diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1d8aec684..7f490a414 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -64,8 +64,10 @@ jobs:
         run: |
           node --version
           node scripts/home-shell-regression-smoke.mjs
+          node scripts/home-shell-bridge-smoke.mjs
           node scripts/home-agent-shell-smoke.mjs
           node scripts/people-discovery-smoke.mjs
+          node --test scripts/chat-room-reconnect.test.mjs
       - name: release artifact source proofs
         run: |
           python3 scripts/ci-release-policy-test.py
diff --git a/capsules/chat-room-ui/.chat_room_ui_source.sha256 b/capsules/chat-room-ui/.chat_room_ui_source.sha256
index b50aac7c1..567484892 100644
--- a/capsules/chat-room-ui/.chat_room_ui_source.sha256
+++ b/capsules/chat-room-ui/.chat_room_ui_source.sha256
@@ -1 +1 @@
-6654816bf80d5e89d51a00a92dc40d97ffc85ddb114119e5f7888008cc6c58bc
+103483778d8f8df3fd51fd47794a5a5f893bd2acfc41b3c0049bcb7f0b4e8e64
diff --git a/capsules/chat-room-ui/Cargo.toml b/capsules/chat-room-ui/Cargo.toml
index f04353785..8b0dea956 100644
--- a/capsules/chat-room-ui/Cargo.toml
+++ b/capsules/chat-room-ui/Cargo.toml
@@ -29,6 +29,7 @@ web-sys = { version = "=0.3.82", features = [
   "HtmlFormElement",
   "HtmlInputElement",
   "HtmlTextAreaElement",
+  "KeyboardEvent",
   "Location",
   "Node",
   "RequestCredentials",
diff --git a/capsules/chat-room-ui/src/direct.rs b/capsules/chat-room-ui/src/direct.rs
index 391a0a7dd..fba525a97 100644
--- a/capsules/chat-room-ui/src/direct.rs
+++ b/capsules/chat-room-ui/src/direct.rs
@@ -25,6 +25,9 @@ pub(super) struct DirectConversationView {
     /// The relationship ended. History stays readable; composing stops.
     #[serde(default)]
     pub(super) removed: bool,
+    /// A message arrived that this person has not opened yet.
+    #[serde(default)]
+    pub(super) unread: bool,
 }
 
 #[derive(Debug, Clone, Deserialize, PartialEq, Eq)]
@@ -232,6 +235,7 @@ mod tests {
             conversation_id: id.to_string(),
             display_name: name.to_string(),
             removed: false,
+            unread: false,
         }
     }
 
diff --git a/capsules/chat-room-ui/src/lib.rs b/capsules/chat-room-ui/src/lib.rs
index 142a45720..5469d24ab 100644
--- a/capsules/chat-room-ui/src/lib.rs
+++ b/capsules/chat-room-ui/src/lib.rs
@@ -1,5 +1,5 @@
 use base64::Engine as _;
-use std::cell::RefCell;
+use std::cell::{Cell, RefCell};
 use std::collections::BTreeMap;
 use std::rc::Rc;
 
@@ -23,7 +23,7 @@ use direct::{
     remove_unavailable_conversation, requested_conversation_decision, selected_conversation,
     should_clear_polled_transient_error, valid_direct_send_response, DirectConversationList,
     DirectMessageDirection, DirectMessageList, DirectSendInput, DirectSendResponse, DirectUiState,
-    RequestedConversationDecision, DIRECT_API_BASE,
+    PendingDirectSend, RequestedConversationDecision, DIRECT_API_BASE,
 };
 
 const BROWSER_SESSION_API_BASE: &str = "/api/browser/session";
@@ -37,6 +37,10 @@ const HOME_TOKEN_HEADER: &str = "x-elastos-home-token";
 const DISPLAY_NAME_REQUIRED_ERROR: &str = "Enter your name.";
 const APPROVAL_REQUESTED_BADGE: &str = "Waiting";
 const APPROVAL_REQUESTED_DETAIL: &str = "Waiting for approval.";
+/// The Attach button is an icon; this is its accessible name.
+const ATTACH_LABEL: &str = "Attach";
+const SHELL_SESSION_LOST_DETAIL: &str =
+    "The conversation session ended. Choose Reconnect to continue; your unsent text stays.";
 const SHELL_ACCESS_UNAVAILABLE_DETAIL: &str =
     "This device is not part of this conversation yet. Join from an invite or connect it first.";
 const EMOJI_BUTTON_IDS: [(&str, &str); 12] = [
@@ -64,7 +68,6 @@ enum AccessMode {
 struct AppConfig {
     access_mode: AccessMode,
     home_token: Option<String>,
-    initial_join_invite: Option<String>,
     initial_direct_conversation_id: Option<String>,
     browser_session_request_storage_key: String,
 }
@@ -98,6 +101,26 @@ struct AppState {
     attachment_urls: BTreeMap<String, String>,
     join_invite_url: Option<String>,
     direct: DirectUiState,
+    /// The conversation whose text the composer shows: `None` is the shared
+    /// room, `Some(id)` a direct conversation.
+    composer_conversation: Option<String>,
+    /// The Home session was lost and has not come back: Reconnect stays
+    /// offered whatever other message is showing.
+    reconnect_needed: bool,
+    reconnecting: bool,
+    pending_direct_launch: Option<String>,
+    /// Unsent text of the conversations the composer does not show, with the
+    /// revision it had when it left the composer.
+    drafts: BTreeMap<Option<String>, (String, u64)>,
+    /// Names the composer's current content; every change gets a new one from
+    /// `composer_edits`. A finished send clears only the revision it sent, so
+    /// newer typing, even identical text, and a repeated response leave it.
+    composer_revision: u64,
+    composer_edits: u64,
+    /// Direct sends still awaiting a response, kept by conversation while
+    /// another one is open. Sending the restored draft again reuses the
+    /// request ID, so Runtime treats it as the same message.
+    held_direct_sends: BTreeMap<String, PendingDirectSend>,
 }
 
 #[derive(Debug, Clone, PartialEq, Eq)]
@@ -121,9 +144,17 @@ struct LibraryPickerRequest {
 
 struct App {
     config: AppConfig,
+    current_home_token: RefCell<Option<String>>,
     home_parent_origin: Option<String>,
     picker_document_nonce: String,
     picker_request: RefCell<Option<LibraryPickerRequest>>,
+    /// Counts card openings, so a late action response only updates the card
+    /// that sent it.
+    participant_card_opening: Cell<u64>,
+    /// The name that opened the card: its reference, and the message `seq`
+    /// when it was a message sender. Lists re-render, so closing the card finds
+    /// that exact name again and returns focus to it.
+    participant_card_opener: RefCell<Option<(String, Option<u64>)>>,
     state: RefCell<AppState>,
     document: Document,
     body: HtmlElement,
@@ -131,6 +162,7 @@ struct App {
     status_badge: Option<HtmlElement>,
     status_detail: Option<HtmlElement>,
     error_text: HtmlElement,
+    reconnect_button: HtmlButtonElement,
     gateway_ui: Option<GatewayUi>,
     chat_card: HtmlElement,
     conversation_selector: HtmlElement,
@@ -150,15 +182,17 @@ struct App {
     emoji_buttons: Vec<HtmlButtonElement>,
     participant_count: HtmlElement,
     participant_list: HtmlElement,
+    participant_card: HtmlElement,
+    participant_card_avatar: HtmlElement,
+    participant_card_name: HtmlElement,
+    participant_card_state: HtmlElement,
+    participant_card_action: HtmlButtonElement,
+    participant_card_close: HtmlButtonElement,
     browser_access_section: HtmlElement,
     browser_access_count: HtmlElement,
     browser_access_list: HtmlElement,
     room_access_section: HtmlElement,
     room_policy_list: HtmlElement,
-    conversation_join_section: HtmlElement,
-    conversation_join_form: HtmlFormElement,
-    conversation_join_input: HtmlInputElement,
-    conversation_join_submit: HtmlButtonElement,
     conversation_invite_create: HtmlButtonElement,
     conversation_invite_output_row: HtmlElement,
     conversation_invite_output: HtmlInputElement,
@@ -221,6 +255,9 @@ impl ShellSessionBootstrapFailure {
 struct ConversationObjectView {
     seq: u64,
     sender: String,
+    /// Opaque reference to the sender's profile card, when Runtime has one.
+    #[serde(default)]
+    sender_ref: Option<String>,
     /// `Some(true)`: `sender` is the sender's verified Profile display name.
     /// `Some(false)`/`None`: configured shared Chat omits the row; other modes
     /// keep their existing server-stamped naming.
@@ -264,8 +301,25 @@ struct AttachmentView {
     is_video: bool,
 }
 
+/// A Community profile card. Runtime supplies only an opaque reference and
+/// the relationship; it never sends a Profile or device DID.
+#[derive(Debug, Clone, Deserialize, PartialEq, Eq)]
+struct ParticipantCard {
+    participant_ref: String,
+    relationship: String,
+    #[serde(default)]
+    conversation_id: Option<String>,
+    #[serde(default)]
+    can_add_contact: bool,
+    /// Shared presence (Discovery on) that has not expired.
+    #[serde(default)]
+    active_now: bool,
+}
+
 #[derive(Debug, Clone, Deserialize, PartialEq, Eq)]
 struct ParticipantView {
+    #[serde(default)]
+    card: Option<ParticipantCard>,
     display_name: String,
     /// Same contract as `ConversationObjectView::sender_profile_verified`.
     #[serde(default)]
@@ -468,22 +522,6 @@ struct ConversationJoinInviteView {
     expires_at: u64,
 }
 
-#[derive(Debug, Serialize)]
-struct ConversationJoinInviteJoinInput<'a> {
-    invite: &'a str,
-}
-
-#[derive(Debug, Deserialize)]
-struct ConversationJoinInviteJoinResponse {
-    #[allow(dead_code)]
-    status: String,
-    room_title: String,
-    #[allow(dead_code)]
-    issuer_gateway: String,
-    #[allow(dead_code)]
-    invite_id: String,
-}
-
 #[wasm_bindgen(start)]
 pub fn start() -> Result<(), JsValue> {
     console_error_panic_hook::set_once();
@@ -516,11 +554,14 @@ pub fn start() -> Result<(), JsValue> {
     };
 
     let app = Rc::new(App {
+        current_home_token: RefCell::new(config.home_token.clone()),
         config,
         home_parent_origin: extract_query_param(&window.location().href()?, "home_origin"),
         picker_document_nonce: new_chat_message_request_id()
             .map_err(|error| JsValue::from_str(&error))?,
         picker_request: RefCell::new(None),
+        participant_card_opening: Cell::new(0),
+        participant_card_opener: RefCell::new(None),
         state: RefCell::new(state),
         document: document.clone(),
         body: document
@@ -530,6 +571,7 @@ pub fn start() -> Result<(), JsValue> {
         status_badge: optional_element_by_id(&document, "status-badge"),
         status_detail: optional_element_by_id(&document, "status-detail"),
         error_text: element_by_id(&document, "error-text")?,
+        reconnect_button: button_by_id(&document, "reconnect-button")?,
         gateway_ui,
         chat_card: element_by_id(&document, "chat-card")?,
         conversation_selector: element_by_id(&document, "conversation-selector")?,
@@ -552,15 +594,17 @@ pub fn start() -> Result<(), JsValue> {
             .collect::<Result<Vec<_>, _>>()?,
         participant_count: element_by_id(&document, "participant-count")?,
         participant_list: element_by_id(&document, "participant-list")?,
+        participant_card: element_by_id(&document, "participant-card")?,
+        participant_card_avatar: element_by_id(&document, "participant-card-avatar")?,
+        participant_card_name: element_by_id(&document, "participant-card-name")?,
+        participant_card_state: element_by_id(&document, "participant-card-state")?,
+        participant_card_action: button_by_id(&document, "participant-card-action")?,
+        participant_card_close: button_by_id(&document, "participant-card-close")?,
         browser_access_section: element_by_id(&document, "browser-access-section")?,
         browser_access_count: element_by_id(&document, "browser-access-count")?,
         browser_access_list: element_by_id(&document, "browser-access-list")?,
         room_access_section: element_by_id(&document, "room-access-section")?,
         room_policy_list: element_by_id(&document, "room-policy-list")?,
-        conversation_join_section: element_by_id(&document, "conversation-join-section")?,
-        conversation_join_form: form_by_id(&document, "conversation-join-form")?,
-        conversation_join_input: input_by_id(&document, "conversation-join-input")?,
-        conversation_join_submit: button_by_id(&document, "conversation-join-submit")?,
         conversation_invite_create: button_by_id(&document, "conversation-invite-create")?,
         conversation_invite_output_row: element_by_id(&document, "conversation-invite-output-row")?,
         conversation_invite_output: input_by_id(&document, "conversation-invite-output")?,
@@ -616,13 +660,22 @@ impl App {
         let poll_app = Rc::clone(self);
         spawn_local(async move {
             loop {
+                let was_active = poll_app.state.borrow().session_active;
                 poll_app.poll_and_render_once().await;
+                // A session that just became active loads its history at
+                // once instead of after one more poll interval.
+                if !was_active && poll_app.state.borrow().session_active {
+                    continue;
+                }
                 TimeoutFuture::new(poll_app.poll_interval_ms()).await;
             }
         });
     }
 
     async fn poll_and_render_once(&self) {
+        if self.state.borrow().reconnect_needed {
+            return;
+        }
         if self.is_direct_mode() {
             let (selection_guard, polled_transient_error) = {
                 let state = self.state.borrow();
@@ -746,13 +799,17 @@ impl App {
     }
 
     fn home_token_headers(&self) -> Vec<(&'static str, String)> {
-        self.config
-            .home_token
+        self.current_home_token
+            .borrow()
             .as_ref()
             .map(|token| vec![(HOME_TOKEN_HEADER, token.clone())])
             .unwrap_or_default()
     }
 
+    fn home_token(&self) -> Option<String> {
+        self.current_home_token.borrow().clone()
+    }
+
     fn room_request_headers(&self) -> Vec<(&'static str, String)> {
         if self.is_shell_mode() {
             self.home_token_headers()
@@ -762,14 +819,24 @@ impl App {
     }
 
     async fn refresh_direct_conversations(&self) -> Result<bool, u16> {
-        if !self.is_shell_mode() {
+        if !self.is_shell_mode()
+            || (self.state.borrow().reconnect_needed && !self.state.borrow().reconnecting)
+        {
             return Ok(false);
         }
-        let response: DirectConversationList = direct_get_json(
+        let guard = current_selection_guard(&self.state.borrow());
+        let request_token = self.home_token();
+        let response: Result<DirectConversationList, u16> = direct_get_json(
             &format!("{DIRECT_API_BASE}/conversations"),
             &self.home_token_headers(),
         )
-        .await?;
+        .await;
+        if self.home_token() != request_token || !self.selection_guard_is_current(&guard) {
+            return Ok(false);
+        }
+        let response = response.inspect_err(|&status| {
+            self.handle_direct_authority_loss(status);
+        })?;
         if response.conversations.iter().any(|conversation| {
             conversation.conversation_id.trim().is_empty()
                 || conversation.display_name.trim().is_empty()
@@ -786,6 +853,7 @@ impl App {
 
     fn return_to_conversation_selector(&self, unavailable_conversation_id: Option<&str>) {
         let mut state = self.state.borrow_mut();
+        state.pending_direct_launch = None;
         if let Some(unavailable_conversation_id) = unavailable_conversation_id {
             remove_unavailable_conversation(&mut state.direct, unavailable_conversation_id);
         } else {
@@ -803,16 +871,22 @@ impl App {
     }
 
     async fn refresh_direct_messages_for_guard(&self, guard: &SelectionGuard) -> Result<bool, u16> {
+        if self.state.borrow().reconnect_needed {
+            return Ok(false);
+        }
         let conversation_id = guard.selected_conversation_id.clone().ok_or(403u16)?;
+        let request_token = self.home_token();
         let conversations_result: Result<DirectConversationList, u16> = direct_get_json(
             &format!("{DIRECT_API_BASE}/conversations"),
             &self.home_token_headers(),
         )
         .await;
-        if !self.selection_guard_is_current(guard) {
+        if self.home_token() != request_token || !self.selection_guard_is_current(guard) {
             return Ok(false);
         }
-        let conversations = conversations_result?;
+        let conversations = conversations_result.inspect_err(|&status| {
+            self.handle_direct_authority_loss(status);
+        })?;
         if conversations.conversations.iter().any(|conversation| {
             conversation.conversation_id.trim().is_empty()
                 || conversation.display_name.trim().is_empty()
@@ -832,10 +906,12 @@ impl App {
             &self.home_token_headers(),
         )
         .await;
-        if !self.selection_guard_is_current(guard) {
+        if self.home_token() != request_token || !self.selection_guard_is_current(guard) {
             return Ok(false);
         }
-        let response = messages_result?;
+        let response = messages_result.inspect_err(|&status| {
+            self.handle_direct_authority_loss(status);
+        })?;
         if response
             .messages
             .iter()
@@ -977,6 +1053,14 @@ impl App {
             reset_click.forget();
         }
 
+        let reconnect_app = Rc::clone(self);
+        let reconnect_click = Closure::<dyn FnMut(Event)>::wrap(Box::new(move |_event: Event| {
+            reconnect_app.reconnect_shell_session();
+        }));
+        self.reconnect_button
+            .add_event_listener_with_callback("click", reconnect_click.as_ref().unchecked_ref())?;
+        reconnect_click.forget();
+
         let send_app = Rc::clone(self);
         let send_submit = Closure::<dyn FnMut(Event)>::wrap(Box::new(move |event: Event| {
             event.prevent_default();
@@ -997,6 +1081,7 @@ impl App {
         let message_edit = Closure::<dyn FnMut(Event)>::wrap(Box::new(move |_event: Event| {
             let body = edit_app.message_input.value().trim().to_string();
             let mut state = edit_app.state.borrow_mut();
+            note_composer_edit(&mut state);
             if let Some(conversation_id) = state.direct.selected_conversation_id.clone() {
                 if state.direct.pending_send.as_ref().is_some_and(|pending| {
                     pending.conversation_id != conversation_id || pending.text != body
@@ -1048,50 +1133,7 @@ impl App {
             let Some(choice) = choice else {
                 return;
             };
-            let selection_guard = {
-                let mut state = selector_app.state.borrow_mut();
-                state.error_text = None;
-                state.error_transient = false;
-                if choice == "shared" {
-                    commit_shared_selection(&mut state)
-                } else {
-                    let Some(guard) = commit_direct_selection(&mut state, &choice) else {
-                        return;
-                    };
-                    guard
-                }
-            };
-            let _ = selector_app.render();
-            if choice == "shared" {
-                selector_app.publish_home_navigation(&selection_guard);
-            }
-            selector_app.start_poll_loop();
-            let app = Rc::clone(&selector_app);
-            spawn_local(async move {
-                if choice == "shared" {
-                    if let Err(error) = app.ensure_shell_session_for_guard(&selection_guard).await {
-                        if app.selection_guard_is_current(&selection_guard) {
-                            app.set_error(Some(error));
-                        }
-                    }
-                } else if let Err(status) = app
-                    .refresh_direct_messages_for_guard(&selection_guard)
-                    .await
-                {
-                    if app.selection_guard_is_current(&selection_guard) {
-                        if status == 403 {
-                            app.return_to_conversation_selector(Some(&choice));
-                        } else {
-                            app.set_error(Some(
-                                "Direct messages are temporarily unavailable.".to_string(),
-                            ));
-                        }
-                    }
-                }
-                if app.selection_guard_is_current(&selection_guard) {
-                    let _ = app.render();
-                }
-            });
+            selector_app.select_conversation(choice);
         }));
         self.conversation_selector
             .add_event_listener_with_callback("click", selector_click.as_ref().unchecked_ref())?;
@@ -1200,26 +1242,7 @@ impl App {
             browser_access_click.as_ref().unchecked_ref(),
         )?;
         browser_access_click.forget();
-
-        let join_invite_app = Rc::clone(self);
-        let join_invite_submit =
-            Closure::<dyn FnMut(Event)>::wrap(Box::new(move |event: Event| {
-                event.prevent_default();
-                let app = Rc::clone(&join_invite_app);
-                spawn_local(async move {
-                    app.clear_error();
-                    if let Err(err) = app.join_conversation_from_invite().await {
-                        app.set_error(Some(err));
-                    }
-                    let _ = app.render();
-                });
-            }));
-        self.conversation_join_form
-            .add_event_listener_with_callback(
-                "submit",
-                join_invite_submit.as_ref().unchecked_ref(),
-            )?;
-        join_invite_submit.forget();
+        self.install_participant_card_listeners()?;
 
         let create_invite_app = Rc::clone(self);
         let create_invite_click =
@@ -1338,6 +1361,7 @@ impl App {
                     format!("{current} {emoji}")
                 };
                 emoji_app.message_input.set_value(&next);
+                note_composer_edit(&mut emoji_app.state.borrow_mut());
                 let _ = emoji_app.message_input.focus();
             }));
             button
@@ -1468,7 +1492,7 @@ impl App {
                         app.set_error(Some(err));
                     }
                     let _ = app.post_library_picker_message(serde_json::json!({
-                        "type": "home:picker-accepted", "homeToken": app.config.home_token,
+                        "type": "home:picker-accepted", "homeToken": app.home_token(),
                         "pickerId": picker_id, "requestId": request_id,
                         "documentNonce": document_nonce, "deliveryId": delivery_id, "accepted": accepted,
                     }));
@@ -1484,13 +1508,22 @@ impl App {
         let attachment_result_app = Rc::clone(self);
         let attachment_result =
             Closure::<dyn FnMut(MessageEvent)>::wrap(Box::new(move |event: MessageEvent| {
+                // Documents answers through Home, so the result comes from
+                // Home's window and origin, like a Library delivery.
                 let Some(window) = window() else {
                     return;
                 };
-                let Ok(origin) = window.location().origin() else {
+                let Some(origin) =
+                    admitted_home_origin(attachment_result_app.home_parent_origin.as_deref())
+                else {
+                    return;
+                };
+                let Ok(Some(top)) = window.top() else {
                     return;
                 };
-                if event.origin() != origin {
+                let source = Reflect::get(event.as_ref(), &JsValue::from_str("source"))
+                    .unwrap_or(JsValue::NULL);
+                if event.origin() != origin || !JsObject::is(&source, top.as_ref()) {
                     return;
                 }
                 let data = event.data();
@@ -1534,6 +1567,13 @@ impl App {
                     }
                     let app = Rc::clone(&runtime_events_app);
                     spawn_local(async move {
+                        // New direct messages and new contacts change the
+                        // conversation list as well as the open thread. The
+                        // poll below renders only when the open thread
+                        // changed, so a list change renders here.
+                        if matches!(app.refresh_direct_conversations().await, Ok(true)) {
+                            let _ = app.render();
+                        }
                         app.poll_and_render_once().await;
                     });
                 }));
@@ -1601,7 +1641,7 @@ impl App {
 
     fn session_loss_detail(&self) -> &'static str {
         if self.is_shell_mode() {
-            "The local conversation session ended. Open Chat again to reconnect."
+            SHELL_SESSION_LOST_DETAIL
         } else {
             "This browser was removed from the conversation."
         }
@@ -1639,15 +1679,22 @@ impl App {
         }
 
         let app = Rc::clone(self);
+        let guard = current_selection_guard(&self.state.borrow());
+        let request_token = self.home_token();
         spawn_local(async move {
             let headers = app.room_request_headers();
-            match api_post_session_json(
+            let result = api_post_session_json(
                 &app.room_api_url("/poll"),
                 &RoomPollInput { since: 0 },
                 &headers,
             )
-            .await
+            .await;
+            if request_token != app.home_token()
+                || !selection_guard_matches(&app.state.borrow(), &guard)
             {
+                return;
+            }
+            match result {
                 Ok(poll) => {
                     let (attachments, _changed) = app.apply_active_poll(poll);
                     for attachment in attachments {
@@ -1712,27 +1759,106 @@ impl App {
         state.error_transient = false;
     }
 
+    /// One visible action asks Home for fresh launch authority in the same
+    /// Chat document. Home owns sign-in; the existing composer keeps its draft.
+    fn reconnect_shell_session(self: &Rc<Self>) {
+        if self.state.borrow().reconnecting {
+            return;
+        }
+        let app = Rc::clone(self);
+        spawn_local(async move {
+            if let Err(error) = app.reconnect_from_home().await {
+                apply_reconnect_failure(&mut app.state.borrow_mut(), error);
+            }
+            app.start_poll_loop();
+            let _ = app.render();
+        });
+    }
+
+    async fn reconnect_from_home(&self) -> Result<(), String> {
+        {
+            let mut state = self.state.borrow_mut();
+            if !self.is_shell_mode() || !state.reconnect_needed || state.reconnecting {
+                return Ok(());
+            }
+            state.reconnecting = true;
+        }
+        let _ = self.render();
+        let result = async {
+            let window = window().ok_or_else(|| "Open Chat from Home to reconnect.".to_string())?;
+            let reconnect =
+                Reflect::get(window.as_ref(), &JsValue::from_str("elastosChatReconnect"))
+                    .and_then(|value| value.dyn_into::<Function>())
+                    .map_err(js_error)?;
+            let token = JsFuture::from(Promise::from(
+                reconnect.call0(&JsValue::NULL).map_err(js_error)?,
+            ))
+            .await
+            .map_err(js_error)?
+            .as_string()
+            .filter(|token| !token.is_empty())
+            .ok_or_else(|| "Home could not reopen Chat. Try again.".to_string())?;
+            *self.current_home_token.borrow_mut() = Some(token);
+            bump_selection_generation(&mut self.state.borrow_mut());
+            let guard = current_selection_guard(&self.state.borrow());
+            let requested = self.state.borrow().pending_direct_launch.clone();
+            if let Some(conversation_id) = requested {
+                match self.refresh_direct_conversations().await {
+                    Ok(_) => {}
+                    Err(401) => return Ok(()),
+                    Err(_) => {
+                        return Err("Direct conversations are temporarily unavailable.".to_string())
+                    }
+                }
+                if self.selection_guard_is_current(&guard)
+                    && self.state.borrow().pending_direct_launch.as_deref()
+                        == Some(conversation_id.as_str())
+                {
+                    let mut state = self.state.borrow_mut();
+                    let direct_guard = commit_direct_selection(&mut state, &conversation_id);
+                    drop(state);
+                    let _ = self.render();
+                    if direct_guard.is_none() {
+                        self.return_to_conversation_selector(Some(&conversation_id));
+                    }
+                }
+            }
+            let guard = current_selection_guard(&self.state.borrow());
+            self.ensure_shell_session_for_guard(&guard).await?;
+            if self.selection_guard_is_current(&guard)
+                && self.state.borrow().session_active
+                && guard.selected_conversation_id.is_some()
+            {
+                match self.refresh_direct_messages_for_guard(&guard).await {
+                    Ok(_) | Err(401) => {}
+                    Err(403) if self.selection_guard_is_current(&guard) => {
+                        self.return_to_conversation_selector(
+                            guard.selected_conversation_id.as_deref(),
+                        );
+                    }
+                    Err(_) if self.selection_guard_is_current(&guard) => {
+                        return Err("Direct messages are temporarily unavailable.".to_string());
+                    }
+                    Err(_) => {}
+                }
+            }
+            Ok(())
+        }
+        .await;
+        self.state.borrow_mut().reconnecting = false;
+        result
+    }
+
     fn handle_session_loss(&self, detail: &str) {
         self.clear_browser_session_request_storage();
-        let mut state = self.state.borrow_mut();
-        state.request_id = None;
-        state.session_active = false;
-        state.show_participants = false;
-        state.show_access_controls = false;
-        state.force_message_follow = true;
-        state.latest_seq = 0;
-        state.objects.clear();
-        state.participants.clear();
-        state.active_sessions.clear();
-        state.attachment_urls.clear();
-        state.status_badge = if self.is_shell_mode() {
-            "Reconnect".to_string()
-        } else {
-            "Join".to_string()
-        };
-        state.status_detail = detail.to_string();
-        state.error_text = None;
-        state.error_transient = false;
+        apply_session_loss(&mut self.state.borrow_mut(), self.is_shell_mode(), detail);
+    }
+
+    fn handle_direct_authority_loss(&self, status: u16) {
+        if status == 401 && self.is_shell_mode() {
+            self.handle_session_loss(self.session_loss_detail());
+            let _ = self.render();
+        }
     }
 
     fn hydrate_defaults(self: &Rc<Self>) {
@@ -1750,7 +1876,20 @@ impl App {
         spawn_local(async move {
             let requested_direct = app.config.initial_direct_conversation_id.clone();
             let bootstrap_generation = app.state.borrow().selection_generation;
-            let direct_loaded = app.refresh_direct_conversations().await.is_ok();
+            let direct_result = app.refresh_direct_conversations().await;
+            let direct_loaded = direct_result.is_ok();
+            if app.state.borrow().reconnect_needed {
+                if matches!(direct_result, Err(401))
+                    && app.state.borrow().selection_generation
+                        == bootstrap_generation.wrapping_add(1)
+                {
+                    app.state.borrow_mut().pending_direct_launch = requested_direct;
+                }
+                return;
+            }
+            if app.state.borrow().selection_generation != bootstrap_generation {
+                return;
+            }
             if let Some(conversation_id) = requested_direct {
                 let decision = requested_conversation_decision(
                     direct_loaded,
@@ -1801,12 +1940,20 @@ impl App {
                     }
                 }
             }
-            let summary = match api_get_json_with_headers::<SummaryView>(
+            if app.state.borrow().reconnect_needed {
+                return;
+            }
+            let shared_guard = current_selection_guard(&app.state.borrow());
+            let request_token = app.home_token();
+            let summary_result = api_get_json_with_headers::<SummaryView>(
                 &app.room_api_url("/summary"),
                 &app.home_token_headers(),
             )
-            .await
-            {
+            .await;
+            if app.home_token() != request_token || !app.selection_guard_is_current(&shared_guard) {
+                return;
+            }
+            let summary = match summary_result {
                 Ok(summary) => summary,
                 Err(error) => {
                     if app.is_shell_mode() {
@@ -1822,18 +1969,10 @@ impl App {
             };
             let _ = app.apply_summary(&summary);
             if app.is_shell_mode() {
-                let shared_guard = {
-                    let state = app.state.borrow();
-                    current_selection_guard(&state)
-                };
-                let bootstrap = if let Some(invite) = app.config.initial_join_invite.as_deref() {
-                    app.conversation_join_input.set_value(invite);
-                    app.join_conversation_from_invite().await
-                } else {
-                    app.ensure_shell_session_for_guard(&shared_guard)
-                        .await
-                        .map(|_| ())
-                };
+                let bootstrap = app
+                    .ensure_shell_session_for_guard(&shared_guard)
+                    .await
+                    .map(|_| ());
                 if let Err(err) = bootstrap {
                     if app.selection_guard_is_current(&shared_guard) {
                         app.set_error(Some(err));
@@ -1935,6 +2074,9 @@ impl App {
         if !self.is_shell_mode() || self.state.borrow().session_active {
             return Ok(false);
         }
+        if self.state.borrow().reconnect_needed && !self.state.borrow().reconnecting {
+            return Ok(false);
+        }
 
         let summary = api_get_json_with_headers::<SummaryView>(
             &self.room_api_url("/summary"),
@@ -2131,36 +2273,6 @@ impl App {
         Ok(())
     }
 
-    async fn join_conversation_from_invite(&self) -> Result<(), String> {
-        if !self.is_shell_mode() {
-            return Err("conversation links must be opened from Home".to_string());
-        }
-        let invite = self.conversation_join_input.value().trim().to_string();
-        if invite.is_empty() {
-            return Err("Paste a conversation invite code or link.".to_string());
-        }
-        self.set_status("Joining", "Claiming the invite and connecting this device.");
-        let joined: ConversationJoinInviteJoinResponse = api_post_json_with_headers(
-            &self.room_api_url("/invites/join"),
-            &ConversationJoinInviteJoinInput { invite: &invite },
-            &self.home_token_headers(),
-        )
-        .await?;
-        self.conversation_join_input.set_value("");
-        let selection_guard = {
-            let state = self.state.borrow();
-            current_selection_guard(&state)
-        };
-        let _ = self
-            .refresh_shell_summary_for_guard(&selection_guard)
-            .await?;
-        let _ = self
-            .ensure_shell_session_for_guard(&selection_guard)
-            .await?;
-        self.set_status("Joined", &format!("Joined {}.", joined.room_title));
-        Ok(())
-    }
-
     async fn revoke_runtime_invite(&self, invite_id: &str) -> Result<(), String> {
         if !self.is_shell_mode() {
             return Err("ElastOS invite cancellation is only available from Home".to_string());
@@ -2193,15 +2305,20 @@ impl App {
             return Ok(());
         }
 
-        let request_id = {
+        let (request_id, sent_revision, selection_guard) = {
             let mut state = self.state.borrow_mut();
-            pending_chat_request_id(
+            let sent_revision = state.composer_revision;
+            let request_id = pending_chat_request_id(
                 &mut state.pending_chat_send,
                 &body,
                 new_chat_message_request_id,
-            )?
+            )?;
+            (request_id, sent_revision, current_selection_guard(&state))
         };
-        if self.send_room_text(&request_id, &body).await? {
+        if self
+            .send_room_text(&request_id, &body, &selection_guard)
+            .await?
+        {
             let mut state = self.state.borrow_mut();
             if state
                 .pending_chat_send
@@ -2210,13 +2327,19 @@ impl App {
             {
                 state.pending_chat_send = None;
             }
+            let clear = settle_sent_draft(&mut state, &None, sent_revision);
             drop(state);
-            self.message_input.set_value("");
+            if clear {
+                self.message_input.set_value("");
+            }
         }
         Ok(())
     }
 
     async fn send_direct_message(&self) -> Result<(), String> {
+        if self.state.borrow().reconnect_needed || self.state.borrow().reconnecting {
+            return Ok(());
+        }
         let conversation_id = self
             .state
             .borrow()
@@ -2234,32 +2357,39 @@ impl App {
         if text.is_empty() {
             return Ok(());
         }
-        let request_id = {
+        let (request_id, sent_revision, selection_guard) = {
             let mut state = self.state.borrow_mut();
-            pending_direct_request_id(
+            let sent_revision = state.composer_revision;
+            let request_id = pending_direct_request_id(
                 &mut state.direct.pending_send,
                 &conversation_id,
                 &text,
                 new_chat_message_request_id,
-            )?
+            )?;
+            (request_id, sent_revision, current_selection_guard(&state))
         };
         let payload = DirectSendInput {
             request_id: &request_id,
             conversation_id: &conversation_id,
             text: &text,
         };
+        let request_token = self.home_token();
         let response_result: Result<(u16, DirectSendResponse), u16> = direct_post_json(
             &format!("{DIRECT_API_BASE}/messages/send"),
             &payload,
             &self.home_token_headers(),
         )
         .await;
-        let current_selection = self.state.borrow().direct.selected_conversation_id.clone();
-        if current_selection.as_deref() != Some(conversation_id.as_str()) {
+        if self.home_token() != request_token || self.state.borrow().reconnect_needed {
             return Ok(());
         }
         let (http_status, response) = match response_result {
             Ok(response) => response,
+            Err(_) if !self.selection_guard_is_current(&selection_guard) => return Ok(()),
+            Err(401) => {
+                self.handle_direct_authority_loss(401);
+                return Ok(());
+            }
             Err(403) => {
                 self.return_to_conversation_selector(Some(&conversation_id));
                 return Err("That conversation is no longer available.".to_string());
@@ -2267,9 +2397,13 @@ impl App {
             Err(_) => return Err("Message could not be sent. Try again.".to_string()),
         };
         if !valid_direct_send_response(http_status, response.status) {
-            return Err("Message could not be sent. Try again.".to_string());
+            return if self.selection_guard_is_current(&selection_guard) {
+                Err("Message could not be sent. Try again.".to_string())
+            } else {
+                Ok(())
+            };
         }
-        {
+        let clear = {
             let mut state = self.state.borrow_mut();
             if state.direct.pending_send.as_ref().is_some_and(|pending| {
                 pending.request_id == request_id
@@ -2278,15 +2412,26 @@ impl App {
             }) {
                 state.direct.pending_send = None;
             }
-        }
-        self.message_input.set_value("");
-        let selection_guard = {
-            let state = self.state.borrow();
-            current_selection_guard(&state)
+            if state
+                .held_direct_sends
+                .get(&conversation_id)
+                .is_some_and(|held| held.request_id == request_id)
+            {
+                state.held_direct_sends.remove(&conversation_id);
+            }
+            // Accepted text settles by its conversation and revision, even
+            // while another conversation is open. Current UI effects below
+            // also require the original selection generation.
+            settle_sent_draft(&mut state, &Some(conversation_id.clone()), sent_revision)
         };
-        let _ = self
-            .refresh_direct_messages_for_guard(&selection_guard)
-            .await;
+        if clear {
+            self.message_input.set_value("");
+        }
+        if self.selection_guard_is_current(&selection_guard) {
+            let _ = self
+                .refresh_direct_messages_for_guard(&selection_guard)
+                .await;
+        }
         Ok(())
     }
 
@@ -2358,84 +2503,57 @@ impl App {
         if !self.library_picker_is_current(request) {
             return Err("The selected conversation changed.".to_string());
         }
-        let mut state = self.state.borrow_mut();
-        state.latest_seq = sent.seq;
-        state.objects.push(sent);
-        state.force_message_follow = true;
+        record_own_shared_send(&mut self.state.borrow_mut(), sent);
         Ok(())
     }
 
-    async fn send_room_text(&self, request_id: &str, body: &str) -> Result<bool, String> {
+    async fn send_room_text(
+        &self,
+        request_id: &str,
+        body: &str,
+        guard: &SelectionGuard,
+    ) -> Result<bool, String> {
         if !self.state.borrow().session_active {
             return Ok(false);
         }
         let payload = SendMessageInput { request_id, body };
+        let request_token = self.home_token();
         let headers = self.room_request_headers();
-        let sent: ConversationObjectView =
-            match api_post_session_json(&self.room_api_url("/objects/send"), &payload, &headers)
-                .await
-            {
-                Ok(sent) => sent,
-                Err(err) if is_session_error(&err) => {
-                    self.handle_session_loss(self.session_loss_detail());
-                    return Ok(false);
-                }
-                Err(err) => return Err(err),
-            };
-
-        let mut state = self.state.borrow_mut();
-        state.latest_seq = sent.seq;
-        state.objects.push(sent);
-        state.force_message_follow = true;
+        let result =
+            api_post_session_json(&self.room_api_url("/objects/send"), &payload, &headers).await;
+        if self.home_token() != request_token || self.state.borrow().reconnect_needed {
+            return Ok(false);
+        }
+        let sent: ConversationObjectView = match result {
+            Ok(sent) => sent,
+            Err(_) if !self.selection_guard_is_current(guard) => return Ok(false),
+            Err(err) if is_session_error(&err) => {
+                self.handle_session_loss(self.session_loss_detail());
+                return Ok(false);
+            }
+            Err(err) => return Err(err),
+        };
+        record_own_shared_send(&mut self.state.borrow_mut(), sent);
         Ok(true)
     }
 
     fn open_elastos_uri_from_shell(&self, uri: &str) -> Result<bool, JsValue> {
         let clean_uri = uri.trim();
-        let Some(home_token) = self.config.home_token.as_deref() else {
+        let Some(home_token) = self.home_token() else {
             return Ok(false);
         };
         if !self.is_shell_mode() || !clean_uri.starts_with("elastos://") {
             return Ok(false);
         }
-        let Some(window) = window() else {
-            return Ok(false);
-        };
-        let Some(parent) = window.parent()? else {
-            return Ok(false);
-        };
-        if JsObject::is(parent.as_ref(), window.as_ref()) {
-            return Ok(false);
-        }
-
-        let message = JsObject::new();
-        Reflect::set(
-            &message,
-            &JsValue::from_str("type"),
-            &JsValue::from_str("home:open-uri"),
-        )?;
-        Reflect::set(
-            &message,
-            &JsValue::from_str("uri"),
-            &JsValue::from_str(clean_uri),
-        )?;
-        Reflect::set(
-            &message,
-            &JsValue::from_str("preferredViewer"),
-            &JsValue::from_str("documents"),
-        )?;
-        Reflect::set(
-            &message,
-            &JsValue::from_str("homeToken"),
-            &JsValue::from_str(home_token),
-        )?;
-        parent.post_message(&message.into(), &window.location().origin()?)?;
-        Ok(true)
+        self.post_home_message(&serde_json::json!({
+            "type": "home:open-uri", "uri": clean_uri, "preferredViewer": "documents",
+            "homeToken": home_token,
+        }))
     }
 
     fn open_attachment_in_documents(&self, attachment_id: &str) -> Result<bool, JsValue> {
         let clean_attachment_id = attachment_id.trim();
-        let Some(home_token) = self.config.home_token.as_deref() else {
+        let Some(home_token) = self.home_token() else {
             return Err(JsValue::from_str(
                 "Open Chat from Home to open attachments in Documents.",
             ));
@@ -2464,73 +2582,334 @@ impl App {
                 .ok_or_else(|| JsValue::from_str("Attachment bytes are still loading."))?;
             (attachment, data_url)
         };
-        let Some(window) = window() else {
-            return Err(JsValue::from_str("Browser window is unavailable."));
-        };
-        let Some(parent) = window.parent()? else {
-            return Err(JsValue::from_str("Home shell is unavailable."));
-        };
-        if JsObject::is(parent.as_ref(), window.as_ref()) {
+        if !self.post_home_message(&documents_attachment_message(
+            &home_token,
+            &attachment,
+            &data_url,
+        ))? {
             return Err(JsValue::from_str(
                 "Open Chat from Home to open attachments in Documents.",
             ));
         }
+        Ok(true)
+    }
 
-        let payload = JsObject::new();
-        Reflect::set(
-            &payload,
-            &JsValue::from_str("type"),
-            &JsValue::from_str("documents:open-chat-attachment"),
-        )?;
-        Reflect::set(
-            &payload,
-            &JsValue::from_str("attachmentId"),
-            &JsValue::from_str(&attachment.attachment_id),
-        )?;
-        Reflect::set(
-            &payload,
-            &JsValue::from_str("fileName"),
-            &JsValue::from_str(&attachment.file_name),
-        )?;
-        Reflect::set(
-            &payload,
-            &JsValue::from_str("mimeType"),
-            &JsValue::from_str(&attachment.mime_type),
-        )?;
-        Reflect::set(
-            &payload,
-            &JsValue::from_str("sizeBytes"),
-            &JsValue::from_f64(attachment.size_bytes as f64),
-        )?;
-        Reflect::set(
-            &payload,
-            &JsValue::from_str("dataUrl"),
-            &JsValue::from_str(&data_url),
-        )?;
+    /// Switches this Chat window to the shared room or one direct
+    /// conversation. The rail, the profile card and Home selection use it.
+    fn select_conversation(self: &Rc<Self>, choice: String) {
+        let selection_guard = {
+            let mut state = self.state.borrow_mut();
+            state.error_text = None;
+            state.error_transient = false;
+            if choice == "shared" {
+                commit_shared_selection(&mut state)
+            } else {
+                let Some(guard) = commit_direct_selection(&mut state, &choice) else {
+                    return;
+                };
+                guard
+            }
+        };
+        let _ = self.render();
+        if choice == "shared" {
+            self.publish_home_navigation(&selection_guard);
+        }
+        self.start_poll_loop();
+        let app = Rc::clone(self);
+        spawn_local(async move {
+            if choice == "shared" {
+                if let Err(error) = app.ensure_shell_session_for_guard(&selection_guard).await {
+                    if app.selection_guard_is_current(&selection_guard) {
+                        app.set_error(Some(error));
+                    }
+                }
+            } else if let Err(status) = app
+                .refresh_direct_messages_for_guard(&selection_guard)
+                .await
+            {
+                if app.selection_guard_is_current(&selection_guard) {
+                    if status == 403 {
+                        app.return_to_conversation_selector(Some(&choice));
+                    } else {
+                        app.set_error(Some(
+                            "Direct messages are temporarily unavailable.".to_string(),
+                        ));
+                    }
+                }
+            }
+            if app.selection_guard_is_current(&selection_guard) {
+                let _ = app.render();
+            }
+        });
+    }
 
-        let message = JsObject::new();
-        Reflect::set(
-            &message,
-            &JsValue::from_str("type"),
-            &JsValue::from_str("home:open-target-with-payload"),
-        )?;
-        Reflect::set(
-            &message,
-            &JsValue::from_str("target"),
-            &JsValue::from_str("documents"),
-        )?;
-        Reflect::set(&message, &JsValue::from_str("payload"), &payload)?;
-        Reflect::set(
-            &message,
-            &JsValue::from_str("homeToken"),
-            &JsValue::from_str(home_token),
-        )?;
-        parent.post_message(&message.into(), &window.location().origin()?)?;
-        Ok(true)
+    /// Opens a direct conversation named by a profile card, refreshing the
+    /// conversation list first when it is new to this window.
+    fn open_direct_conversation(self: &Rc<Self>, conversation_id: String) {
+        let known = self
+            .state
+            .borrow()
+            .direct
+            .conversations
+            .iter()
+            .any(|conversation| conversation.conversation_id == conversation_id);
+        if known {
+            self.select_conversation(conversation_id);
+            return;
+        }
+        let app = Rc::clone(self);
+        let guard = {
+            let mut state = app.state.borrow_mut();
+            bump_selection_generation(&mut state);
+            state.pending_direct_launch = Some(conversation_id.clone());
+            current_selection_guard(&state)
+        };
+        spawn_local(async move {
+            let _ = app.refresh_direct_conversations().await;
+            if app.selection_guard_is_current(&guard) && !app.state.borrow().reconnect_needed {
+                app.select_conversation(conversation_id);
+            }
+        });
+    }
+
+    fn participant_card_for(&self, participant_ref: &str) -> Option<(String, ParticipantCard)> {
+        let state = self.state.borrow();
+        state.participants.iter().find_map(|participant| {
+            participant
+                .card
+                .as_ref()
+                .filter(|card| card.participant_ref == participant_ref)
+                .map(|card| {
+                    (
+                        participant_shown_name(participant).to_string(),
+                        card.clone(),
+                    )
+                })
+        })
+    }
+
+    fn participant_activity_for(&self, participant_ref: &str) -> Option<String> {
+        let state = self.state.borrow();
+        let participant = state.participants.iter().find(|participant| {
+            participant
+                .card
+                .as_ref()
+                .is_some_and(|card| card.participant_ref == participant_ref)
+        })?;
+        let card = participant.card.as_ref()?;
+        if card.active_now {
+            Some("Active now".to_string())
+        } else if participant.last_seen_at > 0 {
+            Some(last_message_text(participant.last_seen_at))
+        } else {
+            None
+        }
+    }
+
+    fn open_participant_card(&self, participant_ref: &str, message_seq: Option<u64>) {
+        let Some((name, card)) = self.participant_card_for(participant_ref) else {
+            return;
+        };
+        self.participant_card_opening
+            .set(self.participant_card_opening.get().wrapping_add(1));
+        *self.participant_card_opener.borrow_mut() =
+            Some((participant_ref.to_string(), message_seq));
+        let (state_text, action) = participant_card_copy(&card, self.home_token().is_some());
+        let activity = self.participant_activity_for(participant_ref);
+        self.participant_card_avatar
+            .set_text_content(Some(&participant_initial(&name)));
+        self.participant_card_name.set_text_content(Some(&name));
+        self.participant_card_state
+            .set_text_content(Some(&match activity {
+                Some(activity) if card.relationship != "you" => {
+                    format!("{state_text} · {activity}")
+                }
+                _ => state_text.to_string(),
+            }));
+        match action {
+            Some((label, action)) => {
+                self.participant_card_action.set_text_content(Some(label));
+                let _ = self
+                    .participant_card_action
+                    .set_attribute("data-card-action", action);
+                self.participant_card_action.set_disabled(false);
+                self.participant_card_action.set_hidden(false);
+            }
+            None => {
+                let _ = self
+                    .participant_card_action
+                    .remove_attribute("data-card-action");
+                self.participant_card_action.set_hidden(true);
+            }
+        }
+        let _ = self
+            .participant_card
+            .set_attribute("data-participant-ref", participant_ref);
+        self.participant_card.set_hidden(false);
+        let _ = self.participant_card_close.focus();
+    }
+
+    fn close_participant_card(&self, return_focus: bool) {
+        self.participant_card.set_hidden(true);
+        let _ = self
+            .participant_card
+            .remove_attribute("data-participant-ref");
+        self.participant_card_opening
+            .set(self.participant_card_opening.get().wrapping_add(1));
+        let opener = self.participant_card_opener.borrow_mut().take();
+        if let Some((participant_ref, message_seq)) = opener.filter(|_| return_focus) {
+            let row = match message_seq {
+                Some(seq) => {
+                    element_with_attribute(&self.message_list, "data-seq", &seq.to_string())
+                }
+                None => Some(Element::from(self.participant_list.clone())),
+            };
+            let named = row.and_then(|row| {
+                element_with_attribute(&row, "data-participant-ref", &participant_ref)
+            });
+            match named.and_then(|named| named.dyn_into::<HtmlElement>().ok()) {
+                Some(named) => {
+                    let _ = named.focus();
+                }
+                // The name is gone (its message left the window or the person
+                // left the room): the composer is the next useful place.
+                None => {
+                    let _ = self.message_input.focus();
+                }
+            }
+        }
+    }
+
+    fn run_participant_card_action(self: &Rc<Self>) {
+        let Some(participant_ref) = self.participant_card.get_attribute("data-participant-ref")
+        else {
+            return;
+        };
+        let Some(action) = self
+            .participant_card_action
+            .get_attribute("data-card-action")
+        else {
+            return;
+        };
+        let Some((_, card)) = self.participant_card_for(&participant_ref) else {
+            self.close_participant_card(true);
+            return;
+        };
+        match action.as_str() {
+            "message" => {
+                self.close_participant_card(false);
+                if let Some(conversation_id) = card.conversation_id {
+                    self.open_direct_conversation(conversation_id);
+                }
+            }
+            "add-contact" => {
+                self.participant_card_action.set_disabled(true);
+                let opening = self.participant_card_opening.get();
+                let app = Rc::clone(self);
+                spawn_local(async move {
+                    let result = app.request_contact(&participant_ref).await;
+                    if app.participant_card_opening.get() != opening {
+                        return;
+                    }
+                    match result {
+                        Ok(()) => {
+                            app.participant_card_state
+                                .set_text_content(Some(PARTICIPANT_CARD_REQUEST_SENT));
+                            app.participant_card_action.set_hidden(true);
+                        }
+                        Err(error) => {
+                            app.participant_card_state.set_text_content(Some(&error));
+                            app.participant_card_action.set_disabled(false);
+                        }
+                    }
+                });
+            }
+            "inbox" | "people" => {
+                self.close_participant_card(false);
+                let _ = self.post_library_picker_message(serde_json::json!({
+                    "type": "home:open-target", "target": action, "query": {},
+                    "homeToken": self.home_token(),
+                }));
+            }
+            _ => {}
+        }
+    }
+
+    async fn request_contact(&self, participant_ref: &str) -> Result<(), String> {
+        let _: serde_json::Value = api_post_json_with_headers(
+            &self.room_api_url("/contacts/request"),
+            &serde_json::json!({ "participant_ref": participant_ref }),
+            &self.home_token_headers(),
+        )
+        .await?;
+        Ok(())
+    }
+
+    /// Profile cards: a click, Enter or Space on any name with a card opens
+    /// it; the card closes on its close button or Escape.
+    fn install_participant_card_listeners(self: &Rc<Self>) -> Result<(), JsValue> {
+        for (list, from_messages) in [(&self.participant_list, false), (&self.message_list, true)] {
+            let card_app = Rc::clone(self);
+            let open_card = Closure::<dyn FnMut(Event)>::wrap(Box::new(move |event: Event| {
+                if let Some(key_event) = event.dyn_ref::<web_sys::KeyboardEvent>() {
+                    if key_event.key() != "Enter" && key_event.key() != " " {
+                        return;
+                    }
+                }
+                let Some(target) = event
+                    .target()
+                    .and_then(|value| value.dyn_into::<Element>().ok())
+                else {
+                    return;
+                };
+                let Some(named) = target.closest("[data-participant-ref]").ok().flatten() else {
+                    return;
+                };
+                let Some(participant_ref) = named.get_attribute("data-participant-ref") else {
+                    return;
+                };
+                event.prevent_default();
+                let message_seq = from_messages
+                    .then(|| named.closest("[data-seq]").ok().flatten())
+                    .flatten()
+                    .and_then(|row| row.get_attribute("data-seq"))
+                    .and_then(|seq| seq.parse().ok());
+                card_app.open_participant_card(&participant_ref, message_seq);
+            }));
+            list.add_event_listener_with_callback("click", open_card.as_ref().unchecked_ref())?;
+            list.add_event_listener_with_callback("keydown", open_card.as_ref().unchecked_ref())?;
+            open_card.forget();
+        }
+        let card_action_app = Rc::clone(self);
+        let card_action = Closure::<dyn FnMut(Event)>::wrap(Box::new(move |_event: Event| {
+            card_action_app.run_participant_card_action();
+        }));
+        self.participant_card_action
+            .add_event_listener_with_callback("click", card_action.as_ref().unchecked_ref())?;
+        card_action.forget();
+        let card_close_app = Rc::clone(self);
+        let card_close = Closure::<dyn FnMut(Event)>::wrap(Box::new(move |_event: Event| {
+            card_close_app.close_participant_card(true);
+        }));
+        self.participant_card_close
+            .add_event_listener_with_callback("click", card_close.as_ref().unchecked_ref())?;
+        card_close.forget();
+        let card_escape_app = Rc::clone(self);
+        let card_escape = Closure::<dyn FnMut(Event)>::wrap(Box::new(move |event: Event| {
+            if let Some(key_event) = event.dyn_ref::<web_sys::KeyboardEvent>() {
+                if key_event.key() == "Escape" && !card_escape_app.participant_card.hidden() {
+                    card_escape_app.close_participant_card(true);
+                }
+            }
+        }));
+        self.document
+            .add_event_listener_with_callback("keydown", card_escape.as_ref().unchecked_ref())?;
+        card_escape.forget();
+        Ok(())
     }
 
     fn open_library_from_home(&self) -> Result<bool, JsValue> {
-        if self.config.home_token.is_none() || self.home_parent_origin.is_none() {
+        if self.home_token().is_none() || self.home_parent_origin.is_none() {
             return Ok(false);
         }
         let request = LibraryPickerRequest {
@@ -2539,7 +2918,7 @@ impl App {
             consumed: false,
         };
         self.post_library_picker_message(serde_json::json!({
-            "type": "home:open-target", "target": "library", "homeToken": self.config.home_token,
+            "type": "home:open-target", "target": "library", "homeToken": self.home_token(),
             "query": { "mode": "attach", "returnTarget": "chat-room" },
             "requestId": request.id, "documentNonce": self.picker_document_nonce,
         }))?;
@@ -2547,21 +2926,34 @@ impl App {
         Ok(true)
     }
 
+    /// Posts to Home, the top window at the origin named by `?home_origin=`.
+    /// Home loads Chat in an opaque frame, so Chat's own origin can never
+    /// address it. Returns false outside Home.
+    fn post_home_message(&self, message: &serde_json::Value) -> Result<bool, JsValue> {
+        let Some(window) = window() else {
+            return Ok(false);
+        };
+        let Some(top) = window.top()? else {
+            return Ok(false);
+        };
+        let Some(origin) = admitted_home_origin(self.home_parent_origin.as_deref()) else {
+            return Ok(false);
+        };
+        if JsObject::is(top.as_ref(), window.as_ref()) {
+            return Ok(false);
+        }
+        top.post_message(&js_sys::JSON::parse(&message.to_string())?, origin)?;
+        Ok(true)
+    }
+
     fn post_library_picker_message(&self, message: serde_json::Value) -> Result<(), JsValue> {
-        let window = window().ok_or_else(|| JsValue::from_str("Home is unavailable"))?;
-        let top = window
-            .top()?
-            .ok_or_else(|| JsValue::from_str("Home is unavailable"))?;
-        let origin = self
-            .home_parent_origin
-            .as_deref()
-            .ok_or_else(|| JsValue::from_str("Home is unavailable"))?;
-        if origin == "null" || origin == "*" || JsObject::is(top.as_ref(), window.as_ref()) {
-            return Err(JsValue::from_str(
+        if self.post_home_message(&message)? {
+            Ok(())
+        } else {
+            Err(JsValue::from_str(
                 "Open Chat from Home to choose a Library item.",
-            ));
+            ))
         }
-        top.post_message(&js_sys::JSON::parse(&message.to_string())?, origin)
     }
 
     fn library_picker_is_current(&self, request: &LibraryPickerRequest) -> bool {
@@ -2579,8 +2971,9 @@ impl App {
             state.session_active
         };
         if session_active {
+            let request_token = self.home_token();
             let headers = self.room_request_headers();
-            let poll: RoomPollView = match api_post_session_json(
+            let response = api_post_session_json(
                 &self.room_api_url("/poll"),
                 &RoomPollInput {
                     since: {
@@ -2590,8 +2983,13 @@ impl App {
                 },
                 &headers,
             )
-            .await
+            .await;
+            if self.home_token() != request_token
+                || guard.is_some_and(|guard| !self.selection_guard_is_current(guard))
             {
+                return Ok(false);
+            }
+            let poll: RoomPollView = match response {
                 Ok(poll) => poll,
                 Err(err) if is_session_error(&err) => {
                     self.handle_session_loss(self.session_loss_detail());
@@ -2701,13 +3099,18 @@ impl App {
             }
         }
 
+        let guard = current_selection_guard(&self.state.borrow());
+        let request_token = self.home_token();
         let headers = self.room_request_headers();
-        let bytes = match api_get_session_bytes(
+        let response = api_get_session_bytes(
             &self.room_api_url(&format!("/attachments/{}", attachment.attachment_id)),
             &headers,
         )
-        .await
-        {
+        .await;
+        if self.home_token() != request_token || !self.selection_guard_is_current(&guard) {
+            return Ok(());
+        }
+        let bytes = match response {
             Ok(bytes) => bytes,
             Err(err) if is_session_error(&err) => {
                 self.handle_session_loss(self.session_loss_detail());
@@ -2734,6 +3137,9 @@ impl App {
         let previous_participant_scroll_top = self.participant_list.scroll_top();
         let (state, force_message_follow) = {
             let mut state = self.state.borrow_mut();
+            if let Some(draft) = switch_composer_draft(&mut state, &self.message_input.value()) {
+                self.message_input.set_value(&draft);
+            }
             let force_message_follow = state.force_message_follow;
             state.force_message_follow = false;
             (state.clone(), force_message_follow)
@@ -2817,13 +3223,27 @@ impl App {
             },
         )?;
 
-        if let Some(error) = &state.error_text {
+        let visible_error = state.error_text.as_deref().or_else(|| {
+            shows_reconnect(
+                self.is_shell_mode(),
+                state.session_active,
+                state.reconnect_needed,
+            )
+            .then_some(SHELL_SESSION_LOST_DETAIL)
+        });
+        if let Some(error) = visible_error {
             self.error_text.remove_attribute("hidden")?;
             self.error_text.set_text_content(Some(error));
         } else {
             self.error_text.set_attribute("hidden", "")?;
             self.error_text.set_text_content(None);
         }
+        self.reconnect_button.set_disabled(state.reconnecting);
+        self.reconnect_button.set_hidden(!shows_reconnect(
+            self.is_shell_mode(),
+            state.session_active,
+            state.reconnect_needed,
+        ));
 
         let show_reset = pending
             || !state.display_name.trim().is_empty()
@@ -2883,12 +3303,6 @@ impl App {
             &self.room_access_section,
             direct_mode || !controls.show_room_access,
         )?;
-        set_hidden(
-            &self.conversation_join_section,
-            direct_mode || !controls.show_conversation_join,
-        )?;
-        self.conversation_join_submit
-            .set_disabled(!controls.enable_gateway_controls);
         let invite_url = state.join_invite_url.as_deref().unwrap_or_default();
         self.conversation_invite_output.set_value(invite_url);
         set_hidden(
@@ -2915,11 +3329,12 @@ impl App {
             self.attach_button
                 .set_attribute("aria-label", DIRECT_ATTACHMENTS_UNAVAILABLE)?;
         } else {
-            self.attach_button.set_title("");
-            self.attach_button.remove_attribute("aria-label")?;
+            self.attach_button.set_title(ATTACH_LABEL);
+            self.attach_button
+                .set_attribute("aria-label", ATTACH_LABEL)?;
         }
         self.send_button.set_disabled(if direct_mode {
-            !direct_send_enabled
+            !direct_send_enabled || state.reconnect_needed || state.reconnecting
         } else {
             !controls.enable_text_send
         });
@@ -2992,10 +3407,11 @@ impl App {
             let selected = direct.selected_conversation_id.as_deref()
                 == Some(conversation.conversation_id.as_str());
             button.set_attribute("aria-current", if selected { "true" } else { "false" })?;
-            button.set_class_name(if selected {
-                "conversation-choice active"
-            } else {
-                "conversation-choice"
+            let unread = conversation.unread && !selected;
+            button.set_class_name(match (selected, unread) {
+                (true, _) => "conversation-choice active",
+                (false, true) => "conversation-choice unread",
+                (false, false) => "conversation-choice",
             });
             append_conversation_choice_content(
                 &self.document,
@@ -3004,10 +3420,18 @@ impl App {
                 &conversation.display_name,
                 if conversation.removed {
                     "Removed contact"
+                } else if unread {
+                    "New message"
                 } else {
                     "Direct message"
                 },
             )?;
+            if unread {
+                let dot = self.document.create_element("span")?;
+                dot.set_class_name("conversation-unread-dot");
+                dot.set_attribute("aria-label", "Unread")?;
+                button.append_child(&dot)?;
+            }
             self.conversation_selector.append_child(&button)?;
         }
 
@@ -3051,7 +3475,9 @@ impl App {
             self.message_list.append_child(&empty)?;
             return Ok(());
         }
+        let mut last_day = None;
         for message in &direct.messages {
+            self.append_day_separator_if_new(&mut last_day, message.created_at)?;
             let outgoing = message.direction == DirectMessageDirection::Outgoing;
             let item = self.document.create_element("li")?;
             item.set_class_name(if outgoing {
@@ -3136,6 +3562,12 @@ impl App {
             } else {
                 "participant"
             });
+            if let Some(card) = participant.card.as_ref() {
+                item.set_class_name(&format!("{} participant-clickable", item.class_name()));
+                item.set_attribute("data-participant-ref", &card.participant_ref)?;
+                item.set_attribute("role", "button")?;
+                item.set_attribute("tabindex", "0")?;
+            }
 
             let shown_name = participant_shown_name(participant);
             let avatar = self.document.create_element("div")?;
@@ -3399,6 +3831,27 @@ impl App {
         Ok(())
     }
 
+    /// Adds a day separator before the first message of each local day.
+    fn append_day_separator_if_new(
+        &self,
+        last_day: &mut Option<(u32, u32, u32)>,
+        timestamp_secs: u64,
+    ) -> Result<(), JsValue> {
+        let day = local_day(timestamp_secs);
+        if *last_day == Some(day) {
+            return Ok(());
+        }
+        *last_day = Some(day);
+        let separator = self.document.create_element("li")?;
+        separator.set_class_name("day-separator");
+        separator.set_attribute("role", "separator")?;
+        let label = self.document.create_element("span")?;
+        label.set_text_content(Some(&day_separator_text(timestamp_secs)));
+        separator.append_child(&label)?;
+        self.message_list.append_child(&separator)?;
+        Ok(())
+    }
+
     fn render_objects(
         &self,
         objects: &[ConversationObjectView],
@@ -3416,8 +3869,11 @@ impl App {
             return Ok(());
         }
 
+        let mut last_day = None;
         for object in objects {
+            self.append_day_separator_if_new(&mut last_day, object.created_at)?;
             let item = self.document.create_element("li")?;
+            item.set_attribute("data-seq", &object.seq.to_string())?;
             let is_self = object.from_current_session;
             item.set_class_name(
                 if is_self && object.kind != ConversationObjectKind::System {
@@ -3432,6 +3888,12 @@ impl App {
             let sender = self.document.create_element("span")?;
             let sender_name = object_sender_name(object);
             sender.set_text_content(Some(if is_self { "You" } else { sender_name }));
+            if let Some(sender_ref) = object.sender_ref.as_deref().filter(|_| !is_self) {
+                sender.set_class_name("message-sender-link");
+                sender.set_attribute("data-participant-ref", sender_ref)?;
+                sender.set_attribute("role", "button")?;
+                sender.set_attribute("tabindex", "0")?;
+            }
             let time = self.document.create_element("span")?;
             time.set_text_content(Some(&format_time(object.created_at)));
             meta.append_child(&sender)?;
@@ -3568,14 +4030,10 @@ fn load_config(document: &Document) -> Result<AppConfig, JsValue> {
     } else {
         AccessMode::Gateway
     };
-    let initial_join_invite = ["invite", "join", "join_invite"]
-        .into_iter()
-        .find_map(|key| extract_query_param(&url, key));
     let initial_direct_conversation_id = extract_query_param(&url, "conversation_id");
     Ok(AppConfig {
         access_mode,
         home_token,
-        initial_join_invite,
         initial_direct_conversation_id,
         browser_session_request_storage_key: BROWSER_SESSION_REQUEST_STORAGE_KEY.to_string(),
     })
@@ -3588,6 +4046,67 @@ fn bump_selection_generation(state: &mut AppState) {
     }
 }
 
+/// Gives the composer's new content a revision no earlier content had.
+fn note_composer_edit(state: &mut AppState) {
+    state.composer_edits += 1;
+    state.composer_revision = state.composer_edits;
+}
+
+/// Keeps unsent text with its conversation. When the selection has moved, the
+/// composer's text is saved under the conversation it belonged to, and the
+/// draft of the newly selected conversation is returned for the composer.
+fn switch_composer_draft(state: &mut AppState, composer: &str) -> Option<String> {
+    let selected = state.direct.selected_conversation_id.clone();
+    if state.composer_conversation == selected {
+        return None;
+    }
+    let leaving = std::mem::replace(&mut state.composer_conversation, selected.clone());
+    if composer.trim().is_empty() {
+        state.drafts.remove(&leaving);
+    } else {
+        state
+            .drafts
+            .insert(leaving, (composer.to_string(), state.composer_revision));
+    }
+    match state.drafts.remove(&selected) {
+        Some((draft, revision)) => {
+            state.composer_revision = revision;
+            Some(draft)
+        }
+        None => {
+            note_composer_edit(state);
+            Some(String::new())
+        }
+    }
+}
+
+/// After a send is accepted, the composer is cleared only while it still
+/// shows that conversation at the revision that was sent; newer typing, even
+/// the same words, stays, and a second response for the same send finds the
+/// cleared revision gone. A saved draft still at the sent revision is
+/// dropped, so the message does not come back after A -> B -> A.
+fn settle_sent_draft(
+    state: &mut AppState,
+    sent_conversation: &Option<String>,
+    sent_revision: u64,
+) -> bool {
+    if state.composer_conversation == *sent_conversation {
+        if state.composer_revision != sent_revision {
+            return false;
+        }
+        note_composer_edit(state);
+        return true;
+    }
+    if state
+        .drafts
+        .get(sent_conversation)
+        .is_some_and(|(_, revision)| *revision == sent_revision)
+    {
+        state.drafts.remove(sent_conversation);
+    }
+    false
+}
+
 fn current_selection_guard(state: &AppState) -> SelectionGuard {
     SelectionGuard {
         generation: state.selection_generation,
@@ -3681,11 +4200,21 @@ fn append_conversation_choice_content(
 fn clear_selected_direct_conversation(state: &mut AppState) {
     state.direct.selected_conversation_id = None;
     state.direct.messages.clear();
-    state.direct.pending_send = None;
+    hold_pending_direct_send(state);
     state.direct.notice = None;
 }
 
