diff --git a/LOTUS_BUGS.md b/LOTUS_BUGS.md
index bea3fd915..e4d9e66b3 100644
--- a/LOTUS_BUGS.md
+++ b/LOTUS_BUGS.md
@@ -488,3 +488,23 @@ This document tracks identified bugs, edge cases, and architectural discrepancie
 | N92 | Location "Open Location" Button    | `MsgTypeRenderers.tsx`   | 534–547 | "Open Location" action link uses `<Chip as="a">` — compact badge-sized element — **FIXED**: replaced with `<Button as="a" variant="Secondary" fill="Solid" radii="300" size="400">` matching FileContent pattern     | `FileContent.tsx` uses `<Button variant="Secondary" fill="Solid" radii="300" size="400">` for "Open File"/"Open PDF"                                             |
 | N93 | Location Coordinates Text          | `MsgTypeRenderers.tsx`   | 532     | `<Text size="T300" style={{ opacity: 0.65 }}>` — hardcoded non-standard opacity — **FIXED**: replaced with `<Text size="T300" priority="300">`                                                                       | Secondary text uses folds `priority` prop; `0.65` is outside the token scale                                                                                     |
 | N94 | Mention Highlight Border Invisible | `App.tsx`                | 41      | `--mention-highlight-border` is set to the same value as `--mention-highlight-bg` — the border is invisible — **FIXED**: border is now `rgba(r,g,b,0.5)` — same hue as the background at 50% opacity, always visible | In folds, `color.*.ContainerLine` is always a lighter/muted sibling of `color.*.Container`, providing the 1px outline that gives mention chips visual definition |
+
+---
+
+#### 🔴 Additional Major Findings (Gemini)
+
+**N95 — AFK Auto-Mute Keeps Hardware Mic Active While Muted**
+
+- **File:** `src/app/hooks/useAfkAutoMute.ts`
+- **Status:** **OPEN** [Gemini_Found]
+- **Issue:** The `useAfkAutoMute` hook holds a persistent `MediaStream` from `getUserMedia` for the duration of the call. This causes the OS-level microphone recording indicator (e.g., green dot on macOS/iOS or camera/mic icon on Windows) to stay on even when the user mutes their microphone within the Lotus Chat UI.
+- **Root Cause:** A separate parallel `MediaStream` is spawned instead of tapping into LiveKit/Element Call's managed local stream.
+- **Fix:** Stop the `MediaStream` tracks (`.getTracks().forEach(t => t.stop())`) when `callEmbed.control.microphone` is false, and re-request `getUserMedia` when it turns back on. Suspending the `AudioContext` alone is **not sufficient** — it stops processing but does not clear the OS recording indicator; only stopping the tracks does. Optionally suspend the `AudioContext` alongside the track stop for CPU savings. Note: re-requesting `getUserMedia` on unmute adds a small latency and may trigger browser permission prompts on some configurations. Tapping into Element Call's local audio stream directly is architecturally cleaner but is not possible from Lotus — EC runs in a cross-origin iframe and its LiveKit `LocalAudioTrack` is inaccessible from our realm.
+
+**N96 — Call Recovery "Retry" and "Leave" Buttons Perform Identical Actions**
+
+- **File:** `src/app/features/call/CallView.tsx` (`CallLoadErrorMessage`)
+- **Status:** **FIXED ⚠️ UNTESTED** [Gemini_Found] — needs verification: force a call load failure (offline the network right as you click join, or block the EC origin), confirm the error overlay shows a single **"Back"** button that returns to the prescreen cleanly.
+- **Issue:** The `Retry` and `Leave` buttons in the call error overlay both executed the exact same `dismiss` function (`setCallEmbed(undefined)`), returning the user to the prescreen. "Retry" falsely implied it would automatically re-attempt joining the call. A true retry would require threading the previous `CallPreferences` into this component (via props or a Jotai atom) — a non-trivial change.
+- **Root Cause:** Two identically-wired buttons with misleading labels; the simpler recovery path is a single honest label.
+- **Fix Applied:** Removed the "Retry" button. Renamed "Leave" → "Back". One button, one clear action: returns to the prescreen where the user can manually click Join again to retry. Updated the code comment to match.
diff --git a/LOTUS_TESTING.md b/LOTUS_TESTING.md
index 6e3ff0b25..6a4fecd96 100644
--- a/LOTUS_TESTING.md
+++ b/LOTUS_TESTING.md
@@ -106,19 +106,19 @@
 
 **Expected:** the decoration ring/overlay renders around that participant's avatar on the call tile, the same way it does in member lists.
 
