feat(desktop): mirror the login tokens into the OS keychain (#105 , step 1)

Step 1 of moving the desktop app's login out of the webview's plaintext localStorage: keep a verified copy of the tokens in the OS keychain (Windows Credential Manager, via cinny-desktop's new secure_session_* commands). The session is still read from localStorage exactly as before, so nothing about login changes and a keychain problem can't log anyone out. Step 2 (a later release, once this has run on real installs) switches reads to the keychain and drops the tokens from localStorage. - sessions.ts: onSessionPersisted — listeners told about every session write (login, token rotation) and removal (logout); a throwing listener can't break the write. - keychainMirror.ts: desktop only. Mirrors userId/deviceId/accessToken/ refreshToken (not the rest of the session); reads first and writes only when the copy differs, then verifies by reading back; serialized, 5 s timeouts; no session → clear (also covers a logout whose reload beat the clear). Every failure is a status, never an exception. A desktop build without the commands reads as "unsupported", so this can ship before the desktop side. - Settings → General (desktop): "Login in the system keychain" status. Tested: unit tests (fake keychain: store, no rewrite when current, rotation, clear, unsupported, missing commands, denied write, read-back mismatch, timeout); a simulated desktop app with a fake keychain, 14/14 (login mirrors only the secrets, Settings status, reload verifies without rewriting, logout clears, an existing session is mirrored after upgrade, Linux/denied show an honest status and stay logged in); the real Linux desktop binary (commands answer "unsupported", login unaffected, Settings says so). Unit 1295 pass, Playwright 20 passed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA
Merge pull request 'A stalled server no longer reads as "your clock is ahead"' (#251 ) from clock-skew-lag into lotus
2026-09-29 00:24:46 -04:00 · 2026-09-28 22:40:13 -04:00 · 2026-09-28 22:11:31 -04:00 · 2026-09-28 22:08:28 -04:00 · 2026-09-28 22:08:13 -04:00 · 2026-09-28 21:40:02 -04:00
27 changed files with 1427 additions and 235 deletions
@@ -257,12 +257,21 @@ test.describe('local homeserver regression', () => {
    await page.clock.install({ time: Date.now() + 14 * 60 * 1000 });
    await loginUI(page, alice);
    await openRoom(page, room);
-    for (let i = 0; i < 4; i += 1) {
-      // eslint-disable-next-line no-await-in-loop
-      await sendText(bob, room, `tick ${i}`);
-      // eslint-disable-next-line no-await-in-loop
-      await page.waitForTimeout(500);
-    }
+    const ticks = async (from: number, n: number) => {
+      for (let i = from; i < from + n; i += 1) {
+        // eslint-disable-next-line no-await-in-loop
+        await sendText(bob, room, `tick ${i}`);
+        // eslint-disable-next-line no-await-in-loop
+        await page.waitForTimeout(500);
+      }
+    };
+    await ticks(0, 4);
+    // "Ahead" could be a late delivery (a stalled server), so it is only
+    // reported once it has held for a minute of fresh samples.
+    await page.waitForTimeout(2000);
+    await expect(page.getByText(/clock is .*ahead of the server/)).toHaveCount(0);
+    await page.clock.fastForward('01:05');
+    await ticks(4, 2);
    await expect(page.getByText(/clock is .*14 minutes ahead of the server/)).toBeVisible();
    await page.getByRole('button', { name: 'Dismiss for 24 h' }).click();
    await expect(page.getByText(/clock is .*ahead of the server/)).toHaveCount(0);
@@ -261,52 +261,69 @@ export function PollContent({
    handleVote(answers[idx].id);
  };

-  const headerLabel = isEnded
-    ? 'Poll closed · Final results'
-    : `Poll · ${isMultiple ? 'Multiple choice' : 'Single choice'}`;
+  // [Gitea #246] Type line under the "Poll" label.
+  const typeLabel = (() => {
+    if (isEnded) return 'Final results';
+    if (isUndisclosed) return 'Results hidden until the end';
+    return isMultiple ? `Pick up to ${maxSelections}` : 'Single choice';
+  })();

+  // Multiple choice counts people, not answers ("1 voter" who picked two).
+  const unit = isMultiple ? 'voter' : 'vote';
  const footerNote = (() => {
+    const totalPart = total > 0 ? `${total} ${unit}${total === 1 ? '' : 's'}` : `No ${unit}s yet`;
    if (isUndisclosed && !isEnded) {
      return canVote
-        ? 'Voting open · Results hidden until the poll ends'
-        : 'Results hidden until the poll ends';
+        ? `${myVotes.size > 0 ? 'You voted' : 'Voting open'} · results shown when the poll ends`
+        : 'Results shown when the poll ends';
    }
-    const votesPart = total > 0 ? `${total} vote${total === 1 ? '' : 's'}` : 'No votes yet';
-    if (isEnded) return `${votesPart} · Poll closed`;
-    if (!canVote) return votesPart;
-    if (isMultiple) return `${votesPart} · Select up to ${maxSelections}`;
-    return `${votesPart} · ${myVotes.size > 0 ? 'Click to change' : 'Click to vote'}`;
+    if (isEnded) return `${totalPart} · Poll closed`;
+    if (!canVote) return totalPart;
+    return `${totalPart} · ${myVotes.size > 0 ? 'Select another answer to change your vote' : 'Select an answer to vote'}`;
  })();