+/// Keeps the open conversation's unanswered send while the person is elsewhere.
+fn hold_pending_direct_send(state: &mut AppState) {
+    if let Some(pending) = state.direct.pending_send.take() {
+        state
+            .held_direct_sends
+            .insert(pending.conversation_id.clone(), pending);
+    }
+}
+
 fn commit_shared_selection(state: &mut AppState) -> SelectionGuard {
+    state.pending_direct_launch = None;
     bump_selection_generation(state);
     clear_selected_direct_conversation(state);
     current_selection_guard(state)
@@ -3694,11 +4223,13 @@ fn commit_shared_selection(state: &mut AppState) -> SelectionGuard {
 fn commit_direct_selection(state: &mut AppState, conversation_id: &str) -> Option<SelectionGuard> {
     let clean_id = conversation_id.trim();
     selected_conversation(&state.direct.conversations, clean_id)?;
+    state.pending_direct_launch = None;
     if state.direct.selected_conversation_id.as_deref() != Some(clean_id) {
         bump_selection_generation(state);
+        hold_pending_direct_send(state);
         state.direct.selected_conversation_id = Some(clean_id.to_string());
         state.direct.messages.clear();
-        state.direct.pending_send = None;
+        state.direct.pending_send = state.held_direct_sends.remove(clean_id);
     }
     state.direct.notice = None;
     Some(current_selection_guard(state))
@@ -3715,6 +4246,98 @@ fn commit_requested_direct_selection_if_current(
     commit_direct_selection(state, conversation_id)
 }
 
+/// Home's origin from `?home_origin=`, refused when it could not name Home:
+/// missing, opaque or a wildcard.
+fn admitted_home_origin(origin: Option<&str>) -> Option<&str> {
+    origin
+        .map(str::trim)
+        .filter(|origin| !origin.is_empty() && *origin != "null" && *origin != "*")
+}
+
+/// The Home message that opens one Chat attachment in Documents.
+fn documents_attachment_message(
+    home_token: &str,
+    attachment: &AttachmentView,
+    data_url: &str,
+) -> serde_json::Value {
+    serde_json::json!({
+        "type": "home:open-target-with-payload",
+        "target": "documents",
+        "homeToken": home_token,
+        "payload": {
+            "type": "documents:open-chat-attachment",
+            "attachmentId": attachment.attachment_id,
+            "fileName": attachment.file_name,
+            "mimeType": attachment.mime_type,
+            "sizeBytes": attachment.size_bytes,
+            "dataUrl": data_url,
+        },
+    })
+}
+
+/// The first element under `root` whose `attribute` is exactly `value`. The
+/// value is compared, never spliced into a selector.
+fn element_with_attribute(root: &Element, attribute: &str, value: &str) -> Option<Element> {
+    let mut child = root.first_element_child();
+    while let Some(element) = child {
+        if element.get_attribute(attribute).as_deref() == Some(value) {
+            return Some(element);
+        }
+        if let Some(found) = element_with_attribute(&element, attribute, value) {
+            return Some(found);
+        }
+        child = element.next_element_sibling();
+    }
+    None
+}
+
+/// The Reconnect action shows only inside Home, while a lost session has not
+/// come back. It does not depend on which message is showing.
+fn shows_reconnect(shell_mode: bool, session_active: bool, reconnect_needed: bool) -> bool {
+    shell_mode && !session_active && reconnect_needed
+}
+
+/// A Reconnect attempt failed. Only a session that is still lost reports that
+/// Chat could not reconnect; when the session came back and a later step
+/// failed (such as loading an attachment), that step's error shows instead.
+fn apply_reconnect_failure(state: &mut AppState, error: String) {
+    state.error_text = Some(error);
+    state.error_transient = state.session_active;
+}
+
+/// Adds the person's own accepted Community message. It scrolls to the newest
+/// message only while Community is open: a response that arrives after they
+/// moved to a direct conversation leaves that conversation's reading place.
+fn record_own_shared_send(state: &mut AppState, sent: ConversationObjectView) {
+    state.latest_seq = state.latest_seq.max(sent.seq);
+    state.objects.push(sent);
+    dedupe_objects(&mut state.objects);
+    if state.direct.selected_conversation_id.is_none() {
+        state.force_message_follow = true;
+    }
+}
+
+/// Ends the conversation session. Home has no status row, so in Shell mode the
+/// reason and how to reconnect show as a lasting error the person can see.
+fn apply_session_loss(state: &mut AppState, shell_mode: bool, detail: &str) {
+    bump_selection_generation(state);
+    state.request_id = None;
+    state.session_active = false;
+    state.show_participants = false;
+    state.show_access_controls = false;
+    state.force_message_follow = true;
+    state.latest_seq = 0;
+    state.objects.clear();
+    state.participants.clear();
+    state.active_sessions.clear();
+    state.attachment_urls.clear();
+    state.status_badge = if shell_mode { "Reconnect" } else { "Join" }.to_string();
+    state.status_detail = detail.to_string();
+    state.error_text = shell_mode.then(|| detail.to_string());
+    state.error_transient = false;
+    state.reconnect_needed = shell_mode;
+}
+
 fn apply_active_poll_state(
     state: &mut AppState,
     mut poll: RoomPollView,
@@ -3735,6 +4358,13 @@ fn apply_active_poll_state(
     let previous_status_detail = state.status_detail.clone();
     let previous_collaboration_configured = state.collaboration_configured;
     state.collaboration_configured = poll.transport.configured;
+    if !was_session_active
+        && (state.reconnect_needed
+            || state.error_text.as_deref() == Some(SHELL_SESSION_LOST_DETAIL))
+    {
+        state.error_text = None;
+    }
+    state.reconnect_needed = false;
     state.session_active = true;
     state.close_leave_sent = false;
     state.display_name = poll.display_name.clone();
@@ -3750,7 +4380,10 @@ fn apply_active_poll_state(
             .participants
             .retain(configured_shared_participant_visible);
     }
-    if previous_latest_seq != state.latest_seq {
+    // A new session opens at the newest message. Later messages follow only a
+    // reader already at the bottom (`should_follow_scroll`), so reading older
+    // history keeps its place; the person's own send forces follow itself.
+    if !was_session_active {
         state.force_message_follow = true;
     }
 
@@ -3947,6 +4580,14 @@ fn load_state(session_storage: Option<&Storage>, config: &AppConfig) -> AppState
         attachment_urls: BTreeMap::new(),
         join_invite_url: None,
         direct: DirectUiState::default(),
+        composer_conversation: None,
+        reconnect_needed: false,
+        reconnecting: false,
+        pending_direct_launch: None,
+        drafts: BTreeMap::new(),
+        composer_revision: 0,
+        composer_edits: 0,
+        held_direct_sends: BTreeMap::new(),
         error_text: None,
     }
 }
@@ -4019,18 +4660,416 @@ mod tests {
         DirectConversationView, DirectMessageList, DirectUiState, PendingDirectSend,
     };
     use super::{
-        apply_active_poll_if_current, apply_active_poll_state, apply_direct_refresh_if_current,
-        chat_control_policy, clear_selected_direct_conversation, commit_direct_selection,
+        admitted_home_origin, apply_active_poll_if_current, apply_active_poll_state,
+        apply_direct_refresh_if_current, apply_session_loss, chat_control_policy,
+        clear_selected_direct_conversation, commit_direct_selection,
         commit_requested_direct_selection_if_current, commit_shared_selection,
-        conversation_initial, current_selection_guard, decode_query_value, extract_fragment_param,
-        extract_query_param, format_chat_message_request_id, object_sender_name,
-        participant_detail, participant_shown_name, pending_chat_request_id, render_projection,
-        resolve_conversation_choice, selection_guard_matches, shell_summary_allows_session,
-        AccessMode, AppConfig, AppState, ConversationObjectKind, ConversationObjectView,
-        ParticipantView, PendingChatSend, RenderProjection, RoomPollView, RoomTransportView,
+        conversation_initial, current_selection_guard, decode_query_value,
+        documents_attachment_message, extract_fragment_param, extract_query_param,
+        format_chat_message_request_id, note_composer_edit, object_sender_name, participant_detail,
+        participant_shown_name, pending_chat_request_id, render_projection,
+        resolve_conversation_choice, selection_guard_matches, settle_sent_draft,
+        shell_summary_allows_session, switch_composer_draft, AccessMode, AppConfig, AppState,
+        AttachmentView, ConversationObjectKind, ConversationObjectView, ParticipantView,
+        PendingChatSend, RenderProjection, RoomPollView, RoomTransportView,
         ShellSessionBootstrapFailure, ShellSessionStartOutput, SummaryView,
     };
 
+    fn two_direct_conversations() -> AppState {
+        let mut state = AppState::default();
+        state.direct.conversations = ["a", "b"]
+            .into_iter()
+            .map(|name| DirectConversationView {
+                conversation_id: format!("direct:sha256:{name}"),
+                display_name: name.to_uppercase(),
+                removed: false,
+                unread: false,
+            })
+            .collect();
+        state
+    }
+
+    #[test]
+    fn authority_loss_keeps_direct_selection_drafts_and_pending_send() {
+        let mut state = two_direct_conversations();
+        switch_composer_draft(&mut state, "");
+        note_composer_edit(&mut state);
+        commit_direct_selection(&mut state, "direct:sha256:a").unwrap();
+        switch_composer_draft(&mut state, "shared draft");
+        note_composer_edit(&mut state);
+        state.direct.pending_send = Some(super::PendingDirectSend {
+            request_id: "uncertain-send".into(),
+            conversation_id: "direct:sha256:a".into(),
+            text: "sent draft".into(),
+        });
+        state.session_active = true;
+        let guard = current_selection_guard(&state);
+        let direct = state.direct.clone();
+        let revision = state.composer_revision;
+        super::apply_session_loss(&mut state, true, "Reconnect through Home.");
+        assert!(state.reconnect_needed);
+        assert!(!state.session_active);
+        assert_eq!(state.direct, direct);
+        assert_eq!(state.drafts[&None].0, "shared draft");
+        assert_eq!(state.composer_revision, revision);
+        assert!(!selection_guard_matches(&state, &guard));
+    }
+
+    #[test]
+    fn failed_initial_direct_intent_survives_loss_and_yields_to_a_user_selection() {
+        let mut state = AppState {
+            pending_direct_launch: Some("direct:a".into()),
+            ..AppState::default()
+        };
+        super::apply_session_loss(&mut state, true, "Reconnect through Home.");
+        assert_eq!(state.pending_direct_launch.as_deref(), Some("direct:a"));
+        state.direct.conversations = vec![DirectConversationView {
+            conversation_id: "direct:a".into(),
+            display_name: "A".into(),
+            removed: false,
+            unread: false,
+        }];
+        let restored_generation = state.selection_generation;
+        assert!(commit_requested_direct_selection_if_current(
+            &mut state,
+            restored_generation,
+            "direct:a"
+        )
+        .is_some());
+        assert_eq!(
+            state.direct.selected_conversation_id.as_deref(),
+            Some("direct:a")
+        );
+        assert!(state.pending_direct_launch.is_none());
+        state.pending_direct_launch = Some("direct:a".into());
+        let pending_generation = state.selection_generation;
+        commit_shared_selection(&mut state);
+        assert!(state.pending_direct_launch.is_none());
+        assert!(commit_requested_direct_selection_if_current(
+            &mut state,
+            pending_generation,
+            "direct:a"
+        )
+        .is_none());
+        assert!(state.direct.selected_conversation_id.is_none());
+    }
+
+    #[test]
+    fn a_lost_home_session_shows_how_to_reconnect_until_it_is_back() {
+        let poll = || RoomPollView {
+            room_slug: "chat-room".to_string(),
+            display_name: "Shared room".to_string(),
+            latest_seq: 1,
+            participants: vec![],
+            objects: vec![],
+            transport: RoomTransportView::default(),
+        };
+        let mut state = AppState {
+            session_active: true,
+            ..AppState::default()
+        };
+        apply_session_loss(&mut state, true, super::SHELL_SESSION_LOST_DETAIL);
+        assert!(!state.session_active);
+        assert_eq!(
+            state.error_text.as_deref(),
+            Some(super::SHELL_SESSION_LOST_DETAIL)
+        );
+        assert!(!state.error_transient);
+        assert!(super::shows_reconnect(
+            true,
+            state.session_active,
+            state.reconnect_needed
+        ));
+
+        // A passing error replaces the message, but Reconnect stays offered.
+        state.error_text = Some("temporary".into());
+        assert!(super::shows_reconnect(
+            true,
+            state.session_active,
+            state.reconnect_needed
+        ));
+        // A failed attempt while still lost says so and keeps the action.
+        super::apply_reconnect_failure(&mut state, "Home refused".into());
+        assert_eq!(state.error_text.as_deref(), Some("Home refused"));
+        assert!(super::shows_reconnect(
+            true,
+            state.session_active,
+            state.reconnect_needed
+        ));
+
+        apply_active_poll_state(&mut state, poll());
+        assert!(state.session_active);
+        assert_eq!(state.error_text, None);
+        assert!(!super::shows_reconnect(
+            true,
+            state.session_active,
+            state.reconnect_needed
+        ));
+        // A later step failing after the session came back is reported as
+        // itself, not as a failed reconnect.
+        super::apply_reconnect_failure(&mut state, "attachment failed".into());
+        assert_eq!(state.error_text.as_deref(), Some("attachment failed"));
+        assert!(!super::shows_reconnect(
+            true,
+            state.session_active,
+            state.reconnect_needed
+        ));
+
+        // A browser guest keeps its own Join stage instead.
+        let mut guest = AppState::default();
+        apply_session_loss(&mut guest, false, "removed");
+        assert_eq!(guest.error_text, None);
+        assert_eq!(guest.status_badge, "Join");
+    }
+
+    fn shared_poll(latest_seq: u64) -> RoomPollView {
+        RoomPollView {
+            room_slug: "chat-room".to_string(),
+            display_name: "Shared room".to_string(),
+            latest_seq,
+            participants: vec![],
+            objects: vec![],
+            transport: RoomTransportView::default(),
+        }
+    }
+
+    #[test]
+    fn only_a_new_session_pulls_the_reader_to_the_newest_message() {
+        let mut state = AppState::default();
+        apply_active_poll_state(&mut state, shared_poll(1));
+        assert!(state.force_message_follow);
+        state.force_message_follow = false;
+        // A message arrives while the person reads older history.
+        apply_active_poll_state(&mut state, shared_poll(2));
+        assert!(!state.force_message_follow);
+    }
+
+    #[test]
+    fn a_late_community_send_does_not_move_a_direct_reader() {
+        let sent = || ConversationObjectView {
+            seq: 7,
+            sender: "Me".into(),
+            sender_ref: None,
+            sender_profile_verified: Some(true),
+            from_current_session: true,
+            kind: ConversationObjectKind::Text,
+            body: Some("hi".into()),
+            emoji: None,
+            link: None,
+            attachment: None,
+            created_at: 1,
+        };
+        let mut state = two_direct_conversations();
+        super::record_own_shared_send(&mut state, sent());
+        assert!(state.force_message_follow);
+
+        let mut state = two_direct_conversations();
+        commit_direct_selection(&mut state, "direct:sha256:b").unwrap();
+        super::record_own_shared_send(&mut state, sent());
+        assert!(!state.force_message_follow);
+        assert_eq!(state.latest_seq, 7);
+    }
+
+    #[test]
+    fn a_late_community_receipt_keeps_one_object_and_the_newer_poll_cursor() {
+        let object = |seq, sender: &str, body: &str| ConversationObjectView {
+            seq,
+            sender: sender.into(),
+            sender_ref: None,
+            sender_profile_verified: Some(true),
+            from_current_session: sender == "Me",
+            kind: ConversationObjectKind::Text,
+            body: Some(body.into()),
+            emoji: None,
+            link: None,
+            attachment: None,
+            created_at: 1,
+        };
+        let sent = object(7, "Me", "accepted message");
+        let newer_peer = object(9, "Peer", "newer message");
+        let mut state = two_direct_conversations();
+        note_composer_edit(&mut state);
+        let sent_revision = state.composer_revision;
+        commit_direct_selection(&mut state, "direct:sha256:a").unwrap();
+        switch_composer_draft(&mut state, "accepted message");
+        note_composer_edit(&mut state);
+        commit_shared_selection(&mut state);
+        switch_composer_draft(&mut state, "direct draft");
+        note_composer_edit(&mut state);
+        let drafts = state.drafts.clone();
+        let revisions = (state.composer_revision, state.composer_edits);
+
+        let poll = RoomPollView {
+            objects: vec![sent.clone(), newer_peer],
+            ..shared_poll(9)
+        };
+        apply_active_poll_state(&mut state, poll);
+        // Polling has already admitted the accepted send and later traffic
+        // before its held HTTP response reaches the composer.
+        super::record_own_shared_send(&mut state, sent.clone());
+        super::record_own_shared_send(&mut state, sent);
+
+        assert_eq!(state.latest_seq, 9);
+        assert_eq!(state.objects.len(), 2);
+        assert_eq!(
+            state
+                .objects
+                .iter()
+                .filter(|object| object.seq == 7)
+                .count(),
+            1
+        );
+        assert_eq!(state.objects[1].body.as_deref(), Some("newer message"));
+        assert!(!settle_sent_draft(&mut state, &None, sent_revision));
+        assert_eq!(state.drafts, drafts);
+        assert_eq!((state.composer_revision, state.composer_edits), revisions);
+    }
+
+    #[test]
+    fn home_messages_need_a_real_home_origin() {
+        assert_eq!(
+            admitted_home_origin(Some("http://127.0.0.1:3000")),
+            Some("http://127.0.0.1:3000")
+        );
+        for refused in [None, Some(""), Some("null"), Some("*"), Some(" ")] {
+            assert_eq!(admitted_home_origin(refused), None);
+        }
+    }
+
+    #[test]
+    fn opening_an_attachment_asks_home_for_documents() {
+        let attachment = AttachmentView {
+            attachment_id: "att-1".into(),
+            file_name: "notes.txt".into(),
+            mime_type: "text/plain".into(),
+            size_bytes: 5,
+            is_image: false,
+            is_audio: false,
+            is_video: false,
+        };
+        assert_eq!(
+            documents_attachment_message("home-token", &attachment, "data:text/plain,hello"),
+            serde_json::json!({
+                "type": "home:open-target-with-payload",
+                "target": "documents",
+                "homeToken": "home-token",
+                "payload": {
+                    "type": "documents:open-chat-attachment",
+                    "attachmentId": "att-1",
+                    "fileName": "notes.txt",
+                    "mimeType": "text/plain",
+                    "sizeBytes": 5,
+                    "dataUrl": "data:text/plain,hello",
+                },
+            })
+        );
+    }
+
+    #[test]
+    fn a_draft_stays_with_its_conversation() {
+        let mut state = two_direct_conversations();
+        assert_eq!(switch_composer_draft(&mut state, "shared words"), None);
+        commit_direct_selection(&mut state, "direct:sha256:a").unwrap();
+        assert_eq!(
+            switch_composer_draft(&mut state, "shared words").as_deref(),
+            Some("")
+        );
+        commit_direct_selection(&mut state, "direct:sha256:b").unwrap();
+        assert_eq!(
+            switch_composer_draft(&mut state, "for A").as_deref(),
+            Some("")
+        );
+        commit_direct_selection(&mut state, "direct:sha256:a").unwrap();
+        assert_eq!(
+            switch_composer_draft(&mut state, "").as_deref(),
+            Some("for A")
+        );
+        commit_shared_selection(&mut state);
+        assert_eq!(
+            switch_composer_draft(&mut state, "for A").as_deref(),
+            Some("shared words")
+        );
+        // B was left empty, so nothing is kept for it.
+        assert!(!state.drafts.contains_key(&Some("direct:sha256:b".into())));
+    }
+
+    #[test]
+    fn resending_a_restored_draft_reuses_its_request_id() {
+        let mut state = two_direct_conversations();
+        commit_direct_selection(&mut state, "direct:sha256:a").unwrap();
+        let first = super::pending_direct_request_id(
+            &mut state.direct.pending_send,
+            "direct:sha256:a",
+            "hello",
+            || Ok("request-1".to_string()),
+        )
+        .unwrap();
+        // The response is held while the person visits B and comes back.
+        commit_direct_selection(&mut state, "direct:sha256:b").unwrap();
+        assert!(state.direct.pending_send.is_none());
+        commit_direct_selection(&mut state, "direct:sha256:a").unwrap();
+        let again = super::pending_direct_request_id(
+            &mut state.direct.pending_send,
+            "direct:sha256:a",
+            "hello",
+            || Ok("request-2".to_string()),
+        )
+        .unwrap();
+        assert_eq!(first, again);
+        commit_shared_selection(&mut state);
+        assert!(state.held_direct_sends.contains_key("direct:sha256:a"));
+    }
+
+    #[test]
+    fn an_accepted_send_clears_only_the_text_it_sent() {
+        let mut state = two_direct_conversations();
+        let a = Some("direct:sha256:a".to_string());
+        commit_direct_selection(&mut state, "direct:sha256:a").unwrap();
+        switch_composer_draft(&mut state, "");
+        note_composer_edit(&mut state);
+        let sent = state.composer_revision;
+        assert!(settle_sent_draft(&mut state, &a, sent));
+        // A second response for the same send finds newer content, even when
+        // the person typed the same words again.
+        note_composer_edit(&mut state);
+        assert!(!settle_sent_draft(&mut state, &a, sent));
+        // A shared-room send that completes while A is open leaves A alone.
+        let current = state.composer_revision;
+        assert!(!settle_sent_draft(&mut state, &None, current));
+    }
+
+    #[test]
+    fn a_send_accepted_after_a_to_b_to_a_does_not_come_back_or_clear_new_text() {
+        let mut state = two_direct_conversations();
+        let a = Some("direct:sha256:a".to_string());
+        commit_direct_selection(&mut state, "direct:sha256:a").unwrap();
+        switch_composer_draft(&mut state, "");
+        note_composer_edit(&mut state);
+        let sent = state.composer_revision;
+        // Sent "hello" in A, then moved to B before the response.
+        commit_direct_selection(&mut state, "direct:sha256:b").unwrap();
+        switch_composer_draft(&mut state, "hello");
+        note_composer_edit(&mut state);
+        assert!(!settle_sent_draft(&mut state, &a, sent));
+        commit_direct_selection(&mut state, "direct:sha256:a").unwrap();
+        assert_eq!(
+            switch_composer_draft(&mut state, "typing to B").as_deref(),
+            Some("")
+        );
+
+        // Moved away again with the draft unsent: a late response for an
+        // older revision keeps the saved newer draft.
+        note_composer_edit(&mut state);
+        let newer = state.composer_revision;
+        commit_direct_selection(&mut state, "direct:sha256:b").unwrap();
+        switch_composer_draft(&mut state, "a newer line");
+        assert!(!settle_sent_draft(&mut state, &a, sent));
+        assert_eq!(
+            state.drafts.get(&a).map(|(_, revision)| *revision),
+            Some(newer)
+        );
+    }
+
     #[test]
     fn navigation_hint_uses_current_verified_selection_without_draft_or_effects() {
         let mut state = AppState::default();
@@ -4038,6 +5077,7 @@ mod tests {
             conversation_id: "direct:sha256:conversation-b".into(),
             display_name: "B".into(),
             removed: false,
+            unread: false,
         }];
         let guard = commit_direct_selection(&mut state, "direct:sha256:conversation-b").unwrap();
         let conversations = state.direct.conversations.clone();
@@ -4212,18 +5252,17 @@ mod tests {
         assert!(!policy.show_browser_requests);
         assert!(!policy.show_room_access_toggle);
         assert!(!policy.show_room_access);
-        assert!(!policy.show_conversation_join);
         assert!(!policy.enable_gateway_controls);
 
         let public_policy = chat_control_policy(true, true, false, false, true, true);
         assert!(!public_policy.enable_text_send);
         assert!(!public_policy.show_browser_requests);
-        assert!(!public_policy.show_conversation_join);
     }
 
     #[test]
     fn configured_chat_uses_verified_profile_names_without_device_details() {
         let participant = ParticipantView {
+            card: None,
             display_name: "Owner".to_string(),
             profile_verified: Some(true),
             device_label: "MacBook".to_string(),
@@ -4236,6 +5275,7 @@ mod tests {
         assert_eq!(participant_detail(&participant, false, false), "active now");
 
         let object = ConversationObjectView {
+            sender_ref: None,
             seq: 1,
             sender: "Owner".to_string(),
             sender_profile_verified: Some(true),
@@ -4259,6 +5299,7 @@ mod tests {
             latest_seq: 4,
             participants: vec![
                 ParticipantView {
+                    card: None,
                     display_name: "Owner".to_string(),
                     profile_verified: Some(true),
                     device_label: String::new(),
@@ -4268,6 +5309,7 @@ mod tests {
                     is_current_session: true,
                 },
                 ParticipantView {
+                    card: None,
                     display_name: "Wrong endpoint".to_string(),
                     profile_verified: Some(false),
                     device_label: "Laptop".to_string(),
@@ -4277,6 +5319,7 @@ mod tests {
                     is_current_session: false,
                 },
                 ParticipantView {
+                    card: None,
                     display_name: "Unsigned guest".to_string(),
                     profile_verified: None,
                     device_label: "Browser".to_string(),
@@ -4286,6 +5329,7 @@ mod tests {
                     is_current_session: false,
                 },
                 ParticipantView {
+                    card: None,
                     display_name: String::new(),
                     profile_verified: Some(true),
                     device_label: String::new(),
@@ -4297,6 +5341,7 @@ mod tests {
             ],
             objects: vec![
                 ConversationObjectView {
+                    sender_ref: None,
                     seq: 1,
                     sender: "Owner".to_string(),
                     sender_profile_verified: Some(true),
@@ -4309,6 +5354,7 @@ mod tests {
                     created_at: 1,
                 },
                 ConversationObjectView {
+                    sender_ref: None,
                     seq: 2,
                     sender: "Wrong profile".to_string(),
                     sender_profile_verified: Some(false),
@@ -4321,6 +5367,7 @@ mod tests {
                     created_at: 2,
                 },
                 ConversationObjectView {
+                    sender_ref: None,
                     seq: 3,
                     sender: "Wrong endpoint".to_string(),
                     sender_profile_verified: Some(false),
@@ -4333,6 +5380,7 @@ mod tests {
                     created_at: 3,
                 },
                 ConversationObjectView {
+                    sender_ref: None,
                     seq: 4,
                     sender: String::new(),
                     sender_profile_verified: None,
@@ -4390,14 +5438,12 @@ mod tests {
         assert!(!shell_isolated.show_browser_requests);
         assert!(!shell_isolated.show_room_access_toggle);
         assert!(!shell_isolated.show_room_access);
-        assert!(!shell_isolated.show_conversation_join);
         assert!(!shell_isolated.enable_gateway_controls);
 
         let gateway_isolated = chat_control_policy(true, false, false, true, true, true);
         assert!(gateway_isolated.show_browser_requests);
         assert!(gateway_isolated.show_room_access_toggle);
         assert!(gateway_isolated.show_room_access);
-        assert!(!gateway_isolated.show_conversation_join);
         assert!(gateway_isolated.enable_gateway_controls);
     }
 
@@ -4409,17 +5455,7 @@ mod tests {
         assert!(!unknown.show_browser_requests);
         assert!(!unknown.show_room_access_toggle);
         assert!(!unknown.show_room_access);
-        assert!(!unknown.show_conversation_join);
         assert!(!unknown.enable_gateway_controls);
-
-        let configured = chat_control_policy(true, true, true, false, true, true);
-        assert!(!configured.show_conversation_join);
-
-        let unconfigured_gateway = chat_control_policy(true, false, false, false, false, false);
-        assert!(unconfigured_gateway.show_conversation_join);
-
-        let unconfigured_shell = chat_control_policy(true, false, true, false, false, false);
-        assert!(!unconfigured_shell.show_conversation_join);
     }
 
     #[test]
@@ -4463,7 +5499,6 @@ mod tests {
         let config = AppConfig {
             access_mode: AccessMode::Shell,
             home_token: Some("test-token".to_string()),
-            initial_join_invite: None,
             initial_direct_conversation_id: None,
             browser_session_request_storage_key: "test-key".to_string(),
         };
@@ -4544,7 +5579,6 @@ mod tests {
         let config = AppConfig {
             access_mode: AccessMode::Shell,
             home_token: Some("test-token".to_string()),
-            initial_join_invite: None,
             initial_direct_conversation_id: None,
             browser_session_request_storage_key: "test-key".to_string(),
         };
@@ -4588,7 +5622,6 @@ mod tests {
         let config = AppConfig {
             access_mode: AccessMode::Shell,
             home_token: Some("test-token".to_string()),
-            initial_join_invite: None,
             initial_direct_conversation_id: Some("direct:sha256:fixture-conversation".to_string()),
             browser_session_request_storage_key: "test-key".to_string(),
         };
@@ -4597,6 +5630,7 @@ mod tests {
             conversation_id: "direct:sha256:fixture-conversation".to_string(),
             display_name: "Fixture Friend".to_string(),
             removed: false,
+            unread: false,
         }];
         let bootstrap_generation = state.selection_generation;
         let shared_guard = commit_shared_selection(&mut state);
@@ -4615,7 +5649,6 @@ mod tests {
         let config = AppConfig {
             access_mode: AccessMode::Shell,
             home_token: Some("test-token".to_string()),
-            initial_join_invite: None,
             initial_direct_conversation_id: None,
             browser_session_request_storage_key: "test-key".to_string(),
         };
@@ -4624,6 +5657,7 @@ mod tests {
             conversation_id: "direct:sha256:fixture-conversation".to_string(),
             display_name: "Fixture Friend".to_string(),
             removed: false,
+            unread: false,
         }];
         let direct_guard =
             commit_direct_selection(&mut state, "direct:sha256:fixture-conversation")
@@ -4647,6 +5681,7 @@ mod tests {
                 conversation_id: "direct:sha256:fixture-conversation".to_string(),
                 display_name: "Fixture Friend".to_string(),
                 removed: false,
+                unread: false,
             }],
             direct_messages,
         );
@@ -4660,7 +5695,6 @@ mod tests {
         let config = AppConfig {
             access_mode: AccessMode::Shell,
             home_token: Some("test-token".to_string()),
-            initial_join_invite: None,
             initial_direct_conversation_id: None,
             browser_session_request_storage_key: "test-key".to_string(),
         };
@@ -4669,6 +5703,7 @@ mod tests {
             conversation_id: "direct:sha256:fixture-conversation".to_string(),
             display_name: "Fixture Friend".to_string(),
             removed: false,
+            unread: false,
         }];
         let shared_guard = current_selection_guard(&state);
         let direct_guard =
@@ -4854,7 +5889,6 @@ struct ChatControlPolicy {
     show_browser_requests: bool,
     show_room_access_toggle: bool,
     show_room_access: bool,
-    show_conversation_join: bool,
     enable_gateway_controls: bool,
 }
 
@@ -4874,7 +5908,6 @@ fn chat_control_policy(
         show_browser_requests: gateway_surface && has_pending_requests,
         show_room_access_toggle: gateway_surface && session_active,
         show_room_access: gateway_surface && session_active && show_access_controls,
-        show_conversation_join: gateway_surface && !session_active,
         enable_gateway_controls: gateway_surface && session_active,
     }
 }
@@ -4965,12 +5998,35 @@ fn participant_detail(participant: &ParticipantView, is_local: bool, shell_mode:
     } else if participant.local_session_count > 0 {
         parts.push("web guest".to_string());
     }
-    if participant.last_seen_at > 0 && !is_local && !local_runtime_participant && !shell_mode {
+    let remote_card = participant
+        .card
+        .as_ref()
+        .filter(|card| card.relationship != "you");
+    if let Some(card) = remote_card {
+        // Community members: presence when they share it, otherwise the
+        // time of their last public message.
+        if card.active_now {
+            parts.push("active now".to_string());
+        } else if participant.last_seen_at > 0 {
+            parts.push(last_message_text(participant.last_seen_at));
+        }
+    } else if participant.last_seen_at > 0 && !is_local && !local_runtime_participant && !shell_mode
+    {
         parts.push(format!("seen {}", format_time(participant.last_seen_at)));
     }
     parts.join(" · ")
 }
 
+/// "last message 14:02" today, otherwise with the day.
+fn last_message_text(timestamp_secs: u64) -> String {
+    let now = (js_sys::Date::now() / 1000.0) as u64;
+    if local_day(timestamp_secs) == local_day(now) {
+        format!("last message {}", format_time(timestamp_secs))
+    } else {
+        format!("last message {}", day_separator_text(timestamp_secs))
+    }
+}
+
 /// The declared direct-conversation attachment policy, stated where the
 /// person meets it. Attachments need object handling and a delivery path of
 /// their own, designed on the unified delivery layer — until then the attach
@@ -4990,6 +6046,32 @@ fn participant_shown_name(participant: &ParticipantView) -> &str {
     &participant.display_name
 }
 
+const PARTICIPANT_CARD_REQUEST_SENT: &str =
+    "Contact request sent. They accept or decline it in Inbox.";
+
+/// The card's status line and its one action (label, action id).
+fn participant_card_copy(
+    card: &ParticipantCard,
+    can_act: bool,
+) -> (&'static str, Option<(&'static str, &'static str)>) {
+    let (text, action) = match card.relationship.as_str() {
+        "you" => ("This is you.", None),
+        "contact" if card.conversation_id.is_some() => ("Contact", Some(("Message", "message"))),
+        "contact" => ("Contact", None),
+        "requested" => ("Contact request sent. Waiting for them to accept.", None),
+        "pending" => (
+            "Wants to add you as a contact.",
+            Some(("Open Inbox", "inbox")),
+        ),
+        _ if card.can_add_contact => ("In Community", Some(("Add contact", "add-contact"))),
+        _ => (
+            "To add each other, both of you turn on Discovery in People.",
+            Some(("Open People", "people")),
+        ),
+    };
+    (text, if can_act { action } else { None })
+}
+
 fn participant_initial(name: &str) -> String {
     name.chars()
         .find(|ch| ch.is_alphanumeric())
@@ -5018,15 +6100,65 @@ fn room_access_policy_enabled_default() -> bool {
     true
 }
 
+fn local_date(timestamp_secs: u64) -> js_sys::Date {
+    js_sys::Date::new(&(timestamp_secs as f64 * 1000.0).into())
+}
+
+/// Hours and minutes in the viewer's own time zone.
 fn format_time(timestamp_secs: u64) -> String {
-    let iso = js_sys::Date::new(&(timestamp_secs as f64 * 1000.0).into())
-        .to_iso_string()
-        .as_string()
-        .unwrap_or_default();
-    if iso.len() >= 16 {
-        iso[11..16].to_string()
+    let date = local_date(timestamp_secs);
+    format!("{:02}:{:02}", date.get_hours(), date.get_minutes())
+}
+
+/// The viewer's local calendar day: (year, month 0-11, day of month).
+fn local_day(timestamp_secs: u64) -> (u32, u32, u32) {
+    let date = local_date(timestamp_secs);
+    (date.get_full_year(), date.get_month(), date.get_date())
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum DayLabel {
+    Today,
+    Yesterday,
+    Date { same_year: bool },
+}
+
+/// Chooses the separator label for a message day, given today and
+/// yesterday in the viewer's time zone.
+fn day_label(day: (u32, u32, u32), today: (u32, u32, u32), yesterday: (u32, u32, u32)) -> DayLabel {
+    if day == today {
+        DayLabel::Today
+    } else if day == yesterday {
+        DayLabel::Yesterday
     } else {
-        timestamp_secs.to_string()
+        DayLabel::Date {
+            same_year: day.0 == today.0,
+        }
+    }
+}
+
+fn day_separator_text(timestamp_secs: u64) -> String {
+    let now = (js_sys::Date::now() / 1000.0) as u64;
+    match day_label(
+        local_day(timestamp_secs),
+        local_day(now),
+        local_day(now.saturating_sub(86_400)),
+    ) {
+        DayLabel::Today => "Today".to_string(),
+        DayLabel::Yesterday => "Yesterday".to_string(),
+        DayLabel::Date { same_year } => {
+            let options = JsObject::new();
+            let _ = Reflect::set(&options, &"weekday".into(), &"short".into());
+            let _ = Reflect::set(&options, &"month".into(), &"short".into());
+            let _ = Reflect::set(&options, &"day".into(), &"numeric".into());
+            if !same_year {
+                let _ = Reflect::set(&options, &"year".into(), &"numeric".into());
+            }
+            local_date(timestamp_secs)
+                .to_locale_date_string("default", &options)
+                .as_string()
+                .unwrap_or_default()
+        }
     }
 }
 
@@ -5400,3 +6532,102 @@ fn js_error(error: JsValue) -> String {
         .as_string()
         .unwrap_or_else(|| "browser storage error".to_string())
 }
+
+#[cfg(test)]
+mod participant_card_tests {
+    use super::*;
+
+    fn card(
+        relationship: &str,
+        conversation_id: Option<&str>,
+        can_add_contact: bool,
+    ) -> ParticipantCard {
+        ParticipantCard {
+            participant_ref: "contact:0".to_string(),
+            relationship: relationship.to_string(),
+            conversation_id: conversation_id.map(str::to_string),
+            can_add_contact,
+            active_now: false,
+        }
+    }
+
+    #[test]
+    fn participant_card_offers_one_action_per_relationship() {
+        assert_eq!(
+            participant_card_copy(&card("you", None, false), true).1,
+            None
+        );
+        assert_eq!(
+            participant_card_copy(&card("contact", Some("direct:1"), false), true).1,
+            Some(("Message", "message"))
+        );
+        assert_eq!(
+            participant_card_copy(&card("requested", None, false), true).1,
+            None
+        );
+        assert_eq!(
+            participant_card_copy(&card("pending", None, false), true).1,
+            Some(("Open Inbox", "inbox"))
+        );
+        assert_eq!(
+            participant_card_copy(&card("none", None, true), true).1,
+            Some(("Add contact", "add-contact"))
+        );
+        assert_eq!(
+            participant_card_copy(&card("none", None, false), true).1,
+            Some(("Open People", "people"))
+        );
+        assert_eq!(
+            participant_card_copy(&card("contact", Some("direct:1"), false), false).1,
+            None,
+            "without a Home token the card only informs"
+        );
+    }
+
+    #[test]
+    fn participant_card_reads_runtime_json() {
+        let participant: ParticipantView = serde_json::from_value(serde_json::json!({
+            "card": {
+                "participant_ref": "contact:abc",
+                "relationship": "contact",
+                "conversation_id": "direct:1",
+                "can_add_contact": false
+            },
+            "display_name": "Alex",
+            "profile_verified": true,
+            "device_label": "",
+            "last_seen_at": 0
+        }))
+        .unwrap();
+        let parsed = participant.card.unwrap();
+        assert_eq!(parsed.participant_ref, "contact:abc");
+        assert_eq!(parsed.conversation_id.as_deref(), Some("direct:1"));
+        let object: ConversationObjectView = serde_json::from_value(serde_json::json!({
+            "seq": 1, "sender": "Alex", "sender_ref": "contact:abc", "kind": "text",
+            "body": "hi", "created_at": 1
+        }))
+        .unwrap();
+        assert_eq!(object.sender_ref.as_deref(), Some("contact:abc"));
+    }
+}
+
+#[cfg(test)]
+mod day_label_tests {
+    use super::*;
+
+    #[test]
+    fn day_label_names_today_yesterday_and_older_dates() {
+        let today = (2026, 8, 30);
+        let yesterday = (2026, 8, 29);
+        assert_eq!(day_label(today, today, yesterday), DayLabel::Today);
+        assert_eq!(day_label(yesterday, today, yesterday), DayLabel::Yesterday);
+        assert_eq!(
+            day_label((2026, 7, 1), today, yesterday),
+            DayLabel::Date { same_year: true }
+        );
+        assert_eq!(
+            day_label((2025, 11, 31), today, yesterday),
+            DayLabel::Date { same_year: false }
+        );
+    }
+}
diff --git a/capsules/chat-room/browser/chat-chrome.js b/capsules/chat-room/browser/chat-chrome.js
index fd74d00d0..51dfff674 100644
--- a/capsules/chat-room/browser/chat-chrome.js
+++ b/capsules/chat-room/browser/chat-chrome.js
@@ -1,11 +1,10 @@
     (function () {
       const launchParams = new URLSearchParams(window.location.search);
-      const homeToken = new URLSearchParams(window.location.hash.replace(/^#/, "")).get("home_token") || "";
+      let homeToken = new URLSearchParams(window.location.hash.replace(/^#/, "")).get("home_token") || "";
       const homeParentOrigin = launchParams.get("home_origin") || "";
       const participantToggle = document.getElementById("participant-toggle");
       const roomAccessToggle = document.getElementById("room-access-toggle");
       const conversationSelector = document.getElementById("conversation-selector");
-      const conversationJoinSection = document.getElementById("conversation-join-section");
       const composerForm = document.getElementById("composer-form");
       const composerField = composerForm?.querySelector(".composer-field") || null;
       const messageInput = document.getElementById("message-input");
@@ -59,11 +58,11 @@
       }
 
       function syncCompactConversationRail() {
-        if (!conversationSelector || !conversationJoinSection) {
+        if (!conversationSelector) {
           return;
         }
         const choiceCount = conversationSelector.querySelectorAll("[data-conversation-choice]").length;
-        const canHideCompactRail = choiceCount < 2 && conversationJoinSection.hidden;
+        const canHideCompactRail = choiceCount < 2;
         document.body.setAttribute("data-room-compact-rail", canHideCompactRail ? "hidden" : "visible");
       }
 
@@ -97,6 +96,13 @@
       syncCompactConversationRail();
       syncComposerPresentation();
 
+      window.addEventListener("elastos-chat-authority-renewed", () => {
+        homeToken = globalThis.elastosChatHomeToken();
+        homeReadySent = false;
+        lastMenuManifest = "";
+        announceHomeChrome();
+      });
+
       if (messageInput) {
         messageInput.addEventListener("input", syncComposerPresentation);
       }
@@ -150,13 +156,6 @@
         });
       }
 
-      if (conversationJoinSection) {
-        new MutationObserver(syncCompactConversationRail).observe(conversationJoinSection, {
-          attributes: true,
-          attributeFilter: ["hidden"],
-        });
-      }
-
       window.addEventListener("message", (event) => {
         if (!isTrustedHomeMenuEvent(event)) {
           return;
diff --git a/capsules/chat-room/browser/chat-room.js b/capsules/chat-room/browser/chat-room.js
index c4ae63342..43dd9df8f 100644
--- a/capsules/chat-room/browser/chat-room.js
+++ b/capsules/chat-room/browser/chat-room.js
@@ -2,24 +2,84 @@
     import {
       createHomeClipboardClient,
     } from "/apps/home/home-clipboard-client.js?v=home-20260726a";
-    import init from "./chat_room_ui.js?v=chat-room-ui-20260804a";
+    import init from "./chat_room_ui.js?v=chat-room-ui-20261008a";
 
     const chatLaunchParams = new URLSearchParams(window.location.search);
-    const chatHomeToken = new URLSearchParams(window.location.hash.replace(/^#/, "")).get("home_token") || "";
+    let chatHomeToken = new URLSearchParams(window.location.hash.replace(/^#/, "")).get("home_token") || "";
     if (chatHomeToken) {
       const homeNavigation = createHomeNavigationClient({ homeToken: chatHomeToken,
         homeOrigin: chatLaunchParams.get("home_origin") || "" });
-      globalThis.elastosChatNavigation = (query) => homeNavigation.setQuery(query);
-      const homeClipboard = createHomeClipboardClient({
+      let currentQuery = chatLaunchParams.has("conversation_id")
+        ? { conversation_id: chatLaunchParams.get("conversation_id") } : {};
+      globalThis.elastosChatNavigation = (query) => {
+        currentQuery = { ...query };
+        homeNavigation.setQuery(query);
+      };
+      const clipboardOptions = () => ({
         targetId: "chat-room",
         homeOrigin: chatLaunchParams.get("home_origin") || "",
         homeToken: chatHomeToken,
       });
+      let homeClipboard = createHomeClipboardClient(clipboardOptions());
       homeClipboard.start();
       globalThis.elastosChatCopyInvite = (text) => homeClipboard.writeText(text, {
         purpose: "conversation.invite",
       });
+      globalThis.elastosChatHomeToken = () => chatHomeToken;
+      let pendingReconnect = null;
+      globalThis.elastosChatReconnect = () => {
+        if (pendingReconnect) return pendingReconnect;
+        const homeOrigin = chatLaunchParams.get("home_origin") || "";
+        if (!homeOrigin || homeOrigin === "null" || homeOrigin === "*" || window.top === window) {
+          return Promise.reject(new Error("Open Chat from Home to reconnect."));
+        }
+        const requestId = window.crypto.randomUUID();
+        pendingReconnect = new Promise((resolve, reject) => {
+          const finish = (error, token) => {
+            window.clearTimeout(timer);
+            window.removeEventListener("message", receive);
+            pendingReconnect = null;
+            if (error) reject(error); else resolve(token);
+          };
+          const receive = (event) => {
+            const data = event.data;
+            if (event.source !== window.top || event.origin !== homeOrigin
+              || data?.type !== "home:shell-response" || data.requestId !== requestId) return;
+            if (data.error) {
+              finish(new Error(data.status === 401 || data.status === 403
+                ? "Sign in to Home, then reconnect Chat. Your drafts are kept."
+                : "Home could not reopen Chat. Try again."));
+              return;
+            }
+            const launched = data.result;
+            let route;
+            try { route = new URL(launched?.route, homeOrigin); } catch { finish(new Error("Home returned an invalid Chat launch.")); return; }
+            const token = new URLSearchParams(route.hash.replace(/^#/, "")).get("home_token") || "";
+            if (launched?.target !== "chat-room" || launched.attach_kind !== "iframe"
+              || (launched.launch_status && launched.launch_status !== "launched")
+              || route.origin !== homeOrigin || route.pathname !== "/apps/chat-room/"
+              || route.username || route.password
+              || !token || token === chatHomeToken || token !== token.trim()) {
+              finish(new Error("Home returned an invalid Chat launch.")); return;
+            }
+            homeClipboard.teardown();
+            chatHomeToken = token;
+            homeNavigation.setHomeToken(token);
+            homeClipboard = createHomeClipboardClient(clipboardOptions());
+            homeClipboard.start();
+            window.dispatchEvent(new Event("elastos-chat-authority-renewed"));
+            finish(null, token);
+          };
+          const timer = window.setTimeout(() => finish(new Error("Home did not answer. Try reconnecting again.")), 30000);
+          window.addEventListener("message", receive);
+          try {
+            window.top.postMessage({ type: "home:launch-target", requestId, target: "chat-room",
+              query: currentQuery, homeToken: chatHomeToken }, homeOrigin);
+          } catch (error) { finish(error); }
+        });
+        return pendingReconnect;
+      };
       init({
-        module_or_path: new URL("./chat_room_ui_bg.wasm?v=chat-room-ui-20260804a", import.meta.url),
+        module_or_path: new URL("./chat_room_ui_bg.wasm?v=chat-room-ui-20261008a", import.meta.url),
       });
     }
diff --git a/capsules/chat-room/browser/chat_room_ui.js b/capsules/chat-room/browser/chat_room_ui.js
index cc786e549..7fad9f657 100644
--- a/capsules/chat-room/browser/chat_room_ui.js
+++ b/capsules/chat-room/browser/chat_room_ui.js
@@ -218,20 +218,20 @@ export function start() {
     wasm.start();
 }
 
-function wasm_bindgen__convert__closures_____invoke__h6c882d24848f50e5(arg0, arg1, arg2) {
-    wasm.wasm_bindgen__convert__closures_____invoke__h6c882d24848f50e5(arg0, arg1, arg2);
+function wasm_bindgen__convert__closures_____invoke__h5883bfd253e22722(arg0, arg1, arg2) {
+    wasm.wasm_bindgen__convert__closures_____invoke__h5883bfd253e22722(arg0, arg1, arg2);
 }
 
-function wasm_bindgen__convert__closures_____invoke__he5a716c89cafc3f6(arg0, arg1, arg2) {
-    wasm.wasm_bindgen__convert__closures_____invoke__he5a716c89cafc3f6(arg0, arg1, arg2);
+function wasm_bindgen__convert__closures_____invoke__h76bc78299e8b98a7(arg0, arg1) {
+    wasm.wasm_bindgen__convert__closures_____invoke__h76bc78299e8b98a7(arg0, arg1);
 }
 
-function wasm_bindgen__convert__closures_____invoke__h31c454d25a03d65b(arg0, arg1) {
-    wasm.wasm_bindgen__convert__closures_____invoke__h31c454d25a03d65b(arg0, arg1);
+function wasm_bindgen__convert__closures_____invoke__hd8efc278d60539af(arg0, arg1) {
+    wasm.wasm_bindgen__convert__closures_____invoke__hd8efc278d60539af(arg0, arg1);
 }
 
-function wasm_bindgen__convert__closures_____invoke__h76bc78299e8b98a7(arg0, arg1) {
-    wasm.wasm_bindgen__convert__closures_____invoke__h76bc78299e8b98a7(arg0, arg1);
+function wasm_bindgen__convert__closures_____invoke__he5a716c89cafc3f6(arg0, arg1, arg2) {
+    wasm.wasm_bindgen__convert__closures_____invoke__he5a716c89cafc3f6(arg0, arg1, arg2);
 }
 
 const __wbindgen_enum_RequestCredentials = ["omit", "same-origin", "include"];
@@ -353,6 +353,13 @@ function __wbg_get_imports() {
         const ret = arg0.call(arg1);
         return ret;
     }, arguments) };
+    imports.wbg.__wbg_className_499ada6a38ae9b27 = function(arg0, arg1) {
+        const ret = arg1.className;
+        const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len1 = WASM_VECTOR_LEN;
+        getDataViewMemory0().setInt32(arg0 + 4 * 1, len1, true);
+        getDataViewMemory0().setInt32(arg0 + 4 * 0, ptr1, true);
+    };
     imports.wbg.__wbg_clearTimeout_5a54f8841c30079a = function(arg0) {
         const ret = clearTimeout(arg0);
         return ret;
@@ -396,6 +403,10 @@ function __wbg_get_imports() {
         const ret = fetch(arg0);
         return ret;
     };
+    imports.wbg.__wbg_firstElementChild_0f402963e541bf19 = function(arg0) {
+        const ret = arg0.firstElementChild;
+        return isLikeNone(ret) ? 0 : addToExternrefTable0(ret);
+    };
     imports.wbg.__wbg_focus_f18e304f287a2dd3 = function() { return handleError(function (arg0) {
         arg0.focus();
     }, arguments) };
@@ -410,10 +421,22 @@ function __wbg_get_imports() {
         getDataViewMemory0().setInt32(arg0 + 4 * 1, len1, true);
         getDataViewMemory0().setInt32(arg0 + 4 * 0, ptr1, true);
     };
+    imports.wbg.__wbg_getDate_5a70d2f6a482d99f = function(arg0) {
+        const ret = arg0.getDate();
+        return ret;
+    };
     imports.wbg.__wbg_getElementById_c365dd703c4a88c3 = function(arg0, arg1, arg2) {
         const ret = arg0.getElementById(getStringFromWasm0(arg1, arg2));
         return isLikeNone(ret) ? 0 : addToExternrefTable0(ret);
     };
+    imports.wbg.__wbg_getFullYear_8240d5a15191feae = function(arg0) {
+        const ret = arg0.getFullYear();
+        return ret;
+    };
+    imports.wbg.__wbg_getHours_5e476e0b9ebc42d1 = function(arg0) {
+        const ret = arg0.getHours();
+        return ret;
+    };
     imports.wbg.__wbg_getItem_89f57d6acc51a876 = function() { return handleError(function (arg0, arg1, arg2, arg3) {
         const ret = arg1.getItem(getStringFromWasm0(arg2, arg3));
         var ptr1 = isLikeNone(ret) ? 0 : passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
@@ -421,6 +444,14 @@ function __wbg_get_imports() {
         getDataViewMemory0().setInt32(arg0 + 4 * 1, len1, true);
         getDataViewMemory0().setInt32(arg0 + 4 * 0, ptr1, true);
     }, arguments) };
+    imports.wbg.__wbg_getMinutes_c95dfb65f1ea8f02 = function(arg0) {
+        const ret = arg0.getMinutes();
+        return ret;
+    };
+    imports.wbg.__wbg_getMonth_25c1c5a601d72773 = function(arg0) {
+        const ret = arg0.getMonth();
+        return ret;
+    };
     imports.wbg.__wbg_getRandomValues_6357e7b583eb49cc = function() { return handleError(function (arg0, arg1, arg2) {
         const ret = arg0.getRandomValues(getArrayU8FromWasm0(arg1, arg2));
         return ret;
@@ -433,6 +464,10 @@ function __wbg_get_imports() {
         const ret = Reflect.get(arg0, arg1);
         return ret;
     }, arguments) };
+    imports.wbg.__wbg_hidden_4114827cc8ff7f56 = function(arg0) {
+        const ret = arg0.hidden;
+        return ret;
+    };
     imports.wbg.__wbg_href_6d02c53ff820b6ae = function() { return handleError(function (arg0, arg1) {
         const ret = arg1.href;
         const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
@@ -520,6 +555,16 @@ function __wbg_get_imports() {
         const ret = result;
         return ret;
     };
+    imports.wbg.__wbg_instanceof_KeyboardEvent_c933deef57a253f3 = function(arg0) {
+        let result;
+        try {
+            result = arg0 instanceof KeyboardEvent;
+        } catch (_) {
+            result = false;
+        }
+        const ret = result;
+        return ret;
+    };
     imports.wbg.__wbg_instanceof_Node_80ed745e9f9b24e4 = function(arg0) {
         let result;
         try {
@@ -558,6 +603,13 @@ function __wbg_get_imports() {
         const ret = Object.is(arg0, arg1);
         return ret;
     };
+    imports.wbg.__wbg_key_32aa43e1cae08d29 = function(arg0, arg1) {
+        const ret = arg1.key;
+        const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len1 = WASM_VECTOR_LEN;
+        getDataViewMemory0().setInt32(arg0 + 4 * 1, len1, true);
+        getDataViewMemory0().setInt32(arg0 + 4 * 0, ptr1, true);
+    };
     imports.wbg.__wbg_length_69bca3cb64fc8748 = function(arg0) {
         const ret = arg0.length;
         return ret;
@@ -622,6 +674,14 @@ function __wbg_get_imports() {
         const ret = new Request(getStringFromWasm0(arg0, arg1));
         return ret;
     }, arguments) };
+    imports.wbg.__wbg_nextElementSibling_8574902612e762ae = function(arg0) {
+        const ret = arg0.nextElementSibling;
+        return isLikeNone(ret) ? 0 : addToExternrefTable0(ret);
+    };
+    imports.wbg.__wbg_now_793306c526e2e3b6 = function() {
+        const ret = Date.now();
+        return ret;
+    };
     imports.wbg.__wbg_ok_5749966cb2b8535e = function(arg0) {
         const ret = arg0.ok;
         return ret;
@@ -644,10 +704,6 @@ function __wbg_get_imports() {
         const ret = arg0.parentElement;
         return isLikeNone(ret) ? 0 : addToExternrefTable0(ret);
     };
-    imports.wbg.__wbg_parent_c0571e551b3efc33 = function() { return handleError(function (arg0) {
-        const ret = arg0.parent;
-        return isLikeNone(ret) ? 0 : addToExternrefTable0(ret);
-    }, arguments) };
     imports.wbg.__wbg_parse_2a704d6b78abb2b8 = function() { return handleError(function (arg0, arg1) {
         const ret = JSON.parse(getStringFromWasm0(arg0, arg1));
         return ret;
@@ -746,6 +802,9 @@ function __wbg_get_imports() {
     imports.wbg.__wbg_set_headers_6926da238cd32ee4 = function(arg0, arg1) {
         arg0.headers = arg1;
     };
+    imports.wbg.__wbg_set_hidden_129bf2a2bb9072e0 = function(arg0, arg1) {
+        arg0.hidden = arg1 !== 0;
+    };
     imports.wbg.__wbg_set_innerHTML_fb5a7e25198fc344 = function(arg0, arg1, arg2) {
         arg0.innerHTML = getStringFromWasm0(arg1, arg2);
     };
@@ -813,8 +872,8 @@ function __wbg_get_imports() {
         const ret = arg0.then(arg1, arg2);
         return ret;
     };
-    imports.wbg.__wbg_toISOString_48d92f5754d01b49 = function(arg0) {
-        const ret = arg0.toISOString();
+    imports.wbg.__wbg_toLocaleDateString_d7a4a330c612aae4 = function(arg0, arg1, arg2, arg3) {
+        const ret = arg0.toLocaleDateString(getStringFromWasm0(arg1, arg2), arg3);
         return ret;
     };
     imports.wbg.__wbg_toString_7da7c8dbec78fcb8 = function(arg0) {
@@ -850,29 +909,34 @@ function __wbg_get_imports() {
         getDataViewMemory0().setInt32(arg0 + 4 * 1, len1, true);
         getDataViewMemory0().setInt32(arg0 + 4 * 0, ptr1, true);
     };
-    imports.wbg.__wbindgen_cast_059fe8fea69d1ac8 = function(arg0, arg1) {
-        // Cast intrinsic for `Closure(Closure { dtor_idx: 182, function: Function { arguments: [Externref], shim_idx: 183, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
-        const ret = makeMutClosure(arg0, arg1, wasm.wasm_bindgen__closure__destroy__h7e0dbe805cce3b26, wasm_bindgen__convert__closures_____invoke__he5a716c89cafc3f6);
+    imports.wbg.__wbindgen_cast_2241b6af4c4b2941 = function(arg0, arg1) {
+        // Cast intrinsic for `Ref(String) -> Externref`.
+        const ret = getStringFromWasm0(arg0, arg1);
         return ret;
     };
-    imports.wbg.__wbindgen_cast_0cfc407ea197d58e = function(arg0, arg1) {
-        // Cast intrinsic for `Closure(Closure { dtor_idx: 165, function: Function { arguments: [NamedExternref("Event")], shim_idx: 168, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
-        const ret = makeMutClosure(arg0, arg1, wasm.wasm_bindgen__closure__destroy__h079344dbc08f8414, wasm_bindgen__convert__closures_____invoke__h6c882d24848f50e5);
+    imports.wbg.__wbindgen_cast_2d12912bac8cf5ca = function(arg0, arg1) {
+        // Cast intrinsic for `Closure(Closure { dtor_idx: 195, function: Function { arguments: [Externref], shim_idx: 196, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
+        const ret = makeMutClosure(arg0, arg1, wasm.wasm_bindgen__closure__destroy__h7e0dbe805cce3b26, wasm_bindgen__convert__closures_____invoke__he5a716c89cafc3f6);
         return ret;
     };
-    imports.wbg.__wbindgen_cast_17092d289d430ebb = function(arg0, arg1) {
-        // Cast intrinsic for `Closure(Closure { dtor_idx: 156, function: Function { arguments: [], shim_idx: 157, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
+    imports.wbg.__wbindgen_cast_4ebb9911410fd400 = function(arg0, arg1) {
+        // Cast intrinsic for `Closure(Closure { dtor_idx: 169, function: Function { arguments: [], shim_idx: 170, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
         const ret = makeMutClosure(arg0, arg1, wasm.wasm_bindgen__closure__destroy__h421d3dbd1097f54c, wasm_bindgen__convert__closures_____invoke__h76bc78299e8b98a7);
         return ret;
     };
-    imports.wbg.__wbindgen_cast_2241b6af4c4b2941 = function(arg0, arg1) {
-        // Cast intrinsic for `Ref(String) -> Externref`.
-        const ret = getStringFromWasm0(arg0, arg1);
+    imports.wbg.__wbindgen_cast_826011e7843d3a83 = function(arg0, arg1) {
+        // Cast intrinsic for `Closure(Closure { dtor_idx: 178, function: Function { arguments: [NamedExternref("Event")], shim_idx: 181, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
+        const ret = makeMutClosure(arg0, arg1, wasm.wasm_bindgen__closure__destroy__h94d73c4a2cdf8bae, wasm_bindgen__convert__closures_____invoke__h5883bfd253e22722);
         return ret;
     };
-    imports.wbg.__wbindgen_cast_3dddd7328a5e6496 = function(arg0, arg1) {
-        // Cast intrinsic for `Closure(Closure { dtor_idx: 165, function: Function { arguments: [NamedExternref("MessageEvent")], shim_idx: 168, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
-        const ret = makeMutClosure(arg0, arg1, wasm.wasm_bindgen__closure__destroy__h079344dbc08f8414, wasm_bindgen__convert__closures_____invoke__h6c882d24848f50e5);
+    imports.wbg.__wbindgen_cast_9367b1ddab4896c2 = function(arg0, arg1) {
+        // Cast intrinsic for `Closure(Closure { dtor_idx: 178, function: Function { arguments: [], shim_idx: 179, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
+        const ret = makeMutClosure(arg0, arg1, wasm.wasm_bindgen__closure__destroy__h94d73c4a2cdf8bae, wasm_bindgen__convert__closures_____invoke__hd8efc278d60539af);
+        return ret;
+    };
+    imports.wbg.__wbindgen_cast_cb7addcbe0fc4a54 = function(arg0, arg1) {
+        // Cast intrinsic for `Closure(Closure { dtor_idx: 178, function: Function { arguments: [NamedExternref("MessageEvent")], shim_idx: 181, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
+        const ret = makeMutClosure(arg0, arg1, wasm.wasm_bindgen__closure__destroy__h94d73c4a2cdf8bae, wasm_bindgen__convert__closures_____invoke__h5883bfd253e22722);
         return ret;
     };
     imports.wbg.__wbindgen_cast_d6cd19b81560fd6e = function(arg0) {
@@ -880,11 +944,6 @@ function __wbg_get_imports() {
         const ret = arg0;
         return ret;
     };
-    imports.wbg.__wbindgen_cast_f7cd1f4e460154b7 = function(arg0, arg1) {
-        // Cast intrinsic for `Closure(Closure { dtor_idx: 165, function: Function { arguments: [], shim_idx: 166, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
-        const ret = makeMutClosure(arg0, arg1, wasm.wasm_bindgen__closure__destroy__h079344dbc08f8414, wasm_bindgen__convert__closures_____invoke__h31c454d25a03d65b);
-        return ret;
-    };
     imports.wbg.__wbindgen_init_externref_table = function() {
         const table = wasm.__wbindgen_externrefs;
         const offset = table.grow(4);
diff --git a/capsules/chat-room/browser/chat_room_ui_bg.wasm b/capsules/chat-room/browser/chat_room_ui_bg.wasm
index 7e0c389c4..fe75619fd 100644
Binary files a/capsules/chat-room/browser/chat_room_ui_bg.wasm and b/capsules/chat-room/browser/chat_room_ui_bg.wasm differ
diff --git a/capsules/chat-room/browser/index.html b/capsules/chat-room/browser/index.html
index cdb20776f..9be18cc9d 100644
--- a/capsules/chat-room/browser/index.html
+++ b/capsules/chat-room/browser/index.html
@@ -6,7 +6,7 @@
   <title>Chat</title>
   <script src="./elastos-theme.js"></script>
   <link rel="stylesheet" href="./elastos-ui.css" />
-  <link rel="stylesheet" href="./style.css?v=chat-room-20260812a" />
+  <link rel="stylesheet" href="./style.css?v=chat-room-20260930c" />
 </head>
 <body data-room-session-active="false">
   <script src="./chat-access.js"></script>
@@ -43,16 +43,7 @@ <h2>Open Chat from Home</h2>
           <a id="chat-open-home" href="/home/" target="_self">Open Home</a>
         </section>
         <p id="error-text" class="error" hidden></p>
-        <section id="conversation-join-section" class="conversation-join" hidden>
-          <div class="conversation-join-copy">
-            <h2>Join a Conversation</h2>
-            <p>Paste a join code or link from another ElastOS user. Joining replaces this unused local conversation; conversations with messages or other members cannot be replaced.</p>
-          </div>
-          <form id="conversation-join-form" class="conversation-join-form">
-            <input id="conversation-join-input" type="text" autocomplete="off" placeholder="Paste invite code or link" aria-label="Invite code or link" />
-            <button id="conversation-join-submit" type="submit">Join</button>
-          </form>
-        </section>
+        <button id="reconnect-button" type="button" class="secondary reconnect" hidden>Reconnect</button>
         <ol id="message-list" class="messages"></ol>
         <form id="composer-form" class="composer">
           <button id="attach-button" type="button" class="composer-icon" aria-label="Attach" title="Attach" hidden disabled>
@@ -94,6 +85,13 @@ <h3 id="participant-count" class="roster-title">Opening conversation</h3>
         </div>
       </div>
       <ol id="participant-list" class="participants"></ol>
+      <section id="participant-card" class="participant-card" role="dialog" aria-labelledby="participant-card-name" hidden>
+        <button id="participant-card-close" type="button" class="participant-card-close" aria-label="Close">×</button>
+        <div id="participant-card-avatar" class="participant-avatar participant-card-avatar" aria-hidden="true"></div>
+        <h3 id="participant-card-name" class="participant-card-name"></h3>
+        <p id="participant-card-state" class="participant-card-state" role="status"></p>
+        <button id="participant-card-action" type="button" class="participant-card-action" hidden></button>
+      </section>
       <section id="browser-access-section" class="browser-access" hidden>
         <div class="browser-access-head">
           <h3 id="browser-access-count" class="browser-access-title">Join Requests · 0</h3>
diff --git a/capsules/chat-room/browser/style.css b/capsules/chat-room/browser/style.css
index 064eb81be..9102d2494 100644
--- a/capsules/chat-room/browser/style.css
+++ b/capsules/chat-room/browser/style.css
@@ -84,6 +84,12 @@ p {
   font-weight: 600;
 }
 
+.reconnect {
+  flex: 0 0 auto;
+  align-self: flex-start;
+  margin: 0 1rem 0.55rem;
+}
+
 .chat-sidebar,
 .chat-people,
 .messages {
@@ -355,15 +361,13 @@ body[data-room-access-mode="gateway"][data-room-session-active="false"] .browser
 }
 
 .browser-access-copy,
-.conversation-join-copy,
 .browser-access-form,
 .stack {
   display: grid;
   gap: 0.45rem;
 }
 
-.browser-access-copy h2,
-.conversation-join-copy h2 {
+.browser-access-copy h2 {
   font-size: 1.05rem;
   font-weight: 700;
 }
@@ -385,23 +389,6 @@ body[data-room-access-mode="gateway"][data-room-session-active="false"] .browser
   gap: 0.4rem;
 }
 
-.conversation-join {
-  display: grid;
-  gap: 0.55rem;
-  margin: 0.75rem 1rem 0;
-  padding: 0.85rem 0.9rem;
-  border: 1px solid var(--line);
-  border-radius: 8px;
-  background: var(--panel-strong);
-}
-
-.conversation-join-copy p {
-  color: var(--muted);
-  font-size: 0.78rem;
-  line-height: 1.4;
-}
-
-.conversation-join-form,
 .join-link-output {
   display: grid;
   grid-template-columns: minmax(0, 1fr) auto;
@@ -960,11 +947,6 @@ button.secondary {
   outline: none;
 }
 
