feat: offline outbox — unsent messages survive reload and retry (#112)

Until now a send that failed (offline, homeserver down, a blip) went
straight to "Failed to send": nothing retried it, and a reload dropped it
without trace (chronological pending ordering keeps local echoes in memory
only).

- Outbox (utils/outbox.ts + features/outbox/OutboxFeature): own message
  sends (text, stickers, reactions, polls; not call signalling or
  redactions) are mirrored to localStorage from their first local echo until
  the server confirms them or the user cancels.
- After a reload they come back as local echoes via room.addPendingEvent,
  same shape as the SDK's own. Recent ones (< 1 h) are sent again with the
  same txnId; older ones come back as "Failed to send" for the user to
  retry or cancel. Ones the server already has (transaction id seen in
  /sync) are dropped, so no duplicates.
- Retries: network failures (ConnectionError, 408/429/5xx) are re-sent when
  the connection returns (sync recovers or the browser goes back online),
  and after a blip while online (5 s, backing off, max 10 per message).
  Oldest first, in order per room. 4xx / consent / encryption failures are
  left to the user.
- UI: a network failure while offline shows a clock, "Queued. Will send
  when you're back online" (thread view too), not the red ✕. The ✕ is now
  a button: click to retry.
- Logout wipes the outbox with the other plaintext caches (the content is
  decrypted, like drafts).

Tested end to end against a local Synapse (Chromium): offline → queued →
sent once on reconnect; homeserver unreachable → queued → sent once; failed
send → reload → sent once and shown once; server accepted but response lost
→ reload → no duplicate; 2 h old entry → failed, not sent, click ✕ → sent;
cancel → gone after reload; encrypted room → restored message goes out as
m.room.encrypted with no plaintext and decrypts; one-off failure retried by
itself in ~5 s; no page errors. Unit tests for the pure parts; Playwright
20 passed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA

e2e/local-homeserver.spec.ts

@@ -169,6 +169,56 @@ test.describe('local homeserver regression', () => {
     await ctx.close();
   });
 
+  test('a thread I started keeps its unread replies while I view the room (#217)', async ({
+    page,
+  }) => {
+    const room = await createRoom(alice, 'Thread Unread Room', { invite: [bob.userId] });
+    await joinRoom(bob, room);
+    const inThread = (root: string) => ({
+      'm.relates_to': {
+        rel_type: 'm.thread',
+        event_id: root,
+        is_falling_back: true,
+        'm.in_reply_to': { event_id: root },
+      },
+    });
+    const root = await sendText(alice, room, 'my thread root');
+    await loginUI(page, alice);
+    await openRoom(page, room);
+    // While the room is open and at the bottom: a thread reply, then a newer
+    // main-timeline message. Neither may clear the thread without opening it.
+    await sendText(bob, room, 'reply in your thread', inThread(root));
+    await sendText(bob, room, 'newer main message');
+    await expect(page.getByText('newer main message')).toBeVisible();
+    const chip = page
+      .locator('[data-message-item]', { hasText: 'my thread root' })
+      .getByRole('button', { name: /1 reply/ });
+    const threadUnread = async () => {
+      // not_types varies so Synapse's sync response cache can't serve a stale answer.
+      const filter = {
+        room: {
+          rooms: [room],
+          timeline: { limit: 1, unread_thread_notifications: true, not_types: [uniq('x.')] },
+        },
+      };
+      const sync = await api<{
+        rooms: {
+          join: Record<string, { unread_thread_notifications?: Record<string, unknown> }>;
+        };
+      }>(
+        'GET',
+        `/_matrix/client/v3/sync?timeout=0&filter=${enc(JSON.stringify(filter))}`,
+        alice.token,
+      );
+      return root in (sync.rooms.join[room]?.unread_thread_notifications ?? {});
+    };
+    await page.waitForTimeout(2000); // let any receipt the room view would send go out
+    expect(await threadUnread()).toBe(true);
+    await expect(chip).toHaveAccessibleName(/unread replies/);
+    await chip.click();
+    await expect.poll(threadUnread).toBe(false);
+  });
+
   test('timeline image opens the gallery lightbox (#219) @webkit', async ({ page }) => {
     const room = await createRoom(alice, 'Lightbox Room');
     const png = Buffer.from(

package-lock.json

@@ -81,7 +81,7 @@
       },
       "devDependencies": {
         "@axe-core/playwright": "4.13.0",
-        "@lotusguild/element-call-embedded": "0.25.0-lotus.16",
+        "@lotusguild/element-call-embedded": "0.25.0-lotus.22",
         "@playwright/test": "1.63.0",
         "@rollup/plugin-inject": "5.0.5",
         "@rollup/plugin-wasm": "6.2.2",
@@ -2695,9 +2695,9 @@
       "integrity": "sha512-dfLbk+PwWvFzSxwk3n5ySL0hfBog779o8h68wK/7/APo/7cgyWp5jcXockbxdk5kFRkbeXWm4Fbi9FrdN381sA=="
     },
     "node_modules/@lotusguild/element-call-embedded": {
-      "version": "0.25.0-lotus.16",
-      "resolved": "https://code.lotusguild.org/api/packages/LotusGuild/npm/%40lotusguild%2Felement-call-embedded/-/0.25.0-lotus.16/element-call-embedded-0.25.0-lotus.16.tgz",
-      "integrity": "sha512-X/MzZ2Ip7IpZD3B+SkBoBzgMfURyZuYD6OaGL9r7sw2nl7Y/0JzgpT8RWV12lu4DlOfWbbeO+ka1l+pTYVewdQ==",
+      "version": "0.25.0-lotus.22",
+      "resolved": "https://code.lotusguild.org/api/packages/LotusGuild/npm/%40lotusguild%2Felement-call-embedded/-/0.25.0-lotus.22/element-call-embedded-0.25.0-lotus.22.tgz",
+      "integrity": "sha512-AimDKZA4xUKEEyl2XUFUSUDl03tBKFv88T/3igKyH2VqNSPMGnqcQJC5HXIkHLTWrOmg8kLcJ//FFbqlUZiLcA==",
       "dev": true
     },
     "node_modules/@matrix-org/matrix-sdk-crypto-wasm": {

package.json

@@ -108,7 +108,7 @@
   },
   "devDependencies": {
     "@axe-core/playwright": "4.13.0",
-    "@lotusguild/element-call-embedded": "0.25.0-lotus.16",
+    "@lotusguild/element-call-embedded": "0.25.0-lotus.22",
     "@playwright/test": "1.63.0",
     "@rollup/plugin-inject": "5.0.5",
     "@rollup/plugin-wasm": "6.2.2",

src/app/components/CallEmbedProvider.tsx

@@ -38,7 +38,7 @@ import {
 } from '../hooks/useCallEmbed';
 import { callChatAtom, callEmbedAtom } from '../state/callEmbed';
 import { toastQueueAtom } from '../state/toast';
-import { CallEmbed, useCallControlState } from '../plugins/call';
+import { CallEmbed, useCallControlState, useScreensharePromptOpen } from '../plugins/call';
 import { hangupCallAndWait } from '../plugins/call/hangup';
 import { useSelectedRoom } from '../hooks/router/useSelectedRoom';
 import { ScreenSize, useScreenSizeContext } from '../hooks/useScreenSize';
@@ -78,9 +78,11 @@ import { getPowersLevelFromMatrixEvent } from '../hooks/usePowerLevels';
 import { getRoomCreatorsForRoomId } from '../hooks/useRoomCreators';
 import { getRoomPermissionsAPI } from '../hooks/useRoomPermissions';
 import { useLivekitSupport } from '../hooks/useLivekitSupport';
+import { useRoomCallPolicy } from '../hooks/useRoomCallPolicy';
 import { useNotificationsQuiet } from '../hooks/useNotificationsQuiet';
 import { CallAvatarAnimation } from '../styles/Animations.css';
 import { webRTCSupported } from '../utils/rtc';
+import { CallsUnavailableMessage } from '../features/call/CallsUnavailable';
 import { zIndices } from '../styles/zIndex';
 
 const PIP_MIN_W = 200;
@@ -230,13 +232,7 @@ function IncomingCall({ dm, info, onIgnore, onAnswer, onReject }: IncomingCallPr
                 </Text>
               )}
               {!webRTCSupported() && (
-                <Text
-                  style={{ margin: 'auto', color: color.Critical.Main }}
-                  size="L400"
-                  align="Center"
-                >
-                  Your browser does not support WebRTC, which is required for calling.
-                </Text>
+                <CallsUnavailableMessage roomId={room.roomId} actionLabel="Answer in browser" />
               )}
               <Box direction="Column" gap="300">
                 {willAnswerWithCamera && (
@@ -758,6 +754,12 @@ function CallUtils({ embed, joined }: { embed: CallEmbed; joined: boolean }) {
   useCallPolicyRevokedToast(embed, joined);
   useCallEndedToast(embed);
   useScreenshareNotices(embed);
+  // [Gitea #43] The in-frame screenshare button follows the same room policy
+  // as the host bar's (hidden where the server would refuse the share).
+  const { allowScreenshare } = useRoomCallPolicy(embed.room);
+  useEffect(() => {
+    embed.control.setFrameScreenshareAllowed(allowScreenshare);
+  }, [embed, allowScreenshare]);
   usePttHaptics();
   useCallAnnouncements(embed, joined);
   useMutedTalkWarning(embed, joined);
@@ -875,6 +877,7 @@ export function CallEmbedProvider({ children }: CallEmbedProviderProps) {
   const callActive = callEmbed && joined;
   const callVisible = inCallRoom && callActive && !chatOnlyView;
   const pipMode = callActive && !inCallRoom;
+  const pipPromptOpen = useScreensharePromptOpen(callEmbed?.control);
   const { navigateRoom } = useRoomNavigate();
 
   const { screenshare: pipScreenshare } = useCallControlState(callEmbed?.control);
@@ -1356,6 +1359,9 @@ export function CallEmbedProvider({ children }: CallEmbedProviderProps) {
                 zIndex: 1,
                 background: 'transparent',
                 cursor: 'grab',
+                // [Gitea #43] The call's "Share your screen?" prompt is drawn
+                // inside the frame: let the click reach its Share button.
+                pointerEvents: pipPromptOpen ? 'none' : undefined,
                 display: 'flex',
                 alignItems: 'flex-start',
                 justifyContent: 'flex-end',

src/app/components/message/content/PollContent.tsx

@@ -261,52 +261,69 @@ export function PollContent({
     handleVote(answers[idx].id);
   };
 
-  const headerLabel = isEnded
-    ? 'Poll closed · Final results'
-    : `Poll · ${isMultiple ? 'Multiple choice' : 'Single choice'}`;
+  // [Gitea #246] Type line under the "Poll" label.
+  const typeLabel = (() => {
+    if (isEnded) return 'Final results';
+    if (isUndisclosed) return 'Results hidden until the end';
+    return isMultiple ? `Pick up to ${maxSelections}` : 'Single choice';
+  })();
 
+  // Multiple choice counts people, not answers ("1 voter" who picked two).
+  const unit = isMultiple ? 'voter' : 'vote';
   const footerNote = (() => {
+    const totalPart = total > 0 ? `${total} ${unit}${total === 1 ? '' : 's'}` : `No ${unit}s yet`;
     if (isUndisclosed && !isEnded) {
       return canVote
-        ? 'Voting open · Results hidden until the poll ends'
-        : 'Results hidden until the poll ends';
+        ? `${myVotes.size > 0 ? 'You voted' : 'Voting open'} · results shown when the poll ends`
+        : 'Results shown when the poll ends';
     }
-    const votesPart = total > 0 ? `${total} vote${total === 1 ? '' : 's'}` : 'No votes yet';
-    if (isEnded) return `${votesPart} · Poll closed`;
-    if (!canVote) return votesPart;
-    if (isMultiple) return `${votesPart} · Select up to ${maxSelections}`;
-    return `${votesPart} · ${myVotes.size > 0 ? 'Click to change' : 'Click to vote'}`;
+    if (isEnded) return `${totalPart} · Poll closed`;
+    if (!canVote) return totalPart;
+    return `${totalPart} · ${myVotes.size > 0 ? 'Select another answer to change your vote' : 'Select an answer to vote'}`;
   })();
 
+  // Neutral tones derived from the theme's text colour, so they have contrast
+  // in every theme (the Container/ContainerLine tokens were near-invisible).
+  const muted = (pct: number) =>
+    `color-mix(in srgb, ${color.SurfaceVariant.OnContainer} ${pct}%, transparent)`;
+
   return (
     <Box
       data-poll-content
       direction="Column"
-      gap="200"
-      style={{ maxWidth: '340px', paddingTop: '2px', paddingBottom: '4px' }}
+      gap="300"
+      style={{
+        // Same width for every poll (the message body shrink-wraps its content).
+        width: toRem(460),
+        maxWidth: '100%',
+        margin: `${config.space.S100} 0`,
+        padding: config.space.S300,
+        borderRadius: config.radii.R400,
+        border: `${config.borderWidth.B300} solid ${muted(18)}`,
+        background: muted(4),
+        boxSizing: 'border-box',
+      }}
     >
-      <Text
-        as="div"
-        size="T200"
-        priority="300"
-        data-poll-content-label
-        style={{
-          fontWeight: 700,
-          letterSpacing: '0.12em',
-          textTransform: 'uppercase',
-          marginBottom: config.space.S100,
-        }}
-      >
-        <span aria-hidden>◉ </span>
-        {headerLabel}
-      </Text>
-      <Text size="T400" style={{ fontWeight: 600 }}>
-        {question}
-      </Text>
+      <Box direction="Column" gap="100">
+        <Box alignItems="Center" gap="200" wrap="Wrap" data-poll-content-label>
+          <Icon size="100" src={Icons.OrderList} style={{ opacity: 0.8 }} />
+          <Text as="span" size="L400" style={{ fontWeight: 600 }}>
+            Poll
+          </Text>
+          <Text as="span" size="T200" priority="300">
+            ·
+          </Text>
+          <Text as="span" size="T200" priority="300">
+            {typeLabel}
+          </Text>
+        </Box>
+        <Text size="T400" style={{ fontWeight: 600, overflowWrap: 'anywhere' }}>
+          {question}
+        </Text>
+      </Box>
       <Box
         direction="Column"
-        gap="100"
-        style={{ marginTop: '2px' }}
+        gap="200"
         role={isMultiple ? 'group' : 'radiogroup'}
         aria-label={question}
         onKeyDown={handleRadioKeyDown}
@@ -316,20 +333,32 @@ export function PollContent({
           const text = answer.text;
           const selected = myVotes.has(id);
           const voteCount = counts.get(id) ?? 0;
-          const pct = showResults && total > 0 ? Math.round((voteCount / total) * 100) : 0;
+          const showBar = showResults && total > 0;
+          const pct = showBar ? Math.round((voteCount / total) * 100) : 0;
           const isWinner = winners.has(id);
+          const resultText = `${voteCount} ${voteCount === 1 ? 'vote' : 'votes'} · ${pct}%`;
           // Roving tabindex for the single-choice radiogroup; checkboxes stay tabbable.
           const tabIndex = isMultiple ? 0 : selected || (myVotes.size === 0 && i === 0) ? 0 : -1;
+          let barColor = muted(40);
+          if (isWinner) barColor = color.Success.Main;
+          else if (selected) barColor = color.Primary.Main;
+          let rowBorder = muted(22);
+          if (isWinner) rowBorder = color.Success.Main;
+          else if (selected) rowBorder = color.Primary.Main;
+          const labelParts = [text];
+          if (showBar) labelParts.push(resultText);
+          if (isWinner) labelParts.push('winning answer');
           return (
             <React.Fragment key={id}>
               <button
                 type="button"
                 data-poll-answer
                 data-selected={selected}
+                data-winner={isWinner || undefined}
                 role={isMultiple ? 'checkbox' : 'radio'}
                 aria-checked={selected}
                 aria-disabled={!canVote}
-                aria-label={isWinner ? `${text}, winning answer` : undefined}
+                aria-label={labelParts.join(', ')}
                 aria-describedby={
                   showVoters && canShowVoters && (voters.get(id)?.length ?? 0) > 0
                     ? `poll-voters-${eventId}-${id}`
@@ -340,60 +369,36 @@ export function PollContent({
                 style={{
                   padding: `${config.space.S200} ${config.space.S300}`,
                   borderRadius: config.radii.R300,
-                  background: selected ? color.Primary.Container : color.SurfaceVariant.Container,
-                  border: `${config.borderWidth.B300} solid ${
-                    isWinner
-                      ? color.Success.Main
-                      : selected
-                        ? color.Primary.Main
-                        : color.SurfaceVariant.ContainerLine
-                  }`,
+                  background: selected ? muted(8) : 'transparent',
+                  border: `${config.borderWidth.B300} solid ${rowBorder}`,
                   lineHeight: 1.4,
                   textAlign: 'left',
                   cursor: canVote ? 'pointer' : 'default',
                   color: 'inherit',
+                  font: 'inherit',
                   display: 'flex',
                   flexDirection: 'column',
-                  gap: config.space.S100,
+                  gap: config.space.S200,
                   width: '100%',
-                  position: 'relative',
-                  overflow: 'hidden',
                   transition: 'border-color 0.15s, background 0.15s',
                 }}
               >
-                {showResults && total > 0 && (
-                  <span
-                    aria-hidden
-                    style={{
-                      position: 'absolute',
-                      inset: 0,
-                      right: 'auto',
-                      width: `${pct}%`,
-                      background: selected
-                        ? color.Primary.ContainerActive
-                        : color.SurfaceVariant.ContainerActive,
-                      pointerEvents: 'none',
-                      transition: 'width 0.3s ease',
-                    }}
-                  />
-                )}
                 <span
                   style={{
                     display: 'flex',
                     alignItems: 'center',
                     gap: config.space.S200,
-                    position: 'relative',
+                    width: '100%',
                   }}
                 >
                   <span
                     aria-hidden
                     style={{
                       flexShrink: 0,
-                      width: toRem(14),
-                      height: toRem(14),
-                      border: `${config.borderWidth.B300} solid ${
-                        selected ? color.Primary.Main : color.Primary.ContainerLine
-                      }`,
+                      boxSizing: 'border-box',
+                      width: toRem(18),
+                      height: toRem(18),
+                      border: `2px solid ${selected ? color.Primary.Main : muted(55)}`,
                       borderRadius: isMultiple ? config.radii.R300 : config.radii.Pill,
                       background: selected ? color.Primary.Main : 'transparent',
                       display: 'flex',
@@ -405,29 +410,72 @@ export function PollContent({
                   >
                     {selected ? <Icon size="50" src={Icons.Check} /> : null}
                   </span>
-                  <Text as="span" size="T300" style={{ flexGrow: 1 }}>
+                  <Text
+                    as="span"
+                    size="T300"
+                    style={{ flexGrow: 1, minWidth: 0, overflowWrap: 'anywhere' }}
+                  >
                     {text}
                   </Text>
                   {isWinner && (
-                    <Icon
-                      size="50"
-                      src={Icons.Check}
-                      style={{ flexShrink: 0, color: color.Success.Main }}
-                    />
+                    <Text
+                      as="span"
+                      size="T200"
+                      style={{
+                        flexShrink: 0,
+                        display: 'inline-flex',
+                        alignItems: 'center',
+                        gap: config.space.S100,
+                        color: color.Success.Main,
+                        fontWeight: 600,
+                      }}
+                    >
+                      <Icon size="50" src={Icons.Star} filled />
+                      Winner
+                    </Text>
                   )}
-                  {showResults && total > 0 && (
-                    <Text as="span" size="T200" priority="300" style={{ flexShrink: 0 }}>
-                      {pct}%
+                  {showBar && (
+                    <Text
+                      as="span"
+                      size="T200"
+                      priority="300"
+                      style={{ flexShrink: 0, fontVariantNumeric: 'tabular-nums' }}
+                    >
+                      {resultText}
                     </Text>
                   )}
                 </span>
+                {showBar && (
+                  <span
+                    aria-hidden
+                    style={{
+                      display: 'block',
+                      width: '100%',
+                      height: toRem(6),
+                      borderRadius: config.radii.Pill,
+                      background: muted(12),
+                      overflow: 'hidden',
+                    }}
+                  >
+                    <span
+                      style={{
+                        display: 'block',
+                        height: '100%',
+                        width: `${pct}%`,
+                        borderRadius: config.radii.Pill,
+                        background: barColor,
+                        transition: 'width 0.3s ease',
+                      }}
+                    />
+                  </span>
+                )}
               </button>
               {showVoters && canShowVoters && (voters.get(id)?.length ?? 0) > 0 && (
                 <Text
                   id={`poll-voters-${eventId}-${id}`}
                   size="T200"
                   priority="300"
-                  style={{ padding: `0 ${config.space.S300} ${config.space.S100}` }}
+                  style={{ padding: `0 ${config.space.S300}`, marginTop: `-${config.space.S100}` }}
                 >
                   {`Voted by ${(voters.get(id) ?? []).map((s) => getMemberName(room, s)).join(', ')}`}
                 </Text>
@@ -436,48 +484,56 @@ export function PollContent({
           );
         })}
       </Box>
-      {canShowVoters && (
-        <Box>
-          <Chip
-            variant={showVoters ? 'Primary' : 'SurfaceVariant'}
-            radii="Pill"
-            aria-pressed={showVoters}
-            onClick={() => setShowVoters((v) => !v)}
-            before={<Icon size="50" src={Icons.User} />}
-          >
-            <Text size="T200">{showVoters ? 'Hide voters' : 'Show who voted'}</Text>
-          </Chip>
-        </Box>
-      )}
-      <Box alignItems="Center" justifyContent="SpaceBetween" gap="200">
-        <Text size="T200" priority="300" style={{ minWidth: 0 }}>
-          <i>{footerNote}</i>
+      <Box alignItems="Center" justifyContent="SpaceBetween" gap="200" wrap="Wrap">
+        <Text size="T200" priority="300" style={{ minWidth: 0, flex: '1 1 12rem' }}>
+          {footerNote}
         </Text>
-        {canEnd &&
-          (confirmEnd ? (
-            <Box gap="100" shrink="No" alignItems="Center">
-              <Chip
-                variant="Critical"
-                radii="Pill"
-                aria-disabled={ending}
-                onClick={ending ? undefined : handleEndPoll}
-              >
-                <Text size="T200">{ending ? 'Ending…' : 'End poll'}</Text>
-              </Chip>
-              <Chip variant="Secondary" radii="Pill" onClick={() => setConfirmEnd(false)}>
-                <Text size="T200">Cancel</Text>
-              </Chip>
-            </Box>
-          ) : (
+        <Box gap="100" shrink="No" alignItems="Center" wrap="Wrap">
+          {canShowVoters && (
             <Chip
-              variant="SurfaceVariant"
+              variant={showVoters ? 'Primary' : 'SurfaceVariant'}
               radii="Pill"
-              onClick={() => setConfirmEnd(true)}
-              before={<Icon size="50" src={Icons.Cross} />}
+              aria-pressed={showVoters}
+              onClick={() => setShowVoters((v) => !v)}
+              before={<Icon size="50" src={Icons.User} />}
             >
-              <Text size="T200">End poll</Text>
+              <Text size="T200" style={{ whiteSpace: 'nowrap' }}>
+                {showVoters ? 'Hide voters' : 'Who voted'}
+              </Text>
             </Chip>
-          ))}
+          )}
+          {canEnd &&
+            (confirmEnd ? (
+              <>
+                <Chip
+                  variant="Critical"
+                  radii="Pill"
+                  aria-disabled={ending}
+                  onClick={ending ? undefined : handleEndPoll}
+                >
+                  <Text size="T200" style={{ whiteSpace: 'nowrap' }}>
+                    {ending ? 'Ending…' : 'End poll'}
+                  </Text>
+                </Chip>
+                <Chip variant="Secondary" radii="Pill" onClick={() => setConfirmEnd(false)}>
+                  <Text size="T200" style={{ whiteSpace: 'nowrap' }}>
+                    Cancel
+                  </Text>
+                </Chip>
+              </>
+            ) : (
+              <Chip
+                variant="SurfaceVariant"
+                radii="Pill"
+                onClick={() => setConfirmEnd(true)}
+                before={<Icon size="50" src={Icons.Cross} />}
+              >
+                <Text size="T200" style={{ whiteSpace: 'nowrap' }}>
+                  End poll
+                </Text>
+              </Chip>
+            ))}
+        </Box>
       </Box>
     </Box>
   );