+  // Neutral tones derived from the theme's text colour, so they have contrast
+  // in every theme (the Container/ContainerLine tokens were near-invisible).
+  const muted = (pct: number) =>
+    `color-mix(in srgb, ${color.SurfaceVariant.OnContainer} ${pct}%, transparent)`;
+
  return (
    <Box
      data-poll-content
      direction="Column"
-      gap="200"
-      style={{ maxWidth: '340px', paddingTop: '2px', paddingBottom: '4px' }}
+      gap="300"
+      style={{
+        // Same width for every poll (the message body shrink-wraps its content).
+        width: toRem(460),
+        maxWidth: '100%',
+        margin: `${config.space.S100} 0`,
+        padding: config.space.S300,
+        borderRadius: config.radii.R400,
+        border: `${config.borderWidth.B300} solid ${muted(18)}`,
+        background: muted(4),
+        boxSizing: 'border-box',
+      }}
    >
-      <Text
-        as="div"
-        size="T200"
-        priority="300"
-        data-poll-content-label
-        style={{
-          fontWeight: 700,
-          letterSpacing: '0.12em',
-          textTransform: 'uppercase',
-          marginBottom: config.space.S100,
-        }}
-      >
-        <span aria-hidden>◉ </span>
-        {headerLabel}
-      </Text>
-      <Text size="T400" style={{ fontWeight: 600 }}>
-        {question}
-      </Text>
+      <Box direction="Column" gap="100">
+        <Box alignItems="Center" gap="200" wrap="Wrap" data-poll-content-label>
+          <Icon size="100" src={Icons.OrderList} style={{ opacity: 0.8 }} />
+          <Text as="span" size="L400" style={{ fontWeight: 600 }}>
+            Poll
+          </Text>
+          <Text as="span" size="T200" priority="300">
+            ·
+          </Text>
+          <Text as="span" size="T200" priority="300">
+            {typeLabel}
+          </Text>
+        </Box>
+        <Text size="T400" style={{ fontWeight: 600, overflowWrap: 'anywhere' }}>
+          {question}
+        </Text>
+      </Box>
      <Box
        direction="Column"
-        gap="100"
-        style={{ marginTop: '2px' }}
+        gap="200"
        role={isMultiple ? 'group' : 'radiogroup'}
        aria-label={question}
        onKeyDown={handleRadioKeyDown}
@@ -316,20 +333,32 @@ export function PollContent({
          const text = answer.text;
          const selected = myVotes.has(id);
          const voteCount = counts.get(id) ?? 0;
-          const pct = showResults && total > 0 ? Math.round((voteCount / total) * 100) : 0;
+          const showBar = showResults && total > 0;
+          const pct = showBar ? Math.round((voteCount / total) * 100) : 0;
          const isWinner = winners.has(id);
+          const resultText = `${voteCount} ${voteCount === 1 ? 'vote' : 'votes'} · ${pct}%`;
          // Roving tabindex for the single-choice radiogroup; checkboxes stay tabbable.
          const tabIndex = isMultiple ? 0 : selected || (myVotes.size === 0 && i === 0) ? 0 : -1;
+          let barColor = muted(40);
+          if (isWinner) barColor = color.Success.Main;
+          else if (selected) barColor = color.Primary.Main;
+          let rowBorder = muted(22);
+          if (isWinner) rowBorder = color.Success.Main;
+          else if (selected) rowBorder = color.Primary.Main;
+          const labelParts = [text];
+          if (showBar) labelParts.push(resultText);
+          if (isWinner) labelParts.push('winning answer');
          return (
            <React.Fragment key={id}>
              <button
                type="button"
                data-poll-answer
                data-selected={selected}
+                data-winner={isWinner || undefined}
                role={isMultiple ? 'checkbox' : 'radio'}
                aria-checked={selected}
                aria-disabled={!canVote}
-                aria-label={isWinner ? `${text}, winning answer` : undefined}
+                aria-label={labelParts.join(', ')}
                aria-describedby={
                  showVoters && canShowVoters && (voters.get(id)?.length ?? 0) > 0
                    ? `poll-voters-${eventId}-${id}`
@@ -340,60 +369,36 @@ export function PollContent({
                style={{
                  padding: `${config.space.S200} ${config.space.S300}`,
                  borderRadius: config.radii.R300,
-                  background: selected ? color.Primary.Container : color.SurfaceVariant.Container,
-                  border: `${config.borderWidth.B300} solid ${
-                    isWinner
-                      ? color.Success.Main
-                      : selected
-                        ? color.Primary.Main
-                        : color.SurfaceVariant.ContainerLine
-                  }`,
+                  background: selected ? muted(8) : 'transparent',
+                  border: `${config.borderWidth.B300} solid ${rowBorder}`,
                  lineHeight: 1.4,
                  textAlign: 'left',
                  cursor: canVote ? 'pointer' : 'default',
                  color: 'inherit',
+                  font: 'inherit',
                  display: 'flex',
                  flexDirection: 'column',
-                  gap: config.space.S100,
+                  gap: config.space.S200,
                  width: '100%',
-                  position: 'relative',
-                  overflow: 'hidden',
                  transition: 'border-color 0.15s, background 0.15s',
                }}
              >
-                {showResults && total > 0 && (
-                  <span
-                    aria-hidden
-                    style={{
-                      position: 'absolute',
-                      inset: 0,
-                      right: 'auto',
-                      width: `${pct}%`,
-                      background: selected
-                        ? color.Primary.ContainerActive
-                        : color.SurfaceVariant.ContainerActive,
-                      pointerEvents: 'none',
-                      transition: 'width 0.3s ease',
-                    }}
-                  />
-                )}
                <span
                  style={{
                    display: 'flex',
                    alignItems: 'center',
                    gap: config.space.S200,
-                    position: 'relative',
+                    width: '100%',
                  }}
                >
                  <span
                    aria-hidden
                    style={{
                      flexShrink: 0,
-                      width: toRem(14),
-                      height: toRem(14),
-                      border: `${config.borderWidth.B300} solid ${
-                        selected ? color.Primary.Main : color.Primary.ContainerLine
-                      }`,
+                      boxSizing: 'border-box',
+                      width: toRem(18),
+                      height: toRem(18),
+                      border: `2px solid ${selected ? color.Primary.Main : muted(55)}`,
                      borderRadius: isMultiple ? config.radii.R300 : config.radii.Pill,
                      background: selected ? color.Primary.Main : 'transparent',
                      display: 'flex',
@@ -405,29 +410,72 @@ export function PollContent({
                  >
                    {selected ? <Icon size="50" src={Icons.Check} /> : null}
                  </span>
-                  <Text as="span" size="T300" style={{ flexGrow: 1 }}>
+                  <Text
+                    as="span"
+                    size="T300"
+                    style={{ flexGrow: 1, minWidth: 0, overflowWrap: 'anywhere' }}
+                  >
                    {text}
                  </Text>
                  {isWinner && (
-                    <Icon
-                      size="50"
-                      src={Icons.Check}
-                      style={{ flexShrink: 0, color: color.Success.Main }}
-                    />
+                    <Text
+                      as="span"
+                      size="T200"
+                      style={{
+                        flexShrink: 0,
+                        display: 'inline-flex',
+                        alignItems: 'center',
+                        gap: config.space.S100,
+                        color: color.Success.Main,
+                        fontWeight: 600,
+                      }}
+                    >
+                      <Icon size="50" src={Icons.Star} filled />
+                      Winner
+                    </Text>
                  )}
-                  {showResults && total > 0 && (
-                    <Text as="span" size="T200" priority="300" style={{ flexShrink: 0 }}>
-                      {pct}%
+                  {showBar && (
+                    <Text
+                      as="span"
+                      size="T200"
+                      priority="300"
+                      style={{ flexShrink: 0, fontVariantNumeric: 'tabular-nums' }}
+                    >
+                      {resultText}
                    </Text>
                  )}
                </span>
+                {showBar && (
+                  <span
+                    aria-hidden
+                    style={{
+                      display: 'block',
+                      width: '100%',
+                      height: toRem(6),
+                      borderRadius: config.radii.Pill,
+                      background: muted(12),
+                      overflow: 'hidden',
+                    }}
+                  >
+                    <span
+                      style={{
+                        display: 'block',
+                        height: '100%',
+                        width: `${pct}%`,
+                        borderRadius: config.radii.Pill,
+                        background: barColor,
+                        transition: 'width 0.3s ease',
+                      }}
+                    />
+                  </span>
+                )}
              </button>
              {showVoters && canShowVoters && (voters.get(id)?.length ?? 0) > 0 && (
                <Text
                  id={`poll-voters-${eventId}-${id}`}
                  size="T200"
                  priority="300"
-                  style={{ padding: `0 ${config.space.S300} ${config.space.S100}` }}
+                  style={{ padding: `0 ${config.space.S300}`, marginTop: `-${config.space.S100}` }}
                >
                  {`Voted by ${(voters.get(id) ?? []).map((s) => getMemberName(room, s)).join(', ')}`}
                </Text>
@@ -436,48 +484,56 @@ export function PollContent({
          );
        })}
      </Box>
-      {canShowVoters && (
-        <Box>
-          <Chip
-            variant={showVoters ? 'Primary' : 'SurfaceVariant'}
-            radii="Pill"
-            aria-pressed={showVoters}
-            onClick={() => setShowVoters((v) => !v)}
-            before={<Icon size="50" src={Icons.User} />}
-          >
-            <Text size="T200">{showVoters ? 'Hide voters' : 'Show who voted'}</Text>
-          </Chip>
-        </Box>
-      )}
-      <Box alignItems="Center" justifyContent="SpaceBetween" gap="200">
-        <Text size="T200" priority="300" style={{ minWidth: 0 }}>
-          <i>{footerNote}</i>
+      <Box alignItems="Center" justifyContent="SpaceBetween" gap="200" wrap="Wrap">
+        <Text size="T200" priority="300" style={{ minWidth: 0, flex: '1 1 12rem' }}>
+          {footerNote}
        </Text>
-        {canEnd &&
-          (confirmEnd ? (
-            <Box gap="100" shrink="No" alignItems="Center">
-              <Chip
-                variant="Critical"
-                radii="Pill"
-                aria-disabled={ending}
-                onClick={ending ? undefined : handleEndPoll}
-              >
-                <Text size="T200">{ending ? 'Ending…' : 'End poll'}</Text>
-              </Chip>
-              <Chip variant="Secondary" radii="Pill" onClick={() => setConfirmEnd(false)}>
-                <Text size="T200">Cancel</Text>
-              </Chip>
-            </Box>
-          ) : (
+        <Box gap="100" shrink="No" alignItems="Center" wrap="Wrap">
+          {canShowVoters && (
            <Chip
-              variant="SurfaceVariant"
+              variant={showVoters ? 'Primary' : 'SurfaceVariant'}
              radii="Pill"
-              onClick={() => setConfirmEnd(true)}
-              before={<Icon size="50" src={Icons.Cross} />}
+              aria-pressed={showVoters}
+              onClick={() => setShowVoters((v) => !v)}
+              before={<Icon size="50" src={Icons.User} />}
            >
-              <Text size="T200">End poll</Text>
+              <Text size="T200" style={{ whiteSpace: 'nowrap' }}>
+                {showVoters ? 'Hide voters' : 'Who voted'}
+              </Text>
            </Chip>
-          ))}
+          )}
+          {canEnd &&
+            (confirmEnd ? (
+              <>
+                <Chip
+                  variant="Critical"
+                  radii="Pill"
+                  aria-disabled={ending}
+                  onClick={ending ? undefined : handleEndPoll}
+                >
+                  <Text size="T200" style={{ whiteSpace: 'nowrap' }}>
+                    {ending ? 'Ending…' : 'End poll'}
+                  </Text>
+                </Chip>
+                <Chip variant="Secondary" radii="Pill" onClick={() => setConfirmEnd(false)}>
+                  <Text size="T200" style={{ whiteSpace: 'nowrap' }}>
+                    Cancel
+                  </Text>
+                </Chip>
+              </>
+            ) : (
+              <Chip
+                variant="SurfaceVariant"
+                radii="Pill"
+                onClick={() => setConfirmEnd(true)}
+                before={<Icon size="50" src={Icons.Cross} />}
+              >
+                <Text size="T200" style={{ whiteSpace: 'nowrap' }}>
+                  End poll
+                </Text>
+              </Chip>
+            ))}
+        </Box>
      </Box>
    </Box>
  );
@@ -72,9 +72,9 @@ export function CallStatus({ callEmbed }: CallStatusProps) {
                    size="T200"
                    truncate
                    style={{ color: color.Warning.Main }}
-                    title="Fix your computer's clock — calls and encryption depend on it"
+                    title="This device's clock is off. Calls and encryption depend on it: turn on automatic time in your system settings."
                  >
-                    Clock {describeSkewVsServer(clockSkew.skewMs)} — calls will fail
+                    Device clock {describeSkewVsServer(clockSkew.skewMs)}: calls may fail
                  </Text>
                </>
              )}
@@ -0,0 +1,268 @@
+import { useSetAtom } from 'jotai';
+import { useEffect } from 'react';
+import {
+  ClientEvent,
+  ClientEventHandlerMap,
+  ConnectionError,
+  EventStatus,
+  KnownMembership,
+  MatrixClient,
+  MatrixError,
+  MatrixEvent,
+  Room,
+  RoomEvent,
+  RoomEventHandlerMap,
+  SyncState,
+} from 'matrix-js-sdk';
+import { useMatrixClient } from '../../hooks/useMatrixClient';
+import { sendOfflineAtom } from '../../state/sendOffline';
+import {
+  OUTBOX_MAX_AUTO_RETRIES,
+  OutboxEntry,
+  isRetryableSendError,
+  loadOutbox,
+  outboxRetryDelayMs,
+  planRestore,
+  saveOutbox,
+  shouldKeepInOutbox,
+  withEntry,
+  withoutEntry,
+} from '../../utils/outbox';
+
+const PENDING: ReadonlySet<EventStatus | null> = new Set([
+  EventStatus.SENDING,
+  EventStatus.ENCRYPTING,
+  EventStatus.QUEUED,
+  EventStatus.NOT_SENT,
+]);
+const ONLINE: ReadonlySet<SyncState | null> = new Set([
+  SyncState.Prepared,
+  SyncState.Syncing,
+  SyncState.Catchup,
+]);
+const OFFLINE: ReadonlySet<SyncState | null> = new Set([SyncState.Reconnecting, SyncState.Error]);
+
+/** The server already has it: its transaction id came back down /sync. */
+const isDelivered = (room: Room, txnId: string): boolean => {
+  const hasTxn = (events: MatrixEvent[]) =>
+    events.some((e) => e.getUnsigned().transaction_id === txnId);
+  return (
+    hasTxn(room.getLiveTimeline().getEvents()) ||
+    room.getThreads().some((t) => hasTxn(t.liveTimeline.getEvents()))
+  );
+};
+
+type OutboxSession = {
+  /** Own pending events of this session, by txnId. */
+  live: Map<string, { event: MatrixEvent; room: Room }>;
+  autoRetries: Map<string, number>;
+  restored: boolean;
+  retrying: boolean;
+};
+
+// Per client, not per mount: a remount must neither restore twice nor forget
+// the events it is tracking.
+const sessions = new WeakMap<MatrixClient, OutboxSession>();
+const getSession = (mx: MatrixClient): OutboxSession => {
+  let session = sessions.get(mx);
+  if (!session) {
+    session = { live: new Map(), autoRetries: new Map(), restored: false, retrying: false };
+    sessions.set(mx, session);
+  }
+  return session;
+};
+
+/**
+ * [Gitea #112] Offline outbox (see utils/outbox.ts): mirrors own message sends
+ * into localStorage until the server confirms them, puts unsent ones back
+ * after a reload, and re-sends network failures when the connection returns.
+ */
+export function OutboxFeature() {
+  const mx = useMatrixClient();
+  const setOffline = useSetAtom(sendOfflineAtom);
+
+  useEffect(() => {
+    const userId = mx.getSafeUserId();
+    let entries = loadOutbox(userId);
+    const session = getSession(mx);
+    const { live, autoRetries } = session;
+    let disposed = false;
+    let offlineNow = false;
+    const timers = new Set<ReturnType<typeof setTimeout>>();
+
+    const isOffline = () =>
+      OFFLINE.has(mx.getSyncState()) ||
+      (typeof navigator !== 'undefined' && navigator.onLine === false);
+
+    const persist = (next: OutboxEntry[]) => {
+      if (next === entries) return;
+      entries = next;
+      saveOutbox(userId, entries);
+    };
+
+    /**
+     * A network failure while we think we're online (a blip neither sync nor
+     * the browser noticed): try again shortly, backing off. Real outages are
+     * handled by the reconnect / back-online triggers below.
+     */
+    const scheduleBlipRetry = (event: MatrixEvent) => {
+      const attempts = autoRetries.get(event.getTxnId() ?? '') ?? 0;
+      if (!isRetryableSendError(event.error) || attempts >= OUTBOX_MAX_AUTO_RETRIES || isOffline())
+        return;
+      const timer = setTimeout(() => {
+        timers.delete(timer);
+        retryQueued();
+      }, outboxRetryDelayMs(attempts));
+      timers.add(timer);
+    };
+
+    const onLocalEcho: RoomEventHandlerMap[RoomEvent.LocalEchoUpdated] = (event, room) => {
+      const txnId = event.getTxnId();
+      if (!txnId || event.getSender() !== userId) return;
+      if (PENDING.has(event.status)) {
+        if (!shouldKeepInOutbox(event.getType(), event.getContent())) return;
+        live.set(txnId, { event, room });
+        if (event.status === EventStatus.NOT_SENT) scheduleBlipRetry(event);
+        persist(
+          withEntry(entries, {
+            txnId,
+            roomId: room.roomId,
+            threadId: event.threadRootId ?? null,
+            type: event.getType(),
+            content: event.getContent(),
+            ts: event.getTs(),
+          }),
+        );
+        return;
+      }
+      // SENT, CANCELLED, or the remote echo replaced it (status null).
+      live.delete(txnId);
+      autoRetries.delete(txnId);
+      persist(withoutEntry(entries, txnId));
+    };
+
+    /** Re-send network failures, oldest first; a room stops at its first failure. */
+    const retryQueued = async () => {
+      if (session.retrying || disposed) return;
+      session.retrying = true;
+      try {
+        const byRoom = new Map<Room, MatrixEvent[]>();
+        Array.from(live.values())
+          .filter(
+            ({ event }) =>
+              event.status === EventStatus.NOT_SENT &&
+              isRetryableSendError(event.error) &&
+              (autoRetries.get(event.getTxnId() ?? '') ?? 0) < OUTBOX_MAX_AUTO_RETRIES,
+          )
+          .sort((a, b) => a.event.getTs() - b.event.getTs())
+          .forEach(({ event, room }) => {
+            byRoom.set(room, [...(byRoom.get(room) ?? []), event]);
+          });
+        await Promise.all(
+          Array.from(byRoom.entries()).map(async ([room, events]) => {
+            for (const event of events) {
+              if (disposed || event.status !== EventStatus.NOT_SENT) continue;
+              const txnId = event.getTxnId() ?? '';
+              autoRetries.set(txnId, (autoRetries.get(txnId) ?? 0) + 1);
+              try {
+                // eslint-disable-next-line no-await-in-loop
+                await mx.resendEvent(event, room);
+              } catch (e) {
+                // Still offline: keep the rest of this room in order for the next try.
+                if (isRetryableSendError(e)) break;
+              }
+            }
+          }),
+        );
+      } finally {
+        session.retrying = false;
+      }
+    };
+
+    const restore = () => {
+      if (session.restored) return;
+      session.restored = true;
+      const plan = planRestore(
+        entries,
+        Date.now(),
+        (roomId) => mx.getRoom(roomId)?.getMyMembership() === KnownMembership.Join,
+        (entry) => {
+          const room = mx.getRoom(entry.roomId);
+          return !!room && isDelivered(room, entry.txnId);
+        },
+      );
+      plan.drop.forEach((entry) => persist(withoutEntry(entries, entry.txnId)));
+      plan.restore.forEach((entry) => {
+        const room = mx.getRoom(entry.roomId);
+        if (!room || live.has(entry.txnId)) return;
+        // Same shape as the SDK's own local echo (client.sendCompleteEvent).
+        const event = new MatrixEvent({
+          type: entry.type,
+          content: entry.content,
+          event_id: `~${entry.roomId}:${entry.txnId}`,
+          sender: userId,
+          room_id: entry.roomId,
+          origin_server_ts: entry.ts,
+        });
+        const thread = entry.threadId ? room.getThread(entry.threadId) : undefined;
+        if (thread) event.setThread(thread);
+        event.setTxnId(entry.txnId);
+        event.setStatus(EventStatus.NOT_SENT);
+        if (plan.autoSend.has(entry.txnId)) {
+          // Recent: treat like a send that lost the network (shown as Queued
+          // while offline, re-sent below and on reconnect).
+          // (The SDK types `error` as MatrixError but stores any send error there.)
+          event.error = new ConnectionError(
+            'not sent before the app was closed',
+          ) as unknown as MatrixError;
+        } else {
+          // Old: back as "Failed to send"; the user decides (Retry / Cancel).
+          autoRetries.set(entry.txnId, OUTBOX_MAX_AUTO_RETRIES);
+        }
+        try {
+          room.addPendingEvent(event, entry.txnId); // emits LocalEchoUpdated → `live`
+        } catch {
+          // Already pending under this txnId: nothing to restore.
+        }
+      });
+      if (!isOffline()) retryQueued();
+    };
+
+    const updateOffline = () => {
+      const offline = isOffline();
+      // Back online (sync recovered or the browser says so): send what's queued.
+      if (offlineNow && !offline && session.restored) retryQueued();
+      offlineNow = offline;
+      setOffline(offline);
+    };
+
+    const onSync: ClientEventHandlerMap[ClientEvent.Sync] = (state, prevState) => {
+      updateOffline();
+      if (!ONLINE.has(state)) return;
+      if (!session.restored) {
+        restore();
+        return;
+      }
+      if (OFFLINE.has(prevState) || prevState === SyncState.Catchup) retryQueued();
+    };
+    const onBrowserOnline = () => updateOffline();
+
+    mx.on(RoomEvent.LocalEchoUpdated, onLocalEcho);
+    mx.on(ClientEvent.Sync, onSync);
+    window.addEventListener('online', onBrowserOnline);
+    window.addEventListener('offline', onBrowserOnline);
+    updateOffline();
+    if (ONLINE.has(mx.getSyncState())) restore();
+
+    return () => {
+      disposed = true;
+      timers.forEach((t) => clearTimeout(t));
+      mx.off(RoomEvent.LocalEchoUpdated, onLocalEcho);
+      mx.off(ClientEvent.Sync, onSync);
+      window.removeEventListener('online', onBrowserOnline);
+      window.removeEventListener('offline', onBrowserOnline);
+    };
+  }, [mx, setOffline]);
+
+  return null;
+}
@@ -26,6 +26,7 @@ import {
  config,
 } from 'folds';
 import React, {
+  CSSProperties,
  FormEventHandler,
  MouseEventHandler,
  ReactNode,
@@ -38,7 +39,7 @@ import { useHover, useFocusWithin } from 'react-aria';
 import { MatrixEvent, Room, EventStatus } from 'matrix-js-sdk';
 import { Relations } from 'matrix-js-sdk/lib/models/relations';
 import classNames from 'classnames';
-import { useAtom } from 'jotai';
+import { useAtom, useAtomValue } from 'jotai';
 import { RoomPinnedEventsEventContent } from 'matrix-js-sdk/lib/types';
 import {
  AvatarBase,
@@ -83,8 +84,6 @@ import { copyToClipboard } from '../../../utils/dom';
 import { stopPropagation } from '../../../utils/keyboard';
 import { getMatrixToRoomEvent } from '../../../plugins/matrix-to';
 import { getLotusRoomPermalink } from '../../../plugins/lotus-permalink';
-import { getOriginBaseUrl } from '../../../pages/pathUtils';
-import { useClientConfig } from '../../../hooks/useClientConfig';
 import { getViaServers } from '../../../plugins/via-servers';
 import { useMediaAuthentication } from '../../../hooks/useMediaAuthentication';
 import { useRoomPinnedEvents } from '../../../hooks/useRoomPinnedEvents';
@@ -98,28 +97,41 @@ import { useLongPress } from '../../../hooks/useLongPress';
 import { ActionSheet } from '../../../components/action-sheet';
 import { useBookmarks } from '../../../hooks/useBookmarks';
 import { PresenceRingAvatar } from '../../../components/presence';
+import { useLotusShareBase } from '../../../hooks/useLotusLinkBase';
 import { AvatarDecoration } from '../../../components/avatar-decoration/AvatarDecoration';
+import { sendOfflineAtom } from '../../../state/sendOffline';
+import { isRetryableSendError } from '../../../utils/outbox';

