fix(ui): receipt pill, insights counts, settings dividers, decoration preview (#269-#273)

#269 read-receipt pill sits at the message row's right edge, not where
     the text ends (outside the shrink-to-fit content column; grows in
     Compact). Bubble layout unchanged.
#270 Most Active Members: the bar's % is of its own track, so every row
     shows its count.
#271 Noise Suppression description at T200 like the rest.
#272 decoration preview shows your own avatar under the decoration; the
     empty state is a visible dashed circle.
#273 grouped settings get a divider between tiles (SettingTileGroup, via
     globalStyle; SettingTile roots carry data-setting-tile), and on phones
     the Sync tile's buttons sit under its description.

Fixes #269
Fixes #270
Fixes #271
Fixes #272
Fixes #273

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

.gitleaks.toml

@@ -12,6 +12,9 @@ regexes = [
   '''https?://matrix\.lotusguild\.org''',
   '''https?://code\.lotusguild\.org/api/packages/LotusGuild/npm/''',
   '''matrix\.lotusguild\.org''',
+  # Lotus Chat desktop updater's minisign PUBLIC key (published in the
+  # cinny-desktop README); utils/updateErrors.ts verifies Linux downloads with it.
+  '''RWRZZdyii05/NUcz337A5SAbiZK\+NPVDWuiL2mM5Jk1p/LfRmNfiZ/6l''',
 ]
 paths = [
   '''config\.json''',

LOTUS_FEATURES.md

@@ -1,7 +1,7 @@
 # Lotus Chat — Feature Reference
 
 Everything added to Lotus Chat beyond upstream Cinny v4.12.1.
-Last updated: July 2026.
+Last updated: October 2026.
 
 ---
 
@@ -28,7 +28,8 @@ Last updated: July 2026.
 19. [Infrastructure](#infrastructure)
 20. [Localization](#localization)
 21. [Desktop App Features](#desktop-app-features)
-22. [Key Custom Files](#key-custom-files)
+22. [June–October 2026 Additions](#juneoctober-2026-additions)
+23. [Key Custom Files](#key-custom-files)
 
 ---
 
@@ -232,7 +233,7 @@ All decoration files are 256×256 APNGs. They animate natively in all modern bro
 Decoration preference is stored in the public Matrix profile field `io.lotus.avatar_decoration` (a slug string, e.g. `lotus_flower`). Any Lotus Chat user viewing your profile sees your current decoration.
 
 **CDN:**
-Files are self-hosted on the Lotus Nextcloud instance. Direct access: `https://drive.lotusguild.org/public.php/dav/files/{token}/cinny-decorations/{slug}.png`. `<img>` elements load cross-origin freely — no CORS headers needed.
+Static files at `https://chat.lotusguild.org/decorations/{slug}.png` (thumbnails: `thumbs/{slug}.webp`), cached for a week. They come from the versioned `avatar-decorations` package in Gitea's package registry, installed by the matrix repo's LXC 106 deploy (see its README, "Avatar decorations"). To add or replace decorations, publish a new package version there, then update the catalog in `avatarDecorations.ts`. They used to be served from Nextcloud (matrix #22). `<img>` elements load cross-origin freely, so no CORS headers are needed.
 
 **Module-level cache with in-flight deduplication:**
 `useAvatarDecoration(userId)` fetches the profile field once per user per session. A `Map<userId, slug|null>` cache prevents redundant requests; a second `pending` waiters map ensures multiple components requesting the same userId simultaneously share one HTTP request rather than firing duplicates.
@@ -1522,6 +1523,98 @@ Checks for a new desktop release every 12h and offers a one-click update. `Tauri
 
 ---
 
+## June–October 2026 Additions
+
+Features shipped since the sections above were last updated (Gitea #294). Each
+line names the commit that introduced it.
+
+### Calls
+
+- **Selectable ringtone + volume:** pick the incoming-call ringtone (`4a875884`).
+- **In-call incoming-call banner:** a small banner for a second call instead of a full ring (`c67aed01`).
+- **Denoise tester:** Settings → Calls lets you audition the ML models and calibrate the noise gate (`14cfa021`).
+- **Mic level meter** on the mute button (`3449338b`, #146).
+- **"You're muted" nudge** when you talk into a muted mic (`73b1d1e3`, #117).
+- **Undeafen catch-up toast:** what you missed while deafened (`33e16e85`, #128).
+- **Admin turned off screen share / camera:** a toast explains why your share or camera stopped (`34574178`, #223).
+- **Voice-limit / audio-only chip** in the room header (`7f17940d`, #134).
+- **"N Live" pill names** who is in the call on hover / focus (`a475531b`, #157).
+- **Live-call dot on the space rail** (`4fe9c870`, #148).
+- **Missed-call line** in the timeline for DMs and small groups (`c921f115`, #162).
+- **Answer with camera or audio-only:** answering says when it turns the camera on (`d2f56817`, #135).
+- **Audio output quick-switch** in the call bar (`98c80f36`, #119).
+- **Call-ended summary toast:** "Call ended · 41 min · connection was good" (`af1c0ee1`, #143).
+- **No WebRTC on desktop:** offers "Open in browser" instead of a dead end (`fff583fc`).
+- **Call page on its own origin** (desktop, opt-in) (`7d7a379c`, #43).
+
+### Messaging & composer
+
+- **Reactions collapse** to one row with a +N chip (`bf05751e`, #138).
+- **Consecutive photos / videos** render as one gallery grid (`bd8c79e0`, #137).
+- **Inline audio playback** for `m.file` audio attachments (`eb34b047`).
+- **Recently used GIFs** in the GIF picker (`5b58e5fe`).
+- **Pasted image → caption field:** a single pasted or dropped image lands in its caption (`0c45bde8`, #129).
+- **Offer to format pasted code** as a code block (`75d55e86`, #107).
+- **Tap to preview stickers / GIFs** on touch, tap again to send (`8d11a62e`, #147).
+- **Link-mismatch confirmation** before opening a link whose text names another site (`74d8e311`, #122).
+- **Embed fallback** for hung embeds and deleted X posts (`ba5b1ffe`, #200).
+- **"Back to where you were"** after jumping in the timeline (`7da91bd8`, #127).
+- **Offline outbox:** unsent messages survive a reload and retry (`02d86cae`, #112).
+- **Terms-consent explanation** when "Failed to send" is the server wanting its terms accepted (`c96c47dd`).
+
+### Search & navigation
+
+- **Quick switcher (Ctrl/⌘+K)**, with a configurable key (`9d4679d2`).
+- **Search filters:** `has:image/file/video`, recent searches, pinned only (`1ee0f0b5`).
+- **Search operators:** `in:`, `before:` / `after:`, `has:`, `is:pinned` (`75951f90`, #106).
+- **Explore:** featured Lotus Guild space and the matrixrooms.info directory (`b1ecb0c4`).
+
+### Rooms & threads
+
+- **Disappearing messages** (MSC1763 `m.room.retention`) (`82e52e1b`).
+- **Mark as Unread** (MSC2867) and **Low Priority** rooms (`d46b91b1`).
+- **"Who can see this"** line under the room name in Room Settings (`ad1cbcf7`, #133).
+- **Threads: Mark all read** in the threads list (`fdec3ed7`, #165).
+
+### Media viewer
+
+- **Swipe** between items in the full-screen viewer (`cf80729a`, #164).
+- **Two-finger pinch zoom** (`39589b40`, #164).
+
+### Profile, privacy & safety
+
+- **Report User** (MSC4260) (`26f90087`).
+- **Active now / Last active** from presence (`dea1f7af`, #150).
+- **Delete all my messages** in a room (`edb46247`, #169).
+- **Self-hosted VT323 font** instead of Google Fonts (`6f250353`, #214).
+- **Device-security nudge:** verify this device / set up key backup (`6a7627fa`, #110, #123).
+- **Homeserver status banner** from Uptime Kuma (`6ae00872`, #124).
+
+### Appearance
+
+- **Custom accent colour** for non-TDS themes (`3c4842df`, P5-1).
+- **Theme presets:** Cyberpunk, Ocean, Blood Red, Matrix, Midnight (`65e24bd4`, P5-2).
+
+### Mobile & PWA
+
+- **Saved Messages** from the room header's More Options menu (`8c711f5f`).
+- **Long-press bottom sheet** of message actions (`53a80adb`, #166).
+- **Haptics** on PTT press / release and on reactions (`492b57c6`, #125).
+- **Android share target:** share into Lotus Chat from other apps (`96a97a2f`, #155).
+
+### Notifications
+
+- **Inline reply** from a browser notification (unencrypted rooms) (`d4420905`, #203).
+
+### Desktop app
+
+- **Tray icon mirrors call state** (`25fa0f6e`, cinny-desktop #4).
+- **Start minimized** under Launch on login (`4a982389`, cinny-desktop #3).
+- **First-close choice:** asks once what closing the window should do (`359c79a4`, cinny-desktop #5).
+- **Keychain mirror:** login tokens also kept in the OS keychain (`9b9f33b2`, #105).
+
+---
+
 ## Key Custom Files
 
 | File                                                           | Purpose                                                                                     |

LOTUS_REFERENCE.md

@@ -34,7 +34,7 @@ This file keeps only what a contributor needs to have open while working: the tw
 
 ## 🚫 Blocked Features (server / upstream gated)
 
-Re-run `/_matrix/client/versions` + `unstable_features` after each Synapse upgrade. **Re-checked on 1.157.1 (2026-07-23): no change — all four below are still `false`.** The 1.156.0→1.157.1 delta unblocked nothing (it's a bugfix release; the only feature-bearing release in the gap was 1.156.0, which we were already running).
+Re-run `/_matrix/client/versions` + `unstable_features` after each Synapse upgrade. **Re-checked on 1.162.0 (2026-10-18, Gitea #294):** live location (`msc3489`/`msc3672`) and relation redaction (`msc3892`) are still unadvertised; thread subscriptions (`msc4306`), sticky events (`msc4354`) and QR login (`msc4108`) are still `false`. New: `org.matrix.msc3026.busy_presence` is advertised as `false`, and enabling it would give Do Not Disturb a real presence state (#283). `msc3266` and `msc4222` are no longer listed, but room preview still works (`im.nheko.summary` and `v1/room_summary` both answer 200). (Previous check: 1.157.1 on 2026-07-23, no change then.)
 
 - **[BLOCKED] Live Location Sharing** (MSC3489 + MSC3672 both `false`) — real-time GPS beacons over the existing static share.
 - **[BLOCKED] Reaction/Relation Redaction** (MSC3892 `false`) — remove a reaction without redacting the parent; current full-redaction fallback is acceptable.

e2e/local-homeserver.spec.ts

@@ -265,6 +265,46 @@ test.describe('local homeserver regression', () => {
     await expect.poll(threadUnread).toBe(false);
   });
 
+  test("a thread I don't follow stays unread while I view the room (#314)", async ({ page }) => {
+    const room = await createRoom(alice, 'Unfollowed Thread Room', { invite: [bob.userId] });
+    await joinRoom(bob, room);
+    const inThread = (root: string) => ({
+      'm.relates_to': {
+        rel_type: 'm.thread',
+        event_id: root,
+        is_falling_back: true,
+        'm.in_reply_to': { event_id: root },
+      },
+    });
+    const root = await sendText(bob, room, "bob's thread root");
+    await loginUI(page, alice);
+    await openRoom(page, room);
+    await sendText(bob, room, 'reply in bob thread', inThread(root));
+    await sendText(bob, room, 'newer main message 314');
+    await expect(page.getByText('newer main message 314')).toBeVisible();
+    const threadUnread = async () => {
+      const filter = {
+        room: {
+          rooms: [room],
+          timeline: { limit: 1, unread_thread_notifications: true, not_types: [uniq('x.')] },
+        },
+      };
+      const sync = await api<{
+        rooms: {
+          join: Record<string, { unread_thread_notifications?: Record<string, unknown> }>;
+        };
+      }>(
+        'GET',
+        `/_matrix/client/v3/sync?timeout=0&filter=${enc(JSON.stringify(filter))}`,
+        alice.token,
+      );
+      return root in (sync.rooms.join[room]?.unread_thread_notifications ?? {});
+    };
+    await page.waitForTimeout(2000); // let any receipt the room view would send go out
+    // Viewing the room used to read every thread you don't follow (#314).
+    expect(await threadUnread()).toBe(true);
+  });
+
   test('timeline image opens the gallery lightbox (#219) @webkit', async ({ page }) => {
     const room = await createRoom(alice, 'Lightbox Room');
     const png = Buffer.from(

e2e/security-nudge.spec.ts

@@ -29,6 +29,32 @@ async function settled(page: Page) {
   await page.waitForTimeout(2000);
 }
 
+/** [Gitea #307] Serve a Kuma status page for `localhost` with one posted announcement. */
+async function mockAnnouncement(page: Page) {
+  await page.route(/\/config\.json(\?.*)?$/, async (route) => {
+    const res = await route.fetch();
+    const cfg = await res.json();
+    cfg.statusPages = { localhost: { url: 'https://isitup.lotusguild.org', slug: 'matrix' } };
+    await route.fulfill({ response: res, json: cfg });
+  });
+  await page.route(/isitup\.lotusguild\.org\/api\/status-page\//, async (route) => {
+    const cors = { 'access-control-allow-origin': '*' };
+    if (route.request().url().includes('/heartbeat/')) {
+      await route.fulfill({ headers: cors, json: { heartbeatList: {}, uptimeList: {} } });
+      return;
+    }
+    await route.fulfill({
+      headers: cors,
+      json: {
+        config: { slug: 'matrix' },
+        incidents: [{ id: 7, title: 'Community call on Friday', content: '', style: 'info' }],
+        maintenanceList: [],
+        publicGroupList: [],
+      },
+    });
+  });
+}
+
 test.describe('security nudge (#110, #123)', () => {
   let user: TestUser;
 
@@ -60,6 +86,22 @@ test.describe('security nudge (#110, #123)', () => {
     await expect(page.getByText('Device Verification').first()).toBeVisible();
   });
 
+  test('a dismissed announcement no longer hides the nudge (#307)', async ({ page }) => {
+    test.setTimeout(200_000);
+    await mockAnnouncement(page);
+    await loginUI(page, user);
+    await pastGrace(page);
+    await settled(page);
+    // The announcement wins the one strip slot until it's dismissed.
+    const announcement = page.getByRole('status').filter({ hasText: 'Community call on Friday' });
+    await expect(announcement).toBeVisible();
+    await expect(strip(page)).toHaveCount(0);
+    await announcement.getByRole('button', { name: 'Dismiss' }).click();
+    await page.reload();
+    await settled(page);
+    await expect(strip(page)).toContainText("Your encryption keys aren't backed up");
+  });
+
   test('"Not now" snoozes it across a reload', async ({ page }) => {
     test.setTimeout(200_000);
     await loginUI(page, user);

package-lock.json

@@ -81,7 +81,7 @@
       },
       "devDependencies": {
         "@axe-core/playwright": "4.13.0",
-        "@lotusguild/element-call-embedded": "0.25.0-lotus.23",
+        "@lotusguild/element-call-embedded": "0.25.0-lotus.26",
         "@playwright/test": "1.63.0",
         "@rollup/plugin-inject": "5.0.5",
         "@rollup/plugin-wasm": "6.2.2",
@@ -2695,9 +2695,9 @@
       "integrity": "sha512-dfLbk+PwWvFzSxwk3n5ySL0hfBog779o8h68wK/7/APo/7cgyWp5jcXockbxdk5kFRkbeXWm4Fbi9FrdN381sA=="
     },
     "node_modules/@lotusguild/element-call-embedded": {
-      "version": "0.25.0-lotus.23",
-      "resolved": "https://code.lotusguild.org/api/packages/LotusGuild/npm/%40lotusguild%2Felement-call-embedded/-/0.25.0-lotus.23/element-call-embedded-0.25.0-lotus.23.tgz",
-      "integrity": "sha512-vRmcWeJcU0Accyl2x3mqNEzrIe8djE5BekyYbYOSCsMflC98rZgD1mO7KOe7bA1cX7gparRf6sAt1fotHoU+bA==",
+      "version": "0.25.0-lotus.26",
+      "resolved": "https://code.lotusguild.org/api/packages/LotusGuild/npm/%40lotusguild%2Felement-call-embedded/-/0.25.0-lotus.26/element-call-embedded-0.25.0-lotus.26.tgz",
+      "integrity": "sha512-u0gFV/ne61MHVkl2JFY6TjC0C/vY2oYTz6dFaDtAmdLUBH6gU+6ar0QOr5xs9bhr4+HT8CSBibU8mLTR+ByjKA==",
       "dev": true
     },
     "node_modules/@matrix-org/matrix-sdk-crypto-wasm": {

package.json

@@ -108,7 +108,7 @@
   },
   "devDependencies": {
     "@axe-core/playwright": "4.13.0",
-    "@lotusguild/element-call-embedded": "0.25.0-lotus.23",
+    "@lotusguild/element-call-embedded": "0.25.0-lotus.26",
     "@playwright/test": "1.63.0",
     "@rollup/plugin-inject": "5.0.5",
     "@rollup/plugin-wasm": "6.2.2",

public/manifest.json

@@ -5,7 +5,6 @@
   "dir": "auto",
   "lang": "en-US",
   "display": "standalone",
-  "orientation": "portrait",
   "start_url": "./",
   "background_color": "#0a0a0a",
   "theme_color": "#980000",
@@ -90,7 +89,7 @@
       "name": "New Message",
       "short_name": "DM",
       "description": "Open a new direct message",
-      "url": "/",
+      "url": "./direct/create/",
       "icons": [
         {
           "src": "public/res/android/android-chrome-96x96.png",

scripts/bundle-budget.json

@@ -1,5 +1,5 @@
 {
-  "$comment": "Gitea #96. Budgets are seeded from the dist/assets gzip sizes on the tree at seed time, +10% headroom. Regenerate deliberately (not just to silence a failure) when a real feature addition grows the bundle: measure the new gzip sizes and bump these with the same +10% margin.",
-  "totalGzipBytes": 1731120,
-  "largestChunkGzipBytes": 358317
+  "$comment": "Gitea #96. Budgets are seeded from the dist/assets gzip sizes on the tree at seed time, +10% headroom. Regenerate deliberately (not just to silence a failure) when a real feature addition grows the bundle: measure the new gzip sizes and bump these with the same +10% margin. Re-seeded 2026-10-18 from lotus d7bc6d94 (total 1666894, largest 360238 bytes gzip) after the October audit fix batch (~40 PRs) grew the entry chunk past the old budget.",
+  "totalGzipBytes": 1833583,
+  "largestChunkGzipBytes": 396262
 }

src/app/components/CallEmbedProvider.tsx

@@ -86,9 +86,16 @@ import { CallAvatarAnimation } from '../styles/Animations.css';
 import { webRTCSupported } from '../utils/rtc';
 import { CallsUnavailableMessage } from '../features/call/CallsUnavailable';
 import { zIndices } from '../styles/zIndex';
+import { useReconnectWhenSynced } from '../hooks/useCallError';
+import { useDenoiseNotices } from '../hooks/useDenoiseNotices';
 
 const PIP_MIN_W = 200;
 const PIP_MIN_H = 112;
+/** [Gitea #323] Minimised PiP bar size. */
+const PIP_MINI_W = 220;
+const PIP_MINI_H = 40;
+/** Default PiP top: just below the 64px-ish room header. */
+const PIP_DEFAULT_TOP = 72;
 
 type Corner = 'se' | 'sw' | 'ne' | 'nw';
 
@@ -811,6 +818,8 @@ function CallUtils({ embed, joined }: { embed: CallEmbed; joined: boolean }) {
   useCallPolicyRevokedToast(embed, joined);
   useCallEndedToast(embed);
   useScreenshareNotices(embed);
+  useReconnectWhenSynced(embed.control);
+  useDenoiseNotices(embed);
   // [Gitea #43] The in-frame screenshare button follows the same room policy
   // as the host bar's (hidden where the server would refuse the share).
   const { allowScreenshare } = useRoomCallPolicy(embed.room);
@@ -999,6 +1008,28 @@ export function CallEmbedProvider({ children }: CallEmbedProviderProps) {
   );
 
   const [pipIsFullscreen, setPipIsFullscreen] = useState(false);
+  // [Gitea #323] Minimised PiP: a small draggable bar (room name + expand)
+  // instead of the video. Remembered; phones start minimised.
+  const [pipMinimized, setPipMinimized] = useState<boolean>(() => {
+    try {
+      const v = localStorage.getItem('pip-minimized');
+      if (v !== null) return v === '1';
+    } catch {
+      /* storage unavailable */
+    }
+    return window.innerWidth < 600;
+  });
+  const pipFullSizeRef = React.useRef({ width: 280, height: 158 });
+  const togglePipMinimized = useCallback(() => {
+    setPipMinimized((m) => {
+      try {
+        localStorage.setItem('pip-minimized', m ? '0' : '1');
+      } catch {
+        /* storage unavailable */
+      }
+      return !m;
+    });
+  }, []);
   useEffect(() => {
     const onFsChange = () => setPipIsFullscreen(!!document.fullscreenElement);
     document.addEventListener('fullscreenchange', onFsChange);
@@ -1064,8 +1095,11 @@ export function CallEmbedProvider({ children }: CallEmbedProviderProps) {
           el.style.left = `${Math.max(0, Math.min(savedPos.left, window.innerWidth - 280))}px`;
           el.style.top = `${Math.max(0, Math.min(savedPos.top, window.innerHeight - 158))}px`;
         } else {
-          el.style.left = `${window.innerWidth - 280 - 16}px`;
-          el.style.top = `${window.innerHeight - 158 - 72}px`;
+          // [Gitea #323] First use: top-right under the room header, over the
+          // timeline. Bottom-right sat on the composer (Send / Emoji, and on
+          // phones the whole message box), so typing landed on the call.
+          el.style.left = `${Math.max(0, window.innerWidth - 280 - 16)}px`;
+          el.style.top = `${PIP_DEFAULT_TOP}px`;
         }
         el.style.width = '280px';
         el.style.height = '158px';
@@ -1096,6 +1130,26 @@ export function CallEmbedProvider({ children }: CallEmbedProviderProps) {
     }
   }, [pipMode, callVisible]);
 
