Merge pull request 'feat(call): Details card after a call, with who/why/numbers/activity (#253)' (#442) from feat/call-summary-details into lotus

lotus.29 adds the call summary `details` (element-call#60).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

e2e/a11y.spec.ts

@@ -118,8 +118,26 @@ test.describe('accessibility', () => {
     test('room settings', async ({ page }) => {
       await page.getByRole('button', { name: 'More Options' }).first().click();
       await page.getByText('Room Settings', { exact: true }).click();
-      await expect(page.getByRole('dialog').first()).toBeVisible();
+      // [Gitea #278] The dialog has an accessible name.
+      await expect(page.getByRole('dialog', { name: 'A11y Room settings' })).toBeVisible();
       await auditPage(page, 'room settings');
+      // [Gitea #278] aria-selected on the power chips, unlabelled pack name and
+      // export date inputs were only on these pages.
+      // One page at a time, in order.
+      for (const name of ['Permissions', 'Emojis & Stickers', 'Export']) {
+        // eslint-disable-next-line no-await-in-loop
+        await page.getByRole('dialog').getByText(name, { exact: true }).first().click();
+        // eslint-disable-next-line no-await-in-loop
+        await page.waitForTimeout(1000);
+        // eslint-disable-next-line no-await-in-loop
+        await auditPage(page, `room settings: ${name}`);
+      }
+    });
+
+    test('inbox invites', async ({ page }) => {
+      await page.goto('/inbox/invites/');
+      await expect(page.getByRole('button', { name: /Known|Unknown|Spam/ }).first()).toBeVisible();
+      await auditPage(page, 'inbox invites');
     });
   });
 });

package-lock.json

@@ -81,7 +81,7 @@
       },
       "devDependencies": {
         "@axe-core/playwright": "4.13.0",
-        "@lotusguild/element-call-embedded": "0.25.0-lotus.26",
+        "@lotusguild/element-call-embedded": "0.25.0-lotus.29",
         "@playwright/test": "1.63.0",
         "@rollup/plugin-inject": "5.0.5",
         "@rollup/plugin-wasm": "6.2.2",
@@ -2695,9 +2695,9 @@
       "integrity": "sha512-dfLbk+PwWvFzSxwk3n5ySL0hfBog779o8h68wK/7/APo/7cgyWp5jcXockbxdk5kFRkbeXWm4Fbi9FrdN381sA=="
     },
     "node_modules/@lotusguild/element-call-embedded": {
-      "version": "0.25.0-lotus.26",
-      "resolved": "https://code.lotusguild.org/api/packages/LotusGuild/npm/%40lotusguild%2Felement-call-embedded/-/0.25.0-lotus.26/element-call-embedded-0.25.0-lotus.26.tgz",
-      "integrity": "sha512-u0gFV/ne61MHVkl2JFY6TjC0C/vY2oYTz6dFaDtAmdLUBH6gU+6ar0QOr5xs9bhr4+HT8CSBibU8mLTR+ByjKA==",
+      "version": "0.25.0-lotus.29",
+      "resolved": "https://code.lotusguild.org/api/packages/LotusGuild/npm/%40lotusguild%2Felement-call-embedded/-/0.25.0-lotus.29/element-call-embedded-0.25.0-lotus.29.tgz",
+      "integrity": "sha512-IAIEyiOFfkfb1k2JfBNOkX4LOVaGF8LzeKVQYCqKoyKDVao6rYEYA71LON8ntTaxkredXOK4CeLFsnkCiJHuGg==",
       "dev": true
     },
     "node_modules/@matrix-org/matrix-sdk-crypto-wasm": {

package.json

@@ -12,7 +12,7 @@
     "build": "vite build",
     "preview": "vite preview",
     "lint": "npm run check:eslint && npm run check:prettier",
-    "check:eslint": "eslint src/* --max-warnings 36",
+    "check:eslint": "eslint src/* --max-warnings 29",
     "check:prettier": "prettier --check .",
     "fix:prettier": "prettier --write .",
     "typecheck": "tsc --noEmit",
@@ -108,7 +108,7 @@
   },
   "devDependencies": {
     "@axe-core/playwright": "4.13.0",
-    "@lotusguild/element-call-embedded": "0.25.0-lotus.26",
+    "@lotusguild/element-call-embedded": "0.25.0-lotus.29",
     "@playwright/test": "1.63.0",
     "@rollup/plugin-inject": "5.0.5",
     "@rollup/plugin-wasm": "6.2.2",

src/app/components/ManualVerification.tsx

@@ -82,7 +82,7 @@ export function ManualVerificationMethodSwitcher({
                 <MenuItem
                   size="300"
                   variant="Surface"
-                  aria-selected={value === ManualVerificationMethod.RecoveryPassphrase}
+                  aria-pressed={value === ManualVerificationMethod.RecoveryPassphrase}
                   radii="300"
                   onClick={() => handleSelect(ManualVerificationMethod.RecoveryPassphrase)}
                 >
@@ -93,7 +93,7 @@ export function ManualVerificationMethodSwitcher({
                 <MenuItem
                   size="300"
                   variant="Surface"
-                  aria-selected={value === ManualVerificationMethod.RecoveryKey}
+                  aria-pressed={value === ManualVerificationMethod.RecoveryKey}
                   radii="300"
                   onClick={() => handleSelect(ManualVerificationMethod.RecoveryKey)}
                 >

src/app/components/Modal500.tsx

@@ -7,8 +7,10 @@ import { ScreenSize, useScreenSizeContext } from '../hooks/useScreenSize';
 type Modal500Props = {
   requestClose: () => void;
   children: ReactNode;
+  /** [Gitea #278] The dialog's accessible name (role="dialog" needs one). */
+  label: string;
 };
-export function Modal500({ requestClose, children }: Modal500Props) {
+export function Modal500({ requestClose, children, label }: Modal500Props) {
   const isMobile = useScreenSizeContext() === ScreenSize.Mobile;
   return (
     <Overlay open backdrop={<OverlayBackdrop />}>
@@ -26,6 +28,7 @@ export function Modal500({ requestClose, children }: Modal500Props) {
             variant="Background"
             role="dialog"
             aria-modal="true"
+            aria-label={label}
             // On mobile expand to fill the viewport. On desktop fall back to the
             // folds `size="500"` width (~50rem) — overriding maxWidth here would
             // squish the two-pane settings layout.

src/app/components/SecretStorage.tsx

@@ -1,6 +1,7 @@
 import React, { FormEventHandler, useCallback } from 'react';
 import { Box, Text, Button, Spinner, color } from 'folds';
 import { decodeRecoveryKey, deriveRecoveryKeyFromPassphrase } from 'matrix-js-sdk/lib/crypto-api';
+import type { SecretStorageKeyDescription } from 'matrix-js-sdk/lib/secret-storage';
 import { PasswordInput } from './password-input';
 import {
   SecretStorageKeyContent,
@@ -39,7 +40,10 @@ export function SecretStorageRecoveryPassphrase({
           bits,
         );
 
-        const match = await mx.secretStorage.checkKey(decodedRecoveryKey, keyContent as any);
+        const match = await mx.secretStorage.checkKey(
+          decodedRecoveryKey,
+          keyContent as SecretStorageKeyDescription,
+        );
 
         if (!match) {
           throw new Error('Invalid recovery passphrase.');
@@ -132,7 +136,10 @@ export function SecretStorageRecoveryKey({
       async (recoveryKey) => {
         const decodedRecoveryKey = decodeRecoveryKey(recoveryKey);
 
-        const match = await mx.secretStorage.checkKey(decodedRecoveryKey, keyContent as any);
+        const match = await mx.secretStorage.checkKey(
+          decodedRecoveryKey,
+          keyContent as SecretStorageKeyDescription,
+        );
 
         if (!match) {
           throw new Error('Invalid recovery key.');

src/app/components/editor/Editor.tsx

@@ -117,7 +117,14 @@ export const CustomEditor = forwardRef<HTMLDivElement, CustomEditorProps>(
 
     const renderPlaceholder = useCallback(
       ({ attributes, children }: RenderPlaceholderProps) => (
-        <span {...attributes} className={css.EditorPlaceholderContainer}>
+        <span
+          {...attributes}
+          // [Gitea #278] Slate puts an inline `opacity: 0.333` on the placeholder,
+          // which beat EditorPlaceholderContainer's AA-contrast opacity (#222):
+          // measured 2.66:1. Drop it so the class decides.
+          style={{ ...attributes.style, opacity: undefined }}
+          className={css.EditorPlaceholderContainer}
+        >
           {/* Inner component to style the actual text position and appearance */}
           <Text as="span" className={css.EditorPlaceholderTextVisual} truncate>
             {children}

src/app/components/image-pack-view/UsageSwitcher.tsx

@@ -39,7 +39,7 @@ export function UsageSelector({ selected, onChange }: UsageSelectorProps) {
           key={getUsageStr(usage)}
           size="300"
           variant={isSelected(usage) ? 'SurfaceVariant' : 'Surface'}
-          aria-selected={isSelected(usage)}
+          aria-pressed={isSelected(usage)}
           radii="300"
           onClick={() => onChange(usage)}
         >

src/app/components/time-date/DatePicker.tsx

@@ -69,7 +69,7 @@ export const DatePicker = forwardRef<HTMLDivElement, DatePickerProps>(
                   variant={selectedDay === day ? 'Primary' : 'SurfaceVariant'}
                   fill="None"
                   radii="300"
-                  aria-selected={selectedDay === day}
+                  aria-pressed={selectedDay === day}
                   onClick={() => handleDay(day)}
                   disabled={
                     (selectedYear === minYear && selectedMonth === minMonth && day < minDay) ||
@@ -90,7 +90,7 @@ export const DatePicker = forwardRef<HTMLDivElement, DatePickerProps>(
                   variant={selectedMonth === month ? 'Primary' : 'SurfaceVariant'}
                   fill="None"
                   radii="300"
-                  aria-selected={selectedMonth === month}
+                  aria-pressed={selectedMonth === month}
                   onClick={() => handleMonth(month)}
                   disabled={
                     (selectedYear === minYear && month < minMonth) ||
@@ -115,7 +115,7 @@ export const DatePicker = forwardRef<HTMLDivElement, DatePickerProps>(
                   variant={selectedYear === year ? 'Primary' : 'SurfaceVariant'}
                   fill="None"
                   radii="300"
-                  aria-selected={selectedYear === year}
+                  aria-pressed={selectedYear === year}
                   onClick={() => handleYear(year)}
                 >
                   <Text size="T300">{year}</Text>

src/app/components/time-date/TimePicker.tsx

@@ -71,7 +71,7 @@ export const TimePicker = forwardRef<HTMLDivElement, TimePickerProps>(
                     variant={hour === selectedHour ? 'Primary' : 'Background'}
                     fill="None"
                     radii="300"
-                    aria-selected={hour === selectedHour}
+                    aria-pressed={hour === selectedHour}
                     onClick={() => handleHour(hour)}
                     disabled={(minDay && hour < minHour24) || (maxDay && hour > maxHour24)}
                   >
@@ -90,7 +90,7 @@ export const TimePicker = forwardRef<HTMLDivElement, TimePickerProps>(
                       variant={hour === selectedHour ? 'Primary' : 'Background'}
                       fill="None"
                       radii="300"
-                      aria-selected={hour === selectedHour}
+                      aria-pressed={hour === selectedHour}
                       onClick={() => handleHour(hour)}
                       disabled={
                         (minDay && hour12to24(hour, selectedPM) < minHour24) ||
@@ -109,7 +109,7 @@ export const TimePicker = forwardRef<HTMLDivElement, TimePickerProps>(
                 variant={minute === selectedMinute ? 'Primary' : 'Background'}
                 fill="None"
                 radii="300"
-                aria-selected={minute === selectedMinute}
+                aria-pressed={minute === selectedMinute}
                 onClick={() => handleMinute(minute)}
                 disabled={
                   (minDay && hour24 === minHour24 && minute < minMinute) ||
@@ -127,7 +127,7 @@ export const TimePicker = forwardRef<HTMLDivElement, TimePickerProps>(
                 variant={!selectedPM ? 'Primary' : 'SurfaceVariant'}
                 fill="None"
                 radii="300"
-                aria-selected={!selectedPM}
+                aria-pressed={!selectedPM}
                 onClick={() => handlePeriod(false)}
                 disabled={minDay && minPM}
               >
@@ -138,7 +138,7 @@ export const TimePicker = forwardRef<HTMLDivElement, TimePickerProps>(
                 variant={selectedPM ? 'Primary' : 'SurfaceVariant'}
                 fill="None"
                 radii="300"
-                aria-selected={selectedPM}
+                aria-pressed={selectedPM}
                 onClick={() => handlePeriod(true)}
                 disabled={maxDay && !maxPM}
               >

src/app/components/user-avatar/UserAvatar.tsx

@@ -33,7 +33,9 @@ export function UserAvatar({ className, userId, src, alt, renderFallback }: User
     <AvatarImage
       className={classNames(css.UserAvatar, className)}
       src={src}
-      alt={alt}
+      // [Gitea #278] An avatar sits next to the person's name or inside a
+      // labelled button, so without an explicit alt it is decorative.
+      alt={alt ?? ''}
       onError={() => setError(true)}
       onLoad={handleLoad}
       draggable={false}

src/app/features/bookmarks/BookmarksPanel.css.ts

@@ -1,10 +1,11 @@
 import { style } from '@vanilla-extract/css';
-import { config, toRem } from 'folds';
+import { config } from 'folds';
+import { SIDE_PANEL_WIDTH } from '../../styles/sidePanel';
 
