fix(room-nav): expiring timed mute no longer clobbers a manual mode change

unmuteRoom unconditionally reset the room to Unset when a timed mute expired
(in-session timer and boot-time restore alike), silently reverting a mode the
user had changed by hand during the window. Mute-timer helpers move to
muteTimers.ts; unmuteRoom now reads the live push-rule mode and only resets
when it is still Mute, always dropping the persisted timer. Unit-tested.

Fixes #21

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA

README.md

@@ -22,7 +22,7 @@ The Lotus Chat logo (`public/res/Lotus.png`) is a derivative work based on the o
 - Slack-style thread notifications: by default you're only pinged for threads you're in or where you're @mentioned; set any thread to All / Mentions-only / Mute from the panel's bell menu (muted threads stop bumping badges; syncs across devices)
 - See who has read each message, and track delivery status (sending / sent / failed)
 - Bookmark any message and revisit saved messages from the sidebar
-- Schedule messages to send at a specific time
+- Schedule messages to send at a specific time (unencrypted rooms only — MSC4140 delayed events cannot be end-to-end encrypted, so the option is hidden in E2EE rooms)
 - Click "edited" on any message to see the full edit history
 - Drafts are saved automatically and survive page reloads
 - Long messages collapse automatically — click "Read more" to expand

src/app/components/CallEmbedProvider.tsx

@@ -58,6 +58,7 @@ import { ExitFullscreenIcon, FullscreenIcon } from '../features/call/Controls';
 import { useTheme, ThemeKind } from '../hooks/useTheme';
 import { useReducedMotion } from '../hooks/useReducedMotion';
 import { useSetting } from '../state/hooks/settings';
+import { useCallPreferences } from '../state/hooks/callPreferences';
 import { settingsAtom } from '../state/settings';
 import { getStateEvent, getStateEvents, getMemberName } from '../utils/room';
 import { StateEvent } from '../../types/matrix/room';
@@ -410,6 +411,8 @@ function IncomingCallListener({ callEmbed, joined }: IncomingCallListenerProps)
   const [callInfo, setCallInfo] = useState<IncomingCallInfo>();
   const dm = callInfo ? directs.has(callInfo.room.roomId) : false;
   const startCall = useCallStart(dm);
+  const { microphone, sound } = useCallPreferences();
+  const [cameraOnJoin] = useSetting(settingsAtom, 'cameraOnJoin');
 
   // C-L6: handleTimelineEvent awaits decryption before calling setState; guard
   // against the component unmounting during that await.
@@ -566,11 +569,15 @@ function IncomingCallListener({ callEmbed, joined }: IncomingCallListenerProps)
 
   const handleAnswer = useCallback(
     (room: Room, video: boolean) => {
-      startCall(room, { microphone: true, video, sound: true });
+      // Honour cameraOnJoin and the persisted mic/sound preferences instead of
+      // forcing camera+mic+sound on — every other join path does this, and
+      // Answer was skipping it, publishing the camera with no prescreen.
+      // (PTT's forceAudioOff is applied downstream inside useCallStart.)
+      startCall(room, { microphone, video: cameraOnJoin && video, sound });
       setCallInfo(undefined);
       navigateRoom(room.roomId);
     },
-    [startCall, navigateRoom],
+    [startCall, navigateRoom, microphone, sound, cameraOnJoin],
   );
 
   if (!callInfo) return null;

src/app/components/seasonal/themes/Halloween.tsx

@@ -164,7 +164,7 @@ export function HalloweenOverlay({ reduced }: SeasonalOverlayProps) {
               height: `${f.height}px`,
               backgroundImage: `radial-gradient(60% 100% at 50% 100%, ${FOG_TINT} 0%, transparent 75%)`,
               filter: 'blur(14px)',
-              willChange: 'transform, opacity',
+              willChange: reduced ? undefined : 'transform, opacity',
               opacity: reduced ? 0.5 : undefined,
               transform: reduced ? 'translate3d(2%, 0, 0) scale(1.18)' : undefined,
               animation: reduced