src/app/features/call-status/CallControl.tsx

@@ -3,7 +3,12 @@ import React, { useCallback, useState } from 'react';
 import { useSetAtom } from 'jotai';
 import { MicLevelBars } from '../call/MicLevelBars';
 import { StatusDivider } from './components';
-import { CallEmbed, useCallControlState, useCallMicLevel } from '../../plugins/call';
+import {
+  CallEmbed,
+  useCallControlState,
+  useCallMicLevel,
+  useScreenshareMode,
+} from '../../plugins/call';
 import { AsyncStatus, useAsyncCallback } from '../../hooks/useAsyncCallback';
 import { callEmbedAtom } from '../../state/callEmbed';
 import { MobileTouchTarget } from '../../styles/mobile.css';
@@ -192,8 +197,16 @@ export function CallControl({
   // Keep a forbidden control visible while its track is still live (so the user
   // can stop it); otherwise hide it entirely.
   const showCamera = allowCamera || video;
-  const showScreenshare = allowScreenshare || screenshare;
+  // [Gitea #43] Hidden where EC shows its own screenshare button in the frame;
+  // where the click can't be delegated, starting asks for the in-frame prompt.
+  const screenshareMode = useScreenshareMode(callEmbed.control);
+  const showScreenshare = screenshareMode !== 'hidden' && (allowScreenshare || screenshare);
   const [shareConfirm, setShareConfirm] = useState(false);
+  const handleScreenshareToggle = () => {
+    if (screenshare) callEmbed.control.toggleScreenshare();
+    else if (screenshareMode === 'prompt') callEmbed.control.promptScreenshare();
+    else setShareConfirm(true);
+  };
 
   const handleMicrophoneToggle = useCallback(
     () => callEmbed.control.toggleMicrophone(),
@@ -248,9 +261,7 @@ export function CallControl({
         {!compact && showScreenshare && (
           <ScreenShareButton
             enabled={screenshare}
-            onToggle={() =>
-              screenshare ? callEmbed.control.toggleScreenshare() : setShareConfirm(true)
-            }
+            onToggle={() => handleScreenshareToggle()}
             disabled={!callJoined}
           />
         )}

src/app/features/call/CallControls.tsx

@@ -29,7 +29,12 @@ import {
   SoundButton,
   VideoButton,
 } from './Controls';
-import { CallEmbed, useCallControlState, useCallMicLevel } from '../../plugins/call';
+import {
+  CallEmbed,
+  useCallControlState,
+  useCallMicLevel,
+  useScreenshareMode,
+} from '../../plugins/call';
 import { useSetting } from '../../state/hooks/settings';
 import { settingsAtom } from '../../state/settings';
 import { callEmbedAtom } from '../../state/callEmbed';
@@ -106,6 +111,15 @@ export function CallControls({ callEmbed }: CallControlsProps) {
   // Keep a forbidden control visible while its track is still live (so the user
   // can stop it); otherwise hide it entirely.
   const showCamera = allowCamera || video;
+  // [Gitea #43] Where EC shows its own screenshare button in the frame, ours
+  // is hidden (the screenshare-audio mute stays); where the click can't be
+  // delegated, starting asks for the fork's in-frame "Share your screen?".
+  const screenshareMode = useScreenshareMode(callEmbed.control);
+  const handleScreenshareToggle = () => {
+    if (screenshare) callEmbed.control.toggleScreenshare();
+    else if (screenshareMode === 'prompt') callEmbed.control.promptScreenshare();
+    else setShareConfirm(true);
+  };
   const showScreenshare = allowScreenshare || screenshare;
   const showVideoGroup = showCamera || showScreenshare || !!document.fullscreenEnabled;
   const handleOpenMenu: MouseEventHandler<HTMLButtonElement> = (evt) => {
@@ -216,12 +230,12 @@ export function CallControls({ callEmbed }: CallControlsProps) {
               {showCamera && <VideoButton enabled={video} onToggle={handleVideoToggle} />}
               {showScreenshare && (
                 <>
-                  <ScreenShareButton
-                    enabled={screenshare}
-                    onToggle={() =>
-                      screenshare ? callEmbed.control.toggleScreenshare() : setShareConfirm(true)
-                    }
-                  />
+                  {screenshareMode !== 'hidden' && (
+                    <ScreenShareButton
+                      enabled={screenshare}
+                      onToggle={() => handleScreenshareToggle()}
+                    />
+                  )}
                   {/* Mute-screenshare-audio sits directly next to the screenshare
                       control since they're the same concern. */}
                   <ScreenshareAudioButton

src/app/features/call/CallSoundboard.tsx

@@ -115,7 +115,12 @@ export function CallSoundboard({ callEmbed }: CallSoundboardProps) {
       try {
         const url = await resolveClipObjectUrl(mx, flat.clip.url);
         const vol = (flat.clip.volume / 100) * master;
-        const result = await callEmbed.control.injectAudio(url, vol);
+        // [Gitea #43] Send the bytes too: the call page may be on another
+        // origin, where this blob: URL can't be fetched.
+        const clipBytes = await fetch(url)
+          .then((r) => r.arrayBuffer())
+          .catch(() => undefined);
+        const result = await callEmbed.control.injectAudio(url, vol, clipBytes);
         if (!result.played) {
           // [EC#13] Refused fork-side (only reason today: local mic muted) —
           // don't play it locally either, or the user would think it went out.

src/app/features/call/CallView.tsx

@@ -23,6 +23,7 @@ import { CallMemberRenderer } from './CallMemberCard';
 import * as css from './styles.css';
 import { CallControls } from './CallControls';
 import { useLivekitSupport } from '../../hooks/useLivekitSupport';
+import { CallsUnavailableMessage } from './CallsUnavailable';
 import { webRTCSupported } from '../../utils/rtc';
 
 function LivekitServerMissingMessage() {
@@ -33,25 +34,19 @@ function LivekitServerMissingMessage() {
   );
 }
 
-function WebRTCMissingError() {
-  return (
-    <Text style={{ margin: 'auto', color: color.Critical.Main }} size="L400" align="Center">
-      Your browser does not support WebRTC, which is required for calling.
-    </Text>
-  );
-}
-
 function JoinMessage({
+  roomId,
   hasParticipant,
   livekitSupported,
   rtcSupported,
 }: {
+  roomId: string;
   hasParticipant?: boolean;
   livekitSupported?: boolean;
   rtcSupported?: boolean;
 }) {
   if (rtcSupported === false) {
-    return <WebRTCMissingError />;
+    return <CallsUnavailableMessage roomId={roomId} />;
   }
 
   if (livekitSupported === false) {
@@ -144,6 +139,7 @@ function CallPrescreen() {
             )}
             {!inOtherCall && hasPermission && !channelFull && (
               <JoinMessage
+                roomId={room.roomId}
                 hasParticipant={hasParticipant}
                 livekitSupported={livekitSupported}
                 rtcSupported={rtcSupported}

src/app/features/call/CallsUnavailable.tsx

@@ -0,0 +1,76 @@
+import React, { useMemo } from 'react';
+import { Box, Button, Icon, Icons, Text, color } from 'folds';
+import { useClientConfig } from '../../hooks/useClientConfig';
+import { isTauri } from '../../hooks/useTauri';
+import { webRTCSupported } from '../../utils/rtc';
+import { getCallInBrowserUrl, resolveWebAppUrl } from '../../utils/callInBrowser';
+
+/**
+ * [cinny-desktop: Linux calls] The desktop app on Linux runs on WebKitGTK,
+ * which ships without WebRTC (disabled in 2.54; a libwebrtc backend is due
+ * around 2.56). Where calls can't work here, send the user to the room in the
+ * web app instead of a dead end. Only in the desktop app, and only when
+ * config.json sets `webAppUrl`.
+ */
+export const useCallInBrowserUrl = (roomId: string): string | undefined => {
+  const { webAppUrl } = useClientConfig();
+  return useMemo(
+    () =>
+      isTauri() && !webRTCSupported()
+        ? getCallInBrowserUrl(resolveWebAppUrl(webAppUrl), roomId)
+        : undefined,
+    [webAppUrl, roomId],
+  );
+};
+
+/** Opens through the desktop's new-window handler → the system browser. */
+export const openCallInBrowser = (url: string): void => {
+  window.open(url, '_blank', 'noopener,noreferrer');
+};
+
+const desktopUnavailableText = (): string =>
+  typeof navigator !== 'undefined' && /Linux/i.test(navigator.userAgent)
+    ? 'Calls aren’t available in the desktop app on Linux yet: its web engine has no WebRTC.'
+    : 'Calls aren’t available in this desktop app: its web engine has no WebRTC.';
+
+type CallsUnavailableMessageProps = {
+  roomId: string;
+  /** Button label, e.g. "Answer in browser" for an incoming call. */
+  actionLabel?: string;
+};
+
+export function CallsUnavailableMessage({
+  roomId,
+  actionLabel = 'Open in browser',
+}: CallsUnavailableMessageProps) {
+  const url = useCallInBrowserUrl(roomId);
+
+  if (!isTauri()) {
+    return (
+      <Text style={{ margin: 'auto', color: color.Critical.Main }} size="L400" align="Center">
+        Your browser does not support WebRTC, which is required for calling.
+      </Text>
+    );
+  }
+
+  return (
+    <Box direction="Column" alignItems="Center" gap="200" style={{ margin: 'auto' }}>
+      <Text style={{ color: color.Warning.Main }} size="L400" align="Center">
+        {desktopUnavailableText()}
+        {url ? ' You can join from the web app in your browser.' : ''}
+      </Text>
+      {url && (
+        <Button
+          size="300"
+          variant="Secondary"
+          fill="Soft"
+          radii="300"
+          before={<Icon size="100" src={Icons.External} />}
+          onClick={() => openCallInBrowser(url)}
+        >
+          <Text size="B300">{actionLabel}</Text>
+        </Button>
+      )}
+    </Box>
+  );
+}

src/app/features/outbox/OutboxFeature.tsx

@@ -0,0 +1,268 @@
+import { useSetAtom } from 'jotai';
+import { useEffect } from 'react';
+import {
+  ClientEvent,
+  ClientEventHandlerMap,
+  ConnectionError,
+  EventStatus,
+  KnownMembership,
+  MatrixClient,
+  MatrixError,
+  MatrixEvent,
+  Room,
+  RoomEvent,
+  RoomEventHandlerMap,
+  SyncState,
+} from 'matrix-js-sdk';
+import { useMatrixClient } from '../../hooks/useMatrixClient';
+import { sendOfflineAtom } from '../../state/sendOffline';
+import {
+  OUTBOX_MAX_AUTO_RETRIES,
+  OutboxEntry,
+  isRetryableSendError,
+  loadOutbox,
+  outboxRetryDelayMs,
+  planRestore,
+  saveOutbox,
+  shouldKeepInOutbox,
+  withEntry,
+  withoutEntry,
+} from '../../utils/outbox';
+
+const PENDING: ReadonlySet<EventStatus | null> = new Set([
+  EventStatus.SENDING,
+  EventStatus.ENCRYPTING,
+  EventStatus.QUEUED,
+  EventStatus.NOT_SENT,
+]);
+const ONLINE: ReadonlySet<SyncState | null> = new Set([
+  SyncState.Prepared,
+  SyncState.Syncing,
+  SyncState.Catchup,
+]);
+const OFFLINE: ReadonlySet<SyncState | null> = new Set([SyncState.Reconnecting, SyncState.Error]);
+
+/** The server already has it: its transaction id came back down /sync. */
+const isDelivered = (room: Room, txnId: string): boolean => {
+  const hasTxn = (events: MatrixEvent[]) =>
+    events.some((e) => e.getUnsigned().transaction_id === txnId);
+  return (
+    hasTxn(room.getLiveTimeline().getEvents()) ||
+    room.getThreads().some((t) => hasTxn(t.liveTimeline.getEvents()))
+  );
+};
+
+type OutboxSession = {
+  /** Own pending events of this session, by txnId. */
+  live: Map<string, { event: MatrixEvent; room: Room }>;
+  autoRetries: Map<string, number>;
+  restored: boolean;
+  retrying: boolean;
+};
+
+// Per client, not per mount: a remount must neither restore twice nor forget
+// the events it is tracking.
+const sessions = new WeakMap<MatrixClient, OutboxSession>();
+const getSession = (mx: MatrixClient): OutboxSession => {
+  let session = sessions.get(mx);
+  if (!session) {
+    session = { live: new Map(), autoRetries: new Map(), restored: false, retrying: false };
+    sessions.set(mx, session);
+  }
+  return session;
+};
+
+/**
+ * [Gitea #112] Offline outbox (see utils/outbox.ts): mirrors own message sends
+ * into localStorage until the server confirms them, puts unsent ones back
+ * after a reload, and re-sends network failures when the connection returns.
+ */
+export function OutboxFeature() {
+  const mx = useMatrixClient();
+  const setOffline = useSetAtom(sendOfflineAtom);
+
+  useEffect(() => {
+    const userId = mx.getSafeUserId();
+    let entries = loadOutbox(userId);
+    const session = getSession(mx);
+    const { live, autoRetries } = session;
+    let disposed = false;
+    let offlineNow = false;
+    const timers = new Set<ReturnType<typeof setTimeout>>();
+
+    const isOffline = () =>
+      OFFLINE.has(mx.getSyncState()) ||
+      (typeof navigator !== 'undefined' && navigator.onLine === false);
+
+    const persist = (next: OutboxEntry[]) => {
+      if (next === entries) return;
+      entries = next;
+      saveOutbox(userId, entries);
+    };
+
+    /**
+     * A network failure while we think we're online (a blip neither sync nor
+     * the browser noticed): try again shortly, backing off. Real outages are
+     * handled by the reconnect / back-online triggers below.
+     */
+    const scheduleBlipRetry = (event: MatrixEvent) => {
+      const attempts = autoRetries.get(event.getTxnId() ?? '') ?? 0;
+      if (!isRetryableSendError(event.error) || attempts >= OUTBOX_MAX_AUTO_RETRIES || isOffline())
+        return;
+      const timer = setTimeout(() => {
+        timers.delete(timer);
+        retryQueued();
+      }, outboxRetryDelayMs(attempts));
+      timers.add(timer);
+    };
+
+    const onLocalEcho: RoomEventHandlerMap[RoomEvent.LocalEchoUpdated] = (event, room) => {
+      const txnId = event.getTxnId();
+      if (!txnId || event.getSender() !== userId) return;
+      if (PENDING.has(event.status)) {
+        if (!shouldKeepInOutbox(event.getType(), event.getContent())) return;
+        live.set(txnId, { event, room });
+        if (event.status === EventStatus.NOT_SENT) scheduleBlipRetry(event);
+        persist(
+          withEntry(entries, {
+            txnId,
+            roomId: room.roomId,
+            threadId: event.threadRootId ?? null,
+            type: event.getType(),
+            content: event.getContent(),
+            ts: event.getTs(),
+          }),
+        );
+        return;
+      }
+      // SENT, CANCELLED, or the remote echo replaced it (status null).
+      live.delete(txnId);
+      autoRetries.delete(txnId);
+      persist(withoutEntry(entries, txnId));
+    };
+
+    /** Re-send network failures, oldest first; a room stops at its first failure. */
+    const retryQueued = async () => {
+      if (session.retrying || disposed) return;
+      session.retrying = true;
+      try {
+        const byRoom = new Map<Room, MatrixEvent[]>();
+        Array.from(live.values())
+          .filter(
+            ({ event }) =>
+              event.status === EventStatus.NOT_SENT &&
+              isRetryableSendError(event.error) &&
+              (autoRetries.get(event.getTxnId() ?? '') ?? 0) < OUTBOX_MAX_AUTO_RETRIES,
+          )
+          .sort((a, b) => a.event.getTs() - b.event.getTs())
+          .forEach(({ event, room }) => {
+            byRoom.set(room, [...(byRoom.get(room) ?? []), event]);
+          });
+        await Promise.all(
+          Array.from(byRoom.entries()).map(async ([room, events]) => {
+            for (const event of events) {
+              if (disposed || event.status !== EventStatus.NOT_SENT) continue;
+              const txnId = event.getTxnId() ?? '';
+              autoRetries.set(txnId, (autoRetries.get(txnId) ?? 0) + 1);
+              try {
+                // eslint-disable-next-line no-await-in-loop
+                await mx.resendEvent(event, room);
+              } catch (e) {
+                // Still offline: keep the rest of this room in order for the next try.
+                if (isRetryableSendError(e)) break;
+              }
+            }
+          }),
+        );
+      } finally {
+        session.retrying = false;
+      }
+    };
+
+    const restore = () => {
+      if (session.restored) return;
+      session.restored = true;
+      const plan = planRestore(
+        entries,
+        Date.now(),
+        (roomId) => mx.getRoom(roomId)?.getMyMembership() === KnownMembership.Join,
+        (entry) => {
+          const room = mx.getRoom(entry.roomId);
+          return !!room && isDelivered(room, entry.txnId);
+        },
+      );
+      plan.drop.forEach((entry) => persist(withoutEntry(entries, entry.txnId)));
+      plan.restore.forEach((entry) => {
+        const room = mx.getRoom(entry.roomId);
+        if (!room || live.has(entry.txnId)) return;
+        // Same shape as the SDK's own local echo (client.sendCompleteEvent).
+        const event = new MatrixEvent({
+          type: entry.type,
+          content: entry.content,
+          event_id: `~${entry.roomId}:${entry.txnId}`,
+          sender: userId,
+          room_id: entry.roomId,
+          origin_server_ts: entry.ts,
+        });
+        const thread = entry.threadId ? room.getThread(entry.threadId) : undefined;
+        if (thread) event.setThread(thread);
+        event.setTxnId(entry.txnId);
+        event.setStatus(EventStatus.NOT_SENT);
+        if (plan.autoSend.has(entry.txnId)) {
+          // Recent: treat like a send that lost the network (shown as Queued
+          // while offline, re-sent below and on reconnect).
+          // (The SDK types `error` as MatrixError but stores any send error there.)
+          event.error = new ConnectionError(
+            'not sent before the app was closed',
+          ) as unknown as MatrixError;
+        } else {
+          // Old: back as "Failed to send"; the user decides (Retry / Cancel).
+          autoRetries.set(entry.txnId, OUTBOX_MAX_AUTO_RETRIES);
+        }
+        try {
+          room.addPendingEvent(event, entry.txnId); // emits LocalEchoUpdated → `live`
+        } catch {
+          // Already pending under this txnId: nothing to restore.
+        }
+      });
+      if (!isOffline()) retryQueued();
+    };
+
+    const updateOffline = () => {
+      const offline = isOffline();
+      // Back online (sync recovered or the browser says so): send what's queued.
+      if (offlineNow && !offline && session.restored) retryQueued();
+      offlineNow = offline;
+      setOffline(offline);
+    };
+
+    const onSync: ClientEventHandlerMap[ClientEvent.Sync] = (state, prevState) => {
+      updateOffline();
+      if (!ONLINE.has(state)) return;
+      if (!session.restored) {
+        restore();
+        return;
+      }
+      if (OFFLINE.has(prevState) || prevState === SyncState.Catchup) retryQueued();
+    };
+    const onBrowserOnline = () => updateOffline();
+
+    mx.on(RoomEvent.LocalEchoUpdated, onLocalEcho);
+    mx.on(ClientEvent.Sync, onSync);
+    window.addEventListener('online', onBrowserOnline);
+    window.addEventListener('offline', onBrowserOnline);
+    updateOffline();
+    if (ONLINE.has(mx.getSyncState())) restore();
+
+    return () => {
+      disposed = true;
+      timers.forEach((t) => clearTimeout(t));
+      mx.off(RoomEvent.LocalEchoUpdated, onLocalEcho);
+      mx.off(ClientEvent.Sync, onSync);
+      window.removeEventListener('online', onBrowserOnline);
+      window.removeEventListener('offline', onBrowserOnline);
+    };
+  }, [mx, setOffline]);
+
+  return null;
+}

src/app/features/room/MediaGallery.tsx

@@ -41,6 +41,7 @@ import { stopPropagation } from '../../utils/keyboard';
 import * as css from './MediaGallery.css';
 import { useTimestampFormatter } from '../../hooks/useTimestampFormatter';
 import { formatRelativeAge } from '../../utils/formatTimestamp';
+import { canCopyImage, copyImageFromUrl } from '../../utils/copyImage';
 
 type GalleryTab = 'image' | 'video' | 'file' | 'audio';
 