 // Delivery status indicator for own messages
 function DeliveryStatus({
-  status,
+  mEvent,
+  room,
  lotusTerminal,
 }: {
-  status: string | null;
+  mEvent: MatrixEvent;
+  room: Room;
  lotusTerminal: boolean;
 }) {
+  const mx = useMatrixClient();
+  const offline = useAtomValue(sendOfflineAtom);
+  const { status } = mEvent;
  if (status === null) return null; // confirmed by server — read receipts take over
  let iconSrc: IconSrc;
  let label: string;
  let colorStyle: string;
  const isSending = status === EventStatus.SENDING || status === EventStatus.ENCRYPTING;
-  if (status === EventStatus.NOT_SENT || status === EventStatus.CANCELLED) {
+  // [Gitea #112] A network failure while offline is queued, not failed: the
+  // outbox sends it again when the connection is back.
+  const queued = status === EventStatus.NOT_SENT && offline && isRetryableSendError(mEvent.error);
+  const failed = !queued && (status === EventStatus.NOT_SENT || status === EventStatus.CANCELLED);
+  if (failed) {
    iconSrc = Icons.Cross;
-    label = 'Failed to send';
+    label = status === EventStatus.NOT_SENT ? 'Failed to send. Click to retry' : 'Failed to send';
    colorStyle = lotusTerminal ? 'var(--lt-accent-red)' : color.Critical.Main;
-  } else if (status === EventStatus.QUEUED || isSending) {
-    iconSrc = Icons.Send;
-    label = isSending ? 'Sending...' : 'Queued';
+  } else if (queued || status === EventStatus.QUEUED || isSending) {
+    iconSrc = queued ? Icons.RecentClock : Icons.Send;
+    if (queued) label = "Queued. Will send when you're back online";
+    else label = isSending ? 'Sending...' : 'Queued';
    colorStyle = lotusTerminal
      ? 'color-mix(in srgb, var(--lt-accent-cyan) 60%, transparent)'
      : color.Secondary.Main;
@@ -130,27 +142,49 @@ function DeliveryStatus({
      ? 'color-mix(in srgb, var(--lt-accent-cyan) 70%, transparent)'
      : color.Secondary.Main;
  }
+  const retryable = failed && status === EventStatus.NOT_SENT;
+  const handleRetry: MouseEventHandler<HTMLButtonElement> = (evt) => {
+    evt.stopPropagation();
+    if (mEvent.status === EventStatus.NOT_SENT) mx.resendEvent(mEvent, room).catch(() => undefined);
+  };
+  const style: CSSProperties = {
+    display: 'inline-flex',
+    alignItems: 'center',
+    marginTop: '2px',
+    lineHeight: 1,
+    color: colorStyle,
+    opacity: 0.85,
+    userSelect: 'none',
+    ...(lotusTerminal && failed ? { textShadow: 'var(--lt-glow-red)' } : {}),
+  };
+  const icon = (
+    <span className={isSending ? SendingSpinClass : undefined}>
+      <Icon size="100" src={iconSrc} />
+    </span>
+  );
+  if (retryable) {
+    return (
+      <button
+        type="button"
+        onClick={handleRetry}
+        aria-label={label}
+        title={label}
+        style={{
+          ...style,
+          background: 'none',
+          border: 'none',
+          padding: 0,
+          cursor: 'pointer',
+          font: 'inherit',
+        }}
+      >
+        {icon}
+      </button>
+    );
+  }
  return (
-    <Box
-      as="span"
-      aria-label={label}
-      title={label}
-      style={{
-        display: 'inline-flex',
-        alignItems: 'center',
-        marginTop: '2px',
-        lineHeight: 1,
-        color: colorStyle,
-        opacity: 0.85,
-        userSelect: 'none',
-        ...(lotusTerminal && status === EventStatus.NOT_SENT
-          ? { textShadow: 'var(--lt-glow-red)' }
-          : {}),
-      }}
-    >
-      <span className={isSending ? SendingSpinClass : undefined}>
-        <Icon size="100" src={iconSrc} />
-      </span>
+    <Box as="span" aria-label={label} title={label} style={style}>
+      {icon}
    </Box>
  );
 }
@@ -460,18 +494,11 @@ export const MessageCopyLotusLinkItem = as<
    onClose?: () => void;
  }
 >(({ room, mEvent, onClose, ...props }, ref) => {
-  const { hashRouter } = useClientConfig();
+  const lotusBase = useLotusShareBase();
  const handleCopy = () => {
    const eventId = mEvent.getId();
    if (!eventId) return;
-    copyToClipboard(
-      getLotusRoomPermalink(
-        getOriginBaseUrl(hashRouter),
-        room.roomId,
-        eventId,
-        getViaServers(room),
-      ),
-    );
+    copyToClipboard(getLotusRoomPermalink(lotusBase, room.roomId, eventId, getViaServers(room)));
    onClose?.();
  };

@@ -1110,7 +1137,7 @@ export const Message = React.memo(
            />
          )}
          {isMine && !mEvent.isState() && readReceiptUsers.length === 0 && (
-            <DeliveryStatus status={mEvent.status} lotusTerminal={!!lotusTerminal} />
+            <DeliveryStatus mEvent={mEvent} room={room} lotusTerminal={!!lotusTerminal} />
          )}
        </Box>
      );
@@ -33,6 +33,8 @@ import { Badge, Box, Chip, Icon, Icons, Line, Scroll, Spinner, Text, color, conf
 import classNames from 'classnames';
 import { Opts as LinkifyOpts } from 'linkifyjs';
 import { isKeyHotkey } from 'is-hotkey';
+import { isRetryableSendError } from '../../../utils/outbox';
+import { sendOfflineAtom } from '../../../state/sendOffline';
 import { eventWithShortcode, factoryEventSentBy } from '../../../utils/matrix';
 import { useMatrixClient } from '../../../hooks/useMatrixClient';
 import { useVirtualPaginator, ItemRange } from '../../../hooks/useVirtualPaginator';
@@ -253,6 +255,7 @@ export type ThreadTimelineProps = {

 export function ThreadTimeline({ room, thread, editor }: ThreadTimelineProps) {
  const mx = useMatrixClient();
+  const sendOffline = useAtomValue(sendOfflineAtom);
  const alive = useAlive();
  const useAuthentication = useMediaAuthentication();

@@ -992,8 +995,12 @@ export function ThreadTimeline({ room, thread, editor }: ThreadTimelineProps) {
  const showEmptyReplies = ready && thread.length === 0;

  const renderPendingEvent = (mEvent: MatrixEvent) => {
+    // [Gitea #112] Network failures while offline are queued, not failed.
+    const queued =
+      mEvent.status === EventStatus.NOT_SENT && sendOffline && isRetryableSendError(mEvent.error);
    const failed =
-      mEvent.status === EventStatus.NOT_SENT || mEvent.status === EventStatus.CANCELLED;
+      !queued &&
+      (mEvent.status === EventStatus.NOT_SENT || mEvent.status === EventStatus.CANCELLED);
    return (
      <div
        key={mEvent.getId() ?? mEvent.getTxnId()}
@@ -1007,6 +1014,13 @@ export function ThreadTimeline({ room, thread, editor }: ThreadTimelineProps) {
            </Text>
          </Box>
        )}
+        {queued && (
+          <Box style={{ padding: `0 ${config.space.S400}` }}>
+            <Text size="T200" priority="300">
+              Queued. Will send when you&apos;re back online
+            </Text>
+          </Box>
+        )}
      </div>
    );
  };
@@ -114,6 +114,7 @@ import { SequenceCardStyle } from '../styles.css';
 import { UpdateProgress, useTauriUpdater } from '../../../hooks/useTauriUpdater';
 import { describeUpdateError, manualDownloadUrl } from '../../../utils/updateErrors';
 import { isTauri as isTauriEnv, invokeTauri, tauriInvoke } from '../../../hooks/useTauri';
+import { useKeychainMirrorStatus } from '../../../state/keychainMirror';
 import { isSafeGlobalToggleKey } from '../../../hooks/useCallHotkeys';
 import { customWindowChromeAtom } from '../../../state/customWindowChrome';
 import { useDateFormatItems } from '../../../hooks/useDateFormat';
@@ -238,6 +239,27 @@ function AutostartSetting() {
  );
 }

+// [Gitea #105] Desktop: whether the login is also kept in the OS keychain.
+function KeychainMirrorSetting() {
+  const status = useKeychainMirrorStatus();
+  if (!isTauriEnv() || status.state === 'idle' || status.state === 'cleared') return null;
+  let description: string;
+  if (status.state === 'ok') {
+    description =
+      "A copy of your login is kept in the system keychain (Windows Credential Manager). A later update will keep it only there, out of the app's data folder.";
+  } else if (status.state === 'unsupported') {
+    description =
+      "Not available on this system yet. Your login is saved in the app's data folder, as before.";
+  } else {
+    description = `Couldn't save a copy to the system keychain (${status.error}). You stay logged in; your login is saved in the app's data folder, as before.`;
+  }
+  return (
+    <SequenceCard className={SequenceCardStyle} variant="SurfaceVariant" direction="Column">
+      <SettingTile title="Login in the system keychain" description={description} />
+    </SequenceCard>
+  );
+}
+
 type ThemeSelectorProps = {
  themeNames: Record<string, string>;
  themes: Theme[];
@@ -570,6 +592,7 @@ function Appearance() {

      <DesktopChromeSetting />
      <AutostartSetting />
+      <KeychainMirrorSetting />