+  // [Gitea #323] Apply the minimised / full PiP size (after the entry effect
+  // below has positioned and sized it). Keeps the bar on screen.
+  React.useEffect(() => {
+    const el = callEmbedRef.current;
+    if (!el || !pipMode) return;
+    if (pipMinimized) {
+      if (el.offsetHeight > PIP_MINI_H) {
+        pipFullSizeRef.current = { width: el.offsetWidth, height: el.offsetHeight };
+      }
+      el.style.width = `${PIP_MINI_W}px`;
+      el.style.height = `${PIP_MINI_H}px`;
+    } else {
+      el.style.width = `${pipFullSizeRef.current.width}px`;
+      el.style.height = `${pipFullSizeRef.current.height}px`;
+    }
+    const rect = el.getBoundingClientRect();
+    el.style.left = `${Math.max(0, Math.min(rect.left, window.innerWidth - el.offsetWidth))}px`;
+    el.style.top = `${Math.max(0, Math.min(rect.top, window.innerHeight - el.offsetHeight))}px`;
+  }, [pipMode, pipMinimized, callEmbedRef]);
+
   React.useEffect(() => {
     if (!pipMode) return;
     const onPipWindowResize = (): void => {
@@ -1414,19 +1468,50 @@ export function CallEmbedProvider({ children }: CallEmbedProviderProps) {
                 position: 'absolute',
                 inset: 0,
                 zIndex: 1,
-                background: 'transparent',
+                // Minimised: cover the frame so only the bar shows.
+                background: pipMinimized ? color.Surface.Container : 'transparent',
                 cursor: 'grab',
                 // [Gitea #43] The call's "Share your screen?" prompt is drawn
                 // inside the frame: let the click reach its Share button.
                 pointerEvents: pipPromptOpen ? 'none' : undefined,
                 display: 'flex',
-                alignItems: 'flex-start',
                 justifyContent: 'flex-end',
+                alignItems: pipMinimized ? 'center' : 'flex-start',
                 padding: '6px',
               }}
             >
-              <div style={{ display: 'flex', gap: config.space.S100, alignItems: 'center' }}>
-                {document.fullscreenEnabled && (
+              <div
+                style={{
+                  display: 'flex',
+                  gap: config.space.S100,
+                  alignItems: 'center',
+                  ...(pipMinimized ? { width: '100%' } : {}),
+                }}
+              >
+                {/* Leftmost: the top-right corner is a resize handle. */}
+                <IconButton
+                  type="button"
+                  size="300"
+                  radii="300"
+                  variant="Surface"
+                  fill="None"
+                  aria-label={pipMinimized ? 'Expand call' : 'Minimise call'}
+                  aria-pressed={pipMinimized}
+                  onClick={(e) => {
+                    e.stopPropagation();
+                    togglePipMinimized();
+                  }}
+                  onMouseDown={(e) => e.stopPropagation()}
+                  onTouchStart={(e) => e.stopPropagation()}
+                  style={{
+                    background: 'rgba(0,0,0,0.65)',
+                    backdropFilter: 'blur(4px)',
+                    color: '#fff',
+                  }}
+                >
+                  <Icon size="100" src={pipMinimized ? Icons.ChevronTop : Icons.Minus} />
+                </IconButton>
+                {!pipMinimized && document.fullscreenEnabled && (
                   <IconButton
                     type="button"
                     size="300"
@@ -1458,14 +1543,23 @@ export function CallEmbedProvider({ children }: CallEmbedProviderProps) {
                     fontSize: '11px',
                     fontWeight: 600,
                     pointerEvents: 'none',
+                    ...(pipMinimized
+                      ? {
+                          flexGrow: 1,
+                          minWidth: 0,
+                          overflow: 'hidden',
+                          textOverflow: 'ellipsis',
+                          whiteSpace: 'nowrap',
+                        }
+                      : {}),
                   }}
                 >
-                  ↗ Return to call
+                  {pipMinimized ? `↗ ${callEmbed.room.name ?? 'Call'}` : '↗ Return to call'}
                 </div>
               </div>
             </div>
-            <PipMuteOverlay callEmbed={callEmbed} />
-            {(['se', 'sw', 'ne', 'nw'] as Corner[]).map((corner) => {
+            {!pipMinimized && <PipMuteOverlay callEmbed={callEmbed} />}
+            {(pipMinimized ? [] : (['se', 'sw', 'ne', 'nw'] as Corner[])).map((corner) => {
               const s = corner.includes('s');
               const e2 = corner.includes('e');
               const dots = [

src/app/components/ConsentRequiredPrompt.tsx

@@ -44,6 +44,9 @@ export function ConsentRequiredPrompt() {
   const [opened, setOpened] = useState(false);
   const [blockedCount, setBlockedCount] = useState(0);
   const snoozedUntil = useRef(0);
+  // [Gitea #311] Closing via Retry also deactivates the focus trap; that must
+  // not snooze, or a retry that fails again (terms not accepted yet) is silent.
+  const closingForRetry = useRef(false);
   const blocked = useRef(new Map<MatrixEvent, Room>());
   const modalStyle = useModalStyle(440);
   const server = mx.getDomain() ?? 'Your homeserver';
@@ -74,6 +77,8 @@ export function ConsentRequiredPrompt() {
   }, [consentUri]);
 
   const retry = useCallback(() => {
+    closingForRetry.current = true;
+    snoozedUntil.current = 0;
     setOpen(false);
     setOpened(false);
     const pending = Array.from(blocked.current.entries());
@@ -97,7 +102,13 @@ export function ConsentRequiredPrompt() {
           focusTrapOptions={{
             initialFocus: '#consent-review',
             fallbackFocus: '#consent-later',
-            onDeactivate: later,
+            onDeactivate: () => {
+              if (closingForRetry.current) {
+                closingForRetry.current = false;
+                return;
+              }
+              later();
+            },
             clickOutsideDeactivates: true,
             escapeDeactivates: true,
           }}

src/app/components/image-pack-view/ImagePackContent.tsx

@@ -16,7 +16,7 @@ import { SettingTile } from '../setting-tile';
 import { UsageSwitcher } from './UsageSwitcher';
 import { ImagePackProfile, ImagePackProfileEdit } from './PackMeta';
 import * as css from './style.css';
-import { useFilePicker } from '../../hooks/useFilePicker';
+import { useStrippedFilePicker } from '../../hooks/useStrippedFilePicker';
 import { CompactUploadCardRenderer } from '../upload-card';
 import { UploadSuccess } from '../../state/upload';
 import { getImageInfo, TUploadContent } from '../../utils/matrix';
@@ -60,7 +60,7 @@ export const ImagePackContent = as<'div', ImagePackContentProps>(
       [imagePack, savedImages, uploadedImages],
     );
 
-    const pickFiles = useFilePicker(
+    const pickFiles = useStrippedFilePicker(
       useCallback(
         (pickedFiles: File[]) => {
           const uniqueFiles = pickedFiles.map((file) => {

src/app/components/image-pack-view/PackMeta.tsx

@@ -19,7 +19,7 @@ import { nameInitials } from '../../utils/common';
 import { BreakWord } from '../../styles/Text.css';
 import { LINKIFY_OPTS } from '../../plugins/react-custom-html-parser';
 import { ContainerColor } from '../../styles/ContainerColor.css';
-import { useFilePicker } from '../../hooks/useFilePicker';
+import { useStrippedFilePicker } from '../../hooks/useStrippedFilePicker';
 import { useObjectURL } from '../../hooks/useObjectURL';
 import { createUploadAtom, UploadSuccess } from '../../state/upload';
 import { CompactUploadCardRenderer } from '../upload-card';
@@ -111,7 +111,7 @@ export function ImagePackProfileEdit({ meta, onCancel, onSave }: ImagePackProfil
     return undefined;
   }, [imageFile]);
 
-  const pickFile = useFilePicker(setImageFile, false);
+  const pickFile = useStrippedFilePicker(setImageFile, false);
 
   const handleRemoveUpload = useCallback(() => {
     setImageFile(undefined);

src/app/components/message/MsgTypeRenderers.tsx

@@ -40,6 +40,7 @@ import { parseGeoUri, scaleYDimension } from '../../utils/common';
 import { formatAccuracy } from '../../utils/geoShare';
 import { Attachment, AttachmentBox, AttachmentContent, AttachmentHeader } from './attachment';
 import { FileHeader, FileDownloadButton } from './FileHeader';
+import { previewUrlsFor } from '../../utils/linkSafety';
 
 // ≈ 20 lines; in rem so a larger font setting doesn't show fewer lines (Gitea #343).
 const COLLAPSE_MAX_HEIGHT_REM = 20;
@@ -343,7 +344,13 @@ export function MText({
   if (typeof body !== 'string') return <BrokenContent />;
   const trimmedBody = trimReplyFromBody(body);
   const urlsMatch = renderUrlsPreview && trimmedBody.match(URL_REG);
-  const urls = urlsMatch ? [...new Set(urlsMatch)] : undefined;
+  // [Gitea #286] no genuine card for a site a deceptive link only pretends to be
+  const urls = urlsMatch
+    ? previewUrlsFor(
+        [...new Set(urlsMatch)],
+        typeof customBody === 'string' ? customBody : undefined,
+      )
+    : undefined;
 
   return (
     <>
@@ -401,7 +408,13 @@ export function MEmote({
   if (typeof body !== 'string') return <BrokenContent />;
   const trimmedBody = trimReplyFromBody(body);
   const urlsMatch = renderUrlsPreview && trimmedBody.match(URL_REG);
-  const urls = urlsMatch ? [...new Set(urlsMatch)] : undefined;
+  // [Gitea #286] no genuine card for a site a deceptive link only pretends to be
+  const urls = urlsMatch
+    ? previewUrlsFor(
+        [...new Set(urlsMatch)],
+        typeof customBody === 'string' ? customBody : undefined,
+      )
+    : undefined;
 
   return (
     <>
@@ -458,7 +471,13 @@ export function MNotice({
   if (typeof body !== 'string') return <BrokenContent />;
   const trimmedBody = trimReplyFromBody(body);
   const urlsMatch = renderUrlsPreview && trimmedBody.match(URL_REG);
-  const urls = urlsMatch ? [...new Set(urlsMatch)] : undefined;
+  // [Gitea #286] no genuine card for a site a deceptive link only pretends to be
+  const urls = urlsMatch
+    ? previewUrlsFor(
+        [...new Set(urlsMatch)],
+        typeof customBody === 'string' ? customBody : undefined,
+      )
+    : undefined;
 
   return (
     <>

src/app/components/presence/Presence.tsx

@@ -13,11 +13,13 @@ import {
 import React, { ReactNode } from 'react';
 import * as css from './styles.css';
 import { Presence, usePresenceLabel } from '../../hooks/useUserPresence';
+import { isDndPresence } from '../../utils/busyPresence';
 
 const PresenceToColor: Record<Presence, MainColor> = {
   [Presence.Online]: 'Success',
   [Presence.Unavailable]: 'Warning',
   [Presence.Offline]: 'Secondary',
+  [Presence.Busy]: 'Critical',
 };
 
 type PresenceBadgeProps = {
@@ -31,9 +33,11 @@ export function PresenceBadge({ presence, status, size }: PresenceBadgeProps) {
   // Disturb" to match PresenceRingAvatar and the settings picker (which both
   // special-case 'dnd' → Critical) — the badge was the lone outlier showing a
   // yellow "Idle". The 'dnd' sentinel isn't surfaced as a status line.
-  const isDnd = presence === Presence.Unavailable && status === 'dnd';
+  // [Gitea #283] or MSC3026 busy, which keeps a real status line.
+  const isDnd = isDndPresence(presence, status);
+  const legacyDnd = isDnd && status === 'dnd';
   const displayLabel = isDnd ? 'Do Not Disturb' : label[presence];
-  const displayStatus = isDnd ? undefined : status;
+  const displayStatus = legacyDnd ? undefined : status;
   const ariaLabel = displayStatus ? `${displayLabel} — ${displayStatus}` : displayLabel;
 
   return (

src/app/components/presence/PresenceRingAvatar.tsx

@@ -4,6 +4,7 @@ import { Presence, useUserPresence } from '../../hooks/useUserPresence';
 
 function presenceRingColor(presence: Presence | undefined, status?: string): string | null {
   if (!presence || presence === Presence.Offline) return null;
+  if (presence === Presence.Busy) return color.Critical.Main; // [Gitea #283] DND
   if (presence === Presence.Unavailable) {
     return status === 'dnd' ? color.Critical.Main : color.Warning.Main;
   }

src/app/components/setting-tile/SettingTile.tsx

@@ -34,7 +34,8 @@ export function SettingTile({ title, description, before, after, children }: Set
   });
 
   return (
-    <Box alignItems="Center" gap="300">
+    // data-setting-tile: lets a group card draw dividers between tiles only (#273).
+    <Box alignItems="Center" gap="300" data-setting-tile="">
       {before && <Box shrink="No">{before}</Box>}
       <Box grow="Yes" direction="Column" gap="100">
         {title && (
@@ -43,7 +44,9 @@ export function SettingTile({ title, description, before, after, children }: Set
           </Text>
         )}
         {description && (
-          <Text className={BreakWord} size="T200" priority="300">
+          // [Gitea #291] A <div>, not a <p>: many tiles pass blocks (badges,
+          // <Box>, <Text>) as the description, which is invalid inside a <p>.
+          <Text as="div" className={BreakWord} size="T200" priority="300">
             {description}
           </Text>
         )}

src/app/components/upload-card/UploadCardRenderer.tsx

@@ -310,9 +310,13 @@ export function UploadCardRenderer({
   const { file } = upload;
   const fileSizeExceeded = file.size >= allowSize;
 
-  if (upload.status === UploadStatus.Idle && !fileSizeExceeded) {
-    startUpload();
-  }
+  // [Gitea #291] Start in an effect, not during render: the desktop taskbar
+  // progress hook subscribes to the upload atoms, so a render-time start
+  // updated another component mid-render (React warning on every image send).
+  const idle = upload.status === UploadStatus.Idle;
+  useEffect(() => {
+    if (idle && !fileSizeExceeded) startUpload();
+  }, [idle, fileSizeExceeded, startUpload]);
 
   const handleSpoiler = (marked: boolean) => {
     setMetadata(fileItem, { ...metadata, markedAsSpoiler: marked });

src/app/components/url-preview/UrlPreviewCard.tsx

@@ -54,6 +54,7 @@ import {
   GIF_PREVIEW_MAX_WIDTH,
   gifPreviewBox,
 } from '../../utils/gifPreviewSize';
+import { sameProvider } from './embedProvider';
 
 const linkStyles = { color: color.Success.Main };
 
@@ -2497,7 +2498,10 @@ export const UrlPreviewCard = as<'div', { url: string; ts: number }>(
     const resolveEmbed = (prev: IPreviewUrlResponse): MediaEmbed | null => {
       if (embed) return embed;
       const ogUrl = prev['og:url'];
-      return typeof ogUrl === 'string' && ogUrl !== url
+      // [Gitea #326] …but only from an og:url on the posted link's own
+      // provider: the page sets og:url, so any site could otherwise show up
+      // as a playable YouTube (etc.) card that links to itself.
+      return typeof ogUrl === 'string' && ogUrl !== url && sameProvider(url, ogUrl)
         ? parseMediaEmbed(ogUrl, window.location.hostname)
         : null;
     };

src/app/components/url-preview/embedProvider.test.ts

@@ -0,0 +1,22 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { sameProvider } from './embedProvider';
+
+test("sameProvider: a page cannot borrow another provider's embed via og:url (#326)", () => {
+  const yt = 'https://www.youtube.com/watch?v=dQw4w9WgXcQ';
+  assert.equal(sameProvider('https://evil.example/free-gift', yt), false);
+  assert.equal(sameProvider('https://youtube.com.evil.example/x', yt), false);
+  assert.equal(sameProvider('https://youtu.be/abc', yt), true);
+  assert.equal(sameProvider('https://m.youtube.com/shorts/abc', yt), true);
+  assert.equal(
+    sameProvider('https://vm.tiktok.com/ZM123/', 'https://www.tiktok.com/@a/video/1'),
+    true,
+  );
+  assert.equal(sameProvider('https://spotify.link/abc', 'https://open.spotify.com/track/1'), true);
+  assert.equal(sameProvider('https://on.soundcloud.com/x', 'https://soundcloud.com/a/b'), true);
+  assert.equal(
+    sameProvider('https://redd.it/abc', 'https://www.reddit.com/r/x/comments/abc/'),
+    true,
+  );
+  assert.equal(sameProvider('not a url', yt), false);
+});

src/app/components/url-preview/embedProvider.ts

@@ -0,0 +1,36 @@
+/**
+ * [Gitea #326] A page's og:url is chosen by the page itself, so a phishing
+ * link could serve `og:url = youtube.com/watch?v=…` and render as a playable
+ * YouTube card linking to the attacker. Only trust an og:url on the same
+ * provider as the link actually posted (including the provider's own
+ * short-link domains).
+ */
+const PROVIDER_ALIASES: Record<string, string> = {
+  'youtu.be': 'youtube.com',
+  'youtube-nocookie.com': 'youtube.com',
+  'spotify.link': 'spotify.com',
+  'redd.it': 'reddit.com',
+  'x.com': 'twitter.com',
+  'twitch.tv': 'twitch.tv',
+  'apple.co': 'apple.com',
+};
+
+/**
+ * Pure: the provider a host belongs to (last two labels, aliases folded). Hosts
+ * under two-part public suffixes (`*.co.uk`) share a value, which is harmless
+ * here: no embeddable provider lives under one.
+ */
+export const providerOf = (host: string): string => {
+  const parts = host.toLowerCase().replace(/\.$/, '').split('.');
+  const base = parts.slice(-2).join('.');
+  return PROVIDER_ALIASES[base] ?? base;
+};
+
+/** Pure: whether `ogUrl` is on the same provider as the posted `url`. */
+export function sameProvider(url: string, ogUrl: string): boolean {
+  try {
+    return providerOf(new URL(url).hostname) === providerOf(new URL(ogUrl).hostname);
+  } catch {
+    return false;
+  }
+}

src/app/components/user-profile/UserRoomProfile.tsx

@@ -286,10 +286,11 @@ function UserPrivateNotes({ userId }: { userId: string }) {
       </Box>
       <textarea
         aria-label="Private note about this user"
+        aria-describedby="private-note-storage"
         value={draft}
         onChange={handleChange}
         maxLength={USER_NOTE_MAX_LENGTH}
-        placeholder="Notes only visible to you…"
+        placeholder="Add a private note…"
         rows={3}
         style={{
           width: '100%',
@@ -305,6 +306,11 @@ function UserPrivateNotes({ userId }: { userId: string }) {
           outline: 'none',
         }}
       />
+      {/* [Gitea #329] Account data isn't end-to-end encrypted: say so. */}
+      <Text id="private-note-storage" size="T200" priority="300">
+        Only you can see this in Lotus Chat. It&apos;s stored on your homeserver and isn&apos;t
+        end-to-end encrypted.
+      </Text>
     </Box>
   );
 }

src/app/features/call-status/AudioOutputButton.tsx

@@ -16,6 +16,7 @@ import {
   toRem,
 } from 'folds';
 import { CallEmbed } from '../../plugins/call';
+import { AUDIO_OUTPUT_STATE } from '../../plugins/call/CallControl';
 import { MobileTouchTarget } from '../../styles/mobile.css';
 import { stopPropagation } from '../../utils/keyboard';
 
@@ -39,6 +40,21 @@ export function AudioOutputButton({ embed, disabled }: { embed: CallEmbed; disab
   const [devices, setDevices] = useState<OutputDevice[]>([]);
   const [selected, setSelected] = useState<string | undefined>(embed.control.audioOutputId);
 
+  // [Gitea #310] Prefer the fork's list: its ids are the ones valid inside
+  // the call iframe. Older forks don't report one; fall back to our own.
+  const [forkDevices, setForkDevices] = useState(embed.control.audioOutputs);
+  useEffect(() => {
+    const onState = () => {
+      setForkDevices(embed.control.audioOutputs);
+      setSelected(embed.control.audioOutputId);
+    };
+    onState();
+    embed.control.on(AUDIO_OUTPUT_STATE, onState);
+    return () => {
+      embed.control.off(AUDIO_OUTPUT_STATE, onState);
+    };
+  }, [embed]);
+
   const refresh = useCallback(async () => {
     try {
       const all = await navigator.mediaDevices.enumerateDevices();
@@ -53,11 +69,13 @@ export function AudioOutputButton({ embed, disabled }: { embed: CallEmbed; disab
   }, []);
 
   useEffect(() => {
-    if (!anchor) return undefined;
+    if (!anchor || forkDevices) return undefined;
     refresh();
     navigator.mediaDevices.addEventListener('devicechange', refresh);
     return () => navigator.mediaDevices.removeEventListener('devicechange', refresh);
-  }, [anchor, refresh]);
+  }, [anchor, refresh, forkDevices]);
+
+  const shown = forkDevices ?? devices;
 
   const choose = (id: string) => {
     embed.control.setAudioOutput(id);
@@ -90,13 +108,14 @@ export function AudioOutputButton({ embed, disabled }: { embed: CallEmbed; disab
             aria-label="Audio output"
           >
             <Box direction="Column" gap="100" style={{ padding: config.space.S100 }}>
-              {devices.length === 0 && (
+              {shown.length === 0 && (
                 <Text size="T200" priority="300" style={{ padding: config.space.S200 }}>
                   No audio outputs found.
                 </Text>
               )}
-              {devices.map((d) => {
-                const isSelected = selected ? d.id === selected : d.id === 'default';
+              {shown.map((d) => {
+                const isSelected =
+                  selected !== undefined ? d.id === selected : d.id === 'default' || d.id === '';
                 return (
                   <MenuItem
                     key={d.id}

src/app/features/call-status/CallStatus.tsx

@@ -1,5 +1,5 @@
 import React, { useMemo } from 'react';
-import { Box, Spinner, Text, color } from 'folds';
+import { Box, Button, Spinner, Text, color } from 'folds';
 import { useAtomValue } from 'jotai';
 import classNames from 'classnames';
 import { LiveChip } from './LiveChip';
@@ -18,6 +18,7 @@ import { useMatrixClient } from '../../hooks/useMatrixClient';
 import { MemberSpeaking } from './MemberSpeaking';
 import { clockSkewAtom } from '../../state/clockSkew';
 import { describeSkewVsServer } from '../../utils/clockSkew';
+import { useCallError } from '../../hooks/useCallError';
 
 type CallStatusProps = {
   callEmbed: CallEmbed;
@@ -42,6 +43,8 @@ export function CallStatus({ callEmbed }: CallStatusProps) {
   const clockSkew = useAtomValue(clockSkewAtom);
 
   const compact = screenSize === ScreenSize.Mobile;
+  // [Gitea #318] The call dropped ("Connection lost" in the frame).
+  const callError = useCallError(callEmbed.control);
 
   const memberVisible = callJoined && callMembers.length > 0;
 
@@ -65,6 +68,25 @@ export function CallStatus({ callEmbed }: CallStatusProps) {
           {!compact && (
             <>
               <CallRoomName room={room} />
+              {callError && (
+                <>
+                  <StatusDivider />
+                  <Text size="T200" truncate role="alert" style={{ color: color.Critical.Main }}>
+                    Call disconnected
+                  </Text>
+                  {callError.recoverable && (
+                    <Button
+                      size="300"
+                      radii="300"
+                      variant="Critical"
+                      fill="Soft"
+                      onClick={() => callEmbed.control.reconnect()}
+                    >
+                      <Text size="B300">Reconnect</Text>
+                    </Button>
+                  )}
+                </>
+              )}
               {clockSkew.warning && clockSkew.skewMs !== null && (
                 <>
                   <StatusDivider />
@@ -102,8 +124,19 @@ export function CallStatus({ callEmbed }: CallStatusProps) {
       {memberVisible && !compact && <StatusDivider />}
       <Box shrink="No" alignItems="Center" gap="Inherit">
         {compact && (
-          <Box grow="Yes">
+          <Box grow="Yes" alignItems="Center" gap="200">
             <CallRoomName room={room} />
+            {callError?.recoverable && (
+              <Button
+                size="300"
+                radii="300"
+                variant="Critical"
+                fill="Soft"
+                onClick={() => callEmbed.control.reconnect()}
+              >
+                <Text size="B300">Reconnect</Text>
+              </Button>
+            )}
           </Box>
         )}
         <CallControl callJoined={callJoined} compact={compact} callEmbed={callEmbed} />

src/app/features/call/CallSoundboard.tsx

@@ -50,6 +50,14 @@ type FlatClip = {
  * A management toggle reveals the pack editors (personal + this room, if
  * permitted). Space-wide packs are managed from Space settings.
  */
+/** [EC#13, EC#47] Why the fork refused to play a clip, for the user. */
+export const soundboardRefusalText = (reason: string | undefined): string => {
+  if (reason === 'muted') return 'Unmute your microphone to play a soundboard clip.';
+  if (reason === 'not_permitted')
+    return "The soundboard isn't available in this voice channel (only microphone audio is allowed here).";
+  return 'Could not play that clip.';
+};
+
 export function CallSoundboard({ callEmbed }: CallSoundboardProps) {
   const mx = useMatrixClient();
   const { room } = callEmbed;
@@ -122,13 +130,10 @@ export function CallSoundboard({ callEmbed }: CallSoundboardProps) {
           .catch(() => undefined);
         const result = await callEmbed.control.injectAudio(url, vol, clipBytes);
         if (!result.played) {
-          // [EC#13] Refused fork-side (only reason today: local mic muted) —
+          // [EC#13, EC#47] Refused fork-side (mic muted, or the room's token
+          // only allows the microphone source, as in audio-only rooms) —
           // don't play it locally either, or the user would think it went out.
-          setError(
-            result.reason === 'muted'
-              ? 'Unmute your microphone to play a soundboard clip.'
-              : 'Could not play that clip.',
-          );
+          setError(soundboardRefusalText(result.reason));
           done();
           return;
         }

src/app/features/common-settings/general/RoomProfile.tsx

@@ -52,8 +52,7 @@ import { settingsAtom } from '../../../state/settings';
 import { AsyncStatus, useAsyncCallback } from '../../../hooks/useAsyncCallback';
 import { useAlive } from '../../../hooks/useAlive';
 import { RoomPermissionsAPI } from '../../../hooks/useRoomPermissions';
-
-const MARKDOWN_PATTERN = /(\*\*|__|\*|_|~~|`|\[.+?\]\(.+?\))/;
+import { buildTopicContent } from '../../../utils/topicMarkdown';
 
 function wrapSelection(textarea: HTMLTextAreaElement, syntax: string, placeholder: string) {
   const start = textarea.selectionStart;
@@ -71,30 +70,6 @@ function wrapSelection(textarea: HTMLTextAreaElement, syntax: string, placeholde
   textarea.setSelectionRange(cursorStart, cursorEnd);
 }
 