-// Mirrors MembersDrawer: a 266px side panel on desktop that becomes a
+// Mirrors MembersDrawer: a side panel (shared width) on desktop that becomes a
 // full-screen fixed panel on narrow viewports — the app's canonical drawer.
 export const BookmarksPanel = style({
-  width: toRem(266),
+  width: SIDE_PANEL_WIDTH,
   '@media': {
     '(max-width: 750px)': {
       position: 'fixed',

src/app/features/call-summary/CallSummaryDialog.tsx

@@ -0,0 +1,84 @@
+import React from 'react';
+import FocusTrap from 'focus-trap-react';
+import {
+  Box,
+  config,
+  Dialog,
+  Header,
+  Icon,
+  IconButton,
+  Icons,
+  Overlay,
+  OverlayBackdrop,
+  OverlayCenter,
+  Text,
+} from 'folds';
+import { useAtom } from 'jotai';
+import { callSummaryViewAtom } from '../../state/callSummary';
+import { useModalStyle } from '../../hooks/useModalStyle';
+import { stopPropagation } from '../../utils/keyboard';
+
+/**
+ * [Gitea #253] The post-call "Details" card: opened from the call-ended toast,
+ * shows who was in the call, connection quality and whose side it was on,
+ * network numbers and your own activity (technical wording).
+ */
+export function CallSummaryDialog() {
+  const [view, setView] = useAtom(callSummaryViewAtom);
+  const modalStyle = useModalStyle(400);
+  if (!view) return null;
+  const close = () => setView(undefined);
+  return (
+    <Overlay open backdrop={<OverlayBackdrop />}>
+      <OverlayCenter>
+        <FocusTrap
+          focusTrapOptions={{
+            initialFocus: false,
+            onDeactivate: close,
+            clickOutsideDeactivates: true,
+            escapeDeactivates: stopPropagation,
+          }}
+        >
+          <Dialog
+            variant="Surface"
+            role="dialog"
+            aria-modal="true"
+            aria-labelledby="call-summary-title"
+            style={modalStyle}
+          >
+            <Header
+              variant="Surface"
+              size="500"
+              style={{
+                padding: `0 ${config.space.S200} 0 ${config.space.S400}`,
+                borderBottomWidth: config.borderWidth.B300,
+              }}
+            >
+              <Box grow="Yes" alignItems="Center" gap="200">
+                <Icon src={Icons.Phone} size="100" />
+                <Text id="call-summary-title" size="H4" truncate>
+                  Call summary · {view.roomName}
+                </Text>
+              </Box>
+              <IconButton size="300" radii="300" onClick={close} aria-label="Close">
+                <Icon src={Icons.Cross} />
+              </IconButton>
+            </Header>
+            <Box direction="Column" gap="400" style={{ padding: config.space.S400 }}>
+              {view.sections.map((section) => (
+                <Box key={section.title} direction="Column" gap="100">
+                  <Text size="L400">{section.title}</Text>
+                  {section.lines.map((line) => (
+                    <Text key={line} size="T300" style={{ fontVariantNumeric: 'tabular-nums' }}>
+                      {line}
+                    </Text>
+                  ))}
+                </Box>
+              ))}
+            </Box>
+          </Dialog>
+        </FocusTrap>
+      </OverlayCenter>
+    </Overlay>
+  );
+}

src/app/features/call/CallControls.tsx

@@ -44,6 +44,7 @@ import { stopPropagation } from '../../utils/keyboard';
 import { AsyncStatus, useAsyncCallback } from '../../hooks/useAsyncCallback';
 import { useCallEmbedRef } from '../../hooks/useCallEmbed';
 import { pttActiveAtom } from '../../hooks/useCallHotkeys';
+import { SCREENSHARE_AUDIO_STATE } from '../../plugins/call/CallControl';
 import { CallSoundboard } from './CallSoundboard';
 import { useRoomCallPolicy } from '../../hooks/useRoomCallPolicy';
 import { ScreenshareConfirm } from './ScreenshareConfirm';
@@ -90,6 +91,21 @@ export function CallControls({ callEmbed }: CallControlsProps) {
 
   const { microphone, video, sound, screenshare, spotlight, screenshareAudioMuted } =
     useCallControlState(callEmbed.control);
+  // [Gitea #277] Only offer "Mute Screenshare Audio" while a remote share's
+  // audio is playing, or while it is muted (so a hidden mute can't silently
+  // swallow the next share).
+  const [remoteScreenshareAudio, setRemoteScreenshareAudio] = useState(
+    callEmbed.control.remoteScreenshareAudio,
+  );
+  useEffect(() => {
+    const onState = () => setRemoteScreenshareAudio(callEmbed.control.remoteScreenshareAudio);
+    onState();
+    callEmbed.control.on(SCREENSHARE_AUDIO_STATE, onState);
+    return () => {
+      callEmbed.control.off(SCREENSHARE_AUDIO_STATE, onState);
+    };
+  }, [callEmbed]);
+  const showScreenshareAudio = remoteScreenshareAudio || screenshareAudioMuted;
   const micLevel = useCallMicLevel(callEmbed);
 
   const [cords, setCords] = useState<RectCords>();
@@ -122,6 +138,8 @@ export function CallControls({ callEmbed }: CallControlsProps) {
   };
   const showScreenshare = allowScreenshare || screenshare;
   const showVideoGroup = showCamera || showScreenshare || !!document.fullscreenEnabled;
+  // [Gitea #265] Phones can't share their screen from a browser; don't offer it.
+  const canShareScreen = typeof navigator.mediaDevices?.getDisplayMedia === 'function';
   const handleOpenMenu: MouseEventHandler<HTMLButtonElement> = (evt) => {
     setCords(evt.currentTarget.getBoundingClientRect());
   };
@@ -166,6 +184,111 @@ export function CallControls({ callEmbed }: CallControlsProps) {
     return () => clearTimeout(id);
   }, [hangupState.status, callEmbed, setCallEmbed]);
 
+  const moreMenu = (
+    <PopOut
+      anchor={cords}
+      position="Top"
+      align="Center"
+      content={
+        <FocusTrap
+          focusTrapOptions={{
+            initialFocus: false,
+            onDeactivate: () => setCords(undefined),
+            clickOutsideDeactivates: true,
+            isKeyForward: (evt: KeyboardEvent) => evt.key === 'ArrowDown',
+            isKeyBackward: (evt: KeyboardEvent) => evt.key === 'ArrowUp',
+            escapeDeactivates: stopPropagation,
+          }}
+        >
+          <Menu>
+            <Box direction="Column" style={{ padding: config.space.S100 }}>
+              {compact && showScreenshare && screenshareMode !== 'hidden' && canShareScreen && (
+                <MenuItem
+                  size="300"
+                  variant="Surface"
+                  radii="300"
+                  onClick={() => {
+                    setCords(undefined);
+                    handleScreenshareToggle();
+                  }}
+                >
+                  <Text size="B300" truncate>
+                    {screenshare ? 'Stop Screenshare' : 'Share Screen'}
+                  </Text>
+                </MenuItem>
+              )}
+              {compact && showScreenshareAudio && (
+                <MenuItem
+                  size="300"
+                  variant="Surface"
+                  radii="300"
+                  onClick={() => {
+                    setCords(undefined);
+                    callEmbed.control.toggleScreenshareAudio();
+                  }}
+                >
+                  <Text size="B300" truncate>
+                    {screenshareAudioMuted ? 'Unmute Screenshare Audio' : 'Mute Screenshare Audio'}
+                  </Text>
+                </MenuItem>
+              )}
+              {compact && !!document.fullscreenEnabled && (
+                <MenuItem
+                  size="300"
+                  variant="Surface"
+                  radii="300"
+                  onClick={() => {
+                    setCords(undefined);
+                    handleFullscreen();
+                  }}
+                >
+                  <Text size="B300" truncate>
+                    {isFullscreen ? 'Exit Fullscreen' : 'Fullscreen'}
+                  </Text>
+                </MenuItem>
+              )}
+              <MenuItem size="300" variant="Surface" radii="300" onClick={handleSpotlightClick}>
+                <Text size="B300" truncate>
+                  {spotlight ? 'Grid View' : 'Spotlight View'}
+                </Text>
+              </MenuItem>
+              <MenuItem size="300" variant="Surface" radii="300" onClick={handleReactionsClick}>
+                <Text size="B300" truncate>
+                  Reactions
+                </Text>
+              </MenuItem>
+              <MenuItem size="300" variant="Surface" radii="300" onClick={handleSettingsClick}>
+                <Text size="B300" truncate>
+                  Settings
+                </Text>
+              </MenuItem>
+            </Box>
+          </Menu>
+        </FocusTrap>
+      }
+    >
+      <IconButton
+        variant="Surface"
+        fill="Soft"
+        radii="400"
+        size="400"
+        onClick={handleOpenMenu}
+        outlined
+        aria-label="More options"
+        aria-expanded={!!cords}
+        aria-haspopup="menu"
+      >
+        <Icon size="400" src={Icons.VerticalDots} />
+      </IconButton>
+    </PopOut>
+  );
+
+  const hangupIcon = exiting ? (
+    <Spinner variant="Critical" fill="Solid" size="200" />
+  ) : (
+    <Icon src={Icons.PhoneDown} size="200" filled />
+  );
+
   const pttKeyLabel = pttKey === 'Space' ? 'SPACE' : pttKey.replace('Key', '').replace('Digit', '');
 
   return (
@@ -204,144 +327,114 @@ export function CallControls({ callEmbed }: CallControlsProps) {
         }}
         onCancel={() => setShareConfirm(false)}
       />
-      <SequenceCard
-        className={css.ControlCard}
-        variant="SurfaceVariant"
-        gap="400"
-        radii="500"
-        alignItems="Center"
-        justifyContent="SpaceBetween"
-        wrap="Wrap"
-      >
-        <Box alignItems="Center" gap="Inherit" grow="Yes" direction={compact ? 'Column' : 'Row'}>
-          <Box shrink="No" alignItems="Inherit" justifyContent="Inherit" gap="200">
-            <MicrophoneButton
-              enabled={microphone}
-              onToggle={handleMicrophoneToggle}
-              level={micLevel}
-            />
-            <SoundButton enabled={sound} onToggle={() => callEmbed.control.toggleSound()} />
-          </Box>
-          {!compact && showVideoGroup && <ControlDivider />}
-          {showVideoGroup && (
+      {compact ? (
+        // [Gitea #265] Phones / narrow windows: ONE row. Screenshare, its audio
+        // mute and fullscreen live in More (they rarely matter on a phone), and
+        // End is icon-only. The old stacked layout took four rows (~40% of a
+        // portrait phone).
+        <SequenceCard
+          className={css.ControlCard}
+          variant="SurfaceVariant"
+          gap="200"
+          radii="500"
+          alignItems="Center"
+          justifyContent="SpaceBetween"
+          wrap="NoWrap"
+        >
+          <MicrophoneButton
+            enabled={microphone}
+            onToggle={handleMicrophoneToggle}
+            level={micLevel}
+          />
+          <SoundButton enabled={sound} onToggle={() => callEmbed.control.toggleSound()} />
+          {showCamera && <VideoButton enabled={video} onToggle={handleVideoToggle} />}
+          <ChatButton />
+          {soundboardEnabled && <CallSoundboard callEmbed={callEmbed} />}
+          {moreMenu}
+          <Button
+            variant="Critical"
+            fill="Solid"
+            radii="400"
+            size="400"
+            onClick={hangup}
+            disabled={exiting}
+            aria-label="End Call"
+            style={{ paddingInline: config.space.S300 }}
+          >
+            {hangupIcon}
+          </Button>
+        </SequenceCard>
+      ) : (
+        <SequenceCard
+          className={css.ControlCard}
+          variant="SurfaceVariant"
+          gap="400"
+          radii="500"
+          alignItems="Center"
+          justifyContent="SpaceBetween"
+          wrap="Wrap"
+        >
+          <Box alignItems="Center" gap="Inherit" grow="Yes">
             <Box shrink="No" alignItems="Inherit" justifyContent="Inherit" gap="200">
-              {/* Show a forbidden control while its track is still live so the
-                  user can stop it; once stopped it hides and can't be restarted. */}
-              {showCamera && <VideoButton enabled={video} onToggle={handleVideoToggle} />}
-              {showScreenshare && (
-                <>
-                  {screenshareMode !== 'hidden' && (
-                    <ScreenShareButton
-                      enabled={screenshare}
-                      onToggle={() => handleScreenshareToggle()}
-                    />
-                  )}
-                  {/* Mute-screenshare-audio sits directly next to the screenshare
-                      control since they're the same concern. */}
-                  <ScreenshareAudioButton
-                    muted={screenshareAudioMuted}
-                    onToggle={() => callEmbed.control.toggleScreenshareAudio()}
-                  />
-                </>
-              )}
-              {!!document.fullscreenEnabled && (
-                <FullscreenButton isFullscreen={isFullscreen} onToggle={handleFullscreen} />
-              )}
+              <MicrophoneButton
+                enabled={microphone}
+                onToggle={handleMicrophoneToggle}
+                level={micLevel}
+              />
+              <SoundButton enabled={sound} onToggle={() => callEmbed.control.toggleSound()} />
             </Box>
-          )}
-        </Box>
-        {!compact && <ControlDivider />}
-        <Box alignItems="Center" gap="Inherit" grow="Yes" direction={compact ? 'Column' : 'Row'}>
-          <Box shrink="No" alignItems="Inherit" justifyContent="Inherit" gap="200">
-            <ChatButton />
-            {soundboardEnabled && <CallSoundboard callEmbed={callEmbed} />}
-            <PopOut
-              anchor={cords}
-              position="Top"
-              align="Center"
-              content={
-                <FocusTrap
-                  focusTrapOptions={{
-                    initialFocus: false,
-                    onDeactivate: () => setCords(undefined),
-                    clickOutsideDeactivates: true,
-                    isKeyForward: (evt: KeyboardEvent) => evt.key === 'ArrowDown',
-                    isKeyBackward: (evt: KeyboardEvent) => evt.key === 'ArrowUp',
-                    escapeDeactivates: stopPropagation,
-                  }}
-                >
-                  <Menu>
-                    <Box direction="Column" style={{ padding: config.space.S100 }}>
-                      <MenuItem
-                        size="300"
-                        variant="Surface"
-                        radii="300"
-                        onClick={handleSpotlightClick}
-                      >
-                        <Text size="B300" truncate>
-                          {spotlight ? 'Grid View' : 'Spotlight View'}
-                        </Text>
-                      </MenuItem>
-                      <MenuItem
-                        size="300"
-                        variant="Surface"
-                        radii="300"
-                        onClick={handleReactionsClick}
-                      >
-                        <Text size="B300" truncate>
-                          Reactions
-                        </Text>
-                      </MenuItem>
-                      <MenuItem
-                        size="300"
-                        variant="Surface"
-                        radii="300"
-                        onClick={handleSettingsClick}
-                      >
-                        <Text size="B300" truncate>
-                          Settings
-                        </Text>
-                      </MenuItem>
-                    </Box>
-                  </Menu>
-                </FocusTrap>
-              }
-            >
-              <IconButton
-                variant="Surface"
-                fill="Soft"
-                radii="400"
-                size="400"
-                onClick={handleOpenMenu}
-                outlined
-                aria-label="More options"
-                aria-expanded={!!cords}
-                aria-haspopup="menu"
+            {showVideoGroup && <ControlDivider />}
+            {showVideoGroup && (
+              <Box shrink="No" alignItems="Inherit" justifyContent="Inherit" gap="200">
+                {/* Show a forbidden control while its track is still live so the
+                    user can stop it; once stopped it hides and can't be restarted. */}
+                {showCamera && <VideoButton enabled={video} onToggle={handleVideoToggle} />}
+                {showScreenshare && (
+                  <>
+                    {screenshareMode !== 'hidden' && (
+                      <ScreenShareButton
+                        enabled={screenshare}
+                        onToggle={() => handleScreenshareToggle()}
+                      />
+                    )}
+                    {/* Mute-screenshare-audio sits directly next to the screenshare
+                        control since they're the same concern. */}
+                    {showScreenshareAudio && (
+                      <ScreenshareAudioButton
+                        muted={screenshareAudioMuted}
+                        onToggle={() => callEmbed.control.toggleScreenshareAudio()}
+                      />
+                    )}
+                  </>
+                )}
+                {!!document.fullscreenEnabled && (
+                  <FullscreenButton isFullscreen={isFullscreen} onToggle={handleFullscreen} />
+                )}
+              </Box>
+            )}
+          </Box>
+          <ControlDivider />
+          <Box alignItems="Center" gap="Inherit" grow="Yes">
+            <Box shrink="No" alignItems="Inherit" justifyContent="Inherit" gap="200">
+              <ChatButton />
+              {soundboardEnabled && <CallSoundboard callEmbed={callEmbed} />}
+              {moreMenu}
+            </Box>
+            <Box shrink="No" direction="Column">
+              <Button
+                style={{ minWidth: toRem(88) }}
+                variant="Critical"
+                fill="Solid"
+                onClick={hangup}
+                before={hangupIcon}
+                disabled={exiting}
               >
-                <Icon size="400" src={Icons.VerticalDots} />
-              </IconButton>
-            </PopOut>
+                <Text size="B400">End</Text>
+              </Button>
+            </Box>
           </Box>
-          <Box shrink="No" direction="Column">
-            <Button
-              style={{ minWidth: toRem(88) }}
-              variant="Critical"
-              fill="Solid"
-              onClick={hangup}
-              before={
-                exiting ? (
-                  <Spinner variant="Critical" fill="Solid" size="200" />
-                ) : (
-                  <Icon src={Icons.PhoneDown} size="200" filled />
-                )
-              }
-              disabled={exiting}
-            >
-              <Text size="B400">End</Text>
-            </Button>
-          </Box>
-        </Box>
-      </SequenceCard>
+        </SequenceCard>
+      )}
     </Box>
   );
 }