      <SequenceCard className={SequenceCardStyle} variant="SurfaceVariant" direction="Column">
        <SettingTile
@@ -0,0 +1,23 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { lotusLinkBases, lotusShareBase } from './useLotusLinkBase';
+
+const LOCAL = 'http://localhost:44548/#/';
+const WEB = 'https://chat.lotusguild.org';
+
+test('web: shared links use the page origin', () => {
+  assert.equal(lotusShareBase(WEB, false, WEB), WEB);
+  assert.deepEqual(lotusLinkBases(WEB, false, undefined), [WEB]);
+});
+
+test('desktop with webAppUrl: shared links use the public web app', () => {
+  assert.equal(lotusShareBase(LOCAL, true, `${WEB}/`), WEB);
+  assert.deepEqual(lotusLinkBases(LOCAL, true, WEB), [LOCAL, WEB]);
+});
+
+test('desktop without a valid webAppUrl falls back to the origin', () => {
+  [undefined, '', 'http://chat.lotusguild.org', 'nonsense'].forEach((v) => {
+    assert.equal(lotusShareBase(LOCAL, true, v), LOCAL, String(v));
+    assert.deepEqual(lotusLinkBases(LOCAL, true, v), [LOCAL]);
+  });
+});
@@ -0,0 +1,37 @@
+import { useMemo } from 'react';
+import { useClientConfig } from './useClientConfig';
+import { isTauri } from './useTauri';
+import { getOriginBaseUrl } from '../pages/pathUtils';
+import { resolveWebAppUrl } from '../utils/callInBrowser';
+
+/**
+ * [Gitea #248] Base URL for Lotus links meant for other people.
+ *
+ * On the web that's this page's origin. In the desktop app the page is served
+ * from a local address (and hash-routed), which nobody else can open, so use
+ * the public web app from config `webAppUrl` (web path routing) instead.
+ * Without a valid `webAppUrl` it falls back to the origin, as before.
+ */
+export const lotusShareBase = (originBase: string, desktop: boolean, webAppUrl: unknown): string =>
+  (desktop && resolveWebAppUrl(webAppUrl)) || originBase;
+
+/**
+ * Every base a Lotus link to this deployment may start with: the origin, plus
+ * the public web app in the desktop app, so a shared https link opens in-app.
+ */
+export const lotusLinkBases = (
+  originBase: string,
+  desktop: boolean,
+  webAppUrl: unknown,
+): string[] => {
+  const shared = lotusShareBase(originBase, desktop, webAppUrl);
+  return shared === originBase ? [originBase] : [originBase, shared];
+};
+
+export const useLotusShareBase = (): string => {
+  const { hashRouter, webAppUrl } = useClientConfig();
+  return useMemo(
+    () => lotusShareBase(getOriginBaseUrl(hashRouter), isTauri(), webAppUrl),
+    [hashRouter, webAppUrl],
+  );
+};
@@ -31,6 +31,7 @@ import { allInvitesAtom } from '../../state/room-list/inviteList';
 import { useMatrixClient } from '../../hooks/useMatrixClient';
 import { useClientConfig } from '../../hooks/useClientConfig';
 import { useHydrateMsgDrafts } from '../../hooks/useHydrateMsgDrafts';
+import { OutboxFeature } from '../../features/outbox/OutboxFeature';
 import { useSearchCacheInvalidation } from '../../utils/searchCacheInvalidation';
 import { ClockSkewMonitor } from '../../utils/clockSkew';
 import { clockSkewAtom } from '../../state/clockSkew';
@@ -77,6 +78,7 @@ import { KeyboardShortcutsDialog, useKeyboardShortcutsTrigger } from '../../feat
 import { useRoomsListener } from '../../hooks/useRoomsListener';
 import { threadNotificationsAtom } from '../../state/threadNotifications';
 import { roomIdToActiveThreadIdAtomFamily } from '../../state/room/thread';
+import { lotusLinkBases } from '../../hooks/useLotusLinkBase';
 import {
  getThreadNotificationMode,
  shouldNotifyThreadReply,
@@ -118,11 +120,12 @@ function SystemEmojiFeature() {

 // [Gitea #103] Mirror the privacy toggle into the html parser's module flag.
 function LotusPermalinkFeature() {
-  const { hashRouter } = useClientConfig();
+  const { hashRouter, webAppUrl } = useClientConfig();
  useEffect(() => {
-    setLotusPermalinkBase(getOriginBaseUrl(hashRouter));
+    // [Gitea #248] In the desktop app, links to the public web app count too.
+    setLotusPermalinkBase(lotusLinkBases(getOriginBaseUrl(hashRouter), isTauriApp(), webAppUrl));
    return () => setLotusPermalinkBase(undefined);
-  }, [hashRouter]);
+  }, [hashRouter, webAppUrl]);
  return null;
 }

@@ -1069,6 +1072,10 @@ function ClockSkewFeature() {
      data,
    ) => {
      if (!data.liveEvent) return;
+      // Only events our homeserver stamped: a federated event's
+      // origin_server_ts is the other server's clock.
+      const senderServer = mEvent.getSender()?.split(':').slice(1).join(':');
+      if (senderServer !== mx.getDomain()) return;
      monitor.sample(mEvent.getTs(), mEvent.getAge(), mEvent.localTimestamp);
    };
    mx.on(RoomEvent.Timeline, onTimeline);
@@ -1105,6 +1112,7 @@ export function ClientNonUIFeatures({ children }: ClientNonUIFeaturesProps) {
      <TauriDesktopFeatures />
      <CloseBehaviorPrompt />
      <ConsentRequiredPrompt />
+      <OutboxFeature />
      <LotusDenoiseFeature />
      <DeepLinkNavigator />
      <KeyboardShortcutsFeature />
@@ -19,7 +19,7 @@ const readDismissedUntil = (): number => {
 };

 /**
- * [Gitea #158] "Your computer's clock is 14 minutes ahead of the server."
+ * [Gitea #158] "This device's clock is 14 minutes ahead of the server."
 * Same slot and style as the sync banners. Shown while the skew monitor is
 * over its threshold; the direction matters, so it is said. Dismissable for
 * 24 h; never auto-corrects anything.
@@ -53,8 +53,8 @@ export function ClockSkewBanner() {
      >
        <Box alignItems="Center" gap="300" wrap="Wrap" justifyContent="Center">
          <Text size="L400" align="Center">
-            Your computer&apos;s clock is <b>{describeSkewVsServer(skewMs)}</b>. Encrypted messages
-            and voice calls will fail until it is fixed.
+            This device&apos;s clock is <b>{describeSkewVsServer(skewMs)}</b>. Voice calls and
+            encrypted messages can fail until it&apos;s corrected.
          </Text>
          <Button
            size="300"
@@ -49,13 +49,7 @@ import { roomToParentsAtom } from '../../../state/room/roomToParents';
 import { allRoomsAtom } from '../../../state/room-list/roomList';
 import { useAnyRoomLiveCall } from '../../../hooks/useSpaceLiveCall';
 import { LiveDot } from './SpaceTabs.css';
-import {
-  getOriginBaseUrl,
-  getSpaceLobbyPath,
-  getSpacePath,
-  joinPathComponent,
-} from '../../pathUtils';
-import { useClientConfig } from '../../../hooks/useClientConfig';
+import { getSpaceLobbyPath, getSpacePath, joinPathComponent } from '../../pathUtils';
 import {
  SidebarAvatar,
  SidebarItem,
@@ -102,6 +96,7 @@ import { settingsAtom } from '../../../state/settings';
 import { useOpenSpaceSettings } from '../../../state/hooks/spaceSettings';
 import { useRoomCreators } from '../../../hooks/useRoomCreators';
 import { useRoomPermissions } from '../../../hooks/useRoomPermissions';
+import { useLotusShareBase } from '../../../hooks/useLotusLinkBase';
 import { InviteUserPrompt } from '../../../components/invite-user-prompt';

 type SpaceMenuProps = {
@@ -112,7 +107,7 @@ type SpaceMenuProps = {
 const SpaceMenu = forwardRef<HTMLDivElement, SpaceMenuProps>(
  ({ room, requestClose, onUnpin }, ref) => {
    const mx = useMatrixClient();
-    const { hashRouter } = useClientConfig();
+    const lotusBase = useLotusShareBase();
    const [hideActivity] = useSetting(settingsAtom, 'hideActivity');
    const roomToParents = useAtomValue(roomToParentsAtom);
    const powerLevels = usePowerLevels(room);
@@ -152,9 +147,7 @@ const SpaceMenu = forwardRef<HTMLDivElement, SpaceMenuProps>(
    const handleCopyLotusLink = () => {
      const roomIdOrAlias = getCanonicalAliasOrRoomId(mx, room.roomId);
      const viaServers = isRoomAlias(roomIdOrAlias) ? undefined : getViaServers(room);
-      copyToClipboard(
-        getLotusSpacePermalink(getOriginBaseUrl(hashRouter), roomIdOrAlias, viaServers),
-      );
+      copyToClipboard(getLotusSpacePermalink(lotusBase, roomIdOrAlias, viaServers));
      requestClose();
    };

@@ -39,13 +39,7 @@ import {
  NavItemContent,
  NavLink,
 } from '../../../components/nav';
-import {
-  getOriginBaseUrl,
-  getSpaceLobbyPath,
-  getSpaceRoomPath,
-  getSpaceSearchPath,
-} from '../../pathUtils';
-import { useClientConfig } from '../../../hooks/useClientConfig';
+import { getSpaceLobbyPath, getSpaceRoomPath, getSpaceSearchPath } from '../../pathUtils';
 import { getCanonicalAliasOrRoomId, isRoomAlias } from '../../../utils/matrix';
 import { useSelectedRoom } from '../../../hooks/router/useSelectedRoom';
 import {
@@ -92,6 +86,7 @@ import { ContainerColor } from '../../../styles/ContainerColor.css';
 import { AsyncStatus, useAsyncCallback } from '../../../hooks/useAsyncCallback';
 import { BreakWord } from '../../../styles/Text.css';
 import { InviteUserPrompt } from '../../../components/invite-user-prompt';
+import { useLotusShareBase } from '../../../hooks/useLotusLinkBase';
 import { useCallEmbed } from '../../../hooks/useCallEmbed';

 type SpaceMenuProps = {
@@ -100,7 +95,7 @@ type SpaceMenuProps = {
 };
 const SpaceMenu = forwardRef<HTMLDivElement, SpaceMenuProps>(({ room, requestClose }, ref) => {
  const mx = useMatrixClient();
-  const { hashRouter } = useClientConfig();
+  const lotusBase = useLotusShareBase();
  const [hideActivity] = useSetting(settingsAtom, 'hideActivity');
  const [developerTools] = useSetting(settingsAtom, 'developerTools');
  const roomToParents = useAtomValue(roomToParentsAtom);
@@ -137,9 +132,7 @@ const SpaceMenu = forwardRef<HTMLDivElement, SpaceMenuProps>(({ room, requestClo
  const handleCopyLotusLink = () => {
    const roomIdOrAlias = getCanonicalAliasOrRoomId(mx, room.roomId);
    const viaServers = isRoomAlias(roomIdOrAlias) ? undefined : getViaServers(room);
-    copyToClipboard(
-      getLotusSpacePermalink(getOriginBaseUrl(hashRouter), roomIdOrAlias, viaServers),
-    );
+    copyToClipboard(getLotusSpacePermalink(lotusBase, roomIdOrAlias, viaServers));
    requestClose();
  };

@@ -122,11 +122,15 @@ const cleanHref = (href: string): string =>
  stripTrackingOnRender ? stripTrackingParams(href) : href;

 // [Gitea #130] Links to THIS deployment's room routes render and click like
-// matrix.to links. The base is set once from the client config
-// (ClientNonUIFeatures) because this module has no access to hooks.
-let lotusPermalinkBase: string | undefined;
-export const setLotusPermalinkBase = (baseUrl: string | undefined): void => {
-  lotusPermalinkBase = baseUrl;
+// matrix.to links. The bases are set once from the client config
+// (ClientNonUIFeatures) because this module has no access to hooks. [Gitea
+// #248] Several: the desktop app knows both its local origin and the public web
+// app (`webAppUrl`), and people share the public one.
+let lotusPermalinkBases: string[] = [];
+export const setLotusPermalinkBase = (baseUrls: string | string[] | undefined): void => {
+  lotusPermalinkBases = (Array.isArray(baseUrls) ? baseUrls : [baseUrls]).filter(
+    (b): b is string => !!b,
+  );
 };
 /**
 * The matrix.to form of `href` when it is a matrix.to link or a Lotus
@@ -134,7 +138,11 @@ export const setLotusPermalinkBase = (baseUrl: string | undefined): void => {
 */
 export const toMatrixToHref = (href: string): string | undefined => {
  if (testMatrixTo(href)) return href;
-  return lotusPermalinkBase ? lotusPermalinkToMatrixTo(lotusPermalinkBase, href) : undefined;
+  for (const base of lotusPermalinkBases) {
+    const matrixTo = lotusPermalinkToMatrixTo(base, href);
+    if (matrixTo) return matrixTo;
+  }
+  return undefined;
 };