src/app/features/call/Controls.tsx

@@ -74,7 +74,8 @@ export function SoundButton({ enabled, onToggle }: SoundButtonProps) {
           size="400"
           className={MobileTouchTarget}
           onClick={() => onToggle()}
-          aria-label={enabled ? 'Undeafen' : 'Deafen'}
+          aria-label={enabled ? 'Deafen' : 'Undeafen'}
+          aria-pressed={enabled}
           outlined
         >
           <Icon

src/app/features/room-nav/RoomNavItem.tsx

@@ -6,7 +6,7 @@ import React, {
   useRef,
   useState,
 } from 'react';
-import { MatrixClient, Room } from 'matrix-js-sdk';
+import { Room } from 'matrix-js-sdk';
 import {
   Avatar,
   Box,
@@ -69,6 +69,7 @@ import {
   setRoomNotificationPreference,
 } from '../../hooks/useRoomsNotificationPreferences';
 import { RoomNotificationModeSwitcher } from '../../components/RoomNotificationSwitcher';
+import { scheduleMuteTimer, unmuteRoom } from './muteTimers';
 import { getRoomCreatorsForRoomId, useRoomCreators } from '../../hooks/useRoomCreators';
 import { getRoomPermissionsAPI, useRoomPermissions } from '../../hooks/useRoomPermissions';
 import { InviteUserPrompt } from '../../components/invite-user-prompt';
@@ -274,47 +275,6 @@ function RenameRoomDialog({ room, onClose }: RenameRoomDialogProps) {
   );
 }
 
-// localStorage key for timed mute timers
-export const MUTE_TIMERS_KEY = 'io.lotus.mute_timers';
-
-// setTimeout's delay is a signed 32-bit int; larger values overflow and fire
-// immediately. Clamp long delays to this max (~24.8 days).
-export const MAX_MUTE_TIMEOUT_MS = 2_147_483_647;
-
-export type MuteTimerEntry = { roomId: string; unmuteAt: number };
-
-export function loadMuteTimers(): MuteTimerEntry[] {
-  try {
-    const parsed = JSON.parse(localStorage.getItem(MUTE_TIMERS_KEY) ?? '[]');
-    return Array.isArray(parsed) ? parsed : [];
-  } catch {
-    return [];
-  }
-}
-
-export function saveMuteTimers(timers: MuteTimerEntry[]): void {
-  localStorage.setItem(MUTE_TIMERS_KEY, JSON.stringify(timers));
-}
-
-// Reverse a timed mute: restore the room's notification mode to Unset and drop
-// its persisted timer. Shared by the in-session timer and the boot-time restore.
-export async function unmuteRoom(mx: MatrixClient, roomId: string): Promise<void> {
-  await setRoomNotificationPreference(
-    mx,
-    roomId,
-    RoomNotificationMode.Unset,
-    RoomNotificationMode.Mute,
-  ).catch(() => {});
-  saveMuteTimers(loadMuteTimers().filter((e) => e.roomId !== roomId));
-}
-
-function scheduleMuteTimer(roomId: string, durationMs: number, onUnmute: () => void): void {
-  const unmuteAt = Date.now() + durationMs;
-  const existing = loadMuteTimers().filter((e) => e.roomId !== roomId);
-  saveMuteTimers([...existing, { roomId, unmuteAt }]);
-  setTimeout(onUnmute, Math.min(durationMs, MAX_MUTE_TIMEOUT_MS));
-}
-
 type RoomNavItemMenuProps = {
   room: Room;
   requestClose: () => void;