@@ -160,6 +161,7 @@ function LightboxMedia({
   onMouseDown,
   onTouchStart,
   onImageDoubleClick,
+  onUrl,
 }: {
   item: LightboxItem;
   useAuthentication: boolean;
@@ -169,6 +171,7 @@ function LightboxMedia({
   onMouseDown: React.MouseEventHandler<HTMLElement>;
   onTouchStart: React.TouchEventHandler<HTMLElement>;
   onImageDoubleClick: () => void;
+  onUrl: (url: string | undefined) => void;
 }) {
   const mx = useMatrixClient();
   const media = useDecryptedMediaUrl(
@@ -178,6 +181,11 @@ function LightboxMedia({
     useAuthentication,
     item.mimeType,
   );
+  const readyUrl = media.status === 'ok' ? media.url : undefined;
+  useEffect(() => {
+    onUrl(readyUrl);
+    return () => onUrl(undefined);
+  }, [readyUrl, onUrl]);
 
   return (
     <Box
@@ -292,6 +300,24 @@ export function Lightbox({
   );
   const toggleZoom = useCallback(() => setZoom((z) => (z === 1 ? 2 : 1)), [setZoom]);
 
+  // [Gitea #164] Copy image. No "open in new tab": an E2EE image is a blob URL
+  // revoked when the viewer closes, and authenticated media 401s in a bare tab.
+  const [mediaUrl, setMediaUrl] = useState<string>();
+  const [copyState, setCopyState] = useState<'idle' | 'copied' | 'failed'>('idle');
+  useEffect(() => {
+    if (copyState === 'idle') return undefined;
+    const t = window.setTimeout(() => setCopyState('idle'), 2000);
+    return () => window.clearTimeout(t);
+  }, [copyState]);
+  useEffect(() => setCopyState('idle'), [index]);
+  const handleCopyImage = useCallback(() => {
+    if (!mediaUrl) return;
+    copyImageFromUrl(mediaUrl).then(
+      () => setCopyState('copied'),
+      () => setCopyState('failed'),
+    );
+  }, [mediaUrl]);
+
   // Reset zoom when navigating to another item (and thus pan, via usePan).
   useEffect(() => {
     setZoom(1);
@@ -409,6 +435,40 @@ export function Lightbox({
                 </IconButton>
               </Box>
             )}
+            {isImage && canCopyImage() && (
+              <TooltipProvider
+                position="Bottom"
+                align="End"
+                offset={4}
+                tooltip={
+                  <Tooltip>
+                    <Text>
+                      {copyState === 'copied' && 'Copied'}
+                      {copyState === 'failed' && 'Could not copy image'}
+                      {copyState === 'idle' && 'Copy image'}
+                    </Text>
+                  </Tooltip>
+                }
+              >
+                {(ref) => (
+                  <IconButton
+                    ref={ref}
+                    variant="Surface"
+                    aria-label={copyState === 'copied' ? 'Image copied' : 'Copy image'}
+                    onClick={handleCopyImage}
+                    disabled={!mediaUrl}
+                  >
+                    <Icon
+                      src={
+                        (copyState === 'copied' && Icons.Check) ||
+                        (copyState === 'failed' && Icons.Warning) ||
+                        Icons.Photo
+                      }
+                    />
+                  </IconButton>
+                )}
+              </TooltipProvider>
+            )}
             {item.mxcUrl && (
               <TooltipProvider
                 position="Bottom"
@@ -512,6 +572,7 @@ export function Lightbox({
                 onMouseDown={onMouseDown}
                 onTouchStart={onTouchStart}
                 onImageDoubleClick={toggleZoom}
+                onUrl={setMediaUrl}
               />
             </Box>
             {index < items.length - 1 && (

src/app/features/room/RoomTimeline.tsx

@@ -108,7 +108,7 @@ import {
   getIntersectionObserverEntry,
   useIntersectionObserver,
 } from '../../hooks/useIntersectionObserver';
-import { markAsRead } from '../../utils/notifications';
+import { markAsRead, MarkAsReadOptions } from '../../utils/notifications';
 import { useDebounce } from '../../hooks/useDebounce';
 import { getResizeObserverEntry, useResizeObserver } from '../../hooks/useResizeObserver';
 import * as css from './RoomTimeline.css';
@@ -505,6 +505,11 @@ export function RoomTimeline({ room, eventId, roomInputRef, editor }: RoomTimeli
 
   const setReplyDraft = useSetAtom(roomIdToReplyDraftAtomFamily(room.roomId));
   const setActiveThreadId = useSetAtom(roomIdToActiveThreadIdAtomFamily(room.roomId));
+  // [Gitea #217] Reads from just viewing the timeline are passive: threads the
+  // user follows stay unread, and the open thread panel sends its own receipts.
+  const activeThreadId = useAtomValue(roomIdToActiveThreadIdAtomFamily(room.roomId));
+  const passiveReadRef = useRef<MarkAsReadOptions>({ passive: true });
+  passiveReadRef.current = { passive: true, openThreadId: activeThreadId ?? undefined };
   // Thread summary chips only mount for events that already carry thread data
   // (perf: a chip subscribes room-level listeners, so mounting one per rendered
   // message would exceed the SDK's emitter cap). This single room-level
@@ -707,7 +712,10 @@ export function RoomTimeline({ room, eventId, roomInputRef, editor }: RoomTimeli
             // and either there are no unread messages or the latest message is from the current user.
             // If either condition is met, trigger the markAsRead function to send a read receipt.
             const _roomId = mEvt.getRoomId();
-            if (_roomId) requestAnimationFrame(() => markAsRead(mx, _roomId, hideActivity));
+            if (_roomId)
+              requestAnimationFrame(() =>
+                markAsRead(mx, _roomId, hideActivity, passiveReadRef.current),
+              );
           }
 
           if (!document.hasFocus() && !unreadInfo) {
@@ -829,13 +837,17 @@ export function RoomTimeline({ room, eventId, roomInputRef, editor }: RoomTimeli
   const tryAutoMarkAsRead = useCallback(() => {
     const readUptoEventId = readUptoEventIdRef.current;
     if (!readUptoEventId) {
-      requestAnimationFrame(() => markAsRead(mx, room.roomId, hideActivity));
+      requestAnimationFrame(() =>
+        markAsRead(mx, room.roomId, hideActivity, passiveReadRef.current),
+      );
       return;
     }
     const evtTimeline = getEventTimeline(room, readUptoEventId);
     const latestTimeline = evtTimeline && getFirstLinkedTimeline(evtTimeline, Direction.Forward);
     if (latestTimeline === room.getLiveTimeline()) {
-      requestAnimationFrame(() => markAsRead(mx, room.roomId, hideActivity));
+      requestAnimationFrame(() =>
+        markAsRead(mx, room.roomId, hideActivity, passiveReadRef.current),
+      );
     }
   }, [mx, room, hideActivity]);
 

src/app/features/room/RoomViewHeader.tsx

@@ -80,6 +80,7 @@ import { widgetsPanelAtom } from '../../state/widgetsPanel';
 import { mobileMembersPanelAtom } from '../../state/mobileMembersPanel';
 import { threadsListAtom } from '../../state/threadsList';
 import { usePendingKnocks } from '../../hooks/usePendingKnocks';
+import { openCallInBrowser, useCallInBrowserUrl } from '../call/CallsUnavailable';
 import { bookmarksPanelAtom } from '../../state/bookmarksPanel';
 
 type RoomMenuProps = {
@@ -465,6 +466,36 @@ function CallRulesChip({ room }: { room: Room }) {
   );
 }
 
+/**
+ * [cinny-desktop: Linux calls] Stand-in for CallButton where this app can't
+ * make calls (desktop on WebKitGTK): opens the room in the web app instead.
+ */
+function CallInBrowserButton({ url }: { url: string }) {
+  return (
+    <TooltipProvider
+      position="Bottom"
+      offset={4}
+      tooltip={
+        <Tooltip>
+          <Text>Call in your browser (this desktop app can’t make calls here)</Text>
+        </Tooltip>
+      }
+    >
+      {(triggerRef) => (
+        <IconButton
+          variant="Surface"
+          fill="None"
+          ref={triggerRef}
+          aria-label="Start call in browser"
+          onClick={() => openCallInBrowser(url)}
+        >
+          <Icon size="400" src={Icons.VideoCamera} />
+        </IconButton>
+      )}
+    </TooltipProvider>
+  );
+}
+
 function CallButton() {
   const room = useRoom();
   const direct = useIsDirectRoom();
@@ -555,6 +586,7 @@ export function RoomViewHeader({ callView }: { callView?: boolean }) {
   );
   const livekitSupported = useLivekitSupport();
   const rtcSupported = webRTCSupported();
+  const callInBrowserUrl = useCallInBrowserUrl(room.roomId);
 
   const [menuAnchor, setMenuAnchor] = useState<RectCords>();
   const [pinMenuAnchor, setPinMenuAnchor] = useState<RectCords>();
@@ -782,11 +814,16 @@ export function RoomViewHeader({ callView }: { callView?: boolean }) {
             {screenSize === ScreenSize.Desktop && <CallRulesChip room={room} />}
             {!room.isCallRoom() &&
               livekitSupported &&
-              rtcSupported &&
+              (rtcSupported || callInBrowserUrl) &&
               hasCallPermission &&
               (direct ||
                 (room.getJoinRule() === 'invite' &&
-                  getStateEvents(room, StateEvent.SpaceParent).length === 0)) && <CallButton />}
+                  getStateEvents(room, StateEvent.SpaceParent).length === 0)) &&
+              (rtcSupported ? (
+                <CallButton />
+              ) : (
+                callInBrowserUrl && <CallInBrowserButton url={callInBrowserUrl} />
+              ))}
             {screenSize === ScreenSize.Desktop && (
               <TooltipProvider
                 position="Bottom"

src/app/features/room/message/Message.tsx

@@ -26,6 +26,7 @@ import {
   config,
 } from 'folds';
 import React, {
+  CSSProperties,
   FormEventHandler,
   MouseEventHandler,
   ReactNode,
@@ -38,7 +39,7 @@ import { useHover, useFocusWithin } from 'react-aria';
 import { MatrixEvent, Room, EventStatus } from 'matrix-js-sdk';
 import { Relations } from 'matrix-js-sdk/lib/models/relations';
 import classNames from 'classnames';
-import { useAtom } from 'jotai';
+import { useAtom, useAtomValue } from 'jotai';
 import { RoomPinnedEventsEventContent } from 'matrix-js-sdk/lib/types';
 import {
   AvatarBase,
@@ -83,8 +84,6 @@ import { copyToClipboard } from '../../../utils/dom';
 import { stopPropagation } from '../../../utils/keyboard';
 import { getMatrixToRoomEvent } from '../../../plugins/matrix-to';
 import { getLotusRoomPermalink } from '../../../plugins/lotus-permalink';
-import { getOriginBaseUrl } from '../../../pages/pathUtils';
-import { useClientConfig } from '../../../hooks/useClientConfig';
 import { getViaServers } from '../../../plugins/via-servers';
 import { useMediaAuthentication } from '../../../hooks/useMediaAuthentication';
 import { useRoomPinnedEvents } from '../../../hooks/useRoomPinnedEvents';
@@ -98,28 +97,41 @@ import { useLongPress } from '../../../hooks/useLongPress';
 import { ActionSheet } from '../../../components/action-sheet';
 import { useBookmarks } from '../../../hooks/useBookmarks';
 import { PresenceRingAvatar } from '../../../components/presence';
+import { useLotusShareBase } from '../../../hooks/useLotusLinkBase';
 import { AvatarDecoration } from '../../../components/avatar-decoration/AvatarDecoration';
+import { sendOfflineAtom } from '../../../state/sendOffline';
+import { isRetryableSendError } from '../../../utils/outbox';
 
 // Delivery status indicator for own messages
 function DeliveryStatus({
-  status,
+  mEvent,
+  room,
   lotusTerminal,
 }: {
-  status: string | null;
+  mEvent: MatrixEvent;
+  room: Room;
   lotusTerminal: boolean;
 }) {
+  const mx = useMatrixClient();
+  const offline = useAtomValue(sendOfflineAtom);
+  const { status } = mEvent;
   if (status === null) return null; // confirmed by server — read receipts take over
   let iconSrc: IconSrc;
   let label: string;
   let colorStyle: string;
   const isSending = status === EventStatus.SENDING || status === EventStatus.ENCRYPTING;
-  if (status === EventStatus.NOT_SENT || status === EventStatus.CANCELLED) {
+  // [Gitea #112] A network failure while offline is queued, not failed: the
+  // outbox sends it again when the connection is back.
+  const queued = status === EventStatus.NOT_SENT && offline && isRetryableSendError(mEvent.error);
+  const failed = !queued && (status === EventStatus.NOT_SENT || status === EventStatus.CANCELLED);
+  if (failed) {
     iconSrc = Icons.Cross;
-    label = 'Failed to send';
+    label = status === EventStatus.NOT_SENT ? 'Failed to send. Click to retry' : 'Failed to send';
     colorStyle = lotusTerminal ? 'var(--lt-accent-red)' : color.Critical.Main;
-  } else if (status === EventStatus.QUEUED || isSending) {
-    iconSrc = Icons.Send;
-    label = isSending ? 'Sending...' : 'Queued';
+  } else if (queued || status === EventStatus.QUEUED || isSending) {
+    iconSrc = queued ? Icons.RecentClock : Icons.Send;
+    if (queued) label = "Queued. Will send when you're back online";
+    else label = isSending ? 'Sending...' : 'Queued';
     colorStyle = lotusTerminal
       ? 'color-mix(in srgb, var(--lt-accent-cyan) 60%, transparent)'
       : color.Secondary.Main;
@@ -130,27 +142,49 @@ function DeliveryStatus({
       ? 'color-mix(in srgb, var(--lt-accent-cyan) 70%, transparent)'
       : color.Secondary.Main;
   }
+  const retryable = failed && status === EventStatus.NOT_SENT;
+  const handleRetry: MouseEventHandler<HTMLButtonElement> = (evt) => {
+    evt.stopPropagation();
+    if (mEvent.status === EventStatus.NOT_SENT) mx.resendEvent(mEvent, room).catch(() => undefined);
+  };
+  const style: CSSProperties = {
+    display: 'inline-flex',
+    alignItems: 'center',
+    marginTop: '2px',
+    lineHeight: 1,
+    color: colorStyle,
+    opacity: 0.85,
+    userSelect: 'none',
+    ...(lotusTerminal && failed ? { textShadow: 'var(--lt-glow-red)' } : {}),
+  };
+  const icon = (
+    <span className={isSending ? SendingSpinClass : undefined}>
+      <Icon size="100" src={iconSrc} />
+    </span>
+  );
+  if (retryable) {
+    return (
+      <button
+        type="button"
+        onClick={handleRetry}
+        aria-label={label}
+        title={label}
+        style={{
+          ...style,
+          background: 'none',
+          border: 'none',
+          padding: 0,
+          cursor: 'pointer',
+          font: 'inherit',
+        }}
+      >
+        {icon}
+      </button>
+    );
+  }
   return (
-    <Box
-      as="span"
-      aria-label={label}
-      title={label}
-      style={{
-        display: 'inline-flex',
-        alignItems: 'center',
-        marginTop: '2px',
-        lineHeight: 1,
-        color: colorStyle,
-        opacity: 0.85,
-        userSelect: 'none',
-        ...(lotusTerminal && status === EventStatus.NOT_SENT
-          ? { textShadow: 'var(--lt-glow-red)' }
-          : {}),
-      }}
-    >
-      <span className={isSending ? SendingSpinClass : undefined}>
-        <Icon size="100" src={iconSrc} />
-      </span>
+    <Box as="span" aria-label={label} title={label} style={style}>
+      {icon}
     </Box>
   );
 }
@@ -460,18 +494,11 @@ export const MessageCopyLotusLinkItem = as<
     onClose?: () => void;
   }
 >(({ room, mEvent, onClose, ...props }, ref) => {
-  const { hashRouter } = useClientConfig();
+  const lotusBase = useLotusShareBase();
   const handleCopy = () => {
     const eventId = mEvent.getId();
     if (!eventId) return;
-    copyToClipboard(
-      getLotusRoomPermalink(
-        getOriginBaseUrl(hashRouter),
-        room.roomId,
-        eventId,
-        getViaServers(room),
-      ),
-    );
+    copyToClipboard(getLotusRoomPermalink(lotusBase, room.roomId, eventId, getViaServers(room)));
     onClose?.();
   };
 
@@ -1110,7 +1137,7 @@ export const Message = React.memo(
             />
           )}
           {isMine && !mEvent.isState() && readReceiptUsers.length === 0 && (
-            <DeliveryStatus status={mEvent.status} lotusTerminal={!!lotusTerminal} />
+            <DeliveryStatus mEvent={mEvent} room={room} lotusTerminal={!!lotusTerminal} />
           )}
         </Box>
       );

src/app/features/room/thread/ThreadTimeline.tsx

@@ -33,6 +33,8 @@ import { Badge, Box, Chip, Icon, Icons, Line, Scroll, Spinner, Text, color, conf
 import classNames from 'classnames';
 import { Opts as LinkifyOpts } from 'linkifyjs';
 import { isKeyHotkey } from 'is-hotkey';
+import { isRetryableSendError } from '../../../utils/outbox';
+import { sendOfflineAtom } from '../../../state/sendOffline';
 import { eventWithShortcode, factoryEventSentBy } from '../../../utils/matrix';
 import { useMatrixClient } from '../../../hooks/useMatrixClient';
 import { useVirtualPaginator, ItemRange } from '../../../hooks/useVirtualPaginator';
@@ -73,7 +75,7 @@ import { useSetting } from '../../../state/hooks/settings';
 import { MessageLayout, settingsAtom } from '../../../state/settings';
 import { Message, Reactions, EncryptedContent } from '../message';
 import { RenderMessageContent } from '../../../components/RenderMessageContent';
-import { RoomMediaLightbox } from '../RoomMediaLightbox';
+import { Lightbox, toLightboxItems } from '../MediaGallery';
 import { Image } from '../../../components/media';
 import { ImageViewer } from '../../../components/image-viewer';
 import * as css from './ThreadTimeline.css';
@@ -253,6 +255,7 @@ export type ThreadTimelineProps = {
 
 export function ThreadTimeline({ room, thread, editor }: ThreadTimelineProps) {
   const mx = useMatrixClient();
+  const sendOffline = useAtomValue(sendOfflineAtom);
   const alive = useAlive();
   const useAuthentication = useMediaAuthentication();
 
@@ -308,7 +311,7 @@ export function ThreadTimeline({ room, thread, editor }: ThreadTimelineProps) {
 
   const [editId, setEditId] = useState<string>();
   const [editHistoryEvent, setEditHistoryEvent] = useState<MatrixEvent | undefined>();
-  // [Gitea #219] Thread images open the room's shared media lightbox too.
+  // [Gitea #219] Thread images open the shared media lightbox too.
   const [lightboxEventId, setLightboxEventId] = useState<string | undefined>();
 
   const linkifyOpts = useMemo<LinkifyOpts>(
@@ -627,11 +630,9 @@ export function ThreadTimeline({ room, thread, editor }: ThreadTimelineProps) {
     ),
   );
 
-  const handleOpenReply: MouseEventHandler = useCallback(
-    (evt) => {
-      const targetId = evt.currentTarget.getAttribute('data-event-id');
-      if (!targetId) return;
-      // best-effort: scroll to referenced event if it is inside the loaded thread window
+  // best-effort: scroll to an event if it is inside the loaded thread window
+  const scrollToThreadEvent = useCallback(
+    (targetId: string) => {
       let absIndex = -1;
       let acc = 0;
       timeline.linkedTimelines.some((tl) => {
@@ -654,6 +655,39 @@ export function ThreadTimeline({ room, thread, editor }: ThreadTimelineProps) {
     [timeline.linkedTimelines, scrollToItem],
   );
 
+  const handleOpenReply: MouseEventHandler = useCallback(
+    (evt) => {
+      const targetId = evt.currentTarget.getAttribute('data-event-id');
+      if (targetId) scrollToThreadEvent(targetId);
+    },
+    [scrollToThreadEvent],
+  );
+
+  // [Gitea #164] The viewer steps through this thread's media (root + loaded
+  // replies). Thread replies never reach the room's media timeline, so the
+  // room lightbox could only ever show a thread image as "1 / 1".
+  const lightboxItems = useMemo(() => {
+    if (!lightboxEventId) return [];
+    const seen = new Set<string>();
+    const events = [thread.rootEvent, ...timeline.linkedTimelines.flatMap((tl) => tl.getEvents())]
+      .filter((ev): ev is MatrixEvent => !!ev)
+      .filter((ev) => {
+        const id = ev.getId();
+        if (!id || seen.has(id) || ev.isRedacted()) return false;
+        seen.add(id);
+        return true;
+      });
+    return toLightboxItems(room, events);
+  }, [lightboxEventId, thread.rootEvent, timeline.linkedTimelines, room]);
+  const lightboxIndex = lightboxItems.findIndex((it) => it.eventId === lightboxEventId);
+  const handleLightboxJump = useCallback(
+    (id: string) => {
+      setLightboxEventId(undefined);
+      scrollToThreadEvent(id);
+    },
+    [scrollToThreadEvent],
+  );
+
   const renderMessageContent = useCallback(
     (mEvent: MatrixEvent, mEventId: string, timelineSet: EventTimelineSet): ReactNode => {
       // Evaluated lazily so EncryptedContent can re-run it (re-reading getType())
@@ -961,8 +995,12 @@ export function ThreadTimeline({ room, thread, editor }: ThreadTimelineProps) {
   const showEmptyReplies = ready && thread.length === 0;
 
   const renderPendingEvent = (mEvent: MatrixEvent) => {
+    // [Gitea #112] Network failures while offline are queued, not failed.
+    const queued =
+      mEvent.status === EventStatus.NOT_SENT && sendOffline && isRetryableSendError(mEvent.error);
     const failed =
-      mEvent.status === EventStatus.NOT_SENT || mEvent.status === EventStatus.CANCELLED;
+      !queued &&
+      (mEvent.status === EventStatus.NOT_SENT || mEvent.status === EventStatus.CANCELLED);
     return (
       <div
         key={mEvent.getId() ?? mEvent.getTxnId()}
@@ -976,6 +1014,13 @@ export function ThreadTimeline({ room, thread, editor }: ThreadTimelineProps) {
             </Text>
           </Box>
         )}
+        {queued && (
+          <Box style={{ padding: `0 ${config.space.S400}` }}>
+            <Text size="T200" priority="300">
+              Queued. Will send when you&apos;re back online
+            </Text>
+          </Box>
+        )}
       </div>
     );
   };
@@ -1051,11 +1096,13 @@ export function ThreadTimeline({ room, thread, editor }: ThreadTimelineProps) {
           onClose={() => setEditHistoryEvent(undefined)}
         />
       )}
-      {lightboxEventId && (
-        <RoomMediaLightbox
-          room={room}
-          eventId={lightboxEventId}
+      {lightboxEventId && lightboxIndex !== -1 && (
+        <Lightbox
+          items={lightboxItems}
+          initialIndex={lightboxIndex}
+          useAuthentication={useAuthentication}
           onClose={() => setLightboxEventId(undefined)}
+          onJump={handleLightboxJump}
         />
       )}
     </Box>

src/app/features/room/widgets/RoomWidgetView.tsx

@@ -12,6 +12,7 @@ import { Capability, ClientWidgetApi, IRoomEvent, Widget } from 'matrix-widget-a
 import { useMatrixClient } from '../../../hooks/useMatrixClient';
 import { GeneralWidgetDriver } from './GeneralWidgetDriver';
 import { WidgetPermissionRequest, isWidgetUrlSafe } from './widgetUtils';
+import { restrictWidgetMessages } from '../../../plugins/widgetTransport';
 import { WidgetPermissionPrompt } from './WidgetPermissionPrompt';
 
 type PendingAsk = {
@@ -96,6 +97,9 @@ export function RoomWidgetView({ room, widget }: RoomWidgetViewProps) {
         }),
     );
     const clientApi = new ClientWidgetApi(current, iframe, driver);
+    // Only messages from this widget's own frame and origin are handled, so a
+    // widget can't impersonate another one (or the call).
+    restrictWidgetMessages(clientApi, iframe, current.origin);
     clientApi.setViewedRoomId(room.roomId);
 