 export const LINKIFY_OPTS: LinkifyOpts = {
@@ -0,0 +1,117 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { KeychainInvoke, sameTokens, syncKeychain, tokensOf } from './keychainMirror';
+import type { Session } from './sessions';
+
+const session: Session = {
+  baseUrl: 'https://matrix.example.org',
+  userId: '@alice:example.org',
+  deviceId: 'DEV1',
+  accessToken: 'syt_token',
+  refreshToken: 'mar_refresh',
+};
+
+/** An in-memory keychain behind the same commands the desktop app exposes. */
+const fakeKeychain = (opts: { supported?: boolean; failSet?: boolean; corrupt?: boolean } = {}) => {
+  let stored: unknown = null;
+  const calls: string[] = [];
+  const invoke: KeychainInvoke = async (cmd, args) => {
+    calls.push(cmd);
+    switch (cmd) {
+      case 'secure_session_supported':
+        return opts.supported ?? true;
+      case 'secure_session_get':
+        return stored;
+      case 'secure_session_set':
+        if (opts.failSet) throw new Error('Access is denied.');
+        stored = opts.corrupt ? { ...(args?.tokens as object), accessToken: 'x' } : args?.tokens;
+        return null;
+      case 'secure_session_clear':
+        stored = null;
+        return null;
+      default:
+        throw new Error(`unknown ${cmd}`);
+    }
+  };
+  return { invoke, calls, get: () => stored };
+};
+
+test('stores the tokens (not the whole session) and verifies them', async () => {
+  const kc = fakeKeychain();
+  assert.deepEqual(await syncKeychain(kc.invoke, session), { state: 'ok' });
+  assert.deepEqual(kc.get(), {
+    userId: '@alice:example.org',
+    deviceId: 'DEV1',
+    accessToken: 'syt_token',
+    refreshToken: 'mar_refresh',
+  });
+  assert.deepEqual(kc.calls, [
+    'secure_session_supported',
+    'secure_session_get',
+    'secure_session_set',
+    'secure_session_get',
+  ]);
+});
+
+test('an up-to-date copy is not rewritten', async () => {
+  const kc = fakeKeychain();
+  await syncKeychain(kc.invoke, session);
+  kc.calls.length = 0;
+  assert.deepEqual(await syncKeychain(kc.invoke, session), { state: 'ok' });
+  assert.deepEqual(kc.calls, ['secure_session_supported', 'secure_session_get']);
+});
+
+test('a token rotation rewrites; no session clears', async () => {
+  const kc = fakeKeychain();
+  await syncKeychain(kc.invoke, session);
+  await syncKeychain(kc.invoke, { ...session, accessToken: 'syt_new', refreshToken: undefined });
+  assert.equal((kc.get() as { accessToken: string }).accessToken, 'syt_new');
+  assert.equal('refreshToken' in (kc.get() as object), false);
+  assert.deepEqual(await syncKeychain(kc.invoke, null), { state: 'cleared' });
+  assert.equal(kc.get(), null);
+});
+
+test('unsupported platform: nothing is touched', async () => {
+  const kc = fakeKeychain({ supported: false });
+  assert.deepEqual(await syncKeychain(kc.invoke, session), { state: 'unsupported' });
+  assert.deepEqual(kc.calls, ['secure_session_supported']);
+});
+
+test('failures become a status, never an exception', async () => {
+  assert.deepEqual(await syncKeychain(fakeKeychain({ failSet: true }).invoke, session), {
+    state: 'error',
+    error: 'Access is denied.',
+  });
+  assert.deepEqual(await syncKeychain(fakeKeychain({ corrupt: true }).invoke, session), {
+    state: 'error',
+    error: 'read-back did not match',
+  });
+  // The credential store hangs (the support check itself is instant).
+  const hung: KeychainInvoke = async (cmd) =>
+    cmd === 'secure_session_supported'
+      ? true
+      : new Promise(() => {
+          /* never settles */
+        });
+  assert.deepEqual(await syncKeychain(hung, session, 50), {
+    state: 'error',
+    error: 'keychain timed out',
+  });
+});
+
+test('a desktop build without the commands reads as unsupported, not an error', async () => {
+  const missingCommand: KeychainInvoke = async (cmd) => {
+    throw new Error(`Command ${cmd} not found`);
+  };
+  assert.deepEqual(await syncKeychain(missingCommand, session), { state: 'unsupported' });
+});
+
+test('sameTokens compares only the secrets, treating a missing refresh token as absent', () => {
+  const t = tokensOf({ ...session, refreshToken: undefined });
+  assert.equal(sameTokens({ ...t }, t), true);
+  assert.equal(sameTokens({ ...t, refreshToken: undefined }, t), true);
+  assert.equal(sameTokens({ ...t, accessToken: 'other' }, t), false);
+  assert.equal(sameTokens({ ...t, refreshToken: 'r' }, t), false);
+  assert.equal(sameTokens(null, t), false);
+  assert.equal(sameTokens('string', t), false);
+});
@@ -0,0 +1,141 @@
+import { useEffect, useState } from 'react';
+import { getFallbackSession, onSessionPersisted, Session } from './sessions';
+
+/**
+ * [Gitea #105] Desktop, step 1: mirror the login tokens into the OS keychain.
+ *
+ * The session is still read from localStorage exactly as before; this only
+ * keeps a copy in the keychain (Windows Credential Manager) and checks it by
+ * reading it back, so real installs prove the keychain works before step 2
+ * switches reads over to it. Nothing here can log anyone out: every failure
+ * just records a status for Settings.
+ *
+ * Writes are serialized (a token rotation right after login must not race
+ * the login's write) and time out, so a hung credential store can't pile up.
+ * When there's no session the keychain entry is cleared, which also covers a
+ * logout whose page reload beat the clear.
+ */
+
+export type KeychainTokens = {
+  userId: string;
+  deviceId: string;
+  accessToken: string;
+  refreshToken?: string;
+};
+
+export type KeychainMirrorStatus =
+  | { state: 'idle' }
+  | { state: 'unsupported' }
+  | { state: 'ok' }
+  | { state: 'cleared' }
+  | { state: 'error'; error: string };
+
+export type KeychainInvoke = (cmd: string, args?: Record<string, unknown>) => Promise<unknown>;
+
+export const KEYCHAIN_TIMEOUT_MS = 5000;
+
+export const tokensOf = (session: Session): KeychainTokens => ({
+  userId: session.userId,
+  deviceId: session.deviceId,
+  accessToken: session.accessToken,
+  ...(session.refreshToken ? { refreshToken: session.refreshToken } : {}),
+});
+
+export const sameTokens = (a: unknown, b: KeychainTokens): boolean => {
+  if (!a || typeof a !== 'object') return false;
+  const t = a as Partial<KeychainTokens>;
+  return (
+    t.userId === b.userId &&
+    t.deviceId === b.deviceId &&
+    t.accessToken === b.accessToken &&
+    (t.refreshToken ?? undefined) === (b.refreshToken ?? undefined)
+  );
+};
+
+const withTimeout = <T>(p: Promise<T>, ms: number): Promise<T> =>
+  new Promise<T>((resolve, reject) => {
+    const timer = setTimeout(() => reject(new Error('keychain timed out')), ms);
+    p.then(
+      (v) => {
+        clearTimeout(timer);
+        resolve(v);
+      },
+      (e) => {
+        clearTimeout(timer);
+        reject(e);
+      },
+    );
+  });
+
+const errorText = (e: unknown): string =>
+  (e instanceof Error ? e.message : String(e)).slice(0, 200);
+
+/**
+ * Bring the keychain in line with `session` (null = no session). Reads first
+ * and only writes when the stored copy differs, then verifies by reading back.
+ */
+export const syncKeychain = async (
+  invoke: KeychainInvoke,
+  session: Session | null,
+  timeoutMs = KEYCHAIN_TIMEOUT_MS,
+): Promise<KeychainMirrorStatus> => {
+  // A desktop build without the commands (older than this feature) rejects
+  // the call: that is "not supported", not an error to show the user.
+  let supported: unknown;
+  try {
+    supported = await withTimeout(invoke('secure_session_supported'), timeoutMs);
+  } catch {
+    supported = false;
+  }
+  if (supported !== true) return { state: 'unsupported' };
+  try {
+    if (!session) {
+      await withTimeout(invoke('secure_session_clear'), timeoutMs);
+      return { state: 'cleared' };
+    }
+    const tokens = tokensOf(session);
+    const stored = await withTimeout(invoke('secure_session_get'), timeoutMs);
+    if (sameTokens(stored, tokens)) return { state: 'ok' };
+    await withTimeout(invoke('secure_session_set', { tokens }), timeoutMs);
+    const back = await withTimeout(invoke('secure_session_get'), timeoutMs);
+    if (!sameTokens(back, tokens)) return { state: 'error', error: 'read-back did not match' };
+    return { state: 'ok' };
+  } catch (e) {
+    return { state: 'error', error: errorText(e) };
+  }
+};
+
+let status: KeychainMirrorStatus = { state: 'idle' };
+const statusListeners = new Set<(s: KeychainMirrorStatus) => void>();
+const setStatus = (next: KeychainMirrorStatus): void => {
+  status = next;
+  statusListeners.forEach((cb) => cb(next));
+};
+
+export const getKeychainMirrorStatus = (): KeychainMirrorStatus => status;
+
+let started = false;
+
+/** Start mirroring (desktop only; call once at boot). */
+export const startKeychainMirror = (invoke: KeychainInvoke | undefined): void => {
+  if (!invoke || started) return;
+  started = true;
+  let chain: Promise<unknown> = Promise.resolve();
+  const enqueue = (session: Session | null) => {
+    chain = chain.then(async () => setStatus(await syncKeychain(invoke, session)));
+  };
+  enqueue(getFallbackSession() ?? null);
+  onSessionPersisted((session) => enqueue(session));
+};
+
+export const useKeychainMirrorStatus = (): KeychainMirrorStatus => {
+  const [value, setValue] = useState(status);
+  useEffect(() => {
+    setValue(status);
+    statusListeners.add(setValue);
+    return () => {
+      statusListeners.delete(setValue);
+    };
+  }, []);
+  return value;
+};
@@ -36,6 +36,7 @@ test('clearPlaintextCaches removes every plaintext/PII localStorage key', () =>
  store.set('cinny_recent_forward_targets_v1', '[]');
  store.set('cinny_recent_gifs_v1', '[]');
  store.set('cinny_recent_stickers_v1', '[]');
+  store.set('lotus_outbox_v1', '{"userId":"@me:server","entries":[]}');
  removed.length = 0;

  clearPlaintextCaches();
@@ -47,6 +48,7 @@ test('clearPlaintextCaches removes every plaintext/PII localStorage key', () =>
    'cinny_recent_forward_targets_v1',
    'cinny_recent_gifs_v1',
    'cinny_recent_stickers_v1',
+    'lotus_outbox_v1', // [Gitea #112] unsent message content
  ]) {
    assert.ok(removed.includes(key), `${key} cleared`);
  }
@@ -7,6 +7,7 @@ import { clearRecentStickers } from './recentStickers';
 import { clearNavToActivePathStore } from './navToActivePath';
 import { DRAFT_MSG_KEY_PREFIX } from '../utils/draft';
 import { clearCallSession } from '../utils/callRejoin';
+import { clearOutbox } from '../utils/outbox';

 /**
 * [Gitea #41] Wipe every persisted composer draft (`draft-msg-<roomId>`). Drafts
@@ -44,6 +45,7 @@ const clearMsgDrafts = (): void => {
 * - `cinny_recent_forward_targets_v1` — recent forward contact/room graph (PII)
 * - `cinny_recent_gifs_v1` / `cinny_recent_stickers_v1` — media the user sent
 * - `navToActivePath<userId>` — per-space last-visited room paths (needs userId)
+ * - `lotus_outbox_v1` — decrypted content of messages not yet sent ([Gitea #112])
 * - `draft-msg-*` — unsent composer drafts (decrypted message text, unscoped by
 *   user — see [Gitea #41]; previously deliberately preserved across logout
 *   (N98), which let the next account on this device see/send a prior user's
@@ -93,6 +95,7 @@ export const clearPlaintextCaches = (userId?: string): void => {
  clearRecentGifs();
  clearRecentStickers();
  clearMsgDrafts();
+  clearOutbox();
  clearCallSession();
  clearStatusMessage();
  if (userId) clearNavToActivePathStore(userId);
@@ -0,0 +1,9 @@
+import { atom } from 'jotai';
+
+/**
+ * [Gitea #112] True while the client can't reach the homeserver (sync is
+ * reconnecting / erroring, or the browser reports offline). Messages that
+ * failed for network reasons show "Queued" instead of "Failed to send" while
+ * this is set; the outbox sends them again once it clears.
+ */
+export const sendOfflineAtom = atom(false);
@@ -432,3 +432,20 @@ test('subscribeSessionChanges ignores unrelated storage keys', () => {
  listeners.forEach((cb) => cb({ key: 'some_unrelated_preference' }));
  assert.equal(fired, false);
 });
+
+test('onSessionPersisted: told about writes and removals; a throwing listener is harmless', async () => {
+  installStorage();
+  const { onSessionPersisted } = await import('./sessions');
+  const seen: (string | null)[] = [];
+  const offBad = onSessionPersisted(() => {
+    throw new Error('boom');
+  });
+  const off = onSessionPersisted((s) => seen.push(s ? s.accessToken : null));
+  setFallbackSession('tok-a', 'DEV', '@a:hs', 'https://hs', { refreshToken: 'ref-a' });
+  removeFallbackSession();
+  off();
+  offBad();
+  setFallbackSession('tok-b', 'DEV', '@a:hs', 'https://hs');
+  assert.deepEqual(seen, ['tok-a', null]);
+  assert.equal(getFallbackSession()?.accessToken, 'tok-b', 'write still happened');
+});
@@ -233,6 +233,27 @@ export type SessionStoreName = {
 //   crypto: 'crypto-store',
 // } as const;

+// [Gitea #105] Listeners told about every session write in THIS tab (login,
+// token rotation) and removal (logout), e.g. the desktop keychain mirror.
+// A throwing listener never breaks the write.
+type PersistListener = (session: Session | null) => void;
+const persistListeners = new Set<PersistListener>();
+const notifyPersisted = (session: Session | null): void => {
+  persistListeners.forEach((cb) => {
+    try {
+      cb(session);
+    } catch {
+      /* listener errors must not affect login/logout */
+    }
+  });
+};
+export const onSessionPersisted = (cb: PersistListener): (() => void) => {
+  persistListeners.add(cb);
+  return () => {
+    persistListeners.delete(cb);
+  };
+};
+
 // Persist the session. Writes the atomic blob FIRST (so the consistent,
 // never-torn copy is established before the multi-key legacy write), then
 // dual-writes the legacy keys for rollback safety. Signature is unchanged —
@@ -249,6 +270,7 @@ export function setFallbackSession(
  localStorage.setItem(SESSION_BLOB_KEY, JSON.stringify(persisted));
  // Dual-write the legacy keys (removal of this half is a future release).
  writeLegacyKeys(persisted);
+  notifyPersisted(sessionFromPersisted(persisted));
 }