-### A7. EC iframe load watchdog + recovery UI (#EC)
+### A7. EC iframe load watchdog + recovery UI (#EC, N96)
 
-This guards against a permanently-stuck "Loading…" call.
+This guards against a permanently-stuck "Loading…" call. Also covers the N96 button-label fix (the old "Retry" and "Leave" buttons were identical — now there is a single **"Back"** button).
 
 1. Normal case: **join a call** → it should connect within a few seconds as usual (the watchdog stays invisible).
 2. Failure case (best-effort to reproduce): throttle your network hard (devtools → Network → Offline) **right as** you click join, or block the Element Call origin, so the iframe can't finish loading.
 
 **Expected**
 
-- On a genuine failure/timeout (~25s), instead of an endless spinner you get a **visible error overlay with Retry / Leave** buttons.
-- **Retry** attempts to reload the call; **Leave** exits cleanly.
+- On a genuine failure/timeout (~25s), instead of an endless spinner you get a **visible error overlay with a single "Back" button** (the old "Retry" + "Leave" pair is gone — they did the same thing and "Retry" was misleading).
+- Clicking **Back** returns you to the call prescreen, where you can manually click Join to try again.
 - Normal joins must **not** trigger the error overlay (no false positives) — this is the important part to confirm.
-- **Self-heal:** if the error overlay appears on a slow network but EC then finishes loading anyway, the overlay should **dismiss itself** and drop you into the live call (it no longer strands you on the error screen). Worth confirming on a deliberately throttled-but-not-blocked connection.
+- **Self-heal:** if the error overlay appears on a slow network but EC then finishes loading anyway, the overlay should **dismiss itself** and drop you into the live call. Worth confirming on a deliberately throttled-but-not-blocked connection.
 
 ---
 
@@ -342,6 +342,25 @@ Trigger a desktop/browser notification for a new message.
 
 ---
 
+## L. Open bugs flagged by audit — reproduction needed before fix
+
+### L1. AFK auto-mute keeps the OS microphone indicator lit (N95) — 👥 live call
+
+**Context:** `useAfkAutoMute.ts` calls `getUserMedia({ audio: true })` independently of Element Call's managed stream. When you mute in the Lotus UI, the LiveKit mic inside EC's iframe is muted via the widget API — but the separate `MediaStream` held by the AFK hook keeps its tracks running. The OS-level recording indicator (green dot on macOS, mic icon on Windows/Linux) therefore stays lit while your mic is muted.
+
+**To reproduce:**
+
+1. Enable **AFK auto-mute** in Settings → Calls and **join a call**.
+2. Manually **mute your mic** using the call controls.
+3. Check the **OS recording indicator** (macOS: green dot top-right of menu bar; Windows: mic icon in taskbar).
+
+**Expected (current broken behavior):** the OS recording indicator stays on even though your Lotus mic shows muted.
+**Expected after fix:** the indicator should clear when you mute and re-appear when you unmute.
+
+> **Note:** This is an **open bug** — no fix has been applied yet. Reproduce and confirm the symptom first. The fix involves stopping `MediaStream` tracks on mute and re-requesting `getUserMedia` on unmute (see LOTUS_BUGS.md N95 for full details). Once fixed, re-run this check to verify the indicator clears.
+
+---
+
 ## Priority if you're short on time
 
 1. **A4** (in-call banner) + **A3** (ringtone) — newest, most logic, hardest to reproduce.
diff --git a/LOTUS_TODO.md b/LOTUS_TODO.md
index 725b6e443..5647409b1 100644
--- a/LOTUS_TODO.md
+++ b/LOTUS_TODO.md
@@ -543,6 +543,7 @@ Exhaustive, low-level implementation details for backlog items. Follow these pat
 **Mechanism:** KaTeX injection into the HTML parser.
 