     // Live room events for widgets that were allowed to see them

src/app/hooks/useCallHotkeys.ts

@@ -105,32 +105,6 @@ const isInteractive = (el: HTMLElement): boolean => {
   return false;
 };
 
-/**
- * Bind listeners to the EC iframe's window and keep them bound across document
- * reloads. [Gitea #60] Listeners registered on a contentWindow are discarded
- * when that window navigates to a new document (crash recovery, in-widget
- * navigation), so re-run `bind` from the iframe's `load` event and detach the
- * previous set. Returns a cleanup that detaches everything.
- */
-const bindIframeWindow = (
-  iframe: HTMLIFrameElement,
-  bind: (win: Window) => () => void,
-): (() => void) => {
-  let unbind: (() => void) | undefined;
-  const attach = () => {
-    unbind?.();
-    const win = iframe.contentWindow;
-    unbind = win ? bind(win) : undefined;
-  };
-  attach();
-  iframe.addEventListener('load', attach);
-  return () => {
-    iframe.removeEventListener('load', attach);
-    unbind?.();
-    unbind = undefined;
-  };
-};
-
 /**
  * Push-to-talk and deafen hotkeys for the active call.
  *
@@ -210,11 +184,12 @@ export function useCallHotkeys(callEmbed: CallEmbed | undefined, joined: boolean
       pttActiveRef.current = false;
       setPttActive(false);
     };
-    const onKeyDown = (e: KeyboardEvent) => {
+    // `prevent` is absent for keys reported by the fork, which already
+    // cancelled the default action inside its frame.
+    const pttDown = (e: KeyLike, editable: boolean, interactive: boolean, prevent?: () => void) => {
       if (!isPttKeyDown(e, pttKey)) return;
-      const target = e.target as HTMLElement;
-      if (isEditable(target)) return;
-      if (!isInteractive(target)) e.preventDefault();
+      if (editable) return;
+      if (!interactive) prevent?.();
       // Key auto-repeat re-fires keydown while held; don't restart the clock.
       if (pttActiveRef.current) return;
       // C-M5: mark PTT active BEFORE unmuting so the mic echo (onMediaState)
@@ -225,6 +200,10 @@ export function useCallHotkeys(callEmbed: CallEmbed | undefined, joined: boolean
       setPttActive(true);
       holdWatchdog.current.arm();
     };
+    const onKeyDown = (e: KeyboardEvent) => {
+      const target = e.target as HTMLElement;
+      pttDown(e, isEditable(target), isInteractive(target), () => e.preventDefault());
+    };
     const onKeyUp = (e: KeyboardEvent) => {
       if (e.code !== pttKey) return;
       release();
@@ -249,11 +228,18 @@ export function useCallHotkeys(callEmbed: CallEmbed | undefined, joined: boolean
       };
     };
     const unbindHost = bind(window);
-    // BUG-9: also wire iframe key/blur/focus so PTT works with focus in the iframe
-    const unbindIframe = bindIframeWindow(embed.iframe, bind);
+    // BUG-9: PTT also works with focus in the call frame, reported by the
+    // fork (io.lotus.hotkey; the host no longer listens on the frame's window).
+    embed.control.setHotkeyCodes('ptt', [pttKey]);
+    const unbindFork = embed.control.onHotkey((r) => {
+      if (r.type === 'focus') onFocusChange();
+      else if (r.type === 'keydown') pttDown(r, r.editable, r.interactive);
+      else if (r.code === pttKey) release();
+    });
     return () => {
       unbindHost();
-      unbindIframe();
+      unbindFork();
+      embed.control.setHotkeyCodes('ptt', []);
       // BUG-8: if the embed changes while PTT is active, release mic on cleanup
       if (pttActiveRef.current) release();
     };
@@ -330,15 +316,18 @@ export function useCallHotkeys(callEmbed: CallEmbed | undefined, joined: boolean
       embed.control.toggleSound();
     };
     window.addEventListener('keydown', onKeyDown);
-    // C-L4: also bind the EC iframe window so the deafen key works when focus is
-    // inside the iframe (mirrors the PTT binding above).
-    const unbindIframe = bindIframeWindow(embed.iframe, (win) => {
-      win.addEventListener('keydown', onKeyDown);
-      return () => win.removeEventListener('keydown', onKeyDown);
+    // C-L4: the deafen key also works with focus inside the call frame (no
+    // composer there, so only the editable-field check applies).
+    embed.control.setHotkeyCodes('deafen', [deafenKey]);
+    const unbindFork = embed.control.onHotkey((r) => {
+      if (r.type === 'keydown' && isDeafenKeyDown(r, deafenKey) && !r.editable) {
+        embed.control.toggleSound();
+      }
     });
     return () => {
       window.removeEventListener('keydown', onKeyDown);
-      unbindIframe();
+      unbindFork();
+      embed.control.setHotkeyCodes('deafen', []);
     };
   }, [embed, deafenKey, deafenHotkey]);
 }

src/app/hooks/useCallSpeakers.ts

@@ -1,25 +1,16 @@
 import { useEffect, useState } from 'react';
 import { CallEmbed } from '../plugins/call';
-import { getCallDocument } from '../plugins/call/utils';
-import { isUserId } from '../utils/matrix';
 import { nextSpeakerSet } from '../utils/speakerSet';
 import { useCallMembers, useCallSession } from './useCall';
 import { useCallJoined } from './useCallEmbed';
 
 /**
- * Returns the set of Matrix user IDs currently speaking in the Element Call
- * iframe.
+ * Returns the set of Matrix user IDs currently speaking in the call, from the
+ * fork's io.lotus.call_state reports ([lotus #2]).
  *
- * EC renders each participant's video tile with a `[data-video-fit]` wrapper.
- * When a participant is speaking, EC draws a speaking indicator via the tile's
- * `::before` pseudo-element `background-image` (anything other than `none`).
- * The participant's Matrix user ID is exposed on the first descendant carrying
- * an `aria-label`.
- *
- * We watch the whole iframe document so tiles added/removed mid-call are picked
- * up automatically, and on every relevant mutation we re-scan ALL `[data-video-fit]`
- * tiles and rebuild the set from the full current DOM state (rather than just the
- * tiles in the mutation batch).
+ * [Gitea #43] The fallback that scraped EC's rendered tiles (the speaking
+ * ring's `::before` background) is gone: the bundled fork always reports call
+ * state, and the host no longer reads the call frame's DOM.
  */
 export const useCallSpeakers = (callEmbed: CallEmbed): Set<string> => {
   const [speakers, setSpeakers] = useState(new Set<string>());
@@ -28,9 +19,8 @@ export const useCallSpeakers = (callEmbed: CallEmbed): Set<string> => {
   const joined = useCallJoined(callEmbed);
 
   // C-L5 — depend on a STABLE boolean, not the callMembers array (whose identity
-  // changes on every membership change). The MutationObserver + io.lotus.call_state
-  // subscription below already track tiles joining/leaving live, so rebuilding
-  // them on each membership change is pure churn.
+  // changes on every membership change). The io.lotus.call_state subscription
+  // below already tracks participants joining/leaving live.
   const hasCallMembers = callMembers.length > 0;
 
   useEffect(() => {
@@ -39,123 +29,22 @@ export const useCallSpeakers = (callEmbed: CallEmbed): Set<string> => {
       return undefined;
     }
 
-    const getDoc = (): Document | undefined => getCallDocument(callEmbed.iframe);
-
-    let tileObserver: MutationObserver | undefined;
-
-    const detachTileObserver = (): void => {
-      tileObserver?.disconnect();
-      tileObserver = undefined;
-    };
-
-    // #32 — only attach the DOM fallback observer while the fork isn't
-    // supplying usable speaker data; it stays disconnected for the rest of
-    // the call once io.lotus.call_state starts reporting participants.
-    const attachTileObserver = (): void => {
-      if (tileObserver) return;
-      const doc = getDoc();
-      if (!doc?.body) return;
-      // Watch the whole document for attribute changes on tiles (which carry
-      // the speaking indicator) and for new tiles being added/removed.
-      tileObserver = new MutationObserver((mutations) => {
-        const relevant = mutations.some(
-          (m) =>
-            m.type === 'attributes' ||
-            (m.type === 'childList' &&
-              (Array.from(m.addedNodes).some(
-                (n) => n instanceof Element && n.querySelector('[data-video-fit]'),
-              ) ||
-                Array.from(m.removedNodes).some(
-                  (n) => n instanceof Element && n.querySelector('[data-video-fit]'),
-                ))),
-        );
-        if (relevant) syncState();
-      });
-      tileObserver.observe(doc.body, {
-        subtree: true,
-        childList: true,
-        attributes: true,
-        attributeFilter: ['class', 'style'],
-      });
-    };
-
     const syncState = (): void => {
-      // [lotus #2] Prefer the fork's io.lotus.call_state events over scraping
-      // EC's rendered DOM. Falls back to the DOM path below when the fork hasn't
-      // sent yet (null) OR sent a spurious empty list (you're always present in
-      // your own joined call, so [] means "no usable data", not "nobody").
-      const lotus = callEmbed.getLotusParticipants();
-      if (lotus !== null && lotus.length > 0) {
-        detachTileObserver();
-        // #32 — bail out of setState (and the re-render it causes) when the
-        // derived set is unchanged from the previous one.
-        setSpeakers((prev) => nextSpeakerSet(prev, lotus));
-        return;
-      }
-      const doc = getDoc();
-      if (!doc) {
-        setSpeakers(new Set<string>());
-        return;
-      }
-      // Fork gave no usable data (older fork, or hasn't sent yet) — fall back
-      // to scraping the DOM, and keep watching it for changes.
-      attachTileObserver();
-      const s = new Set<string>();
-      // Re-scan every tile on each mutation and build the set from the full
-      // current DOM state, not just the tiles that mutated this batch.
-      const tiles = doc.querySelectorAll<HTMLElement>('[data-video-fit]');
-      tiles.forEach((el) => {
-        const style = callEmbed.iframe.contentWindow?.getComputedStyle(el, '::before');
-        if (!style) return;
-        const tileBackgroundImage = style.getPropertyValue('background-image');
-        const speaking = tileBackgroundImage !== 'none';
-        if (!speaking) return;
-
-        const speakerId = el.querySelector('[aria-label]')?.getAttribute('aria-label');
-        if (speakerId && isUserId(speakerId)) {
-          s.add(speakerId);
-        }
-      });
-      setSpeakers(s);
+      // #32 — bail out of setState (and the re-render it causes) when the
+      // derived set is unchanged from the previous one.
+      setSpeakers((prev) => nextSpeakerSet(prev, callEmbed.getLotusParticipants() ?? []));
     };
 
     syncState();
-    // [lotus #2] Re-derive whenever the fork pushes new call-state.
-    const unsubLotus = callEmbed.onLotusCallState(syncState);
-
-    // If iframe isn't ready yet, wait for body to be available.
-    let bodyWatcher: MutationObserver | undefined;
-    if (!getDoc()?.body) {
-      bodyWatcher = new MutationObserver(() => {
-        if (getDoc()?.body) {
-          bodyWatcher?.disconnect();
-          bodyWatcher = undefined;
-          syncState();
-        }
-      });
-      const doc = getDoc();
-      if (doc) bodyWatcher.observe(doc, { childList: true });
-    }
-
-    return () => {
-      detachTileObserver();
-      bodyWatcher?.disconnect();
-      unsubLotus();
-    };
+    return callEmbed.onLotusCallState(syncState);
   }, [callEmbed, hasCallMembers, joined]);
 
   return speakers;
 };
 
 /**
- * Returns true when any REMOTE participant has their microphone muted in the
- * Element Call iframe.
- *
- * EC renders a mute-icon element per participant tile with a `data-muted`
- * attribute ("true" = muted, "false" = unmuted) and an `aria-label` set to
- * the participant's Matrix user ID.  We watch for attribute changes on all
- * `[data-muted]` elements, filter out the local user, and return true if any
- * remaining participant is muted.
+ * Returns true when there is at least one REMOTE participant and every one of
+ * them has their microphone muted, from the fork's io.lotus.call_state reports.
  */
 export const useRemoteAllMuted = (callEmbed: CallEmbed | undefined): boolean => {
   const [muted, setMuted] = useState(false);
@@ -163,105 +52,17 @@ export const useRemoteAllMuted = (callEmbed: CallEmbed | undefined): boolean =>
   useEffect(() => {
     if (!callEmbed) return undefined;
 
-    const getDoc = (): Document | undefined => getCallDocument(callEmbed.iframe);
-
     const localUserId = callEmbed.room.client?.getUserId() ?? '';
 
-    let tileObserver: MutationObserver | undefined;
-
-    const detachTileObserver = (): void => {
-      tileObserver?.disconnect();
-      tileObserver = undefined;
-    };
-
-    // #32 — only attach the DOM fallback observer while the fork isn't
-    // supplying usable participant data; it stays disconnected for the rest
-    // of the call once io.lotus.call_state starts reporting participants.
-    const attachTileObserver = (): void => {
-      if (tileObserver) return;
-      const doc = getDoc();
-      if (!doc?.body) return;
-      // Watch the whole document for attribute changes on data-muted elements
-      // and for new tiles being added/removed.
-      tileObserver = new MutationObserver((mutations) => {
-        const relevant = mutations.some(
-          (m) =>
-            m.type === 'attributes' ||
-            (m.type === 'childList' &&
-              (Array.from(m.addedNodes).some(
-                (n) => n instanceof Element && n.querySelector('[data-muted]'),
-              ) ||
-                Array.from(m.removedNodes).some(
-                  (n) => n instanceof Element && n.querySelector('[data-muted]'),
-                ))),
-        );
-        if (relevant) syncState();
-      });
-      tileObserver.observe(doc.body, {
-        subtree: true,
-        childList: true,
-        attributes: true,
-        attributeFilter: ['data-muted'],
-      });
-    };
-
     const syncState = (): void => {
-      // [lotus #2] Prefer the fork's io.lotus.call_state over DOM scraping;
-      // ignore a spurious empty list (fall back to DOM).
-      const lotus = callEmbed.getLotusParticipants();
-      if (lotus !== null && lotus.length > 0) {
-        detachTileObserver();
-        const remote = lotus.filter((p) => p.userId !== localUserId);
-        setMuted(remote.length > 0 && remote.every((p) => !p.audioEnabled));
-        return;
-      }
-      const doc = getDoc();
-      if (!doc) {
-        setMuted(false);
-        return;
-      }
-      // Fork gave no usable data (older fork, or hasn't sent yet) — fall back
-      // to scraping the DOM, and keep watching it for changes.
-      attachTileObserver();
-      // Each participant's mute icon has data-muted="true"|"false" and
-      // aria-label set to their Matrix user ID.
-      const muteIcons = doc.querySelectorAll<HTMLElement>('[data-muted]');
-      let remoteCount = 0;
-      let remoteMutedCount = 0;
-      muteIcons.forEach((el) => {
-        const userId = el.getAttribute('aria-label') ?? '';
-        if (userId === localUserId) return;
-        remoteCount += 1;
-        if (el.getAttribute('data-muted') === 'true') remoteMutedCount += 1;
-      });
-      // "All muted" badge: true only when there is at least one remote
-      // participant and every one of them is muted (not merely any single one).
-      setMuted(remoteCount > 0 && remoteMutedCount === remoteCount);
+      const remote = (callEmbed.getLotusParticipants() ?? []).filter(
+        (p) => p.userId !== localUserId,
+      );
+      setMuted(remote.length > 0 && remote.every((p) => !p.audioEnabled));
     };
 
     syncState();
-    // [lotus #2] Re-derive whenever the fork pushes new call-state.
-    const unsubLotus = callEmbed.onLotusCallState(syncState);
-
-    // If iframe isn't ready yet, wait for body to be available.
-    let bodyWatcher: MutationObserver | undefined;
-    if (!getDoc()?.body) {
-      bodyWatcher = new MutationObserver(() => {
-        if (getDoc()?.body) {
-          bodyWatcher?.disconnect();
-          bodyWatcher = undefined;
-          syncState();
-        }
-      });
-      const doc = getDoc();
-      if (doc) bodyWatcher.observe(doc, { childList: true });
-    }
-
-    return () => {
-      detachTileObserver();
-      bodyWatcher?.disconnect();
-      unsubLotus();
-    };
+    return callEmbed.onLotusCallState(syncState);
   }, [callEmbed]);
 
   return muted;

src/app/hooks/useClientConfig.ts

@@ -19,6 +19,18 @@ export type ClientConfig = {
 
   hashRouter?: HashRouterConfig;
   gifApiKey?: string;
+
+  /**
+   * [Gitea #43] Absolute https URL of the Element Call page on its own origin.
+   * Unset: the bundled copy on this origin. Ignored in the desktop app.
+   */
+  elementCallUrl?: string;
+
+  /**
+   * Absolute https URL of the public web app (e.g. https://chat.lotusguild.org).
+   * The desktop app sets it so it can hand calls it can't make to the browser.
+   */
+  webAppUrl?: string;
 };
 
 const ClientConfigContext = createContext<ClientConfig | null>(null);

src/app/hooks/useLotusLinkBase.test.ts

@@ -0,0 +1,23 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { lotusLinkBases, lotusShareBase } from './useLotusLinkBase';
+
+const LOCAL = 'http://localhost:44548/#/';
+const WEB = 'https://chat.lotusguild.org';
+
+test('web: shared links use the page origin', () => {
+  assert.equal(lotusShareBase(WEB, false, WEB), WEB);
+  assert.deepEqual(lotusLinkBases(WEB, false, undefined), [WEB]);
+});
+
+test('desktop with webAppUrl: shared links use the public web app', () => {
+  assert.equal(lotusShareBase(LOCAL, true, `${WEB}/`), WEB);
+  assert.deepEqual(lotusLinkBases(LOCAL, true, WEB), [LOCAL, WEB]);
+});
+
+test('desktop without a valid webAppUrl falls back to the origin', () => {
+  [undefined, '', 'http://chat.lotusguild.org', 'nonsense'].forEach((v) => {
+    assert.equal(lotusShareBase(LOCAL, true, v), LOCAL, String(v));
+    assert.deepEqual(lotusLinkBases(LOCAL, true, v), [LOCAL]);
+  });
+});

src/app/hooks/useLotusLinkBase.ts

@@ -0,0 +1,37 @@
+import { useMemo } from 'react';
+import { useClientConfig } from './useClientConfig';
+import { isTauri } from './useTauri';
+import { getOriginBaseUrl } from '../pages/pathUtils';
+import { resolveWebAppUrl } from '../utils/callInBrowser';
+
+/**
+ * [Gitea #248] Base URL for Lotus links meant for other people.
+ *
+ * On the web that's this page's origin. In the desktop app the page is served
+ * from a local address (and hash-routed), which nobody else can open, so use
+ * the public web app from config `webAppUrl` (web path routing) instead.
+ * Without a valid `webAppUrl` it falls back to the origin, as before.
+ */
+export const lotusShareBase = (originBase: string, desktop: boolean, webAppUrl: unknown): string =>
+  (desktop && resolveWebAppUrl(webAppUrl)) || originBase;
+
+/**
+ * Every base a Lotus link to this deployment may start with: the origin, plus
+ * the public web app in the desktop app, so a shared https link opens in-app.
+ */
+export const lotusLinkBases = (
+  originBase: string,
+  desktop: boolean,
+  webAppUrl: unknown,
+): string[] => {
+  const shared = lotusShareBase(originBase, desktop, webAppUrl);
+  return shared === originBase ? [originBase] : [originBase, shared];
+};
+
+export const useLotusShareBase = (): string => {
+  const { hashRouter, webAppUrl } = useClientConfig();
+  return useMemo(
+    () => lotusShareBase(getOriginBaseUrl(hashRouter), isTauri(), webAppUrl),
+    [hashRouter, webAppUrl],
+  );
+};

src/app/hooks/useRoomMediaTimeline.ts

@@ -9,6 +9,7 @@ import {
   Room,
   RoomEvent,
   RoomEventHandlerMap,
+  ThreadEvent,
 } from 'matrix-js-sdk';
 
 import {
@@ -34,7 +35,7 @@ export const isMediaMessage = (event: MatrixEvent): boolean =>
 const PAGE_SIZE = 100;
 
 export type RoomMediaTimeline = {
-  /** Every loaded media message in the room, newest first. */
+  /** Every loaded media message in the room and its threads, newest first. */
   events: MatrixEvent[];
   loadMore: () => Promise<void>;
   loading: boolean;
@@ -57,11 +58,23 @@ export const useRoomMediaTimeline = (mx: MatrixClient, room: Room): RoomMediaTim
     [mx, room],
   );
 