-body[data-room-access-mode="shell"][data-room-join-visible="true"] .messages,
-body[data-room-access-mode="shell"][data-room-join-visible="true"] .composer {
-  display: none;
-}
-
 body[data-room-access-mode="shell"][data-room-session-active="false"] .roster-head {
   display: none;
 }
@@ -1043,3 +1025,119 @@ body[data-room-access-mode="shell"][data-room-session-active="false"] .roster-he
     animation: none;
   }
 }
+
+/* Profile cards: any name with a card opens one. */
+.participant-clickable,
+.message-sender-link {
+  cursor: pointer;
+}
+
+.participant-clickable:hover,
+.participant-clickable:focus-visible {
+  background: var(--accent-soft);
+}
+
+.message-sender-link:hover,
+.message-sender-link:focus-visible {
+  text-decoration: underline;
+}
+
+.participant-clickable:focus-visible,
+.message-sender-link:focus-visible {
+  outline: 2px solid var(--accent);
+  outline-offset: 2px;
+}
+
+.participant-card {
+  position: relative;
+  display: grid;
+  justify-items: center;
+  gap: 0.5rem;
+  margin: 0.75rem;
+  padding: 1rem 1rem 1.1rem;
+  border: 1px solid var(--line);
+  border-radius: 14px;
+  background: var(--panel-strong);
+  color: var(--ink);
+  text-align: center;
+}
+
+.participant-card[hidden] {
+  display: none;
+}
+
+.participant-card-avatar {
+  width: 3rem;
+  height: 3rem;
+  flex-basis: 3rem;
+  font-size: 1.1rem;
+}
+
+.participant-card-name {
+  margin: 0;
+  font-size: 1rem;
+  font-weight: 700;
+  overflow-wrap: anywhere;
+}
+
+.participant-card-state {
+  margin: 0;
+  color: var(--muted);
+  font-size: 0.85rem;
+}
+
+.participant-card-action {
+  min-width: 8rem;
+}
+
+.participant-card-close {
+  position: absolute;
+  top: 0.35rem;
+  right: 0.45rem;
+  padding: 0.1rem 0.45rem;
+  border: 0;
+  background: transparent;
+  color: var(--muted);
+  font-size: 1.1rem;
+  line-height: 1;
+  cursor: pointer;
+}
+
+/* Day separators between messages from different local days. */
+.day-separator {
+  display: flex;
+  align-items: center;
+  gap: 0.75rem;
+  margin: 0.75rem 0 0.25rem;
+  color: var(--muted);
+  font-size: 0.75rem;
+  font-weight: 600;
+  list-style: none;
+}
+
+.day-separator::before,
+.day-separator::after {
+  content: "";
+  flex: 1;
+  border-top: 1px solid var(--line);
+}
+
+/* Unread direct conversations in the rail. */
+.conversation-choice {
+  position: relative;
+}
+
+.conversation-choice.unread .conversation-choice-name {
+  font-weight: 800;
+}
+
+.conversation-unread-dot {
+  position: absolute;
+  top: 50%;
+  right: 0.75rem;
+  width: 0.55rem;
+  height: 0.55rem;
+  border-radius: 999px;
+  background: var(--accent);
+  transform: translateY(-50%);
+}
diff --git a/capsules/home-gui/browser/home-gui-shell.js b/capsules/home-gui/browser/home-gui-shell.js
index f0b815d92..c40b35647 100644
--- a/capsules/home-gui/browser/home-gui-shell.js
+++ b/capsules/home-gui/browser/home-gui-shell.js
@@ -5,6 +5,7 @@ import {
   openHomeGuiTarget,
   relaunchHomeGuiWindowForToken,
   renewHomeGuiBrowserWindowAuthority,
+  renewHomeGuiChatWindowAuthority,
   restoreHomeGuiSession,
   setHomeGuiMenuManifest,
   handleHomeGuiHomeNavigation,
@@ -159,6 +160,23 @@ function handleGuiCommand(message) {
   if (command === "renew-browser-authority") {
     return handleBrowserAuthorityRenewalCommand(message);
   }
+  if (command === "renew-chat-authority") {
+    if (!hasExactKeys(message, ["type", "command", "requestId", "homeToken", "launched", "expiresAt", "phase"])
+      || !/^[A-Za-z0-9-]{1,64}$/.test(message.requestId)
+      || !Number.isSafeInteger(message.expiresAt) || !["prepare", "commit"].includes(message.phase)) return false;
+    const freshHomeToken = new URLSearchParams(new URL(message.launched?.route, homeOrigin).hash.slice(1)).get("home_token") || "";
+    if (message.phase === "commit") {
+      const ok = renewHomeGuiChatWindowAuthority(message.homeToken, message.launched, homeOrigin);
+      postToHome({ type: "home:chat-authority-committed", requestId: message.requestId,
+        oldHomeToken: message.homeToken, freshHomeToken, ok });
+      return ok;
+    }
+    const ok = message.expiresAt > Date.now()
+      && renewHomeGuiChatWindowAuthority(message.homeToken, message.launched, homeOrigin, false);
+    postToHome({ type: "home:chat-authority-renewed", requestId: message.requestId,
+      oldHomeToken: message.homeToken, freshHomeToken, ok });
+    return ok;
+  }
   if (command === "open-target") {
     return openHomeGuiTarget(message.target, { query: message.query || {} });
   }
diff --git a/capsules/home-gui/browser/home-gui.js b/capsules/home-gui/browser/home-gui.js
index 66e403cee..6f29e6ac6 100644
--- a/capsules/home-gui/browser/home-gui.js
+++ b/capsules/home-gui/browser/home-gui.js
@@ -709,6 +709,27 @@ export function relaunchHomeGuiWindowForToken(homeToken) {
   return true;
 }
 
+export function renewHomeGuiChatWindowAuthority(homeToken, launched, homeOrigin, apply = true) {
+  const entry = homeGuiWindowEntryForToken(homeToken);
+  const frame = entry?.node?.querySelector(".window-frame");
+  const freshToken = homeLaunchTokenFromRoute(launched?.route || "");
+  let route;
+  try { route = new URL(launched?.route, homeOrigin); } catch { return false; }
+  if (!entry || entry.targetId !== "chat-room" || !frame?.contentWindow
+    || launched?.target !== "chat-room" || launched.attach_kind !== "iframe"
+    || (launched.launch_status && launched.launch_status !== "launched")
+    || route.origin !== homeOrigin || route.pathname !== "/apps/chat-room/"
+    || route.username || route.password
+    || !freshToken || freshToken === homeToken) return false;
+  if (!apply) return true;
+  // The existing document keeps its drafts; Home's window controls and
+  // presentation handshake follow its renewed Runtime launch authority.
+  frame.dataset.route = launched.route;
+  entry.homeNavigation = null;
+  probeHomeNavigation(entry, true);
+  return true;
+}
+
 export function attachAuthorizedHomeGuiTarget(launched) {
   if (walletRailOpen() && isConnectorSheetTarget(launched?.target)) {
     return attachAuthorizedConnectorSheet(launched);
diff --git a/capsules/home-gui/browser/shell-setup-sheet.js b/capsules/home-gui/browser/shell-setup-sheet.js
index af824ac24..af0c4ce18 100644
--- a/capsules/home-gui/browser/shell-setup-sheet.js
+++ b/capsules/home-gui/browser/shell-setup-sheet.js
@@ -75,6 +75,13 @@ export function homeRecoveryStatus(summary) {
   return typedReadinessStatus(summary?.identity?.recovery_readiness, RECOVERY_READINESS_SCHEMA);
 }
 
+// Only an explicit "recovery_kit_outdated" earns the updated-kit copy; any
+// other setup_required reason reads as a first kit for a new account.
+function homeRecoveryKitOutdated(summary) {
+  const readiness = summary?.identity?.recovery_readiness;
+  return homeRecoveryStatus(summary) === "setup_required" && readiness?.reason === "recovery_kit_outdated";
+}
+
 function typedReadinessStatus(readiness, schema) {
   if (!readiness || readiness.schema !== schema) {
     return "unavailable";
@@ -204,17 +211,20 @@ function renderSetupSheet(summary) {
   const unavailable = homeSetupStatus(summary) === "unavailable" || homeRecoveryStatus(summary) === "unavailable";
   const complete = setupFinished(summary);
   const profileReady = homeSetupStatus(summary) === "ready";
+  const kitOutdated = homeRecoveryKitOutdated(summary);
   if (titleNode) titleNode.textContent = "Welcome to Home";
   if (leadNode) leadNode.textContent = complete ? "Home is set up."
     : unavailable ? "Open System to check setup."
-    : profileReady ? "Save an updated Recovery Kit that includes your Profile."
+    : profileReady && kitOutdated ? "Save an updated Recovery Kit that includes your Profile."
+    : profileReady ? "Save a Recovery Kit so you can get back into your account."
     : "Create your Profile and save a complete Recovery Kit in System.";
   recoveryStep?.classList.toggle("is-complete", complete);
   recoveryStep?.classList.toggle("is-current", !complete && !unavailable);
   if (recoveryBody) recoveryBody.textContent = unavailable
     ? "Open System to check setup."
     : complete ? "Profile and Recovery Kit are ready."
-    : profileReady ? "Your Profile stays unchanged. Save the updated kit offline."
+    : profileReady && kitOutdated ? "Your Profile stays unchanged. Save the updated kit offline."
+    : profileReady ? "Keep the kit offline. It restores your account on a new device."
     : "Confirm your name and save the kit offline.";
   if (recoveryButton) {
     recoveryButton.textContent = complete ? "Ready" : unavailable ? "Open System"
diff --git a/capsules/home/browser/home-navigation-client.js b/capsules/home/browser/home-navigation-client.js
index cd9f796b8..0ca12c127 100644
--- a/capsules/home/browser/home-navigation-client.js
+++ b/capsules/home/browser/home-navigation-client.js
@@ -26,5 +26,13 @@ export function createHomeNavigationClient({ homeToken, homeOrigin, enabled = tr
     unloading = false;
     if (attached()) windowRef.top.postMessage({ type: "home:app-ready", homeToken }, homeOrigin);
   });
-  return { setQuery(value) { query = { ...value }; publish(); } };
+  return {
+    setQuery(value) { query = { ...value }; publish(); },
+    setHomeToken(value) {
+      homeToken = value;
+      requestId = "";
+      sequence = 0;
+      if (attached()) windowRef.top.postMessage({ type: "home:app-ready", homeToken }, homeOrigin);
+    },
+  };
 }
diff --git a/capsules/home/browser/home-shell-host.js b/capsules/home/browser/home-shell-host.js
index 822f441e7..b5125bdf2 100644
--- a/capsules/home/browser/home-shell-host.js
+++ b/capsules/home/browser/home-shell-host.js
@@ -78,7 +78,7 @@ const SHELL_MESSAGE_OPEN_TARGET_SOURCES = Object.freeze({
   "home-agent": new Set(["marketplace", "system", "inbox"]),
   "archive-manager": new Set(["library"]),
   browser: new Set(["library"]),
-  "chat-room": new Set(["library"]),
+  "chat-room": new Set(["library", "people", "inbox"]),
   "gba-emulator": new Set(["library"]),
   "home-cli": "visible-target",
   "home-gui": "visible-target",
@@ -182,6 +182,7 @@ function retireLaunchedAppContext(homeToken) {
     return false;
   }
   cancelBrowserAuthorityRenewalsForToken(homeToken);
+  cancelChatReconnect(context);
   cancelLibraryPicker(context);
   homeClipboardHost.retireFrame(context.clipboardState);
   launchedAppContexts.delete(homeToken);
@@ -191,12 +192,54 @@ function retireLaunchedAppContext(homeToken) {
 function clearLaunchedAppContexts() {
   clearPendingBrowserAuthorityRenewals();
   for (const context of launchedAppContexts.values()) {
+    cancelChatReconnect(context);
     cancelLibraryPicker(context);
     homeClipboardHost.retireFrame(context.clipboardState);
   }
   launchedAppContexts.clear();
 }
 
+function cancelChatReconnect(context) {
+  const record = context.chatReconnectPending;
+  if (!record) return;
+  context.chatReconnectPending = null;
+  window.clearTimeout(record.timeout);
+  if (record.freshToken) retireLaunchedAppContext(record.freshToken);
+}
+
+function settleChatReconnect(old, record, error = null) {
+  if (old.chatReconnectPending !== record) return false;
+  old.chatReconnectPending = null;
+  window.clearTimeout(record.timeout);
+  if (error) {
+    if (record.freshToken) retireLaunchedAppContext(record.freshToken);
+  } else {
+    const fresh = launchedAppContexts.get(record.freshToken);
+    if (launchedAppContexts.get(record.oldToken) !== old || old.source !== record.event.source
+      || fresh?.targetId !== "chat-room" || fresh.source || record.expiresAt <= Date.now()) {
+      if (record.freshToken) retireLaunchedAppContext(record.freshToken);
+      error = new Error("Home could not reopen this Chat window");
+    } else {
+      try {
+        requireHomeGuiActive("reconnect Chat");
+        fresh.chatReconnectCommit = { requestId: record.requestId, oldToken: record.oldToken };
+        if (!postToActiveShell({ type: "home:gui-command", command: "renew-chat-authority",
+          phase: "commit", requestId: record.requestId, homeToken: record.oldToken,
+          launched: record.launched, expiresAt: record.expiresAt })) {
+          throw new Error("Home GUI could not reopen Chat");
+        }
+        fresh.source = record.event.source;
+        retireLaunchedAppContext(record.oldToken);
+      } catch (failure) {
+        retireLaunchedAppContext(record.freshToken);
+        error = failure;
+      }
+    }
+  }
+  replyToShellRequest(record.event, record.requestId, error ? null : record.launched, error);
+  return true;
+}
+
 function enterHostAuthGate() {
   document.body.dataset.homeAuthority = "unsigned";
   stopHomePresenceHeartbeat();
@@ -1596,9 +1639,81 @@ window.addEventListener("message", (event) => {
     }
     return;
   }
+  if (data.type === "home:chat-authority-renewed") {
+    if (context.kind !== "shell-frame" || context.targetId !== HOME_GUI_SHELL_ID
+      || !hasExactMessageKeys(data, ["type", "requestId", "oldHomeToken", "freshHomeToken", "ok", "homeToken"])) return;
+    const old = launchedAppContexts.get(data.oldHomeToken);
+    const record = old?.chatReconnectPending;
+    if (!record || record.requestId !== data.requestId || record.freshToken !== data.freshHomeToken
+      || !record.launched || typeof data.ok !== "boolean") return;
+    settleChatReconnect(old, record, data.ok ? null : new Error("Home could not reopen this Chat window"));
+    return;
+  }
+  if (data.type === "home:chat-authority-committed") {
+    if (context.kind !== "shell-frame" || context.targetId !== HOME_GUI_SHELL_ID
+      || !hasExactMessageKeys(data, ["type", "requestId", "oldHomeToken", "freshHomeToken", "ok", "homeToken"])) return;
+    const fresh = launchedAppContexts.get(data.freshHomeToken);
+    const commit = fresh?.chatReconnectCommit;
+    if (fresh?.targetId !== "chat-room" || !commit || commit.requestId !== data.requestId
+      || commit.oldToken !== data.oldHomeToken || typeof data.ok !== "boolean") return;
+    delete fresh.chatReconnectCommit;
+    if (!data.ok) retireLaunchedAppContext(data.freshHomeToken);
+    return;
+  }
   if (data.type === "home:launch-target") {
     const requestId = typeof data.requestId === "string" ? data.requestId.trim() : "";
     const target = typeof data.target === "string" ? data.target.trim() : "";
+    if (context.kind === "app-frame" && context.targetId === "chat-room") {
+      const query = data.query;
+      const keys = query && typeof query === "object" && !Array.isArray(query) ? Object.keys(query) : null;
+      const validQuery = keys && (keys.length === 0 || (keys.length === 1 && keys[0] === "conversation_id"
+        && typeof query.conversation_id === "string" && /^[A-Za-z0-9:._-]{1,512}$/.test(query.conversation_id)));
+      if (!hasExactMessageKeys(data, ["type", "requestId", "target", "query", "homeToken"])
+        || !/^[A-Za-z0-9-]{1,64}$/.test(requestId) || requestId !== data.requestId
+        || target !== "chat-room" || target !== data.target || data.homeToken !== context.homeToken || !validQuery) {
+        replyToShellRequest(event, requestId, null, new Error("Home denied the Chat reconnect"));
+        return;
+      }
+      const old = launchedAppContexts.get(context.homeToken);
+      if (old.chatReconnectPending) {
+        if (old.chatReconnectPending.requestId !== requestId) {
+          replyToShellRequest(event, requestId, null, new Error("Chat is already reconnecting"));
+        }
+        return;
+      }
+      const record = { requestId, oldToken: context.homeToken, event, freshToken: "", launched: null,
+        expiresAt: Date.now() + 20000, timeout: 0 };
+      old.chatReconnectPending = record;
+      record.timeout = window.setTimeout(() => {
+        if (old.chatReconnectPending !== record) return;
+        settleChatReconnect(old, record, new Error("Home could not reopen Chat in time"));
+      }, 25000);
+      let createdToken = "";
+      launchHomeTarget("chat-room", query).then((launched) => {
+        const freshToken = homeLaunchTokenFromRoute(launched?.route || "");
+        createdToken = freshToken;
+        const fresh = launchedAppContexts.get(freshToken);
+        if (launched?.target !== "chat-room" || launched.attach_kind !== "iframe"
+          || (launched.launch_status && launched.launch_status !== "launched")
+          || !fresh || freshToken === context.homeToken || fresh.source
+          || launchedAppContexts.get(context.homeToken) !== old || old.source !== event.source
+          || old.chatReconnectPending !== record) {
+          if (freshToken && freshToken !== context.homeToken) retireLaunchedAppContext(freshToken);
+          throw new Error("Home could not reopen this Chat window");
+        }
+        requireHomeGuiActive("reconnect Chat");
+        record.freshToken = freshToken;
+        record.launched = launched;
+        if (!postToActiveShell({ type: "home:gui-command", command: "renew-chat-authority",
+          phase: "prepare", requestId, homeToken: context.homeToken, launched, expiresAt: record.expiresAt })) {
+          throw new Error("Home GUI could not reopen Chat");
+        }
+      }).catch((error) => {
+        if (createdToken && createdToken !== context.homeToken) retireLaunchedAppContext(createdToken);
+        settleChatReconnect(old, record, error);
+      });
+      return;
+    }
     if (
       context.kind !== "shell-frame" ||
       ![HOME_GUI_SHELL_ID, HOME_CLI_SHELL_ID].includes(context.targetId) ||
@@ -1836,6 +1951,10 @@ window.addEventListener("message", (event) => {
     console.warn("home ignored unauthorized open-target message", context.targetId, target);
     return;
   }
+  if (context.targetId === "chat-room" && ["people", "inbox"].includes(target)
+    && (!hasExactMessageKeys(data, ["type", "target", "query", "homeToken"])
+      || !data.query || typeof data.query !== "object" || Array.isArray(data.query)
+      || Object.keys(data.query).length !== 0)) return;
   if (["assistant", "home-agent"].includes(context.targetId)) {
     if (!hasExactMessageKeys(data, ["type", "target", "query", "homeToken"])) return;
     const marketplace = data.target === "marketplace" && assistantModelsMarketplaceQuery(data.query);
diff --git a/capsules/home/browser/index.html b/capsules/home/browser/index.html
index 3860c269a..4fe326762 100644
--- a/capsules/home/browser/index.html
+++ b/capsules/home/browser/index.html
@@ -82,6 +82,7 @@ <h1 id="shell-host-recovery-title">Home didn't open</h1>
                 </span>
               </button>
               <p id="home-unlock-person-name" class="home-unlock-account-name" hidden></p>
+              <button id="home-unlock-create" class="home-unlock-create" type="button" hidden>Create account</button>
             </div>
           </div>
         </div>
diff --git a/capsules/home/browser/shell-auth.js b/capsules/home/browser/shell-auth.js
index 608d7c9f6..e6d4a511f 100644
--- a/capsules/home/browser/shell-auth.js
+++ b/capsules/home/browser/shell-auth.js
@@ -20,6 +20,7 @@ const passkeyHintPanel = document.querySelector("#home-passkey-hint-panel");
 const passkeyHintInput = document.querySelector("#home-passkey-hint");
 const passkeyHintCancel = document.querySelector("#home-passkey-hint-cancel");
 const unlockSecondary = document.querySelector("#home-unlock-secondary");
+const unlockCreate = document.querySelector("#home-unlock-create");
 const unlockStatus = document.querySelector("#home-unlock-status");
 const unlockName = document.querySelector("#home-unlock-name");
 const ownerToken = document.querySelector("#home-owner-token");
@@ -204,6 +205,16 @@ export function bindHomeUnlock() {
   };
   unlockPrimary?.addEventListener("click", startUnlock);
   unlockPerson?.addEventListener("click", startUnlock);
+  // First-visit entry on the lock face: the same guest enrollment the card's
+  // secondary action opens, reachable without first failing a passkey prompt.
+  unlockCreate?.addEventListener("click", () => {
+    if (busy || !guestRegistrationAvailable) return;
+    clearRecoverySelection();
+    recoverySession = null;
+    recoveryTerminalToken = "";
+    unlockMode = "create_guest";
+    renderUnlockMode({ registered: true, guestRegistrationEnabled: true });
+  });
   unlockSecondary?.addEventListener("click", () => {
     clearRecoverySelection();
     recoverySession = null;
@@ -412,6 +423,10 @@ function renderUnlockMode({ registered, guestRegistrationEnabled }) {
   if (unlockFace) {
     unlockFace.hidden = !showFace;
   }
+  if (unlockCreate) {
+    unlockCreate.hidden = !(showFace && guestRegistrationEnabled);
+    unlockCreate.disabled = unlockMode === "unsupported";
+  }
   if (unlockCard) {
     unlockCard.hidden = showFace;
   }
diff --git a/capsules/home/browser/style.css b/capsules/home/browser/style.css
index c26999252..ce846518e 100644
--- a/capsules/home/browser/style.css
+++ b/capsules/home/browser/style.css
@@ -327,6 +327,44 @@ img {
   line-height: 1.5;
 }
 
+.home-unlock-create {
+  appearance: none;
+  margin-top: 18px;
+  padding: 9px 20px;
+  border: 1px solid rgba(255, 255, 255, 0.28);
+  border-radius: 999px;
+  background: rgba(16, 24, 32, 0.55);
+  color: #f5f5f7;
+  font: inherit;
+  font-size: 14px;
+  font-weight: 600;
+  letter-spacing: 0;
+  white-space: nowrap;
+  cursor: pointer;
+  backdrop-filter: blur(12px);
+  -webkit-backdrop-filter: blur(12px);
+  box-shadow: 0 6px 22px rgba(0, 0, 0, 0.28);
+}
+
+.home-unlock-create:hover {
+  background: rgba(16, 24, 32, 0.75);
+  border-color: rgba(96, 165, 250, 0.7);
+}
+
+.home-unlock-create:focus-visible {
+  outline: 2px solid var(--brand-focus);
+  outline-offset: 3px;
+}
+
+.home-unlock-create:disabled {
+  cursor: default;
+  opacity: 0.55;
+}
+
+.home-unlock-create[hidden] {
+  display: none;
+}
+
 .home-unlock-card {
   width: min(390px, 100%);
   max-height: 100%;
diff --git a/capsules/inbox/browser/inbox.js b/capsules/inbox/browser/inbox.js
index 4ca3c3ca4..162f2cd71 100644
--- a/capsules/inbox/browser/inbox.js
+++ b/capsules/inbox/browser/inbox.js
@@ -495,11 +495,14 @@
     }
 
     function fillEntryActions(actions, entry) {
+      const actionId = entry.action_ref && entry.action_ref.action_id;
       if (typeof entry.source_app === "string" && entry.source_app.trim()) {
-        actions.appendChild(createButton("Open", () => openSource(entry.source_app)));
+        // A direct-message notice opens its own conversation in Chat.
+        const query = typeof actionId === "string" && actionId.startsWith("chat-open-direct:")
+          ? { conversation_id: actionId.slice("chat-open-direct:".length) } : {};
+        actions.appendChild(createButton("Open", () => openSource(entry.source_app, query)));
       }
 
-      const actionId = entry.action_ref && entry.action_ref.action_id;
       if (typeof actionId === "string" && actionId.startsWith("room-approve-request:")) {
         actions.appendChild(createActionButton("Approve", actionId, "primary"));
         actions.appendChild(createActionButton("Deny", "room-deny-request:" + actionId.slice("room-approve-request:".length), "danger"));
diff --git a/capsules/people/browser/people.js b/capsules/people/browser/people.js
index 7aef60f97..7b1c58f53 100644
--- a/capsules/people/browser/people.js
+++ b/capsules/people/browser/people.js
@@ -109,6 +109,20 @@ function bindActions() {
     profileDraftDirty = true;
     profileDraftValue = profileInput.value;
   });
+  // Home pushes people.changed when contacts or Discovery state change, so
+  // "Connecting…" and newly visible people update without a manual Refresh.
+  window.addEventListener("message", (event) => {
+    if (event.origin !== homeParentOrigin || event.source !== window.top) {
+      return;
+    }
+    const message = event.data || {};
+    if (message.type !== "elastos:runtime-events" || !Array.isArray(message.events)) {
+      return;
+    }
+    if (message.events.some((item) => item?.scope === "people" || item?.kind === "people.changed")) {
+      refreshPeople({ quiet: true }).catch(() => {});
+    }
+  });
   window.addEventListener("message", (event) => {
     if (event.origin !== "null" || event.source !== window.parent) {
       return;
@@ -375,6 +389,9 @@ function normalizeDiscoveryStatusMessage(status, runtimeMessage, remainingSecond
   if (status === "off") {
     return "Discovery is off.";
   }
+  if (status === "connecting") {
+    return "Discovery is connecting. People who are visible appear here in a few seconds.";
+  }
   return runtimeMessage || "Discovery is unavailable.";
 }
 
@@ -397,6 +414,12 @@ function discoveryEmptyState(status, configured, enabled) {
       emptyCopy: "Your last visibility window is closing.",
     };
   }
+  if (status === "connecting") {
+    return {
+      emptyTitle: "Connecting…",
+      emptyCopy: "Looking for people who are visible right now.",
+    };
+  }
   if (status === "off") {
     return {
       emptyTitle: "Discovery is off",
diff --git a/docs/COLLABORATION_NETWORK_PROFILE.md b/docs/COLLABORATION_NETWORK_PROFILE.md
index 3871dc912..b33cf52c5 100644
--- a/docs/COLLABORATION_NETWORK_PROFILE.md
+++ b/docs/COLLABORATION_NETWORK_PROFILE.md
@@ -16,6 +16,16 @@ an absent setting keeps the default listener and ephemeral-port fallback.
 The setting changes the listener address only. Carrier network policy and
 collaboration authority keep their own checks.
 
+> **Tip — pin the bootstrap Runtime's Carrier address before exporting its
+> receipt.** The bootstrap receipt, and so every Home's network file, records
+> the bootstrap Runtime's exact IP address and UDP port. Without
+> `carrier_bind_addr`, a Runtime takes `0.0.0.0:4433` when that port is free
+> and a random port otherwise, so a restart can move it. Pin a port that every
+> joining Home can reach, for example `0.0.0.0:4433`: `127.0.0.1` answers only
+> on the same machine, while the receipt usually names the LAN or public
+> address. When two Runtimes share one machine, give each its own port.
+> See [Troubleshooting](TROUBLESHOOTING.md#collaboration-network-and-carrier).
+
 The canonical JSON envelope uses lexicographically ordered object keys with no
 insignificant whitespace and has exactly three fields: `payload`, `signature`,
 and `signer_did`. The canonical bytes of its `payload` field are signed with the
@@ -69,17 +79,96 @@ fallback. Absence selects isolation. A present file is validated and accepted
 before Carrier subscription or worker startup; invalid permissions, bounds,
 encoding, trust, chain, or grant fail closed.
 
+## Release default network
+
+Every Home joins the shared Community room by default. The signed release
+names that network, and setup installs it; a Home stays isolated only when its
+person chooses isolation.
+
+The release pins the network in `components.json` as `collaboration_network`:
+
+- `head_cid`, the raw SHA-256 CIDv1 of the exact startup configuration bytes;
+- `expected_network_id`;
+- `trusted_profile_signer_dids`, the complete trusted signer set.
+
+The release ships those bytes beside `components.json` as
+`collaboration-network-release-v1.json`. The release signature covers
+`components.json`, so the release publisher vouches for the pin, and the pin
+fixes the exact configuration, network and signer set. Setup then checks the
+configuration with the same validator Runtime startup uses. Runtime startup
+itself still reads only `collaboration-network-v1.json`.
+
+The release delivers that file the same way it delivers `model-catalog.json`.
+Release staging and the custodian signer bind it to the pin, and release
+publication admits it only when its bytes match the pin and pass the startup
+validator. Installed setup fetches the exact pinned CID from the trusted source
+over Carrier, with the startup configuration's 3 MiB byte bound checked before
+the body is read. `elastos update` and Home's System update also fetch it by its
+pinned CID with the Runtime and `components.json`, while Home still runs and
+before the new Runtime replaces the old one. `elastos update` installs it as its last
+update step; System update installs it right after activation, before Home
+restarts. A refusal before or during that step restores the previous release
+files. Undo restores the earlier release and keeps the joined network, its
+accepted revision, contacts, and messages, including state written after the
+update. An older release pin cannot replace a newer accepted configuration.
+Leaving Community is a separate action. A Home that stays isolated
+fetches nothing. An offline update hop refuses a changed pin, like other support
+changes.
+
+Setup and update apply the release network to the data root:
+
+- A new Home receives `collaboration-network-v1.json` from the release copy
+  and prints one line saying it joins the Community room and how to stay
+  isolated.
+- An update that pins a newer revision of the same network and signer set
+  replaces the file only when the new chain strictly extends the installed
+  chain. The accepted-head marker then advances at the next start.
+- A Home that already holds a configuration for another network keeps it.
+- `elastos setup --isolated` (or `install.sh --isolated`) records the
+  owner-only choice `collaboration-isolated-v1`. Before the first start it
+  also removes the release network file that setup installed, so Runtime never
+  joins it; setup and update then leave the release network uninstalled.
+  Setup refuses and keeps the file when Runtime already accepted a network
+  (the `collaboration` state directory exists), because Runtime refuses to
+  drop an accepted network, and when the file is not the network the installed
+  release pins, because it then belongs to the Home's operator. Runtime
+  startup also treats the recorded choice as isolation until it has accepted
+  a network, so an interrupted `--isolated` run never joins, and startup and
+  `--isolated` share one lock so they cannot interleave. Leaving Community
+  after joining is a separate, later step.
+- Source-home setup keeps its explicit `ELASTOS_COLLABORATION_STARTUP_MODE`
+  (`configured` or `isolated`) and ignores the release pin.
+
+A release without `collaboration_network` leaves every Home's collaboration
+configuration unchanged. The operator provisioning below creates the network
+and its configuration bytes that a release then pins.
+
 ## Operator provisioning
 
 `elastos collaboration-config` is the only repository tool that creates this
 startup file and is never called by the installer or Runtime. Key creation,
 profile generation, and verification are offline. The separate explicit local
 bootstrap export attaches only to the selected running Runtime. The
-configuration authority is a dedicated raw 32-byte Ed25519 key at an explicit
-operator path; it is not a Runtime device key, Carrier identity, release
-publisher, Wallet/passkey identity, or host identity.
+configuration authority is the signer explicitly named in
+`trusted_profile_signer_dids`. Runtime device, Carrier, Wallet, passkey, and
+user-message authority keep their own identities and checks.
+
+The production Community network's profile signer is the release maintainer
+DID. Runtime checks each signing role separately: the signed release pins the
+file's CID and its signer set, and profile signatures use their own domain,
+`elastos.collaboration-network.profile.v1`. Production profiles are signed by
+the approved offline release custodian outside CI; that custodian operation is
+prepared when this network ships.
+
+The existing release-signing interface, `scripts/release-signer.py`, uses the
+custodian's Ed25519 PEM key through OpenSSL. The `collaboration-config` file
+interface accepts an owner-only raw 32-byte Ed25519 key for the disposable test
+and fixture networks below. Production keys stay in their existing custody
+workflow.
 
-Create the key as a separate explicit action:
+For an isolated test fixture, create a disposable authority key as a separate
+explicit action. Give the fixture an owner and cleanup condition, keep its trust
+store separate from real Homes, and keep its private key out of source and logs:
 
 ```text
 elastos collaboration-config create-authority-key --key <owner-only-key-path>
@@ -119,6 +208,22 @@ elastos collaboration-config verify \
   --input <data-root>/collaboration-network-v1.json
 ```
 
+When the bootstrap Runtime's address changes, export a fresh bootstrap
+receipt and generate the next signed revision from the current file with the
+same authority key. The network ID, trusted signer set and default-conversation
+grant stay the same; only the bootstrap peers change:
+
+```text
+elastos collaboration-config generate-revision \
+  --authority-key <owner-only-key-path> \
+  --input <current collaboration-network-v1.json> \
+  --bootstrap-peer <owner-only-bootstrap-receipt> \
+  --output <next collaboration-network-v1.json>
+```
+
+Ship the new revision in the next release with its pin; update then advances
+each joined Home along the same chain.
+
 Generation fixes the logical sender service to Chat (`chat`); Runtime startup
 separately binds the operation capsule to `chat-room`. The command creates the
 canonical `profile_scoped_signer` grant, binds its raw SHA-256 CID into the
@@ -129,7 +234,9 @@ accepted-head marker, create a Runtime device identity, join Carrier, or write
 product state. Its receipt contains only public identifiers and hashes; it
 never prints the authority key or connect ticket.
 
-An absent profile means isolated mode. It never falls back to a public network.
+At Runtime startup, an absent profile means isolated mode; Runtime never
+substitutes a network of its own. Joining the default network is a setup and
+update step governed by the release pin above.
 A profile with another valid network ID is a separate namespace and is rejected
 when a different network was requested. Updates fail closed on signature,
 canonicalization, bounds, signer, network, revision, or previous-hash errors.
diff --git a/docs/INSTALL.md b/docs/INSTALL.md
index 6e347796d..44ced04d8 100644
--- a/docs/INSTALL.md
+++ b/docs/INSTALL.md
@@ -261,7 +261,12 @@ Replace `<previous head CID>` with the saved CID. A plain update to an older
 release is refused. Undo needs the network: it fetches the changed parts of the
 previous release again by CID from the trusted source, so the source must be
 reachable. Undo keeps your identity, accounts, and user data, including data
-written after the update.
+written after the update. A Home that joined the release Community
+network stays joined, with its accepted revision, contacts, and messages. An
+older release with no network pin, or with an older pin for the same network,
+keeps the joined configuration in place. Leaving Community is a separate
+action. To keep a Home out of Community, choose that before its first start
+with `elastos setup --isolated`.
 
 For a legacy Home, the first update to a new publisher key uses the installer's
 re-trust step. After that step, Undo accepts only heads signed by the current
diff --git a/docs/MAC.md b/docs/MAC.md
index ea9caa051..cd235f0dc 100644
--- a/docs/MAC.md
+++ b/docs/MAC.md
@@ -16,11 +16,11 @@ source "$HOME/.cargo/env"
 rustup target add wasm32-unknown-unknown
 ```
 
-Source-home imports `ffmpeg`/`ffprobe` from the explicit developer tools directory
-`SETUP_SOURCE_HOME_MEDIA_TOOLS_DIR` for the media-provider prerequisite and
-fail-closed rejects any group-writable ancestor of the resolved binaries. If
-setup stops with `ffmpeg prerequisite parent is unsafe`, tighten the Homebrew
-directory on that path (commonly `chmod g-w /opt/homebrew/Cellar`) and rerun.
+Source-home requires an owner-only directory containing regular, owner-only
+`ffmpeg` and `ffprobe` executables. The build/setup wrapper copies the selected
+host tools into a private temporary directory inside the selected home and
+checks that the copies run. It preserves Homebrew permissions and removes the
+temporary copies on exit. Homebrew libraries remain dependencies of these tools.
 
 Ordinary Home setup fetches the signed `media-tools` package and imports its
 managed executable pair. The host tool instructions above apply to source-home
@@ -44,7 +44,7 @@ CARGO_HOME="$USER_HOME/.cargo" \
 RUSTUP_HOME="$USER_HOME/.rustup" \
 PATH="$USER_HOME/.cargo/bin:/opt/homebrew/bin:$PATH" \
 ELASTOS_COLLABORATION_STARTUP_MODE=isolated \
-scripts/setup-source-home.sh
+scripts/build-and-setup-source-home.sh
 ```
 
 `setup-source-home.sh` builds the runtime server, native providers,
@@ -55,6 +55,11 @@ the stable Runtime under the source-home data root at `bin/elastos`, writes the
 owner-only `receipts/source-home-installation.json` receipt, and signs the
 installed VZ supervisor on macOS.
 
+The wrapper defaults to isolated collaboration and leaves Runtime startup as
+a separate step. It disables Browser TURN startup during setup. To check only
+the media tools before a build, run
+`scripts/build-and-setup-source-home.sh --check-tools`.
+
 For Home/passkey use without Browser VM proof artifacts, start the stable
 installed gateway through the restart helper:
 
@@ -95,7 +100,7 @@ CARGO_HOME="$USER_HOME/.cargo" \
 RUSTUP_HOME="$USER_HOME/.rustup" \
 PATH="$USER_HOME/.cargo/bin:/opt/homebrew/bin:$PATH" \
 ELASTOS_COLLABORATION_STARTUP_MODE=isolated \
-scripts/setup-source-home.sh
+scripts/build-and-setup-source-home.sh
 