-function topicMarkdownToHtml(text: string): string {
-  return text
-    .replace(/&/g, '&')
-    .replace(/</g, '&lt;')
-    .replace(/>/g, '&gt;')
-    .replace(/\*\*(.+?)\*\*/g, '<strong>$1</strong>')
-    .replace(/__(.+?)__/g, '<strong>$1</strong>')
-    .replace(/\*(.+?)\*/g, '<em>$1</em>')
-    .replace(/_(.+?)_/g, '<em>$1</em>')
-    .replace(/~~(.+?)~~/g, '<del>$1</del>')
-    .replace(/`(.+?)`/g, '<code>$1</code>')
-    .replace(/\[(.+?)\]\((.+?)\)/g, '<a href="$2">$1</a>')
-    .replace(/\n/g, '<br>');
-}
-
-function buildTopicContent(topic: string): Record<string, string> {
-  if (!MARKDOWN_PATTERN.test(topic)) return { topic };
-  const formattedBody = topicMarkdownToHtml(topic);
-  // Use HTML-stripped text as the plain topic so the header shows clean text, not raw markdown syntax
-  const plainTopic = formattedBody.replace(/<br>/g, '\n').replace(/<[^>]+>/g, '');
-
-  return { topic: plainTopic, format: 'org.matrix.custom.html', formatted_body: formattedBody };
-}
-
 type RoomProfileEditProps = {
   canEditAvatar: boolean;
   canEditName: boolean;

src/app/features/common-settings/permissions/PowersEditor.tsx

@@ -40,7 +40,7 @@ import { useImagePackRooms } from '../../../hooks/useImagePackRooms';
 import { roomToParentsAtom } from '../../../state/room/roomToParents';
 import { useMediaAuthentication } from '../../../hooks/useMediaAuthentication';
 import { useMatrixClient } from '../../../hooks/useMatrixClient';
-import { useFilePicker } from '../../../hooks/useFilePicker';
+import { useStrippedFilePicker } from '../../../hooks/useStrippedFilePicker';
 import { CompactUploadCardRenderer } from '../../../components/upload-card';
 import { createUploadAtom, UploadSuccess } from '../../../state/upload';
 import { AsyncStatus, useAsyncCallback } from '../../../hooks/useAsyncCallback';
@@ -68,7 +68,7 @@ function EditPower({ maxPower, power, tag, onSave, onClose }: EditPowerProps) {
   const imagePackRooms = useImagePackRooms(room.roomId, roomToParents);
 
   const [iconFile, setIconFile] = useState<File>();
-  const pickFile = useFilePicker(setIconFile, false);
+  const pickFile = useStrippedFilePicker(setIconFile, false);
 
   const [tagColor, setTagColor] = useState<string | undefined>(tag?.color);
   const [tagIcon, setTagIcon] = useState<MemberPowerTagIcon | undefined>(tag?.icon);

src/app/features/lotus/avatarDecorations.ts

@@ -3,8 +3,10 @@
 // of this file at runtime (by regex) instead of re-declaring it, so the two can
 // never drift. If you migrate the CDN, change it here ONLY — keep the
 // `export const DECORATION_CDN = '...'` shape so the sync script can still parse it.
-export const DECORATION_CDN =
-  'https://drive.lotusguild.org/public.php/dav/files/bHswJ9pNKp2t26N/cinny-decorations';
+// matrix #22: static files on chat.lotusguild.org (a versioned package installed
+// by the matrix repo's LXC 106 deploy), not Nextcloud's public DAV. Absolute, so
+// the desktop app and the Element Call fork's origin allowlist both work.
+export const DECORATION_CDN = 'https://chat.lotusguild.org/decorations';
 
 // Runtime base. A deployment can repoint the decorations at a different host
 // without editing the catalog literal above (which scripts/syncDecorations.mjs

src/app/features/room-nav/RoomNavItem.tsx

@@ -80,7 +80,7 @@ import {
   setRoomNotificationPreference,
 } from '../../hooks/useRoomsNotificationPreferences';
 import { RoomNotificationModeSwitcher } from '../../components/RoomNotificationSwitcher';
-import { scheduleMuteTimer, unmuteRoom } from './muteTimers';
+import { clearMuteTimer, scheduleMuteTimer } from './muteTimers';
 import { getRoomCreatorsForRoomId, useRoomCreators } from '../../hooks/useRoomCreators';
 import { getRoomPermissionsAPI, useRoomPermissions } from '../../hooks/useRoomPermissions';
 import { InviteUserPrompt } from '../../components/invite-user-prompt';
@@ -381,9 +381,10 @@ const RoomNavItemMenu = forwardRef<HTMLDivElement, RoomNavItemMenuProps>(
           prevMode,
         ).catch(() => {});
         if (durationMs !== null) {
-          scheduleMuteTimer(room.roomId, durationMs, () => {
-            unmuteRoom(mx, room.roomId);
-          });
+          await scheduleMuteTimer(mx, room.roomId, durationMs).catch(() => {});
+        } else {
+          // An indefinite mute replaces any timed one.
+          await clearMuteTimer(mx, room.roomId);
         }
         requestClose();
       },

src/app/features/room-nav/muteTimers.test.ts

@@ -1,7 +1,7 @@
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
 import { RoomNotificationMode } from '../../hooks/useRoomsNotificationPreferences';
-import { shouldResetMuteOnUnmute } from './muteTimers';
+import { muteTimersContent, parseMuteTimers, shouldResetMuteOnUnmute } from './muteTimers';
 
 test('resets to Unset when the room is still Mute at expiry', () => {
   assert.equal(shouldResetMuteOnUnmute(RoomNotificationMode.Mute), true);
@@ -18,3 +18,16 @@ test('does not reset when the user switched to Special messages during the mute
 test('does not reset when the mode is already Unset', () => {
   assert.equal(shouldResetMuteOnUnmute(RoomNotificationMode.Unset), false);
 });
+
+test('parseMuteTimers / muteTimersContent round-trip and tolerate garbage (#333)', () => {
+  const entries = [
+    { roomId: '!a:x', unmuteAt: 1000 },
+    { roomId: '!b:x', unmuteAt: 2000 },
+  ];
+  assert.deepEqual(parseMuteTimers(muteTimersContent(entries)), entries);
+  assert.deepEqual(parseMuteTimers({ timers: { '!a:x': 'soon', '!b:x': 5 } }), [
+    { roomId: '!b:x', unmuteAt: 5 },
+  ]);
+  assert.deepEqual(parseMuteTimers(undefined), []);
+  assert.deepEqual(parseMuteTimers({ timers: null }), []);
+});

src/app/features/room-nav/muteTimers.ts

@@ -7,7 +7,7 @@ import {
   setRoomNotificationPreference,
 } from '../../hooks/useRoomsNotificationPreferences';
 
-// localStorage key for timed mute timers
+// Legacy localStorage key (before #333); migrated into account data once.
 export const MUTE_TIMERS_KEY = 'io.lotus.mute_timers';
 
 // setTimeout's delay is a signed 32-bit int; larger values overflow and fire
@@ -16,17 +16,60 @@ export const MAX_MUTE_TIMEOUT_MS = 2_147_483_647;
 
 export type MuteTimerEntry = { roomId: string; unmuteAt: number };
 
-export function loadMuteTimers(): MuteTimerEntry[] {
-  try {
-    const parsed = JSON.parse(localStorage.getItem(MUTE_TIMERS_KEY) ?? '[]');
-    return Array.isArray(parsed) ? parsed : [];
-  } catch {
-    return [];
-  }
+/** Pure: the timers in an `io.lotus.mute_timers` account data content. */
+export function parseMuteTimers(content: unknown): MuteTimerEntry[] {
+  const timers = (content as { timers?: unknown } | undefined)?.timers;
+  if (!timers || typeof timers !== 'object') return [];
+  return Object.entries(timers as Record<string, unknown>)
+    .filter((e): e is [string, number] => typeof e[1] === 'number' && Number.isFinite(e[1]))
+    .map(([roomId, unmuteAt]) => ({ roomId, unmuteAt }));
 }
 
-export function saveMuteTimers(timers: MuteTimerEntry[]): void {
-  localStorage.setItem(MUTE_TIMERS_KEY, JSON.stringify(timers));
+/** Pure: account data content for `entries`. */
+export const muteTimersContent = (entries: MuteTimerEntry[]) => ({
+  timers: Object.fromEntries(entries.map((e) => [e.roomId, e.unmuteAt])),
+});
+
+/**
+ * [Gitea #333] Timed mutes live in account data: the mute itself is a
+ * server-side push rule on every device, so the timer must be too — kept in one
+ * browser's localStorage, only that device ever unmuted (and never after a
+ * logout there).
+ */
+export function loadMuteTimers(mx: MatrixClient): MuteTimerEntry[] {
+  return parseMuteTimers(getAccountData(mx, AccountDataEvent.LotusMuteTimers)?.getContent());
+}
+
+async function saveMuteTimers(mx: MatrixClient, entries: MuteTimerEntry[]): Promise<void> {
+  await mx.setAccountData(
+    AccountDataEvent.LotusMuteTimers as never,
+    muteTimersContent(entries) as never,
+  );
+}
+
+/** Move timers kept in this browser's localStorage (pre-#333) into account data. */
+export async function migrateLocalMuteTimers(mx: MatrixClient): Promise<void> {
+  let legacy: MuteTimerEntry[] = [];
+  try {
+    const parsed = JSON.parse(localStorage.getItem(MUTE_TIMERS_KEY) ?? '[]');
+    legacy = Array.isArray(parsed)
+      ? parsed.filter(
+          (e): e is MuteTimerEntry =>
+            !!e && typeof e.roomId === 'string' && typeof e.unmuteAt === 'number',
+        )
+      : [];
+  } catch {
+    legacy = [];
+  }
+  if (legacy.length === 0) return;
+  const current = loadMuteTimers(mx);
+  const merged = [...current, ...legacy.filter((l) => !current.some((c) => c.roomId === l.roomId))];
+  await saveMuteTimers(mx, merged);
+  try {
+    localStorage.removeItem(MUTE_TIMERS_KEY);
+  } catch {
+    /* ignore */
+  }
 }
 
 // Pure decision for the unmute guard: a timed mute should only be reset back to
@@ -77,12 +120,30 @@ export async function unmuteRoom(mx: MatrixClient, roomId: string): Promise<void
       RoomNotificationMode.Mute,
     ).catch(() => {});
   }
-  saveMuteTimers(loadMuteTimers().filter((e) => e.roomId !== roomId));
+  await clearMuteTimer(mx, roomId);
 }
 
-export function scheduleMuteTimer(roomId: string, durationMs: number, onUnmute: () => void): void {
-  const unmuteAt = Date.now() + durationMs;
-  const existing = loadMuteTimers().filter((e) => e.roomId !== roomId);
-  saveMuteTimers([...existing, { roomId, unmuteAt }]);
-  setTimeout(onUnmute, Math.min(durationMs, MAX_MUTE_TIMEOUT_MS));
+/** Drop a room's timer (e.g. it was muted indefinitely or unmuted by hand). */
+export async function clearMuteTimer(mx: MatrixClient, roomId: string): Promise<void> {
+  const timers = loadMuteTimers(mx);
+  if (!timers.some((e) => e.roomId === roomId)) return;
+  await saveMuteTimers(
+    mx,
+    timers.filter((e) => e.roomId !== roomId),
+  ).catch(() => {});
+}
+
+/**
+ * Record when a timed mute ends. MuteTimerRestore (on every Lotus device)
+ * schedules the unmute from account data, so whichever is online at expiry
+ * lifts it.
+ */
+export async function scheduleMuteTimer(
+  mx: MatrixClient,
+  roomId: string,
+  durationMs: number,
+): Promise<void> {
+  const unmuteAt = Date.now() + durationMs;
+  const existing = loadMuteTimers(mx).filter((e) => e.roomId !== roomId);
+  await saveMuteTimers(mx, [...existing, { roomId, unmuteAt }]);
 }

src/app/features/room-settings/PolicyListViewer.tsx

@@ -17,6 +17,7 @@ import { Page, PageContent, PageHeader } from '../../components/page';
 import { useMatrixClient } from '../../hooks/useMatrixClient';
 import { SequenceCard } from '../../components/sequence-card';
 import { SequenceCardStyle } from '../common-settings/styles.css';
+import { dedupePolicyEntries, PolicyEntry, recommendationLabel } from './policyEntries';
 
 // ── Policy event types ────────────────────────────────────────────────────────
 
@@ -38,13 +39,6 @@ type PolicyRuleContent = {
   recommendation?: string;
 };
 
-type PolicyEntry = {
-  entity: string;
-  reason: string;
-  recommendation: string;
-  stateKey: string;
-};
-
 type PolicyTab = 'users' | 'rooms' | 'servers';
 
 // ── Helpers ───────────────────────────────────────────────────────────────────
@@ -53,13 +47,6 @@ function isGlob(entity: string): boolean {
   return entity.includes('*') || entity.includes('?');
 }
 
-function recommendationLabel(rec: string): string {
-  // `m.ban` is the stable value; `org.matrix.mjolnir.ban` is the legacy
-  // (pre-stabilization) recommendation still emitted by older bots.
-  if (rec === 'm.ban' || rec === 'org.matrix.mjolnir.ban') return 'Ban';
-  return rec;
-}
-
 /**
  * Fetch all state events of a given type from a room's live forward state.
  * Uses the raw matrix-js-sdk `getStateEvents` API which accepts any string type.
@@ -84,23 +71,6 @@ function extractPolicyEntries(events: MatrixEvent[]): PolicyEntry[] {
     .filter((entry) => entry.entity !== '');
 }
 
-/**
- * Merge policy entries from the stable and legacy event types for a rule
- * kind, de-duplicating by entity+recommendation so a room that emits both a
- * stable and a legacy rule for the same target isn't double-listed.
- */
-export function dedupePolicyEntries(entries: PolicyEntry[]): PolicyEntry[] {
-  const seen = new Set<string>();
-  const result: PolicyEntry[] = [];
-  entries.forEach((entry) => {
-    const key = `${entry.entity} ${entry.recommendation}`;
-    if (seen.has(key)) return;
-    seen.add(key);
-    result.push(entry);
-  });
-  return result;
-}
-
 // ── Entry row ─────────────────────────────────────────────────────────────────
 
 function PolicyEntryRow({ entry }: { entry: PolicyEntry }) {

src/app/features/room-settings/RoomInsights.tsx

@@ -401,16 +401,19 @@ export function RoomInsights({ requestClose }: RoomInsightsProps) {
                               {displayName}
                             </Text>
                             <Box alignItems="Center" gap="200">
-                              <div
-                                style={{
-                                  height: 6,
-                                  width: barWidth,
-                                  background: color.Primary.Main,
-                                  borderRadius: config.radii.R300,
-                                  transition: 'width 0.3s ease',
-                                  flexShrink: 0,
-                                }}
-                              />
+                              {/* [Gitea #270] The bar's % width is of its own track,
+                                  not of the row, so the count always fits beside it. */}
+                              <div style={{ flex: 1, minWidth: 0 }}>
+                                <div
+                                  style={{
+                                    height: 6,
+                                    width: barWidth,
+                                    background: color.Primary.Main,
+                                    borderRadius: config.radii.R300,
+                                    transition: 'width 0.3s ease',
+                                  }}
+                                />
+                              </div>
                               <Text size="T200" priority="300" style={{ flexShrink: 0 }}>
                                 {count}
                               </Text>

src/app/features/room-settings/RoomServerACL.tsx

@@ -32,24 +32,12 @@ import { AsyncStatus, useAsyncCallback } from '../../hooks/useAsyncCallback';
 import { SequenceCard } from '../../components/sequence-card';
 import { SequenceCardStyle } from '../common-settings/styles.css';
 import { stopPropagation } from '../../utils/keyboard';
-import { isValidServerPattern, matchesAnyGlob } from '../../utils/serverAcl';
+import { isValidServerPattern, matchesAnyGlob, normalizeServerAcl } from '../../utils/serverAcl';
 import { MobileTouchTarget } from '../../styles/mobile.css';
 import { useModalStyle } from '../../hooks/useModalStyle';
 
 // ── Types ─────────────────────────────────────────────────────────────────────
 
-type ServerAclContent = {
-  allow: string[];
-  deny: string[];
-  allow_ip_literals: boolean;
-};
-
-const DEFAULT_ACL: ServerAclContent = {
-  allow: ['*'],
-  deny: [],
-  allow_ip_literals: false,
-};
-
 // ── Server list sub-component ─────────────────────────────────────────────────
 
 type ServerListProps = {
@@ -185,20 +173,20 @@ export function RoomServerACL({ requestClose }: RoomServerACLProps) {
 
   // Read current ACL from room state
   const aclEvent = useStateEvent(room, StateEvent.RoomServerAcl);
-  const currentAcl = aclEvent?.getContent<ServerAclContent>() ?? DEFAULT_ACL;
+  const currentAcl = normalizeServerAcl(aclEvent?.getContent());
 
   // Local draft state — initialised from current ACL
-  const [allowList, setAllowList] = useState<string[]>(() => currentAcl.allow ?? ['*']);
-  const [denyList, setDenyList] = useState<string[]>(() => currentAcl.deny ?? []);
+  const [allowList, setAllowList] = useState<string[]>(() => currentAcl.allow);
+  const [denyList, setDenyList] = useState<string[]>(() => currentAcl.deny);
   const [allowIpLiterals, setAllowIpLiterals] = useState<boolean>(
-    () => currentAcl.allow_ip_literals ?? false,
+    () => currentAcl.allow_ip_literals,
   );
 
   // Track whether there are unsaved changes
   const isDirty =
-    JSON.stringify(allowList) !== JSON.stringify(currentAcl.allow ?? ['*']) ||
-    JSON.stringify(denyList) !== JSON.stringify(currentAcl.deny ?? []) ||
-    allowIpLiterals !== (currentAcl.allow_ip_literals ?? false);
+    JSON.stringify(allowList) !== JSON.stringify(currentAcl.allow) ||
+    JSON.stringify(denyList) !== JSON.stringify(currentAcl.deny) ||
+    allowIpLiterals !== currentAcl.allow_ip_literals;
 
   // Save handler
   const [saveState, save] = useAsyncCallback(
@@ -336,7 +324,10 @@ export function RoomServerACL({ requestClose }: RoomServerACLProps) {
                       id="allow-ip-literals"
                       checked={allowIpLiterals}
                       disabled={!canEdit}
-                      onClick={() => setAllowIpLiterals(!allowIpLiterals)}
+                      // folds' Checkbox has no onChange; readOnly tells React the
+                      // click handler controls it (no "checked without onChange").
+                      readOnly
+                      onClick={(e) => setAllowIpLiterals(e.currentTarget.checked)}
                       size="300"
                       variant="Primary"
                     />

src/app/features/room-settings/policyEntries.test.ts

@@ -0,0 +1,32 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { dedupePolicyEntries, recommendationLabel } from './policyEntries';
+
+const e = (entity: string, recommendation: string, stateKey = entity) => ({
+  entity,
+  reason: 'spam waves',
+  recommendation,
+  stateKey,
+});
+
+test('dedupePolicyEntries: a stable rule and its legacy twin show once (#321)', () => {
+  const out = dedupePolicyEntries([
+    e('@spammer:evil.example', 'm.ban'),
+    e('@spammer:evil.example', 'org.matrix.mjolnir.ban'),
+    e('@*:spam.example', 'm.ban'),
+  ]);
+  assert.deepEqual(
+    out.map((x) => x.entity),
+    ['@spammer:evil.example', '@*:spam.example'],
+  );
+});
+
+test('dedupePolicyEntries: different recommendations stay separate', () => {
+  assert.equal(dedupePolicyEntries([e('@a:x', 'm.ban'), e('@a:x', 'org.example.mute')]).length, 2);
+});
+
+test('recommendationLabel', () => {
+  assert.equal(recommendationLabel('m.ban'), 'Ban');
+  assert.equal(recommendationLabel('org.matrix.mjolnir.ban'), 'Ban');
+  assert.equal(recommendationLabel('org.example.mute'), 'org.example.mute');
+});

src/app/features/room-settings/policyEntries.ts

@@ -0,0 +1,35 @@
+export type PolicyEntry = {
+  entity: string;
+  reason: string;
+  recommendation: string;
+  stateKey: string;
+};
+
+/**
+ * `m.ban` is the stable value; `org.matrix.mjolnir.ban` is the legacy
+ * (pre-stabilization) recommendation still emitted by older bots.
+ */
+export const normalizeRecommendation = (rec: string): string =>
+  rec === 'org.matrix.mjolnir.ban' ? 'm.ban' : rec;
+
+export function recommendationLabel(rec: string): string {
+  if (normalizeRecommendation(rec) === 'm.ban') return 'Ban';
+  return rec;
+}
+
+/**
+ * Merge stable and legacy rule lists, one entry per entity + recommendation.
+ * [Gitea #321] Keyed on the normalised recommendation: a bot publishing both
+ * `m.ban` and its `org.matrix.mjolnir.ban` twin showed the rule twice.
+ */
+export function dedupePolicyEntries(entries: PolicyEntry[]): PolicyEntry[] {
+  const seen = new Set<string>();
+  const result: PolicyEntry[] = [];
+  entries.forEach((entry) => {
+    const key = `${entry.entity} ${normalizeRecommendation(entry.recommendation)}`;
+    if (seen.has(key)) return;
+    seen.add(key);
+    result.push(entry);
+  });
+  return result;
+}

src/app/features/room/message/ForwardMessageDialog.tsx

@@ -47,8 +47,12 @@ import {
   recentForwardTargetsAtom,
   addRecentForwardTarget,
 } from '../../../state/recentForwardTargets';
-import { buildForwardContent, buildPlaintextAttachmentContent } from './forwardContent';
-import { useLocalRoomNames } from '../../../hooks/useRoomMeta';
+import {
+  buildForwardContent,
+  buildPlaintextAttachmentContent,
+  forwardEncryptionWarning,
+} from './forwardContent';
+import { useLocalRoomNames, getLocalRoomName } from '../../../hooks/useRoomMeta';
 
 type RoomRowProps = {
   room: Room;
@@ -275,6 +279,14 @@ export function ForwardMessageDialog({ mEvent, onClose }: Props) {
   // Selection persists across query changes: a room selected then filtered out
   // of the rendered slice stays selected.
   const [selectedRoomIds, setSelectedRoomIds] = useState<Set<string>>(new Set());
+  const encryptionWarning = forwardEncryptionWarning(
+    !!mx.getRoom(mEvent.getRoomId() ?? '')?.hasEncryptionStateEvent(),
+    [...selectedRoomIds]
+      .map((id) => mx.getRoom(id))
+      .filter((r): r is Room => !!r && !r.hasEncryptionStateEvent())
+      // The name the user sees (their own "Rename for me" name, if set).
+      .map((r) => getLocalRoomName(mx, r.roomId) ?? r.name),
+  );
 
   const toggleRoom = useCallback((roomId: string) => {
     setSelectedRoomIds((prev) => {
@@ -590,7 +602,13 @@ export function ForwardMessageDialog({ mEvent, onClose }: Props) {
                   shrink="No"
                   direction="Column"
                   style={{ padding: `${config.space.S200} ${config.space.S400}` }}
+                  gap="200"
                 >
+                  {encryptionWarning && (
+                    <Text size="T200" role="note" style={{ color: color.Warning.Main }}>
+                      {encryptionWarning}
+                    </Text>
+                  )}
                   <Button
                     variant="Primary"
                     size="400"

src/app/features/room/message/Message.tsx

@@ -1137,25 +1137,31 @@ export const Message = React.memo(
         </AvatarBase>
       );
 