 // Clear BOTH the atomic blob and every legacy key so no reader (blob-preferring
@@ -257,6 +279,7 @@ export const removeFallbackSession = () => {
  localStorage.removeItem(SESSION_BLOB_KEY);
  Object.values(LEGACY_KEYS).forEach((key) => localStorage.removeItem(key));
  Object.values(OIDC_KEYS).forEach((key) => localStorage.removeItem(key));
+  notifyPersisted(null);
 };

 // Read the session, preferring the atomic blob. If the blob is absent or
@@ -8,44 +8,96 @@ import {
  formatSkew,
 } from './clockSkew';

-// A live event received when the local clock is `skew` ms ahead of the server:
-// origin_server_ts = T (server clock), age = a, localTimestamp = (T + a + skew) - a.
-const feed = (m: ClockSkewMonitor, skew: number, age = 500, t = 1_700_000_000_000) =>
-  m.sample(t, age, t + skew);
+const T = 1_700_000_000_000;

-test('needs three samples, then reports the median with direction', () => {
+/**
+ * A live event received `atSec` seconds into the test, when the local clock is
+ * `skew` ms off the server and the response took `delay` ms to arrive:
+ * localTimestamp − origin_server_ts = skew + delay.
+ */
+const feed = (m: ClockSkewMonitor, skew: number, atSec = 0, delay = 0, wallJump = 0) =>
+  m.sample(T, 500, T + skew + delay, { wall: T + atSec * 1000 + wallJump, mono: atSec * 1000 });
+
+test('behind: reported as soon as there are three samples', () => {
  const m = new ClockSkewMonitor();
-  assert.equal(feed(m, 60_000).skewMs, null);
-  assert.equal(feed(m, 61_000).skewMs, null);
-  const s = feed(m, 59_000);
-  assert.equal(s.skewMs, 60_000);
+  assert.equal(feed(m, -60_000, 0).skewMs, null);
+  assert.equal(feed(m, -61_000, 1).skewMs, null);
+  const s = feed(m, -59_000, 2);
+  assert.equal(s.skewMs, -61_000);
  assert.equal(s.warning, true);
-  assert.equal(formatSkew(s.skewMs!), '60 seconds ahead');
+  assert.equal(formatSkew(s.skewMs!), '61 seconds behind');
 });

-test('one bad sample cannot trip the warning (median) and hysteresis clears only under 15 s', () => {
+test('ahead: only once it has held for a minute', () => {
  const m = new ClockSkewMonitor();
-  feed(m, 1000);
-  feed(m, 1500);
-  assert.equal(feed(m, 90_000).warning, false); // outlier
-  assert.equal(m.getState().skewMs, 1500);
+  feed(m, 60_000, 0);
+  feed(m, 60_000, 10);
+  assert.equal(feed(m, 60_000, 20).warning, false);
+  assert.equal(m.getState().skewMs, 60_000);
+  assert.equal(feed(m, 60_000, 59).warning, false);
+  assert.equal(feed(m, 60_000, 61).warning, true);
+});

+test('server stall (2026-09-29): a burst of late events does not read as a wrong clock', () => {
+  const m = new ClockSkewMonitor();
+  // Normal traffic, then the homeserver stalls and one /sync arrives 30 s late
+  // with a pile of events, then normal traffic again.
+  feed(m, 200, 0);
+  feed(m, 150, 5);
+  feed(m, 300, 10);
+  [1, 2, 3, 4, 5, 6].forEach(() => feed(m, 0, 130, 31_000));
+  assert.equal(m.getState().warning, false);
+  assert.ok(m.getState().skewMs! < 1000);
+
+  // Fresh client whose first samples are all from the late burst.
+  const fresh = new ClockSkewMonitor();
+  [1, 2, 3, 4, 5, 6].forEach(() => feed(fresh, 0, 0, 31_000));
+  assert.equal(fresh.getState().warning, false);
+  // …and the next timely event brings the estimate back down.
+  feed(fresh, 0, 70, 100);
+  assert.equal(fresh.getState().warning, false);
+  assert.equal(fresh.getState().skewMs, 100);
+});
+
+test('slow deliveries mixed with fast ones: the fastest one wins', () => {
+  const m = new ClockSkewMonitor();
+  [0, 20, 40, 60, 80].forEach((at, i) => feed(m, 45_000, at, i === 2 ? 0 : 20_000));
+  assert.equal(m.getState().skewMs, 45_000);
+  assert.equal(m.getState().warning, true);
+});
+
+test('hysteresis: once on, clears only under 15 s', () => {
  const w = new ClockSkewMonitor();
-  [40_000, 41_000, 39_000, 40_000, 40_000].forEach((s) => feed(w, s));
+  [0, 1, 2].forEach((at) => feed(w, -40_000, at));
  assert.equal(w.getState().warning, true);
-  // drifting down to 20 s: still >= 15 s → stays on
-  [20_000, 20_000, 20_000, 20_000, 20_000].forEach((s) => feed(w, s));
+  // Samples expire after 5 minutes; drifting to -20 s keeps it on (>= 15 s).
+  [400, 401, 402].forEach((at) => feed(w, -20_000, at));
+  assert.equal(w.getState().skewMs, -20_000);
  assert.equal(w.getState().warning, true);
-  [10_000, 10_000, 10_000, 10_000, 10_000].forEach((s) => feed(w, s));
+  [800, 801, 802].forEach((at) => feed(w, -10_000, at));
  assert.equal(w.getState().warning, false);
 });

+test('fixing the local clock starts the measurement afresh', () => {
+  const m = new ClockSkewMonitor();
+  [0, 1, 2].forEach((at) => feed(m, -14 * 60_000, at));
+  assert.equal(m.getState().warning, true);
+  // The user sets the clock forward 14 minutes: wall jumps vs the monotonic clock.
+  const jump = 14 * 60_000;
+  feed(m, 0, 10, 0, jump);
+  assert.equal(m.getState().warning, false);
+  assert.equal(m.getState().skewMs, null);
+  feed(m, 0, 11, 0, jump);
+  feed(m, 0, 12, 0, jump);
+  assert.equal(m.getState().skewMs, 0);
+  assert.equal(m.getState().warning, false);
+});
+
 test('stale or missing age is ignored (cache replay must not read as skew)', () => {
  const m = new ClockSkewMonitor();
-  const t = 1_700_000_000_000;
-  m.sample(t, undefined, t + 3_600_000);
-  m.sample(t, 40 * 24 * 60 * 60 * 1000, t + 3_600_000);
-  m.sample(t, -5, t);
+  m.sample(T, undefined, T + 3_600_000);
+  m.sample(T, 40 * 24 * 60 * 60 * 1000, T + 3_600_000);
+  m.sample(T, -5, T);
  assert.equal(m.getState().skewMs, null);
 });

@@ -53,10 +105,7 @@ test('subscribe fires on change only; reset clears', () => {
  const m = new ClockSkewMonitor();
  const seen: (number | null)[] = [];
  m.subscribe((s) => seen.push(s.skewMs));
-  feed(m, -120_000);
-  feed(m, -120_000);
-  feed(m, -120_000);
-  feed(m, -120_000);
+  [0, 1, 2, 3].forEach((at) => feed(m, -120_000, at));
  assert.deepEqual(seen, [-120_000]);
  assert.equal(formatSkew(-120_000), '2 minutes behind');
  m.reset();
@@ -22,8 +22,23 @@

 export const SKEW_WARN_MS = 30_000;
 export const SKEW_CLEAR_MS = 15_000;
-export const SKEW_SAMPLES = 5;
 export const SKEW_MIN_SAMPLES = 3;
+/** Samples older than this are forgotten. */
+export const SKEW_WINDOW_MS = 5 * 60 * 1000;
+export const SKEW_MAX_SAMPLES = 30;
+/**
+ * "Ahead" must hold across samples received at least this far apart.
+ *
+ * Incident 2026-09-29: the homeserver's host ran out of memory and stalled for
+ * ~2 minutes; the /sync that finally went out carried events whose `age` was
+ * computed ~30 s before it arrived, so every client read "your clock is 30 s
+ * ahead" — while the real problem was the server. A late delivery can only make
+ * the local clock look AHEAD (never behind), so the estimate is the LOWEST
+ * recent sample (the one delivered fastest), and "ahead" has to persist across
+ * a minute of fresh samples before it is reported. "Behind" can't come from a
+ * delay and is reported as soon as there are enough samples.
+ */
+export const SKEW_AHEAD_SPAN_MS = 60_000;
 /**
 * Sanity cap on `age`. Old events are still valid samples (the server computes
 * `age` at response time, so `ts + age` is its clock regardless of the event's
@@ -38,14 +53,21 @@ export type ClockSkewState = {
  warning: boolean;
 };

-const median = (xs: number[]): number => {
-  const s = [...xs].sort((a, b) => a - b);
-  const mid = Math.floor(s.length / 2);
-  return s.length % 2 ? s[mid] : (s[mid - 1] + s[mid]) / 2;
+/** A wall-clock change larger than this (vs the monotonic clock) resets the samples. */
+export const CLOCK_JUMP_MS = 5_000;
+
+type Sample = { skew: number; at: number };
+
+const currentClock = (): { wall: number; mono: number } => {
+  const wall = Date.now();
+  const mono = typeof performance !== 'undefined' ? performance.now() : wall;
+  return { wall, mono };
 };

 export class ClockSkewMonitor {
-  private samples: number[] = [];
+  private samples: Sample[] = [];
+
+  private clockOffset: number | undefined;

  private state: ClockSkewState = { skewMs: null, warning: false };

@@ -64,25 +86,47 @@ export class ClockSkewMonitor {

  /**
   * Feed one live event. `originServerTs` + `age` come from the event;
-   * `localTimestamp` is the SDK's `Date.now() − age` at construction.
+   * `localTimestamp` is the SDK's `Date.now() − age` at construction; `clock`
+   * is when the sample was taken: wall clock and a monotonic clock
+   * (performance.now()), so samples are aged by real elapsed time and a change
+   * of the local clock (someone fixing it) starts the measurement afresh.
+   * Only feed events stamped by OUR homeserver: another server's
+   * `origin_server_ts` carries that server's clock.
   * Returns the new state (unchanged object when nothing moved).
   */
  public sample(
    originServerTs: number,
    age: number | undefined,
    localTimestamp: number,
+    clock: { wall: number; mono: number } = currentClock(),
  ): ClockSkewState {
    if (age === undefined || !Number.isFinite(age) || age < 0 || age > SKEW_MAX_AGE_MS) {
      return this.state;
    }
    if (!Number.isFinite(originServerTs) || !Number.isFinite(localTimestamp)) return this.state;
-    this.samples.push(localTimestamp - originServerTs);
-    if (this.samples.length > SKEW_SAMPLES) this.samples.shift();
+    const now = clock.mono;
+    const offset = clock.wall - clock.mono;
+    if (this.clockOffset !== undefined && Math.abs(offset - this.clockOffset) > CLOCK_JUMP_MS) {
+      // The local clock was changed: earlier samples measured the old clock.
+      this.reset();
+    }
+    this.clockOffset = offset;
+    this.samples.push({ skew: localTimestamp - originServerTs, at: now });
+    this.samples = this.samples.filter((s) => now - s.at <= SKEW_WINDOW_MS);
+    if (this.samples.length > SKEW_MAX_SAMPLES) this.samples.shift();
    if (this.samples.length < SKEW_MIN_SAMPLES) return this.state;

-    const skewMs = median(this.samples);
+    // Delivery delay only ever adds to a sample: the smallest is the truest.
+    const skewMs = Math.min(...this.samples.map((s) => s.skew));
    const abs = Math.abs(skewMs);
-    const warning = this.state.warning ? abs >= SKEW_CLEAR_MS : abs > SKEW_WARN_MS;
+    let warning: boolean;
+    if (this.state.warning) warning = abs >= SKEW_CLEAR_MS;
+    else if (skewMs < -SKEW_WARN_MS) warning = true;
+    else if (skewMs > SKEW_WARN_MS) {
+      // Ahead: only if the fastest-delivered samples stayed high for a minute.
+      const span = now - Math.min(...this.samples.map((s) => s.at));
+      warning = span >= SKEW_AHEAD_SPAN_MS;
+    } else warning = false;
    if (skewMs === this.state.skewMs && warning === this.state.warning) return this.state;
    this.state = { skewMs, warning };
    this.listeners.forEach((cb) => cb(this.state));
@@ -91,6 +135,7 @@ export class ClockSkewMonitor {