 HOME="$MAC_TEST_HOME" scripts/browser-vm-artifact-preflight.sh
 ```
diff --git a/docs/PEOPLE_CONVERSATIONS.md b/docs/PEOPLE_CONVERSATIONS.md
index 509d666ee..d67f2cfe9 100644
--- a/docs/PEOPLE_CONVERSATIONS.md
+++ b/docs/PEOPLE_CONVERSATIONS.md
@@ -400,7 +400,10 @@ User test:
 Status: implemented. Direct conversations are Profile-scoped, Runtime-authorized
 on every read and send, and routed over the Runtime-mediated peer path. Shared
 group Chat is unchanged. Bilateral removal, shared-room Profile attribution,
-and incoming-message notifications have landed with it. Direct conversations
+and incoming-message notifications have landed with it. A message alert and its
+unread dot belong to the account that received the message: many accounts can
+share one Home, so Home, Inbox and Chat show each account only its own alerts,
+and only that account can read, dismiss or clear them. Direct conversations
 are text-only for now: attachments need object handling and a delivery path of
 their own, designed on the unified delivery layer, and until then the attach
 control is visibly unavailable in direct mode rather than silently missing.
diff --git a/docs/TROUBLESHOOTING.md b/docs/TROUBLESHOOTING.md
new file mode 100644
index 000000000..3e696e5c3
--- /dev/null
+++ b/docs/TROUBLESHOOTING.md
@@ -0,0 +1,62 @@
+# Troubleshooting
+
+Known symptoms, their causes and the fix. Each section starts with the log line
+or screen state a person sees first. Add a section when a problem took real
+effort to diagnose.
+
+## Collaboration network and Carrier
+
+Background: [collaboration network profile](COLLABORATION_NETWORK_PROFILE.md)
+and [Carrier](CARRIER.md).
+
+### `Carrier provider connect failed ticket_index=0 error=connect timed out`
+
+A Home logs this every 25 seconds, and Discovery, contact requests and direct
+messages stop. Chat messages sent before the break may still show; new direct
+messages stay **Sending**, and an accepted contact appears on one side only.
+
+The Home cannot reach the bootstrap Runtime at the address recorded in its
+network file.
+
+1. Read the bootstrap address from the network file. `profile_chain_base64`
+   holds the signed profile; its `bootstrap_peers` carry a connect ticket that
+   lists `"Ip":"<address>:<port>"`.
+2. Compare it with the bootstrap Runtime's log line
+   `carrier: isolated <did> (port <port>)` and with
+   `lsof -nP -iUDP | grep elastos`.
+3. Match them:
+   - The port differs: run
+     `elastos config set carrier_bind_addr 0.0.0.0:<port from the file>` on the
+     bootstrap Runtime.
+   - It listens on `127.0.0.1` while the file names a LAN or public address:
+     bind `0.0.0.0:<port>` instead. `127.0.0.1` answers only on the same
+     machine.
+   - Two Runtimes on one machine compete for the default port `4433`: give the
+     other Runtime its own `carrier_bind_addr`, and start the bootstrap
+     Runtime first.
+   - The machine's address itself changed: generate the next signed revision
+     with `elastos collaboration-config generate-revision` from a fresh
+     bootstrap receipt, and give every Home the new file (a release for the
+     public network).
+4. Restart the bootstrap Runtime, then the other Homes. The timeout lines stop
+   once the Home connects.
+
+Prevention: pin the bootstrap Runtime's `carrier_bind_addr` before exporting
+its bootstrap receipt. See the tip in the
+[collaboration network profile](COLLABORATION_NETWORK_PROFILE.md).
+
+### `Configured Carrier listener could not start … Failed to bind requested Carrier address`
+
+Another process holds that address, often a second Runtime on the same machine
+pinned to the same port. Give each Runtime its own port with
+`elastos config set carrier_bind_addr`. Settings live in each Home's own
+`config.toml`, so set a second Home's port with that Home's `HOME` or
+`XDG_DATA_HOME`.
+
+### `discovery relay outbox delivery failed … discovery advertisement is not active`
+
+This debug line means a queued contact request or decision names a Discovery
+advertisement that the relay no longer holds, for example after the bootstrap
+Runtime restarted. The outbox keeps retrying on later passes and stops
+resending a request once its advertisement expires. It does not make Discovery
+unavailable.
diff --git a/elastos/crates/elastos-server/src/api/gateway.rs b/elastos/crates/elastos-server/src/api/gateway.rs
index 3c0f182b5..e0097a219 100644
--- a/elastos/crates/elastos-server/src/api/gateway.rs
+++ b/elastos/crates/elastos-server/src/api/gateway.rs
@@ -708,6 +708,10 @@ fn gateway_router_with_api_url(state: GatewayState, gateway_api_url: String) ->
             get(gateway_carrier_bootstrap),
         )
         .route("/api/carrier/bootstrap", get(gateway_carrier_bootstrap))
+        .route(
+            "/api/apps/chat-room/contacts/request",
+            post(chat_room_contact_request),
+        )
         .route("/artifacts/*path", get(serve_artifact_file))
         .route(
             "/api/apps/assistant/workspace",
diff --git a/elastos/crates/elastos-server/src/api/gateway_home_runtime.rs b/elastos/crates/elastos-server/src/api/gateway_home_runtime.rs
index df23375f0..7cb958ec7 100644
--- a/elastos/crates/elastos-server/src/api/gateway_home_runtime.rs
+++ b/elastos/crates/elastos-server/src/api/gateway_home_runtime.rs
@@ -1012,6 +1012,7 @@ fn home_site_summary(data_dir: &std::path::Path) -> HomeSiteSummary {
 
 fn home_room_summary(summary: crate::room_service::RoomSummary) -> HomeRoomSummary {
     HomeRoomSummary {
+        latest_seq: summary.latest_seq,
         room_slug: summary.room_slug,
         title: summary.room_control.title,
         member_count: summary.room_control.member_count,
diff --git a/elastos/crates/elastos-server/src/api/gateway_home_system.rs b/elastos/crates/elastos-server/src/api/gateway_home_system.rs
index f44293657..1550f761c 100644
--- a/elastos/crates/elastos-server/src/api/gateway_home_system.rs
+++ b/elastos/crates/elastos-server/src/api/gateway_home_system.rs
@@ -587,7 +587,11 @@ pub(super) async fn people_discovery_update(
                     now,
                 )
                 .await?;
-            service.wake_registered_sync(authority.store.as_ref(), &authority.profile, now)?;
+            service.wake_registered_discovery_now(
+                authority.store.as_ref(),
+                &authority.profile,
+                now,
+            )?;
             service.local_status(authority.store.as_ref(), &authority.profile, now)
         },
     )
@@ -608,7 +612,11 @@ pub(super) async fn people_discovery_refresh(
         &headers,
         false,
         |service, authority, now| async move {
-            service.wake_registered_sync(authority.store.as_ref(), &authority.profile, now)?;
+            service.wake_registered_discovery_now(
+                authority.store.as_ref(),
+                &authority.profile,
+                now,
+            )?;
             service.local_status(authority.store.as_ref(), &authority.profile, now)
         },
     )
@@ -876,6 +884,13 @@ pub(super) fn apply_contact_request_notification_projection(
         None => Vec::new(),
     };
     let mut summary = crate::notifications::load_summary(data_dir)?;
+    if let Some(store) = contact_store {
+        crate::notifications::project_direct_message_notifications(
+            &mut summary,
+            data_dir,
+            store.local_profile_did(),
+        )?;
+    }
     crate::notifications::project_contact_request_notifications(&mut summary, &pending);
     *notifications = home_notifications_summary(summary);
     Ok(())
@@ -1056,6 +1071,12 @@ fn configured_people_discovery_summary(
         )
     } else if !status.enabled() {
         ("off", "Discovery is off.".to_string())
+    } else if status.connecting() {
+        (
+            "connecting",
+            "Discovery is connecting. People who are visible appear here in a few seconds."
+                .to_string(),
+        )
     } else if status.available() {
         (
             "visible",
@@ -1238,6 +1259,29 @@ mod discovery_summary_tests {
         assert!(json.get("remote_visibility_remaining_seconds").is_none());
     }
 
+    #[test]
+    fn configured_discovery_summary_reports_connecting_before_first_relay_pass() {
+        let summary = configured_people_discovery_summary(
+            &crate::collaboration_discovery_runtime::CollaborationDiscoveryStatus::test_new(
+                false,
+                true,
+                None,
+                None,
+                Vec::new(),
+                Vec::new(),
+            )
+            .with_connecting_for_test(),
+            100,
+        );
+
+        let json = serde_json::to_value(&summary).unwrap();
+        assert_eq!(json["status"], "connecting");
+        assert_eq!(
+            json["status_message"],
+            "Discovery is connecting. People who are visible appear here in a few seconds."
+        );
+    }
+
     #[test]
     fn configured_discovery_summary_reports_runtime_retry_and_one_request_count() {
         let summary = configured_people_discovery_summary(
@@ -5177,7 +5221,20 @@ async fn home_realtime_snapshot(
     if apply_home_services_selection(&state.data_dir, context, &mut home_state.services).is_err() {
         home_state.services = HomeServicesSummary::default();
     }
-    let room_signature = home_room_realtime_signature(&home_state.room);
+    // A new direct message refreshes its conversation's notification time,
+    // so the newest such time signals direct messages alongside the room.
+    let direct_message_marker = home_state
+        .notifications
+        .entries
+        .iter()
+        .filter(|entry| crate::notifications::is_direct_message_notification_id(&entry.id))
+        .map(|entry| entry.created_at)
+        .max()
+        .unwrap_or_default();
+    let room_signature = format!(
+        "{}:dm{direct_message_marker}",
+        home_room_realtime_signature(&home_state.room)
+    );
     let mut notifications = home_state.notifications;
     let wallet_approvals = system_wallet_approvals_summary(state, authority, false).await;
     let mut wallet_request_signature = wallet_approvals
@@ -5221,7 +5278,17 @@ async fn home_realtime_snapshot(
     .await;
     let recovery_readiness = recovery_readiness_for_context(&state.data_dir, context);
     let desktop_signature = home_desktop_events_signature(state, context).await;
-    let people_signature = home_people_realtime_signature(&home_state.people);
+    let mut people_signature = home_people_realtime_signature(&home_state.people);
+    if let (Some(service), Ok(Some(authority))) = (
+        state.collaboration_discovery_service.as_ref(),
+        contact_authority.as_ref(),
+    ) {
+        if let Ok(status) =
+            service.read_only_status(authority.store.as_ref(), &authority.profile, now_ts())
+        {
+            people_signature.push(home_discovery_realtime_signature(&status));
+        }
+    }
     let services_signature = home_services_realtime_signature(&home_state.services);
     HomeRealtimeSnapshot {
         principal_id: context.principal_id.clone(),
@@ -5335,8 +5402,9 @@ fn home_room_realtime_signature(room: &HomeRoomSummary) -> String {
         .collect::<Vec<_>>();
     sessions.sort();
     format!(
-        "{}:{}:{}:{}:{}:{}:{}:{}",
+        "{}:{}:{}:{}:{}:{}:{}:{}:{}",
         room.room_slug,
+        room.latest_seq,
         room.pending_count,
         room.active_session_count,
         room.member_count,
@@ -5347,6 +5415,27 @@ fn home_room_realtime_signature(room: &HomeRoomSummary) -> String {
     )
 }
 
+/// Discovery state that People shows. Countdown seconds stay out so the
+/// signature changes only when what a person can act on changes.
+fn home_discovery_realtime_signature(
+    status: &crate::collaboration_discovery_runtime::CollaborationDiscoveryStatus,
+) -> String {
+    let mut visible = status
+        .visible_people()
+        .iter()
+        .map(|person| person.advertisement_id())
+        .collect::<Vec<_>>();
+    visible.sort_unstable();
+    format!(
+        "discovery:{}:{}:{}:{}:{}",
+        status.enabled(),
+        status.connecting(),
+        status.available(),
+        status.incoming_requests().len(),
+        visible.join(",")
+    )
+}
+
 fn home_people_realtime_signature(people: &HomePeopleSummary) -> Vec<String> {
     let mut signature = people
         .contacts
@@ -5671,15 +5760,18 @@ pub(super) fn recovery_readiness_for_context(
         &home_browser_localhost_root(context),
     ) {
         Ok(recovery) => {
+            let kit_outdated = recovery
+                .required_actions
+                .iter()
+                .any(|action| action == "download_recovery_kit_with_profile");
             if crate::api::auth_gateway::principal_root_recovery_is_ready(&recovery)
-                && !recovery
-                    .required_actions
-                    .iter()
-                    .any(|action| action == "download_recovery_kit_with_profile")
+                && !kit_outdated
             {
                 RecoveryReadinessSummary::ready()
+            } else if recovery.recovery_configured {
+                RecoveryReadinessSummary::setup_required(RECOVERY_READINESS_REASON_KIT_OUTDATED)
             } else {
-                RecoveryReadinessSummary::setup_required()
+                RecoveryReadinessSummary::setup_required(RECOVERY_READINESS_REASON_KIT_MISSING)
             }
         }
         Err(_) => RecoveryReadinessSummary::unavailable(),
@@ -7746,6 +7838,14 @@ pub(super) async fn home_background_image(
 mod home_realtime_tests {
     use super::*;
 
+    #[test]
+    fn room_realtime_signature_changes_when_a_message_arrives() {
+        let mut room = HomeRoomSummary::default();
+        let before = home_room_realtime_signature(&room);
+        room.latest_seq = 7;
+        assert_ne!(home_room_realtime_signature(&room), before);
+    }
+
     #[test]
     fn room_realtime_signature_ignores_session_last_seen_heartbeat() {
         let mut room = HomeRoomSummary {
@@ -7992,7 +8092,9 @@ mod home_realtime_tests {
         let snapshot = HomeRealtimeSnapshot {
             principal_id: "person:local:test".to_string(),
             runtime_signature: String::new(),
-            recovery_readiness: RecoveryReadinessSummary::setup_required(),
+            recovery_readiness: RecoveryReadinessSummary::setup_required(
+                RECOVERY_READINESS_REASON_KIT_MISSING,
+            ),
             profile_readiness: ProfileReadinessSummary::setup_required(),
             notification_signature: Vec::new(),
             wallet_request_signature: Vec::new(),
diff --git a/elastos/crates/elastos-server/src/api/gateway_inbox.rs b/elastos/crates/elastos-server/src/api/gateway_inbox.rs
index ed02589a0..7c899b9ef 100644
--- a/elastos/crates/elastos-server/src/api/gateway_inbox.rs
+++ b/elastos/crates/elastos-server/src/api/gateway_inbox.rs
@@ -274,9 +274,13 @@ async fn dispatch_inbox_action(
 ) -> anyhow::Result<String> {
     let action_id = action.action_id.as_str();
     let data_dir = &state.data_dir;
+    // Entries one account owns, such as its direct messages, change only for
+    // that account.
+    let viewer = super::gateway_home_system::load_profile_authority_for_context(data_dir, context)?
+        .map(|profile| profile.document().profile_did.clone());
     if let Some(notification_id) = action_id.strip_prefix("notification-read:") {
         return Ok(
-            match crate::notifications::mark_read(data_dir, notification_id)? {
+            match crate::notifications::mark_read(data_dir, viewer.as_deref(), notification_id)? {
                 true => "Marked inbox entry read.".to_string(),
                 false => "That inbox entry was already read or is no longer present.".to_string(),
             },
@@ -284,7 +288,7 @@ async fn dispatch_inbox_action(
     }
     if let Some(notification_id) = action_id.strip_prefix("notification-dismiss:") {
         return Ok(
-            match crate::notifications::dismiss(data_dir, notification_id)? {
+            match crate::notifications::dismiss(data_dir, viewer.as_deref(), notification_id)? {
                 true => "Dismissed inbox entry.".to_string(),
                 false => "That inbox entry is already gone.".to_string(),
             },
@@ -318,7 +322,7 @@ async fn dispatch_inbox_action(
         };
         let summary = crate::room_service::load_summary(data_dir)?;
         let _ = crate::notifications::sync_room_notifications(data_dir, &summary);
-        let _ = crate::notifications::mark_acted_for_action(data_dir, action_id);
+        let _ = crate::notifications::mark_acted_for_action(data_dir, None, action_id);
         return Ok(message);
     }
     if let Some(request_id) = action_id.strip_prefix("room-deny-request:") {
@@ -332,7 +336,7 @@ async fn dispatch_inbox_action(
             };
         let summary = crate::room_service::load_summary(data_dir)?;
         let _ = crate::notifications::sync_room_notifications(data_dir, &summary);
-        let _ = crate::notifications::mark_acted_for_action(data_dir, action_id);
+        let _ = crate::notifications::mark_acted_for_action(data_dir, None, action_id);
         return Ok(message);
     }
     if let Some(request_id) = action_id.strip_prefix("wallet-approve-request:") {
@@ -364,7 +368,7 @@ async fn dispatch_inbox_action(
             INBOX_CAPSULE_ID,
         )
         .await?;
-        let _ = crate::notifications::mark_acted_for_action(data_dir, action_id);
+        let _ = crate::notifications::mark_acted_for_action(data_dir, None, action_id);
         return Ok(outcome.message);
     }
     if let Some(request_id) = action_id.strip_prefix("wallet-reject-request:") {
@@ -439,7 +443,7 @@ async fn dispatch_inbox_action(
         ensure_admin_context(data_dir, context)?;
         let approved_at = now_ts();
         store_wallet_price_http_policy(data_dir, &context.principal_id, approved_at)?;
-        let _ = crate::notifications::mark_acted_for_action(data_dir, action_id);
+        let _ = crate::notifications::mark_acted_for_action(data_dir, None, action_id);
         append_wallet_price_policy_audit(
             data_dir,
             &context.principal_id,
@@ -488,7 +492,7 @@ async fn dispatch_inbox_action(
             .as_deref()
             .ok_or_else(|| anyhow::anyhow!("admin passkey required"))?;
         crate::api::model_provider_egress_decision::approve(data_dir, request_id, proof)?;
-        let _ = crate::notifications::mark_acted_for_action(data_dir, action_id);
+        let _ = crate::notifications::mark_acted_for_action(data_dir, None, action_id);
         return Ok(
             "Approved this hosted access. End it in Inbox when it is no longer needed.".to_string(),
         );
@@ -511,7 +515,7 @@ async fn dispatch_inbox_action(
     {
         ensure_admin_context(data_dir, context)?;
         crate::jev_approval_lens::record_human_decision(data_dir, request_id, "approve")?;
-        let _ = crate::notifications::mark_acted_for_action(data_dir, action_id);
+        let _ = crate::notifications::mark_acted_for_action(data_dir, None, action_id);
         return Ok("Approved this hosted connection. Send again from Assistant.".to_string());
     }
     if let Some(request_id) =
diff --git a/elastos/crates/elastos-server/src/api/gateway_models.rs b/elastos/crates/elastos-server/src/api/gateway_models.rs
index 3e8de776f..55649b00b 100644
--- a/elastos/crates/elastos-server/src/api/gateway_models.rs
+++ b/elastos/crates/elastos-server/src/api/gateway_models.rs
@@ -78,8 +78,17 @@ impl ProfileReadinessSummary {
 pub struct RecoveryReadinessSummary {
     schema: &'static str,
     status: &'static str,
+    /// Why setup is still required, so Home can greet a new account
+    /// differently from one whose Recovery Kit predates its Profile.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    reason: Option<&'static str>,
 }
 
+/// Recovery setup is required because no Recovery Kit was ever verified.
+pub const RECOVERY_READINESS_REASON_KIT_MISSING: &str = "recovery_kit_missing";
+/// Recovery setup is required because the verified kit does not cover the Profile.
+pub const RECOVERY_READINESS_REASON_KIT_OUTDATED: &str = "recovery_kit_outdated";
+
 impl RecoveryReadinessSummary {
     const SCHEMA: &'static str = "elastos.recovery.readiness/v1";
 
@@ -87,13 +96,15 @@ impl RecoveryReadinessSummary {
         Self {
             schema: Self::SCHEMA,
             status: "ready",
+            reason: None,
         }
     }
 
-    fn setup_required() -> Self {
+    fn setup_required(reason: &'static str) -> Self {
         Self {
             schema: Self::SCHEMA,
             status: "setup_required",
+            reason: Some(reason),
         }
     }
 
@@ -101,6 +112,7 @@ impl RecoveryReadinessSummary {
         Self {
             schema: Self::SCHEMA,
             status: "unavailable",
+            reason: None,
         }
     }
 }
@@ -796,6 +808,9 @@ struct HomeRoomSummary {
     pending_requests: Vec<HomePendingRequestSummary>,
     #[serde(default)]
     active_sessions: Vec<HomeActiveSessionSummary>,
+    /// Newest room object sequence; realtime signal only, never serialized.
+    #[serde(skip)]
+    latest_seq: u64,
 }
 
 impl Default for HomeRoomSummary {
@@ -817,6 +832,7 @@ impl Default for HomeRoomSummary {
             browser_access_block_reason: None,
             pending_requests: Vec::new(),
             active_sessions: Vec::new(),
+            latest_seq: 0,
         }
     }
 }
@@ -1045,6 +1061,12 @@ struct GatewayRoomPollView {
 struct GatewayConversationObjectView {
     seq: u64,
     sender: String,
+    /// Runtime-only identity used to attach `sender_ref`; never serialized.
+    #[serde(skip)]
+    sender_member_did: Option<String>,
+    /// Opaque reference to the sender's participant card.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    sender_ref: Option<String>,
     #[serde(default)]
     sender_profile_verified: Option<bool>,
     #[serde(default)]
@@ -1063,6 +1085,11 @@ struct GatewayConversationObjectView {
 
 #[derive(Debug, Clone, Serialize)]
 struct GatewayParticipantView {
+    /// Runtime-only identity used to attach the card; never serialized.
+    #[serde(skip)]
+    member_did: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    card: Option<GatewayParticipantCard>,
     display_name: String,
     #[serde(default)]
     profile_verified: Option<bool>,
@@ -1076,6 +1103,87 @@ struct GatewayParticipantView {
     is_current_session: bool,
 }
 
+/// What a person's profile card may offer in the configured Community room.
+/// It carries an opaque reference, never a Profile or device DID.
+#[derive(Debug, Clone, Serialize, PartialEq, Eq)]
+struct GatewayParticipantCard {
+    participant_ref: String,
+    /// `you`, `contact`, `requested`, `pending` or `none`.
+    relationship: &'static str,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    conversation_id: Option<String>,
+    can_add_contact: bool,
+    /// The person shares presence (Discovery on) and it has not expired.
+    active_now: bool,
+}
+
+/// Relationship facts behind the configured Community room's profile cards,
+/// keyed by Profile DID inside Runtime. Only opaque references and product
+/// states leave Runtime.
+#[derive(Debug, Default)]
+pub(super) struct ParticipantCardDirectory {
+    pub(super) local_profile_did: Option<String>,
+    /// Profile DID to (`contact` | `requested` | `pending`, direct conversation).
+    pub(super) relationships: std::collections::HashMap<String, (&'static str, Option<String>)>,
+    /// Profile DIDs visible in Discovery right now, so a request can bind to
+    /// their signed advertisement.
+    pub(super) discoverable: std::collections::HashSet<String>,
+    /// Profile DIDs with unexpired shared presence.
+    pub(super) present: std::collections::HashSet<String>,
+}
+
+impl ParticipantCardDirectory {
+    fn card_for(&self, member_did: &str) -> GatewayParticipantCard {
+        let participant_ref = home_people_contact_id(member_did);
+        if self.local_profile_did.as_deref() == Some(member_did) {
+            return GatewayParticipantCard {
+                participant_ref,
+                relationship: "you",
+                conversation_id: None,
+                can_add_contact: false,
+                active_now: true,
+            };
+        }
+        let (relationship, conversation_id) = self
+            .relationships
+            .get(member_did)
+            .map(|(relationship, conversation)| (*relationship, conversation.clone()))
+            .unwrap_or(("none", None));
+        GatewayParticipantCard {
+            participant_ref,
+            relationship,
+            conversation_id,
+            can_add_contact: relationship == "none" && self.discoverable.contains(member_did),
+            active_now: self.present.contains(member_did),
+        }
+    }
+}
+
+impl GatewayRoomPollView {
+    /// Attaches a profile card to every verified participant and an opaque
+    /// sender reference to every verified message.
+    pub(super) fn apply_participant_cards(&mut self, directory: &ParticipantCardDirectory) {
+        for participant in &mut self.participants {
+            if participant.profile_verified != Some(true) {
+                continue;
+            }
+            if let Some(member_did) = participant.member_did.as_deref() {
+                participant.card = Some(directory.card_for(member_did));
+            }
+        }
+        for object in &mut self.objects {
+            if object.sender_profile_verified != Some(true) {
+                continue;
+            }
+            if let Some(member_did) = object.sender_member_did.as_deref() {
+                object.sender_ref = Some(home_people_contact_id(
+                    member_did,
+                ));
+            }
+        }
+    }
+}
+
 impl From<crate::room_service::RoomSummary> for GatewayRoomSummary {
     fn from(summary: crate::room_service::RoomSummary) -> Self {
         Self {
@@ -1189,6 +1297,8 @@ impl From<crate::room_service::ConversationObjectView> for GatewayConversationOb
         Self {
             seq: view.seq,
             sender: view.sender,
+            sender_member_did: view.sender_member_did,
+            sender_ref: None,
             sender_profile_verified: view.sender_profile_verified,
             from_current_session: view.from_current_session,
             kind: view.kind,
@@ -1204,6 +1314,8 @@ impl From<crate::room_service::ConversationObjectView> for GatewayConversationOb
 impl From<crate::room_service::ParticipantView> for GatewayParticipantView {
     fn from(view: crate::room_service::ParticipantView) -> Self {
         Self {
+            member_did: view.member_did,
+            card: None,
             display_name: view.display_name,
             profile_verified: view.profile_verified,
             device_label: view.device_label,
diff --git a/elastos/crates/elastos-server/src/api/gateway_room.rs b/elastos/crates/elastos-server/src/api/gateway_room.rs
index cc2d6038f..4c78c79ff 100644
--- a/elastos/crates/elastos-server/src/api/gateway_room.rs
+++ b/elastos/crates/elastos-server/src/api/gateway_room.rs
@@ -78,7 +78,15 @@ pub(super) async fn chat_direct_conversations(
         .direct_message_service()
         .conversation_summaries(authority.store.as_ref())
     {
-        Ok(conversations) => {
+        Ok(mut conversations) => {
+            let unread = crate::notifications::unread_direct_message_conversations(
+                &state.data_dir,
+                authority.store.local_profile_did(),
+            )
+            .unwrap_or_default();
+            for conversation in &mut conversations {
+                conversation.unread = unread.contains(&conversation.conversation_id);
+            }
             Json(serde_json::json!({"conversations": conversations})).into_response()
         }
         Err(error) => direct_api_error_response(error),
@@ -107,6 +115,7 @@ pub(super) async fn chat_direct_conversation_messages(
             // notification; the next incoming message resurfaces it.
             let _ = crate::notifications::mark_acted_for_action(
                 &state.data_dir,
+                Some(authority.store.local_profile_did()),
                 &crate::notifications::direct_message_notification_action_id(&conversation_id),
             );
             Json(serde_json::json!({
@@ -489,6 +498,7 @@ pub(super) async fn chat_room_session_start(
     let transport = room_transport_view(&state);
     let port = state.collaboration_chat_product_port.clone();
     let discovery_service = state.collaboration_discovery_service.clone();
+    let presence_port = state.collaboration_presence_product_port.clone();
     match tokio::task::spawn_blocking(move || -> anyhow::Result<_> {
         let output = if port.is_some() {
             start_configured_chat_room_session(&data_dir, &context)?
@@ -500,6 +510,7 @@ pub(super) async fn chat_room_session_start(
             Some(port) => port.conversation_poll(&data_dir, &output.token, 0)?,
             None => crate::room_service::room_poll(&data_dir, &output.token, 0)?,
         };
+        let mut cards = None;
         // The configured shared room refreshes only already-verified signed
         // Profile names here. The plain room keeps its server-stamped
         // home-session and guest names.
@@ -520,18 +531,28 @@ pub(super) async fn chat_room_session_start(
                     .map(|(did, name)| (did.as_str(), name.as_str())),
             );
             apply_profile_attribution_to_room_poll(&mut poll, &names);
+            cards = Some(participant_card_directory(
+                authority.as_ref(),
+                discovery_service.as_ref(),
+                presence_port.as_ref(),
+                local_identity.as_ref().map(|(did, _)| did.as_str()),
+            ));
         }
         poll.transport = transport;
-        Ok((output, poll))
+        Ok((output, poll, cards))
     })
     .await
     {
-        Ok(Ok((output, poll))) => {
+        Ok(Ok((output, poll, cards))) => {
+            let mut poll = GatewayRoomPollView::from(poll);
+            if let Some(cards) = cards.as_ref() {
+                poll.apply_participant_cards(cards);
+            }
             let mut response = Json(ChatRoomSessionStartResponse {
                 status: "connected".to_string(),
                 display_name: output.display_name,
                 expires_at: output.expires_at,
-                poll: GatewayRoomPollView::from(poll),
+                poll,
             })
             .into_response();
             match set_room_session_cookie_header(&output.token, output.max_age_secs, secure) {
@@ -1231,6 +1252,144 @@ fn room_local_profile_identity(
     Some((member_did, card.display_name))
 }
 
+/// Collects the relationship facts behind Community profile cards from this
+/// principal's signed contact store and current Discovery view.
+fn participant_card_directory(
+    authority: Option<&gateway_home_system::ConfiguredContactAuthority>,
+    discovery_service: Option<
+        &crate::collaboration_discovery_runtime::CollaborationDiscoveryService,
+    >,
+    presence_port: Option<&crate::collaboration_presence::CollaborationPresenceProductPort>,
+    local_profile_did: Option<&str>,
+) -> ParticipantCardDirectory {
+    let mut directory = ParticipantCardDirectory {
+        local_profile_did: local_profile_did.map(str::to_string),
+        ..ParticipantCardDirectory::default()
+    };
+    // Presence exists only for people who chose Discovery; everyone else
+    // shows their last Community message time instead.
+    let now = now_ts();
+    if let Some(snapshot) = presence_port.and_then(|port| port.snapshot(now).ok()) {
+        directory.present = snapshot
+            .records()
+            .iter()
+            .filter(|record| record.expires_at() > now)
+            .map(|record| record.sender_profile_did().to_string())
+            .collect();
+    }
+    let Some(authority) = authority else {
+        return directory;
+    };
+    let store = authority.store.as_ref();
+    if let Ok(requests) = store.pending_incoming_requests() {
+        for request in requests {
+            directory.relationships.insert(
+                request.requester_profile_did().to_string(),
+                ("pending", None),
+            );
+        }
+    }
+    if let Ok(requests) = store.outgoing_pending_requests(now) {
+        for request in requests {
+            directory
+                .relationships
+                .insert(request.remote_profile_did.clone(), ("requested", None));
+        }
+    }
+    if let Ok(snapshot) = store.snapshot() {
+        for contact in snapshot.contacts() {
+            directory.relationships.insert(
+                contact.remote_profile_did().to_string(),
+                ("contact", Some(contact.conversation_id().to_string())),
+            );
+        }
+    }
+    if let Some(service) = discovery_service {
+        if let Ok(status) = service.read_only_status(store, &authority.profile, now) {
+            directory.discoverable = status
+                .visible_people()
+                .iter()
+                .map(|person| person.profile_did().to_string())
+                .collect();
+        }
+    }
+    directory
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub(super) struct ChatRoomContactRequestBody {
+    participant_ref: String,
+}
+
+/// Sends a contact request to a Community participant chosen on their
+/// profile card. The request binds to that person's signed Discovery
+/// advertisement, and they accept or decline it in Inbox.
+pub(super) async fn chat_room_contact_request(
+    State(state): State<GatewayState>,
+    headers: HeaderMap,
+    Json(body): Json<ChatRoomContactRequestBody>,
+) -> Response {
+    // The Chat session comes first, so a refused caller learns nothing about
+    // this Home's Discovery setup.
+    let context =
+        match require_home_launch_token_context(&state.data_dir, &headers, CHAT_ROOM_CAPSULE_ID) {
+            Ok(context) => context,
+            Err(err) => return room_service_error_response(err),
+        };
+    let Some(service) = state.collaboration_discovery_service.clone() else {
+        return (
+            StatusCode::CONFLICT,
+            "Contacts are unavailable on this Home.",
+        )
+            .into_response();
+    };
+    let authority = match gateway_home_system::load_configured_contact_authority_for_context(
+        &state.data_dir,
+        &context,
+        Some(&service),
+    ) {
+        Ok(Some(authority)) => authority,
+        Ok(None) => {
+            return (
+                StatusCode::CONFLICT,
+                "Create your Profile before adding contacts.",
+            )
+                .into_response()
+        }
+        Err(err) => return room_service_error_response(err),
+    };
+    let now = now_ts();
+    let status = match service.read_only_status(authority.store.as_ref(), &authority.profile, now) {
+        Ok(status) => status,
+        Err(err) => return room_service_error_response(err),
+    };
+    let Some(advertisement_id) = status
+        .visible_people()
+        .iter()
+        .find(|person| home_people_contact_id(person.profile_did()) == body.participant_ref)
+        .map(|person| person.advertisement_id().to_string())
+    else {
+        return (
+            StatusCode::CONFLICT,
+            "Ask them to turn on Discovery, then try again. Both of you need Discovery on to add a contact.",
+        )
+            .into_response();
+    };
+    match service
+        .send_contact_request(
+            authority.store.as_ref(),
+            &advertisement_id,
+            &authority.profile,
+            now,
+        )
+        .await
+    {
+        Ok(()) => Json(serde_json::json!({ "status": "requested" })).into_response(),
+        Err(err) => room_service_error_response(err),
+    }
+}
+
 /// Binds configured shared-room attribution to signed Profile identity.
 /// A visible row must already carry a verified Profile+endpoint binding from
 /// the room projection; this helper may refresh the display name from signed
@@ -1394,6 +1553,7 @@ pub(super) async fn room_service_poll(
     let transport = room_transport_view(&state);
     let port = state.collaboration_chat_product_port.clone();
     let discovery_service = state.collaboration_discovery_service.clone();
+    let presence_port = state.collaboration_presence_product_port.clone();
     let mut launch_context = None;
     let token = match port.as_ref() {
         Some(_) => {
@@ -1439,6 +1599,7 @@ pub(super) async fn room_service_poll(
             Some(port) => port.conversation_poll(&data_dir, &token, body.since)?,
             None => crate::room_service::room_poll(&data_dir, &token, body.since)?,
         };
+        let mut cards = None;
         // The configured shared room refreshes only already-verified signed
         // Profile names here: contact authority plus room membership cards
         // may refresh the display name, but they never upgrade an unverified
@@ -1461,14 +1622,24 @@ pub(super) async fn room_service_poll(
                     .map(|(did, name)| (did.as_str(), name.as_str())),
             );
             apply_profile_attribution_to_room_poll(&mut poll, &names);
+            cards = Some(participant_card_directory(
+                authority.as_ref(),
+                discovery_service.as_ref(),
+                presence_port.as_ref(),
+                local_identity.as_ref().map(|(did, _)| did.as_str()),
+            ));
         }
-        Ok::<_, anyhow::Error>(poll)
+        Ok::<_, anyhow::Error>((poll, cards))
     })
     .await
     {
-        Ok(Ok(mut output)) => {
+        Ok(Ok((mut output, cards))) => {
             output.transport = transport;
-            Json(GatewayRoomPollView::from(output)).into_response()
+            let mut view = GatewayRoomPollView::from(output);
+            if let Some(cards) = cards.as_ref() {
+                view.apply_participant_cards(cards);
+            }
+            Json(view).into_response()
         }
         Ok(Err(err)) => room_service_error_response(err),
         Err(err) => room_service_join_error_response(err),
diff --git a/elastos/crates/elastos-server/src/api/gateway_tests/home_system.rs b/elastos/crates/elastos-server/src/api/gateway_tests/home_system.rs
index e309dbb84..8cc3bf917 100644
--- a/elastos/crates/elastos-server/src/api/gateway_tests/home_system.rs
+++ b/elastos/crates/elastos-server/src/api/gateway_tests/home_system.rs
@@ -156,12 +156,12 @@ pub(super) fn configured_discovery_network_profile_for_test(
     }
 }
 
-struct TestCollaborationMessageScope<'a> {
-    network_id: &'a str,
-    conversation_id: &'a str,
+pub(super) struct TestCollaborationMessageScope<'a> {
+    pub(super) network_id: &'a str,
+    pub(super) conversation_id: &'a str,
 }
 
-fn signed_discovery_message_for_test(
+pub(super) fn signed_discovery_message_for_test(
     signing_key: &SigningKey,
     sender_profile_did: &str,
     scope: TestCollaborationMessageScope<'_>,
@@ -4122,6 +4122,18 @@ fn assert_recovery_readiness_projection(payload: &Value, status: &str, path: &st
     );
 }
 
+fn assert_recovery_setup_required_projection(payload: &Value, reason: &str, path: &str) {
+    assert_eq!(
+        payload["identity"]["recovery_readiness"],
+        json!({
+            "schema": "elastos.recovery.readiness/v1",
+            "status": "setup_required",
+            "reason": reason,
+        }),
+        "{path}"
+    );
+}
+
 #[tokio::test]
 async fn existing_profile_setup_protects_root_without_claiming_recovery() {
     let dir = tempfile::tempdir().unwrap();
@@ -4256,7 +4268,11 @@ async fn existing_profile_setup_protects_root_without_claiming_recovery() {
     .await;
     assert_eq!(status, StatusCode::OK);
     assert_eq!(payload["identity"]["profile_readiness"]["status"], "ready");
-    assert_recovery_readiness_projection(&payload, "setup_required", "profile without backup");
+    assert_recovery_setup_required_projection(
+        &payload,
+        "recovery_kit_missing",
+        "profile without backup",
+    );
     assert_eq!(
         payload["discovery"]["status"], "unconfigured",
         "Profile creation does not opt into discovery"
@@ -4285,7 +4301,7 @@ async fn test_recovery_readiness_does_not_claim_profile_coverage() {
     ] {
         let (status, payload) = home_test_get_json(&app, path, token, origin).await;
         assert_eq!(status, StatusCode::OK, "{path}");
-        assert_recovery_readiness_projection(&payload, "setup_required", path);
+        assert_recovery_setup_required_projection(&payload, "recovery_kit_missing", path);
     }
     assert_eq!(file_snapshot(dir.path()), before_summary);
 
@@ -4321,6 +4337,24 @@ async fn test_recovery_readiness_does_not_claim_profile_coverage() {
     assert_eq!(status, StatusCode::OK);
     assert_eq!(payload["profile"]["display_name"], "Owner");
     assert_eq!(payload["profile_readiness"]["status"], "ready");
+
+    // A verified kit that predates the Profile is outdated, not missing.
+    for (path, token, origin) in [
+        (
+            "/api/apps/home/summary",
+            authority.home_token.as_str(),
+            "http://localhost:61180",
+        ),
+        (
+            "/api/apps/people/summary",
+            authority.people_token.as_str(),
+            "null",
+        ),
+    ] {
+        let (status, payload) = home_test_get_json(&app, path, token, origin).await;
+        assert_eq!(status, StatusCode::OK, "{path}");
+        assert_recovery_setup_required_projection(&payload, "recovery_kit_outdated", path);
+    }
 }
 
 #[tokio::test]
diff --git a/elastos/crates/elastos-server/src/api/gateway_tests/room.rs b/elastos/crates/elastos-server/src/api/gateway_tests/room.rs
index cf90a2312..0e454e843 100644
--- a/elastos/crates/elastos-server/src/api/gateway_tests/room.rs
+++ b/elastos/crates/elastos-server/src/api/gateway_tests/room.rs
@@ -1,5 +1,6 @@
 use super::*;
 
+mod contact_request;
 mod direct;
 
 struct MockPeerProvider;
@@ -2382,3 +2383,133 @@ async fn test_room_service_session_leave_appends_system_object() {
     let summary = crate::room_service::load_summary(dir.path()).unwrap();
     assert_eq!(summary.active_session_count, 0);
 }
+
+fn card_test_participant(member_did: &str, verified: bool) -> GatewayParticipantView {
+    GatewayParticipantView {
+        member_did: Some(member_did.to_string()),
+        card: None,
+        display_name: "Person".to_string(),
+        profile_verified: Some(verified),
+        device_label: String::new(),
+        last_seen_at: 0,
+        role: None,
+        local_session_count: 0,
+        is_current_session: false,
+    }
+}
+
+#[test]
+fn test_participant_cards_project_relationships_without_dids() {
+    let mut directory = ParticipantCardDirectory {
+        local_profile_did: Some("did:key:zSelf".to_string()),
+        ..ParticipantCardDirectory::default()
+    };
+    directory.relationships.insert(
+        "did:key:zContact".to_string(),
+        ("contact", Some("direct:abc".to_string())),
+    );
+    directory
+        .relationships
+        .insert("did:key:zRequested".to_string(), ("requested", None));
+    directory
+        .relationships
+        .insert("did:key:zPending".to_string(), ("pending", None));
+    directory
+        .discoverable
+        .insert("did:key:zVisible".to_string());
+    directory.present.insert("did:key:zContact".to_string());
+    let mut poll = GatewayRoomPollView {
+        room_slug: "community".to_string(),
+        display_name: "Community".to_string(),
+        latest_seq: 0,
+        participants: vec![
+            card_test_participant("did:key:zSelf", true),
+            card_test_participant("did:key:zContact", true),
+            card_test_participant("did:key:zRequested", true),
+            card_test_participant("did:key:zPending", true),
+            card_test_participant("did:key:zVisible", true),
+            card_test_participant("did:key:zStranger", true),
+            card_test_participant("did:key:zUnverified", false),
+        ],
+        objects: Vec::new(),
+        transport: Default::default(),
+    };
+
+    poll.apply_participant_cards(&directory);
+
+    let cards = poll
+        .participants
+        .iter()
+        .map(|participant| {
+            participant.card.as_ref().map(|card| {
+                (
+                    card.relationship,
+                    card.conversation_id.clone(),
+                    card.can_add_contact,
+                )
+            })
+        })
+        .collect::<Vec<_>>();
+    assert_eq!(
+        cards,
+        vec![
+            Some(("you", None, false)),
+            Some(("contact", Some("direct:abc".to_string()), false)),
+            Some(("requested", None, false)),
+            Some(("pending", None, false)),
+            Some(("none", None, true)),
+            Some(("none", None, false)),
+            None,
+        ]
+    );
+    let json = serde_json::to_string(&poll).unwrap();
+    assert!(
+        !json.contains("did:key:"),
+        "cards must not expose DIDs: {json}"
+    );
+    assert!(poll.participants[1].card.as_ref().unwrap().active_now);
+    assert!(!poll.participants[2].card.as_ref().unwrap().active_now);
+    assert_eq!(
+        poll.participants[1].card.as_ref().unwrap().participant_ref,
+        home_people_contact_id("did:key:zContact")
+    );
+}
+
+#[tokio::test]
+async fn test_chat_contact_request_needs_configured_contacts() {
+    let dir = tempfile::tempdir().unwrap();
+    let app = gateway_router(test_state(dir.path()));
+    let authority = passkey_authority_with_profile(dir.path(), "owner");
+    let launch = app
+        .clone()
+        .oneshot(
+            test_browser_request("localhost:61180", "http://localhost:61180")
+                .method("POST")
+                .uri("/api/apps/home/launch")
+                .header("x-elastos-home-token", authority.home_token.as_str())
+                .header(CONTENT_TYPE, "application/json")
+                .body(Body::from(r#"{"target":"chat-room"}"#))
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    let body = axum::body::to_bytes(launch.into_body(), usize::MAX)
+        .await
+        .unwrap();
+    let payload: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    let token = test_launch_token_from_route(payload["route"].as_str().unwrap());
+
+    let response = app
+        .oneshot(
+            test_browser_request("localhost:61180", "null")
+                .method("POST")
+                .uri("/api/apps/chat-room/contacts/request")
+                .header("x-elastos-home-token", token.as_str())
+                .header(CONTENT_TYPE, "application/json")
+                .body(Body::from(r#"{"participant_ref":"contact:0"}"#))
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(response.status(), StatusCode::CONFLICT);
+}
diff --git a/elastos/crates/elastos-server/src/api/gateway_tests/room/contact_request.rs b/elastos/crates/elastos-server/src/api/gateway_tests/room/contact_request.rs
new file mode 100644
index 000000000..fa0796f43
--- /dev/null
+++ b/elastos/crates/elastos-server/src/api/gateway_tests/room/contact_request.rs
@@ -0,0 +1,266 @@
+use super::super::home_system::{
+    configured_discovery_network_profile_for_test, home_test_post_json,
+    signed_discovery_message_for_test, TestCollaborationMessageScope,
+};
+use super::*;
+use elastos_runtime::signature::{generate_keypair, SigningKey};
+
+const NETWORK: &str = "gateway-chat-contact-request";
+const CONTACT_REQUEST_PATH: &str = "/api/apps/chat-room/contacts/request";
+
+/// A Home with a Profile, a Discovery service and a remote Profile whose
+/// signed advertisement the tests can make visible. No relay is reachable.
+struct ContactRequestHome {
+    dir: tempfile::TempDir,
+    app: Router,
+    authority: TestPasskeyAuthority,
+    service: crate::collaboration_discovery_runtime::CollaborationDiscoveryService,
+    store: crate::collaboration_contact_store::CollaborationContactStore,
+    local_profile: crate::collaboration_profile_authority::VerifiedCollaborationProfileDocument,
+    remote_profile_did: String,
+    remote_advertisement: Vec<u8>,
+    chat_context: HomeLaunchTokenContext,
+    chat_token: String,
+    now: u64,
+}
+
+impl ContactRequestHome {
+    async fn new() -> Self {
+        let now = crate::auth::now_ts();
+        let dir = tempfile::tempdir().unwrap();
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt;
+            std::fs::set_permissions(dir.path(), std::fs::Permissions::from_mode(0o700)).unwrap();
+        }
+        let authority = passkey_authority_with_name(dir.path(), Some("Local"));
+        crate::auth::store_test_principal_root_protection(dir.path(), &authority.principal_id);
+
+        let (trusted_key, _) = generate_keypair();
+        let network_profile = configured_discovery_network_profile_for_test(&trusted_key, NETWORK);
+        // Production keys Discovery with the runtime device identity, which is
+        // the device the local Profile authorizes.
+        let (runtime_device_key, _) = elastos_identity::load_or_create_did(dir.path()).unwrap();
+        let service = crate::collaboration_discovery_runtime::CollaborationDiscoveryService::new(
+            SigningKey::from_bytes(&runtime_device_key.to_bytes()),
+            network_profile.clone(),
+            Arc::new(elastos_runtime::provider::ProviderRegistry::new()),
+        )
+        .await
+        .unwrap();
+        let mut state = test_state(dir.path());
+        state.collaboration_discovery_service = Some(service.clone());
+        let app = gateway_router(state);
+
+        let (status, _) = home_test_post_json(
+            &app,
+            "/api/apps/people/profile",
+            &authority.people_token,
+            "null",
+            serde_json::json!({ "display_name": "Local Profile" }),
+        )
+        .await;
+        assert_eq!(status, StatusCode::OK);
+        let localhost_root = crate::auth::principal_localhost_root(&authority.principal_id);
+        let local_profile = crate::collaboration_profile_authority::load_profile_authority(
+            dir.path(),
+            &authority.principal_id,
+            &localhost_root,
+        )
+        .unwrap()
+        .unwrap();
+        let local_device_did =
+            crate::collaboration_profile_authority::load_existing_device_did(dir.path())
+                .unwrap()
+                .unwrap();
+        let store = crate::collaboration_contact_store::CollaborationContactStore::new(
+            dir.path(),
+            &authority.principal_id,
+            &localhost_root,
+            network_profile,
+            &local_profile,
+            &local_device_did,
+        )
+        .unwrap();
+
+        let (remote_profile_did, remote_advertisement) = remote_advertisement("Remote", now);
+        let chat_context = HomeLaunchTokenContext {
+            principal_id: authority.principal_id.clone(),
+            session_id: authority.session_id.clone(),
+            proof_binding_id: Some(authority.proof_binding_id.clone()),
+            grant_id: authority.grant_id.clone(),
+        };
+        let chat_token = issue_home_projection_launch_token_with_context(
+            dir.path(),
+            CHAT_ROOM_CAPSULE_ID,
+            CHAT_ROOM_CAPSULE_ID,
+            &chat_context,
+        )
+        .unwrap();
+        Self {
+            dir,
+            app,
+            authority,
+            service,
+            store,
+            local_profile,
+            remote_profile_did,
+            remote_advertisement,
+            chat_context,
+            chat_token,
+            now,
+        }
+    }
+
+    fn show(&self, visible: Vec<Vec<u8>>) {
+        self.service
+            .seed_visible_discovery_for_test(&self.store, &self.local_profile, visible, self.now)
+            .unwrap();
+    }
+
+    async fn request(&self, token: Option<&str>, participant_ref: &str) -> (StatusCode, String) {
+        let mut request = Request::builder()
+            .method("POST")
+            .uri(CONTACT_REQUEST_PATH)
+            .header(HOST, "localhost:61180")
+            .header("origin", "null")
+            .header(CONTENT_TYPE, "application/json");
+        if let Some(token) = token {
+            request = request.header("x-elastos-home-token", token);
+        }
+        let body = serde_json::json!({ "participant_ref": participant_ref }).to_string();
+        let response = self
+            .app
+            .clone()
+            .oneshot(request.body(Body::from(body)).unwrap())
+            .await
+            .unwrap();
+        let status = response.status();
+        let bytes = axum::body::to_bytes(response.into_body(), usize::MAX)
+            .await
+            .unwrap();
+        (status, String::from_utf8_lossy(&bytes).into_owned())
+    }
+
+    fn outgoing_requests(&self) -> usize {
+        self.store
+            .outgoing_pending_requests(self.now)
+            .unwrap()
+            .len()
+    }
+}
+
+/// A remote person's signed Discovery advertisement and Profile DID.
+fn remote_advertisement(display_name: &str, now: u64) -> (String, Vec<u8>) {
+    let (device_key, _) = generate_keypair();
+    let device_key = SigningKey::from_bytes(&device_key.to_bytes());
+    let device_did = crate::crypto::encode_signing_key_did(&device_key);
+    let (profile_key, _) = generate_keypair();
+    let profile = crate::collaboration_profile_authority::signed_profile_document_for_test(
+        &SigningKey::from_bytes(&profile_key.to_bytes()),
+        display_name,
+        None,
+        1,
+        None,
+        now,
+        vec![device_did],
+    )
+    .unwrap();
+    let profile_did = profile.document().profile_did.clone();
+    let advertisement = signed_discovery_message_for_test(
+        &device_key,
+        &profile_did,
+        TestCollaborationMessageScope {
+            network_id: NETWORK,
+            conversation_id: crate::collaboration_discovery::COLLABORATION_DISCOVERY_DIRECTORY_ID,
+        },
+        elastos_common::collaboration_protocol::CollaborationRecipient {
+            kind: elastos_common::collaboration_protocol::CollaborationRecipientKind::Conversation,
+            id: crate::collaboration_discovery::COLLABORATION_DISCOVERY_DIRECTORY_ID.to_string(),
+        },
+        crate::collaboration_discovery::COLLABORATION_DISCOVERY_ADVERTISEMENT_PAYLOAD_TYPE,
+        serde_json::to_value(
+            crate::collaboration_discovery::CollaborationDiscoveryAdvertisementPayload {
+                signed_profile: profile.signed_envelope().clone(),
+            },
+        )
+        .unwrap(),
+        now..now + crate::collaboration_discovery::COLLABORATION_DISCOVERY_ADVERTISEMENT_TTL_SECS,
+    );
+    (profile_did, advertisement)
+}
+
+#[tokio::test]
+async fn test_chat_contact_request_refuses_callers_without_a_chat_session() {
+    let home = ContactRequestHome::new().await;
+    home.show(vec![home.remote_advertisement.clone()]);
+    let participant_ref = home_people_contact_id(&home.remote_profile_did);
+
+    let (status, body) = home.request(None, &participant_ref).await;
+    assert_eq!(status, StatusCode::FORBIDDEN, "{body}");
+
+    let expired = issue_expired_home_launch_token_with_context(
+        home.dir.path(),
+        CHAT_ROOM_CAPSULE_ID,
+        &home.chat_context,
+    )
+    .unwrap();
+    let (status, body) = home.request(Some(&expired), &participant_ref).await;
+    assert_eq!(status, StatusCode::FORBIDDEN, "{body}");
+
+    // A valid launch token for another app passes the front door, then Chat
+    // refuses it.
+    let (status, body) = home
+        .request(Some(&home.authority.people_token), &participant_ref)
+        .await;
+    assert_eq!(status, StatusCode::UNAUTHORIZED, "{body}");
+
+    assert_eq!(home.outgoing_requests(), 0);
+}
+
+#[tokio::test]
+async fn test_chat_contact_request_refuses_a_person_not_visible_in_discovery() {
+    let home = ContactRequestHome::new().await;
+    let participant_ref = home_people_contact_id(&home.remote_profile_did);
+
+    // Nobody is visible yet.
+    let (status, body) = home.request(Some(&home.chat_token), &participant_ref).await;
+    assert_eq!(status, StatusCode::CONFLICT, "{body}");
+    assert!(body.contains("turn on Discovery"), "{body}");
+
+    // Someone else is visible, not this person.
+    let (_, other_advertisement) = remote_advertisement("Other", home.now);
+    home.show(vec![other_advertisement]);
+    let (status, body) = home.request(Some(&home.chat_token), &participant_ref).await;
+    assert_eq!(status, StatusCode::CONFLICT, "{body}");
+
+    // The person is visible, but this Home turned Discovery off.
+    home.show(vec![home.remote_advertisement.clone()]);
+    home.store.set_discovery_enabled(false, home.now).unwrap();
+    let (status, body) = home.request(Some(&home.chat_token), &participant_ref).await;
+    assert_eq!(status, StatusCode::CONFLICT, "{body}");
+    assert!(!body.contains("did:key:"), "{body}");
+
+    assert_eq!(home.outgoing_requests(), 0);
+}
+
+#[tokio::test]
+async fn test_chat_contact_request_queues_one_request_for_a_visible_person() {
+    let home = ContactRequestHome::new().await;
+    home.show(vec![home.remote_advertisement.clone()]);
+    let participant_ref = home_people_contact_id(&home.remote_profile_did);
+
+    let (status, body) = home.request(Some(&home.chat_token), &participant_ref).await;
+    assert_eq!(status, StatusCode::OK, "{body}");
+    assert_eq!(
+        serde_json::from_str::<serde_json::Value>(&body).unwrap(),
+        serde_json::json!({ "status": "requested" })
+    );
+    assert!(!body.contains("did:key:"), "{body}");
+    assert_eq!(home.outgoing_requests(), 1);
+
+    // Asking again reuses the stored request.
+    let (status, body) = home.request(Some(&home.chat_token), &participant_ref).await;
+    assert_eq!(status, StatusCode::OK, "{body}");
+    assert_eq!(home.outgoing_requests(), 1);
+}
diff --git a/elastos/crates/elastos-server/src/api/gateway_tests/room/direct.rs b/elastos/crates/elastos-server/src/api/gateway_tests/room/direct.rs
index c30f69d9a..a96e4ad4f 100644
--- a/elastos/crates/elastos-server/src/api/gateway_tests/room/direct.rs
+++ b/elastos/crates/elastos-server/src/api/gateway_tests/room/direct.rs
@@ -229,6 +229,7 @@ async fn direct_api_auth_list_and_message_projection_are_bounded_and_redacted()
             "conversation_id": fixture.peer.conversation_id,
             "display_name": "Remote Person",
             "removed": false,
+            "unread": false,
         })
     );
     let list_text = list.to_string();
@@ -683,3 +684,101 @@ async fn direct_api_authority_configuration_and_corruption_fail_closed() {
     assert!(!error.contains(fixture.dir.path().to_string_lossy().as_ref()));
     assert!(!error.contains("did:key"));
 }
+
+#[tokio::test]
+async fn direct_api_unread_dot_and_inbox_entry_belong_to_one_account() {
+    let fixture = direct_api_route_fixture().await;
+    let data = fixture.dir.path();
+    let conversation = fixture.peer.conversation_id.clone();
+    let owner = fixture.profile.document().profile_did.clone();
+    // Another account on the same Home.
+    let other = "did:key:z6MkOtherAccountOnThisHome";
+    let inbox_token = issue_home_projection_launch_token_with_context(
+        data,
+        INBOX_CAPSULE_ID,
+        INBOX_CAPSULE_ID,
+        &fixture.chat_context,
+    )
+    .unwrap();
+    let unread = |app: Router| {
+        let token = fixture.chat_token.clone();
+        async move {
+            let list = app
+                .oneshot(direct_api_request(
+                    Some(&token),
+                    "GET",
+                    "/api/apps/chat-room/direct/conversations",
+                    Body::empty(),
+                ))
+                .await
+                .unwrap();
+            json_response(list).await["conversations"][0]["unread"].clone()
+        }
+    };
+    let inbox_direct_entries = |app: Router| {
+        let token = inbox_token.clone();
+        async move {
+            let summary = app
+                .oneshot(direct_api_request(
+                    Some(&token),
+                    "GET",
+                    "/api/apps/inbox/summary",
+                    Body::empty(),
+                ))
+                .await
+                .unwrap();
+            assert_eq!(summary.status(), StatusCode::OK);
+            json_response(summary).await["notifications"]["entries"]
+                .as_array()
+                .unwrap()
+                .iter()
+                .filter(|entry| entry["kind"] == "direct_message")
+                .count()
+        }
+    };
+
+    // Another account's message alert never shows for this account.
+    crate::notifications::upsert_direct_message_notification(
+        data,
+        other,
+        &conversation,
+        "Remote Person",
+        crate::auth::now_ts(),
+    )
+    .unwrap();
+    assert_eq!(unread(fixture.app.clone()).await, json!(false));
+    assert_eq!(inbox_direct_entries(fixture.app.clone()).await, 0);
+
+    // Its own alert shows as a dot and an Inbox entry.
+    crate::notifications::upsert_direct_message_notification(
+        data,
+        &owner,
+        &conversation,
+        "Remote Person",
+        crate::auth::now_ts(),
+    )
+    .unwrap();
+    assert_eq!(unread(fixture.app.clone()).await, json!(true));
+    assert_eq!(inbox_direct_entries(fixture.app.clone()).await, 1);
+
+    // Opening the conversation clears only this account's alert.
+    let opened = fixture
+        .app
+        .clone()
+        .oneshot(direct_api_request(
+            Some(&fixture.chat_token),
+            "GET",
+            &format!("/api/apps/chat-room/direct/conversations/{conversation}/messages"),
+            Body::empty(),
+        ))
+        .await
+        .unwrap();
+    assert_eq!(opened.status(), StatusCode::OK);
+    assert_eq!(unread(fixture.app.clone()).await, json!(false));
+    assert_eq!(inbox_direct_entries(fixture.app.clone()).await, 0);
+    assert!(
+        crate::notifications::unread_direct_message_conversations(data, other)
+            .unwrap()
+            .contains(&conversation)
+    );
+}
diff --git a/elastos/crates/elastos-server/src/carrier.rs b/elastos/crates/elastos-server/src/carrier.rs
index dd7d34147..1fb1e1777 100644
--- a/elastos/crates/elastos-server/src/carrier.rs
+++ b/elastos/crates/elastos-server/src/carrier.rs
@@ -8285,6 +8285,16 @@ impl CarrierClient {
     }
 
     pub async fn fetch_content(&self, cid: &str, path: Option<&str>) -> Result<Vec<u8>> {
+        self.fetch_content_bounded(cid, path, MAX_DOWNLOAD_BYTES)
+            .await
+    }
+
+    pub(crate) async fn fetch_content_bounded(
+        &self,
+        cid: &str,
+        path: Option<&str>,
+        max_bytes: usize,
+    ) -> Result<Vec<u8>> {
         let mut msg = serde_json::json!({
             "op": "content_fetch",
             "cid": cid,
@@ -8292,8 +8302,7 @@ impl CarrierClient {
         if let Some(path) = path.filter(|path| !path.is_empty()) {
             msg["path"] = serde_json::Value::String(path.to_string());
         }
-        self.fetch_bytes(msg, "content fetch", cid, MAX_DOWNLOAD_BYTES)
-            .await
+        self.fetch_bytes(msg, "content fetch", cid, max_bytes).await
     }
 
     /// Sends `msg` and reads its length-prefixed reply. Every phase is
diff --git a/elastos/crates/elastos-server/src/chat_cmd.rs b/elastos/crates/elastos-server/src/chat_cmd.rs
index f52afcb56..c87ad3dbb 100644
--- a/elastos/crates/elastos-server/src/chat_cmd.rs
+++ b/elastos/crates/elastos-server/src/chat_cmd.rs
@@ -100,9 +100,9 @@ impl ChatTerminalUi {
         });
     }
 
-    fn push_char(&self, byte: u8) {
+    fn push_char(&self, ch: char) {
         let _ = self.with_output(|output, current| {
-            current.push(byte as char);
+            current.push(ch);
             redraw_chat_input(output, current);
         });
     }
@@ -1183,6 +1183,7 @@ fn native_chat_tty_loop_from_io(
     input: &mut dyn Read,
     ui: &ChatTerminalUi,
 ) -> bool {
+    let mut utf8 = Vec::with_capacity(4);
     loop {
         let mut byte = [0u8; 1];
         let read = match input.read(&mut byte) {
@@ -1192,6 +1193,13 @@ fn native_chat_tty_loop_from_io(
         if read == 0 {
             return false;
         }
+        if byte[0] >= 0x80 {
+            if let Some(ch) = push_utf8_byte(&mut utf8, byte[0]) {
+                ui.push_char(ch);
+            }
+            continue;
+        }
+        utf8.clear();
 
         match byte[0] {
             b'\x1b' => {
@@ -1230,13 +1238,36 @@ fn native_chat_tty_loop_from_io(
                 ui.backspace();
             }
             b if !b.is_ascii_control() => {
-                ui.push_char(b);
+                ui.push_char(char::from(b));
             }
             _ => {}
         }
     }
 }
 
+/// Collects the bytes of one typed UTF-8 character and returns it once
+/// complete, so "é" (C3 A9) is one character rather than two Latin-1 ones. An
+/// invalid sequence is dropped; the byte that broke it may start the next
+/// character, so it is kept when it is a lead byte.
+fn push_utf8_byte(pending: &mut Vec<u8>, byte: u8) -> Option<char> {
+    pending.push(byte);
+    match std::str::from_utf8(pending) {
+        Ok(text) => {
+            let ch = text.chars().next();
+            pending.clear();
+            ch
+        }
+        Err(error) if error.error_len().is_none() && pending.len() < 4 => None,
+        Err(_) => {
+            pending.clear();
+            if byte >= 0xC0 {
+                pending.push(byte);
+            }
+            None
+        }
+    }
+}
+
 #[cfg(unix)]
 fn native_chat_controlling_tty_loop(ctx: &NativeChatCtx<'_>, ui: &ChatTerminalUi) -> Option<bool> {
     use std::fs::OpenOptions;
@@ -1445,11 +1476,14 @@ async fn sign_via_did_provider(
         }))
         .send()
         .await
+        .ok()?
+        .error_for_status()
         .ok()?;
     let body: serde_json::Value = resp.json().await.ok()?;
     body.get("data")
         .and_then(|d| d.get("signature"))
         .and_then(|s| s.as_str())
+        .filter(|s| !s.is_empty())
         .map(|s| s.to_string())
 }
 
@@ -1508,23 +1542,16 @@ fn send_chat_message(
             .duration_since(std::time::UNIX_EPOCH)
             .unwrap_or_default()
             .as_secs();
-        let signature =
-            sign_via_did_provider(client, api, token, did_cap, self_did, ts, message).await;
-        let mut payload = serde_json::json!({
-            "topic": CHAT_TOPIC,
-            "message": message,
-            "sender": nick,
-            "ts": ts,
-        });
-        if !self_did.is_empty() {
-            payload["sender_id"] = serde_json::Value::String(self_did.to_string());
-        }
-        if !self_session_id.is_empty() {
-            payload["sender_session_id"] = serde_json::Value::String(self_session_id.to_string());
-        }
-        if let Some(sig) = signature {
-            payload["signature"] = serde_json::Value::String(sig);
-        }
+        let signature = if self_did.is_empty() {
+            None
+        } else {
+            sign_via_did_provider(client, api, token, did_cap, self_did, ts, message).await
+        };
+        let payload =
+            match chat_send_payload(nick, message, ts, self_did, self_session_id, signature) {
+                Ok(payload) => payload,
+                Err(refusal) => return ChatSendOutcome::Error(refusal.to_string()),
+            };
         match client
             .post(format!("{}/api/provider/peer/gossip_send", api))
             .header("Authorization", format!("Bearer {}", token))
@@ -1556,6 +1583,34 @@ fn send_chat_message(
     })
 }
 
+/// The gossip payload for one chat line. Receivers drop a line that is not
+/// signed by its sender, so an unsigned line is refused here instead of being
+/// broadcast and shown as sent.
+fn chat_send_payload(
+    nick: &str,
+    message: &str,
+    ts: u64,
+    self_did: &str,
+    self_session_id: &str,
+    signature: Option<String>,
+) -> Result<serde_json::Value, &'static str> {
+    let signature = signature
+        .filter(|signature| !self_did.is_empty() && !signature.is_empty())
+        .ok_or("message not sent: it could not be signed with this Home's identity")?;
+    let mut payload = serde_json::json!({
+        "topic": CHAT_TOPIC,
+        "message": message,
+        "sender": nick,
+        "ts": ts,
+        "sender_id": self_did,
+        "signature": signature,
+    });
+    if !self_session_id.is_empty() {
+        payload["sender_session_id"] = serde_json::Value::String(self_session_id.to_string());
+    }
+    Ok(payload)
+}
+
 fn report_chat_send_outcome(
     outcome: ChatSendOutcome,
     nick: &str,
@@ -2092,6 +2147,57 @@ mod tests {
         ));
     }
 
+    #[test]
+    fn an_unsigned_chat_line_is_refused_before_broadcast() {
+        assert!(chat_send_payload("nick", "hi", 1, "did:key:me", "", None).is_err());
+        assert!(chat_send_payload("nick", "hi", 1, "did:key:me", "", Some(String::new())).is_err());
+        assert!(chat_send_payload("nick", "hi", 1, "", "", Some("sig".into())).is_err());
+        let payload = chat_send_payload(
+            "nick",
+            "hi",
+            1,
+            "did:key:me",
+            "session-1",
+            Some("sig".into()),
+        )
+        .unwrap();
+        assert_eq!(payload["signature"], "sig");
+        assert_eq!(payload["sender_id"], "did:key:me");
+        assert_eq!(payload["sender_session_id"], "session-1");
+    }
+
+    #[test]
+    fn tty_typing_keeps_utf8_characters() {
+        let client = reqwest::Client::new();
+        let mut input = Cursor::new("café ✓".as_bytes().to_vec());
+        let output = Arc::new(Mutex::new(Vec::new()));
+        let ui = ChatTerminalUi::buffer(Arc::clone(&output));
+        let ctx = NativeChatCtx {
+            client: &client,
+            api: "http://127.0.0.1",
+            token: "token",
+            peer_cap: "cap",
+            did_cap: "cap",
+            self_did: "",
+            self_session_id: "",
+            nick: "nick",
+        };
+
+        native_chat_tty_loop_from_io(&ctx, &mut input, &ui);
+
+        assert_eq!(ui.current.lock().unwrap().as_str(), "café ✓");
+        let mut pending = Vec::new();
+        // A broken "é" followed by a whole "✓" (E2 9C 93) keeps the check mark.
+        assert_eq!(push_utf8_byte(&mut pending, 0xC3), None);
+        assert_eq!(push_utf8_byte(&mut pending, 0xE2), None);
+        assert_eq!(push_utf8_byte(&mut pending, 0x9C), None);
+        assert_eq!(push_utf8_byte(&mut pending, 0x93), Some('✓'));
+        assert!(pending.is_empty());
+        // A stray continuation byte is dropped.
+        assert_eq!(push_utf8_byte(&mut pending, 0x93), None);
+        assert!(pending.is_empty());
+    }
+
     #[test]
     fn tty_loop_quit_returns_false() {
         let client = reqwest::Client::new();
@@ -2259,8 +2365,8 @@ mod tests {
         let output = Arc::new(Mutex::new(Vec::new()));
         let ui = ChatTerminalUi::buffer(Arc::clone(&output));
 
-        ui.push_char(b'h');
-        ui.push_char(b'i');
+        ui.push_char('h');
+        ui.push_char('i');
         ui.print_event("<peer> hello");
 
         let rendered = String::from_utf8(output.lock().unwrap().clone()).unwrap();
diff --git a/elastos/crates/elastos-server/src/collaboration_config.rs b/elastos/crates/elastos-server/src/collaboration_config.rs
index a300fd392..d0c532c7d 100644
--- a/elastos/crates/elastos-server/src/collaboration_config.rs
+++ b/elastos/crates/elastos-server/src/collaboration_config.rs
@@ -54,6 +54,19 @@ pub enum CollaborationConfigCommand {
         #[arg(long)]
         output: PathBuf,
     },
+    /// Generate the next signed revision of an existing startup configuration
+    /// with a new bootstrap peer, for example after the bootstrap Runtime's
+    /// address changed. Network, signer set and grant stay the same.
+    GenerateRevision {
+        #[arg(long)]
+        authority_key: PathBuf,
+        #[arg(long)]
+        input: PathBuf,
+        #[arg(long)]
+        bootstrap_peer: PathBuf,
+        #[arg(long)]
+        output: PathBuf,
+    },
     /// Purely verify one candidate startup configuration.
     Verify {
         #[arg(long)]
@@ -130,16 +143,7 @@ async fn run_collaboration_config_command_with_writer(
             output: output_path,
         } => {
             let signing_key = read_authority_key(&authority_key)?;
-            let peer_bytes = read_owner_only_file(
-                &bootstrap_peer,
-                MAX_BOOTSTRAP_RECEIPT_BYTES,
-                "collaboration bootstrap receipt",
-            )?;
-            let peer: CollaborationBootstrapPeer = serde_json::from_slice(&peer_bytes)
-                .context("invalid collaboration bootstrap receipt")?;
-            if serde_json::to_vec(&serde_json::to_value(&peer)?)? != peer_bytes {
-                anyhow::bail!("collaboration bootstrap receipt is not canonical JSON");
-            }
+            let peer = read_bootstrap_peer(&bootstrap_peer)?;
             let config_bytes =
                 initial_config_bytes(&signing_key, &network_id, &conversation_id, peer)?;
             let receipt = verified_receipt(&config_bytes)?;
@@ -150,6 +154,25 @@ async fn run_collaboration_config_command_with_writer(
             )?;
             write_receipt(output, &receipt)
         }
+        CollaborationConfigCommand::GenerateRevision {
+            authority_key,
+            input,
+            bootstrap_peer,
+            output: output_path,
+        } => {
+            let signing_key = read_authority_key(&authority_key)?;
+            validate_owner_only_parent(&input)?;
+            let current = read_collaboration_startup_config_candidate(&input)?;
+            let peer = read_bootstrap_peer(&bootstrap_peer)?;
+            let config_bytes = next_revision_config_bytes(&signing_key, &current, peer)?;
+            let receipt = verified_receipt(&config_bytes)?;
+            create_owner_only_file(
+                &output_path,
+                &config_bytes,
+                "collaboration startup configuration",
+            )?;
+            write_receipt(output, &receipt)
+        }
         CollaborationConfigCommand::Verify { input } => {
             validate_owner_only_parent(&input)?;
             let bytes = read_collaboration_startup_config_candidate(&input)?;
@@ -195,6 +218,88 @@ fn write_local_bootstrap_receipt(
     )
 }
 
+fn read_bootstrap_peer(path: &Path) -> anyhow::Result<CollaborationBootstrapPeer> {
+    let peer_bytes = read_owner_only_file(
+        path,
+        MAX_BOOTSTRAP_RECEIPT_BYTES,
+        "collaboration bootstrap receipt",
+    )?;
+    let peer: CollaborationBootstrapPeer =
+        serde_json::from_slice(&peer_bytes).context("invalid collaboration bootstrap receipt")?;
+    if serde_json::to_vec(&serde_json::to_value(&peer)?)? != peer_bytes {
+        anyhow::bail!("collaboration bootstrap receipt is not canonical JSON");
+    }
+    Ok(peer)
+}
+
+fn sign_network_profile(