src/app/features/common-settings/developer-tools/DevelopTools.tsx

@@ -30,6 +30,7 @@ import {
   AccountDataSubmitCallback,
 } from '../../../components/AccountDataEditor';
 import { useMatrixClient } from '../../../hooks/useMatrixClient';
+import { setRoomAccountData } from '../../../utils/accountData';
 
 type DeveloperToolsProps = {
   requestClose: () => void;
@@ -58,8 +59,7 @@ export function DeveloperTools({ requestClose }: DeveloperToolsProps) {
 
   const submitAccountData: AccountDataSubmitCallback = useCallback(
     async (type, content) => {
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-      await mx.setRoomAccountData(room.roomId, type as any, content);
+      await setRoomAccountData(mx, room.roomId, type, content);
     },
     [mx, room.roomId],
   );

src/app/features/common-settings/developer-tools/SendRoomEvent.tsx

@@ -1,5 +1,5 @@
 import React, { useCallback, useRef, useState, FormEventHandler, useEffect } from 'react';
-import { MatrixError } from 'matrix-js-sdk';
+import { IContent, MatrixError } from 'matrix-js-sdk';
 import {
   Box,
   Chip,
@@ -22,6 +22,7 @@ import { useTextAreaCodeEditor } from '../../../hooks/useTextAreaCodeEditor';
 import { AsyncStatus, useAsyncCallback } from '../../../hooks/useAsyncCallback';
 import { syntaxErrorPosition } from '../../../utils/dom';
 import { Cursor } from '../../../plugins/text-area';
+import { sendRoomEvent, sendStateEvent } from '../../../utils/room';
 
 const EDITOR_INTENT_SPACE_COUNT = 2;
 
@@ -51,9 +52,9 @@ export function SendRoomEvent({ type, stateKey, requestClose }: SendRoomEventPro
     useCallback(
       (evtType, evtStateKey, evtContent) => {
         if (typeof evtStateKey === 'string') {
-          return mx.sendStateEvent(room.roomId, evtType as any, evtContent, evtStateKey);
+          return sendStateEvent(mx, room.roomId, evtType, evtContent, evtStateKey);
         }
-        return mx.sendEvent(room.roomId, evtType as any, evtContent);
+        return sendRoomEvent(mx, room.roomId, null, evtType, evtContent as IContent);
       },
       [mx, room],
     ),

src/app/features/common-settings/developer-tools/StateEventEditor.tsx

@@ -31,6 +31,7 @@ import { usePowerLevels } from '../../../hooks/usePowerLevels';
 import { useTextAreaCodeEditor } from '../../../hooks/useTextAreaCodeEditor';
 import { useRoomCreators } from '../../../hooks/useRoomCreators';
 import { useRoomPermissions } from '../../../hooks/useRoomPermissions';
+import { sendStateEvent } from '../../../utils/room';
 
 const EDITOR_INTENT_SPACE_COUNT = 2;
 
@@ -59,7 +60,7 @@ function StateEventEdit({ type, stateKey, content, requestClose }: StateEventEdi
 
   const [submitState, submit] = useAsyncCallback<object, MatrixError, [object]>(
     useCallback(
-      (c) => mx.sendStateEvent(room.roomId, type as any, c, stateKey),
+      (c) => sendStateEvent(mx, room.roomId, type, c, stateKey),
       [mx, room, type, stateKey],
     ),
   );

src/app/features/common-settings/emojis-stickers/RoomPacks.tsx

@@ -109,8 +109,11 @@ function CreatePackTile({ packs, roomId }: CreatePackTileProps) {
           alignItems="End"
         >
           <Box direction="Column" gap="100" grow="Yes">
-            <Text size="L400">Name</Text>
+            <Text as="label" htmlFor="room-pack-name" size="L400">
+              Name
+            </Text>
             <Input
+              id="room-pack-name"
               name="nameInput"
               required
               size="400"

src/app/features/common-settings/permissions/PermissionGroups.tsx

@@ -136,7 +136,8 @@ export function PermissionGroups({
                     outlined={powerChanges}
                     fill="Soft"
                     radii="Pill"
-                    aria-selected={opened}
+                    aria-haspopup="menu"
+                    aria-expanded={opened}
                     disabled={!canEdit || applyingChanges}
                     after={
                       powerChanges && (
@@ -200,7 +201,8 @@ export function PermissionGroups({
                           outlined={powerChanges}
                           fill="Soft"
                           radii="Pill"
-                          aria-selected={opened}
+                          aria-haspopup="menu"
+                          aria-expanded={opened}
                           disabled={!canEdit || applyingChanges}
                           after={
                             powerChanges && (

src/app/features/common-settings/soundboard/Soundboard.tsx

@@ -38,10 +38,14 @@ export function Soundboard({ requestClose }: SoundboardProps) {
           <PageContent>
             <Box direction="Column" gap="700">
               <Box direction="Column" gap="200">
-                <Text size="L400">This room / space (shared)</Text>
+                <Text size="L400">
+                  {room?.isSpaceRoom() ? 'This space (shared)' : 'This room (shared)'}
+                </Text>
                 <Text size="T200" priority="300">
-                  Clips here are shared with everyone, and inherited by every room under this space
-                  — just like emoji/sticker packs. Only members with permission can edit.
+                  {/* [Gitea #279] Only a space's clips are inherited by rooms under it. */}
+                  {room?.isSpaceRoom()
+                    ? 'Clips here are shared with everyone, and inherited by every room under this space — just like emoji/sticker packs. Only members with permission can edit.'
+                    : 'Clips here are shared with everyone in this room — just like emoji/sticker packs. Only members with permission can edit.'}
                 </Text>
                 {room && <RoomSoundboardPack room={room} stateKey="" />}
               </Box>

src/app/features/outbox/OutboxFeature.tsx

@@ -94,10 +94,15 @@ export function OutboxFeature() {
       OFFLINE.has(mx.getSyncState()) ||
       (typeof navigator !== 'undefined' && navigator.onLine === false);
 
-    const persist = (next: OutboxEntry[]) => {
-      if (next === entries) return;
+    // [Gitea #268] Read-modify-write: another tab may have queued or cleared
+    // entries since we last looked, and saving our own copy over the key
+    // would drop theirs. Entries are added/removed by txnId, so applying our
+    // change to the stored list merges cleanly.
+    const persist = (update: (list: OutboxEntry[]) => OutboxEntry[]) => {
+      const stored = loadOutbox(userId);
+      const next = update(stored);
       entries = next;
-      saveOutbox(userId, entries);
+      if (next !== stored) saveOutbox(userId, next);
     };
 
     /**
@@ -123,8 +128,8 @@ export function OutboxFeature() {
         if (!shouldKeepInOutbox(event.getType(), event.getContent())) return;
         live.set(txnId, { event, room });
         if (event.status === EventStatus.NOT_SENT) scheduleBlipRetry(event);
-        persist(
-          withEntry(entries, {
+        persist((list) =>
+          withEntry(list, {
             txnId,
             roomId: room.roomId,
             threadId: event.threadRootId ?? null,
@@ -138,7 +143,7 @@ export function OutboxFeature() {
       // SENT, CANCELLED, or the remote echo replaced it (status null).
       live.delete(txnId);
       autoRetries.delete(txnId);
-      persist(withoutEntry(entries, txnId));
+      persist((list) => withoutEntry(list, txnId));
     };
 
     /** Re-send network failures, oldest first; a room stops at its first failure. */
@@ -191,7 +196,7 @@ export function OutboxFeature() {
           return !!room && isDelivered(room, entry.txnId);
         },
       );
-      plan.drop.forEach((entry) => persist(withoutEntry(entries, entry.txnId)));
+      plan.drop.forEach((entry) => persist((list) => withoutEntry(list, entry.txnId)));
       plan.restore.forEach((entry) => {
         const room = mx.getRoom(entry.roomId);
         if (!room || live.has(entry.txnId)) return;

src/app/features/room-settings/ExportRoomHistory.tsx

@@ -353,8 +353,11 @@ ${msgRows}
                 >
                   <Box gap="400" wrap="Wrap">
                     <Box direction="Column" gap="100" style={{ flex: 1, minWidth: 160 }}>
-                      <Text size="T300">From</Text>
+                      <Text as="label" htmlFor="export-from-date" size="T300">
+                        From
+                      </Text>
                       <Input
+                        id="export-from-date"
                         type="date"
                         variant="Secondary"
                         size="400"
@@ -364,8 +367,11 @@ ${msgRows}
                       />
                     </Box>
                     <Box direction="Column" gap="100" style={{ flex: 1, minWidth: 160 }}>
-                      <Text size="T300">To</Text>
+                      <Text as="label" htmlFor="export-to-date" size="T300">
+                        To
+                      </Text>
                       <Input
+                        id="export-to-date"
                         type="date"
                         variant="Secondary"
                         size="400"

src/app/features/room-settings/RoomSettingsRenderer.tsx

@@ -21,7 +21,7 @@ function RenderSettings({ state }: RenderSettingsProps) {
   if (!room) return null;
 
   return (
-    <Modal500 requestClose={closeSettings}>
+    <Modal500 requestClose={closeSettings} label={`${room.name} settings`}>
       <SpaceProvider value={space ?? null}>
         <RoomProvider value={room}>
           <RoomSettings initialPage={page} requestClose={closeSettings} />

src/app/features/room/MediaGallery.css.ts

@@ -1,13 +1,13 @@
 import { style } from '@vanilla-extract/css';
 import { color, config, toRem } from 'folds';
+import { SIDE_PANEL_WIDTH } from '../../styles/sidePanel';
 