+      // [Gitea #269] The content column shrinks to the message's width; the
+      // receipt pill / delivery status sit OUTSIDE it, in a full-width column,
+      // so their `margin-left: auto` reaches the row's right edge instead of
+      // wherever the text happens to end.
       const msgContentJSX = (
-        <Box direction="Column" alignSelf="Start" style={{ maxWidth: '100%' }}>
-          {reply}
-          {edit && onEditId ? (
-            <MessageEditor
-              style={{
-                maxWidth: '100%',
-                width: '100vw',
-              }}
-              roomId={room.roomId}
-              room={room}
-              mEvent={mEvent}
-              imagePackRooms={imagePackRooms}
-              onCancel={() => onEditId()}
-            />
-          ) : (
-            children
-          )}
-          {reactions}
+        <Box direction="Column" style={{ maxWidth: '100%', flexGrow: 1, minWidth: 0 }}>
+          <Box direction="Column" alignSelf="Start" style={{ maxWidth: '100%' }}>
+            {reply}
+            {edit && onEditId ? (
+              <MessageEditor
+                style={{
+                  maxWidth: '100%',
+                  width: '100vw',
+                }}
+                roomId={room.roomId}
+                room={room}
+                mEvent={mEvent}
+                imagePackRooms={imagePackRooms}
+                onCancel={() => onEditId()}
+              />
+            ) : (
+              children
+            )}
+            {reactions}
+          </Box>
           {readReceiptUsers.length > 0 && (
             <ReadReceiptAvatars
               room={room}

src/app/features/room/message/forwardContent.test.ts

@@ -1,7 +1,7 @@
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
 import { MatrixClient, MatrixEvent } from 'matrix-js-sdk';
-import { buildForwardContent, getForwardedMeta } from './forwardContent';
+import { buildForwardContent, forwardEncryptionWarning, getForwardedMeta } from './forwardContent';
 
 // Pure content builder buildForwardContent: refuses undecryptable events, forwards
 // the latest edit (`m.new_content`), and strips reply fallbacks + `m.relates_to`.
@@ -171,3 +171,16 @@ test('getForwardedMeta rejects malformed metadata', () => {
   assert.equal(getForwardedMeta({ 'io.lotus.forwarded': { sender: 1 } }), undefined);
   assert.equal(getForwardedMeta({}), undefined);
 });
+
+test('forwardEncryptionWarning: only from an encrypted room into unencrypted ones (#330)', () => {
+  assert.equal(forwardEncryptionWarning(false, ['general']), undefined);
+  assert.equal(forwardEncryptionWarning(true, []), undefined);
+  assert.match(
+    forwardEncryptionWarning(true, ['general']) ?? '',
+    /^general isn't encrypted\..*that room, along with who originally wrote it\.$/,
+  );
+  assert.match(
+    forwardEncryptionWarning(true, ['a', 'b']) ?? '',
+    /^2 of the rooms you picked aren't encrypted\..*those rooms/,
+  );
+});

src/app/features/room/message/forwardContent.ts

@@ -122,3 +122,23 @@ export async function buildPlaintextAttachmentContent(
 
   return plainContent;
 }
+
+/**
+ * [Gitea #330] The note shown when forwarding out of an encrypted room into
+ * rooms that aren't: the text (and a re-uploaded attachment) becomes readable
+ * by the server, and the original author is shown with it. Undefined when
+ * there's nothing to warn about.
+ */
+export function forwardEncryptionWarning(
+  sourceEncrypted: boolean,
+  unencryptedDestNames: string[],
+): string | undefined {
+  if (!sourceEncrypted || unencryptedDestNames.length === 0) return undefined;
+  const where =
+    unencryptedDestNames.length === 1
+      ? `${unencryptedDestNames[0]} isn't encrypted.`
+      : `${unencryptedDestNames.length} of the rooms you picked aren't encrypted.`;
+  return `${where} The forwarded message (and any attachment) will be readable by the server and everyone in ${
+    unencryptedDestNames.length === 1 ? 'that room' : 'those rooms'
+  }, along with who originally wrote it.`;
+}

src/app/features/security-nudge/SecurityBanner.tsx

@@ -14,7 +14,7 @@ import { useKeyBackupInfo, useKeyBackupStatusChange } from '../../hooks/useKeyBa
 import { useAlive } from '../../hooks/useAlive';
 import { useSyncState } from '../../hooks/useSyncState';
 import { settingsRequestAtom } from '../../state/settingsRequest';
-import { serverStatusAtom } from '../../state/serverStatus';
+import { serverStatusAtom, statusDismissedAtom } from '../../state/serverStatus';
 import { pickBanner } from '../../utils/kumaStatus';
 import {
   dismissNudge,
@@ -66,6 +66,7 @@ function SecurityBannerFor({ crypto }: { crypto: CryptoApi }) {
   const backupInfo = useKeyBackupInfo(crypto);
   const backupActive = useBackupActive(crypto);
   const { status: serverStatus, syncLost } = useAtomValue(serverStatusAtom);
+  const statusDismissed = useAtomValue(statusDismissedAtom);
   const requestSettings = useSetAtom(settingsRequestAtom);
   // Not urgent: wait until sync has settled (two SYNCING in a row), so it
   // never stacks under the "Connecting…" strip at startup.
@@ -91,7 +92,11 @@ function SecurityBannerFor({ crypto }: { crypto: CryptoApi }) {
   });
 
   // One strip at a time: outages, maintenance and a lost connection win.
-  const otherStrip = syncLost || !!pickBanner(serverStatus, { syncLost, where: 'client' });
+  // [Gitea #307] Pass what the user dismissed: a dismissed announcement isn't
+  // on screen and must not keep the nudge hidden for as long as it's posted.
+  const otherStrip =
+    syncLost ||
+    !!pickBanner(serverStatus, { syncLost, where: 'client', dismissed: new Set(statusDismissed) });
   if (!settled || !deviceId || !kind || otherStrip || !shouldShowNudge(kind, record, Date.now()))
     return null;
 

src/app/features/server-status/ServerStatusBanner.tsx

@@ -1,5 +1,5 @@
 import React, { useCallback, useEffect, useMemo, useState } from 'react';
-import { useAtomValue, useSetAtom } from 'jotai';
+import { useAtom, useAtomValue, useSetAtom } from 'jotai';
 import { MatrixClient, SyncState } from 'matrix-js-sdk';
 import { Box, Button, config, Icon, IconButton, Icons, IconSrc, Line, Text } from 'folds';
 import { ContainerColor } from '../../styles/ContainerColor.css';
@@ -7,22 +7,10 @@ import { useClientConfig } from '../../hooks/useClientConfig';
 import { useSyncState } from '../../hooks/useSyncState';
 import { useServerStatus } from '../../hooks/useServerStatus';
 import { ScreenSize, useScreenSizeContext } from '../../hooks/useScreenSize';
-import { serverStatusAtom } from '../../state/serverStatus';
+import { serverStatusAtom, statusDismissedAtom } from '../../state/serverStatus';
 import { pickBanner, resolveStatusPage, StatusBanner } from '../../utils/kumaStatus';
 import { homeserverStalledAtom, useHomeserverStall } from '../../hooks/useHomeserverStall';
 
-const DISMISS_KEY = 'lotus-status-banner-dismissed';
-const DISMISS_MAX = 50;
-
-const readDismissed = (): string[] => {
-  try {
-    const v = JSON.parse(localStorage.getItem(DISMISS_KEY) ?? '[]');
-    return Array.isArray(v) ? v.filter((k): k is string => typeof k === 'string') : [];
-  } catch {
-    return [];
-  }
-};
-
 const bannerIcon = (b: StripContent): IconSrc => {
   if (b.kind === 'maintenance') return Icons.Setting;
   if (b.tone === 'Primary') return Icons.Info;
@@ -179,22 +167,14 @@ export function ServerStatusFeature({ mx }: { mx: MatrixClient }) {
 /** The logged-in app's status strip. */
 export function ServerStatusBanner() {
   const { status, syncLost } = useAtomValue(serverStatusAtom);
-  const [dismissed, setDismissed] = useState(readDismissed);
+  const [dismissed, dismissKey] = useAtom(statusDismissedAtom);
   const banner = pickBanner(status, {
     syncLost,
     where: 'client',
     dismissed: new Set(dismissed),
   });
   if (!banner) return null;
-  const dismiss = () => {
-    const next = [...dismissed.filter((k) => k !== banner.key), banner.key].slice(-DISMISS_MAX);
-    try {
-      localStorage.setItem(DISMISS_KEY, JSON.stringify(next));
-    } catch {
-      // storage unavailable — dismissed for this session only
-    }
-    setDismissed(next);
-  };
+  const dismiss = () => dismissKey(banner.key);
   return <StatusStrip banner={banner} onDismiss={dismiss} />;
 }
 

src/app/features/settings/Settings.tsx

@@ -33,16 +33,9 @@ import { About } from './about';
 import { UseStateProvider } from '../../components/UseStateProvider';
 import { stopPropagation } from '../../utils/keyboard';
 import { LogoutDialog } from '../../components/LogoutDialog';
+import { SettingsPages } from './pages';
 
-export enum SettingsPages {
-  GeneralPage,
-  AccountPage,
-  NotificationPage,
-  DevicesPage,
-  EmojisStickersPage,
-  DeveloperToolsPage,
-  AboutPage,
-}
+export { SettingsPages };
 
 type SettingsMenuItem = {
   page: SettingsPages;

src/app/features/settings/SettingsLazy.tsx

@@ -0,0 +1,43 @@
+import React, { lazy, Suspense } from 'react';
+import { Box, Spinner, config } from 'folds';
+import type { SettingsPages } from './pages';
+
+// Settings is a large, rarely-open dialog (all its pages, pickers, the
+// denoise tester…). Load it on first open instead of in the entry chunk, and
+// warm the chunk once the app is idle so opening it rarely waits.
+const loadSettings = () => import('./Settings');
+const SettingsDialog = lazy(() => loadSettings().then((m) => ({ default: m.Settings })));
+if (typeof window !== 'undefined') {
+  const warm = () => {
+    loadSettings().catch(() => undefined);
+  };
+  if ('requestIdleCallback' in window) window.requestIdleCallback(warm, { timeout: 10_000 });
+  else setTimeout(warm, 5_000);
+}
+
+type SettingsProps = {
+  initialPage?: SettingsPages;
+  requestClose: () => void;
+};
+
+export function Settings(props: SettingsProps) {
+  return (
+    <Suspense
+      fallback={
+        // Settings opens inside a FocusTrap, which needs a tabbable node.
+        <Box
+          tabIndex={0}
+          role="status"
+          aria-label="Loading settings"
+          alignItems="Center"
+          justifyContent="Center"
+          style={{ padding: config.space.S700, outline: 'none' }}
+        >
+          <Spinner variant="Secondary" size="400" />
+        </Box>
+      }
+    >
+      <SettingsDialog {...props} />
+    </Suspense>
+  );
+}

src/app/features/settings/account/Profile.tsx

@@ -38,7 +38,11 @@ import { SettingTile } from '../../../components/setting-tile';
 import { useMatrixClient } from '../../../hooks/useMatrixClient';
 import { getAccountData, setAccountData } from '../../../utils/accountData';
 import { presenceStateFromSetting } from '../../../hooks/usePresenceUpdater';
-import { describePresenceError, setPresenceWithRetry } from '../../../utils/presenceWrite';
+import {
+  describePresenceError,
+  setPresenceWithRetry,
+  writePresence,
+} from '../../../utils/presenceWrite';
 import { useSetting } from '../../../state/hooks/settings';
 import { settingsAtom } from '../../../state/settings';
 import { UserProfile, useUserProfile } from '../../../hooks/useUserProfile';
@@ -67,6 +71,8 @@ import {
   makePresetId,
   normalizeLabel,
 } from '../../../utils/statusPresets';
+import { STATUS_EXPIRY_KEY, STATUS_MSG_KEY } from '../../../utils/statusKeys';
+import { writeStatusExpiry } from '../../../utils/statusExpiry';
 
 type ProfileProps = {
   profile: UserProfile;
@@ -365,8 +371,7 @@ function ProfileDisplayName({ profile, userId }: ProfileProps) {
   );
 }
 
-export const STATUS_EXPIRY_KEY = (id: string) => `lotus-status-expiry-${id}`;
-export const STATUS_MSG_KEY = (id: string) => `lotus-status-msg-${id}`;
+export { STATUS_EXPIRY_KEY, STATUS_MSG_KEY };
 
 const CLEAR_AFTER_OPTIONS = [
   { label: 'Never', value: '0' },
@@ -508,12 +513,16 @@ function ProfileStatus() {
       if (msg && delayMs > 0) {
         // Persist the expiry timestamp; the always-mounted StatusExpiryMonitor
         // (ClientNonUIFeatures) fires the auto-clear even when Settings is closed.
-        localStorage.setItem(STATUS_EXPIRY_KEY(userId), String(Date.now() + delayMs));
+        const expiresAt = Date.now() + delayMs;
+        localStorage.setItem(STATUS_EXPIRY_KEY(userId), String(expiresAt));
+        // [Gitea #300] …and on every other Lotus device, via account data.
+        writeStatusExpiry(mx, msg, expiresAt).catch(() => undefined);
       } else {
         localStorage.removeItem(STATUS_EXPIRY_KEY(userId));
+        writeStatusExpiry(mx, msg).catch(() => undefined);
       }
     },
-    [saveStatus, userId],
+    [saveStatus, userId, mx],
   );
 
   const handleSubmit: FormEventHandler<HTMLFormElement> = (evt) => {
@@ -553,8 +562,9 @@ function ProfileStatus() {
     setStatusMsg('');
     localStorage.removeItem(STATUS_MSG_KEY(userId));
     localStorage.removeItem(STATUS_EXPIRY_KEY(userId));
+    writeStatusExpiry(mx, '').catch(() => undefined);
     // Preserve the user's chosen presence when clearing the status message.
-    mx.setPresence({
+    writePresence(mx, {
       presence: presenceStateFromSetting(presenceStatus, hidePresence),
       status_msg: '',
     }).catch(() => undefined);

src/app/features/settings/account/ProfileDecoration.tsx

@@ -1,7 +1,12 @@
 import React, { ChangeEvent, useCallback, useEffect, useMemo, useRef, useState } from 'react';
-import { Box, Button, Chip, Icon, Icons, Input, Text, Spinner, color } from 'folds';
+import { Avatar, Box, Button, Chip, Icon, Icons, Input, Text, Spinner, color } from 'folds';
 import { Method } from 'matrix-js-sdk';
 import { useMatrixClient } from '../../../hooks/useMatrixClient';
+import { useMediaAuthentication } from '../../../hooks/useMediaAuthentication';
+import { useUserProfile } from '../../../hooks/useUserProfile';
+import { getMxIdLocalPart, mxcUrlToHttp } from '../../../utils/matrix';
+import { nameInitials } from '../../../utils/common';
+import { UserAvatar } from '../../../components/user-avatar';
 import { AsyncStatus, useAsyncCallback } from '../../../hooks/useAsyncCallback';
 import { SettingTile } from '../../../components/setting-tile';
 import {
@@ -14,6 +19,8 @@ import { invalidateDecorationCache } from '../../../hooks/useAvatarDecoration';
 
 const PROFILE_FIELD = 'io.lotus.avatar_decoration';
 const CELL_SIZE = 72;
+// Matches AvatarDecoration's default inset, so the preview looks like the timeline.
+const PREVIEW_INSET = 8;
 
 function DecorationPreviewCell({
   slug,
@@ -86,6 +93,12 @@ function categoryOf(slug: string | null): string {
 export function ProfileDecoration() {
   const mx = useMatrixClient();
   const userId = mx.getUserId()!;
+  const useAuthentication = useMediaAuthentication();
+  const profile = useUserProfile(userId);
+  const myName = profile.displayName ?? getMxIdLocalPart(userId) ?? userId;
+  const myAvatarUrl = profile.avatarUrl
+    ? (mxcUrlToHttp(mx, profile.avatarUrl, useAuthentication, 96, 96, 'crop') ?? undefined)
+    : undefined;
 
   const [current, setCurrent] = useState<string | null>(null);
   const [selected, setSelected] = useState<string | null>(null);
@@ -198,6 +211,10 @@ export function ProfileDecoration() {
       <Box direction="Column" gap="300">
         {/* Current selection preview */}
         <Box alignItems="Center" gap="300">
+          {/* [Gitea #272] Your own avatar with the decoration overlaid, as the
+              timeline draws it (AvatarDecoration: the image is the avatar plus
+              an 8px margin on every side). With no decoration the circle gets
+              a visible dashed outline instead of vanishing into the card. */}
           <div
             style={{
               position: 'relative',
@@ -205,10 +222,29 @@ export function ProfileDecoration() {
               height: CELL_SIZE,
               flexShrink: 0,
               borderRadius: '50%',
-              background: color.SurfaceVariant.Container,
-              overflow: 'hidden',
+              boxSizing: 'border-box',
+              border: selected
+                ? 'none'
+                : `2px dashed color-mix(in srgb, ${color.SurfaceVariant.OnContainer} 45%, transparent)`,
             }}
           >
+            <Avatar
+              size="500"
+              radii="Pill"
+              style={{
+                position: 'absolute',
+                inset: PREVIEW_INSET,
+                width: CELL_SIZE - PREVIEW_INSET * 2,
+                height: CELL_SIZE - PREVIEW_INSET * 2,
+              }}
+            >
+              <UserAvatar
+                userId={userId}
+                src={myAvatarUrl}
+                alt=""
+                renderFallback={() => <Text size="H5">{nameInitials(myName)}</Text>}
+              />
+            </Avatar>
             {selected && (
               <img
                 src={decorationUrl(selected)}
@@ -220,6 +256,7 @@ export function ProfileDecoration() {
                   height: '100%',
                   objectFit: 'contain',
                   pointerEvents: 'none',
+                  zIndex: 1,
                 }}
               />
             )}

src/app/features/settings/general/General.tsx

@@ -108,9 +108,11 @@ import {
   TRANSLATE_TARGET_LANGUAGES,
   normalizeLang,
   isSupportedTargetLang,
+  translationUnavailableText,
 } from '../../../utils/translation/langUtils';
 import { chromeTranslationEngine } from '../../../utils/translation/chromeEngine';
-import { SequenceCardStyle } from '../styles.css';
+import { SequenceCardStyle, SettingTileGroup } from '../styles.css';
+import { ScreenSize, useScreenSize } from '../../../hooks/useScreenSize';
 import { UpdateProgress, useTauriUpdater } from '../../../hooks/useTauriUpdater';
 import {
   describeUpdateError,
@@ -596,10 +598,6 @@ function Appearance() {
         />
       </SequenceCard>
 
-      <DesktopChromeSetting />
-      <AutostartSetting />
-      <KeychainMirrorSetting />
-
       <SequenceCard className={SequenceCardStyle} variant="SurfaceVariant" direction="Column">
         <SettingTile
           title="Twitter Emoji"
@@ -1601,6 +1599,7 @@ function Privacy() {
 // [Gitea #104] Sync toggle + the two manual actions. The toggle is itself
 // device-local (never synced) so switching it off here sticks.
 function SettingsSyncSection() {
+  const isMobile = useScreenSize() === ScreenSize.Mobile;
   const [settingsSync, setSettingsSync] = useSetting(settingsAtom, 'settingsSync');
   const { pushNow, clearRemote } = useSettingsSyncActions();
   const [busy, setBusy] = useState<'push' | 'clear' | null>(null);
@@ -1624,6 +1623,34 @@ function SettingsSyncSection() {
     }
   };
 
+  const syncButtons = (
+    <Box gap="200">
+      <Button
+        size="300"
+        variant="Secondary"
+        fill="Soft"
+        outlined
+        radii="300"
+        disabled={busy !== null}
+        before={busy === 'push' ? <Spinner size="100" variant="Secondary" /> : undefined}
+        onClick={() => run('push')}
+      >
+        <Text size="B300">Push now</Text>
+      </Button>
+      <Button
+        size="300"
+        variant="Critical"
+        fill="None"
+        radii="300"
+        disabled={busy !== null}
+        before={busy === 'clear' ? <Spinner size="100" variant="Critical" /> : undefined}
+        onClick={() => run('clear')}
+      >
+        <Text size="B300">Clear synced copy</Text>
+      </Button>
+    </Box>
+  );
+
   return (
     <Box direction="Column" gap="100">
       <Text size="L400">Sync</Text>
@@ -1639,34 +1666,12 @@ function SettingsSyncSection() {
           <SettingTile
             title="Use This Device's Settings Everywhere"
             description="Push this device's current preferences so every other device adopts them, even ones that changed something more recently."
-            after={
-              <Box gap="200">
-                <Button
-                  size="300"
-                  variant="Secondary"
-                  fill="Soft"
-                  outlined
-                  radii="300"
-                  disabled={busy !== null}
-                  before={busy === 'push' ? <Spinner size="100" variant="Secondary" /> : undefined}
-                  onClick={() => run('push')}
-                >
-                  <Text size="B300">Push now</Text>
-                </Button>
-                <Button
-                  size="300"
-                  variant="Critical"
-                  fill="None"
-                  radii="300"
-                  disabled={busy !== null}
-                  before={busy === 'clear' ? <Spinner size="100" variant="Critical" /> : undefined}
-                  onClick={() => run('clear')}
-                >
-                  <Text size="B300">Clear synced copy</Text>
-                </Button>
-              </Box>
-            }
-          />
+            // [Gitea #273] On phones the two buttons squeezed the text into a
+            // narrow column; put them under the description there.
+            after={isMobile ? undefined : syncButtons}
+          >
+            {isMobile && <Box style={{ paddingTop: config.space.S100 }}>{syncButtons}</Box>}
+          </SettingTile>
           {note && (
             <Text
               size="T200"
@@ -1803,7 +1808,8 @@ function Calls() {
           title="Noise Suppression"
           description={
             <Box direction="Column" gap="200">
-              <Text>
+              {/* [Gitea #271] T200 like every other setting description. */}
+              <Text size="T200">
                 Filter background noise from your mic during calls. Browser-native uses the built-in
                 WebRTC suppressor (Google NSNet2). ML runs a dedicated model for stronger removal.
               </Text>
@@ -2036,7 +2042,7 @@ function Calls() {
         )}
       </SequenceCard>
       <SequenceCard
-        className={SequenceCardStyle}
+        className={`${SequenceCardStyle} ${SettingTileGroup}`}
         variant="SurfaceVariant"
         direction="Column"
         gap="400"
@@ -2133,7 +2139,7 @@ function Calls() {
         )}
       </SequenceCard>
       <SequenceCard
-        className={SequenceCardStyle}
+        className={`${SequenceCardStyle} ${SettingTileGroup}`}
         variant="SurfaceVariant"
         direction="Column"
         gap="400"
@@ -2267,7 +2273,11 @@ function Calls() {
         />
       </SequenceCard>
 
-      <SequenceCard className={SequenceCardStyle} variant="SurfaceVariant" direction="Column">
+      <SequenceCard
+        className={`${SequenceCardStyle} ${SettingTileGroup}`}
+        variant="SurfaceVariant"
+        direction="Column"
+      >
         <SettingTile
           title="Soundboard"
           description="Show a soundboard button in the call bar. Upload short audio clips (like custom emojis) to play them into the call. Clips sync across your devices."
@@ -2754,13 +2764,17 @@ function Messages() {
           }
         />
       </SequenceCard>
-      <SequenceCard className={SequenceCardStyle} variant="SurfaceVariant" direction="Column">
+      <SequenceCard
+        className={`${SequenceCardStyle} ${SettingTileGroup}`}
+        variant="SurfaceVariant"
+        direction="Column"
+      >
         <SettingTile
           title="Translate Messages Into"
           description={
             translationSupported
               ? 'Translate messages written in other languages into this one. Runs entirely on your device — message text never leaves your computer or touches a cloud service.'
-              : 'On-device translation isn’t available in this browser. Use a Chromium desktop browser (Chrome/Edge 138+) or the Lotus desktop app.'
+              : translationUnavailableText(isTauriEnv())
           }
           after={
             <SettingsSelect
@@ -2856,6 +2870,23 @@ function PackageUpdate({ help }: { help: NonNullable<ReturnType<typeof packageUp
   );
 }
 