src/app/features/room-nav/muteTimers.test.ts

@@ -0,0 +1,20 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { RoomNotificationMode } from '../../hooks/useRoomsNotificationPreferences';
+import { shouldResetMuteOnUnmute } from './muteTimers';
+
+test('resets to Unset when the room is still Mute at expiry', () => {
+  assert.equal(shouldResetMuteOnUnmute(RoomNotificationMode.Mute), true);
+});
+
+test('does not reset when the user switched to All messages during the mute window', () => {
+  assert.equal(shouldResetMuteOnUnmute(RoomNotificationMode.AllMessages), false);
+});
+
+test('does not reset when the user switched to Special messages during the mute window', () => {
+  assert.equal(shouldResetMuteOnUnmute(RoomNotificationMode.SpecialMessages), false);
+});
+
+test('does not reset when the mode is already Unset', () => {
+  assert.equal(shouldResetMuteOnUnmute(RoomNotificationMode.Unset), false);
+});

src/app/features/room-nav/muteTimers.ts

@@ -0,0 +1,88 @@
+import { IPushRule, IPushRules, MatrixClient } from 'matrix-js-sdk';
+import { AccountDataEvent } from '../../../types/matrix/accountData';
+import { getAccountData } from '../../utils/room';
+import { getNotificationMode, NotificationMode } from '../../hooks/useNotificationMode';
+import {
+  RoomNotificationMode,
+  setRoomNotificationPreference,
+} from '../../hooks/useRoomsNotificationPreferences';
+
+// localStorage key for timed mute timers
+export const MUTE_TIMERS_KEY = 'io.lotus.mute_timers';
+
+// setTimeout's delay is a signed 32-bit int; larger values overflow and fire
+// immediately. Clamp long delays to this max (~24.8 days).
+export const MAX_MUTE_TIMEOUT_MS = 2_147_483_647;
+
+export type MuteTimerEntry = { roomId: string; unmuteAt: number };
+
+export function loadMuteTimers(): MuteTimerEntry[] {
+  try {
+    const parsed = JSON.parse(localStorage.getItem(MUTE_TIMERS_KEY) ?? '[]');
+    return Array.isArray(parsed) ? parsed : [];
+  } catch {
+    return [];
+  }
+}
+
+export function saveMuteTimers(timers: MuteTimerEntry[]): void {
+  localStorage.setItem(MUTE_TIMERS_KEY, JSON.stringify(timers));
+}
+
+// Pure decision for the unmute guard: a timed mute should only be reset back to
+// Unset if the room's notification mode is still Mute at expiry time. If the user
+// manually changed it (e.g. to All messages) while the timer was pending, leave
+// their choice alone — just let the stale timer entry get dropped.
+export function shouldResetMuteOnUnmute(currentMode: RoomNotificationMode): boolean {
+  return currentMode === RoomNotificationMode.Mute;
+}
+
+// Reads the room's live notification mode straight from account data push rules,
+// mirroring useRoomsNotificationPreferences' per-room derivation, without needing
+// the React hook (this runs from plain timers/effects, not components).
+export function getLiveRoomNotificationMode(
+  mx: MatrixClient,
+  roomId: string,
+): RoomNotificationMode {
+  const pushRules = getAccountData(mx, AccountDataEvent.PushRules)?.getContent<IPushRules>();
+  const global = pushRules?.global;
+
+  const overrideRule = global?.override?.find((rule: IPushRule) => rule.rule_id === roomId);
+  if (overrideRule && getNotificationMode(overrideRule.actions) === NotificationMode.OFF) {
+    return RoomNotificationMode.Mute;
+  }
+
+  const roomRule = global?.room?.find((rule: IPushRule) => rule.rule_id === roomId);
+  if (roomRule) {
+    return getNotificationMode(roomRule.actions) === NotificationMode.OFF
+      ? RoomNotificationMode.SpecialMessages
+      : RoomNotificationMode.AllMessages;
+  }
+
+  return RoomNotificationMode.Unset;
+}
+
+// Reverse a timed mute: restore the room's notification mode to Unset and drop
+// its persisted timer. Shared by the in-session timer and the boot-time restore.
+// Only resets the mode if it is still Mute — otherwise a manual change made
+// during the mute window (e.g. switching to "All messages") would silently get
+// reverted when the stale timer fires.
+export async function unmuteRoom(mx: MatrixClient, roomId: string): Promise<void> {
+  const currentMode = getLiveRoomNotificationMode(mx, roomId);
+  if (shouldResetMuteOnUnmute(currentMode)) {
+    await setRoomNotificationPreference(
+      mx,
+      roomId,
+      RoomNotificationMode.Unset,
+      RoomNotificationMode.Mute,
+    ).catch(() => {});
+  }
+  saveMuteTimers(loadMuteTimers().filter((e) => e.roomId !== roomId));
+}
+
+export function scheduleMuteTimer(roomId: string, durationMs: number, onUnmute: () => void): void {
+  const unmuteAt = Date.now() + durationMs;
+  const existing = loadMuteTimers().filter((e) => e.roomId !== roomId);
+  saveMuteTimers([...existing, { roomId, unmuteAt }]);
+  setTimeout(onUnmute, Math.min(durationMs, MAX_MUTE_TIMEOUT_MS));
+}