 // Right-side drawer DOCKED into the room layout row (a flex sibling of the
-// timeline), exactly like MembersDrawer — not a floating overlay. 320px is a
-// little wider than the 266px member/bookmark drawers because it hosts a media
-// grid. On narrow viewports it becomes a full-screen fixed panel, matching the
-// app's other drawers.
+// timeline), exactly like MembersDrawer — not a floating overlay. Same width as
+// every other right-hand panel (styles/sidePanel.ts, #263). On narrow viewports
+// it becomes a full-screen fixed panel, matching the app's other drawers.
 export const MediaGalleryDrawer = style({
-  width: toRem(320),
+  width: SIDE_PANEL_WIDTH,
   overflow: 'hidden',
   '@media': {
     '(max-width: 750px)': {

src/app/features/room/MembersDrawer.css.ts

@@ -1,8 +1,9 @@
 import { keyframes, style } from '@vanilla-extract/css';
-import { config, toRem } from 'folds';
+import { config } from 'folds';
+import { SIDE_PANEL_WIDTH } from '../../styles/sidePanel';
 
 export const MembersDrawer = style({
-  width: toRem(266),
+  width: SIDE_PANEL_WIDTH,
   '@media': {
     '(max-width: 750px)': {
       position: 'fixed',

src/app/features/room/ScheduleMessageModal.tsx

@@ -20,7 +20,12 @@ import { IContent } from 'matrix-js-sdk';
 import { useTimestampFormatter } from '../../hooks/useTimestampFormatter';
 import { useMatrixClient } from '../../hooks/useMatrixClient';
 import { stopPropagation } from '../../utils/keyboard';
-import { scheduleMessage } from '../../utils/scheduledMessages';
+import {
+  describeScheduleError,
+  MAX_SCHEDULE_AHEAD_MS,
+  scheduleMessage,
+  SCHEDULE_TOO_FAR_TEXT,
+} from '../../utils/scheduledMessages';
 import { useModalStyle } from '../../hooks/useModalStyle';
 import {
   toLocalDate,
@@ -121,7 +126,13 @@ export function ScheduleMessageModal({
       return;
     }
     const diffMs = sendAt.getTime() - Date.now();
-    if (diffMs < 60_000) {
+    // [Gitea #275] Say so as soon as a too-late time is picked, not on submit.
+    const tooFar = diffMs > MAX_SCHEDULE_AHEAD_MS;
+    setError((e) => {
+      if (tooFar) return SCHEDULE_TOO_FAR_TEXT;
+      return e === SCHEDULE_TOO_FAR_TEXT ? null : e;
+    });
+    if (diffMs < 60_000 || tooFar) {
       setPreview(null);
       return;
     }
@@ -149,6 +160,10 @@ export function ScheduleMessageModal({
       setError('Scheduled time must be at least 1 minute in the future.');
       return;
     }
+    if (diffMs > MAX_SCHEDULE_AHEAD_MS) {
+      setError(SCHEDULE_TOO_FAR_TEXT);
+      return;
+    }
     if (!messageText.trim()) {
       setError('Please enter a message to schedule.');
       return;
@@ -162,7 +177,7 @@ export function ScheduleMessageModal({
       onScheduled(delayId, sendAt.getTime(), content);
       onClose();
     } catch (err) {
-      setError(err instanceof Error ? err.message : 'Failed to schedule message.');
+      setError(describeScheduleError(err));
       setSubmitting(false);
     }
   };
@@ -247,6 +262,8 @@ export function ScheduleMessageModal({
                     <input
                       id="schedule-date"
                       type="date"
+                      min={toLocalDate(new Date())}
+                      max={toLocalDate(new Date(Date.now() + MAX_SCHEDULE_AHEAD_MS))}
                       value={dateValue}
                       onChange={(e) => setDateValue(e.target.value)}
                       style={pickerInputStyle(color, config)}
@@ -294,7 +311,8 @@ export function ScheduleMessageModal({
                   </Box>
                 </Box>
               ) : (
-                (dateValue || timeValue) && (
+                (dateValue || timeValue) &&
+                error !== SCHEDULE_TOO_FAR_TEXT && (
                   <Text size="T200" style={{ color: color.Critical.Main }}>
                     Must be at least 1 minute in the future
                   </Text>

src/app/features/room/message/styles.css.ts

@@ -1,4 +1,4 @@
-import { style } from '@vanilla-extract/css';
+import { globalStyle, style } from '@vanilla-extract/css';
 import { DefaultReset, FocusOutline, color, config, toRem } from 'folds';
 
 export const MessageBase = style({
@@ -77,3 +77,14 @@ export const ReactionsMore = style([
 export const ReactionsTooltipText = style({
   wordBreak: 'break-word',
 });
+
+// [Gitea #199] Long-press opens the message action sheet on touch screens. On
+// iOS a long-press otherwise belongs to the system: a link/image callout, or
+// the text-selection loupe, both of which race (and win against) the 450 ms
+// press. No callout on message rows, and no selection while a finger is
+// down; copying text is in the sheet.
+globalStyle('[data-touch-actions]', { WebkitTouchCallout: 'none' });
+globalStyle('[data-touch-actions][data-pressing], [data-touch-actions][data-pressing] *', {
+  userSelect: 'none',
+  WebkitUserSelect: 'none',
+});

src/app/features/room/room-pin-menu/RoomPinMenu.tsx

@@ -531,7 +531,7 @@ export const RoomPinMenu = forwardRef<HTMLDivElement, RoomPinMenuProps>(
                         No Pinned Messages
                       </Text>
                       <Text size="T400" align="Center">
-                        Users with sufficient power level can pin a messages from its context menu.
+                        Users with sufficient power level can pin a message from its context menu.
                       </Text>
                     </Box>
                   </Box>

src/app/features/room/thread/ThreadPanel.css.ts

@@ -1,8 +1,9 @@
 import { style } from '@vanilla-extract/css';
-import { config, toRem } from 'folds';
+import { config } from 'folds';
+import { SIDE_PANEL_WIDTH } from '../../../styles/sidePanel';
 
 export const ThreadPanel = style({
-  width: toRem(360),
+  width: SIDE_PANEL_WIDTH,
   '@media': {
     '(max-width: 750px)': {
       position: 'fixed',

src/app/features/room/thread/ThreadsListPanel.css.ts

@@ -1,8 +1,9 @@
 import { style } from '@vanilla-extract/css';
-import { color, config, toRem } from 'folds';
+import { color, config } from 'folds';
+import { SIDE_PANEL_WIDTH } from '../../../styles/sidePanel';
 
 export const ThreadsListPanel = style({
-  width: toRem(340),
+  width: SIDE_PANEL_WIDTH,
   '@media': {
     '(max-width: 750px)': {
       position: 'fixed',

src/app/features/room/widgets/RoomWidgetView.tsx

@@ -11,7 +11,7 @@ import {
 import { Capability, ClientWidgetApi, IRoomEvent, Widget } from 'matrix-widget-api';
 import { useMatrixClient } from '../../../hooks/useMatrixClient';
 import { GeneralWidgetDriver } from './GeneralWidgetDriver';
-import { WidgetPermissionRequest, isWidgetUrlSafe } from './widgetUtils';
+import { WidgetPermissionRequest, isWidgetUrlSafe, widgetCompleteUrl } from './widgetUtils';
 import { restrictWidgetMessages } from '../../../plugins/widgetTransport';
 import { WidgetPermissionPrompt } from './WidgetPermissionPrompt';
 import { isFromFilteredTimelineSet } from '../../../utils/room';
@@ -46,12 +46,7 @@ export function RoomWidgetView({ room, widget }: RoomWidgetViewProps) {
     if (!container) return undefined;
     const current = widgetRef.current;
 
-    const completeUrl = current.getCompleteUrl({
-      currentUserId: mx.getSafeUserId(),
-      widgetRoomId: room.roomId,
-      deviceId: mx.getDeviceId() ?? undefined,
-      baseUrl: mx.baseUrl,
-    });
+    const completeUrl = widgetCompleteUrl(current, mx, room.roomId);
 
     // Security: never render a same-origin widget with allow-same-origin (a
     // same-origin frame could break out of the sandbox against our own origin).

src/app/features/room/widgets/WidgetsPanel.css.ts

@@ -1,8 +1,9 @@
 import { style } from '@vanilla-extract/css';
-import { config, toRem } from 'folds';
+import { config } from 'folds';
+import { SIDE_PANEL_WIDTH } from '../../../styles/sidePanel';
 
 export const WidgetsPanel = style({
-  width: toRem(360),
+  width: SIDE_PANEL_WIDTH,
   '@media': {
     '(max-width: 750px)': {
       position: 'fixed',

src/app/features/room/widgets/WidgetsPanel.tsx

@@ -27,7 +27,13 @@ import { useRoomCreators } from '../../../hooks/useRoomCreators';
 import { useRoomPermissions } from '../../../hooks/useRoomPermissions';
 import { StateEvent } from '../../../../types/matrix/room';
 import { sendStateEvent } from '../../../utils/room';
-import { generateWidgetId, validateWidgetUrl, WidgetUrlError } from './widgetUtils';
+import {
+  generateWidgetId,
+  validateWidgetUrl,
+  widgetCompleteUrl,
+  widgetPopoutUrl,
+  WidgetUrlError,
+} from './widgetUtils';
 
 const urlErrorMessage = (err: WidgetUrlError): string => {
   switch (err) {
@@ -60,6 +66,14 @@ export function WidgetsPanel({ room, requestClose }: WidgetsPanelProps) {
   const [error, setError] = useState<string>();
 
   const viewing = widgets.find((w) => w.id === viewingId) ?? null;
+  // [Gitea #205] Open a widget in its own window, beside the chat. It runs
+  // standalone there (no widget API), as in Element's popout.
+  const popoutUrl = (widget: (typeof widgets)[number]) =>
+    widgetPopoutUrl(widgetCompleteUrl(widget, mx, room.roomId), window.location.origin);
+  const popout = (widget: (typeof widgets)[number]) => {
+    const url = popoutUrl(widget);
+    if (url) window.open(url, '_blank', 'noopener,noreferrer');
+  };
 
   const handleAdd: FormEventHandler<HTMLFormElement> = async (evt) => {
     evt.preventDefault();
@@ -144,7 +158,13 @@ export function WidgetsPanel({ room, requestClose }: WidgetsPanelProps) {
       <Box grow="Yes" className={css.WidgetsPanelContent}>
         {viewing ? (
           <Box grow="Yes" direction="Column">
-            <Box shrink="No" style={{ padding: config.space.S200 }}>
+            <Box
+              shrink="No"
+              alignItems="Center"
+              justifyContent="SpaceBetween"
+              gap="200"
+              style={{ padding: config.space.S200 }}
+            >
               <Button
                 variant="Secondary"
                 fill="Soft"
@@ -157,6 +177,17 @@ export function WidgetsPanel({ room, requestClose }: WidgetsPanelProps) {
                   {viewing.name || 'Widget'}
                 </Text>
               </Button>
+              {popoutUrl(viewing) && (
+                <IconButton
+                  size="300"
+                  radii="300"
+                  variant="Background"
+                  aria-label={`Open ${viewing.name || 'widget'} in a new window`}
+                  onClick={() => popout(viewing)}
+                >
+                  <Icon size="100" src={Icons.External} />
+                </IconButton>
+              )}
             </Box>
             <RoomWidgetView room={room} widget={viewing} />
           </Box>
@@ -184,6 +215,17 @@ export function WidgetsPanel({ room, requestClose }: WidgetsPanelProps) {
                       {widget.name || widget.templateUrl}
                     </Text>
                   </Box>
+                  {popoutUrl(widget) && (
+                    <IconButton
+                      size="300"
+                      radii="300"
+                      variant="Background"
+                      aria-label={`Open ${widget.name || 'widget'} in a new window`}
+                      onClick={() => popout(widget)}
+                    >
+                      <Icon size="100" src={Icons.External} />
+                    </IconButton>
+                  )}
                   {canModify && (
                     <IconButton
                       size="300"

src/app/features/room/widgets/widgetUtils.test.ts

@@ -8,6 +8,7 @@ import {
   generateWidgetId,
   classifyWidgetCapabilities,
   loadWidgetConsent,
+  widgetPopoutUrl,
 } from './widgetUtils';
 
 const APP = 'https://chat.lotusguild.org';
@@ -106,3 +107,33 @@ test('classifyWidgetCapabilities: reading protected state is fine, changing unpr
 test('loadWidgetConsent tolerates missing storage', () => {
   assert.equal(loadWidgetConsent('!r:x', 'w', 'https://w.example'), undefined);
 });
+
+test('[#266] space structure, call membership and Lotus room policy can never be granted', () => {
+  const { auto, ask } = classifyWidgetCapabilities(
+    [
+      'm.space.child',
+      'm.space.parent',
+      'org.matrix.msc3401.call',
+      'org.matrix.msc3401.call.member',
+      'm.call.member',
+      'io.lotus.voice_limit',
+      'io.lotus.room_quality',
+    ].map((t) => `org.matrix.msc2762.send.state_event:${t}`),
+  );
+  assert.equal(auto.size, 0);
+  assert.deepEqual(ask, []);
+});
+
+test('[#205] widgetPopoutUrl: only cross-origin https opens in a new window', () => {
+  // Built at runtime so the no-script-url lint rule doesn't flag the test data.
+  const scriptUrl = ['javascript', 'alert(1)'].join(':');
+  assert.equal(
+    widgetPopoutUrl('https://pad.example.org/p/room', APP),
+    'https://pad.example.org/p/room',
+  );
+  assert.equal(widgetPopoutUrl('https://chat.lotusguild.org/evil', APP), null, 'same origin');
+  assert.equal(widgetPopoutUrl('http://pad.example.org/', APP), null, 'not https');
+  assert.equal(widgetPopoutUrl(scriptUrl, APP), null, 'script URL');
+  assert.equal(widgetPopoutUrl('data:text/html,<b>x</b>', APP), null, 'data:');
+  assert.equal(widgetPopoutUrl('not a url', APP), null);
+});

src/app/features/room/widgets/widgetUtils.ts

@@ -1,8 +1,10 @@
+import type { MatrixClient } from 'matrix-js-sdk';
 import {
   Capability,
   EventDirection,
   EventKind,
   MatrixCapabilities,
+  type Widget,
   WidgetEventCapability,
 } from 'matrix-widget-api';
 
@@ -48,6 +50,29 @@ export const isWidgetUrlSafe = (completeUrl: string, appOrigin: string): boolean
   }
 };
 
+/** The widget's URL with its template variables filled in for this viewer. */
+export const widgetCompleteUrl = (widget: Widget, mx: MatrixClient, roomId: string): string =>
+  widget.getCompleteUrl({
+    currentUserId: mx.getSafeUserId(),
+    widgetRoomId: roomId,
+    deviceId: mx.getDeviceId() ?? undefined,
+    baseUrl: mx.baseUrl,
+  });
+
+/**
+ * [Gitea #205] The URL to open a widget in its own window, or null when it
+ * mustn't be opened: only cross-origin https (room state can carry anything,
+ * e.g. a `javascript:` URL from another client, whose origin is "null").
+ */
+export const widgetPopoutUrl = (completeUrl: string, appOrigin: string): string | null => {
+  try {
+    const u = new URL(completeUrl);
+    return u.protocol === 'https:' && u.origin !== appOrigin ? u.href : null;
+  } catch {
+    return null;
+  }
+};
+
 export const generateWidgetId = (): string =>
   `lotus_${Date.now()}_${Math.random().toString(36).slice(2, 10)}`;
 
