
-if GH_MAIN_MOVE_DURING_WORKFLOW=1 run_release "$operator" candidate 9.9.3 > "$tmp/main-race-output" 2>&1; then
-  fail "candidate succeeded after main moved during publication"
-fi
+GH_MAIN_MOVE_DURING_WORKFLOW=1 run_release "$operator" candidate 9.9.3 > "$tmp/main-race-output" 2>&1
 post_race_main_sha="$(git --git-dir="$remote" rev-parse refs/heads/main)"
 [[ "$pre_race_main_sha" != "$post_race_main_sha" ]]
-[[ "$(git --git-dir="$remote" rev-parse 'refs/tags/mobile-v9.9.3-rc.1^{commit}')" == \
-   "$pre_race_main_sha" ]]
-grep -Fq "origin/main moved from requested commit $pre_race_main_sha to $post_race_main_sha during publication" \
-  "$tmp/main-race-output"
+[[ "$(git --git-dir="$remote" rev-parse 'refs/tags/mobile-v9.9.3-rc.1^{commit}')" == "$pre_race_main_sha" ]]
+grep -Fq 'Published mobile-v9.9.3-rc.1' "$tmp/main-race-output"
+
+# Explicit historical source remains pinned even when the source branch advances.
+run_release "$operator" candidate 7.7.0 --commit "$remote_main_sha"
+[[ "$(git --git-dir="$remote" rev-parse 'refs/tags/mobile-v7.7.0-rc.1^{commit}')" == "$remote_main_sha" ]]
+run_release "$operator" candidate 1.2.5 --commit "$remote_main_sha" --source-branch mobile-v1.2
+[[ "$(git --git-dir="$remote" rev-parse 'refs/tags/mobile-v1.2.5-rc.1^{commit}')" == "$remote_main_sha" ]]
+before_attempts="$(wc -l < "$GH_WORKFLOW_ATTEMPTS")"
+before_dispatches="$(wc -l < "$GH_WORKFLOW_CAPTURE")"
+if run_release "$operator" candidate 7.7.1 --commit "$stable_sha" >/dev/null 2>&1; then
+  fail "accepted a commit outside main history"
+fi
+if run_release "$operator" candidate 1.2.6 --source-branch mobile-v1.2 --commit "$new_main_sha" >/dev/null 2>&1; then
+  fail "accepted a main-only commit outside stable history"
+fi
+for invalid_sha in main HEAD deadbeef 9999999999999999999999999999999999999999 ''; do
+  if run_release "$operator" candidate 7.7.1 --commit "$invalid_sha" >/dev/null 2>&1; then
+    fail "accepted invalid or absent commit '$invalid_sha'"
+  fi
+done
+if GH_COMPARE_FAIL=1 run_release "$operator" candidate 7.7.1 --commit "$remote_main_sha" >/dev/null 2>&1; then
+  fail "accepted unavailable ancestry evidence"
+fi
+if run_release "$operator" candidate 7.7.1 --commit "$remote_main_sha" --commit "$new_main_sha" >/dev/null 2>&1; then
+  fail "accepted duplicate commit options"
+fi
+[[ "$(wc -l < "$GH_WORKFLOW_ATTEMPTS")" == "$before_attempts" ]]
+[[ "$(wc -l < "$GH_WORKFLOW_CAPTURE")" == "$before_dispatches" ]]
 
 # Publishing through a fork is rejected and unsupported gh versions fail before
 # dispatching any candidate publication.