  public reset(): void {
    this.samples = [];
+    this.clockOffset = undefined;
    if (this.state.skewMs !== null || this.state.warning) {
      this.state = { skewMs: null, warning: false };
      this.listeners.forEach((cb) => cb(this.state));
@@ -0,0 +1,131 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import {
+  OUTBOX_AUTOSEND_MS,
+  OUTBOX_MAX_ENTRIES,
+  OutboxEntry,
+  isRetryableSendError,
+  outboxRetryDelayMs,
+  parseOutbox,
+  planRestore,
+  shouldKeepInOutbox,
+  withEntry,
+  withoutEntry,
+} from './outbox';
+
+const entry = (txnId: string, ts: number, roomId = '!a:hs'): OutboxEntry => ({
+  txnId,
+  roomId,
+  threadId: null,
+  type: 'm.room.message',
+  content: { msgtype: 'm.text', body: txnId },
+  ts,
+});
+
+test('keeps message-like events, not call signalling or redactions', () => {
+  assert.equal(shouldKeepInOutbox('m.room.message', { body: 'hi' }), true);
+  assert.equal(shouldKeepInOutbox('m.reaction', { 'm.relates_to': { event_id: '$x' } }), true);
+  assert.equal(shouldKeepInOutbox('org.matrix.msc3381.poll.start', {}), true);
+  assert.equal(shouldKeepInOutbox('org.matrix.msc4075.rtc.notification', {}), false);
+  assert.equal(shouldKeepInOutbox('m.call.invite', {}), false);
+  assert.equal(shouldKeepInOutbox('m.room.redaction', {}), false);
+});
+
+test('skips events that point at another unsent message (local id)', () => {
+  assert.equal(
+    shouldKeepInOutbox('m.reaction', { 'm.relates_to': { event_id: '~!a:hs:m123' } }),
+    false,
+  );
+  assert.equal(
+    shouldKeepInOutbox('m.room.message', {
+      body: 'reply',
+      'm.relates_to': { 'm.in_reply_to': { event_id: '~!a:hs:m1' } },
+    }),
+    false,
+  );
+  assert.equal(
+    shouldKeepInOutbox('m.room.message', {
+      body: 'reply',
+      'm.relates_to': { 'm.in_reply_to': { event_id: '$real' } },
+    }),
+    true,
+  );
+});
+
+test('retryable: connection loss, timeouts, rate limits, server errors', () => {
+  const connectionError = new Error('fetch failed');
+  Object.defineProperty(connectionError, 'name', { value: 'ConnectionError' });
+  assert.equal(isRetryableSendError(connectionError), true);
+  assert.equal(isRetryableSendError({ httpStatus: 429 }), true);
+  assert.equal(isRetryableSendError({ httpStatus: 408 }), true);
+  assert.equal(isRetryableSendError({ httpStatus: 502 }), true);
+});
+
+test('not retryable: client errors, consent, unknown or missing errors', () => {
+  assert.equal(isRetryableSendError({ httpStatus: 403, errcode: 'M_FORBIDDEN' }), false);
+  assert.equal(isRetryableSendError({ httpStatus: 403, errcode: 'M_CONSENT_NOT_GIVEN' }), false);
+  assert.equal(isRetryableSendError({ httpStatus: 400 }), false);
+  assert.equal(isRetryableSendError(new Error('encryption failed')), false);
+  assert.equal(isRetryableSendError(undefined), false);
+  assert.equal(isRetryableSendError(null), false);
+});
+
+test('parse: only this user, only well-formed entries, junk tolerated', () => {
+  const good = entry('m1', 1);
+  const raw = JSON.stringify({ userId: '@me:hs', entries: [good, { txnId: 5 }, null] });
+  assert.deepEqual(parseOutbox(raw, '@me:hs'), [good]);
+  assert.deepEqual(parseOutbox(raw, '@other:hs'), []);
+  assert.deepEqual(parseOutbox('{not json', '@me:hs'), []);
+  assert.deepEqual(parseOutbox(null, '@me:hs'), []);
+});
+
+test('withEntry: first write wins, sorted, capped (oldest dropped)', () => {
+  const a = entry('a', 2);
+  let list = withEntry([], a);
+  assert.equal(withEntry(list, { ...a, content: { body: 'changed' } }), list);
+  list = withEntry(list, entry('b', 1));
+  assert.deepEqual(
+    list.map((e) => e.txnId),
+    ['b', 'a'],
+  );
+  let many: OutboxEntry[] = [];
+  for (let i = 0; i < OUTBOX_MAX_ENTRIES + 5; i += 1) many = withEntry(many, entry(`t${i}`, i));
+  assert.equal(many.length, OUTBOX_MAX_ENTRIES);
+  assert.equal(many[0].txnId, 't5');
+});
+
+test('withoutEntry: removes, and returns the same list when absent', () => {
+  const list = [entry('a', 1), entry('b', 2)];
+  assert.deepEqual(
+    withoutEntry(list, 'a').map((e) => e.txnId),
+    ['b'],
+  );
+  assert.equal(withoutEntry(list, 'zzz'), list);
+});
+
+test('restore plan: drops delivered / left rooms, auto-sends only recent ones', () => {
+  const now = 10 * OUTBOX_AUTOSEND_MS;
+  const recent = entry('recent', now - 60_000);
+  const old = entry('old', now - OUTBOX_AUTOSEND_MS - 1);
+  const delivered = entry('delivered', now - 1000);
+  const left = entry('left', now - 1000, '!left:hs');
+  const plan = planRestore(
+    [recent, left, old, delivered],
+    now,
+    (roomId) => roomId !== '!left:hs',
+    (e) => e.txnId === 'delivered',
+  );
+  assert.deepEqual(
+    plan.restore.map((e) => e.txnId),
+    ['old', 'recent'],
+  );
+  assert.deepEqual([...plan.autoSend], ['recent']);
+  assert.deepEqual(plan.drop.map((e) => e.txnId).sort(), ['delivered', 'left']);
+});
+
+test('blip retry delay backs off and is capped at a minute', () => {
+  assert.deepEqual(
+    [0, 1, 2, 3, 4, 9].map(outboxRetryDelayMs),
+    [5000, 10000, 20000, 40000, 60000, 60000],
+  );
+});
@@ -0,0 +1,182 @@
+import { IContent } from 'matrix-js-sdk';
+
+/**
+ * [Gitea #112] Offline outbox: unsent messages survive a reload and are
+ * retried when the connection comes back.
+ *
+ * The SDK keeps local echoes in memory only (chronological pending ordering),
+ * so a reload used to drop every message that hadn't reached the server. Each
+ * own message send is mirrored here (type + clear content + txnId) from its
+ * first local echo until the server confirms it or the user cancels it. On
+ * the next start it is put back as a failed local echo (Retry / Cancel as
+ * usual) and, if it's recent, sent again with the SAME txnId — the server
+ * deduplicates a transaction it already accepted.
+ *
+ * The content is the decrypted message, like a composer draft: it lives in
+ * localStorage until sent and is wiped on logout (clearPlaintextCaches).
+ */
+
+export type OutboxEntry = {
+  txnId: string;
+  roomId: string;
+  threadId: string | null;
+  type: string;
+  content: IContent;
+  /** When the message was first sent (local echo timestamp, ms). */
+  ts: number;
+};
+
+type Stored = { userId: string; entries: OutboxEntry[] };
+
+const STORAGE_KEY = 'lotus_outbox_v1';
+/** Hard cap so a long offline stretch can't grow localStorage without bound. */
+export const OUTBOX_MAX_ENTRIES = 100;
+/**
+ * Restored messages younger than this are sent again automatically after a
+ * reload; older ones come back as "Failed to send" and wait for the user
+ * (sending a message typed hours ago without asking would surprise people).
+ */
+export const OUTBOX_AUTOSEND_MS = 60 * 60 * 1000;
+/** Auto-retries per message per session (one per reconnect). */
+export const OUTBOX_MAX_AUTO_RETRIES = 10;
+
+/** Delay before automatic retry number `attempt` (0-based) after a blip. */
+export const outboxRetryDelayMs = (attempt: number): number =>
+  Math.min(5000 * 2 ** Math.max(0, attempt), 60_000);
+
+/** Message-like events worth keeping. Not call signalling, not redactions. */
+export const OUTBOX_EVENT_TYPES: ReadonlySet<string> = new Set([
+  'm.room.message',
+  'm.sticker',
+  'm.reaction',
+  'm.poll.start',
+  'm.poll.response',
+  'm.poll.end',
+  'org.matrix.msc3381.poll.start',
+  'org.matrix.msc3381.poll.response',
+  'org.matrix.msc3381.poll.end',
+]);
+
+const relatesToPendingEvent = (content: IContent): boolean => {
+  const rel = content['m.relates_to'] as
+    | { event_id?: unknown; 'm.in_reply_to'?: { event_id?: unknown } }
+    | undefined;
+  const ids = [rel?.event_id, rel?.['m.in_reply_to']?.event_id];
+  // A local echo's id ("~!room:txn") means nothing after a reload.
+  return ids.some((id) => typeof id === 'string' && id.startsWith('~'));
+};
+
+/** Whether a send should be mirrored into the outbox. */
+export const shouldKeepInOutbox = (type: string, content: IContent): boolean =>
+  OUTBOX_EVENT_TYPES.has(type) && !relatesToPendingEvent(content);
+
+/**
+ * A failure the network is to blame for: no connection (the SDK's
+ * ConnectionError), a timeout, rate limiting or a server error. Anything else
+ * (403, consent, bad request, encryption failure) needs the user.
+ */
+export const isRetryableSendError = (err: unknown): boolean => {
+  if (!err || typeof err !== 'object') return false;
+  const { name, httpStatus } = err as { name?: unknown; httpStatus?: unknown };
+  if (name === 'ConnectionError') return true;
+  if (typeof httpStatus !== 'number') return false;
+  return httpStatus === 408 || httpStatus === 429 || httpStatus >= 500;
+};
+
+const isEntry = (e: unknown): e is OutboxEntry => {
+  if (!e || typeof e !== 'object') return false;
+  const o = e as Record<string, unknown>;
+  return (
+    typeof o.txnId === 'string' &&
+    typeof o.roomId === 'string' &&
+    (o.threadId === null || typeof o.threadId === 'string') &&
+    typeof o.type === 'string' &&
+    !!o.content &&
+    typeof o.content === 'object' &&
+    typeof o.ts === 'number'
+  );
+};
+
+/** Parse the stored outbox, keeping only this user's well-formed entries. */
+export const parseOutbox = (raw: string | null, userId: string): OutboxEntry[] => {
+  if (!raw) return [];
+  try {
+    const parsed = JSON.parse(raw) as Partial<Stored>;
+    if (parsed.userId !== userId || !Array.isArray(parsed.entries)) return [];
+    return parsed.entries.filter(isEntry);
+  } catch {
+    return [];
+  }
+};
+
+/** Add (or keep) an entry: first write wins, oldest dropped past the cap. */
+export const withEntry = (entries: OutboxEntry[], entry: OutboxEntry): OutboxEntry[] => {
+  if (entries.some((e) => e.txnId === entry.txnId)) return entries;
+  const next = [...entries, entry].sort((a, b) => a.ts - b.ts);
+  return next.length > OUTBOX_MAX_ENTRIES ? next.slice(next.length - OUTBOX_MAX_ENTRIES) : next;
+};
+
+export const withoutEntry = (entries: OutboxEntry[], txnId: string): OutboxEntry[] =>
+  entries.some((e) => e.txnId === txnId) ? entries.filter((e) => e.txnId !== txnId) : entries;
+
+export type RestorePlan = {
+  /** Put back as failed local echoes, oldest first. */
+  restore: OutboxEntry[];
+  /** Subset of `restore` to send again right away. */
+  autoSend: Set<string>;
+  /** Already delivered or no longer sendable: forget them. */
+  drop: OutboxEntry[];
+};
+
+/**
+ * Decide what to do with the stored outbox on start.
+ * `canSend(roomId)`: the user is still joined; `delivered(entry)`: the
+ * server already has it (the transaction id came back down /sync).
+ */
+export const planRestore = (
+  entries: OutboxEntry[],
+  now: number,
+  canSend: (roomId: string) => boolean,
+  delivered: (entry: OutboxEntry) => boolean,
+): RestorePlan => {
+  const restore: OutboxEntry[] = [];
+  const autoSend = new Set<string>();
+  const drop: OutboxEntry[] = [];
+  [...entries]
+    .sort((a, b) => a.ts - b.ts)
+    .forEach((entry) => {
+      if (!canSend(entry.roomId) || delivered(entry)) {
+        drop.push(entry);
+        return;
+      }
+      restore.push(entry);
+      if (now - entry.ts < OUTBOX_AUTOSEND_MS) autoSend.add(entry.txnId);
+    });
+  return { restore, autoSend, drop };
+};
+
+export const loadOutbox = (userId: string): OutboxEntry[] => {
+  try {
+    return parseOutbox(localStorage.getItem(STORAGE_KEY), userId);
+  } catch {
+    return [];
+  }
+};
+
+export const saveOutbox = (userId: string, entries: OutboxEntry[]): void => {
+  try {
+    if (entries.length === 0) localStorage.removeItem(STORAGE_KEY);
+    else localStorage.setItem(STORAGE_KEY, JSON.stringify({ userId, entries } satisfies Stored));
+  } catch {
+    // Storage full or blocked: the outbox is best-effort.
+  }
+};
+
+/** Wipe the outbox (logout): it holds decrypted message content. */
+export const clearOutbox = (): void => {
+  try {
+    localStorage.removeItem(STORAGE_KEY);
+  } catch {
+    /* localStorage unavailable — nothing to clear */
+  }
+};
@@ -17,10 +17,16 @@ import App from './app/pages/App';
 import './app/i18n';
 import { pushSessionToSW } from './sw-session';
 import { getFallbackSession } from './app/state/sessions';
+import { startKeychainMirror } from './app/state/keychainMirror';
+import { tauriInvoke } from './app/hooks/useTauri';
 import { cleanupSearchCacheIfSignedOut } from './client/initMatrix';

 document.body.classList.add(configClass, varsClass);