+/**
+ * [Gitea #290] Desktop-only settings in their own section (they used to sit
+ * inside Appearance, between Monochrome Mode and Twitter Emoji). Renders
+ * nothing outside the desktop app.
+ */
+function DesktopSettings() {
+  if (!isTauriEnv()) return null;
+  return (
+    <Box direction="Column" gap="100">
+      <Text size="L400">Desktop</Text>
+      <AutostartSetting />
+      <KeychainMirrorSetting />
+      <DesktopChromeSetting />
+    </Box>
+  );
+}
+
 function AppUpdates() {
   const { isTauri, status, check, install, installKind } = useTauriUpdater();
   if (!isTauri) return null;
@@ -2964,6 +2995,7 @@ export function General({ requestClose }: GeneralProps) {
               <StorageUsage />
               <SettingsSyncSection />
               <Calls />
+              <DesktopSettings />
               <AppUpdates />
             </Box>
           </PageContent>

src/app/features/settings/index.ts

@@ -1 +1,2 @@
-export * from './Settings';
+export { SettingsPages } from './pages';
+export { Settings } from './SettingsLazy';

src/app/features/settings/pages.ts

@@ -0,0 +1,11 @@
+/** Settings dialog pages. Kept apart from Settings.tsx so callers can name a
+ * page without pulling the dialog into the entry chunk. */
+export enum SettingsPages {
+  GeneralPage,
+  AccountPage,
+  NotificationPage,
+  DevicesPage,
+  EmojisStickersPage,
+  DeveloperToolsPage,
+  AboutPage,
+}

src/app/features/settings/styles.css.ts

@@ -1,6 +1,18 @@
-import { style } from '@vanilla-extract/css';
-import { config } from 'folds';
+import { globalStyle, style } from '@vanilla-extract/css';
+import { color, config } from 'folds';
 
 export const SequenceCardStyle = style({
   padding: config.space.S300,
 });
+
+/**
+ * [Gitea #273] Several settings share one card; without a separator the next
+ * tile's title read like part of the previous description. A thin line goes
+ * between tiles only (not between a tile and its own slider or note).
+ */
+export const SettingTileGroup = style({});
+// globalStyle: vanilla-extract's `selectors` may only target the element itself.
+globalStyle(`${SettingTileGroup} > [data-setting-tile] ~ [data-setting-tile]`, {
+  borderTop: `1px solid color-mix(in srgb, ${color.SurfaceVariant.OnContainer} 14%, transparent)`,
+  paddingTop: config.space.S400,
+});

src/app/features/shortcuts/KeyboardShortcutsDialog.tsx

@@ -25,6 +25,9 @@ import { settingsAtom } from '../../state/settings';
 import { isMacOS } from '../../utils/user-agent';
 import { KeySymbol } from '../../utils/key-symbol';
 import * as css from './KeyboardShortcutsDialog.css';
+import { BLOCK_HOTKEYS, INLINE_HOTKEYS } from '../../components/editor/keyboard';
+import { MarkType } from '../../components/editor/types';
+import { BLOCK_LABELS, MARK_LABELS, hotkeyKeys, keyCodeLabel } from './shortcutLabels';
 
 /** Global open-state for the keyboard shortcuts help dialog. */
 export const keyboardShortcutsDialogAtom = atom<boolean>(false);
@@ -98,6 +101,9 @@ export function KeyboardShortcutsDialog() {
   const { open, closeDialog } = useKeyboardShortcutsDialog();
   const modalStyle = useModalStyle(480);
   const [enterForNewline] = useSetting(settingsAtom, 'enterForNewline');
+  const [pttMode] = useSetting(settingsAtom, 'pttMode');
+  const [pttKey] = useSetting(settingsAtom, 'pttKey');
+  const [deafenKey] = useSetting(settingsAtom, 'deafenKey');
 
   const modKey = isMacOS() ? KeySymbol.Command : 'Ctrl';
 
@@ -109,6 +115,8 @@ export function KeyboardShortcutsDialog() {
       rows: [
         { description: 'Show keyboard shortcuts', keys: ['?'] },
         { description: 'Close open panel, otherwise mark room as read', keys: [KeySymbol.Escape] },
+        // [Gitea #334] the quick switcher / search was missing
+        { description: 'Quick switcher: jump to a room or person', keys: [modKey, 'K'] },
       ],
     },
     {
@@ -124,6 +132,26 @@ export function KeyboardShortcutsDialog() {
           keys: enterForNewline ? ['Enter'] : [KeySymbol.Shift, 'Enter'],
         },
         { description: 'Send message (always)', keys: [modKey, 'Enter'] },
+        { description: 'Edit your last message (empty composer)', keys: ['↑'] },
+      ],
+    },
+    {
+      // [Gitea #334] generated from the editor's own bindings so they can't drift
+      title: 'Composer formatting',
+      rows: [
+        ...Object.entries(INLINE_HOTKEYS).map(([hotkey, mark]) => ({
+          description:
+            mark === MarkType.StrikeThrough
+              ? `${MARK_LABELS[mark]} (not the browser's Save)`
+              : MARK_LABELS[mark],
+          keys: hotkeyKeys(hotkey, modKey),
+        })),
+        { description: 'Heading 1 / 2 / 3', keys: [modKey, '1 / 2 / 3'] },
+        ...Object.entries(BLOCK_HOTKEYS).map(([hotkey, block]) => ({
+          description: BLOCK_LABELS[block] ?? block,
+          keys: hotkeyKeys(hotkey, modKey),
+        })),
+        { description: 'Clear formatting', keys: [modKey, 'E'] },
       ],
     },
     {
@@ -132,6 +160,19 @@ export function KeyboardShortcutsDialog() {
         { description: 'Reveal message actions (react, reply, more)', keys: ['Hover / focus'] },
       ],
     },
+    {
+      // [Gitea #334] the user's own bindings (Settings → Calls)
+      title: 'Calls',
+      rows: [
+        {
+          description: pttMode
+            ? 'Push to talk (hold)'
+            : 'Push to talk (hold; turn on in Settings → Calls)',
+          keys: [keyCodeLabel(pttKey)],
+        },
+        { description: 'Deafen / undeafen', keys: [keyCodeLabel(deafenKey)] },
+      ],
+    },
   ];
 
   return (

src/app/features/shortcuts/shortcutLabels.test.ts

@@ -0,0 +1,16 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { hotkeyKeys, keyCodeLabel } from './shortcutLabels';
+
+test('hotkeyKeys (#334)', () => {
+  assert.deepEqual(hotkeyKeys('mod+b', 'Ctrl'), ['Ctrl', 'B']);
+  assert.deepEqual(hotkeyKeys("mod+'", '⌘'), ['⌘', "'"]);
+  assert.deepEqual(hotkeyKeys('mod+[', 'Ctrl'), ['Ctrl', '[']);
+});
+
+test('keyCodeLabel (#334)', () => {
+  assert.equal(keyCodeLabel('KeyM'), 'M');
+  assert.equal(keyCodeLabel('Digit1'), '1');
+  assert.equal(keyCodeLabel('Space'), 'Space');
+  assert.equal(keyCodeLabel(''), 'Not set');
+});

src/app/features/shortcuts/shortcutLabels.ts

@@ -0,0 +1,29 @@
+import { BlockType, MarkType } from '../../components/editor/types';
+
+/** Pure: an is-hotkey string ('mod+b', "mod+'") as keycap labels. */
+export const hotkeyKeys = (hotkey: string, modKey: string): string[] =>
+  hotkey.split('+').map((k) => (k === 'mod' ? modKey : k.length === 1 ? k.toUpperCase() : k));
+
+/** Pure: a KeyboardEvent.code ('KeyM', 'Digit1', 'Space') as a keycap label. */
+export const keyCodeLabel = (code: string | undefined): string => {
+  if (!code) return 'Not set';
+  if (/^Key[A-Z]$/.test(code)) return code.slice(3);
+  if (/^Digit\d$/.test(code)) return code.slice(5);
+  return code;
+};
+
+export const MARK_LABELS: Record<MarkType, string> = {
+  [MarkType.Bold]: 'Bold',
+  [MarkType.Italic]: 'Italic',
+  [MarkType.Underline]: 'Underline',
+  [MarkType.StrikeThrough]: 'Strikethrough',
+  [MarkType.Code]: 'Inline code',
+  [MarkType.Spoiler]: 'Spoiler',
+};
+
+export const BLOCK_LABELS: Partial<Record<BlockType, string>> = {
+  [BlockType.OrderedList]: 'Numbered list',
+  [BlockType.UnorderedList]: 'Bulleted list',
+  [BlockType.BlockQuote]: 'Quote',
+  [BlockType.CodeBlock]: 'Code block',
+};

src/app/hooks/useCallError.ts

@@ -0,0 +1,41 @@
+import { useCallback, useEffect, useRef, useState } from 'react';
+import { SyncState } from 'matrix-js-sdk';
+import { CALL_ERROR_CHANGED, CallControl } from '../plugins/call/CallControl';
+import { CallErrorState } from '../plugins/call/callError';
+import { useMatrixClient } from './useMatrixClient';
+import { useSyncState } from './useSyncState';
+
+/** [Gitea #318] The fork's current call error (null while the call is fine). */
+export function useCallError(control: CallControl): CallErrorState {
+  const [err, setErr] = useState(control.callError);
+  useEffect(() => {
+    const on = () => setErr(control.callError);
+    on();
+    control.on(CALL_ERROR_CHANGED, on);
+    return () => {
+      control.off(CALL_ERROR_CHANGED, on);
+    };
+  }, [control]);
+  return err;
+}
+
+/**
+ * [Gitea #318] After a homeserver stall the call drops with "Connection
+ * lost". Once sync is back, reconnect automatically (once per drop).
+ */
+export function useReconnectWhenSynced(control: CallControl): void {
+  const mx = useMatrixClient();
+  const err = useCallError(control);
+  const tried = useRef<CallErrorState>(null);
+  useSyncState(
+    mx,
+    useCallback(
+      (state: SyncState | null) => {
+        if (state !== SyncState.Syncing || !err?.recoverable || tried.current === err) return;
+        tried.current = err;
+        control.reconnect();
+      },
+      [err, control],
+    ),
+  );
+}

src/app/hooks/useDenoiseNotices.ts

@@ -0,0 +1,38 @@
+import { useEffect, useRef } from 'react';
+import { useSetAtom } from 'jotai';
+import { Icons } from 'folds';
+import { CallEmbed } from '../plugins/call';
+import { toastQueueAtom } from '../state/toast';
+import { useSetting } from '../state/hooks/settings';
+import { settingsAtom } from '../state/settings';
+import { denoiseNotice, DenoiseStateReport } from '../utils/denoiseNotice';
+
+/**
+ * [Gitea #260] Tell the user when ML noise suppression didn't attach (raw mic)
+ * or fell back to another model. The fork's `io.lotus.denoise_state` used to
+ * go unanswered ("unsupported action"), so failures were silent.
+ */
+export function useDenoiseNotices(embed: CallEmbed): void {
+  const setToast = useSetAtom(toastQueueAtom);
+  const [mode] = useSetting(settingsAtom, 'callNoiseSuppression');
+  const [model] = useSetting(settingsAtom, 'callDenoiseModel');
+  const latest = useRef({ mode, model });
+  latest.current = { mode, model };
+  useEffect(
+    () =>
+      embed.listenAction<{ data?: DenoiseStateReport }>('io.lotus.denoise_state', (evt) => {
+        if (latest.current.mode !== 'ml') return;
+        const body = denoiseNotice(latest.current.model, evt.detail?.data);
+        if (!body) return;
+        setToast({
+          id: `denoise-state-${Date.now()}`,
+          iconSrc: Icons.Mic,
+          displayName: 'Noise suppression',
+          body,
+          roomName: embed.room.name ?? 'Voice call',
+          roomId: embed.roomId,
+        });
+      }),
+    [embed, setToast],
+  );
+}

src/app/hooks/useMessageTranslation.ts

@@ -12,7 +12,8 @@ import {
   markAutoTranslateTried,
 } from '../state/translation';
 import { chromeTranslationEngine as engine } from '../utils/translation/chromeEngine';
-import { sameLanguage } from '../utils/translation/langUtils';
+import { sameLanguage, translateSkipMessage } from '../utils/translation/langUtils';
+import { toastQueueAtom } from '../state/toast';
 
 export type MsgTranslationStatus =
   | 'idle' // not translating (original shown)
@@ -52,6 +53,7 @@ export const useMessageTranslation = (eventId: string, text: string): MsgTransla
   // Write-only: reading the whole cache array here (via useAtom) would
   // resubscribe this message to every other message's writes. [Gitea #39]
   const setCache = useSetAtom(translationCacheAtom);
+  const setToast = useSetAtom(toastQueueAtom);
 
   // The key includes a fingerprint of `text`, so an edit (same event id, new
   // body) misses the old entry and re-translates instead of showing stale
@@ -124,6 +126,16 @@ export const useMessageTranslation = (eventId: string, text: string): MsgTransla
         if (!from || sameLanguage(from, targetLang)) {
           setStatus('skipped');
           setActive(false);
+          // [Gitea #287] Say why nothing happened instead of silently undoing
+          // the click (no chip shows once translation is switched back off).
+          setToast({
+            id: `translate-skipped-${eventId}-${Date.now()}`,
+            displayName: 'Translate',
+            body: translateSkipMessage(from, targetLang),
+            roomName: '',
+            roomId: '',
+            onClick: () => undefined,
+          });
           return;
         }
         setFromLang(from);
@@ -154,7 +166,7 @@ export const useMessageTranslation = (eventId: string, text: string): MsgTransla
       // Invalidate this run's writes if inputs change / unmount.
       runIdRef.current += 1;
     };
-  }, [active, cached, supported, text, targetLang, key, setActive, setCache]);
+  }, [active, cached, supported, text, targetLang, key, setActive, setCache, setToast, eventId]);
 
   // When switched off, drop back to idle (keep the cached translation around so
   // toggling back on is instant).

src/app/hooks/usePresenceUpdater.ts

@@ -1,20 +1,27 @@
 import { useEffect, useRef } from 'react';
 import { SetPresence } from 'matrix-js-sdk';
-import { PresenceDeduper, PresenceWrite } from '../utils/presenceWrite';
+import { PresenceDeduper, PresenceWrite, writePresence } from '../utils/presenceWrite';
 import { useMatrixClient } from './useMatrixClient';
 import { getLastLocalStatusWrite, pickHeartbeatStatus } from '../utils/ownStatusSync';
 import { useSetting } from '../state/hooks/settings';
 import { settingsAtom } from '../state/settings';
+import {
+  BUSY_PRESENCE,
+  BUSY_PRESENCE_FEATURE,
+  isBusyPresenceSupported,
+  setBusyPresenceSupported,
+} from '../utils/busyPresence';
 
 const IDLE_TIMEOUT_MS = 10 * 60 * 1000;
 const ACTIVITY_THROTTLE_MS = 1000;
 
 export type PresenceSetting = 'auto' | 'online' | 'idle' | 'dnd' | 'invisible';
-export type PresenceState = 'online' | 'unavailable' | 'offline';
+export type PresenceState = 'online' | 'unavailable' | 'offline' | typeof BUSY_PRESENCE;
 
 /**
  * Single source of truth for mapping the user's presence preference to the
- * Matrix presence value: auto/online → 'online', idle/dnd → 'unavailable',
+ * Matrix presence value: auto/online → 'online', idle → 'unavailable', dnd →
+ * MSC3026 busy (or 'unavailable' where the server lacks it),
  * invisible (or the hidePresence override) → 'offline'. Shared with the Profile
  * status writer so setting/clearing a status message never overrides the user's
  * chosen presence (e.g. outing an Invisible user as online).
@@ -24,7 +31,10 @@ export function presenceStateFromSetting(
   hidePresence: boolean,
 ): PresenceState {
   if (hidePresence || presenceStatus === 'invisible') return 'offline';
-  if (presenceStatus === 'idle' || presenceStatus === 'dnd') return 'unavailable';
+  // [Gitea #283] DND is MSC3026 busy where the server supports it, so status
+  // writes (save / clear / auto-clear) don't downgrade it to "unavailable".
+  if (presenceStatus === 'dnd') return isBusyPresenceSupported() ? BUSY_PRESENCE : 'unavailable';
+  if (presenceStatus === 'idle') return 'unavailable';
   return 'online';
 }
 
@@ -62,8 +72,7 @@ export function usePresenceUpdater() {
     // by a heartbeat that changed nothing.
     const send = (write: PresenceWrite, label: string) => {
       if (!deduper.shouldSend(write)) return Promise.resolve();
-      return mx
-        .setPresence(write)
+      return writePresence(mx, write)
         .then(() => deduper.sent(write))
         .catch((err) => warnPresenceFailure(label, err));
     };
@@ -134,7 +143,22 @@ export function usePresenceUpdater() {
       return undefined;
     }
     if (presenceStatus === 'dnd') {
-      setUnavailable('dnd');
+      // [Gitea #283] Real "busy" presence where supported: the status text
+      // stays yours. /sync reporting "online" doesn't override busy on
+      // Synapse, so the sync loop can stay online. Older servers keep the
+      // legacy unavailable + "dnd" text encoding.
+      mx.doesServerSupportUnstableFeature(BUSY_PRESENCE_FEATURE)
+        .catch(() => false)
+        .then(async (busy) => {
+          setBusyPresenceSupported(busy);
+          if (!busy) {
+            setUnavailable('dnd');
+            return;
+          }
+          syncPresence(SetPresence.Online);
+          const status = await resolveStatus();
+          send({ presence: BUSY_PRESENCE, ...(status ? { status_msg: status } : {}) }, 'busy');
+        });
       return undefined;
     }
 

src/app/hooks/useScreenshareNotices.test.ts

@@ -0,0 +1,10 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { shouldShowScreenshareNotice } from './useScreenshareNotices';
+
+test('shouldShowScreenshareNotice: no "window was closed" when an admin turned sharing off (#297)', () => {
+  assert.equal(shouldShowScreenshareNotice('ended', false), false);
+  assert.equal(shouldShowScreenshareNotice('ended', true), true);
+  assert.equal(shouldShowScreenshareNotice('no-frames', false), true);
+  assert.equal(shouldShowScreenshareNotice('alone', true), true);
+});

src/app/hooks/useScreenshareNotices.ts

@@ -1,8 +1,9 @@
-import { useEffect } from 'react';
+import { useEffect, useRef } from 'react';
 import { useSetAtom } from 'jotai';
 import { Icons } from 'folds';
 import { CallEmbed } from '../plugins/call';
 import { toastQueueAtom } from '../state/toast';
+import { useRoomCallPolicy } from './useRoomCallPolicy';
 
 export type ScreenshareNoticeKind = 'ended' | 'no-frames' | 'alone';
 
@@ -19,18 +20,32 @@ export const describeScreenshareNotice = (kind: ScreenshareNoticeKind): string |
   }
 };
 
+/** Pure: a policy-forced stop is explained by its own toast (#297). */
+export const shouldShowScreenshareNotice = (
+  kind: ScreenshareNoticeKind,
+  allowScreenshare: boolean,
+): boolean => !(kind === 'ended' && !allowScreenshare);
+
 /**
  * [Gitea EC#39] Toast the fork's io.lotus.screenshare_notice: shared window
  * closed, no frames for a while, or a long share with nobody watching.
  */
 export function useScreenshareNotices(embed: CallEmbed): void {
   const setToast = useSetAtom(toastQueueAtom);
+  // [Gitea #297] When a room admin turns screen sharing off, the share ends
+  // and the fork reports `ended` ("the shared window was closed"), which is
+  // wrong; useCallPolicyRevokedToast already says what happened.
+  const { allowScreenshare } = useRoomCallPolicy(embed.room);
+  const allowRef = useRef(allowScreenshare);
+  allowRef.current = allowScreenshare;
   useEffect(
     () =>
       embed.listenAction<{ data?: { kind?: ScreenshareNoticeKind } }>(
         'io.lotus.screenshare_notice',
         (evt) => {
-          const body = describeScreenshareNotice(evt.detail?.data?.kind as ScreenshareNoticeKind);
+          const kind = evt.detail?.data?.kind as ScreenshareNoticeKind;
+          if (!shouldShowScreenshareNotice(kind, allowRef.current)) return;
+          const body = describeScreenshareNotice(kind);
           if (!body) return;
           setToast({
             id: `screenshare-${evt.detail?.data?.kind}-${Date.now()}`,

src/app/hooks/useStrippedFilePicker.ts

@@ -0,0 +1,36 @@
+import { useCallback } from 'react';
+import { useFilePicker } from './useFilePicker';
+import { useSetting } from '../state/hooks/settings';
+import { settingsAtom } from '../state/settings';
+import { stripImageMetadata } from '../utils/stripImageMetadata';
+
+/**
+ * [Gitea #332] `useFilePicker` for images that get published (emoji / sticker
+ * packs, pack avatars, power-level badges): applies "Remove Photo Metadata"
+ * like message attachments and avatars, so a phone photo's GPS location and
+ * timestamp don't go to every member of the room or space.
+ */
+export const useStrippedFilePicker = <M extends boolean | undefined = undefined>(
+  onSelect: (file: M extends true ? File[] : File) => void,
+  multiple?: M,
+) => {
+  const [strip] = useSetting(settingsAtom, 'stripImageMetadata');
+  const handle = useCallback(
+    (picked: File | File[]) => {
+      if (!strip) {
+        onSelect(picked as M extends true ? File[] : File);
+        return;
+      }
+      const clean = (f: File) => stripImageMetadata(f).then((r) => r.file);
+      if (Array.isArray(picked)) {
+        Promise.all(picked.map(clean)).then((files) =>
+          onSelect(files as M extends true ? File[] : File),
+        );
+      } else {
+        clean(picked).then((file) => onSelect(file as M extends true ? File[] : File));
+      }
+    },
+    [strip, onSelect],
+  );
+  return useFilePicker(handle as (file: M extends true ? File[] : File) => void, multiple);
+};

src/app/hooks/useUserPresence.ts

@@ -6,6 +6,8 @@ export enum Presence {
   Online = 'online',
   Unavailable = 'unavailable',
   Offline = 'offline',
+  // [Gitea #283] MSC3026 busy: Lotus's Do Not Disturb.
+  Busy = 'org.matrix.msc3026.busy',
 }
 
 export type UserPresence = {
@@ -129,6 +131,7 @@ export const usePresenceLabel = (): Record<Presence, string> =>
       [Presence.Online]: 'Online',
       [Presence.Unavailable]: 'Idle',
       [Presence.Offline]: 'Offline',
+      [Presence.Busy]: 'Do Not Disturb',
     }),
     [],
   );

src/app/pages/client/ClientNonUIFeatures.tsx

@@ -59,11 +59,11 @@ import { useMediaAuthentication } from '../../hooks/useMediaAuthentication';
 import { presenceStateFromSetting, usePresenceUpdater } from '../../hooks/usePresenceUpdater';
 import {
   MAX_MUTE_TIMEOUT_MS,
-  MuteTimerEntry,
   loadMuteTimers,
+  migrateLocalMuteTimers,
   unmuteRoom,
 } from '../../features/room-nav/muteTimers';
-import { STATUS_EXPIRY_KEY, STATUS_MSG_KEY } from '../../features/settings/account/Profile';
+import { STATUS_EXPIRY_KEY, STATUS_MSG_KEY } from '../../utils/statusKeys';
 import { noteLocalStatusWrite } from '../../utils/ownStatusSync';
 import { setPresenceWithRetry } from '../../utils/presenceWrite';
 import { useDeepLinkNavigate } from '../../hooks/useDeepLinkNavigate';
@@ -92,6 +92,8 @@ import {
   shouldNotifyThreadReply,
   THREAD_NOTIFICATIONS_FALLBACK_BEHAVIOR,
 } from '../../utils/threadNotifications';
+import { readStatusExpiry, statusExpiryAction, writeStatusExpiry } from '../../utils/statusExpiry';
+import { AccountDataEvent } from '../../../types/matrix/accountData';
 
 // Grace period after the initial sync settles before invite notifications arm, so
 // the async invite-atom population lands first and isn't mistaken for new invites.
@@ -335,7 +337,9 @@ function InviteNotifications() {
 
     if (quietActive) return;
 
-    if (showNotifications && notificationPermission('granted')) {
+    // [Gitea #324] The in-app toast (focused window) needs no browser
+    // permission; only the OS notification does.
+    if (showNotifications && (document.hasFocus() || notificationPermission('granted'))) {
       notify(newCount);
     }
     if (notificationSound && inviteSoundId !== 'none') {
@@ -370,30 +374,35 @@ function PresenceUpdater() {
 function MuteTimerRestore() {
   const mx = useMatrixClient();
 
+  // [Gitea #333] Timers are in account data, so a mute set on another device
+  // is lifted here too, and changes there (a new mute, a manual unmute)
+  // reschedule. Moves any timers this browser kept locally (pre-#333) first.
   useEffect(() => {
-    const timers = loadMuteTimers();
-    if (timers.length === 0) return undefined;
-
-    const now = Date.now();
-    const pastDue: MuteTimerEntry[] = [];
-    const future: MuteTimerEntry[] = [];
-    timers.forEach((entry) => (entry.unmuteAt <= now ? pastDue : future).push(entry));
-
-    pastDue.forEach((entry) => {
-      unmuteRoom(mx, entry.roomId);
-    });
-
-    const handles = future.map((entry) =>
-      setTimeout(
-        () => {
-          unmuteRoom(mx, entry.roomId);
-        },
-        Math.min(entry.unmuteAt - now, MAX_MUTE_TIMEOUT_MS),
-      ),
-    );
+    migrateLocalMuteTimers(mx).catch(() => {});
+  }, [mx]);
 