src/app/features/room/RoomInput.tsx

@@ -105,6 +105,7 @@ import {
   settingsAtom,
 } from '../../state/settings';
 import {
+  buildCompressedUploadItem,
   getAudioMsgContent,
   getFileMsgContent,
   getImageMsgContent,
@@ -244,8 +245,11 @@ export const RoomInput = forwardRef<HTMLDivElement, RoomInputProps>(
     const showLocation = composerToolbarButtons?.showLocation ?? true;
     const showPoll = composerToolbarButtons?.showPoll ?? true;
     const showVoice = composerToolbarButtons?.showVoice ?? true;
-    // Schedule-send is hidden in thread mode (v1 reduction).
-    const showSchedule = (composerToolbarButtons?.showSchedule ?? true) && !threadRootId;
+    // Schedule-send is hidden in thread mode (v1 reduction) and in encrypted rooms:
+    // MSC4140 delayed events are PUT as plaintext m.room.message, bypassing the
+    // SDK's encryption pipeline, so scheduling in an E2EE room would leak the body.
+    const showSchedule =
+      (composerToolbarButtons?.showSchedule ?? true) && !threadRootId && !isEncrypted;
     const composerButtonOrder = useMemo(
       () => normalizeComposerToolbarOrder(composerToolbarButtons?.order),
       [composerToolbarButtons?.order],
@@ -485,22 +489,29 @@ export const RoomInput = forwardRef<HTMLDivElement, RoomInputProps>(
               const compressedFile = new File([compressionResult.blob], compressedName, {
                 type: compressedType,
               });
-              const uploadRes = await mx.uploadContent(compressedFile, {
-                name: compressedName,
-                type: compressedType,
-              });
+              // Compression re-encodes the image, so in an encrypted room the new
+              // bytes must be encrypted before upload (and the event must carry the
+              // *new* encInfo) — reusing the original's encInfo would publish the
+              // image in the clear and yield an undecryptable attachment.
+              const encrypted = fileItem.encInfo ? await encryptFile(compressedFile) : undefined;
+              const uploadRes = encrypted
+                ? await mx.uploadContent(encrypted.file)
+                : await mx.uploadContent(compressedFile, {
+                    name: compressedName,
+                    type: compressedType,
+                  });
               const compressedMxc = (uploadRes as { content_uri: string }).content_uri;
               if (compressedMxc) {
                 // Delete the pre-uploaded original so only one copy lives on the server.
                 tryDeleteMxcContent(mx, upload.mxc);
                 mxc = compressedMxc;
-                // Build a synthetic fileItem that refers to the compressed file so
-                // getImageMsgContent picks up the correct dimensions and type.
-                const compressedItem = {
-                  ...fileItem,
-                  file: compressedFile,
-                  originalFile: compressedFile,
-                };
+                // Synthetic fileItem referring to the compressed file so
+                // getImageMsgContent picks up the correct dimensions, type and encInfo.
+                const compressedItem = buildCompressedUploadItem(
+                  fileItem,
+                  compressedFile,
+                  encrypted,
+                );
                 return getImageMsgContent(mx, compressedItem, mxc);
               }
             }
@@ -697,11 +708,14 @@ export const RoomInput = forwardRef<HTMLDivElement, RoomInputProps>(
     }, [editor, isMarkdown, mx, roomId, replyDraft]);
 