+// [Gitea #105] Desktop: keep a copy of the login tokens in the OS keychain
+// (step 1: mirror only; the session is still read from localStorage).
+startKeychainMirror(tauriInvoke());
+
 // Register Service Worker
 // Service workers only register on http(s) pages. The desktop app loads from
 // `tauri://localhost` in debug builds (and on any platform where the localhost
@@ -898,6 +898,14 @@ globalStyle(
    boxShadow: '0 0 10px rgba(255,107,0,0.10)',
  },
 );
+// [Gitea #246] The poll's winning answer (after it ends).
+globalStyle(
+  `body.${lotusTerminalBodyClass} [data-poll-content] [data-poll-answer][data-winner="true"]`,
+  {
+    border: '1px solid rgba(0,255,136,0.55) !important',
+    boxShadow: '0 0 10px rgba(0,255,136,0.10)',
+  },
+);
 globalStyle(`body.${lotusTerminalBodyClass} [data-poll-content] [data-poll-content-label]`, {
  color: 'rgba(0,212,255,0.60) !important',
  opacity: '1 !important',
Author	SHA1	Message	Date
Lotus CIandClaude Opus 5.5	9b9f33b270	feat(desktop): mirror the login tokens into the OS keychain (#105 , step 1) CI / Build & Quality Checks (pull_request) Successful in 1m46s Details CI / Trigger Desktop Build (pull_request) Skipped Details CI / Docker image build & smoke test (pull_request) Skipped Details CI / Secret scan (gitleaks) (pull_request) Successful in 8s Details CI / Playwright smoke (e2e) (pull_request) Successful in 8m44s Details Step 1 of moving the desktop app's login out of the webview's plaintext localStorage: keep a verified copy of the tokens in the OS keychain (Windows Credential Manager, via cinny-desktop's new secure_session_* commands). The session is still read from localStorage exactly as before, so nothing about login changes and a keychain problem can't log anyone out. Step 2 (a later release, once this has run on real installs) switches reads to the keychain and drops the tokens from localStorage. - sessions.ts: onSessionPersisted — listeners told about every session write (login, token rotation) and removal (logout); a throwing listener can't break the write. - keychainMirror.ts: desktop only. Mirrors userId/deviceId/accessToken/ refreshToken (not the rest of the session); reads first and writes only when the copy differs, then verifies by reading back; serialized, 5 s timeouts; no session → clear (also covers a logout whose reload beat the clear). Every failure is a status, never an exception. A desktop build without the commands reads as "unsupported", so this can ship before the desktop side. - Settings → General (desktop): "Login in the system keychain" status. Tested: unit tests (fake keychain: store, no rewrite when current, rotation, clear, unsupported, missing commands, denied write, read-back mismatch, timeout); a simulated desktop app with a fake keychain, 14/14 (login mirrors only the secrets, Settings status, reload verifies without rewriting, logout clears, an existing session is mirrored after upgrade, Linux/denied show an honest status and stay logged in); the real Linux desktop binary (commands answer "unsupported", login unaffected, Settings says so). Unit 1295 pass, Playwright 20 passed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-29 00:24:46 -04:00
jared	91f82d60e3	Merge pull request 'A stalled server no longer reads as "your clock is ahead"' (#251 ) from clock-skew-lag into lotus CI / Build & Quality Checks (push) Successful in 3m4s Details CI / Docker image build & smoke test (push) Skipped Details CI / Secret scan (gitleaks) (push) Successful in 8s Details CI / Trigger Desktop Build (push) Successful in 4s Details CI / Playwright smoke (e2e) (push) Successful in 10m32s Details Merge pull request #251: a stalled server no longer reads as a wrong clock	2026-09-28 22:40:13 -04:00
Lotus CI	f0865115a4	Merge remote-tracking branch 'origin/lotus' into clock-skew-lag CI / Build & Quality Checks (pull_request) Successful in 3m7s Details CI / Trigger Desktop Build (pull_request) Skipped Details CI / Docker image build & smoke test (pull_request) Skipped Details CI / Secret scan (gitleaks) (pull_request) Successful in 7s Details CI / Playwright smoke (e2e) (pull_request) Successful in 10m59s Details	2026-09-28 22:11:31 -04:00
jared	899e160aed	Merge pull request 'Offline outbox: unsent messages survive reload and retry (#112 )' (#250 ) from offline-outbox into lotus CI / Build & Quality Checks (push) Successful in 2m58s Details CI / Docker image build & smoke test (push) Skipped Details CI / Secret scan (gitleaks) (push) Successful in 12s Details CI / Trigger Desktop Build (push) Successful in 9s Details CI / Playwright smoke (e2e) (push) Successful in 10m52s Details Merge pull request #250: Offline outbox (#112)	2026-09-28 22:08:28 -04:00
Lotus CIandClaude Opus 5.5	3e5fdd0dab	test(e2e): clock-ahead warning needs a minute of samples (#158 ) CI / Build & Quality Checks (pull_request) Successful in 2m57s Details CI / Trigger Desktop Build (pull_request) Skipped Details CI / Docker image build & smoke test (pull_request) Skipped Details CI / Secret scan (gitleaks) (pull_request) Successful in 10s Details CI / Playwright smoke (e2e) (pull_request) Canceled after 0s Details "Ahead" is now reported only once it has held for a minute of fresh samples (a stalled server delivers late and reads as ahead). The test sends its ticks, checks nothing is shown yet, fast-forwards the page clock past a minute and sends two more. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-28 22:08:13 -04:00
Lotus CIandClaude Opus 5.5	bb569d69a2	fix: a stalled server no longer reads as "your clock is ahead" CI / Build & Quality Checks (pull_request) Successful in 3m1s Details CI / Trigger Desktop Build (pull_request) Skipped Details CI / Docker image build & smoke test (pull_request) Skipped Details CI / Secret scan (gitleaks) (pull_request) Successful in 7s Details CI / Playwright smoke (e2e) (pull_request) Failing after 11m28s Details Incident 2026-09-29: the homeserver's host ran out of memory and stalled for ~2 minutes. The /sync that finally went out carried events whose `age` was computed ~30 s before it arrived, so every client showed "Your computer's clock is 30 seconds ahead of the server" while the real problem was the server (all host clocks were within 0.25 s the whole evening). The skew estimate was the median of the last 5 samples, and a sample is local skew + delivery delay, so one late /sync with a handful of events tripped it. - Estimate = the LOWEST sample of the last 5 minutes: delay only ever adds, so the fastest-delivered event is the truest. - "Behind" (which a delay can't cause) is reported as soon as there are 3 samples, like before. "Ahead" must hold across samples received at least a minute apart, so a single late burst never trips it. - Samples are aged on the monotonic clock, and a change of the local clock (someone fixing it) resets the measurement, so the warning clears at once. - Only events stamped by our own homeserver are sampled: a federated event's origin_server_ts is the other server's clock. - Wording: "This device's clock is … Voice calls and encrypted messages can fail until it's corrected." / call bar "Device clock … : calls may fail" (was "will fail"). Unit tests: the incident (late burst after normal traffic, and a fresh client whose first samples are all late), mixed slow/fast deliveries, ahead only after a minute, behind at once, hysteresis, clock fixed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-28 21:40:02 -04:00
Lotus CIandClaude Opus 5.5	02d86caeb0	feat: offline outbox — unsent messages survive reload and retry (#112 ) CI / Build & Quality Checks (pull_request) Successful in 6m4s Details CI / Trigger Desktop Build (pull_request) Skipped Details CI / Secret scan (gitleaks) (pull_request) Successful in 27s Details CI / Docker image build & smoke test (pull_request) Skipped Details CI / Playwright smoke (e2e) (pull_request) Successful in 10m28s Details Until now a send that failed (offline, homeserver down, a blip) went straight to "Failed to send": nothing retried it, and a reload dropped it without trace (chronological pending ordering keeps local echoes in memory only). - Outbox (utils/outbox.ts + features/outbox/OutboxFeature): own message sends (text, stickers, reactions, polls; not call signalling or redactions) are mirrored to localStorage from their first local echo until the server confirms them or the user cancels. - After a reload they come back as local echoes via room.addPendingEvent, same shape as the SDK's own. Recent ones (< 1 h) are sent again with the same txnId; older ones come back as "Failed to send" for the user to retry or cancel. Ones the server already has (transaction id seen in /sync) are dropped, so no duplicates. - Retries: network failures (ConnectionError, 408/429/5xx) are re-sent when the connection returns (sync recovers or the browser goes back online), and after a blip while online (5 s, backing off, max 10 per message). Oldest first, in order per room. 4xx / consent / encryption failures are left to the user. - UI: a network failure while offline shows a clock, "Queued. Will send when you're back online" (thread view too), not the red ✕. The ✕ is now a button: click to retry. - Logout wipes the outbox with the other plaintext caches (the content is decrypted, like drafts). Tested end to end against a local Synapse (Chromium): offline → queued → sent once on reconnect; homeserver unreachable → queued → sent once; failed send → reload → sent once and shown once; server accepted but response lost → reload → no duplicate; 2 h old entry → failed, not sent, click ✕ → sent; cancel → gone after reload; encrypted room → restored message goes out as m.room.encrypted with no plaintext and decrypts; one-off failure retried by itself in ~5 s; no page errors. Unit tests for the pure parts; Playwright 20 passed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-28 21:02:45 -04:00
jared	c0c93213c1	Merge pull request 'Desktop: Lotus links use the public web app and open in-app (#248 )' (#249 ) from desktop-lotus-links into lotus CI / Build & Quality Checks (push) Successful in 2m7s Details CI / Docker image build & smoke test (push) Skipped Details CI / Secret scan (gitleaks) (push) Successful in 7s Details CI / Trigger Desktop Build (push) Successful in 8s Details CI / Playwright smoke (e2e) (push) Successful in 9m6s Details Merge pull request #249: Desktop Lotus links use the public web app (#248)	2026-09-28 19:53:20 -04:00
Lotus CIandClaude Opus 5.5	1ea6987083	fix(desktop): Lotus links use the public web app, and open in-app (#248 ) CI / Build & Quality Checks (pull_request) Successful in 1m50s Details CI / Trigger Desktop Build (pull_request) Skipped Details CI / Docker image build & smoke test (pull_request) Skipped Details CI / Secret scan (gitleaks) (pull_request) Successful in 8s Details CI / Playwright smoke (e2e) (pull_request) Successful in 9m19s Details Lotus permalinks (#130) were built from window.location.origin. In the desktop app that's the local tauri-plugin-localhost server (hash-routed), so "Copy Lotus Link" copied e.g. http://localhost:…/#/home/!room…, which works for nobody else. And the link recogniser only knew that local base, so a real https://chat.lotusguild.org/home/… link in a message opened the browser instead of the room. - useLotusShareBase: in the desktop app, links for other people use config `webAppUrl` (https only, set by cinny-desktop #23) in web path-routing form; otherwise the origin, as before. Used by "Copy Lotus Link" on messages, the space menu and space tabs. - The recogniser accepts several bases: the origin, plus `webAppUrl` in the desktop app. - The web app is unchanged. Verified with a simulated desktop (Tauri bridge + webAppUrl) against a local Synapse. Copied links are https://chat.lotusguild.org/home/<room>/<event> and https://chat.lotusguild.org/<space>. A public link in a message renders as the room pill and clicking it opens the room in-app, with nothing sent to the system browser. The web app still copies origin links. Unit tests for the base selection; Playwright 20 passed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-28 19:39:48 -04:00
jared	be8e49a2bb	Merge pull request #247 : readable poll card (#246 ) CI / Build & Quality Checks (push) Successful in 1m34s Details CI / Docker image build & smoke test (push) Skipped Details CI / Secret scan (gitleaks) (push) Successful in 8s Details CI / Trigger Desktop Build (push) Successful in 6s Details CI / Playwright smoke (e2e) (push) Successful in 7m57s Details	2026-09-27 23:28:48 -04:00
Lotus CIandClaude Opus 5.5	1e217592fc	fix(polls): readable poll card: counts, visible bars/indicators, no chip overflow (#246 ) CI / Build & Quality Checks (pull_request) Successful in 1m35s Details CI / Trigger Desktop Build (pull_request) Skipped Details CI / Docker image build & smoke test (pull_request) Skipped Details CI / Secret scan (gitleaks) (pull_request) Successful in 6s Details CI / Playwright smoke (e2e) (pull_request) Successful in 7m55s Details Rendering only; the vote logic (tally, optimistic votes, end poll, keyboard radiogroup, voters) is unchanged. - Every row shows "N votes · P%". Multiple choice looked broken as "100% / 100%" with no counts; the footer now says "voters" there. - Results are a thin progress bar under each answer: accent for your pick, success for the winner, neutral otherwise. The old full-row fill was the same grey as the row, so a 100% answer just looked disabled. - Radio and checkbox indicators are 18px with a 2px border in a colour mixed from the theme's text colour. Primary.ContainerLine was nearly invisible, especially in dark themes. - The winner shows a star and "Winner" instead of a second check mark. - Bordered card, 460px wide (max 100%, same width for every poll). The header is now "Poll · Single choice \| Pick up to N \| Results hidden until the end \| Final results", replacing the letter-spaced "◉ POLL · …" line. - Footer: plain muted text that wraps, and chips ("Who voted", "End poll") that never wrap. Previously the chip label broke onto two lines inside a one-line chip and spilled out of it. Reproduced before/after in Lotus Terminal at 150% zoom, a 360px phone, and dark at 125%. - Lotus Terminal theme: data-winner gets its own green border rule. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-27 23:18:25 -04:00
jared	ffe1d5a81e	Merge pull request #245 : desktop without WebRTC offers "Open in browser" CI / Build & Quality Checks (push) Successful in 1m53s Details CI / Docker image build & smoke test (push) Skipped Details CI / Secret scan (gitleaks) (push) Successful in 6s Details CI / Trigger Desktop Build (push) Successful in 3s Details CI / Playwright smoke (e2e) (push) Successful in 9m54s Details	2026-09-27 17:10:50 -04:00