+  useEffect(() => {
+    let handles: ReturnType<typeof setTimeout>[] = [];
+    const schedule = () => {
+      handles.forEach(clearTimeout);
+      const now = Date.now();
+      handles = loadMuteTimers(mx).map((entry) =>
+        setTimeout(
+          () => {
+            unmuteRoom(mx, entry.roomId);
+          },
+          Math.max(0, Math.min(entry.unmuteAt - now, MAX_MUTE_TIMEOUT_MS)),
+        ),
+      );
+    };
+    const onAccountData = (event: MatrixEvent) => {
+      if (event.getType() === AccountDataEvent.LotusMuteTimers) schedule();
+    };
+    schedule();
+    mx.on(ClientEvent.AccountData, onAccountData);
     return () => {
       handles.forEach(clearTimeout);
+      mx.removeListener(ClientEvent.AccountData, onAccountData);
     };
   }, [mx]);
 
@@ -428,12 +437,7 @@ function StatusExpiryMonitor() {
     // permanently and the status stayed set forever. Retry the write (honouring
     // Retry-After), and only forget the status once the server has taken it.
     let clearing = false;
-    const check = () => {
-      if (clearing) return;
-      const stored = localStorage.getItem(expiryKey);
-      if (!stored) return;
-      const ts = parseInt(stored, 10);
-      if (!ts || Date.now() < ts) return;
+    const clearStatus = () => {
       clearing = true;
       setPresenceWithRetry(mx, {
         presence: presenceStateFromSetting(presenceStatusRef.current, hidePresenceRef.current),
@@ -443,12 +447,31 @@ function StatusExpiryMonitor() {
           noteLocalStatusWrite();
           localStorage.removeItem(msgKey);
           localStorage.removeItem(expiryKey);
+          writeStatusExpiry(mx, '').catch(() => undefined);
         })
         .catch(() => undefined)
         .finally(() => {
           clearing = false;
         });
     };
+    const check = () => {
+      if (clearing) return;
+      const stored = localStorage.getItem(expiryKey);
+      const ts = stored ? parseInt(stored, 10) : 0;
+      if (ts && Date.now() >= ts) {
+        clearStatus();
+        return;
+      }
+      // [Gitea #300] An expiry set on another device (account data): clear the
+      // status if it is still that one, otherwise just forget the expiry.
+      const action = statusExpiryAction(
+        readStatusExpiry(mx),
+        mx.getUser(userId)?.presenceStatusMsg,
+        Date.now(),
+      );
+      if (action === 'clear') clearStatus();
+      else if (action === 'forget') writeStatusExpiry(mx, '').catch(() => undefined);
+    };
 
     check();
     // Poll often enough that a rate-limited retry lands promptly, but not so
@@ -572,7 +595,8 @@ function MessageNotifications() {
                 // NotificationOptions typing.
                 actions: [{ action: 'reply', title: 'Reply', type: 'text', placeholder: 'Reply…' }],
               }),
-          data: { path: roomPath, roomId, threadId: threadId || undefined },
+          // userId: [Gitea #299] the SW replies as this account only.
+          data: { path: roomPath, roomId, threadId: threadId || undefined, userId: mx.getUserId() },
         },
         () => {
           window.focus();
@@ -580,7 +604,7 @@ function MessageNotifications() {
         },
       );
     },
-    [navigate, setToast, mDirects],
+    [navigate, setToast, mDirects, mx],
   );
 
   // N105: when a service-worker-owned notification is clicked, the SW focuses
@@ -642,7 +666,11 @@ function MessageNotifications() {
 
       if (quietActive) return;
 
-      if (showNotifications && notificationPermission('granted')) {
+      // [Gitea #324] notify() shows an in-app toast while the window is focused,
+      // which needs no browser permission; only its OS-notification path does.
+      // Gating both on the permission left people who declined it (most web
+      // users) with a ping sound and nothing on screen.
+      if (showNotifications && (document.hasFocus() || notificationPermission('granted'))) {
         const avatarMxc =
           room.getAvatarFallbackMember()?.getMxcAvatarUrl() ?? room.getMxcAvatarUrl();
         notify({
@@ -1062,32 +1090,6 @@ function TauriUpdateFeature() {
   return null;
 }
 
-function LotusDenoiseFeature() {
-  const setToast = useSetAtom(toastQueueAtom);
-
-  useEffect(() => {
-    const handleMessage = (event: MessageEvent) => {
-      if (event.data?.type === 'lotus-denoise-status') {
-        const { active, error } = event.data;
-        if (!active) {
-          setToast({
-            id: `denoise-fail-${Date.now()}`,
-            displayName: 'Audio Quality',
-            body: `ML Noise Suppression failed: ${error || 'Unknown error'}. Falling back to raw mic.`,
-            roomName: 'System',
-            roomId: '',
-          });
-        }
-      }
-    };
-
-    window.addEventListener('message', handleMessage);
-    return () => window.removeEventListener('message', handleMessage);
-  }, [setToast]);
-
-  return null;
-}
-
 // Registers the global `?` shortcut (ignored while typing) and renders the
 // keyboard-shortcuts help dialog. Headless — the dialog self-gates on its atom.
 function KeyboardShortcutsFeature() {
@@ -1170,7 +1172,6 @@ export function ClientNonUIFeatures({ children }: ClientNonUIFeaturesProps) {
       <CloseBehaviorPrompt />
       <ConsentRequiredPrompt />
       <OutboxFeature />
-      <LotusDenoiseFeature />
       <DeepLinkNavigator />
       <KeyboardShortcutsFeature />
       {children}

src/app/plugins/call/CallControl.ts

@@ -3,6 +3,7 @@ import { EventEmitter } from 'events';
 import { CallControlState } from './CallControlState';
 import { ElementMediaStateDetail, ElementMediaStatePayload, ElementWidgetActions } from './types';
 import { canDelegateCapability } from './utils';
+import { CallErrorState, parseCallError } from './callError';
 
 export enum CallControlEvent {
   StateUpdate = 'state_update',
@@ -54,6 +55,29 @@ export function parseForkHotkeyReport(data: unknown): ForkHotkeyReport | null {
   };
 }
 
+export const CALL_ERROR_CHANGED = 'call_error_changed';
+
+export type AudioOutputOption = { id: string; label: string };
+export const AUDIO_OUTPUT_STATE = 'audio_output_state';
+
+/** Pure: parse the fork's `io.lotus.audio_output_state` (#310). */
+export function parseAudioOutputState(
+  data: unknown,
+): { deviceId?: string; available?: AudioOutputOption[] } | undefined {
+  if (typeof data !== 'object' || data === null) return undefined;
+  const { deviceId, available } = data as { deviceId?: unknown; available?: unknown };
+  const list = Array.isArray(available)
+    ? available.filter(
+        (o): o is AudioOutputOption =>
+          typeof o === 'object' &&
+          o !== null &&
+          typeof (o as AudioOutputOption).id === 'string' &&
+          typeof (o as AudioOutputOption).label === 'string',
+      )
+    : undefined;
+  return { deviceId: typeof deviceId === 'string' ? deviceId : undefined, available: list };
+}
+
 export class CallControl extends EventEmitter implements CallControlState {
   private state: CallControlState;
 
@@ -212,11 +236,51 @@ export class CallControl extends EventEmitter implements CallControlState {
     return this._audioOutputId;
   }
 
+  // [Gitea #318] The fork's error page ("Connection lost") is up; the host
+  // kept showing the call as joined with controls that did nothing.
+  private _callError: CallErrorState = null;
+
+  public get callError(): CallErrorState {
+    return this._callError;
+  }
+
+  /** The fork's `io.lotus.call_error` report. */
+  public onCallError(data: unknown) {
+    const next = parseCallError(data);
+    if (next === undefined) return;
+    this._callError = next;
+    this.emit(CALL_ERROR_CHANGED);
+  }
+
+  /** Press the fork's Reconnect / Try again. */
+  public reconnect(): void {
+    this.call.transport.send('io.lotus.reconnect', {}).catch(() => undefined);
+  }
+
   public setAudioOutput(deviceId: string): void {
     this._audioOutputId = deviceId;
     this.sendAudioOutput(deviceId);
   }
 
+  // [Gitea #310] deviceIds are hashed per frame/origin, so ids from the
+  // host's own enumerateDevices() mean nothing inside the call iframe. The
+  // fork reports its outputs (ids valid in the frame) and its effective
+  // selection; the call bar's menu uses those when present.
+  private _audioOutputs: AudioOutputOption[] | undefined;
+
+  public get audioOutputs(): AudioOutputOption[] | undefined {
+    return this._audioOutputs;
+  }
+
+  /** The fork's `io.lotus.audio_output_state` report. */
+  public onAudioOutputState(data: unknown) {
+    const report = parseAudioOutputState(data);
+    if (!report) return;
+    this._audioOutputs = report.available;
+    if (report.deviceId !== undefined) this._audioOutputId = report.deviceId;
+    this.emit(AUDIO_OUTPUT_STATE);
+  }
+
   private sendAudioOutput(deviceId: string): void {
     if (!this.joined) return;
     this.call.transport.send('io.lotus.set_audio_output', { deviceId }).catch(() => undefined);

src/app/plugins/call/CallEmbed.ts

@@ -218,6 +218,9 @@ export class CallEmbed {
       //  - transparent background so the room wallpaper shows through natively
       lotusCallState: 'true',
       lotusTransparent: 'true',
+      // [Gitea #293] the fork applies the theme with transparency anyway, and
+      // warned in every call that lotusTheme wasn't set
+      lotusTheme: 'true',
       // [Gitea #43] The fork hides its own footer (we draw the call bar) and
       // sets its root color-scheme from the theme, instead of us injecting CSS.
       lotusHostControls: 'true',
@@ -450,6 +453,18 @@ export class CallEmbed {
         this.control.onControlsState((evt.detail as { data?: unknown } | undefined)?.data);
       }),
     );
+    // [Gitea #318] The fork's error page ("Connection lost") is up / cleared.
+    this.disposables.push(
+      this.listenAction('io.lotus.call_error', (evt) => {
+        this.control.onCallError((evt.detail as { data?: unknown } | undefined)?.data);
+      }),
+    );
+    // [Gitea #310] The fork's own output list + selection (frame-valid ids).
+    this.disposables.push(
+      this.listenAction('io.lotus.audio_output_state', (evt) => {
+        this.control.onAudioOutputState((evt.detail as { data?: unknown } | undefined)?.data);
+      }),
+    );
     // [Gitea #43] PTT / deafen keys pressed while focus is inside the frame.
     this.disposables.push(
       this.listenAction('io.lotus.hotkey', (evt) => {

src/app/plugins/call/audioOutputState.test.ts

@@ -0,0 +1,24 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { parseAudioOutputState } from './CallControl';
+
+test('parseAudioOutputState: keeps valid options, tolerates garbage (#310)', () => {
+  assert.deepEqual(
+    parseAudioOutputState({
+      deviceId: 'f2',
+      available: [{ id: '', label: 'Default' }, { id: 'f2', label: 'Headset' }, { id: 3 }, null],
+    }),
+    {
+      deviceId: 'f2',
+      available: [
+        { id: '', label: 'Default' },
+        { id: 'f2', label: 'Headset' },
+      ],
+    },
+  );
+  assert.deepEqual(parseAudioOutputState({ deviceId: null }), {
+    deviceId: undefined,
+    available: undefined,
+  });
+  assert.equal(parseAudioOutputState('x'), undefined);
+});

src/app/plugins/call/callError.test.ts

@@ -0,0 +1,17 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { parseCallError } from './callError';
+
+test('parseCallError (#318)', () => {
+  assert.deepEqual(parseCallError({ code: 'CONNECTION_LOST_ERROR', recoverable: true }), {
+    code: 'CONNECTION_LOST_ERROR',
+    recoverable: true,
+  });
+  assert.deepEqual(parseCallError({ code: 'E2EE_NOT_SUPPORTED' }), {
+    code: 'E2EE_NOT_SUPPORTED',
+    recoverable: false,
+  });
+  assert.equal(parseCallError({ code: null }), null);
+  assert.equal(parseCallError({}), undefined);
+  assert.equal(parseCallError('x'), undefined);
+});

src/app/plugins/call/callError.ts

@@ -0,0 +1,14 @@
+/**
+ * [Gitea #318] The fork's `io.lotus.call_error`: its error page is showing
+ * (`{ code, recoverable }`) or was cleared (`{ code: null }`).
+ */
+export type CallErrorState = { code: string; recoverable: boolean } | null;
+
+/** Pure: parse a report; undefined for garbage (ignored). */
+export function parseCallError(data: unknown): CallErrorState | undefined {
+  if (typeof data !== 'object' || data === null) return undefined;
+  const { code, recoverable } = data as { code?: unknown; recoverable?: unknown };
+  if (code === null) return null;
+  if (typeof code !== 'string' || !code) return undefined;
+  return { code, recoverable: recoverable === true };
+}

src/app/state/plaintextCaches.ts

@@ -64,9 +64,10 @@ const clearMsgDrafts = (): void => {
  *   `lotus-status-expiry-*`, used to be preserved; since [Gitea #204] they are
  *   swept with the rest — the server-side presence status survives, so a
  *   re-login loses nothing)
- * - low-sensitivity UI/metadata residue (`io.lotus.mute_timers`, collapsed
- *   nav/space categories, `cinny_oidc_dynamic_clients`) is treated as
- *   preferences, not swept here
+ * - low-sensitivity UI/metadata residue (collapsed nav/space categories,
+ *   `cinny_oidc_dynamic_clients`) is treated as preferences, not swept here.
+ *   Timed mutes moved to account data in [Gitea #333]; a leftover local
+ *   `io.lotus.mute_timers` is migrated there on the next start.
  */
 /**
  * [Gitea #204] The local mirror of the user's status message (+ its expiry) is

src/app/state/serverStatus.ts

@@ -16,3 +16,35 @@ export const serverStatusAtom = atom<{
   syncLost: false,
   lostAt: null,
 });
+
+const DISMISS_KEY = 'lotus-status-banner-dismissed';
+const DISMISS_MAX = 50;
+
+const readDismissed = (): string[] => {
+  try {
+    const v = JSON.parse(localStorage.getItem(DISMISS_KEY) ?? '[]');
+    return Array.isArray(v) ? v.filter((k): k is string => typeof k === 'string') : [];
+  } catch {
+    return [];
+  }
+};
+
+const baseDismissedAtom = atom<string[]>(readDismissed());
+
+/**
+ * [Gitea #307] Status strips the user dismissed (by banner key), shared so
+ * the security nudge knows a dismissed announcement isn't on screen.
+ * Persisted to localStorage; session-only if storage is unavailable.
+ */
+export const statusDismissedAtom = atom(
+  (get) => get(baseDismissedAtom),
+  (get, set, key: string) => {
+    const next = [...get(baseDismissedAtom).filter((k) => k !== key), key].slice(-DISMISS_MAX);
+    try {
+      localStorage.setItem(DISMISS_KEY, JSON.stringify(next));
+    } catch {
+      // storage unavailable — dismissed for this session only
+    }
+    set(baseDismissedAtom, next);
+  },
+);

src/app/utils/busyPresence.test.ts

@@ -0,0 +1,11 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { BUSY_PRESENCE, isDndPresence } from './busyPresence';
+
+test('isDndPresence: busy, or the legacy unavailable + "dnd" text (#283)', () => {
+  assert.equal(isDndPresence(BUSY_PRESENCE, '🎮 Gaming'), true);
+  assert.equal(isDndPresence(BUSY_PRESENCE, undefined), true);
+  assert.equal(isDndPresence('unavailable', 'dnd'), true);
+  assert.equal(isDndPresence('unavailable', 'lunch'), false);
+  assert.equal(isDndPresence('online', 'dnd'), false);
+});

src/app/utils/busyPresence.ts

@@ -0,0 +1,21 @@
+/**
+ * [Gitea #283] Do Not Disturb as a real presence state: MSC3026 "busy"
+ * (Synapse `experimental_features.msc3026_enabled`). Before, DND was sent as
+ * presence `unavailable` with the literal status text "dnd", which replaced
+ * your status and showed as "dnd" in other clients.
+ */
+export const BUSY_PRESENCE = 'org.matrix.msc3026.busy';
+export const BUSY_PRESENCE_FEATURE = 'org.matrix.msc3026.busy_presence';
+
+let busySupported = false;
+
+/** Recorded by the presence updater from the server's unstable_features. */
+export const setBusyPresenceSupported = (supported: boolean): void => {
+  busySupported = supported;
+};
+
+export const isBusyPresenceSupported = (): boolean => busySupported;
+
+/** Pure: whether a presence means Do Not Disturb (busy, or the legacy "dnd" text). */
+export const isDndPresence = (presence: string | undefined, status: string | undefined): boolean =>
+  presence === BUSY_PRESENCE || (presence === 'unavailable' && status === 'dnd');

src/app/utils/denoiseNotice.test.ts

@@ -0,0 +1,17 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { denoiseNotice } from './denoiseNotice';
+
+test('denoiseNotice: says when ML is off or fell back (#260)', () => {
+  assert.equal(denoiseNotice('deepfilternet', { active: true, model: 'deepfilternet' }), undefined);
+  assert.match(
+    denoiseNotice('deepfilternet', { active: true, model: 'rnnoise' }) ?? '',
+    /^DeepFilterNet 3 couldn't start, so noise suppression is using RNNoise instead\.$/,
+  );
+  assert.match(
+    denoiseNotice('rnnoise', { active: false, error: 'boom' }) ?? '',
+    /unfiltered audio/,
+  );
+  assert.equal(denoiseNotice('rnnoise', undefined), undefined);
+  assert.equal(denoiseNotice('rnnoise', { model: 'x' }), undefined);
+});

src/app/utils/denoiseNotice.ts

@@ -0,0 +1,29 @@
+/**
+ * [Gitea #260] The fork reports what noise suppression actually runs as
+ * `io.lotus.denoise_state { active, model, error? }`. Pure: the toast text for
+ * a report, or undefined when what runs is what the user picked.
+ */
+export type DenoiseStateReport = { active?: unknown; model?: unknown; error?: unknown };
+
+const MODEL_NAMES: Record<string, string> = {
+  rnnoise: 'RNNoise',
+  speex: 'Speex',
+  dtln: 'DTLN',
+  deepfilternet: 'DeepFilterNet 3',
+};
+const modelName = (m: unknown): string =>
+  typeof m === 'string' ? (MODEL_NAMES[m] ?? m) : 'the selected model';
+
+export function denoiseNotice(
+  requestedModel: string,
+  report: DenoiseStateReport | undefined,
+): string | undefined {
+  if (!report || typeof report.active !== 'boolean') return undefined;
+  if (!report.active) {
+    return `ML noise suppression couldn't start, so your microphone is sending unfiltered audio. You can pick another model in Settings → Calls.`;
+  }
+  if (typeof report.model === 'string' && report.model !== requestedModel) {
+    return `${modelName(requestedModel)} couldn't start, so noise suppression is using ${modelName(report.model)} instead.`;
+  }
+  return undefined;
+}

src/app/utils/imageCompression.test.ts

@@ -1,6 +1,11 @@
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
-import { formatFileSize, isCompressible } from './imageCompression';
+import {
+  formatFileSize,
+  hasTransparency,
+  isAnimatedWebp,
+  isCompressible,
+} from './imageCompression';
 
 test('formatFileSize formats bytes below 1KB as B', () => {
   assert.equal(formatFileSize(0), '0 B');
@@ -25,14 +30,38 @@ test('formatFileSize formats values in the MB range', () => {
 test('isCompressible accepts raster image types', () => {
   assert.equal(isCompressible({ type: 'image/png' } as Blob), true);
   assert.equal(isCompressible({ type: 'image/jpeg' } as Blob), true);
-  assert.equal(isCompressible({ type: 'image/gif' } as Blob), true);
   assert.equal(isCompressible({ type: 'image/webp' } as Blob), true);
 });
 
 test('isCompressible rejects svg, empty type, and non-images', () => {
   assert.equal(isCompressible({ type: 'image/svg+xml' } as Blob), false);
+  // [Gitea #331] usually animated; a canvas keeps one frame
+  assert.equal(isCompressible({ type: 'image/gif' } as Blob), false);
+  assert.equal(isCompressible({ type: 'image/apng' } as Blob), false);
   assert.equal(isCompressible({ type: '' } as Blob), false);
   assert.equal(isCompressible({ type: 'application/pdf' } as Blob), false);
   assert.equal(isCompressible({ type: 'text/plain' } as Blob), false);
   assert.equal(isCompressible({ type: 'video/mp4' } as Blob), false);
 });
+
+const webpHeader = (chunk: string, flags = 0) => {
+  const b = new Uint8Array(32);
+  const put = (at: number, str: string) => b.set(new TextEncoder().encode(str), at);
+  put(0, 'RIFF');
+  put(8, 'WEBP');
+  put(12, chunk);
+  b[20] = flags;
+  return b;
+};
+
+test('isAnimatedWebp: VP8X with the animation flag (#331)', () => {
+  assert.equal(isAnimatedWebp(webpHeader('VP8X', 0x02)), true);
+  assert.equal(isAnimatedWebp(webpHeader('VP8X', 0x10)), false, 'alpha flag only');
+  assert.equal(isAnimatedWebp(webpHeader('VP8 ')), false, 'simple lossy');
+  assert.equal(isAnimatedWebp(new Uint8Array(8)), false);
+});
+
+test('hasTransparency (#331)', () => {
+  assert.equal(hasTransparency(new Uint8ClampedArray([1, 2, 3, 255, 4, 5, 6, 255])), false);
+  assert.equal(hasTransparency(new Uint8ClampedArray([1, 2, 3, 255, 0, 0, 0, 0])), true);
+});

src/app/utils/imageCompression.ts

@@ -8,11 +8,32 @@ export type CompressionResult = {
   height: number;
 };
 
-// Any raster image the browser can render to canvas can be compressed to JPEG.
-// SVG is vector and must stay as-is; GIF animation is lost on canvas but static
-// frames compress fine. Empty type string (undetected MIME) is excluded.
+// Raster images the browser can render to canvas can be compressed to JPEG.
+// SVG is vector and must stay as-is. [Gitea #331] GIF and APNG are usually
+// animated, and a canvas keeps only the first frame, so they aren't offered.
+// Empty type string (undetected MIME) is excluded.
+const NOT_COMPRESSIBLE = new Set(['image/svg+xml', 'image/gif', 'image/apng']);
 const isCompressibleType = (type: string): boolean =>
-  type.startsWith('image/') && type !== 'image/svg+xml' && type !== '';
+  type.startsWith('image/') && !NOT_COMPRESSIBLE.has(type);
+
+/**
+ * Pure: whether a WebP file is animated. An animated WebP is a VP8X file
+ * whose header has the animation flag (byte 20, bit 0x02) and an ANIM chunk.
+ */
+export function isAnimatedWebp(bytes: Uint8Array): boolean {
+  const ascii = (at: number, len: number) => String.fromCharCode(...bytes.subarray(at, at + len));
+  if (bytes.length < 21 || ascii(0, 4) !== 'RIFF' || ascii(8, 4) !== 'WEBP') return false;
+  // Bit 0x02 of the VP8X flags byte (no-bitwise: test it arithmetically).
+  return ascii(12, 4) === 'VP8X' && Math.floor(bytes[20] / 2) % 2 === 1;
+}
+
+/** Pure: whether RGBA pixel data has any pixel that isn't fully opaque. */
+export function hasTransparency(rgba: Uint8ClampedArray): boolean {
+  for (let i = 3; i < rgba.length; i += 4) {
+    if (rgba[i] !== 255) return true;
+  }
+  return false;
+}
 