     const handleScheduleClick = useCallback(() => {
+      // Defense in depth: scheduling sends an unencrypted m.room.message, so never
+      // open the modal for an encrypted room even if the button somehow renders.
+      if (isEncrypted) return;
       // Pre-fill from editor if there's content; open blank if editor is empty.
       const content = buildCurrentTextContent();
       setScheduleContent(content);
       setScheduleOpen(true);
-    }, [buildCurrentTextContent]);
+    }, [buildCurrentTextContent, isEncrypted]);
 
     const handleScheduled = useCallback(
       (delayId: string, sendAt: number, content: IContent) => {
@@ -823,18 +837,38 @@ export const RoomInput = forwardRef<HTMLDivElement, RoomInputProps>(
             return;
           }
 
-          const uploadRes = await mx.uploadContent(
-            new File([blob], 'image.gif', { type: 'image/gif' }),
-            { type: 'image/gif', name: 'image.gif', includeFilename: false },
-          );
-          const mxcUrl = (uploadRes as { content_uri: string }).content_uri;
-          if (!mxcUrl) return;
-          mx.sendMessage(roomId, threadRootId ?? null, {
+          const gifFile = new File([blob], 'image.gif', { type: 'image/gif' });
+          const baseContent = {
             msgtype: MsgType.Image,
             body: 'image.gif',
-            url: mxcUrl,
             info: { mimetype: 'image/gif', w, h, size: blob.size },
-          });
+          };
+
+          // Mirror the attachment/voice paths: in an encrypted room the media
+          // itself must be encrypted, otherwise the homeserver (and anyone with
+          // the mxc URI) can see the GIF even though the event body is encrypted.
+          if (room.hasEncryptionStateEvent()) {
+            const { encInfo, file: encBlob } = await encryptFile(gifFile);
+            const uploadRes = await mx.uploadContent(encBlob);
+            const mxcUrl = (uploadRes as { content_uri: string }).content_uri;
+            if (!mxcUrl) return;
+            mx.sendMessage(roomId, threadRootId ?? null, {
+              ...baseContent,
+              file: { ...encInfo, url: mxcUrl },
+            } as any);
+          } else {
+            const uploadRes = await mx.uploadContent(gifFile, {
+              type: 'image/gif',
+              name: 'image.gif',
+              includeFilename: false,
+            });
+            const mxcUrl = (uploadRes as { content_uri: string }).content_uri;
+            if (!mxcUrl) return;
+            mx.sendMessage(roomId, threadRootId ?? null, {
+              ...baseContent,
+              url: mxcUrl,
+            } as any);
+          }
         } catch (e) {
           console.error('GIF send failed:', e instanceof Error ? e.message : 'unknown error');
           if (!alive()) return;
@@ -844,7 +878,7 @@ export const RoomInput = forwardRef<HTMLDivElement, RoomInputProps>(
           if (alive()) setGifUploading(false);
         }
       },
-      [mx, roomId, threadRootId, alive],
+      [mx, room, roomId, threadRootId, alive],
     );
 