-  const readEvents = useCallback(
-    (): MatrixEvent[] =>
-      collectTimelineEvents(detached.set.getLiveTimeline()).filter(isMediaMessage).reverse(),
-    [detached],
-  );
+  // [Gitea #165] The SDK routes thread replies out of every room timeline set
+  // (ours included) into the room's Thread objects, so media posted in a
+  // thread only shows up if we read the loaded threads too.
+  const readEvents = useCallback((): MatrixEvent[] => {
+    const seen = new Set<string>();
+    return [
+      ...collectTimelineEvents(detached.set.getLiveTimeline()),
+      ...room.getThreads().flatMap((thread) => thread.timeline),
+    ]
+      .filter((event) => {
+        const id = event.getId();
+        if (!id || seen.has(id) || !isMediaMessage(event)) return false;
+        seen.add(id);
+        return true;
+      })
+      .sort((a, b) => b.getTs() - a.getTs());
+  }, [detached, room]);
 
   const [events, setEvents] = useState<MatrixEvent[]>(readEvents);
   const [loading, setLoading] = useState(false);
@@ -119,11 +132,23 @@ export const useRoomMediaTimeline = (mx: MatrixClient, room: Room): RoomMediaTim
       refresh();
     };
 
+    const onThreadReply = (_thread: unknown, event: MatrixEvent) => {
+      if (event.isBeingDecrypted() || event.shouldAttemptDecryption()) {
+        event.once(MatrixEventEvent.Decrypted, () => {
+          if (isMediaMessage(event)) refresh();
+        });
+        return;
+      }
+      if (isMediaMessage(event)) refresh();
+    };
+
     room.on(RoomEvent.Timeline, onTimeline);
     room.on(RoomEvent.Redaction, onRedaction);
+    room.on(ThreadEvent.NewReply, onThreadReply);
     return () => {
       room.removeListener(RoomEvent.Timeline, onTimeline);
       room.removeListener(RoomEvent.Redaction, onRedaction);
+      room.removeListener(ThreadEvent.NewReply, onThreadReply);
     };
   }, [detached, room, readEvents]);
 

src/app/pages/App.tsx

@@ -36,6 +36,7 @@ import { applyCustomAccent, removeCustomAccent } from '../utils/accentColor';
 import { zIndices } from '../styles/zIndex';
 import { OIDC_CALLBACK_PATH } from './paths';
 import { OidcCallback } from './auth/oidc/OidcCallback';
+import { resolveCallPageUrl, setCallPageUrl } from '../plugins/call/callPageUrl';
 
 // The emoji families (Twemoji when "Twitter emoji" is on, Twemoji flags on
 // Windows — see SystemEmojiFeature) must sit before the generic family, or the
@@ -220,23 +221,27 @@ function App() {
                     <ConfigConfigError error={err} retry={retry} ignore={ignore} />
                   )}
                 >
-                  {(clientConfig) => (
-                    <ClientConfigProvider value={clientConfig}>
-                      <QueryClientProvider client={queryClient}>
-                        <JotaiProvider>
-                          <AppearanceEffects />
-                          <TauriEffects />
-                          <DesktopChrome>
-                            <RouterProvider router={createRouter(clientConfig, screenSize)} />
-                          </DesktopChrome>
-                          <SeasonalEffect />
-                          <NightLightOverlay />
-                          <LotusToastContainer />
-                        </JotaiProvider>
-                        <ReactQueryDevtools initialIsOpen={false} />
-                      </QueryClientProvider>
-                    </ClientConfigProvider>
-                  )}
+                  {(clientConfig) => {
+                    // [Gitea #43] Idempotent: where the call page is loaded from.
+                    setCallPageUrl(resolveCallPageUrl(clientConfig.elementCallUrl, isTauri()));
+                    return (
+                      <ClientConfigProvider value={clientConfig}>
+                        <QueryClientProvider client={queryClient}>
+                          <JotaiProvider>
+                            <AppearanceEffects />
+                            <TauriEffects />
+                            <DesktopChrome>
+                              <RouterProvider router={createRouter(clientConfig, screenSize)} />
+                            </DesktopChrome>
+                            <SeasonalEffect />
+                            <NightLightOverlay />
+                            <LotusToastContainer />
+                          </JotaiProvider>
+                          <ReactQueryDevtools initialIsOpen={false} />
+                        </QueryClientProvider>
+                      </ClientConfigProvider>
+                    );
+                  }}
                 </ClientConfigLoader>
               </FeatureCheck>
             </ScreenSizeProvider>

src/app/pages/client/ClientNonUIFeatures.tsx

@@ -31,6 +31,7 @@ import { allInvitesAtom } from '../../state/room-list/inviteList';
 import { useMatrixClient } from '../../hooks/useMatrixClient';
 import { useClientConfig } from '../../hooks/useClientConfig';
 import { useHydrateMsgDrafts } from '../../hooks/useHydrateMsgDrafts';
+import { OutboxFeature } from '../../features/outbox/OutboxFeature';
 import { useSearchCacheInvalidation } from '../../utils/searchCacheInvalidation';
 import { ClockSkewMonitor } from '../../utils/clockSkew';
 import { clockSkewAtom } from '../../state/clockSkew';
@@ -77,6 +78,7 @@ import { KeyboardShortcutsDialog, useKeyboardShortcutsTrigger } from '../../feat
 import { useRoomsListener } from '../../hooks/useRoomsListener';
 import { threadNotificationsAtom } from '../../state/threadNotifications';
 import { roomIdToActiveThreadIdAtomFamily } from '../../state/room/thread';
+import { lotusLinkBases } from '../../hooks/useLotusLinkBase';
 import {
   getThreadNotificationMode,
   shouldNotifyThreadReply,
@@ -118,11 +120,12 @@ function SystemEmojiFeature() {
 
 // [Gitea #103] Mirror the privacy toggle into the html parser's module flag.
 function LotusPermalinkFeature() {
-  const { hashRouter } = useClientConfig();
+  const { hashRouter, webAppUrl } = useClientConfig();
   useEffect(() => {
-    setLotusPermalinkBase(getOriginBaseUrl(hashRouter));
+    // [Gitea #248] In the desktop app, links to the public web app count too.
+    setLotusPermalinkBase(lotusLinkBases(getOriginBaseUrl(hashRouter), isTauriApp(), webAppUrl));
     return () => setLotusPermalinkBase(undefined);
-  }, [hashRouter]);
+  }, [hashRouter, webAppUrl]);
   return null;
 }
 
@@ -1105,6 +1108,7 @@ export function ClientNonUIFeatures({ children }: ClientNonUIFeaturesProps) {
       <TauriDesktopFeatures />
       <CloseBehaviorPrompt />
       <ConsentRequiredPrompt />
+      <OutboxFeature />
       <LotusDenoiseFeature />
       <DeepLinkNavigator />
       <KeyboardShortcutsFeature />

src/app/pages/client/sidebar/SpaceTabs.tsx

@@ -49,13 +49,7 @@ import { roomToParentsAtom } from '../../../state/room/roomToParents';
 import { allRoomsAtom } from '../../../state/room-list/roomList';
 import { useAnyRoomLiveCall } from '../../../hooks/useSpaceLiveCall';
 import { LiveDot } from './SpaceTabs.css';
-import {
-  getOriginBaseUrl,
-  getSpaceLobbyPath,
-  getSpacePath,
-  joinPathComponent,
-} from '../../pathUtils';
-import { useClientConfig } from '../../../hooks/useClientConfig';
+import { getSpaceLobbyPath, getSpacePath, joinPathComponent } from '../../pathUtils';
 import {
   SidebarAvatar,
   SidebarItem,
@@ -102,6 +96,7 @@ import { settingsAtom } from '../../../state/settings';
 import { useOpenSpaceSettings } from '../../../state/hooks/spaceSettings';
 import { useRoomCreators } from '../../../hooks/useRoomCreators';
 import { useRoomPermissions } from '../../../hooks/useRoomPermissions';
+import { useLotusShareBase } from '../../../hooks/useLotusLinkBase';
 import { InviteUserPrompt } from '../../../components/invite-user-prompt';
 
 type SpaceMenuProps = {
@@ -112,7 +107,7 @@ type SpaceMenuProps = {
 const SpaceMenu = forwardRef<HTMLDivElement, SpaceMenuProps>(
   ({ room, requestClose, onUnpin }, ref) => {
     const mx = useMatrixClient();
-    const { hashRouter } = useClientConfig();
+    const lotusBase = useLotusShareBase();
     const [hideActivity] = useSetting(settingsAtom, 'hideActivity');
     const roomToParents = useAtomValue(roomToParentsAtom);
     const powerLevels = usePowerLevels(room);
@@ -152,9 +147,7 @@ const SpaceMenu = forwardRef<HTMLDivElement, SpaceMenuProps>(
     const handleCopyLotusLink = () => {
       const roomIdOrAlias = getCanonicalAliasOrRoomId(mx, room.roomId);
       const viaServers = isRoomAlias(roomIdOrAlias) ? undefined : getViaServers(room);
-      copyToClipboard(
-        getLotusSpacePermalink(getOriginBaseUrl(hashRouter), roomIdOrAlias, viaServers),
-      );
+      copyToClipboard(getLotusSpacePermalink(lotusBase, roomIdOrAlias, viaServers));
       requestClose();
     };
 

src/app/pages/client/space/Space.tsx

@@ -39,13 +39,7 @@ import {
   NavItemContent,
   NavLink,
 } from '../../../components/nav';
-import {
-  getOriginBaseUrl,
-  getSpaceLobbyPath,
-  getSpaceRoomPath,
-  getSpaceSearchPath,
-} from '../../pathUtils';
-import { useClientConfig } from '../../../hooks/useClientConfig';
+import { getSpaceLobbyPath, getSpaceRoomPath, getSpaceSearchPath } from '../../pathUtils';
 import { getCanonicalAliasOrRoomId, isRoomAlias } from '../../../utils/matrix';
 import { useSelectedRoom } from '../../../hooks/router/useSelectedRoom';
 import {
@@ -92,6 +86,7 @@ import { ContainerColor } from '../../../styles/ContainerColor.css';
 import { AsyncStatus, useAsyncCallback } from '../../../hooks/useAsyncCallback';
 import { BreakWord } from '../../../styles/Text.css';
 import { InviteUserPrompt } from '../../../components/invite-user-prompt';
+import { useLotusShareBase } from '../../../hooks/useLotusLinkBase';
 import { useCallEmbed } from '../../../hooks/useCallEmbed';
 
 type SpaceMenuProps = {
@@ -100,7 +95,7 @@ type SpaceMenuProps = {
 };
 const SpaceMenu = forwardRef<HTMLDivElement, SpaceMenuProps>(({ room, requestClose }, ref) => {
   const mx = useMatrixClient();
-  const { hashRouter } = useClientConfig();
+  const lotusBase = useLotusShareBase();
   const [hideActivity] = useSetting(settingsAtom, 'hideActivity');
   const [developerTools] = useSetting(settingsAtom, 'developerTools');
   const roomToParents = useAtomValue(roomToParentsAtom);
@@ -137,9 +132,7 @@ const SpaceMenu = forwardRef<HTMLDivElement, SpaceMenuProps>(({ room, requestClo
   const handleCopyLotusLink = () => {
     const roomIdOrAlias = getCanonicalAliasOrRoomId(mx, room.roomId);
     const viaServers = isRoomAlias(roomIdOrAlias) ? undefined : getViaServers(room);
-    copyToClipboard(
-      getLotusSpacePermalink(getOriginBaseUrl(hashRouter), roomIdOrAlias, viaServers),
-    );
+    copyToClipboard(getLotusSpacePermalink(lotusBase, roomIdOrAlias, viaServers));
     requestClose();
   };
 

src/app/plugins/call/CallControl.ts

@@ -2,7 +2,7 @@ import { ClientWidgetApi } from 'matrix-widget-api';
 import { EventEmitter } from 'events';
 import { CallControlState } from './CallControlState';
 import { ElementMediaStateDetail, ElementMediaStatePayload, ElementWidgetActions } from './types';
-import { getCallDocument } from './utils';
+import { canDelegateCapability } from './utils';
 
 export enum CallControlEvent {
   StateUpdate = 'state_update',
@@ -19,6 +19,41 @@ export type LotusQualityPayload = {
   screenshareMaxFramerate?: number | null;
 };
 
+/** fromWidget `io.lotus.hotkey` (Gitea #43): a watched key in the call frame. */
+export type ForkHotkeyReport =
+  | {
+      type: 'keydown' | 'keyup';
+      code: string;
+      repeat: boolean;
+      ctrlKey: boolean;
+      altKey: boolean;
+      metaKey: boolean;
+      shiftKey: boolean;
+      /** Went to a text field in the frame. */
+      editable: boolean;
+      /** Went to a button/link in the frame. */
+      interactive: boolean;
+    }
+  | { type: 'focus' };
+
+export function parseForkHotkeyReport(data: unknown): ForkHotkeyReport | null {
+  if (typeof data !== 'object' || data === null) return null;
+  const d = data as Record<string, unknown>;
+  if (d.type === 'focus') return { type: 'focus' };
+  if ((d.type !== 'keydown' && d.type !== 'keyup') || typeof d.code !== 'string') return null;
+  return {
+    type: d.type,
+    code: d.code,
+    repeat: d.repeat === true,
+    ctrlKey: d.ctrlKey === true,
+    altKey: d.altKey === true,
+    metaKey: d.metaKey === true,
+    shiftKey: d.shiftKey === true,
+    editable: d.editable === true,
+    interactive: d.interactive === true,
+  };
+}
+
 export class CallControl extends EventEmitter implements CallControlState {
   private state: CallControlState;
 
@@ -26,14 +61,6 @@ export class CallControl extends EventEmitter implements CallControlState {
 
   private iframe: HTMLIFrameElement;
 
-  private bodyMutationObserver: MutationObserver;
-
-  private controlMutationObserver: MutationObserver;
-
-  // C-H3: coalesces bursts of body-subtree mutations into a single debounced
-  // re-observe pass so a busy EC re-render doesn't thrash the control observer.
-  private bodyMutationTimer?: ReturnType<typeof setTimeout>;
-
   // [Gitea #56] Tracks the participant currently pinned via focusCameraParticipant(),
   // so callers (MemberGlance) can render a "Focus camera" / "Unfocus camera" toggle
   // instead of a one-way pin with no way back. null == no manual pin (speaker-follows).
@@ -62,68 +89,12 @@ export class CallControl extends EventEmitter implements CallControlState {
   // timeout — io.lotus toWidget actions must only be sent after call-join).
   private joined = false;
 
-  private get document(): Document | undefined {
-    return getCallDocument(this.iframe);
-  }
-
-  private get screenshareButton(): HTMLElement | undefined {
-    const screenshareBtn = this.document?.querySelector(
-      '[data-testid="incall_screenshare"]',
-    ) as HTMLElement | null;
-
-    return screenshareBtn ?? undefined;
-  }
-
-  private get leaveButton(): Element | undefined {
-    const leaveBtn = this.document?.querySelector('[data-testid="incall_leave"]');
-
-    return leaveBtn ?? undefined;
-  }
-
-  private get settingsButton(): HTMLElement | undefined {
-    // EC 0.20.1: settings button moved to bottom-left; fall back to bottom-center.
-    const settingsButtonLeft = this.document?.querySelector(
-      '[data-testid="settings-bottom-left"]',
-    ) as HTMLButtonElement | undefined;
-    const settingsButtonCenter = this.document?.querySelector(
-      '[data-testid="settings-bottom-center"]',
-    ) as HTMLButtonElement | undefined;
-
-    return settingsButtonLeft ?? settingsButtonCenter ?? undefined;
-  }
-
-  private get reactionsButton(): HTMLElement | undefined {
-    // EC 0.20.1: reactions/raise-hand button sits just before the leave button.
-    const reactionsButton = this.leaveButton?.previousElementSibling as HTMLElement | null;
-
-    return reactionsButton ?? undefined;
-  }
-
-  private get spotlightButton(): HTMLInputElement | undefined {
-    const spotlightButton = this.document?.querySelector(
-      'input[value="spotlight"]',
-    ) as HTMLInputElement | null;
-
-    return spotlightButton ?? undefined;
-  }
-
-  private get gridButton(): HTMLInputElement | undefined {
-    const gridButton = this.document?.querySelector(
-      'input[value="grid"]',
-    ) as HTMLInputElement | null;
-
-    return gridButton ?? undefined;
-  }
-
   constructor(state: CallControlState, call: ClientWidgetApi, iframe: HTMLIFrameElement) {
     super();
 
     this.state = state;
     this.call = call;
     this.iframe = iframe;
-
-    this.bodyMutationObserver = new MutationObserver(this.onBodyMutation.bind(this));
-    this.controlMutationObserver = new MutationObserver(this.onControlMutation.bind(this));
   }
 
   public getState(): CallControlState {
@@ -180,6 +151,8 @@ export class CallControl extends EventEmitter implements CallControlState {
     this.joined = true;
     this.sendDeafenState();
     this.sendQuality();
+    this.sendHotkeyCodes();
+    this.sendFrameScreenshareAllowed();
   }
 
   /**
@@ -194,62 +167,8 @@ export class CallControl extends EventEmitter implements CallControlState {
     if (this._audioOutputId !== undefined) this.sendAudioOutput(this._audioOutputId);
     // [Gitea #17] The pin lives fork-side and is dropped on a handler remount.
     if (this._focusedUserId !== null) this.sendFocus(this._focusedUserId, this._focusedMediaId);
-  }
-
-  public startObserving() {
-    if (!this.document) return;
-
-    // C-H3: watch the whole body subtree (not just direct children) so we
-    // re-bind the control observer when EC re-renders its controls deeper in the
-    // tree. Debounced via onBodyMutation() to avoid thrashing on busy renders.
-    this.bodyMutationObserver.observe(this.document.body, {
-      childList: true,
-      subtree: true,
-    });
-    this.applyBodyMutation();
-  }
-
-  private onBodyMutation() {
-    // C-H3: coalesce a burst of subtree mutations into one debounced pass.
-    if (this.bodyMutationTimer !== undefined) return;
-    this.bodyMutationTimer = setTimeout(() => {
-      this.bodyMutationTimer = undefined;
-      this.applyBodyMutation();
-    }, 100);
-  }
-
-  private applyBodyMutation() {
-    if (!this.document) return;
-
-    this.document.body.style.setProperty('background', 'none', 'important');
-
-    const controls = this.leaveButton?.parentElement?.parentElement;
-    if (controls) {
-      controls.style.setProperty('position', 'absolute');
-      controls.style.setProperty('visibility', 'hidden');
-    }
-
-    this.observeControls();
-  }
-
-  private observeControls() {
-    this.controlMutationObserver.disconnect();
-
-    const screenshareBtn = this.screenshareButton;
-    if (screenshareBtn) {
-      this.controlMutationObserver.observe(screenshareBtn, {
-        attributes: true,
-        attributeFilter: ['data-kind'],
-      });
-    }
-    const spotlightBtn = this.spotlightButton;
-    if (spotlightBtn) {
-      this.controlMutationObserver.observe(spotlightBtn, {
-        attributes: true,
-      });
-    }
-
-    this.onControlMutation();
+    this.sendHotkeyCodes();
+    this.sendFrameScreenshareAllowed();
   }
 
   private async setMediaState(state: ElementMediaStatePayload) {
@@ -330,30 +249,152 @@ export class CallControl extends EventEmitter implements CallControlState {
     }
   }
 
-  // [Gitea #43] Set once the fork reports io.lotus.controls_state: from then on
-  // layout / settings / reactions go over the widget API and screenshare +
-  // layout state come from that report, not from EC's DOM. Older forks never
-  // send it and keep the DOM path below.
-  private forkControls = false;
+  // [Gitea #43] The fork has reported io.lotus.controls_state, so its Lotus
+  // action handlers are mounted. Screenshare and layout state come from that
+  // report; the host never reads or clicks EC's DOM.
+  private forkReady = false;
+
+  // [Gitea #43] The fork shows EC's own screenshare button inside the frame
+  // (lotusFrameScreenshare: no Capability Delegation here), so the host bar
+  // hides its own.
+  private _frameScreenshare = false;
+
+  private frameScreenshareListeners = new Set<() => void>();
+
+  // [Gitea #43] The fork draws the "Share your screen?" prompt inside the frame
+  // on request (io.lotus.prompt_screenshare), so where the click can't be
+  // delegated our call-bar button asks for that instead of starting the share.
+  private _screensharePrompt = false;
+
+  // [Gitea #43] The fork's in-frame prompt is showing: anything the host lays
+  // over the frame (the picture-in-picture overlay) must let clicks through.
+  private _screensharePromptOpen = false;
+
+  // [Gitea #43] Whether the room's call policy allows screensharing; the fork
+  // hides its in-frame button when it doesn't.
+  private frameScreenshareAllowed = true;
+
+  private hotkeyCodes = new Map<string, string[]>();
+
+  private hotkeyListeners = new Set<(report: ForkHotkeyReport) => void>();
+
+  /** EC's own screenshare button is shown in the frame instead of ours. */
+  public get frameScreenshare(): boolean {
+    return this._frameScreenshare;
+  }
+
+  /**
+   * Starting a share must go through the fork's in-frame prompt: this engine
+   * can't delegate the click (Firefox, Safari, WebKitGTK) and the fork has
+   * the prompt. Stopping never needs it.
+   */
+  public get screenshareNeedsPrompt(): boolean {
+    return this._screensharePrompt && !canDelegateCapability();
+  }
+
+  /** The fork's in-frame "Share your screen?" prompt is showing. */
+  public get screensharePromptOpen(): boolean {
+    return this._screensharePromptOpen;
+  }
+
+  /**
+   * Ask the fork to show "Share your screen?" inside the call frame; its Share
+   * button starts the share with the frame's own click.
+   */
+  public promptScreenshare(): void {
+    this.sendForkAction('io.lotus.prompt_screenshare', {});
+  }
+
+  /**
+   * Subscribe to `frameScreenshare` / `screenshareNeedsPrompt` /
+   * `screensharePromptOpen` changes. Returns an unsubscribe.
+   */
+  public onFrameScreenshareChange(cb: () => void): () => void {
+    this.frameScreenshareListeners.add(cb);
+    return () => {
+      this.frameScreenshareListeners.delete(cb);
+    };
+  }
+
+  /** Room call policy for the in-frame screenshare button. */
+  public setFrameScreenshareAllowed(allowed: boolean): void {
+    this.frameScreenshareAllowed = allowed;
+    this.sendFrameScreenshareAllowed();
+  }
+
+  private sendFrameScreenshareAllowed(): void {
+    if (!this.joined || !this.forkReady) return;
+    if (!this._frameScreenshare && !this._screensharePrompt) return;
+    this.sendForkAction('io.lotus.set_frame_screenshare', {
+      visible: this.frameScreenshareAllowed,
+    });
+  }
+
+  /** Key codes `source` (e.g. 'ptt', 'deafen') wants reported from the frame. */
+  public setHotkeyCodes(source: string, codes: string[]): void {
+    this.hotkeyCodes.set(source, codes);
+    this.sendHotkeyCodes();
+  }
+
+  private sendHotkeyCodes(): void {
+    if (!this.joined || !this.forkReady) return;
+    const codes = [...new Set([...this.hotkeyCodes.values()].flat())];
+    this.call.transport.send('io.lotus.set_hotkeys', { codes }).catch(() => undefined);
+  }
+
+  /** Subscribe to the fork's `io.lotus.hotkey` reports. Returns an unsubscribe. */
+  public onHotkey(cb: (report: ForkHotkeyReport) => void): () => void {
+    this.hotkeyListeners.add(cb);
+    return () => {
+      this.hotkeyListeners.delete(cb);
+    };
+  }
+
+  /** [Gitea #43] The fork's `io.lotus.hotkey` report. */
+  public onHotkeyReport(data: unknown): void {
+    const report = parseForkHotkeyReport(data);
+    if (report) this.hotkeyListeners.forEach((l) => l(report));
+  }
 