+    signing_key: &SigningKey,
+    profile: CollaborationNetworkProfile,
+) -> anyhow::Result<Vec<u8>> {
+    let payload_bytes = canonical_collaboration_network_profile_payload_bytes(&profile)?;
+    let (signature, envelope_signer) = crate::crypto::domain_separated_sign(
+        signing_key,
+        COLLABORATION_NETWORK_PROFILE_SIGNATURE_DOMAIN,
+        &payload_bytes,
+    );
+    Ok(serde_json::to_vec(&serde_json::to_value(
+        SignedCollaborationNetworkProfile {
+            payload: profile,
+            signature,
+            signer_did: envelope_signer,
+        },
+    )?)?)
+}
+
+/// Appends revision N+1 to a validated configuration's signed chain. It keeps
+/// the network ID, trusted signer set and default-conversation grant, and
+/// replaces the bootstrap peers.
+fn next_revision_config_bytes(
+    signing_key: &SigningKey,
+    current_bytes: &[u8],
+    bootstrap_peer: CollaborationBootstrapPeer,
+) -> anyhow::Result<Vec<u8>> {
+    let validated = parse_and_validate_collaboration_startup_configuration(current_bytes)
+        .context("current collaboration configuration is invalid")?;
+    let head = validated
+        .network()
+        .head()
+        .context("current collaboration profile chain is empty")?
+        .profile()
+        .clone();
+    let mut config: CollaborationStartupConfigFile = serde_json::from_slice(current_bytes)?;
+    let signer_did = crate::crypto::encode_signing_key_did(signing_key);
+    if !config.trusted_profile_signer_dids.contains(&signer_did) {
+        anyhow::bail!("authority key is not a trusted signer of this collaboration network");
+    }
+    let last_envelope = base64::engine::general_purpose::STANDARD.decode(
+        config
+            .profile_chain_base64
+            .last()
+            .context("current collaboration profile chain is empty")?,
+    )?;
+    let profile = CollaborationNetworkProfile {
+        schema: COLLABORATION_NETWORK_PROFILE_SCHEMA.to_string(),
+        network_id: head.network_id.clone(),
+        revision: head
+            .revision
+            .checked_add(1)
+            .context("collaboration profile revision overflow")?,
+        previous_profile_sha256: Some(sha256_label(&last_envelope)),
+        signer_did,
+        bootstrap_peers: vec![bootstrap_peer],
+        default_conversation: head.default_conversation.clone(),
+    };
+    let profile_bytes = sign_network_profile(signing_key, profile)?;
+    config
+        .profile_chain_base64
+        .push(base64::engine::general_purpose::STANDARD.encode(profile_bytes));
+    let bytes = canonical_startup_config_bytes(&config)?;
+    parse_and_validate_collaboration_startup_configuration(&bytes)
+        .context("next collaboration configuration revision is invalid")?;
+    Ok(bytes)
+}
+
 fn initial_config_bytes(
     signing_key: &SigningKey,
     network_id: &str,
@@ -219,18 +324,7 @@ fn initial_config_bytes(
         bootstrap_peers: vec![bootstrap_peer],
         default_conversation: Some(DefaultConversationGrantDescriptor { grant_cid }),
     };
-    let payload_bytes = canonical_collaboration_network_profile_payload_bytes(&profile)?;
-    let (signature, envelope_signer) = crate::crypto::domain_separated_sign(
-        signing_key,
-        COLLABORATION_NETWORK_PROFILE_SIGNATURE_DOMAIN,
-        &payload_bytes,
-    );
-    let profile_bytes =
-        serde_json::to_vec(&serde_json::to_value(SignedCollaborationNetworkProfile {
-            payload: profile,
-            signature,
-            signer_did: envelope_signer,
-        })?)?;
+    let profile_bytes = sign_network_profile(signing_key, profile)?;
     let config = CollaborationStartupConfigFile {
         schema: COLLABORATION_STARTUP_CONFIG_SCHEMA.to_string(),
         expected_network_id: network_id.to_string(),
@@ -511,6 +605,47 @@ mod tests {
         (key, peer, bytes)
     }
 
+    #[test]
+    fn next_revision_extends_the_signed_chain_with_a_new_bootstrap_peer() {
+        let (key, _, initial) = valid_config();
+        let moved_peer = bootstrap_peer(11);
+        let next = next_revision_config_bytes(&key, &initial, moved_peer.clone()).unwrap();
+
+        let validated = parse_and_validate_collaboration_startup_configuration(&next).unwrap();
+        let head = validated.network().head().unwrap().profile();
+        assert_eq!(head.revision, 2);
+        assert_eq!(head.bootstrap_peers, vec![moved_peer.clone()]);
+        let before: CollaborationStartupConfigFile = serde_json::from_slice(&initial).unwrap();
+        let after: CollaborationStartupConfigFile = serde_json::from_slice(&next).unwrap();
+        assert_eq!(after.profile_chain_base64.len(), 2);
+        assert_eq!(
+            after.profile_chain_base64[0],
+            before.profile_chain_base64[0]
+        );
+        assert_eq!(after.expected_network_id, before.expected_network_id);
+        assert_eq!(
+            after.trusted_profile_signer_dids,
+            before.trusted_profile_signer_dids
+        );
+        assert_eq!(
+            after.default_conversation_grant_base64,
+            before.default_conversation_grant_base64
+        );
+        let third = next_revision_config_bytes(&key, &next, bootstrap_peer(10)).unwrap();
+        let validated = parse_and_validate_collaboration_startup_configuration(&third).unwrap();
+        assert_eq!(validated.network().head().unwrap().profile().revision, 3);
+    }
+
+    #[test]
+    fn next_revision_refuses_a_key_outside_the_trusted_signer_set() {
+        let (_, _, initial) = valid_config();
+        let (other, _) = elastos_runtime::signature::generate_keypair();
+        let error = next_revision_config_bytes(&other, &initial, bootstrap_peer(9))
+            .unwrap_err()
+            .to_string();
+        assert!(error.contains("not a trusted signer"), "{error}");
+    }
+
     #[tokio::test]
     async fn deterministic_golden_generation_and_pure_round_trip() {
         let (key, peer, expected) = valid_config();
diff --git a/elastos/crates/elastos-server/src/collaboration_contact_store.rs b/elastos/crates/elastos-server/src/collaboration_contact_store.rs
index 15082e88b..d4a4f59e1 100644
--- a/elastos/crates/elastos-server/src/collaboration_contact_store.rs
+++ b/elastos/crates/elastos-server/src/collaboration_contact_store.rs
@@ -213,6 +213,10 @@ impl PendingIncomingContactRequest {
         &self.request_hash
     }
 
+    pub(crate) fn requester_profile_did(&self) -> &str {
+        &self.requester_profile_did
+    }
+
     pub(crate) fn display_name(&self) -> &str {
         &self.display_name
     }
@@ -811,9 +815,15 @@ impl CollaborationContactStore {
                         .revoked_request_hashes
                         .contains(request.message().envelope_sha256())
                     && !loaded.decisions.contains_key(request.message().envelope_sha256())
+                    // The relay admits a request only while its bound
+                    // advertisement is live; after that the recipient's own
+                    // copy carries it, so resending would only be refused.
                     && loaded
                         .advertisements
-                        .contains_key(request.advertisement_envelope_sha256())
+                        .get(request.advertisement_envelope_sha256())
+                        .is_some_and(|advertisement| {
+                            advertisement.message().envelope().payload.expires_at > now
+                        })
             })
             .collect::<Vec<_>>();
         resendable.sort_by(|left, right| {
@@ -4169,6 +4179,62 @@ mod tests {
         );
     }
 
+    #[test]
+    fn outgoing_request_stops_resending_once_its_advertisement_expires() {
+        let fixture = Fixture::new();
+        fixture
+            .store
+            .store_local_advertisement(
+                &advertisement_with_profile(&fixture.local_key, &fixture.local_profile, NOW),
+                NOW,
+            )
+            .unwrap();
+        let (remote_key, _) = generate_keypair();
+        let remote_ad = advertisement(&remote_key, "Remote", NOW);
+        let advertisement_hash = collaboration_message_envelope_sha256(&remote_ad);
+        let remote_profile_did = advertisement_profile_did(&remote_ad);
+        let request = outgoing_request_with_profile(
+            &fixture.local_key,
+            &fixture.local_profile,
+            &remote_profile_did,
+            &advertisement_hash,
+            NOW + 1,
+        );
+        fixture
+            .store
+            .record_outgoing_contact_request(&request, &remote_ad, NOW + 1)
+            .unwrap();
+        let advertisement_expires_at = NOW + COLLABORATION_DISCOVERY_ADVERTISEMENT_TTL_SECS;
+        // The request itself outlives the advertisement it is bound to.
+        assert!(
+            advertisement_expires_at < NOW + 1 + COLLABORATION_DISCOVERY_CONTACT_REQUEST_TTL_SECS
+        );
+
+        assert_eq!(
+            fixture
+                .store
+                .resendable_outgoing_contact_requests(advertisement_expires_at - 1, 4)
+                .unwrap()
+                .len(),
+            1
+        );
+        assert!(fixture
+            .store
+            .resendable_outgoing_contact_requests(advertisement_expires_at, 4)
+            .unwrap()
+            .is_empty());
+        // The stored request stays: it is the evidence behind "Requested".
+        assert!(fixture
+            .store
+            .stored_outgoing_contact_request(
+                &advertisement_hash,
+                &remote_profile_did,
+                advertisement_expires_at
+            )
+            .unwrap()
+            .is_some());
+    }
+
     #[test]
     fn accepted_and_declined_decisions_stop_request_resend_and_only_accept_creates_contact() {
         let fixture = Fixture::new();
diff --git a/elastos/crates/elastos-server/src/collaboration_direct_messages.rs b/elastos/crates/elastos-server/src/collaboration_direct_messages.rs
index 7fb42a3b4..c7df9f2bf 100644
--- a/elastos/crates/elastos-server/src/collaboration_direct_messages.rs
+++ b/elastos/crates/elastos-server/src/collaboration_direct_messages.rs
@@ -200,6 +200,8 @@ pub(crate) struct DirectConversationSummary {
     /// True once the relationship ended. The conversation stays listed —
     /// history is readable per the declared policy — but composing stops.
     pub(crate) removed: bool,
+    /// A message arrived that this person has not opened yet.
+    pub(crate) unread: bool,
 }
 
 #[derive(Debug, Clone, Serialize, PartialEq, Eq)]
@@ -1123,6 +1125,7 @@ impl CollaborationDirectMessageService {
                 conversation_id: contact.conversation_id().to_string(),
                 display_name: contact.remote_display_name().to_string(),
                 removed: false,
+                unread: false,
             })
             .collect::<Vec<_>>();
         match DECLARED_DIRECT_HISTORY_POLICY {
@@ -1132,6 +1135,7 @@ impl CollaborationDirectMessageService {
                         conversation_id: removed.conversation_id().to_string(),
                         display_name: removed.display_name().to_string(),
                         removed: true,
+                        unread: false,
                     }
                 }));
             }
@@ -1597,6 +1601,7 @@ impl CollaborationDirectMessageService {
         // presentation this receive just verified against.
         let _ = crate::notifications::upsert_direct_message_notification(
             context.contact_store.data_root(),
+            context.contact_store.local_profile_did(),
             contact.conversation_id(),
             contact.remote_display_name(),
             now,
diff --git a/elastos/crates/elastos-server/src/collaboration_direct_messages/tests.rs b/elastos/crates/elastos-server/src/collaboration_direct_messages/tests.rs
index 3a3d8d162..9d7e0f223 100644
--- a/elastos/crates/elastos-server/src/collaboration_direct_messages/tests.rs
+++ b/elastos/crates/elastos-server/src/collaboration_direct_messages/tests.rs
@@ -704,8 +704,23 @@ async fn incoming_direct_message_notifies_until_the_conversation_is_read() {
 
     // A verified incoming message tells the person, named by the signed
     // contact presentation, pointing at Chat — never carrying the message
-    // decision surface itself.
-    let summary = crate::notifications::load_summary(&b_root).unwrap();
+    // decision surface itself. Only the receiving account sees it.
+    let b_profile = pair.store_b.local_profile_did().to_string();
+    let b_summary = || {
+        let mut summary = crate::notifications::load_summary(&b_root).unwrap();
+        crate::notifications::project_direct_message_notifications(
+            &mut summary,
+            &b_root,
+            &b_profile,
+        )
+        .unwrap();
+        summary
+    };
+    assert!(crate::notifications::load_summary(&b_root)
+        .unwrap()
+        .entries
+        .is_empty());
+    let summary = b_summary();
     assert_eq!(summary.entries.len(), 1);
     assert_eq!(summary.entries[0].kind, "direct_message");
     assert_eq!(summary.entries[0].title, "New message from Alice");
@@ -724,20 +739,14 @@ async fn incoming_direct_message_notifies_until_the_conversation_is_read() {
     // replay of the same envelope returns the stored receipt without
     // resurfacing it.
     assert_eq!(
-        crate::notifications::mark_acted_for_action(&b_root, &action_id).unwrap(),
+        crate::notifications::mark_acted_for_action(&b_root, Some(&b_profile), &action_id).unwrap(),
         1
     );
-    assert!(crate::notifications::load_summary(&b_root)
-        .unwrap()
-        .entries
-        .is_empty());
+    assert!(b_summary().entries.is_empty());
     direct_b
         .receive(&message, &fixture_source_endpoint(&message), now + 1)
         .unwrap();
-    assert!(crate::notifications::load_summary(&b_root)
-        .unwrap()
-        .entries
-        .is_empty());
+    assert!(b_summary().entries.is_empty());
 
     // A genuinely new message resurfaces it.
     let second = test_message(
@@ -751,7 +760,7 @@ async fn incoming_direct_message_notifies_until_the_conversation_is_read() {
     direct_b
         .receive(&second, &fixture_source_endpoint(&second), now + 2)
         .unwrap();
-    let resurfaced = crate::notifications::load_summary(&b_root).unwrap();
+    let resurfaced = b_summary();
     assert_eq!(resurfaced.entries.len(), 1);
     assert!(!resurfaced.entries[0].read);
 }
diff --git a/elastos/crates/elastos-server/src/collaboration_discovery_runtime.rs b/elastos/crates/elastos-server/src/collaboration_discovery_runtime.rs
index ca5e673b0..a548974dd 100644
--- a/elastos/crates/elastos-server/src/collaboration_discovery_runtime.rs
+++ b/elastos/crates/elastos-server/src/collaboration_discovery_runtime.rs
@@ -77,6 +77,9 @@ const DECLARED_CONTACT_REVOCATION_END_OF_LIFE: crate::collaboration_delivery::De
     crate::collaboration_delivery::DeliveryEndOfLife::RemintExact;
 const DISCOVERY_SYNC_BASE_BACKOFF_SECS: u64 = 5;
 const DISCOVERY_SYNC_MAX_BACKOFF_SECS: u64 = 60;
+/// While a person has Discovery on and is waiting to see people, a failed
+/// relay pass retries within this bound instead of the idle backoff ceiling.
+const DISCOVERY_SYNC_ENABLED_MAX_BACKOFF_SECS: u64 = 15;
 const MAX_DISCOVERY_OUTBOX_SENDS_PER_SYNC: usize = 4;
 
 #[derive(Clone)]
@@ -95,6 +98,7 @@ pub struct CollaborationDiscoveryService {
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub(crate) struct CollaborationDiscoveryStatus {
     available: bool,
+    connecting: bool,
     enabled: bool,
     expires_at: Option<u64>,
     remote_visibility_may_remain_until: Option<u64>,
@@ -105,6 +109,8 @@ pub(crate) struct CollaborationDiscoveryStatus {
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub(crate) struct DiscoveryVisiblePerson {
     advertisement_id: String,
+    /// Kept inside Runtime to match a visible person to a Chat participant.
+    profile_did: String,
     display_name: String,
     handle: Option<String>,
     last_seen_at: u64,
@@ -199,6 +205,8 @@ struct DiscoveryClientState {
     observed_profile_heads: BTreeMap<String, ObservedProfileHead>,
     remote_visibility_may_remain_until: Option<u64>,
     transport_available: bool,
+    /// Discovery was just turned on and no relay pass has finished since.
+    connecting: bool,
 }
 
 #[derive(Clone, PartialEq, Eq, PartialOrd, Ord)]
@@ -233,6 +241,7 @@ impl Default for DiscoveryClientState {
             observed_profile_heads: BTreeMap::new(),
             remote_visibility_may_remain_until: None,
             transport_available: true,
+            connecting: false,
         }
     }
 }
@@ -578,11 +587,36 @@ impl CollaborationDiscoveryService {
         anyhow::bail!("discovery sync context is not registered");
     }
 
+    /// A person turned Discovery on or asked for a refresh. The next worker
+    /// pass retries Discovery at once, even after earlier failures; the worker
+    /// cadence still bounds how often the relay is reached.
+    pub(crate) fn wake_registered_discovery_now(
+        &self,
+        store: &CollaborationContactStore,
+        profile: &VerifiedCollaborationProfileDocument,
+        now: u64,
+    ) -> anyhow::Result<()> {
+        if self.wake_registered_sync_inner(store, profile, now, true)? {
+            return Ok(());
+        }
+        anyhow::bail!("discovery sync context is not registered");
+    }
+
     pub(crate) fn wake_registered_sync_if_present(
         &self,
         store: &CollaborationContactStore,
         profile: &VerifiedCollaborationProfileDocument,
         now: u64,
+    ) -> anyhow::Result<bool> {
+        self.wake_registered_sync_inner(store, profile, now, false)
+    }
+
+    fn wake_registered_sync_inner(
+        &self,
+        store: &CollaborationContactStore,
+        profile: &VerifiedCollaborationProfileDocument,
+        now: u64,
+        person_requested_discovery: bool,
     ) -> anyhow::Result<bool> {
         self.require_profile_store_match(store, profile)?;
         let key = DiscoverySyncContextKey {
@@ -597,6 +631,9 @@ impl CollaborationDiscoveryService {
         let Some(context) = contexts.get_mut(&key) else {
             return Ok(false);
         };
+        if person_requested_discovery {
+            context.discovery_failures = 0;
+        }
         if context.discovery_failures == 0 {
             context.discovery_next_wake_at = now;
         }
@@ -710,11 +747,20 @@ impl CollaborationDiscoveryService {
                 }
             };
             let discovery_result = if context.discovery_next_wake_at <= now {
-                Some(
-                    self.refresh(context.store.as_ref(), &context.profile, now)
-                        .await
-                        .is_ok(),
-                )
+                match self
+                    .refresh(context.store.as_ref(), &context.profile, now)
+                    .await
+                {
+                    Ok(_) => Some(true),
+                    Err(err) => {
+                        tracing::debug!(
+                            failures = context.discovery_failures,
+                            error = %format!("{err:#}"),
+                            "discovery relay pass failed"
+                        );
+                        Some(false)
+                    }
+                }
             } else {
                 None
             };
@@ -761,7 +807,8 @@ impl CollaborationDiscoveryService {
                 continue;
             }
             if let Some(success) = discovery_result {
-                let cadence = match current.store.discovery_enabled() {
+                let enabled = current.store.discovery_enabled();
+                let cadence = match enabled {
                     Ok(true) => DISCOVERY_SYNC_ENABLED_CADENCE_SECS,
                     Ok(false) => DISCOVERY_SYNC_IDLE_CADENCE_SECS,
                     Err(_) => DISCOVERY_SYNC_MAX_BACKOFF_SECS,
@@ -773,6 +820,11 @@ impl CollaborationDiscoveryService {
                     cadence,
                     now,
                 );
+                if !success && matches!(enabled, Ok(true)) {
+                    current.discovery_next_wake_at = current
+                        .discovery_next_wake_at
+                        .min(now.saturating_add(DISCOVERY_SYNC_ENABLED_MAX_BACKOFF_SECS));
+                }
             }
             if let Some(success) = direct_result {
                 update_sync_schedule(
@@ -835,6 +887,45 @@ impl CollaborationDiscoveryService {
         project_discovery_status(&state, enabled, store)
     }
 
+    /// Leaves this principal's Discovery as a finished relay pass would: on,
+    /// with a published current advertisement and the given verified
+    /// advertisements visible. Gateway tests have no relay to reach.
+    #[cfg(test)]
+    pub(crate) fn seed_visible_discovery_for_test(
+        &self,
+        store: &CollaborationContactStore,
+        profile: &VerifiedCollaborationProfileDocument,
+        visible: Vec<Vec<u8>>,
+        now: u64,
+    ) -> anyhow::Result<()> {
+        let profile_did = self.require_profile_store_match(store, profile)?;
+        store.set_discovery_enabled(true, now)?;
+        if store.published_local_advertisement(now)?.is_none() {
+            let current = self.authority.prepare_advertisement(profile, now)?;
+            store.store_local_advertisement(&current, now)?;
+        }
+        let mut states = self
+            .state
+            .lock()
+            .map_err(|_| anyhow::anyhow!("discovery client state lock is poisoned"))?;
+        let state = client_state_mut(&mut states, profile_did)?;
+        for envelope_bytes in visible {
+            let verified = verify_collaboration_discovery_advertisement(
+                &envelope_bytes,
+                &self.authority.profile,
+                now,
+            )?;
+            state.visible_advertisements.insert(
+                verified.profile_did().to_string(),
+                CachedAdvertisement {
+                    envelope_bytes,
+                    verified,
+                },
+            );
+        }
+        Ok(())
+    }
+
     #[cfg(test)]
     pub(crate) fn client_state_snapshot_for_test(&self) -> serde_json::Value {
         let Ok(states) = self.state.lock() else {
@@ -881,6 +972,7 @@ impl CollaborationDiscoveryService {
             state.current_advertisement = None;
             state.remote_visibility_may_remain_until = None;
             state.transport_available = false;
+            state.connecting = true;
         } else {
             store.set_discovery_enabled(false, now)?;
             let current = {
@@ -904,6 +996,7 @@ impl CollaborationDiscoveryService {
             let state = client_state_mut(&mut states, profile_did)?;
             state.remote_visibility_may_remain_until = remote_visibility_may_remain_until;
             state.transport_available = false;
+            state.connecting = false;
         }
         self.status_from_state(store, now)
     }
@@ -938,9 +1031,13 @@ impl CollaborationDiscoveryService {
         } else {
             Ok(())
         };
+        // The outbox retries on every pass; a refused item is not a relay
+        // outage, so it neither blocks the query nor reads as unavailable.
         if let Err(err) = outbox_result {
-            self.set_transport_available(profile_did, false)?;
-            return Err(err.context("discovery relay outbox delivery failed"));
+            tracing::debug!(
+                error = %format!("{err:#}"),
+                "discovery relay outbox delivery failed; retrying on the next pass"
+            );
         }
         if let Err(err) = mailbox_result {
             self.set_transport_available(profile_did, false)?;
@@ -996,6 +1093,7 @@ impl CollaborationDiscoveryService {
                     let state = client_state_mut(&mut states, profile_did)?;
                     state.current_advertisement = Some(cached);
                     state.transport_available = false;
+                    state.connecting = false;
                     anyhow::bail!("discovery relay query failed");
                 }
             }
@@ -1030,6 +1128,7 @@ impl CollaborationDiscoveryService {
                     let state = client_state_mut(&mut states, profile_did)?;
                     state.remote_visibility_may_remain_until = None;
                     state.transport_available = true;
+                    state.connecting = false;
                 }
                 Err(_) => {
                     self.mark_withdrawal_unavailable(profile_did, &current)?;
@@ -1326,6 +1425,8 @@ impl CollaborationDiscoveryService {
         let mut decisions =
             VecDeque::from(store.resendable_contact_decisions(now, MAX_DISCOVERY_QUERY_RESULTS)?);
         let mut prefer_requests = true;
+        // One refused item must not starve the rest of the outbox.
+        let mut first_failure: Option<anyhow::Error> = None;
         for _ in 0..MAX_DISCOVERY_OUTBOX_SENDS_PER_SYNC {
             let next_is_request = match (requests.is_empty(), decisions.is_empty()) {
                 (true, true) => break,
@@ -1337,7 +1438,7 @@ impl CollaborationDiscoveryService {
                 let request = requests
                     .pop_front()
                     .ok_or_else(|| anyhow::anyhow!("pending contact request queue underflow"))?;
-                let response = self
+                let sent = match self
                     .invoke_bootstrap(
                         "send_contact_request",
                         serde_json::to_value(DiscoveryProviderContactRequest {
@@ -1345,13 +1446,21 @@ impl CollaborationDiscoveryService {
                             request: encode_bytes(&request),
                         })?,
                     )
-                    .await?;
-                require_discovery_provider_success(response, "contact request submission")?;
+                    .await
+                {
+                    Ok(response) => {
+                        require_discovery_provider_success(response, "contact request submission")
+                    }
+                    Err(err) => Err(err),
+                };
+                if let Err(err) = sent {
+                    first_failure.get_or_insert(err);
+                }
             } else {
                 let receipt = decisions
                     .pop_front()
                     .ok_or_else(|| anyhow::anyhow!("pending contact decision queue underflow"))?;
-                let response = self
+                let sent = match self
                     .invoke_bootstrap(
                         "submit_contact_decision_receipt",
                         serde_json::to_value(DiscoveryProviderDecisionReceiptRequest {
@@ -1359,8 +1468,16 @@ impl CollaborationDiscoveryService {
                             receipt: encode_bytes(&receipt),
                         })?,
                     )
-                    .await?;
-                require_discovery_provider_success(response, "contact decision submission")?;
+                    .await
+                {
+                    Ok(response) => {
+                        require_discovery_provider_success(response, "contact decision submission")
+                    }
+                    Err(err) => Err(err),
+                };
+                if let Err(err) = sent {
+                    first_failure.get_or_insert(err);
+                }
             }
             if !requests.is_empty() && !decisions.is_empty() {
                 prefer_requests = !prefer_requests;
@@ -1368,7 +1485,10 @@ impl CollaborationDiscoveryService {
                 prefer_requests = !requests.is_empty();
             }
         }
-        Ok(())
+        match first_failure {
+            Some(err) => Err(err),
+            None => Ok(()),
+        }
     }
 
     fn set_transport_available(&self, profile_did: &str, available: bool) -> anyhow::Result<()> {
@@ -1376,7 +1496,9 @@ impl CollaborationDiscoveryService {
             .state
             .lock()
             .map_err(|_| anyhow::anyhow!("discovery client state lock is poisoned"))?;
-        client_state_mut(&mut states, profile_did)?.transport_available = available;
+        let state = client_state_mut(&mut states, profile_did)?;
+        state.transport_available = available;
+        state.connecting = false;
         Ok(())
     }
 
@@ -1392,6 +1514,7 @@ impl CollaborationDiscoveryService {
         let state = client_state_mut(&mut states, profile_did)?;
         state.current_advertisement = Some(current_advertisement);
         state.transport_available = false;
+        state.connecting = false;
         Ok(())
     }
 
@@ -1414,6 +1537,7 @@ impl CollaborationDiscoveryService {
                 .expires_at,
         );
         state.transport_available = false;
+        state.connecting = false;
         Ok(())
     }
 
@@ -1611,6 +1735,7 @@ fn project_discovery_status(
             .values()
             .map(|cached| DiscoveryVisiblePerson {
                 advertisement_id: cached.verified.message().envelope_sha256().to_string(),
+                profile_did: cached.verified.profile_did().to_string(),
                 display_name: cached.verified.display_name().to_string(),
                 handle: cached.verified.handle().map(str::to_string),
                 last_seen_at: cached.verified.message().envelope().payload.created_at,
@@ -1622,6 +1747,7 @@ fn project_discovery_status(
     };
     Ok(CollaborationDiscoveryStatus {
         available: state.transport_available,
+        connecting: enabled && state.connecting,
         enabled,
         expires_at: state
             .current_advertisement
@@ -1761,6 +1887,11 @@ impl CollaborationDiscoveryStatus {
         self.available
     }
 
+    /// Discovery is on and its first relay pass has not finished yet.
+    pub(crate) fn connecting(&self) -> bool {
+        self.connecting
+    }
+
     pub(crate) fn enabled(&self) -> bool {
         self.enabled
     }
@@ -1786,6 +1917,12 @@ impl CollaborationDiscoveryStatus {
         &self.incoming_requests
     }
 
+    #[cfg(test)]
+    pub(crate) fn with_connecting_for_test(mut self) -> Self {
+        self.connecting = true;
+        self
+    }
+
     #[cfg(test)]
     pub(crate) fn test_new(
         available: bool,
@@ -1797,6 +1934,7 @@ impl CollaborationDiscoveryStatus {
     ) -> Self {
         Self {
             available,
+            connecting: false,
             enabled,
             expires_at,
             remote_visibility_may_remain_until,
@@ -1811,6 +1949,10 @@ impl DiscoveryVisiblePerson {
         &self.advertisement_id
     }
 
+    pub(crate) fn profile_did(&self) -> &str {
+        &self.profile_did
+    }
+
     pub(crate) fn display_name(&self) -> &str {
         &self.display_name
     }
@@ -1831,8 +1973,10 @@ impl DiscoveryVisiblePerson {
         last_seen_at: u64,
         expires_at: u64,
     ) -> Self {
+        let advertisement_id = advertisement_id.into();
         Self {
-            advertisement_id: advertisement_id.into(),
+            profile_did: format!("did:key:test-{advertisement_id}"),
+            advertisement_id,
             display_name: display_name.into(),
             handle,
             last_seen_at,
@@ -2830,7 +2974,8 @@ fn client_state_mut<'a>(
                 && state.visible_advertisements.is_empty()
                 && state.observed_profile_heads.is_empty()
                 && state.remote_visibility_may_remain_until.is_none()
-                && state.transport_available)
+                && state.transport_available
+                && !state.connecting)
                 .then(|| candidate.clone())
         }) {
             states.remove(&disposable_profile_did);
@@ -2862,6 +3007,7 @@ fn apply_decoded_advertisements(
     state.observed_profile_heads = candidate_heads;
     state.visible_advertisements = candidate_visible;
     state.transport_available = transport_available;
+    state.connecting = false;
     Ok(())
 }
 
@@ -4487,6 +4633,10 @@ pub(crate) mod tests {
             .await
             .unwrap();
         assert!(enabled.enabled());
+        assert!(
+            enabled.connecting(),
+            "turning Discovery on reads as connecting until the first relay pass finishes"
+        );
         let refreshed = wait_for_visible_peer(
             &local_service,
             local_store.as_ref(),
@@ -4494,6 +4644,11 @@ pub(crate) mod tests {
             "Remote",
         )
         .await;
+        assert!(
+            !refreshed.connecting(),
+            "a finished relay pass ends connecting"
+        );
+        assert!(refreshed.available());
         assert_eq!(refreshed.visible_people().len(), 1);
         assert_eq!(refreshed.visible_people()[0].display_name(), "Remote");
         assert_eq!(refreshed.incoming_requests().len(), 0);
@@ -4776,6 +4931,66 @@ pub(crate) mod tests {
         );
     }
 
+    #[tokio::test]
+    async fn person_requested_discovery_wake_clears_backoff() {
+        let temp = tempfile::tempdir().unwrap();
+        let pair = durable_profile_peer_pair(temp.path()).await;
+        let root_a = temp.path().join("a");
+        let now = crate::auth::now_ts();
+        let grant_a =
+            store_home_session_grant_for_test(&root_a, &pair.identity_a, "alice-home", now);
+        pair.service_a
+            .register_sync_context(
+                pair.store_a.clone(),
+                pair.identity_a.profile.clone(),
+                &grant_a.session_id,
+                Some(&pair.identity_a.proof_binding_id),
+                &grant_a.grant_id,
+                now,
+            )
+            .unwrap();
+        let backed_off_until = now + DISCOVERY_SYNC_MAX_BACKOFF_SECS;
+        let set_backoff = || {
+            for context in pair.service_a.sync_contexts.lock().unwrap().values_mut() {
+                context.discovery_failures = 4;
+                context.discovery_next_wake_at = backed_off_until;
+            }
+        };
+        let discovery_schedule = || {
+            pair.service_a
+                .sync_contexts
+                .lock()
+                .unwrap()
+                .values()
+                .map(|context| (context.discovery_failures, context.discovery_next_wake_at))
+                .collect::<Vec<_>>()
+        };
+
+        set_backoff();
+        assert!(pair
+            .service_a
+            .wake_registered_sync_if_present(
+                pair.store_a.as_ref(),
+                &pair.identity_a.profile,
+                now + 1
+            )
+            .unwrap());
+        assert_eq!(
+            discovery_schedule(),
+            vec![(4, backed_off_until)],
+            "a background wake keeps the failure backoff"
+        );
+
+        pair.service_a
+            .wake_registered_discovery_now(pair.store_a.as_ref(), &pair.identity_a.profile, now + 1)
+            .unwrap();
+        assert_eq!(
+            discovery_schedule(),
+            vec![(0, now + 1)],
+            "a person's Refresh or Turn On retries Discovery at once"
+        );
+    }
+
     #[tokio::test]
     async fn unilateral_contact_removal_propagates_after_sync_wake() {
         let temp = tempfile::tempdir().unwrap();
@@ -5743,19 +5958,23 @@ pub(crate) mod tests {
             )
             .unwrap()
             .expect("request must remain stored for retry");
-        assert!(local_service
+        // A refused outbox item stays queued, but the pass still reaches the
+        // relay's mailbox and query, so Discovery keeps working meanwhile.
+        let during_outage = local_service
             .refresh(local_store.as_ref(), &local_profile, current_timestamp())
             .await
-            .is_err());
+            .unwrap();
+        assert!(during_outage.available());
         assert!(remote_store.pending_incoming_requests().unwrap().is_empty());
 
         seed_provider.allow_requests();
         seed_provider
             .set_request_submission_response(serde_json::json!({"status":"error","data":{}}));
-        assert!(local_service
+        local_service
             .refresh(local_store.as_ref(), &local_profile, current_timestamp())
             .await
-            .is_err());
+            .unwrap();
+        assert!(remote_store.pending_incoming_requests().unwrap().is_empty());
         assert_eq!(
             local_store
                 .stored_outgoing_contact_request(
@@ -8543,6 +8762,7 @@ pub(crate) mod tests {
             observed_profile_heads: BTreeMap::new(),
             remote_visibility_may_remain_until: None,
             transport_available: false,
+            connecting: false,
         };
 
         apply_decoded_advertisements(&mut state, vec![revision_two.clone()], true).unwrap();
@@ -8625,6 +8845,7 @@ pub(crate) mod tests {
             observed_profile_heads: BTreeMap::new(),
             remote_visibility_may_remain_until: None,
             transport_available: false,
+            connecting: false,
         };
 
         let error =
diff --git a/elastos/crates/elastos-server/src/collaboration_release_network.rs b/elastos/crates/elastos-server/src/collaboration_release_network.rs
new file mode 100644
index 000000000..27a1b0e7e
--- /dev/null
+++ b/elastos/crates/elastos-server/src/collaboration_release_network.rs
@@ -0,0 +1,803 @@
+//! Release-pinned default collaboration network.
+//!
+//! The signed release names one collaboration network in `components.json`
+//! and ships its startup configuration beside the manifest. Setup and update
+//! install that configuration so a new Home joins the shared Community room
+//! without an operator step. A Home stays isolated when its person chose
+//! isolation before the first join.
+//!
+//! Trust comes from the release: the manifest pin fixes the exact bytes, the
+//! network ID and the trusted profile-signer set. The configuration itself is
+//! then checked by the same validator Runtime startup uses.
+
+use std::fs;
+use std::path::Path;
+
+use anyhow::Context;
+use serde::{Deserialize, Serialize};
+
+use crate::collaboration_config::create_owner_only_file;
+use crate::collaboration_startup::{
+    parse_and_validate_collaboration_startup_configuration,
+    read_collaboration_startup_config_candidate, CollaborationStartupConfigFile,
+    COLLABORATION_STARTUP_CONFIG_FILE, MAX_STARTUP_CONFIG_BYTES,
+};
+
+/// The release copy of the pinned configuration, beside `components.json`.
+pub const RELEASE_COLLABORATION_NETWORK_FILE: &str = "collaboration-network-release-v1.json";
+/// Present when the person chose an isolated Home.
+pub const COLLABORATION_ISOLATED_MARKER_FILE: &str = "collaboration-isolated-v1";
+/// Serializes the isolation choice with Runtime startup's network acceptance.
+const COLLABORATION_NETWORK_CHOICE_LOCK_FILE: &str = ".collaboration-network-choice.lock";
+/// Source-home setup owns collaboration through its own explicit mode.
+const SOURCE_HOME_COLLABORATION_MODE_ENV: &str = "ELASTOS_COLLABORATION_STARTUP_MODE";
+
+/// The release pin for the default collaboration network.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct CollaborationNetworkPin {
+    /// Raw SHA-256 CIDv1 of the exact release configuration bytes.
+    pub head_cid: String,
+    pub expected_network_id: String,
+    pub trusted_profile_signer_dids: Vec<String>,
+}
+
+/// What setup or update did with the release network.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum ReleaseNetworkOutcome {
+    /// The release names no default network.
+    NotPinned,
+    /// Source-home setup manages collaboration explicitly.
+    SourceHomeManaged,
+    /// The person chose an isolated Home.
+    Isolated,
+    /// The Home now uses the release network.
+    Joined { network_id: String },
+    /// The Home already uses this exact release configuration.
+    Unchanged { network_id: String },
+    /// The Home moved forward along the same signed network chain.
+    Advanced { network_id: String },
+    /// The Home keeps a different configuration its operator installed.
+    KeptExisting,
+}
+
+impl ReleaseNetworkOutcome {
+    /// One line for setup and update output.
+    pub fn summary_line(&self) -> Option<String> {
+        match self {
+            Self::NotPinned | Self::SourceHomeManaged => None,
+            Self::Isolated => Some(
+                "Community: this Home stays isolated, as chosen. It does not join the shared Community room."
+                    .to_string(),
+            ),
+            Self::Joined { network_id }
+            | Self::Unchanged { network_id }
+            | Self::Advanced { network_id } => Some(format!(
+                "Community: this Home joins the shared Community room ({network_id}). To keep a new Home isolated, run `elastos setup --isolated` before its first start."
+            )),
+            Self::KeptExisting => Some(
+                "Community: this Home keeps its own collaboration network configuration.".to_string(),
+            ),
+        }
+    }
+}
+
+/// Records that this Home stays isolated.
+///
+/// Before the first start this also removes the release network file that
+/// setup installed, so Runtime never joins it. A Home whose Runtime already
+/// accepted a network keeps it, because Runtime refuses to drop an accepted
+/// network; leaving Community is a separate step. A configuration that is
+/// not the release network belongs to the Home's operator and is kept.
+pub fn choose_isolated(data_dir: &Path) -> anyhow::Result<()> {
+    fs::create_dir_all(data_dir)?;
+    // Runtime startup takes the same lock to read and accept the network, so
+    // the check, the choice and the removal below cannot interleave with it.
+    let _choice = lock_network_choice(data_dir)?;
+    let config = data_dir.join(COLLABORATION_STARTUP_CONFIG_FILE);
+    let marker = data_dir.join(COLLABORATION_ISOLATED_MARKER_FILE);
+    let release_config = match fs::symlink_metadata(&config) {
+        Ok(_) => {
+            require_not_started(data_dir)?;
+            let bytes = read_collaboration_startup_config_candidate(&config)?;
+            if !is_installed_release_network(data_dir, &bytes)? {
+                anyhow::bail!(
+                    "this Home has its own collaboration network configuration; isolation applies only to the release network"
+                );
+            }
+            true
+        }
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => false,
+        Err(error) => return Err(error).context("failed to inspect collaboration configuration"),
+    };
+    // The choice is recorded first. Startup honours it until the Home joins,
+    // so an interrupted run stays isolated and a rerun finishes the removal.
+    if fs::symlink_metadata(&marker).is_err() {
+        create_owner_only_file(&marker, b"isolated\n", "collaboration isolation choice")?;
+    }
+    if release_config {
+        fs::remove_file(&config).context("failed to remove the release collaboration network")?;
+        fs::File::open(data_dir)?.sync_all()?;
+        tracing::debug!("removed the release collaboration network before the first start");
+    }
+    Ok(())
+}
+
+/// Holds the network-choice lock for one isolation choice or one Runtime
+/// startup acceptance. A missing data root has nothing to serialize.
+pub(crate) fn lock_network_choice(
+    data_dir: &Path,
+) -> anyhow::Result<Option<crate::host_lock::FileLock>> {
+    if !data_dir.is_dir() {
+        return Ok(None);
+    }
+    crate::collaboration_core::lock_owner_only_file(
+        &data_dir.join(COLLABORATION_NETWORK_CHOICE_LOCK_FILE),
+    )
+    .map(Some)
+    .context("failed to lock the collaboration network choice")
+}
+
+/// True when Runtime startup must stay isolated: the person chose isolation
+/// and Runtime has not accepted a network yet. A leftover release file from an
+/// interrupted `--isolated` run is then ignored.
+pub(crate) fn isolation_applies_at_startup(data_dir: &Path) -> bool {
+    is_isolated(data_dir) && require_not_started(data_dir).is_ok()
+}
+
+/// Runtime creates the collaboration namespace when it first accepts a
+/// network, so its presence means this Home already joined.
+fn require_not_started(data_dir: &Path) -> anyhow::Result<()> {
+    match fs::symlink_metadata(data_dir.join("collaboration")) {
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => Ok(()),
+        Err(error) => Err(error).context("failed to inspect collaboration state"),
+        Ok(_) => anyhow::bail!(
+            "this Home already joined Community; isolation applies only before its first start"
+        ),
+    }
+}
+
+/// True when `bytes` are exactly the network the Home's installed release pins.
+fn is_installed_release_network(data_dir: &Path, bytes: &[u8]) -> anyhow::Result<bool> {
+    const MAX_INSTALLED_COMPONENTS_BYTES: u64 = 4 * 1024 * 1024;
+    let path = data_dir.join("components.json");
+    let metadata = match fs::symlink_metadata(&path) {
+        Ok(metadata) => metadata,
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => return Ok(false),
+        Err(error) => return Err(error).context("failed to inspect installed components"),
+    };
+    if !metadata.is_file() || metadata.len() > MAX_INSTALLED_COMPONENTS_BYTES {
+        return Ok(false);
+    }
+    let manifest: crate::setup::ComponentsManifest =
+        serde_json::from_slice(&fs::read(&path)?).context("installed components are invalid")?;
+    let Some(pin) = manifest.collaboration_network else {
+        return Ok(false);
+    };
+    Ok(crate::setup::catalog_head_cid(bytes)? == pin.head_cid)
+}
+
+pub fn is_isolated(data_dir: &Path) -> bool {
+    fs::symlink_metadata(data_dir.join(COLLABORATION_ISOLATED_MARKER_FILE)).is_ok()
+}
+
+/// Checks release configuration bytes against the manifest pin.
+pub fn verify_release_network_bytes(
+    pin: &CollaborationNetworkPin,
+    bytes: &[u8],
+) -> anyhow::Result<()> {
+    if bytes.is_empty() || bytes.len() > MAX_STARTUP_CONFIG_BYTES {
+        anyhow::bail!("release collaboration network configuration has an invalid byte length");
+    }
+    let actual = crate::setup::catalog_head_cid(bytes)?;
+    if actual != pin.head_cid {
+        anyhow::bail!(
+            "release collaboration network {actual} does not match the pinned raw SHA-256 CIDv1 {}",
+            pin.head_cid
+        );
+    }
+    parse_and_validate_collaboration_startup_configuration(bytes)
+        .context("release collaboration network configuration is invalid")?;
+    let config = parse_config(bytes)?;
+    if config.expected_network_id != pin.expected_network_id {
+        anyhow::bail!("release collaboration network ID does not match the release pin");
+    }
+    if sorted(&config.trusted_profile_signer_dids) != sorted(&pin.trusted_profile_signer_dids) {
+        anyhow::bail!("release collaboration signer set does not match the release pin");
+    }
+    Ok(())
+}
+
+/// What a Home needs from the release network before any write.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum ReleaseNetworkPlan<'a> {
+    /// The Home keeps its collaboration state and needs no release bytes.
+    Skip(ReleaseNetworkOutcome),
+    /// The Home needs the pinned release configuration.
+    Install(&'a CollaborationNetworkPin),
+}
+
+/// Decides whether this Home takes the release network.
+pub fn plan_release_network<'a>(
+    data_dir: &Path,
+    pin: Option<&'a CollaborationNetworkPin>,
+) -> ReleaseNetworkPlan<'a> {
+    let Some(pin) = pin else {
+        return ReleaseNetworkPlan::Skip(ReleaseNetworkOutcome::NotPinned);
+    };
+    if std::env::var_os(SOURCE_HOME_COLLABORATION_MODE_ENV).is_some() {
+        return ReleaseNetworkPlan::Skip(ReleaseNetworkOutcome::SourceHomeManaged);
+    }
+    if is_isolated(data_dir) {
+        return ReleaseNetworkPlan::Skip(ReleaseNetworkOutcome::Isolated);
+    }
+    ReleaseNetworkPlan::Install(pin)
+}
+
+/// Fetches and verifies the release configuration this Home needs.
+///
+/// Signed setup and update call this with their other release downloads,
+/// before they write anything. A Home that needs no release bytes fetches
+/// nothing.
+pub async fn fetch_release_network<F, Fut>(
+    data_dir: &Path,
+    pin: Option<&CollaborationNetworkPin>,
+    fetch: F,
+) -> anyhow::Result<Option<Vec<u8>>>
+where
+    F: FnOnce(&CollaborationNetworkPin) -> Fut,
+    Fut: std::future::Future<Output = anyhow::Result<Vec<u8>>>,
+{
+    let ReleaseNetworkPlan::Install(pin) = plan_release_network(data_dir, pin) else {
+        return Ok(None);
+    };
+    let bytes = fetch(pin)
+        .await
+        .context("could not fetch the release collaboration network configuration")?;
+    verify_release_network_bytes(pin, &bytes)?;
+    tracing::debug!(
+        network_id = %pin.expected_network_id,
+        bytes = bytes.len(),
+        "verified release collaboration network"
+    );
+    Ok(Some(bytes))
+}
+
+/// Installs or advances the release network from bytes fetched earlier by
+/// [`fetch_release_network`].
+pub fn install_fetched_release_network(
+    data_dir: &Path,
+    pin: Option<&CollaborationNetworkPin>,
+    fetched: Option<&[u8]>,
+) -> anyhow::Result<ReleaseNetworkOutcome> {
+    match plan_release_network(data_dir, pin) {
+        ReleaseNetworkPlan::Skip(outcome) => Ok(outcome),
+        ReleaseNetworkPlan::Install(pin) => {
+            let release = fetched.context(
+                "the release pins a collaboration network but its configuration was not fetched",
+            )?;
+            apply_release_network(data_dir, pin, release)
+        }
+    }
+}
+
+/// Installs or advances the release network from the release copy beside a
+/// local `components.json`.
+pub fn install_release_network(
+    data_dir: &Path,
+    pin: Option<&CollaborationNetworkPin>,
+    release_copy: &Path,
+) -> anyhow::Result<ReleaseNetworkOutcome> {
+    let fetched = match plan_release_network(data_dir, pin) {
+        ReleaseNetworkPlan::Install(_) => Some(fs::read(release_copy).with_context(|| {
+            format!(
+                "the release pins a collaboration network but {} is missing; use the complete signed release, or run `elastos setup --isolated` to keep this Home out of Community",
+                release_copy.display()
+            )
+        })?),
+        ReleaseNetworkPlan::Skip(_) => None,
+    };
+    install_fetched_release_network(data_dir, pin, fetched.as_deref())
+}
+
+fn apply_release_network(
+    data_dir: &Path,
+    pin: &CollaborationNetworkPin,
+    release: &[u8],
+) -> anyhow::Result<ReleaseNetworkOutcome> {
+    verify_release_network_bytes(pin, release)?;
+    let network_id = pin.expected_network_id.clone();
+    let dest = data_dir.join(COLLABORATION_STARTUP_CONFIG_FILE);
+    if fs::symlink_metadata(&dest).is_err() {
+        fs::create_dir_all(data_dir)?;
+        create_owner_only_file(&dest, release, "collaboration network configuration")?;
+        return Ok(ReleaseNetworkOutcome::Joined { network_id });
+    }
+    let existing = read_collaboration_startup_config_candidate(&dest)?;
+    if existing == release {
+        return Ok(ReleaseNetworkOutcome::Unchanged { network_id });
+    }
+    if release_extends_existing(&existing, release)? {
+        replace_owner_only_file(data_dir, &dest, release)?;
+        return Ok(ReleaseNetworkOutcome::Advanced { network_id });
+    }
+    Ok(ReleaseNetworkOutcome::KeptExisting)
+}
+
+/// True when `release` is the same network and signer set with a signed
+/// chain that strictly extends the installed one.
+fn release_extends_existing(existing: &[u8], release: &[u8]) -> anyhow::Result<bool> {
+    let Ok(existing) = parse_config(existing) else {
+        return Ok(false);
+    };
+    let release = parse_config(release)?;
+    Ok(existing.expected_network_id == release.expected_network_id
+        && sorted(&existing.trusted_profile_signer_dids)
+            == sorted(&release.trusted_profile_signer_dids)
+        && release.profile_chain_base64.len() > existing.profile_chain_base64.len()
+        && release
+            .profile_chain_base64
+            .starts_with(&existing.profile_chain_base64))
+}
+
+fn replace_owner_only_file(data_dir: &Path, dest: &Path, bytes: &[u8]) -> anyhow::Result<()> {
+    let staged = data_dir.join(format!(".{COLLABORATION_STARTUP_CONFIG_FILE}.release.tmp"));
+    let _ = fs::remove_file(&staged);
+    create_owner_only_file(&staged, bytes, "collaboration network configuration update")?;
+    fs::rename(&staged, dest).inspect_err(|_| {
+        let _ = fs::remove_file(&staged);
+    })?;
+    fs::File::open(data_dir)?.sync_all()?;
+    Ok(())
+}
+
+fn parse_config(bytes: &[u8]) -> anyhow::Result<CollaborationStartupConfigFile> {
+    serde_json::from_slice(bytes).context("invalid collaboration network configuration")
+}
+
+fn sorted(values: &[String]) -> Vec<&str> {
+    let mut values = values.iter().map(String::as_str).collect::<Vec<_>>();
+    values.sort_unstable();
+    values
+}
+
+#[cfg(test)]
+pub(crate) mod tests {
+    use super::*;
+    use base64::Engine as _;
+    use elastos_runtime::signature::generate_keypair;
+    use sha2::{Digest, Sha256};
+
+    use crate::collaboration_network::{
+        canonical_collaboration_network_profile_payload_bytes, CollaborationNetworkProfile,
+        SignedCollaborationNetworkProfile, COLLABORATION_NETWORK_PROFILE_SCHEMA,
+        COLLABORATION_NETWORK_PROFILE_SIGNATURE_DOMAIN,
+    };
+    use crate::collaboration_startup::{
+        canonical_startup_config_bytes, COLLABORATION_STARTUP_CONFIG_SCHEMA,
+    };
+
+    /// One signer's network, with the canonical startup configuration for
+    /// every revision from 1 to `revisions`.
+    pub(crate) fn signed_profile_chain_config(revisions: u64) -> (String, Vec<Vec<u8>>) {
+        let (signer, _) = generate_keypair();
+        let signer_did = crate::crypto::encode_signing_key_did(&signer);
+        let network_id = format!(
+            "release-network-{}",
+            &hex::encode(Sha256::digest(signer_did.as_bytes()))[..12]
+        );
+        let mut envelopes: Vec<Vec<u8>> = Vec::new();
+        let mut configs = Vec::new();
+        for revision in 1..=revisions {
+            let payload = CollaborationNetworkProfile {
+                schema: COLLABORATION_NETWORK_PROFILE_SCHEMA.to_string(),
+                network_id: network_id.clone(),
+                revision,
+                previous_profile_sha256: envelopes
+                    .last()
+                    .map(|bytes| format!("sha256:{}", hex::encode(Sha256::digest(bytes)))),
+                signer_did: signer_did.clone(),
+                bootstrap_peers: Vec::new(),
+                default_conversation: None,
+            };
+            let payload_bytes =
+                canonical_collaboration_network_profile_payload_bytes(&payload).unwrap();
+            let (signature, envelope_signer) = crate::crypto::domain_separated_sign(
+                &signer,
+                COLLABORATION_NETWORK_PROFILE_SIGNATURE_DOMAIN,
+                &payload_bytes,
+            );
+            envelopes.push(
+                serde_json::to_vec(
+                    &serde_json::to_value(SignedCollaborationNetworkProfile {
+                        payload,
+                        signature,
+                        signer_did: envelope_signer,
+                    })
+                    .unwrap(),
+                )
+                .unwrap(),
+            );
+            configs.push(
+                canonical_startup_config_bytes(&CollaborationStartupConfigFile {
+                    schema: COLLABORATION_STARTUP_CONFIG_SCHEMA.to_string(),
+                    expected_network_id: network_id.clone(),
+                    trusted_profile_signer_dids: vec![signer_did.clone()],
+                    profile_chain_base64: envelopes
+                        .iter()
+                        .map(|bytes| base64::engine::general_purpose::STANDARD.encode(bytes))
+                        .collect(),
+                    default_conversation_grant_base64: None,
+                })
+                .unwrap(),
+            );
+        }
+        (signer_did, configs)
+    }
+
+    fn pin_for(bytes: &[u8]) -> CollaborationNetworkPin {
+        let config = parse_config(bytes).unwrap();
+        CollaborationNetworkPin {
+            head_cid: crate::setup::catalog_head_cid(bytes).unwrap(),
+            expected_network_id: config.expected_network_id,
+            trusted_profile_signer_dids: config.trusted_profile_signer_dids,
+        }
+    }
+
+    fn release_dir_with(bytes: &[u8]) -> (tempfile::TempDir, std::path::PathBuf) {
+        let release = tempfile::tempdir().unwrap();
+        let path = release.path().join(RELEASE_COLLABORATION_NETWORK_FILE);
+        fs::write(&path, bytes).unwrap();
+        (release, path)
+    }
+
+    fn private_data_dir() -> tempfile::TempDir {
+        let dir = tempfile::tempdir().unwrap();
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt;
+            fs::set_permissions(dir.path(), fs::Permissions::from_mode(0o700)).unwrap();
+        }
+        dir
+    }
+
+    #[test]
+    fn a_new_home_joins_the_pinned_release_network() {
+        let (_signer, chain) = signed_profile_chain_config(1);
+        let (_release, release_path) = release_dir_with(&chain[0]);
+        let data = private_data_dir();
+        let pin = pin_for(&chain[0]);
+
+        let outcome = install_release_network(data.path(), Some(&pin), &release_path).unwrap();
+
+        assert_eq!(
+            outcome,
+            ReleaseNetworkOutcome::Joined {
+                network_id: pin.expected_network_id.clone()
+            }
+        );
+        let dest = data.path().join(COLLABORATION_STARTUP_CONFIG_FILE);
+        assert_eq!(fs::read(&dest).unwrap(), chain[0]);
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt;
+            assert_eq!(
+                fs::metadata(&dest).unwrap().permissions().mode() & 0o777,
+                0o600
+            );
+        }
+        assert!(outcome
+            .summary_line()
+            .unwrap()
+            .contains("elastos setup --isolated"));
+        assert_eq!(
+            install_release_network(data.path(), Some(&pin), &release_path).unwrap(),
+            ReleaseNetworkOutcome::Unchanged {
+                network_id: pin.expected_network_id
+            },
+            "setup again is idempotent"
+        );
+    }
+
+    #[test]
+    fn an_isolated_home_stays_isolated() {
+        let (_signer, chain) = signed_profile_chain_config(1);
+        let (_release, release_path) = release_dir_with(&chain[0]);
+        let data = private_data_dir();
+        choose_isolated(data.path()).unwrap();
+
+        let outcome =
+            install_release_network(data.path(), Some(&pin_for(&chain[0])), &release_path).unwrap();
+
+        assert_eq!(outcome, ReleaseNetworkOutcome::Isolated);
+        assert!(fs::symlink_metadata(data.path().join(COLLABORATION_STARTUP_CONFIG_FILE)).is_err());
+    }
+
+    /// The Home's installed `components.json`, pinning `pin`.
+    fn install_components_pin(data: &Path, pin: &CollaborationNetworkPin) {
+        let manifest = serde_json::json!({
+            "external": {},
+            "profiles": {},
+            "collaboration_network": pin,
+        });
+        fs::write(data.join("components.json"), manifest.to_string()).unwrap();
+    }
+
+    #[test]
+    fn isolation_before_the_first_start_removes_the_release_network() {
+        let (_signer, chain) = signed_profile_chain_config(1);
+        let (_release, release_path) = release_dir_with(&chain[0]);
+        let data = private_data_dir();
+        let pin = pin_for(&chain[0]);
+        install_components_pin(data.path(), &pin);
+        install_release_network(data.path(), Some(&pin), &release_path).unwrap();
+
+        choose_isolated(data.path()).unwrap();
+
+        assert!(is_isolated(data.path()));
+        assert!(fs::symlink_metadata(data.path().join(COLLABORATION_STARTUP_CONFIG_FILE)).is_err());
+        // Setup and update now leave it uninstalled, and the choice is idempotent.
+        assert_eq!(
+            install_release_network(data.path(), Some(&pin), &release_path).unwrap(),
+            ReleaseNetworkOutcome::Isolated
+        );
+        assert!(fs::symlink_metadata(data.path().join(COLLABORATION_STARTUP_CONFIG_FILE)).is_err());
+        choose_isolated(data.path()).unwrap();
+    }
+
+    #[test]
+    fn isolation_is_refused_after_a_home_joined() {
+        let (_signer, chain) = signed_profile_chain_config(1);
+        let (_release, release_path) = release_dir_with(&chain[0]);
+        let data = private_data_dir();
+        let pin = pin_for(&chain[0]);
+        install_components_pin(data.path(), &pin);
+        install_release_network(data.path(), Some(&pin), &release_path).unwrap();
+        // Runtime accepted the network at its first start.
+        fs::create_dir(data.path().join("collaboration")).unwrap();
+
+        let err = choose_isolated(data.path()).unwrap_err().to_string();
+
+        assert!(err.contains("already joined Community"), "{err}");
+        assert!(!is_isolated(data.path()));
+        assert_eq!(
+            fs::read(data.path().join(COLLABORATION_STARTUP_CONFIG_FILE)).unwrap(),
+            chain[0]
+        );
+    }
+
+    #[test]
+    fn isolation_keeps_an_operator_network() {
+        let (_signer, chain) = signed_profile_chain_config(1);
+        let (_other_signer, other) = signed_profile_chain_config(1);
+        let (_release, release_path) = release_dir_with(&chain[0]);
+        let data = private_data_dir();
+        install_release_network(data.path(), Some(&pin_for(&chain[0])), &release_path).unwrap();
+
+        // No installed pin, then a pin for another network: neither marks
+        // this file as the release network.
+        for pin in [None, Some(pin_for(&other[0]))] {
+            if let Some(pin) = &pin {
+                install_components_pin(data.path(), pin);
+            }
+            let err = choose_isolated(data.path()).unwrap_err().to_string();
+            assert!(err.contains("its own collaboration network"), "{err}");
+            assert!(!is_isolated(data.path()));
+            assert_eq!(
+                fs::read(data.path().join(COLLABORATION_STARTUP_CONFIG_FILE)).unwrap(),
+                chain[0]
+            );
+        }
+    }
+
+    #[test]
+    fn an_interrupted_isolation_finishes_on_the_next_run() {
+        let (_signer, chain) = signed_profile_chain_config(1);
+        let (_release, release_path) = release_dir_with(&chain[0]);
+        let data = private_data_dir();
+        let pin = pin_for(&chain[0]);
+        install_components_pin(data.path(), &pin);
+        install_release_network(data.path(), Some(&pin), &release_path).unwrap();
+        // The choice was recorded, then the run stopped before the removal.
+        create_owner_only_file(
+            &data.path().join(COLLABORATION_ISOLATED_MARKER_FILE),
+            b"isolated\n",
+            "test",
+        )
+        .unwrap();
+
+        // Until the rerun, startup honours the recorded choice: it stays
+        // isolated and does not join the leftover release network.
+        let startup =
+            crate::collaboration_startup::load_and_accept_collaboration_startup_configuration(
+                data.path(),
+            )
+            .unwrap();
+        assert!(startup.is_isolated_for_test());
+        assert!(fs::symlink_metadata(data.path().join("collaboration")).is_err());
+
+        choose_isolated(data.path()).unwrap();
+
+        assert!(fs::symlink_metadata(data.path().join(COLLABORATION_STARTUP_CONFIG_FILE)).is_err());
+    }
+
+    #[test]
+    fn isolation_waits_for_a_startup_that_is_accepting_the_network() {
+        let (_signer, chain) = signed_profile_chain_config(1);
+        let (_release, release_path) = release_dir_with(&chain[0]);
+        let data = private_data_dir();
+        let pin = pin_for(&chain[0]);
+        install_components_pin(data.path(), &pin);
+        install_release_network(data.path(), Some(&pin), &release_path).unwrap();
+
+        // A starting Runtime holds the lock while it reads and accepts.
+        let startup = lock_network_choice(data.path()).unwrap();
+        let (done_tx, done_rx) = std::sync::mpsc::channel();
+        let data_path = data.path().to_path_buf();
+        let isolation = std::thread::spawn(move || {
+            let result = choose_isolated(&data_path).map_err(|err| err.to_string());
+            done_tx.send(()).unwrap();
+            result
+        });
+        assert!(done_rx
+            .recv_timeout(std::time::Duration::from_millis(300))
+            .is_err());
+        // The Runtime accepted the network before releasing the lock.
+        fs::create_dir(data.path().join("collaboration")).unwrap();
+        drop(startup);
+
+        let err = isolation.join().unwrap().unwrap_err();
+        assert!(err.contains("already joined Community"), "{err}");
+        assert!(!is_isolated(data.path()));
+        assert_eq!(
+            fs::read(data.path().join(COLLABORATION_STARTUP_CONFIG_FILE)).unwrap(),
+            chain[0]
+        );
+    }
+
+    #[test]
+    fn release_bytes_must_match_the_pin() {
+        let (_signer, chain) = signed_profile_chain_config(1);
+        let (_release, release_path) = release_dir_with(&chain[0]);
+        let data = private_data_dir();
+        let mut pin = pin_for(&chain[0]);
+        pin.head_cid = crate::setup::catalog_head_cid(b"other").unwrap();
+
+        let err = install_release_network(data.path(), Some(&pin), &release_path)
+            .unwrap_err()
+            .to_string();
+
+        assert!(err.contains("does not match the pinned"), "{err}");
+        assert!(fs::symlink_metadata(data.path().join(COLLABORATION_STARTUP_CONFIG_FILE)).is_err());
+    }
+
+    #[test]
+    fn release_network_id_and_signers_must_match_the_pin() {
+        let (_signer, chain) = signed_profile_chain_config(1);
+        let mut pin = pin_for(&chain[0]);
+        pin.expected_network_id = "another-network".to_string();
+        assert!(verify_release_network_bytes(&pin, &chain[0])
+            .unwrap_err()
+            .to_string()
+            .contains("network ID"));
+
+        let mut pin = pin_for(&chain[0]);
+        pin.trusted_profile_signer_dids = vec!["did:key:z6MkOther".to_string()];
+        assert!(verify_release_network_bytes(&pin, &chain[0])
+            .unwrap_err()
+            .to_string()
+            .contains("signer set"));
+    }
+
+    #[test]
+    fn an_update_advances_along_the_same_signed_chain() {
+        let (_signer, chain) = signed_profile_chain_config(2);
+        let data = private_data_dir();
+        let (_first, first_path) = release_dir_with(&chain[0]);
+        install_release_network(data.path(), Some(&pin_for(&chain[0])), &first_path).unwrap();
+        let (_second, second_path) = release_dir_with(&chain[1]);
+
+        let outcome =
+            install_release_network(data.path(), Some(&pin_for(&chain[1])), &second_path).unwrap();
+
+        assert!(matches!(outcome, ReleaseNetworkOutcome::Advanced { .. }));
+        let dest = data.path().join(COLLABORATION_STARTUP_CONFIG_FILE);
+        assert_eq!(fs::read(&dest).unwrap(), chain[1]);
+    }
+
+    #[test]
+    fn an_operator_configuration_for_another_network_is_kept() {
+        let (_signer_a, operator_chain) = signed_profile_chain_config(1);
+        let (_signer_b, release_chain) = signed_profile_chain_config(1);
+        let data = private_data_dir();
+        let dest = data.path().join(COLLABORATION_STARTUP_CONFIG_FILE);
+        create_owner_only_file(&dest, &operator_chain[0], "operator configuration").unwrap();
+        let (_release, release_path) = release_dir_with(&release_chain[0]);
+
+        let outcome = install_release_network(
+            data.path(),
+            Some(&pin_for(&release_chain[0])),
+            &release_path,
+        )
+        .unwrap();
+
+        assert_eq!(outcome, ReleaseNetworkOutcome::KeptExisting);
+        assert_eq!(fs::read(&dest).unwrap(), operator_chain[0]);
+    }
+
+    #[test]
+    fn a_missing_release_copy_fails_when_the_release_pins_a_network() {
+        let (_signer, chain) = signed_profile_chain_config(1);
+        let data = private_data_dir();
+        let missing = data.path().join(RELEASE_COLLABORATION_NETWORK_FILE);
+
+        let err = install_release_network(data.path(), Some(&pin_for(&chain[0])), &missing)
+            .unwrap_err()
+            .to_string();
+
+        assert!(err.contains("is missing"), "{err}");
+    }
+
+    #[tokio::test]
+    async fn a_home_that_needs_no_release_bytes_fetches_nothing() {
+        let (_signer, chain) = signed_profile_chain_config(1);
+        let pin = pin_for(&chain[0]);
+        let data = private_data_dir();
+        let refuse = |_: &CollaborationNetworkPin| async {
+            anyhow::bail!("this Home fetches no release network")
+        };
+
+        assert_eq!(
+            fetch_release_network(data.path(), None, refuse)
+                .await
+                .unwrap(),
+            None
+        );
+        choose_isolated(data.path()).unwrap();
+        assert_eq!(
+            fetch_release_network(data.path(), Some(&pin), refuse)
+                .await
+                .unwrap(),
+            None
+        );
+        assert_eq!(
+            install_fetched_release_network(data.path(), Some(&pin), None).unwrap(),
+            ReleaseNetworkOutcome::Isolated
+        );
+    }
+
+    #[tokio::test]
+    async fn fetched_bytes_must_match_the_pin_before_install() {
+        let (_signer, chain) = signed_profile_chain_config(1);
+        let (_other, other) = signed_profile_chain_config(1);
+        let pin = pin_for(&chain[0]);
+        let data = private_data_dir();
+
+        let fetched = fetch_release_network(data.path(), Some(&pin), |pin| {
+            let head_cid = pin.head_cid.clone();
+            let bytes = chain[0].clone();
+            async move {
+                assert_eq!(head_cid, crate::setup::catalog_head_cid(&bytes).unwrap());
+                Ok(bytes)
+            }
+        })
+        .await
+        .unwrap();
+        assert_eq!(fetched.as_deref(), Some(chain[0].as_slice()));
+
+        let err = fetch_release_network(data.path(), Some(&pin), |_| {
+            let bytes = other[0].clone();
+            async move { Ok(bytes) }
+        })
+        .await
+        .unwrap_err()
+        .to_string();
+        assert!(err.contains("does not match the pinned"), "{err}");
+
+        let err = install_fetched_release_network(data.path(), Some(&pin), None)
+            .unwrap_err()
+            .to_string();
+        assert!(err.contains("was not fetched"), "{err}");
+        assert!(fs::symlink_metadata(data.path().join(COLLABORATION_STARTUP_CONFIG_FILE)).is_err());
+    }
+}
diff --git a/elastos/crates/elastos-server/src/collaboration_startup.rs b/elastos/crates/elastos-server/src/collaboration_startup.rs
index db9f66764..6fb1004b5 100644
--- a/elastos/crates/elastos-server/src/collaboration_startup.rs
+++ b/elastos/crates/elastos-server/src/collaboration_startup.rs
@@ -64,6 +64,16 @@ pub struct CollaborationStartupConfiguration {
     configuration: CollaborationNetworkConfiguration,
 }
 
+#[cfg(test)]
+impl CollaborationStartupConfiguration {
+    pub(crate) fn is_isolated_for_test(&self) -> bool {
+        matches!(
+            self.configuration,
+            CollaborationNetworkConfiguration::Isolated
+        )
+    }
+}
+
 /// Owns the one collaboration worker started for this Runtime process.
 pub struct CollaborationRuntimeService {
     shutdown: watch::Sender<bool>,
@@ -130,6 +140,27 @@ pub fn load_and_accept_collaboration_startup_configuration(
     data_root: &Path,
 ) -> anyhow::Result<CollaborationStartupConfiguration> {
     let loader = CollaborationProfileChainLoader::new(data_root);
+    // An absent file is final for this load, so it stays free of writes and
+    // never reads the path again. A present file is read and accepted only
+    // under the lock `elastos setup --isolated` takes, after rechecking the
+    // isolation choice, so a Home is never isolated and joined at once.
+    match fs::symlink_metadata(data_root.join(COLLABORATION_STARTUP_CONFIG_FILE)) {
+        Ok(_) => {}
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => {
+            return Ok(CollaborationStartupConfiguration {
+                configuration: loader.load_absent()?,
+            });
+        }
+        Err(error) => {
+            return Err(error).context("failed to inspect collaboration startup configuration")
+        }
+    }
+    let _choice = crate::collaboration_release_network::lock_network_choice(data_root)?;
+    if crate::collaboration_release_network::isolation_applies_at_startup(data_root) {
+        return Ok(CollaborationStartupConfiguration {
+            configuration: loader.load_absent()?,
+        });
+    }
     let Some(config_bytes) = read_startup_config_bytes(data_root)? else {
         return Ok(CollaborationStartupConfiguration {
             configuration: loader.load_absent()?,
@@ -1199,6 +1230,7 @@ mod tests {
             temp.path().to_path_buf(),
             crate::setup::ComponentsManifest {
                 model_catalog: None,
+                collaboration_network: None,
                 external: std::collections::HashMap::new(),
                 capsules: std::collections::HashMap::new(),
                 profiles: std::collections::HashMap::new(),
diff --git a/elastos/crates/elastos-server/src/home_cmd.rs b/elastos/crates/elastos-server/src/home_cmd.rs
index c2cfb49cd..40ea635ec 100644
--- a/elastos/crates/elastos-server/src/home_cmd.rs
+++ b/elastos/crates/elastos-server/src/home_cmd.rs
@@ -861,6 +861,7 @@ async fn run_managed_dashboard() -> anyhow::Result<()> {
                         Ok(message) => {
                             let _ = elastos_server::notifications::mark_acted_for_action(
                                 &default_data_dir(),
+                                None,
                                 action_id,
                             );
                             message
@@ -1926,14 +1927,21 @@ async fn dispatch_action(
         return dispatch_people_action(action_id, snapshot, coords, dashboard).await;
     }
     if let Some(notification_id) = action_id.strip_prefix("notification-read:") {
-        return match elastos_server::notifications::mark_read(&default_data_dir(), notification_id)?
-        {
+        return match elastos_server::notifications::mark_read(
+            &default_data_dir(),
+            None,
+            notification_id,
+        )? {
             true => Ok("Marked inbox entry read.".to_string()),
             false => Ok("That inbox entry was already read or is no longer present.".to_string()),
         };
     }
     if let Some(notification_id) = action_id.strip_prefix("notification-dismiss:") {
-        return match elastos_server::notifications::dismiss(&default_data_dir(), notification_id)? {
+        return match elastos_server::notifications::dismiss(
+            &default_data_dir(),
+            None,
+            notification_id,
+        )? {
             true => Ok("Dismissed inbox entry.".to_string()),