     const handleStickerSelect = useCallback(

src/app/features/room/msgContent.compressedItem.test.ts

@@ -0,0 +1,73 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { EncryptedAttachmentInfo } from 'browser-encrypt-attachment';
+import { buildCompressedUploadItem } from './msgContent';
+import { TUploadItem } from '../../state/room/roomInputDrafts';
+
+// buildCompressedUploadItem decides which bytes are uploaded and which encInfo
+// (if any) the resulting m.image event carries. Getting this wrong either leaks
+// a plaintext image into an E2EE room or produces an undecryptable attachment.
+
+const enc = (tag: string): EncryptedAttachmentInfo =>
+  ({
+    v: 'v2',
+    key: { alg: 'A256CTR', k: tag },
+    iv: `iv-${tag}`,
+    hashes: { sha256: `sha-${tag}` },
+  }) as unknown as EncryptedAttachmentInfo;
+
+const fakeFile = (name: string, size: number): File =>
+  new File([new Uint8Array(size)], name, { type: 'image/jpeg' });
+
+const makeItem = (encInfo?: EncryptedAttachmentInfo): TUploadItem =>
+  ({
+    file: fakeFile('photo.png', 900),
+    originalFile: fakeFile('photo.png', 900),
+    encInfo,
+    metadata: { markedAsSpoiler: false, compressImage: true },
+  }) as unknown as TUploadItem;
+
+test('unencrypted room: compressed item uploads the plain file and carries no encInfo', () => {
+  const compressed = fakeFile('photo.jpg', 300);
+  const item = buildCompressedUploadItem(makeItem(), compressed);
+
+  assert.equal(item.file, compressed);
+  assert.equal(item.originalFile, compressed);
+  assert.equal(item.encInfo, undefined);
+});
+
+test('encrypted room: compressed item carries the NEW encInfo, never the original one', () => {
+  const compressed = fakeFile('photo.jpg', 300);
+  const encryptedBlob = fakeFile('photo.jpg', 320);
+  const item = buildCompressedUploadItem(makeItem(enc('original')), compressed, {
+    file: encryptedBlob,
+    encInfo: enc('compressed'),
+  });
+
+  // The ciphertext is what gets uploaded; the plaintext stays available for
+  // dimensions/blurhash only.
+  assert.equal(item.file, encryptedBlob);
+  assert.equal(item.originalFile, compressed);
+  assert.deepEqual(item.encInfo, enc('compressed'));
+  assert.notDeepEqual(item.encInfo, enc('original'));
+});
+
+test('encrypted room: an encInfo-less compressed item never inherits the original encInfo', () => {
+  // Defensive: even if the caller forgets to re-encrypt, we must not emit the
+  // stale encInfo (that is the bug this helper exists to prevent).
+  const item = buildCompressedUploadItem(makeItem(enc('original')), fakeFile('photo.jpg', 300));
+  assert.equal(item.encInfo, undefined);
+});
+
+test('metadata (caption, spoiler) is preserved on the compressed item', () => {
+  const base = makeItem();
+  base.metadata.caption = 'a caption';
+  base.metadata.markedAsSpoiler = true;
+  const item = buildCompressedUploadItem(base, fakeFile('photo.jpg', 300));
+  assert.equal(item.metadata.caption, 'a caption');
+  assert.equal(item.metadata.markedAsSpoiler, true);
+});
+
+// getImageMsgContent itself is not covered here: it needs a DOM (loadImageElement).
+// Its encInfo branch (content.file vs content.url) is exercised by the sibling
+// msgContent.test.ts builders, which share the same shape.

src/app/features/room/msgContent.ts

@@ -1,5 +1,6 @@
 import { IContent, MatrixClient, MsgType } from 'matrix-js-sdk';
 import to from 'await-to-js';
+import { EncryptedAttachmentInfo } from 'browser-encrypt-attachment';
 import {
   IThumbnailContent,
   MATRIX_BLUR_HASH_PROPERTY_NAME,
@@ -43,6 +44,28 @@ const generateThumbnailContent = async (
   return thumbnailContent;
 };
 
+/**
+ * Build the synthetic upload item for a *re-encoded* (compressed) image.
+ *
+ * The compressed bytes are a brand new payload, so the item must never inherit
+ * the original's `encInfo` — that key/iv/sha256 describes the pre-compression
+ * ciphertext and would make receivers fail to decrypt. In an encrypted room the
+ * caller re-runs `encryptFile` and passes the new ciphertext + encInfo here; in
+ * an unencrypted room both are omitted and the item carries no `encInfo` at all.
+ */
+export const buildCompressedUploadItem = (
+  item: TUploadItem,
+  compressedFile: File,
+  encrypted?: { file: File; encInfo: EncryptedAttachmentInfo },
+): TUploadItem => ({
+  ...item,
+  // `file` is what gets uploaded/described, `originalFile` is the plaintext used
+  // for dimensions + blurhash.
+  file: encrypted?.file ?? compressedFile,
+  originalFile: compressedFile,
+  encInfo: encrypted?.encInfo,
+});
+
 export const getImageMsgContent = async (
   mx: MatrixClient,
   item: TUploadItem,