@@ -67,6 +92,16 @@ export const PROTECTED_STATE_TYPES: ReadonlySet<string> = new Set([
   'm.room.third_party_invite',
   'im.vector.modular.widgets',
   'm.widget',
+  // [Gitea #266] Space structure, call membership and Lotus room policy: a
+  // widget could restructure a space, fake call membership or lift the
+  // voice-channel limit, so these can't be granted even with consent.
+  'm.space.child',
+  'm.space.parent',
+  'org.matrix.msc3401.call',
+  'org.matrix.msc3401.call.member',
+  'm.call.member',
+  'io.lotus.voice_limit',
+  'io.lotus.room_quality',
 ]);
 
 export type WidgetPermissionRequest = {
@@ -137,8 +172,11 @@ export const classifyWidgetCapabilities = (
  */
 export type StoredWidgetConsent = { url: string; allowed: Capability[]; denied: Capability[] };
 
+// [Gitea #266] Swept on logout by clearPlaintextCaches, so one account's
+// approvals never apply to the next account on the same device.
+export const WIDGET_CONSENT_PREFIX = 'lotus.widgetConsent.';
 export const widgetConsentKey = (roomId: string, widgetId: string): string =>
-  `lotus.widgetConsent.${roomId}.${widgetId}`;
+  `${WIDGET_CONSENT_PREFIX}${roomId}.${widgetId}`;
 
 export const loadWidgetConsent = (
   roomId: string,

src/app/features/settings/about/About.tsx

@@ -8,6 +8,7 @@ import { getOriginBaseUrl, withOriginBaseUrl } from '../../../pages/pathUtils';
 import pkg from '../../../../../package.json';
 import { clearCacheAndReload } from '../../../../client/initMatrix';
 import { useMatrixClient } from '../../../hooks/useMatrixClient';
+import { tauriInvoke } from '../../../hooks/useTauri';
 
 const LotusLogo = withOriginBaseUrl(getOriginBaseUrl(), '/public/res/lotus-logo.png');
 
@@ -78,6 +79,51 @@ function useServerSupport(): { support: MSC1929Support | null; loading: boolean
 type AboutProps = {
   requestClose: () => void;
 };
+/**
+ * [Gitea #276] Which build someone is on: the web deploy's commit and build
+ * date (stamped in by vite.config.js), plus the desktop app's own version from
+ * Tauri, the number a desktop or updater bug report needs.
+ */
+function BuildInfo() {
+  const [desktopVersion, setDesktopVersion] = useState<string>();
+  useEffect(() => {
+    tauriInvoke()?.('plugin:app|version')
+      .then((v) => {
+        if (typeof v === 'string') setDesktopVersion(v);
+      })
+      .catch(() => undefined);
+  }, []);
+  const commit = __LOTUS_BUILD_COMMIT__;
+  const built = new Date(__LOTUS_BUILD_DATE__);
+  const builtText = Number.isNaN(built.getTime())
+    ? undefined
+    : built.toLocaleString(undefined, { dateStyle: 'medium', timeStyle: 'short' });
+  return (
+    <Box direction="Column" gap="0">
+      {desktopVersion && (
+        <Text size="T200" priority="300">
+          Desktop {desktopVersion}
+        </Text>
+      )}
+      <Text size="T200" priority="300">
+        Web build{' '}
+        {commit !== 'unknown' ? (
+          <a
+            href={`https://code.lotusguild.org/LotusGuild/cinny/commit/${commit}`}
+            target="_blank"
+            rel="noreferrer noopener"
+          >
+            {commit}
+          </a>
+        ) : (
+          commit
+        )}
+        {builtText && ` · built ${builtText}`}
+      </Text>
+    </Box>
+  );
+}
+
 export function About({ requestClose }: AboutProps) {
   const mx = useMatrixClient();
   const { support: serverSupport, loading: supportLoading } = useServerSupport();
@@ -117,6 +163,7 @@ export function About({ requestClose }: AboutProps) {
                       <Text size="T200">v{pkg.version}</Text>
                     </Box>
                     <Text>A Matrix client for Lotus Guild.</Text>
+                    <BuildInfo />
                   </Box>
 
                   <Box gap="200" wrap="Wrap">

src/app/features/settings/general/General.tsx

@@ -1749,6 +1749,7 @@ function Calls() {
   );
 
   const [pttMode, setPttMode] = useSetting(settingsAtom, 'pttMode');
+  const [callSummaryToast, setCallSummaryToast] = useSetting(settingsAtom, 'callSummaryToast');
   const [callRejoin, setCallRejoin] = useSetting(settingsAtom, 'callRejoinAfterRestart');
   const [haptics, setHaptics] = useSetting(settingsAtom, 'hapticFeedback');
   const [pttKey, setPttKey] = useSetting(settingsAtom, 'pttKey');
@@ -2062,6 +2063,13 @@ function Calls() {
             />
           }
         />
+        <SettingTile
+          title="Summary After Calls"
+          description="When a call ends, show how long it was and how the connection held up, with a Details button for who was there, network numbers and your own talk/mute time."
+          after={
+            <Switch variant="Primary" value={callSummaryToast} onChange={setCallSummaryToast} />
+          }
+        />
         {hapticsSupported() && (
           <SettingTile
             title="Haptic Feedback"
@@ -2098,7 +2106,12 @@ function Calls() {
           description={
             deafenBind.error ??
             (deafenHotkey
-              ? `Press ${keyLabel(deafenKey)} during a call to mute your speakers. Press Escape to cancel rebind.${
+              ? `${
+                  // [Gitea #279] The Escape hint only applies while rebinding.
+                  deafenBind.listening
+                    ? 'Press a key to bind it, or Escape to cancel.'
+                    : `Press ${keyLabel(deafenKey)} during a call to mute your speakers.`
+                }${
                   !isSafeGlobalToggleKey(deafenKey)
                     ? ` A letter, digit or Space only works in the call view — on a chat screen typing takes priority${
                         isTauriEnv() && globalCallHotkeys ? ' and other apps are never watched' : ''

src/app/features/settings/notifications/NotificationModeSwitcher.tsx

@@ -98,7 +98,7 @@ export function NotificationModeSwitcher({ pushRule, onChange }: NotificationMod
                     key={mode}
                     size="300"
                     variant="Surface"
-                    aria-selected={mode === selectedMode}
+                    aria-pressed={mode === selectedMode}
                     radii="300"
                     onClick={() => handleSelect(mode)}
                   >

src/app/features/space-settings/SpaceSettingsRenderer.tsx

@@ -21,7 +21,7 @@ function RenderSettings({ state }: RenderSettingsProps) {
   if (!room) return null;
 
   return (
-    <Modal500 requestClose={closeSettings}>
+    <Modal500 requestClose={closeSettings} label={`${room.name} space settings`}>
       <SpaceProvider value={space ?? null}>
         <RoomProvider value={room}>
           <SpaceSettings initialPage={page} requestClose={closeSettings} />

src/app/features/toast/LotusToastContainer.tsx

@@ -1,6 +1,6 @@
 import React, { useEffect, useRef, CSSProperties } from 'react';
 import { useAtomValue, useSetAtom } from 'jotai';
-import { color, config, Icon, IconButton, Icons } from 'folds';
+import { Button, color, config, Icon, IconButton, Icons, Text } from 'folds';
 import { ScreenSize, useScreenSize } from '../../hooks/useScreenSize';
 import { toastQueueAtom, dismissToastAtom, ToastNotif } from '../../state/toast';
 import { useSetting } from '../../state/hooks/settings';
@@ -43,13 +43,17 @@ function ToastCard({ toast }: ToastCardProps) {
 
   useEffect(() => {
     if (toast.sticky) return;
-    timerRef.current = setTimeout(() => {
-      dismiss(toast.id);
-    }, 4000);
+    timerRef.current = setTimeout(
+      () => {
+        dismiss(toast.id);
+      },
+      // [Gitea #253] A toast with a button stays long enough to use it.
+      toast.actionLabel ? 10_000 : 4000,
+    );
     return () => {
       if (timerRef.current !== null) clearTimeout(timerRef.current);
     };
-  }, [dismiss, toast.id, toast.sticky]);
+  }, [dismiss, toast.id, toast.sticky, toast.actionLabel]);
 
   const handleCardClick = () => {
     if (toast.onClick) {
@@ -212,6 +216,24 @@ function ToastCard({ toast }: ToastCardProps) {
       </div>
       <div style={bodyStyle}>{toast.body}</div>
       {toast.roomName && <div style={roomNameStyle}>{toast.roomName}</div>}
+      {toast.actionLabel && toast.onAction && (
+        <div style={{ marginTop: config.space.S200 }}>
+          <Button
+            type="button"
+            size="300"
+            radii="300"
+            variant="Secondary"
+            fill="Soft"
+            onClick={(e) => {
+              e.stopPropagation();
+              toast.onAction?.();
+              dismiss(toast.id);
+            }}
+          >
+            <Text size="B300">{toast.actionLabel}</Text>
+          </Button>
+        </div>
+      )}
     </div>
   );
 }

src/app/hooks/useCallEndedToast.ts

@@ -3,7 +3,10 @@ import { useSetAtom } from 'jotai';
 import { CallEmbed } from '../plugins/call';
 import { useCallHangupEvent } from './useCallEmbed';
 import { toastQueueAtom } from '../state/toast';
-import { describeCallEnd } from '../utils/callSummary';
+import { describeCallDetails, describeCallEnd } from '../utils/callSummary';
+import { callSummaryViewAtom } from '../state/callSummary';
+import { useSetting } from '../state/hooks/settings';
+import { settingsAtom } from '../state/settings';
 
 // The fork sends io.lotus.call_summary on SFU disconnect, which normally lands
 // before Element Call's hangup echo; give a late one this long before toasting.
@@ -16,6 +19,8 @@ const SUMMARY_GRACE_MS = 400;
  */
 export function useCallEndedToast(embed: CallEmbed): void {
   const setToast = useSetAtom(toastQueueAtom);
+  const setSummaryView = useSetAtom(callSummaryViewAtom);
+  const [callSummaryToast] = useSetting(settingsAtom, 'callSummaryToast');
   const fired = useRef(false);
 
   useEffect(() => {
@@ -25,14 +30,25 @@ export function useCallEndedToast(embed: CallEmbed): void {
   useCallHangupEvent(embed, () => {
     if (fired.current || !embed.joined || embed.joinedAt === undefined) return;
     fired.current = true;
+    if (!callSummaryToast) return;
     const durationMs = Date.now() - embed.joinedAt;
+    const deafenedMs = embed.deafenedMs();
+    const roomName = embed.room.name ?? 'Voice call';
+    const nameOf = (userId: string) => embed.room.getMember(userId)?.name ?? userId;
     const toast = () =>
       setToast({
         id: `call-ended-${Date.now()}`,
         displayName: 'Lotus Chat',
         body: describeCallEnd(durationMs, embed.lastSummary),
-        roomName: embed.room.name ?? 'Voice call',
+        roomName,
         roomId: embed.roomId,
+        // [Gitea #253] The full breakdown, snapshotted at hangup.
+        actionLabel: 'Details',
+        onAction: () =>
+          setSummaryView({
+            roomName,
+            sections: describeCallDetails(embed.lastSummary, durationMs, deafenedMs, nameOf),
+          }),
       });
     if (embed.lastSummary) toast();
     else setTimeout(toast, SUMMARY_GRACE_MS);

src/app/hooks/useLongPress.ts

@@ -17,22 +17,37 @@ export function useLongPress(onLongPress: (x: number, y: number) => void) {
   const timer = useRef<number | undefined>(undefined);
   const start = useRef<{ x: number; y: number } | null>(null);
   const fired = useRef(false);
+  // [Gitea #199] The element being pressed carries `data-pressing` (set on the
+  // DOM directly, no re-render) so iOS can't start a text selection under
+  // the finger; see `[data-touch-actions]` in room/message/styles.css.ts.
+  const pressed = useRef<HTMLElement | null>(null);
 
-  const clear = useCallback(() => {
+  const stopTimer = useCallback(() => {
     if (timer.current !== undefined) window.clearTimeout(timer.current);
     timer.current = undefined;
     start.current = null;
   }, []);
 