   /** [Gitea #43] The fork's `io.lotus.controls_state` report. */
   public onControlsState(data: unknown) {
     if (typeof data !== 'object' || data === null) return;
-    const { screensharing, layout } = data as { screensharing?: unknown; layout?: unknown };
-    this.forkControls = true;
+    const { screensharing, layout, frameScreenshare, screensharePrompt, screensharePromptOpen } =
+      data as {
+        screensharing?: unknown;
+        layout?: unknown;
+        frameScreenshare?: unknown;
+        screensharePrompt?: unknown;
+        screensharePromptOpen?: unknown;
+      };
+    const firstReport = !this.forkReady;
+    this.forkReady = true;
+    const frame = frameScreenshare === true;
+    const prompt = screensharePrompt === true;
+    const promptOpen = screensharePromptOpen === true;
+    if (promptOpen !== this._screensharePromptOpen) {
+      this._screensharePromptOpen = promptOpen;
+      if (frame === this._frameScreenshare && prompt === this._screensharePrompt) {
+        this.frameScreenshareListeners.forEach((l) => l());
+      }
+    }
+    if (frame !== this._frameScreenshare || prompt !== this._screensharePrompt) {
+      const promptTurnedOn = prompt && !this._screensharePrompt;
+      this._frameScreenshare = frame;
+      this._screensharePrompt = prompt;
+      this.frameScreenshareListeners.forEach((l) => l());
+      if (promptTurnedOn && !firstReport) this.sendFrameScreenshareAllowed();
+    }
+    if (firstReport) {
+      this.sendHotkeyCodes();
+      this.sendFrameScreenshareAllowed();
+    }
     this.applyControls(
       typeof screensharing === 'boolean' ? screensharing : this.screenshare,
       layout === 'spotlight' || layout === 'grid' ? layout === 'spotlight' : this.spotlight,
     );
   }
 
-  private onControlMutation() {
-    if (this.forkControls) return;
-    const screenshare: boolean = this.screenshareButton?.getAttribute('data-kind') === 'primary';
-    const spotlight: boolean = this.spotlightButton?.checked ?? false;
-    this.applyControls(screenshare, spotlight);
-  }
-
   private applyControls(screenshare: boolean, spotlight: boolean) {
     const wasScreensharing = this.screenshare;
 
@@ -453,39 +494,65 @@ export class CallControl extends EventEmitter implements CallControlState {
     this.applyScreenshareAudioMuted();
   }
 
+  /**
+   * Must be called synchronously inside the user's click: starting a share
+   * calls getDisplayMedia in the frame, which needs that click. Where the
+   * browser can hand the click over (Capability Delegation, Chromium incl.
+   * WebView2) it is sent with delegation. Elsewhere the host bar hides its
+   * button and EC's own shows in the frame (`frameScreenshare`); a plain send
+   * still stops a share, which needs no click.
+   */
   public toggleScreenshare() {
-    this.screenshareButton?.click();
+    const data = { on: !this.screenshare };
+    if (canDelegateCapability()) {
+      this.sendDelegated('io.lotus.set_screenshare', data, 'display-capture');
+      return;
+    }
+    this.sendForkAction('io.lotus.set_screenshare', data);
+  }
+
+  /**
+   * Send a widget action with `postMessage(…, { delegate })` so the frame
+   * receives the user's activation for `capability`. matrix-widget-api has no
+   * postMessage options, so swap its `sendInternal` for this one synchronous
+   * send (the request is posted before `send()` returns). Delegation refuses a
+   * `*` target origin, so the frame's real origin is used.
+   */
+  private sendDelegated(action: string, data: Record<string, unknown>, capability: string): void {
+    const target = this.iframe.contentWindow;
+    if (!target) return;
+    const targetOrigin = new URL(this.iframe.src, window.location.href).origin;
+    const transport = this.call.transport as unknown as {
+      sendInternal: (message: unknown) => void;
+    };
+    const hadOwn = Object.prototype.hasOwnProperty.call(transport, 'sendInternal');
+    const original = transport.sendInternal;
+    transport.sendInternal = (message: unknown) =>
+      target.postMessage(message, {
+        targetOrigin,
+        delegate: capability,
+      } as WindowPostMessageOptions);
+    try {
+      this.call.transport.send(action, data).catch(() => undefined);
+    } finally {
+      if (hadOwn) transport.sendInternal = original;
+      else delete (transport as { sendInternal?: unknown }).sendInternal;
+    }
   }
 
   public toggleSpotlight() {
-    if (this.forkControls) {
-      this.sendForkAction('io.lotus.set_layout', {
-        layout: this.spotlight ? 'grid' : 'spotlight',
-      });
-      return;
-    }
-    if (this.spotlight) {
-      this.gridButton?.click();
-      return;
-    }
-    this.spotlightButton?.click();
+    this.sendForkAction('io.lotus.set_layout', {
+      layout: this.spotlight ? 'grid' : 'spotlight',
+    });
   }
 
   public toggleReactions() {
-    if (this.forkControls) {
-      this.sendForkAction('io.lotus.toggle_reactions', {});
-      return;
-    }
-    this.reactionsButton?.click();
+    this.sendForkAction('io.lotus.toggle_reactions', {});
   }
 
   public toggleSettings() {
-    if (this.forkControls) {
-      // Same as clicking EC's settings button: opens the modal.
-      this.sendForkAction('io.lotus.open_settings', { open: true });
-      return;
-    }
-    this.settingsButton?.click();
+    // Same as clicking EC's settings button: opens the modal.
+    this.sendForkAction('io.lotus.open_settings', { open: true });
   }
 
   private sendForkAction(action: string, data: Record<string, unknown>): void {
@@ -546,19 +613,27 @@ export class CallControl extends EventEmitter implements CallControlState {
    * track (`io.lotus.inject_audio`) rather than splicing the mic. `url` must be
    * an https/blob URL the widget can fetch WITHOUT credentials — the host
    * resolves an mxc clip to a `blob:` object URL first (authenticated media
-   * can't be fetched cross-realm by the widget). `volume` is 0–1.
+   * can't be fetched cross-realm by the widget) — and `audio` the same clip's
+   * bytes, which the fork prefers. `volume` is 0–1.
    *
    * The local user does not hear their own published track, so callers should
    * also play the clip locally for feedback.
    */
-  public injectAudio(url: string, volume = 1): Promise<{ played: boolean; reason?: string }> {
+  public injectAudio(
+    url: string,
+    volume = 1,
+    audio?: ArrayBuffer,
+  ): Promise<{ played: boolean; reason?: string }> {
     // [EC#13] The fork now refuses while the local mic is muted and replies
     // { played:false, reason:"muted" }; older forks reply {} (treated as played).
+    // [Gitea #43] `audio` carries the clip's bytes: a `blob:` URL only works on
+    // this origin, so a call page on its own origin can't fetch it. Forks that
+    // predate `audio` ignore it and use `url`.
     return this.call.transport
-      .send<{ url: string; volume: number }, { played?: boolean; reason?: string }>(
-        'io.lotus.inject_audio',
-        { url, volume },
-      )
+      .send<
+        { url: string; volume: number; audio?: ArrayBuffer },
+        { played?: boolean; reason?: string }
+      >('io.lotus.inject_audio', audio ? { url, volume, audio } : { url, volume })
       .then((r) => ({ played: r?.played !== false, reason: r?.reason }))
       .catch(() => ({ played: true }));
   }
@@ -587,14 +662,8 @@ export class CallControl extends EventEmitter implements CallControlState {
   }
 
   public dispose() {
-    if (this.bodyMutationTimer !== undefined) {
-      clearTimeout(this.bodyMutationTimer);
-      this.bodyMutationTimer = undefined;
-    }
     // [Gitea #56] Don't let a manual focus pin outlive the call.
     this.clearFocusParticipant();
-    this.bodyMutationObserver.disconnect();
-    this.controlMutationObserver.disconnect();
   }
 
   private emitStateUpdate() {

src/app/plugins/call/CallEmbed.ts

@@ -28,7 +28,9 @@ import {
 import { CallControl } from './CallControl';
 import { CallControlState } from './CallControlState';
 import { verifyDenoiseAssets } from './denoiseSmokeCheck';
-import { getCallDocument } from './utils';
+import { canDelegateCapability } from './utils';
+import { getCallPageUrl } from './callPageUrl';
+import { restrictWidgetMessages } from '../widgetTransport';
 
 // Maximum time to wait for the embedded Element Call iframe to progress from
 // initial load to a ready/joined state. If it hasn't by then, we assume the
@@ -105,8 +107,6 @@ export class CallEmbed {
 
   private readonly initialState: CallControlState;
 
-  private styleRetryObserver?: MutationObserver;
-
   private themeKind: ElementCallThemeKind = 'dark';
 
   // Watchdog: detects an iframe that never reaches a usable state.
@@ -217,6 +217,14 @@ export class CallEmbed {
       //  - transparent background so the room wallpaper shows through natively
       lotusCallState: 'true',
       lotusTransparent: 'true',
+      // [Gitea #43] The fork hides its own footer (we draw the call bar) and
+      // sets its root color-scheme from the theme, instead of us injecting CSS.
+      lotusHostControls: 'true',
+      // [Gitea #43] Engines without Capability Delegation (Firefox, Safari,
+      // WebKitGTK) can't start a share from our call bar: getDisplayMedia
+      // needs the click inside the frame. There the fork shows EC's own
+      // screenshare button and we hide ours.
+      ...(canDelegateCapability() ? {} : { lotusFrameScreenshare: 'true' }),
       // [lotus #3 / P5-15] Arm the fork's audio-inject handler so the in-call
       // soundboard can publish clips into the call. Dormant until the host
       // sends io.lotus.inject_audio (only on an explicit user click), so
@@ -247,10 +255,14 @@ export class CallEmbed {
       params.append('sendNotificationType', CallEmbed.dmCall(intent) ? 'ring' : 'notification');
     }
 
-    const widgetUrl = new URL(
-      `${trimTrailingSlash(import.meta.env.BASE_URL)}/public/element-call/index.html`,
-      window.location.origin,
-    );
+    // [Gitea #43] On its own origin when config.json sets elementCallUrl.
+    const externalPage = getCallPageUrl();
+    const widgetUrl = externalPage
+      ? new URL(externalPage)
+      : new URL(
+          `${trimTrailingSlash(import.meta.env.BASE_URL)}/public/element-call/index.html`,
+          window.location.origin,
+        );
     widgetUrl.search = params.toString();
 
     const options: IWidget = {
@@ -299,6 +311,8 @@ export class CallEmbed {
 
     const callWidgetDriver: WidgetDriver = new CallWidgetDriver(mx, room.roomId);
     const call: ClientWidgetApi = new ClientWidgetApi(widget, iframe, callWidgetDriver);
+    // Only messages from the call's own frame and origin reach the widget API.
+    restrictWidgetMessages(call, iframe, widget.origin);
 
     this.mx = mx;
     this.call = call;
@@ -310,10 +324,6 @@ export class CallEmbed {
     const controlState = initialControlState ?? new CallControlState(true, false, true);
     this.control = new CallControl(controlState, call, iframe);
     this.initialState = controlState;
-    this.control.startObserving();
-    iframe.onload = () => {
-      this.control.startObserving();
-    };
     // If the iframe document itself fails to load, fail fast.
     iframe.onerror = () => {
       this.settleLoad('iframe');
@@ -347,17 +357,8 @@ export class CallEmbed {
     return this.room.roomId;
   }
 
-  get document(): Document | undefined {
-    return getCallDocument(this.iframe);
-  }
-
   public setTheme(theme: ElementCallThemeKind) {
     this.themeKind = theme;
-    const doc = this.document;
-    if (doc && this.joined) {
-      const styleEl = doc.getElementById('lotus-ec-styles');
-      if (styleEl) styleEl.textContent = this.buildStyleContent();
-    }
     return this.call.transport
       .send(WidgetApiToWidgetAction.ThemeChange, { name: theme })
       .catch(() => {
@@ -438,6 +439,12 @@ export class CallEmbed {
         this.control.onControlsState((evt.detail as { data?: unknown } | undefined)?.data);
       }),
     );
+    // [Gitea #43] PTT / deafen keys pressed while focus is inside the frame.
+    this.disposables.push(
+      this.listenAction('io.lotus.hotkey', (evt) => {
+        this.control.onHotkeyReport((evt.detail as { data?: unknown } | undefined)?.data);
+      }),
+    );
     this.disposables.push(
       this.listenAction('io.lotus.call_state', (evt) => {
         const data = (evt.detail as { data?: { participants?: unknown } } | undefined)?.data;
@@ -479,7 +486,6 @@ export class CallEmbed {
     });
     this.clearLoadWatchdog();
     this.loadErrorListeners.clear();
-    this.styleRetryObserver?.disconnect();
     this.call.stop();
     this.container.removeChild(this.iframe);
     this.control.dispose();
@@ -572,14 +578,12 @@ export class CallEmbed {
 
   private onCallJoined(): void {
     this.settleLoad();
-    this.applyStyles();
-    this.control.startObserving();
 
     // C-H1: EC fires JoinCall again on an EC reconnect (this action has no
     // once-guard). forceState() would reset live mic/video/deafen back to the
     // join-time snapshot, so only run it on the FIRST join. On a rejoin we just
-    // re-apply styles/observers (above) and re-push the sticky fork state
-    // (deafen/quality), leaving the user's live media state untouched.
+    // re-push the sticky fork state (deafen/quality), leaving the user's live
+    // media state untouched.
     if (this.joined) {
       this.control.resendForkState();
       return;
@@ -590,50 +594,6 @@ export class CallEmbed {
     this.control.forceState(this.initialState);
   }
 
-  private buildStyleContent(): string {
-    return [
-      'html, body { background: none !important; }',
-      `:root { color-scheme: ${this.themeKind}; }`,
-      '[style*="height: 0"][style*="z-index: 1"][style*="align-self: center"] { display: none !important; }',
-      // EC 0.19.4: avatar uses line-height centering which breaks in some tile sizes;
-      // override with flexbox for reliable centering of the initial letter.
-      '._avatarContainer_1mrho_40 ._avatar_va14e_8 { display: flex !important; align-items: center !important; justify-content: center !important; line-height: 1 !important; }',
-    ].join('\n');
-  }
-
-  private applyStyles(): void {
-    const doc = this.document;
-    if (!doc) return;
-
-    doc.body.style.setProperty('background', 'none', 'important');
-
-    if (!doc.getElementById('lotus-ec-styles')) {
-      const style = doc.createElement('style');
-      style.id = 'lotus-ec-styles';
-      style.textContent = this.buildStyleContent();
-      (doc.head ?? doc.body).appendChild(style);
-    } else {
-      const styleEl = doc.getElementById('lotus-ec-styles');
-      if (styleEl) styleEl.textContent = this.buildStyleContent();
-    }
-
-    // Hide EC built-in controls (we provide our own)
-    const leaveBtn = doc.body.querySelector('[data-testid="incall_leave"]');
-    if (leaveBtn) {
-      this.styleRetryObserver?.disconnect();
-      this.styleRetryObserver = undefined;
-      const controls = leaveBtn.parentElement?.parentElement;
-      if (controls) {
-        controls.style.setProperty('position', 'absolute');
-        controls.style.setProperty('visibility', 'hidden');
-      }
-    } else if (!this.styleRetryObserver) {
-      // Controls not in DOM yet — observe and retry when they appear
-      this.styleRetryObserver = new MutationObserver(() => this.applyStyles());
-      this.styleRetryObserver.observe(doc.body, { childList: true, subtree: true });
-    }
-  }
-
   private onEvent(ev: MatrixEvent): void {
     this.mx.decryptEventIfNeeded(ev);
     this.feedEvent(ev);

src/app/plugins/call/callPageUrl.test.ts

@@ -0,0 +1,40 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { resolveCallPageUrl } from './callPageUrl';
+
+const URL_OK = 'https://call.chat.example.org/public/element-call/index.html';
+
+test('uses an absolute https URL on the web', () => {
+  assert.equal(resolveCallPageUrl(URL_OK, false), URL_OK);
+});
+
+test('strips a query or hash (the app adds its own parameters)', () => {
+  assert.equal(resolveCallPageUrl(`${URL_OK}?x=1#y`, false), URL_OK);
+});
+
+test('allows http only on localhost (development)', () => {
+  assert.equal(
+    resolveCallPageUrl('http://127.0.0.1:5174/public/element-call/index.html', false),
+    'http://127.0.0.1:5174/public/element-call/index.html',
+  );
+  assert.equal(resolveCallPageUrl('http://call.example.org/index.html', false), undefined);
+});
+
+test('desktop keeps the bundled page', () => {
+  assert.equal(resolveCallPageUrl(URL_OK, true), undefined);
+});
+
+test('anything else falls back to the bundled page', () => {
+  [
+    undefined,
+    null,
+    42,
+    '',
+    '  ',
+    'not a url',
+    '/public/element-call/index.html',
+    'http://call.chat.example.org/index.html',
+    ['javascript', 'alert(1)'].join(':'),
+    'data:text/html,x',
+  ].forEach((v) => assert.equal(resolveCallPageUrl(v, false), undefined, String(v)));
+});

src/app/plugins/call/callPageUrl.ts

@@ -0,0 +1,37 @@
+/**
+ * [Gitea #43] Where the Element Call page is loaded from.
+ *
+ * By default it's the copy bundled with this app (same origin). With
+ * `elementCallUrl` in config.json (e.g.
+ * "https://call.chat.lotusguild.org/public/element-call/index.html") the web
+ * app loads it from that origin instead, so the call frame can no longer
+ * reach this origin's storage (login token, crypto store) or service worker.
+ *
+ * Web only: the desktop app keeps its bundled copy (its CSP doesn't allow
+ * another frame origin, and a network copy could drift from the bundle).
+ * Anything that isn't an absolute https URL (http only on localhost, for
+ * development) is ignored, so a bad value falls
+ * back to the bundled page instead of breaking calls.
+ */
+export const resolveCallPageUrl = (value: unknown, desktop: boolean): string | undefined => {
+  if (desktop || typeof value !== 'string' || value.trim() === '') return undefined;
+  try {
+    const url = new URL(value);
+    // http only for local development (localhost is a secure context).
+    const local = url.hostname === 'localhost' || url.hostname === '127.0.0.1';
+    if (url.protocol !== 'https:' && !(url.protocol === 'http:' && local)) return undefined;
+    url.search = '';
+    url.hash = '';
+    return url.href;
+  } catch {
+    return undefined;
+  }
+};
+
+let callPageUrl: string | undefined;
+
+export const setCallPageUrl = (url: string | undefined): void => {
+  callPageUrl = url;
+};
+
+export const getCallPageUrl = (): string | undefined => callPageUrl;

src/app/plugins/call/forkHotkeyReport.test.ts

@@ -0,0 +1,40 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { parseForkHotkeyReport } from './CallControl';
+
+test('parseForkHotkeyReport: key reports keep only known boolean flags', () => {
+  assert.deepEqual(
+    parseForkHotkeyReport({
+      type: 'keydown',
+      code: 'Space',
+      repeat: false,
+      ctrlKey: false,
+      altKey: 'yes',
+      metaKey: false,
+      shiftKey: true,
+      editable: false,
+      interactive: true,
+      extra: 1,
+    }),
+    {
+      type: 'keydown',
+      code: 'Space',
+      repeat: false,
+      ctrlKey: false,
+      altKey: false,
+      metaKey: false,
+      shiftKey: true,
+      editable: false,
+      interactive: true,
+    },
+  );
+  assert.equal(parseForkHotkeyReport({ type: 'keyup', code: 'KeyM' })?.type, 'keyup');
+});
+
+test('parseForkHotkeyReport: focus reports and junk', () => {
+  assert.deepEqual(parseForkHotkeyReport({ type: 'focus' }), { type: 'focus' });
+  assert.equal(parseForkHotkeyReport({ type: 'keydown' }), null);
+  assert.equal(parseForkHotkeyReport({ type: 'click', code: 'Space' }), null);
+  assert.equal(parseForkHotkeyReport(null), null);
+  assert.equal(parseForkHotkeyReport('keydown'), null);
+});

src/app/plugins/call/hooks.ts

@@ -73,3 +73,48 @@ export const useCallMicLevel = (callEmbed: CallEmbed | undefined): number => {
   );
   return useSyncExternalStore(subscribe, () => callEmbed?.getMicLevel() ?? 0);
 };
+
+/**
+ * [Gitea #43] How the call bar's screenshare button behaves:
+ * - `hidden`: EC's own button is inside the frame (fork lotus.20/21), so ours hides;
+ * - `prompt`: starting asks the fork for its in-frame "Share your screen?"
+ *   (no Capability Delegation in this engine);
+ * - `direct`: our own confirm, then a (delegated) set_screenshare.
+ */
+export type ScreenshareMode = 'hidden' | 'prompt' | 'direct';
+
+const screenshareMode = (control: CallControl): ScreenshareMode => {
+  if (control.frameScreenshare) return 'hidden';
+  return control.screenshareNeedsPrompt ? 'prompt' : 'direct';
+};
+
+export const useScreenshareMode = (control: CallControl | undefined): ScreenshareMode => {
+  const [mode, setMode] = useState<ScreenshareMode>(() =>
+    control ? screenshareMode(control) : 'direct',
+  );
+  useEffect(() => {
+    if (!control) {
+      setMode('direct');
+      return undefined;
+    }
+    const sync = () => setMode(screenshareMode(control));
+    sync();
+    return control.onFrameScreenshareChange(sync);
+  }, [control]);
+  return mode;
+};
+
+/** [Gitea #43] The fork's in-frame "Share your screen?" prompt is showing. */
+export const useScreensharePromptOpen = (control: CallControl | undefined): boolean => {
+  const [open, setOpen] = useState(() => control?.screensharePromptOpen ?? false);
+  useEffect(() => {
+    if (!control) {
+      setOpen(false);
+      return undefined;
+    }
+    const sync = () => setOpen(control.screensharePromptOpen);
+    sync();
+    return control.onFrameScreenshareChange(sync);
+  }, [control]);
+  return open;
+};

src/app/plugins/call/utils.ts

@@ -118,17 +118,10 @@ export function getCallCapabilities(
 }
 
 /**
- * The EC iframe's document, or undefined when it cannot be read. The widget is
- * same-origin, but when its navigation fails (offline, blocked) the frame
- * becomes a cross-origin error page and `contentWindow.document` THROWS a
- * SecurityError — which surfaced as page errors (and a React "Should not
- * already be working" cascade) from every DOM-driven call hook the moment the
- * load watchdog fired. Treat "can't read" the same as "not loaded yet".
+ * Capability Delegation (`postMessage(msg, { delegate })`) ships only in
+ * Chromium; other engines silently ignore the option, so the frame would get
+ * no activation. `navigator.userAgentData` is likewise Chromium-only, which
+ * makes it the practical feature test.
  */
-export const getCallDocument = (iframe: HTMLIFrameElement): Document | undefined => {
-  try {
-    return iframe.contentDocument ?? iframe.contentWindow?.document ?? undefined;
-  } catch {
-    return undefined;
-  }
-};
+export const canDelegateCapability = (): boolean =>
+  typeof navigator !== 'undefined' && 'userAgentData' in navigator;

src/app/plugins/react-custom-html-parser.tsx

@@ -122,11 +122,15 @@ const cleanHref = (href: string): string =>
   stripTrackingOnRender ? stripTrackingParams(href) : href;
 