src/app/features/settings/notifications/PushRuleEditor.tsx

@@ -18,6 +18,7 @@ import { useMatrixClient } from '../../../hooks/useMatrixClient';
 import { AsyncStatus, useAsyncCallback } from '../../../hooks/useAsyncCallback';
 import {
   getNotificationModeActions,
+  getNotificationModeOptionsFromActions,
   NotificationMode,
   useNotificationModeActions,
 } from '../../../hooks/useNotificationMode';
@@ -131,7 +132,13 @@ type RuleModeSwitcherProps = {
 
 function RuleModeSwitcher({ kind, pushRule }: RuleModeSwitcherProps) {
   const mx = useMatrixClient();
-  const getModeActions = useNotificationModeActions();
+  // Preserve any `highlight`/custom sound tweak already on the rule — otherwise
+  // switching mode here rebuilds actions from scratch and silently drops them.
+  const options = useMemo(
+    () => getNotificationModeOptionsFromActions(pushRule.actions),
+    [pushRule.actions],
+  );
+  const getModeActions = useNotificationModeActions(options);
 
   const handleChange = useCallback(
     async (mode: NotificationMode) => {

src/app/hooks/useNotificationMode.test.ts

@@ -0,0 +1,42 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { PushRuleActionName, TweakName } from 'matrix-js-sdk';
+import { getNotificationModeOptionsFromActions } from './useNotificationMode';
+
+test('getNotificationModeOptionsFromActions: no tweaks -> no highlight, no sound value', () => {
+  const options = getNotificationModeOptionsFromActions([PushRuleActionName.Notify]);
+  assert.deepEqual(options, { soundValue: undefined, highlight: false });
+});
+
+test('getNotificationModeOptionsFromActions: picks up highlight: true', () => {
+  const options = getNotificationModeOptionsFromActions([
+    PushRuleActionName.Notify,
+    { set_tweak: TweakName.Highlight, value: true },
+  ]);
+  assert.equal(options.highlight, true);
+});
+
+test('getNotificationModeOptionsFromActions: highlight: false is not treated as set', () => {
+  const options = getNotificationModeOptionsFromActions([
+    PushRuleActionName.Notify,
+    { set_tweak: TweakName.Highlight, value: false },
+  ]);
+  assert.equal(options.highlight, false);
+});
+
+test('getNotificationModeOptionsFromActions: picks up a custom sound value', () => {
+  const options = getNotificationModeOptionsFromActions([
+    PushRuleActionName.Notify,
+    { set_tweak: TweakName.Sound, value: 'ping.ogg' },
+  ]);
+  assert.equal(options.soundValue, 'ping.ogg');
+});
+
+test('getNotificationModeOptionsFromActions: picks up both tweaks together', () => {
+  const options = getNotificationModeOptionsFromActions([
+    PushRuleActionName.Notify,
+    { set_tweak: TweakName.Sound, value: 'ping.ogg' },
+    { set_tweak: TweakName.Highlight, value: true },
+  ]);
+  assert.deepEqual(options, { soundValue: 'ping.ogg', highlight: true });
+});

src/app/hooks/useNotificationMode.ts

@@ -49,6 +49,29 @@ export const getNotificationModeActions = (
   return actions;
 };
 