 - **Sanitizer (`src/app/utils/sanitize.ts`):** Allow KaTeX-specific tags and classes (e.g., `span`, `annotation`, `math`). Use a specialized allowed list for math blocks.
+  > [Gemini_Found] `sanitize.ts` uses **`sanitize-html`** (not DOMPurify) with an explicit allowlist (`allowedTags`) and `disallowedTagsMode: 'discard'`. All MathML tags are currently absent from the allowlist and are silently stripped. Update `permittedHtmlTags` to include: `<math>`, `<mi>`, `<mo>`, `<mn>`, `<ms>`, `<mtext>`, `<mspace>`, `<mrow>`, `<mfrac>`, `<msqrt>`, `<mroot>`, `<mstyle>`, `<merror>`, `<mpadded>`, `<mphantom>`, `<mfenced>`, `<menclose>`, `<msub>`, `<msup>`, `<msubsup>`, `<munder>`, `<mover>`, `<munderover>`, `<mmultiscripts>`, `<mtable>`, `<mtr>`, `<mtd>`, `<maligngroup>`, `<malignmark>`, and `annotation`. Also add the required MathML attributes (e.g. `xmlns`, `display`, `mathvariant`) to `permittedTagToAttributes`.
 - **Parser (`src/app/plugins/react-custom-html-parser.tsx`):** Detect `$ ... $` and `$$ ... $$` patterns in text nodes:
   ```tsx
   if (node.type === 'text') {
@@ -592,12 +593,16 @@ Exhaustive, low-level implementation details for backlog items. Follow these pat
 - Route the mic `MediaStream` and the clip source to the destination node.
 - Pass the destination's `.stream` to the call bridge.
 
+> ⚠️ **[Gemini_Found — CORRECTED]** Gemini originally suggested using LiveKit's `LocalAudioTrack.replaceTrack()` to mix audio into the call stream. This is **not possible** from Lotus Chat's realm: Element Call runs in a **cross-origin iframe** controlled via `matrix-widget-api` (postMessage). LiveKit's JS SDK and its `LocalAudioTrack` live inside EC's sandboxed context — inaccessible from our code. This directly contradicts the confirmed constraint already listed in the Server Capabilities table: *"Cindy CANNOT inject audio into EC call stream — In-call soundboard must be redesigned as local-only."* The soundboard must be a local-playback-only feature (output through the user's speakers, not mixed into the call audio stream).
+
 ---
 
 ### P5-20 · Quick Reply from Browser Notification
 
 **Mechanism:** Service Worker `notificationclick` Action.
 
+> [Gemini_Found] Implementation detail: `serviceWorkerRegistration.showNotification()` should be used instead of `new Notification()` so that the service worker can listen to the `notificationclick` event. `new Notification()` creates notifications that are bound to the client page, not the SW.
+
 ```typescript
 // src/sw.ts
 self.addEventListener('notificationclick', (event) => {
diff --git a/src/app/features/call/CallView.tsx b/src/app/features/call/CallView.tsx
index 2edef8910..08d53f4c3 100644
--- a/src/app/features/call/CallView.tsx
+++ b/src/app/features/call/CallView.tsx
@@ -164,7 +164,7 @@ function CallLoadErrorMessage() {
   const setCallEmbed = useSetAtom(callEmbedAtom);
 
   // Disposing the embed tears down the hung iframe and returns the user to the
-  // prescreen, from which they can join again ("Retry") or simply walk away.
+  // prescreen, where they can choose to join again.
   const dismiss = () => setCallEmbed(undefined);
 
   return (
@@ -180,11 +180,8 @@ function CallLoadErrorMessage() {
         The call failed to load. Check your connection and try again.
       </Text>
       <Box gap="200" alignItems="Center">
-        <Button variant="Primary" size="300" radii="400" onClick={dismiss}>
-          <Text size="B400">Retry</Text>
-        </Button>
         <Button variant="Secondary" fill="Soft" size="300" radii="400" onClick={dismiss}>
-          <Text size="B400">Leave</Text>
+          <Text size="B400">Back</Text>
         </Button>
       </Box>
     </Box>