+  // The finger is up (or the gesture was cancelled): only now drop
+  // `data-pressing`, so the system selection can't start under a finger that
+  // is still down after the sheet opened.
+  const clear = useCallback(() => {
+    stopTimer();
+    pressed.current?.removeAttribute('data-pressing');
+    pressed.current = null;
+  }, [stopTimer]);
+
   const onTouchStart = useCallback(
     (evt: React.TouchEvent) => {
       if (!coarse || evt.touches.length !== 1) return;
       const t = evt.touches[0];
       start.current = { x: t.clientX, y: t.clientY };
       fired.current = false;
+      pressed.current = evt.currentTarget as HTMLElement;
+      pressed.current.setAttribute('data-pressing', '');
       timer.current = window.setTimeout(() => {
         const s = start.current;
-        clear();
+        stopTimer();
         if (!s) return;
         fired.current = true;
         window.setTimeout(() => {
@@ -41,7 +56,7 @@ export function useLongPress(onLongPress: (x: number, y: number) => void) {
         onLongPress(s.x, s.y);
       }, LONG_PRESS_MS);
     },
-    [coarse, clear, onLongPress],
+    [coarse, stopTimer, onLongPress],
   );
 
   const onTouchMove = useCallback(
@@ -72,7 +87,16 @@ export function useLongPress(onLongPress: (x: number, y: number) => void) {
 
   return {
     coarse,
-    handlers: coarse ? { onTouchStart, onTouchMove, onTouchEnd, onTouchCancel: clear } : {},
+    handlers: coarse
+      ? {
+          // [Gitea #199] Marks the element for the iOS hardening CSS.
+          'data-touch-actions': '',
+          onTouchStart,
+          onTouchMove,
+          onTouchEnd,
+          onTouchCancel: clear,
+        }
+      : {},
     /** True for ~1 s after a long-press fired (drop the Android contextmenu echo). */
     suppressContextMenu: fired,
   };

src/app/hooks/usePowerLevels.ts

@@ -46,7 +46,7 @@ const fillMissingPowers = (powerLevels: IPowerLevels): IPowerLevels =>
     const keys = Object.keys(DEFAULT_POWER_LEVELS) as unknown as (keyof IPowerLevels)[];
     keys.forEach((key) => {
       if (draftPl[key] === undefined) {
-        draftPl[key] = DEFAULT_POWER_LEVELS[key] as any;
+        (draftPl as Record<string, unknown>)[key] = DEFAULT_POWER_LEVELS[key];
       }
     });
     if (draftPl.notifications && typeof draftPl.notifications.room !== 'number') {

src/app/pages/App.tsx

@@ -25,6 +25,7 @@ import { useCompositionEndTracking } from '../hooks/useComposingCheck';
 import { settingsAtom } from '../state/settings';
 import { isWithinTimeWindow } from '../utils/timeWindow';
 import { LotusToastContainer } from '../features/toast/LotusToastContainer';
+import { CallSummaryDialog } from '../features/call-summary/CallSummaryDialog';
 import { useTauriNotificationBadge } from '../hooks/useTauriNotificationBadge';
 import { useSessionAppeared } from '../hooks/useSessionAppeared';
 import { useTauriWindowChrome } from '../hooks/useTauriWindowChrome';
@@ -248,6 +249,7 @@ function App() {
                             <SeasonalEffect />
                             <NightLightOverlay />
                             <LotusToastContainer />
+                            <CallSummaryDialog />
                           </JotaiProvider>
                           <ReactQueryDevtools initialIsOpen={false} />
                         </QueryClientProvider>

src/app/pages/client/ClientRoot.tsx

@@ -33,6 +33,8 @@ import {
 } from '../../../client/initMatrix';
 import { deleteSearchCacheDatabase } from '../../utils/searchCache';
 import { clearPlaintextCaches } from '../../state/plaintextCaches';
+import { clearSoundboardClipCache } from '../../utils/soundboardClips';
+import { clearSharedPayload } from '../../../swShare';
 import { SplashScreen } from '../../components/splash-screen';
 import { ServerConfigsLoader } from '../../components/ServerConfigsLoader';
 import { CapabilitiesProvider } from '../../hooks/useCapabilities';
@@ -172,6 +174,10 @@ const useLogoutListener = (mx?: MatrixClient) => {
       // (translation, scheduled messages, recent searches/forwards/gifs/
       // stickers, nav paths) — wipe them on server-forced logout too.
       clearPlaintextCaches(mx?.getUserId() ?? undefined);
+      // [Gitea #57] As on manual logout: no decrypted clip bytes via blob: URLs.
+      clearSoundboardClipCache();
+      // [Gitea #267] As on manual logout: drop files stashed by the share target.
+      await clearSharedPayload().catch(() => undefined);
       // Remove only the session credential keys — NOT settings, drafts, and
       // other preferences (N98). The SDK's IndexedDB stores are cleared above;
       // window.localStorage.clear() is reserved for the explicit reset path.

src/app/pages/client/SyncStatus.tsx

@@ -65,12 +65,12 @@ export function SyncStatus({ mx }: SyncStatusProps) {
     );
   }
 
-  if (
-    (stateData.current === SyncState.Prepared ||
-      stateData.current === SyncState.Syncing ||
-      stateData.current === SyncState.Catchup) &&
-    stateData.previous !== SyncState.Syncing
-  ) {
+  // [Gitea #274] Only while catching up after a drop. Upstream also showed it
+  // for PREPARED and for the first SYNCING after PREPARED/RECONNECTING, i.e.
+  // until the NEXT /sync returned: on a quiet account that long-polls ~30 s
+  // while the app already works (a SYNCING means a sync just succeeded).
+  // A real failure still surfaces as Reconnecting / Connection lost.
+  if (stateData.current === SyncState.Catchup) {
     return (
       <Box direction="Column" shrink="No">
         <Box

src/app/pages/client/inbox/Invites.tsx

@@ -369,7 +369,7 @@ function InviteFilters({
     <Box gap="200">
       <Chip
         variant={isKnown ? 'Success' : 'Surface'}
-        aria-selected={isKnown}
+        aria-pressed={isKnown}
         outlined={!isKnown}
         onClick={() => onFilter(InviteFilter.Known)}
         before={isKnown && <Icon size="100" src={Icons.Check} />}
@@ -385,7 +385,7 @@ function InviteFilters({
       </Chip>
       <Chip
         variant={isUnknown ? 'Warning' : 'Surface'}
-        aria-selected={isUnknown}
+        aria-pressed={isUnknown}
         outlined={!isUnknown}
         onClick={() => onFilter(InviteFilter.Unknown)}
         before={isUnknown && <Icon size="100" src={Icons.Check} />}
@@ -401,7 +401,7 @@ function InviteFilters({
       </Chip>
       <Chip
         variant={isSpam ? 'Critical' : 'Surface'}
-        aria-selected={isSpam}
+        aria-pressed={isSpam}
         outlined={!isSpam}
         onClick={() => onFilter(InviteFilter.Spam)}
         before={isSpam && <Icon size="100" src={Icons.Check} />}

src/app/pages/client/share/Share.tsx

@@ -145,6 +145,11 @@ export function Share() {
               <Box direction="Column" gap="400">
                 <Box direction="Column" gap="200">
                   <Text size="L400">Shared</Text>
+                  {/* [Gitea #267] Not everything that arrives here came from the
+                      user's share sheet; say so before they pick a room. */}
+                  <Text size="T200" priority="300">
+                    This came from another app or website. Check it before you send it.
+                  </Text>
                   {shared.files.map((f) => (
                     <Box key={f.name} alignItems="Center" gap="200">
                       <Icon

src/app/pages/client/sidebar/SettingsTab.tsx

@@ -217,7 +217,7 @@ export function SettingsTab() {
       </SidebarItemTooltip>
       <PresencePicker />
       {settingsOpen && (
-        <Modal500 requestClose={() => setSettingsOpen(false)}>
+        <Modal500 requestClose={() => setSettingsOpen(false)} label="Settings">
           <Settings initialPage={initialPage} requestClose={() => setSettingsOpen(false)} />
         </Modal500>
       )}

src/app/pages/client/sidebar/UnverifiedTab.tsx

@@ -82,7 +82,7 @@ function UnverifiedIndicator() {
         </SidebarItem>
       )}
       {settings && (
-        <Modal500 requestClose={closeSettings}>
+        <Modal500 requestClose={closeSettings} label="Settings">
           <Settings initialPage={SettingsPages.DevicesPage} requestClose={closeSettings} />
         </Modal500>
       )}

src/app/plugins/call/CallControl.ts

@@ -57,6 +57,15 @@ export function parseForkHotkeyReport(data: unknown): ForkHotkeyReport | null {
 
 export const CALL_ERROR_CHANGED = 'call_error_changed';
 
+export const SCREENSHARE_AUDIO_STATE = 'screenshare_audio_state';
+
+/** Pure: parse the fork's `io.lotus.screenshare_audio_state` (#277). */
+export function parseScreenshareAudioState(data: unknown): boolean | undefined {
+  if (typeof data !== 'object' || data === null) return undefined;
+  const { present } = data as { present?: unknown };
+  return typeof present === 'boolean' ? present : undefined;
+}
+
 export type AudioOutputOption = { id: string; label: string };
 export const AUDIO_OUTPUT_STATE = 'audio_output_state';
 
@@ -281,6 +290,22 @@ export class CallControl extends EventEmitter implements CallControlState {
     this.emit(AUDIO_OUTPUT_STATE);
   }
 
+  // [Gitea #277] Whether a remote screenshare's audio is being received (the
+  // fork's `io.lotus.screenshare_audio_state`), so the call bar only offers
+  // "Mute Screenshare Audio" when there is something to mute.
+  private _remoteScreenshareAudio = false;
+
+  public get remoteScreenshareAudio(): boolean {
+    return this._remoteScreenshareAudio;
+  }
+
+  public onScreenshareAudioState(data: unknown) {
+    const present = parseScreenshareAudioState(data);
+    if (present === undefined || present === this._remoteScreenshareAudio) return;
+    this._remoteScreenshareAudio = present;
+    this.emit(SCREENSHARE_AUDIO_STATE);
+  }
+
   private sendAudioOutput(deviceId: string): void {
     if (!this.joined) return;
     this.call.transport.send('io.lotus.set_audio_output', { deviceId }).catch(() => undefined);

src/app/plugins/call/CallEmbed.ts

@@ -15,6 +15,7 @@ import {
   WidgetApiFromWidgetAction,
   WidgetApiToWidgetAction,
   WidgetDriver,
+  IWidgetApiRequest,
 } from 'matrix-widget-api';
 import { CallWidgetDriver } from './CallWidgetDriver';
 import { trimTrailingSlash } from '../../utils/common';
@@ -25,13 +26,14 @@ import {
   ElementMediaStateDetail,
   ElementWidgetActions,
 } from './types';
-import { CallControl } from './CallControl';
+import { CallControl, CallControlEvent } from './CallControl';
 import { CallControlState } from './CallControlState';
 import { verifyDenoiseAssets } from './denoiseSmokeCheck';
 import { canDelegateCapability } from './utils';
 import { getCallPageUrl } from './callPageUrl';
 import { restrictWidgetMessages } from '../widgetTransport';
 import { isRingableRoom } from '../../utils/callRing';
+import { parseCallSummaryDetails, type LotusCallSummaryDetails } from '../../utils/callSummary';
 
 // Maximum time to wait for the embedded Element Call iframe to progress from
 // initial load to a ready/joined state. If it hasn't by then, we assume the
@@ -58,6 +60,8 @@ export interface LotusCallSummary {
   reconnects: number;
   poorMs: number;
   verdict: 'good' | 'fair' | 'poor' | 'unknown';
+  /** [Gitea #253] Breakdown for the Details card (fork lotus.29+). */
+  details?: LotusCallSummaryDetails;
 }
 
 export class CallEmbed {
@@ -77,6 +81,25 @@ export class CallEmbed {
   /** [Gitea #143] The fork's end-of-call summary, once it arrives. */
   public lastSummary: LotusCallSummary | undefined;
 
+  // [Gitea #253] Time spent deafened (sound off), for the post-call Details.
+  private deafenedSince: number | undefined;
+
+  private deafenedTotal = 0;
+
+  public deafenedMs(now = Date.now()): number {
+    return this.deafenedTotal + (this.deafenedSince === undefined ? 0 : now - this.deafenedSince);
+  }
+
+  private trackDeafened = (): void => {
+    if (!this.joined) return;
+    const deaf = !this.control.sound;
+    if (deaf && this.deafenedSince === undefined) this.deafenedSince = Date.now();
+    if (!deaf && this.deafenedSince !== undefined) {
+      this.deafenedTotal += Date.now() - this.deafenedSince;
+      this.deafenedSince = undefined;
+    }
+  };
+
   // C-M4: set once dispose() has run so the hangup fallback timer can tell
   // whether the embed was already torn down by the normal Close/Hangup echo.
   public disposed = false;
@@ -338,6 +361,8 @@ export class CallEmbed {
     const controlState = initialControlState ?? new CallControlState(true, false, true);
     this.control = new CallControl(controlState, call, iframe);
     this.initialState = controlState;
+    this.control.on(CallControlEvent.StateUpdate, this.trackDeafened);
+    this.disposables.push(() => this.control.off(CallControlEvent.StateUpdate, this.trackDeafened));
     // If the iframe document itself fails to load, fail fast.
     iframe.onerror = () => {
       this.settleLoad('iframe');
@@ -433,6 +458,7 @@ export class CallEmbed {
             reconnects: data.reconnects ?? 0,
             poorMs: data.poorMs ?? 0,
             verdict: data.verdict ?? 'unknown',
+            details: parseCallSummaryDetails((data as { details?: unknown }).details),
           };
         }
       }),
@@ -465,6 +491,12 @@ export class CallEmbed {
         this.control.onAudioOutputState((evt.detail as { data?: unknown } | undefined)?.data);
       }),
     );
+    // [Gitea #277] Remote screenshare audio being received, or not.
+    this.disposables.push(
+      this.listenAction('io.lotus.screenshare_audio_state', (evt) => {
+        this.control.onScreenshareAudioState((evt.detail as { data?: unknown } | undefined)?.data);
+      }),
+    );
     // [Gitea #43] PTT / deafen keys pressed while focus is inside the frame.
     this.disposables.push(
       this.listenAction('io.lotus.hotkey', (evt) => {
@@ -616,6 +648,7 @@ export class CallEmbed {
     }
     this.joined = true;
     this.joinedAt = Date.now();
+    this.trackDeafened();
     // EC ignores io.element.device_mute before join; re-apply desired state now that EC is live
     this.control.forceState(this.initialState);
   }
@@ -790,7 +823,7 @@ export class CallEmbed {
     const wrapped = (ev: CustomEvent<T>) => {
       ev.preventDefault();
       // Reply with success so the widget transport doesn't time out waiting for a response
-      this.call.transport.reply(ev.detail as any, {});
+      this.call.transport.reply(ev.detail as unknown as IWidgetApiRequest, {});
       callback(ev);
     };
     return this.listenEvent(`action:${type}`, wrapped);

src/app/plugins/call/screenshareAudioState.test.ts

@@ -0,0 +1,12 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { parseScreenshareAudioState } from './CallControl';
+
+test('parseScreenshareAudioState: reads present, ignores anything else (#277)', () => {
+  assert.equal(parseScreenshareAudioState({ present: true }), true);
+  assert.equal(parseScreenshareAudioState({ present: false }), false);
+  assert.equal(parseScreenshareAudioState({ present: 'yes' }), undefined);
+  assert.equal(parseScreenshareAudioState({}), undefined);
+  assert.equal(parseScreenshareAudioState(null), undefined);
+  assert.equal(parseScreenshareAudioState('present'), undefined);
+});

src/app/state/callSummary.ts

@@ -0,0 +1,6 @@
+import { atom } from 'jotai';
+import type { CallSummarySection } from '../utils/callSummary';
+
+/** [Gitea #253] The post-call Details card currently open (undefined = closed). */
+export type CallSummaryView = { roomName: string; sections: CallSummarySection[] };
+export const callSummaryViewAtom = atom<CallSummaryView | undefined>(undefined);

src/app/state/plaintextCaches.test.ts

@@ -26,7 +26,10 @@ const api = {
       : Object.getOwnPropertyDescriptor(target, key),
 });
 