             false => Ok("That inbox entry is already gone.".to_string()),
         };
diff --git a/elastos/crates/elastos-server/src/lib.rs b/elastos/crates/elastos-server/src/lib.rs
index 9dac4e327..983f975ea 100644
--- a/elastos/crates/elastos-server/src/lib.rs
+++ b/elastos/crates/elastos-server/src/lib.rs
@@ -32,6 +32,7 @@ pub(crate) mod collaboration_profile_authority;
 pub(crate) mod collaboration_profile_loader;
 mod collaboration_profile_updates;
 pub mod collaboration_protocol;
+pub mod collaboration_release_network;
 pub mod collaboration_startup;
 pub(crate) mod collaboration_transport;
 pub(crate) mod component;
diff --git a/elastos/crates/elastos-server/src/main.rs b/elastos/crates/elastos-server/src/main.rs
index 48e278802..1e55482ac 100755
--- a/elastos/crates/elastos-server/src/main.rs
+++ b/elastos/crates/elastos-server/src/main.rs
@@ -505,6 +505,11 @@ enum Commands {
         /// Developer-supplied directory containing ffmpeg and ffprobe
         #[arg(long, hide = true, requires = "prerequisites_only")]
         media_tools_dir: Option<PathBuf>,
+
+        /// Keep this Home out of the shared Community room. Choose this
+        /// before the Home first starts; a Home keeps a network it joined.
+        #[arg(long)]
+        isolated: bool,
     },
 
     /// Manage trusted release sources
@@ -1587,7 +1592,11 @@ async fn run() -> anyhow::Result<()> {
             list,
             prerequisites_only,
             media_tools_dir,
+            isolated,
         } => {
+            if isolated {
+                setup::choose_isolated_collaboration()?;
+            }
             setup::run(
                 profile,
                 with,
diff --git a/elastos/crates/elastos-server/src/notifications.rs b/elastos/crates/elastos-server/src/notifications.rs
index d61fe0453..9012e9490 100644
--- a/elastos/crates/elastos-server/src/notifications.rs
+++ b/elastos/crates/elastos-server/src/notifications.rs
@@ -95,6 +95,40 @@ struct NotificationEntryRecord {
     acted: bool,
     #[serde(default)]
     dismissed: bool,
+    /// The local Profile this entry belongs to. Absent for Home-wide entries.
+    /// Many accounts can share one Home, so an owned entry is shown to, and
+    /// changed by, its owner only.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    owner_profile_did: Option<String>,
+}
+
+impl NotificationEntryRecord {
+    /// Whether `viewer` (the signed-in account's Profile DID, if any) may see
+    /// or change this entry. A direct-message entry without an owner predates
+    /// per-account entries; it is shown to nobody.
+    fn visible_to(&self, viewer: Option<&str>) -> bool {
+        match self.owner_profile_did.as_deref() {
+            Some(owner) => viewer == Some(owner),
+            None => self.kind != DIRECT_MESSAGE_KIND,
+        }
+    }
+
+    fn view(&self) -> NotificationEntryView {
+        NotificationEntryView {
+            id: self.id.clone(),
+            source_app: self.source_app.clone(),
+            kind: self.kind.clone(),
+            title: self.title.clone(),
+            body: self.body.clone(),
+            action_ref: self.action_ref.clone(),
+            created_at: self.created_at,
+            expires_at: self.expires_at,
+            severity: self.severity,
+            read: self.read,
+            acted: self.acted,
+            dismissed: self.dismissed,
+        }
+    }
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize, Default)]
@@ -118,6 +152,8 @@ struct NotificationEventRecord {
     disposition: NotificationEventDisposition,
     #[serde(default)]
     resolution: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    owner_profile_did: Option<String>,
 }
 
 #[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq)]
@@ -128,6 +164,7 @@ enum NotificationEventDisposition {
 }
 
 pub fn sync_room_notifications(data_dir: &Path, summary: &RoomSummary) -> anyhow::Result<()> {
+    let _store = lock_store(data_dir)?;
     let path = notifications_path(data_dir)?;
     let mut store = read_json_or_default::<NotificationStore>(&path)?;
     let existing_ids = store
@@ -198,6 +235,7 @@ pub fn sync_room_notifications(data_dir: &Path, summary: &RoomSummary) -> anyhow
             read: false,
             acted: false,
             dismissed: false,
+            owner_profile_did: None,
         });
         if !existing_ids.contains(&id) {
             record_event(
@@ -218,6 +256,7 @@ pub fn sync_room_notifications(data_dir: &Path, summary: &RoomSummary) -> anyhow
                     created_at: request.requested_at,
                     disposition: NotificationEventDisposition::Appeared,
                     resolution: None,
+                    owner_profile_did: None,
                 },
             )?;
         }
@@ -324,17 +363,23 @@ fn contact_request_notification_id(request_hash: &str) -> String {
 /// this module never invents one.
 pub fn upsert_direct_message_notification(
     data_dir: &Path,
+    owner_profile_did: &str,
     conversation_id: &str,
     sender_display_name: &str,
     now: u64,
 ) -> anyhow::Result<()> {
+    let _store = lock_store(data_dir)?;
     let id = direct_message_notification_id(conversation_id);
     let path = notifications_path(data_dir)?;
     let mut store = read_json_or_default::<NotificationStore>(&path)?;
-    let already_exists = store.entries.iter().any(|entry| entry.id == id);
     if store.schema.trim().is_empty() {
         store.schema = NOTIFICATIONS_SCHEMA.to_string();
     }
+    // Entries from before per-account ownership are shown to nobody; drop them.
+    store
+        .entries
+        .retain(|entry| entry.kind != DIRECT_MESSAGE_KIND || entry.owner_profile_did.is_some());
+    let owner = Some(owner_profile_did.to_string());
     let title = format!("New message from {sender_display_name}");
     let body = format!("{sender_display_name} sent you a message in Chat.");
     let action_ref = Some(NotificationActionRef {
@@ -342,7 +387,11 @@ pub fn upsert_direct_message_notification(
         action_id: direct_message_notification_action_id(conversation_id),
     });
 
-    if let Some(existing) = store.entries.iter_mut().find(|entry| entry.id == id) {
+    if let Some(existing) = store
+        .entries
+        .iter_mut()
+        .find(|entry| entry.id == id && entry.owner_profile_did == owner)
+    {
         existing.source_app = "chat-room".to_string();
         existing.kind = DIRECT_MESSAGE_KIND.to_string();
         existing.title = title;
@@ -369,23 +418,23 @@ pub fn upsert_direct_message_notification(
         read: false,
         acted: false,
         dismissed: false,
+        owner_profile_did: owner.clone(),
     });
-    if !already_exists {
-        record_event(
-            data_dir,
-            NotificationEventRecord {
-                id: format!("appeared:{id}"),
-                notification_id: id,
-                source_app: "chat-room".to_string(),
-                title,
-                body,
-                action_ref,
-                created_at: now,
-                disposition: NotificationEventDisposition::Appeared,
-                resolution: None,
-            },
-        )?;
-    }
+    record_event(
+        data_dir,
+        NotificationEventRecord {
+            id: format!("appeared:{id}"),
+            notification_id: id,
+            source_app: "chat-room".to_string(),
+            title,
+            body,
+            action_ref,
+            created_at: now,
+            disposition: NotificationEventDisposition::Appeared,
+            resolution: None,
+            owner_profile_did: owner,
+        },
+    )?;
     write_json_atomic(&path, &store)
 }
 
@@ -396,50 +445,86 @@ pub fn direct_message_notification_action_id(conversation_id: &str) -> String {
     format!("chat-open-direct:{conversation_id}")
 }
 
+/// This account's direct conversations whose newest message notification
+/// has not been acted on yet, which is when the person opens the conversation.
+pub fn unread_direct_message_conversations(
+    data_dir: &Path,
+    owner_profile_did: &str,
+) -> anyhow::Result<std::collections::HashSet<String>> {
+    let path = notifications_path(data_dir)?;
+    let store = read_json_or_default::<NotificationStore>(&path)?;
+    Ok(store
+        .entries
+        .iter()
+        .filter(|entry| entry.kind == DIRECT_MESSAGE_KIND && !entry.acted)
+        .filter(|entry| entry.visible_to(Some(owner_profile_did)))
+        .filter_map(|entry| entry.id.strip_prefix(DIRECT_MESSAGE_ID_PREFIX))
+        .map(str::to_string)
+        .collect())
+}
+
+/// True for the per-conversation direct message notification entries.
+pub fn is_direct_message_notification_id(id: &str) -> bool {
+    id.starts_with(DIRECT_MESSAGE_ID_PREFIX)
+}
+
 fn direct_message_notification_id(conversation_id: &str) -> String {
     format!("{DIRECT_MESSAGE_ID_PREFIX}{conversation_id}")
 }
 
+/// The Home-wide entries. Entries owned by one account, such as direct
+/// messages, are added per reader by [`project_direct_message_notifications`].
 pub fn load_summary(data_dir: &Path) -> anyhow::Result<NotificationSummary> {
-    let path = notifications_path(data_dir)?;
-    let mut store = read_json_or_default::<NotificationStore>(&path)?;
-    if store.schema.trim().is_empty() {
-        store.schema = NOTIFICATIONS_SCHEMA.to_string();
-    }
+    let entries = live_entries(data_dir, None)?;
+    Ok(summary_from(entries))
+}
 
-    let now = now_ts();
-    store
+/// Adds the signed-in account's own direct-message entries to one Home or
+/// Inbox read response.
+pub fn project_direct_message_notifications(
+    summary: &mut NotificationSummary,
+    data_dir: &Path,
+    owner_profile_did: &str,
+) -> anyhow::Result<()> {
+    summary
         .entries
-        .retain(|entry| entry.expires_at.is_none_or(|expires_at| expires_at > now));
+        .retain(|entry| entry.kind != DIRECT_MESSAGE_KIND);
+    summary.entries.extend(
+        live_entries(data_dir, Some(owner_profile_did))?
+            .into_iter()
+            .filter(|entry| entry.kind == DIRECT_MESSAGE_KIND),
+    );
+    *summary = summary_from(std::mem::take(&mut summary.entries));
+    Ok(())
+}
 
-    let entries = store
+/// Unexpired, unresolved entries `viewer` may see.
+fn live_entries(
+    data_dir: &Path,
+    viewer: Option<&str>,
+) -> anyhow::Result<Vec<NotificationEntryView>> {
+    let path = notifications_path(data_dir)?;
+    let store = read_json_or_default::<NotificationStore>(&path)?;
+    let now = now_ts();
+    Ok(store
         .entries
         .iter()
+        .filter(|entry| entry.expires_at.is_none_or(|expires_at| expires_at > now))
         .filter(|entry| !entry.dismissed && !entry.acted)
-        .map(|entry| NotificationEntryView {
-            id: entry.id.clone(),
-            source_app: entry.source_app.clone(),
-            kind: entry.kind.clone(),
-            title: entry.title.clone(),
-            body: entry.body.clone(),
-            action_ref: entry.action_ref.clone(),
-            created_at: entry.created_at,
-            expires_at: entry.expires_at,
-            severity: entry.severity,
-            read: entry.read,
-            acted: entry.acted,
-            dismissed: entry.dismissed,
-        })
-        .collect::<Vec<_>>();
+        .filter(|entry| entry.visible_to(viewer))
+        .map(NotificationEntryRecord::view)
+        .collect())
+}
 
-    Ok(NotificationSummary {
+fn summary_from(entries: Vec<NotificationEntryView>) -> NotificationSummary {
+    NotificationSummary {
         unread_count: entries.iter().filter(|entry| !entry.read).count(),
         attention_count: entries
             .iter()
             .filter(|entry| entry.severity == NotificationSeverity::Attention)
             .count(),
         entries,
-    })
+    }
 }
 
 pub fn upsert_external_http_request(
@@ -451,6 +536,7 @@ pub fn upsert_external_http_request(
     approve_action_id: &str,
     created_at: u64,
 ) -> anyhow::Result<()> {
+    let _store = lock_store(data_dir)?;
     let id = external_http_request_notification_id(request_id);
     let path = notifications_path(data_dir)?;
     let mut store = read_json_or_default::<NotificationStore>(&path)?;
@@ -491,6 +577,7 @@ pub fn upsert_external_http_request(
         read: false,
         acted: false,
         dismissed: false,
+        owner_profile_did: None,
     });
     if !already_exists {
         record_event(
@@ -508,6 +595,7 @@ pub fn upsert_external_http_request(
                 created_at,
                 disposition: NotificationEventDisposition::Appeared,
                 resolution: None,
+                owner_profile_did: None,
             },
         )?;
     }
@@ -515,14 +603,24 @@ pub fn upsert_external_http_request(
 }
 
 pub fn dismiss_external_http_request(data_dir: &Path, request_id: &str) -> anyhow::Result<bool> {
-    dismiss(data_dir, &external_http_request_notification_id(request_id))
+    dismiss(
+        data_dir,
+        None,
+        &external_http_request_notification_id(request_id),
+    )
 }
 
 fn external_http_request_notification_id(request_id: &str) -> String {
     format!("external-http-request:{request_id}")
 }
 
-pub fn mark_acted_for_action(data_dir: &Path, action_id: &str) -> anyhow::Result<usize> {
+/// Resolves the entries `viewer` may see whose action is `action_id`.
+pub fn mark_acted_for_action(
+    data_dir: &Path,
+    viewer: Option<&str>,
+    action_id: &str,
+) -> anyhow::Result<usize> {
+    let _store = lock_store(data_dir)?;
     let path = notifications_path(data_dir)?;
     let mut store = read_json_or_default::<NotificationStore>(&path)?;
     if store.schema.trim().is_empty() {
@@ -537,6 +635,7 @@ pub fn mark_acted_for_action(data_dir: &Path, action_id: &str) -> anyhow::Result
             .map(|action_ref| action_ref.action_id.as_str())
             == Some(action_id)
             && !entry.acted
+            && entry.visible_to(viewer)
         {
             record_event(
                 data_dir,
@@ -550,6 +649,7 @@ pub fn mark_acted_for_action(data_dir: &Path, action_id: &str) -> anyhow::Result
                     created_at: now_ts(),
                     disposition: NotificationEventDisposition::Resolved,
                     resolution: Some("acted".to_string()),
+                    owner_profile_did: entry.owner_profile_did.clone(),
                 },
             )?;
             entry.acted = true;
@@ -564,7 +664,8 @@ pub fn mark_acted_for_action(data_dir: &Path, action_id: &str) -> anyhow::Result
     Ok(updated)
 }
 
-pub fn mark_read(data_dir: &Path, id: &str) -> anyhow::Result<bool> {
+pub fn mark_read(data_dir: &Path, viewer: Option<&str>, id: &str) -> anyhow::Result<bool> {
+    let _store = lock_store(data_dir)?;
     let path = notifications_path(data_dir)?;
     let mut store = read_json_or_default::<NotificationStore>(&path)?;
     if store.schema.trim().is_empty() {
@@ -573,7 +674,7 @@ pub fn mark_read(data_dir: &Path, id: &str) -> anyhow::Result<bool> {
 
     let mut updated = false;
     for entry in &mut store.entries {
-        if entry.id == id && !entry.read {
+        if entry.id == id && !entry.read && entry.visible_to(viewer) {
             entry.read = true;
             updated = true;
         }
@@ -585,7 +686,8 @@ pub fn mark_read(data_dir: &Path, id: &str) -> anyhow::Result<bool> {
     Ok(updated)
 }
 
-pub fn dismiss(data_dir: &Path, id: &str) -> anyhow::Result<bool> {
+pub fn dismiss(data_dir: &Path, viewer: Option<&str>, id: &str) -> anyhow::Result<bool> {
+    let _store = lock_store(data_dir)?;
     let path = notifications_path(data_dir)?;
     let mut store = read_json_or_default::<NotificationStore>(&path)?;
     if store.schema.trim().is_empty() {
@@ -594,7 +696,7 @@ pub fn dismiss(data_dir: &Path, id: &str) -> anyhow::Result<bool> {
 
     let mut updated = false;
     for entry in &mut store.entries {
-        if entry.id == id && !entry.dismissed {
+        if entry.id == id && !entry.dismissed && entry.visible_to(viewer) {
             record_event(
                 data_dir,
                 NotificationEventRecord {
@@ -607,6 +709,7 @@ pub fn dismiss(data_dir: &Path, id: &str) -> anyhow::Result<bool> {
                     created_at: now_ts(),
                     disposition: NotificationEventDisposition::Resolved,
                     resolution: Some("dismissed".to_string()),
+                    owner_profile_did: entry.owner_profile_did.clone(),
                 },
             )?;
             entry.dismissed = true;
@@ -636,6 +739,17 @@ fn notifications_root_dir(data_dir: &Path) -> anyhow::Result<PathBuf> {
         .context("failed to resolve notifications root")
 }
 
+/// Serializes every read-modify-write of the shared store, so one account's
+/// write never replaces another's fresh entry with an older snapshot. Held by
+/// each public writer; internal helpers such as [`record_event`] run under it.
+fn lock_store(data_dir: &Path) -> anyhow::Result<crate::host_lock::FileLock> {
+    let root = notifications_root_dir(data_dir)?;
+    fs::create_dir_all(&root)?;
+    crate::collaboration_core::lock_owner_only_file(&root.join(".notifications.lock"))
+        .context("failed to lock the notification store")
+}
+
+/// Runs under the caller's [`lock_store`].
 fn record_event(data_dir: &Path, event: NotificationEventRecord) -> anyhow::Result<()> {
     let path = notification_events_path(data_dir)?;
     let mut store = read_json_or_default::<NotificationEventStore>(&path)?;
@@ -719,40 +833,142 @@ mod tests {
         }
     }
 
+    const ALICE: &str = "did:key:z6MkAlice";
+    const BOB: &str = "did:key:z6MkBob";
+
+    fn owned_summary(data: &Path, owner: &str) -> NotificationSummary {
+        let mut summary = load_summary(data).unwrap();
+        project_direct_message_notifications(&mut summary, data, owner).unwrap();
+        summary
+    }
+
     #[test]
-    fn sync_room_notifications_creates_attention_entry() {
+    fn direct_message_notifications_belong_to_one_account() {
         let tmp = tempfile::tempdir().unwrap();
-        sync_room_notifications(tmp.path(), &sample_summary()).unwrap();
-        let summary = load_summary(tmp.path()).unwrap();
-        assert_eq!(summary.unread_count, 1);
-        assert_eq!(summary.attention_count, 1);
-        assert_eq!(summary.entries[0].source_app, "chat-room");
-        assert_eq!(summary.entries[0].id, "room-access-request:req-1");
-        assert_eq!(summary.entries[0].kind, ROOM_ACCESS_REQUEST_KIND);
+        upsert_direct_message_notification(tmp.path(), ALICE, "direct:alice-x", "Xan", now_ts())
+            .unwrap();
+        upsert_direct_message_notification(tmp.path(), BOB, "direct:bob-y", "Yan", now_ts())
+            .unwrap();
+
+        // Each account sees only its own dot and Inbox entry.
         assert_eq!(
-            summary.entries[0]
-                .action_ref
-                .as_ref()
-                .map(|action_ref| action_ref.action_id.as_str()),
-            Some("room-approve-request:req-1")
+            unread_direct_message_conversations(tmp.path(), ALICE).unwrap(),
+            ["direct:alice-x".to_string()].into()
         );
+        assert_eq!(
+            unread_direct_message_conversations(tmp.path(), BOB).unwrap(),
+            ["direct:bob-y".to_string()].into()
+        );
+        assert!(load_summary(tmp.path()).unwrap().entries.is_empty());
+        let alice = owned_summary(tmp.path(), ALICE);
+        assert_eq!(alice.entries.len(), 1);
+        assert_eq!(alice.unread_count, 1);
+        assert_eq!(alice.entries[0].title, "New message from Xan");
+
+        // Neither another account nor the Home CLI can change Alice's entry.
+        let alice_id = direct_message_notification_id("direct:alice-x");
+        let alice_action = direct_message_notification_action_id("direct:alice-x");
+        for viewer in [Some(BOB), None] {
+            assert!(!mark_read(tmp.path(), viewer, &alice_id).unwrap());
+            assert!(!dismiss(tmp.path(), viewer, &alice_id).unwrap());
+            assert_eq!(
+                mark_acted_for_action(tmp.path(), viewer, &alice_action).unwrap(),
+                0
+            );
+        }
+        assert_eq!(owned_summary(tmp.path(), ALICE).unread_count, 1);
+
+        // Alice opening her conversation clears only her entry.
+        assert_eq!(
+            mark_acted_for_action(tmp.path(), Some(ALICE), &alice_action).unwrap(),
+            1
+        );
+        assert!(unread_direct_message_conversations(tmp.path(), ALICE)
+            .unwrap()
+            .is_empty());
+        assert_eq!(owned_summary(tmp.path(), BOB).unread_count, 1);
     }
 
     #[test]
-    fn sync_room_notifications_prunes_stale_pair_requests() {
+    fn concurrent_writes_from_many_accounts_keep_every_alert() {
         let tmp = tempfile::tempdir().unwrap();
-        sync_room_notifications(tmp.path(), &sample_summary()).unwrap();
-        let empty = RoomSummary::default();
-        sync_room_notifications(tmp.path(), &empty).unwrap();
-        let summary = load_summary(tmp.path()).unwrap();
-        assert!(summary.entries.is_empty());
+        let accounts = 12;
+        let per_account = 5;
+        std::thread::scope(|scope| {
+            for account in 0..accounts {
+                let data = tmp.path();
+                scope.spawn(move || {
+                    let owner = format!("did:key:z6MkAccount{account}");
+                    for index in 0..per_account {
+                        upsert_direct_message_notification(
+                            data,
+                            &owner,
+                            &format!("direct:{account}-{index}"),
+                            "Peer",
+                            now_ts(),
+                        )
+                        .unwrap();
+                        // Reads and clears by another account race the writes.
+                        mark_read(data, Some(&owner), "room-access-request:none").unwrap();
+                    }
+                });
+            }
+        });
+        for account in 0..accounts {
+            assert_eq!(
+                unread_direct_message_conversations(
+                    tmp.path(),
+                    &format!("did:key:z6MkAccount{account}")
+                )
+                .unwrap()
+                .len(),
+                per_account
+            );
+        }
+    }
+
+    #[test]
+    fn a_direct_message_entry_without_an_owner_is_shown_to_nobody() {
+        let tmp = tempfile::tempdir().unwrap();
+        let path = notifications_path(tmp.path()).unwrap();
+        write_json_atomic(
+            &path,
+            &serde_json::json!({
+                "schema": NOTIFICATIONS_SCHEMA,
+                "entries": [{
+                    "id": direct_message_notification_id("direct:legacy"),
+                    "source_app": "chat-room",
+                    "kind": DIRECT_MESSAGE_KIND,
+                    "title": "New message from Old",
+                    "body": "Old sent you a message in Chat.",
+                    "created_at": now_ts(),
+                    "severity": "attention",
+                }],
+            }),
+        )
+        .unwrap();
+        for viewer in [ALICE, BOB] {
+            assert!(owned_summary(tmp.path(), viewer).entries.is_empty());
+            assert!(unread_direct_message_conversations(tmp.path(), viewer)
+                .unwrap()
+                .is_empty());
+        }
+        assert!(load_summary(tmp.path()).unwrap().entries.is_empty());
+
+        // The next message for any account drops it.
+        upsert_direct_message_notification(tmp.path(), ALICE, "direct:new", "New", now_ts())
+            .unwrap();
+        let store = read_json_or_default::<NotificationStore>(&path).unwrap();
+        assert_eq!(store.entries.len(), 1);
+        assert_eq!(store.entries[0].owner_profile_did.as_deref(), Some(ALICE));
     }
 
     #[test]
     fn mark_acted_for_action_hides_notification_entry() {
         let tmp = tempfile::tempdir().unwrap();
         sync_room_notifications(tmp.path(), &sample_summary()).unwrap();
-        let updated = mark_acted_for_action(tmp.path(), "room-approve-request:req-1").unwrap();
+        let updated =
+            mark_acted_for_action(tmp.path(), None, "room-approve-request:req-1").unwrap();
         assert_eq!(updated, 1);
         let summary = load_summary(tmp.path()).unwrap();
         assert!(summary.entries.is_empty());
@@ -762,7 +978,7 @@ mod tests {
     fn mark_read_updates_entry_state() {
         let tmp = tempfile::tempdir().unwrap();
         sync_room_notifications(tmp.path(), &sample_summary()).unwrap();
-        let updated = mark_read(tmp.path(), "room-access-request:req-1").unwrap();
+        let updated = mark_read(tmp.path(), None, "room-access-request:req-1").unwrap();
         assert!(updated);
         let summary = load_summary(tmp.path()).unwrap();
         assert_eq!(summary.unread_count, 0);
@@ -773,7 +989,7 @@ mod tests {
     fn dismiss_hides_entry() {
         let tmp = tempfile::tempdir().unwrap();
         sync_room_notifications(tmp.path(), &sample_summary()).unwrap();
-        let updated = dismiss(tmp.path(), "room-access-request:req-1").unwrap();
+        let updated = dismiss(tmp.path(), None, "room-access-request:req-1").unwrap();
         assert!(updated);
         let summary = load_summary(tmp.path()).unwrap();
         assert!(summary.entries.is_empty());
@@ -838,8 +1054,8 @@ mod tests {
     fn direct_message_notification_resolves_on_read_and_resurfaces_on_new_mail() {
         let tmp = tempfile::tempdir().unwrap();
         let conversation = "direct:sha256:abc";
-        upsert_direct_message_notification(tmp.path(), conversation, "Alice", 100).unwrap();
-        let summary = load_summary(tmp.path()).unwrap();
+        upsert_direct_message_notification(tmp.path(), ALICE, conversation, "Alice", 100).unwrap();
+        let summary = owned_summary(tmp.path(), ALICE);
         assert_eq!(summary.entries.len(), 1);
         assert_eq!(summary.entries[0].kind, DIRECT_MESSAGE_KIND);
         assert_eq!(summary.entries[0].id, "direct-message:direct:sha256:abc");
@@ -854,21 +1070,23 @@ mod tests {
         );
 
         // A second message keeps one entry per conversation.
-        upsert_direct_message_notification(tmp.path(), conversation, "Alice", 101).unwrap();
-        assert_eq!(load_summary(tmp.path()).unwrap().entries.len(), 1);
+        upsert_direct_message_notification(tmp.path(), ALICE, conversation, "Alice", 101).unwrap();
+        assert_eq!(owned_summary(tmp.path(), ALICE).entries.len(), 1);
 
         // Reading the conversation resolves it.
         let acted = mark_acted_for_action(
             tmp.path(),
+            Some(ALICE),
             &direct_message_notification_action_id(conversation),
         )
         .unwrap();
         assert_eq!(acted, 1);
-        assert!(load_summary(tmp.path()).unwrap().entries.is_empty());
+        assert!(owned_summary(tmp.path(), ALICE).entries.is_empty());
 
         // New mail after a read resurfaces the same entry, unread again.
-        upsert_direct_message_notification(tmp.path(), conversation, "Alice Renamed", 102).unwrap();
-        let resurfaced = load_summary(tmp.path()).unwrap();
+        upsert_direct_message_notification(tmp.path(), ALICE, conversation, "Alice Renamed", 102)
+            .unwrap();
+        let resurfaced = owned_summary(tmp.path(), ALICE);
         assert_eq!(resurfaced.entries.len(), 1);
         assert!(!resurfaced.entries[0].read);
         assert_eq!(
@@ -910,7 +1128,7 @@ mod tests {
     fn dismiss_records_resolved_event() {
         let tmp = tempfile::tempdir().unwrap();
         sync_room_notifications(tmp.path(), &sample_summary()).unwrap();
-        dismiss(tmp.path(), "room-access-request:req-1").unwrap();
+        dismiss(tmp.path(), None, "room-access-request:req-1").unwrap();
 
         let events: NotificationEventStore =
             read_json_or_default(&notification_events_path(tmp.path()).unwrap()).unwrap();
diff --git a/elastos/crates/elastos-server/src/release_publication.rs b/elastos/crates/elastos-server/src/release_publication.rs
index ed870c3a4..9e1261d34 100644
--- a/elastos/crates/elastos-server/src/release_publication.rs
+++ b/elastos/crates/elastos-server/src/release_publication.rs
@@ -230,6 +230,9 @@ impl Publication {
                     Some("model-catalog.json"),
                 )?;
             }
+            if let Some(network) = component.get("collaboration_network") {
+                admit_collaboration_network(&artifact_directory, &names, &mut artifacts, network)?;
+            }
         }
         ensure!(
             !artifacts.is_empty() && artifacts.len() <= MAX_FILES,
@@ -669,6 +672,48 @@ fn admit_descriptor(
     Ok(())
 }
 
+/// A manifest pin names one release file by its raw CID; the file is served
+/// beside the components manifest under its fixed name.
+fn admit_pinned_file(
+    dir: &File,
+    names: &BTreeSet<String>,
+    artifacts: &mut BTreeMap<String, Artifact>,
+    pin: &Value,
+    name: &str,
+) -> Result<Vec<u8>> {
+    let cid = text(pin, "head_cid")?;
+    ensure!(
+        checked_cid(cid)?.codec() == 0x55,
+        "{name} pin must be a raw CID"
+    );
+    let file = regular(dir, name, MAX_COMPONENTS)?;
+    let bytes = bounded_bytes(&file, MAX_COMPONENTS)?;
+    crate::update::verify_release_metadata_cid(cid, &bytes)?;
+    let descriptor = serde_json::json!({"cid":cid,"sha256":digest(&bytes),"size":bytes.len()});
+    admit_descriptor(dir, names, artifacts, &descriptor, Some(name))?;
+    Ok(bytes)
+}
+
+/// The release network is checked as every Home checks it before joining.
+fn admit_collaboration_network(
+    dir: &File,
+    names: &BTreeSet<String>,
+    artifacts: &mut BTreeMap<String, Artifact>,
+    pin: &Value,
+) -> Result<()> {
+    use crate::collaboration_release_network as release_network;
+    let bytes = admit_pinned_file(
+        dir,
+        names,
+        artifacts,
+        pin,
+        release_network::RELEASE_COLLABORATION_NETWORK_FILE,
+    )?;
+    let pin: release_network::CollaborationNetworkPin =
+        serde_json::from_value(pin.clone()).context("collaboration network pin refused")?;
+    release_network::verify_release_network_bytes(&pin, &bytes)
+}
+
 fn component_refs(
     value: &Value,
     dir: &File,
@@ -1094,6 +1139,22 @@ mod tests {
         fn open(&self) -> Result<Publication> {
             Publication::open_flat(&self.input, &self.did)
         }
+
+        fn write_components(&mut self, components: &Value) {
+            let bytes = serde_json::to_vec(components).unwrap();
+            std::fs::write(self.input.join("components-aarch64-darwin.json"), &bytes).unwrap();
+            self.release["platforms"]["aarch64-darwin"]["components"] = descriptor(&bytes);
+            self.write_signed();
+        }
+
+        fn pin_network(&mut self, pin: Value) {
+            let mut components: Value = serde_json::from_slice(
+                &std::fs::read(self.input.join("components-aarch64-darwin.json")).unwrap(),
+            )
+            .unwrap();
+            components["collaboration_network"] = pin;
+            self.write_components(&components);
+        }
     }
 
     #[test]
@@ -1471,6 +1532,58 @@ mod tests {
         }
     }
 
+    fn network_pin(bytes: &[u8]) -> Value {
+        let config: Value = serde_json::from_slice(bytes).unwrap();
+        json!({
+            "head_cid": raw_cid(bytes),
+            "expected_network_id": config["expected_network_id"],
+            "trusted_profile_signer_dids": config["trusted_profile_signer_dids"],
+        })
+    }
+
+    #[test]
+    fn pinned_collaboration_network_is_admitted_only_with_its_exact_file() {
+        use crate::collaboration_release_network::RELEASE_COLLABORATION_NETWORK_FILE as NETWORK;
+        let (_signer, chain) =
+            crate::collaboration_release_network::tests::signed_profile_chain_config(1);
+        let (_other, other) =
+            crate::collaboration_release_network::tests::signed_profile_chain_config(1);
+        let mut fixture = PublicPublicationFixture::new();
+        fixture.pin_network(network_pin(&chain[0]));
+        std::fs::write(fixture.input.join(NETWORK), &chain[0]).unwrap();
+        let publication = fixture.open().unwrap();
+        let admitted = publication
+            .artifacts()
+            .iter()
+            .find(|artifact| artifact.name == NETWORK)
+            .unwrap();
+        assert_eq!(admitted.cid, raw_cid(&chain[0]));
+        assert_eq!(
+            publication.read_verified_artifact(NETWORK).unwrap(),
+            chain[0]
+        );
+
+        let mut another_network = network_pin(&chain[0]);
+        another_network["expected_network_id"] = json!("another-network");
+        for (case, pin, file) in [
+            ("missing file", network_pin(&chain[0]), None),
+            ("other bytes", network_pin(&chain[0]), Some(&other[0])),
+            ("other network ID", another_network, Some(&chain[0])),
+        ] {
+            let mut fixture = PublicPublicationFixture::new();
+            fixture.pin_network(pin);
+            if let Some(file) = file {
+                std::fs::write(fixture.input.join(NETWORK), file).unwrap();
+            }
+            assert!(fixture.open().is_err(), "{case}");
+        }
+
+        let fixture = PublicPublicationFixture::new();
+        std::fs::write(fixture.input.join(NETWORK), &chain[0]).unwrap();
+        let error = fixture.open().err().unwrap().to_string();
+        assert!(error.contains("unadvertised"), "{error}");
+    }
+
     #[test]
     fn held_file_and_directory_fds_defeat_path_replacement() {
         let fixture = PublicPublicationFixture::new();
diff --git a/elastos/crates/elastos-server/src/room_service.rs b/elastos/crates/elastos-server/src/room_service.rs
index ffdf142e0..8931272cb 100644
--- a/elastos/crates/elastos-server/src/room_service.rs
+++ b/elastos/crates/elastos-server/src/room_service.rs
@@ -82,6 +82,10 @@ pub struct RoomSummary {
     pub browser_access_block_reason: Option<String>,
     #[serde(default)]
     pub transport: RoomTransportView,
+    /// Sequence number of the newest room object, so Home can signal new
+    /// messages without reading them.
+    #[serde(default)]
+    pub latest_seq: u64,
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
@@ -870,6 +874,7 @@ pub fn load_summary(data_dir: &Path) -> anyhow::Result<RoomSummary> {
             browser_access_allowed: true,
             browser_access_block_reason: None,
             transport: RoomTransportView::default(),
+            latest_seq: state.next_seq.saturating_sub(1),
         })
     })
 }
diff --git a/elastos/crates/elastos-server/src/setup.rs b/elastos/crates/elastos-server/src/setup.rs
index c3227a36b..53e0a5401 100644
--- a/elastos/crates/elastos-server/src/setup.rs
+++ b/elastos/crates/elastos-server/src/setup.rs
@@ -43,6 +43,12 @@ pub struct ComponentsManifest {
     /// unchanged; catalog entries cannot supply their own trust configuration.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub model_catalog: Option<ModelCatalogConfig>,
+
+    /// Release-pinned default collaboration network. Absence leaves the
+    /// Home's collaboration configuration unchanged.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub collaboration_network:
+        Option<crate::collaboration_release_network::CollaborationNetworkPin>,
 }
 
 #[derive(Deserialize, Serialize, Clone)]
@@ -348,7 +354,7 @@ async fn run_with_data_dir(
     }
 
     if let Some(metadata) = &signed_setup {
-        metadata.install(&data_dir)?;
+        metadata.install(&data_dir, &manifest)?;
     }
 
     prepare_selected_component_prerequisites(
@@ -552,6 +558,7 @@ async fn run_with_data_dir(
     } else {
         let stamped = write_installed_manifest(&data_dir, &manifest, &platform)?;
         install_signed_model_catalog(&data_dir, &manifest, &manifest_path)?;
+        install_release_collaboration_network(&data_dir, &manifest, &manifest_path)?;
         stamped
     };
 
@@ -577,11 +584,12 @@ const COMPONENTS_MANIFEST_ENV: &str = "ELASTOS_COMPONENTS_MANIFEST";
 struct SignedSetupMetadata {
     components: Vec<u8>,
     catalog: Option<Vec<u8>>,
+    network: Option<Vec<u8>>,
 }
 
 impl SignedSetupMetadata {
-    fn install(&self, data_dir: &Path) -> anyhow::Result<()> {
-        // Admission of both inputs precedes the first metadata or component write.
+    fn install(&self, data_dir: &Path, manifest: &ComponentsManifest) -> anyhow::Result<()> {
+        // Admission of every input precedes the first metadata or component write.
         if let Some(bytes) = &self.catalog {
             atomic_write_file(&data_dir.join(MODEL_CATALOG_FILE), bytes)?;
             #[cfg(unix)]
@@ -593,6 +601,13 @@ impl SignedSetupMetadata {
                 )?;
             }
         }
+        report_release_network(
+            crate::collaboration_release_network::install_fetched_release_network(
+                data_dir,
+                manifest.collaboration_network.as_ref(),
+                self.network.as_deref(),
+            )?,
+        );
         atomic_write_file(&data_dir.join("components.json"), &self.components)
     }
 }
@@ -651,11 +666,32 @@ async fn admit_installed_setup_metadata(
         } else {
             None
         };
+        // The pinned CID names exact bytes; the release name could serve
+        // newer ones, so setup fetches by CID as update does.
+        let network = crate::collaboration_release_network::fetch_release_network(
+            data_dir,
+            manifest.collaboration_network.as_ref(),
+            |pin| {
+                let cid = pin.head_cid.clone();
+                let client = &client;
+                async move {
+                    client
+                        .fetch_content_bounded(
+                            &cid,
+                            None,
+                            crate::collaboration_startup::MAX_STARTUP_CONFIG_BYTES,
+                        )
+                        .await
+                }
+            },
+        )
+        .await?;
         Ok::<_, anyhow::Error>((
             manifest,
             SignedSetupMetadata {
                 components,
                 catalog,
+                network,
             },
         ))
     }
@@ -2643,6 +2679,37 @@ fn resolve_model_catalog_source(manifest_path: &Path, dest: &Path) -> anyhow::Re
     );
 }
 
+/// Records the person's choice to keep this Home out of the shared
+/// Community room. Setup then leaves the release network uninstalled.
+pub fn choose_isolated_collaboration() -> anyhow::Result<()> {
+    crate::collaboration_release_network::choose_isolated(&data_dir()?)
+}
+
+/// Joins the release-pinned Community network unless this Home is isolated.
+fn install_release_collaboration_network(
+    data_dir: &Path,
+    manifest: &ComponentsManifest,
+    manifest_path: &Path,
+) -> anyhow::Result<()> {
+    use crate::collaboration_release_network as release_network;
+    let release_copy = manifest_path
+        .parent()
+        .ok_or_else(|| anyhow::anyhow!("components manifest has no parent directory"))?
+        .join(release_network::RELEASE_COLLABORATION_NETWORK_FILE);
+    report_release_network(release_network::install_release_network(
+        data_dir,
+        manifest.collaboration_network.as_ref(),
+        &release_copy,
+    )?);
+    Ok(())
+}
+
+fn report_release_network(outcome: crate::collaboration_release_network::ReleaseNetworkOutcome) {
+    if let Some(line) = outcome.summary_line() {
+        println!("{line}");
+    }
+}
+
 pub(crate) fn install_signed_model_catalog(
     data_dir: &Path,
     manifest: &ComponentsManifest,
@@ -6098,6 +6165,7 @@ pub(crate) mod tests {
         fs::write(&binary_path, b"object-provider").unwrap();
         let manifest = ComponentsManifest {
             model_catalog: None,
+            collaboration_network: None,
             external: HashMap::new(),
             capsules: HashMap::new(),
             profiles: HashMap::new(),
@@ -6187,12 +6255,14 @@ pub(crate) mod tests {
 
         let old_manifest = ComponentsManifest {
             model_catalog: None,
+            collaboration_network: None,
             external: HashMap::from([("object-provider".to_string(), old_component)]),
             capsules: HashMap::new(),
             profiles: HashMap::new(),
         };
         let new_manifest = ComponentsManifest {
             model_catalog: None,
+            collaboration_network: None,
             external: HashMap::from([("object-provider".to_string(), new_component)]),
             capsules: HashMap::new(),
             profiles: HashMap::new(),
@@ -6219,12 +6289,14 @@ pub(crate) mod tests {
         old_component.capsule_metadata = None;
         let old_manifest = ComponentsManifest {
             model_catalog: None,
+            collaboration_network: None,
             external: HashMap::from([("object-provider".to_string(), old_component)]),
             capsules: HashMap::new(),
             profiles: HashMap::new(),
         };
         let new_manifest = ComponentsManifest {
             model_catalog: None,
+            collaboration_network: None,
             external: HashMap::from([("object-provider".to_string(), new_component)]),
             capsules: HashMap::new(),
             profiles: HashMap::new(),
@@ -6458,6 +6530,7 @@ pub(crate) mod tests {
         };
         let manifest = ComponentsManifest {
             model_catalog: None,
+            collaboration_network: None,
             external: HashMap::new(),
             capsules: HashMap::new(),
             profiles: HashMap::new(),
@@ -7338,6 +7411,30 @@ pub(crate) mod tests {
         }
     }
 
+    #[tokio::test]
+    async fn installed_setup_fetches_the_pinned_network_by_cid_and_joins_it() {
+        signed_setup_carrier_fixture("network fresh", false).await;
+    }
+
+    #[tokio::test]
+    async fn installed_setup_of_an_isolated_home_fetches_no_network() {
+        signed_setup_carrier_fixture("network isolated", false).await;
+    }
+
+    #[tokio::test]
+    async fn installed_setup_refuses_a_mismatched_network_without_writes() {
+        for existing in [false, true] {
+            signed_setup_carrier_fixture("network hash", existing).await;
+        }
+    }
+
+    #[tokio::test]
+    async fn installed_setup_refuses_oversized_network_before_body_without_writes() {
+        for existing in [false, true] {
+            signed_setup_carrier_fixture("network size", existing).await;
+        }
+    }
+
     #[tokio::test]
     async fn installed_setup_refuses_pending_or_busy_writer_before_fetch() {
         for case in ["pending journal", "writer busy"] {
@@ -7624,7 +7721,11 @@ pub(crate) mod tests {
             "elastos.model.catalog.v1",
             if case == "catalog signer" { 218 } else { 217 },
         );
-        let components = format!(
+        let network = case
+            .starts_with("network")
+            .then(|| crate::collaboration_release_network::tests::signed_profile_chain_config(1).1)
+            .map(|mut chain| chain.remove(0));
+        let mut components = format!(
             "{{\n \"publisher_extension\":true, \"external\":{{\"effect\":{{
             \"install_path\":\"bin/effect\",\"platforms\":{{\"*\":{{
                 \"release_path\":\"effect\", \"cid\":\"{}\", \"checksum\":\"sha256:{:x}\"
@@ -7637,6 +7738,16 @@ pub(crate) mod tests {
             publisher
         )
         .into_bytes();
+        if let Some(network) = &network {
+            let config: serde_json::Value = serde_json::from_slice(network).unwrap();
+            let mut manifest: serde_json::Value = serde_json::from_slice(&components).unwrap();
+            manifest["collaboration_network"] = serde_json::json!({
+                "head_cid": catalog_head_cid(network).unwrap(),
+                "expected_network_id": config["expected_network_id"],
+                "trusted_profile_signer_dids": config["trusted_profile_signer_dids"],
+            });
+            components = serde_json::to_vec(&manifest).unwrap();
+        }
         let descriptor = |bytes: &[u8]| {
             serde_json::json!({
                 "cid": catalog_head_cid(bytes).unwrap(),
@@ -7701,6 +7812,9 @@ pub(crate) mod tests {
             fs::write(data.join("components.json"), b"previous components").unwrap();
             fs::write(data.join(MODEL_CATALOG_FILE), b"previous catalog").unwrap();
         }
+        if case == "network isolated" {
+            crate::collaboration_release_network::choose_isolated(&data).unwrap();
+        }
         if case == "pending journal" {
             fs::write(
                 data.join(".elastos.update-journal.json"),
@@ -7723,7 +7837,7 @@ pub(crate) mod tests {
         if case == "catalog hash" {
             served_catalog.push(b'\n');
         }
-        let files = Arc::new(HashMap::from([
+        let mut files = HashMap::from([
             (
                 format!(
                     "components-{}.json",
@@ -7733,12 +7847,27 @@ pub(crate) mod tests {
             ),
             (MODEL_CATALOG_FILE.to_owned(), served_catalog),
             ("effect".to_owned(), b"Carrier component".to_vec()),
-        ]));
+        ]);
+        if let Some(network) = &network {
+            let mut served_network = network.clone();
+            if case == "network hash" {
+                served_network.push(b'\n');
+            }
+            files.insert(
+                crate::collaboration_release_network::RELEASE_COLLABORATION_NETWORK_FILE.to_owned(),
+                served_network,
+            );
+        }
+        let files = Arc::new(files);
         let requests = Arc::new(AtomicUsize::new(0));
         let observed = requests.clone();
         let endpoint = server.clone();
         let writer_parent = data.clone();
         let oversized_catalog = case == "catalog size";
+        let oversized_network = case == "network size";
+        let network_cid = network
+            .as_ref()
+            .map(|bytes| catalog_head_cid(bytes).unwrap());
         let effect_cid = catalog_head_cid(b"Carrier component").unwrap();
         let serving = tokio::spawn(async move {
             while let Some(incoming) = endpoint.accept().await {
@@ -7752,12 +7881,24 @@ pub(crate) mod tests {
                         .await
                         .unwrap();
                     let mut request: serde_json::Value = serde_json::from_str(&request).unwrap();
-                    // The signed component CID is fetched by CID, not by its release name.
+                    // Signed component and network pins select content by CID.
                     if request["op"] == "content_fetch" {
-                        assert_eq!(request["cid"], effect_cid);
-                        request["path"] = "effect".into();
+                        if request["cid"] == effect_cid {
+                            request["path"] = "effect".into();
+                        } else {
+                            assert_eq!(request["cid"].as_str(), network_cid.as_deref());
+                            assert!(request.get("path").is_none(), "network fetch used a name");
+                            request["path"] =
+                                crate::collaboration_release_network::RELEASE_COLLABORATION_NETWORK_FILE
+                                    .into();
+                        }
                     } else {
                         assert_ne!(request["path"], "effect", "signed CID fetched by name");
+                        assert_ne!(
+                            request["path"],
+                            crate::collaboration_release_network::RELEASE_COLLABORATION_NETWORK_FILE,
+                            "signed network CID fetched by name"
+                        );
                     }
                     assert!(
                         crate::install_transaction::InstallationGuard::acquire(&writer_parent)
@@ -7776,6 +7917,20 @@ pub(crate) mod tests {
                         let _ = send.stopped().await;
                         continue;
                     }
+                    if oversized_network
+                        && request["path"]
+                            == crate::collaboration_release_network::RELEASE_COLLABORATION_NETWORK_FILE
+                    {
+                        // Refuse the header without waiting for an oversized body.
+                        send.write_all(
+                            &((crate::collaboration_startup::MAX_STARTUP_CONFIG_BYTES as u64) + 1)
+                                .to_be_bytes(),
+                        )
+                        .await
+                        .unwrap();
+                        let _ = send.stopped().await;
+                        continue;
+                    }
                     let bytes = &files[request["path"].as_str().unwrap()];
                     send.write_all(&(bytes.len() as u64).to_be_bytes())
                         .await
@@ -7791,7 +7946,7 @@ pub(crate) mod tests {
         server.close().await;
         let before = serving.await.unwrap();
         drop(held);
-        if case == "fresh" {
+        if matches!(case, "fresh" | "network fresh" | "network isolated") {
             result.unwrap();
             assert_eq!(fs::read(data.join("components.json")).unwrap(), components);
             assert_eq!(fs::read(data.join(MODEL_CATALOG_FILE)).unwrap(), catalog);
@@ -7799,20 +7954,37 @@ pub(crate) mod tests {
                 fs::read(data.join("bin/effect")).unwrap(),
                 b"Carrier component"
             );
-            assert_eq!(requests.load(Ordering::SeqCst), 3);
+            let config = data.join(crate::collaboration_startup::COLLABORATION_STARTUP_CONFIG_FILE);
+            if case == "network fresh" {
+                assert_eq!(fs::read(&config).unwrap(), network.unwrap());
+                assert_eq!(
+                    fs::metadata(&config).unwrap().permissions().mode() & 0o777,
+                    0o600
+                );
+                assert_eq!(requests.load(Ordering::SeqCst), 4);
+            } else {
+                assert!(fs::symlink_metadata(&config).is_err(), "{case}");
+                assert_eq!(requests.load(Ordering::SeqCst), 3);
+            }
         } else {
             assert!(result.is_err(), "{case}");
             assert_eq!(signed_setup_snapshot(&data), before, "{case}");
-            if case == "catalog size" {
+            if matches!(case, "catalog size" | "network size") {
+                let bound = if case == "catalog size" {
+                    MAX_MODEL_CATALOG_BYTES
+                } else {
+                    crate::collaboration_startup::MAX_STARTUP_CONFIG_BYTES
+                };
                 let error = format!("{:#}", result.unwrap_err());
                 assert!(
-                    error.contains(&format!("exceeds its {MAX_MODEL_CATALOG_BYTES}-byte bound")),
+                    error.contains(&format!("exceeds its {bound}-byte bound")),
                     "{error}"
                 );
             }
             let expected_requests = match case {
                 "component hash" => 1,
                 "catalog hash" | "catalog signer" | "catalog size" => 2,
+                "network hash" | "network size" => 3,
                 "head signer" | "release signer" | "pending journal" | "writer busy" => 0,
                 _ => panic!("unknown refusal case"),
             };
diff --git a/elastos/crates/elastos-server/src/supervisor.rs b/elastos/crates/elastos-server/src/supervisor.rs
index 06e086fad..14b2774d8 100644
--- a/elastos/crates/elastos-server/src/supervisor.rs
+++ b/elastos/crates/elastos-server/src/supervisor.rs
@@ -1679,6 +1679,7 @@ mod tests {
             data_dir.to_path_buf(),
             ComponentsManifest {
                 model_catalog: None,
+                collaboration_network: None,
                 external: std::collections::HashMap::new(),
                 capsules,
                 profiles: std::collections::HashMap::new(),
@@ -1973,6 +1974,7 @@ mod tests {
             tempfile::tempdir().unwrap().keep(),
             ComponentsManifest {
                 model_catalog: None,
+                collaboration_network: None,
                 external: std::collections::HashMap::new(),
                 capsules: std::collections::HashMap::new(),
                 profiles: std::collections::HashMap::new(),
@@ -2121,6 +2123,7 @@ mod tests {
             data_dir.to_path_buf(),
             ComponentsManifest {
                 model_catalog: None,
+                collaboration_network: None,
                 external,
                 capsules: std::collections::HashMap::new(),
                 profiles: std::collections::HashMap::new(),
@@ -2177,6 +2180,7 @@ mod tests {
             data_dir.to_path_buf(),
             ComponentsManifest {
                 model_catalog: None,
+                collaboration_network: None,
                 external,
                 capsules: std::collections::HashMap::new(),
                 profiles: std::collections::HashMap::new(),
@@ -2221,6 +2225,7 @@ mod tests {
             data_dir.to_path_buf(),
             ComponentsManifest {
                 model_catalog: None,
+                collaboration_network: None,
                 external,
                 capsules: std::collections::HashMap::new(),
                 profiles: std::collections::HashMap::new(),
@@ -2299,6 +2304,7 @@ mod tests {
             data_dir.to_path_buf(),
             ComponentsManifest {
                 model_catalog: None,
+                collaboration_network: None,
                 external: std::collections::HashMap::new(),
                 capsules,
                 profiles: std::collections::HashMap::new(),
@@ -2344,6 +2350,7 @@ mod tests {
             data_dir.to_path_buf(),
             ComponentsManifest {
                 model_catalog: None,
+                collaboration_network: None,
                 external: std::collections::HashMap::new(),
                 capsules,
                 profiles: std::collections::HashMap::new(),
diff --git a/elastos/crates/elastos-server/src/update.rs b/elastos/crates/elastos-server/src/update.rs
index 6d8f07a07..a9ed6819c 100644
--- a/elastos/crates/elastos-server/src/update.rs
+++ b/elastos/crates/elastos-server/src/update.rs
@@ -1278,6 +1278,45 @@ pub(crate) fn verify_release_binding(
     Ok(())
 }
 
+/// Fetches the release-pinned Community network by its pinned CID with the
+/// other release downloads. A Home that keeps its own collaboration state
+/// fetches nothing.
+async fn fetch_release_network_for_update(
+    data_dir: &Path,
+    manifest: &crate::setup::ComponentsManifest,
+    fetch_fn: &FetchFn,
+    ordered_gateways: &[String],
+) -> anyhow::Result<Option<Vec<u8>>> {
+    crate::collaboration_release_network::fetch_release_network(
+        data_dir,
+        manifest.collaboration_network.as_ref(),
+        |pin| fetch_fn(pin.head_cid.clone(), ordered_gateways.to_vec()),
+    )
+    .await
+}
+
+/// The CLI update and Home's System update join the release-pinned network.
+/// The offline hop without a restart owner admits only an unchanged pin.
+fn joins_release_network(apply_mode: ApplyMode, has_restart_owner: bool) -> bool {
+    apply_mode == ApplyMode::Normal || has_restart_owner
+}
+
+/// Joins or advances the release-pinned Community network from bytes fetched
+/// before Home stopped or the binary changed.
+fn join_release_network(
+    data_dir: &Path,
+    manifest: &crate::setup::ComponentsManifest,
+    fetched: Option<&[u8]>,
+) -> anyhow::Result<crate::collaboration_release_network::ReleaseNetworkOutcome> {
+    let outcome = crate::collaboration_release_network::install_fetched_release_network(
+        data_dir,
+        manifest.collaboration_network.as_ref(),
+        fetched,
+    )?;
+    tracing::info!(?outcome, "release collaboration network applied");
+    Ok(outcome)
+}
+
 /// Execute upgrade from a verified release head.
 #[allow(clippy::too_many_arguments)]
 #[cfg(test)]
@@ -1594,15 +1633,28 @@ async fn run_upgrade_with_restart(
         crate::installed_release::admit_descriptor(comp_info, comp_sha256, comp_data.len() as u64)
     })())?;
     // These bytes already match the signed digest, so a refusal here is the publisher's.
-    refused((|| {
+    let manifest = refused((|| {
         anyhow::ensure!(
             comp_data.len() <= 4 * 1024 * 1024,
             "Installed components exceed their byte bound"
         );
         let manifest: crate::setup::ComponentsManifest = serde_json::from_slice(&comp_data)?;
-        crate::setup::admit_release_components(&manifest, &component_platform)
+        crate::setup::admit_release_components(&manifest, &component_platform)?;
+        Ok(manifest)
     })())?;
 
+    // 9b. Fetch and verify the release-pinned Community network while Home
+    // still runs and before the binary changes.
+    let joins_network = joins_release_network(apply_mode, restart_owner.is_some());
+    let release_network = if joins_network {
+        fetch_release_network_for_update(data_dir, &manifest, fetch_fn, ordered_gateways).await?
+    } else {
+        None
+    };
+    if release_network.is_some() {
+        println!("  Community network verified (pinned CID ✓)");
+    }
+
     if apply_mode == ApplyMode::Normal {
         // 10. Atomic replace binary
         let bin_path = if source.install_path.is_empty() {
@@ -1741,6 +1793,13 @@ async fn run_upgrade_with_restart(
                 principal_root_receipt.status, principal_root_receipt.object_count
             );
 
+            // 13. Join or advance the release-pinned Community network last, so
+            // an earlier refusal leaves the Home's network unchanged.
+            let outcome = join_release_network(data_dir, &manifest, release_network.as_deref())?;
+            if let Some(line) = outcome.summary_line() {
+                println!("  {line}");
+            }
+
             Ok(())
         }
         .await;
@@ -1917,19 +1976,30 @@ async fn run_upgrade_with_restart(
             data_dir, "update", "offline",
         )?);
     }
-    let activation = transaction.commit_checked(|| {
-        if support_snapshot(
-            data_dir,
-            &old_components,
-            &comp_data,
-            &component_platform,
-            &transaction.excluded_paths(),
-        )? != support
-        {
-            anyhow::bail!("installed support changed during activation");
-        }
-        Ok(())
-    });
+    let activation = transaction
+        .commit_checked(|| {
+            if support_snapshot(
+                data_dir,
+                &old_components,
+                &comp_data,
+                &component_platform,
+                &transaction.excluded_paths(),
+            )? != support
+            {
+                anyhow::bail!("installed support changed during activation");
+            }
+            Ok(())
+        })
+        .and_then(|()| {
+            // Join after activation while the offline fence holds. A release that
+            // is rolled back later keeps the joined network, as the CLI update
+            // does: Runtime never drops an accepted network.
+            if joins_network {
+                join_release_network(data_dir, &manifest, release_network.as_deref()).map(|_| ())
+            } else {
+                Ok(())
+            }
+        });
     if let Some(owner) = restart_owner.as_mut() {
         drop(offline);
         let candidate = match activation {
@@ -2043,7 +2113,13 @@ pub(crate) fn frozen_support_snapshot(
     {
         anyhow::bail!("unsupported components schema for offline update");
     }
-    for field in ["external", "capsules", "profiles", "model_catalog"] {
+    for field in [
+        "external",
+        "capsules",
+        "profiles",
+        "model_catalog",
+        "collaboration_network",
+    ] {
         if old_value.get(field) != new_value.get(field) {
             anyhow::bail!(
                 "support change in {field} requires complete staging by the release owner"
@@ -4906,4 +4982,406 @@ mod tests {
             }
         }
     }
+
+    const EMPTY_COMPONENTS: &[u8] =
+        br#"{"schema":"elastos.components/v1","external":{},"profiles":{},"capsules":{}}"#;
+
+    fn components_pinning_network(config: &[u8]) -> Vec<u8> {
+        let parsed: serde_json::Value = serde_json::from_slice(config).unwrap();
+        serde_json::to_vec(&serde_json::json!({
+            "schema": "elastos.components/v1", "external": {}, "profiles": {}, "capsules": {},
+            "collaboration_network": {
+                "head_cid": crate::setup::catalog_head_cid(config).unwrap(),
+                "expected_network_id": parsed["expected_network_id"],
+                "trusted_profile_signer_dids": parsed["trusted_profile_signer_dids"],
+            },
+        }))
+        .unwrap()
+    }
+
+    /// A flat signed publication that `Publication` admits, and the content a
+    /// Carrier source serves from it: the publisher imports exactly the
+    /// admitted artifacts and the two metadata envelopes, addressed by CID.
+    #[cfg(unix)]
+    struct PublishedRelease {
+        _input: tempfile::TempDir,
+        head_cid: String,
+        content: std::collections::HashMap<String, Vec<u8>>,
+    }
+
+    #[cfg(unix)]
+    fn published_release(
+        executable: &[u8],
+        components: &[u8],
+        network: Option<&[u8]>,
+    ) -> PublishedRelease {
+        published_release_with_version(executable, components, network, "0.7.1")
+    }
+
+    #[cfg(unix)]
+    fn published_release_with_version(
+        executable: &[u8],
+        components: &[u8],
+        network: Option<&[u8]>,
+        version: &str,
+    ) -> PublishedRelease {
+        use sha2::Digest;
+        let input = tempfile::tempdir().unwrap();
+        // Publication admission refuses symlinked ancestors such as macOS /var.
+        let root = input.path().canonicalize().unwrap();
+        let platform = detect_release_platform();
+        let installer = b"#!/bin/sh\n# fixture installer\n";
+        let mut files = vec![
+            (format!("elastos-{platform}"), executable),
+            (format!("components-{platform}.json"), components),
+            ("install.sh".to_string(), installer.as_slice()),
+        ];
+        if let Some(network) = network {
+            files.push((
+                crate::collaboration_release_network::RELEASE_COLLABORATION_NETWORK_FILE
+                    .to_string(),
+                network,
+            ));
+        }
+        for (name, bytes) in &files {
+            std::fs::write(root.join(name), bytes).unwrap();
+        }
+        let descriptor = |bytes: &[u8]| {
+            serde_json::json!({
+                "cid": raw_cid(bytes), "sha256": hex::encode(sha2::Sha256::digest(bytes)),
+                "size": bytes.len()
+            })
+        };
+        let release = binding_envelope(
+            serde_json::json!({
+                "schema": "elastos.release/v1", "version": version, "channel": "stable",
+                "source": {"commit": "a".repeat(40), "tree": "b".repeat(40)},
+                "released_at": 1, "prev_release_cid": null,
+                "installer_sha256": hex::encode(sha2::Sha256::digest(installer)),
+                "platforms": {(platform): {
+                    "binary": descriptor(executable), "components": descriptor(components)
+                }}
+            }),
+            "elastos.release.v1",
+        );
+        let did =
+            crate::crypto::encode_signing_key_did(&ed25519_dalek::SigningKey::from_bytes(&[7; 32]));
+        let mut head = binding_head(&release);
+        head["version"] = serde_json::json!(version);
+        head["signer_did"] = serde_json::json!(did);
+        head["updated_at"] = serde_json::json!(2);
+        head["prev_head_cid"] = serde_json::Value::Null;
+        let head = binding_envelope(head, "elastos.release.head.v1");
+        std::fs::write(root.join("release.json"), &release).unwrap();
+        std::fs::write(root.join("release-head.json"), &head).unwrap();
+        let publication = crate::release_publication::Publication::open_flat(&root, &did).unwrap();
+        let mut content = std::collections::HashMap::from([
+            (raw_cid(&head), head.clone()),
+            (publication.release_cid().to_string(), release),
+        ]);
+        for artifact in publication.artifacts() {
+            content.insert(
+                artifact.cid.clone(),
+                publication.read_verified_artifact(&artifact.name).unwrap(),
+            );
+        }
+        PublishedRelease {
+            _input: input,
+            head_cid: raw_cid(&head),
+            content,
+        }
+    }
+
+    /// Runs a normal update against a source that answers only for content
+    /// it published, like a Carrier `content_fetch`. Returns each requested
+    /// CID with whether the installed binary was still the previous one.
+    #[cfg(unix)]
+    async fn update_from_published(
+        data: &Path,
+        binary: &Path,
+        published: &PublishedRelease,
+    ) -> (anyhow::Result<()>, Vec<(String, bool)>) {
+        let previous_binary = std::fs::read(binary).unwrap();
+        let requests = std::sync::Arc::new(std::sync::Mutex::new(Vec::new()));
+        let observed = requests.clone();
+        let content = published.content.clone();
+        let binary = binary.to_path_buf();
+        let fetch: FetchFn = Box::new(move |cid, gateways| {
+            assert!(gateways.is_empty(), "fixture uses only its Carrier source");
+            let before_activation = std::fs::read(&binary).unwrap() == previous_binary;
+            observed
+                .lock()
+                .unwrap()
+                .push((cid.clone(), before_activation));
+            let served = content
+                .get(&cid)
+                .cloned()
+                .ok_or_else(|| anyhow::anyhow!("content {cid} is not published by this source"));
+            Box::pin(async move { served })
+        });
+        let result = run_update_for_data_dir(
+            data,
+            &fetch,
+            None,
+            false,
+            Some(published.head_cid.clone()),
+            true,
+            vec![],
+            "0.7.0",
+            true,
+            false,
+            false,
+        )
+        .await;
+        let requests = requests.lock().unwrap().clone();
+        (result, requests)
+    }
+
+    #[cfg(unix)]
+    fn release_files(data: &Path, binary: &Path) -> Vec<(PathBuf, Vec<u8>)> {
+        [
+            binary.to_path_buf(),
+            data.join("components.json"),
+            data.join("sources.json"),
+            installation_release_head_path(data),
+            installation_release_manifest_path(data),
+        ]
+        .into_iter()
+        .map(|path| {
+            let bytes = std::fs::read(&path).unwrap();
+            (path, bytes)
+        })
+        .collect()
+    }
+
+    fn startup_config(data: &Path) -> PathBuf {
+        data.join(crate::collaboration_startup::COLLABORATION_STARTUP_CONFIG_FILE)
+    }
+
+    const NEXT_EXECUTABLE: &[u8] = b"#!/bin/sh\nprintf 'elastos 0.7.1\\n'\n";
+
+    #[cfg(unix)]
+    #[tokio::test]
+    async fn update_fetches_the_pinned_network_before_activation_and_joins_it() {
+        let (_signer, chain) =
+            crate::collaboration_release_network::tests::signed_profile_chain_config(1);
+        let (_fixture, data, binary, _source) = default_apply_fixture(EMPTY_COMPONENTS);
+        let components = components_pinning_network(&chain[0]);
+        let published = published_release(NEXT_EXECUTABLE, &components, Some(&chain[0]));
+
+        let (result, requests) = update_from_published(&data, &binary, &published).await;
+
+        result.unwrap();
+        let network_cid = crate::setup::catalog_head_cid(&chain[0]).unwrap();
+        assert_eq!(
+            requests.iter().find(|(cid, _)| *cid == network_cid),
+            Some(&(network_cid, true)),
+            "the network is fetched once, before the binary changes: {requests:?}"
+        );
+        assert_eq!(std::fs::read(startup_config(&data)).unwrap(), chain[0]);
+        assert_eq!(std::fs::read(&binary).unwrap(), NEXT_EXECUTABLE);
+        assert_eq!(
+            std::fs::read(data.join("components.json")).unwrap(),
+            components
+        );
+        assert!(!InstallTransaction::has_pending_recovery(&binary));
+    }
+
+    #[cfg(unix)]
+    #[tokio::test]
+    async fn undo_keeps_joined_network_revision_and_data_written_after_update() {
+        let (_signer, chain) =
+            crate::collaboration_release_network::tests::signed_profile_chain_config(2);
+        for previous_pins_network in [false, true] {
+            let previous_network = previous_pins_network.then_some(chain[0].as_slice());
+            let previous_components = previous_network
+                .map(components_pinning_network)
+                .unwrap_or_else(|| EMPTY_COMPONENTS.to_vec());
+            let (_fixture, data, binary, _source) = default_apply_fixture(&previous_components);
+            let previous_binary = std::fs::read(&binary).unwrap();
+            let previous = published_release_with_version(
+                &previous_binary,
+                &previous_components,
+                previous_network,
+                "0.7.0",
+            );
+            let components = components_pinning_network(&chain[1]);
+            let next = published_release(NEXT_EXECUTABLE, &components, Some(&chain[1]));
+            update_from_published(&data, &binary, &next)
+                .await
+                .0
+                .unwrap();
+            crate::collaboration_startup::load_and_accept_collaboration_startup_configuration(
+                &data,
+            )
+            .unwrap();
+            let accepted_path = data.join("collaboration/config/accepted-profile-head-v1.json");
+            let accepted = std::fs::read(&accepted_path).unwrap();
+            assert_eq!(
+                serde_json::from_slice::<serde_json::Value>(&accepted).unwrap()["revision"],
+                2
+            );
+            std::fs::write(data.join("owner-data"), b"written after update").unwrap();
+
+            let content = previous.content.clone();
+            let fetch: FetchFn = Box::new(move |cid, gateways| {
+                assert!(gateways.is_empty(), "fixture uses only its Carrier source");
+                let served = content.get(&cid).cloned().ok_or_else(|| {
+                    anyhow::anyhow!("content {cid} is not published by this source")
+                });
+                Box::pin(async move { served })
+            });
+            // release_cmd maps --rollback-to to this head override and force=true.
+            run_update_for_data_dir(
+                &data,
+                &fetch,
+                None,
+                false,
+                Some(previous.head_cid),
+                true,
+                vec![],
+                "0.7.1",
+                true,
+                true,
+                false,
+            )
+            .await
+            .unwrap();
+
+            assert_eq!(std::fs::read(&binary).unwrap(), previous_binary);
+            assert_eq!(
+                std::fs::read(data.join("components.json")).unwrap(),
+                previous_components
+            );
+            assert_eq!(
+                load_trusted_sources(&data)
+                    .unwrap()
+                    .default_source()
+                    .unwrap()
+                    .installed_version,
+                "0.7.0"
+            );
+            assert_eq!(std::fs::read(startup_config(&data)).unwrap(), chain[1]);
+            assert_eq!(std::fs::read(&accepted_path).unwrap(), accepted);
+            assert_eq!(
+                std::fs::read(data.join("owner-data")).unwrap(),
+                b"written after update"
+            );
+            crate::collaboration_startup::load_and_accept_collaboration_startup_configuration(
+                &data,
+            )
+            .unwrap();
+            assert!(!InstallTransaction::has_pending_recovery(&binary));
+        }
+    }
+
+    #[cfg(unix)]
+    #[tokio::test]
+    async fn update_of_an_isolated_home_fetches_no_network() {
+        let (_signer, chain) =
+            crate::collaboration_release_network::tests::signed_profile_chain_config(1);
+        let (_fixture, data, binary, _source) = default_apply_fixture(EMPTY_COMPONENTS);
+        crate::collaboration_release_network::choose_isolated(&data).unwrap();
+        let components = components_pinning_network(&chain[0]);
+        let published = published_release(NEXT_EXECUTABLE, &components, Some(&chain[0]));
+
+        let (result, requests) = update_from_published(&data, &binary, &published).await;
+
+        result.unwrap();
+        assert_eq!(
+            requests.len(),
+            4,
+            "head, release, binary, components: {requests:?}"
+        );
+        assert!(std::fs::symlink_metadata(startup_config(&data)).is_err());
+        assert!(crate::collaboration_release_network::is_isolated(&data));
+        assert_eq!(std::fs::read(&binary).unwrap(), NEXT_EXECUTABLE);
+    }
+
+    #[cfg(unix)]
+    #[tokio::test]
+    async fn update_refuses_network_bytes_that_differ_from_the_pin_before_activation() {
+        let (_signer, chain) =
+            crate::collaboration_release_network::tests::signed_profile_chain_config(1);
+        let (_other, other_chain) =
+            crate::collaboration_release_network::tests::signed_profile_chain_config(1);
+        let (_fixture, data, binary, _source) = default_apply_fixture(EMPTY_COMPONENTS);
+        let components = components_pinning_network(&chain[0]);
+        let mut published = published_release(NEXT_EXECUTABLE, &components, Some(&chain[0]));
+        published.content.insert(
+            crate::setup::catalog_head_cid(&chain[0]).unwrap(),
+            other_chain[0].clone(),
+        );
+        let original = release_files(&data, &binary);
+
+        let (result, _requests) = update_from_published(&data, &binary, &published).await;
+
+        let error = format!("{:#}", result.unwrap_err());
+        assert!(error.contains("does not match the pinned"), "{error}");
+        assert_eq!(release_files(&data, &binary), original);
+        assert!(std::fs::symlink_metadata(startup_config(&data)).is_err());
+        assert!(!InstallTransaction::has_pending_recovery(&binary));
+    }
+
+    #[cfg(unix)]
+    #[tokio::test]
+    async fn update_restores_release_files_when_the_network_install_fails() {
+        let (_signer, chain) =
+            crate::collaboration_release_network::tests::signed_profile_chain_config(1);
+        let (_fixture, data, binary, _source) = default_apply_fixture(EMPTY_COMPONENTS);
+        // A directory where the configuration belongs makes the last support
+        // step fail after the binary was activated.
+        std::fs::create_dir(startup_config(&data)).unwrap();
+        let components = components_pinning_network(&chain[0]);
+        let published = published_release(NEXT_EXECUTABLE, &components, Some(&chain[0]));