 // [Gitea #130] Links to THIS deployment's room routes render and click like
-// matrix.to links. The base is set once from the client config
-// (ClientNonUIFeatures) because this module has no access to hooks.
-let lotusPermalinkBase: string | undefined;
-export const setLotusPermalinkBase = (baseUrl: string | undefined): void => {
-  lotusPermalinkBase = baseUrl;
+// matrix.to links. The bases are set once from the client config
+// (ClientNonUIFeatures) because this module has no access to hooks. [Gitea
+// #248] Several: the desktop app knows both its local origin and the public web
+// app (`webAppUrl`), and people share the public one.
+let lotusPermalinkBases: string[] = [];
+export const setLotusPermalinkBase = (baseUrls: string | string[] | undefined): void => {
+  lotusPermalinkBases = (Array.isArray(baseUrls) ? baseUrls : [baseUrls]).filter(
+    (b): b is string => !!b,
+  );
 };
 /**
  * The matrix.to form of `href` when it is a matrix.to link or a Lotus
@@ -134,7 +138,11 @@ export const setLotusPermalinkBase = (baseUrl: string | undefined): void => {
  */
 export const toMatrixToHref = (href: string): string | undefined => {
   if (testMatrixTo(href)) return href;
-  return lotusPermalinkBase ? lotusPermalinkToMatrixTo(lotusPermalinkBase, href) : undefined;
+  for (const base of lotusPermalinkBases) {
+    const matrixTo = lotusPermalinkToMatrixTo(base, href);
+    if (matrixTo) return matrixTo;
+  }
+  return undefined;
 };
 
 export const LINKIFY_OPTS: LinkifyOpts = {

src/app/plugins/widgetTransport.test.ts

@@ -0,0 +1,46 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { ClientWidgetApi } from 'matrix-widget-api';
+import { isFromWidgetFrame, restrictWidgetMessages } from './widgetTransport';
+
+const frame = {} as Window;
+const other = {} as Window;
+const ORIGIN = 'https://call.example.org';
+
+test('isFromWidgetFrame: only the widget frame at its origin', () => {
+  assert.equal(isFromWidgetFrame({ source: frame, origin: ORIGIN }, frame, ORIGIN), true);
+  assert.equal(isFromWidgetFrame({ source: other, origin: ORIGIN }, frame, ORIGIN), false);
+  assert.equal(isFromWidgetFrame({ source: frame, origin: 'null' }, frame, ORIGIN), false);
+  assert.equal(
+    isFromWidgetFrame({ source: frame, origin: 'https://evil.example' }, frame, ORIGIN),
+    false,
+  );
+  assert.equal(isFromWidgetFrame({ source: null, origin: ORIGIN }, null, ORIGIN), false);
+});
+
+test('restrictWidgetMessages swaps the listener and drops foreign messages', () => {
+  const seen: unknown[] = [];
+  const original = (ev: MessageEvent) => {
+    seen.push(ev.data);
+  };
+  const transport = { handleMessage: original };
+  const api = { transport } as unknown as ClientWidgetApi;
+  const iframe = { contentWindow: frame } as HTMLIFrameElement;
+  const listeners = new Set<EventListener>([original as EventListener]);
+  const inbound = {
+    addEventListener: (_t: string, l: EventListener) => listeners.add(l),
+    removeEventListener: (_t: string, l: EventListener) => listeners.delete(l),
+  } as unknown as Window;
+
+  restrictWidgetMessages(api, iframe, ORIGIN, inbound);
+  assert.equal(listeners.has(original as EventListener), false);
+  assert.equal(listeners.size, 1);
+  assert.equal(transport.handleMessage === original, false);
+
+  const dispatch = (ev: Partial<MessageEvent>) =>
+    listeners.forEach((l) => l(ev as unknown as Event));
+  dispatch({ source: other, origin: ORIGIN, data: 'spoof' });
+  dispatch({ source: frame, origin: 'null', data: 'wrong-origin' });
+  dispatch({ source: frame, origin: ORIGIN, data: 'real' });
+  assert.deepEqual(seen, ['real']);
+});

src/app/plugins/widgetTransport.ts

@@ -0,0 +1,47 @@
+import { ClientWidgetApi } from 'matrix-widget-api';
+
+type MessageLike = Pick<MessageEvent, 'source' | 'origin'>;
+
+/**
+ * True when a message came from the widget's own frame, at the origin the
+ * widget was loaded from.
+ */
+export const isFromWidgetFrame = (
+  ev: MessageLike,
+  frameWindow: Window | null | undefined,
+  widgetOrigin: string,
+): boolean => !!frameWindow && ev.source === frameWindow && ev.origin === widgetOrigin;
+
+type InboundTransport = {
+  handleMessage: (ev: MessageEvent) => void;
+};
+
+/**
+ * matrix-widget-api's host transport accepts a message from ANY window on the
+ * page as long as it carries the widget's id (its `strictOriginCheck` only
+ * compares against the host's own origin, and is off by default). The call
+ * widget's id is fixed ('call-embed'), so any other frame (a room widget, a
+ * URL-preview embed) could post fromWidget actions as the call: e.g. a fake
+ * push-to-talk keydown turned the user's mic on.
+ *
+ * Swap the transport's listener for one that only lets through messages from
+ * this widget's iframe and origin. `stop()` removes `handleMessage`, which is
+ * the guarded one after this. Call right after `new ClientWidgetApi(...)`,
+ * which has already started the transport.
+ */
+export const restrictWidgetMessages = (
+  api: ClientWidgetApi,
+  iframe: HTMLIFrameElement,
+  widgetOrigin: string,
+  inbound: Pick<Window, 'addEventListener' | 'removeEventListener'> = window,
+): void => {
+  const transport = api.transport as unknown as InboundTransport;
+  const original = transport.handleMessage;
+  const guarded = (ev: MessageEvent) => {
+    if (!isFromWidgetFrame(ev, iframe.contentWindow, widgetOrigin)) return;
+    original(ev);
+  };
+  inbound.removeEventListener('message', original as EventListener);
+  transport.handleMessage = guarded;
+  inbound.addEventListener('message', guarded as EventListener);
+};

src/app/state/plaintextCaches.test.ts

@@ -36,6 +36,7 @@ test('clearPlaintextCaches removes every plaintext/PII localStorage key', () =>
   store.set('cinny_recent_forward_targets_v1', '[]');
   store.set('cinny_recent_gifs_v1', '[]');
   store.set('cinny_recent_stickers_v1', '[]');
+  store.set('lotus_outbox_v1', '{"userId":"@me:server","entries":[]}');
   removed.length = 0;
 
   clearPlaintextCaches();
@@ -47,6 +48,7 @@ test('clearPlaintextCaches removes every plaintext/PII localStorage key', () =>
     'cinny_recent_forward_targets_v1',
     'cinny_recent_gifs_v1',
     'cinny_recent_stickers_v1',
+    'lotus_outbox_v1', // [Gitea #112] unsent message content
   ]) {
     assert.ok(removed.includes(key), `${key} cleared`);
   }

src/app/state/plaintextCaches.ts

@@ -7,6 +7,7 @@ import { clearRecentStickers } from './recentStickers';
 import { clearNavToActivePathStore } from './navToActivePath';
 import { DRAFT_MSG_KEY_PREFIX } from '../utils/draft';
 import { clearCallSession } from '../utils/callRejoin';
+import { clearOutbox } from '../utils/outbox';
 
 /**
  * [Gitea #41] Wipe every persisted composer draft (`draft-msg-<roomId>`). Drafts
@@ -44,6 +45,7 @@ const clearMsgDrafts = (): void => {
  * - `cinny_recent_forward_targets_v1` — recent forward contact/room graph (PII)
  * - `cinny_recent_gifs_v1` / `cinny_recent_stickers_v1` — media the user sent
  * - `navToActivePath<userId>` — per-space last-visited room paths (needs userId)
+ * - `lotus_outbox_v1` — decrypted content of messages not yet sent ([Gitea #112])
  * - `draft-msg-*` — unsent composer drafts (decrypted message text, unscoped by
  *   user — see [Gitea #41]; previously deliberately preserved across logout
  *   (N98), which let the next account on this device see/send a prior user's
@@ -93,6 +95,7 @@ export const clearPlaintextCaches = (userId?: string): void => {
   clearRecentGifs();
   clearRecentStickers();
   clearMsgDrafts();
+  clearOutbox();
   clearCallSession();
   clearStatusMessage();
   if (userId) clearNavToActivePathStore(userId);

src/app/state/sendOffline.ts

@@ -0,0 +1,9 @@
+import { atom } from 'jotai';
+
+/**
+ * [Gitea #112] True while the client can't reach the homeserver (sync is
+ * reconnecting / erroring, or the browser reports offline). Messages that
+ * failed for network reasons show "Queued" instead of "Failed to send" while
+ * this is set; the outbox sends them again once it clears.
+ */
+export const sendOfflineAtom = atom(false);

src/app/utils/callInBrowser.test.ts

@@ -0,0 +1,32 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { getCallInBrowserUrl, resolveWebAppUrl } from './callInBrowser';
+
+test('resolveWebAppUrl keeps an https origin (+ path) without a trailing slash', () => {
+  assert.equal(resolveWebAppUrl('https://chat.example.org'), 'https://chat.example.org');
+  assert.equal(resolveWebAppUrl('https://chat.example.org/'), 'https://chat.example.org');
+  assert.equal(resolveWebAppUrl('https://example.org/chat/'), 'https://example.org/chat');
+  assert.equal(resolveWebAppUrl('https://chat.example.org/?x=1#y'), 'https://chat.example.org');
+});
+
+test('resolveWebAppUrl rejects anything but absolute https', () => {
+  [
+    undefined,
+    null,
+    1,
+    '',
+    ' ',
+    '/home',
+    'http://chat.example.org',
+    'not a url',
+    ['javascript', 'alert(1)'].join(':'),
+    'data:text/html,x',
+  ].forEach((v) => assert.equal(resolveWebAppUrl(v), undefined, String(v)));
+});
+
+test('getCallInBrowserUrl points at the room in the web app (no auto-join)', () => {
+  const url = getCallInBrowserUrl('https://chat.example.org', '!room:example.org');
+  assert.equal(url, 'https://chat.example.org/home/!room%3Aexample.org');
+  assert.ok(!/join|call=/i.test(url ?? ''));
+  assert.equal(getCallInBrowserUrl(undefined, '!room:example.org'), undefined);
+});

src/app/utils/callInBrowser.ts

@@ -0,0 +1,27 @@
+import { getLotusRoomPermalink } from '../plugins/lotus-permalink';
+
+/**
+ * The public web app's address from config.json `webAppUrl` (the desktop app
+ * sets it; its own origin is a local server). Absolute https only; anything
+ * else is ignored.
+ */
+export const resolveWebAppUrl = (value: unknown): string | undefined => {
+  if (typeof value !== 'string' || value.trim() === '') return undefined;
+  try {
+    const url = new URL(value);
+    if (url.protocol !== 'https:') return undefined;
+    return url.origin + url.pathname.replace(/\/+$/, '');
+  } catch {
+    return undefined;
+  }
+};
+
+/**
+ * Where to send the user to take a call this app can't make: the room in the
+ * web app (they press Join there themselves — never an auto-join link, which
+ * a crafted URL could abuse to open someone's mic).
+ */
+export const getCallInBrowserUrl = (
+  webAppUrl: string | undefined,
+  roomId: string,
+): string | undefined => (webAppUrl ? getLotusRoomPermalink(webAppUrl, roomId) : undefined);

src/app/utils/copyImage.test.ts

@@ -0,0 +1,72 @@
+import { afterEach, test } from 'node:test';
+import assert from 'node:assert/strict';
+import { canCopyImage, copyImageFromUrl, toPngBlob } from './copyImage';
+
+const g = globalThis as Record<string, unknown>;
+const saved = {
+  ClipboardItem: Object.getOwnPropertyDescriptor(g, 'ClipboardItem'),
+  navigator: Object.getOwnPropertyDescriptor(g, 'navigator'),
+  fetch: Object.getOwnPropertyDescriptor(g, 'fetch'),
+};
+const stub = (key: keyof typeof saved, value: unknown) =>
+  Object.defineProperty(g, key, { value, configurable: true, writable: true });
+
+afterEach(() => {
+  (Object.keys(saved) as (keyof typeof saved)[]).forEach((key) => {
+    const desc = saved[key];
+    if (desc) Object.defineProperty(g, key, desc);
+    else delete g[key];
+  });
+});
+
+class FakeClipboardItem {
+  constructor(public data: Record<string, Promise<Blob>>) {}
+}
+
+test('canCopyImage is false without ClipboardItem', () => {
+  stub('ClipboardItem', undefined);
+  assert.equal(canCopyImage(), false);
+});
+
+test('canCopyImage is true with ClipboardItem and clipboard.write', () => {
+  stub('ClipboardItem', FakeClipboardItem);
+  stub('navigator', { clipboard: { write: async () => undefined } });
+  assert.equal(canCopyImage(), true);
+});
+
+test('toPngBlob passes a PNG through untouched', async () => {
+  const png = new Blob(['x'], { type: 'image/png' });
+  assert.equal(await toPngBlob(png), png);
+});
+
+test('copyImageFromUrl writes a single image/png item', async () => {
+  const png = new Blob(['x'], { type: 'image/png' });
+  stub('fetch', async () => ({ ok: true, blob: async () => png }));
+  stub('ClipboardItem', FakeClipboardItem);
+  const written: FakeClipboardItem[][] = [];
+  stub('navigator', {
+    clipboard: {
+      write: async (items: FakeClipboardItem[]) => {
+        written.push(items);
+      },
+    },
+  });
+
+  await copyImageFromUrl('blob:x');
+  assert.equal(written.length, 1);
+  assert.deepEqual(Object.keys(written[0][0].data), ['image/png']);
+  assert.equal(await written[0][0].data['image/png'], png);
+});
+
+test('copyImageFromUrl rejects when the fetch fails', async () => {
+  stub('fetch', async () => ({ ok: false, status: 404 }));
+  stub('ClipboardItem', FakeClipboardItem);
+  stub('navigator', {
+    clipboard: {
+      write: async (items: FakeClipboardItem[]) => {
+        await items[0].data['image/png'];
+      },
+    },
+  });
+  await assert.rejects(copyImageFromUrl('blob:x'), /404/);
+});

src/app/utils/copyImage.ts

@@ -0,0 +1,43 @@
+/**
+ * [Gitea #164] Copy an image to the system clipboard.
+ *
+ * The async Clipboard API only guarantees `image/png`, so anything else (JPEG,
+ * WebP, a GIF's first frame) is re-encoded through a canvas first. The blob is
+ * handed to `ClipboardItem` as a promise so the write starts inside the click's
+ * user activation — Safari rejects a write that begins after an await.
+ */
+export function canCopyImage(): boolean {
+  return (
+    typeof ClipboardItem !== 'undefined' &&
+    typeof navigator !== 'undefined' &&
+    typeof navigator.clipboard?.write === 'function'
+  );
+}
+
+export async function toPngBlob(blob: Blob): Promise<Blob> {
+  if (blob.type === 'image/png') return blob;
+  const bitmap = await createImageBitmap(blob);
+  try {
+    const canvas = document.createElement('canvas');
+    canvas.width = bitmap.width;
+    canvas.height = bitmap.height;
+    const ctx = canvas.getContext('2d');
+    if (!ctx) throw new Error('no 2d context');
+    ctx.drawImage(bitmap, 0, 0);
+    return await new Promise<Blob>((resolve, reject) => {
+      canvas.toBlob((b) => (b ? resolve(b) : reject(new Error('png encode failed'))), 'image/png');
+    });
+  } finally {
+    bitmap.close();
+  }
+}
+
+export async function copyImageFromUrl(url: string): Promise<void> {
+  const png = fetch(url)
+    .then((res) => {
+      if (!res.ok) throw new Error(`fetch failed: ${res.status}`);
+      return res.blob();
+    })
+    .then(toPngBlob);
+  await navigator.clipboard.write([new ClipboardItem({ 'image/png': png })]);
+}

src/app/utils/notifications.test.ts

@@ -13,13 +13,16 @@ type ReceiptCall = { eventId: string; receiptType: ReceiptType; unthreaded?: boo
 
 const evt = (id: string, sending = false) => ({ getId: () => id, isSending: () => sending }) as any;
 
-const thread = (id: string, lastReply: any) => ({ id, lastReply: () => lastReply }) as any;
+const thread = (id: string, lastReply: any, extra: Record<string, unknown> = {}) =>
+  ({ id, lastReply: () => lastReply, ...extra }) as any;
 
 type RoomOpts = {
   timeline?: any[];
   readUpTo?: string | null;
   threads?: any[];
   threadUnread?: Record<string, number>;
+  threadHighlight?: Record<string, number>;
+  readEvents?: string[];
   markedUnread?: boolean;
 };
 