+// Derive the options that would reproduce an existing rule's tweaks, so a mode
+// switch rebuilds actions on top of them instead of silently dropping a
+// `highlight` tweak (or a custom sound) that isn't part of the mode itself.
+export const getNotificationModeOptionsFromActions = (
+  actions: PushRuleAction[],
+): NotificationModeOptions => {
+  const soundTweak = actions.find(
+    (action) => typeof action === 'object' && action.set_tweak === TweakName.Sound,
+  );
+  const highlightTweak = actions.find(
+    (action) => typeof action === 'object' && action.set_tweak === TweakName.Highlight,
+  );
+
+  return {
+    soundValue:
+      soundTweak && typeof soundTweak === 'object' && typeof soundTweak.value === 'string'
+        ? soundTweak.value
+        : undefined,
+    highlight:
+      !!highlightTweak && typeof highlightTweak === 'object' && highlightTweak.value !== false,
+  };
+};
+
 export type GetNotificationModeCallback = (mode: NotificationMode) => PushRuleAction[];
 export const useNotificationModeActions = (
   options?: NotificationModeOptions,

src/app/pages/client/ClientNonUIFeatures.tsx

@@ -51,7 +51,7 @@ import {
   MuteTimerEntry,
   loadMuteTimers,
   unmuteRoom,
-} from '../../features/room-nav/RoomNavItem';
+} from '../../features/room-nav/muteTimers';
 import { STATUS_EXPIRY_KEY, STATUS_MSG_KEY } from '../../features/settings/account/Profile';
 import { useDeepLinkNavigate } from '../../hooks/useDeepLinkNavigate';
 import { toastQueueAtom } from '../../state/toast';

src/app/utils/scheduledMessages.encryption.test.ts

@@ -0,0 +1,49 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+
+import { scheduleMessage } from './scheduledMessages';
+
+// MSC4140 delayed events are PUT as a plaintext m.room.message, so scheduling
+// must be refused outright for encrypted rooms — the composer hides the button,
+// this guard stops any other caller from regressing it.
+const makeMx = (encrypted: boolean | undefined) => {
+  const calls: unknown[][] = [];
+  const mx = {
+    getRoom: (_roomId: string) =>
+      encrypted === undefined ? null : { hasEncryptionStateEvent: () => encrypted },
+    http: {
+      authedRequest: (...args: unknown[]) => {
+        calls.push(args);
+        return Promise.resolve({ delay_id: 'delay-1' });
+      },
+    },
+  };
+  return { mx: mx as never, calls };
+};
+
+test('scheduleMessage throws and sends nothing for an encrypted room', async () => {
+  const { mx, calls } = makeMx(true);
+  await assert.rejects(
+    () => scheduleMessage(mx, '!enc:lotusguild.org', { body: 'secret' }, Date.now() + 60_000),
+    /encrypted rooms/,
+  );
+  assert.equal(calls.length, 0);
+});
+
+test('scheduleMessage still sends for an unencrypted room', async () => {
+  const { mx, calls } = makeMx(false);
+  const delayId = await scheduleMessage(
+    mx,
+    '!plain:lotusguild.org',
+    { body: 'hi' },
+    Date.now() + 60_000,
+  );
+  assert.equal(delayId, 'delay-1');
+  assert.equal(calls.length, 1);
+});
+
+test('scheduleMessage sends when the room is unknown to the client', async () => {
+  const { mx, calls } = makeMx(undefined);
+  await scheduleMessage(mx, '!unknown:lotusguild.org', { body: 'hi' }, Date.now() + 60_000);
+  assert.equal(calls.length, 1);
+});

src/app/utils/scheduledMessages.ts

@@ -12,6 +12,13 @@ export async function scheduleMessage(
   content: IContent,
   sendAtMs: number,
 ): Promise<string> {
+  // MSC4140 delayed events are PUT straight to /send/m.room.message, bypassing
+  // the SDK's encryptEventIfNeeded pipeline — the body would land on the server
+  // (and later in the timeline) in the clear. Refuse rather than leak; the
+  // composer also hides the Schedule button in encrypted rooms.
+  if (mx.getRoom?.(roomId)?.hasEncryptionStateEvent()) {
+    throw new Error('Scheduled messages are not supported in encrypted rooms.');
+  }
   // A past/near target floors at 1000ms (send ~immediately) — an intentional,
   // tested contract; the ScheduleMessageModal already guards ≥60s in the future.
   const delayMs = Math.max(1000, Math.round(sendAtMs - Date.now()));