+        let original = release_files(&data, &binary);
+
+        let (result, _requests) = update_from_published(&data, &binary, &published).await;
+
+        let error = format!("{:#}", result.unwrap_err());
+        assert!(error.contains("original release files restored"), "{error}");
+        assert_eq!(release_files(&data, &binary), original);
+        assert!(!InstallTransaction::has_pending_recovery(&binary));
+    }
+
+    #[cfg(unix)]
+    #[tokio::test]
+    async fn update_of_an_unpinned_release_leaves_collaboration_unchanged() {
+        let (_fixture, data, binary, _source) = default_apply_fixture(EMPTY_COMPONENTS);
+        let published = published_release(NEXT_EXECUTABLE, EMPTY_COMPONENTS, None);
+
+        let (result, requests) = update_from_published(&data, &binary, &published).await;
+
+        result.unwrap();
+        assert_eq!(requests.len(), 4, "{requests:?}");
+        assert!(std::fs::symlink_metadata(startup_config(&data)).is_err());
+        assert!(!crate::collaboration_release_network::is_isolated(&data));
+        assert_eq!(std::fs::read(&binary).unwrap(), NEXT_EXECUTABLE);
+    }
+
+    #[cfg(unix)]
+    #[tokio::test]
+    async fn offline_update_refuses_a_changed_network_pin() {
+        let (_signer, chain) =
+            crate::collaboration_release_network::tests::signed_profile_chain_config(1);
+        let (_fixture, data, binary, source) = default_apply_fixture(EMPTY_COMPONENTS);
+        let original = release_files(&data, &binary);
+
+        let error = apply_signed_executable_fixture(
+            &data,
+            &source,
+            NEXT_EXECUTABLE,
+            &components_pinning_network(&chain[0]),
+        )
+        .await
+        .unwrap_err();
+
+        assert!(
+            format!("{error:#}").contains("support change in collaboration_network"),
+            "{error:#}"
+        );
+        assert_eq!(release_files(&data, &binary), original);
+        assert!(std::fs::symlink_metadata(startup_config(&data)).is_err());
+        assert!(!InstallTransaction::has_pending_recovery(&binary));
+    }
 }
diff --git a/elastos/crates/elastos-server/src/update_controller/tests.rs b/elastos/crates/elastos-server/src/update_controller/tests.rs
index 5b0aefe97..244dbb951 100644
--- a/elastos/crates/elastos-server/src/update_controller/tests.rs
+++ b/elastos/crates/elastos-server/src/update_controller/tests.rs
@@ -3905,6 +3905,222 @@ async fn stage_before_stop_preserves_home_on_fetch_or_verify_failure_and_restart
     }
 }
 
+#[tokio::test]
+async fn system_update_fetches_the_pinned_network_before_stop_and_joins_after_activation() {
+    let config_file = crate::collaboration_startup::COLLABORATION_STARTUP_CONFIG_FILE;
+    for outcome in [
+        "joined",
+        "tampered",
+        "isolated",
+        "join fails",
+        "candidate fails",
+    ] {
+        let fixture = PrivateFixture::new();
+        fs::create_dir(fixture.data.join("bin")).unwrap();
+        fixture.file(
+            &fixture.data.join("bin/fixture-provider"),
+            b"old support",
+            0o755,
+        );
+        let manifest = |bytes: &[u8]| {
+            json!({
+                "schema":"elastos.components/v1", "profiles":{}, "capsules":{},
+                "external":{"fixture-provider":{"install_path":"bin/fixture-provider", "platforms":{
+                    (crate::setup::detect_platform()): {"cid":raw_cid(bytes), "checksum":format!("sha256:{}", digest(bytes)), "size":bytes.len()}
+                }}}
+            })
+        };
+        let (_signer, chain) =
+            crate::collaboration_release_network::tests::signed_profile_chain_config(1);
+        let network = chain[0].clone();
+        let parsed: Value = serde_json::from_slice(&network).unwrap();
+        let network_cid = crate::setup::catalog_head_cid(&network).unwrap();
+        let mut value = manifest(b"new support");
+        value["collaboration_network"] = json!({
+            "head_cid": network_cid,
+            "expected_network_id": parsed["expected_network_id"],
+            "trusted_profile_signer_dids": parsed["trusted_profile_signer_dids"],
+        });
+        let old_components = serde_json::to_vec(&manifest(b"old support")).unwrap();
+        let components = serde_json::to_vec(&value).unwrap();
+        fixture.publish_installed_release_with_components(&old_components);
+        publish_retained_receipt(&fixture);
+        if outcome == "isolated" {
+            crate::collaboration_release_network::choose_isolated(&fixture.data).unwrap();
+        }
+        if outcome == "join fails" {
+            // Nothing can be joined where a directory holds the config path.
+            fs::create_dir(fixture.data.join(config_file)).unwrap();
+        }
+        let binary = b"#!/bin/sh\nprintf 'elastos 0.7.1\\n'\n".as_slice();
+        let descriptor =
+            |bytes: &[u8]| json!({"cid":raw_cid(bytes),"sha256":digest(bytes),"size":bytes.len()});
+        let release = signed(
+            json!({
+                "schema":"elastos.release/v1","version":"0.7.1","channel":"stable",
+                "platforms":{(crate::update::detect_release_platform()):{"binary":descriptor(binary),"components":descriptor(&components)}}
+            }),
+            "elastos.release.v1",
+        );
+        let head = signed(
+            json!({
+                "schema":"elastos.release.head/v1","version":"0.7.1","channel":"stable",
+                "latest_release_cid":raw_cid(&release),"release_sha256":digest(&release)
+            }),
+            "elastos.release.head.v1",
+        );
+        let (_, mut request, _) = choice_fixture();
+        request.head_cid = raw_cid(&head);
+        request.release_cid = raw_cid(&release);
+        let mut command = tokio::process::Command::new("/bin/sh");
+        command.args(["-c", "exec sleep 60"]);
+        let child = child::OwnedChild::spawn(&mut command).unwrap();
+        let pid = child.pid();
+        let birth = process_start(pid).unwrap();
+        let mut owner = StagingRestartOwner {
+            controller: Controller {
+                receipt: read_private_json(&fixture.directory.join(RECEIPT)).unwrap(),
+                directory: fixture.directory.clone(),
+                child: Some(child),
+                request: Some(request.clone()),
+                previous_binary_sha256: digest(b"signed fixture Runtime"),
+                previous_version: "0.7.0".into(),
+                generation: "a".repeat(32),
+                host_ready: true,
+                carrier: None,
+                carrier_close: None,
+                test_readiness: None,
+            },
+            host: Some(
+                crate::host_lock::acquire_host_process_lock(&fixture.data, "home", "fixture")
+                    .unwrap(),
+            ),
+            stops: 0,
+            starts: 0,
+            fail_candidate: outcome == "candidate fails",
+            candidate_support: PathBuf::from("bin/fixture-provider"),
+        };
+        owner
+            .controller
+            .publish("staging", "Checking the signed update.")
+            .unwrap();
+        let served_network = if outcome == "tampered" {
+            crate::collaboration_release_network::tests::signed_profile_chain_config(1).1[0].clone()
+        } else {
+            network.clone()
+        };
+        let items = std::collections::BTreeMap::from([
+            (request.head_cid.clone(), head),
+            (request.release_cid.clone(), release),
+            (raw_cid(binary), binary.to_vec()),
+            (raw_cid(&components), components),
+            (raw_cid(b"new support"), b"new support".to_vec()),
+            (network_cid.clone(), served_network),
+        ]);
+        let network_fetches = std::sync::Arc::new(std::sync::atomic::AtomicUsize::new(0));
+        let observed = network_fetches.clone();
+        let data = fixture.data.clone();
+        let fetch: crate::update::FetchFn = Box::new(move |cid, _| {
+            let bytes = items.get(&cid).cloned();
+            let network_fetch = cid == network_cid;
+            let observed = observed.clone();
+            let birth = birth.clone();
+            let data = data.clone();
+            Box::pin(async move {
+                if network_fetch {
+                    observed.fetch_add(1, std::sync::atomic::Ordering::SeqCst);
+                    // The network comes with the other downloads, while the
+                    // current Home still runs on the current release.
+                    assert!(!child::generation_gone(pid, &birth).unwrap());
+                    assert_eq!(
+                        fs::read(data.join("bin/fixture-provider")).unwrap(),
+                        b"old support"
+                    );
+                }
+                bytes.ok_or_else(|| anyhow::anyhow!("content {cid} is not published"))
+            })
+        });
+        let result = crate::update::run_restarting_update(
+            &fixture.data,
+            &fetch,
+            request.head_cid,
+            &mut owner,
+        )
+        .await;
+        owner.controller.publish_apply_result(&result).unwrap();
+        let status = status(&fixture.data).unwrap().unwrap();
+        let joined_network = || fs::read(fixture.data.join(config_file)).ok();
+        match outcome {
+            "joined" => {
+                result.unwrap();
+                assert_eq!((owner.stops, owner.starts), (1, 1));
+                assert_eq!(status.phase, "updated");
+                assert_eq!(joined_network(), Some(network.clone()));
+                assert_eq!(
+                    fs::metadata(fixture.data.join(config_file))
+                        .unwrap()
+                        .permissions()
+                        .mode()
+                        & 0o777,
+                    0o600
+                );
+            }
+            "isolated" => {
+                result.unwrap();
+                assert_eq!(network_fetches.load(std::sync::atomic::Ordering::SeqCst), 0);
+                assert_eq!(joined_network(), None);
+            }
+            "tampered" => {
+                let error = format!("{:#}", result.unwrap_err());
+                assert!(error.contains("does not match the pinned"), "{error}");
+                assert_eq!((owner.stops, owner.starts), (0, 0));
+                assert_eq!(status.phase, "failed");
+                assert!(status.message.contains("unchanged"));
+                assert_eq!(joined_network(), None);
+                assert_eq!(
+                    fs::read(&fixture.binary).unwrap(),
+                    b"signed fixture Runtime"
+                );
+            }
+            "join fails" => {
+                assert!(result.is_err());
+                assert_eq!((owner.stops, owner.starts), (2, 1));
+                assert_eq!(status.phase, "restored");
+                assert!(fixture.data.join(config_file).is_dir());
+            }
+            "candidate fails" => {
+                assert!(result.is_err());
+                assert_eq!((owner.stops, owner.starts), (2, 2));
+                assert_eq!(status.phase, "restored");
+                // The previous release comes back; the joined network stays.
+                assert_eq!(joined_network(), Some(network.clone()));
+            }
+            _ => unreachable!(),
+        }
+        if outcome != "tampered" && outcome != "isolated" {
+            assert_eq!(network_fetches.load(std::sync::atomic::Ordering::SeqCst), 1);
+        }
+        if ["join fails", "candidate fails"].contains(&outcome) {
+            assert!(owner.controller.child.is_some(), "previous Home is running");
+            assert_eq!(
+                fs::read(&fixture.binary).unwrap(),
+                b"signed fixture Runtime"
+            );
+            assert_eq!(
+                fs::read(fixture.data.join("components.json")).unwrap(),
+                old_components
+            );
+        }
+        assert!(
+            !InstallTransaction::has_pending_recovery(&fixture.binary),
+            "{outcome}"
+        );
+        assert!(!fixture.data.join(".elastos.update-support").exists());
+        owner.host.take();
+        owner.controller.stop_child().await.unwrap();
+    }
+}
+
 #[test]
 fn apply_failures_are_classified_only_from_typed_evidence() {
     for (error, expected) in [
diff --git a/justfile b/justfile
index 91c315a52..b24bff9cb 100644
--- a/justfile
+++ b/justfile
@@ -204,6 +204,7 @@ verify-ci: ci-test-capsules ci-test-elastos
 
 product-ui-source:
     node scripts/home-shell-regression-smoke.mjs
+    node scripts/home-shell-bridge-smoke.mjs
     node scripts/people-discovery-smoke.mjs
     node scripts/inbox-product-behavior-smoke.mjs
     node scripts/archive-product-behavior-smoke.mjs
@@ -212,6 +213,7 @@ product-ui-source:
     node --test scripts/documents-markdown.test.mjs
     node scripts/library-product-behavior-smoke.mjs
     node scripts/chat-room-product-behavior-smoke.mjs
+    node --test scripts/chat-room-reconnect.test.mjs
 
 product-ui-browser:
     node scripts/people-product-layout-smoke.mjs
diff --git a/scripts/build-and-setup-source-home-test.py b/scripts/build-and-setup-source-home-test.py
new file mode 100644
index 000000000..03525f49c
--- /dev/null
+++ b/scripts/build-and-setup-source-home-test.py
@@ -0,0 +1,68 @@
+#!/usr/bin/env python3
+"""Exercise the wrapper without building or touching an installed Home."""
+import os
+from pathlib import Path
+import shutil
+import subprocess
+import tempfile
+import unittest
+
+
+SCRIPT = Path(__file__).with_name("build-and-setup-source-home.sh")
+
+
+class BuildAndSetupTest(unittest.TestCase):
+    def test_private_copies_cleanup_and_setup_failure(self):
+        with tempfile.TemporaryDirectory(prefix="source-home-wrapper-") as temporary:
+            root = Path(temporary)
+            scripts = root / "scripts"
+            scripts.mkdir()
+            shutil.copyfile(SCRIPT, scripts / SCRIPT.name)
+            source = root / "shared tools"
+            source.mkdir(mode=0o755)
+            executable = root / "tool"
+            executable.write_text('#!/bin/sh\ntest "$1" = -version\n')
+            executable.chmod(0o755)
+            for name in ("ffmpeg", "ffprobe"):
+                (source / name).symlink_to(executable)
+            record = root / "stage-path"
+            (scripts / "setup-source-home.sh").write_text('''#!/bin/bash
+set -eu
+python3 - <<'PY'
+import os, pathlib, stat
+p = pathlib.Path(os.environ["SETUP_SOURCE_HOME_MEDIA_TOOLS_DIR"])
+for item in (p, p / "ffmpeg", p / "ffprobe"):
+    s = item.lstat()
+    assert not stat.S_ISLNK(s.st_mode)
+    assert stat.S_IMODE(s.st_mode) == 0o700
+    assert s.st_uid == os.geteuid()
+assert os.environ["ELASTOS_COLLABORATION_STARTUP_MODE"] == "isolated"
+assert os.environ["SETUP_SOURCE_HOME_RUNTIME_TURN"] == "0"
+pathlib.Path(os.environ["TEST_RECORD"]).write_text(str(p))
+PY
+exit "${TEST_EXIT:-0}"
+''')
+            env = {key: value for key, value in os.environ.items()
+                   if not key.startswith(("SETUP_SOURCE_HOME_", "ELASTOS_COLLABORATION_"))}
+            env.update(TEST_RECORD=str(record), TMPDIR=temporary, HOME=temporary)
+            command = ["/bin/bash", str(scripts / SCRIPT.name), "--media-tools-dir", str(source)]
+            for exit_code in (0, 7):
+                env["TEST_EXIT"] = str(exit_code)
+                result = subprocess.run(command, env=env, capture_output=True, text=True)
+                self.assertEqual(result.returncode, exit_code, result.stderr)
+                self.assertFalse(Path(record.read_text()).exists())
+            self.assertEqual(source.stat().st_mode & 0o777, 0o755)
+            self.assertEqual(executable.stat().st_mode & 0o777, 0o755)
+            self.assertTrue((source / "ffmpeg").is_symlink())
+            record.unlink()
+            result = subprocess.run(command + ["--check-tools"], env=env, capture_output=True)
+            self.assertEqual(result.returncode, 0, result.stderr)
+            self.assertFalse(record.exists())
+            (source / "ffprobe").unlink()
+            result = subprocess.run(command, env=env, capture_output=True)
+            self.assertNotEqual(result.returncode, 0)
+            self.assertFalse(record.exists())
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/scripts/build-and-setup-source-home.sh b/scripts/build-and-setup-source-home.sh
new file mode 100755
index 000000000..b8057142b
--- /dev/null
+++ b/scripts/build-and-setup-source-home.sh
@@ -0,0 +1,85 @@
+#!/usr/bin/env bash
+# Stage trusted local media executables, then use the canonical installer.
+set -euo pipefail
+umask 077
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+media_source="${SETUP_SOURCE_HOME_MEDIA_TOOLS_DIR:-}"
+check_tools=0
+
+usage() {
+    cat <<'EOF'
+Usage: scripts/build-and-setup-source-home.sh [options]
+
+  --media-tools-dir PATH   Trusted installed ffmpeg/ffprobe directory.
+                          Default: SETUP_SOURCE_HOME_MEDIA_TOOLS_DIR, then PATH.
+  --check-tools            Check private copies, then exit before build/setup.
+  --help                  Show this help.
+
+Copies the tools (including Homebrew symlink targets) into a temporary private
+directory, checks that they run, and invokes setup-source-home.sh. Copies are
+removed on exit; setup imports its own persistent copies. Homebrew libraries
+remain dependencies of Homebrew executables.
+
+Defaults to isolated collaboration. Set ELASTOS_COLLABORATION_STARTUP_MODE and
+the canonical setup variables to select another configuration. HOME selects
+the macOS installation home; Linux also supports XDG_DATA_HOME.
+
+Builds and installs only. Browser TURN startup is disabled for this operation.
+Use the platform source-home restart script separately after setup succeeds.
+EOF
+}
+
+while [[ $# -gt 0 ]]; do
+    case "$1" in
+        --media-tools-dir)
+            [[ -n "${2:-}" ]] || { echo '--media-tools-dir requires a path' >&2; exit 2; }
+            media_source="$2"
+            shift 2
+            ;;
+        --check-tools) check_tools=1; shift ;;
+        --help|-h) usage; exit 0 ;;
+        *) echo "Unknown argument: $1" >&2; usage >&2; exit 2 ;;
+    esac
+done
+
+# Runtime checks every ancestor of imported tools. Shared /tmp is writable by
+# other users, so stage inside the selected home, including for Linux setup.
+mkdir -p "$HOME"
+stage="$(mktemp -d "${HOME}/.elastos-media-tools.XXXXXX")"
+trap 'rm -rf "$stage"' EXIT
+trap 'exit 130' INT
+trap 'exit 143' TERM
+chmod 700 "$stage"
+
+for tool in ffmpeg ffprobe; do
+    if [[ -n "$media_source" ]]; then
+        source_path="${media_source}/${tool}"
+    else
+        source_path="$(command -v "$tool" || true)"
+    fi
+    if [[ ! -f "$source_path" || ! -x "$source_path" ]]; then
+        echo "Missing executable ${tool}: install FFmpeg or use --media-tools-dir PATH." >&2
+        exit 1
+    fi
+    echo "[build-and-setup] copy ${tool} from ${source_path}"
+    # install follows the source symlink and creates a regular private file.
+    install -m 700 "$source_path" "${stage}/${tool}"
+    "${stage}/${tool}" -version >/dev/null
+done
+
+if [[ "$check_tools" == 1 ]]; then
+    echo '[build-and-setup] media tool checks passed; temporary copies will be removed'
+    exit 0
+fi
+
+export SETUP_SOURCE_HOME_MEDIA_TOOLS_DIR="$stage"
+export ELASTOS_COLLABORATION_STARTUP_MODE="${ELASTOS_COLLABORATION_STARTUP_MODE:-isolated}"
+export SETUP_SOURCE_HOME_RUNTIME_TURN=0
+/bin/bash "${ROOT}/scripts/setup-source-home.sh"
+
+echo '[build-and-setup] setup complete; start Home separately:'
+case "$(uname -s)" in
+    Darwin) printf '  %q --test-home %q\n' "${ROOT}/scripts/mac-source-home-restart.sh" "$HOME" ;;
+    Linux) printf '  %q --help\n' "${ROOT}/scripts/linux-source-home-restart.sh" ;;
+esac
diff --git a/scripts/chat-room-configured-layout-smoke.mjs b/scripts/chat-room-configured-layout-smoke.mjs
index 09614b06f..7f898002b 100644
--- a/scripts/chat-room-configured-layout-smoke.mjs
+++ b/scripts/chat-room-configured-layout-smoke.mjs
@@ -123,6 +123,7 @@ async function serveFile(response, pathname) {
 }
 
 function startServer(scenario) {
+  const initialDirectRecovery = scenario.startsWith("direct-initial-401");
   const holdBoundary = holdBoundaryForScenario(scenario);
   const holds = {
     "initial-conversations": holdBoundary === "initial-conversations"
@@ -143,6 +144,7 @@ function startServer(scenario) {
     current: null,
     directConversations: 0,
     directMessages: 0,
+    freshDirectRequests: 0,
     heldBoundary: holdBoundary,
     heldReleases: [],
     leaves: 0,
@@ -166,10 +168,24 @@ function startServer(scenario) {
         return;
       }
       if (url.pathname === "/fixture") {
-        const chatSrc = isDirectSwitchScenario(scenario)
-          ? "/apps/chat-room/?conversation_id=direct%3Asha256%3Afixture-conversation#home_token=test-token"
+        const homeOrigin = `http://127.0.0.1:${server.address().port}`;
+        const chatSrc = isDirectSwitchScenario(scenario) || initialDirectRecovery
+          ? `/apps/chat-room/?conversation_id=direct%3Asha256%3Afixture-conversation${initialDirectRecovery ? `&home_origin=${encodeURIComponent(homeOrigin)}` : ""}#home_token=test-token`
           : "/apps/chat-room/#home_token=test-token";
-        const body = Buffer.from(`<!doctype html><style>html,body{height:100%;margin:0}iframe{border:0;height:100%;width:100%}</style><iframe title="Chat" sandbox="allow-forms allow-modals allow-pointer-lock allow-scripts" src="${chatSrc}"></iframe>`);
+        const reconnectHost = initialDirectRecovery ? `<script>
+          window.fixtureReconnects = 0;
+          window.addEventListener("message", (event) => {
+            const data = event.data;
+            if (event.source !== document.querySelector("iframe").contentWindow || event.origin !== "null"
+              || data?.type !== "home:launch-target" || data.target !== "chat-room"
+              || data.homeToken !== "test-token" || typeof data.requestId !== "string") return;
+            window.fixtureReconnects += 1;
+            event.source.postMessage({ type: "home:shell-response", requestId: data.requestId,
+              result: { target: "chat-room", attach_kind: "iframe", launch_status: "launched",
+                route: "/apps/chat-room/?home_origin=" + encodeURIComponent(location.origin) + "#home_token=fresh-token" }, status: 0 }, "*");
+          });
+        </script>` : "";
+        const body = Buffer.from(`<!doctype html><style>html,body{height:100%;margin:0}iframe{border:0;height:100%;width:100%}</style><iframe title="Chat" sandbox="allow-forms allow-modals allow-pointer-lock allow-scripts" src="${chatSrc}"></iframe>${reconnectHost}`);
         response.writeHead(200, {
           "content-length": body.length,
           "content-type": "text/html; charset=utf-8",
@@ -262,6 +278,12 @@ function startServer(scenario) {
       }
       if (url.pathname === "/api/apps/chat-room/direct/conversations") {
         trace.directConversations += 1;
+        if (initialDirectRecovery) {
+          if (request.headers["x-elastos-home-token"] !== "fresh-token") {
+            return json(response, { error: "Home session expired" }, 401);
+          }
+          trace.freshDirectRequests += 1;
+        }
         if (scenario === "single-conversation") {
           return json(response, { conversations: [] });
         }
@@ -280,6 +302,12 @@ function startServer(scenario) {
       }
       if (url.pathname === "/api/apps/chat-room/direct/conversations/direct%3Asha256%3Afixture-conversation/messages") {
         trace.directMessages += 1;
+        if (initialDirectRecovery) {
+          if (request.headers["x-elastos-home-token"] !== "fresh-token") {
+            return json(response, { error: "Home session expired" }, 401);
+          }
+          trace.freshDirectRequests += 1;
+        }
         directMessageResponses += 1;
         const hold = directMessageResponses === 1
           ? holds["bootstrap-messages"]
@@ -375,7 +403,6 @@ async function waitForConfiguredChatWithoutLegacyFlash(frame, label) {
         "#browser-access-section",
         "#browser-access-stage",
         "#conversation-invite-create",
-        "#conversation-join-section",
         "#room-access-section",
         "#room-access-toggle",
       ];
@@ -468,6 +495,37 @@ async function runScenario(scenario) {
     await page.goto(url, { waitUntil: "domcontentloaded" });
     let frame = await chatFrame(page);
 
+    if (scenario.startsWith("direct-initial-401")) {
+      const originalFrame = frame;
+      const timeOrigin = await frame.evaluate(() => performance.timeOrigin);
+      await frame.locator("#reconnect-button").waitFor({ state: "visible" });
+      await new Promise(resolveDelay => setTimeout(resolveDelay, 2200));
+      assert(trace.directConversations === 1 && trace.directMessages === 0 && trace.cycles[0].starts === 0,
+        "initial Direct401 performed automatic recovery work", trace);
+      assert(await page.evaluate(() => window.fixtureReconnects) === 0, "initial Direct401 reopened itself");
+      const selectedByUser = scenario === "direct-initial-401-user-selection";
+      if (selectedByUser) await clickSharedChoice(frame);
+      await frame.locator("#error-text").waitFor({ state: "visible" });
+      assert((await frame.locator("#error-text").innerText()).trim(),
+        "Reconnect lost its visible recovery explanation");
+      await frame.locator("#reconnect-button").click();
+      await frame.waitForFunction((shared) => document.body.dataset.roomSessionActive === "true"
+        && document.querySelector("#reconnect-button")?.hidden === true
+        && document.querySelector("[data-conversation-choice].active")?.dataset.conversationChoice
+          === (shared ? "shared" : "direct:sha256:fixture-conversation"), selectedByUser);
+      frame = await chatFrame(page);
+      assert(frame === originalFrame && await frame.evaluate(() => performance.timeOrigin) === timeOrigin,
+        "initial Direct401 recovery replaced its draft-owning document");
+      assert(trace.cycles.length === 1 && trace.cycles[0].starts === 1,
+        "initial Direct401 recovery did not use one explicit session start", trace);
+      assert(await page.evaluate(() => window.fixtureReconnects) === 1, "initial Direct401 did not use one Home launch");
+      if (!selectedByUser) {
+        await frame.waitForFunction(() => document.querySelector("#message-list")?.textContent.includes("hello from direct"));
+        assert(trace.freshDirectRequests >= 2, "requested Direct was not verified with fresh Home authority", trace);
+      }
+      return;
+    }
+
     if (scenario === "session-failure" || scenario === "summary-failure") {
       const expected = scenario === "session-failure"
         ? "Chat session bootstrap was not authorized. Reopen Chat from Home."
@@ -492,10 +550,6 @@ async function runScenario(scenario) {
         await frame.evaluate(() => document.body.dataset.roomSessionActive) === "false",
         "bootstrap failure activated Chat",
       );
-      assert(
-        await frame.evaluate(() => document.querySelector("#conversation-join-section")?.hidden),
-        "bootstrap failure exposed the legacy Join surface",
-      );
       return;
     }
 
@@ -565,6 +619,7 @@ async function runScenario(scenario) {
           && switched.selected === "shared"
           && switched.conversationTitle === "Community"
           && switched.conversationDetail === "Shared room"
+          && switched.errorText === ""
           && switched.attachHidden,
         "direct-to-shared switch did not leave configured Chat in shared mode",
         { heldBoundary, ...switched, preClickTrace, trace },
@@ -665,7 +720,6 @@ async function runScenario(scenario) {
               browserStageHidden: hidden("#browser-access-stage"),
               browserRequestsHidden: hidden("#browser-access-section"),
               roomSettingsHidden: hidden("#room-access-toggle") && hidden("#room-access-section"),
-              joinHidden: hidden("#conversation-join-section"),
               textVisible: !hidden("#composer-form") && !!input && !input.disabled && !!send && !send.disabled,
               messageInputTag: input?.tagName || "",
               shellDisplay: shell ? getComputedStyle(shell).display : "",
@@ -691,7 +745,6 @@ async function runScenario(scenario) {
       assert(state.attachHidden, "configured Chat exposed Attach", state);
       assert(state.browserStageHidden && state.browserRequestsHidden, "configured Chat exposed browser join controls", state);
       assert(state.roomSettingsHidden, "configured Chat exposed legacy room settings", state);
-      assert(state.joinHidden, "configured Chat exposed invite/join controls", state);
       assert(state.textVisible, "configured Chat text composer is unavailable", state);
       assert(state.messageInputTag === "TEXTAREA", "published Chat composer was not retained", state);
       assert(state.shellDisplay === "grid" && state.sidebarBeforeThread, "Chat is not a split conversation shell", state);
@@ -834,6 +887,8 @@ async function main() {
     "direct-switch-hold-bootstrap-messages",
     "direct-switch-hold-poll-conversations",
     "direct-switch-hold-poll-messages",
+    "direct-initial-401",
+    "direct-initial-401-user-selection",
   ];
   for (const scenario of scenarios) {
     await runScenario(scenario);
diff --git a/scripts/chat-room-layout-smoke.mjs b/scripts/chat-room-layout-smoke.mjs
index 85ffcca79..9b58fbb69 100644
--- a/scripts/chat-room-layout-smoke.mjs
+++ b/scripts/chat-room-layout-smoke.mjs
@@ -93,19 +93,15 @@ try {
     const result = await page.evaluate(() => {
       document.body.dataset.roomAccessMode = "shell";
       document.body.dataset.roomSessionActive = "true";
-      document.body.dataset.roomJoinVisible = "true";
       const chatCard = document.querySelector("#chat-card");
       chatCard.dataset.rosterOpen = "true";
       for (const id of [
         "room-access-toggle",
         "room-access-section",
-        "conversation-join-section",
         "conversation-invite-output-row",
       ]) {
         document.querySelector(`#${id}`).hidden = false;
       }
-      document.querySelector("#conversation-join-input").value =
-        "elastos://peer/invite?token=" + "j".repeat(180);
       document.querySelector("#conversation-invite-output").value =
         "elastos://peer/invite?token=" + "a".repeat(180);
       document.querySelector("#room-policy-list").innerHTML = `
@@ -121,38 +117,10 @@ try {
           </div>
         </li>`;
 
-      for (const selector of [
-        "#conversation-join-section",
-        "#conversation-join-input",
-        "#conversation-join-submit",
-      ]) {
-        if (document.querySelector(selector).getClientRects().length === 0) {
-          throw new Error(`Chat join control is not visible: ${selector}`);
-        }
-      }
-      if (
-        !document
-          .querySelector("#conversation-join-section p")
-          .textContent.includes("replaces this unused local conversation")
-      ) {
-        throw new Error(
-          "Chat join copy does not explain unused-conversation replacement",
-        );
-      }
-      for (const selector of ["#message-list", "#composer-form"]) {
-        if (getComputedStyle(document.querySelector(selector)).display !== "none") {
-          throw new Error(`Chat surface remains visible behind join UI: ${selector}`);
-        }
-      }
-
       const selectors = [
         "html",
         "body",
         "#chat-card",
-        "#conversation-join-section",
-        "#conversation-join-form",
-        "#conversation-join-input",
-        "#conversation-join-submit",
         ".presence-card",
         "#room-access-section",
         ".join-link-card",
diff --git a/scripts/chat-room-product-behavior-smoke.mjs b/scripts/chat-room-product-behavior-smoke.mjs
index dcf2f27db..09018b508 100644
--- a/scripts/chat-room-product-behavior-smoke.mjs
+++ b/scripts/chat-room-product-behavior-smoke.mjs
@@ -81,8 +81,6 @@ function createEnvironment() {
     { dataset: { conversationChoice: "shared" } },
     { dataset: { conversationChoice: "direct:sha256:fixture-conversation" } },
   ];
-  const conversationJoinSection = new FakeElement("conversation-join-section");
-  conversationJoinSection.hidden = true;
   const composerForm = new FakeElement("composer-form");
   const composerField = new FakeElement("composer-field");
   const messageInput = new FakeTextAreaElement("message-input");
@@ -112,7 +110,6 @@ function createEnvironment() {
     ["participant-toggle", participantToggle],
     ["room-access-toggle", roomAccessToggle],
     ["conversation-selector", conversationSelector],
-    ["conversation-join-section", conversationJoinSection],
     ["composer-form", composerForm],
     ["message-input", messageInput],
   ]);
@@ -162,7 +159,6 @@ function createEnvironment() {
     body,
     composerField,
     context,
-    conversationJoinSection,
     conversationSelector,
     messageInput,
     notify(target) {
@@ -194,6 +190,13 @@ function checkChatStartup() {
   const startup = readFileSync(resolve(repoRoot, "capsules/chat-room/browser/chat-room.js"), "utf8")
     .replace(/^[ \t]*import\b[\s\S]*?;/gm, "")
     .replaceAll("import.meta.url", JSON.stringify("http://home.example/apps/chat-room/chat-room.js"));
+  // The cache version changes with every rebuilt bundle; both asset URLs must
+  // carry the same one.
+  const startupSource = readFileSync(resolve(repoRoot, "capsules/chat-room/browser/chat-room.js"), "utf8");
+  const assetVersions = [...startupSource.matchAll(/\?v=(chat-room-ui-[0-9a-z]+)/g)].map(match => match[1]);
+  assert.equal(assetVersions.length, 2, "Chat startup must version both browser assets");
+  assert.equal(assetVersions[0], assetVersions[1], "Chat startup assets must share one cache version");
+  const assetVersion = assetVersions[0];
   for (const token of ["", "chat-test-token"]) {
     const env = createEnvironment();
     const calls = [];
@@ -222,7 +225,7 @@ function checkChatStartup() {
     assert.equal(calls[0].options.homeToken, token);
     assert.equal(calls[1].options.homeToken, token);
     assert.equal(calls[1].options.targetId, "chat-room");
-    assert.equal(calls[3].url, "http://home.example/apps/chat-room/chat_room_ui_bg.wasm?v=chat-room-ui-20260804a");
+    assert.equal(calls[3].url, `http://home.example/apps/chat-room/chat_room_ui_bg.wasm?v=${assetVersion}`);
     env.context.elastosChatNavigation({ conversation_id: "fixture" });
     env.context.elastosChatCopyInvite("fixture-invite");
     assert.deepEqual(plainJson(calls.slice(4)), [
@@ -312,10 +315,7 @@ function main() {
   assert.equal(env.body.dataset.roomCompactRail, "visible", "Two conversations must keep the compact rail available");
   env.conversationSelector.children = [{ dataset: { conversationChoice: "shared" } }];
   env.notify(env.conversationSelector);
-  assert.equal(env.body.dataset.roomCompactRail, "hidden", "One conversation may hide the compact rail when no required join control is visible");
-  env.conversationJoinSection.hidden = false;
-  env.notify(env.conversationJoinSection);
-  assert.equal(env.body.dataset.roomCompactRail, "visible", "Visible join controls must keep the compact rail available");
+  assert.equal(env.body.dataset.roomCompactRail, "hidden", "One conversation may hide the compact rail");
 
   env.messageInput.value = "line one\nline two\nline three";
   env.messageInput.dispatchEvent({ type: "input" });
diff --git a/scripts/chat-room-reconnect.test.mjs b/scripts/chat-room-reconnect.test.mjs
new file mode 100644
index 000000000..42a41fcec
--- /dev/null
+++ b/scripts/chat-room-reconnect.test.mjs
@@ -0,0 +1,158 @@
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import test from "node:test";
+import vm from "node:vm";
+import { createHomeNavigationClient } from "../capsules/home/browser/home-navigation-client.js";
+
+const homeOrigin = "https://home.fixture";
+const read = path => readFileSync(new URL(`../${path}`, import.meta.url), "utf8");
+const launched = token => ({ target: "chat-room", attach_kind: "iframe", launch_status: "launched",
+  route: `/apps/chat-room/?home_origin=${encodeURIComponent(homeOrigin)}#home_token=${token}` });
+
+function chatFixture() {
+  const listeners = new Map(), timers = new Map(), messages = [], clipboard = [];
+  let sequence = 0;
+  const top = { postMessage: (data, origin) => messages.push({ data, origin }) };
+  const parent = {};
+  const window = { top, parent, location: { search: `?home_origin=${encodeURIComponent(homeOrigin)}`, hash: "#home_token=old" },
+    crypto: { randomUUID: () => `request-${++sequence}` },
+    addEventListener(type, fn) { if (!listeners.has(type)) listeners.set(type, new Set()); listeners.get(type).add(fn); },
+    removeEventListener(type, fn) { listeners.get(type)?.delete(fn); },
+    dispatchEvent(event) { for (const fn of listeners.get(event.type) || []) fn(event); },
+    setTimeout(fn) { const id = ++sequence; timers.set(id, fn); return id; },
+    clearTimeout(id) { timers.delete(id); },
+  };
+  const context = vm.createContext({ window, URL, URLSearchParams, Event, init() {},
+    createHomeNavigationClient: options => createHomeNavigationClient({ ...options, windowRef: window }),
+    createHomeClipboardClient(options) { const client = { token: options.homeToken, started: false, retired: false,
+      start() { this.started = true; }, teardown() { this.retired = true; }, writeText() {} };
+      clipboard.push(client); return client; },
+  });
+  const source = read("capsules/chat-room/browser/chat-room.js")
+    .replace(/^\s*import[\s\S]*?;/gm, "").replaceAll("import.meta.url", JSON.stringify("https://home.fixture/apps/chat-room/chat-room.js"));
+  vm.runInContext(source, context);
+  const respond = (requestId, result, extra = {}, source = top, origin = homeOrigin) =>
+    window.dispatchEvent({ type: "message", source, origin,
+      data: { type: "home:shell-response", requestId, result, ...extra } });
+  return { context, window, top, parent, timers, messages, clipboard, respond };
+}
+
+test("Reconnect uses one visible action and only the Home response renews the same document", async () => {
+  const f = chatFixture();
+  assert.equal(f.messages.length, 0, "startup must leave renewal to the user");
+  f.context.elastosChatNavigation({ conversation_id: "direct:a" });
+  const pending = f.context.elastosChatReconnect();
+  assert.equal(f.context.elastosChatReconnect(), pending, "two clicks share one Home launch");
+  assert.equal(f.messages.length, 1);
+  const request = f.messages[0];
+  assert.equal(request.origin, homeOrigin);
+  assert.deepEqual(JSON.parse(JSON.stringify(request.data)), { type: "home:launch-target", requestId: request.data.requestId,
+    target: "chat-room", query: { conversation_id: "direct:a" }, homeToken: "old" });
+  f.respond(request.data.requestId, launched("forged"), {}, {}, homeOrigin);
+  f.respond(request.data.requestId, launched("forged"), {}, f.top, "https://evil.fixture");
+  f.respond("wrong-request", launched("forged"));
+  assert.equal(f.context.elastosChatHomeToken(), "old");
+  assert.equal(f.timers.size, 1);
+  f.respond(request.data.requestId, launched("fresh"));
+  assert.equal(await pending, "fresh");
+  assert.equal(f.context.elastosChatHomeToken(), "fresh");
+  assert.equal(f.clipboard[0].retired, true);
+  assert.equal(f.clipboard[1].token, "fresh");
+  assert.equal(f.clipboard[1].started, true);
+  assert.equal(f.timers.size, 0);
+  assert.equal(f.messages.at(-1).data.type, "home:app-ready");
+  // The actual navigation client keeps its selector and document nonce while
+  // requiring a new GUI probe under the renewed token.
+  f.window.dispatchEvent({ type: "message", source: f.parent, origin: "null",
+    data: { type: "elastos.home.navigation.request/v1", requestId: "probe-old", homeToken: "old" } });
+  const count = f.messages.length;
+  f.window.dispatchEvent({ type: "message", source: f.parent, origin: "null",
+    data: { type: "elastos.home.navigation.request/v1", requestId: "probe-fresh", homeToken: "fresh" } });
+  assert.equal(f.messages.length, count + 1);
+  assert.equal(f.messages.at(-1).data.query.conversation_id, "direct:a");
+});
+
+test("Expired Home and refused launches keep the old authority available for a user retry", async () => {
+  for (const reply of [{ error: "expired", status: 401 }, { result: { ...launched("fresh"), target: "browser" } },
+    { result: { ...launched("fresh"), route: "https://evil.fixture/apps/chat-room/#home_token=fresh" } }]) {
+    const f = chatFixture();
+    const pending = f.context.elastosChatReconnect();
+    const rejection = assert.rejects(pending, /Sign in to Home|invalid Chat launch/);
+    f.respond(f.messages[0].data.requestId, reply.result, reply);
+    await rejection;
+    assert.equal(f.context.elastosChatHomeToken(), "old");
+    assert.equal(f.clipboard.length, 1);
+    assert.equal(f.clipboard[0].retired, false);
+    assert.equal(f.timers.size, 0);
+    const retry = f.context.elastosChatReconnect();
+    f.respond(f.messages.at(-1).data.requestId, launched("retry"));
+    assert.equal(await retry, "retry");
+  }
+});
+
+test("A missing Home reply expires one request and permits an explicit retry", async () => {
+  const f = chatFixture();
+  const pending = f.context.elastosChatReconnect();
+  const rejection = assert.rejects(pending, /Home did not answer/);
+  const oldRequestId = f.messages[0].data.requestId;
+  [...f.timers.values()][0]();
+  await rejection;
+  assert.equal(f.timers.size, 0);
+  assert.equal(f.context.elastosChatHomeToken(), "old");
+  f.respond(oldRequestId, launched("late"));
+  assert.equal(f.context.elastosChatHomeToken(), "old", "expired request must ignore a late Home reply");
+  const retry = f.context.elastosChatReconnect();
+  f.respond(f.messages.at(-1).data.requestId, launched("retry"));
+  assert.equal(await retry, "retry");
+});
+
+function sourceFunction(source, name) {
+  const start = source.indexOf(`function ${name}(`);
+  assert.ok(start >= 0, name);
+  return source.slice(start, source.indexOf("\n}", start) + 2);
+}
+
+test("Home GUI accepts only the open Chat entry and keeps its iframe document", () => {
+  const oldRoute = launched("old").route;
+  const frame = { contentWindow: {}, src: oldRoute, dataset: { route: oldRoute }, getAttribute: () => oldRoute };
+  const entry = { targetId: "chat-room", node: { querySelector: () => frame }, homeNavigation: { old: true } };
+  const probes = [], receipts = [];
+  const context = vm.createContext({ URL, URLSearchParams, Date, homeOrigin,
+    window: { location: { href: `${homeOrigin}/apps/home-gui/` } }, shellState: { windows: new Map([["chat", entry]]) },
+    probeHomeNavigation: (value, force) => probes.push([value, force]),
+    postToHome: value => receipts.push(value),
+    hasExactKeys: (value, keys) => Object.keys(value).sort().join(",") === keys.sort().join(","),
+  });
+  const gui = read("capsules/home-gui/browser/home-gui.js");
+  for (const name of ["homeLaunchTokenFromRoute", "homeGuiWindowEntryForToken", "renewHomeGuiChatWindowAuthority"])
+    vm.runInContext(sourceFunction(gui, name), context);
+  vm.runInContext(sourceFunction(read("capsules/home-gui/browser/home-gui-shell.js"), "handleGuiCommand"), context);
+  const command = { type: "home:gui-command", command: "renew-chat-authority", requestId: "renew-chat",
+    phase: "prepare", homeToken: "old", launched: launched("fresh"), expiresAt: Date.now() + 1000 };
+  assert.equal(context.handleGuiCommand({ ...command, expiresAt: Date.now() - 1 }), false);
+  assert.equal(receipts.at(-1).ok, false);
+  assert.equal(frame.dataset.route, oldRoute);
+  assert.equal(context.renewHomeGuiChatWindowAuthority("old", { ...launched("fresh"), target: "browser" }, homeOrigin), false);
+  assert.equal(context.renewHomeGuiChatWindowAuthority("old", { ...launched("fresh"), route: "https://evil.fixture/apps/chat-room/#home_token=fresh" }, homeOrigin), false);
+  assert.equal(context.handleGuiCommand(command), true);
+  assert.equal(receipts.at(-1).ok, true);
+  assert.equal(receipts.at(-1).freshHomeToken, "fresh");
+  assert.equal(frame.dataset.route, oldRoute, "an unaccepted prepare receipt must preserve retry lookup");
+  assert.equal(probes.length, 0);
+  assert.equal(context.handleGuiCommand({ ...command, phase: "commit" }), true);
+  assert.equal(receipts.at(-1).type, "home:chat-authority-committed");
+  assert.equal(receipts.at(-1).ok, true);
+  assert.equal(frame.dataset.route, launched("fresh").route);
+  assert.equal(frame.src, oldRoute, "renewal must retain the same iframe document and drafts");
+  assert.equal(entry.homeNavigation, null);
+  assert.equal(probes.length, 1);
+  assert.equal(context.renewHomeGuiChatWindowAuthority("old", launched("later"), homeOrigin), false);
+  const closedCommand = { ...command, homeToken: "fresh", launched: launched("later") };
+  assert.equal(context.handleGuiCommand(closedCommand), true);
+  assert.equal(receipts.at(-1).type, "home:chat-authority-renewed");
+  context.shellState.windows.clear();
+  assert.equal(context.handleGuiCommand({ ...closedCommand, phase: "commit" }), false);
+  assert.equal(receipts.at(-1).type, "home:chat-authority-committed");
+  assert.equal(receipts.at(-1).ok, false, "a closed Chat entry must refuse the commit");
+  assert.equal(context.renewHomeGuiChatWindowAuthority("fresh", launched("later"), homeOrigin), false);
+});
diff --git a/scripts/home-navigation-consumers-smoke.mjs b/scripts/home-navigation-consumers-smoke.mjs
index e14fd7dc7..2819cdde6 100644
--- a/scripts/home-navigation-consumers-smoke.mjs
+++ b/scripts/home-navigation-consumers-smoke.mjs
@@ -146,12 +146,13 @@ export async function exerciseNavigationConsumers(makeClient) {
   // Rust owns the guarded Chat selection. This exact bridge consumes its JSON;
   // the native regression covers the producer with current/stale guards.
   const chatSource = read("capsules/chat-room/browser/chat-room.js");
-  const chat = vm.createContext({ globalThis: {}, homeNavigation: client("chat-room") });
-  const bridge = chatSource.match(/globalThis\.elastosChatNavigation =[^;]+;/);
+  const chat = vm.createContext({ globalThis: {}, currentQuery: {}, homeNavigation: client("chat-room") });
+  const bridge = chatSource.match(/globalThis\.elastosChatNavigation = \(query\) => \{[\s\S]*?\n\s*\};/);
   assert.ok(bridge, "Chat must connect the actual Rust selector to Home navigation");
   vm.runInContext(bridge[0], chat);
   chat.globalThis.elastosChatNavigation({ conversation_id: "direct:sha256:conversation-b" });
   assert.deepEqual(reports["chat-room"], { conversation_id: "direct:sha256:conversation-b" });
+  assert.equal(chat.currentQuery.conversation_id, "direct:sha256:conversation-b", "Reconnect must use the settled Chat selection");
   chat.globalThis.elastosChatNavigation({});
   assert.deepEqual(reports["chat-room"], {}, "explicit default retained direct selection");
   chat.globalThis.elastosChatNavigation({ conversation_id: "direct:sha256:conversation-b" });
diff --git a/scripts/home-passkey-virtual-auth-smoke.mjs b/scripts/home-passkey-virtual-auth-smoke.mjs
index 6141a1a6d..bd1439db2 100644
--- a/scripts/home-passkey-virtual-auth-smoke.mjs
+++ b/scripts/home-passkey-virtual-auth-smoke.mjs
@@ -4025,9 +4025,11 @@ async function ensureSignedWithVirtualPasskey(page, onCreated) {
     throw skip;
   }
 
-  const secondary = page.locator("#home-unlock-secondary");
-  await secondary.waitFor({ state: "visible", timeout: 15_000 });
-  await secondary.click();
+  // The lock face offers "Create account" directly; the card's secondary
+  // action covers the neutral surface.
+  const createEntry = page.locator("#home-unlock-create:visible, #home-unlock-secondary:visible").first();
+  await createEntry.waitFor({ state: "visible", timeout: 15_000 });
+  await createEntry.click();
   state = await homeState(page);
   assert(
     state.unlockTitle === "Create guest account" && state.unlockNameVisible,
diff --git a/scripts/home-shell-auth-gate-smoke.mjs b/scripts/home-shell-auth-gate-smoke.mjs
index 1e9385104..fb049c31b 100644
--- a/scripts/home-shell-auth-gate-smoke.mjs
+++ b/scripts/home-shell-auth-gate-smoke.mjs
@@ -50,6 +50,10 @@ class FakeEventSource {
   }
 }
 
+// The guest-enabled variant runs in a child process (see the end of this file)
+// because the shell modules bind to this fake DOM once per process.
+const guestRegistrationEnabled = process.env.HOME_AUTH_GATE_GUEST_ENABLED === "1";
+
 class FakeClassList {
   constructor() {
     this.values = new Set();
@@ -344,7 +348,7 @@ globalThis.fetch = async (url, init = {}) => {
     });
   }
   if (url === "/api/auth/passkey/status") {
-    return jsonResponse({ registered: true, guest_registration_enabled: false });
+    return jsonResponse({ registered: true, guest_registration_enabled: guestRegistrationEnabled });
   }
   if (url === "/api/auth/passkey/authenticate/begin") {
     return jsonResponse({
@@ -470,6 +474,31 @@ assert(activeShellFrame.src === "about:blank", "auth gate did not unload the sta
 assert(!requests.some((request) => request.url === "/api/apps/home/active-shell"), "auth gate tried to switch shells without a token", requests);
 assert(!requests.some((request) => request.url === "/api/apps/home/launch"), "auth gate tried to launch a shell while locked", requests);
 
+const createAccount = elementForSelector("#home-unlock-create");
+if (guestRegistrationEnabled) {
+  assert(createAccount.hidden === false, "lock face hid Create account while guest registration is on");
+  createAccount.click();
+  for (let attempt = 0; attempt < 20 && elementForSelector(".home-unlock-card").hidden; attempt += 1) {
+    await new Promise((resolve) => setTimeout(resolve, 0));
+  }
+  assert(
+    elementForSelector("#home-unlock-title").textContent === "Create guest account",
+    "Create account did not open guest enrollment",
+    elementForSelector("#home-unlock-title").textContent,
+  );
+  assert(elementForSelector(".home-unlock-card").hidden === false, "Create account did not show the enrollment card");
+  assert(elementForSelector(".home-unlock-face").hidden === true, "Create account left the lock face over the enrollment card");
+  assert(createAccount.hidden === true, "Create account stayed visible during guest enrollment");
+  assert(
+    requests.filter((request) => request.url === "/api/auth/passkey/authenticate/begin").length === 0,
+    "Create account started passkey sign-in instead of enrollment",
+    requests,
+  );
+  console.log("[home-shell-auth-gate] PASS (guest registration on)");
+  process.exit(0);
+}
+assert(createAccount.hidden === true, "lock face offered Create account while guest registration is off");
+
 elementForSelector("#home-unlock-person").click();
 for (
   let attempt = 0;
@@ -919,3 +948,10 @@ assert(reconnectDeadlines.length > 0 && reconnectDeadlines.every(delay => delay
 assert(requestDeadlineTimers.size === 0, "closed event channel retained request deadlines");
 
 console.log("[home-shell-auth-gate] PASS");
+
+const { spawnSync } = await import("node:child_process");
+const guestVariant = spawnSync(process.execPath, [new URL(import.meta.url).pathname], {
+  env: { ...process.env, HOME_AUTH_GATE_GUEST_ENABLED: "1" },
+  stdio: "inherit",
+});
+if (guestVariant.status !== 0) process.exit(guestVariant.status ?? 1);
diff --git a/scripts/home-shell-bridge-smoke.mjs b/scripts/home-shell-bridge-smoke.mjs
index 0e4d1d176..84858f4a6 100644
--- a/scripts/home-shell-bridge-smoke.mjs
+++ b/scripts/home-shell-bridge-smoke.mjs
@@ -5,6 +5,8 @@ const requests = [];
 const injectedProviderCalls = [];
 let extraWindowOpenCount = 0;
 const windowListeners = new Map();
+const chatReconnectTimers = new Map();
+let chatReconnectTimerSequence = 0;
 const localStorageValues = new Map([
   ["elastos.home.active-shell-hint", "home-cli"],
 ]);
@@ -244,6 +246,7 @@ const summary = {
     { target: "browser", title: "Browser", attach_kind: "iframe", role: "app", target_kind: "app" },
     { target: "inbox", title: "Inbox", attach_kind: "iframe", role: "app", target_kind: "app" },
     { target: "people", title: "People", attach_kind: "iframe", role: "app", target_kind: "app" },
+    { target: "chat-room", title: "Chat", attach_kind: "iframe", role: "app", target_kind: "app" },
     { target: "assistant", title: "Assistant", attach_kind: "iframe", role: "app", target_kind: "app" },
     { target: "home-agent", title: "Home Agent", attach_kind: "iframe", role: "app", target_kind: "app" },
     { target: "marketplace", title: "Apps", attach_kind: "iframe", role: "app", target_kind: "app" },
@@ -255,6 +258,8 @@ let activeShellName = "home-cli";
 const pendingAppearanceResponses = [];
 const renewalBrowserInstance = "browser:authority-renewal-bridge";
 let renewalBrowserLaunchCount = 0;
+let chatLaunchCount = 0;
+let expireNextChatLaunch = false;
 let passkeyCompleted = false;
 const braveAddress = "0x2222222222222222222222222222222222222222";
 const metamaskAddress = "0x1111111111111111111111111111111111111111";
@@ -376,9 +381,14 @@ globalThis.window = {
   removeEventListener: removeWindowEventListener,
   dispatchEvent: dispatchWindowEvent,
   clearInterval() {},
-  clearTimeout() {},
+  clearTimeout(id) { chatReconnectTimers.delete(id); },
   setInterval: () => 0,
-  setTimeout: () => 0,
+  setTimeout(fn, delay) {
+    if (delay !== 25000) return 0;
+    const id = ++chatReconnectTimerSequence;
+    chatReconnectTimers.set(id, fn);
+    return id;
+  },
   open() {
     extraWindowOpenCount += 1;
     throw new Error("Home wallet connector must not open another window");
@@ -528,6 +538,15 @@ globalThis.fetch = async (url, init = {}) => {
         title: "People",
       });
     }
+    if (body?.target === "chat-room") {
+      if (expireNextChatLaunch) {
+        expireNextChatLaunch = false;
+        return { ...jsonResponse({ error: "Home session expired" }), ok: false, status: 401 };
+      }
+      chatLaunchCount += 1;
+      return jsonResponse({ target: "chat-room", attach_kind: "iframe", launch_status: "launched",
+        route: `/apps/chat-room/?home_origin=http%3A%2F%2Flocalhost%3A61180#home_token=chat-token-${chatLaunchCount}` });
+    }
     if (body?.target === "wallet") {
       return jsonResponse({
         attach_kind: "iframe",
@@ -2299,6 +2318,144 @@ assert(
   systemStepUpBegin,
 );
 
+// Actual Home admission and canonical launch path: only the registered Chat
+// frame may request this recovery, and GUI preparation keeps its retry lookup.
+sendChildMessage("null", shellFrameWindow, { type: "home:launch-target", requestId: "launch-chat",
+  target: "chat-room", query: {}, homeToken: "gui-token" });
+await waitForShellResponse(shellMessages, "launch-chat");
+const chatReplies = [];
+const chatFrameWindow = { parent: shellFrameWindow, postMessage: (payload, origin) => chatReplies.push({ payload, origin }) };
+sendChildMessage("null", chatFrameWindow, { type: "home:app-ready", homeToken: "chat-token-1" });
+const reconnect = requestId => ({ type: "home:launch-target", requestId, target: "chat-room",
+  query: { conversation_id: "direct:a" }, homeToken: "chat-token-1" });
+const chatLaunches = () => requests.filter(r => r.url === "/api/apps/home/launch" && r.body?.target === "chat-room").length;
+const beforeWrongChatMessages = chatLaunches();
+const allLaunches = () => requests.filter(r => r.url === "/api/apps/home/launch").length;
+const beforeAllWrongChatMessages = allLaunches();
+for (const [origin, source, data] of [
+  ["https://evil.invalid", chatFrameWindow, reconnect("wrong-origin")],
+  ["null", {}, reconnect("wrong-source")],
+  ["null", chatFrameWindow, { ...reconnect("wrong-token"), homeToken: "substituted" }],
+  ["null", chatFrameWindow, { ...reconnect("wrong-target"), target: "browser" }],
+  ["null", chatFrameWindow, { ...reconnect("wrong-query"), query: { conversation_id: "direct:a", authority: "extra" } }],
+  ["null", chatFrameWindow, { ...reconnect("wrong-shape"), extra: true }],
+]) sendChildMessage(origin, source, data);
+await new Promise(resolve => setTimeout(resolve, 0));
+assert(allLaunches() === beforeAllWrongChatMessages, "Chat recovery accepted a wrong source/token/origin/target/query", requests);
+async function waitForChatPrepare(requestId) {
+  for (let attempt = 0; attempt < 30; attempt += 1) {
+    const command = shellMessages.find(m => m.payload?.command === "renew-chat-authority"
+      && m.payload?.phase === "prepare" && m.payload?.requestId === requestId)?.payload;
+    if (command) return command;
+    await new Promise(resolve => setTimeout(resolve, 0));
+  }
+  throw new Error(`missing Chat GUI prepare ${requestId}`);
+}
+function acknowledgeChat(command, ok, source = shellFrameWindow, extra = {}) {
+  const freshHomeToken = new URL(command.launched.route, window.location.origin).hash.split("home_token=")[1];
+  sendChildMessage("null", source, { type: "home:chat-authority-renewed", requestId: command.requestId,
+    oldHomeToken: command.homeToken, freshHomeToken, ok, homeToken: "gui-token", ...extra });
+  return freshHomeToken;
+}
+const deniedRequest = reconnect("chat-gui-refused");
+sendChildMessage("null", chatFrameWindow, deniedRequest);
+sendChildMessage("null", chatFrameWindow, deniedRequest);
+const deniedPrepare = await waitForChatPrepare(deniedRequest.requestId);
+assert(chatLaunches() === beforeWrongChatMessages + 1, "duplicate Chat recovery minted two authorities", requests);
+acknowledgeChat(deniedPrepare, true, {});
+acknowledgeChat(deniedPrepare, true, shellFrameWindow, { freshHomeToken: "substituted" });
+assert(!chatReplies.some(r => r.payload.requestId === deniedRequest.requestId), "Chat returned authority before a valid GUI receipt", chatReplies);
+const refusedToken = acknowledgeChat(deniedPrepare, false);
+assert((await waitForShellResponse(chatReplies, deniedRequest.requestId)).payload.error,
+  "refused or closed GUI entry did not return a recovery error", chatReplies);
+const openCommands = () => shellMessages.filter(m => m.payload?.command === "open-target").length;
+function assertChatTokenRetired(token, frame = chatFrameWindow) {
+  const before = openCommands();
+  sendChildMessage("null", frame, { type: "home:app-ready", homeToken: token });
+  sendChildMessage("null", frame, { type: "home:open-target", homeToken: token, target: "inbox", query: {} });
+  assert(openCommands() === before, "failed recovery retained fresh launch authority", { token, shellMessages });
+}
+assertChatTokenRetired(refusedToken);
+
+sendChildMessage("null", chatFrameWindow, reconnect("chat-timeout"));
+const timeoutPrepare = await waitForChatPrepare("chat-timeout");
+assert(chatReconnectTimers.size === 1, "Chat recovery timer must be bounded", chatReconnectTimers.size);
+[...chatReconnectTimers.values()][0]();
+assert((await waitForShellResponse(chatReplies, "chat-timeout")).payload.error, "timeout did not leave a retryable result");
+const repliesAfterTimeout = chatReplies.length;
+acknowledgeChat(timeoutPrepare, true);
+assert(chatReplies.length === repliesAfterTimeout, "late GUI receipt returned retired authority", chatReplies);
+assertChatTokenRetired(new URL(timeoutPrepare.launched.route, window.location.origin).hash.split("home_token=")[1]);
+
+expireNextChatLaunch = true;
+sendChildMessage("null", chatFrameWindow, reconnect("chat-home-expired"));
+assert((await waitForShellResponse(chatReplies, "chat-home-expired")).payload.status === 401,
+  "expired Home sign-in did not reach the reconnect control", chatReplies);
+
+sendChildMessage("null", chatFrameWindow, reconnect("chat-gui-gone"));
+activeShellFrame.contentWindow = null;
+const unavailableReply = await waitForShellResponse(chatReplies, "chat-gui-gone");
+activeShellFrame.contentWindow = shellFrameWindow;
+assert(unavailableReply.payload.error && chatReconnectTimers.size === 0,
+  "GUI failure leaked fresh authority or recovery timer", chatReplies);
+assertChatTokenRetired(`chat-token-${chatLaunchCount}`);
+
+sendChildMessage("null", chatFrameWindow, reconnect("chat-success"));
+const successfulPrepare = await waitForChatPrepare("chat-success");
+const freshChatToken = acknowledgeChat(successfulPrepare, true);
+const chatSuccess = await waitForShellResponse(chatReplies, "chat-success");
+assert(chatSuccess.payload.result.route === successfulPrepare.launched.route && chatReconnectTimers.size === 0,
+  "GUI acceptance did not return the canonical Runtime Chat launch", chatReplies);
+assert(shellMessages.some(m => m.payload?.command === "renew-chat-authority"
+  && m.payload.phase === "commit" && m.payload.requestId === "chat-success"), "Home omitted the same-frame metadata commit", shellMessages);
+function acknowledgeChatCommit(command, ok, source = shellFrameWindow) {
+  sendChildMessage("null", source, { type: "home:chat-authority-committed", requestId: command.requestId,
+    oldHomeToken: command.homeToken,
+    freshHomeToken: new URL(command.launched.route, window.location.origin).hash.split("home_token=")[1],
+    ok, homeToken: "gui-token" });
+}
+const beforeMissingCommitReceipt = openCommands();
+sendChildMessage("null", chatFrameWindow, { type: "home:open-target", target: "inbox", query: {}, homeToken: freshChatToken });
+await new Promise(resolve => setTimeout(resolve, 0));
+assert(openCommands() === beforeMissingCommitReceipt + 1 && chatReconnectTimers.size === 0,
+  "a missing GUI commit receipt made fresh authority unavailable or started a rollback timer");
+acknowledgeChatCommit(successfulPrepare, true);
+acknowledgeChatCommit(successfulPrepare, false);
+const launchesAfterRenewal = chatLaunches();
+sendChildMessage("null", chatFrameWindow, reconnect("old-authority-replay"));
+assert(chatLaunches() === launchesAfterRenewal, "old Chat authority remained usable after renewal");
+const beforeProfileActions = openCommands();
+for (const [source, target, query] of [[{}, "inbox", {}], [chatFrameWindow, "system", {}],
+  [chatFrameWindow, "inbox", { item: "extra" }], [chatFrameWindow, "people", { extra: "injected" }]])
+  sendChildMessage("null", source, { type: "home:open-target", homeToken: freshChatToken, target, query });
+assert(openCommands() === beforeProfileActions, "Chat gained unrelated Home action authority", shellMessages);
+for (const target of ["people", "inbox"]) sendChildMessage("null", chatFrameWindow,
+  { type: "home:open-target", homeToken: freshChatToken, target, query: {} });
+await new Promise(resolve => setTimeout(resolve, 0));
+assert(openCommands() === beforeProfileActions + 2, "Profile card did not open its exact People and Inbox targets", shellMessages);
+sendChildMessage("null", chatFrameWindow, { ...reconnect("chat-commit-refused"), homeToken: freshChatToken });
+const refusedCommitPrepare = await waitForChatPrepare("chat-commit-refused");
+const refusedCommitToken = acknowledgeChat(refusedCommitPrepare, true);
+await waitForShellResponse(chatReplies, "chat-commit-refused");
+acknowledgeChatCommit(refusedCommitPrepare, false, {});
+const beforeWrongCommitReceipt = openCommands();
+sendChildMessage("null", chatFrameWindow, { type: "home:open-target", target: "inbox", query: {}, homeToken: refusedCommitToken });
+await new Promise(resolve => setTimeout(resolve, 0));
+assert(openCommands() === beforeWrongCommitReceipt + 1, "a forged GUI commit receipt retired valid Chat authority");
+acknowledgeChatCommit(refusedCommitPrepare, false);
+assertChatTokenRetired(refusedCommitToken);
+acknowledgeChatCommit(refusedCommitPrepare, true);
+assertChatTokenRetired(refusedCommitToken);
+sendChildMessage("null", shellFrameWindow, { type: "home:launch-target", requestId: "launch-chat-sign-out",
+  target: "chat-room", query: {}, homeToken: "gui-token" });
+const signOutChatLaunch = await waitForShellResponse(shellMessages, "launch-chat-sign-out");
+const signOutChatToken = new URL(signOutChatLaunch.payload.result.route, window.location.origin).hash.split("home_token=")[1];
+sendChildMessage("null", chatFrameWindow, { type: "home:app-ready", homeToken: signOutChatToken });
+// Keep a prepared renewal pending when the existing sign-out test changes
+// Home authority; context retirement must cancel its timer and fresh launch.
+sendChildMessage("null", chatFrameWindow, { ...reconnect("chat-sign-out"), homeToken: signOutChatToken });
+const signOutChatPrepare = await waitForChatPrepare("chat-sign-out");
+
 const signOutRequestsBefore = requests.filter(
   (request) => request.url === "/api/auth/sessions/sign-out",
 ).length;
@@ -2350,4 +2507,9 @@ assert(
   shellMessages,
 );
 
+await new Promise(resolve => setTimeout(resolve, 0));
+assert(chatReconnectTimers.size === 0, "Home sign-out kept a pending Chat authority renewal", chatReconnectTimers.size);
+assert(!chatReplies.some(r => r.payload.requestId === "chat-sign-out" && r.payload.result),
+  "Home sign-out delivered a prepared Chat authority", chatReplies);
+assertChatTokenRetired(new URL(signOutChatPrepare.launched.route, window.location.origin).hash.split("home_token=")[1]);
 console.log("[home-shell-bridge] PASS");
diff --git a/scripts/home-two-runtime-acceptance-core.mjs b/scripts/home-two-runtime-acceptance-core.mjs
index 06ba32c98..8ec5b4cae 100644
--- a/scripts/home-two-runtime-acceptance-core.mjs
+++ b/scripts/home-two-runtime-acceptance-core.mjs
@@ -5,21 +5,27 @@ import {
   openSync,
   readFileSync,
 } from "node:fs";
+import { createHash } from "node:crypto";
 import { isAbsolute, relative, resolve } from "node:path";
 
 export const REQUIRED_ACCEPTANCE_LEGS = Object.freeze([
   "provisioning_and_sign_in",
+  "system_recovery_after_signup",
   "distinct_runtime_instances",
   "fresh_fixture_precondition",
-  "system_recovery_before_profile",
   "distinct_profile_names",
   "overlapping_opt_in_discovery",
   "exactly_one_contact_request",
   "inbox_only_accept",
   "stable_contacts",
   "distinct_profile_identities",
+  "community_profile_launch",
   "direct_message_a_to_b",
+  "inbox_direct_launch",
   "direct_message_b_to_a",
+  "conversation_draft_preservation",
+  "shared_session_recovery",
+  "direct_session_recovery",
   "rename_propagation",
   "bilateral_removal",
   "re_add_contact",
@@ -48,6 +54,14 @@ const RAW_IDENTITY_RE = /(?:did:(?:key|elastos):|\bz6Mk[1-9A-HJ-NP-Za-km-z]{20,}
 
 export class AcceptanceEvidenceError extends Error {}
 
+export function assertFreshOwnerEnrollmentPrecondition(aStoredCredentials, bStoredCredentials) {
+  if (aStoredCredentials !== 0 || bStoredCredentials !== 0) {
+    throw new AcceptanceEvidenceError(
+      "fresh owner enrollment requires empty credential stores on both sides; reset the issue-owned fixture Homes and browser profiles before this run",
+    );
+  }
+}
+
 function exactObjectKeys(value, keys, label) {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
     throw new AcceptanceEvidenceError(`${label} must be an object`);
@@ -277,7 +291,7 @@ export function assertDistinctRuntimeEvidence(aDeviceDid, bDeviceDid, config) {
   }
 }
 
-export function assertDistinctProfileContactEvidence(aContactId, bContactId) {
+export function assertDistinctProfileContactEvidence(aContactId, bContactId, aRecoveryProfileDid, bRecoveryProfileDid) {
   if (
     typeof aContactId !== "string"
     || typeof bContactId !== "string"
@@ -287,6 +301,14 @@ export function assertDistinctProfileContactEvidence(aContactId, bContactId) {
   ) {
     throw new AcceptanceEvidenceError("opaque contact projections do not prove distinct Profile identities");
   }
+  const contactId = (profileDid) => `contact:${createHash("sha256")
+    .update(`elastos.people.contact.v1:${profileDid}`).digest("hex").slice(0, 24)}`;
+  if (!isDidKey(aRecoveryProfileDid) || !isDidKey(bRecoveryProfileDid)
+    || aContactId !== contactId(bRecoveryProfileDid)
+    || bContactId !== contactId(aRecoveryProfileDid)) {
+    throw new AcceptanceEvidenceError("opaque contact projections do not bind both Recovery Profiles");
+  }
+  return { recovery_profile_binding_checked: true };
 }
 
 export function assertRestartTransition({ before, after, side, systemDeviceDid }) {
@@ -361,15 +383,48 @@ export function assertFreshFixturePrecondition(aContacts, bContacts) {
   }
 }
 
+export function assertRecoveryBundleEvidence(bundle, expected) {
+  if (!expected.principalId || !expected.localhostRoot || !expected.profileName
+    || bundle?.schema !== "elastos.full-recovery-bundle/v1"
+    || bundle.principal_id !== expected.principalId
+    || bundle.localhost_root !== expected.localhostRoot
+    || bundle.included?.data_kit !== true
+    || bundle.data_kit?.schema !== "elastos.recovery-kit/v1"
+    || bundle.data_kit.principal_id !== expected.principalId
+    || bundle.data_kit.localhost_root !== expected.localhostRoot) {
+    throw new AcceptanceEvidenceError("Recovery Kit does not contain the current principal's bound data kit");
+  }
+  const identity = bundle.people_identity;
+  const authority = identity?.profile_authority_bundle;
+  const signed = authority?.signed_profile;
+  const profile = signed?.payload;
+  if (bundle.included?.people_identity !== true
+    || identity?.schema !== "elastos.people.recovery-identity/v1"
+    || authority?.schema !== "elastos.profile-authority-bundle/v1"
+    || !/^[0-9a-f]{64}$/.test(authority.profile_signing_seed_hex || "")
+    || profile?.schema !== "elastos.profile-document/v1"
+    || !isDidKey(profile.profile_did)
+    || signed.signer_did !== profile.profile_did
+    || !/^[0-9a-f]{128}$/.test(signed.signature || "")
+    || profile.display_name !== expected.profileName) {
+    throw new AcceptanceEvidenceError("Recovery Kit does not include the signed Profile created by signup");
+  }
+  return { principal_binding_checked: true, profile_included: true };
+}
+
 export function assertRecoverySetupEvidence(config, evidence) {
   exactObjectKeys(evidence, ["a", "b"], "recovery setup evidence");
   const validateSide = (side, summary) => {
     exactObjectKeys(summary, [
       "download_count",
       "download_path",
-      "before_status",
-      "blocked_status",
-      "after_status",
+      "profile_status",
+      "profile_name",
+      "before_recovery_status",
+      "after_recovery_status",
+      "principal_binding_checked",
+      "profile_included",
+      "archive_available",
     ], `${side.prefix} recovery evidence`);
     const downloadPath = absolutePath(
       summary.download_path,
@@ -377,22 +432,20 @@ export function assertRecoverySetupEvidence(config, evidence) {
     );
     if (
       summary.download_count !== 1
-      || summary.before_status !== "setup_required"
-      || summary.blocked_status !== "recovery_required"
-      || summary.after_status !== "setup_required"
+      || summary.profile_status !== "ready"
+      || summary.profile_name !== `${side.name} Admin`
+      || summary.before_recovery_status !== "setup_required"
+      || summary.after_recovery_status !== "ready"
+      || summary.principal_binding_checked !== true
+      || summary.profile_included !== true
+      || summary.archive_available !== true
       || !isPathInsideRoot(side.fixture.dataRoot, downloadPath)
     ) {
       throw new AcceptanceEvidenceError(
         `${side.prefix} recovery evidence is not a single verified fixture-owned Recovery setup`,
       );
     }
-    return {
-      download_count: summary.download_count,
-      download_path: downloadPath,
-      before_status: summary.before_status,
-      blocked_status: summary.blocked_status,
-      after_status: summary.after_status,
-    };
+    return { ...summary, download_path: downloadPath };
   };
   const a = validateSide(config.a, evidence.a);
   const b = validateSide(config.b, evidence.b);
diff --git a/scripts/home-two-runtime-acceptance.mjs b/scripts/home-two-runtime-acceptance.mjs
index fbca38324..c11d583cf 100644
--- a/scripts/home-two-runtime-acceptance.mjs
+++ b/scripts/home-two-runtime-acceptance.mjs
@@ -8,10 +8,9 @@
 // the contact, and survive a restart of both runtimes — asserting along the
 // way that normal UI never shows a raw DID.
 //
-// Each side signs in with a persisted virtual-authenticator credential
-// created by scripts/home-passkey-virtual-auth-smoke.mjs run with
-// HOME_VIRTUAL_AUTH_CLEANUP=0 and HOME_VIRTUAL_AUTH_PROFILE pointing at the
-// same directory passed here.
+// Each fresh Home enrolls its first owner passkey with a virtual authenticator.
+// Both fixture profiles must have empty credential stores before this run.
+// This run proves owner enrollment; guest account enrollment is a separate leg.
 //
 //   ELASTOS_A_BASE_URL=<fixture-a-origin> \
 //   ELASTOS_A_PROFILE=<fixture-a-browser-profile> \
@@ -24,16 +23,18 @@
 //   node scripts/home-two-runtime-acceptance.mjs
 
 import { execSync } from "node:child_process";
-import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { createRequire } from "node:module";
 
 import {
   assertRecoverySetupEvidence,
+  assertRecoveryBundleEvidence,
   assertDistinctProfileContactEvidence,
   assertDistinctRuntimeEvidence,
   assertExactDirectConversation,
   assertFreshFixturePrecondition,
+  assertFreshOwnerEnrollmentPrecondition,
   assertIdentityFrame,
   assertRestartTransition,
   createAcceptanceReport,
@@ -45,7 +46,13 @@ import {
 
 const CONFIG = (() => {
   try {
-    return loadAcceptanceConfig(process.env);
+    const config = loadAcceptanceConfig(process.env);
+    // Admit both sides before either browser starts or enrolls a passkey.
+    assertFreshOwnerEnrollmentPrecondition(
+      readCredentialStore(config.a.profile).length,
+      readCredentialStore(config.b.profile).length,
+    );
+    return config;
   } catch (error) {
     console.error("FAIL home-two-runtime-acceptance configuration");
     console.log(JSON.stringify({
@@ -136,9 +143,13 @@ async function persistCredentials(side) {
     { mode: 0o600 },
   );
   chmodSync(credentialStorePath(side.profile), 0o600);
+  return credentials.length;
 }
 
 async function openSide(side) {
+  const stored = readCredentialStore(side.profile);
+  // Recheck before launch if fixture state changed after configuration admission.
+  assertFreshOwnerEnrollmentPrecondition(stored.length, 0);
   const context = await chromium.launchPersistentContext(side.profile, {
     acceptDownloads: true,
     headless: true,
@@ -183,7 +194,6 @@ async function openSide(side) {
       automaticPresenceSimulation: true,
     },
   });
-  const stored = readCredentialStore(side.profile);
   for (const credential of stored) {
     await cdp.send("WebAuthn.addCredential", { authenticatorId, credential });
   }
@@ -202,7 +212,7 @@ async function openSide(side) {
 async function ensureAccount(side) {
   if (side.hasStoredCredential) {
     await signIn(side);
-    return;
+    return { enrollment: "resumed" };
   }
   // First passkey on a fresh Home becomes the admin.
   await side.page.goto(`${side.base}/apps/home/`, { waitUntil: "domcontentloaded" });
@@ -214,16 +224,23 @@ async function ensureAccount(side) {
       && response.url().endsWith("/api/auth/passkey/register/complete")
   ), { timeout: 30_000 });
   registered.catch(() => {});
-  await side.page.evaluate(() => {