-const { clearPlaintextCaches, plaintextCachesWiped } = await import('./plaintextCaches');
+const { clearPlaintextCaches, plaintextCachesWiped, WIDGET_CONSENT_KEY_PREFIX } =
+  await import('./plaintextCaches');
+const { WIDGET_CONSENT_PREFIX, widgetConsentKey } =
+  await import('../features/room/widgets/widgetUtils');
 
 test('clearPlaintextCaches removes every plaintext/PII localStorage key', () => {
   store.clear();
@@ -104,3 +107,17 @@ test('clearPlaintextCaches clears the encrypted-search opt-in and flags the wipe
   assert.equal(store.has('mxjssdk_memory_filter_FILTER_SYNC_@me:server'), false);
   assert.equal(plaintextCachesWiped(), true, 'draft writes stop until the page reloads');
 });
+
+test('[#266] clearPlaintextCaches sweeps remembered widget approvals', () => {
+  assert.equal(WIDGET_CONSENT_KEY_PREFIX, WIDGET_CONSENT_PREFIX, 'prefix kept in sync');
+  store.clear();
+  const consent = widgetConsentKey('!room:server', 'widget-1');
+  store.set(consent, '{"url":"https://pad.example","allowed":[],"denied":[]}');
+  store.set('lotus.widgetConsentNotAKey', 'kept');
+  removed.length = 0;
+
+  clearPlaintextCaches('@me:server');
+
+  assert.ok(removed.includes(consent), 'consent cleared');
+  assert.ok(store.has('lotus.widgetConsentNotAKey'), 'unrelated key kept');
+});

src/app/state/plaintextCaches.ts

@@ -139,6 +139,31 @@ const clearAccountScopedFlags = (userId?: string): void => {
   });
 };
 
+/**
+ * [Gitea #266] Remembered widget approvals (`lotus.widgetConsent.<room>.<widget>`,
+ * widgetUtils.ts) would otherwise apply silently to the next account on this
+ * device, and their keys list the previous account's rooms. Kept as a string
+ * here so logout doesn't pull the widget code into the entry chunk; a test
+ * checks it matches WIDGET_CONSENT_PREFIX.
+ */
+export const WIDGET_CONSENT_KEY_PREFIX = 'lotus.widgetConsent.';
+const clearWidgetConsents = (): void => {
+  let keys: string[];
+  try {
+    keys = Object.keys(localStorage);
+  } catch {
+    return;
+  }
+  keys.forEach((key) => {
+    if (!key.startsWith(WIDGET_CONSENT_KEY_PREFIX)) return;
+    try {
+      localStorage.removeItem(key);
+    } catch {
+      // best-effort
+    }
+  });
+};
+
 export const clearPlaintextCaches = (userId?: string): void => {
   wiped = true;
   clearTranslationCache();
@@ -153,5 +178,6 @@ export const clearPlaintextCaches = (userId?: string): void => {
   clearStatusMessage();
   clearCallVolumesAndSyncMeta(userId);
   clearAccountScopedFlags(userId);
+  clearWidgetConsents();
   if (userId) clearNavToActivePathStore(userId);
 };

src/app/state/room/markedUnread.ts

@@ -2,6 +2,7 @@ import { atom, useSetAtom } from 'jotai';
 import { MatrixClient, MatrixEvent, Room, RoomEvent, RoomEventHandlerMap } from 'matrix-js-sdk';
 import { useEffect } from 'react';
 import { AccountDataEvent } from '../../../types/matrix/accountData';
+import { setRoomAccountData } from '../../utils/accountData';
 
 // MSC2867 — "mark a room as unread". A per-room account-data flag `{ unread }`.
 // Stable type `m.marked_unread`; servers/clients predating the stabilization use
@@ -25,11 +26,9 @@ export const setMarkedUnread = (
   unread: boolean,
 ): Promise<unknown> =>
   Promise.all([
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    mx.setRoomAccountData(roomId, AccountDataEvent.MarkedUnread as any, { unread }),
+    setRoomAccountData(mx, roomId, AccountDataEvent.MarkedUnread, { unread }),
     // Best-effort mirror for older servers; never fail the primary write on it.
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    mx.setRoomAccountData(roomId, UNSTABLE_MARKED_UNREAD as any, { unread }).catch(() => undefined),
+    setRoomAccountData(mx, roomId, UNSTABLE_MARKED_UNREAD, { unread }).catch(() => undefined),
   ]);
 
 export const receiptIsMine = (event: MatrixEvent, userId: string): boolean => {

src/app/state/settings.ts

@@ -310,6 +310,8 @@ export interface Settings {
   screenshareFramerate: ScreenshareFramerate;
   // [P5-15] In-call soundboard
   soundboardEnabled: boolean;
+  // [Gitea #253] The call-ended toast (with its Details card).
+  callSummaryToast: boolean;
   soundboardVolume: number; // 0–100
 
   seasonalThemeOverride: SeasonalThemeOverride;
@@ -429,6 +431,7 @@ const defaultSettings: Settings = {
   screenshareBitrate: 'auto',
   screenshareFramerate: 'auto',
   soundboardEnabled: true,
+  callSummaryToast: true,
   soundboardVolume: 80,
 
   seasonalThemeOverride: 'auto',

src/app/state/toast.ts

@@ -13,6 +13,8 @@ export type ToastNotif = {
   onClick?: () => void; // custom click handler; skips hash navigation when set
   sticky?: boolean; // when true, does not auto-dismiss — use for action toasts that require a click
   onDismiss?: () => void; // called when the user closes the toast with its X (not on click/eviction)
+  actionLabel?: string; // [Gitea #253] a small button on the toast, e.g. "Details"
+  onAction?: () => void;
   createdAt?: number; // set by toastQueueAtom when enqueued; used for #80 eviction ordering
 };
 

src/app/styles/sidePanel.ts

@@ -0,0 +1,9 @@
+import { toRem } from 'folds';
+
+/**
+ * One width for every right-hand room panel (members, bookmarks, threads, a
+ * thread, media gallery, widgets). Swapping one panel for another must not
+ * resize the room view: when the widths differed, the header icons slid
+ * sideways and a second click on the same spot hit a different button (#263).
+ */
+export const SIDE_PANEL_WIDTH = toRem(340);

src/app/utils/accountData.ts

@@ -18,6 +18,17 @@ export function getAccountData<T>(
   return event?.getContent() as T | undefined;
 }
 
+/** Room account data under a custom or developer-chosen type (same cast). */
+export function setRoomAccountData<T>(
+  mx: MatrixClient,
+  roomId: string,
+  eventType: string,
+  content: T,
+): Promise<unknown> {
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  return (mx as any).setRoomAccountData(roomId, eventType, content);
+}
+
 export function setAccountData<T>(
   mx: MatrixClient,
   eventType: AccountDataEvent | string,

src/app/utils/callSummary.test.ts

@@ -1,6 +1,11 @@
 import { describe, it } from 'node:test';
 import assert from 'node:assert/strict';
-import { describeCallDuration, describeCallEnd } from './callSummary';
+import {
+  describeCallDuration,
+  describeCallEnd,
+  describeCallDetails,
+  parseCallSummaryDetails,
+} from './callSummary';
 
 describe('describeCallDuration', () => {
   it('picks the unit', () => {
@@ -65,3 +70,97 @@ describe('describeCallEnd', () => {
     );
   });
 });
+
+it('[#253] parseCallSummaryDetails keeps well-formed fields and drops the rest', () => {
+  const d = parseCallSummaryDetails({
+    participants: ['@bob:x', 7, '@carol:x'],
+    peakParticipants: 3,
+    quality: {
+      youPoorMs: 1000,
+      othersPoorMs: { '@bob:x': 500, evil: 9, '@c:x': -1 },
+      everyonePoorMs: 0,
+    },
+    network: { rttMedianMs: 38, rttP95Ms: 'fast', inboundLossPct: 0.5 },
+    activity: { speakingMs: 60_000, mutedMs: 'x', screenshareMs: 0 },
+  });
+  assert.deepEqual(d, {
+    participants: ['@bob:x', '@carol:x'],
+    peakParticipants: 3,
+    quality: { youPoorMs: 1000, othersPoorMs: { '@bob:x': 500 }, everyonePoorMs: 0 },
+    network: { rttMedianMs: 38, inboundLossPct: 0.5 },
+    activity: { speakingMs: 60_000, mutedMs: 0, screenshareMs: 0 },
+  });
+  assert.equal(parseCallSummaryDetails(undefined), undefined);
+  assert.equal(parseCallSummaryDetails('details'), undefined);
+});
+
+it('[#253] describeCallDetails: technical sections with names, blame and numbers', () => {
+  const names: Record<string, string> = { '@bob:x': 'Bob', '@carol:x': 'Carol' };
+  const sections = describeCallDetails(
+    {
+      durationMs: 2_460_000,
+      reconnects: 2,
+      poorMs: 120_000,
+      verdict: 'fair',
+      details: {
+        participants: ['@bob:x', '@carol:x'],
+        peakParticipants: 3,
+        quality: {
+          youPoorMs: 120_000,
+          othersPoorMs: { '@carol:x': 30_000 },
+          everyonePoorMs: 10_000,
+        },
+        network: {
+          rttMedianMs: 38,
+          rttP95Ms: 310,
+          outboundLossPct: 4.1,
+          inboundLossPct: 0.5,
+          jitterMs: 6,
+        },
+        activity: { speakingMs: 600_000, mutedMs: 1_200_000, screenshareMs: 300_000 },
+      },
+    },
+    2_460_000,
+    90_000,
+    (u) => names[u] ?? u,
+  );
+  assert.deepEqual(sections, [
+    { title: 'Call', lines: ['Duration 41 min · peak 3 in the call', 'With Bob, Carol'] },
+    {
+      title: 'Connection',
+      lines: [
+        'Verdict: fair · 2 reconnects',
+        'Your connection poor/lost: 2 min',
+        'Carol poor/lost: 30 s',
+        'Everyone poor at once: 10 s (likely server or SFU side)',
+      ],
+    },
+    {
+      title: 'Network',
+      lines: [
+        'RTT median 38 ms · p95 310 ms',
+        'Outbound packet loss 4.1%',
+        'Inbound packet loss 0.5%',
+        'Jitter 6 ms',
+      ],
+    },
+    {
+      title: 'You',
+      lines: ['Talking 10 min · muted 20 min · deafened 2 min', 'Screensharing 5 min'],
+    },
+  ]);
+});
+
+it('[#253] describeCallDetails without fork details (older fork) still says something useful', () => {
+  const sections = describeCallDetails(
+    { durationMs: 60_000, reconnects: 0, poorMs: 0, verdict: 'good' },
+    60_000,
+    0,
+    (u) => u,
+  );
+  assert.deepEqual(
+    sections.map((s) => s.title),
+    ['Call', 'Connection'],
+  );
+  assert.deepEqual(sections[0].lines, ['Duration 1 min', 'Participants unknown']);
+});