@@ -30,8 +33,12 @@ const setup = (opts: RoomOpts) => {
     getLiveTimeline: () => ({ getEvents: () => opts.timeline ?? [] }),
     getEventReadUpTo: () => opts.readUpTo ?? null,
     getThreads: () => opts.threads ?? [],
-    getThreadUnreadNotificationCount: (threadId: string, _type: NotificationCountType) =>
-      opts.threadUnread?.[threadId] ?? 0,
+    hasUserReadEvent: (_userId: string, eventId: string) =>
+      (opts.readEvents ?? []).includes(eventId),
+    getThreadUnreadNotificationCount: (threadId: string, type: NotificationCountType) =>
+      (type === NotificationCountType.Highlight ? opts.threadHighlight : opts.threadUnread)?.[
+        threadId
+      ] ?? 0,
     getAccountData: (type: string) =>
       opts.markedUnread && type === 'm.marked_unread'
         ? { getContent: () => ({ unread: true }) }
@@ -157,3 +164,127 @@ test('private receipt flag uses ReadPrivate', async () => {
   await markAsRead(mx, '!r:server', true);
   assert.equal(calls[0].receiptType, ReceiptType.ReadPrivate);
 });
+
+// [Gitea #217] A passive read (just looking at the room) keeps threads the user
+// follows unread; an explicit mark-as-read still clears everything.
+const sender = (userId: string) => ({ getSender: () => userId });
+
+test('passive: a thread I replied in stays unread; main receipt is scoped to main', async () => {
+  const mine = thread('$mine', evt('$r1'), { hasCurrentUserParticipated: true });
+  const other = thread('$other', evt('$r2'));
+  const { mx, calls } = setup({
+    timeline: [evt('a'), evt('b')],
+    readUpTo: 'a',
+    threads: [mine, other],
+    threadUnread: { $mine: 1, $other: 1 },
+  });
+  await markAsRead(mx, '!r:server', false, { passive: true });
+  assert.deepEqual(
+    calls.map((c) => [c.eventId, c.unthreaded]),
+    [
+      ['b', false], // main-scoped: unthreaded would also read $mine's reply
+      ['$r2', false],
+    ],
+  );
+});
+
+test('passive: threads I started or was mentioned in stay unread', async () => {
+  const started = thread('$started', evt('$r1'), { rootEvent: sender('@me:server') });
+  const byTimeline = thread('$t', evt('$r2'), { timeline: [sender('@me:server')] });
+  const mentioned = thread('$mention', evt('$r3'));
+  const { mx, calls } = setup({
+    timeline: [evt('a')],
+    readUpTo: 'a',
+    threads: [started, byTimeline, mentioned],
+    threadUnread: { $started: 1, $t: 1, $mention: 1 },
+    threadHighlight: { $mention: 1 },
+  });
+  await markAsRead(mx, '!r:server', false, { passive: true });
+  assert.equal(calls.length, 0);
+});
+
+test('passive: no followed thread unread → main receipt stays unthreaded', async () => {
+  const other = thread('$other', evt('$r2'), { rootEvent: sender('@bob:server') });
+  const { mx, calls } = setup({
+    timeline: [evt('a'), evt('b')],
+    readUpTo: 'a',
+    threads: [other],
+    threadUnread: { $other: 1 },
+  });
+  await markAsRead(mx, '!r:server', false, { passive: true });
+  assert.deepEqual(
+    calls.map((c) => [c.eventId, c.unthreaded]),
+    [
+      ['b', true],
+      ['$r2', false],
+    ],
+  );
+});
+
+test('explicit mark as read clears followed threads too', async () => {
+  const mine = thread('$mine', evt('$r1'), { hasCurrentUserParticipated: true });
+  const { mx, calls } = setup({
+    timeline: [evt('a'), evt('b')],
+    readUpTo: 'a',
+    threads: [mine],
+    threadUnread: { $mine: 1 },
+  });
+  await markAsRead(mx, '!r:server', false);
+  assert.deepEqual(
+    calls.map((c) => [c.eventId, c.unthreaded]),
+    [
+      ['b', true],
+      ['$r1', false],
+    ],
+  );
+});
+
+test('passive: the thread open in the panel is left to the panel', async () => {
+  const open = thread('$open', evt('$r1'));
+  const other = thread('$other', evt('$r2'));
+  const { mx, calls } = setup({
+    timeline: [evt('a')],
+    readUpTo: 'a',
+    threads: [open, other],
+    threadUnread: { $open: 1, $other: 1 },
+  });
+  await markAsRead(mx, '!r:server', false, { passive: true, openThreadId: '$open' });
+  assert.deepEqual(
+    calls.map((c) => c.eventId),
+    ['$r2'],
+  );
+});
+
+test('passive: a followed thread whose count lags is still protected', async () => {
+  // The reply and a newer main message arrived in the same sync; the thread's
+  // count is still 0 but its latest reply (from bob) is unread.
+  const reply = { ...evt('$r1'), getSender: () => '@bob:server' };
+  const mine = thread('$mine', reply, { hasCurrentUserParticipated: true });
+  const { mx, calls } = setup({
+    timeline: [evt('a'), evt('b')],
+    readUpTo: 'a',
+    threads: [mine],
+    threadUnread: { $mine: 0 },
+  });
+  await markAsRead(mx, '!r:server', false, { passive: true });
+  assert.deepEqual(
+    calls.map((c) => [c.eventId, c.unthreaded]),
+    [['b', false]],
+  );
+});
+
+test('passive: followed thread already read → main receipt stays unthreaded', async () => {
+  const reply = { ...evt('$r1'), getSender: () => '@bob:server' };
+  const mine = thread('$mine', reply, { hasCurrentUserParticipated: true });
+  const { mx, calls } = setup({
+    timeline: [evt('a'), evt('b')],
+    readUpTo: 'a',
+    threads: [mine],
+    readEvents: ['$r1'],
+  });
+  await markAsRead(mx, '!r:server', false, { passive: true });
+  assert.deepEqual(
+    calls.map((c) => [c.eventId, c.unthreaded]),
+    [['b', true]],
+  );
+});

src/app/utils/notifications.ts

@@ -1,8 +1,42 @@
-import { MatrixClient, NotificationCountType, ReceiptType } from 'matrix-js-sdk';
+import { MatrixClient, NotificationCountType, ReceiptType, Room, Thread } from 'matrix-js-sdk';
 import { getSettings } from '../state/settings';
 import { readMarkedUnread, setMarkedUnread } from '../state/room/markedUnread';
 
-export async function markAsRead(mx: MatrixClient, roomId: string, privateReceipt: boolean) {
+/**
+ * [Gitea #217] Threads the user is following: they started it, replied in it,
+ * or were mentioned in it. `hasCurrentUserParticipated` comes from the server's
+ * thread bundle and lags a reply we just sent, so our own loaded events count too.
+ */
+export function isThreadFollowed(room: Room, thread: Thread, userId: string | null): boolean {
+  if (thread.hasCurrentUserParticipated) return true;
+  if (userId && thread.rootEvent?.getSender() === userId) return true;
+  if (userId && thread.timeline?.some((e) => e.getSender() === userId)) return true;
+  return (
+    (room.getThreadUnreadNotificationCount(thread.id, NotificationCountType.Highlight) ?? 0) > 0
+  );
+}
+
+export type MarkAsReadOptions = {
+  /**
+   * [Gitea #217] The read comes from simply looking at the room (timeline at
+   * the bottom and focused), not an explicit "mark as read". Threads the user
+   * follows stay unread until their panel is opened, like Slack and Discord;
+   * the rest are cleared so they don't keep the room dot lit forever.
+   */
+  passive?: boolean;
+  /**
+   * The thread open in the thread panel, which sends its own receipts; skip it
+   * here so each reply isn't receipted twice.
+   */
+  openThreadId?: string;
+};
+
+export async function markAsRead(
+  mx: MatrixClient,
+  roomId: string,
+  privateReceipt: boolean,
+  { passive = false, openThreadId }: MarkAsReadOptions = {},
+) {
   const { privateReadReceipts } = getSettings();
   const room = mx.getRoom(roomId);
   if (!room) return;
@@ -29,12 +63,32 @@ export async function markAsRead(mx: MatrixClient, roomId: string, privateReceip
     return null;
   };
 
+  const threads = room.getThreads();
+  const threadUnread = (thread: Thread) =>
+    room.getThreadUnreadNotificationCount(thread.id, NotificationCountType.Total) ?? 0;
+  const keepThread = (thread: Thread) => passive && isThreadFollowed(room, thread, mx.getUserId());
+  // [Gitea #217] An unthreaded receipt also reads every thread reply older than
+  // it, so a passive read while a followed thread is unread must stay scoped
+  // to the main timeline or the next main message would clear that thread.
+  // The count can lag: a reply and a newer main message often arrive in the
+  // same sync, before the thread's count is updated, so also ask whether the
+  // latest reply has been read.
+  const myUserId = mx.getUserId();
+  const hasUnreadReply = (thread: Thread) => {
+    if (threadUnread(thread) > 0) return true;
+    const last = thread.lastReply();
+    const lastId = last?.getId();
+    if (!last || !lastId || !myUserId || last.getSender() === myUserId) return false;
+    return !room.hasUserReadEvent(myUserId, lastId);
+  };
+  const keepAnyThread = threads.some((thread) => keepThread(thread) && hasUnreadReply(thread));
+
   const latestEvent = timeline.length > 0 ? getLatestValidEvent() : null;
   if (latestEvent) {
     // Unthreaded receipt: with client threadSupport enabled the SDK would
     // otherwise scope this to the main timeline (thread_id: "main"). Unthreaded
     // clears the main timeline + every event up to this one.
-    await mx.sendReadReceipt(latestEvent, receiptType, true);
+    await mx.sendReadReceipt(latestEvent, receiptType, !keepAnyThread);
   }
 
   // Clear per-thread notification counts too — the room's unread dot sums them,
@@ -50,12 +104,10 @@ export async function markAsRead(mx: MatrixClient, roomId: string, privateReceip
   // returns null -> the room is reported unread on every mark-read call (this was
   // the P6 regression, amplified by the bulk mark-all-orphan-rooms-read callers).
   // If a thread's replies aren't loaded (lastReply() null), just skip it.
-  const threads = room.getThreads();
   await Promise.all(
     threads.map((thread) => {
-      const unread =
-        room.getThreadUnreadNotificationCount(thread.id, NotificationCountType.Total) ?? 0;
-      if (unread <= 0) return undefined;
+      if (threadUnread(thread) <= 0) return undefined;
+      if (keepThread(thread) || thread.id === openThreadId) return undefined;
       const lastReply = thread.lastReply();
       if (!lastReply || lastReply.isSending()) return undefined;
       // Threaded receipt (unthreaded = false → the SDK scopes it to this thread

src/app/utils/outbox.test.ts

@@ -0,0 +1,131 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import {
+  OUTBOX_AUTOSEND_MS,
+  OUTBOX_MAX_ENTRIES,
+  OutboxEntry,
+  isRetryableSendError,
+  outboxRetryDelayMs,
+  parseOutbox,
+  planRestore,
+  shouldKeepInOutbox,
+  withEntry,
+  withoutEntry,
+} from './outbox';
+
+const entry = (txnId: string, ts: number, roomId = '!a:hs'): OutboxEntry => ({
+  txnId,
+  roomId,
+  threadId: null,
+  type: 'm.room.message',
+  content: { msgtype: 'm.text', body: txnId },
+  ts,
+});
+
+test('keeps message-like events, not call signalling or redactions', () => {
+  assert.equal(shouldKeepInOutbox('m.room.message', { body: 'hi' }), true);
+  assert.equal(shouldKeepInOutbox('m.reaction', { 'm.relates_to': { event_id: '$x' } }), true);
+  assert.equal(shouldKeepInOutbox('org.matrix.msc3381.poll.start', {}), true);
+  assert.equal(shouldKeepInOutbox('org.matrix.msc4075.rtc.notification', {}), false);
+  assert.equal(shouldKeepInOutbox('m.call.invite', {}), false);
+  assert.equal(shouldKeepInOutbox('m.room.redaction', {}), false);
+});
+
+test('skips events that point at another unsent message (local id)', () => {
+  assert.equal(
+    shouldKeepInOutbox('m.reaction', { 'm.relates_to': { event_id: '~!a:hs:m123' } }),
+    false,
+  );
+  assert.equal(
+    shouldKeepInOutbox('m.room.message', {
+      body: 'reply',
+      'm.relates_to': { 'm.in_reply_to': { event_id: '~!a:hs:m1' } },
+    }),
+    false,
+  );
+  assert.equal(
+    shouldKeepInOutbox('m.room.message', {
+      body: 'reply',
+      'm.relates_to': { 'm.in_reply_to': { event_id: '$real' } },
+    }),
+    true,
+  );
+});
+
+test('retryable: connection loss, timeouts, rate limits, server errors', () => {
+  const connectionError = new Error('fetch failed');
+  Object.defineProperty(connectionError, 'name', { value: 'ConnectionError' });
+  assert.equal(isRetryableSendError(connectionError), true);
+  assert.equal(isRetryableSendError({ httpStatus: 429 }), true);
+  assert.equal(isRetryableSendError({ httpStatus: 408 }), true);
+  assert.equal(isRetryableSendError({ httpStatus: 502 }), true);
+});
+
+test('not retryable: client errors, consent, unknown or missing errors', () => {
+  assert.equal(isRetryableSendError({ httpStatus: 403, errcode: 'M_FORBIDDEN' }), false);
+  assert.equal(isRetryableSendError({ httpStatus: 403, errcode: 'M_CONSENT_NOT_GIVEN' }), false);
+  assert.equal(isRetryableSendError({ httpStatus: 400 }), false);
+  assert.equal(isRetryableSendError(new Error('encryption failed')), false);
+  assert.equal(isRetryableSendError(undefined), false);
+  assert.equal(isRetryableSendError(null), false);
+});
+
+test('parse: only this user, only well-formed entries, junk tolerated', () => {
+  const good = entry('m1', 1);
+  const raw = JSON.stringify({ userId: '@me:hs', entries: [good, { txnId: 5 }, null] });
+  assert.deepEqual(parseOutbox(raw, '@me:hs'), [good]);
+  assert.deepEqual(parseOutbox(raw, '@other:hs'), []);
+  assert.deepEqual(parseOutbox('{not json', '@me:hs'), []);
+  assert.deepEqual(parseOutbox(null, '@me:hs'), []);
+});
+
+test('withEntry: first write wins, sorted, capped (oldest dropped)', () => {
+  const a = entry('a', 2);
+  let list = withEntry([], a);
+  assert.equal(withEntry(list, { ...a, content: { body: 'changed' } }), list);
+  list = withEntry(list, entry('b', 1));
+  assert.deepEqual(
+    list.map((e) => e.txnId),
+    ['b', 'a'],
+  );
+  let many: OutboxEntry[] = [];
+  for (let i = 0; i < OUTBOX_MAX_ENTRIES + 5; i += 1) many = withEntry(many, entry(`t${i}`, i));
+  assert.equal(many.length, OUTBOX_MAX_ENTRIES);
+  assert.equal(many[0].txnId, 't5');
+});
+
+test('withoutEntry: removes, and returns the same list when absent', () => {
+  const list = [entry('a', 1), entry('b', 2)];
+  assert.deepEqual(
+    withoutEntry(list, 'a').map((e) => e.txnId),
+    ['b'],
+  );
+  assert.equal(withoutEntry(list, 'zzz'), list);
+});
+
+test('restore plan: drops delivered / left rooms, auto-sends only recent ones', () => {
+  const now = 10 * OUTBOX_AUTOSEND_MS;
+  const recent = entry('recent', now - 60_000);
+  const old = entry('old', now - OUTBOX_AUTOSEND_MS - 1);
+  const delivered = entry('delivered', now - 1000);
+  const left = entry('left', now - 1000, '!left:hs');
+  const plan = planRestore(
+    [recent, left, old, delivered],
+    now,
+    (roomId) => roomId !== '!left:hs',
+    (e) => e.txnId === 'delivered',
+  );
+  assert.deepEqual(
+    plan.restore.map((e) => e.txnId),
+    ['old', 'recent'],
+  );
+  assert.deepEqual([...plan.autoSend], ['recent']);
+  assert.deepEqual(plan.drop.map((e) => e.txnId).sort(), ['delivered', 'left']);
+});
+
+test('blip retry delay backs off and is capped at a minute', () => {
+  assert.deepEqual(
+    [0, 1, 2, 3, 4, 9].map(outboxRetryDelayMs),
+    [5000, 10000, 20000, 40000, 60000, 60000],
+  );
+});

src/app/utils/outbox.ts

@@ -0,0 +1,182 @@
+import { IContent } from 'matrix-js-sdk';
+
+/**
+ * [Gitea #112] Offline outbox: unsent messages survive a reload and are
+ * retried when the connection comes back.
+ *
+ * The SDK keeps local echoes in memory only (chronological pending ordering),
+ * so a reload used to drop every message that hadn't reached the server. Each
+ * own message send is mirrored here (type + clear content + txnId) from its
+ * first local echo until the server confirms it or the user cancels it. On
+ * the next start it is put back as a failed local echo (Retry / Cancel as
+ * usual) and, if it's recent, sent again with the SAME txnId — the server
+ * deduplicates a transaction it already accepted.
+ *
+ * The content is the decrypted message, like a composer draft: it lives in
+ * localStorage until sent and is wiped on logout (clearPlaintextCaches).
+ */
+
+export type OutboxEntry = {
+  txnId: string;
+  roomId: string;
+  threadId: string | null;
+  type: string;
+  content: IContent;
+  /** When the message was first sent (local echo timestamp, ms). */
+  ts: number;
+};
+
+type Stored = { userId: string; entries: OutboxEntry[] };
+
+const STORAGE_KEY = 'lotus_outbox_v1';
+/** Hard cap so a long offline stretch can't grow localStorage without bound. */
+export const OUTBOX_MAX_ENTRIES = 100;
+/**
+ * Restored messages younger than this are sent again automatically after a
+ * reload; older ones come back as "Failed to send" and wait for the user
+ * (sending a message typed hours ago without asking would surprise people).
+ */
+export const OUTBOX_AUTOSEND_MS = 60 * 60 * 1000;
+/** Auto-retries per message per session (one per reconnect). */
+export const OUTBOX_MAX_AUTO_RETRIES = 10;
+
+/** Delay before automatic retry number `attempt` (0-based) after a blip. */
+export const outboxRetryDelayMs = (attempt: number): number =>
+  Math.min(5000 * 2 ** Math.max(0, attempt), 60_000);
+
+/** Message-like events worth keeping. Not call signalling, not redactions. */
+export const OUTBOX_EVENT_TYPES: ReadonlySet<string> = new Set([
+  'm.room.message',
+  'm.sticker',
+  'm.reaction',
+  'm.poll.start',
+  'm.poll.response',
+  'm.poll.end',
+  'org.matrix.msc3381.poll.start',
+  'org.matrix.msc3381.poll.response',
+  'org.matrix.msc3381.poll.end',
+]);
+
+const relatesToPendingEvent = (content: IContent): boolean => {
+  const rel = content['m.relates_to'] as
+    | { event_id?: unknown; 'm.in_reply_to'?: { event_id?: unknown } }
+    | undefined;
+  const ids = [rel?.event_id, rel?.['m.in_reply_to']?.event_id];
+  // A local echo's id ("~!room:txn") means nothing after a reload.
+  return ids.some((id) => typeof id === 'string' && id.startsWith('~'));
+};
+
+/** Whether a send should be mirrored into the outbox. */
+export const shouldKeepInOutbox = (type: string, content: IContent): boolean =>
+  OUTBOX_EVENT_TYPES.has(type) && !relatesToPendingEvent(content);
+
+/**
+ * A failure the network is to blame for: no connection (the SDK's
+ * ConnectionError), a timeout, rate limiting or a server error. Anything else
+ * (403, consent, bad request, encryption failure) needs the user.
+ */
+export const isRetryableSendError = (err: unknown): boolean => {
+  if (!err || typeof err !== 'object') return false;
+  const { name, httpStatus } = err as { name?: unknown; httpStatus?: unknown };
+  if (name === 'ConnectionError') return true;
+  if (typeof httpStatus !== 'number') return false;
+  return httpStatus === 408 || httpStatus === 429 || httpStatus >= 500;
+};
+
+const isEntry = (e: unknown): e is OutboxEntry => {
+  if (!e || typeof e !== 'object') return false;
+  const o = e as Record<string, unknown>;
+  return (
+    typeof o.txnId === 'string' &&
+    typeof o.roomId === 'string' &&
+    (o.threadId === null || typeof o.threadId === 'string') &&
+    typeof o.type === 'string' &&
+    !!o.content &&
+    typeof o.content === 'object' &&
+    typeof o.ts === 'number'
+  );
+};
+
+/** Parse the stored outbox, keeping only this user's well-formed entries. */
+export const parseOutbox = (raw: string | null, userId: string): OutboxEntry[] => {
+  if (!raw) return [];
+  try {
+    const parsed = JSON.parse(raw) as Partial<Stored>;
+    if (parsed.userId !== userId || !Array.isArray(parsed.entries)) return [];
+    return parsed.entries.filter(isEntry);
+  } catch {
+    return [];
+  }
+};
+
+/** Add (or keep) an entry: first write wins, oldest dropped past the cap. */
+export const withEntry = (entries: OutboxEntry[], entry: OutboxEntry): OutboxEntry[] => {
+  if (entries.some((e) => e.txnId === entry.txnId)) return entries;
+  const next = [...entries, entry].sort((a, b) => a.ts - b.ts);
+  return next.length > OUTBOX_MAX_ENTRIES ? next.slice(next.length - OUTBOX_MAX_ENTRIES) : next;
+};
+
+export const withoutEntry = (entries: OutboxEntry[], txnId: string): OutboxEntry[] =>
+  entries.some((e) => e.txnId === txnId) ? entries.filter((e) => e.txnId !== txnId) : entries;
+
+export type RestorePlan = {
+  /** Put back as failed local echoes, oldest first. */
+  restore: OutboxEntry[];
+  /** Subset of `restore` to send again right away. */
+  autoSend: Set<string>;
+  /** Already delivered or no longer sendable: forget them. */
+  drop: OutboxEntry[];
+};
+
+/**
+ * Decide what to do with the stored outbox on start.
+ * `canSend(roomId)`: the user is still joined; `delivered(entry)`: the
+ * server already has it (the transaction id came back down /sync).
+ */
+export const planRestore = (
+  entries: OutboxEntry[],
+  now: number,
+  canSend: (roomId: string) => boolean,
+  delivered: (entry: OutboxEntry) => boolean,
+): RestorePlan => {
+  const restore: OutboxEntry[] = [];
+  const autoSend = new Set<string>();
+  const drop: OutboxEntry[] = [];
+  [...entries]
+    .sort((a, b) => a.ts - b.ts)
+    .forEach((entry) => {
+      if (!canSend(entry.roomId) || delivered(entry)) {
+        drop.push(entry);
+        return;
+      }
+      restore.push(entry);
+      if (now - entry.ts < OUTBOX_AUTOSEND_MS) autoSend.add(entry.txnId);
+    });
+  return { restore, autoSend, drop };
+};
+
+export const loadOutbox = (userId: string): OutboxEntry[] => {
+  try {
+    return parseOutbox(localStorage.getItem(STORAGE_KEY), userId);
+  } catch {
+    return [];
+  }
+};
+
+export const saveOutbox = (userId: string, entries: OutboxEntry[]): void => {
+  try {
+    if (entries.length === 0) localStorage.removeItem(STORAGE_KEY);
+    else localStorage.setItem(STORAGE_KEY, JSON.stringify({ userId, entries } satisfies Stored));
+  } catch {
+    // Storage full or blocked: the outbox is best-effort.
+  }
+};
+
+/** Wipe the outbox (logout): it holds decrypted message content. */
+export const clearOutbox = (): void => {
+  try {
+    localStorage.removeItem(STORAGE_KEY);
+  } catch {
+    /* localStorage unavailable — nothing to clear */
+  }
+};

src/lotus-terminal.css.ts

@@ -898,6 +898,14 @@ globalStyle(
     boxShadow: '0 0 10px rgba(255,107,0,0.10)',
   },
 );
+// [Gitea #246] The poll's winning answer (after it ends).
+globalStyle(
+  `body.${lotusTerminalBodyClass} [data-poll-content] [data-poll-answer][data-winner="true"]`,
+  {
+    border: '1px solid rgba(0,255,136,0.55) !important',
+    boxShadow: '0 0 10px rgba(0,255,136,0.10)',
+  },
+);
 globalStyle(`body.${lotusTerminalBodyClass} [data-poll-content] [data-poll-content-label]`, {
   color: 'rgba(0,212,255,0.60) !important',
   opacity: '1 !important',