-    document.querySelector("#home-unlock-primary")?.click();
-  });
+  await side.page.locator("#home-unlock-primary").click();
   const completion = await registered;
   assertOk(completion.ok(), `${side.prefix}: passkey registration failed`, {
     status: completion.status(),
   });
-  await persistCredentials(side);
+  const verified = await completion.json();
+  assertOk(verified?.schema === "elastos.auth.passkey.verify/v2"
+    && typeof verified.principal_id === "string" && verified.principal_id.length > 0
+    && verified.profile_readiness?.schema === "elastos.profile.readiness/v1"
+    && verified.profile_readiness.status === "ready",
+  `${side.prefix}: signup did not create a ready signed Profile`);
+  side.signupPrincipalId = verified.principal_id;
+  const credentials = await persistCredentials(side);
+  assertOk(credentials === 1, `${side.prefix}: fresh enrollment did not create exactly one passkey`, { credential_count: credentials });
   side.hasStoredCredential = true;
   await signIn(side);
+  return { enrollment: "enrolled", credential_count: credentials };
 }
 
 async function signIn(side) {
@@ -243,9 +260,12 @@ async function signIn(side) {
       return { done: true, value: state };
     }
     if (state.unlockVisible && /passkey/i.test(state.unlockPrimary)) {
-      await side.page.evaluate(() => {
-        document.querySelector("#home-unlock-primary")?.click();
-      }).catch(() => {});
+      const person = side.page.locator("#home-unlock-person");
+      const primary = side.page.locator("#home-unlock-primary");
+      const action = await person.isVisible() ? person : primary;
+      if (await action.isVisible() && await action.isEnabled()) {
+        await action.click();
+      }
     }
     return { done: false, value: state };
   });
@@ -281,8 +301,24 @@ async function waitForFrame(side, target, timeoutMs = 30_000) {
 }
 
 async function openAppWindow(side, target) {
-  await signIn(side);
+  // Keep existing capsule documents and their drafts alive when Home is ready.
+  const ready = await side.page.evaluate(() => (
+    document.body?.dataset?.homeAuthority === "signed"
+      && document.body?.dataset?.homeStatus === "ready"
+  )).catch(() => false);
+  if (!ready) {
+    await signIn(side);
+  }
   const homeGuiFrame = await waitForFrame(side, "home-gui");
+  if (target === "system" && await homeGuiFrame.locator("#setup-sheet:not(.is-yielded)").isVisible()) {
+    const saveRecoveryKit = homeGuiFrame.locator("#setup-sheet-recovery");
+    assertOk(
+      (await saveRecoveryKit.innerText()).trim() === "Save Recovery Kit",
+      `${side.prefix}: fresh Home Welcome did not offer Save Recovery Kit`,
+    );
+    await saveRecoveryKit.click();
+    return waitForAppWindow(side, target);
+  }
   await homeGuiFrame.locator("#launcher-toggle").click();
   const card = homeGuiFrame.locator(`#launcher-grid [data-target="${target}"]`).first();
   await card.waitFor({ state: "visible", timeout: 10_000 });
@@ -291,6 +327,11 @@ async function openAppWindow(side, target) {
   await homeGuiFrame.evaluate((appTarget) => {
     document.querySelector(`#launcher-grid [data-target="${appTarget}"]`)?.click();
   }, target);
+  return waitForAppWindow(side, target);
+}
+
+async function waitForAppWindow(side, target) {
+  const homeGuiFrame = await waitForFrame(side, "home-gui");
   const windowFrameEl = homeGuiFrame
     .locator(`section.window[data-target="${target}"] iframe.window-frame`)
     .last();
@@ -357,114 +398,110 @@ async function peopleSnapshot(frame) {
   });
 }
 
-async function peopleReadiness(frame) {
-  return frame.evaluate(async () => {
-    const token = new URLSearchParams(window.location.hash.replace(/^#/, ""))
-      .get("home_token") || "";
-    if (!token) {
-      return { status: "", schema: "" };
-    }
-    const response = await fetch("/api/apps/people/summary", {
+async function homeRecoveryState(side, systemFrame = null) {
+  const home = await side.page.evaluate(async () => {
+    const response = await fetch("/api/apps/home/summary", { credentials: "same-origin" });
+    if (!response.ok) throw new Error(`Home Recovery acceptance read failed: HTTP ${response.status}`);
+    const home = await response.json();
+    return {
+      signedIn: home?.authority?.signed_in === true,
+      profileSchema: home?.identity?.profile_readiness?.schema || "",
+      profileStatus: home?.identity?.profile_readiness?.status || "",
+      profileName: home?.identity?.profile?.display_name || "",
+      recoverySchema: home?.identity?.recovery_readiness?.schema || "",
+      recoveryStatus: home?.identity?.recovery_readiness?.status || "",
+    };
+  });
+  if (!systemFrame) return home;
+  const recovery = await systemFrame.evaluate(async () => {
+    const token = new URLSearchParams(window.location.hash.replace(/^#/, "")).get("home_token") || "";
+    if (!token) throw new Error("Recovery acceptance requires the launched System window");
+    const response = await fetch("/api/auth/recovery/status", {
       credentials: "same-origin",
       headers: { "x-elastos-home-token": token },
     });
-    if (!response.ok) {
-      return { status: "", schema: "" };
-    }
-    const summary = await response.json();
-    const readiness = summary?.identity?.profile_readiness;
+    if (!response.ok) throw new Error(`System Recovery acceptance read failed: HTTP ${response.status}`);
+    const recovery = await response.json();
     return {
-      schema: typeof readiness?.schema === "string" ? readiness.schema.trim() : "",
-      status: typeof readiness?.status === "string" ? readiness.status.trim() : "",
+      archiveSchema: recovery?.schema || "",
+      principalId: recovery?.principal_id || "",
+      localhostRoot: recovery?.localhost_root || "",
+      rootEncrypted: recovery?.root_encrypted === true,
+      recoveryConfigured: recovery?.recovery_configured === true,
+      archiveAvailable: recovery?.recovery_download_available === true,
+      profileCovered: Array.isArray(recovery?.required_actions)
+        && !recovery.required_actions.includes("download_recovery_kit_with_profile"),
     };
   });
+  return { ...home, ...recovery };
 }
 
-async function completeRecoverySetup(side, peopleFrame) {
-  const before = await peopleReadiness(peopleFrame);
-  assertOk(
-    before.schema === "elastos.profile.readiness/v1" && before.status === "setup_required",
-    `${side.prefix}: fresh Home did not begin in setup_required Profile readiness`,
-    before,
-  );
-  await peopleFrame.locator("#profile-name").fill(side.name);
-  const blockedSave = side.page.waitForResponse((response) => (
-    response.request().method() === "POST"
-      && response.url().endsWith("/api/apps/people/profile")
-  ), { timeout: 30_000 });
-  blockedSave.catch(() => {});
-  await peopleFrame.evaluate(() => {
-    document.querySelector("#profile-submit")?.click();
-  });
-  const blockedResponse = await blockedSave;
-  const blockedBody = await blockedResponse.json().catch(() => ({}));
-  assertOk(
-    blockedResponse.status() === 409
-      && blockedBody?.schema === "elastos.people.profile-protection-required/v1"
-      && blockedBody?.status === "recovery_required"
-      && blockedBody?.action_target === "system",
-    `${side.prefix}: first Profile save did not fail with the exact Recovery-required result`,
-    {
-      status: blockedResponse.status(),
-      body: blockedBody,
-    },
-  );
-  const systemFramePromise = waitForFrame(side, "system", 30_000);
-  await peopleFrame.evaluate(() => {
-    document.querySelector("#profile-submit")?.click();
-  });
-  const systemFrame = await systemFramePromise;
-  await systemFrame.evaluate(() => {
-    const button = document.querySelector('button[data-settings="security"]');
-    if (!(button instanceof HTMLButtonElement)) {
-      throw new Error("System security button is missing");
-    }
-    button.click();
-  });
-  await systemFrame.locator('button[data-settings="security"].active').waitFor({
-    state: "visible",
-    timeout: 10_000,
-  });
-  await systemFrame.locator('#recovery-download').waitFor({
-    state: "visible",
-    timeout: 10_000,
-  });
-  const downloadTarget = recoveryDownloadPath(side);
-  mkdirSync(join(side.fixture.dataRoot, "acceptance-recovery"), {
-    recursive: true,
-    mode: 0o700,
-  });
+async function completeRecoverySetup(side) {
+  const before = await homeRecoveryState(side);
+  assertOk(before.signedIn
+    && before.profileSchema === "elastos.profile.readiness/v1" && before.profileStatus === "ready"
+    && before.profileName === `${side.name} Admin`
+    && before.recoverySchema === "elastos.recovery.readiness/v1" && before.recoveryStatus === "setup_required",
+  `${side.prefix}: fresh signup did not create its consented Profile with Recovery still required`);
+  const homeGuiFrame = await waitForFrame(side, "home-gui");
+  await homeGuiFrame.locator("#setup-sheet:not(.is-yielded)").waitFor({ state: "visible", timeout: 30_000 });
+  let downloads = 0;
+  const countDownload = () => { downloads += 1; };
+  side.page.on("download", countDownload);
   const downloadPromise = side.page.waitForEvent("download", { timeout: 45_000 });
-  await systemFrame.evaluate(() => {
-    const button = document.querySelector("#recovery-download");
-    if (!(button instanceof HTMLButtonElement)) {
-      throw new Error("System Recovery download button is missing");
-    }
-    button.click();
-  });
-  const download = await downloadPromise;
-  await download.saveAs(downloadTarget);
-  chmodSync(downloadTarget, 0o600);
-  const bundle = JSON.parse(readFileSync(downloadTarget, "utf8"));
-  assertOk(
-    bundle?.schema === "elastos.full-recovery-bundle/v1",
-    `${side.prefix}: Recovery download did not produce the expected bundle`,
-    { schema: bundle?.schema || "", suggested: download.suggestedFilename() },
-  );
-  const after = await poll(`${side.prefix}: Recovery changes Profile readiness`, 30_000, 500, async () => {
-    const current = await peopleReadiness(peopleFrame);
+  downloadPromise.catch(() => {});
+  try {
+    const [systemFrame, download] = await Promise.all([
+      openAppWindow(side, "system"),
+      downloadPromise,
+    ]);
+    await systemFrame.locator('button[data-settings="security"].active').waitFor({
+      state: "visible", timeout: 10_000,
+    });
+    const downloadTarget = recoveryDownloadPath(side);
+    mkdirSync(join(side.fixture.dataRoot, "acceptance-recovery"), { recursive: true, mode: 0o700 });
+    await download.saveAs(downloadTarget);
+    chmodSync(downloadTarget, 0o600);
+    const bytes = statSync(downloadTarget).size;
+    assertOk(bytes > 0 && bytes <= 8 * 1024 * 1024, `${side.prefix}: Recovery Kit size is invalid`);
+    let bundle;
+    try { bundle = JSON.parse(readFileSync(downloadTarget, "utf8")); }
+    catch { fail(`${side.prefix}: Recovery Kit is not valid JSON`); }
+    const after = await poll(`${side.prefix}: saved Recovery Kit is ready`, 30_000, 500, async () => {
+      const current = await homeRecoveryState(side, systemFrame);
+      return {
+        done: current.recoverySchema === "elastos.recovery.readiness/v1" && current.recoveryStatus === "ready"
+          && current.rootEncrypted && current.recoveryConfigured && current.archiveAvailable && current.profileCovered,
+        value: current,
+      };
+    });
+    assertOk(after.signedIn && after.archiveSchema === "elastos.principal.root-recovery.status/v1"
+      && after.principalId === side.signupPrincipalId && after.localhostRoot.startsWith("localhost://Users/")
+      && after.profileSchema === "elastos.profile.readiness/v1" && after.profileStatus === "ready"
+      && after.profileName === before.profileName,
+    `${side.prefix}: Recovery export changed the signup account or Profile`);
+    const proof = assertRecoveryBundleEvidence(bundle, {
+      principalId: side.signupPrincipalId,
+      localhostRoot: after.localhostRoot,
+      profileName: before.profileName,
+    });
+    // Home exposes the Profile name. Mutual accepted contacts later bind this
+    // private Recovery identity through Runtime's opaque contact projection.
+    side.recoveryProfileDid = bundle.people_identity.profile_authority_bundle.signed_profile.payload.profile_did;
+    assertOk(downloads === 1, `${side.prefix}: Welcome did not save exactly one Recovery Kit`, { download_count: downloads });
     return {
-      done: current.schema === "elastos.profile.readiness/v1" && current.status === "setup_required",
-      value: current,
+      download_count: downloads,
+      download_path: downloadTarget,
+      profile_status: after.profileStatus,
+      profile_name: after.profileName,
+      before_recovery_status: before.recoveryStatus,
+      after_recovery_status: after.recoveryStatus,
+      ...proof,
+      archive_available: after.archiveAvailable,
     };
-  });
-  return {
-    download_count: 1,
-    download_path: downloadTarget,
-    before_status: before.status,
-    blocked_status: blockedBody.status,
-    after_status: after.status,
-  };
+  } finally {
+    side.page.off("download", countDownload);
+  }
 }
 
 async function saveProfile(side, frame, name) {
@@ -543,15 +580,22 @@ async function requestContact(side, frame, peerName) {
 async function acceptContactRequest(side, frame, peerName) {
   await poll(`${side.prefix}: accepted request from ${peerName}`, 120_000, 3_000, async () => {
     const result = await frame.evaluate((name) => {
-      const entries = [...document.querySelectorAll("#entry-list article, #entry-list li, #entry-list section")];
-      const scope = entries.length > 0 ? entries : [document.querySelector("#entry-list")].filter(Boolean);
-      const matches = scope.flatMap((entry) => {
+      const entries = [...document.querySelectorAll("#entry-rows .entry-rail-card, #entry-rows .entry-row")];
+      const matches = entries.flatMap((entry) => {
         const text = (entry.textContent || "").replace(/\s+/g, " ");
         if (!text.includes(name)) {
           return [];
         }
-        const accept = [...entry.querySelectorAll("button")]
+        let accept = [...entry.querySelectorAll("button")]
           .find((button) => button.textContent?.trim() === "Accept");
+        if (!accept && entry.classList.contains("entry-row")) {
+          entry.click();
+          const detail = document.querySelector("#entry-detail");
+          if (detail?.textContent?.includes(name)) {
+            accept = [...detail.querySelectorAll("button")]
+              .find((button) => button.textContent?.trim() === "Accept");
+          }
+        }
         return accept ? [{ accept }] : [];
       });
       if (matches.length === 1) {
@@ -605,33 +649,17 @@ async function openConversation(side, peopleFrame, peerName, expectedConversatio
       .find((node) => node.dataset.conversationId === id);
     exact?.click();
   }, conversationId);
-  const homeGuiFrame = await waitForFrame(side, "home-gui");
-  const windowFrameEl = homeGuiFrame
-    .locator('section.window[data-target="chat-room"] iframe.window-frame')
-    .last();
-  try {
-    await windowFrameEl.waitFor({ state: "visible", timeout: 30_000 });
-  } catch (error) {
-    fail(`${side.prefix}: chat window never opened`, {
-      console: side.consoleTail.slice(-15),
-    });
-  }
-  const handle = await windowFrameEl.elementHandle();
-  const chatFrame = handle ? await handle.contentFrame() : null;
-  assertOk(chatFrame, `${side.prefix}: chat window had no content frame`);
-  await poll(`${side.prefix}: chat document`, 20_000, 200, async () => (
-    { done: chatFrame.url().includes("/apps/chat-room/") }
-  ));
-  await chatFrame.waitForFunction(() => Boolean(document.body), null, { timeout: 15_000 });
+  const chatFrame = await waitForAppWindow(side, "chat-room");
+  await assertDirectSelection(side, chatFrame, conversationId);
+  return { frame: chatFrame, conversationId };
+}
+
+async function assertDirectSelection(side, chatFrame, conversationId) {
   await chatFrame.waitForFunction(() => {
     const input = document.querySelector("#message-input");
     return input && !input.disabled;
   }, null, { timeout: 60_000 });
-  await chatFrame.evaluate((id) => {
-    const exact = [...document.querySelectorAll("[data-conversation-choice]")]
-      .find((node) => node.dataset.conversationChoice === id);
-    exact?.click();
-  }, conversationId);
+  // A launch must select its requested contact without a corrective rail click.
   const selection = await poll(`${side.prefix}: exact direct conversation selected`, 30_000, 250, async () => {
     const state = await chatFrame.evaluate(() => ({
       availableConversationIds: [...document.querySelectorAll("[data-conversation-choice]")]
@@ -651,7 +679,16 @@ async function openConversation(side, peopleFrame, peerName, expectedConversatio
     }
   });
   assertExactDirectConversation({ expectedConversationId: conversationId, ...selection });
-  return { frame: chatFrame, conversationId };
+  return selection;
+}
+
+async function selectDirectConversation(side, chatFrame, conversationId) {
+  await chatFrame.evaluate((id) => {
+    const exact = [...document.querySelectorAll("[data-conversation-choice]")]
+      .find((node) => node.dataset.conversationChoice === id);
+    exact?.click();
+  }, conversationId);
+  await assertDirectSelection(side, chatFrame, conversationId);
 }
 
 async function selectSharedConversation(side, chatFrame) {
@@ -678,6 +715,110 @@ async function openSharedConversation(side) {
   return chatFrame;
 }
 
+async function openParticipantCard(side, chatFrame, peerName, expectedAction) {
+  if (!(await chatFrame.locator("#participant-list").isVisible())) {
+    await chatFrame.locator("#participant-toggle").click();
+  }
+  let opened = false;
+  let nextRefresh = 0;
+  await poll(`${side.prefix}: Community Profile for ${peerName}`, 120_000, 1_000, async () => {
+    const shouldOpen = !opened || Date.now() >= nextRefresh;
+    const result = await chatFrame.evaluate(({ name, action, shouldOpen }) => {
+      const peers = [...document.querySelectorAll("#participant-list [data-participant-ref]")]
+        .filter((node) => node.querySelector(".participant-name")?.textContent?.trim() === name);
+      const pending = document.querySelector("#participant-card-action")?.disabled === true;
+      if (peers.length === 1 && shouldOpen && !pending) {
+        peers[0].click();
+      }
+      const card = document.querySelector("#participant-card");
+      const button = document.querySelector("#participant-card-action");
+      return {
+        count: peers.length,
+        opened: peers.length === 1 && shouldOpen && !pending,
+        name: document.querySelector("#participant-card-name")?.textContent?.trim() || "",
+        action: button?.dataset?.cardAction || "",
+        ready: card?.hidden === false && button?.hidden === false && !button?.disabled
+          && button?.dataset?.cardAction === action,
+      };
+    }, { name: peerName, action: expectedAction, shouldOpen });
+    assertOk(result.count <= 1, `${side.prefix}: ambiguous Community Profile`, result);
+    if (result.opened) {
+      opened = true;
+      nextRefresh = Date.now() + 5_000;
+    }
+    return { done: result.count === 1 && result.name === peerName && result.ready, value: result };
+  });
+}
+
+async function requestCommunityContact(side, chatFrame, peopleFrame, peerName) {
+  await openParticipantCard(side, chatFrame, peerName, "add-contact");
+  const requestResponse = side.page.waitForResponse((response) => (
+    response.request().method() === "POST"
+      && new URL(response.url()).pathname === "/api/apps/chat-room/contacts/request"
+  ), { timeout: 30_000 });
+  requestResponse.catch(() => {});
+  await chatFrame.locator("#participant-card-action").click();
+  const response = await requestResponse;
+  assertOk(response.ok(), `${side.prefix}: Community contact request failed`, { status: response.status() });
+  await poll(`${side.prefix}: one Community contact request`, 60_000, 1_000, async () => {
+    const snapshot = await peopleSnapshot(peopleFrame);
+    const requested = snapshot.contacts.filter((card) => (
+      card.text.includes(peerName) && /Request sent|Requested/i.test(card.text)
+    ));
+    assertOk(requested.length <= 1, `${side.prefix}: duplicate outgoing contact requests`, { count: requested.length });
+    return { done: requested.length === 1, value: { count: requested.length } };
+  });
+  return { count: 1, request_surface: "community_profile" };
+}
+
+async function openInboxFromCommunity(side, chatFrame, peerName) {
+  await openParticipantCard(side, chatFrame, peerName, "inbox");
+  await chatFrame.locator("#participant-card-action").click();
+  // No launcher fallback: the Profile action itself must open Inbox.
+  return waitForAppWindow(side, "inbox");
+}
+
+async function openDirectFromCommunity(side, chatFrame, peerName, conversationId) {
+  await selectSharedConversation(side, chatFrame);
+  await openParticipantCard(side, chatFrame, peerName, "message");
+  await chatFrame.locator("#participant-card-action").click();
+  await assertDirectSelection(side, chatFrame, conversationId);
+  return { frame: chatFrame, conversationId };
+}
+
+async function openDirectFromInbox(side, inboxFrame, message, conversationId) {
+  await poll(`${side.prefix}: Inbox notification opens its conversation`, 60_000, 1_000, async () => {
+    const result = await inboxFrame.evaluate((needle) => {
+      const entries = [...document.querySelectorAll("#entry-rows .entry-rail-card, #entry-rows .entry-row")]
+        .filter((node) => node.textContent?.includes(needle));
+      if (entries.length !== 1) {
+        return { count: entries.length, opened: false };
+      }
+      const row = entries[0];
+      let button = [...row.querySelectorAll("button")]
+        .find((node) => node.textContent?.trim() === "Open");
+      if (!button) {
+        row.click();
+        const detail = document.querySelector("#entry-detail");
+        if (detail?.textContent?.includes(needle)) {
+          button = [...detail.querySelectorAll("button")]
+            .find((node) => node.textContent?.trim() === "Open");
+        }
+      }
+      if (button && !button.disabled) {
+        button.click();
+        return { count: 1, opened: true };
+      }
+      return { count: 1, opened: false };
+    }, message);
+    assertOk(result.count <= 1, `${side.prefix}: ambiguous Inbox direct notification`, result);
+    return { done: result.opened, value: result };
+  });
+  const chatFrame = await waitForAppWindow(side, "chat-room");
+  await assertDirectSelection(side, chatFrame, conversationId);
+  return { frame: chatFrame, conversationId };
+}
+
 async function chatFrameState(chatFrame) {
   return chatFrame.evaluate(() => ({
     chatMode: document.body?.dataset?.chatMode || "",
@@ -699,10 +840,9 @@ async function sendMessage(side, chatFrame, text) {
   });
   try {
     await poll(`${side.prefix}: sent "${text}"`, 45_000, 1_000, async () => {
-      const listed = await chatFrame.evaluate((needle) => (
-        (document.querySelector("#message-list")?.textContent || "").includes(needle)
-      ), text);
-      return { done: listed };
+      const count = await exactMessageCount(chatFrame, text);
+      assertOk(count <= 1, `${side.prefix}: duplicate rendered message`, { count });
+      return { done: count === 1, value: { count } };
     });
     const sent = await chatFrameState(chatFrame);
     console.error(`[acceptance] ${side.prefix}: post-send tail: ${sent.messagesTail.slice(-160)}`);
@@ -718,10 +858,9 @@ async function sendMessage(side, chatFrame, text) {
 async function waitForMessage(side, chatFrame, text, timeoutMs = 300_000) {
   try {
     await poll(`${side.prefix}: received "${text}"`, timeoutMs, 2_000, async () => {
-      const listed = await chatFrame.evaluate((needle) => (
-        (document.querySelector("#message-list")?.textContent || "").includes(needle)
-      ), text);
-      return { done: listed };
+      const count = await exactMessageCount(chatFrame, text);
+      assertOk(count <= 1, `${side.prefix}: duplicate received message`, { count });
+      return { done: count === 1, value: { count } };
     });
   } catch (error) {
     fail(`${side.prefix}: message never arrived`, {
@@ -733,6 +872,273 @@ async function waitForMessage(side, chatFrame, text, timeoutMs = 300_000) {
   }
 }
 
+async function exactMessageCount(chatFrame, text) {
+  return chatFrame.evaluate((needle) => [...document.querySelectorAll("#message-list .message-body")]
+    .filter((node) => node.textContent === needle).length, text);
+}
+
+async function assertDraft(side, chatFrame, selected, text) {
+  const state = await chatFrameState(chatFrame);
+  assertOk(
+    state.selectedConversationId === selected && state.inputValue === text,
+    `${side.prefix}: conversation draft changed`,
+    { selected: state.selectedConversationId, expected: selected, draft_preserved: state.inputValue === text },
+  );
+}
+
+async function withHeldSendResponse(side, chatFrame, path, sentText, conversationId, operation) {
+  const matcher = (url) => url.origin === side.base && url.pathname === path;
+  let responseStatus;
+  let release;
+  let handlerCompletion;
+  let handlerError;
+  let intercepted = 0;
+  let deadlineExpired = false;
+  const handler = async (route) => {
+    try {
+      const request = route.request();
+      if (request.method() !== "POST") {
+        await route.continue();
+        return;
+      }
+      const payload = request.postDataJSON();
+      if ((payload?.text ?? payload?.body) !== sentText) {
+        await route.continue();
+        return;
+      }
+      intercepted += 1;
+      assertOk(intercepted === 1, "held send was submitted more than once");
+      if (conversationId !== "shared") {
+        assertOk(payload.conversation_id === conversationId, "held send targeted the wrong contact");
+      }
+      const response = await route.fetch({ timeout: 10_000 });
+      responseStatus = response.status();
+      const gate = new Promise((resolve) => { release = resolve; });
+      const deadline = setTimeout(() => { deadlineExpired = true; release(); }, 20_000);
+      handlerCompletion = (async () => {
+        try {
+          await gate;
+          await route.fulfill({ response });
+        } finally {
+          clearTimeout(deadline);
+        }
+      })();
+      await handlerCompletion;
+    } catch (error) {
+      handlerError = error;
+      await route.abort().catch(() => {});
+    }
+  };
+  await side.page.route(matcher, handler);
+  try {
+    await chatFrame.locator("#message-input").fill(sentText);
+    await chatFrame.locator("#send-button").click();
+    await poll("successful send response is held", 15_000, 100, async () => {
+      assertOk(!handlerError, "held-response interception failed");
+      return { done: Boolean(release), value: { status: responseStatus } };
+    });
+    assertOk(responseStatus >= 200 && responseStatus < 300, "held send did not succeed", { status: responseStatus });
+    await operation(async () => {
+      assertOk(!deadlineExpired, "held response deadline elapsed before draft checks");
+      release();
+      await handlerCompletion;
+      assertOk(!handlerError, "held-response release failed");
+    });
+    assertOk(!handlerError && !deadlineExpired, "held-response proof did not complete within its bound");
+    return responseStatus;
+  } finally {
+    release?.();
+    await handlerCompletion?.catch(() => {});
+    await side.page.unroute(matcher, handler);
+  }
+}
+
+async function proveDraftPreservation(a, chatFrame, b, bChatFrame, conversationId) {
+  const directDraft = `Direct draft @ ${Date.now()}`;
+  const sharedDraft = `Community draft @ ${Date.now()}`;
+  await chatFrame.locator("#message-input").fill(directDraft);
+  await selectSharedConversation(a, chatFrame);
+  await assertDraft(a, chatFrame, "shared", "");
+  await chatFrame.locator("#message-input").fill(sharedDraft);
+  await selectDirectConversation(a, chatFrame, conversationId);
+  await assertDraft(a, chatFrame, conversationId, directDraft);
+
+  // An edit within the same direct selection must invalidate its old send.
+  const directText = `Held direct response @ ${Date.now()}`;
+  const newerDirectDraft = `Newer direct draft @ ${Date.now()}`;
+  const directStatus = await withHeldSendResponse(
+    a, chatFrame, "/api/apps/chat-room/direct/messages/send", directText, conversationId,
+    async (release) => {
+      await chatFrame.locator("#message-input").fill(newerDirectDraft);
+      await release();
+      await waitForMessage(a, chatFrame, directText, 30_000);
+      await delay(1_000);
+      await assertDraft(a, chatFrame, conversationId, newerDirectDraft);
+      await waitForMessage(b, bChatFrame, directText, 60_000);
+    },
+  );
+  await selectSharedConversation(a, chatFrame);
+  await assertDraft(a, chatFrame, "shared", sharedDraft);
+  await selectSharedConversation(b, bChatFrame);
+
+  // Returning to Community must still invalidate a response from its older
+  // selection, even though the conversation name is the same again.
+  const sharedText = `Held Community response @ ${Date.now()}`;
+  const newerSharedDraft = `Newer Community draft @ ${Date.now()}`;
+  const sharedStatus = await withHeldSendResponse(
+    a, chatFrame, "/api/apps/chat-room/objects/send", sharedText, "shared",
+    async (release) => {
+      await chatFrame.locator("#message-input").fill(newerSharedDraft);
+      await selectDirectConversation(a, chatFrame, conversationId);
+      await assertDraft(a, chatFrame, conversationId, newerDirectDraft);
+      await selectSharedConversation(a, chatFrame);
+      await assertDraft(a, chatFrame, "shared", newerSharedDraft);
+      await release();
+      await waitForMessage(a, chatFrame, sharedText, 30_000);
+      await delay(1_000);
+      await assertDraft(a, chatFrame, "shared", newerSharedDraft);
+      await waitForMessage(b, bChatFrame, sharedText, 60_000);
+    },
+  );
+  await chatFrame.locator("#message-input").fill("");
+  await selectDirectConversation(a, chatFrame, conversationId);
+  await assertDraft(a, chatFrame, conversationId, newerDirectDraft);
+  await chatFrame.locator("#message-input").fill("");
+  await selectDirectConversation(b, bChatFrame, conversationId);
+  return {
+    switched_drafts_preserved: true,
+    direct_newer_draft_after_response: true,
+    shared_newer_draft_after_response: true,
+    held_send_status: { direct: directStatus, shared: sharedStatus },
+    receiver_message_count: { direct: 1, shared: 1 },
+  };
+}
+
+async function proveSessionRecovery(side, chatFrame, receiver, receiverFrame, {
+  conversationId = "shared",
+  lossSource = "poll",
+} = {}) {
+  const direct = conversationId !== "shared";
+  assertOk(lossSource === "poll" || direct && lossSource === "send", "unsupported recovery fault");
+  if (direct) {
+    await selectDirectConversation(side, chatFrame, conversationId);
+    await selectDirectConversation(receiver, receiverFrame, conversationId);
+  } else {
+    await selectSharedConversation(side, chatFrame);
+  }
+  const documentStartedAt = await chatFrame.evaluate(() => performance.timeOrigin);
+  const oldHomeToken = await chatFrame.evaluate(() => globalThis.elastosChatHomeToken?.());
+  assertOk(typeof oldHomeToken === "string" && oldHomeToken.length > 0, "Chat had no launch authority before session loss");
+  const draft = `${direct ? "Direct" : "Community"} ${lossSource} Reconnect draft @ ${Date.now()}`;
+  await chatFrame.locator("#message-input").fill(draft);
+  assertOk(!(await chatFrame.locator("#reconnect-button").isVisible()), "Reconnect was already visible before session loss");
+  let injected = false;
+  let handlerError;
+  let starts = 0;
+  let authPosts = 0;
+  const startTokens = [];
+  const countStarts = (request) => {
+    if (request.method() === "POST") {
+      const path = new URL(request.url()).pathname;
+      if (path === "/api/apps/chat-room/session/start") {
+        starts += 1;
+        startTokens.push(request.headers()["x-elastos-home-token"] || "");
+      } else if (path.startsWith("/api/auth/")) {
+        authPosts += 1;
+      }
+    }
+  };
+  const faultPath = direct
+    ? lossSource === "send" ? "/api/apps/chat-room/direct/messages/send"
+      : `/api/apps/chat-room/direct/conversations/${encodeURIComponent(conversationId)}/messages`
+    : "/api/apps/chat-room/poll";
+  const matcher = (url) => url.origin === side.base && url.pathname === faultPath;
+  const handler = async (route) => {
+    try {
+      const request = route.request();
+      if (request.method() !== (!direct || lossSource === "send" ? "POST" : "GET") || injected) {
+        await route.continue();
+        return;
+      }
+      if (lossSource === "send") {
+        const payload = request.postDataJSON();
+        if (payload?.conversation_id !== conversationId || payload?.text !== draft) {
+          await route.continue();
+          return;
+        }
+      }
+      assertOk(request.headers()["x-elastos-home-token"] === oldHomeToken, "recovery fault targeted stale Chat authority");
+      injected = true;
+      await route.fulfill({ status: 401, contentType: "application/json", body: JSON.stringify({
+        error: direct ? "invalid or expired launch token" : "invalid or expired session",
+      }) });
+    } catch (error) {
+      handlerError = error;
+      await route.abort().catch(() => {});
+    }
+  };
+  side.page.on("request", countStarts);
+  await side.page.route(matcher, handler);
+  try {
+    if (lossSource === "send") {
+      await chatFrame.locator("#send-button").click();
+    }
+    await chatFrame.locator("#reconnect-button").waitFor({ state: "visible", timeout: 30_000 });
+    assertOk(!handlerError, "session-loss interception failed");
+    assertOk(injected, "Reconnect appeared without the injected session loss");
+    assertOk(await chatFrame.locator("#reconnect-button").isEnabled(), "Reconnect control was disabled");
+    const explanation = chatFrame.locator("#error-text");
+    assertOk(await explanation.isVisible() && Boolean((await explanation.innerText()).trim()), "Reconnect had no visible explanation");
+    await assertDraft(side, chatFrame, conversationId, draft);
+    const lost = await chatFrameState(chatFrame);
+    assertOk(lost.sendDisabled && (direct || lost.inputDisabled), "Chat kept sending enabled after session loss");
+    await delay(1_500);
+    assertOk(starts === 0, "room session restarted before the Reconnect click", { session_starts: starts });
+    assertOk(authPosts === 0, "sign-in started before the Reconnect click", { auth_posts: authPosts });
+    if (lossSource === "send") {
+      assertOk(await exactMessageCount(receiverFrame, draft) === 0, "refused direct send reached its peer");
+    }
+    await side.page.unroute(matcher, handler);
+    await chatFrame.locator("#reconnect-button").click();
+    await poll(`${side.prefix}: user Reconnect resumes ${direct ? "Direct" : "Community"}`, 30_000, 250, async () => {
+      const state = await chatFrameState(chatFrame);
+      return {
+        done: starts > 0 && !state.inputDisabled && !(await chatFrame.locator("#reconnect-button").isVisible()),
+        value: { session_starts: starts, input_disabled: state.inputDisabled },
+      };
+    });
+    assertOk(
+      (await waitForAppWindow(side, "chat-room")) === chatFrame
+        && (await chatFrame.evaluate(() => performance.timeOrigin)) === documentStartedAt,
+      "Reconnect replaced the Chat document",
+    );
+    const freshHomeToken = await chatFrame.evaluate(() => globalThis.elastosChatHomeToken?.());
+    assertOk(typeof freshHomeToken === "string" && freshHomeToken.length > 0 && freshHomeToken !== oldHomeToken,
+      "Reconnect retained its old launch authority");
+    assertOk(startTokens.length > 0 && startTokens.every((token) => token === freshHomeToken),
+      "Reconnect started a room session with stale launch authority");
+    await assertDraft(side, chatFrame, conversationId, draft);
+    if (direct) {
+      await assertDirectSelection(side, chatFrame, conversationId);
+    }
+    await chatFrame.locator("#message-input").fill("");
+    if (!direct) {
+      await selectSharedConversation(receiver, receiverFrame);
+    }
+    const message = `${direct ? "Direct" : "Community"} after ${lossSource} Reconnect @ ${Date.now()}`;
+    await sendMessage(side, chatFrame, message);
+    await waitForMessage(receiver, receiverFrame, message, 120_000);
+    assertOk(!handlerError, "session-loss interception did not finish cleanly");
+    return { loss_source: lossSource, injected_status: 401, conversation_id: conversationId,
+      visible_reconnect: true, session_starts_before_click: 0, auth_posts_before_click: 0,
+      session_starts_after_click: starts, fresh_home_token: true, same_document: true,
+      draft_preserved: true, receiver_message_count: 1, message };
+  } finally {
+    side.page.off("request", countStarts);
+    await side.page.unroute(matcher, handler);
+  }
+}
+
 async function removeContact(side, frame, peerName) {
   const snapshot = await peopleSnapshot(frame);
   const contact = snapshot.contacts.find((card) => card.text.includes(peerName));
@@ -828,11 +1234,26 @@ async function main() {
   try {
     a = await openSide(SIDE_A);
     b = await openSide(SIDE_B);
+    report.toolchain = {
+      node: process.version,
+      playwright: require("playwright/package.json").version,
+      chromium: a.context.browser()?.version() || "",
+    };
 
     await runLeg(report, "provisioning_and_sign_in", "provision and sign in both fixture Homes", async () => {
-      await ensureAccount(a);
-      await ensureAccount(b);
-      return { a: "signed", b: "signed" };
+      const aEnrollment = await ensureAccount(a);
+      const bEnrollment = await ensureAccount(b);
+      assertOk(aEnrollment.enrollment === "enrolled" && bEnrollment.enrollment === "enrolled",
+        "signup proof requires fresh owner enrollment on both fixture Homes");
+      return { a: aEnrollment, b: bEnrollment, enrollment_surface: "home_owner_passkey" };
+    });
+
+    await runLeg(report, "system_recovery_after_signup", "save each signup Profile in a Recovery Kit from Welcome", async () => {
+      const evidence = {
+        a: await completeRecoverySetup(a),
+        b: await completeRecoverySetup(b),
+      };
+      return assertRecoverySetupEvidence(CONFIG, evidence);
     });
 
     let aDeviceDid;
@@ -857,14 +1278,6 @@ async function main() {
       return { a_contacts: 0, b_contacts: 0 };
     });
 
-    await runLeg(report, "system_recovery_before_profile", "complete System Recovery on both fresh Homes", async () => {
-      const evidence = {
-        a: await completeRecoverySetup(a, aPeople),
-        b: await completeRecoverySetup(b, bPeople),
-      };
-      return assertRecoverySetupEvidence(CONFIG, evidence);
-    });
-
     await runLeg(report, "distinct_profile_names", "save two distinct Profile names", async () => {
       await saveProfile(a, aPeople, SIDE_A.name);
       await saveProfile(b, bPeople, SIDE_B.name);
@@ -889,20 +1302,34 @@ async function main() {
       };
     });
 
-    await runLeg(report, "exactly_one_contact_request", "A sends exactly one contact request", async () => {
+    // Enter Community through Home on both sides. Signed room messages make
+    // the peer's Profile available through the normal participant controls.
+    const [aCommunity, bCommunity] = await Promise.all([
+      openSharedConversation(a),
+      openSharedConversation(b),
+    ]);
+    const aCommunityMarker = `Community hello A @ ${Date.now()}`;
+    const bCommunityMarker = `Community hello B @ ${Date.now()}`;
+    await sendMessage(a, aCommunity, aCommunityMarker);
+    await waitForMessage(b, bCommunity, aCommunityMarker, 120_000);
+    await sendMessage(b, bCommunity, bCommunityMarker);
+    await waitForMessage(a, aCommunity, bCommunityMarker, 120_000);
+
+    await runLeg(report, "exactly_one_contact_request", "A requests the Community Profile once", async () => {
       await assertPeopleHasNoDecisionActions(b, bPeople);
-      const evidence = await requestContact(a, aPeople, SIDE_B.name);
+      const evidence = await requestCommunityContact(a, aCommunity, aPeople, SIDE_B.name);
       assertOk(evidence.count === 1, "outgoing request evidence was not exact", evidence);
       await assertPeopleHasNoDecisionActions(b, bPeople);
       return evidence;
     });
 
-    await runLeg(report, "inbox_only_accept", "B accepts only in Inbox", async () => {
-      const bInbox = await openAppWindow(b, "inbox");
+    let bInbox;
+    await runLeg(report, "inbox_only_accept", "B opens Inbox from the Community Profile and accepts", async () => {
+      bInbox = await openInboxFromCommunity(b, bCommunity, SIDE_A.name);
       await acceptContactRequest(b, bInbox, SIDE_A.name);
       bPeople = await openAppWindow(b, "people");
       await assertPeopleHasNoDecisionActions(b, bPeople);
-      return { decision_surface: "inbox" };
+      return { decision_surface: "inbox", launch_surface: "community_profile" };
     });
 
     let conversationId;
@@ -924,19 +1351,31 @@ async function main() {
     });
 
     await runLeg(report, "distinct_profile_identities", "prove distinct Profile identities through opaque contacts", async () => {
-      assertDistinctProfileContactEvidence(aContactId, bContactId);
-      return { a_contact_id: aContactId, b_contact_id: bContactId };
+      const binding = assertDistinctProfileContactEvidence(aContactId, bContactId, a.recoveryProfileDid, b.recoveryProfileDid);
+      return { a_contact_id: aContactId, b_contact_id: bContactId, ...binding };
     });
 
-    const aDirect = await openConversation(a, aPeople, SIDE_B.name, conversationId);
-    const bDirect = await openConversation(b, bPeople, SIDE_A.name, conversationId);
+    let aDirect;
+    await runLeg(report, "community_profile_launch", "Community Profile Message selects the accepted conversation", async () => {
+      aDirect = await openDirectFromCommunity(a, aCommunity, SIDE_B.name, conversationId);
+      return { conversation_id: conversationId, launch_surface: "community_profile", corrective_selection: false };
+    });
+    let bDirect = await openConversation(b, bPeople, SIDE_A.name, conversationId);
+    // Leave B in Community so Inbox Open must change its selection.
+    await selectSharedConversation(b, bDirect.frame);
     const helloFromA = `Hello from ${SIDE_A.name} @ ${Date.now()}`;
     await runLeg(report, "direct_message_a_to_b", "direct message A to B", async () => {
       await sendMessage(a, aDirect.frame, helloFromA);
+      bDirect = await openDirectFromInbox(b, bInbox, helloFromA, conversationId);
       await waitForMessage(b, bDirect.frame, helloFromA);
       return { conversation_id: conversationId, message: helloFromA };
     });
 
+    await runLeg(report, "inbox_direct_launch", "Inbox Open selects the incoming direct conversation", async () => {
+      await assertDirectSelection(b, bDirect.frame, conversationId);
+      return { conversation_id: conversationId, launch_surface: "inbox", corrective_selection: false };
+    });
+
     const helloFromB = `Hello back from ${SIDE_B.name} @ ${Date.now()}`;
     await runLeg(report, "direct_message_b_to_a", "direct message B to A", async () => {
       await sendMessage(b, bDirect.frame, helloFromB);
@@ -944,6 +1383,19 @@ async function main() {
       return { conversation_id: conversationId, message: helloFromB };
     });
 
+    await runLeg(report, "conversation_draft_preservation", "preserve drafts through selection and a late send response", async () => (
+      proveDraftPreservation(a, aDirect.frame, b, bDirect.frame, conversationId)
+    ));
+
+    await runLeg(report, "shared_session_recovery", "recover the room only after visible Reconnect", async () => (
+      proveSessionRecovery(a, aDirect.frame, b, bDirect.frame)
+    ));
+
+    await runLeg(report, "direct_session_recovery", "recover Direct polling and sending only after visible Reconnect", async () => ({
+      poll: await proveSessionRecovery(a, aDirect.frame, b, bDirect.frame, { conversationId }),
+      send: await proveSessionRecovery(a, aDirect.frame, b, bDirect.frame, { conversationId, lossSource: "send" }),
+    }));
+
     await runLeg(report, "rename_propagation", "signed Profile rename propagates", async () => {
       await saveProfile(a, aPeople, RENAMED_A);
       await poll("B sees A's rename", 180_000, 4_000, async () => {
diff --git a/scripts/home-two-runtime-acceptance.test.mjs b/scripts/home-two-runtime-acceptance.test.mjs
index 04f13afdb..090949bc3 100644
--- a/scripts/home-two-runtime-acceptance.test.mjs
+++ b/scripts/home-two-runtime-acceptance.test.mjs
@@ -17,7 +17,9 @@ import {
   assertDistinctRuntimeEvidence,
   assertExactDirectConversation,
   assertFreshFixturePrecondition,
+  assertFreshOwnerEnrollmentPrecondition,
   assertIdentityFrame,
+  assertRecoveryBundleEvidence,
   assertRecoverySetupEvidence,
   assertRestartTransition,
   createAcceptanceReport,
@@ -158,6 +160,13 @@ test("a loopback Home without launcher-owned fixture manifests is rejected", (t)
   assert.throws(() => loadAcceptanceConfig(nonFixture), /ELASTOS_A_FIXTURE_MANIFEST is required/);
 });
 
+test("signup proof refuses a stored credential on either fixture before enrollment", () => {
+  assert.doesNotThrow(() => assertFreshOwnerEnrollmentPrecondition(0, 0));
+  for (const counts of [[1, 0], [0, 1], [1, 1], [undefined, 0], [0, "0"]]) {
+    assert.throws(() => assertFreshOwnerEnrollmentPrecondition(...counts), /reset the issue-owned fixture Homes and browser profiles/);
+  }
+});
+
 test("System evidence must prove two distinct manifest-bound Runtime instances", (t) => {
   const fixture = fixtureConfig(t);
   const config = loadAcceptanceConfig(fixture.env);
@@ -178,15 +187,27 @@ test("System evidence must prove two distinct manifest-bound Runtime instances",
   ), /two distinct fixture Runtimes/);
 });
 
-test("opaque accepted-contact projections must prove distinct Profile identities", () => {
-  assert.doesNotThrow(() => assertDistinctProfileContactEvidence(
-    "contact:opaque-a",
-    "contact:opaque-b",
-  ));
+test("opaque accepted-contact projections must bind distinct downloaded Recovery Profiles", () => {
+  const aProfileDid = "did:key:z6MkAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
+  const bProfileDid = "did:key:z6MkBBBBBBBBBBBBBBBBBBBBBBBBBBBB";
+  const aContactId = "contact:459124a94946ce899c021a75";
+  const bContactId = "contact:b0785e1e57b39d59f45161a8";
+  assert.deepEqual(assertDistinctProfileContactEvidence(aContactId, bContactId, aProfileDid, bProfileDid), {
+    recovery_profile_binding_checked: true,
+  });
   assert.throws(
     () => assertDistinctProfileContactEvidence("contact:shared", "contact:shared"),
     /distinct Profile identities/,
   );
+  for (const [aDid, bDid] of [
+    [undefined, bProfileDid],
+    [aProfileDid, ""],
+    [aProfileDid, "foreign"],
+    [bProfileDid, aProfileDid],
+    ["did:key:z6MkCCCCCCCCCCCCCCCCCCCCCCCCCCCC", bProfileDid],
+  ]) {
+    assert.throws(() => assertDistinctProfileContactEvidence(aContactId, bContactId, aDid, bDid), /bind both Recovery Profiles/);
+  }
   assert.throws(
     () => assertDistinctProfileContactEvidence("", "contact:opaque-b"),
     /distinct Profile identities/,
@@ -249,23 +270,31 @@ test("pre-existing contact state fails the fresh-fixture precondition", () => {
   );
 });
 
-test("Recovery setup evidence requires one verified fixture-owned download per side", (t) => {
+test("Welcome Recovery evidence requires the signup Profile and one fixture-owned download per side", (t) => {
   const fixture = fixtureConfig(t);
   const config = loadAcceptanceConfig(fixture.env);
   const valid = {
     a: {
       download_count: 1,
       download_path: join(fixture.a.data_root, "recovery", "fixture-a.json"),
-      before_status: "setup_required",
-      blocked_status: "recovery_required",
-      after_status: "setup_required",
+      profile_status: "ready",
+      profile_name: `${config.a.name} Admin`,
+      before_recovery_status: "setup_required",
+      after_recovery_status: "ready",
+      principal_binding_checked: true,
+      profile_included: true,
+      archive_available: true,
     },
     b: {
       download_count: 1,
       download_path: join(fixture.b.data_root, "recovery", "fixture-b.json"),
-      before_status: "setup_required",
-      blocked_status: "recovery_required",
-      after_status: "setup_required",
+      profile_status: "ready",
+      profile_name: `${config.b.name} Admin`,
+      before_recovery_status: "setup_required",
+      after_recovery_status: "ready",
+      principal_binding_checked: true,
+      profile_included: true,
+      archive_available: true,
     },
   };
   assert.deepEqual(assertRecoverySetupEvidence(config, valid), valid);
@@ -273,34 +302,102 @@ test("Recovery setup evidence requires one verified fixture-owned download per s
     () => assertRecoverySetupEvidence(config, { a: valid.a }),
     /unsupported shape/,
   );
-  assert.throws(
-    () => assertRecoverySetupEvidence(config, {
-      ...valid,
-      a: { ...valid.a, download_count: 2 },
-    }),
-    /single verified fixture-owned Recovery setup/,
-  );
-  assert.throws(
-    () => assertRecoverySetupEvidence(config, {
-      ...valid,
-      a: { ...valid.a, blocked_status: "setup_required" },
-    }),
-    /single verified fixture-owned Recovery setup/,
-  );
-  assert.throws(
-    () => assertRecoverySetupEvidence(config, {
-      ...valid,
-      b: { ...valid.b, after_status: "unavailable" },
-    }),
-    /single verified fixture-owned Recovery setup/,
-  );
-  assert.throws(
-    () => assertRecoverySetupEvidence(config, {
-      ...valid,
-      a: { ...valid.a, download_path: join(fixture.b.data_root, "recovery", "substituted.json") },
-    }),
-    /single verified fixture-owned Recovery setup/,
-  );
+  for (const invalid of [
+    { download_count: 0 },
+    { download_count: 2 },
+    { profile_status: "unavailable" },
+    { profile_name: "Other Profile" },
+    { before_recovery_status: "ready" },
+    { after_recovery_status: "unavailable" },
+    { principal_binding_checked: false },
+    { profile_included: false },
+    { archive_available: false },
+    { download_path: join(fixture.b.data_root, "recovery", "substituted.json") },
+    { download_path: join(fixture.root, "outside.json") },
+  ]) {
+    assert.throws(
+      () => assertRecoverySetupEvidence(config, { ...valid, a: { ...valid.a, ...invalid } }),
+      /single verified fixture-owned Recovery setup/,
+    );
+  }
+});
+
+test("Recovery download must bind its data kit and signed signup Profile to the current principal", () => {
+  const expected = {
+    principalId: "principal:signup-a",
+    localhostRoot: "localhost://Users/signup-a",
+    profileName: "Alma Admin",
+  };
+  const aProfileDid = "did:key:z6MkAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
+  const bundle = {
+    schema: "elastos.full-recovery-bundle/v1",
+    principal_id: expected.principalId,
+    localhost_root: expected.localhostRoot,
+    included: { data_kit: true, people_identity: true },
+    data_kit: {
+      schema: "elastos.recovery-kit/v1",
+      principal_id: expected.principalId,
+      localhost_root: expected.localhostRoot,
+    },
+    people_identity: {
+      schema: "elastos.people.recovery-identity/v1",
+      profile_authority_bundle: {
+        schema: "elastos.profile-authority-bundle/v1",
+        profile_signing_seed_hex: "11".repeat(32),
+        signed_profile: {
+          payload: {
+            schema: "elastos.profile-document/v1",
+            profile_did: aProfileDid,
+            display_name: expected.profileName,
+          },
+          signer_did: aProfileDid,
+          signature: "22".repeat(64),
+        },
+      },
+    },
+  };
+  assert.deepEqual(assertRecoveryBundleEvidence(bundle, expected), {
+    principal_binding_checked: true,
+    profile_included: true,
+  });
+  for (const change of [
+    (value) => { value.schema = "elastos.full-recovery-bundle.package/v1"; },
+    (value) => { value.principal_id = "principal:foreign"; },
+    (value) => { value.localhost_root = "localhost://Users/foreign"; },
+    (value) => { value.included.data_kit = false; },
+    (value) => { value.data_kit.principal_id = "principal:foreign"; },
+    (value) => { value.data_kit.localhost_root = "localhost://Users/foreign"; },
+    (value) => { value.data_kit.schema = "foreign"; },
+  ]) {
+    const invalid = structuredClone(bundle);
+    change(invalid);
+    assert.throws(() => assertRecoveryBundleEvidence(invalid, expected), /current principal's bound data kit/);
+  }
+  for (const change of [
+    (value) => { delete value.people_identity; },
+    (value) => { value.included.people_identity = false; },
+    (value) => { value.people_identity.profile_authority_bundle.profile_signing_seed_hex = ""; },
+    (value) => { value.people_identity.profile_authority_bundle.signed_profile.payload.display_name = "Foreign Profile"; },
+    (value) => { value.people_identity.profile_authority_bundle.signed_profile.signer_did = "did:key:z6MkBBBBBBBBBBBBBBBBBBBBBBBBBBBB"; },
+    (value) => { value.people_identity.profile_authority_bundle.signed_profile.signature = ""; },
+  ]) {
+    const invalid = structuredClone(bundle);
+    change(invalid);
+    assert.throws(() => assertRecoveryBundleEvidence(invalid, expected), /signed Profile created by signup/);
+  }
+  const sameNameForeignProfile = structuredClone(bundle);
+  const foreignSigned = sameNameForeignProfile.people_identity.profile_authority_bundle.signed_profile;
+  foreignSigned.payload.profile_did = "did:key:z6MkCCCCCCCCCCCCCCCCCCCCCCCCCCCC";
+  foreignSigned.signer_did = foreignSigned.payload.profile_did;
+  // A name match alone is insufficient; final acceptance binds the download to
+  // the two Runtime-accepted opaque contact projections.
+  assert.doesNotThrow(() => assertRecoveryBundleEvidence(sameNameForeignProfile, expected));
+  assert.throws(() => assertDistinctProfileContactEvidence(
+    "contact:459124a94946ce899c021a75",
+    "contact:b0785e1e57b39d59f45161a8",
+    foreignSigned.payload.profile_did,
+    "did:key:z6MkBBBBBBBBBBBBBBBBBBBBBBBBBBBB",
+  ), /bind both Recovery Profiles/);
 });
 
 test("only the exact opaque direct conversation can satisfy selection", () => {
@@ -348,12 +445,24 @@ test("identity evidence rejects empty, wrong, and raw-identity frames", () => {
 });
 
 test("skipped legs and incomplete reports can never become acceptance evidence", () => {
-  const report = validReport();
-  for (const leg of REQUIRED_ACCEPTANCE_LEGS) {
-    report.results.push({ leg, status: leg === "both_runtime_restart" ? "skipped" : "passed" });
+  assert.equal(REQUIRED_ACCEPTANCE_LEGS.length, 28);
+  assert.deepEqual(REQUIRED_ACCEPTANCE_LEGS.slice(0, 2), ["provisioning_and_sign_in", "system_recovery_after_signup"]);
+  assert.ok(REQUIRED_ACCEPTANCE_LEGS.includes("shared_session_recovery"));
+  assert.ok(REQUIRED_ACCEPTANCE_LEGS.includes("direct_session_recovery"));
+  // Exercise every mandatory leg, including launch, drafts, and both recovery modes.
+  // A harness that omits or skips any one of them must retain ok=false.
+  for (const skipped of REQUIRED_ACCEPTANCE_LEGS) {
+    const report = validReport();
+    for (const leg of REQUIRED_ACCEPTANCE_LEGS) {
+      report.results.push({ leg, status: leg === skipped ? "skipped" : "passed" });
+    }
+    assert.throws(() => finalizeAcceptanceReport(report), new RegExp(`nonpassing=${skipped}`));
+    assert.equal(report.ok, false);
+
+    report.results = report.results.filter((result) => result.leg !== skipped);
+    assert.throws(() => finalizeAcceptanceReport(report), new RegExp(`missing=${skipped}`));
+    assert.equal(report.ok, false);
   }
-  assert.throws(() => finalizeAcceptanceReport(report), /nonpassing=both_runtime_restart/);
-  assert.equal(report.ok, false);
 
   const incomplete = validReport();
   recordAcceptancePass(incomplete, REQUIRED_ACCEPTANCE_LEGS[0]);
diff --git a/scripts/install.sh b/scripts/install.sh
index 99e53431e..a27bfff92 100755
--- a/scripts/install.sh
+++ b/scripts/install.sh
@@ -133,6 +133,7 @@ show_help() {
     echo "  --publisher-node-id ID   Publisher P2P node ID (for durable Carrier link)"
     echo "  --install-dir PATH    Binary install directory (default: ~/.local/bin)"
     echo "  --install-only        Install Runtime without setup or opening Home"
+    echo "  --isolated            Keep this Home out of the shared Community room"
     echo "  --help                Show this help"
     echo ""
     echo -e "${BOLD}What gets installed:${NC}"
@@ -896,7 +897,11 @@ finish_install() {
     fi
     step 5 "Set up Home"
     info "Setting up Home..."
-    "$runtime_bin" setup </dev/null || return $?
+    if [[ "${ISOLATED:-false}" == true ]]; then
+        "$runtime_bin" setup --isolated </dev/null || return $?
+    else
+        "$runtime_bin" setup </dev/null || return $?
+    fi
     show_ready "$runtime_bin"
     if ( : </dev/tty ) 2>/dev/null && [[ -t 1 ]]; then
         info "Opening Home..."
@@ -915,6 +920,7 @@ if [[ "${BASH_SOURCE[0]:-$0}" != "$0" ]]; then
     return 0
 fi
 
+ISOLATED=false
 INSTALL_DIR="${HOME}/.local/bin"
 INSTALL_ONLY="${ELASTOS_INSTALL_ONLY:-false}"
 INSTALL_STARTED_AT=$SECONDS
@@ -941,6 +947,7 @@ while [[ $# -gt 0 ]]; do
             [[ -z "${2:-}" ]] && die "Usage: --publisher-node-id <node-id>"
             PUBLISHER_NODE_ID="$2"; PUBLISHER_NODE_ID_EXPLICIT=true; shift 2 ;;
         --install-only) INSTALL_ONLY=true; shift ;;
+        --isolated) ISOLATED=true; shift ;;
         --install-dir)
             [[ -z "${2:-}" ]] && die "Usage: --install-dir PATH"
             INSTALL_DIR="$2"; shift 2 ;;
diff --git a/scripts/prepare-release-platform.sh b/scripts/prepare-release-platform.sh
index 77dbdad70..73b268ba7 100755
--- a/scripts/prepare-release-platform.sh
+++ b/scripts/prepare-release-platform.sh
@@ -246,6 +246,9 @@ cp scripts/release-upstream-recipes.json "$STAGING/upstream-recipes.json"
 if [[ -f "$SOURCE_ROOT/model-catalog.json" ]]; then
     cp "$SOURCE_ROOT/model-catalog.json" "$STAGING/artifacts/model-catalog.json"
 fi
+if [[ -f "$SOURCE_ROOT/collaboration-network-release-v1.json" ]]; then
+    cp "$SOURCE_ROOT/collaboration-network-release-v1.json" "$STAGING/artifacts/collaboration-network-release-v1.json"
+fi
 fi
 python3 scripts/release-platform-input.py record \
     --root "$STAGING" --version "$VERSION" --platform "$PLATFORM" --target "$TARGET" \
diff --git a/scripts/publish-release.sh b/scripts/publish-release.sh
index 78a28e810..470b452bb 100755
--- a/scripts/publish-release.sh
+++ b/scripts/publish-release.sh
@@ -898,6 +898,9 @@ stage_release_artifacts() {
     if [[ -f model-catalog.json ]]; then
         cp -f model-catalog.json "${artifact_dir}/model-catalog.json"
     fi
+    if [[ -f collaboration-network-release-v1.json ]]; then
+        cp -f collaboration-network-release-v1.json "${artifact_dir}/collaboration-network-release-v1.json"
+    fi
     if [[ -n "${CROSS_PLATFORM:-}" ]]; then
         CROSS_SRC="${TMPDIR}/artifacts-${CROSS_ARCH}"
         [ -d "$CROSS_SRC" ] || CROSS_SRC="artifacts-${CROSS_ARCH}"
@@ -1037,10 +1040,11 @@ merge_direct_assets() {
 generate_components_json() {
     local capsule_entries="$1"
     local direct_assets="$2"
-    local external profiles catalog
+    local external profiles catalog network
     external=$(jq '.external' components.json)
     profiles=$(jq '.profiles' components.json)
     catalog=$(jq -c '.model_catalog // null' components.json)
+    network=$(jq -c '.collaboration_network // null' components.json)
     jq -n \
         --arg schema "elastos.components/v1" \
         --argjson capsules "$capsule_entries" \
@@ -1048,7 +1052,8 @@ generate_components_json() {
         --argjson profiles "$profiles" \
         --argjson direct "$direct_assets" \
         --argjson catalog "$catalog" \
-        '{schema: $schema, capsules: $capsules, external: ($external * $direct.external), profiles: $profiles} + (if $catalog == null then {} else {model_catalog: $catalog} end)'
+        --argjson network "$network" \
+        '{schema: $schema, capsules: $capsules, external: ($external * $direct.external), profiles: $profiles} + (if $catalog == null then {} else {model_catalog: $catalog} end) + (if $network == null then {} else {collaboration_network: $network} end)'
 }
 
 runtime_tunnel_url() {
@@ -1310,6 +1315,28 @@ try:
             raise ValueError(f"model-catalog.json head {actual} does not match pin {head}")
         referenced.add("model-catalog.json")
         extra = sorted(set(present) - referenced)
+    network_pin = None
+    for name in present:
+        if name.startswith("components-") and name.endswith(".json"):
+            candidate = json.loads(present[name].read_bytes()).get("collaboration_network")
+            if network_pin is None:
+                network_pin = candidate
+            elif network_pin != candidate:
+                raise ValueError("prepared components disagree on collaboration_network")
+    if isinstance(network_pin, dict):
+        head = network_pin.get("head_cid")
+        if not isinstance(head, str) or not head:
+            raise ValueError("collaboration_network.head_cid is required")
+        network_file = "collaboration-network-release-v1.json"
+        if network_file not in present:
+            raise ValueError(f"advertised Community network pin is missing {network_file}")
+        data = present[network_file].read_bytes()
+        digest = hashlib.sha256(data).digest()
+        actual = "b" + __import__("base64").b32encode(b"\x01\x55\x12\x20" + digest).decode("ascii").lower().rstrip("=")
+        if actual != head:
+            raise ValueError(f"{network_file} head {actual} does not match pin {head}")
+        referenced.add(network_file)
+        extra = sorted(set(present) - referenced)
     if extra:
         raise ValueError(f"prepared artifacts are not advertised by this release: {extra}")
 except (OSError, ValueError, TypeError, AttributeError) as exc:
diff --git a/scripts/recovery-profile-setup-smoke.mjs b/scripts/recovery-profile-setup-smoke.mjs
index 68b1e1805..b9d088f58 100644
--- a/scripts/recovery-profile-setup-smoke.mjs
+++ b/scripts/recovery-profile-setup-smoke.mjs
@@ -134,6 +134,14 @@ const summary = { authority: { signed_in: true }, identity: {
   recovery_readiness: { schema: "elastos.recovery.readiness/v1", status: "setup_required" },
 } };
 assert.equal(home.homeSetupNeedsAct(summary), true, "existing Profile still needs an exported kit covering it");
+vm.runInContext(functionSource(setup, "homeRecoveryKitOutdated"), home);
+assert.equal(home.homeRecoveryKitOutdated(summary), false, "a kit without a stated reason reads as a first kit");
+summary.identity.recovery_readiness.reason = "recovery_kit_missing";
+assert.equal(home.homeRecoveryKitOutdated(summary), false, "a new account is greeted with a first-kit message");
+summary.identity.recovery_readiness.reason = "recovery_kit_outdated";
+assert.equal(home.homeRecoveryKitOutdated(summary), true, "a kit that predates the Profile reads as outdated");
+delete summary.identity.recovery_readiness.reason;
+assert(setup.includes("Save a Recovery Kit so you can get back into your account."), "new accounts get first-kit copy");
 let shown = 0;
 Object.assign(home, { SETUP_HOLD_TARGETS: new Set(["chat-room"]), shellState: { currentSummary: summary }, showSetupSheet: () => { shown += 1; } });
 vm.runInContext(functionSource(setup, "holdHomeSetupAct"), home);
diff --git a/scripts/release-platform-input-test.py b/scripts/release-platform-input-test.py
index ef72fdd0d..1bf0b320a 100644
--- a/scripts/release-platform-input-test.py
+++ b/scripts/release-platform-input-test.py
@@ -485,6 +485,61 @@ def pin_catalogue(self):
             self.refresh(root)
         return pin
 
+    def pin_network(self, network=b'{"expected_network_id":"fixture-network"}\n'):
+        """Pin a Community network release copy in the template and every bundle, as the candidate source does."""
+        pin = {"head_cid": inputs.catalog_head_cid(network), "expected_network_id": "fixture-network",
+               "trusted_profile_signer_dids": ["did:key:z6Mkfixture"]}
+        self.template["collaboration_network"] = pin
+        self.write_json(inputs.SOURCE_ROOT / "components.json", self.template)
+        for root in self.bundles.values():
+            manifest = json.loads((root / "components.json").read_text())
+            manifest["collaboration_network"] = pin
+            self.write_json(root / "components.json", manifest)
+            self.write_json(root / "components-template.json", self.template)
+            (root / "artifacts" / inputs.RELEASE_NETWORK_FILE).write_bytes(network)
+            self.refresh(root)
+        return pin, network
+
+    def test_pinned_community_network_is_staged_and_bound_on_every_platform(self):
+        pin, network = self.pin_network()
+        stage = self.root / "publication"
+        record = inputs.stage_inputs(self.values(), "0.7.1", stage)
+        self.assertIn(inputs.RELEASE_NETWORK_FILE, record["files"])
+        self.assertEqual((stage / "artifacts" / inputs.RELEASE_NETWORK_FILE).read_bytes(), network)
+        self.assertEqual(json.loads((stage / "components.json").read_text())["collaboration_network"], pin)
+        cids = self.root / "cids.json"
+        self.write_json(cids, {name: "bafy" + entry["sha256"] for name, entry in record["files"].items()})
+        inputs.attach_input_cids(stage, cids)
+        for platform in inputs.PLATFORMS:
+            final = json.loads((stage / "artifacts" / f"components-{platform}.json").read_text())
+            self.assertEqual(final["collaboration_network"], pin)
+
+    def test_community_network_file_must_match_its_source_pin(self):
+        self.pin_network()
+        root = self.bundles["aarch64-darwin"]
+        network = root / "artifacts" / inputs.RELEASE_NETWORK_FILE
+        network.write_bytes(b'{"expected_network_id":"other-network"}\n')
+        self.refresh(root)
+        with self.assertRaisesRegex(ValueError, "does not match pin"):
+            inputs.verify(root)
+        network.unlink()
+        self.refresh(root)
+        with self.assertRaises(FileNotFoundError):
+            inputs.verify(root)
+        manifest = json.loads((root / "components.json").read_text())
+        manifest["collaboration_network"]["expected_network_id"] = "drifted-network"
+        self.write_json(root / "components.json", manifest)
+        self.refresh(root)
+        with self.assertRaisesRegex(ValueError, "differs from source template"):
+            inputs.verify(root)
+
+    def test_community_network_file_without_a_pin_is_refused(self):
+        root = self.bundles["x86_64-linux"]
+        (root / "artifacts" / inputs.RELEASE_NETWORK_FILE).write_bytes(b'{"expected_network_id":"unpinned"}\n')
+        self.refresh(root)
+        with self.assertRaisesRegex(ValueError, "artifact inventory mismatch"):
+            inputs.verify(root)
+
     def test_default_admission_rejects_a_single_platform_input(self):
         darwin = [f"aarch64-darwin={self.bundles['aarch64-darwin']}"]
         stage = self.root / "publication"
diff --git a/scripts/release-platform-input.py b/scripts/release-platform-input.py
index 00234b097..709089796 100644
--- a/scripts/release-platform-input.py
+++ b/scripts/release-platform-input.py
@@ -25,6 +25,9 @@
 SCRIPT_ROOT = Path(__file__).resolve().parent
 SOURCE_ROOT = SCRIPT_ROOT.parent
 SCHEMA = "elastos.release-platform-input/v1"
+RELEASE_NETWORK_FILE = "collaboration-network-release-v1.json"
+# Publication imports a pinned raw block up to this size.
+MAX_RELEASE_NETWORK_BYTES = 2 * 1024 * 1024
 PLATFORMS = {
     "x86_64-linux": ("linux-amd64", "x86_64-unknown-linux-musl", 62),
     "aarch64-linux": ("linux-arm64", "aarch64-unknown-linux-musl", 183),
@@ -82,6 +85,25 @@ def admit_model_catalog_artifact(manifest, artifact_root, referenced):
     referenced.add("model-catalog.json")
 
 
+def admit_collaboration_network_artifact(manifest, template, artifact_root, referenced):
+    """Admit the release copy of the source-pinned Community network."""
+    pin = manifest.get("collaboration_network")
+    if pin != template.get("collaboration_network"):
+        raise ValueError("prepared collaboration_network pin differs from source template")
+    if pin is None:
+        return
+    if not isinstance(pin, dict) or not isinstance(pin.get("head_cid"), str) or not pin["head_cid"]:
+        raise ValueError("collaboration_network.head_cid is required")
+    with regular_file(artifact_root, RELEASE_NETWORK_FILE).open("rb") as network:
+        data = network.read(MAX_RELEASE_NETWORK_BYTES + 1)
+    if len(data) > MAX_RELEASE_NETWORK_BYTES:
+        raise ValueError("Community network artifact exceeds its publication bound")
+    actual = catalog_head_cid(data)
+    if actual != pin["head_cid"]:
+        raise ValueError(f"{RELEASE_NETWORK_FILE} head {actual} does not match pin {pin['head_cid']}")
+    referenced.add(RELEASE_NETWORK_FILE)
+
+
 def file_record(path):
     return {"sha256": digest(path), "size": path.stat().st_size,
             "executable": bool(path.stat().st_mode & 0o111)}
@@ -498,6 +520,7 @@ def check_contents(root, platform, omissions):
     actual = {str(path.relative_to(root / "artifacts"))
               for path in (root / "artifacts").rglob("*") if not path.is_dir() or path.is_symlink()}
     admit_model_catalog_artifact(manifest, root / "artifacts", referenced)
+    admit_collaboration_network_artifact(manifest, template, root / "artifacts", referenced)
     if actual != referenced:
         raise ValueError(f"artifact inventory mismatch: {sorted(actual ^ referenced)}")
     return manifest, template
@@ -909,9 +932,9 @@ def merged_input_components(values, receipts):
         if actual != expected:
             raise ValueError(f"input manifest changed after admission: {platform}")
         manifest = json.loads(manifest_bytes)
-        contract = {"model_catalog": manifest.get("model_catalog")}
+        contract = {name: manifest.get(name) for name in ("model_catalog", "collaboration_network")}
         if model_contract is not None and contract != model_contract:
-            raise ValueError("platform model catalogue pins differ")
+            raise ValueError("platform model catalogue or Community network pins differ")
         model_contract = contract
         for name, value in contract.items():
             if value is None:
diff --git a/scripts/release-signer-test.py b/scripts/release-signer-test.py
index da9d04597..3eca54e9b 100644
--- a/scripts/release-signer-test.py
+++ b/scripts/release-signer-test.py
@@ -701,6 +701,35 @@ def test_external_checksum_release_path_size_and_model_pin_tamper_are_refused(se
         with self.assertRaisesRegex(ValueError, "catalog head differs"):
             self.prepare()
 
+    def test_pinned_community_network_is_bound_like_the_catalog(self):
+        name = "collaboration-network-release-v1.json"
+        network = S.json_bytes({"expected_network_id": "fixture-network"})
+        def clear_snapshot():
+            for path in self.snapshot.iterdir():
+                path.unlink()
+        def pin(components, data):
+            components = copy.deepcopy(components)
+            components["collaboration_network"] = {"head_cid": S.raw_cid(data), "expected_network_id": "fixture-network",
+                                                   "trusted_profile_signer_dids": [DID]}
+            return components
+        original = self.current_shape()
+        (self.root / name).write_bytes(network)
+        self.manifest["files"][name] = {"sha256": S.sha256(network), "size": len(network), "cid": S.raw_cid(network)}
+        self.reapprove_components(pin(original, network))
+        self.assertEqual(len(self.prepare().files), 7)
+        self.assertFalse(self.marker.exists())
+        for components, message in ((pin(original, b"other network"), "Community network head differs"),
+                                    (original, "unbound artifact")):
+            clear_snapshot()
+            self.reapprove_components(components)
+            with self.subTest(message=message), self.assertRaisesRegex(ValueError, message):
+                self.prepare()
+        clear_snapshot()
+        del self.manifest["files"][name]
+        self.reapprove_components(pin(original, network))
+        with self.assertRaisesRegex(ValueError, "Community network snapshot required"):
+            self.prepare()
+
     def reapprove_components(self, components):
         data = S.json_bytes(components)
         (self.root / "components.json").write_bytes(data)
diff --git a/scripts/release-signer.py b/scripts/release-signer.py
index b9963a1c3..925fed213 100644
--- a/scripts/release-signer.py
+++ b/scripts/release-signer.py
@@ -51,6 +51,9 @@
 MAX_JSON = 2 * 1024 * 1024
 MAX_FILE = 512 * 1024 * 1024
 CHANNELS = {"stable", "canary", "jetson-test"}
+# Manifest pins that name one release file by the raw CID of its exact bytes.
+PINNED_RELEASE_FILES = (("model_catalog", "model-catalog.json", "model catalog"),
+                        ("collaboration_network", "collaboration-network-release-v1.json", "Community network"))
 STAMPS = {"MAINTAINER_DID", "SOURCE_CONNECT_TICKET", "PUBLISHER_GATEWAY", "PUBLISHER_NODE_ID", "IPNS_NAME"}
 
 
@@ -552,14 +555,16 @@ def component_refs(value):
                     for child in value:
                         component_refs(child)
             component_refs(component)
-            catalog = component.get("model_catalog")
-            if catalog is not None:
-                require(type(catalog) is dict and type(catalog.get("head_cid")) is str, "model catalog pin refused")
-                record = records.get("model-catalog.json")
-                require(type(record) is dict, "model catalog snapshot required")
-                catalog_bytes = regular_bytes(snapshot_root / "model-catalog.json", MAX_JSON)
-                require(catalog["head_cid"] == raw_cid(catalog_bytes), "model catalog head differs from snapshot")
-                admit_ref(record["cid"], record["sha256"], record["size"], "model-catalog.json")
+            for field, name, subject in PINNED_RELEASE_FILES:
+                pin = component.get(field)
+                if pin is None:
+                    continue
+                require(type(pin) is dict and type(pin.get("head_cid")) is str, f"{subject} pin refused")
+                record = records.get(name)
+                require(type(record) is dict, f"{subject} snapshot required")
+                require(pin["head_cid"] == raw_cid(regular_bytes(snapshot_root / name, MAX_JSON)),
+                        f"{subject} head differs from snapshot")
+                admit_ref(record["cid"], record["sha256"], record["size"], name)
     require(advertised == approved_refs, "unbound artifact in approved snapshot")
     head = manifest["head"]
     require(type(head) is dict and set(head) == {"updated_at", "prev_head_cid"}