 /** Returns true if this file can be compressed via canvas (any raster image type). */
 export function isCompressible(file: File | Blob): boolean {
@@ -28,7 +49,8 @@ const JPEG_OUTPUT_TYPE = 'image/jpeg';
  *
  * PNG is skipped entirely: it may carry an alpha channel, and re-encoding to
  * JPEG composites transparency onto an opaque (black) background, corrupting the
- * image. Returning null makes callers fall back to uploading the lossless
+ * image. Any other image with transparent pixels, and animated WebP, are left
+ * alone for the same reason (#331). Returning null makes callers fall back to uploading the lossless
  * original. The image is decoded with `imageOrientation: 'from-image'` so any
  * EXIF orientation is baked into the pixels instead of being silently dropped.
  */
@@ -39,6 +61,15 @@ export async function compressImage(
   if (!isCompressibleType(file.type)) return null;
   // Skip PNG (potential alpha) — re-encoding to JPEG would flatten transparency.
   if (file.type === 'image/png') return null;
+  // [Gitea #331] An animated WebP would become a single still frame.
+  if (file.type === 'image/webp') {
+    try {
+      const head = new Uint8Array(await file.slice(0, 32).arrayBuffer());
+      if (isAnimatedWebp(head)) return null;
+    } catch {
+      return null;
+    }
+  }
 
   let bitmap: ImageBitmap;
   try {
@@ -60,6 +91,13 @@ export async function compressImage(
   }
   ctx.drawImage(bitmap, 0, 0);
   bitmap.close();
+  // [Gitea #331] JPEG has no alpha: a transparent WebP (sticker, logo) came out
+  // with a black background. Keep any image with transparency as the original.
+  try {
+    if (hasTransparency(ctx.getImageData(0, 0, width, height).data)) return null;
+  } catch {
+    return null;
+  }
 
   return new Promise((resolve) => {
     canvas.toBlob(

src/app/utils/kumaStatus.test.ts

@@ -1,6 +1,7 @@
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
 import {
+  plain,
   DEFAULT_GROUPS,
   kumaBeatTime,
   kumaUrls,
@@ -260,3 +261,27 @@ test('a dismissed calls-down banner lets the next one through, never hides serve
     'server-down',
   );
 });
+
+test('plain: strips Markdown syntax only, keeps ordinary #, _, > and * (#308)', () => {
+  assert.equal(
+    plain('join #lotus-general or #announcements:lotusguild.org'),
+    'join #lotus-general or #announcements:lotusguild.org',
+  );
+  assert.equal(
+    plain('ping @some_user about snake_case and C#'),
+    'ping @some_user about snake_case and C#',
+  );
+  assert.equal(
+    plain('calls -> fixed, > 5 people, 5 * 3 = 15'),
+    'calls -> fixed, > 5 people, 5 * 3 = 15',
+  );
+  assert.equal(
+    plain('# Heading\n* item one\n- item two\n> quoted'),
+    'Heading\nitem one\nitem two\nquoted',
+  );
+  assert.equal(plain('**bold**, *em*, _em_, `/sfu/get`'), 'bold, em, em, /sfu/get');
+  assert.equal(
+    plain('Read the <b>guide</b> <img src=x onerror=alert(1)> [docs](https://x.y)'),
+    'Read the guide  docs',
+  );
+});

src/app/utils/kumaStatus.ts

@@ -240,12 +240,25 @@ const incidentTone = (style: string): BannerTone => {
 };
 
 /** Markdown-ish incident text as plain text for the Details line. */
-const plain = (s: string): string =>
+/**
+ * [Gitea #308] Markdown → plain text for the Details line. Strips only the
+ * syntax: removing every `*_\`#>` also broke "#lotus-general", "snake_case",
+ * "->" and "5 * 3". HTML tags are dropped (React escapes the text anyway).
+ */
+export const plain = (s: string): string =>
   s
     .replace(/!\[[^\]]*\]\([^)]*\)/g, '')
     .replace(/\[([^\]]+)\]\([^)]*\)/g, '$1')
-    .replace(/[*_`#>]/g, '')
-    .replace(/\s+\n/g, '\n')
+    .replace(/<\/?[a-z][^>]*>/gi, '')
+    .replace(/^[ \t]{0,3}#{1,6}[ \t]+/gm, '')
+    .replace(/^[ \t]*>[ \t]?/gm, '')
+    .replace(/^[ \t]*[*+-][ \t]+/gm, '')
+    .replace(/`([^`\n]+)`/g, '$1')
+    .replace(/\*\*(?=\S)([^*\n]*?\S)\*\*/g, '$1')
+    .replace(/__(?=\S)([^_\n]*?\S)__/g, '$1')
+    .replace(/(^|[^\w*])\*(?=\S)([^*\n]*?\S)\*(?![\w*])/g, '$1$2')
+    .replace(/(^|[^\w])_(?=\S)([^_\n]*?\S)_(?!\w)/g, '$1$2')
+    .replace(/[ \t]+\n/g, '\n')
     .trim();
 
 /**

src/app/utils/linkSafety.test.ts

@@ -1,6 +1,6 @@
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
-import { analyzeLink, hostFromText, registrableDomain } from './linkSafety';
+import { analyzeLink, hostFromText, previewUrlsFor, registrableDomain } from './linkSafety';
 
 test('visible text that names another site is a mismatch', () => {
   const r = analyzeLink('https://matrix.lotusguild.org/login', 'https://evil.example/login');
@@ -73,3 +73,25 @@ test('shared hosting suffixes are separate sites (#335)', () => {
   );
   assert.equal(registrableDomain('news.bbc.co.uk'), 'bbc.co.uk');
 });
+
+test('previewUrlsFor: no preview for a site a deceptive link only claims (#286)', () => {
+  const urls = ['https://paypal.com'];
+  assert.deepEqual(
+    previewUrlsFor(urls, '<a href="https://evil.example/login">https://paypal.com</a>'),
+    [],
+  );
+  // An honest link keeps its preview.
+  assert.deepEqual(
+    previewUrlsFor(urls, '<a href="https://www.paypal.com/x">https://paypal.com</a>'),
+    urls,
+  );
+  assert.deepEqual(previewUrlsFor(urls, undefined), urls);
+  // Other links in the message keep theirs.
+  assert.deepEqual(
+    previewUrlsFor(
+      ['https://paypal.com', 'https://lotusguild.org'],
+      'see <a href="https://evil.example">paypal.com</a> and https://lotusguild.org',
+    ),
+    ['https://lotusguild.org'],
+  );
+});

src/app/utils/linkSafety.ts

@@ -221,3 +221,37 @@ export const analyzeLink = (text: string, href: string): LinkSafety | null => {
   const other = shown.find((h) => registrableDomain(h) !== realSite);
   return { mismatch: other !== undefined, shownHost: other ?? shown[0], realHost, punycode };
 };
+
+const ANCHOR_REG = /<a\s[^>]*href\s*=\s*(["'])(.*?)\1[^>]*>([\s\S]*?)<\/a>/gi;
+const decodeEntities = (s: string): string =>
+  s
+    .replace(/<[^>]+>/g, '')
+    .replace(/&quot;/g, '"')
+    .replace(/&#39;/g, "'")
+    .replace(/&lt;/g, '<')
+    .replace(/&gt;/g, '>')
+    .replace(/&amp;/g, '&');
+
+/**
+ * [Gitea #286] The URLs to build link previews for. Previews come from the
+ * plain `body`, but clicks follow `formatted_body`'s hrefs, and a sender
+ * controls both: text reading "https://paypal.com" linked to evil.example got
+ * a genuine PayPal card. Drop any body URL whose site is only *claimed* by a
+ * deceptive link's text.
+ */
+export const previewUrlsFor = (urls: string[], formattedBody: string | undefined): string[] => {
+  if (!formattedBody || urls.length === 0) return urls;
+  const claimed = new Set<string>();
+  Array.from(formattedBody.matchAll(ANCHOR_REG)).forEach((m) => {
+    const safety = analyzeLink(decodeEntities(m[3]), decodeEntities(m[2]));
+    if (safety?.mismatch && safety.shownHost) claimed.add(registrableDomain(safety.shownHost));
+  });
+  if (claimed.size === 0) return urls;
+  return urls.filter((u) => {
+    try {
+      return !claimed.has(registrableDomain(new URL(u).hostname));
+    } catch {
+      return true;
+    }
+  });
+};

src/app/utils/notifications.test.ts

@@ -169,7 +169,7 @@ test('private receipt flag uses ReadPrivate', async () => {
 // follows unread; an explicit mark-as-read still clears everything.
 const sender = (userId: string) => ({ getSender: () => userId });
 
-test('passive: a thread I replied in stays unread; main receipt is scoped to main', async () => {
+test('passive: threads stay unread, followed or not; main receipt is scoped to main (#314)', async () => {
   const mine = thread('$mine', evt('$r1'), { hasCurrentUserParticipated: true });
   const other = thread('$other', evt('$r2'));
   const { mx, calls } = setup({
@@ -181,10 +181,9 @@ test('passive: a thread I replied in stays unread; main receipt is scoped to mai
   await markAsRead(mx, '!r:server', false, { passive: true });
   assert.deepEqual(
     calls.map((c) => [c.eventId, c.unthreaded]),
-    [
-      ['b', false], // main-scoped: unthreaded would also read $mine's reply
-      ['$r2', false],
-    ],
+    // main-scoped (unthreaded would read the threads' replies), and no thread
+    // receipts: [Gitea #314] unfollowed threads used to be read silently.
+    [['b', false]],
   );
 });
 
@@ -203,7 +202,7 @@ test('passive: threads I started or was mentioned in stay unread', async () => {
   assert.equal(calls.length, 0);
 });
 
-test('passive: no followed thread unread → main receipt stays unthreaded', async () => {
+test('passive: an unfollowed unread thread is left unread too (#314)', async () => {
   const other = thread('$other', evt('$r2'), { rootEvent: sender('@bob:server') });
   const { mx, calls } = setup({
     timeline: [evt('a'), evt('b')],
@@ -214,10 +213,16 @@ test('passive: no followed thread unread → main receipt stays unthreaded', asy
   await markAsRead(mx, '!r:server', false, { passive: true });
   assert.deepEqual(
     calls.map((c) => [c.eventId, c.unthreaded]),
-    [
-      ['b', true],
-      ['$r2', false],
-    ],
+    [['b', false]],
+  );
+});
+
+test('passive: no thread unread → main receipt stays unthreaded', async () => {
+  const { mx, calls } = setup({ timeline: [evt('a'), evt('b')], readUpTo: 'a', threads: [] });
+  await markAsRead(mx, '!r:server', false, { passive: true });
+  assert.deepEqual(
+    calls.map((c) => [c.eventId, c.unthreaded]),
+    [['b', true]],
   );
 });
 
@@ -249,9 +254,10 @@ test('passive: the thread open in the panel is left to the panel', async () => {
     threadUnread: { $open: 1, $other: 1 },
   });
   await markAsRead(mx, '!r:server', false, { passive: true, openThreadId: '$open' });
+  // The open thread is left to the panel, and [#314] the other one stays unread.
   assert.deepEqual(
     calls.map((c) => c.eventId),
-    ['$r2'],
+    [],
   );
 });
 

src/app/utils/notifications.ts

@@ -1,27 +1,19 @@
-import { MatrixClient, NotificationCountType, ReceiptType, Room, Thread } from 'matrix-js-sdk';
+import { MatrixClient, NotificationCountType, ReceiptType, Thread } from 'matrix-js-sdk';
 import { getSettings } from '../state/settings';
 import { readMarkedUnread, setMarkedUnread } from '../state/room/markedUnread';
+import { isThreadFollowed } from './room';
 
-/**
- * [Gitea #217] Threads the user is following: they started it, replied in it,
- * or were mentioned in it. `hasCurrentUserParticipated` comes from the server's
- * thread bundle and lags a reply we just sent, so our own loaded events count too.
- */
-export function isThreadFollowed(room: Room, thread: Thread, userId: string | null): boolean {
-  if (thread.hasCurrentUserParticipated) return true;
-  if (userId && thread.rootEvent?.getSender() === userId) return true;
-  if (userId && thread.timeline?.some((e) => e.getSender() === userId)) return true;
-  return (
-    (room.getThreadUnreadNotificationCount(thread.id, NotificationCountType.Highlight) ?? 0) > 0
-  );
-}
+// isThreadFollowed lives in utils/room (getUnreadInfo needs it too).
+export { isThreadFollowed };
 
 export type MarkAsReadOptions = {
   /**
    * [Gitea #217] The read comes from simply looking at the room (timeline at
-   * the bottom and focused), not an explicit "mark as read". Threads the user
-   * follows stay unread until their panel is opened, like Slack and Discord;
-   * the rest are cleared so they don't keep the room dot lit forever.
+   * the bottom and focused), not an explicit "mark as read". Threads stay
+   * unread until opened (or "Mark all read"), like Slack and Discord.
+   * [Gitea #314] That includes threads you don't follow; those no longer
+   * count toward the room's unread dot (see getUnreadInfo), so leaving them
+   * unread doesn't keep the room lit.
    */
   passive?: boolean;
   /**
@@ -66,7 +58,9 @@ export async function markAsRead(
   const threads = room.getThreads();
   const threadUnread = (thread: Thread) =>
     room.getThreadUnreadNotificationCount(thread.id, NotificationCountType.Total) ?? 0;
-  const keepThread = (thread: Thread) => passive && isThreadFollowed(room, thread, mx.getUserId());
+  // [Gitea #314] A passive read leaves every thread's state alone (it used to
+  // silently read every thread you don't follow).
+  const keepThread = (_thread: Thread) => passive;
   // [Gitea #217] An unthreaded receipt also reads every thread reply older than
   // it, so a passive read while a followed thread is unread must stay scoped
   // to the main timeline or the next main message would clear that thread.

src/app/utils/presenceWrite.ts

@@ -1,4 +1,5 @@
-import { MatrixClient, MatrixError } from 'matrix-js-sdk';
+import { MatrixClient, MatrixError, IPresenceOpts, Method } from 'matrix-js-sdk';
+import { BUSY_PRESENCE } from './busyPresence';
 
 /**
  * Synapse rate-limits `PUT /presence/{user}/status` to ONE request per 10 s per
@@ -10,7 +11,29 @@ import { MatrixClient, MatrixError } from 'matrix-js-sdk';
  * and `PresenceDeduper` lets the heartbeat skip writes that would not change
  * anything, so it stops spending the budget in the first place.
  */
-export type PresenceWrite = { presence: 'online' | 'offline' | 'unavailable'; status_msg?: string };
+export type PresenceWrite = {
+  // [Gitea #283] or MSC3026 busy (Do Not Disturb)
+  presence: 'online' | 'offline' | 'unavailable' | typeof BUSY_PRESENCE;
+  status_msg?: string;
+};
+
+/**
+ * `mx.setPresence` for a PresenceWrite. The SDK refuses anything but the three
+ * spec presences ("Bad presence value"), so MSC3026 busy (#283) goes straight
+ * to the same endpoint.
+ */
+export const writePresence = async (
+  mx: Pick<MatrixClient, 'setPresence'> & Partial<Pick<MatrixClient, 'getSafeUserId' | 'http'>>,
+  write: PresenceWrite,
+): Promise<void> => {
+  if (write.presence !== BUSY_PRESENCE) {
+    await mx.setPresence(write as IPresenceOpts);
+    return;
+  }
+  if (!mx.getSafeUserId || !mx.http) throw new Error('busy presence needs a full MatrixClient');
+  const path = `/presence/${encodeURIComponent(mx.getSafeUserId())}/status`;
+  await mx.http.authedRequest(Method.Put, path, undefined, write);
+};
 
 const sleep = (ms: number) =>
   new Promise<void>((r) => {
@@ -28,7 +51,7 @@ export async function setPresenceWithRetry(
   for (;;) {
     try {
       // eslint-disable-next-line no-await-in-loop
-      await mx.setPresence(write);
+      await writePresence(mx, write);
       return;
     } catch (e) {
       if (!(e instanceof MatrixError) || e.httpStatus !== 429) throw e;

src/app/utils/room.test.ts

@@ -928,3 +928,42 @@ test('getAllVersionsRoomCreator returns empty set when no create event', () => {
 test('EventTimeline.FORWARDS constant is available', () => {
   assert.equal(typeof EventTimeline.FORWARDS, 'string');
 });
+
+test('getUnreadInfo: unfollowed threads do not light the room; followed and mentioned do (#314)', () => {
+  const threads = [
+    { id: '$followed', hasCurrentUserParticipated: true },
+    { id: '$other' },
+    { id: '$mention' },
+  ];
+  const counts: Record<string, { total: number; highlight: number }> = {
+    $followed: { total: 2, highlight: 0 },
+    $other: { total: 3, highlight: 0 },
+    $mention: { total: 1, highlight: 1 },
+  };
+  const room = {
+    roomId: '!r:x',
+    // Server room totals include thread counts: 2 + 3 + 1 thread, 0 main.
+    getUnreadNotificationCount: (type: NotificationCountType) =>
+      type === NotificationCountType.Total ? 6 : 1,
+    getThreads: () => threads,
+    getThreadUnreadNotificationCount: (id: string, type: NotificationCountType) =>
+      type === NotificationCountType.Total ? counts[id].total : counts[id].highlight,
+    getEventReadUpTo: () => null,
+    getLiveTimeline: () => ({ getEvents: () => [] }),
+  } as unknown as Room;
+  const me = { getUserId: () => '@me:x' } as unknown as MatrixClient;
+  assert.deepEqual(getUnreadInfo(room, undefined, me), { roomId: '!r:x', highlight: 1, total: 3 });
+  // Only an unfollowed thread is unread: the room isn't lit.
+  counts.$followed.total = 0;
+  counts.$mention = { total: 0, highlight: 0 };
+  const onlyOther = {
+    ...room,
+    getUnreadNotificationCount: (type: NotificationCountType) =>
+      type === NotificationCountType.Total ? 3 : 0,
+  } as unknown as Room;
+  assert.deepEqual(getUnreadInfo(onlyOther, undefined, me), {
+    roomId: '!r:x',
+    highlight: 0,
+    total: 0,
+  });
+});

src/app/utils/room.ts

@@ -18,6 +18,7 @@ import {
   NotificationCountType,
   RelationType,
   Room,
+  Thread,
   RoomMember,
   TimelineEvents,
   IRoomTimelineData,
@@ -418,6 +419,20 @@ export const roomHaveUnread = (mx: MatrixClient, room: Room) => {
   return true;
 };
 
+/**
+ * [Gitea #217] Threads the user is following: they started it, replied in it,
+ * or were mentioned in it. `hasCurrentUserParticipated` comes from the server's
+ * thread bundle and lags a reply we just sent, so our own loaded events count too.
+ */
+export function isThreadFollowed(room: Room, thread: Thread, userId: string | null): boolean {
+  if (thread.hasCurrentUserParticipated) return true;
+  if (userId && thread.rootEvent?.getSender() === userId) return true;
+  if (userId && thread.timeline?.some((e) => e.getSender() === userId)) return true;
+  return (
+    (room.getThreadUnreadNotificationCount(thread.id, NotificationCountType.Highlight) ?? 0) > 0
+  );
+}
+
 export const getUnreadInfo = (
   room: Room,
   mutedThreads?: Set<string>,
@@ -439,6 +454,18 @@ export const getUnreadInfo = (
     if (highlight < 0) highlight = 0;
   }
 
+  // [Gitea #314] Threads you don't follow stay unread in the Threads panel
+  // (viewing the room no longer reads them) but don't light the room's dot.
+  // A mention makes a thread followed, so highlights are never subtracted.
+  if (mx) {
+    room.getThreads().forEach((thread) => {
+      if (mutedThreads?.has(thread.id)) return;
+      if (isThreadFollowed(room, thread, mx.getUserId())) return;
+      total -= room.getThreadUnreadNotificationCount(thread.id, NotificationCountType.Total) ?? 0;
+    });
+    if (total < 0) total = 0;
+  }
+
   const resolvedTotal = highlight > total ? highlight : total;
 
   // Suppress a spurious Total when the room isn't really unread. Two safe cases,

src/app/utils/serverAcl.test.ts

@@ -1,6 +1,11 @@
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
-import { isValidServerPattern, globToRegExp, matchesAnyGlob } from './serverAcl';
+import {
+  isValidServerPattern,
+  globToRegExp,
+  matchesAnyGlob,
+  normalizeServerAcl,
+} from './serverAcl';
 
 test('isValidServerPattern: accepts hostnames, IPs, and globs', () => {
   for (const v of [
@@ -42,3 +47,35 @@ test('matchesAnyGlob: true if any glob matches (self-ban detection)', () => {
   assert.equal(matchesAnyGlob('lotusguild.org', ['*.evil.com']), false);
   assert.equal(matchesAnyGlob('lotusguild.org', []), false);
 });
+
+test('no ACL event: every server allowed, IP literals allowed (#261)', () => {
+  assert.deepEqual(normalizeServerAcl(undefined), {
+    allow: ['*'],
+    deny: [],
+    allow_ip_literals: true,
+  });
+});
+
+test('a missing allow_ip_literals defaults to true, per the spec (#261)', () => {
+  assert.equal(normalizeServerAcl({ allow: ['*'], deny: ['bad.example'] }).allow_ip_literals, true);
+});
+
+test('an explicit allow_ip_literals is kept', () => {
+  assert.equal(
+    normalizeServerAcl({ allow: ['*'], allow_ip_literals: false }).allow_ip_literals,
+    false,
+  );
+  assert.equal(
+    normalizeServerAcl({ allow: ['*'], allow_ip_literals: true }).allow_ip_literals,
+    true,
+  );
+});
+
+test('missing or malformed lists become empty, non-strings are dropped', () => {
+  assert.deepEqual(normalizeServerAcl({ allow: ['a.example', 3, null] }), {
+    allow: ['a.example'],
+    deny: [],
+    allow_ip_literals: true,
+  });
+  assert.deepEqual(normalizeServerAcl({ allow: 'a.example', deny: {} }).allow, []);
+});

src/app/utils/serverAcl.ts

@@ -50,3 +50,29 @@ export function matchesAnyGlob(domain: string, globs: string[]): boolean {
     }
   });
 }
+
+/**
+ * `m.room.server_acl` content with the spec's defaults filled in (#261).
+ * `allow_ip_literals` defaults to **true** when absent; `allow` and `deny`
+ * default to empty lists, but with no ACL event at all every server is allowed,
+ * so the editor starts from `allow: ['*']` in that case.
+ * https://spec.matrix.org/v1.12/client-server-api/#mroomserver_acl
+ */
+export type ServerAclContent = {
+  allow: string[];
+  deny: string[];
+  allow_ip_literals: boolean;
+};
+
+const stringList = (value: unknown): string[] | undefined =>
+  Array.isArray(value) ? value.filter((v): v is string => typeof v === 'string') : undefined;
+
+export function normalizeServerAcl(content: Record<string, unknown> | undefined): ServerAclContent {
+  if (!content) return { allow: ['*'], deny: [], allow_ip_literals: true };
+  return {
+    allow: stringList(content.allow) ?? [],
+    deny: stringList(content.deny) ?? [],
+    allow_ip_literals:
+      typeof content.allow_ip_literals === 'boolean' ? content.allow_ip_literals : true,
+  };
+}

src/app/utils/statusExpiry.test.ts

@@ -0,0 +1,22 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { parseStatusExpiry, statusExpiryAction } from './statusExpiry';
+
+test('parseStatusExpiry (#300)', () => {
+  assert.deepEqual(parseStatusExpiry({ status_msg: '🍔 Lunch', expires_at: 5 }), {
+    statusMsg: '🍔 Lunch',
+    expiresAt: 5,
+  });
+  assert.equal(parseStatusExpiry({}), undefined);
+  assert.equal(parseStatusExpiry({ status_msg: '', expires_at: 5 }), undefined);
+  assert.equal(parseStatusExpiry({ status_msg: 'x', expires_at: '5' }), undefined);
+});
+
+test('statusExpiryAction: clears only the status that was set to expire (#300)', () => {
+  const e = { statusMsg: '🍔 Lunch', expiresAt: 1000 };
+  assert.equal(statusExpiryAction(e, '🍔 Lunch', 999), 'none');
+  assert.equal(statusExpiryAction(e, '🍔 Lunch', 1000), 'clear');
+  assert.equal(statusExpiryAction(e, '🎮 Gaming', 2000), 'forget');
+  assert.equal(statusExpiryAction(e, '', 2000), 'forget');
+  assert.equal(statusExpiryAction(undefined, 'x', 2000), 'none');
+});