src/app/utils/callSummary.ts

@@ -32,3 +32,123 @@ export function describeCallEnd(durationMs: number, summary?: LotusCallSummary):
   }
   return parts.join(' · ');
 }
+
+/** [Gitea #253] The fork's `details` in io.lotus.call_summary (lotus.29+). */
+export type LotusCallSummaryDetails = {
+  participants: string[];
+  peakParticipants: number;
+  quality: { youPoorMs: number; othersPoorMs: Record<string, number>; everyonePoorMs: number };
+  network: {
+    rttMedianMs?: number;
+    rttP95Ms?: number;
+    outboundLossPct?: number;
+    inboundLossPct?: number;
+    jitterMs?: number;
+  };
+  activity: { speakingMs: number; mutedMs: number; screenshareMs: number };
+};
+
+const num = (v: unknown): number | undefined =>
+  typeof v === 'number' && Number.isFinite(v) && v >= 0 ? v : undefined;
+const obj = (v: unknown): Record<string, unknown> =>
+  typeof v === 'object' && v !== null && !Array.isArray(v) ? (v as Record<string, unknown>) : {};
+
+/** Defensive: the frame is another origin; take only well-formed fields. */
+export function parseCallSummaryDetails(raw: unknown): LotusCallSummaryDetails | undefined {
+  if (typeof raw !== 'object' || raw === null) return undefined;
+  const r = obj(raw);
+  const quality = obj(r.quality);
+  const network = obj(r.network);
+  const activity = obj(r.activity);
+  const othersPoorMs: Record<string, number> = {};
+  Object.entries(obj(quality.othersPoorMs)).forEach(([user, ms]) => {
+    const n = num(ms);
+    if (n !== undefined && user.startsWith('@')) othersPoorMs[user] = n;
+  });
+  const net: LotusCallSummaryDetails['network'] = {};
+  (['rttMedianMs', 'rttP95Ms', 'outboundLossPct', 'inboundLossPct', 'jitterMs'] as const).forEach(
+    (k) => {
+      const n = num(network[k]);
+      if (n !== undefined) net[k] = n;
+    },
+  );
+  return {
+    participants: Array.isArray(r.participants)
+      ? r.participants.filter((p): p is string => typeof p === 'string').slice(0, 200)
+      : [],
+    peakParticipants: num(r.peakParticipants) ?? 1,
+    quality: {
+      youPoorMs: num(quality.youPoorMs) ?? 0,
+      othersPoorMs,
+      everyonePoorMs: num(quality.everyonePoorMs) ?? 0,
+    },
+    network: net,
+    activity: {
+      speakingMs: num(activity.speakingMs) ?? 0,
+      mutedMs: num(activity.mutedMs) ?? 0,
+      screenshareMs: num(activity.screenshareMs) ?? 0,
+    },
+  };
+}
+
+export type CallSummarySection = { title: string; lines: string[] };
+
+/**
+ * [Gitea #253] The Details card, in technical wording (the owner's choice):
+ * who was there, connection quality and whose side it was on, network
+ * numbers, and your own activity. `nameOf` turns a user id into a display name.
+ */
+export function describeCallDetails(
+  summary: LotusCallSummary | undefined,
+  durationMs: number,
+  deafenedMs: number,
+  nameOf: (userId: string) => string,
+): CallSummarySection[] {
+  const sections: CallSummarySection[] = [];
+  const d = summary?.details;
+  const dur = describeCallDuration;
+  const people = d?.participants ?? [];
+  sections.push({
+    title: 'Call',
+    lines: [
+      `Duration ${dur(durationMs)}${d ? ` · peak ${d.peakParticipants} in the call` : ''}`,
+      people.length
+        ? `With ${people.map(nameOf).join(', ')}`
+        : d
+          ? 'Nobody else joined'
+          : 'Participants unknown',
+    ],
+  });
+  if (summary) {
+    const quality: string[] = [
+      `Verdict: ${summary.verdict} · ${summary.reconnects} reconnect${summary.reconnects === 1 ? '' : 's'}`,
+    ];
+    if (d) {
+      quality.push(`Your connection poor/lost: ${dur(d.quality.youPoorMs)}`);
+      Object.entries(d.quality.othersPoorMs)
+        .sort((a, b) => b[1] - a[1])
+        .forEach(([user, ms]) => quality.push(`${nameOf(user)} poor/lost: ${dur(ms)}`));
+      if (d.quality.everyonePoorMs > 0)
+        quality.push(
+          `Everyone poor at once: ${dur(d.quality.everyonePoorMs)} (likely server or SFU side)`,
+        );
+    } else quality.push(`Your connection poor/lost: ${dur(summary.poorMs)}`);
+    sections.push({ title: 'Connection', lines: quality });
+  }
+  if (d) {
+    const n = d.network;
+    const net: string[] = [];
+    if (n.rttMedianMs !== undefined)
+      net.push(`RTT median ${n.rttMedianMs} ms · p95 ${n.rttP95Ms ?? n.rttMedianMs} ms`);
+    if (n.outboundLossPct !== undefined) net.push(`Outbound packet loss ${n.outboundLossPct}%`);
+    if (n.inboundLossPct !== undefined) net.push(`Inbound packet loss ${n.inboundLossPct}%`);
+    if (n.jitterMs !== undefined) net.push(`Jitter ${n.jitterMs} ms`);
+    if (net.length) sections.push({ title: 'Network', lines: net });
+    const act = [
+      `Talking ${dur(d.activity.speakingMs)} · muted ${dur(d.activity.mutedMs)} · deafened ${dur(deafenedMs)}`,
+    ];
+    if (d.activity.screenshareMs > 0) act.push(`Screensharing ${dur(d.activity.screenshareMs)}`);
+    sections.push({ title: 'You', lines: act });
+  }
+  return sections;
+}

src/app/utils/room.ts

@@ -60,7 +60,7 @@ export const getStateEvents = (room: Room, eventType: StateEvent): MatrixEvent[]
 export function sendStateEvent<T extends object>(
   mx: MatrixClient,
   roomId: string,
-  eventType: StateEvent,
+  eventType: StateEvent | string,
   content: T,
   stateKey = '',
 ): Promise<ISendEventResponse> {

src/app/utils/scheduledMessages.test.ts

@@ -179,3 +179,15 @@ test('groupScheduledByRoom: groups and sorts by sendAt', () => {
   );
   assert.equal(g.get('!2')?.length, 1);
 });
+
+test('[#275] the server limit maps to friendly text; other errors keep theirs', async () => {
+  const { describeScheduleError, SCHEDULE_TOO_FAR_TEXT, MAX_SCHEDULE_AHEAD_MS } =
+    await import('./scheduledMessages');
+  assert.equal(MAX_SCHEDULE_AHEAD_MS, 86_400_000);
+  const tooLarge = Object.assign(new Error('The requested delay (172800000ms) exceeds…'), {
+    errcode: 'ORG.MATRIX.MSC4140_DELAY_TOO_LARGE',
+  });
+  assert.equal(describeScheduleError(tooLarge), SCHEDULE_TOO_FAR_TEXT);
+  assert.equal(describeScheduleError(new Error('Boom')), 'Boom');
+  assert.equal(describeScheduleError('nope'), 'Failed to schedule message.');
+});

src/app/utils/scheduledMessages.ts

@@ -1,6 +1,22 @@
 import { IContent, MatrixClient, Method } from 'matrix-js-sdk';
 import type { ScheduledMessage } from '../state/scheduledMessages';
 
+/**
+ * [Gitea #275] Production Synapse caps delayed events at
+ * `max_event_delay_duration: 24h`; a later time is rejected with
+ * ORG.MATRIX.MSC4140_DELAY_TOO_LARGE. The dialog enforces the same limit and
+ * the server's error maps to the same text, in case the limit changes.
+ */
+export const MAX_SCHEDULE_AHEAD_MS = 24 * 60 * 60 * 1000;
+export const SCHEDULE_TOO_FAR_TEXT = 'You can schedule up to 24 hours ahead.';
+
+/** A user-facing sentence for a failed schedule. */
+export const describeScheduleError = (err: unknown): string => {
+  const errcode = (err as { errcode?: unknown } | null)?.errcode;
+  if (errcode === 'ORG.MATRIX.MSC4140_DELAY_TOO_LARGE') return SCHEDULE_TOO_FAR_TEXT;
+  return err instanceof Error ? err.message : 'Failed to schedule message.';
+};
+
 /**
  * Schedule a message via MSC4140 (delayed messages).
  * Synapse implementation: pass org.matrix.msc4140.delay on the standard

src/app/utils/urlTracking.test.ts

@@ -109,3 +109,10 @@ describe('stripTrackingParamsInHtml', () => {
     assert.equal(stripTrackingParamsInHtml(html), html);
   });
 });
+
+it('[#280] Reddit keeps context= (it shows the parent comments) but drops share_id', () => {
+  assert.equal(
+    stripTrackingParams('https://www.reddit.com/r/x/comments/abc/def/xyz/?context=3&share_id=1'),
+    'https://www.reddit.com/r/x/comments/abc/def/xyz/?context=3',
+  );
+});

src/app/utils/urlTracking.ts

@@ -103,7 +103,9 @@ const HOST_PARAMS: Array<{ hosts: string[]; params: string[]; prefixes?: string[
   },
   {
     hosts: ['reddit.com'],
-    params: ['share_id', 'rdt', 'context'],
+    // [Gitea #280] Not `context`: on a comment permalink, ?context=N shows the
+    // N parent comments, i.e. the conversation the sender meant to share.
+    params: ['share_id', 'rdt'],
   },
   {
     hosts: ['tiktok.com'],

src/client/initMatrix.ts

@@ -9,6 +9,7 @@ import { pushSessionToSW } from '../sw-session';
 import { deleteSearchCacheDatabase, shouldRunBootCleanup } from '../app/utils/searchCache';
 import { clearPlaintextCaches } from '../app/state/plaintextCaches';
 import { clearSoundboardClipCache } from '../app/utils/soundboardClips';
+import { clearSharedPayload } from '../swShare';
 
 // Thrown when the local IndexedDB has a higher schema version than this SDK expects.
 // This happens after a downgrade (e.g. matrix-js-sdk was briefly upgraded and then reverted).
@@ -146,6 +147,9 @@ export const logoutClient = async (mx: MatrixClient) => {
   // [Gitea #57] Same reasoning as clearPlaintextCaches: decrypted soundboard
   // clip bytes stay reachable via live blob: URLs until the reload otherwise.
   clearSoundboardClipCache();
+  // [Gitea #267] Files stashed by the share target stay in Cache Storage until
+  // /share is opened; a shared photo must not outlive the logout.
+  await clearSharedPayload().catch(() => undefined);
   // Remove only the session credential keys, preserving user preferences and
   // unsent drafts (N98). The factory-reset path is clearLoginData() below.
   removeFallbackSession();

src/ext.d.ts

@@ -1,5 +1,9 @@
 /// <reference types="vite/client" />
 
+// [Gitea #276] Set by vite.config.js `define`.
+declare const __LOTUS_BUILD_COMMIT__: string;
+declare const __LOTUS_BUILD_DATE__: string;
+
 declare module 'browser-encrypt-attachment' {
   export interface EncryptedAttachmentInfo {
     v: string;

src/sw.ts

@@ -1,7 +1,7 @@
 /// <reference lib="WebWorker" />
 
 import { precacheAndRoute, type PrecacheEntry } from 'workbox-precaching';
-import { SHARE_TARGET_PATH, stashSharedForm } from './swShare';
+import { isTrustedShareRequest, SHARE_TARGET_PATH, stashSharedForm } from './swShare';
 import { pickReplySession, replyFailureText, sendNotificationReply } from './swReply';
 
 export type {};
@@ -249,6 +249,11 @@ self.addEventListener('fetch', (event: FetchEvent) => {
   // share_target). Stash the form and bounce to the in-app /share page.
   if (method === 'POST' && new URL(url).pathname.endsWith(SHARE_TARGET_PATH)) {
     const base = new URL(url).pathname.slice(0, -SHARE_TARGET_PATH.length);
+    // [Gitea #267] A cross-site form posting here is not a share: drop it.
+    if (!isTrustedShareRequest(event.request.headers, self.location.origin)) {
+      event.respondWith(Response.redirect(`${base}/`, 303));
+      return;
+    }
     event.respondWith(
       stashSharedForm(event.request, base).catch(() => Response.redirect(`${base}/`, 303)),
     );

src/swShare.test.ts

@@ -1,6 +1,6 @@
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
-import { shareDraftText } from './swShare';
+import { isTrustedShareRequest, shareDraftText } from './swShare';
 
 const base = { files: [], receivedAt: 0 };
 
@@ -25,3 +25,14 @@ test('shareDraftText drops a title/url the text already contains', () => {
   assert.equal(shareDraftText({ ...base, url: 'https://x.test' }), 'https://x.test');
   assert.equal(shareDraftText(base), '');
 });
+
+test('[#267] a share another website submitted is refused', () => {
+  const app = 'https://chat.lotusguild.org';
+  const h = (origin?: string) => new Headers(origin ? { Origin: origin } : {});
+  assert.equal(isTrustedShareRequest(h(), app), true, 'no Origin (OS share sheet)');
+  assert.equal(isTrustedShareRequest(h('null'), app), true, 'opaque origin (OS share sheet)');
+  assert.equal(isTrustedShareRequest(h(app), app), true, 'the app itself');
+  assert.equal(isTrustedShareRequest(h('https://evil.example'), app), false);
+  assert.equal(isTrustedShareRequest(h('https://chat.lotusguild.org.evil.example'), app), false);
+  assert.equal(isTrustedShareRequest(h('http://chat.lotusguild.org'), app), false, 'other scheme');
+});

src/swShare.ts

@@ -20,6 +20,27 @@ export type SharePayload = {
   receivedAt: number;
 };
 
+/**
+ * [Gitea #267] Refuse a share that another website submitted: any site could
+ * otherwise auto-submit a cross-site form here and drop attacker-chosen text
+ * and files into the "Share to…" picker as if the user had shared them.
+ *
+ * The worker can't use `Sec-Fetch-Site`: fetch-metadata headers are added
+ * after the service worker and never appear on `event.request` (checked in
+ * Chromium). `Origin` does: a cross-site form carries the site's origin. The
+ * OS share sheet's POST has no web initiator, so its Origin is `null` or
+ * absent, and both stay accepted. A page can also produce `Origin: null`
+ * (sandboxed frame, no-referrer), which is why /share also says the content
+ * came from elsewhere.
+ */
+export const isTrustedShareRequest = (
+  headers: Pick<Headers, 'get'>,
+  selfOrigin: string,
+): boolean => {
+  const origin = headers.get('Origin');
+  return origin === null || origin === 'null' || origin === selfOrigin;
+};
+
 /** Worker side: stash the POSTed form and answer with a redirect to /share. */
 export async function stashSharedForm(request: Request, base: string): Promise<Response> {
   const form = await request.formData();

vite.config.js

@@ -6,6 +6,7 @@ import { viteStaticCopy } from 'vite-plugin-static-copy';
 import { vanillaExtractPlugin } from '@vanilla-extract/vite-plugin';
 import { VitePWA } from 'vite-plugin-pwa';
 import fs from 'fs';
+import { execSync } from 'child_process';
 import path from 'path';
 import buildConfig from './build.config';
 
@@ -272,8 +273,26 @@ const vendorChunks = (id) => {
   if (id.includes('node_modules/chroma-js')) return 'chroma';
 };
 
+// [Gitea #276] Which build is this? The short commit and build time are shown
+// in Settings → About (web deploys change many times a day while the package
+// version stays the same). LOTUS_BUILD_COMMIT overrides; no git → "unknown".
+const buildCommit = (() => {
+  if (process.env.LOTUS_BUILD_COMMIT) return process.env.LOTUS_BUILD_COMMIT.slice(0, 12);
+  try {
+    return execSync('git rev-parse --short=8 HEAD', { stdio: ['ignore', 'pipe', 'ignore'] })
+      .toString()
+      .trim();
+  } catch {
+    return 'unknown';
+  }
+})();
+
 export default defineConfig({
   appType: 'spa',
+  define: {
+    __LOTUS_BUILD_COMMIT__: JSON.stringify(buildCommit),
+    __LOTUS_BUILD_DATE__: JSON.stringify(new Date().toISOString()),
+  },
   publicDir: false,
   base: buildConfig.base,
   server: {