src/app/utils/statusExpiry.ts

@@ -0,0 +1,46 @@
+import { MatrixClient } from 'matrix-js-sdk';
+import { AccountDataEvent } from '../../types/matrix/accountData';
+import { getAccountData } from './room';
+
+/**
+ * [Gitea #300] The status message's auto-clear time, in account data so every
+ * Lotus device knows it. Before, only the device that set "clear after 1 hour"
+ * (localStorage) ever cleared it, and only while it was open.
+ */
+export type StatusExpiry = { statusMsg: string; expiresAt: number };
+
+/** Pure: parse `io.lotus.status_expiry` content. */
+export function parseStatusExpiry(content: unknown): StatusExpiry | undefined {
+  const c = content as { status_msg?: unknown; expires_at?: unknown } | undefined;
+  if (!c || typeof c.status_msg !== 'string' || typeof c.expires_at !== 'number') return undefined;
+  if (!c.status_msg || !Number.isFinite(c.expires_at)) return undefined;
+  return { statusMsg: c.status_msg, expiresAt: c.expires_at };
+}
+
+/**
+ * Pure: what to do with a due expiry. Clear the server status only if it is
+ * still the one that was set to expire; if it has since changed (e.g. on
+ * another device), just forget the expiry.
+ */
+export function statusExpiryAction(
+  entry: StatusExpiry | undefined,
+  currentStatusMsg: string | undefined,
+  now: number,
+): 'none' | 'clear' | 'forget' {
+  if (!entry || now < entry.expiresAt) return 'none';
+  return (currentStatusMsg ?? '') === entry.statusMsg ? 'clear' : 'forget';
+}
+
+export const readStatusExpiry = (mx: MatrixClient): StatusExpiry | undefined =>
+  parseStatusExpiry(getAccountData(mx, AccountDataEvent.LotusStatusExpiry)?.getContent());
+
+/** Record (or with no `expiresAt`, remove) the shared auto-clear time. */
+export async function writeStatusExpiry(
+  mx: MatrixClient,
+  statusMsg: string,
+  expiresAt?: number,
+): Promise<void> {
+  const content =
+    statusMsg && expiresAt !== undefined ? { status_msg: statusMsg, expires_at: expiresAt } : {};
+  await mx.setAccountData(AccountDataEvent.LotusStatusExpiry as never, content as never);
+}

src/app/utils/statusKeys.ts

@@ -0,0 +1,3 @@
+/** localStorage keys for this device's copy of the status message and its expiry. */
+export const STATUS_EXPIRY_KEY = (id: string) => `lotus-status-expiry-${id}`;
+export const STATUS_MSG_KEY = (id: string) => `lotus-status-msg-${id}`;

src/app/utils/topicMarkdown.test.ts

@@ -0,0 +1,72 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { buildTopicContent } from './topicMarkdown';
+
+test('a URL with underscores is sent verbatim (#262)', () => {
+  const t = 'Rules: https://wiki.lotusguild.org/en/server_rules_and_faq';
+  assert.deepEqual(buildTopicContent(t), { topic: t });
+});
+
+test('a markdown link keeps its underscored URL in both fields (#262)', () => {
+  const c = buildTopicContent('[Our wiki](https://wiki.example.org/my_cool_page)');
+  assert.ok('formatted_body' in c);
+  assert.match(c.formatted_body, /href="https:\/\/wiki\.example\.org\/my_cool_page"/);
+  assert.equal(c.topic, 'Our wiki (https://wiki.example.org/my_cool_page)');
+});
+
+test('room aliases and user IDs with underscores are untouched (#262)', () => {
+  for (const t of [
+    'Join #my_room_name:matrix.org',
+    'Ask @some_user_x:matrix.org',
+    'see snake_case_word',
+  ]) {
+    assert.deepEqual(buildTopicContent(t), { topic: t });
+  }
+});
+
+test('emphasis still works at word boundaries', () => {
+  const c = buildTopicContent('this is _really_ *great* and **bold**');
+  assert.ok('formatted_body' in c);
+  assert.match(c.formatted_body, /<i data-md="_">really<\/i>/);
+  assert.match(c.formatted_body, /<i data-md="\*">great<\/i>/);
+  assert.match(c.formatted_body, /<strong data-md="\*\*">bold<\/strong>/);
+  assert.equal(c.topic, 'this is really great and bold');
+});
+
+test('emphasis around an alias keeps the alias intact', () => {
+  const c = buildTopicContent('**Join #my_room:matrix.org**');
+  assert.ok('formatted_body' in c);
+  assert.match(c.formatted_body, /<strong data-md="\*\*">Join #my_room:matrix\.org<\/strong>/);
+  assert.equal(c.topic, 'Join #my_room:matrix.org');
+});
+
+test('inline code keeps its underscores and no backslashes appear', () => {
+  const c = buildTopicContent('run `a_b_c` now');
+  assert.ok('formatted_body' in c);
+  assert.match(c.formatted_body, /<code data-md="`">a_b_c<\/code>/);
+  assert.equal(c.topic, 'run a_b_c now');
+});
+
+test('a double quote in a link target cannot break out of the attribute (#262)', () => {
+  const c = buildTopicContent('[x](https://a" onclick="alert(1))');
+  assert.ok('formatted_body' in c);
+  assert.doesNotMatch(c.formatted_body, /" onclick="/);
+});
+
+test('HTML in the topic is escaped, and the plain topic shows it as typed', () => {
+  const c = buildTopicContent('**<b>hi</b> & bye**');
+  assert.ok('formatted_body' in c);
+  assert.match(c.formatted_body, /&lt;b&gt;hi&lt;\/b&gt; &amp; bye/);
+  assert.equal(c.topic, '<b>hi</b> & bye');
+});
+
+test('line breaks become <br> and survive in the plain topic', () => {
+  const c = buildTopicContent('**Rules**\nBe nice');
+  assert.ok('formatted_body' in c);
+  assert.equal(c.formatted_body, '<strong data-md="**">Rules</strong><br>Be nice');
+  assert.equal(c.topic, 'Rules\nBe nice');
+});
+
+test('plain text with no markdown is sent as typed', () => {
+  assert.deepEqual(buildTopicContent("It's <fun> & games"), { topic: "It's <fun> & games" });
+});

src/app/utils/topicMarkdown.ts

@@ -0,0 +1,63 @@
+import { parseInlineMD } from '../plugins/markdown';
+import { sanitizeText } from './sanitize';
+
+/**
+ * Room topic markdown → `m.room.topic` content (#262).
+ *
+ * Uses the composer's inline markdown parser (the same rules as messages: links,
+ * bare URLs and `"` are handled), with one topic-specific guard: an `_` between
+ * two letters/digits is literal, as in CommonMark. Topics are full of
+ * `#room_alias:server`, `@user_name:server` and snake_case paths, which the
+ * shared parser would otherwise turn into italics and, worse, drop from the
+ * plain `topic` that every other client shows.
+ */
+
+// Spans the guard must not touch: inline code, link targets, bare URLs.
+const PROTECTED = /(`[^`\n]*`|\]\([^)\n]*\)|https?:\/\/[^\s<>"]+)/;
+const INTRAWORD_UNDERSCORES = /(?<=[\p{L}\p{N}])_+(?=[\p{L}\p{N}])/gu;
+
+const escapeIntrawordUnderscores = (line: string): string =>
+  line
+    .split(PROTECTED)
+    .map((part, i) =>
+      // split() with one capture group puts the protected spans at odd indexes.
+      i % 2 === 1 ? part : part.replace(INTRAWORD_UNDERSCORES, (m) => m.replace(/_/g, '\\_')),
+    )
+    .join('');
+
+const ENTITIES: Record<string, string> = {
+  '&amp;': '&',
+  '&lt;': '<',
+  '&gt;': '>',
+  '&quot;': '"',
+  '&#39;': "'",
+};
+const decodeEntities = (s: string): string =>
+  s.replace(/&(?:amp|lt|gt|quot|#39);/g, (e) => ENTITIES[e]);
+
+/** Readable plain text for `topic`: markers dropped, links kept as "text (url)". */
+const htmlToPlain = (html: string): string =>
+  decodeEntities(
+    html
+      .replace(/<a\b[^>]*\bhref="([^"]*)"[^>]*>(.*?)<\/a>/g, (_m, href: string, label: string) => {
+        const text = label.replace(/<[^>]+>/g, '');
+        return text === href ? href : `${text} (${href})`;
+      })
+      .replace(/<br>/g, '\n')
+      .replace(/<[^>]+>/g, ''),
+  );
+
+export type TopicContent =
+  | { topic: string }
+  | { topic: string; format: 'org.matrix.custom.html'; formatted_body: string };
+
+export function buildTopicContent(text: string): TopicContent {
+  const lines = text.split('\n');
+  const html = lines
+    .map((line) => parseInlineMD(sanitizeText(escapeIntrawordUnderscores(line))))
+    .join('<br>');
+  const plainHtml = lines.map(sanitizeText).join('<br>');
+  // No markdown at all: send the text as typed, without a formatted body.
+  if (html === plainHtml) return { topic: text };
+  return { topic: htmlToPlain(html), format: 'org.matrix.custom.html', formatted_body: html };
+}

src/app/utils/translation/langUtils.test.ts

@@ -1,6 +1,7 @@
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
 import {
+  translationUnavailableText,
   normalizeLang,
   sameLanguage,
   languageName,
@@ -53,3 +54,9 @@ test('curated list: unique codes, English present', () => {
   assert.equal(new Set(codes).size, codes.length);
   assert.ok(codes.includes('en'));
 });
+
+test('translationUnavailableText: no "use the desktop app" inside the desktop app (#349)', () => {
+  assert.doesNotMatch(translationUnavailableText(true), /desktop app\.$|Lotus desktop app/);
+  assert.match(translationUnavailableText(true), /this version of the desktop app/);
+  assert.match(translationUnavailableText(false), /this browser/);
+});

src/app/utils/translation/langUtils.ts

@@ -85,3 +85,19 @@ export function languageName(code: string, uiLocale = 'en'): string {
 export function isSupportedTargetLang(code: string): boolean {
   return CURATED_NAME.has(normalizeLang(code));
 }
+
+/**
+ * [Gitea #349] Why translation is unavailable, by platform. The desktop app
+ * on Linux/macOS (WebKit) lacks the on-device APIs too, so it must not send
+ * people to "the Lotus desktop app" they're already using.
+ */
+export const translationUnavailableText = (desktopApp: boolean): string =>
+  desktopApp
+    ? 'On-device translation isn’t available in this version of the desktop app. It works in Chrome or Edge 138+ on a computer.'
+    : 'On-device translation isn’t available in this browser. Use Chrome or Edge 138+ on a computer.';
+
+/** Pure: why a manual Translate did nothing (#287). */
+export const translateSkipMessage = (from: string | undefined, targetLang: string): string =>
+  from
+    ? `This message is already in ${languageName(targetLang) || targetLang}.`
+    : "Couldn't tell what language this message is in, so it wasn't translated.";

src/app/utils/translation/translateSkip.test.ts

@@ -0,0 +1,8 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { translateSkipMessage } from './langUtils';
+
+test('translateSkipMessage explains a Translate that did nothing (#287)', () => {
+  assert.equal(translateSkipMessage('en', 'en'), 'This message is already in English.');
+  assert.match(translateSkipMessage(undefined, 'en'), /^Couldn't tell what language/);
+});

src/app/utils/updateErrors.test.ts

@@ -69,13 +69,23 @@ test('install kinds: anything unknown keeps the in-app updater', async () => {
 test('package installs get their package manager’s command, not an Install button', async () => {
   const { packageUpdateHelp, isPackageManagedError } = await import('./updateErrors');
   const pacman = packageUpdateHelp('pacman')!;
-  // Not `pacman -U <url>`: that also wants `<url>.sig`, which we don't publish.
-  assert.equal(
-    pacman.command,
-    'curl -LO https://code.lotusguild.org/LotusGuild/cinny-desktop/releases/download/latest/LotusChat-x86_64.pkg.tar.zst && sudo pacman -U ./LotusChat-x86_64.pkg.tar.zst',
+  // [cinny-desktop #36] signature, then checksum, then install, in that order;
+  // a local `pacman -U ./file` (not `<url>`, which also wants `<url>.sig`).
+  const steps = pacman.command!.split(' && ');
+  assert.equal(steps[0], 'cd "$(mktemp -d)"');
+  assert.match(
+    steps[1],
+    /-fLO \S+\/LotusChat-x86_64\.pkg\.tar\.zst -fLO \S+\/SHA256SUMS\.txt -fLO \S+\/SHA256SUMS\.txt\.minisig$/,
   );
+  assert.equal(
+    steps[2],
+    'minisign -Vm SHA256SUMS.txt -P RWRZZdyii05/NUcz337A5SAbiZK+NPVDWuiL2mM5Jk1p/LfRmNfiZ/6l',
+  );
+  assert.equal(steps[3], 'sha256sum -c --ignore-missing SHA256SUMS.txt');
+  assert.equal(steps[4], 'sudo pacman -U ./LotusChat-x86_64.pkg.tar.zst');
   assert.match(pacman.url, /LotusChat-x86_64\.pkg\.tar\.zst$/);
   const deb = packageUpdateHelp('deb')!;
+  assert.match(deb.command!, /minisign -Vm SHA256SUMS\.txt/);
   assert.match(deb.command!, /sudo apt install \.\/LotusChat-x86_64\.deb$/);
   assert.equal(packageUpdateHelp('manual')?.command, undefined);
   assert.equal(packageUpdateHelp('in-app'), undefined);

src/app/utils/updateErrors.ts

@@ -64,23 +64,38 @@ export const toInstallKind = (value: unknown): InstallKind =>
 
 export type PackageUpdateHelp = { command?: string; url: string; download: string };
 
+/** The desktop updater's minisign public key (cinny-desktop tauri.conf.json). */
+export const RELEASE_MINISIGN_KEY = 'RWRZZdyii05/NUcz337A5SAbiZK+NPVDWuiL2mM5Jk1p/LfRmNfiZ/6l';
+
+/**
+ * [cinny-desktop #36] Download a Linux package and install it only after
+ * checking the release's minisign-signed SHA256SUMS.txt. Runs in a fresh temp
+ * directory so a stale SHA256SUMS.txt can't be picked up.
+ */
+const verifiedInstall = (file: string, install: string): string =>
+  [
+    `cd "$(mktemp -d)"`,
+    `curl -fLO ${RELEASE_DOWNLOAD}/${file} -fLO ${RELEASE_DOWNLOAD}/SHA256SUMS.txt -fLO ${RELEASE_DOWNLOAD}/SHA256SUMS.txt.minisig`,
+    `minisign -Vm SHA256SUMS.txt -P ${RELEASE_MINISIGN_KEY}`,
+    `sha256sum -c --ignore-missing SHA256SUMS.txt`,
+    `${install} ./${file}`,
+  ].join(' && ');
+
 export const packageUpdateHelp = (kind: InstallKind): PackageUpdateHelp | undefined => {
   if (kind === 'pacman') {
-    const url = `${RELEASE_DOWNLOAD}/LotusChat-x86_64.pkg.tar.zst`;
-    // Download first, then install the local file: `pacman -U <url>` also
-    // fetches `<url>.sig` and fails without it (we don't sign packages),
-    // while a local file falls under LocalFileSigLevel (signature optional).
+    // Install the local file: `pacman -U <url>` also fetches `<url>.sig` and
+    // fails without it (packages aren't signed for pacman), while a local file
+    // falls under LocalFileSigLevel. Integrity comes from SHA256SUMS.txt.
     return {
-      command: `curl -LO ${url} && sudo pacman -U ./LotusChat-x86_64.pkg.tar.zst`,
-      url,
+      command: verifiedInstall('LotusChat-x86_64.pkg.tar.zst', 'sudo pacman -U'),
+      url: `${RELEASE_DOWNLOAD}/LotusChat-x86_64.pkg.tar.zst`,
       download: 'Download package',
     };
   }
   if (kind === 'deb') {
-    const url = `${RELEASE_DOWNLOAD}/LotusChat-x86_64.deb`;
     return {
-      command: `curl -LO ${url} && sudo apt install ./LotusChat-x86_64.deb`,
-      url,
+      command: verifiedInstall('LotusChat-x86_64.deb', 'sudo apt install'),
+      url: `${RELEASE_DOWNLOAD}/LotusChat-x86_64.deb`,
       download: 'Download package',
     };
   }

src/index.tsx

@@ -43,7 +43,7 @@ if ('serviceWorker' in navigator && swProtocolOk) {
 
   const sendSessionToSW = () => {
     const session = getFallbackSession();
-    pushSessionToSW(session?.baseUrl, session?.accessToken);
+    pushSessionToSW(session?.baseUrl, session?.accessToken, session?.userId);
   };
 
   // The dev worker is an ES module (it imports workbox), so it must be

src/sw-session.ts

@@ -1,4 +1,4 @@
-export function pushSessionToSW(baseUrl?: string, accessToken?: string) {
+export function pushSessionToSW(baseUrl?: string, accessToken?: string, userId?: string) {
   if (!('serviceWorker' in navigator)) return;
   if (!navigator.serviceWorker.controller) return;
 
@@ -6,5 +6,6 @@ export function pushSessionToSW(baseUrl?: string, accessToken?: string) {
     type: 'setSession',
     accessToken,
     baseUrl,
+    userId,
   });
 }

src/sw.ts

@@ -2,7 +2,7 @@
 
 import { precacheAndRoute, type PrecacheEntry } from 'workbox-precaching';
 import { SHARE_TARGET_PATH, stashSharedForm } from './swShare';
-import { sendNotificationReply } from './swReply';
+import { pickReplySession, replyFailureText, sendNotificationReply } from './swReply';
 
 export type {};
 declare const self: ServiceWorkerGlobalScope & {
@@ -40,6 +40,8 @@ precacheAndRoute(self.__WB_MANIFEST);
 type SessionInfo = {
   accessToken: string;
   baseUrl: string;
+  /** [Gitea #299] whose session this is, so a notification reply uses its own account */
+  userId?: string;
 };
 
 /**
@@ -63,9 +65,13 @@ async function cleanupDeadClients() {
   });
 }
 
-function setSession(clientId: string, accessToken: string, baseUrl: string) {
+function setSession(clientId: string, accessToken: string, baseUrl: string, userId?: unknown) {
   if (typeof accessToken === 'string' && typeof baseUrl === 'string') {
-    sessions.set(clientId, { accessToken, baseUrl });
+    sessions.set(clientId, {
+      accessToken,
+      baseUrl,
+      userId: typeof userId === 'string' ? userId : undefined,
+    });
   } else {
     // Logout or invalid session
     sessions.delete(clientId);
@@ -130,10 +136,10 @@ self.addEventListener('message', (event: ExtendableMessageEvent) => {
   const client = event.source as Client | null;
   if (!client) return;
 
-  const { type, accessToken, baseUrl } = event.data || {};
+  const { type, accessToken, baseUrl, userId } = event.data || {};
 
   if (type === 'setSession') {
-    setSession(client.id, accessToken, baseUrl);
+    setSession(client.id, accessToken, baseUrl, userId);
     cleanupDeadClients();
   }
 });
@@ -155,15 +161,19 @@ self.addEventListener('notificationclick', (event: NotificationEvent) => {
     if (text) {
       event.waitUntil(
         sendNotificationReply(
-          Array.from(sessions.values()).pop(),
+          // [Gitea #299] The notification's own account, not the newest session.
+          pickReplySession(
+            Array.from(sessions.values()),
+            typeof data.userId === 'string' ? data.userId : undefined,
+          ),
           data.roomId,
           data.threadId,
           text,
-        ).then((ok) => {
-          if (!ok) {
+        ).then((result) => {
+          if (result !== 'sent') {
             // Let the user know it didn't go out, and keep their text reachable.
             return self.registration.showNotification('Reply not sent', {
-              body: `Couldn't send "${text.slice(0, 60)}" — open the app to retry.`,
+              body: replyFailureText(result, text),
               tag: `swreply-fail-${data.roomId}`,
               data: { path },
             });

src/swReply.test.ts

@@ -1,6 +1,12 @@
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
-import { buildReplyContent, replySendUrl, sendNotificationReply } from './swReply';
+import {
+  buildReplyContent,
+  pickReplySession,
+  replyFailureText,
+  replySendUrl,
+  sendNotificationReply,
+} from './swReply';
 
 test('thread replies carry the m.thread relation, room replies do not', () => {
   assert.deepEqual(buildReplyContent('hi'), { msgtype: 'm.text', body: 'hi', 'm.mentions': {} });
@@ -19,40 +25,64 @@ test('send URL encodes the room id against the session base URL', () => {
   );
 });
 
-test('sendNotificationReply PUTs with the bearer token and reports ok / failure', async () => {
+test('sendNotificationReply checks encryption, then PUTs with the bearer token (#203, #299)', async () => {
   const calls: { url: string; init: RequestInit }[] = [];
-  const fetchOk = (async (url: string, init: RequestInit) => {
-    calls.push({ url, init });
-    return { ok: true } as Response;
-  }) as unknown as typeof fetch;
-  assert.equal(
-    await sendNotificationReply(
-      { accessToken: 'tok', baseUrl: 'https://hs' },
-      '!r:hs',
-      '$t',
-      'yo',
-      fetchOk,
-    ),
-    true,
-  );
-  assert.equal(calls[0].init.method, 'PUT');
-  assert.equal((calls[0].init.headers as Record<string, string>).Authorization, 'Bearer tok');
+  const fetchFor = (encStatus: number, sendOk = true) =>
+    (async (url: string, init: RequestInit = {}) => {
+      calls.push({ url, init });
+      if (url.includes('/state/m.room.encryption/')) {
+        return { ok: encStatus === 200, status: encStatus } as Response;
+      }
+      return { ok: sendOk, status: sendOk ? 200 : 500 } as Response;
+    }) as unknown as typeof fetch;
+  const session = { accessToken: 'tok', baseUrl: 'https://hs' };
+
+  assert.equal(await sendNotificationReply(session, '!r:hs', '$t', 'yo', fetchFor(404)), 'sent');
+  assert.match(calls[0].url, /\/rooms\/!r%3Ahs\/state\/m\.room\.encryption\/$/);
+  const put = calls[1];
+  assert.equal(put.init.method, 'PUT');
+  assert.equal((put.init.headers as Record<string, string>).Authorization, 'Bearer tok');
   assert.match(
-    calls[0].url,
+    put.url,
     /^https:\/\/hs\/_matrix\/client\/v3\/rooms\/!r%3Ahs\/send\/m\.room\.message\/swreply-/,
   );
-  assert.equal(JSON.parse(calls[0].init.body as string)['m.relates_to'].event_id, '$t');
+  assert.equal(JSON.parse(put.init.body as string)['m.relates_to'].event_id, '$t');
 
-  const fetchFail = (async () => ({ ok: false }) as Response) as unknown as typeof fetch;
+  // Encryption turned on since the notification was shown: nothing is sent.
+  calls.length = 0;
   assert.equal(
-    await sendNotificationReply(
-      { accessToken: 'tok', baseUrl: 'https://hs' },
-      '!r:hs',
-      undefined,
-      'yo',
-      fetchFail,
-    ),
-    false,
+    await sendNotificationReply(session, '!r:hs', undefined, 'yo', fetchFor(200)),
+    'encrypted',
+  );
+  assert.equal(calls.length, 1);
+  // Can't tell (server error): fail safe, nothing is sent.
+  calls.length = 0;
+  assert.equal(
+    await sendNotificationReply(session, '!r:hs', undefined, 'yo', fetchFor(500)),
+    'failed',
+  );
+  assert.equal(calls.length, 1);
+  assert.equal(
+    await sendNotificationReply(session, '!r:hs', undefined, 'yo', fetchFor(404, false)),
+    'failed',
+  );
+  assert.equal(
+    await sendNotificationReply(undefined, '!r:hs', undefined, 'yo', fetchFor(404)),
+    'no-session',
   );
-  assert.equal(await sendNotificationReply(undefined, '!r:hs', undefined, 'yo', fetchOk), false);
+});
+
+test('pickReplySession: the notification account only (#299)', () => {
+  const a = { accessToken: 'a', baseUrl: 'https://hs', userId: '@a:hs' };
+  const b = { accessToken: 'b', baseUrl: 'https://hs', userId: '@b:hs' };
+  assert.equal(pickReplySession([a, b], '@a:hs'), a);
+  assert.equal(pickReplySession([b], '@a:hs'), undefined, 'logged out of @a here');
+  assert.equal(pickReplySession([a], undefined), a, 'old notification, one session');
+  assert.equal(pickReplySession([a, b], undefined), undefined, 'old notification, ambiguous');
+});
+
+test('replyFailureText says why', () => {
+  assert.match(replyFailureText('encrypted', 'hi'), /now encrypted/);
+  assert.match(replyFailureText('no-session', 'hi'), /no longer signed in/);
+  assert.match(replyFailureText('failed', 'hi'), /retry/);
 });